diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8249dcf0c..388b44f03 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -48,13 +48,21 @@ jobs:
           echo "CRAFT_FONTS_DIR=$GITHUB_WORKSPACE/craft-fonts" >> "$GITHUB_ENV"
           echo "CRAFT_FONTS_REQUIRED=1" >> "$GITHUB_ENV"
 
-      - name: Install Linux system dependencies (egui/winit/rfd)
+      - name: Install Linux system dependencies (egui/winit/rfd) and the oracles
         if: runner.os == 'Linux'
         run: |
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends \
             libxkbcommon-dev libwayland-dev libx11-dev libxrandr-dev libxi-dev \
-            libgl1-mesa-dev libgtk-3-dev
+            libgl1-mesa-dev libgtk-3-dev \
+            qpdf poppler-utils
+
+      # The independent oracles (crates/oracle) are only worth having when they run. With this
+      # set, a missing one fails the job instead of printing a skip notice that reads as a pass.
+      # Only the tools the job actually uses are installed above.
+      - name: Require the oracles (Linux)
+        if: runner.os == 'Linux'
+        run: echo "PDFCRAFT_ORACLES_REQUIRED=1" >> "$GITHUB_ENV"
 
       - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
         with:
diff --git a/ATTRIBUTION.md b/ATTRIBUTION.md
index 3b451f246..903d13284 100644
--- a/ATTRIBUTION.md
+++ b/ATTRIBUTION.md
@@ -4,7 +4,7 @@
 
 Every asset PdfCraft includes, bundles or uses to build its published material, with its author, source and licence. The policy is in [AGENTS.md](AGENTS.md) §1. The machine-readable list, with SHA-256 hashes, is [ATTRIBUTION.toml](ATTRIBUTION.toml). Licence texts are kept beside the assets and summarised in [NOTICE](NOTICE).
 
-## In this repository (270)
+## In this repository (272)
 
 | Asset | Title | Author | Licence | Source | Used for |
 |---|---|---|---|---|---|
@@ -27,7 +27,8 @@ Every asset PdfCraft includes, bundles or uses to build its published material,
 | `crates/ui-egui/src/i18n/uk.tsv` | Ukrainian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | Ukrainian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
 | `crates/ui-egui/src/i18n/ar.tsv` | Arabic interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | Arabic UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
 | `crates/ui-egui/src/i18n/tr.tsv` | Turkish interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | Turkish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
-| `crates/ui-egui/src/i18n/lt.tsv` | Lithuanian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels and user-facing messages; reviewed by a native Lithuanian-speaking contributor | Lithuanian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
+| `crates/ui-egui/src/i18n/lt.tsv` | Lithuanian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels and user-facing messages; original catalog reviewed by a native Lithuanian-speaking contributor; 2026-10-15 coverage additions are AI-assisted and not separately native-reviewed | Lithuanian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
+| `crates/ui-egui/src/i18n/vi.tsv` | Vietnamese interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels; PhotoCraft and VectorCraft Vietnamese catalogs used only as translation memory when English source and semantic context matched; original catalog reviewed by a native Vietnamese-speaking contributor; 2026-10-15 coverage additions are AI-assisted and not separately native-reviewed | Vietnamese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
 | `assets/icons/accessibility.svg` | Lucide icon "accessibility" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/accessibility.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
 | `assets/icons/align-left.svg` | Lucide icon "align-left" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-left.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
 | `assets/icons/align-center.svg` | Lucide icon "align-center" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-center.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
@@ -278,6 +279,7 @@ Every asset PdfCraft includes, bundles or uses to build its published material,
 | `crates/sign/tests/data/x509-rsa-sha1.pdf` | One-page PDF with a legacy adbe.x509.rsa_sha1 signature by the RSA test key | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: hand-written PDF objects; signature made with `openssl dgst -sha1 -sign` over its byte ranges (see crates/sign/tests/data/README.md) | Signature validation tests (crates/sign/tests/pdf.rs): the legacy adbe.x509.rsa_sha1 format |
 | `assets/icons/monitor.svg` | Lucide icon "monitor" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/monitor.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
 | `crates/ui-egui/src/i18n/sl.tsv` | Slovene interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | Slovene UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
+| `vendor/vello_common/assets/probe.png` | vello_common probe reference image (rendered from probe.rgba) | Linebender vello contributors | MIT OR Apache-2.0 | vello_common 0.0.8 (crates.io), vendored in vendor/vello_common; regenerated by its vello_sparse_tests regenerate_probe_reference binary | Reference picture of the vendored vello_common probe module, for people only; the build reads probe.rgba, not this file |
 
 ## Compiled in through dependencies (6)
 
diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index 07433fc45..34f17b513 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -7,7 +7,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Greek UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "389982dcbb7f1ac29fb150c9af43f9529db6e59a091b9971f0401684847d8b53"
+sha256 = "cefa955aa92790d6773cb1d1e15e19019b3165a00528d57d6617362e1d1988ab"
 
 # ATTRIBUTION.toml: one entry per asset (AGENTS.md §1). The source of truth for provenance and licences.
 # ATTRIBUTION.md is generated from this file: `cargo xtask assets --write`. Checked by `cargo xtask assets` (part of `xtask ci`).
@@ -30,7 +30,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Simplified Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "d8ea23644d81476e3fd35c09780ab9b3ac8c9e28bed4e14e1cbc6493bb896d91"
+sha256 = "1de29a6cc089be31cb6206bf41e0715f8ddcf74ef887b45ccee235d743bed223"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/zh-hant.tsv"
@@ -41,7 +41,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Traditional Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "26dd0b0d697fd40db996fc102f3c7f2320bdeb6d6af38dbdde353bd5d940baad"
+sha256 = "0b0dafa3806a6b3508684f64e1f07b435113f8efd0e59201d12250c63c1d9547"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/cs.tsv"
@@ -52,7 +52,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Czech UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "322b8cda21a2b8d157716182846619bd92bfb31263d1f8d13da7eaad365fbfd7"
+sha256 = "8a8aed18bd8fceabd1389580361ba75b0dccf141d845650a353d8dfe19c95536"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/pt-br.tsv"
@@ -63,7 +63,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Brazilian Portuguese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "21bf9c73b482eb987ddaf839b4a4aa8f9938d5aa10428e6d39beea254a95a0c0"
+sha256 = "1c197ac045810950aceb733152a296f2224f38857b1169032fdc7092ab4aa3f7"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/es.tsv"
@@ -74,7 +74,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Spanish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "fef35ae1771edf2e044e72aebb958bb4827ded57234207f96b6cb7a250fedb22"
+sha256 = "a9cf0e062b006b40f549ce2316b88d4b0196d70bd9cecd66c12d980d699bf679"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/fr.tsv"
@@ -85,7 +85,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "French UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "d723622298b10400e9a1ba697cbebd831f5e0f7e5bbe4545b97f61e64db7535f"
+sha256 = "ef5c84bd13ef8318f7deab7f42136cfe3c14cbef6fd5231014b94167baaecd2a"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/de.tsv"
@@ -96,7 +96,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "German UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "686ab9658b7ef9dd7f3af05ce73f99f1ab2a75f8357bad6f7e987d40a8730df9"
+sha256 = "be689af8bb22537879269ad9ab9bdcc4b730665cf0b27c6bf4bad560cacf3b69"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/te.tsv"
@@ -107,7 +107,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Telugu UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "90b94038699aa74aa48ffbda3e90a2255b65d0dbf081e8ecf20c5804940fc129"
+sha256 = "989d2e5f57cf22c21a85951835ca9fbd05e314da67eb4c17332df1f03679fa00"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/it.tsv"
@@ -118,7 +118,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Italian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "5aa6475df91a3e82010aee198c2e29bb80328505bbd0240f3828e36a5d6dfdf3"
+sha256 = "425c42acb8d98ac31b216b13c05a285e0676318dd379dcfb9d57cc7329e9d7a5"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/pl.tsv"
@@ -129,7 +129,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Polish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "e6d306d9bf289fac2fe8fcfa6f9d0a51b650728e45669289d391be2031076692"
+sha256 = "988bcf2e0322a46c0464ff7b91ab5d90193b0ea7f454812d12595eb843de6fc7"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ru.tsv"
@@ -140,7 +140,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Russian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "277f4995a87297a2fcc473df1feebdbdf3378fa460a7f85eb1a0a151cee40a2b"
+sha256 = "ebe7aa9152baff38ae7e36aeb4f6a7ed2198166ab93425a612a66d53e43cb363"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/hu.tsv"
@@ -151,7 +151,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Hungarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "01b32370cedce935b74925858a79ee691dc2a5560ba5eb758de2de1c243c528e"
+sha256 = "69d2da21949f02c3c40f71159e377eef2fdd1a87f749d6c504e1d151ef33f643"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/bg.tsv"
@@ -162,7 +162,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Bulgarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "f8ae97901c61dfdc0a844a23356173211bb052b3ff54128d7edc8097c535eee9"
+sha256 = "98359685aa555f391846f2259ac302ce1234c7a180fb4abe07c36e0c1c62211e"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/kk.tsv"
@@ -173,7 +173,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Kazakh UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "7107ba77577794395451dd85355a86ef3e033a7f240b72414b877b9b43adb19e"
+sha256 = "9f6296d9c79c848167fc80bb4cfaacc9e60f72edb70cc1d70f7b6088ada83578"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ja.tsv"
@@ -184,7 +184,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Japanese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "114b3d50531eb1682535c7a646e62914b0c9afaa5d5d1b9f66b94fd472e4e7b3"
+sha256 = "3528e85afd4117de2c22b9f37d32a380a073a49834fa5a3063d21b803606ffbf"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/uk.tsv"
@@ -195,7 +195,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Ukrainian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "f56ec5f4cb7d1992041df0783f1cfd76c27d5d180c3f73c60b104e3fd02f600d"
+sha256 = "4db7e23074d44305f4584e2cd8b9a0fc35b433cb187dad493c8f7d78a8cd4ad2"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ar.tsv"
@@ -206,7 +206,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Arabic UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "113fdf57e28fcff90d212fb468011bedebfb98ac100218d29b584f4de4c87912"
+sha256 = "2af01de9509db4b4ae61193f41ff0f7f3b70ca5f91cd2afda667e90d34980b25"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/tr.tsv"
@@ -217,18 +217,30 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Turkish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "2b5edfe026578ed475f07f94f1d1ed4a3dac93a745c19209589936e2d67f6ec5"
+sha256 = "de988b6959572931c4878a0588109c236bf8c5d46ef57c7a406b6ab42de51339"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/lt.tsv"
 title = "Lithuanian interface translation catalog"
 author = "PdfCraft contributors"
-source = "Contributor-original: clean-room translations of PdfCraft's English UI labels and user-facing messages; reviewed by a native Lithuanian-speaking contributor"
+source = "Contributor-original: clean-room translations of PdfCraft's English UI labels and user-facing messages; original catalog reviewed by a native Lithuanian-speaking contributor; 2026-10-15 coverage additions are AI-assisted and not separately native-reviewed"
 licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Lithuanian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "fe58835b0538f470b463f078e1b4cdf78a8e2632056bc61c6946071478f39a64"
+sha256 = "62151d79be5089d964876b6569d490ee3fdacef4388684b574be9627b1354e92"
+
+
+[[asset]]
+path = "crates/ui-egui/src/i18n/vi.tsv"
+title = "Vietnamese interface translation catalog"
+author = "PdfCraft contributors"
+source = "Contributor-original: clean-room translations of PdfCraft's English UI labels; PhotoCraft and VectorCraft Vietnamese catalogs used only as translation memory when English source and semantic context matched; original catalog reviewed by a native Vietnamese-speaking contributor; 2026-10-15 coverage additions are AI-assisted and not separately native-reviewed"
+licence = "MIT OR Apache-2.0"
+licence_file = "LICENSE-MIT"
+kind = "translation"
+usage = "Vietnamese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
+sha256 = "f9002d56e44e49429e0cdeabb10525f79f32831b94233f3c0a8a0ecb202850d5"
 
 [[asset]]
 path = "assets/icons/accessibility.svg"
@@ -3351,4 +3363,15 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Slovene UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "9bbbd0d516f284b571ad6e2ed811f6bbdee283cea8483686f4aa939db38ea288"
+sha256 = "5881cc7fbfe9da5f5f611309dacf267f95db3a143b916a113b649839019b292c"
+
+[[asset]]
+path = "vendor/vello_common/assets/probe.png"
+title = "vello_common probe reference image (rendered from probe.rgba)"
+author = "Linebender vello contributors"
+source = "vello_common 0.0.8 (crates.io), vendored in vendor/vello_common; regenerated by its vello_sparse_tests regenerate_probe_reference binary"
+licence = "MIT OR Apache-2.0"
+licence_file = "vendor/vello_common/LICENSE-MIT"
+kind = "image"
+usage = "Reference picture of the vendored vello_common probe module, for people only; the build reads probe.rgba, not this file"
+sha256 = "78c59a0cfd2c829909d77006f94e34dac1ae5d1f90e7f10f72e84de541fef697"
diff --git a/Cargo.lock b/Cargo.lock
index f2acd78dc..91ed3c490 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1145,7 +1145,7 @@ dependencies = [
 [[package]]
 name = "craft-print"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=f03ec27ab2c405969428512178f746183cd55ca0#f03ec27ab2c405969428512178f746183cd55ca0"
+source = "git+https://github.com/storytold/craft-libs?rev=666c358065261a2816b376fa3bb10538dbf53040#666c358065261a2816b376fa3bb10538dbf53040"
 dependencies = [
  "miniz_oxide 0.8.9",
  "roxmltree",
@@ -1154,6 +1154,18 @@ dependencies = [
  "winsafe",
 ]
 
+[[package]]
+name = "craft-quit"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=f58bc1a3df490992d633393d0898af0588ce882c#f58bc1a3df490992d633393d0898af0588ce882c"
+dependencies = [
+ "dispatch2",
+ "egui",
+ "muda",
+ "objc2 0.6.4",
+ "objc2-app-kit 0.3.2",
+]
+
 [[package]]
 name = "craft-ui"
 version = "0.1.0"
@@ -1184,6 +1196,15 @@ dependencies = [
  "x509-cert",
 ]
 
+[[package]]
+name = "crossbeam-channel"
+version = "0.5.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "98b0cc327b5bc766e7fda9c9260cc0fa81b43a8e240440422dff70788e3f9ef1"
+dependencies = [
+ "crossbeam-utils",
+]
+
 [[package]]
 name = "crossbeam-deque"
 version = "0.8.8"
@@ -2067,6 +2088,15 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "fontconfig-parser"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbc773e24e02d4ddd8395fd30dc147524273a83e54e0f312d986ea30de5f5646"
+dependencies = [
+ "roxmltree",
+]
+
 [[package]]
 name = "foreign-types"
 version = "0.5.0"
@@ -3005,6 +3035,16 @@ dependencies = [
  "cpufeatures 0.3.1",
 ]
 
+[[package]]
+name = "keyboard-types"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fbe853b403ae61a04233030ae8a79d94975281ed9770a1f9e246732b534b28d"
+dependencies = [
+ "bitflags 2.13.2",
+ "serde",
+]
+
 [[package]]
 name = "khronos-egl"
 version = "6.0.0"
@@ -3248,6 +3288,24 @@ dependencies = [
  "pxfm",
 ]
 
+[[package]]
+name = "muda"
+version = "0.21.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4340e89c178916e62879c5c36b7f699019369be413e496178a6983ce91b8bc03"
+dependencies = [
+ "crossbeam-channel",
+ "dpi",
+ "keyboard-types",
+ "objc2 0.6.4",
+ "objc2-app-kit 0.3.2",
+ "objc2-core-foundation",
+ "objc2-foundation 0.3.2",
+ "png 0.18.1",
+ "thiserror 2.0.21",
+ "windows-sys 0.60.2",
+]
+
 [[package]]
 name = "multiversion_no_op"
 version = "1.0.0"
@@ -3877,6 +3935,7 @@ dependencies = [
 name = "pdfcraft"
 version = "0.8.0"
 dependencies = [
+ "craft-quit",
  "eframe",
  "egui",
  "fmv-macos-events",
@@ -3884,6 +3943,7 @@ dependencies = [
  "pdfcraft-engine",
  "pdfcraft-ui-egui",
  "pollster 1.0.1",
+ "raw-window-handle",
  "rustls-native-certs",
  "serde_json",
  "uds_windows",
@@ -3891,6 +3951,7 @@ dependencies = [
  "wayland-client",
  "wayland-protocols",
  "windows",
+ "winit",
  "winresource",
  "winsafe",
 ]
@@ -3959,6 +4020,7 @@ dependencies = [
  "pdfcraft-automation",
  "pdfcraft-cos",
  "pdfcraft-engine",
+ "pdfcraft-platform",
  "pdfcraft-render",
  "rustix 1.1.5",
  "serde_json",
@@ -3983,6 +4045,8 @@ dependencies = [
  "hayro-syntax",
  "pdfcraft-crypt",
  "pdfcraft-filters",
+ "pdfcraft-oracle",
+ "pdfcraft-testkit",
  "proptest",
  "serde_json",
  "thiserror 2.0.21",
@@ -4065,6 +4129,7 @@ dependencies = [
  "pdfcraft-xfdf",
  "png 0.18.1",
  "thiserror 2.0.21",
+ "unicode-segmentation",
  "url",
 ]
 
@@ -4126,6 +4191,7 @@ dependencies = [
  "pdfcraft-content",
  "pdfcraft-cos",
  "pdfcraft-model",
+ "pdfcraft-testkit",
  "serde",
  "thiserror 2.0.21",
 ]
@@ -4160,6 +4226,10 @@ dependencies = [
  "thiserror 2.0.21",
 ]
 
+[[package]]
+name = "pdfcraft-oracle"
+version = "0.8.0"
+
 [[package]]
 name = "pdfcraft-organize"
 version = "0.8.0"
@@ -4167,6 +4237,7 @@ dependencies = [
  "hayro-syntax",
  "pdfcraft-content",
  "pdfcraft-cos",
+ "pdfcraft-oracle",
  "thiserror 2.0.21",
 ]
 
@@ -4176,6 +4247,7 @@ version = "0.8.0"
 dependencies = [
  "async-channel",
  "futures-lite",
+ "rustix 1.1.5",
  "zbus",
 ]
 
@@ -4183,6 +4255,7 @@ dependencies = [
 name = "pdfcraft-preflight"
 version = "0.8.0"
 dependencies = [
+ "pdfcraft-content",
  "pdfcraft-cos",
  "pdfcraft-model",
 ]
@@ -4209,6 +4282,8 @@ dependencies = [
  "pdfcraft-fonts",
  "pdfcraft-forms",
  "pdfcraft-model",
+ "pdfcraft-testkit",
+ "pdfcraft-xfa",
  "thiserror 2.0.21",
 ]
 
@@ -4265,6 +4340,10 @@ dependencies = [
  "thiserror 2.0.21",
 ]
 
+[[package]]
+name = "pdfcraft-testkit"
+version = "0.8.0"
+
 [[package]]
 name = "pdfcraft-ui-egui"
 version = "0.8.0"
@@ -4272,11 +4351,13 @@ dependencies = [
  "arboard",
  "base64 0.22.1",
  "bytemuck",
+ "craft-quit",
  "craft-ui",
  "eframe",
  "egui",
  "egui_extras",
  "egui_kittest",
+ "fontconfig-parser",
  "getrandom 0.4.3",
  "image",
  "js-sys",
@@ -5398,9 +5479,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.45"
+version = "0.23.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
+checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf"
 dependencies = [
  "aws-lc-rs",
  "log",
@@ -6868,8 +6949,6 @@ dependencies = [
 [[package]]
 name = "vello_common"
 version = "0.0.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3361bff7f7d82c0c496b92048db83846691f0e844cc28dee92b1c824291b55ee"
 dependencies = [
  "bytemuck",
  "fearless_simd",
@@ -7946,6 +8025,8 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "lopdf",
+ "pdfcraft-cos",
+ "pdfcraft-oracle",
  "png 0.18.1",
  "serde",
  "serde_json",
diff --git a/Cargo.toml b/Cargo.toml
index 87422986d..597dd316f 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -14,8 +14,10 @@ repository = "https://github.com/storytold/pdfcraft"
 [workspace.dependencies]
 # Shared frontend components; engines remain independent of egui.
 craft-ui = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "5c874d51eeb3de70e735c8ce87a59a7dedd47675", features = ["serde"] }
+# Quit the macOS way (#1136): ⌘Q asks about unsaved changes, and closing quits through `terminate:`.
+craft-quit = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "f58bc1a3df490992d633393d0898af0588ce882c" }
 # Shared system spooler; document composition remains in pdfcraft-print.
-craft-print = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "f03ec27ab2c405969428512178f746183cd55ca0" }
+craft-print = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "666c358065261a2816b376fa3bb10538dbf53040" }
 # internal
 pdfcraft-geom = { path = "crates/geom", version = "0.8.0" }
 pdfcraft-filters = { path = "crates/filters", version = "0.8.0" }
@@ -34,6 +36,8 @@ pdfcraft-xfdf = { path = "crates/xfdf", version = "0.8.0" }
 pdfcraft-sign = { path = "crates/sign", version = "0.8.0" }
 pdfcraft-optimize = { path = "crates/optimize", version = "0.8.0" }
 pdfcraft-a11y = { path = "crates/a11y", version = "0.8.0" }
+pdfcraft-oracle = { path = "crates/oracle", version = "0.8.0" }
+pdfcraft-testkit = { path = "crates/testkit", version = "0.8.0" }
 pdfcraft-ocr = { path = "crates/ocr", version = "0.8.0" }
 pdfcraft-js = { path = "crates/js", version = "0.8.0" }
 pdfcraft-compare = { path = "crates/compare", version = "0.8.0" }
@@ -110,3 +114,4 @@ hayro-jbig2 = { path = "vendor/hayro-jbig2" }
 lopdf = { path = "vendor/lopdf" }
 winit = { path = "vendor/winit" }
 egui-wgpu = { path = "vendor/egui-wgpu" }
+vello_common = { path = "vendor/vello_common" }
diff --git a/README.md b/README.md
index b20179fff..bd33ad23b 100644
--- a/README.md
+++ b/README.md
@@ -172,7 +172,7 @@ Open **Organize pages** to see every page at once:
 **Saves you can trust:**
 - *Incremental:* the original bytes stay byte-for-byte intact.
 - *Atomic:* the file is written to a temporary copy, then swapped in.
-- *Verified:* independently checked with qpdf.
+- *Verified:* independently checked with qpdf, on every CI run.
 
 When open documents exceed the window width, scroll over the tab strip with the mouse wheel or trackpad, or use its horizontal scrollbar. Opening or switching to a document brings its tab into view.
 
@@ -199,7 +199,7 @@ Every page of a combined document renders pixel-identical to its source.
 
 ```sh
 pdfcraft-cli combine report.pdf appendix.pdf --out combined.pdf
-pdfcraft-cli extract report.pdf --pages 1,3,5 --out highlights.pdf
+pdfcraft-cli extract report.pdf --pages 1,3,5-8 --out highlights.pdf
 pdfcraft-cli split   report.pdf --every 10 --out-dir parts/
 ```
 
@@ -285,6 +285,7 @@ Every engine feature is reachable without the GUI, through one table of JSON-Sch
   pdfcraft-cli run text_find doc=1 query=invoice            # key=value; values parse as JSON
   pdfcraft-cli run --script review.json                     # e.g. comment_add {"type": "highlight", "find": "total due"}
   pdfcraft-cli run --script steps.json --root ./work        # several steps in one session
+  pdfcraft-cli run --script steps.json --report             # one JSON document: per step its number, tool, status, result or error
   ```
 
   With `--root`, every file the script's steps read or write stays in that directory, including the PNG a step saves with `"out"` (the script itself is read from wherever you name it).
@@ -365,7 +366,8 @@ On top of those, two corpus sweeps run over real-world files:
 - **Opening and rendering:** of the 983 pdf.js test files, 963 open and render cleanly, with 0 crashes.
 - **Open, edit and save round trips:** 958 succeed.
 
-The output is verified with independent tools: hayro, qpdf and poppler.
+The output is verified against independent implementations: hayro and qpdf on every CI run, and
+poppler over the corpus on demand (`cargo xtask text-oracle`).
 
 PdfCraft is a clean-room implementation. Its behaviour comes from the ISO 32000 specification and black-box observation, never from anyone else's code. Every icon, font and image is openly licensed and listed in [ATTRIBUTION.md](ATTRIBUTION.md).
 
@@ -451,17 +453,40 @@ logs and crash recovery in a `PdfCraftData` folder next to `pdfcraft.exe`, so no
 `%APPDATA%`; delete that file to use the normal per-user folders.
 
 The MSI installs for all users and requires administrator privileges. It adds "Edit with PdfCraft"
-to the right-click menu of PDF files in File Explorer (on Windows 11, under "Show more options"),
-without changing which app opens PDFs by default. For unattended deployment without a desktop
-shortcut, run from an elevated terminal:
+to the right-click menu of PDF files and "Create PDF with PdfCraft…" to the right-click menu of
+images (.png .jpg .jpeg .tif .tiff .gif .bmp .jp2 .j2k .jpx) in File Explorer (on Windows 11, under
+"Show more options"), without changing which app opens them by default. For unattended deployment
+without a desktop shortcut, run from an elevated terminal:
 
 ```powershell
 msiexec /i "pdfcraft-<ver>-windows-x64.msi" /qn /norestart INSTALLDESKTOPSHORTCUT=0
 ```
 
-Add `INSTALLPDFCONTEXTMENU=0` to leave out the right-click menu entry. Pass both on upgrades too,
-since each install applies its own choices. Use the MSI for your architecture. Per-user
-installation overrides are not supported.
+| Property | `=0` leaves out |
+|---|---|
+| `INSTALLDESKTOPSHORTCUT` | the all-users desktop shortcut |
+| `INSTALLPDFCONTEXTMENU` | "Edit with PdfCraft" on PDF files |
+| `INSTALLIMAGECONTEXTMENU` | "Create PDF with PdfCraft…" on images |
+
+All three are on for a first install. An upgrade keeps what the installed version has: a shortcut
+or menu entry that is there stays, and one that is missing (left out at install, or a desktop
+shortcut someone deleted) stays missing, so you don't need to pass them again. A value on the
+command line always wins: `=1` puts one back and `=0` removes it. Upgrading from a release that
+didn't have a menu yet (0.6.0 and earlier for the PDF menu, 0.2.1 and earlier for the image menu)
+adds it, as a first install would. Use the MSI for your architecture. Per-user installation
+overrides are not supported.
+
+**Pin the checksum, not just the version.** Release candidates of a version share its MSI version
+(MSI versions are numbers only, so 1.2.3-rc.1 and 1.2.3 are both 1.2.3), and the installer lets an
+MSI of the same version replace the installed one without asking. Two different `0.7.1` MSIs can't
+be told apart by version, so if your deployment tool checks the file, pin its SHA-256 from
+`SHA256SUMS.txt` (`Get-FileHash <file> -Algorithm SHA256`).
+
+**Signing identities.** The Windows MSIs and both executables are signed through Azure Trusted
+Signing with a certificate issued to `Learning Machines Inc` (Atlanta, Georgia, US). The macOS app
+and command-line tool are signed with the Developer ID `Learning Machines LLC (DJ6XS33FX8)` and
+notarized. The MSI's manufacturer, shown as the publisher in Installed apps, is
+`Learning Machines LLC`.
 
 ### macOS
 
diff --git a/ROADMAP.md b/ROADMAP.md
index 8f8a2056a..cb15663e8 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -1,9 +1,15 @@
 # PdfCraft roadmap
 
-**Stage: alpha** · next: beta, ~26% (ready for real work 49% → 75%) and ~400–700 h away
+**Stage: alpha** · next: beta, ~25% (ready for real work 50% → 75%) and ~400–700 h away
 
 > **Last reviewed:** 2026-10-14 · **Last updated:** 2026-10-14 · **Change:** minor (M1: raw-deflate fallback preserves decoding-limit errors; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-13 · **Last updated:** 2026-10-14 · **Change:** minor (M14: the Italian catalog has every entry the other catalogs had and the code looks up; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-14 · **Last updated:** 2026-10-14 · **Change:** minor (M3 #2080 candidate: explicit search jumps join per-tab history; rail and control-channel Back/Forward; estimates unchanged)
+> **Last reviewed:** 2026-10-13 · **Last updated:** 2026-10-13 · **Change:** minor (M4 #1910: Organize Pages opens on the current page; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-14 · **Last updated:** 2026-10-14 · **Change:** minor (M3 candidate: coordinate control clicks keep press/release together on slow frames and preserve text multi-click selection; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-13 · **Last updated:** 2026-10-13 · **Change:** minor (M3 candidate: native opens retain chosen tools through password retries and defer startup intake while preparation is pending; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (M4 #1310 #1311 #1312: undo, revert and the next save keep the last saved revision; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-13 · **Last updated:** 2026-10-13 · **Change:** minor (M3 #1980: exact quit modifiers preserve Ctrl+Alt+Q email input; M3 candidate: native opens retain chosen tools through password retries and defer startup intake while preparation is pending; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (M13: CLI check visits each directory once through aliases and cycles; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (M4: Extract and Split preserve shared Type 3 glyph resources; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (M2: packed TIFF-predictor RGB rows retain their byte boundaries; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
@@ -11,6 +17,7 @@
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (M5 #1398: stamps read upright on rotated pages; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (gap 6: cloudy comments stay when flatten cannot draw them, a refused text-box edit keeps its properties, arrow defaults stay off lines, a custom match stops at a separator, and the vertical-text redaction error no longer claims an overlap; #1317, #1327, #1302, #1315, #1340; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (M7 #1316: replacing a line keeps a neighbouring line whose glyph box overlaps; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (M5: comment submission shortcuts; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (M1 #1339: an unchanged incremental save of a classic cross-reference table writes a zero-length subsection; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (M14 Windows low-DPI font-hinting candidate measured on macOS; no Windows runtime claim; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (M3: Windows' Animation effects setting is followed, and Preferences has Animation effects: system, on or off); earlier: exclusive image-crop resize follow-up; M2 short same-line redraws split before placement; estimates unchanged · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
@@ -48,7 +55,7 @@ and add a line to the [progress log](#progress-log); when a gap closes, remove i
 |---|---|---|
 | **Feature breadth** | **≈ 67%** tier-weighted (56.9% unweighted: 423 shipped + 74 partial of 808; P0 94.2%) | measured, `parity/acrobat-features.toml` |
 | Feature breadth, mainstream practitioner | ≈ 70% tier-weighted (63.2% unweighted; P0 95.3%) | measured ([split](docs/target-app-parity.md#mainstream-practitioner-vs-full-acrobat-pro)) |
-| **Ready for real work**, full Acrobat Pro | **≈ 49%** (45–53%) | estimated, weighted sum over [dimensions](#by-dimension) |
+| **Ready for real work**, full Acrobat Pro | **≈ 50%** (45–53%) | estimated, weighted sum over [dimensions](#by-dimension) |
 | **Ready for real work**, mainstream practitioner | **≈ 55%** (50–60%) | estimated ([split](docs/target-app-parity.md#mainstream-practitioner-vs-full-acrobat-pro)) |
 | **Ready for real work**, essentials user | **≈ 66%** (60–70%) | estimated ([method](docs/target-app-parity.md#essentials-user)) |
 | Remaining to **beta** | ≈ 400–700 Opus 5.5 agent-hours | estimated |
@@ -65,7 +72,7 @@ and 245 open issues keep it far from beta.
 
 | Audience | Ready | Opus 5.5 agent-hours to ≈ 95% | Work that dominates |
 |---|---|---|---|
-| Full Acrobat Pro (ready for real work) | ≈ 49% | ≈ 780–1,400 h (≈ 300–550 h wall clock with 3–5 agents; 60–70% parallelizes) | Own renderer and fidelity harness, editing existing content, OCR and Office conversion, Preflight and PDF/A/X/UA, accessibility tagging, signatures for institutions |
+| Full Acrobat Pro (ready for real work) | ≈ 50% | ≈ 780–1,400 h (≈ 300–550 h wall clock with 3–5 agents; 60–70% parallelizes) | Own renderer and fidelity harness, editing existing content, OCR and Office conversion, Preflight and PDF/A/X/UA, accessibility tagging, signatures for institutions |
 | Mainstream practitioner | ≈ 55% | ≈ 500–900 h (≈ 200–400 h wall clock; ≈ 60% parallelizes) | Rendering fidelity, editing existing text (CJK, RTL, subsets), conversion (Word layout, Excel, PowerPoint, Office→PDF), OCR languages, the bug backlog |
 | Essentials user | ≈ 66% | ≈ 180–330 h (≈ 90–180 h wall clock; ≈ 50% parallelizes) | Rendering fidelity on everyday files, launch and GPU stability, simple text fixes, Word export layout, Chinese UI glyphs |
 
@@ -80,13 +87,13 @@ Hours are calibrated as in [Effort and calibration](docs/target-app-parity.md#ef
 | File formats and conversion | ≈ 40% | 12% | 120–220 (within features) | [file-format-parity.md](docs/file-format-parity.md) |
 | PDF specification and standards | ≈ 60% | 8% | 150–260 (within features) | [pdf-spec-parity.md](docs/pdf-spec-parity.md) |
 | Hardware | ≈ 35% | 4% | 25–50 | [hardware-parity.md](docs/hardware-parity.md) |
-| Localization | ≈ 59% | 5% | 35–60 | [localization-parity.md](docs/localization-parity.md) |
+| Localization | ≈ 68% | 5% | 35–60 | [localization-parity.md](docs/localization-parity.md) |
 | Performance | ≈ 40% | 6% | 25–45 | [gaps.md](docs/gaps.md) gap 13 |
 | Stability | ≈ 50% | 8% | 45–80 | [gaps.md](docs/gaps.md) gap 6 |
 | Platforms | ≈ 70% | 5% | 15–30 | [hardware-parity.md](docs/hardware-parity.md#platforms) |
 | Ecosystem and plug-ins | ≈ 30% | 1% | 10–20 (within features) | [gaps.md](docs/gaps.md) |
 | AI features | ≈ 0% (in scope: local providers) | 1% | 20–40 (within features) | [gaps.md](docs/gaps.md) gap 23 |
-| **Total (weighted sum)** | **≈ 49%** | 100% | **≈ 780–1,400** | |
+| **Total (weighted sum)** | **≈ 50%** | 100% | **≈ 780–1,400** | |
 
 ## Features
 
@@ -111,8 +118,8 @@ What's strong and missing in each: [target-app-parity.md](docs/target-app-parity
 
 ## Languages
 
-Measured from `crates/ui-egui/src/i18n/*.tsv` (2,143 keys). Detail and script notes:
-[localization-parity.md](docs/localization-parity.md).
+Twelve key languages (historical % snapshot vs 2,143 keys, except Vietnamese vs the current
+union). Detail and script notes: [localization-parity.md](docs/localization-parity.md).
 
 | Language | Code | Strings | Status |
 |---|---|---|---|
@@ -127,10 +134,11 @@ Measured from `crates/ui-egui/src/i18n/*.tsv` (2,143 keys). Detail and script no
 | Japanese | `ja` | 99.1% | partial |
 | German | `de` | 99.3% | partial |
 | Korean | `ko` | 0% | none |
-| Vietnamese | `vi` | 0% | none |
+| Vietnamese | `vi` | 100% of current union | partial (dialogs / tooltips; no help) |
 
-Also shipped: Traditional Chinese, Russian, Bulgarian, Telugu, Hungarian, Ukrainian, Italian
-(94–100%) and Czech (menus only): **8 more languages**.
+Also shipped: Traditional Chinese, Russian, Bulgarian, Telugu, Hungarian, Ukrainian, Italian,
+Kazakh, Polish, Slovenian, Greek, Turkish, Lithuanian and Czech (menus only): **14 more catalogs**
+(23 interface languages including English).
 
 ## Upcoming
 
@@ -149,11 +157,61 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 | 8 | 1.0 polish: performance, right-to-left, missing languages, keyboard-only (M14) | 55–95 |
 
 ## Progress log
+- **2026-10-13 (community, M3, #1569 review):** Pixel-only Wayland wheel, wheel-tilt and continuous input use standalone moved events, so Ctrl zoom does not remain latched after the modifier is released (#991); vendored winit patch (13), with a policy test. Estimates unchanged.
+- **2026-10-12 (M6):** XFDF field import and data-file extraction join all text nodes in a value, preserving text after XML comments and processing instructions. Synthetic regressions cover Unicode, CDATA, empty values and PDF save/reopen. Estimates unchanged.
+- **2026-10-12 (M7, picture right-click menu):** The Edit text & images menu of a picture gains Cut Image, Redact Image (a redaction mark over the picture, applied from Redact a PDF), Create Link… and Recognize Text… (for that page), in all 21 catalogs. The menu was drawn only while the pointer was over the picture, so its items outside the picture (most of a logo's menu, and Delete below a page) could not be clicked; an open menu now stays drawn. Still missing from Acrobat's menu: Arrange (bring to front, send backward), Remove crop, Draw freehand and Edit image using… (opening an external editor).
+- **2026-10-12 (M2, inline-image boundaries):** Unfiltered inline images with known sample layouts keep pixel bytes that look like the `EI` terminator when content is rewritten. Regression tests cover row padding, colour-space and parameter aliases, masks and malformed sizes; classic and packed saved PDFs retain the pixels in independent readers and renderers. Filtered and resource-defined layouts retain the existing tolerant heuristic. Estimates unchanged.
+- **2026-10-12 (M3, drawing markups):** While a comment is being drawn, the pointer in a band along any edge of the view (or just past it) scrolls the view up, down, left or right, so points beyond what is shown can be reached. A polygon, cloud or run of connected lines takes back its last point with Backspace, Delete or Undo (the first point's removal cancels it). Edge scrolling has unit tests of its maths only; it has not been exercised end to end in the app by an automated test.
+- **2026-10-12 (gap 6, #1319, #1305, #1324):** Editing an XFA form keeps a radio item's stored text when it contains a space, so a later layout still selects it. Replace Pages on a split selection replaces those pages and leaves the gap; editing the dialog range still replaces the span. Marking a figure decorative rewrites only that figure's content stream, so a header, added text and unknown stream entries stay. Estimates unchanged.
+- **2026-10-15 (M14, gap 24):** `misc.localization` and `misc.installers` move from planned to partial. Localization: 22 catalogs ship, but Chinese shows tofu in releases, Telugu has no release font and Arabic is not mirrored. Installers: macOS and Windows releases are signed, Linux packages are not. The Acrobat menu diff itself remains open. Estimates unchanged.
+- **2026-10-13 (G14, Vietnamese localization):** Added Vietnamese (`vi`, Tiếng Việt) as an interface and date language with a 2,591-entry catalog (`plural_none`) covering 100% of the current localizable key union (plus `theme`/`Appearance`). Locale tags `vi` / `vi-VN` / `vi_VN.UTF-8` resolve; calendar months use numeric `Tháng 1`…`12` / `tháng 1`…`12`. Native-speaker community review recorded. The twelve-language localization mean moves from ≈59% to ≈68%; weighted readiness ≈49% → ≈50%. Status stays `partial`: engine/OS details, document contents, filenames, CLI/MCP and external help stay outside the catalog by design.
 
 - **2026-10-14 (M1, Flate fallback):** Raw deflate whose first bytes resemble a zlib header no longer loses a decoding-limit error during fallback. Strict and tolerant filter regressions and a COS stream regression cover refusal at the caller limit and successful decoding within it. No parity status or estimate changes.
 
+- **2026-10-12 (M6, XML field names):** AcroForm XML data export constrains generated element names to XML 1.0 NCNames, so Latin-1 names such as `Area²` and `Aµ` produce readable data files. Original PDF field names travel through the existing `xfdf:original` attribute; previously valid tags, including Greek and CJK, keep their spelling. Saved-PDF regressions cover invalid prefixes, combining letters and normalized-name collisions. Estimates unchanged.
+- **2026-10-12 (M6, CSV carriage returns):** Form-data CSV export quotes carriage returns in field names and values, so a trailing carriage return cannot turn into a record separator and disappear on reimport. Saved-PDF round-trip regressions cover CR, LF, CRLF, commas and quotes; estimates unchanged.
+- **2026-10-13 (community, M14, #1553 review):** Relative Fontconfig includes resolve beside each including config, including nested configuration selected through `FONTCONFIG_PATH`. Directory includes accept only digit-prefixed `*.conf` in lexical order. Isolated regressions reproduce both review findings; configuration size/count/depth limits, cycles, symlinked config and valid reset ordering are covered. Estimates unchanged.
+- **2026-10-12 (community, M14, NixOS UI fonts):** Linux/Unix interface fallback fonts are also discovered in Fontconfig's configured directories, including Nix store and user font paths. Existing candidate names, glyph checks, size limits and the screenshot opt-out are retained. Synthetic regressions cover included configuration, symlinks, cycles, depth limits and candidate ordering. Estimates unchanged.
+- **2026-10-12 (M7, local text-box candidate):** Add Text opens source text for editing and both text tools retype added items on one click. Draft boxes grow toward the page edge and downwards, with the grown width saved. Single visual rows grow across style boundaries, while multi-row paragraph widths stay fixed. Added-text previews remove only the selected item on a clone, with UI and read-only tool regressions. Arabic shaping, ordering and alignment are outside this candidate. Estimates unchanged.
+- **2026-10-12 (M14, #1395):** XDG desktops use the configuration base for app.ron, safely copying existing preferences without overwriting a destination. Original preferences, logs, recovery and digital IDs are retained; failed migration falls back to the original location. Portable and non-XDG locations remain unchanged; estimates unchanged.
+
+- **2026-10-12 (M10, Windows print progress, follow-up to #944):** While a job spools, the progress card counts its sheets ("Sending sheet 2 of 3 to Office…") as craft-print reports them (`submit_with_progress`, storytold/craft-libs#27), and steps aside for another long job's card. Pins craft-libs 666c358. Estimates unchanged.
+- 2026-10-12 · M3: selected page text can be copied from Edit and the canvas context menu (#1225). Five focused regressions, full CI and native Unicode clipboard checks pass; floating Copy shares the document permission gate. Estimates unchanged.
+
+- **2026-10-13 (M2, page-label prefixes):** Preserve literal leading and trailing whitespace in page-label prefixes without changing generic metadata normalization. Nine original public-inspection cases cover prefix spaces, encodings and empty-prefix controls. Existing empty-prefix fallback remains a compatibility policy, not a conformance claim. Estimates unchanged.
+- **2026-10-14 (M14, Italian catalog):** Italian gains the 201 entries the other catalogs had and the code looks up: the sentences the accessibility checker, preflight, signature validation and page-range parser word, certificate and calendar labels, digital-ID dialog messages and five plurals. It now has 2,528 entries. 64 keys other catalogs carry but no code looks up (tooltip texts with a fixed shortcut, older wordings, generic labels only Lithuanian has) were left out. AI-assisted, written from the meaning of the English; native review welcome. Estimates unchanged.
+- **2026-10-15 (M3, #2166 part 1):** Save asks before writing over a version of the file the document did not come from (something else wrote it since the open or the last save), with Save as… to keep it, and the changed-on-disk notice says what Reload and Save each do; a file that is open already comes to the front instead of opening twice; a running instance's autosaves are locked, so a second instance neither offers nor discards them. Part 2 (every writer checked and atomic) is #2182.
+- **2026-10-14 (M1, #2166):** No PDF leaves the engine unchecked and no writer truncates: new files from Combine, Extract, Split and Create, signed, timestamped and LTV-embedded files and the OCR batch output reopen with their pages before anyone writes them, as saves already did; the desktop app, the automation tools (with or without `--root`) and the CLI's edit, combine, extract and split all write through the one staging-file writer in `pdfcraft-platform`, so a failed write or `--out` naming the input never leaves a half-written file. Special files such as `/dev/stdout` are still written as given.
+- **2026-10-14 (M3 #2080 candidate):** Existing per-tab page history gains explicit search jumps, rail buttons and control-channel commands. Continuous scrolling and automatic search refresh stay outside history; page-level restoration and estimates unchanged.
+
+- **2026-10-13 (M2, page-unit transform precision):** Preserve small transform coefficients in page marks, added content and print output. Regression cases cover accepted page units of 4096 and 75000; existing page-unit interpretation and estimates are unchanged.
+- **2026-10-14 (M5, PR #1457 branch refresh):** Merged upstream main and reconciled roadmap entries while preserving comment submission shortcuts. Estimates unchanged.
+
+- **2026-10-12 (M3, page-label navigation):** The page box displays logical labels and keeps the current page when its unchanged value is submitted, including duplicate labels. Editable-control regressions also cover numeric fallback, invalid input, active typing and focused same-document replacement with changed labels or fewer pages. Clean file-watcher reload preserves the chosen scrolling mode, preventing a Single Page reader from jumping to page 1 during replacement. Estimates unchanged.
+- **2026-10-13 (community, M2/M6, form-heavy documents):** An image whose pixels hold at most 16 bits of samples (an 8-bit Separation or DeviceN spot-colour image, a 1-4-bit gray or indexed one) is converted once per possible pixel value instead of once per pixel (vendored hayro-interpret patch 28). A fillable character sheet whose 3304 × 4105 DeviceN background ran a PostScript tint transform per pixel drew each page in 3.8 s and 430 MB, on opening and again after every field was filled; it now draws in 0.11 s and 100 MB, pixel for pixel the same. The inspector places widgets without `/P` in one pass over the pages (a form of 8,000 such fields opened in 1.17 s), and the Fields panel pairs its rows with the form through one map a frame and draws only the rows in view (8,000 fields: about 15× less CPU a frame with the panel open). Regressions fail before each fix.
+- **2026-10-14 (M9, signature appearance labels):** A visible signature's labels ("Digitally signed by", "Reason: ", …) follow the interface language when Helvetica can draw all of them, and fall back to English as a set otherwise, with a note under the preview; the preview shows the same labels and the signing time. A drawn label the font can't draw is refused naming the label and character, never written as `?`. `sign_document` takes `labels` and `appearance`. Sign, automation and kittest regressions cover German, Chinese and the refusals. Estimates unchanged.
+- **2026-10-13 (M4, #1910 Organize on the current page):** Opening Organize Pages from the toolbar, tool panel, command or `--organize` selects the page being read and scrolls its cell into view, replacing a stale grid selection that did not include it. One UI regression covers a middle page, the last page and reopening after an earlier selection. Estimates unchanged.
+- **2026-10-13 (M5, signature pad undo):** The Draw tab of Create signature/initials has an Undo button and Ctrl/Cmd+Z that take back the last stroke (#1963). Pad is UI-only, so no automation tool. Estimates unchanged.
+- **2026-10-13 (M2, raw crop and page-unit floor):** The renderer applies its existing one-point minimum in physical points for non-nearly-zero raw crop dimensions on scaled pages. Five synthetic regressions cover inspection, crop origins and rotations, reciprocal rounding and bounded raster controls. Existing UserUnit policy, nearly-zero fallback, feature statuses and estimates are unchanged.
+- **2026-10-13 (M5, text box font size, #1908):** Comment Properties has a Font size control for text boxes, typewriter text and callouts (1-400 pt); it writes `/DA` and the rich-text strings, redraws the appearance and grows the box to fit. `comment_edit` takes `font_size`. Annot, tool and UI regressions. Estimates unchanged.
+- **2026-10-13 (M3, Single Page edge paging, #1924):** In Single Page view a page taller than the window pans with the wheel, and one more notch (or a fresh trackpad swipe) at the bottom/top edge shows the next page at its top / the previous page at its bottom. A swipe that panned to the edge, momentum included, does not turn. Estimates unchanged.
+- **2026-10-13 (M3, #1980):** Ctrl+Alt+Q in the digital ID email field no longer requests application exit. Quit requires exact Ctrl+Q/Cmd+Q modifiers and uses the existing unsaved-document confirmation. Synthetic keyboard regressions cover email input and clean/dirty quit requests; estimates unchanged.
+
+- **2026-10-14 (M4, page transitions read, §12.4.4):** `/Trans` and `/Dur` are read into `DocInfo::transitions` and listed by `doc_info`, the data a full-screen presentation needs to play transitions and auto-advance; playing and editing them stay planned.
+- **2026-10-14 (M4, page transitions set, §12.4.4):** `page_transition_set` (one undoable edit) writes or removes `/Trans` and `/Dur` on chosen pages with the values checked first, the counterpart of reading them into `DocInfo::transitions`; playing them and the dialog stay planned.
+- **2026-10-14 (M12, transition geometry):** `pdfcraft_render::transition` gives the picture of any of the twelve page transitions at a moment of its run (which parts of the old and new page to paint, where, how opaque), in page fractions, tested for every style and direction; the full-screen presentation will paint from it once it plays transitions.
+- **2026-10-14 (M3, Open in Full Screen mode honoured):** a document with `/PageMode /FullScreen` now asks (Full Screen / Not now) before the app enters full screen, as Acrobat does; before, the setting was written and read but never acted on when opening.
+- **2026-10-14 (M3, control-click candidate):** Coordinate clicks retain hover warmup and pair press/release in one input pass so slow frames do not turn a click into a hold. Text multi-click selection accepts the actual press event when egui has already cleared its origin. Regression cases cover slow-frame button activation, disabled controls and coalesced text selection; estimates unchanged.
+- **2026-10-14 (community, M7, #128 Hebrew in Add text):** Add text and `page_add_text` draw Hebrew with the craft-fonts Hebr face (Noto Sans Hebrew), through the same shaped path as Arabic and Thai: right-to-left display order with numbers and Latin in place, points and cantillation kept on their letter as one Type 3 glyph, ToUnicode and per-line ActualText so extraction, search and the editor get typing order. Builds without the face refuse Hebrew rather than write `?`. Regular style only. Estimates unchanged.
+- **2026-10-14 (M9, #1787):** Changes after signing are judged by the role an object held when signed for a page's resources too: a rewritten font, XObject, graphics state or resources dictionary is page content however its new version is labelled, so a `/FT` or `/Subtype /Widget` added by the attacker no longer reads as a permitted form fill. A category dictionary that only gained a name is judged as before.
 - **2026-10-13 (M3, native-opening candidate):** Chosen tools survive preparation, conversion and password retries; startup intake waits for pending preparation. Regression tests cover completion, cancellation and document identity. Estimates unchanged.
+- **2026-10-13 (community, M3, #531 touchpad momentum):** On Wayland a two-finger swipe keeps gliding after the fingers lift and slows to a stop, measured from the gesture's last 0.1 s and decaying with a 0.35 s time constant through the #759 1:1 path. Any wheel input, click, key, zoom or edge ends it (fingers resting on the touchpad don't yet: the vendored winit binds no Wayland hold gestures); single-page paging, macOS (which sends its own momentum), the web, and Animation effects Off never glide. Unit tests for the physics and two headless view tests. Estimates unchanged.
+- **2026-10-13 (M3, native-open admission):** Later prepared replies stay queued while a modal or native picker owns the foreground. Picker completion, cancellation and abandonment wake retained opens. Regressions cover recipient ownership, exactly-once admission, source/history preservation and one-shot repaint requests. Estimates unchanged.
+- **2026-10-13 (M6, choice indices):** Multi-select choice fields write ascending `/I` option indices while preserving the caller's `/V` order. Synthetic forms and headless engine regressions cover reverse selection and save/reopen. Estimates unchanged.
+
 - **2026-10-12 (M10, Windows printing without PowerShell, #1107):** craft-print now prints on Windows in-process: printers from EnumPrinters/GetDefaultPrinter, jobs drawn as vectors by Windows.Data.Pdf into the XPS print API with a driver-validated PrintTicket (exact paper, orientation, no scaling), so printing works where App Control for Business or AppLocker run PowerShell in Constrained Language Mode. Portrait and landscape sheets still print as one job (turned with /Rotate); a sheet size the driver lacks is refused rather than shrunk. Pins craft-libs f03ec27 (craft-libs#28); deny.toml allows the storytold/winprint.rs fork and adds a webpki-root-certs licence exception and a RUSTSEC-2024-0370 ignore for winprint's build-dependencies. An earlier craft-print revision was checked in Windows Sandbox under enforced WDAC: printers listed, CLI and desktop jobs spooled, and no powershell.exe in the 4688 audit. The final pinned revision passed craft-libs Windows CI, including a real paused-queue job; that Sandbox run has not been repeated. Estimates unchanged.
+- **2026-10-12 (M1, #1338):** A full rewrite used to build a new trailer from `/Root`, `/Info`, `/Encrypt` and `/ID`, so accepted unknown entries such as a custom string or `/Version` disappeared, including when an incremental save was forced to rewrite. Those entries are copied, and objects reachable only from them are written and renumbered with the rest of the file. Ordinary incremental saves are unchanged. Estimates unchanged.
+- **2026-10-12 (M4, #1310, #1311, #1312):** Undo back to the opened file left it marked unsaved, so recovery and close treated unchanged work as dirty. After a save, Revert followed the restored snapshot's older base and the next save dropped the latest saved revision. The last saved file is remembered on its own: undo and redo are clean only when they land on it, Revert opens it, and a later save appends to it. Estimates unchanged.
 - **2026-10-12 (M13, CLI robustness scans):** `pdfcraft-cli check` visits a directory once even when input roots overlap or directory symlinks lead back into the tree. PDFs reached through file symlinks remain accepted. Three real CLI regressions cover overlapping roots, a directory cycle and directory/file aliases. Estimates unchanged.
 - **2026-10-12 (M4, Type 3 extraction fidelity):** Extract and Split preserve shared image/resource dictionaries reached through Type 3 glyphs, including nested forms, patterns and soft masks. A bounded object-graph walk protects unknown glyph content; unreadable pages/forms retain their glyph resources, and shared explicit fonts are visited once. Separate page dictionaries still prune unused images. Synthetic save/reopen regressions and an opt-in Poppler pixel oracle cover resource ownership, nested forms, cycles, limits and repeated fonts. Estimates unchanged.
 - **2026-10-12 (M2, TIFF predictor rows):** Packed RGB images using TIFF horizontal differencing keep every row when samples do not fill the last byte. The renderer aligns each decoded row before moving to the next. Synthetic decoding tests cover 1/2/4-bit samples, horizontal differencing and an 8-bit control; a red/green page-render regression verifies visible output. Estimates unchanged.
@@ -165,6 +223,9 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 - **2026-10-12 (gap 6, #1317, #1327, #1302, #1315, #1340):** Flattening keeps a visible comment it cannot draw, such as a cloudy square with no stored appearance, and still draws a solid square, a hidden comment and a cloudy square that already has an appearance. A text box another program drew is left unchanged when a restyle or resize is refused. Make Current Properties Default on an arrow updates the Arrow tool and leaves plain lines alone. A custom text match that ends on a reconstructed word or line separator no longer includes the next glyph. The vertical-writing redaction refusal still fails closed, and its message no longer says the text was under the mark. Estimates unchanged.
 - **2026-10-12 (M12, text-only auto-tag):** Automatically tag PDF now writes marked text objects, paragraph tags, a Document element and a parent tree for untagged text-only PDFs. The result is undoable and opens the Tags panel for review. Mixed paint, forms, annotations, existing tags and malformed streams are refused before mutation. Synthetic two-page engine and tool tests check the tree, checker, unchanged rendering and save/reopen. Richer content and role classification remain open. Estimates unchanged.
 - **2026-10-12 (M7, #1316):** Replacing a line or paragraph no longer removes a distinct neighbour whose glyph box overlaps the edited line. A second drawing is removed only when it also sits on the same baseline, so fake-bold and invisible copies still go. Synthetic regressions cover 6 pt leading, the same word on the next line, ordinary spacing, a separate paragraph, same-position copies, and incremental and full save/reopen. Estimates unchanged.
+- **2026-10-12 (M5, comment shortcuts):** Ctrl+Enter posts highlight comment text and replies; Shift+Enter adds a newline. Replies keep Enter-to-post, and floating comment composers only submit from their focused editor. Estimates unchanged.
+
+- **2026-10-12 (M7, #1443):** Adding a word to a multi-line paragraph no longer reflows or merges its lines. Two causes: in Chrome- and Skia-made subset fonts, `/W` leaves out glyphs of the `/DW` width, which were treated as missing, so unchanged rows measured too wide and rewrapped (and new letters fell back to Helvetica); and lines drawn turned on the page (a landscape page drawn a quarter turn round) were compared along the page's x axis, so all of them became one line. Lines and rows are now found along each text's own baseline, a turned paragraph is rewritten in its own text space, and that rewrite keeps explicit line breaks. Formatting part of turned text is refused rather than misplaced. Synthetic regressions cover three turns and a default-width subset. Estimates unchanged.
 - **2026-10-12 (M1, #1339):** An incremental save of an unchanged classic-table file used to append `xref` and then `trailer` with no subsection, which qpdf reports as a damaged file. The section now has a zero-length subsection, so no object entry changes and a trailer-only edit is still written. Estimates unchanged.
 - **2026-10-12 (M12, auto-tag preview):** The engine and `accessibility_autotag_preview` propose paragraph and large-heading roles for bounded text blocks on one page, with locations and reasons. Every proposal needs review; images remain unclassified. No PDF tags are written yet. Synthetic tool tests cover normal text, a larger heading, bounds and unchanged source bytes. Estimates unchanged.
 - **2026-10-12 (M10, editing OCR text on scans):** Editing a recognised word on a scanned page now changes what the page shows. Before, the rewrite stayed invisible OCR text, so the scan still showed the old word; on a form, the whole OCR layer also grouped into one paragraph that rewrapped when one word changed. OCR words now group into phrases (a table cell or a tab stop splits them, and lines stay apart); an edit draws the phrase visibly in the scan's sampled ink colour over a cover in the sampled paper colour, keeping each word's width and growing rightwards. The editor covers the scanned word while typing. OCR words are now sized from their letters (a capitals-only word's box spans the cap height, not the full ascender-descender span), so recognised and rewritten text is as tall as the scanned word and sits on its baseline. Five engine tests on synthetic scans and a kittest UI test; `ocr.editable-text-output` is partial.
@@ -178,6 +239,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 - **2026-10-12 (M12, XFA scripts turned off):** When a runaway script turns an XFA form's scripts off, the app now says so: a toast as it happens (at open or after a click), and the notice bar from then on, ahead of its other notices, with a JavaScript Console button. Before, the error was only in the console, so calculations and buttons just stopped. A notice bar the user had closed comes back for it; closed again, it stays closed. The engine reports the state (`Document::xfa_scripts_off`, and `xfa_scripts_off` in `doc_info`) instead of the UI reading error text. Two kittest UI tests (a runaway at open; a runaway click after the bar was closed), engine assertions and a `doc_info` tool test. Overall unchanged.
 - **2026-10-12 (M14, Windows low-DPI font-hinting candidate):** The Windows policy disables symmetric rendering for embedded JetBrains Mono only. On the locked-font macOS probe, horizontal alpha-edge energy per ink improves 2.78%, 3.87% and 1.59% at 100%, 125% and 150% scaling, and is down 0.79% at 200%; Inter is pixel-identical. Logical layout hashes and 8 MiB atlas size match, repeated fractional offsets add no atlas dimensions, and baseline/candidate time and RSS ranges overlap. Windows runtime and hardware remain unverified; estimates unchanged.
 - **2026-10-12 (M7, #1200 candidate):** Bounded local GoToR file specifications open in desktop tabs; explicit numeric page views apply, while named destinations open at the default view with a warning. The automation tool resolves relative to the source and uses existing `--root` confinement. Appearance-only Link Properties edits preserve the existing action. URL/network paths remain refused; `/NewWindow` is a tab hint. Estimates unchanged.
+- **2026-10-12 (M1, #1337):** COS opening repairs exhausted cross-reference entries and records the skipped row; allocation safely falls back to unused numbers for exhausted /Size hints and high edits. Classic-table and stream regressions reproduce the former panic; ordinary, zero-offset and repaired-range controls preserve opening and allocation. Estimates unchanged.
 - **2026-10-12 (M7, private image crops):** Exclusive image crops resize with their pixels across nested states, intervening operators and content streams; shared clips remain fixed. Synthetic engine/tool regressions and private image save/reopen checks; estimates unchanged.
 
 - **2026-10-12 (M12, accessibility finding locations):** Checker findings for figures, annotations and form widgets carry verified page bounds. Selecting one flashes its location; the headless check returns the same PDF-space rectangle. Malformed annotation rectangles remain page-only findings. Guided review and tagging estimates unchanged.
@@ -203,6 +265,7 @@ Newest first: the date, what moved, and the new overall estimate.
 
 - **2026-10-12 (M3, GNOME title bar, #553):** On GNOME's Wayland session, whose compositor draws no window frames (it offers no `zxdg_decoration_manager_v1`), PdfCraft no longer shows winit's fallback title bar: it turns the frame off and the tab strip becomes the header bar, as in GNOME's own apps. Minimize, maximize/restore and close are drawn in Adwaita's style, in the order and on the side GNOME's `button-layout` names (Fedora's default shows only close); the window's edges and corners resize it, and a hairline outlines it while it isn't maximized. Preferences ▸ Use system title bar (shown only there) gives the window back winit's frame at once, without a restart (part of #1001), and `PDFCRAFT_TITLEBAR=app|system` overrides the choice. KDE, Sway, Hyprland, COSMIC and X11 keep the frame their desktop draws. Not done: right-clicking the header bar doesn't open GNOME's window menu (egui can't ask for it), the window has no shadow or rounded corners, the resize edges lie just inside the window rather than outside it, and Windows still uses its system frame (the rest of #1001). Estimates unchanged.
 - **2026-10-12 (M0, build label):** A local or patched build can carry a label, set at compile time with `PDFCRAFT_BUILD_LABEL`: `pdfcraft --version`, `pdfcraft-cli --version`, About and the log show `0.7.1 (titlebar)`, and `packaging/linux/package.sh` names the files `pdfcraft-0.7.1-titlebar-…` and makes the .rpm/.deb release `1.titlebar`, which upgrades over the release of the same version (and the next release over it). The version itself is unchanged, so the update check still compares it with published releases. Unlabelled builds are as before. Estimates unchanged.
+- **2026-10-11 (M6, #1208):** Dropdown and list-box Field Properties expose the existing Left/Center/Right alignment picker. Existing alignment stays intact until changed; cancel, undo/redo and save/reopen are covered through the real UI without changing options, values or flags. Estimates unchanged.
 - 2026-10-11: Organize Pages shows an editable, synchronized physical page-range selection (#1092), with bounded validation and UI/operation regression coverage; overall estimate unchanged.
 
 - **2026-10-11 (M5.7, scanned signatures, #1110):** Fill & Sign ▸ Add signature has a Scan tab: a phone photo of a signature on paper is framed automatically (all words; table, sheet edge and dust ignored; a sideways signature turned upright), the frame can be moved, resized or redrawn, the photo turned, and an ink-sensitivity slider picks up faint ink. A morphological paper estimate removes shadows and uneven light, and the trimmed ink is saved and reused like an image signature. Photos and images can also be dropped on the Image and Scan tabs. Photos keep the image-signature limits (#1124: a 4 MiB file, up to 32 megapixels decoded, scaled down to 4 megapixels), so a scan never processes more than 4 megapixels. `fill_sign_add` takes `scan` and `sensitivity`. Synthetic engine, UI and automation tests; checked by hand on real phone photos. Milestone and effort estimates unchanged.
@@ -431,6 +494,10 @@ Newest first: the date, what moved, and the new overall estimate.
 | Date | Change | Summary |
 |---|---|---|
 | 2026-10-14 | minor | M1: raw-deflate fallback preserves decoding-limit errors in strict and tolerant decoding; synthetic filter and COS stream regressions. Estimates unchanged. |
+| 2026-10-12 | minor | M6: valid AcroForm XML element names with original PDF field names preserved; saved-PDF collision and Unicode regressions. Estimates unchanged. |
+| 2026-10-12 | minor | M6: preserve carriage returns in exported CSV field names and values; saved-PDF round-trip coverage. Estimates unchanged. |
+| 2026-10-13 | minor | M4: Insert-from-file preserves source bookmarks; integration tests retained with current main. Estimates unchanged. |
+| 2026-10-14 | minor | M7/#128: Hebrew in Add text with the craft-fonts Hebr face (display order, points, ToUnicode, ActualText); estimates unchanged. |
 | 2026-10-12 | minor | M3/#1364 candidate: absolute local GoToR links require desktop consent or headless allow_absolute; existing relative navigation and validation retained. Estimates unchanged. |
 | 2026-10-12 | minor | M8: redaction retires inherited `/Resources` so a parent `/Pages` can't keep a removed XObject reachable; only redacted pages that inherit are pinned (one shared reference), unredacted pages are untouched; estimates unchanged |
 | 2026-10-12 | minor | M7/#1200 candidate: bounded local GoToR opening, root-confined automation, and action-preserving appearance edits; named destinations and window behavior remain partial; estimates unchanged. |
@@ -447,5 +514,7 @@ Newest first: the date, what moved, and the new overall estimate.
 | 2026-10-10 | major | Restructured to the progress-docs standard (stage, two numbers, dimensions, features, languages, upcoming, log); full re-measure; assessment, gaps and milestones moved to `docs/`; log sorted newest first and a stray merged entry dated |
 | 2026-10-07 | minor | 806 tracked features, 51.0% shipped, effort-weighted ≈ 30–35%, 600–1,100 h |
 | 2026-10-05 | major | Honest assessment and "Where we're lacking" added |
+| 2026-10-12 | minor | M8: image redaction removes alternate images and unsupported masks only on affected images. Estimates unchanged. |
 
 - **2026-10-12 (M8):** Redaction cleans indirect and form structure references, preserving surviving form tags.
+- **2026-10-13 (M7):** Edit a PDF ▸ Add content: Header and footer, Watermark and Background open an Add / Update / Remove menu (Update and Remove enabled only when the document has that mark), as Acrobat's Watermark control does. The catalogue gains `ToolItem::actions`, so any tool can list more commands (#1192).
diff --git a/apps/pdfcraft-cli/Cargo.toml b/apps/pdfcraft-cli/Cargo.toml
index abe2657fb..d7b52fbd6 100644
--- a/apps/pdfcraft-cli/Cargo.toml
+++ b/apps/pdfcraft-cli/Cargo.toml
@@ -19,6 +19,7 @@ pdfcraft-engine = { workspace = true }
 pdfcraft-audit = { workspace = true }
 pdfcraft-cos = { workspace = true }
 pdfcraft-automation = { workspace = true }
+pdfcraft-platform = { workspace = true }
 base64 = "0.22"
 
 [target.'cfg(unix)'.dependencies]
diff --git a/apps/pdfcraft-cli/src/automation_args.rs b/apps/pdfcraft-cli/src/automation_args.rs
new file mode 100644
index 000000000..868cdf66a
--- /dev/null
+++ b/apps/pdfcraft-cli/src/automation_args.rs
@@ -0,0 +1,90 @@
+//! Parse `--automation-read-root` / `--automation-write-root` before the server starts. A malformed
+//! flag must not silently remove a root and leave the server unconfined.
+
+use std::path::PathBuf;
+
+pub struct AutomationArgs {
+    pub read_root: Option<PathBuf>,
+    pub write_root: Option<PathBuf>,
+    read_given: bool,
+    write_given: bool,
+}
+
+impl AutomationArgs {
+    pub fn new(read_root: Option<PathBuf>, write_root: Option<PathBuf>) -> Self {
+        Self { read_root, write_root, read_given: false, write_given: false }
+    }
+
+    /// Returns whether this argument is a root flag. A second occurrence of a flag is an error,
+    /// including when the two spellings (`--flag DIR`, `--flag=DIR`) are mixed.
+    pub fn consume(&mut self, arg: &str, args: &mut impl Iterator<Item = String>) -> Result<bool, String> {
+        let (flag, inline) = arg.split_once('=').map_or((arg, None), |(flag, value)| (flag, Some(value)));
+        let (root, given) = match flag {
+            "--automation-read-root" => (&mut self.read_root, &mut self.read_given),
+            "--automation-write-root" => (&mut self.write_root, &mut self.write_given),
+            _ => return Ok(false),
+        };
+        if *given {
+            return Err(format!("{flag} given twice"));
+        }
+        let value = match inline {
+            Some(value) => value.to_owned(),
+            None => {
+                let value = args.next().ok_or_else(|| format!("{flag} needs a folder"))?;
+                if value.starts_with('-') {
+                    return Err(format!("{flag} needs a folder; use {flag}=<dir> for a folder starting with '-'"));
+                }
+                value
+            }
+        };
+        if value.is_empty() {
+            return Err(format!("{flag} needs a non-empty folder"));
+        }
+        *root = Some(value.into());
+        *given = true;
+        Ok(true)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn roots_are_taken_once_and_other_arguments_are_left() {
+        let mut roots = AutomationArgs::new(None, None);
+        let mut args = ["a folder".to_owned(), "report.pdf".to_owned()].into_iter();
+        assert!(roots.consume("--automation-read-root", &mut args).unwrap());
+        assert!(roots.consume("--automation-write-root=out", &mut args).unwrap());
+        assert!(!roots.consume("--compact", &mut args).unwrap());
+        assert_eq!(roots.read_root, Some("a folder".into()));
+        assert_eq!(roots.write_root, Some("out".into()));
+        assert_eq!(args.next().as_deref(), Some("report.pdf"));
+        assert!(roots.consume("--automation-read-root=other", &mut args).is_err());
+        assert_eq!(roots.read_root, Some("a folder".into()));
+    }
+
+    #[test]
+    fn invalid_operands_leave_roots_unchanged() {
+        for flag in ["--automation-read-root", "--automation-write-root"] {
+            for operand in [None, Some(""), Some("--version"), Some("--root"), Some("-folder")] {
+                let mut roots = AutomationArgs::new(Some("read".into()), Some("write".into()));
+                let mut args = operand.map(str::to_owned).into_iter();
+                assert!(roots.consume(flag, &mut args).is_err(), "{flag} {operand:?}");
+                assert_eq!(roots.read_root, Some("read".into()));
+                assert_eq!(roots.write_root, Some("write".into()));
+            }
+            let mut roots = AutomationArgs::new(None, None);
+            assert!(roots.consume(&format!("{flag}="), &mut std::iter::empty()).is_err());
+        }
+    }
+
+    #[test]
+    fn explicit_dash_folder_and_relative_dash_folder_are_valid() {
+        let mut roots = AutomationArgs::new(None, None);
+        assert!(roots.consume("--automation-read-root=-folder", &mut std::iter::empty()).unwrap());
+        assert!(roots.consume("--automation-write-root", &mut ["./-folder".to_owned()].into_iter()).unwrap());
+        assert_eq!(roots.read_root, Some("-folder".into()));
+        assert_eq!(roots.write_root, Some("./-folder".into()));
+    }
+}
diff --git a/apps/pdfcraft-cli/src/main.rs b/apps/pdfcraft-cli/src/main.rs
index 190cb3da9..0e24800d3 100644
--- a/apps/pdfcraft-cli/src/main.rs
+++ b/apps/pdfcraft-cli/src/main.rs
@@ -17,6 +17,8 @@
 
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
+#[cfg(feature = "mcp")]
+mod automation_args;
 mod batch;
 
 use std::io::Write;
@@ -33,8 +35,14 @@ use pdfcraft_render::{PageRenderer, RenderConfig, RenderRequest, RequestKind, in
 macro_rules! mcp_usage {
     () => {
         "\
-pdfcraft-cli mcp    [--root DIR] [--compact]              MCP server on stdin/stdout (opt-in)
+pdfcraft-cli mcp    [--root DIR] [--compact] [--automation-read-root DIR] [--automation-write-root DIR]
+                                                           MCP server on stdin/stdout (opt-in)
                                                            --compact lists a core set of tools plus tool_search and tool_call
+                                                           --automation-read-root / --automation-write-root confine the files the
+                                                           agent's tools read (open, combine, import, fonts, certificates…) and
+                                                           write (save, export, extract, split, reports…) to DIR, links followed;
+                                                           a root left out grants none of its access. --root, when also given,
+                                                           applies as well
 "
     };
 }
@@ -55,7 +63,7 @@ pdfcraft-cli edit   <in.pdf> --out out.pdf [--rotate 1,3:90] [--delete 2,4] [--m
                       [--insert-blank 1] [--title T] [--author A] [--full]
                       (options run in order; page numbers refer to the document after the earlier options)
 pdfcraft-cli combine <a.pdf> <b.pdf> … --out combined.pdf
-pdfcraft-cli extract <in.pdf> --pages 1,3,5 --out out.pdf
+pdfcraft-cli extract <in.pdf> --pages 1,3,5-8 --out out.pdf    (pages and ranges, in the order given)
 pdfcraft-cli split   <in.pdf> (--every N | --before 3,7) [--out-dir DIR]
 pdfcraft-cli check  <files or dirs…> [--timeout 20] [--dpi 36] [--json out.json]
 pdfcraft-cli audit  <file.pdf> [--password PW]            find faux redactions (fails when found)
@@ -64,7 +72,8 @@ pdfcraft-cli batch <files or dirs...> --steps convert,ocr,optimize --out-dir DIR
                       [--ppi 150] [--quality 60] [--dpi 300] [--language en] [--ocr-all-pages]
 pdfcraft-cli tools                                       automation tools and their JSON Schemas
 pdfcraft-cli run    <tool> [key=value …] [--root DIR] [--out image.png]
-pdfcraft-cli run    --script steps.json [--root DIR]      [{\"tool\": \"doc_open\", \"args\": {…}}, …]
+pdfcraft-cli run    --script steps.json [--root DIR] [--report]
+                      [{\"tool\": \"doc_open\", \"args\": {…}}, …]; --report prints one JSON document for the run
 ",
     mcp_usage!(),
     "\
@@ -161,15 +170,20 @@ fn audit(args: &[String]) -> Result<(), CliError> {
     validate_options("audit", args, AUDIT_OPTIONS)?;
     let path = *positional(args).first().ok_or("audit: missing file")?;
     let bytes = read(path)?;
-    let doc = pdfcraft_cos::Document::open_with_password(bytes, flag(args, "--password")).map_err(|e| format!("{path}: {e}"))?;
+    let password = flag(args, "--password");
+    let doc = pdfcraft_cos::Document::open_with_password(bytes.clone(), password).map_err(|e| format!("{path}: {e}"))?;
     let findings = pdfcraft_audit::audit_redactions(&doc).map_err(|e| format!("{path}: {e}"))?;
+    // Rectangles in points from the top-left of the displayed page, as `doc_audit_redactions`
+    // reports them; the page geometry is read only when there is something to place.
+    let info = if findings.is_empty() { None } else { Some(inspect(bytes, password).map_err(|e| format!("{path}: {e}"))?) };
     let items: Vec<serde_json::Value> = findings
         .into_iter()
         .map(|f| {
+            let rect = f.rect.map(|v| v as f32);
             serde_json::json!({
                 "page": f.page + 1,
                 "kind": f.kind.id(),
-                "rect": f.rect,
+                "rect": info.as_ref().map_or(rect, |i| pdfcraft_automation::view_rect(i, f.page, rect)),
                 "covered_text": f.covered_text,
             })
         })
@@ -251,6 +265,7 @@ const RUN_OPTIONS: &[OptionSpec] = &[
     OptionSpec { name: "--root", takes_value: true },
     OptionSpec { name: "--script", takes_value: true },
     OptionSpec { name: "--out", takes_value: true },
+    OptionSpec { name: "--report", takes_value: false },
 ];
 const UI_OPTIONS: &[OptionSpec] = &[OptionSpec { name: "--control", takes_value: true }, OptionSpec { name: "--out", takes_value: true }];
 
@@ -305,6 +320,7 @@ fn info(args: &[String]) -> Result<(), CliError> {
         "xfa_layout": xfa_layout,
         "bookmarks": info.outline.len(), "annotations": info.annotations.len(), "fields": info.fields.len(),
         "links": info.links.len(), "layers": info.layers.len(), "attachments": info.attachments.len(),
+        "transitions": info.transitions.len(),
         "page_labels": info.pages.iter().take(8).map(|p| p.label.clone()).collect::<Vec<_>>(),
         "warnings": info.warnings,
     });
@@ -376,9 +392,30 @@ fn text(args: &[String]) -> Result<(), CliError> {
     }
 }
 
-/// 1-based page list ("1,3,5") → 0-based indices.
+/// The most pages one `A-B` range may name: a bound on what a typed range can allocate.
+const MAX_RANGE: usize = 1_000_000;
+
+/// 1-based pages ("1,3,5-8": single pages and inclusive ranges, in the order given) → 0-based
+/// indices (#1923).
 fn page_list(s: &str) -> Result<Vec<usize>, String> {
-    s.split(',').map(|p| p.trim().parse::<usize>().ok().filter(|n| *n > 0).map(|n| n - 1).ok_or(format!("bad page number {p:?}"))).collect()
+    let number = |t: &str, item: &str| t.trim().parse::<usize>().ok().filter(|n| *n > 0).ok_or_else(|| format!("bad page number {item:?}"));
+    let mut out = Vec::new();
+    for item in s.split(',').map(str::trim) {
+        match item.split_once('-') {
+            Some((from, to)) => {
+                let (from, to) = (number(from, item)?, number(to, item)?);
+                if to < from {
+                    return Err(format!("bad page range {item:?}: it ends before it starts"));
+                }
+                if to - from >= MAX_RANGE {
+                    return Err(format!("bad page range {item:?}: more than {MAX_RANGE} pages"));
+                }
+                out.extend(from - 1..to);
+            }
+            None => out.push(number(item, item)? - 1),
+        }
+    }
+    Ok(out)
 }
 
 /// The options `edit` understands, for its "unknown option" message.
@@ -469,7 +506,16 @@ fn edit(args: &[String]) -> Result<(), CliError> {
         session.apply(id, e).map_err(|e| e.to_string())?;
     }
     let bytes = if full { session.save_full_bytes(id) } else { session.save_bytes(id) }.map_err(|e| e.to_string())?;
-    std::fs::write(out, bytes.as_slice()).map_err(|e| format!("{out}: {e}").into())
+    // As the app's Save: the file must reopen with its pages before it replaces anything (#1698).
+    session.check_save(id, &bytes).map_err(|e| e.to_string())?;
+    write_pdf(Path::new(out), &bytes)
+}
+
+/// Write a PDF a command produced, through a staging file beside the target (#2166): a write
+/// that fails, or `--out` naming the input, never leaves a truncated file where a good one was.
+fn write_pdf(out: &Path, bytes: &[u8]) -> Result<(), CliError> {
+    use pdfcraft_platform::staging::{StagingName, write_atomically};
+    write_atomically(out, bytes, StagingName::SuffixThenTag).map_err(|e| format!("{}: {e}", out.display()).into())
 }
 
 fn file_stem(path: &str) -> String {
@@ -485,7 +531,7 @@ fn combine(args: &[String]) -> Result<(), CliError> {
     }
     let sources = inputs.iter().map(|p| Ok((file_stem(p), read(p)?))).collect::<Result<Vec<_>, String>>()?;
     let bytes = pdfcraft_engine::Session::new().combine(&sources).map_err(|e| e.to_string())?;
-    std::fs::write(out, bytes.as_slice()).map_err(|e| format!("{out}: {e}").into())
+    write_pdf(Path::new(out), &bytes)
 }
 
 fn extract(args: &[String]) -> Result<(), CliError> {
@@ -496,7 +542,7 @@ fn extract(args: &[String]) -> Result<(), CliError> {
     let mut session = pdfcraft_engine::Session::new();
     let id = session.open(path, None, read(path)?, flag(args, "--password")).map_err(|e| e.to_string())?;
     let bytes = session.extract(id, &pages).map_err(|e| e.to_string())?;
-    std::fs::write(out, bytes.as_slice()).map_err(|e| format!("{out}: {e}").into())
+    write_pdf(Path::new(out), &bytes)
 }
 
 fn split(args: &[String]) -> Result<(), CliError> {
@@ -518,7 +564,7 @@ fn split(args: &[String]) -> Result<(), CliError> {
     std::fs::create_dir_all(&dir).map_err(|e| format!("split: --out-dir {}: {e}", dir.display()))?;
     for (a, b, bytes) in parts {
         let name = dir.join(if a == b { format!("{stem}-p{a}.pdf") } else { format!("{stem}-p{a}-{b}.pdf") });
-        std::fs::write(&name, bytes.as_slice()).map_err(|e| format!("{}: {e}", name.display()))?;
+        write_pdf(&name, &bytes)?;
         stdout_line(format_args!("{}", name.display()))?;
     }
     Ok(())
@@ -539,8 +585,11 @@ fn render(args: &[String]) -> Result<(), CliError> {
         Some("pam") => None,
         _ => return Err(format!("render: --out {out}: use a .png, .jpg, .tif or .pam name").into()),
     };
+    // The app renders a display copy that draws comments missing their /AP streams; the CLI
+    // must agree with it (and with independent viewers), while keeping the file it reads intact.
+    let bytes = read(path)?;
     let mut r = PageRenderer::new(
-        read(path)?,
+        pdfcraft_engine::display_bytes_for(bytes.clone(), flag(args, "--password")),
         RenderConfig { password: flag(args, "--password").map(Arc::from), reject_oversize: true, ..Default::default() },
     );
     let p = r.render(RenderRequest { page: page_index, kind: RequestKind::Pixels, tile: None, scale: dpi / 72.0, tag: 0, preview: false });
@@ -757,22 +806,88 @@ fn print_output(auto: &pdfcraft_automation::Automation, content: Vec<pdfcraft_au
                     let written = auto.write_output(path, &data).map_err(|e| e.to_string())?;
                     stdout_line(format_args!("{}", serde_json::json!({ "image": written.to_string_lossy(), "width": width, "height": height })))?;
                 }
-                None => stdout_line(format_args!(
-                    "{}",
-                    serde_json::json!({ "image": "png", "width": width, "height": height, "bytes": data.len(), "hint": "pass --out file.png to save it" })
-                ))?,
+                None => stdout_line(format_args!("{}", png_summary(&data, width, height)))?,
             },
         }
     }
     Ok(())
 }
 
+/// What a PNG result is reported as when it isn't written to a file.
+fn png_summary(data: &[u8], width: u32, height: u32) -> serde_json::Value {
+    serde_json::json!({ "image": "png", "width": width, "height": height, "bytes": data.len(), "hint": "pass --out file.png to save it" })
+}
+
+/// A tool's result as JSON values, for the `--report` of a script. Same content as
+/// [`print_output`], collected instead of printed.
+fn output_values(
+    auto: &pdfcraft_automation::Automation,
+    content: Vec<pdfcraft_automation::Content>,
+    out: Option<&str>,
+) -> Result<Vec<serde_json::Value>, String> {
+    let mut values = Vec::new();
+    for c in content {
+        values.push(match c {
+            pdfcraft_automation::Content::Json(v) => v,
+            pdfcraft_automation::Content::Png { data, width, height } => match out {
+                Some(path) => {
+                    let written = auto.write_output(path, &data).map_err(|e| e.to_string())?;
+                    serde_json::json!({ "image": written.to_string_lossy(), "width": width, "height": height })
+                }
+                None => png_summary(&data, width, height),
+            },
+        });
+    }
+    Ok(values)
+}
+
+/// Run a script and print one JSON document: per step its number, tool and `ok`/`error`/`skipped`
+/// with the result or the message. The first failing step ends the run, as without `--report`;
+/// the steps after it are listed as skipped and the exit status is the same.
+fn run_script_report(auto: &mut pdfcraft_automation::Automation, steps: &[serde_json::Value]) -> Result<(), CliError> {
+    let mut report = Vec::with_capacity(steps.len());
+    let mut failure: Option<String> = None;
+    for (i, step) in steps.iter().enumerate() {
+        let n = i + 1;
+        let tool = step["tool"].as_str();
+        if failure.is_some() {
+            report.push(serde_json::json!({ "step": n, "tool": tool, "status": "skipped" }));
+            continue;
+        }
+        let outcome = match tool {
+            None => Err(format!("step {n}: missing \"tool\"")),
+            Some(t) => auto
+                .call(t, &step["args"])
+                .map_err(|e| e.to_string())
+                .and_then(|content| output_values(auto, content, step["out"].as_str()))
+                .map_err(|e| format!("step {n} ({t}): {e}")),
+        };
+        match outcome {
+            Ok(result) => report.push(serde_json::json!({ "step": n, "tool": tool, "status": "ok", "result": result })),
+            Err(message) => {
+                report.push(serde_json::json!({ "step": n, "tool": tool, "status": "error", "error": message }));
+                failure = Some(message);
+            }
+        }
+    }
+    let document = serde_json::json!({ "ok": failure.is_none(), "steps": report });
+    stdout_line(format_args!("{}", serde_json::to_string_pretty(&document).unwrap_or_default()))?;
+    failure.map_or(Ok(()), |message| Err(CliError::Message(message)))
+}
+
 fn run(args: &[String]) -> Result<(), CliError> {
     validate_options("run", args, RUN_OPTIONS)?;
+    let report = args.iter().any(|a| a == "--report");
+    if report && flag(args, "--script").is_none() {
+        return Err("run: --report needs --script".to_string().into());
+    }
     let mut auto = automation(args)?;
     if let Some(script) = flag(args, "--script") {
         let text = std::fs::read_to_string(script).map_err(|e| format!("{script}: {e}"))?;
         let steps: Vec<serde_json::Value> = serde_json::from_str(&text).map_err(|e| format!("{script}: {e}"))?;
+        if report {
+            return run_script_report(&mut auto, &steps);
+        }
         for (i, step) in steps.iter().enumerate() {
             let tool = step["tool"].as_str().ok_or(format!("step {}: missing \"tool\"", i + 1))?;
             let content = auto.call(tool, &step["args"]).map_err(|e| format!("step {} ({tool}): {e}", i + 1))?;
@@ -794,11 +909,42 @@ fn run(args: &[String]) -> Result<(), CliError> {
     print_output(&auto, content, flag(args, "--out"))
 }
 
+/// Take `--automation-read-root` / `--automation-write-root` (each `--flag DIR` or `--flag=DIR`,
+/// once) out of `args`, and open the roots, which must be existing folders. Returns the arguments
+/// that are left. A malformed root flag is an error, never a root silently left out.
+#[cfg(feature = "mcp")]
+fn automation_roots(command: &str, args: &[String]) -> Result<(Option<Arc<pdfcraft_automation::file_access::AutomationRoots>>, Vec<String>), String> {
+    let mut found = automation_args::AutomationArgs::new(None, None);
+    let mut left = Vec::new();
+    let mut it = args.iter().cloned();
+    while let Some(arg) = it.next() {
+        if !found.consume(&arg, &mut it).map_err(|e| format!("{command}: {e}"))? {
+            left.push(arg);
+        }
+    }
+    let roots = pdfcraft_automation::file_access::AutomationRoots::new(found.read_root.as_deref(), found.write_root.as_deref())
+        .map_err(|e| format!("{command}: {e}"))?;
+    Ok((roots, left))
+}
+
 #[cfg(feature = "mcp")]
 fn mcp(args: &[String]) -> Result<(), CliError> {
+    let (roots, args) = automation_roots("mcp", args)?;
+    let args = args.as_slice();
     validate_options("mcp", args, MCP_OPTIONS)?;
     let compact = args.iter().any(|a| a == "--compact");
-    let mut server = pdfcraft_automation::mcp::McpServer::new(automation(args)?).with_compact(compact);
+    let mut auto = automation(args)?;
+    if let Some(roots) = roots {
+        let show = |root: Option<&Path>| root.map_or_else(|| "none".to_string(), |r| r.display().to_string());
+        let _ = writeln!(
+            std::io::stderr().lock(),
+            "pdfcraft-cli: files confined: read root {}, write root {}",
+            show(roots.read_root()),
+            show(roots.write_root())
+        );
+        auto = auto.with_automation_roots(Some(roots));
+    }
+    let mut server = pdfcraft_automation::mcp::McpServer::new(auto).with_compact(compact);
     let _ = writeln!(
         std::io::stderr().lock(),
         "pdfcraft-cli: MCP server on stdio (protocol {}{}); close stdin to stop",
diff --git a/apps/pdfcraft-cli/tests/audit.rs b/apps/pdfcraft-cli/tests/audit.rs
new file mode 100644
index 000000000..eb99fa11d
--- /dev/null
+++ b/apps/pdfcraft-cli/tests/audit.rs
@@ -0,0 +1,66 @@
+//! `audit` reports the rectangles of faux redactions where `doc_audit_redactions` does: in
+//! points from the top-left of the page as displayed, after `/Rotate`.
+
+use std::process::Command;
+
+const BIN: &str = env!("CARGO_BIN_EXE_pdfcraft-cli");
+
+/// Two US Letter pages with "TOP SECRET" under an opaque `90 688 220 32 re`; the second page is
+/// turned a quarter (`/Rotate 90`).
+fn fixture() -> Vec<u8> {
+    let body = "BT /F1 24 Tf 100 700 Td (TOP SECRET) Tj ET\n0 g\n90 688 220 32 re f";
+    let objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R >>".into(),
+        "<< /Type /Pages /Kids [4 0 R 5 0 R] /Count 2 /MediaBox [0 0 612 792] >>".into(),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Contents 6 0 R /Resources << /Font << /F1 3 0 R >> >> >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Rotate 90 /Contents 6 0 R /Resources << /Font << /F1 3 0 R >> >> >>".into(),
+        format!("<< /Length {} >>\nstream\n{body}\nendstream", body.len()),
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    out
+}
+
+/// The `rect` of each finding, in page order.
+fn rects(report: &serde_json::Value) -> Vec<serde_json::Value> {
+    report["findings"].as_array().expect("findings").iter().map(|f| f["rect"].clone()).collect()
+}
+
+#[test]
+fn audit_rectangles_match_the_tool_in_top_left_points() {
+    let dir = std::env::temp_dir().join(format!("pdfcraft-cli-audit-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    std::fs::write(dir.join("faux.pdf"), fixture()).unwrap();
+
+    let out = Command::new(BIN).arg("audit").arg(dir.join("faux.pdf")).output().unwrap();
+    assert!(!out.status.success(), "findings must fail the audit");
+    let cli: serde_json::Value = serde_json::from_slice(&out.stdout).unwrap();
+    assert_eq!(cli["count"], 2, "{cli}");
+    // Page 1 upright: y measured down from the top of the 792 pt page. Page 2 turned a quarter
+    // clockwise: 792 pt wide, and the cover's user-space y becomes its x.
+    let expected = [serde_json::json!([90.0, 72.0, 310.0, 104.0]), serde_json::json!([688.0, 90.0, 720.0, 310.0])];
+    assert_eq!(rects(&cli), expected, "{cli}");
+
+    // The tool reports the same rectangles.
+    let steps = serde_json::json!([
+        { "tool": "doc_open", "args": { "path": "faux.pdf" } },
+        { "tool": "doc_audit_redactions", "args": { "doc": 1 } },
+    ]);
+    std::fs::write(dir.join("steps.json"), steps.to_string()).unwrap();
+    let out = Command::new(BIN).arg("run").arg("--script").arg(dir.join("steps.json")).arg("--root").arg(&dir).output().unwrap();
+    assert!(out.status.success(), "{}", String::from_utf8_lossy(&out.stderr));
+    let stdout = String::from_utf8_lossy(&out.stdout);
+    let tool = serde_json::Deserializer::from_str(&stdout).into_iter::<serde_json::Value>().last().unwrap().unwrap();
+    assert_eq!(rects(&tool), rects(&cli), "{tool}");
+}
diff --git a/apps/pdfcraft-cli/tests/automation_roots.rs b/apps/pdfcraft-cli/tests/automation_roots.rs
new file mode 100644
index 000000000..162d79baf
--- /dev/null
+++ b/apps/pdfcraft-cli/tests/automation_roots.rs
@@ -0,0 +1,123 @@
+//! `pdfcraft-cli mcp --automation-read-root DIR --automation-write-root DIR`, on the real binary:
+//! both spellings of the flags confine the server, and a malformed flag stops it instead of
+//! leaving it unconfined.
+#![cfg(feature = "mcp")]
+
+use std::io::Write as _;
+use std::path::{Path, PathBuf};
+use std::process::{Command, Output, Stdio};
+
+use serde_json::{Value, json};
+
+const BIN: &str = env!("CARGO_BIN_EXE_pdfcraft-cli");
+
+/// `in/a.pdf` and `outside/secret.pdf`, blank one-page PDFs made by the binary itself.
+fn folders(tag: &str) -> PathBuf {
+    let base = std::env::temp_dir().join(format!("pdfcraft-cli-roots-{tag}-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&base);
+    for d in ["in", "out", "outside"] {
+        std::fs::create_dir_all(base.join(d)).unwrap();
+    }
+    for f in ["in/a.pdf", "outside/secret.pdf"] {
+        let script = json!([
+            {"tool": "doc_create", "args": {"from": "blank", "pages": 1, "width": 100, "height": 100}},
+            {"tool": "doc_save", "args": {"doc": 1, "path": f}},
+        ]);
+        std::fs::write(base.join("steps.json"), script.to_string()).unwrap();
+        let out = Command::new(BIN).args(["run", "--script"]).arg(base.join("steps.json")).arg("--root").arg(&base).output().unwrap();
+        assert!(out.status.success(), "{}", String::from_utf8_lossy(&out.stderr));
+    }
+    base
+}
+
+/// Run `mcp <flags>`, send `calls` as `tools/call` requests and return the replies.
+fn session(flags: &[String], calls: &[(&str, Value)]) -> (Vec<Value>, String) {
+    let mut child = Command::new(BIN).arg("mcp").args(flags).stdin(Stdio::piped()).stdout(Stdio::piped()).stderr(Stdio::piped()).spawn().unwrap();
+    let mut input = String::from("{\"jsonrpc\":\"2.0\",\"id\":0,\"method\":\"initialize\",\"params\":{}}\n");
+    for (i, (name, args)) in calls.iter().enumerate() {
+        let r = json!({"jsonrpc": "2.0", "id": i + 1, "method": "tools/call", "params": {"name": name, "arguments": args}});
+        input.push_str(&format!("{r}\n"));
+    }
+    child.stdin.take().unwrap().write_all(input.as_bytes()).unwrap();
+    let out = child.wait_with_output().unwrap();
+    assert!(out.status.success());
+    let replies = String::from_utf8(out.stdout).unwrap().lines().skip(1).map(|l| serde_json::from_str(l).unwrap()).collect();
+    (replies, String::from_utf8(out.stderr).unwrap())
+}
+
+fn s(p: &Path) -> String {
+    p.to_string_lossy().into_owned()
+}
+
+fn flags(spelling: &str, base: &Path) -> Vec<String> {
+    let (r, w) = (s(&base.join("in")), s(&base.join("out")));
+    if spelling == "equals" {
+        vec![format!("--automation-read-root={r}"), format!("--automation-write-root={w}")]
+    } else {
+        vec!["--automation-read-root".into(), r, "--automation-write-root".into(), w]
+    }
+}
+
+fn text(reply: &Value) -> String {
+    reply["result"]["content"][0]["text"].as_str().unwrap_or_default().to_owned()
+}
+
+#[test]
+fn both_spellings_confine_the_server() {
+    for spelling in ["equals", "separate"] {
+        let base = folders(spelling);
+        let calls = [
+            ("doc_open", json!({"path": s(&base.join("in/a.pdf"))})),
+            ("doc_open", json!({"path": s(&base.join("outside/secret.pdf"))})),
+            ("doc_save", json!({"doc": 1, "path": s(&base.join("out/copy.pdf"))})),
+            ("doc_save", json!({"doc": 1, "path": s(&base.join("outside/copy.pdf"))})),
+        ];
+        let (replies, stderr) = session(&flags(spelling, &base), &calls);
+        assert_eq!(replies[0]["result"]["isError"], false, "{spelling}: {replies:?}");
+        assert!(text(&replies[1]).contains("automation path rejected: outside the read root"), "{spelling}: {replies:?}");
+        assert_eq!(replies[2]["result"]["isError"], false, "{spelling}: {replies:?}");
+        assert!(text(&replies[3]).contains("automation path rejected: outside the write root"), "{spelling}: {replies:?}");
+        assert!(base.join("out/copy.pdf").is_file() && !base.join("outside/copy.pdf").exists());
+        assert!(stderr.contains("files confined: read root") && stderr.contains("write root"), "{stderr}");
+    }
+}
+
+#[test]
+fn a_root_left_out_grants_none_of_its_access() {
+    let base = folders("one");
+    let read_only = vec!["--automation-read-root".to_string(), s(&base.join("in"))];
+    let calls = [("doc_open", json!({"path": s(&base.join("in/a.pdf"))})), ("doc_save", json!({"doc": 1, "path": s(&base.join("out/x.pdf"))}))];
+    let (replies, _) = session(&read_only, &calls);
+    assert_eq!(replies[0]["result"]["isError"], false);
+    assert!(text(&replies[1]).contains("write authority is absent"), "{replies:?}");
+    assert!(!base.join("out/x.pdf").exists());
+}
+
+#[test]
+fn no_flags_means_no_confinement() {
+    let base = folders("none");
+    let (replies, stderr) = session(&[], &[("doc_open", json!({"path": s(&base.join("outside/secret.pdf"))}))]);
+    assert_eq!(replies[0]["result"]["isError"], false);
+    assert!(!stderr.contains("confined"), "{stderr}");
+}
+
+fn fails(args: &[&str]) -> String {
+    let out: Output = Command::new(BIN).arg("mcp").args(args).stdin(Stdio::null()).output().unwrap();
+    assert_eq!(out.status.code(), Some(1), "{args:?} should fail");
+    assert!(out.stdout.is_empty(), "{args:?} must not start a server");
+    String::from_utf8(out.stderr).unwrap()
+}
+
+#[test]
+fn malformed_flags_are_errors_not_a_missing_root() {
+    let dir = s(&std::env::temp_dir());
+    assert!(fails(&["--automation-read-root"]).contains("--automation-read-root needs a folder"));
+    assert!(fails(&["--automation-write-root", "--compact"]).contains("--automation-write-root needs a folder; use --automation-write-root=<dir>"));
+    assert!(fails(&["--automation-read-root="]).contains("--automation-read-root needs a non-empty folder"));
+    assert!(fails(&["--automation-read-root", &dir, "--automation-read-root", &dir]).contains("--automation-read-root given twice"));
+    assert!(fails(&["--automation-write-root", &dir, &format!("--automation-write-root={dir}")]).contains("--automation-write-root given twice"));
+    let missing = fails(&["--automation-read-root", "/definitely/not/a/folder"]);
+    assert!(missing.contains("mcp: cannot open the automation read root"), "{missing}");
+    let file = std::env::current_exe().unwrap();
+    assert!(fails(&["--automation-write-root", &s(&file)]).contains("cannot open the automation write root"));
+}
diff --git a/apps/pdfcraft-cli/tests/edit.rs b/apps/pdfcraft-cli/tests/edit.rs
index c9a5e7e2b..b35b71ddd 100644
--- a/apps/pdfcraft-cli/tests/edit.rs
+++ b/apps/pdfcraft-cli/tests/edit.rs
@@ -92,6 +92,20 @@ fn the_documented_options_still_edit_and_save() {
     }
 }
 
+/// `--out` naming the input replaces it through a staging file (#2166): the result is the
+/// edited, reopenable file, and nothing is left beside it.
+#[test]
+fn editing_in_place_leaves_a_valid_file_and_no_staging_file() {
+    let input = tmp("in-place", "doc.pdf");
+    std::fs::write(&input, fixture()).unwrap();
+    let out = Command::new(BIN).args(["edit", input.to_str().unwrap(), "--out", input.to_str().unwrap(), "--rotate", "1:90"]).output().unwrap();
+    assert!(out.status.success(), "{}", String::from_utf8_lossy(&out.stderr));
+    assert_eq!(first_page_rotation(&input), 90);
+    let names: Vec<String> =
+        std::fs::read_dir(input.parent().unwrap()).unwrap().map(|e| e.unwrap().file_name().to_string_lossy().into_owned()).collect();
+    assert_eq!(names, ["doc.pdf"], "no staging file beside the result");
+}
+
 mod one_based_arguments {
     use super::*;
     use std::sync::atomic::{AtomicU64, Ordering};
@@ -225,6 +239,102 @@ fn the_append_destination_and_counts_grown_by_earlier_edits_are_accepted() {
     }
 }
 
+/// Two pages whose catalog points at a page tree object the file does not have (#1656). The
+/// reader finds the pages by scanning, in file order, so `edit` must work on the same pages.
+/// Object 3 is written before object 2, so file order and object numbers disagree.
+fn fixture_without_page_tree() -> Vec<u8> {
+    let stream = |content: &str| format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len()).into_bytes();
+    let objs: Vec<(usize, Vec<u8>)> = vec![
+        (1, b"<< /Type /Catalog /Pages 6 0 R >>".to_vec()),
+        (3, b"<< /Type /Page /Parent 6 0 R /MediaBox [0 0 200 300] /Contents 4 0 R >>".to_vec()),
+        (2, b"<< /Type /Page /Parent 6 0 R /MediaBox [0 0 300 200] /Contents 5 0 R >>".to_vec()),
+        (4, stream("0 0 m 10 10 l S")),
+        (5, stream("0 0 m 20 20 l S")),
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = vec![0; objs.len()];
+    for (num, o) in &objs {
+        offsets[num - 1] = out.len();
+        out.extend_from_slice(format!("{num} 0 obj\n").as_bytes());
+        out.extend_from_slice(o);
+        out.extend_from_slice(b"\nendobj\n");
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    out
+}
+
+#[test]
+fn a_document_whose_page_tree_is_missing_edits_the_pages_the_reader_shows() {
+    let input = tmp("no-page-tree", "in.pdf");
+    std::fs::write(&input, fixture_without_page_tree()).unwrap();
+    let before = pdfcraft_render::inspect(std::sync::Arc::new(fixture_without_page_tree()), None).unwrap();
+    assert_eq!(before.pages.iter().map(|p| (p.width, p.height)).collect::<Vec<_>>(), [(200.0, 300.0), (300.0, 200.0)]);
+    for (name, args, expected) in [
+        // Width and height are as displayed: the turned page reads 200 x 300.
+        ("rotate.pdf", ["--rotate", "2:90"], &[(200.0, 300.0, 0), (200.0, 300.0, 90)][..]),
+        ("delete.pdf", ["--delete", "1"], &[(300.0, 200.0, 0)][..]),
+    ] {
+        let output = tmp("no-page-tree", name);
+        let mut all = vec!["edit", input.to_str().unwrap(), "--out", output.to_str().unwrap()];
+        all.extend(args);
+        let out = Command::new(BIN).args(&all).output().unwrap();
+        assert!(out.status.success(), "{name}: {}", String::from_utf8_lossy(&out.stderr));
+        let info = pdfcraft_render::inspect(std::sync::Arc::new(std::fs::read(&output).unwrap()), None).unwrap();
+        let pages: Vec<_> = info.pages.iter().map(|p| (p.width, p.height, p.rotation)).collect();
+        assert_eq!(pages, expected, "{name}");
+    }
+}
+
+/// Like [`fixture_without_page_tree`], but the scanning reader shows different pages from the
+/// page objects: it skips the blank 200 x 200 page (no `/Contents`) and shows the Text
+/// annotation (which has `/Contents`) as a page. No page tree may be rebuilt from such a file.
+fn fixture_whose_scan_disagrees() -> Vec<u8> {
+    let stream = |content: &str| format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len()).into_bytes();
+    let objs: Vec<Vec<u8>> = vec![
+        b"<< /Type /Catalog /Pages 9 0 R >>".to_vec(),
+        b"<< /Type /Page /Parent 9 0 R /MediaBox [0 0 100 100] /Contents 5 0 R >>".to_vec(),
+        b"<< /Type /Page /Parent 9 0 R /MediaBox [0 0 200 200] >>".to_vec(),
+        b"<< /Type /Page /Parent 9 0 R /MediaBox [0 0 300 300] /Contents 6 0 R /Annots [7 0 R] >>".to_vec(),
+        stream("0 0 m 10 10 l S"),
+        stream("0 0 m 20 20 l S"),
+        b"<< /Type /Annot /Subtype /Text /Rect [10 10 30 30] /Contents (hello) >>".to_vec(),
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n", i + 1).as_bytes());
+        out.extend_from_slice(o);
+        out.extend_from_slice(b"\nendobj\n");
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    out
+}
+
+#[test]
+fn a_page_tree_is_not_rebuilt_when_the_reader_shows_other_pages() {
+    let input = tmp("scan-disagrees", "in.pdf");
+    std::fs::write(&input, fixture_whose_scan_disagrees()).unwrap();
+    let shown = pdfcraft_render::inspect(std::sync::Arc::new(fixture_whose_scan_disagrees()), None).unwrap();
+    assert_eq!(shown.pages.len(), 3);
+    assert!(shown.pages.iter().all(|p| p.width != 200.0), "the reader must not show the blank page");
+    let output = tmp("scan-disagrees", "out.pdf");
+    let out = Command::new(BIN).args(["edit", input.to_str().unwrap(), "--out", output.to_str().unwrap(), "--delete", "2"]).output().unwrap();
+    assert_eq!(out.status.code(), Some(1));
+    assert_eq!(String::from_utf8_lossy(&out.stderr), "pdfcraft-cli: the document's page tree lists no pages: the file is damaged\n");
+    assert!(!output.exists(), "no page may be deleted");
+}
+
 /// A page past the end names its own option and the page count left by the earlier options (#1550).
 #[test]
 fn a_page_past_the_end_after_earlier_edits_names_that_option() {
diff --git a/apps/pdfcraft-cli/tests/extract.rs b/apps/pdfcraft-cli/tests/extract.rs
new file mode 100644
index 000000000..25f1aabc2
--- /dev/null
+++ b/apps/pdfcraft-cli/tests/extract.rs
@@ -0,0 +1,129 @@
+//! `extract --pages`: single pages and ranges (#1923), and an out-of-range page named as the
+//! user typed it (1-based; it was off by one in 0.7.1).
+
+use std::path::PathBuf;
+use std::process::{Command, Output};
+
+const BIN: &str = env!("CARGO_BIN_EXE_pdfcraft-cli");
+
+/// A PDF with `n` empty 200×300 pt pages.
+fn fixture(n: usize) -> Vec<u8> {
+    let mut objs: Vec<Vec<u8>> = vec![b"<< /Type /Catalog /Pages 2 0 R >>".to_vec()];
+    let kids: Vec<String> = (0..n).map(|i| format!("{} 0 R", 3 + i)).collect();
+    objs.push(format!("<< /Type /Pages /Kids [{}] /Count {n} /MediaBox [0 0 200 300] >>", kids.join(" ")).into_bytes());
+    for _ in 0..n {
+        objs.push(b"<< /Type /Page /Parent 2 0 R >>".to_vec());
+    }
+    let mut out = b"%PDF-1.7
+"
+    .to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(
+            format!(
+                "{} 0 obj
+",
+                i + 1
+            )
+            .as_bytes(),
+        );
+        out.extend_from_slice(o);
+        out.extend_from_slice(
+            b"
+endobj
+",
+        );
+    }
+    let xref = out.len();
+    out.extend_from_slice(
+        format!(
+            "xref
+0 {}
+0000000000 65535 f 
+",
+            objs.len() + 1
+        )
+        .as_bytes(),
+    );
+    for o in offsets {
+        out.extend_from_slice(
+            format!(
+                "{o:010} 00000 n 
+"
+            )
+            .as_bytes(),
+        );
+    }
+    out.extend_from_slice(
+        format!(
+            "trailer
+<< /Size {} /Root 1 0 R >>
+startxref
+{xref}
+%%EOF
+",
+            objs.len() + 1
+        )
+        .as_bytes(),
+    );
+    out
+}
+
+/// A fresh directory holding `five.pdf` (5 pages).
+fn workdir(test: &str) -> PathBuf {
+    let d = std::env::temp_dir().join(format!("pdfcraft-cli-extract-{test}-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&d);
+    std::fs::create_dir_all(&d).unwrap();
+    std::fs::write(d.join("five.pdf"), fixture(5)).unwrap();
+    d
+}
+
+fn extract(dir: &std::path::Path, pages: &str) -> Output {
+    let out = dir.join(format!("out-{}.pdf", pages.replace(['-', ','], "_")));
+    Command::new(BIN).args(["extract", dir.join("five.pdf").to_str().unwrap(), "--pages", pages, "--out", out.to_str().unwrap()]).output().unwrap()
+}
+
+/// The page count `info` reports for the extracted file.
+fn pages_of(dir: &std::path::Path, pages: &str) -> usize {
+    let out = dir.join(format!("out-{}.pdf", pages.replace(['-', ','], "_")));
+    let info = Command::new(BIN).args(["info", out.to_str().unwrap()]).output().unwrap();
+    let text = String::from_utf8_lossy(&info.stdout);
+    let n = text.split("\"pages\":").nth(1).and_then(|s| s.trim().split(|c: char| !c.is_ascii_digit()).next()).unwrap_or("");
+    n.parse().unwrap_or_else(|_| panic!("no page count in {text}"))
+}
+
+#[test]
+fn pages_and_ranges_are_accepted_in_the_order_given() {
+    let dir = workdir("ranges");
+    for (pages, count) in [("1-3", 3), ("5,1-2", 3), ("2-2", 1), ("1,3,5", 3), (" 4 - 5 , 1 ", 3)] {
+        let out = extract(&dir, pages);
+        assert!(out.status.success(), "{pages:?}: {}", String::from_utf8_lossy(&out.stderr));
+        assert_eq!(pages_of(&dir, pages), count, "{pages:?}");
+    }
+}
+
+#[test]
+fn bad_pages_and_ranges_are_named_as_typed() {
+    let dir = workdir("bad");
+    for (pages, what) in [
+        ("3-1", "bad page range \"3-1\""),
+        ("0", "bad page number \"0\""),
+        ("1-x", "bad page number \"1-x\""),
+        ("2-", "bad page number \"2-\""),
+        ("1-9999999", "bad page range \"1-9999999\""),
+    ] {
+        let out = extract(&dir, pages);
+        assert!(!out.status.success(), "{pages:?} succeeded");
+        let stderr = String::from_utf8_lossy(&out.stderr);
+        assert!(stderr.contains(what), "{pages:?}: {stderr}");
+    }
+    // A page past the end is named as the user counts it (1-based), as a single page and as the
+    // first page a range reaches past the end.
+    for (pages, missing) in [("6", "page 6 does not exist"), ("9", "page 9 does not exist"), ("4-7", "page 6 does not exist")] {
+        let out = extract(&dir, pages);
+        assert!(!out.status.success(), "{pages:?} succeeded");
+        let stderr = String::from_utf8_lossy(&out.stderr);
+        assert!(stderr.contains(missing), "{pages:?}: {stderr}");
+    }
+}
diff --git a/apps/pdfcraft-cli/tests/run_report.rs b/apps/pdfcraft-cli/tests/run_report.rs
new file mode 100644
index 000000000..cf1e6b650
--- /dev/null
+++ b/apps/pdfcraft-cli/tests/run_report.rs
@@ -0,0 +1,71 @@
+//! `pdfcraft-cli run --script --report`: one JSON document for the whole run (#1891).
+
+use std::process::{Command, Output};
+
+fn run_script(test: &str, steps: &serde_json::Value, extra: &[&str]) -> Output {
+    let dir = std::env::temp_dir().join(format!("pdfcraft-cli-{test}-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).unwrap();
+    let script = dir.join("steps.json");
+    std::fs::write(&script, steps.to_string()).unwrap();
+    let out =
+        Command::new(env!("CARGO_BIN_EXE_pdfcraft-cli")).current_dir(&dir).arg("run").arg("--script").arg(&script).args(extra).output().unwrap();
+    let _ = std::fs::remove_dir_all(&dir);
+    out
+}
+
+fn blank() -> serde_json::Value {
+    serde_json::json!({ "tool": "doc_create", "args": { "from": "blank", "width": 100, "height": 100 } })
+}
+
+#[test]
+fn a_successful_run_is_one_document_with_a_result_per_step() {
+    let steps = serde_json::json!([blank(), { "tool": "page_render", "args": { "doc": 1, "page": 1, "dpi": 10 } }]);
+    let o = run_script("report-ok", &steps, &["--report"]);
+    assert!(o.status.success(), "{}", String::from_utf8_lossy(&o.stderr));
+    let report: serde_json::Value = serde_json::from_slice(&o.stdout).expect("stdout is one JSON document");
+    assert_eq!(report["ok"], true);
+    let steps = report["steps"].as_array().unwrap();
+    assert_eq!(steps.len(), 2);
+    assert_eq!((steps[0]["step"].clone(), steps[0]["tool"].clone(), steps[0]["status"].clone()), (1.into(), "doc_create".into(), "ok".into()));
+    assert_eq!(steps[1]["result"][0]["image"], "png", "an image with no `out` is summarised: {report}");
+}
+
+#[test]
+fn a_failing_step_is_named_and_the_rest_are_skipped() {
+    let steps = serde_json::json!([blank(), { "tool": "page_rotate", "args": { "doc": 1, "pages": [999], "degrees": 90 } }, { "tool": "doc_close", "args": { "doc": 1 } }]);
+    let o = run_script("report-fail", &steps, &["--report"]);
+    assert_eq!(o.status.code(), Some(1), "exit status is unchanged");
+    let stderr = String::from_utf8_lossy(&o.stderr);
+    assert!(stderr.contains("step 2 (page_rotate)"), "{stderr}");
+    let report: serde_json::Value = serde_json::from_slice(&o.stdout).expect("stdout is one JSON document");
+    assert_eq!(report["ok"], false);
+    let steps = report["steps"].as_array().unwrap();
+    assert_eq!(steps.iter().map(|s| s["status"].as_str().unwrap()).collect::<Vec<_>>(), ["ok", "error", "skipped"]);
+    assert!(steps[1]["error"].as_str().unwrap().contains("step 2 (page_rotate)"), "{report}");
+    assert_eq!(steps[2]["tool"], "doc_close");
+}
+
+#[test]
+fn a_step_without_a_tool_is_an_error_step() {
+    let o = run_script("report-notool", &serde_json::json!([{ "args": {} }]), &["--report"]);
+    assert_eq!(o.status.code(), Some(1));
+    let report: serde_json::Value = serde_json::from_slice(&o.stdout).unwrap();
+    assert_eq!(report["steps"][0]["status"], "error");
+    assert!(report["steps"][0]["tool"].is_null());
+}
+
+#[test]
+fn without_the_flag_the_output_is_unchanged() {
+    let o = run_script("report-off", &serde_json::json!([blank()]), &[]);
+    assert!(o.status.success());
+    let stdout = String::from_utf8_lossy(&o.stdout);
+    assert!(!stdout.contains("\"steps\""), "{stdout}");
+}
+
+#[test]
+fn the_flag_needs_a_script() {
+    let o = Command::new(env!("CARGO_BIN_EXE_pdfcraft-cli")).args(["run", "doc_create", "--report"]).output().unwrap();
+    assert_eq!(o.status.code(), Some(1));
+    assert!(String::from_utf8_lossy(&o.stderr).contains("--report needs --script"));
+}
diff --git a/apps/pdfcraft/Cargo.toml b/apps/pdfcraft/Cargo.toml
index 4a185d1f9..a27401c70 100644
--- a/apps/pdfcraft/Cargo.toml
+++ b/apps/pdfcraft/Cargo.toml
@@ -29,6 +29,9 @@ log = { workspace = true }
 # crate registers the handler (Objective-C interop needs unsafe, which our workspace forbids)
 # behind a safe API. Same version as PhotoCraft. Pinned exactly: review the diff before bumping.
 fmv-macos-events = "=0.1.0"
+# ⌘Q asks about unsaved changes like the close button (#1136): an app menu whose Quit asks the
+# window to close instead of winit's, which ends the process without asking.
+craft-quit = { workspace = true, features = ["menu"] }
 
 [target.'cfg(target_os = "linux")'.dependencies]
 # Asks the Wayland compositor which GPU it draws with (linux-dmabuf feedback), so the window is
@@ -36,10 +39,19 @@ fmv-macos-events = "=0.1.0"
 wayland-client = "0.31"
 wayland-protocols = { version = "0.32", features = ["client"] }
 
+[target.'cfg(all(unix, not(target_os = "macos")))'.dependencies]
+# Whether the window is on Wayland, where it can't bring itself forward (src/single_instance.rs).
+# Already in the tree through winit and eframe.
+raw-window-handle = "0.6"
+
 [dev-dependencies]
 # Waits for wgpu's adapter, device and error-scope futures in tests (already in the tree through wgpu).
 pollster = "1.0"
 
+[target.'cfg(target_os = "linux")'.dev-dependencies]
+# Exercise the vendored Wayland scroll policy with the actual winit event type.
+winit = { version = "0.30", default-features = false, features = ["wayland"] }
+
 [target.'cfg(target_os = "windows")'.dependencies]
 # Which GPU drives which display (EnumDisplayDevices), so the window is drawn on the GPU that
 # shows it (issue #378). Safe wrappers over Win32; only the `user` feature (which brings `kernel` with it).
diff --git a/apps/pdfcraft/src/logging.rs b/apps/pdfcraft/src/logging.rs
index a62d300f6..71ed1d2d2 100644
--- a/apps/pdfcraft/src/logging.rs
+++ b/apps/pdfcraft/src/logging.rs
@@ -3,7 +3,7 @@
 //! Without a logger every `log::warn!`/`log::error!` in the workspace (a failed autosave, a page
 //! that would not render, a render worker that could not start, the panic hook's report) vanished.
 //! A launch from a desktop menu has no terminal, so the file is what a bug report can attach:
-//! `<settings dir>/logs/pdfcraft.log`, next to `app.ron` (see `settings_dir` in `main.rs`). Each
+//! `<data dir>/logs/pdfcraft.log` (the PdfCraft eframe storage directory, or portable data). Each
 //! start moves the previous log to `pdfcraft.1.log` (and that one to `.2`), so the log of a run
 //! that crashed survives the next launch.
 //!
diff --git a/apps/pdfcraft/src/main.rs b/apps/pdfcraft/src/main.rs
index a1d2ad998..7a0bb2043 100644
--- a/apps/pdfcraft/src/main.rs
+++ b/apps/pdfcraft/src/main.rs
@@ -37,6 +37,7 @@ mod logging;
 #[cfg(target_os = "windows")]
 mod motion;
 mod reopen;
+mod settings;
 mod single_instance;
 mod text_scale;
 mod updates;
@@ -57,14 +58,24 @@ const APP_ICON_PNG: &[u8] = include_bytes!("../../../assets/app-icon/hicolor/256
 /// The app was called PrintCraft before; settings saved then are under this key.
 const LEGACY_STORAGE_KEY: &str = "printcraft";
 
-/// The settings folder: `app.ron` and the `logs` folder (docs/development.md). In portable mode
-/// it is `PdfCraftData` beside the executable (#157). eframe would otherwise derive it from the
-/// app id; keep it under "PdfCraft".
+/// The preferences folder (`app.ron`, docs/development.md). In portable mode
+/// it is `PdfCraftData` beside the executable (#157). XDG desktops use the configuration base;
+/// other platforms retain eframe's PdfCraft folder. Logs and recovery stay in the data folder.
 fn settings_dir() -> Option<std::path::PathBuf> {
-    if let Some(dir) = pdfcraft_ui_egui::portable::data_dir() {
-        return Some(dir.to_path_buf());
+    let legacy = eframe::storage_dir("PdfCraft");
+    match settings::directory(
+        cfg!(all(unix, not(target_os = "macos"))),
+        pdfcraft_ui_egui::portable::data_dir(),
+        legacy.clone(),
+        std::env::var_os("XDG_CONFIG_HOME").map(std::path::PathBuf::from),
+        std::env::home_dir(),
+    ) {
+        Ok(dir) => dir,
+        Err(e) => {
+            log::warn!("could not migrate preferences to the XDG configuration folder; using the original location: {e}");
+            legacy
+        }
     }
-    eframe::storage_dir("PdfCraft")
 }
 
 /// Move the settings and crash-recovery folders of the app's former name, PrintCraft, to the new
@@ -75,7 +86,7 @@ fn migrate_legacy_folders() {
     if pdfcraft_ui_egui::portable::data_dir().is_some() {
         return;
     }
-    let mut moves = vec![(eframe::storage_dir("PrintCraft"), settings_dir())];
+    let mut moves = vec![(eframe::storage_dir("PrintCraft"), eframe::storage_dir("PdfCraft"))];
     // Recovery lives in the settings folder except on Windows, where it is under %LOCALAPPDATA%.
     if cfg!(windows) {
         let local = std::env::var_os("LOCALAPPDATA").filter(|v| !v.is_empty()).map(std::path::PathBuf::from);
@@ -203,19 +214,22 @@ fn main() -> eframe::Result {
     // GNOME on Wayland leaves the window frame to the app (src/decorations.rs).
     let window_controls = if cfg!(any(target_os = "macos", target_os = "windows")) { None } else { decorations::app_drawn() };
     migrate_legacy_folders();
-    // The log file lives in the settings folder; opened after the arguments (so `--version` leaves
+    // The log file stays in the data folder; opened after the arguments (so `--version` leaves
     // no file behind) and after the PrintCraft migration (which a fresh folder would block).
     // Records logged until now are written to it first.
-    if let (Some(logger), Some(dir)) = (logger, settings_dir()) {
+    if let (Some(logger), Some(dir)) =
+        (logger, pdfcraft_ui_egui::portable::data_dir().map(std::path::Path::to_path_buf).or_else(|| eframe::storage_dir("PdfCraft")))
+    {
         match logger.attach_dir(&dir.join("logs")) {
             Ok(path) => log::info!("PdfCraft {}, log file {}", pdfcraft_engine::build_info::version(), path.display()),
             // Standard error only by now (`attach_dir` gave up on the file); unlike `eprintln!`, never panics.
             Err(e) => log::warn!("no log file: {e}"),
         }
     }
-    // Windows: a launch that only names files (an Outlook attachment, an Explorer double-click)
-    // hands them to the PdfCraft already running and exits (#282, #317). Any option means the
-    // caller wants this launch's own window.
+    // Windows, Linux and the BSDs: a launch that only names files (an Outlook attachment, an
+    // Explorer double-click, a file manager or `xdg-open`) hands them to the PdfCraft already
+    // running and exits (#282, #317, #1726). Any option means the caller wants this launch's own
+    // window.
     let may_hand_off = !new_window && !files.is_empty() && options.is_empty() && control_file.is_none() && !create_images;
     let instance = match single_instance::claim(&single_instance::absolute(&files), may_hand_off) {
         single_instance::Claim::HandedOff => return Ok(()),
@@ -332,6 +346,18 @@ struct Launch {
     window_controls: Option<pdfcraft_ui_egui::window_controls::Layout>,
 }
 
+/// Whether the window is a native Wayland one (not X11 or XWayland).
+#[cfg(all(unix, not(target_os = "macos")))]
+fn native_wayland(cc: &eframe::CreationContext<'_>) -> bool {
+    use raw_window_handle::{HasDisplayHandle, RawDisplayHandle};
+    cc.display_handle().is_ok_and(|handle| matches!(handle.as_raw(), RawDisplayHandle::Wayland(_)))
+}
+
+#[cfg(not(all(unix, not(target_os = "macos"))))]
+fn native_wayland(_: &eframe::CreationContext<'_>) -> bool {
+    false
+}
+
 fn app_creator<'a>(
     launch: Launch,
     started: Rc<Cell<bool>>,
@@ -366,9 +392,14 @@ fn app_creator<'a>(
         #[cfg(target_os = "macos")]
         {
             app.os_events = Some(apple_events.connect(&cc.egui_ctx));
+            // winit's Quit (⌘Q) ends the process without asking about unsaved changes (#1136). This
+            // menu's Quit closes the window instead, so `guard_quit` asks, as for the close button.
+            if let Err(e) = craft_quit::install_app_menu(&cc.egui_ctx, "PdfCraft") {
+                log::warn!("couldn't install the app menu, so ⌘Q quits without asking to save: {e}");
+            }
         }
         if let Some(server) = instance {
-            app.os_events = Some(server.connect(&cc.egui_ctx));
+            app.os_events = Some(server.connect(&cc.egui_ctx, native_wayland(cc)));
         }
         if let Some(file) = &control_file {
             let client = app.attach_control(&cc.egui_ctx);
diff --git a/apps/pdfcraft/src/settings.rs b/apps/pdfcraft/src/settings.rs
new file mode 100644
index 000000000..950566a2e
--- /dev/null
+++ b/apps/pdfcraft/src/settings.rs
@@ -0,0 +1,194 @@
+//! Platform preference location, separate from logs and crash recovery.
+
+use std::path::{Path, PathBuf};
+use std::sync::atomic::{AtomicU64, Ordering};
+
+static STAGING_ID: AtomicU64 = AtomicU64::new(0);
+
+pub fn directory(
+    xdg: bool,
+    portable: Option<&Path>,
+    legacy: Option<PathBuf>,
+    config_home: Option<PathBuf>,
+    home: Option<PathBuf>,
+) -> std::io::Result<Option<PathBuf>> {
+    if let Some(portable) = portable {
+        return Ok(Some(portable.to_path_buf()));
+    }
+    if !xdg {
+        return Ok(legacy);
+    }
+    // XDG requires absolute environment paths; empty and relative overrides are ignored.
+    let preferred = config_home.filter(|p| p.is_absolute()).or_else(|| home.filter(|p| p.is_absolute()).map(|p| p.join(".config")));
+    let Some(preferred) = preferred.map(|p| p.join("pdfcraft")) else { return Ok(legacy) };
+    let target = preferred.join("app.ron");
+    if std::fs::symlink_metadata(&target).is_ok() {
+        return Ok(Some(preferred));
+    }
+    create_private_directory(&preferred)?;
+    if let Some(source) = legacy.map(|p| p.join("app.ron")) {
+        match std::fs::File::open(&source) {
+            Ok(mut source) => migrate(&mut source, &preferred, &target)?,
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
+            Err(e) => return Err(e),
+        }
+    }
+    Ok(Some(preferred))
+}
+
+/// Create private configuration directories without changing existing directory permissions.
+fn create_private_directory(directory: &Path) -> std::io::Result<()> {
+    let mut builder = std::fs::DirBuilder::new();
+    builder.recursive(true);
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::DirBuilderExt;
+        builder.mode(0o700);
+    }
+    builder.create(directory)
+}
+
+/// Publish a complete copy without replacing a concurrent launch's preferences. Keep the
+/// original file and all other data (especially recovery and digital IDs) where they were.
+fn migrate(source: &mut std::fs::File, directory: &Path, target: &Path) -> std::io::Result<()> {
+    create_private_directory(directory)?;
+    for _ in 0..32 {
+        let id = STAGING_ID.fetch_add(1, Ordering::Relaxed);
+        let staging = directory.join(format!(".app.ron-migrate-{}-{id}", std::process::id()));
+        let mut options = std::fs::OpenOptions::new();
+        options.write(true).create_new(true);
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::OpenOptionsExt;
+            options.mode(0o600);
+        }
+        let mut file = match options.open(&staging) {
+            Ok(file) => file,
+            Err(e) if e.kind() == std::io::ErrorKind::AlreadyExists => continue,
+            Err(e) => return Err(e),
+        };
+        let result = (|| {
+            std::io::copy(source, &mut file)?;
+            file.sync_all()?;
+            // Both files are in the same directory/filesystem. Unlike rename, hard_link
+            // atomically refuses an existing destination on Unix as well as Windows.
+            match std::fs::hard_link(&staging, target) {
+                Err(e) if e.kind() == std::io::ErrorKind::AlreadyExists => Ok(()),
+                result => result,
+            }
+        })();
+        drop(file);
+        let _ = std::fs::remove_file(&staging);
+        return result;
+    }
+    Err(std::io::Error::new(std::io::ErrorKind::AlreadyExists, "no free settings migration staging name"))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn xdg_preferences_use_config_instead_of_data() {
+        let fixture = Fixture::new();
+        let home = fixture.0.join("home");
+        let data = home.join(".local/share/pdfcraft");
+        assert_eq!(directory(true, None, Some(data), None, Some(home.clone())).unwrap(), Some(home.join(".config/pdfcraft")));
+    }
+
+    struct Fixture(PathBuf);
+    impl Fixture {
+        fn new() -> Self {
+            let id = STAGING_ID.fetch_add(1, Ordering::Relaxed);
+            let dir = std::env::temp_dir().join(format!("pdfcraft-settings-{}-{id}", std::process::id()));
+            std::fs::create_dir(&dir).unwrap();
+            Self(dir)
+        }
+    }
+    impl Drop for Fixture {
+        fn drop(&mut self) {
+            let _ = std::fs::remove_dir_all(&self.0);
+        }
+    }
+
+    #[test]
+    fn xdg_override_and_invalid_overrides() {
+        let f = Fixture::new();
+        let home = f.0.join("home");
+        let config = f.0.join("custom-config");
+        assert_eq!(directory(true, None, None, Some(config.clone()), Some(home.clone())).unwrap(), Some(config.join("pdfcraft")));
+        for invalid in [PathBuf::new(), PathBuf::from("relative")] {
+            assert_eq!(directory(true, None, None, Some(invalid), Some(home.clone())).unwrap(), Some(home.join(".config/pdfcraft")));
+        }
+        assert_eq!(directory(true, None, Some(f.0.clone()), None, None).unwrap(), Some(f.0.clone()));
+    }
+
+    #[test]
+    fn migration_preserves_preferences_and_other_data() {
+        let f = Fixture::new();
+        let data = f.0.join("data/pdfcraft");
+        let config = f.0.join("config");
+        std::fs::create_dir_all(data.join("recovery")).unwrap();
+        std::fs::write(data.join("app.ron"), b"(theme:Dark,language:German)").unwrap();
+        std::fs::write(data.join("recovery/unsaved.pdf"), b"UNSAVED").unwrap();
+        std::fs::write(data.join("digital-id.p12"), b"KEY").unwrap();
+        let selected = directory(true, None, Some(data.clone()), Some(config.clone()), None).unwrap().unwrap();
+        assert_eq!(selected, config.join("pdfcraft"));
+        assert_eq!(std::fs::read(selected.join("app.ron")).unwrap(), std::fs::read(data.join("app.ron")).unwrap());
+        assert_eq!(std::fs::read(data.join("recovery/unsaved.pdf")).unwrap(), b"UNSAVED");
+        assert_eq!(std::fs::read(data.join("digital-id.p12")).unwrap(), b"KEY");
+        // The migrated file is a copy, not a link to the original settings.
+        std::fs::write(selected.join("app.ron"), b"NEW").unwrap();
+        assert_eq!(std::fs::read(data.join("app.ron")).unwrap(), b"(theme:Dark,language:German)");
+        assert_eq!(directory(true, None, Some(data), Some(config), None).unwrap(), Some(selected.clone()));
+        assert_eq!(std::fs::read(selected.join("app.ron")).unwrap(), b"NEW");
+        assert_eq!(std::fs::read_dir(selected).unwrap().count(), 1);
+    }
+
+    #[test]
+    fn existing_or_concurrently_created_preferences_are_never_replaced() {
+        let f = Fixture::new();
+        let source = f.0.join("old.ron");
+        let config = f.0.join("config/pdfcraft");
+        std::fs::write(&source, b"OLD").unwrap();
+        std::fs::create_dir_all(&config).unwrap();
+        let target = config.join("app.ron");
+        std::fs::write(&target, b"CURRENT").unwrap();
+        migrate(&mut std::fs::File::open(source).unwrap(), &config, &target).unwrap();
+        assert_eq!(std::fs::read(&target).unwrap(), b"CURRENT");
+        assert_eq!(std::fs::read_dir(config).unwrap().count(), 1);
+    }
+
+    #[test]
+    fn failed_migration_keeps_original_available() {
+        let f = Fixture::new();
+        std::fs::write(f.0.join("app.ron"), b"OLD").unwrap();
+        let blocked = f.0.join("blocked");
+        std::fs::write(&blocked, b"NOT A DIRECTORY").unwrap();
+        assert!(directory(true, None, Some(f.0.clone()), Some(blocked), None).is_err());
+        assert_eq!(std::fs::read(f.0.join("app.ron")).unwrap(), b"OLD");
+    }
+
+    #[test]
+    fn portable_and_non_xdg_platforms_keep_their_locations() {
+        let f = Fixture::new();
+        let portable = f.0.join("PdfCraftData");
+        for xdg in [true, false] {
+            assert_eq!(directory(xdg, Some(&portable), Some(f.0.clone()), Some(f.0.clone()), None).unwrap(), Some(portable.clone()));
+        }
+        assert_eq!(directory(false, None, Some(f.0.clone()), Some(portable), None).unwrap(), Some(f.0.clone()));
+        assert_eq!(std::fs::read_dir(&f.0).unwrap().count(), 0, "no migration outside XDG mode");
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn new_config_directory_is_private_and_existing_permissions_are_preserved() {
+        use std::os::unix::fs::PermissionsExt;
+        let f = Fixture::new();
+        let selected = directory(true, None, None, Some(f.0.join("config")), None).unwrap().unwrap();
+        assert_eq!(std::fs::metadata(&selected).unwrap().permissions().mode() & 0o777, 0o700);
+        std::fs::set_permissions(&selected, std::fs::Permissions::from_mode(0o750)).unwrap();
+        create_private_directory(&selected).unwrap();
+        assert_eq!(std::fs::metadata(selected).unwrap().permissions().mode() & 0o777, 0o750);
+    }
+}
diff --git a/apps/pdfcraft/src/single_instance.rs b/apps/pdfcraft/src/single_instance.rs
index 9d15f5b26..ecfa12f5c 100644
--- a/apps/pdfcraft/src/single_instance.rs
+++ b/apps/pdfcraft/src/single_instance.rs
@@ -1,41 +1,50 @@
-//! One PdfCraft per Windows sign-in: a launch that only names files hands them to the PdfCraft
-//! that is already running, where they open as tabs, and exits (#282, #317).
+//! One PdfCraft per Windows sign-in or Linux/BSD display: a launch that only names files hands them
+//! to the PdfCraft that is already running, where they open as tabs, and exits (#282, #317, #1726).
 //!
-//! Outlook attachments, Explorer double-clicks and Open With all start `pdfcraft.exe "<file>"`, so
-//! until now every file got its own process and window. The first PdfCraft listens on a Unix
-//! domain socket (Windows 10 1803 and later) in `%LOCALAPPDATA%\PdfCraft`, or in the data folder of
-//! a portable copy. The socket is named after the Windows session (`instance-Console.sock`), so
-//! two sign-ins of the same user never open files in each other's windows, and it lives in the
-//! user's own profile, so other accounts can't create, replace or reach it: nobody else can
-//! intercept a launch or open files in this user's window. The exchange is one line each way, a
-//! JSON request naming absolute paths and `ok`, and the running app opens the paths exactly as
-//! File ▸ Open would.
+//! Outlook attachments, Explorer double-clicks and Open With all start `pdfcraft.exe "<file>"`, and
+//! a file manager or `xdg-open` starts `pdfcraft <file>` the same way, so until now every file got
+//! its own process and window. The first PdfCraft listens on a Unix domain socket. On Windows (10
+//! 1803 and later) it is in `%LOCALAPPDATA%\PdfCraft`, or in the data folder of a portable copy,
+//! and is named after the Windows session (`instance-Console.sock`), so two sign-ins of the same
+//! user never open files in each other's windows. On Linux and the BSDs it is in
+//! `$XDG_RUNTIME_DIR/pdfcraft` and is named after the display (`instance-wayland-0.sock`), so a
+//! launch on another display or seat opens its own window there. Either way it lives in a folder
+//! only the user can reach, so other accounts can't create, replace or reach it: nobody else can
+//! intercept a launch or open files in this user's window. Inside a Flatpak, `$XDG_RUNTIME_DIR` is
+//! the app's own and is shared by every run of it, so the handoff works there too. The exchange is
+//! one line each way, a JSON request naming absolute paths and `ok`, and the running app opens the
+//! paths exactly as File ▸ Open would.
 //!
 //! Every failure falls back to the old behaviour: a launch that can't hand its files over within
 //! a few seconds opens its own window. `--new-window`, any other option, or no files at all also
-//! starts a window of its own, as before. Other platforms keep their current behaviour (macOS
-//! already routes Finder opens to the running app through Apple events).
+//! starts a window of its own, as before. macOS keeps its current behaviour (it already routes
+//! Finder opens to the running app through Apple events).
 //!
-//! The socket comes from `uds_windows`, already in the lockfile through zbus: `std` has no Unix
-//! sockets on Windows, and calling Winsock directly would need `unsafe`, which the workspace
-//! forbids.
+//! On Windows the socket comes from `uds_windows`, already in the lockfile through zbus: `std` has
+//! no Unix sockets on Windows, and calling Winsock directly would need `unsafe`, which the
+//! workspace forbids.
 
 use std::sync::{Arc, Mutex, PoisonError};
-#[cfg(windows)]
+#[cfg(any(windows, all(unix, not(target_os = "macos"))))]
 use std::time::Duration;
 
+#[cfg(all(unix, not(target_os = "macos")))]
+use std::os::unix::net::{UnixListener, UnixStream};
+#[cfg(windows)]
+use uds_windows::{UnixListener, UnixStream};
+
 use pdfcraft_ui_egui::{OsEvent, OsEventsFn};
 
 /// Longest request read: one line of JSON, far longer than any real list of paths.
-#[cfg_attr(not(windows), allow(dead_code))]
+#[cfg_attr(not(any(windows, all(unix, not(target_os = "macos")))), allow(dead_code))]
 const MAX_REQUEST: u64 = 1 << 20;
 
 /// How long either side waits for the other before giving up.
-#[cfg(windows)]
+#[cfg(any(windows, all(unix, not(target_os = "macos"))))]
 const TIMEOUT: Duration = Duration::from_secs(5);
 
 /// What this launch should do.
-#[cfg_attr(not(windows), allow(dead_code))]
+#[cfg_attr(not(any(windows, all(unix, not(target_os = "macos")))), allow(dead_code))]
 pub enum Claim {
     /// The running PdfCraft took the files: exit without a window.
     HandedOff,
@@ -59,13 +68,13 @@ pub struct Server {
 }
 
 impl Server {
-    #[cfg_attr(not(windows), allow(dead_code))]
+    #[cfg_attr(not(any(windows, all(unix, not(target_os = "macos")))), allow(dead_code))]
     fn new() -> Self {
         Self { inbox: Arc::default() }
     }
 
     /// Queue files from another launch and wake the UI.
-    #[cfg_attr(not(windows), allow(dead_code))]
+    #[cfg_attr(not(any(windows, all(unix, not(target_os = "macos")))), allow(dead_code))]
     fn deliver(&self, paths: Vec<String>) {
         let mut inbox = self.inbox.lock().unwrap_or_else(PoisonError::into_inner);
         inbox.paths.extend(paths);
@@ -76,8 +85,10 @@ impl Server {
 
     /// The queue the UI drains every frame (`PdfCraftApp::os_events`). Files that arrived before
     /// the window existed are in the first batch. A batch also brings the window forward, as the
-    /// new window it replaces would have been.
-    pub fn connect(&self, ctx: &egui::Context) -> OsEventsFn {
+    /// new window it replaces would have been. A Wayland window can't bring itself forward (winit
+    /// ignores `Focus` there), so on `native_wayland` it asks for the user's attention instead,
+    /// which desktops show by highlighting it in the taskbar.
+    pub fn connect(&self, ctx: &egui::Context, native_wayland: bool) -> OsEventsFn {
         let wake = ctx.clone();
         self.inbox.lock().unwrap_or_else(PoisonError::into_inner).wake = Some(Box::new(move || wake.request_repaint()));
         let inbox = Arc::clone(&self.inbox);
@@ -89,13 +100,16 @@ impl Server {
             }
             ctx.send_viewport_cmd(egui::ViewportCommand::Minimized(false));
             ctx.send_viewport_cmd(egui::ViewportCommand::Focus);
+            if native_wayland {
+                ctx.send_viewport_cmd(egui::ViewportCommand::RequestUserAttention(egui::UserAttentionType::Informational));
+            }
             vec![OsEvent::Open(paths)]
         })
     }
 }
 
 /// The request a launch sends: `{"open":[…]}` and a newline.
-#[cfg_attr(not(windows), allow(dead_code))]
+#[cfg_attr(not(any(windows, all(unix, not(target_os = "macos")))), allow(dead_code))]
 pub fn request(paths: &[String]) -> String {
     let mut line = serde_json::json!({ "open": paths }).to_string();
     line.push('\n');
@@ -104,7 +118,7 @@ pub fn request(paths: &[String]) -> String {
 
 /// The paths a request names, or `None` when it isn't a request: anything but one JSON object
 /// whose `open` is a non-empty list of non-empty strings.
-#[cfg_attr(not(windows), allow(dead_code))]
+#[cfg_attr(not(any(windows, all(unix, not(target_os = "macos")))), allow(dead_code))]
 pub fn parse_request(line: &str) -> Option<Vec<String>> {
     let value: serde_json::Value = serde_json::from_str(line.trim_end()).ok()?;
     let open = value.get("open")?.as_array()?;
@@ -121,14 +135,14 @@ pub fn absolute(paths: &[String]) -> Vec<String> {
 /// Decide what this launch does. `files` are absolute ([`absolute`]); `may_hand_off` is false
 /// when the launch asked for anything besides opening files, so it gets its own window.
 pub fn claim(files: &[String], may_hand_off: bool) -> Claim {
-    #[cfg(windows)]
+    #[cfg(any(windows, all(unix, not(target_os = "macos"))))]
     {
         match socket_path() {
             Some(path) => claim_at(&path, files, may_hand_off),
             None => Claim::Alone,
         }
     }
-    #[cfg(not(windows))]
+    #[cfg(not(any(windows, all(unix, not(target_os = "macos")))))]
     {
         let _ = (files, may_hand_off);
         Claim::Alone
@@ -148,6 +162,28 @@ fn socket_path() -> Option<std::path::PathBuf> {
     std::env::var_os("LOCALAPPDATA").filter(|v| !v.is_empty()).map(|d| std::path::PathBuf::from(d).join("PdfCraft").join(name))
 }
 
+/// The socket in `$XDG_RUNTIME_DIR/pdfcraft`; none when `$XDG_RUNTIME_DIR` is unset. Never `/tmp`
+/// instead: other accounts can create files there, and so could listen in this user's place.
+#[cfg(all(unix, not(target_os = "macos")))]
+fn socket_path() -> Option<std::path::PathBuf> {
+    let var = |k: &str| std::env::var(k).ok().filter(|v| !v.is_empty());
+    let name = display_socket_name(var("WAYLAND_DISPLAY").or_else(|| var("DISPLAY")).as_deref());
+    // The XDG base directory spec makes it the user's own (mode 0700), so the folder inside it is
+    // out of other accounts' reach whatever the umask.
+    var("XDG_RUNTIME_DIR").map(|d| std::path::PathBuf::from(d).join("pdfcraft").join(name))
+}
+
+/// The socket's file name for a display (`WAYLAND_DISPLAY`, else `DISPLAY`): a launch opens its
+/// files on the display it was started on, never in a window on another seat, a nested
+/// compositor or a remote X display. Letters, digits, `-`, `_` and `.` are kept, and of those the
+/// last 32, where an absolute `WAYLAND_DISPLAY` (`/run/user/1000/wayland-1`) differs.
+#[cfg_attr(not(all(unix, not(target_os = "macos"))), allow(dead_code))]
+fn display_socket_name(display: Option<&str>) -> String {
+    let kept: Vec<char> = display.unwrap_or_default().chars().filter(|c| c.is_ascii_alphanumeric() || matches!(c, '-' | '_' | '.')).collect();
+    let display: String = kept.get(kept.len().saturating_sub(32)..).unwrap_or_default().iter().collect();
+    if display.is_empty() { "instance.sock".to_string() } else { format!("instance-{display}.sock") }
+}
+
 /// The socket's file name for a Windows session (`SESSIONNAME`: `Console`, `RDP-Tcp#3`…). The
 /// same user signed in twice (at the console and over Remote Desktop) gets one socket per session,
 /// so a file never opens in a window on the other screen. Only letters, digits and `-` are kept.
@@ -161,9 +197,9 @@ fn socket_name(session: Option<&str>) -> String {
 /// files selected in Explorer and opened at once) take turns: the first one is listening before
 /// the next one looks. Without it a launch could find the socket bound but not yet listening,
 /// fail to clear it ("Access is denied") and open a window of its own. The lock is on a file
-/// beside the socket, which is never deleted; Windows releases it when the process ends, however
-/// it ends. Best effort: without the lock the launch goes on as before.
-#[cfg(windows)]
+/// beside the socket, which is never deleted; the system releases it when the process ends,
+/// however it ends. Best effort: without the lock the launch goes on as before.
+#[cfg(any(windows, all(unix, not(target_os = "macos"))))]
 fn election(socket: &std::path::Path) -> Option<std::fs::File> {
     if let Some(dir) = socket.parent() {
         let _ = std::fs::create_dir_all(dir);
@@ -183,9 +219,8 @@ fn election(socket: &std::path::Path) -> Option<std::fs::File> {
 }
 
 /// [`claim`] with the socket at `path`.
-#[cfg(windows)]
+#[cfg(any(windows, all(unix, not(target_os = "macos"))))]
 fn claim_at(path: &std::path::Path, files: &[String], may_hand_off: bool) -> Claim {
-    use uds_windows::{UnixListener, UnixStream};
     // Released when this function returns: by then this launch listens, or has handed over.
     let _election = election(path);
     // Two launches can start together: the one that loses the race to bind hands over to the
@@ -241,8 +276,8 @@ fn claim_at(path: &std::path::Path, files: &[String], may_hand_off: bool) -> Cla
 }
 
 /// Send `files` over `stream` and wait for the running app's `ok`.
-#[cfg(windows)]
-fn hand_off(stream: &uds_windows::UnixStream, files: &[String]) -> std::io::Result<()> {
+#[cfg(any(windows, all(unix, not(target_os = "macos"))))]
+fn hand_off(stream: &UnixStream, files: &[String]) -> std::io::Result<()> {
     use std::io::{BufRead, Read, Write};
     stream.set_read_timeout(Some(TIMEOUT))?;
     stream.set_write_timeout(Some(TIMEOUT))?;
@@ -254,8 +289,8 @@ fn hand_off(stream: &uds_windows::UnixStream, files: &[String]) -> std::io::Resu
 }
 
 /// Accept launches on a background thread for as long as the process runs.
-#[cfg(windows)]
-fn serve(listener: uds_windows::UnixListener) -> Claim {
+#[cfg(any(windows, all(unix, not(target_os = "macos"))))]
+fn serve(listener: UnixListener) -> Claim {
     let server = Server::new();
     let inbox = Server { inbox: Arc::clone(&server.inbox) };
     let started = std::thread::Builder::new().name("single-instance".into()).spawn(move || {
@@ -278,8 +313,8 @@ fn serve(listener: uds_windows::UnixListener) -> Claim {
 }
 
 /// Read one launch's request, queue its files and confirm.
-#[cfg(windows)]
-fn receive(stream: &uds_windows::UnixStream, server: &Server) -> std::io::Result<()> {
+#[cfg(any(windows, all(unix, not(target_os = "macos"))))]
+fn receive(stream: &UnixStream, server: &Server) -> std::io::Result<()> {
     use std::io::{BufRead, Read, Write};
     stream.set_read_timeout(Some(TIMEOUT))?;
     stream.set_write_timeout(Some(TIMEOUT))?;
@@ -338,26 +373,40 @@ mod tests {
         // Before the window exists: queued, nothing to wake yet.
         server.deliver(vec!["a.pdf".into()]);
         let ctx = egui::Context::default();
-        let mut poll = server.connect(&ctx);
+        let mut poll = server.connect(&ctx, false);
         server.deliver(vec!["b.pdf".into()]);
         let events = poll();
         assert!(matches!(events.as_slice(), [OsEvent::Open(p)] if p == &["a.pdf", "b.pdf"]));
         assert!(poll().is_empty(), "each file is delivered once");
     }
 
-    #[cfg(windows)]
+    #[test]
+    fn each_display_gets_its_own_socket_name() {
+        assert_eq!(display_socket_name(Some("wayland-0")), "instance-wayland-0.sock");
+        assert_eq!(display_socket_name(Some(":0")), "instance-0.sock");
+        assert_ne!(display_socket_name(Some(":1.0")), display_socket_name(Some(":10")));
+        assert_ne!(display_socket_name(Some("wayland-0")), display_socket_name(Some("wayland-1")));
+        // An absolute WAYLAND_DISPLAY keeps the end of its path, where nested compositors differ.
+        let nested = display_socket_name(Some("/home/someone/.cache/nested-compositor/run/wayland-1"));
+        assert!(nested.ends_with("wayland-1.sock") && !nested.contains('/'), "{nested}");
+        assert_eq!(display_socket_name(Some("../../x/y")), "instance-....xy.sock", "never a path");
+        assert_eq!(display_socket_name(None), "instance.sock");
+        assert_eq!(display_socket_name(Some("")), "instance.sock");
+    }
+
+    #[cfg(any(windows, all(unix, not(target_os = "macos"))))]
     fn socket(test: &str) -> std::path::PathBuf {
         let dir = std::env::temp_dir().join(format!("pdfcraft-instance-{}-{test}", std::process::id()));
         let _ = std::fs::remove_dir_all(&dir);
         dir.join(socket_name(None))
     }
 
-    #[cfg(windows)]
+    #[cfg(any(windows, all(unix, not(target_os = "macos"))))]
     #[test]
     fn a_second_launch_hands_its_files_to_the_first() {
         let path = socket("hand-off");
         let Claim::Primary(first) = claim_at(&path, &[], true) else { panic!("the first launch listens") };
-        let mut poll = first.connect(&egui::Context::default());
+        let mut poll = first.connect(&egui::Context::default(), false);
         assert!(matches!(claim_at(&path, &["C:\\a.pdf".into()], true), Claim::HandedOff));
         assert!(matches!(poll().as_slice(), [OsEvent::Open(p)] if p == &["C:\\a.pdf"]));
         // A launch with options keeps its own window and doesn't take over the socket.
@@ -365,10 +414,10 @@ mod tests {
         assert!(poll().is_empty());
     }
 
-    #[cfg(windows)]
+    #[cfg(any(windows, all(unix, not(target_os = "macos"))))]
     #[test]
     fn launches_started_together_share_one_window() {
-        // Several files selected in Explorer and opened with Enter: one process per file, all at once.
+        // Several files selected in Explorer or a file manager and opened at once: one process per file.
         let path = socket("together");
         let barrier = Arc::new(std::sync::Barrier::new(8));
         let launches: Vec<_> = (0..8)
@@ -386,12 +435,12 @@ mod tests {
         assert_eq!(claims.iter().filter(|c| matches!(c, Claim::HandedOff)).count(), 7, "the rest hand over");
     }
 
-    #[cfg(windows)]
+    #[cfg(any(windows, all(unix, not(target_os = "macos"))))]
     #[test]
     fn a_socket_left_by_a_crashed_instance_is_replaced() {
         let path = socket("stale");
         // Bind and drop: the file stays, nobody listens.
-        drop(uds_windows::UnixListener::bind({
+        drop(UnixListener::bind({
             std::fs::create_dir_all(path.parent().unwrap()).unwrap();
             &path
         }));
diff --git a/apps/pdfcraft/tests/winit_macos_title_bar_drag.rs b/apps/pdfcraft/tests/winit_macos_title_bar_drag.rs
new file mode 100644
index 000000000..5422af59b
--- /dev/null
+++ b/apps/pdfcraft/tests/winit_macos_title_bar_drag.rs
@@ -0,0 +1,20 @@
+//! vendor/winit patch (12) (vendor/README.md).
+
+#[test]
+fn winit_lets_macos_title_bar_drags_reach_the_app() {
+    // On macOS the tab strip is the title bar: a transparent title bar over a full-size content
+    // view. NSView answers YES to `mouseDownCanMoveWindow` for a view that isn't opaque, so AppKit
+    // moved the whole window for a drag that began on a document tab, and tabs could not be
+    // reordered. vendor/winit answers with the window's `movable_by_window_background` (NO unless
+    // asked); the empty strip still moves the window through `ViewportCommand::StartDrag`. A
+    // re-vendored copy without the patch would silently bring the bug back: re-apply the patch, or
+    // drop the copy once winit has the fix.
+    let root = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../..");
+    let view = std::fs::read_to_string(root.join("vendor/winit/src/platform_impl/macos/view.rs")).unwrap();
+    let (_, method) = view.split_once("#[method(mouseDownCanMoveWindow)]").expect("a title-bar drag moves the window again");
+    let body = method.split_once("\n        }\n").map_or(method, |(body, _)| body);
+    assert!(body.contains("movable_by_window_background"), "mouseDownCanMoveWindow no longer follows the window's setting");
+    // The strip still moves the window itself, from its empty background.
+    let chrome = std::fs::read_to_string(root.join("crates/ui-egui/src/chrome.rs")).unwrap();
+    assert!(chrome.contains("ViewportCommand::StartDrag"), "the empty tab strip no longer moves the window");
+}
diff --git a/apps/pdfcraft/tests/winit_wayland_scroll.rs b/apps/pdfcraft/tests/winit_wayland_scroll.rs
new file mode 100644
index 000000000..ec76d2b4b
--- /dev/null
+++ b/apps/pdfcraft/tests/winit_wayland_scroll.rs
@@ -0,0 +1,76 @@
+#![cfg(target_os = "linux")]
+
+use egui::{Event, Modifiers, MouseWheelUnit, RawInput, TouchPhase, vec2};
+use wayland_client::protocol::wl_pointer::AxisSource;
+
+// Compile the production policy against winit's real event type, without a compositor.
+mod event {
+    pub use winit::event::TouchPhase;
+}
+#[path = "../../../vendor/winit/src/platform_impl/linux/wayland/seat/pointer/scroll.rs"]
+mod scroll;
+
+fn egui_phase(phase: event::TouchPhase) -> TouchPhase {
+    match phase {
+        event::TouchPhase::Started => TouchPhase::Start,
+        event::TouchPhase::Moved => TouchPhase::Move,
+        event::TouchPhase::Ended => TouchPhase::End,
+        event::TouchPhase::Cancelled => TouchPhase::Cancel,
+    }
+}
+
+fn wheel_trace(source: AxisSource, discrete: bool) -> Vec<(f32, egui::Vec2)> {
+    let ctx = egui::Context::default();
+    let mut previous = event::TouchPhase::Ended;
+    let mut seen = Vec::new();
+    let ctrl = Modifiers { ctrl: true, command: true, ..Modifiers::NONE };
+    for (frame, modifiers) in [ctrl, ctrl, Modifiers::NONE].into_iter().enumerate() {
+        let phase = scroll::phase(previous, Some(source), discrete, false);
+        previous = phase;
+        let (unit, dy) = if discrete { (MouseWheelUnit::Line, 1.0) } else { (MouseWheelUnit::Point, 24.0) };
+        let input = RawInput {
+            time: Some(frame as f64 / 60.0),
+            events: vec![Event::MouseWheel { unit, delta: vec2(0.0, dy), phase: egui_phase(phase), modifiers }],
+            ..Default::default()
+        };
+        ctx.run_ui(input, |ui| seen.push(ui.input(|i| (i.zoom_delta(), i.smooth_scroll_delta)))).textures_delta.clear();
+    }
+    seen
+}
+
+#[test]
+fn releasing_ctrl_after_pixel_wheel_zoom_returns_to_scrolling() {
+    for source in [AxisSource::Wheel, AxisSource::WheelTilt, AxisSource::Continuous] {
+        let seen = wheel_trace(source, false);
+        assert!(seen[1].0 > 1.0, "Ctrl must zoom: {source:?}");
+        assert_eq!(seen[2].0, 1.0, "releasing Ctrl must stop zooming: {source:?}");
+        assert!(seen[2].1.y > 0.0, "the next wheel event must scroll: {source:?}");
+    }
+}
+
+#[test]
+fn discrete_wheels_still_follow_current_modifiers() {
+    let seen = wheel_trace(AxisSource::Wheel, true);
+    assert!(seen[1].0 > 1.0);
+    assert_eq!(seen[2].0, 1.0);
+    assert!(seen[2].1.y > 0.0);
+}
+
+#[test]
+fn finger_gestures_keep_their_modifier_until_the_gesture_ends() {
+    // A finger scroll's momentum may arrive after Ctrl is released.
+    let seen = wheel_trace(AxisSource::Finger, false);
+    assert!(seen[1].0 > 1.0);
+    assert!(seen[2].0 > 1.0);
+    assert_eq!(seen[2].1, egui::Vec2::ZERO);
+    assert_eq!(scroll::phase(event::TouchPhase::Moved, Some(AxisSource::Finger), false, true), event::TouchPhase::Ended);
+    assert_eq!(scroll::phase(event::TouchPhase::Ended, Some(AxisSource::Finger), false, false), event::TouchPhase::Started);
+}
+
+#[test]
+fn unknown_sources_keep_the_existing_phase_policy() {
+    assert_eq!(scroll::phase(event::TouchPhase::Ended, None, false, false), event::TouchPhase::Started);
+    assert_eq!(scroll::phase(event::TouchPhase::Started, None, false, false), event::TouchPhase::Moved);
+    assert_eq!(scroll::phase(event::TouchPhase::Ended, None, true, false), event::TouchPhase::Moved);
+    assert_eq!(scroll::phase(event::TouchPhase::Moved, None, false, true), event::TouchPhase::Ended);
+}
diff --git a/contributors/people.toml b/contributors/people.toml
index aa8dd7a15..da3cfc6a7 100644
--- a/contributors/people.toml
+++ b/contributors/people.toml
@@ -25,6 +25,11 @@ real_name = "Brandon Thomas"
 display_name = "Brandon Thomas"
 sync_github_name = false
 
+[people.edurbs]
+real_name = "Eduardo Soares"
+display_name = "Eduardo Soares"
+sync_github_name = false
+
 [people.jcl-bit]
 real_name = "James Locke"
 display_name = "James Locke"
@@ -129,3 +134,14 @@ sync_github_name = false
 
 [people.webdevtodayjason]
 display_name = "Jason Brashear"
+
+[people.alexanderalber]
+real_name = "Alexander Alber"
+
+[people.mtlcl410]
+display_name = "mtlcl410"
+sync_github_name = false
+
+[people.Silvertree2010]
+display_name = "Netter"
+sync_github_name = false
diff --git a/crates/a11y/src/alt.rs b/crates/a11y/src/alt.rs
index 1f2035405..92a5ae8c2 100644
--- a/crates/a11y/src/alt.rs
+++ b/crates/a11y/src/alt.rs
@@ -27,6 +27,31 @@ pub enum AltError {
     Cos(#[from] pdfcraft_cos::CosError),
 }
 
+/// Why a structure tag cannot safely become an artifact.
+#[derive(Debug, thiserror::Error, PartialEq)]
+pub enum ArtifactError {
+    #[error("the document has no tags")]
+    Untagged,
+    #[error("object {0} is not a reachable indirect structure tag")]
+    NotATag(u32),
+    #[error("the tag has child structure elements; mark a leaf tag instead")]
+    HasChildren,
+    #[error("the tag has no direct marked content")]
+    NoMarkedContent,
+    #[error("the tag has no page")]
+    NoPage,
+    #[error("the tag's marked content was not found on its page")]
+    ContentNotFound,
+    #[error("the tag has no removable structure-tree parent")]
+    NoParent,
+    #[error("the parent must list the tag exactly once")]
+    AmbiguousParent,
+    #[error("couldn't update the parent tree: {0}")]
+    ParentTree(String),
+    #[error(transparent)]
+    Cos(#[from] pdfcraft_cos::CosError),
+}
+
 pub(crate) fn tree_root(doc: &Document) -> Option<Dict> {
     let cat = doc.root().and_then(|r| doc.get(r).as_dict().cloned())?;
     cat.get(b"StructTreeRoot").map(|o| doc.resolve(o)).and_then(|o| o.as_dict().cloned())
@@ -115,6 +140,22 @@ fn mcids(d: &Dict) -> Vec<i64> {
     out
 }
 
+/// The page's named property lists (`/Resources /Properties`), which a `BDC` can name instead of
+/// writing its property list inline.
+fn page_properties(doc: &Document, page: &Dict) -> Dict {
+    let res = page.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned()).unwrap_or_default();
+    res.get(b"Properties").map(|p| doc.resolve(p)).and_then(|p| p.as_dict().cloned()).unwrap_or_default()
+}
+
+/// The marked-content id a `BDC` opens, whether its property list is inline or named in `props`.
+fn bdc_mcid(doc: &Document, props: &Dict, op: &pdfcraft_content::Op) -> Option<i64> {
+    match op.operands.get(1)? {
+        Object::Dict(d) => d.get(b"MCID").and_then(Object::as_int),
+        Object::Name(n) => props.get(n).map(|x| doc.resolve(x)).and_then(|x| x.as_dict().and_then(|d| d.get(b"MCID").and_then(Object::as_int))),
+        _ => None,
+    }
+}
+
 pub(crate) fn page_content(doc: &Document, page: &Dict) -> Vec<u8> {
     let Some(c) = page.get(b"Contents") else { return Vec::new() };
     match &*doc.resolve(c) {
@@ -145,6 +186,7 @@ fn union(a: Option<[f64; 4]>, b: [f64; 4]) -> [f64; 4] {
 fn content_bbox(doc: &Document, page: &Dict, ids: &HashSet<i64>) -> Option<[f64; 4]> {
     let res = page.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned()).unwrap_or_default();
     let xobjects = res.get(b"XObject").map(|x| doc.resolve(x)).and_then(|x| x.as_dict().cloned()).unwrap_or_default();
+    let props = page_properties(doc, page);
     let mut ctm = vec![Matrix([1.0, 0.0, 0.0, 1.0, 0.0, 0.0])];
     let mut marks: Vec<bool> = Vec::new();
     let mut bbox = None;
@@ -165,9 +207,7 @@ fn content_bbox(doc: &Document, page: &Dict, ids: &HashSet<i64>) -> Option<[f64;
                 }
             }
             b"BMC" => marks.push(false),
-            b"BDC" => marks.push(
-                matches!(op.operands.get(1), Some(Object::Dict(d)) if d.get(b"MCID").and_then(Object::as_int).is_some_and(|n| ids.contains(&n))),
-            ),
+            b"BDC" => marks.push(bdc_mcid(doc, &props, &op).is_some_and(|n| ids.contains(&n))),
             b"EMC" => {
                 marks.pop();
             }
@@ -262,6 +302,72 @@ pub fn set_alt(doc: &mut Document, obj: ObjRef, alt: Option<&str>) -> Result<(),
     Ok(())
 }
 
+/// The page's content entries: one stream, or the elements of a contents array.
+fn content_entries(doc: &Document, page: &Dict) -> Option<Vec<Object>> {
+    let c = page.get(b"Contents")?;
+    Some(match &*doc.resolve(c) {
+        Object::Array(a) => a.clone(),
+        Object::Stream(_) => vec![c.clone()],
+        _ => return None,
+    })
+}
+
+fn marked(doc: &Document, props: &Dict, op: &pdfcraft_content::Op, ids: &HashSet<i64>) -> bool {
+    op.op == b"BDC" && bdc_mcid(doc, props, op).is_some_and(|n| ids.contains(&n))
+}
+
+/// Turn the figure's marked-content blocks into artifacts, rewriting only the streams that
+/// contain them. Other content streams, and unknown entries on a rewritten stream, stay.
+fn artifact_marked_content(doc: &mut Document, page: &pdfcraft_model::Page, ids: &HashSet<i64>) -> Result<bool, AltError> {
+    let Some(entries) = content_entries(doc, &page.dict) else { return Ok(false) };
+    let props = page_properties(doc, &page.dict);
+    let mut next = Vec::with_capacity(entries.len());
+    let mut changed = false;
+    for entry in entries {
+        let Some(stream) = (match &*doc.resolve(&entry) {
+            Object::Stream(s) => Some(s.clone()),
+            _ => None,
+        }) else {
+            next.push(entry);
+            continue;
+        };
+        let mut ops = pdfcraft_content::parse(&stream.decoded().unwrap_or_default()).ops;
+        let mut ours = false;
+        for op in &mut ops {
+            if marked(doc, &props, op, ids) {
+                *op = pdfcraft_content::Op::new("BMC", vec![Object::name("Artifact")]);
+                ours = true;
+            }
+        }
+        if !ours {
+            next.push(entry);
+            continue;
+        }
+        changed = true;
+        let mut dict = stream.dict;
+        dict.remove(b"Length");
+        dict.remove(b"Filter");
+        dict.remove(b"DecodeParms");
+        let stream = Object::Stream(Stream::flate(dict, &pdfcraft_content::serialize_ops(&ops)));
+        let stored = match entry {
+            Object::Ref(r) => {
+                doc.set(r, stream);
+                Object::Ref(r)
+            }
+            _ => Object::Ref(doc.add(stream)),
+        };
+        next.push(stored);
+    }
+    if changed {
+        let contents = match next.as_slice() {
+            [one] => one.clone(),
+            _ => Object::Array(next),
+        };
+        doc.update_dict(page.obj, |p| p.set(b"Contents".to_vec(), contents))?;
+    }
+    Ok(changed)
+}
+
 /// Decorative figure: its marked content on the page becomes an artifact, and the element
 /// leaves the structure tree (and the parent tree).
 pub fn mark_decorative(doc: &mut Document, obj: ObjRef) -> Result<(), AltError> {
@@ -269,24 +375,12 @@ pub fn mark_decorative(doc: &mut Document, obj: ObjRef) -> Result<(), AltError>
     let ids: HashSet<i64> = mcids(&d).into_iter().collect();
     let pages = pdfcraft_model::pages(doc);
     let pg = d.get(b"Pg").and_then(Object::as_ref).or_else(|| elements(doc).into_iter().find(|e| e.object == obj).and_then(|e| e.page));
-    if let Some(page) = pg.and_then(|p| pages.iter().find(|x| x.obj == p)).filter(|_| !ids.is_empty()) {
-        let mut ops = pdfcraft_content::parse(&page_content(doc, &page.dict)).ops;
-        let mut changed = false;
-        for op in ops.iter_mut() {
-            let ours = op.op == b"BDC"
-                && matches!(op.operands.get(1), Some(Object::Dict(m)) if m.get(b"MCID").and_then(Object::as_int).is_some_and(|n| ids.contains(&n)));
-            if ours {
-                *op = pdfcraft_content::Op::new("BMC", vec![Object::name("Artifact")]);
-                changed = true;
-            }
-        }
-        if changed {
-            let s = doc.add(Object::Stream(Stream::flate(Dict::new(), &pdfcraft_content::serialize_ops(&ops))));
-            doc.update_dict(page.obj, |p| p.set(b"Contents".to_vec(), Object::Ref(s)))?;
-            // The parent tree no longer points those ids at the figure.
-            if let Some(key) = page.dict.get(b"StructParents").and_then(Object::as_int) {
-                clear_parent_tree(doc, key, obj)?;
-            }
+    if let Some(page) = pg.and_then(|p| pages.iter().find(|x| x.obj == p)).filter(|_| !ids.is_empty())
+        && artifact_marked_content(doc, page, &ids)?
+    {
+        // The parent tree no longer points those ids at the figure.
+        if let Some(key) = page.dict.get(b"StructParents").and_then(Object::as_int) {
+            clear_parent_tree(doc, key, obj)?;
         }
     }
     // Out of its parent's kids.
@@ -305,17 +399,95 @@ pub fn mark_decorative(doc: &mut Document, obj: ObjRef) -> Result<(), AltError>
     Ok(())
 }
 
+/// Mark a leaf structure tag's directly owned marked content as an artifact.
+///
+/// This deliberately refuses a tag with child structure elements. Converting a parent would
+/// otherwise silently discard semantic descendants. The visible page content is preserved: each
+/// matching marked-content sequence changes from `BDC` with an MCID to `/Artifact BMC`.
+pub fn mark_tag_artifact(doc: &mut Document, obj: ObjRef) -> Result<(), ArtifactError> {
+    tree_root(doc).ok_or(ArtifactError::Untagged)?;
+    let elements = elements(doc);
+    let Some(element) = elements.iter().find(|e| e.object == obj) else { return Err(ArtifactError::NotATag(obj.num)) };
+    if has_child_structure(doc, &element.dict) {
+        return Err(ArtifactError::HasChildren);
+    }
+    let ids: HashSet<i64> = mcids(&element.dict).into_iter().collect();
+    if ids.is_empty() {
+        return Err(ArtifactError::NoMarkedContent);
+    }
+    let pages = pdfcraft_model::pages(doc);
+    let page_ref = element.page.ok_or(ArtifactError::NoPage)?;
+    let page = pages.iter().find(|page| page.obj == page_ref).ok_or(ArtifactError::NoPage)?;
+    let mut ops = pdfcraft_content::parse(&page_content(doc, &page.dict)).ops;
+    let mut found = HashSet::new();
+    for op in &mut ops {
+        let id = (op.op == b"BDC")
+            .then(|| match op.operands.get(1) {
+                Some(Object::Dict(mark)) => mark.get(b"MCID").and_then(Object::as_int),
+                _ => None,
+            })
+            .flatten()
+            .filter(|id| ids.contains(id));
+        if let Some(id) = id {
+            *op = pdfcraft_content::Op::new("BMC", vec![Object::name("Artifact")]);
+            found.insert(id);
+        }
+    }
+    if found != ids {
+        return Err(ArtifactError::ContentNotFound);
+    }
+    let stream = doc.add(Object::Stream(Stream::flate(Dict::new(), &pdfcraft_content::serialize_ops(&ops))));
+    doc.update_dict(page.obj, |p| p.set(b"Contents".to_vec(), Object::Ref(stream)))?;
+    if let Some(key) = page.dict.get(b"StructParents").and_then(Object::as_int) {
+        clear_parent_tree(doc, key, obj).map_err(|e| ArtifactError::ParentTree(e.to_string()))?;
+    }
+    let parent = element.dict.get(b"P").and_then(Object::as_ref).ok_or(ArtifactError::NoParent)?;
+    remove_from_parent(doc, parent, obj)?;
+    // Keep the retired object valid if another object holds an out-of-tree reference to it.
+    doc.update_dict(obj, |d| {
+        d.remove(b"P");
+    })?;
+    Ok(())
+}
+
+fn has_child_structure(doc: &Document, tag: &Dict) -> bool {
+    fn child(doc: &Document, item: &Object) -> bool {
+        match item {
+            Object::Array(items) => items.iter().any(|item| child(doc, item)),
+            Object::Ref(r) => doc.get(*r).as_dict().is_some_and(|d| d.contains(b"S")),
+            Object::Dict(d) => d.contains(b"S"),
+            _ => false,
+        }
+    }
+    tag.get(b"K").is_some_and(|items| child(doc, items))
+}
+
+fn remove_from_parent(doc: &mut Document, parent: ObjRef, obj: ObjRef) -> Result<(), ArtifactError> {
+    let kids = doc.get(parent).as_dict().and_then(|p| p.get(b"K").cloned()).ok_or(ArtifactError::NoParent)?;
+    let replacement = match kids {
+        Object::Array(items) => {
+            if items.iter().filter(|item| item.as_ref() == Some(obj)).count() != 1 {
+                return Err(ArtifactError::AmbiguousParent);
+            }
+            Object::Array(items.into_iter().filter(|item| item.as_ref() != Some(obj)).collect())
+        }
+        Object::Ref(r) if r == obj => Object::Array(Vec::new()),
+        _ => return Err(ArtifactError::NoParent),
+    };
+    doc.update_dict(parent, |p| p.set(b"K".to_vec(), replacement))?;
+    Ok(())
+}
+
 /// Replace `obj` by null in the page's parent-tree array (`key`), in a flat /Nums tree.
 fn clear_parent_tree(doc: &mut Document, key: i64, obj: ObjRef) -> Result<(), AltError> {
     let Some(pt) = tree_root(doc).and_then(|r| r.get(b"ParentTree").and_then(Object::as_ref)) else { return Ok(()) };
     let Some(nums) = doc.get(pt).as_dict().and_then(|d| d.get(b"Nums").and_then(|n| n.as_array().cloned())) else { return Ok(()) };
     let mut nums = nums;
-    for pair in nums.chunks_mut(2) {
-        if pair[0].as_int() == Some(key) {
-            match &pair[1] {
-                Object::Array(a) => {
-                    pair[1] = Object::Array(a.iter().map(|x| if x.as_ref() == Some(obj) { Object::Null } else { x.clone() }).collect())
-                }
+    // Whole pairs only: a trailing key without a value maps nothing, so it is left as it is.
+    for [k, v] in nums.as_chunks_mut::<2>().0 {
+        if k.as_int() == Some(key) {
+            match &*v {
+                Object::Array(a) => *v = Object::Array(a.iter().map(|x| if x.as_ref() == Some(obj) { Object::Null } else { x.clone() }).collect()),
                 Object::Ref(r) => {
                     if let Some(a) = doc.get(*r).as_array().cloned() {
                         let a: Vec<Object> = a.iter().map(|x| if x.as_ref() == Some(obj) { Object::Null } else { x.clone() }).collect();
diff --git a/crates/a11y/src/autotag_fields.rs b/crates/a11y/src/autotag_fields.rs
new file mode 100644
index 000000000..3203aca37
--- /dev/null
+++ b/crates/a11y/src/autotag_fields.rs
@@ -0,0 +1,138 @@
+//! Conservative tagging for AcroForm widgets.
+//!
+//! It creates `/Form` structure elements and `/OBJR` children so assistive technology can find
+//! widgets. An existing direct `/Document` root and direct `/ParentTree /Nums` are extended;
+//! unusual tree layouts are refused before any edit is made.
+
+use pdfcraft_cos::{Dict, Document, ObjRef, Object};
+
+fn reference(object: Option<&Object>, what: &str) -> Result<ObjRef, String> {
+    object.and_then(Object::as_ref).ok_or_else(|| format!("the {what} must be an indirect reference"))
+}
+
+fn nums(doc: &Document, parent_tree: ObjRef) -> Result<Vec<Object>, String> {
+    let tree = doc.get(parent_tree);
+    let tree = tree.as_dict().ok_or("the structure parent tree is invalid")?;
+    tree.get(b"Nums")
+        .map(|value| doc.resolve(value))
+        .as_deref()
+        .and_then(Object::as_array)
+        .cloned()
+        .ok_or_else(|| "the structure parent tree must use a direct Nums array".to_string())
+}
+
+/// Add `/Form` tags for every page widget that does not already have a structure parent.
+///
+/// A new structure tree is written for an untagged form. A conventional existing tree is
+/// extended by adding the form tags to its direct `/Document` element and fresh entries to its
+/// direct `/ParentTree /Nums` array. Text, figures, links, and non-widget annotations remain
+/// outside this operation and need separate review.
+pub fn tag_form_fields(doc: &mut Document) -> Result<usize, String> {
+    let root = doc.root().ok_or("the PDF has no catalog")?;
+    let catalog_object = doc.get(root);
+    let catalog = catalog_object.as_dict().ok_or("the PDF catalog is invalid")?;
+    if !catalog.contains(b"AcroForm") {
+        return Err("the PDF has no AcroForm fields".into());
+    }
+    let existing_root = catalog.get(b"StructTreeRoot").cloned();
+    let mark_info = catalog.get(b"MarkInfo").map(|v| doc.resolve(v)).as_deref().and_then(Object::as_dict).cloned().unwrap_or_default();
+    let pages = pdfcraft_model::pages(doc);
+    let mut widgets = Vec::new();
+    // A widget listed in more than one page's /Annots is tagged once (one key, one /Form).
+    let mut seen = std::collections::HashSet::new();
+    for page in &pages {
+        let annots = page.dict.get(b"Annots").map(|a| doc.resolve(a)).as_deref().and_then(Object::as_array).cloned().unwrap_or_default();
+        for annot in annots {
+            let Some(reference) = annot.as_ref() else { continue };
+            let resolved = doc.get(reference);
+            let Some(dict) = resolved.as_dict() else { continue };
+            if dict.name(b"Subtype") == Some(b"Widget") && !dict.contains(b"StructParent") && seen.insert(reference) {
+                widgets.push((page.obj, reference));
+            }
+        }
+    }
+    if widgets.is_empty() {
+        return Err("the AcroForm has no untagged page widgets".into());
+    }
+
+    let (struct_root, document_ref, parent_tree, mut parent_nums, first_key, new_tree) = if let Some(existing_root) = existing_root {
+        let struct_root = reference(Some(&existing_root), "structure tree root")?;
+        let structure_object = doc.get(struct_root);
+        let structure = structure_object.as_dict().ok_or("the structure tree root is invalid")?;
+        let document_ref = reference(structure.get(b"K"), "structure tree root K")?;
+        let document = doc.get(document_ref);
+        if document.as_dict().is_none_or(|d| d.name(b"S") != Some(b"Document")) {
+            return Err("the structure tree root must point directly to a Document element".into());
+        }
+        let parent_tree = reference(structure.get(b"ParentTree"), "structure parent tree")?;
+        let parent_nums = nums(doc, parent_tree)?;
+        if parent_nums.len() % 2 != 0 {
+            return Err("the structure parent tree has an odd number of entries".into());
+        }
+        let mut greatest = -1_i64;
+        for pair in parent_nums.as_chunks::<2>().0 {
+            let Some(key) = pair[0].as_int() else { return Err("the structure parent tree has a non-integer key".into()) };
+            if key < 0 {
+                return Err("the structure parent tree has a negative key".into());
+            }
+            greatest = greatest.max(key);
+        }
+        let first_key = greatest.checked_add(1).ok_or("the structure parent tree has no available key")?;
+        (struct_root, document_ref, parent_tree, parent_nums, first_key, false)
+    } else {
+        let mut root_dict = Dict::new();
+        root_dict.set(b"Type".to_vec(), Object::Name(b"StructTreeRoot".to_vec()));
+        let struct_root = doc.add(Object::Dict(root_dict));
+        let mut document = Dict::new();
+        document.set(b"S".to_vec(), Object::Name(b"Document".to_vec()));
+        document.set(b"P".to_vec(), Object::Ref(struct_root));
+        let document_ref = doc.add(Object::Dict(document));
+        let parent_tree = doc.add(Object::Dict(Dict::new()));
+        (struct_root, document_ref, parent_tree, Vec::new(), 0, true)
+    };
+    let mut kids = Vec::with_capacity(widgets.len());
+    for (offset, (page, widget)) in widgets.iter().copied().enumerate() {
+        let key = first_key.checked_add(i64::try_from(offset).map_err(|_| "too many form widgets")?).ok_or("too many form widgets")?;
+        let mut objr = Dict::new();
+        objr.set(b"Type".to_vec(), Object::Name(b"OBJR".to_vec()));
+        objr.set(b"Obj".to_vec(), Object::Ref(widget));
+        objr.set(b"Pg".to_vec(), Object::Ref(page));
+        let mut form = Dict::new();
+        form.set(b"S".to_vec(), Object::Name(b"Form".to_vec()));
+        form.set(b"P".to_vec(), Object::Ref(document_ref));
+        form.set(b"Pg".to_vec(), Object::Ref(page));
+        form.set(b"K".to_vec(), Object::Dict(objr));
+        let form_ref = doc.add(Object::Dict(form));
+        doc.update_dict(widget, |d| d.set(b"StructParent".to_vec(), Object::Int(key))).map_err(|e| e.to_string())?;
+        parent_nums.extend([Object::Int(key), Object::Ref(form_ref)]);
+        kids.push(Object::Ref(form_ref));
+    }
+    doc.update_dict(document_ref, |d| {
+        let old = d.remove(b"K").unwrap_or(Object::Array(Vec::new()));
+        let mut all = match old {
+            Object::Array(items) => items,
+            item => vec![item],
+        };
+        all.extend(kids);
+        d.set(b"K".to_vec(), Object::Array(all));
+    })
+    .map_err(|e| e.to_string())?;
+    doc.update_dict(parent_tree, |d| d.set(b"Nums".to_vec(), Object::Array(parent_nums))).map_err(|e| e.to_string())?;
+    if new_tree {
+        doc.update_dict(struct_root, |d| {
+            d.set(b"K".to_vec(), Object::Ref(document_ref));
+            d.set(b"ParentTree".to_vec(), Object::Ref(parent_tree));
+        })
+        .map_err(|e| e.to_string())?;
+    }
+    let mut mark_info = mark_info;
+    mark_info.set(b"Marked".to_vec(), Object::Bool(true));
+    doc.update_dict(root, |d| {
+        d.set(b"MarkInfo".to_vec(), Object::Dict(mark_info));
+        if new_tree {
+            d.set(b"StructTreeRoot".to_vec(), Object::Ref(struct_root));
+        }
+    })
+    .map_err(|e| e.to_string())?;
+    Ok(widgets.len())
+}
diff --git a/crates/a11y/src/headings.rs b/crates/a11y/src/headings.rs
index 7a35deb46..c7e911fde 100644
--- a/crates/a11y/src/headings.rs
+++ b/crates/a11y/src/headings.rs
@@ -3,6 +3,7 @@
 
 use std::collections::{HashMap, HashSet};
 
+use pdfcraft_content::Matrix;
 use pdfcraft_cos::{Dict, Document, ObjRef, Object};
 use pdfcraft_fonts::pdf::Metrics;
 use pdfcraft_model::Page;
@@ -171,13 +172,24 @@ fn sub(doc: &Document, d: &Dict, key: &[u8]) -> Dict {
 }
 
 /// The text each marked-content id shows on a page (text drawn directly in the page content).
-fn mcid_texts(doc: &Document, page: &Dict) -> HashMap<i64, String> {
+///
+/// Word breaks come from where the glyphs are, as on the page: a glyph that starts on another
+/// line, more than 0.2 em past the end of the previous glyph of the same id, or back over more
+/// than an em from it, starts a new word (the em is the font size times |`Tz`|; see [`new_word`]).
+/// Text-positioning operators alone don't break words: producers that place every glyph with its
+/// own `Td` (Chromium) would otherwise read as "C h a p t e r".
+pub(crate) fn mcid_texts(doc: &Document, page: &Dict) -> HashMap<i64, String> {
     let res = sub(doc, page, b"Resources");
     let (fonts, props) = (sub(doc, &res, b"Font"), sub(doc, &res, b"Properties"));
     let mut metrics: HashMap<Vec<u8>, Metrics> = HashMap::new();
-    let mut font: Option<Vec<u8>> = None;
     let mut stack: Vec<Option<i64>> = Vec::new();
     let mut out: HashMap<i64, String> = HashMap::new();
+    // Where each id's last glyph ended, in user space.
+    let mut ends: HashMap<i64, (f64, f64)> = HashMap::new();
+    let mut gs = TextState::default();
+    let mut saved: Vec<TextState> = Vec::new();
+    let mut unsaved = 0usize;
+    let (mut tm, mut tlm) = (Matrix::IDENTITY, Matrix::IDENTITY);
     for op in pdfcraft_content::parse(&page_content(doc, page)).ops {
         let id = stack.iter().rev().find_map(|m| *m);
         match op.op.as_slice() {
@@ -192,8 +204,22 @@ fn mcid_texts(doc: &Document, page: &Dict) -> HashMap<i64, String> {
             b"EMC" => {
                 stack.pop();
             }
+            b"q" if saved.len() < MAX_SAVED => saved.push(gs.clone()),
+            b"q" => unsaved += 1,
+            b"Q" if unsaved > 0 => unsaved -= 1,
+            b"Q" => {
+                if let Some(saved) = saved.pop() {
+                    gs = saved;
+                }
+            }
+            b"cm" => {
+                if let Some(m) = op.nums::<6>() {
+                    gs.ctm = Matrix(m).then(&gs.ctm);
+                }
+            }
             b"Tf" => {
-                font = op.name(0).map(<[u8]>::to_vec);
+                gs.size = op.num(1).unwrap_or(gs.size);
+                gs.font = op.name(0).map(<[u8]>::to_vec);
                 if let Some(name) = op.name(0)
                     && !metrics.contains_key(name)
                     && let Some(f) = fonts.get(name).map(|f| doc.resolve(f)).and_then(|f| f.as_dict().cloned())
@@ -201,34 +227,113 @@ fn mcid_texts(doc: &Document, page: &Dict) -> HashMap<i64, String> {
                     metrics.insert(name.to_vec(), Metrics::from_dict(doc, &f));
                 }
             }
-            _ => {}
-        }
-        let (Some(id), Some(m)) = (id, font.as_ref().and_then(|f| metrics.get(f))) else { continue };
-        let text = out.entry(id).or_default();
-        if text.len() >= MAX_TITLE * 4 {
-            continue;
-        }
-        match op.op.as_slice() {
-            b"Tj" | b"'" | b"\"" => {
-                if op.op != b"Tj" {
-                    text.push(' ');
-                }
-                if let Some(s) = op.operands.iter().rev().find_map(Object::as_string) {
-                    text.push_str(&m.decode(&s.bytes));
+            b"Tc" => gs.char_spacing = op.num(0).unwrap_or(0.0),
+            b"Tw" => gs.word_spacing = op.num(0).unwrap_or(0.0),
+            b"Tz" => gs.scale = op.num(0).unwrap_or(100.0) / 100.0,
+            b"TL" => gs.leading = op.num(0).unwrap_or(0.0),
+            b"BT" => (tm, tlm) = (Matrix::IDENTITY, Matrix::IDENTITY),
+            b"Td" | b"TD" => {
+                if let Some([x, y]) = op.nums::<2>() {
+                    if op.op == b"TD" {
+                        gs.leading = -y;
+                    }
+                    tlm = Matrix::translate(x, y).then(&tlm);
+                    tm = tlm;
                 }
             }
-            b"TJ" => {
-                for item in op.operands.first().and_then(Object::as_array).into_iter().flatten() {
-                    match item {
-                        Object::String(s) => text.push_str(&m.decode(&s.bytes)),
-                        n if n.as_f64().is_some_and(|n| n < -200.0) => text.push(' '),
-                        _ => {}
+            b"Tm" => {
+                if let Some(m) = op.nums::<6>() {
+                    (tm, tlm) = (Matrix(m), Matrix(m));
+                }
+            }
+            b"T*" => {
+                tlm = Matrix::translate(0.0, -gs.leading).then(&tlm);
+                tm = tlm;
+            }
+            _ => {}
+        }
+        let shows = matches!(op.op.as_slice(), b"Tj" | b"TJ" | b"'" | b"\"");
+        let Some(m) = gs.font.as_ref().and_then(|f| metrics.get(f)).filter(|_| shows) else { continue };
+        if op.op != b"Tj" && op.op != b"TJ" {
+            if op.op == b"\"" {
+                gs.word_spacing = op.num(0).unwrap_or(gs.word_spacing);
+                gs.char_spacing = op.num(1).unwrap_or(gs.char_spacing);
+            }
+            tlm = Matrix::translate(0.0, -gs.leading).then(&tlm);
+            tm = tlm;
+        }
+        let pieces: Vec<&Object> = match op.op.as_slice() {
+            b"TJ" => op.operands.first().and_then(Object::as_array).map(|a| a.iter().collect()).unwrap_or_default(),
+            _ => op.operands.last().into_iter().collect(),
+        };
+        for piece in pieces {
+            let s = match piece {
+                Object::String(s) => s,
+                other => {
+                    // A TJ adjustment moves the next glyph; whether it breaks a word is decided there.
+                    let dx = -other.as_f64().unwrap_or(0.0) / 1000.0 * gs.size * gs.scale;
+                    tm = Matrix::translate(dx, 0.0).then(&tm);
+                    continue;
+                }
+            };
+            for (code, len) in m.codes(&s.bytes) {
+                let trm = tm.then(&gs.ctm);
+                if let Some(id) = id
+                    && let Some(glyph) = m.text_of(code)
+                {
+                    let text = out.entry(id).or_default();
+                    if text.len() < MAX_TITLE * 4 {
+                        let breaks = ends.get(&id).is_some_and(|end| new_word(&trm, *end, gs.size, gs.scale));
+                        if breaks && !text.is_empty() && !text.ends_with(' ') && !glyph.starts_with(' ') {
+                            text.push(' ');
+                        }
+                        text.push_str(&glyph);
                     }
                 }
+                let advance = m.width(code) * gs.size + gs.char_spacing + if m.is_space(code, len) { gs.word_spacing } else { 0.0 };
+                tm = Matrix::translate(advance * gs.scale, 0.0).then(&tm);
+                if let Some(id) = id {
+                    ends.insert(id, tm.then(&gs.ctm).apply(0.0, 0.0));
+                }
             }
-            b"Td" | b"TD" | b"T*" | b"Tm" => text.push(' '),
-            _ => {}
         }
     }
     out
 }
+
+/// How deep `q` nests before the text state stops being saved (a hostile stream can nest millions).
+const MAX_SAVED: usize = 256;
+
+/// The graphics state that places glyphs: the CTM, the font and the text state parameters.
+#[derive(Clone)]
+struct TextState {
+    ctm: Matrix,
+    font: Option<Vec<u8>>,
+    size: f64,
+    char_spacing: f64,
+    word_spacing: f64,
+    scale: f64,
+    leading: f64,
+}
+
+impl Default for TextState {
+    fn default() -> Self {
+        TextState { ctm: Matrix::IDENTITY, font: None, size: 0.0, char_spacing: 0.0, word_spacing: 0.0, scale: 1.0, leading: 0.0 }
+    }
+}
+
+/// Does a glyph drawn with text rendering matrix `trm` (text space → user space) start a new word
+/// after a glyph that ended at `end` (user space)? Yes on another line (more than half the absolute
+/// font size up or down), more than 0.2 horizontal em ahead, or back over more than a horizontal em.
+/// The horizontal em is the absolute value of font size times horizontal scale (`Tz`); "ahead" follows
+/// the glyph advance, backwards when the size or `Tz` is negative. `Tz` never scales the vertical threshold.
+fn new_word(trm: &Matrix, end: (f64, f64), font_size: f64, horizontal_scale: f64) -> bool {
+    let advance = font_size * horizontal_scale;
+    let em = advance.abs();
+    let start = trm.apply(0.0, 0.0);
+    let [a, b, c, d, _, _] = trm.0;
+    let Some(back) = Matrix([a, b, c, d, 0.0, 0.0]).invert() else { return true };
+    let (dx, dy) = back.apply(start.0 - end.0, start.1 - end.1);
+    let ahead = if advance < 0.0 { -dx } else { dx };
+    !(ahead.is_finite() && dy.is_finite()) || dy.abs() > font_size.abs() * 0.5 || ahead > em * 0.2 || ahead < -em
+}
diff --git a/crates/a11y/src/lib.rs b/crates/a11y/src/lib.rs
index 81fbade91..ff81cc4c9 100644
--- a/crates/a11y/src/lib.rs
+++ b/crates/a11y/src/lib.rs
@@ -14,17 +14,19 @@ use pdfcraft_cos::Document;
 
 mod alt;
 mod autotag;
+mod autotag_fields;
 mod content;
 mod headings;
 mod report;
 mod structure;
 mod tags;
 
-pub use alt::{AltError, Figure, figures, mark_decorative, set_alt};
+pub use alt::{AltError, ArtifactError, Figure, figures, mark_decorative, mark_tag_artifact, set_alt};
 pub use autotag::{AutoTagError, AutoTagResult, autotag_text};
+pub use autotag_fields::tag_form_fields;
 pub use headings::{Heading, headings};
 pub use report::{REPORT_WORDS, report_html};
-pub use tags::{TagError, TagInfo, TagPlacement, TagProperty, move_tag, set_tag_property, tags};
+pub use tags::{TagContentItem, TagError, TagInfo, TagPlacement, TagProperty, move_tag, set_tag_property, tag_content, tags};
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash)]
 pub enum Category {
diff --git a/crates/a11y/src/tags.rs b/crates/a11y/src/tags.rs
index 926350c3d..565f6620d 100644
--- a/crates/a11y/src/tags.rs
+++ b/crates/a11y/src/tags.rs
@@ -21,6 +21,14 @@ pub struct TagInfo {
     pub page: Option<usize>,
 }
 
+/// A marked-content reference directly owned by a structure tag.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct TagContentItem {
+    pub page: Option<usize>,
+    pub mcid: i64,
+    pub text: String,
+}
+
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum TagProperty {
     Type,
@@ -140,6 +148,58 @@ pub fn tags(doc: &Document) -> Vec<TagInfo> {
         .collect()
 }
 
+/// List marked-content references directly owned by an indirect tag.
+pub fn tag_content(doc: &Document, object: ObjRef) -> Result<Vec<TagContentItem>, TagError> {
+    let Some(element) = alt::elements(doc).into_iter().find(|e| e.object == object) else { return Err(TagError::NotATag(object)) };
+    let pages = pdfcraft_model::pages(doc);
+    let page_index: std::collections::HashMap<ObjRef, usize> = pages.iter().enumerate().map(|(i, p)| (p.obj, i)).collect();
+    let mut marks = Vec::new();
+    if let Some(kids) = element.dict.get(b"K") {
+        direct_marks(doc, kids, element.page, &mut marks);
+    }
+    // Each page's content is parsed once, however many of its MCIDs the tag owns.
+    let mut texts: std::collections::HashMap<usize, std::collections::HashMap<i64, String>> = std::collections::HashMap::new();
+    Ok(marks
+        .into_iter()
+        .map(|(page, mcid)| {
+            let page = page.and_then(|p| page_index.get(&p).copied());
+            let text = page
+                .and_then(|i| {
+                    let page_texts = match texts.entry(i) {
+                        std::collections::hash_map::Entry::Occupied(e) => e.into_mut(),
+                        std::collections::hash_map::Entry::Vacant(e) => {
+                            e.insert(pages.get(i).map(|p| crate::headings::mcid_texts(doc, &p.dict)).unwrap_or_default())
+                        }
+                    };
+                    page_texts.get(&mcid).cloned()
+                })
+                .unwrap_or_default();
+            TagContentItem { page, mcid, text }
+        })
+        .collect())
+}
+
+fn direct_marks(doc: &Document, item: &Object, page: Option<ObjRef>, out: &mut Vec<(Option<ObjRef>, i64)>) {
+    match item {
+        Object::Int(mcid) => out.push((page, *mcid)),
+        Object::Array(items) => items.iter().for_each(|item| direct_marks(doc, item, page, out)),
+        Object::Dict(dict) if dict.name(b"Type") == Some(b"MCR") => {
+            if let Some(mcid) = dict.get(b"MCID").and_then(Object::as_int) {
+                out.push((dict.get(b"Pg").and_then(Object::as_ref).or(page), mcid));
+            }
+        }
+        Object::Ref(reference) => {
+            if let Some(dict) = doc.get(*reference).as_dict()
+                && dict.name(b"Type") == Some(b"MCR")
+                && let Some(mcid) = dict.get(b"MCID").and_then(Object::as_int)
+            {
+                out.push((dict.get(b"Pg").and_then(Object::as_ref).or(page), mcid));
+            }
+        }
+        _ => {}
+    }
+}
+
 /// Change one property of a reachable tag; `None` removes a text property.
 pub fn set_tag_property(doc: &mut Document, object: ObjRef, property: TagProperty, value: Option<&str>) -> Result<(), TagError> {
     if !alt::elements(doc).iter().any(|e| e.object == object) {
diff --git a/crates/a11y/src/tests.rs b/crates/a11y/src/tests.rs
index e406569a8..fcd681efc 100644
--- a/crates/a11y/src/tests.rs
+++ b/crates/a11y/src/tests.rs
@@ -96,6 +96,78 @@ fn autotag_text_refuses_paint_and_does_not_modify_the_document() {
     assert_eq!(autotag_text(&mut pdf(&good(), "")), Err(AutoTagError::AlreadyTagged));
 }
 
+#[test]
+fn autotag_form_fields_writes_widget_structure_and_parent_tree() {
+    let mut doc = pdf(
+        &[
+            "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [5 0 R] >> >>".into(),
+            "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
+            "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots [5 0 R 6 0 R] >>".into(),
+            "<< /Length 0 >>\nstream\n\nendstream".into(),
+            "<< /FT /Tx /T (name) /Kids [6 0 R] >>".into(),
+            "<< /Type /Annot /Subtype /Widget /Parent 5 0 R /Rect [20 60 120 80] >>".into(),
+        ],
+        "",
+    );
+    assert_eq!(tag_form_fields(&mut doc).unwrap(), 1);
+    let report = check(&doc, &Options { rules: [Rule::TaggedPdf, Rule::TaggedFormFields].into(), pages: None });
+    assert_eq!(status(&report, Rule::TaggedPdf), Status::Passed);
+    assert_eq!(status(&report, Rule::TaggedFormFields), Status::Passed);
+    let tree = doc.get(doc.root().unwrap()).as_dict().unwrap().reference(b"StructTreeRoot").unwrap();
+    assert!(doc.get(tree).as_dict().unwrap().contains(b"ParentTree"));
+    let widget = pdfcraft_model::pages(&doc)[0].dict.get(b"Annots").and_then(|a| doc.resolve(a).as_array().cloned()).unwrap()[1].as_ref().unwrap();
+    assert_eq!(doc.get(widget).as_dict().unwrap().get(b"StructParent").and_then(Object::as_int), Some(0));
+    let written = pdfcraft_cos::write_full(&doc, &pdfcraft_cos::SaveOptions::default()).unwrap();
+    let reopened = Document::open(Arc::new(written)).unwrap();
+    assert_eq!(status(&check(&reopened, &Options { rules: [Rule::TaggedFormFields].into(), pages: None }), Rule::TaggedFormFields), Status::Passed);
+}
+
+#[test]
+fn autotag_form_fields_tags_a_widget_listed_on_two_pages_once() {
+    let mut doc = pdf(
+        &[
+            "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [5 0 R] >> >>".into(),
+            "<< /Type /Pages /Kids [3 0 R 6 0 R] /Count 2 >>".into(),
+            "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots [5 0 R] >>".into(),
+            "<< /Length 0 >>\nstream\n\nendstream".into(),
+            "<< /Type /Annot /Subtype /Widget /FT /Tx /T (name) /Rect [20 60 120 80] >>".into(),
+            "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots [5 0 R] >>".into(),
+        ],
+        "",
+    );
+    assert_eq!(tag_form_fields(&mut doc).unwrap(), 1);
+    let tree = doc.get(doc.root().unwrap()).as_dict().unwrap().reference(b"StructTreeRoot").unwrap();
+    let parent_tree = doc.get(tree).as_dict().unwrap().reference(b"ParentTree").unwrap();
+    let nums = doc.get(parent_tree).as_dict().unwrap().get(b"Nums").and_then(|n| n.as_array().cloned()).unwrap();
+    assert_eq!(nums.len(), 2, "one key and one /Form element for the shared widget");
+}
+
+#[test]
+fn autotag_form_fields_extends_a_direct_existing_structure_tree() {
+    let mut doc = pdf(
+        &[
+            "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [5 0 R] >> /MarkInfo << /Marked true >> /StructTreeRoot 6 0 R >>".into(),
+            "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
+            "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots [5 0 R] /StructParents 0 >>".into(),
+            "<< /Length 0 >>\nstream\n\nendstream".into(),
+            "<< /Type /Annot /Subtype /Widget /FT /Tx /T (name) /Rect [20 60 120 80] >>".into(),
+            "<< /Type /StructTreeRoot /K 7 0 R /ParentTree 8 0 R >>".into(),
+            "<< /S /Document /P 6 0 R /K 9 0 R >>".into(),
+            "<< /Nums [0 [9 0 R]] >>".into(),
+            "<< /S /P /P 7 0 R /Pg 3 0 R /K 0 >>".into(),
+        ],
+        "",
+    );
+    assert_eq!(tag_form_fields(&mut doc).unwrap(), 1);
+    let widget = pdfcraft_model::pages(&doc)[0].dict.get(b"Annots").and_then(|a| doc.resolve(a).as_array().cloned()).unwrap()[0].as_ref().unwrap();
+    assert_eq!(doc.get(widget).as_dict().unwrap().get(b"StructParent").and_then(Object::as_int), Some(1));
+    let report = check(&doc, &Options { rules: [Rule::TaggedFormFields].into(), pages: None });
+    assert_eq!(status(&report, Rule::TaggedFormFields), Status::Passed);
+    let document_object = doc.get(pdfcraft_cos::ObjRef::new(7, 0));
+    let document = document_object.as_dict().unwrap();
+    assert_eq!(document.get(b"K").and_then(Object::as_array).unwrap().len(), 2, "the existing paragraph and new form remain siblings");
+}
+
 #[test]
 fn an_untagged_document_fails_the_document_rules() {
     let doc = pdf(
@@ -526,6 +598,16 @@ fn figures_are_listed_with_their_alt_text_and_place() {
     assert_eq!((finding.object, finding.page, finding.bbox), (Some(f[0].obj), Some(0), f[0].bbox));
 }
 
+#[test]
+fn tag_content_lists_direct_marked_content() {
+    let doc = figures_doc();
+    let tags = tags(&doc);
+    let first = tag_content(&doc, tags[1].object).unwrap();
+    let second = tag_content(&doc, tags[2].object).unwrap();
+    assert_eq!((first[0].page, first[0].mcid, first[0].text.as_str()), (Some(0), 0, ""));
+    assert_eq!((second[0].page, second[0].mcid, second[0].text.as_str()), (Some(0), 1, ""));
+}
+
 #[test]
 fn sibling_tags_move_in_reading_order_without_changing_content() {
     let mut doc = figures_doc();
@@ -591,6 +673,95 @@ fn setting_alt_text_and_marking_decorative() {
     assert!(text.contains("/Artifact BMC") && !text.contains("/MCID 0"), "{text}");
 }
 
+#[test]
+fn marking_a_leaf_tag_as_an_artifact_preserves_appearance_and_structure_integrity() {
+    let mut doc = figures_doc();
+    let page = pdfcraft_model::pages(&doc)[0].obj;
+    mark_tag_artifact(&mut doc, pdfcraft_cos::ObjRef::new(7, 0)).unwrap();
+    assert_eq!(tags(&doc).into_iter().map(|tag| tag.object.num).collect::<Vec<_>>(), [6, 8]);
+    let c = doc.resolve(doc.get(page).as_dict().unwrap().get(b"Contents").unwrap());
+    let pdfcraft_cos::Object::Stream(c) = &*c else { panic!("one content stream") };
+    let text = String::from_utf8(c.decoded().unwrap()).unwrap();
+    assert!(text.contains("/Artifact BMC") && !text.contains("/MCID 0"), "{text}");
+    let report = check(&doc, &Options { rules: [Rule::TaggedContent, Rule::FiguresAltText].into(), pages: None });
+    assert_eq!(failed(&report), Vec::<Rule>::new(), "{:?}", report.results);
+    assert_eq!(mark_tag_artifact(&mut doc, pdfcraft_cos::ObjRef::new(6, 0)), Err(ArtifactError::HasChildren));
+    assert_eq!(mark_tag_artifact(&mut doc, pdfcraft_cos::ObjRef::new(7, 0)), Err(ArtifactError::NotATag(7)));
+}
+
+#[test]
+fn marking_decorative_survives_a_parent_tree_with_an_unpaired_key() {
+    // A trailing key without a value, matching the page's StructParents (#1809), and the same
+    // with no valid pair at all.
+    let tree = |nums: &str| pdf(&[format!("<< /Nums {nums} >>")], "").get(pdfcraft_cos::ObjRef::new(1, 0)).as_ref().clone();
+    for (nums, cleared) in [("[0 [7 0 R 8 0 R] 0]", "[0 [null 8 0 R] 0]"), ("[0]", "[0]")] {
+        let mut doc = figures_doc();
+        let pt = pdfcraft_cos::ObjRef::new(9, 0);
+        doc.set(pt, tree(nums));
+        let f = figures(&doc);
+        mark_decorative(&mut doc, f[0].obj).unwrap();
+        assert_eq!(figures(&doc).len(), 1, "{nums}");
+        // The pair is cleared and the unpaired key is kept as it was.
+        assert_eq!(*doc.get(pt), tree(cleared), "{nums}");
+    }
+}
+
+/// `figures_doc` with its property lists named in the page resources (one inline, one indirect)
+/// instead of written inline in the content.
+fn named_figures_doc() -> Document {
+    pdf(
+        &[
+            "<< /Type /Catalog /Pages 2 0 R /MarkInfo << /Marked true >> /StructTreeRoot 5 0 R >>".into(),
+            "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
+            "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Contents 4 0 R /StructParents 0 \
+             /Resources << /XObject << /Im 10 0 R >> /Properties << /P0 << /MCID 0 >> /P1 11 0 R /Other << /Note (kept) >> >> >> >>"
+                .into(),
+            stream(
+                "/Figure /P0 BDC q 40 0 0 20 10 150 cm /Im Do Q EMC \
+                 /Photo /P1 BDC 100 100 50 30 re f EMC",
+            ),
+            "<< /Type /StructTreeRoot /K 6 0 R /ParentTree 9 0 R /RoleMap << /Photo /Figure >> >>".into(),
+            "<< /S /Document /P 5 0 R /K [7 0 R 8 0 R] >>".into(),
+            "<< /S /Figure /P 6 0 R /Pg 3 0 R /K 0 >>".into(),
+            "<< /S /Photo /P 6 0 R /Pg 3 0 R /Alt (A bar) /K 1 >>".into(),
+            "<< /Nums [0 [7 0 R 8 0 R]] >>".into(),
+            "<< /Type /XObject /Subtype /Image /Width 1 /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8 /Length 1 >>\nstream\n\u{0}\nendstream"
+                .into(),
+            "<< /MCID 1 >>".into(),
+        ],
+        "",
+    )
+}
+
+#[test]
+fn named_property_lists_are_found_and_marked_decorative_like_inline_ones() {
+    let (mut inline, mut named) = (figures_doc(), named_figures_doc());
+    let place = |doc: &Document| figures(doc).into_iter().map(|f| (f.obj, f.page, f.alt, f.bbox)).collect::<Vec<_>>();
+    assert_eq!(place(&named), place(&inline), "both figures, placed where their content is drawn");
+    for doc in [&mut inline, &mut named] {
+        mark_decorative(doc, pdfcraft_cos::ObjRef::new(8, 0)).unwrap();
+        let left = figures(doc);
+        assert_eq!((left.len(), left[0].obj.num, left[0].bbox), (1, 7, Some([10.0, 150.0, 50.0, 170.0])));
+        let pages = pdfcraft_model::pages(doc);
+        let c = doc.resolve(pages[0].dict.get(b"Contents").unwrap());
+        let Object::Stream(c) = &*c else { panic!("one content stream") };
+        let text = String::from_utf8(c.decoded().unwrap()).unwrap();
+        assert!(text.contains("/Artifact BMC") && !text.contains("/P1") && !text.contains("/MCID 1"), "{text}");
+        assert!(text.contains("/Im Do"), "the drawing itself stays: {text}");
+        let nums = doc.get(pdfcraft_cos::ObjRef::new(9, 0)).as_dict().and_then(|d| d.get(b"Nums").cloned());
+        assert_eq!(
+            nums,
+            Some(Object::Array(vec![Object::Int(0), Object::Array(vec![Object::Ref(pdfcraft_cos::ObjRef::new(7, 0)), Object::Null])])),
+            "the parent tree no longer points MCID 1 at the removed figure"
+        );
+        let r = check(doc, &Options { rules: [Rule::FiguresAltText, Rule::TaggedContent].into(), pages: None });
+        assert_eq!(r.result(Rule::TaggedContent).unwrap().status, Status::Passed, "{:?}", r.results);
+    }
+    let props = pdfcraft_model::pages(&named)[0].dict.get(b"Resources").and_then(|r| named.resolve(r).as_dict().cloned());
+    let props = props.and_then(|r| r.get(b"Properties").and_then(|p| named.resolve(p).as_dict().cloned())).unwrap();
+    assert!(props.contains(b"P0") && props.contains(b"P1") && props.contains(b"Other"), "resources are left as they were");
+}
+
 fn ref_(n: u32) -> Option<pdfcraft_cos::ObjRef> {
     Some(pdfcraft_cos::ObjRef::new(n, 0))
 }
@@ -640,6 +811,114 @@ fn headings_are_found_with_their_levels_titles_and_pages() {
     );
 }
 
+#[test]
+fn tag_content_reads_the_text_of_each_marked_content_reference() {
+    let doc = pdf(&headings_doc(), "");
+    let items = |n| tag_content(&doc, ref_(n).unwrap()).unwrap().into_iter().map(|i| (i.page, i.mcid, i.text)).collect::<Vec<_>>();
+    assert_eq!(items(12), [(Some(0), 0, "Chapter One".to_string())]);
+    assert_eq!(items(13), [(Some(0), 2, "Sec A".to_string())]);
+    assert_eq!(items(15), [(Some(1), 1, "AB".to_string())]);
+}
+
+/// Helvetica advances (standard 14 metrics, per 1000 em) of the characters the tests below draw.
+fn helvetica_width(c: char) -> f64 {
+    match c {
+        'C' | 'w' => 722.0,
+        'P' => 667.0,
+        'T' | 'F' => 611.0,
+        'v' => 500.0,
+        'r' => 333.0,
+        't' | ' ' => 278.0,
+        'i' => 222.0,
+        _ => 556.0, // a e h o p
+    }
+}
+
+/// `text` drawn one glyph at a time from (72, y), each glyph moved into place with its own `Td`,
+/// as Chromium writes text. With `spaces`, the space is drawn too; without, the next glyph is
+/// just moved past it.
+fn glyph_by_glyph(text: &str, size: f64, y: f64, spaces: bool) -> String {
+    let mut ops = format!("BT /F1 {size} Tf 72 {y} Td");
+    let mut step = 0.0;
+    for c in text.chars() {
+        if c == ' ' && !spaces {
+            step += helvetica_width(c) / 1000.0 * size;
+            continue;
+        }
+        ops.push_str(&format!(" {step:.3} 0 Td ({c}) Tj"));
+        step = helvetica_width(c) / 1000.0 * size;
+    }
+    ops + " ET"
+}
+
+/// `text` drawn one glyph at a time with `/F1 1 Tf` and a `Tm` per glyph scaled to `size`; the
+/// space is skipped over, not drawn.
+fn glyph_by_tm(text: &str, size: f64, y: f64) -> String {
+    let mut ops = "BT /F1 1 Tf".to_string();
+    let mut x = 72.0;
+    for c in text.chars() {
+        if c != ' ' {
+            ops.push_str(&format!(" {size} 0 0 {size} {x:.3} {y} Tm ({c}) Tj"));
+        }
+        x += helvetica_width(c) / 1000.0 * size;
+    }
+    ops + " ET"
+}
+
+/// One tagged page whose H1 headings show `contents` (one marked-content sequence each).
+fn heading_page(contents: &[String]) -> Document {
+    let marked: Vec<String> = contents.iter().enumerate().map(|(i, c)| format!("/H1 << /MCID {i} >> BDC {c} EMC")).collect();
+    let kids: Vec<String> = (0..contents.len()).map(|i| format!("{} 0 R", 7 + i)).collect();
+    let mut objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R /StructTreeRoot 5 0 R >>".into(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] /Contents 4 0 R /Resources << /Font << /F1 6 0 R >> >> >>".into(),
+        stream(&marked.join("\n")),
+        format!("<< /Type /StructTreeRoot /K [{}] >>", kids.join(" ")),
+        FONT.into(),
+    ];
+    objs.extend((0..contents.len()).map(|i| format!("<< /S /H1 /Pg 3 0 R /K {i} >>")));
+    pdf(&objs, "")
+}
+
+/// Chromium (Skia) places each glyph with its own `Td`: a heading must read as its words, not as
+/// "C h a p t e r T w o", whether the space is drawn or only skipped over. A heading set with a
+/// negative font size or `Tz` keeps its words too.
+#[test]
+fn headings_drawn_glyph_by_glyph_keep_their_words() {
+    let doc = heading_page(&[
+        "BT /F1 20 Tf 72 700 Td (Chapter One) Tj ET".into(),
+        glyph_by_glyph("Chapter Two", 20.0, 650.0, true),
+        glyph_by_glyph("Chapter Three", 20.0, 600.0, false),
+        // Each glyph placed with its own Tm, at font size 1 scaled by the matrix.
+        glyph_by_tm("Part Five", 18.0, 550.0),
+        // Kerning inside a word, then a word space as a TJ adjustment, then a wrapped line.
+        "BT /F1 16 Tf 72 450 Td [(Ch) 40 (apter) -350 (Four)] TJ 0 -20 Td (continued) Tj ET".into(),
+        // A negative font size runs the glyphs backwards in text space: alone, in a mirrored
+        // text matrix (upright on the page), with a word space as a TJ adjustment, and the same
+        // with a negative horizontal scale instead (reset after, as Tz outlives the text object).
+        "BT /F1 -20 Tf 72 380 Td (Chapter Six) Tj ET".into(),
+        "BT /F1 -20 Tf -1 0 0 -1 300 330 Tm (Chapter Seven) Tj ET".into(),
+        "BT /F1 -20 Tf 72 280 Td [(Chapter) -300 (Eight)] TJ ET".into(),
+        "BT /F1 20 Tf -100 Tz 300 230 Td [(Chapter) -300 (Nine)] TJ ET 100 Tz".into(),
+    ]);
+    let titles: Vec<String> = headings(&doc).into_iter().map(|h| h.title).collect();
+    assert_eq!(
+        titles,
+        [
+            "Chapter One",
+            "Chapter Two",
+            "Chapter Three",
+            "Part Five",
+            "Chapter Four continued",
+            "Chapter Six",
+            "Chapter Seven",
+            "Chapter Eight",
+            "Chapter Nine"
+        ]
+    );
+}
+
 #[test]
 fn an_untagged_document_has_no_headings() {
     let mut objs = headings_doc();
@@ -736,3 +1015,11 @@ fn a_nested_finding_says_itself() {
     // Both wordings are translated, each on its own, and the document's words are left alone.
     assert_eq!(f.said(&|w: &str| format!("«{w}»")), "«Table element on page 3: «rows have between 1 and 2 columns»»");
 }
+
+/// Horizontal stretching must not raise the vertical line-break threshold.
+#[test]
+fn horizontally_scaled_wrapped_heading_keeps_a_space_between_lines() {
+    let doc = heading_page(&["BT /F1 20 Tf 400 Tz 72 700 Td (I) Tj 0 -30 Td (Overview) Tj ET".into()]);
+    let titles: Vec<String> = headings(&doc).into_iter().map(|h| h.title).collect();
+    assert_eq!(titles, ["I Overview"]);
+}
diff --git a/crates/annot/src/appearance.rs b/crates/annot/src/appearance.rs
index a5394038d..0f0706428 100644
--- a/crates/annot/src/appearance.rs
+++ b/crates/annot/src/appearance.rs
@@ -269,6 +269,12 @@ fn stamp_turn(d: &Dict) -> i64 {
     d.get(b"PCStampRotate").and_then(Object::as_int).unwrap_or(0).rem_euclid(360) / 90 * 90
 }
 
+/// The page `/Rotate` a text box's or Fill & Sign text's lines are turned back by
+/// (`/PCTextRotate`, written when it is added to a turned page).
+fn text_turn(d: &Dict) -> i64 {
+    d.get(b"PCTextRotate").and_then(Object::as_int).unwrap_or(0).rem_euclid(360) / 90 * 90
+}
+
 /// The first text [`build`] would draw in the standard fonts (Helvetica, WinAnsiEncoding) that
 /// they can't, which would come out as `?`: what it is (for the message) and the character. The
 /// text of a text box, callout or Fill & Sign text, a measurement's label, a dynamic stamp's
@@ -666,6 +672,19 @@ pub fn build(d: &Dict) -> Option<Stream> {
             let bw = if d.contains(b"BS") || d.contains(b"Border") { border_width(d) } else { 0.0 };
             // A callout: the leader line (arrowhead at its first point), and the text box inside
             // `/Rect` by `/RD`.
+            // Text added to a turned page is drawn upright in its displayed box, which the form
+            // `/Matrix` then maps into `/Rect` (as for stamps). Callouts keep user-space axes.
+            let turn = if d.contains(b"CL") { 0 } else { text_turn(d) };
+            let (rect, matrix) = if turn == 0 {
+                (rect, None)
+            } else {
+                let (rw, rh) = (rect[2] - rect[0], rect[3] - rect[1]);
+                let (dw, dh) = if matches!(turn, 90 | 270) { (rh, rw) } else { (rw, rh) };
+                if dw < 1.0 || dh < 1.0 {
+                    return None;
+                }
+                ([0.0, 0.0, dw, dh], Some(pdfcraft_model::view_matrix_for(turn, rect)))
+            };
             let full = rect;
             let mut rect = rect;
             if d.contains(b"CL") {
@@ -751,7 +770,11 @@ pub fn build(d: &Dict) -> Option<Stream> {
             let mut fonts = Dict::new();
             fonts.set(b"Helv".to_vec(), Object::Dict(font));
             res.set(b"Font".to_vec(), Object::Dict(fonts));
-            return Some(form(full, &out, res));
+            let mut stream = form(full, &out, res);
+            if let Some(m) = matrix {
+                stream.dict.set(b"Matrix".to_vec(), Object::Array(m.iter().copied().map(Object::Real).collect()));
+            }
+            return Some(stream);
         }
         _ => return None,
     }
diff --git a/crates/annot/src/lib.rs b/crates/annot/src/lib.rs
index a25b35c3b..f4973aa02 100644
--- a/crates/annot/src/lib.rs
+++ b/crates/annot/src/lib.rs
@@ -1206,6 +1206,13 @@ pub fn add_annotation(doc: &mut Document, new: &NewAnnotation, meta: &Meta) -> R
             }
             border(&mut d);
             rich_text(&mut d);
+            // The text is laid out for the page as displayed, like a stamp's label.
+            if !matches!(new.shape, Shape::Callout { .. }) {
+                let turn = pdfcraft_model::pages(doc).get(new.page).map_or(0, |p| p.rotation(doc));
+                if matches!(turn, 90 | 180 | 270) {
+                    d.set(b"PCTextRotate".to_vec(), Object::Int(turn));
+                }
+            }
         }
         _ => {}
     }
@@ -1939,6 +1946,47 @@ pub fn set_style(
     redraw_or_restore(doc, r, before)
 }
 
+/// Change the font size of a text box, typewriter text or callout (`/DA` keeps its colour; the
+/// rich-text strings follow) and redraw it. The box grows to hold the wrapped text at the new
+/// size and never shrinks, so a box the user drew large stays large. Sizes are 1 to 400 pt.
+pub fn set_font_size(doc: &mut Document, page: usize, index: usize, size: f64, meta: &Meta) -> Result<(), AnnotError> {
+    let (_, r) = annot_ref(doc, page, index)?;
+    unlocked(doc, r)?;
+    let d = annot_dict(doc, r);
+    if d.name(b"Subtype") != Some(b"FreeText") {
+        return Err(AnnotError::Invalid("only text boxes, typewriter text and callouts have a font size".into()));
+    }
+    if !size.is_finite() || !(1.0..=400.0).contains(&size) {
+        return Err(AnnotError::Invalid("font size must be 1\u{2013}400 pt".into()));
+    }
+    refuse_foreign_text(doc, &d)?;
+    let before = d;
+    doc.update_dict(r, |d| {
+        let (col, _) = appearance::parse_da(d);
+        d.set(b"DA".to_vec(), PdfString::literal(format!("{} {} {} rg /Helv {} Tf", n(col[0]), n(col[1]), n(col[2]), n(size)).into_bytes()));
+        rich_text(d);
+        touch(d, meta);
+    })?;
+    let text = text_value(doc, &annot_dict(doc, r), b"Contents").unwrap_or_default();
+    let result = match fitted_box(doc, r, &text) {
+        Some(fit) => {
+            let cur = annot_dict(doc, r);
+            let nums: Vec<f64> =
+                cur.get(b"Rect").and_then(|o| o.as_array()).map(|a| a.iter().filter_map(|x| x.as_f64()).collect()).unwrap_or_default();
+            // Keep the top and sides; only the bottom edge moves, and only downwards.
+            match four(&nums).map(normalize) {
+                Some(old) if !cur.contains(b"CL") => apply_text_box(doc, r, [fit[0], fit[1].min(old[1]), fit[2], fit[3]], meta, false),
+                _ => apply_text_box(doc, r, fit, meta, false),
+            }
+        }
+        None => redraw_or_restore(doc, r, before.clone()),
+    };
+    if result.is_err() {
+        doc.set(r, Object::Dict(before));
+    }
+    result
+}
+
 /// Whether a comment of this subtype has an interior that can be filled (`/IC`: rectangles,
 /// ovals, polygons and clouds, §12.5.6.8–9).
 pub fn fillable(subtype: &str) -> bool {
@@ -2173,6 +2221,8 @@ pub struct Props {
     pub fillable: bool,
     /// `/IC`, the interior colour (`None`: no fill).
     pub fill: Option<Rgb>,
+    /// Text boxes, typewriter text and callouts: the `/DA` font size in points.
+    pub font_size: Option<f64>,
 }
 
 /// The current properties of the comment at `(page, index)`.
@@ -2198,6 +2248,7 @@ pub fn props(doc: &Document, page: usize, index: usize) -> Option<Props> {
         locked: annotation_flags(doc, d) & FLAG_LOCKED != 0,
         fillable: fillable(&subtype),
         fill: fill_of(d),
+        font_size: (subtype == "FreeText").then(|| appearance::parse_da(d).1),
         subtype,
         endings: line_endings_of(d),
     })
diff --git a/crates/annot/src/tests.rs b/crates/annot/src/tests.rs
index 2ae46a246..faed409ab 100644
--- a/crates/annot/src/tests.rs
+++ b/crates/annot/src/tests.rs
@@ -1273,3 +1273,38 @@ fn cached_appearances_are_reused_while_annotations_are_unchanged() {
     assert!(!a.is_empty());
     assert_eq!(a, b, "the reused appearance is byte-identical");
 }
+
+/// #1908: a text box's font size changes in `/DA` (colour kept), the rich text follows, the box
+/// grows to hold the bigger text but never shrinks, and bad sizes and other subtypes are refused.
+#[test]
+fn text_box_font_size_changes_the_da_and_grows_the_box() {
+    let mut doc = fixture();
+    let t = add_annotation(&mut doc, &new(0, Shape::TextBox { rect: [100.0, 680.0, 220.0, 692.0], font_size: 12.0 }), &meta("t")).unwrap();
+    set_style(&mut doc, 0, t, Some([1.0, 0.0, 0.0]), None, None, None, &meta("")).unwrap();
+    set_contents(&mut doc, 0, t, "one two three four five six seven eight nine ten eleven twelve", &meta("")).unwrap();
+    let height = |doc: &Document| {
+        let rect: Vec<f64> = list(doc, 0)[t].get(b"Rect").unwrap().as_array().unwrap().iter().map(|x| x.as_f64().unwrap()).collect();
+        rect[3] - rect[1]
+    };
+    let before = height(&doc);
+    set_font_size(&mut doc, 0, t, 24.0, &meta("")).unwrap();
+    let doc = reopen(&doc);
+    let d = &list(&doc, 0)[t];
+    assert_eq!(text(d, b"DA"), "1 0 0 rg /Helv 24 Tf");
+    assert!(text(d, b"DS").contains("24pt") && text(d, b"RC").contains("font-size:24pt"));
+    assert_eq!(props(&doc, 0, t).unwrap().font_size, Some(24.0));
+    assert!(height(&doc) > before, "the box grows");
+    let mut doc = doc;
+    let grown = height(&doc);
+    set_font_size(&mut doc, 0, t, 6.0, &meta("")).unwrap();
+    assert!(height(&doc) >= grown, "the box never shrinks");
+    for bad in [0.0, 0.5, 401.0, f64::NAN, f64::INFINITY] {
+        assert!(matches!(set_font_size(&mut doc, 0, t, bad, &meta("")), Err(AnnotError::Invalid(_))), "{bad}");
+    }
+    assert_eq!(props(&doc, 0, t).unwrap().font_size, Some(6.0));
+    let note = add_annotation(&mut doc, &new(0, Shape::Note { at: [50.0, 50.0], icon: NoteIcon::Note }), &meta("t"));
+    if let Ok(i) = note {
+        assert!(set_font_size(&mut doc, 0, i, 12.0, &meta("")).is_err());
+        assert_eq!(props(&doc, 0, i).unwrap().font_size, None);
+    }
+}
diff --git a/crates/audit/README.md b/crates/audit/README.md
index c8a6a3249..5dd15de3a 100644
--- a/crates/audit/README.md
+++ b/crates/audit/README.md
@@ -16,6 +16,11 @@ It reports two kinds of finding:
 A properly applied redaction removes the text, so it never flags. Page backgrounds, table
 shading and highlights don't either: they're painted before the text, or light against it.
 
+A rectangle covers a text line when it hides at least 40% of the area of the words the line
+draws, or at least 40% of the line's box together with a positive-area intersection with one
+of its words. The gap an applied redaction leaves (a `TJ` adjustment where the text was) is in the line's box but
+holds no word, so a redaction box over it alone does not count.
+
 Limits, by design and documented rather than hidden:
 
 - only filled rectangles count as covers, drawn with `re` or as a single `m`/`l` subpath whose
@@ -23,9 +28,13 @@ Limits, by design and documented rather than hidden:
   translucent one (`/ca` below 1) is not flagged;
 - covers inside form XObjects are found, but only text drawn directly in the page content is
   checked under them;
-- annotation rectangles are compared in unrotated user space, so `/Rotate` pages may misalign.
+- annotation rectangles are compared in unrotated user space, so `/Rotate` pages may misalign;
+- a cover that hides less than 40% of a line's box and less than 40% of its words (a short
+  value in the middle of a long line) is not flagged.
 
 It fails closed: an undecodable content stream, malformed `/Annots`, form XObjects nested deeper
 than 32 or in a cycle, or a walk past the operator bound is an error, never "no findings".
 
-Surfaces: the `redact_audit` automation tool and `pdfcraft-cli`.
+Surfaces: the `doc_audit_redactions` automation tool and `pdfcraft-cli audit`. Both report each
+rectangle in points from the top-left of the page as displayed (y down, after `/Rotate`), like
+the other tools; `AuditFinding::rect` itself stays in PDF user space.
diff --git a/crates/audit/src/cover.rs b/crates/audit/src/cover.rs
index be8afe0a8..3df666c19 100644
--- a/crates/audit/src/cover.rs
+++ b/crates/audit/src/cover.rs
@@ -219,10 +219,13 @@ impl<'a> Walker<'a> {
                 b"h" => {
                     path = match path {
                         Path::Lines(pts, _) => Path::Lines(pts, true),
+                        // `re` already closed its subpath, so a further `h` changes nothing.
+                        Path::Rect(r) => Path::Rect(r),
                         _ => Path::Other,
                     };
                 }
-                b"f" | b"F" | b"f*" | b"B" | b"B*" => {
+                // `b`/`b*` close the path before filling it, which the fill does anyway.
+                b"f" | b"F" | b"f*" | b"B" | b"B*" | b"b" | b"b*" => {
                     if let Some(r) = std::mem::replace(&mut path, Path::Empty).rect()
                         && gs.alpha >= 1.0
                     {
diff --git a/crates/audit/src/lib.rs b/crates/audit/src/lib.rs
index ad26c2559..204d237b3 100644
--- a/crates/audit/src/lib.rs
+++ b/crates/audit/src/lib.rs
@@ -9,12 +9,13 @@
 //! unreadable (WCAG contrast below 3.0). Page backgrounds, table shading and highlight
 //! marks are therefore not flagged.
 //!
-//! Detection limits (documented, not hidden): only `re` rectangles closed by a fill operator
-//! are considered — arbitrary filled paths, shadings and patterns are not; a rectangle drawn
-//! with a translucent ExtGState (`/ca < 1`) is not flagged; annotation rectangles are compared
-//! in unrotated user space, so pages with `/Rotate` may misalign; covers inside form XObjects
-//! are found, but only text drawn directly in the page content is checked under them, so text
-//! inside a form XObject is not audited.
+//! Detection limits (documented, not hidden): `re` rectangles and single closed `m`/`l`
+//! subpaths whose four corners form an axis-aligned rectangle in user space (#1510) are
+//! considered when closed by a fill operator — other filled paths, shadings and patterns are
+//! not; a rectangle drawn with a translucent ExtGState (`/ca < 1`) is not flagged; annotation
+//! rectangles are compared in unrotated user space, so pages with `/Rotate` may misalign;
+//! covers inside form XObjects are found, but only text drawn directly in the page content
+//! is checked under them, so text inside a form XObject is not audited.
 //!
 //! The audit fails closed: any content that cannot be read (an undecodable content stream,
 //! malformed annotations, form XObjects nested deeper than 32 or in a cycle) is an error, never
@@ -40,6 +41,11 @@ pub enum FindingKind {
 }
 
 impl FindingKind {
+    /// The stable machine-readable ID for this finding class.
+    ///
+    /// These strings are the crate's public vocabulary: they appear in CLI output and are
+    /// the IDs a future machine-readable format would serialize. Do not rename them;
+    /// add a new variant instead.
     pub fn id(self) -> &'static str {
         match self {
             FindingKind::CoveredText => "covered-text",
@@ -54,9 +60,11 @@ pub struct AuditFinding {
     /// 0-based page index.
     pub page: usize,
     pub kind: FindingKind,
-    /// The covering rectangle (or the mark's rectangle), in page user space.
+    /// The covering rectangle (or the mark's rectangle), in page user space, normalized so
+    /// `rect[0] <= rect[2]` and `rect[1] <= rect[3]`.
     pub rect: [f64; 4],
-    /// The extractable text the cover hides (possibly empty when nothing decodable remains).
+    /// The extractable text the cover hides, lines joined with single spaces and trimmed.
+    /// Possibly empty when nothing decodable remains under the cover.
     pub covered_text: String,
 }
 
@@ -76,7 +84,8 @@ pub enum AuditError {
     Edit(#[from] pdfcraft_edit::EditError),
 }
 
-/// Fraction of a text line's area that must lie under a cover to count as hidden.
+/// Fraction of a text line's ink (the area of its words), or of its box, that must lie under a
+/// cover to count as hidden (see [`covers`]).
 const COVER_FRACTION: f64 = 0.4;
 /// WCAG contrast ratio below which the text is unreadable against the cover.
 const COVER_CONTRAST: f64 = 3.0;
@@ -106,7 +115,7 @@ pub fn audit_redactions(doc: &Document) -> Result<Vec<AuditFinding>, AuditError>
         for annot in annots(doc, &page.dict)? {
             let mut covered = String::new();
             for line in &lines {
-                if covers(&annot, &line.rect) {
+                if covers(&annot, line) {
                     if !covered.is_empty() {
                         covered.push(' ');
                     }
@@ -126,23 +135,35 @@ pub fn audit_redactions(doc: &Document) -> Result<Vec<AuditFinding>, AuditError>
 /// make the text unreadable. Light covers (table shading, highlights) over dark text fail the
 /// contrast check and are not flagged.
 fn is_cover(rect: &cover::FilledRect, line: &TextLine) -> bool {
-    rect.pos > line.paint_pos() && covers(&rect.rect, &line.rect) && contrast(line.color, rect.rgb) < COVER_CONTRAST
+    rect.pos > line.paint_pos() && covers(&rect.rect, line) && contrast(line.color, rect.rgb) < COVER_CONTRAST
 }
 
-/// Does `cover` hide a substantial part of `line`?
-fn covers(cover: &[f64; 4], line: &[f64; 4]) -> bool {
-    let ix0 = cover[0].max(line[0]);
-    let iy0 = cover[1].max(line[1]);
-    let ix1 = cover[2].min(line[2]);
-    let iy1 = cover[3].min(line[3]);
-    if ix1 <= ix0 || iy1 <= iy0 {
-        return false;
-    }
-    let line_area = (line[2] - line[0]).max(0.0) * (line[3] - line[1]).max(0.0);
-    if line_area <= 0.0 {
-        return false;
-    }
-    (ix1 - ix0) * (iy1 - iy0) / line_area >= COVER_FRACTION
+/// Does `cover` hide a substantial part of what `line` draws? Two ways, either is enough:
+///
+/// - 40% of the area of the line's words (its `ink`) lies under the cover. Measured on the words,
+///   not the box: an applied redaction leaves a gap that draws nothing (a `TJ` adjustment where
+///   the text was), and the box still spans it, so a redaction box at the end of a line used to
+///   cover most of the box and flag the words left beside it.
+/// - 40% of the line's box lies under the cover (the measure used before `ink`) and intersects the ink
+///   of a word still drawn. This keeps a cover over a short value after a long label
+///   flagged, while a cover over the gap alone, with no word under it, stops counting.
+///
+/// A line without word boxes is measured on its box alone.
+fn covers(cover: &[f64; 4], line: &TextLine) -> bool {
+    let hidden = |b: &[f64; 4]| area(&[cover[0].max(b[0]), cover[1].max(b[1]), cover[2].min(b[2]), cover[3].min(b[3])]);
+    let fraction = |boxes: &[[f64; 4]]| {
+        let total: f64 = boxes.iter().map(area).sum();
+        if total > 0.0 { boxes.iter().map(hidden).sum::<f64>() / total } else { 0.0 }
+    };
+    let inked = fraction(&line.ink) >= COVER_FRACTION;
+    let boxed = fraction(std::slice::from_ref(&line.rect)) >= COVER_FRACTION;
+    let word_intersects = || line.ink.iter().any(|w| hidden(w) > 0.0);
+    inked || (boxed && (line.ink.is_empty() || word_intersects()))
+}
+
+/// The area of a rectangle, 0 when it is empty or inverted.
+fn area(r: &[f64; 4]) -> f64 {
+    (r[2] - r[0]).max(0.0) * (r[3] - r[1]).max(0.0)
 }
 
 /// WCAG 2.x relative luminance of an sRGB triple.
diff --git a/crates/audit/src/tests.rs b/crates/audit/src/tests.rs
index be98d7284..d7d83a7db 100644
--- a/crates/audit/src/tests.rs
+++ b/crates/audit/src/tests.rs
@@ -5,7 +5,7 @@ use std::sync::Arc;
 
 use pdfcraft_cos::Document;
 
-use crate::{FindingKind, audit_redactions};
+use crate::{AuditFinding, FindingKind, audit_redactions};
 
 /// Minimal PDF assembler: objects are numbered 1..=n in order.
 struct Builder {
@@ -228,12 +228,105 @@ fn self_drawing_form_fails_the_audit() {
     assert!(matches!(result, Err(crate::AuditError::TooDeep)), "{result:?}");
 }
 
+/// An applied redaction leaves the words around it and a `TJ` adjustment over the gap where the
+/// text was, then the redaction box. At the end of a line, the box covers most of the line's box
+/// (which spans the gap) but none of its words: nothing is hidden, so nothing is flagged.
+#[test]
+fn applied_redaction_at_the_end_of_a_line_is_not_flagged() {
+    let content = b"BT /F1 11 Tf 72 742 Td [(Mail the team:) -11354] TJ ET\n0 g\n144.138 739.8 121.814 11 re f\n";
+    let findings = audit_redactions(&open(one_page(content, ""))).expect("audit must run");
+    assert!(findings.is_empty(), "{findings:?}");
+    // The same gap between two words, wider than the words beside it.
+    let content = b"BT /F1 11 Tf 72 742 Td [(Card:) -14000 (ok)] TJ ET\n0 g\n101 739.8 150 11 re f\n";
+    let findings = audit_redactions(&open(one_page(content, ""))).expect("audit must run");
+    assert!(findings.is_empty(), "{findings:?}");
+}
+
+/// The control: the same box over text still drawn under it is a faux redaction, at the end of a
+/// line as in the middle of a short one.
+#[test]
+fn faux_redaction_at_the_end_of_a_line_is_found() {
+    let content = b"BT /F1 11 Tf 72 742 Td (Mail the team: someone@example.com) Tj ET\n0 g\n144.138 739.8 121.814 11 re f\n";
+    let findings = audit_redactions(&open(one_page(content, ""))).expect("audit must run");
+    assert_eq!(findings.len(), 1, "{findings:?}");
+    assert_eq!(findings[0].covered_text, "Mail the team: someone@example.com");
+    let content = b"BT /F1 11 Tf 72 742 Td [(Card:) -300 (4111111111111111) -300 (ok)] TJ ET\n0 g\n101 739.8 100 11 re f\n";
+    let findings = audit_redactions(&open(one_page(content, ""))).expect("audit must run");
+    assert_eq!(findings.len(), 1, "{findings:?}");
+}
+
+/// A cover over a short value after a long label hides less than 40% of the line's words, but the
+/// whole of the words it covers, and most of the line's box: still a faux redaction. The value
+/// follows the label in the same `TJ` after a wide gap, or in a second run moved by `Td`.
+#[test]
+fn faux_redaction_over_a_short_value_after_a_long_label_is_found() {
+    let content = b"BT /F1 11 Tf 72 742 Td [(Social insurance number:) -8000 (123 456 789)] TJ ET\n0 g\n200 739.8 150 11 re f\n";
+    let findings = audit_redactions(&open(one_page(content, ""))).expect("audit must run");
+    assert_eq!(findings.len(), 1, "{findings:?}");
+    assert_eq!(findings[0].covered_text, "Social insurance number: 123 456 789");
+    let content = b"BT /F1 11 Tf 72 742 Td (Account:) Tj 70 0 Td (4111) Tj ET\n0 g\n115 739.8 55 11 re f\n";
+    let findings = audit_redactions(&open(one_page(content, ""))).expect("audit must run");
+    assert_eq!(findings.len(), 1, "{findings:?}");
+    assert!(findings[0].covered_text.contains("4111"), "{findings:?}");
+}
+
+/// Text set with a negative font size in a mirrored text matrix runs its glyphs backwards: a
+/// cover over the address it draws is still found.
+#[test]
+fn faux_redaction_over_mirrored_text_is_found() {
+    let content = b"BT /F1 -11 Tf -1 0 0 1 300 742 Tm (Mail the team: someone@example.com) Tj ET\n0 g\n365 733 130 14 re f\n";
+    let findings = audit_redactions(&open(one_page(content, ""))).expect("audit must run");
+    assert_eq!(findings.len(), 1, "{findings:?}");
+    assert_eq!(findings[0].covered_text, "Mail the team: someone@example.com");
+}
+
+/// A cover over less than half a value must retain the historical line-box detection.
+#[test]
+fn faux_redaction_over_a_partial_value_after_a_long_label_is_found() {
+    partial_value_is_found(false);
+}
+
+#[test]
+fn faux_redaction_over_a_partial_value_after_a_long_label_on_a_rotated_page_is_found() {
+    partial_value_is_found(true);
+}
+
+fn partial_value_is_found(rotated: bool) {
+    let bytes = one_page(
+        b"BT /F1 11 Tf 72 742 Td [(Social insurance number:) -8000 (123456789)] TJ ET\n0 g\n193 738 111 16 re f\n",
+        if rotated { "/Rotate 90" } else { "" },
+    );
+    let findings = audit_redactions(&open(bytes)).expect("audit must run");
+    assert_eq!(findings.len(), 1, "partial value, rotated={rotated}");
+}
+
+/// Keep the historic detections with several covers, lines and text-spacing states.
+#[test]
+fn faux_redactions_with_multiple_covers_lines_and_spacing_are_found() {
+    let cases: [&[u8]; 4] = [
+        b"BT /F1 11 Tf 72 742 Td (Account: 123456789) Tj ET\n0 g\n72 738 65 16 re f\n140 738 40 16 re f\n",
+        b"BT /F1 11 Tf 72 742 Td (Account: 123456789) Tj 0 -15 Td (Account: 987654321) Tj ET\n0 g\n115 723 100 30 re f\n",
+        b"BT /F1 11 Tf 8 Tc 72 742 Td (Account: 1234) Tj ET\n0 g\n145 738 90 16 re f\n",
+        b"BT /F1 11 Tf 250 Tz 72 742 Td (Account: 1234) Tj ET\n0 g\n100 738 160 16 re f\n",
+    ];
+    for content in cases {
+        let findings = audit_redactions(&open(one_page(content, ""))).expect("audit must run");
+        assert_eq!(findings.len(), 1, "{}: {findings:?}", String::from_utf8_lossy(content));
+    }
+}
+
 #[test]
 fn rectangle_drawn_as_a_path_covers_text_like_re() {
     // The same cover as `re`, built from `m`/`l` (closed with `h`, a repeated start point, or
     // only by the fill itself), or in a scaled user space: all are faux redactions (#1510).
-    let covers: [&[u8]; 5] = [
+    // So are `re` with a redundant `h`, and either path painted with `b`/`b*` (#1817).
+    let covers: [&[u8]; 10] = [
         b"0 g\n100 688 220 32 re f\n",
+        b"0 g\n100 688 220 32 re h f\n",
+        b"0 g\n100 688 220 32 re b\n",
+        b"0 g\n100 688 220 32 re h b*\n",
+        b"0 g\n100 688 m 320 688 l 320 720 l 100 720 l b\n",
+        b"0 g\n100 688 m 320 688 l 320 720 l 100 720 l h b*\n",
         b"0 g\n100 688 m 320 688 l 320 720 l 100 720 l h f\n",
         b"0 g\n100 688 m 320 688 l 320 720 l 100 720 l 100 688 l h f\n",
         b"0 g\n100 688 m 100 720 l 320 720 l 320 688 l f\n",
@@ -253,9 +346,12 @@ fn rectangle_drawn_as_a_path_covers_text_like_re() {
 #[test]
 fn non_rectangular_path_is_not_a_cover() {
     // Each path's bounding box covers the text, but the shape itself does not hide it all.
-    let covers: [&[u8]; 5] = [
+    let covers: [&[u8]; 7] = [
         // A triangle.
         b"0 g\n100 688 m 320 688 l 320 720 l h f\n",
+        // A triangle painted with `b`, and a trapezoid with `b*`.
+        b"0 g\n100 688 m 320 688 l 320 720 l b\n",
+        b"0 g\n100 688 m 320 688 l 320 720 l 140 720 l b*\n",
         // A triangle, then a line from its start point after `h`: not a fourth corner.
         b"0 g\n100 688 m 320 688 l 320 720 l h 100 720 l f\n",
         // A trapezoid: four corners, one slanted side.
@@ -272,3 +368,92 @@ fn non_rectangular_path_is_not_a_cover() {
         assert!(findings.is_empty(), "{:?}: {findings:?}", String::from_utf8_lossy(cover));
     }
 }
+
+#[test]
+fn finding_kind_ids_are_stable() {
+    // The string IDs are the crate's public vocabulary (CLI output, future machine-readable
+    // formats). They must not change; add a variant instead of renaming.
+    assert_eq!(FindingKind::CoveredText.id(), "covered-text");
+    assert_eq!(FindingKind::UnappliedMark.id(), "unapplied-mark");
+}
+
+#[test]
+fn covered_text_finding_is_fully_determined() {
+    // Golden test: the whole finding, not just its presence, is pinned.
+    let content = b"BT /F1 24 Tf 100 700 Td (SECRET DATA 123) Tj ET\n0 g\n100 688 220 32 re f\n";
+    let findings = audit_redactions(&open(one_page(content, ""))).expect("audit must run");
+    assert_eq!(
+        findings,
+        vec![AuditFinding {
+            page: 0,
+            kind: FindingKind::CoveredText,
+            rect: [100.0, 688.0, 320.0, 720.0],
+            covered_text: "SECRET DATA 123".to_string(),
+        }]
+    );
+}
+
+#[test]
+fn unapplied_mark_finding_is_fully_determined() {
+    // Golden test for the second finding class, with its exact mark rectangle.
+    let content = b"BT /F1 24 Tf 100 700 Td (DO NOT SHARE) Tj ET\n";
+    let page_extra = "/Annots [6 0 R]";
+    let mut b = Builder::new();
+    b.add("<< /Type /Catalog /Pages 2 0 R >>");
+    b.add("<< /Type /Pages /Kids [3 0 R] /Count 1 >>");
+    b.add(&format!("<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> {page_extra} >>"));
+    b.add_stream(content);
+    b.add(FONT);
+    b.add("<< /Type /Annot /Subtype /Redact /Rect [95 685 305 725] /C [1 0 0] >>");
+    let findings = audit_redactions(&open(b.build())).expect("audit must run");
+    assert_eq!(
+        findings,
+        vec![AuditFinding { page: 0, kind: FindingKind::UnappliedMark, rect: [95.0, 685.0, 305.0, 725.0], covered_text: "DO NOT SHARE".to_string() }]
+    );
+}
+
+/// A page whose content draws a chain of `n` nested form XObjects. The innermost form draws
+/// nothing, so a successful audit reports no findings.
+fn nested_forms(n: usize) -> Vec<u8> {
+    let mut b = Builder::new();
+    b.add("<< /Type /Catalog /Pages 2 0 R >>");
+    b.add("<< /Type /Pages /Kids [3 0 R] /Count 1 >>");
+    // Object 3: page; object 4: content; objects 5..5+n: the form chain.
+    b.add("<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] /Contents 4 0 R /Resources << /XObject << /F1 5 0 R >> >> >>");
+    b.add_stream(b"/F1 Do");
+    for i in 1..=n {
+        let obj = 4 + i;
+        if i < n {
+            let next = obj + 1;
+            let name = format!("/F{}", i + 1);
+            b.add_stream_with(
+                format!("/{name} Do", name = &name[1..]).as_bytes(),
+                &format!(
+                    "/Type /XObject /Subtype /Form /BBox [0 0 612 792] /Resources << /XObject << /F{i} {next} 0 R >> >>",
+                    i = i + 1,
+                    next = next
+                ),
+            );
+        } else {
+            b.add_stream_with(b"q Q", "/Type /XObject /Subtype /Form /BBox [0 0 612 792]");
+        }
+        debug_assert_eq!(b.objects.len(), obj);
+    }
+    b.build()
+}
+
+#[test]
+fn forms_nested_at_depth_limit_audit_clean() {
+    // 32 nested forms is the deepest walk the audit follows: it must succeed and report
+    // the page clean rather than fail.
+    let findings = audit_redactions(&open(nested_forms(32))).expect("audit must run");
+    assert!(findings.is_empty(), "{findings:?}");
+}
+
+#[test]
+fn forms_nested_past_depth_limit_fail_closed() {
+    // The 33rd nesting level cannot be followed: the audit fails rather than report the
+    // page clean with a possible cover left unseen.
+    let result = audit_redactions(&open(nested_forms(33)));
+    assert!(matches!(result, Err(crate::AuditError::TooDeep)), "{result:?}");
+}
diff --git a/crates/automation/README.md b/crates/automation/README.md
index d702b7ed4..4e27702a3 100644
--- a/crates/automation/README.md
+++ b/crates/automation/README.md
@@ -27,9 +27,14 @@ mcp::McpServer::new(a).serve(stdin, stdout)?             // newline-delimited JS
 - For proportional image signature resizing, use the embedded image layer's width/height ratio rather than a previously stretched annotation rectangle. The GUI preserves this ratio at corners with the opposite corner anchored; edge midpoint handles change only their own axis. `comment_edit` accepts the resulting rectangle.
 - `doc_close` refuses to drop unsaved changes unless `discard_changes: true`. `doc_save` writes atomically, incrementally in place, and in full for a new path. Atomic output writes call `sync_all` on the staging file before replacing the destination. A write or sync error leaves the destination intact, removes staging and leaves the document dirty for retry. A filesystem that does not support syncing returns an error; there is no unsynced fallback. This flushes file contents, but does not guarantee persistence of the parent-directory rename across power loss.
 - With a root set, every read and write path must resolve inside it (symlinks and `..` included). Relative paths resolve inside the root, and `..` is resolved by name before the check. Every path outside the root gets the same refusal (`<path> is outside the allowed directory <root>`), whether or not it exists, so a confined agent can't probe the rest of the disk; on Windows another network share or device path (`\\host\share`, `\\?\UNC\…`, `\\.\…`) is refused without being contacted. "Not found" and other filesystem errors are reported only for paths inside the root. Tools that write several files into a folder name them after the document or input file, with separators, colons and control characters replaced by `_`, so a name can't lead them out of the folder. The root itself must be a folder.
+- `Automation::with_automation_roots` holds a read folder and a write folder (`pdfcraft-cli mcp --automation-read-root DIR --automation-write-root DIR`, see [docs/mcp.md](../../docs/mcp.md)). Reads must lie inside the read root and writes inside the write root, links followed. A root left out grants none of its access. Refusals read `automation path rejected: outside the read root <root>: <path>`. It applies on top of `with_root`.
 
 ## Text search and cache limits
 
+`text_word_count` counts the current snapshot without filling the text cache. It returns totals
+and per-page Unicode word/character counts, with optional tagged-table, tagged-code and
+image/OCR exclusions. See [word count](../../docs/word-count.md) for counting rules and limits.
+
 Extracted page text is reused in a session-wide LRU cache: at most **64 MiB** of estimated owned
 text storage and **4,096 pages**, shared by all open documents. Accounting includes glyph-vector
 capacity, each glyph string's capacity, line indexes and word-break flags. Cache hits share the
@@ -152,6 +157,10 @@ For inline editor previews, `page_render` accepts `hide_text_block` (a 1-based i
 `text_paragraphs`). It renders the page without that paragraph’s source glyphs and leaves the
 working document unchanged.
 
+`page_render.hide_added_text` does the same for an added text item's 1-based index from
+`content_list` or `object_list`. It removes only that item in a read-only preview and is
+mutually exclusive with `hide_text_block`.
+
 
 ## Existing text and document fonts
 
@@ -184,3 +193,19 @@ unapplied with a warning.
 `doc_batch` runs conversion, OCR and compression over files and optionally recursive
 folders. The CLI also exposes it as `pdfcraft-cli batch`. See the
 [batch guide](../../docs/cli-batch.md) for examples, output protection, errors and limits.
+
+## Viewer navigation history
+
+A running PdfCraft instance launched with `--control FILE` exposes its per-tab history through
+`pdfcraft-cli ui --control FILE command id=view.previous_view` and
+`pdfcraft-cli ui --control FILE command id=view.next_view`. `commands` reports whether each action
+is enabled for the active document. These are the same actions as the rail buttons, View → Page
+navigation, and Ctrl+[ / Ctrl+] (⌘[ / ⌘] on macOS).
+
+Explicit page jumps, including search-result selection and Next/Previous match, enter history
+when the page changes. Automatic search refresh, continuous scrolling, and within-page scroll
+movement do not. Existing page-step commands and single-page wheel turns retain their history
+behavior. Back/Forward
+returns to page tops, does not restore zoom, does not switch documents, and is not saved across
+restarts. Standalone engine/MCP sessions have no viewport, so they do not have a separate
+navigation-history tool; use the opt-in UI control channel to navigate the displayed document.
diff --git a/crates/automation/src/a11y.rs b/crates/automation/src/a11y.rs
index 71e96131e..1e8d71bd1 100644
--- a/crates/automation/src/a11y.rs
+++ b/crates/automation/src/a11y.rs
@@ -202,6 +202,10 @@ fn review_html(record: &Value) -> Result<String> {
     Ok(html)
 }
 
+/// Tags in one page of `accessibility_tags`, by default and at most.
+const TAG_PAGE: usize = 200;
+const MAX_TAG_PAGE: usize = 1000;
+
 impl Automation {
     pub(crate) fn accessibility_autotag_apply(&mut self, a: &Args) -> Result<Value> {
         let id = self.doc(a)?.id;
@@ -213,6 +217,19 @@ impl Automation {
         }))
     }
 
+    pub(crate) fn accessibility_autotag_form_fields(&mut self, a: &Args) -> Result<Value> {
+        let id = self.doc(a)?.id;
+        self.session.apply(id, pdfcraft_engine::Edit::AutoTagFormFields).map_err(failed)?;
+        let report = self
+            .doc(a)?
+            .accessibility_check(&Options { rules: [Rule::TaggedFormFields].into(), pages: None })
+            .ok_or_else(|| failed("the document can't be read"))?;
+        let result = report.result(Rule::TaggedFormFields).ok_or_else(|| failed("the form field check is unavailable"))?;
+        Ok(
+            json!({ "status": status_id(result.status), "remaining_findings": result.findings.len(), "note": "Only form widgets were tagged. Review text, figures, links, reading order, and other document content separately." }),
+        )
+    }
+
     pub(crate) fn accessibility_autotag_preview(&self, a: &Args) -> Result<Value> {
         let page = self.page(a)?;
         let preview = self.doc(a)?.autotag_preview(page).map_err(failed)?;
@@ -269,6 +286,14 @@ impl Automation {
         Ok(report_json(&r))
     }
 
+    /// Report only untagged page content, annotations, and AcroForm widgets.
+    pub(crate) fn a11y_find_untagged(&self, a: &Args) -> Result<Value> {
+        let pages = a.opt_ints("pages")?.map(|_| self.pages(a, "pages")).transpose()?;
+        let rules = [Rule::TaggedContent, Rule::TaggedAnnotations, Rule::TaggedFormFields].into_iter().collect();
+        let report = self.doc(a)?.accessibility_check(&Options { rules, pages }).ok_or_else(|| failed("the document can't be read for checking"))?;
+        Ok(report_json(&report))
+    }
+
     pub(crate) fn a11y_report(&self, a: &Args) -> Result<Value> {
         let o = self.a11y_options(a)?;
         let doc = self.doc(a)?;
@@ -441,11 +466,39 @@ impl Automation {
         self.accessibility_figures(a)
     }
 
+    /// The structure tags, one page at a time (`offset`, `limit`), optionally only some types, pages
+    /// (1-based) or depths. `count` is how many match; `next` is where the following page starts.
     pub(crate) fn accessibility_tags(&self, a: &Args) -> Result<Value> {
-        let tags: Vec<Value> = self
+        let offset = usize::try_from(a.opt_int("offset")?.unwrap_or(0)).map_err(|_| ToolError::InvalidArgs("offset must be 0 or more".into()))?;
+        let limit = a.opt_int("limit")?.unwrap_or(TAG_PAGE as i64);
+        let limit = usize::try_from(limit)
+            .ok()
+            .filter(|l| (1..=MAX_TAG_PAGE).contains(l))
+            .ok_or_else(|| ToolError::InvalidArgs(format!("limit must be from 1 to {MAX_TAG_PAGE}")))?;
+        let types: Option<Vec<&str>> = a.get("types").map(|_| a.strs("types")).transpose()?;
+        let pages: Option<Vec<usize>> = a
+            .opt_ints("pages")?
+            .map(|p| p.into_iter().map(|n| usize::try_from(n).ok().filter(|n| *n >= 1).map(|n| n - 1)).collect::<Option<Vec<_>>>())
+            .map(|p| p.ok_or_else(|| ToolError::InvalidArgs("pages must be 1-based page numbers".into())))
+            .transpose()?;
+        let max_depth = a
+            .opt_int("max_depth")?
+            .map(|d| usize::try_from(d).map_err(|_| ToolError::InvalidArgs("max_depth must be 0 or more".into())))
+            .transpose()?;
+        let matching: Vec<_> = self
             .doc(a)?
             .tags()
             .into_iter()
+            .filter(|t| types.as_ref().is_none_or(|ty| ty.contains(&t.kind.as_str())))
+            .filter(|t| pages.as_ref().is_none_or(|p| t.page.is_some_and(|page| p.contains(&page))))
+            .filter(|t| max_depth.is_none_or(|d| t.depth <= d))
+            .collect();
+        let count = matching.len();
+        let next = offset.checked_add(limit).filter(|n| *n < count);
+        let tags: Vec<Value> = matching
+            .into_iter()
+            .skip(offset)
+            .take(limit)
             .map(|t| {
                 json!({
                     "object": t.object.num, "generation": t.object.generation, "type": t.kind,
@@ -455,7 +508,17 @@ impl Automation {
                 })
             })
             .collect();
-        Ok(json!({ "count": tags.len(), "tags": tags }))
+        Ok(json!({ "count": count, "tags": tags, "next": next }))
+    }
+
+    pub(crate) fn accessibility_tag_content(&self, a: &Args) -> Result<Value> {
+        let object = u32::try_from(a.int("object")?).map_err(|_| ToolError::InvalidArgs("object must be a positive tag object number".into()))?;
+        let generation =
+            u16::try_from(a.int("generation")?).map_err(|_| ToolError::InvalidArgs("generation must be a PDF object generation".into()))?;
+        let content = self.doc(a)?.tag_content(pdfcraft_cos::ObjRef { num: object, generation }).map_err(failed)?;
+        Ok(
+            json!({ "count": content.len(), "content": content.into_iter().map(|item| json!({ "page": item.page.map(|p| p + 1), "mcid": item.mcid, "text": item.text })).collect::<Vec<_>>() }),
+        )
     }
 
     pub(crate) fn accessibility_set_tag_property(&mut self, a: &Args) -> Result<Value> {
@@ -476,6 +539,18 @@ impl Automation {
         self.accessibility_tags(a)
     }
 
+    pub(crate) fn accessibility_mark_tag_artifact(&mut self, a: &Args) -> Result<Value> {
+        let object = u32::try_from(a.int("object")?).map_err(|_| ToolError::InvalidArgs("object must be a positive tag object number".into()))?;
+        if object == 0 {
+            return Err(ToolError::InvalidArgs("object must be a positive tag object number".into()));
+        }
+        let generation = u16::try_from(a.int("generation")?)
+            .map_err(|_| ToolError::InvalidArgs("generation must be a PDF object generation from accessibility_tags".into()))?;
+        let id = self.doc(a)?.id;
+        self.session.apply(id, pdfcraft_engine::Edit::MarkTagArtifact { object: pdfcraft_cos::ObjRef::new(object, generation) }).map_err(failed)?;
+        self.accessibility_tags(a)
+    }
+
     pub(crate) fn accessibility_move_tag(&mut self, a: &Args) -> Result<Value> {
         let reference = |number: &str, generation: &str| -> Result<pdfcraft_cos::ObjRef> {
             let n = u32::try_from(a.int(number)?).map_err(|_| ToolError::InvalidArgs(format!("{number} must be a positive tag object number")))?;
@@ -524,7 +599,7 @@ impl Automation {
         // other tools (the write check passes missing files, which stay per-file errors below).
         let paths = a.strs("paths")?;
         for p in &paths {
-            self.resolve(p, true)?;
+            self.resolve_for(p, crate::file_access::Access::Read, true)?;
         }
         std::fs::create_dir_all(&folder).map_err(|e| failed(e.to_string()))?;
         let ocr = pdfcraft_engine::ocr::engine().map_err(failed)?;
diff --git a/crates/automation/src/comments.rs b/crates/automation/src/comments.rs
index d98c48723..302688f72 100644
--- a/crates/automation/src/comments.rs
+++ b/crates/automation/src/comments.rs
@@ -511,7 +511,8 @@ impl Automation {
         let text_at = |t: &str| {
             let w = (pdfcraft_engine::annot_text::text_width(t, size) + 8.0).clamp(20.0, 600.0);
             let h = size * 1.2 + 6.0;
-            Shape::Typewriter { rect: [at[0], at[1] - h, at[0] + w, at[1]], font_size: size }
+            let rect = pdfcraft_engine::text_box_at(i64::from(info.rotation), at, w, h).unwrap_or([at[0], at[1] - h, at[0] + w, at[1]]);
+            Shape::Typewriter { rect, font_size: size }
         };
         let (shape, contents) = match kind {
             "text" => {
@@ -618,6 +619,12 @@ impl Automation {
             let fill = if f.eq_ignore_ascii_case("none") { None } else { Some(parse_color(f)?) };
             edits.push(Edit::FillAnnotation { page, index, fill });
         }
+        if let Some(size) = a.opt_num("font_size")? {
+            if !(1.0..=400.0).contains(&size) {
+                return Err(ToolError::InvalidArgs("font_size must be 1–400 pt".into()));
+            }
+            edits.push(Edit::FontSizeAnnotation { page, index, size });
+        }
         if let Some(r) = a.nums::<4>("rect")? {
             edits.push(Edit::ResizeAnnotation { page, index, rect: rect_to_user(&info, r) });
         }
@@ -626,7 +633,7 @@ impl Automation {
             edits.push(Edit::MoveAnnotation { page, index, dx: d[0] - o[0], dy: d[1] - o[1] });
         }
         if edits.is_empty() {
-            return Err(ToolError::InvalidArgs("nothing to change: pass contents, color, opacity, width, rect or move".into()));
+            return Err(ToolError::InvalidArgs("nothing to change: pass contents, color, opacity, width, fill, font_size, rect or move".into()));
         }
         let edit = if edits.len() == 1 { edits.remove(0) } else { Edit::Batch { label: "Edit comment".into(), edits } };
         self.apply(a, edit)
diff --git a/crates/automation/src/content.rs b/crates/automation/src/content.rs
index 0e97aa8b6..710952d7c 100644
--- a/crates/automation/src/content.rs
+++ b/crates/automation/src/content.rs
@@ -69,7 +69,7 @@ impl Automation {
         let doc = self.doc(a)?;
         let mut per_page: std::collections::HashMap<usize, usize> = Default::default();
         let items: Vec<Value> = doc
-            .added
+            .added()
             .iter()
             .map(|it| {
                 let index = per_page.entry(it.page).or_default();
@@ -110,7 +110,7 @@ impl Automation {
         let mut t = AddedText { rect, text: a.str("text")?.to_string(), ..AddedText::default() };
         style(a, &mut t)?;
         let mut out = self.apply(a, Edit::AddText { page, text: t })?;
-        out["index"] = json!(self.doc(a)?.added.iter().filter(|x| x.page == page).count());
+        out["index"] = json!(self.doc(a)?.added().iter().filter(|x| x.page == page).count());
         Ok(out)
     }
 
@@ -123,7 +123,7 @@ impl Automation {
         let rect = rect_arg(a, "rect")?.map(|r| to_display(r, ph));
         let mut out = self.apply(a, Edit::AddImage { page, rect, name, bytes: std::sync::Arc::new(bytes) })?;
         let doc = self.doc(a)?;
-        let mine: Vec<_> = doc.added.iter().filter(|x| x.page == page).collect();
+        let mine: Vec<_> = doc.added().iter().filter(|x| x.page == page).collect();
         out["index"] = json!(mine.len());
         out["rect"] = json!(mine.last().map(|x| to_view(x.content.rect(), ph)));
         Ok(out)
@@ -135,7 +135,7 @@ impl Automation {
         let index = a.int("index")?;
         let ph = doc.info.pages[page].height as f64;
         let it = doc
-            .added
+            .added()
             .iter()
             .filter(|x| x.page == page)
             .nth((index - 1).max(0) as usize)
diff --git a/crates/automation/src/conventions.rs b/crates/automation/src/conventions.rs
index af8cf671a..ac670109f 100644
--- a/crates/automation/src/conventions.rs
+++ b/crates/automation/src/conventions.rs
@@ -2,15 +2,31 @@
 use serde_json::{Value, json};
 
 use crate::{Args, Automation, Content, Result, ToolError, encode_png, failed, info, tools};
+use pdfcraft_engine::commands;
 use pdfcraft_render::{RenderRequest, RequestKind};
 
 /// The most steps one `command_batch` runs.
 pub(crate) const MAX_BATCH_STEPS: usize = 1000;
 
+/// Why `id` has no tool to run: a tool name passed as a command id, an id the registry doesn't
+/// know, or a real command that nothing automates yet. They need different fixes from the caller.
+fn no_tool_for(id: &str) -> ToolError {
+    if commands::command(id).is_some() {
+        return failed(format!("command {id:?} has no headless tool; see command_list"));
+    }
+    match tools::find(id) {
+        Some(def) => match def.command {
+            Some(command) => failed(format!("{id:?} is a tool, not a command id; use the command id {command:?}, or call the tool directly")),
+            None => failed(format!("{id:?} is a tool, not a command id; call it directly (command ids are in command_list)")),
+        },
+        None => failed(format!("unknown command id {id:?}; see command_list")),
+    }
+}
+
 impl Automation {
     pub(crate) fn command_run(&mut self, args: &Args) -> Result<Vec<Content>> {
         let id = args.str("id")?;
-        let tool = tools::tool_for_command(id).ok_or_else(|| failed(format!("command {id:?} has no headless tool; see command_list")))?;
+        let tool = tools::tool_for_command(id).ok_or_else(|| no_tool_for(id))?;
         let def = tools::find(tool).ok_or_else(|| failed("command tool is unavailable"))?;
         let mut params = match args.get("params") {
             None | Some(Value::Null) => serde_json::Map::new(),
diff --git a/crates/automation/src/file_access.rs b/crates/automation/src/file_access.rs
new file mode 100644
index 000000000..55b10662f
--- /dev/null
+++ b/crates/automation/src/file_access.rs
@@ -0,0 +1,381 @@
+//! The folders automation may read and write.
+//!
+//! `pdfcraft-cli mcp --automation-read-root <dir> --automation-write-root <dir>` confines the
+//! files an agent's tools reach, with the names and wording VectorCraft uses. [`AutomationRoots`]
+//! holds the two folders. Every path a tool reads is checked with [`Access::Read`] and every path
+//! it writes with [`Access::Write`], in `Automation::resolve`, which all of them go through:
+//!
+//! - The path is made absolute against the working directory, as the file system reads it. Its
+//!   links are followed: for a file that doesn't exist yet, the links of its nearest existing
+//!   folder, the rest of the path being plain names (`..` below a missing folder is refused, and so
+//!   is a link that leads nowhere).
+//! - The result must lie inside the root, compared by whole components (`/work2` isn't inside
+//!   `/work`), without regard to case on Windows.
+//! - Read and write access are separate: a root given alone grants only its own kind of access.
+//!
+//! Without roots nothing is checked. A path is checked, then opened: a process that can change the
+//! folders in between (swapping in a link) can still win that race. The roots keep an agent to the
+//! files it was given; they don't guard against other programs on the computer.
+
+use std::ffi::OsString;
+use std::path::{Component, Path, PathBuf};
+use std::sync::Arc;
+
+/// Read access or write access.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Access {
+    Read,
+    Write,
+}
+
+/// The folders automation may read and write; a root left out grants no access of its kind.
+#[derive(Debug)]
+pub struct AutomationRoots {
+    read: Option<Root>,
+    write: Option<Root>,
+}
+
+#[derive(Debug)]
+struct Root {
+    /// The folder made absolute, links followed: what paths are compared with.
+    resolved: PathBuf,
+    /// The same without Windows' `\\?\` prefix, for people.
+    shown: PathBuf,
+}
+
+impl Root {
+    /// The folder at `path`, which must exist.
+    fn open(path: &Path, access: Access) -> Result<Self, String> {
+        let kind = match access {
+            Access::Read => "read",
+            Access::Write => "write",
+        };
+        let resolved = std::fs::canonicalize(path)
+            .and_then(|p| if p.is_dir() { Ok(p) } else { Err(std::io::ErrorKind::NotADirectory.into()) })
+            .map_err(|e| format!("cannot open the automation {kind} root `{}`: {e}", path.display()))?;
+        Ok(Self { shown: plain(resolved.clone()), resolved })
+    }
+}
+
+impl AutomationRoots {
+    /// The roots `read` and `write`, which must be existing folders; `None` when neither is given
+    /// (nothing is confined then).
+    pub fn new(read: Option<&Path>, write: Option<&Path>) -> Result<Option<Arc<Self>>, String> {
+        if read.is_none() && write.is_none() {
+            return Ok(None);
+        }
+        let read = read.map(|p| Root::open(p, Access::Read)).transpose()?;
+        let write = write.map(|p| Root::open(p, Access::Write)).transpose()?;
+        Ok(Some(Arc::new(Self { read, write })))
+    }
+
+    /// The read root, absolute with its links followed.
+    pub fn read_root(&self) -> Option<&Path> {
+        self.read.as_ref().map(|r| r.shown.as_path())
+    }
+
+    /// The write root, absolute with its links followed.
+    pub fn write_root(&self) -> Option<&Path> {
+        self.write.as_ref().map(|r| r.shown.as_path())
+    }
+
+    /// May the file or folder at `path` be read (or written)? `Err` says why not.
+    pub fn check(&self, path: &str, access: Access) -> Result<(), String> {
+        self.check_path(path, Path::new(path), access)
+    }
+
+    /// [`check`](Self::check) for a path that was already put together from `shown` (the way the
+    /// caller wrote it, which is what refusals quote).
+    pub fn check_path(&self, shown: &str, target: &Path, access: Access) -> Result<(), String> {
+        let root = match access {
+            Access::Read => self.read.as_ref(),
+            Access::Write => self.write.as_ref(),
+        };
+        let Some(Root { resolved: folder, shown: root_shown }) = root else {
+            return match access {
+                Access::Read => Err(format!("automation filesystem access is not granted: read authority is absent: {shown}")),
+                Access::Write => Err(format!("automation filesystem access is not granted: write authority is absent: {shown}")),
+            };
+        };
+        if inside(&resolve(shown, target)?, folder) {
+            return Ok(());
+        }
+        let root = root_shown.display();
+        match access {
+            Access::Read => Err(format!("automation path rejected: outside the read root {root}: {shown}")),
+            Access::Write => Err(format!("automation path rejected: outside the write root {root}: {shown}")),
+        }
+    }
+}
+
+/// `path` without Windows' `\\?\` prefix (which `canonicalize` adds), for people to read.
+fn plain(path: PathBuf) -> PathBuf {
+    if !cfg!(windows) {
+        return path;
+    }
+    let text = path.to_string_lossy();
+    if let Some(rest) = text.strip_prefix(r"\\?\UNC\") {
+        return PathBuf::from(format!(r"\\{rest}"));
+    }
+    match text.strip_prefix(r"\\?\") {
+        Some(rest) => PathBuf::from(rest),
+        None => path,
+    }
+}
+
+/// `path` made absolute with its links followed; for a path that doesn't exist (yet), its nearest
+/// existing folder's links followed and the rest appended.
+fn resolve(shown: &str, path: &Path) -> Result<PathBuf, String> {
+    if path.as_os_str().is_empty() {
+        return Err("automation path rejected: path is empty".into());
+    }
+    // Checked as given: making `…\NUL` absolute gives the device path `\\.\NUL` on Windows.
+    if cfg!(windows) && path.components().any(|c| matches!(c, Component::Normal(n) if is_device_name(&n.to_string_lossy()))) {
+        return Err(format!("automation path rejected: reserved device names are not allowed: {shown}"));
+    }
+    let absolute = std::path::absolute(path).map_err(|e| format!("automation path rejected: cannot resolve {shown}: {e}"))?;
+    // The names below the nearest existing folder, last first.
+    let mut missing: Vec<OsString> = vec![];
+    let mut at = absolute.as_path();
+    loop {
+        match std::fs::canonicalize(at) {
+            Ok(mut found) => {
+                found.extend(missing.iter().rev());
+                return Ok(found);
+            }
+            Err(e) => match std::fs::symlink_metadata(at) {
+                Ok(m) if m.file_type().is_symlink() => return Err(format!("automation path rejected: a link that leads nowhere: {shown}")),
+                // There, yet its real path can't be had (no permission): nothing to compare.
+                Ok(_) => return Err(format!("automation path rejected: cannot resolve {shown}: {e}")),
+                Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
+                Err(e) => return Err(format!("automation path rejected: cannot resolve {shown}: {e}")),
+            },
+        }
+        let parent = at.parent();
+        match (at.components().next_back(), parent) {
+            (Some(Component::Normal(name)), Some(parent)) => {
+                missing.push(name.to_os_string());
+                at = parent;
+            }
+            (Some(Component::ParentDir), _) => {
+                return Err(format!("automation path rejected: parent traversal below a folder that doesn't exist: {shown}"));
+            }
+            // Down to the root (or drive) and it doesn't exist either.
+            _ => {
+                let e = std::io::Error::from(std::io::ErrorKind::NotFound);
+                return Err(format!("automation path rejected: cannot resolve {shown}: {e}"));
+            }
+        }
+    }
+}
+
+/// Is `path` (resolved) `root` or inside it, component by component (without regard to case on
+/// Windows, whose file systems ignore it)?
+fn inside(path: &Path, root: &Path) -> bool {
+    let mut path = path.components();
+    root.components().all(|r| path.next().is_some_and(|p| same_component(p, r)))
+}
+
+fn same_component(a: Component, b: Component) -> bool {
+    if a == b {
+        return true;
+    }
+    if !cfg!(windows) {
+        return false;
+    }
+    match (a.as_os_str().to_str(), b.as_os_str().to_str()) {
+        (Some(a), Some(b)) => a.to_lowercase() == b.to_lowercase(),
+        _ => false,
+    }
+}
+
+/// A Windows device name (`CON`, `NUL`, `COM1`… also with an extension), which names no file.
+fn is_device_name(component: &str) -> bool {
+    let stem = component.split('.').next().unwrap_or(component).trim_end_matches(' ').to_ascii_uppercase();
+    let numbered = |prefix: &str| stem.strip_prefix(prefix).is_some_and(|n| matches!(n, "1" | "2" | "3" | "4" | "5" | "6" | "7" | "8" | "9"));
+    matches!(stem.as_str(), "CON" | "PRN" | "AUX" | "NUL" | "CLOCK$" | "CONIN$" | "CONOUT$") || numbered("COM") || numbered("LPT")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// A fresh folder holding `in` (read root), `out` (write root) and `outside`.
+    fn folders(name: &str) -> (PathBuf, Arc<AutomationRoots>) {
+        let base = std::env::temp_dir().join(format!("pc-file-access-{name}-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&base);
+        for d in ["in/sub", "out", "outside", "in2"] {
+            std::fs::create_dir_all(base.join(d)).unwrap();
+        }
+        std::fs::write(base.join("in/a.pdf"), "x").unwrap();
+        std::fs::write(base.join("outside/secret.pdf"), "x").unwrap();
+        let roots = AutomationRoots::new(Some(&base.join("in")), Some(&base.join("out"))).unwrap().unwrap();
+        (base, roots)
+    }
+
+    fn s(p: PathBuf) -> String {
+        p.to_string_lossy().into_owned()
+    }
+
+    #[test]
+    fn paths_inside_the_roots_pass_and_others_dont() {
+        let (base, roots) = folders("inside");
+        assert_eq!(roots.check(&s(base.join("in/a.pdf")), Access::Read), Ok(()));
+        assert_eq!(roots.check(&s(base.join("in")), Access::Read), Ok(()), "the root itself");
+        assert_eq!(roots.check(&s(base.join("in/sub/new.pdf")), Access::Read), Ok(()), "missing files are checked by their folder");
+        assert_eq!(roots.check(&s(base.join("out/new/deeper/x.png")), Access::Write), Ok(()), "and by their nearest folder");
+        let e = roots.check(&s(base.join("outside/secret.pdf")), Access::Read).unwrap_err();
+        assert!(e.starts_with("automation path rejected: outside the read root"), "{e}");
+        // Read and write access are separate.
+        let e = roots.check(&s(base.join("in/a.pdf")), Access::Write).unwrap_err();
+        assert!(e.contains("outside the write root"), "{e}");
+        assert!(roots.check(&s(base.join("out/x.png")), Access::Read).unwrap_err().contains("outside the read root"));
+        let _ = std::fs::remove_dir_all(base);
+    }
+
+    #[test]
+    fn a_sibling_with_the_same_prefix_is_outside() {
+        let (base, roots) = folders("prefix");
+        std::fs::write(base.join("in2/b.pdf"), "x").unwrap();
+        assert!(roots.check(&s(base.join("in2/b.pdf")), Access::Read).is_err(), "in2 is not inside in");
+        assert!(roots.check(&format!("{}2/c.pdf", s(base.join("in"))), Access::Read).is_err());
+        let _ = std::fs::remove_dir_all(base);
+    }
+
+    #[test]
+    fn parent_traversal_is_resolved_or_refused() {
+        let (base, roots) = folders("dotdot");
+        let sep = std::path::MAIN_SEPARATOR;
+        let up = format!("{}{sep}..{sep}outside{sep}secret.pdf", s(base.join("in")));
+        assert!(roots.check(&up, Access::Read).unwrap_err().contains("outside the read root"), "`..` out of the root");
+        let back = format!("{}{sep}..{sep}a.pdf", s(base.join("in/sub")));
+        assert_eq!(roots.check(&back, Access::Read), Ok(()), "`..` that stays inside");
+        let missing = format!("{}{sep}nope{sep}..{sep}..{sep}outside{sep}x.pdf", s(base.join("out")));
+        let e = roots.check(&missing, Access::Write).unwrap_err();
+        // Windows resolves `..` by name first (so does opening the file there): then it's outside.
+        assert!(e.contains("parent traversal below a folder that doesn't exist") || e.contains("outside the write root"), "{e}");
+        let _ = std::fs::remove_dir_all(base);
+    }
+
+    #[test]
+    fn relative_paths_resolve_against_the_working_directory() {
+        let (base, roots) = folders("relative");
+        // The tests' working directory is the crate's folder: not inside the roots.
+        assert!(roots.check("a.pdf", Access::Read).unwrap_err().contains("outside the read root"));
+        assert!(roots.check("", Access::Read).unwrap_err().contains("path is empty"));
+        let _ = std::fs::remove_dir_all(base);
+    }
+
+    #[test]
+    fn a_missing_root_is_an_error_and_none_is_no_confinement() {
+        let (base, _) = folders("missing");
+        let e = AutomationRoots::new(Some(&base.join("nope")), None).unwrap_err();
+        assert!(e.starts_with("cannot open the automation read root"), "{e}");
+        let e = AutomationRoots::new(None, Some(&base.join("in/a.pdf"))).unwrap_err();
+        assert!(
+            e.starts_with("cannot open the automation write root")
+                && e.ends_with(&std::io::Error::from(std::io::ErrorKind::NotADirectory).to_string()),
+            "{e}"
+        );
+        assert!(AutomationRoots::new(Some(Path::new("")), None).unwrap_err().starts_with("cannot open the automation read root ``"));
+        assert!(AutomationRoots::new(None, None).unwrap().is_none());
+        // One root alone grants only its own access.
+        let read_only = AutomationRoots::new(Some(&base.join("in")), None).unwrap().unwrap();
+        let e = read_only.check(&s(base.join("in/x.pdf")), Access::Write).unwrap_err();
+        assert!(e.contains("write authority is absent"), "{e}");
+        let _ = std::fs::remove_dir_all(base);
+    }
+
+    #[test]
+    fn links_are_followed_before_comparing() {
+        let (base, roots) = folders("links");
+        #[cfg(unix)]
+        let made = |target: &Path, link: &Path| std::os::unix::fs::symlink(target, link).is_ok();
+        #[cfg(windows)]
+        let made = |target: &Path, link: &Path| {
+            let made =
+                if target.is_dir() { std::os::windows::fs::symlink_dir(target, link) } else { std::os::windows::fs::symlink_file(target, link) };
+            made.is_ok()
+        };
+        #[cfg(not(any(unix, windows)))]
+        let made = |_: &Path, _: &Path| false;
+        // Windows needs Developer Mode or elevation to make links: nothing to test without them.
+        if !made(&base.join("outside/secret.pdf"), &base.join("in/leak.pdf")) {
+            eprintln!("skipped: symbolic links can't be made here");
+            let _ = std::fs::remove_dir_all(base);
+            return;
+        }
+        assert!(roots.check(&s(base.join("in/leak.pdf")), Access::Read).unwrap_err().contains("outside the read root"), "a file link out");
+        assert!(made(&base.join("outside"), &base.join("out/away")));
+        let e = roots.check(&s(base.join("out/away/new.png")), Access::Write).unwrap_err();
+        assert!(e.contains("outside the write root"), "a folder link out: {e}");
+        assert!(made(&base.join("outside/gone.pdf"), &base.join("out/dangling.png")));
+        let e = roots.check(&s(base.join("out/dangling.png")), Access::Write).unwrap_err();
+        assert!(e.contains("a link that leads nowhere"), "writing would create the file outside: {e}");
+        // A link to a folder inside the root stays inside.
+        assert!(made(&base.join("in/sub"), &base.join("in/alias")));
+        assert_eq!(roots.check(&s(base.join("in/alias/x.pdf")), Access::Read), Ok(()));
+        // A root given through a link is the folder it leads to.
+        assert!(made(&base.join("in"), &base.join("in-link")));
+        let linked = AutomationRoots::new(Some(&base.join("in-link")), None).unwrap().unwrap();
+        assert_eq!(linked.check(&s(base.join("in/a.pdf")), Access::Read), Ok(()));
+        let _ = std::fs::remove_dir_all(base);
+    }
+
+    #[cfg(windows)]
+    #[test]
+    fn windows_ignores_case_and_refuses_devices() {
+        let (base, roots) = folders("case");
+        let upper = s(base.join("IN/A.PDF"));
+        assert_eq!(roots.check(&upper, Access::Read), Ok(()), "{upper}");
+        assert_eq!(roots.check(&s(base.join("In/Sub/New.pdf")), Access::Read), Ok(()));
+        let e = roots.check(&s(base.join("out/NUL")), Access::Write).unwrap_err();
+        assert!(e.contains("reserved device names"), "{e}");
+        assert!(roots.check(&s(base.join("out/com1.txt")), Access::Write).is_err());
+        assert_eq!(roots.check(&s(base.join("out/console.txt")), Access::Write), Ok(()));
+        let _ = std::fs::remove_dir_all(base);
+    }
+
+    /// Every file a tool reads or writes goes through `Automation::resolve`, which holds it to the
+    /// roots. A function that reaches for the file system without resolving a path first would
+    /// bypass them, so each use of `std::fs` or `File::open` must come after a `resolve` call in
+    /// the same function (or be one of the helpers that only ever get a resolved path).
+    #[test]
+    fn tools_do_not_touch_the_file_system_without_resolving_the_path() {
+        // Helpers that are only called with a resolved path. `doc_batch` (batch.rs) resolves its
+        // inputs and out_dir, walks only inside them (skipping links) and resolves every
+        // discovered file again before `process` reads it or `publish` writes it.
+        const RESOLVED_BY_CALLER: &[&str] = &["write_atomic", "write_atomic_with", "read_review_sidecar", "process", "linked", "walk", "publish"];
+        let dir = Path::new(env!("CARGO_MANIFEST_DIR")).join("src");
+        let mut offenders = vec![];
+        for entry in std::fs::read_dir(&dir).unwrap() {
+            let path = entry.unwrap().path();
+            if path.extension().is_none_or(|e| e != "rs")
+                || path.file_name().is_some_and(|n| n == "file_access.rs" || n.to_string_lossy().starts_with("tests"))
+            {
+                continue;
+            }
+            let text = std::fs::read_to_string(&path).unwrap();
+            // Test modules (which build their own fixtures) come last in each file.
+            let code = text.split("\n#[cfg(test)]").next().unwrap_or("");
+            let lines: Vec<&str> = code.lines().collect();
+            for (n, line) in lines.iter().enumerate() {
+                let trimmed = line.trim_start();
+                if trimmed.starts_with("//")
+                    || !(trimmed.contains("std::fs")
+                        || trimmed.contains("File::open")
+                        || trimmed.contains("File::create")
+                        || trimmed.contains("OpenOptions"))
+                {
+                    continue;
+                }
+                let start = (0..=n).rev().find(|&i| lines[i].trim_start().contains("fn ") && lines[i].trim_start().ends_with('{')).unwrap_or(0);
+                let name = lines[start].split("fn ").nth(1).and_then(|r| r.split(['(', '<']).next()).unwrap_or("");
+                if !RESOLVED_BY_CALLER.contains(&name) && !lines[start..=n].iter().any(|l| l.contains("resolve")) {
+                    offenders.push(format!("{}:{}: in `{name}`: {}", path.display(), n + 1, trimmed));
+                }
+            }
+        }
+        assert!(offenders.is_empty(), "resolve the path with `self.resolve` first: {offenders:#?}");
+    }
+}
diff --git a/crates/automation/src/lib.rs b/crates/automation/src/lib.rs
index 4a34909de..88856305b 100644
--- a/crates/automation/src/lib.rs
+++ b/crates/automation/src/lib.rs
@@ -7,7 +7,10 @@
 //!   server ([`mcp`]), `pdfcraft-cli run` and (later) the UI control channel.
 //! - Pages are **1-based** in every tool, as people number them. Rectangles are in PDF points
 //!   with the origin at the top-left of the displayed page.
-//! - An optional root directory confines every path a tool reads or writes.
+//! - An optional root directory confines every path a tool reads or writes. Separately,
+//!   [`file_access::AutomationRoots`] (`pdfcraft-cli mcp --automation-read-root` and
+//!   `--automation-write-root`) holds a read folder and a write folder, each left out meaning no
+//!   access of its kind.
 
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
@@ -16,6 +19,7 @@ mod batch;
 mod comments;
 mod content;
 mod conventions;
+pub mod file_access;
 mod forms;
 mod links;
 #[cfg(feature = "mcp")]
@@ -33,10 +37,11 @@ use std::path::{Path, PathBuf};
 use std::sync::Arc;
 
 use pdfcraft_engine::{CombineSource, DocId, Document, Edit, Session, commands};
-use pdfcraft_platform::staging::{StagingName, create_staging, staging_suffixes};
+use pdfcraft_platform::staging::{StagingName, staging_suffixes};
 use pdfcraft_render::{PageRenderer, PageText, RenderConfig, RenderRequest, RequestKind};
 use serde_json::{Value, json};
 
+pub use pdfcraft_render::Pixels;
 pub use tools::{ToolDef, tools};
 
 /// One piece of a tool's result.
@@ -107,6 +112,8 @@ const FIND_MAX_WARNING_BYTES: usize = 1024;
 pub struct Automation {
     session: Session,
     root: Option<PathBuf>,
+    /// The read and write folders of `--automation-read-root` / `--automation-write-root`.
+    roots: Option<Arc<file_access::AutomationRoots>>,
     /// Synchronous renderers, rebuilt when a document's working bytes change.
     renderers: HashMap<DocId, (Arc<Vec<u8>>, PageRenderer)>,
     /// Extracted page text, under one memory budget across all open documents.
@@ -121,7 +128,7 @@ impl Default for Automation {
 
 impl Automation {
     pub fn new() -> Self {
-        Self { session: Session::new(), root: None, renderers: HashMap::new(), texts: TextCache::default() }
+        Self { session: Session::new(), root: None, roots: None, renderers: HashMap::new(), texts: TextCache::default() }
     }
 
     /// Confine every path the tools read or write to `root` (relative paths resolve inside it).
@@ -134,26 +141,42 @@ impl Automation {
         Ok(self)
     }
 
+    /// Confine the files the tools read to the read root and the files they write to the write
+    /// root (`None`: no confinement). Applies on top of [`with_root`](Self::with_root) when both
+    /// are set.
+    pub fn with_automation_roots(mut self, roots: Option<Arc<file_access::AutomationRoots>>) -> Self {
+        self.roots = roots;
+        self
+    }
+
     /// Use a fixed clock for saves (deterministic output in tests).
     pub fn with_clock(mut self, clock: fn() -> i64) -> Self {
         self.session = std::mem::take(&mut self.session).with_clock(clock);
         self
     }
 
+    /// The clock and time zone of a host without its own. See [`Session::with_wall_clock`].
+    pub fn with_wall_clock(mut self, clock: fn() -> i64, utc_offset: fn() -> i64) -> Self {
+        self.session = std::mem::take(&mut self.session).with_wall_clock(clock, utc_offset);
+        self
+    }
+
     pub fn session(&self) -> &Session {
         &self.session
     }
 
     /// Save `bytes` that a caller writes on the session's behalf, such as `pdfcraft-cli run`
     /// saving a rendered page. With a root, it is confined like a tool's own output (a relative
-    /// path resolves inside it) and written atomically. Without one, the path is written as
-    /// given, so `/dev/stdout` and the like still work. Returns where the file went.
+    /// path resolves inside it). Written atomically either way (#2166), except to something
+    /// that is not a regular file, such as `/dev/stdout` or a pipe, which is written as given.
+    /// Returns where the file went.
     pub fn write_output(&self, path: &str, bytes: &[u8]) -> Result<PathBuf> {
         let target = self.resolve(path, true)?;
-        if self.root.is_some() {
-            write_atomic(&target, bytes)?;
-        } else {
+        let special = self.root.is_none() && self.roots.is_none() && std::fs::metadata(&target).is_ok_and(|m| !m.is_file() && !m.is_dir());
+        if special {
             std::fs::write(&target, bytes).map_err(|e| failed(format!("{path}: {e}")))?;
+        } else {
+            write_atomic(&target, bytes)?;
         }
         Ok(target)
     }
@@ -186,6 +209,7 @@ impl Automation {
             "page_render" => return self.page_render(&a).map(|c| vec![c]),
             "comment_image_preview" => return self.comment_image_preview(&a),
             "text_extract" => self.text_extract(&a)?,
+            "text_word_count" => self.text_word_count(&a)?,
             "text_find" => self.text_find(&a)?,
             "page_rotate" => {
                 let degrees = a.int("degrees")?;
@@ -352,7 +376,9 @@ impl Automation {
                 self.apply(&a, Edit::DuplicatePages { pages })?
             }
             "page_set_box" => self.page_set_box(&a)?,
+            "page_transition_set" => self.page_transition_set(&a)?,
             "doc_create" => self.doc_create(&a)?,
+            "xfa_to_static" => self.apply(&a, Edit::XfaToStatic)?,
             "doc_flatten" => {
                 let (comments, fields) = (a.opt_bool("comments")?.unwrap_or(true), a.opt_bool("fields")?.unwrap_or(true));
                 if !comments && !fields {
@@ -466,6 +492,15 @@ impl Automation {
                             ImageEdit::Move([u0[0].min(u1[0]) as f64, u0[1].min(u1[1]) as f64, u0[0].max(u1[0]) as f64, u0[1].max(u1[1]) as f64])
                         }
                         "rotate" => ImageEdit::Rotate(a.opt_int("quarters")?.unwrap_or(1) as i32),
+                        "crop" => {
+                            let r: Vec<f64> =
+                                a.get("rect").and_then(Value::as_array).map(|x| x.iter().filter_map(Value::as_f64).collect()).unwrap_or_default();
+                            let r =
+                                <[f64; 4]>::try_from(r).map_err(|_| ToolError::InvalidArgs("crop needs rect: 4 numbers, the part to keep".into()))?;
+                            let info = &self.doc(&a)?.info.pages[page];
+                            let (u0, u1) = (info.view_to_user(r[0] as f32, r[1] as f32), info.view_to_user(r[2] as f32, r[3] as f32));
+                            ImageEdit::Crop([u0[0].min(u1[0]) as f64, u0[1].min(u1[1]) as f64, u0[0].max(u1[0]) as f64, u0[1].max(u1[1]) as f64])
+                        }
                         "flip_horizontal" => ImageEdit::Flip { horizontal: true },
                         "flip_vertical" => ImageEdit::Flip { horizontal: false },
                         "delete" => ImageEdit::Delete,
@@ -517,6 +552,12 @@ impl Automation {
                         .iter()
                         .map(|p| self.resolve(p.as_str().ok_or_else(|| ToolError::InvalidArgs("directory must be a path".into()))?, false))
                         .collect::<Result<Vec<_>>>()?
+                } else if let Some(roots) = &self.roots {
+                    // The installed fonts are outside the roots: look in the read root instead.
+                    let read = roots
+                        .read_root()
+                        .ok_or_else(|| failed("automation filesystem access is not granted: read authority is absent: installed fonts"))?;
+                    vec![self.resolve(&read.to_string_lossy(), false)?]
                 } else if let Some(root) = &self.root {
                     vec![root.clone()]
                 } else {
@@ -722,8 +763,10 @@ impl Automation {
             "comment_set_status" => self.comment_set_status(&a)?,
             "sign_list" => self.sign_list(&a)?,
             "accessibility_check" => self.a11y_check(&a)?,
+            "accessibility_find_untagged" => self.a11y_find_untagged(&a)?,
             "accessibility_autotag_preview" => self.accessibility_autotag_preview(&a)?,
             "accessibility_autotag_apply" => self.accessibility_autotag_apply(&a)?,
+            "accessibility_autotag_form_fields" => self.accessibility_autotag_form_fields(&a)?,
             "ocr_recognize" => self.ocr_recognize(&a)?,
             "js_run" => self.js_run(&a)?,
             "js_document_scripts" => self.js_document_scripts(&a)?,
@@ -754,7 +797,9 @@ impl Automation {
             "accessibility_figures" => self.accessibility_figures(&a)?,
             "accessibility_set_alt" => self.accessibility_set_alt(&a)?,
             "accessibility_tags" => self.accessibility_tags(&a)?,
+            "accessibility_tag_content" => self.accessibility_tag_content(&a)?,
             "accessibility_set_tag_property" => self.accessibility_set_tag_property(&a)?,
+            "accessibility_mark_tag_artifact" => self.accessibility_mark_tag_artifact(&a)?,
             "accessibility_move_tag" => self.accessibility_move_tag(&a)?,
             "sign_id_create" => self.sign_id_create(&a)?,
             "sign_document" => self.sign_document(&a)?,
@@ -819,7 +864,8 @@ impl Automation {
             .session
             .bookmark_page(id, offset, limit)
             .ok_or_else(|| ToolError::Failed(format!("no open document with id {} (see doc_list)", id.0)))?;
-        Ok(json!({ "bookmarks": nest_rows(&page.rows), "next": page.next, "truncated": page.truncated }))
+        let pages = &self.doc(a)?.info.pages;
+        Ok(json!({ "bookmarks": nest_rows(&page.rows, pages), "next": page.next, "truncated": page.truncated }))
     }
 
     fn doc(&self, a: &Args) -> Result<&Document> {
@@ -866,7 +912,14 @@ impl Automation {
         let id = doc.id;
         let target = match a.opt_str("path")? {
             Some(p) => self.resolve(p, true)?,
-            None => PathBuf::from(doc.path.clone().ok_or_else(|| failed("the document has never been saved: pass a path"))?),
+            None => {
+                // Saving in place writes where the file was opened from, which the read root
+                // allows and the write root may not.
+                let own = doc.path.clone().ok_or_else(|| failed("the document has never been saved: pass a path"))?;
+                let own_path = PathBuf::from(&own);
+                self.check_roots(&own, &own_path, file_access::Access::Write)?;
+                own_path
+            }
         };
         let same_file = doc.path.as_deref().is_some_and(|p| Path::new(p) == target);
         // Saving to a new file is a full rewrite unless asked otherwise, like Save As.
@@ -879,11 +932,24 @@ impl Automation {
         // A save that adds or removes encryption, or must not keep the old revision (Sanitize,
         // redaction), is rewritten in full even when an incremental save was asked for.
         let incremental = !full && bytes.starts_with(&self.doc(a)?.saved_bytes());
+        self.publish_save(id, &target, bytes, incremental, write)
+    }
+
+    /// Validate the prepared bytes before publishing them or marking the document saved.
+    fn publish_save(
+        &mut self,
+        id: DocId,
+        target: &Path,
+        bytes: Arc<Vec<u8>>,
+        incremental: bool,
+        write: impl FnOnce(&Path, &[u8]) -> Result<()>,
+    ) -> Result<Value> {
         self.session.check_save(id, &bytes).map_err(failed)?;
-        write(&target, &bytes)?;
+        write(target, &bytes)?;
         let path = target.to_string_lossy().into_owned();
         self.session.mark_saved(id, bytes.clone(), Some(path.clone())).map_err(failed)?;
-        Ok(json!({ "path": path, "bytes": bytes.len(), "incremental": incremental, "document": summary(self.doc(a)?) }))
+        let doc = self.session.get(id).ok_or_else(|| failed("the saved document is no longer open"))?;
+        Ok(json!({ "path": path, "bytes": bytes.len(), "incremental": incremental, "document": summary(doc) }))
     }
 
     fn doc_revisions(&mut self, a: &Args) -> Result<Value> {
@@ -993,11 +1059,14 @@ impl Automation {
     }
 
     fn doc_optimize(&mut self, a: &Args) -> Result<Value> {
-        use pdfcraft_engine::optimize::{Compression, ImageSettings, Settings};
+        use pdfcraft_engine::optimize::{Compression, ImageSettings, Preset};
         let id = self.doc(a)?.id;
         let before = self.doc(a)?.bytes.len();
         let path = self.resolve(a.str("path")?, true)?;
-        let mut settings = Settings::default();
+        let mut settings = match a.opt_str("preset")? {
+            None => Preset::Standard.settings(),
+            Some(p) => Preset::from_name(p).ok_or_else(|| ToolError::InvalidArgs(format!("unknown preset {p:?} (standard, mobile)")))?.settings(),
+        };
         let images = |key: &str, base: ImageSettings| -> Result<ImageSettings> {
             let Some(v) = a.get(key) else { return Ok(base) };
             let mut s = base;
@@ -1025,6 +1094,7 @@ impl Automation {
         settings.color = images("color", settings.color)?;
         settings.gray = images("gray", settings.gray)?;
         for (key, flag) in [
+            ("merge_fragments", &mut settings.merge_fragments),
             ("discard_thumbnails", &mut settings.discard_thumbnails),
             ("discard_alternate_images", &mut settings.discard_alternate_images),
             ("discard_tags", &mut settings.discard_tags),
@@ -1057,6 +1127,8 @@ impl Automation {
             "path": path.to_string_lossy(),
             "bytes_before": before,
             "bytes_after": bytes.len(),
+            "merged_images": o.merged_images,
+            "fragments_merged": o.fragments_merged,
             "images": o.images,
             "images_resampled": o.images_resampled,
             "images_recompressed": o.images_recompressed,
@@ -1197,7 +1269,7 @@ impl Automation {
             let out = pdfcraft_engine::export::extract_images(&doc.export_source(), &pages, min).map_err(failed)?;
             let mut files = Vec::new();
             for (k, img) in out.images.iter().enumerate() {
-                let path = child(&folder, &pdfcraft_engine::export::image_file_name(&stem, img, k + 1));
+                let path = child(&folder, &pdfcraft_engine::export::image_file_name(&stem, img, k + 1, doc.info.pages.len()));
                 write_atomic(&path, &img.data)?;
                 files.push(json!({ "path": path.to_string_lossy(), "page": img.page + 1, "width": img.width, "height": img.height }));
             }
@@ -1279,6 +1351,58 @@ impl Automation {
         Ok(summary(self.session.get(id).ok_or_else(|| failed("the document vanished"))?))
     }
 
+    fn page_transition_set(&mut self, a: &Args) -> Result<Value> {
+        use pdfcraft_engine::{Transition, TransitionSpec};
+        let n = self.doc(a)?.info.pages.len();
+        let pages = match a.opt_ints("pages")? {
+            Some(_) => self.pages(a, "pages")?,
+            None => (0..n).collect(),
+        };
+        let transition = match a.opt_str("style")? {
+            None | Some("none") => None,
+            Some(style) => {
+                let mut t = Transition::new(style);
+                if let Some(d) = a.opt_num("duration")? {
+                    t.duration = d as f32;
+                }
+                if let Some(dm) = a.opt_str("dimension")? {
+                    t.horizontal = match dm {
+                        "horizontal" => true,
+                        "vertical" => false,
+                        other => return Err(ToolError::InvalidArgs(format!("dimension must be horizontal or vertical, not {other:?}"))),
+                    };
+                }
+                if let Some(m) = a.opt_str("motion")? {
+                    t.inward = match m {
+                        "inward" => true,
+                        "outward" => false,
+                        other => return Err(ToolError::InvalidArgs(format!("motion must be inward or outward, not {other:?}"))),
+                    };
+                }
+                match a.get("direction") {
+                    None => {}
+                    Some(Value::String(s)) if s == "none" => t.direction = None,
+                    Some(v) => {
+                        t.direction = Some(
+                            v.as_u64()
+                                .and_then(|d| u16::try_from(d).ok())
+                                .ok_or_else(|| ToolError::InvalidArgs("direction must be 0, 90, 180, 270, 315 or \"none\"".into()))?,
+                        );
+                    }
+                }
+                if let Some(s) = a.opt_num("scale")? {
+                    t.scale = s as f32;
+                }
+                if let Some(b) = a.opt_bool("opaque")? {
+                    t.opaque = b;
+                }
+                Some(t)
+            }
+        };
+        let display = a.opt_num("display")?.map(|s| s as f32);
+        self.apply(a, Edit::SetTransition { pages, spec: TransitionSpec { transition, display } })
+    }
+
     fn page_set_box(&mut self, a: &Args) -> Result<Value> {
         use pdfcraft_engine::{BoxSpec, PageBox};
         let doc = self.doc(a)?;
@@ -1687,12 +1811,23 @@ impl Automation {
             return Err(ToolError::InvalidArgs(format!("dpi must be between 1 and {MAX_DPI}")));
         }
         let scale = (dpi / 72.0) as f32;
-        let out = if let Some(block) = a.opt_int("hide_text_block")? {
+        let block = a.opt_int("hide_text_block")?;
+        let added = a.opt_int("hide_added_text")?;
+        if block.is_some() && added.is_some() {
+            return Err(ToolError::InvalidArgs("choose only one of hide_text_block and hide_added_text".into()));
+        }
+        let out = if let Some(block) = block {
             let index = usize::try_from(block)
                 .ok()
                 .and_then(|n| n.checked_sub(1))
                 .ok_or_else(|| ToolError::InvalidArgs("hide_text_block must be a positive paragraph index from text_paragraphs".into()))?;
             self.doc(a)?.text_edit_preview(page, index).map_err(failed)?.render_background(scale).map_err(failed)?
+        } else if let Some(added) = added {
+            let index = usize::try_from(added)
+                .ok()
+                .and_then(|n| n.checked_sub(1))
+                .ok_or_else(|| ToolError::InvalidArgs("hide_added_text must be a positive added text index from object_list".into()))?;
+            self.doc(a)?.added_text_preview(page, index).map_err(failed)?.render_background(scale).map_err(failed)?
         } else {
             self.renderer(id)?.render(RenderRequest { page, kind: RequestKind::Pixels, tile: None, scale, tag: 0, preview: false })
         };
@@ -1703,6 +1838,27 @@ impl Automation {
         Ok(Content::Png { data, width: out.width, height: out.height })
     }
 
+    /// A page as RGBA pixels, without encoding a PNG. `page` is 1-based and `scale` is pixels
+    /// per point (1.0 = 72 dpi). For an embedder that paints the result straight onto a canvas:
+    /// the `page_render` tool only returns PNG, and encoding one to decode it again is wasted
+    /// work on every scroll. It uses the same renderer, and the same per-document cache, as
+    /// `page_render`.
+    pub fn render_pixels(&mut self, doc: u64, page: usize, scale: f32) -> Result<(u32, u32, pdfcraft_render::Pixels)> {
+        if !(scale.is_finite() && scale > 0.0 && scale <= (MAX_DPI / 72.0) as f32) {
+            return Err(ToolError::InvalidArgs(format!("scale must be between 0 and {}", MAX_DPI / 72.0)));
+        }
+        let id = DocId(doc);
+        let n = self.session.get(id).ok_or_else(|| failed(format!("no open document with id {doc} (see doc_list)")))?.info.pages.len();
+        if page < 1 || page > n {
+            return Err(ToolError::InvalidArgs(format!("page {page} is out of range: the document has {n} pages")));
+        }
+        let out = self.renderer(id)?.render(RenderRequest { page: page - 1, kind: RequestKind::Pixels, tile: None, scale, tag: 0, preview: false });
+        if let Some(e) = out.error {
+            return Err(failed(format!("page {page} could not be rendered: {e}")));
+        }
+        Ok((out.width, out.height, out.rgba))
+    }
+
     fn page(&self, a: &Args) -> Result<usize> {
         let n = self.doc(a)?.info.pages.len();
         let p = a.int("page")?;
@@ -1757,6 +1913,28 @@ impl Automation {
         Ok(pages.iter().map(|p| (*p, results.get(p).cloned().unwrap_or_else(|| Err("text extraction returned no result".into())))).collect())
     }
 
+    fn text_word_count(&self, a: &Args) -> Result<Value> {
+        use pdfcraft_engine::word_count::{self, Counts, Options};
+        let doc = self.doc_to_copy(a)?;
+        let pages = match a.opt_ints("pages")? {
+            Some(_) => self.pages(a, "pages")?,
+            None => (0..doc.info.pages.len()).collect(),
+        };
+        let options = Options {
+            exclude_tables: a.opt_bool("exclude_tables")?.unwrap_or(false),
+            exclude_code: a.opt_bool("exclude_code")?.unwrap_or(false),
+            exclude_images: a.opt_bool("exclude_images")?.unwrap_or(false),
+        };
+        let report = word_count::count(doc.export_source(), &pages, options, |_| true).map_err(failed)?;
+        let counts = |c: Counts| json!({ "words": c.words, "characters": c.characters, "characters_without_spaces": c.characters_without_spaces });
+        Ok(json!({
+            "total": counts(report.total),
+            "pages": report.pages.into_iter().map(|(p, c)| json!({ "page": p + 1, "counts": counts(c) })).collect::<Vec<_>>(),
+            "pages_without_text": report.pages_without_text,
+            "unclassified_structure": report.unclassified_structure,
+        }))
+    }
+
     fn text_extract(&mut self, a: &Args) -> Result<Value> {
         let doc = self.doc_to_copy(a)?;
         let id = doc.id;
@@ -1882,6 +2060,29 @@ impl Automation {
     /// namespace is refused without touching it, and the deepest existing ancestor (links
     /// followed) must be inside the root before anything about the rest is reported.
     fn resolve(&self, path: &str, for_write: bool) -> Result<PathBuf> {
+        let access = if for_write { file_access::Access::Write } else { file_access::Access::Read };
+        self.resolve_for(path, access, for_write)
+    }
+
+    /// [`resolve`](Self::resolve) with the kind of access named, for the places where a file that
+    /// is only read may still be missing (a path checked up front, whose absence is reported per
+    /// file later). The automation roots, if any, get the last word.
+    fn resolve_for(&self, path: &str, access: file_access::Access, may_be_missing: bool) -> Result<PathBuf> {
+        let target = self.resolve_in_root(path, may_be_missing)?;
+        self.check_roots(path, &target, access)?;
+        Ok(target)
+    }
+
+    /// Hold `target`, which `path` named, to the automation read or write root. Always passes
+    /// without roots.
+    fn check_roots(&self, path: &str, target: &Path, access: file_access::Access) -> Result<()> {
+        match &self.roots {
+            Some(roots) => roots.check_path(path, target, access).map_err(failed),
+            None => Ok(()),
+        }
+    }
+
+    fn resolve_in_root(&self, path: &str, for_write: bool) -> Result<PathBuf> {
         let p = Path::new(path);
         let Some(root) = &self.root else { return Ok(p.to_path_buf()) };
         let outside = || failed(format!("{path} is outside the allowed directory {}", root.display()));
@@ -1908,8 +2109,17 @@ impl Automation {
             return Err(outside());
         }
         if !rest.is_empty() && !for_write {
-            // Missing, below a folder inside the root: say why, as the system reports it.
-            real = joined.canonicalize().map_err(|e| failed(format!("{path}: {e}")))?;
+            // Missing, below a folder inside the root: say where it was looked for, so a path
+            // written for another working directory can be corrected (#1890), and otherwise
+            // why, as the system reports it. `joined` is under the root, so naming it reveals
+            // nothing outside.
+            real = joined.canonicalize().map_err(|e| {
+                let (looked, root) = (joined.display(), root.display());
+                match e.kind() {
+                    std::io::ErrorKind::NotFound => failed(format!("{path} not found (looked for {looked}, --root {root})")),
+                    _ => failed(format!("{path}: {e} (looked for {looked}, --root {root})")),
+                }
+            })?;
             if !real.starts_with(root) {
                 return Err(outside()); // it appeared, as a link out, since the check above
             }
@@ -2068,7 +2278,7 @@ impl Args<'_> {
 
 /// Bookmark rows in listing order as JSON: a row holds the rows that follow it on the page at the
 /// next level down in `children`, and paths and pages are 1-based.
-fn nest_rows(rows: &[pdfcraft_engine::BookmarkRow]) -> Vec<Value> {
+fn nest_rows(rows: &[pdfcraft_engine::BookmarkRow], pages: &[pdfcraft_render::PageInfo]) -> Vec<Value> {
     // The open rows, outermost first, with their depth and the children gathered so far.
     let mut open: Vec<(usize, Value, Vec<Value>)> = Vec::new();
     let mut roots = Vec::new();
@@ -2078,7 +2288,10 @@ fn nest_rows(rows: &[pdfcraft_engine::BookmarkRow]) -> Vec<Value> {
             close_row(&mut open, &mut roots);
         }
         let path: Vec<usize> = row.path.iter().map(|p| p.saturating_add(1)).collect();
-        let fields = json!({ "path": path, "title": row.title, "page": row.page.map(|p| p.saturating_add(1)), "open": row.open });
+        let mut fields = json!({ "path": path, "title": row.title, "page": row.page.map(|p| p.saturating_add(1)), "open": row.open });
+        if let Some(destination) = row.page.and_then(|p| pages.get(p)).and_then(|p| destination(&row.view, p)) {
+            fields["destination"] = destination;
+        }
         open.push((depth, fields, Vec::new()));
     }
     while !open.is_empty() {
@@ -2087,6 +2300,36 @@ fn nest_rows(rows: &[pdfcraft_engine::BookmarkRow]) -> Vec<Value> {
     roots
 }
 
+/// Where on its page a bookmark or link goes, in points from the top-left of the displayed page
+/// like every `rect`: the destination type (`XYZ`, `Fit`, `FitH`, `FitV`, `FitR`) and its
+/// position, `null` where the destination leaves it unspecified (`/XYZ null null null` keeps the
+/// reader's position and zoom). `None` for a destination without a type.
+pub(crate) fn destination(view: &pdfcraft_render::DestView, page: &pdfcraft_render::PageInfo) -> Option<Value> {
+    use pdfcraft_render::DestView;
+    let points = |left: Option<f32>, top: Option<f32>| {
+        let [x, y] = page.dest_fraction(left, top, 0);
+        let round = |v: f32| f64::from((v * 100.0).round() / 100.0);
+        (x.map(|x| round(x * page.width)), y.map(|y| round(y * page.height)))
+    };
+    Some(match view {
+        DestView::Top => return None,
+        DestView::Xyz { left, top, zoom } => {
+            let (x, y) = points(*left, *top);
+            json!({ "fit": "XYZ", "left": x, "top": y, "zoom": zoom.map(f64::from) })
+        }
+        DestView::Fit => json!({ "fit": "Fit" }),
+        DestView::FitH { top } => {
+            let (x, y) = points(None, *top);
+            json!({ "fit": "FitH", "left": x, "top": y })
+        }
+        DestView::FitV { left } => {
+            let (x, y) = points(*left, None);
+            json!({ "fit": "FitV", "left": x, "top": y })
+        }
+        DestView::FitR { rect } => json!({ "fit": "FitR", "rect": comments::rect_to_view(page, *rect) }),
+    })
+}
+
 /// Closes the innermost open row: it joins the row above it as a child, or the top level.
 fn close_row(open: &mut Vec<(usize, Value, Vec<Value>)>, roots: &mut Vec<Value>) {
     if let Some((_, mut fields, children)) = open.pop() {
@@ -2209,6 +2452,13 @@ fn info(d: &Document) -> Value {
             },
         })).collect::<Vec<_>>(),
         "layers": i.layers.iter().map(|l| json!({ "name": l.name, "visible": l.visible })).collect::<Vec<_>>(),
+        // Full-screen presentation settings a page carries (ISO 32000-2 §12.4.4): only pages with
+        // a `/Trans` or `/Dur` appear; `style` is null for a display time alone.
+        "transitions": i.transitions.iter().map(|t| json!({
+            "page": page1(t.page), "style": t.style.map(pdfcraft_render::TransitionStyle::name), "duration": t.duration,
+            "horizontal": t.horizontal, "inward": t.inward, "direction": t.direction, "scale": t.scale, "opaque": t.opaque,
+            "display": t.display,
+        })).collect::<Vec<_>>(),
         "attachments": i.attachments.iter().map(|a| json!({ "name": a.name, "description": a.description, "size": a.size })).collect::<Vec<_>>(),
         // `substitute` names the face standing in for a program the document does not embed, and
         // `substitution` says why. Both are null for an embedded font: nothing stands in. A null
@@ -2223,9 +2473,11 @@ fn info(d: &Document) -> Value {
     })
 }
 
-/// A user-space rectangle on 0-based `page` in displayed-page coordinates; unchanged when the
-/// page is unknown (a malformed annotation that points at no page).
-fn view_rect(i: &pdfcraft_render::DocInfo, page: usize, rect: [f32; 4]) -> [f32; 4] {
+/// A user-space rectangle on 0-based `page` in displayed-page coordinates (points from the
+/// top-left of the page as displayed, y down, after `/Rotate`), the way every tool reports
+/// rectangles; unchanged when the page is unknown (a malformed annotation that points at no page).
+/// Public so `pdfcraft-cli` reports the same rectangles as the tools.
+pub fn view_rect(i: &pdfcraft_render::DocInfo, page: usize, rect: [f32; 4]) -> [f32; 4] {
     i.pages.get(page).map_or(rect, |p| comments::rect_to_view(p, rect))
 }
 
@@ -2329,32 +2581,20 @@ fn write_atomic_synced(
     suffixes: impl IntoIterator<Item = u64>,
     sync: impl FnOnce(&std::fs::File) -> std::io::Result<()>,
 ) -> Result<()> {
-    use std::io::Write;
     // A folder can't be replaced, and staging beside it could land outside the root: "." names
     // the root itself, whose parent isn't ours to write in.
     if path.is_dir() {
         return Err(failed(format!("{}: is a folder, not a file", path.display())));
     }
     let dir = path.parent().filter(|p| !p.as_os_str().is_empty()).unwrap_or(Path::new("."));
-    let name = path.file_name().ok_or_else(|| failed(format!("{}: not a file path", path.display())))?;
+    path.file_name().ok_or_else(|| failed(format!("{}: not a file path", path.display())))?;
     std::fs::create_dir_all(dir).map_err(|e| failed(format!("{}: {e}", dir.display())))?;
-    let (tmp, file) =
-        create_staging(dir, &name.to_string_lossy(), StagingName::SuffixThenTag, suffixes).map_err(|e| failed(format!("{}: {e}", dir.display())))?;
-    // Closed at the end of the block, before the rename.
-    let written = {
-        let mut file = file;
-        // Surface delayed writeback failures before replacing the destination or marking
-        // a document clean. The handle is closed before rename (required on Windows).
-        file.write_all(bytes).and_then(|()| sync(&file))
-    };
-    if let Err(e) = written {
-        let _ = std::fs::remove_file(&tmp);
-        return Err(failed(format!("{}: {e}", tmp.display())));
-    }
-    std::fs::rename(&tmp, path).map_err(|e| {
-        let _ = std::fs::remove_file(&tmp);
-        failed(format!("{}: {e}", path.display()))
-    })
+    // The writer itself is the platform crate's, shared with the desktop app and the CLI
+    // (#2166): the staging file is written, flushed (delayed writeback failures surface before
+    // the destination is replaced or a document marked clean), closed and renamed; a failure at
+    // any step removes it and leaves the destination as it was.
+    pdfcraft_platform::staging::write_atomically_with(path, bytes, StagingName::SuffixThenTag, suffixes, sync)
+        .map_err(|e| failed(format!("{}: {e}", path.display())))
 }
 
 #[cfg(test)]
@@ -2731,6 +2971,37 @@ mod tests {
         }
     }
 
+    #[test]
+    fn invalid_save_bytes_never_reach_publication_or_mark_saved() {
+        let dir = staging_dir("invalid-save-bytes");
+        let target = dir.join("out.pdf");
+        let mut a = Automation::new().with_root(&dir).unwrap();
+        let id = search_document(&mut a, 2);
+        json(&mut a, "doc_save", json!({"doc": id.0, "path": "out.pdf"}));
+        let old = std::fs::read(&target).unwrap();
+        json(&mut a, "page_rotate", json!({"doc": id.0, "pages": [1], "degrees": 90}));
+        let before = summary(a.session.get(id).unwrap());
+        // Exercise both parse failure and a valid PDF that loses a page. This does not
+        // depend on a malformed input remaining unrepaired by future reader improvements.
+        for bytes in [b"not a PDF".to_vec(), numbered_pages(1)] {
+            let mut published = false;
+            let result = a.publish_save(id, &target, Arc::new(bytes), false, |_, _| {
+                published = true;
+                Ok(())
+            });
+            assert!(result.is_err(), "invalid output must be refused");
+            assert!(result.unwrap_err().to_string().contains("could not be reopened"));
+            assert!(!published, "validation must precede the writer");
+            assert_eq!(summary(a.session.get(id).unwrap()), before, "failed validation must preserve document state");
+            assert_eq!(std::fs::read(&target).unwrap(), old);
+            assert_eq!(listing(&dir), ["out.pdf"]);
+        }
+        json(&mut a, "doc_save", json!({"doc": id.0}));
+        assert!(!a.session.get(id).unwrap().dirty);
+        assert_ne!(std::fs::read(&target).unwrap(), old);
+        std::fs::remove_dir_all(dir).unwrap();
+    }
+
     #[test]
     fn a_failed_save_sync_keeps_the_document_dirty_and_can_be_retried() {
         let dir = staging_dir("sync-dirty");
diff --git a/crates/automation/src/links.rs b/crates/automation/src/links.rs
index c8ef9fc9d..cd0fb9da0 100644
--- a/crates/automation/src/links.rs
+++ b/crates/automation/src/links.rs
@@ -65,18 +65,34 @@ impl Automation {
 
     pub(crate) fn link_list(&self, a: &Args) -> Result<Value> {
         let doc = self.doc(a)?;
+        let targets: std::collections::HashMap<(usize, usize), &LinkTarget> = doc.info.links.iter().map(|t| ((t.page, t.index), &t.target)).collect();
         let items: Vec<Value> = doc
-            .links
+            .links()
             .iter()
             .map(|l| {
                 let p = &doc.info.pages[l.page];
                 let (v0, v1) = (p.user_to_view(l.rect[0] as f32, l.rect[1] as f32), p.user_to_view(l.rect[2] as f32, l.rect[3] as f32));
                 let rect = [v0[0].min(v1[0]), v0[1].min(v1[1]), v0[0].max(v1[0]), v0[1].max(v1[1])].map(|x| (x * 100.0).round() / 100.0);
                 let mut v = json!({ "page": l.page + 1, "index": l.index + 1, "rect": rect, "visible": l.style.visible });
-                match &l.action {
-                    LinkAction::Page(p) => v["to_page"] = json!(p + 1),
-                    LinkAction::Uri(u) => v["url"] = json!(u),
-                    LinkAction::Other(o) => v["other"] = json!(o),
+                // Where an in-document link goes, as the viewer resolves it: named destinations
+                // included, with the position on the page.
+                let target = targets.get(&(l.page, l.index)).and_then(|t| match t {
+                    LinkTarget::Page(page, view) => Some((*page, view)),
+                    _ => None,
+                });
+                match (&l.action, target) {
+                    (LinkAction::Uri(u), _) => v["url"] = json!(u),
+                    (action, Some((page, view))) => {
+                        v["to_page"] = json!(page + 1);
+                        if let Some(d) = doc.info.pages.get(page).and_then(|p| crate::destination(view, p)) {
+                            v["destination"] = d;
+                        }
+                        if matches!(action, LinkAction::Other(_)) {
+                            v["named"] = json!(true);
+                        }
+                    }
+                    (LinkAction::Page(p), None) => v["to_page"] = json!(p + 1),
+                    (LinkAction::Other(o), None) => v["other"] = json!(o),
                 }
                 v
             })
@@ -163,7 +179,7 @@ impl Automation {
         let index = a.int("index")?;
         let doc = self.doc(a)?;
         let l = doc
-            .links
+            .links()
             .iter()
             .find(|l| l.page == page && l.index as i64 + 1 == index)
             .ok_or_else(|| failed(format!("page {} has no link {index} (see link_list)", page + 1)))?;
@@ -201,8 +217,8 @@ impl Automation {
             None => None,
         };
         let before = match &pages {
-            Some(ps) => self.doc(a)?.links.iter().filter(|l| ps.contains(&l.page)).count(),
-            None => self.doc(a)?.links.len(),
+            Some(ps) => self.doc(a)?.links().iter().filter(|l| ps.contains(&l.page)).count(),
+            None => self.doc(a)?.links().len(),
         };
         let mut out = self.apply(a, Edit::RemoveLinks { pages })?;
         out["removed"] = json!(before);
diff --git a/crates/automation/src/printing.rs b/crates/automation/src/printing.rs
index e9b16fc8a..19cd48ef4 100644
--- a/crates/automation/src/printing.rs
+++ b/crates/automation/src/printing.rs
@@ -125,7 +125,18 @@ impl Automation {
                     bad(format!("unknown paper {p:?}; choose one of {}", PAPERS.iter().map(|(name, _)| *name).collect::<Vec<_>>().join(", ")))
                 })?,
         };
-        let settings = print::Settings { pages, paper, orientation, layout, content };
+        // Print as image (Acrobat's Advanced Print Setup): pictures at `dpi`, grey when
+        // `grayscale` is also asked for.
+        let raster = if a.opt_bool("as_image")?.unwrap_or(false) {
+            let dpi = a.opt_num("dpi")?.unwrap_or(300.0);
+            if !(72.0..=600.0).contains(&dpi) {
+                return Err(bad("dpi must be between 72 and 600"));
+            }
+            Some(print::Raster { dpi, grayscale: a.opt_bool("grayscale")?.unwrap_or(false) })
+        } else {
+            None
+        };
+        let settings = print::Settings { pages, paper, orientation, layout, content, raster, crops: Vec::new() };
         let sizes: Vec<(f64, f64)> = self.doc(a)?.info.pages.iter().map(|p| (p.width as f64, p.height as f64)).collect();
         let sheets = print::layout(&sizes, &settings).map_err(|e| bad(e.to_string()))?.len();
         let bytes = self.session.print_pdf(id, &settings).map_err(failed)?;
diff --git a/crates/automation/src/redact.rs b/crates/automation/src/redact.rs
index 60d8c8b77..1b6283c0a 100644
--- a/crates/automation/src/redact.rs
+++ b/crates/automation/src/redact.rs
@@ -173,14 +173,16 @@ impl Automation {
     }
 
     pub(crate) fn doc_audit_redactions(&self, a: &Args) -> Result<Value> {
-        let findings = self.doc(a)?.audit_redactions().map_err(ToolError::Failed)?;
+        let d = self.doc(a)?;
+        let findings = d.audit_redactions().map_err(ToolError::Failed)?;
         let items: Vec<Value> = findings
             .into_iter()
             .map(|f| {
                 json!({
                     "page": f.page + 1,
                     "kind": f.kind.id(),
-                    "rect": f.rect,
+                    // Points from the top-left of the displayed page, like `comment_list` and `doc_info`.
+                    "rect": crate::view_rect(&d.info, f.page, f.rect.map(|v| v as f32)),
                     "covered_text": f.covered_text,
                 })
             })
diff --git a/crates/automation/src/signing.rs b/crates/automation/src/signing.rs
index 2d0281fc0..94fc4bdec 100644
--- a/crates/automation/src/signing.rs
+++ b/crates/automation/src/signing.rs
@@ -17,6 +17,62 @@ fn time(secs: i64) -> sign::Time {
     sign::Time::from_unix(secs)
 }
 
+/// The longest label `sign_document` takes (characters): a label is a few words.
+const MAX_LABEL_CHARS: usize = 200;
+
+/// `appearance`: which items the visible signature shows; those not given keep the default
+/// (name, date and labels on; reason, location and distinguished name off).
+fn appearance_arg(v: &Value) -> Result<sign::Appearance> {
+    const KEYS: &str = "name, date, reason, location, distinguished_name, labels";
+    let o = v.as_object().ok_or_else(|| bad(format!("appearance must be an object of true/false items ({KEYS})")))?;
+    let mut shown = sign::Appearance::default();
+    for (key, value) in o {
+        let on = value.as_bool().ok_or_else(|| bad(format!("appearance.{key} must be true or false")))?;
+        let item = match key.as_str() {
+            "name" => &mut shown.name,
+            "date" => &mut shown.date,
+            "reason" => &mut shown.reason,
+            "location" => &mut shown.location,
+            "distinguished_name" => &mut shown.distinguished_name,
+            "labels" => &mut shown.labels,
+            other => return Err(bad(format!("unknown appearance item {other:?} ({KEYS})"))),
+        };
+        *item = on;
+    }
+    Ok(shown)
+}
+
+/// `labels`: the words of the visible signature's labels; those not given keep the English. Each
+/// must be drawable in the signature's font. Nobody sees a preview here, so a label it can't draw
+/// is refused even when this signature doesn't show it.
+fn labels_arg(v: &Value) -> Result<sign::AppearanceLabels> {
+    const KEYS: &str = "signed_by, distinguished_name, reason, location, date";
+    let o = v.as_object().ok_or_else(|| bad(format!("labels must be an object of strings ({KEYS})")))?;
+    let mut labels = sign::AppearanceLabels::default();
+    for (key, value) in o {
+        let text = value.as_str().ok_or_else(|| bad(format!("labels.{key} must be a string")))?;
+        if text.chars().count() > MAX_LABEL_CHARS {
+            return Err(bad(format!("labels.{key} is longer than {MAX_LABEL_CHARS} characters")));
+        }
+        let label = match key.as_str() {
+            "signed_by" => &mut labels.signed_by,
+            "distinguished_name" => &mut labels.distinguished_name,
+            "reason" => &mut labels.reason,
+            "location" => &mut labels.location,
+            "date" => &mut labels.date,
+            other => return Err(bad(format!("unknown label {other:?} ({KEYS})"))),
+        };
+        *label = text.to_string();
+    }
+    if let Some((field, c)) = labels.first_undrawable() {
+        return Err(bad(format!(
+            "labels.{field}: {}",
+            pdfcraft_engine::undrawable_message(&format!("the {field} label of the visible signature"), c)
+        )));
+    }
+    Ok(labels)
+}
+
 pub(crate) fn cert_json(c: &Certificate) -> Value {
     json!({
         "name": c.display_name(),
@@ -89,8 +145,8 @@ impl Automation {
             return Err(bad("name must not be empty"));
         }
         let password = a.str("password")?;
-        if password.chars().count() < 6 {
-            return Err(bad("the password must have at least 6 characters"));
+        if password.chars().count() < sign::pkcs12::MIN_PASSWORD_CHARS {
+            return Err(bad(format!("the password must have at least {} characters", sign::pkcs12::MIN_PASSWORD_CHARS)));
         }
         let path = self.resolve(a.str("path")?, true)?;
         let key = match a.opt_str("key")?.unwrap_or("rsa2048") {
@@ -177,6 +233,17 @@ impl Automation {
             Some(g) if rect.is_none() && field.is_none() => return Err(bad(format!("graphic {g} needs a visible signature: pass rect or field"))),
             Some(g) => Some(self.signature_graphic(g)?),
         };
+        let visible = rect.is_some() || field.is_some();
+        let appearance = match a.get("appearance") {
+            None | Some(Value::Null) => sign::Appearance::default(),
+            Some(_) if !visible => return Err(bad("appearance needs a visible signature: pass rect or field")),
+            Some(v) => appearance_arg(v)?,
+        };
+        let appearance_labels = match a.get("labels") {
+            None | Some(Value::Null) => sign::AppearanceLabels::default(),
+            Some(_) if !visible => return Err(bad("labels needs a visible signature: pass rect or field")),
+            Some(v) => labels_arg(v)?,
+        };
         let out = self.resolve(a.str("out")?, true)?;
         let opts = SignOptions {
             field,
@@ -186,6 +253,8 @@ impl Automation {
             location: a.opt_str("location")?.map(str::to_string),
             contact: a.opt_str("contact")?.map(str::to_string),
             certify,
+            appearance,
+            appearance_labels,
             graphic,
             ..SignOptions::default()
         };
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index cfdeb1c16..5e89aef78 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -133,7 +133,7 @@ pub fn tools() -> Vec<ToolDef> {
             .cmd("file.open")
             .with(schema(json!({ "path": { "type": "string" }, "password": { "type": "string", "description": "User or owner password for encrypted files." } }), &["path"])),
         t("doc_list", "List open documents", "List the open documents with their ids, page counts and unsaved state.").ro().with(schema(json!({}), &[])),
-        t("doc_info", "Inspect a document", "Metadata, page sizes and labels, bookmarks, annotations, form fields, links, layers, attachments, fonts, security and repair notes.")
+        t("doc_info", "Inspect a document", "Metadata, page sizes and labels, bookmarks, annotations, form fields, links, layers, page transitions and display times, attachments, fonts, security and repair notes.")
             .ro()
             .cmd("file.properties")
             .with(schema(json!({ "doc": doc() }), &["doc"])),
@@ -161,7 +161,8 @@ pub fn tools() -> Vec<ToolDef> {
         t("page_render", "Render a page", "Render one page to a PNG image (default 96 dpi, at most 600).")
             .ro()
             .with(schema(json!({ "doc": doc(), "page": { "type": "integer", "minimum": 1 }, "dpi": { "type": "number", "minimum": 1, "maximum": 600 },
-                "hide_text_block": { "type": "integer", "minimum": 1, "description": "Render an inline editor background without this paragraph (index from text_paragraphs). Does not modify the document." }
+                "hide_text_block": { "type": "integer", "minimum": 1, "description": "Render an inline editor background without this paragraph (index from text_paragraphs). Does not modify the document." },
+                "hide_added_text": { "type": "integer", "minimum": 1, "description": "Render a retyping background without this added text item (added index from object_list). Mutually exclusive with hide_text_block. Does not modify the document." }
             }), &["doc", "page"])),
         t("object_list", "List editable objects", "List existing paragraphs, Image/Form artwork and added content once, with source kind/index references, displayed rectangles and document generation. Indexes change when content changes; use generation in object_move to reject stale references.")
             .ro().with(schema(json!({"doc":doc(),"page":{"type":"integer","minimum":1}}), &["doc","page"])),
@@ -171,6 +172,12 @@ pub fn tools() -> Vec<ToolDef> {
                     "type":"object","properties":{"kind":{"type":"string","enum":["added","text","image"]},"index":{"type":"integer","minimum":1}},"required":["kind","index"],"additionalProperties":false}},
                 "offset":{"type":"array","items":{"type":"number"},"minItems":2,"maxItems":2},
                 "generation":{"type":"integer","minimum":0,"description":"Use generation returned by object_list to reject a stale selection."}}), &["doc","page","objects","offset"])),
+        t("text_word_count", "Word count", "Count Unicode words and characters on selected pages (default all), with totals and per-page counts. Table/code exclusions use PDF structure tags, not visual guesses; unclassified text is retained. Image exclusion removes Figure-tagged and invisible/OCR text. Does not run OCR. Copy permission is required. Fails rather than returning a partial total when a page cannot be read.")
+            .ro()
+            .cmd("file.word_count")
+            .with(schema(json!({ "doc": doc(), "pages": pages("to count (default: all)"),
+                "exclude_tables": { "type": "boolean" }, "exclude_code": { "type": "boolean" }, "exclude_images": { "type": "boolean" }
+            }), &["doc"])),
         t("text_extract", "Extract text", "Extract the text of some or all pages, in reading order. With rect, only the text inside that rectangle on each page, as Column select takes it: one row per visual line, side-by-side pieces (table cells) separated by a tab.")
             .ro()
             .cmd("edit.column_select")
@@ -223,7 +230,7 @@ pub fn tools() -> Vec<ToolDef> {
                 json!({ "doc": doc(), "at": { "type": "integer", "minimum": 1 }, "width": { "type": "number", "description": "Points." }, "height": { "type": "number", "description": "Points." } }),
                 &["doc", "at"],
             )),
-        t("page_insert_file", "Insert pages from a file", "Insert pages of another PDF so the first becomes page `at`. Undoable.")
+        t("page_insert_file", "Insert pages from a file", "Insert pages of another PDF so the first becomes page `at`. Its bookmarks come along, collapsed under one bookmark named after the file, placed among the document's bookmarks where the pages went. Undoable.")
             .cmd("page.insert")
             .with(schema(json!({ "doc": doc(), "path": { "type": "string" }, "at": { "type": "integer", "minimum": 1 }, "pages": pages("of the source file (default: all)") }), &["doc", "path", "at"])),
         t("page_extract", "Extract pages", "Copy pages into a new PDF (links, bookmarks, fields and layers that belong to them come along). separate: true writes each page as its own file into out_dir; delete: true removes the pages from this document afterwards (undoable).")
@@ -366,8 +373,7 @@ pub fn tools() -> Vec<ToolDef> {
             "Field properties",
             "Change field properties: give field for one field, or fields for a list of unique field names (1–1000). A bulk change is atomic and one Undo step; an invalid or locked field leaves every field unchanged. Only the given properties change, and partial appearance changes preserve each field's other colours and font. name (rename), rect (position) and rotation require a single field. General and Options: tooltip, read_only, required, multiline, max_length (0 = no limit), options (combo/list items), font_size (0 = auto), format, validate, calculate (Acrobat's native AF rules). Options: align (left, center, right), default (Reset form's value; check boxes/radio buttons use their on state, \"\" for off), flags { scroll, rich_text, password, file_select, spell_check, comb (needs max_length), sort, editable, multi_select, commit_immediately }, check_style (check boxes/radio buttons: check, circle, cross, diamond, square, star). rotation is 0, 90, 180 or 270 degrees counterclockwise and swaps width/height when the axis changes. Undoable.",
         )
-        .with({
-            let mut input = schema(
+        .with(schema(
             json!({
                 "doc": doc(),
                 "field": { "type": "string", "description": "The field's current name." },
@@ -393,10 +399,7 @@ pub fn tools() -> Vec<ToolDef> {
                 "calculate": { "description": "Calculate tab: {\"op\": \"sum\"|\"product\"|\"average\"|\"min\"|\"max\", \"fields\": [\"a\", \"b\"]}, {\"notation\": \"Price * Qty\"} (simplified field notation), or \"none\"." },
             }),
             &["doc"],
-        );
-            input["oneOf"] = json!([{ "required": ["field"] }, { "required": ["fields"] }]);
-            input
-        }),
+        )),
         t("form_tab_order", "Set the tab order", "Set the tab order of pages (default all): row (top to bottom, left to right), column, structure, or annotations (unspecified). Or order tabs manually: `field` with `move` earlier|later moves that field one place on its page. Returns the resulting order of fields. Undoable.")
             .with(schema(
                 json!({ "doc": doc(), "order": { "type": "string", "enum": ["row", "column", "structure", "annotations"] }, "pages": pages("to set (default: all)"), "field": { "type": "string" }, "move": { "type": "string", "enum": ["earlier", "later"] } }),
@@ -468,7 +471,7 @@ pub fn tools() -> Vec<ToolDef> {
         t(
             "doc_audit_redactions",
             "Audit faux redactions",
-            "Find faux redactions: opaque filled rectangles painted over text that is still extractable, and /Redact annotations that were marked but never applied. Paint-order and colour-aware: a rectangle counts only when painted after the text and dark enough to hide it (page backgrounds and light shading are not flagged). Each finding reports the 1-based page, the kind (covered-text or unapplied-mark), the rectangle, and the hidden text. Fails closed: unreadable content is an error, never a clean bill. A properly applied redaction removes the text and never flags.",
+            "Find faux redactions: opaque filled rectangles painted over text that is still extractable, and /Redact annotations that were marked but never applied. Paint-order and colour-aware: a rectangle counts only when painted after the text and dark enough to hide it (page backgrounds and light shading are not flagged). Each finding reports the 1-based page, the kind (covered-text or unapplied-mark), the rectangle (points from the top-left of the displayed page, like comment_list), and the hidden text. Fails closed: unreadable content is an error, never a clean bill. A properly applied redaction removes the text and never flags.",
         )
         .ro()
         .with(schema(json!({ "doc": doc() }), &["doc"])),
@@ -479,7 +482,7 @@ pub fn tools() -> Vec<ToolDef> {
         t(
             "doc_print",
             "Print",
-            "Print with Acrobat's Print dialog options, or save the print-ready PDF. pages: a range such as \"1-3, 6, 9-\" (page labels allowed; default all); subset odd/even; reverse. layout: fit (default), actual, shrink, custom (scale %), multiple (per_sheet 2/4/6/9/16, order, border, auto_rotate; cut-stack order arranges single-sided sheets for cutting into piles and stacking left to right, top to bottom, keeping sheet order within each pile; duplex must be off), booklet (booklet_subset both/front/back, binding left/right), poster (scale %, overlap pt, cut_marks). orientation auto/portrait/landscape; comments_forms document / document-and-markups (default) / document-and-stamps / form-fields-only; paper Letter/Legal/Tabloid, ARCH A/B/C/D/E1/E, ANSI C/D/E, or A0/A1/A2/A3/A4/A5 (short names or full preset labels); use layout actual for 100% in the print-ready PDF; printer drivers may still substitute paper or scale. Then path (save) or printer (a name or \"default\") with copies, collate, duplex off/long-edge/short-edge, grayscale, and options (driver options from printer_options, CUPS).",
+            "Print with Acrobat's Print dialog options, or save the print-ready PDF. pages: a range such as \"1-3, 6, 9-\" (page labels allowed; default all); subset odd/even; reverse. layout: fit (default), actual, shrink, custom (scale %), multiple (per_sheet 2/4/6/9/16, order, border, auto_rotate; cut-stack order arranges single-sided sheets for cutting into piles and stacking left to right, top to bottom, keeping sheet order within each pile; duplex must be off), booklet (booklet_subset both/front/back, binding left/right), poster (scale %, overlap pt, cut_marks). orientation auto/portrait/landscape; comments_forms document / document-and-markups (default) / document-and-stamps / form-fields-only; paper Letter/Legal/Tabloid, ARCH A/B/C/D/E1/E, ANSI C/D/E, or A0/A1/A2/A3/A4/A5/A6 (short names or full preset labels); use layout actual for 100% in the print-ready PDF; printer drivers may still substitute paper or scale. Then path (save) or printer (a name or \"default\") with copies, collate, duplex off/long-edge/short-edge, grayscale, and options (driver options from printer_options, CUPS).",
         )
         .with(schema(
             json!({
@@ -506,6 +509,8 @@ pub fn tools() -> Vec<ToolDef> {
                 "collate": { "type": "boolean" },
                 "duplex": { "type": "string", "enum": ["off", "long-edge", "short-edge"] },
                 "grayscale": { "type": "boolean" },
+                "as_image": { "type": "boolean", "description": "Print as image (Acrobat's Advanced Print Setup): every page rendered to a picture at dpi before it is placed on the paper, for printers that skip text, shading or transparency; the print is no longer searchable text, and with grayscale the pictures are grey." },
+                "dpi": { "type": "number", "minimum": 72, "maximum": 600, "description": "Resolution for as_image (default 300)." },
                 "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Printer driver options from printer_options: key → choice value." },
             }),
             &["doc"],
@@ -516,7 +521,7 @@ pub fn tools() -> Vec<ToolDef> {
         t(
             "page_add_text",
             "Add text to a page",
-            "Add text as page content (not a comment). Place it with at [x, y] (top-left, points from the top-left of the displayed page) and width (wrap width, default 200), or rect. Newlines start new lines; long lines wrap. Style: font helvetica/times/courier, size, bold, italic, color (#RRGGBB or a name), align left/center/right. Text must be Western European (WinAnsi) characters; others are refused. It stays editable with content_update. Undoable.",
+            "Add text as page content (not a comment). Place it with at [x, y] (top-left, points from the top-left of the displayed page) and width (wrap width, default 200), or rect. Newlines start new lines; long lines wrap. Style: font helvetica/times/courier, size, bold, italic, color (#RRGGBB or a name), align left/center/right. Text must be Western European (WinAnsi) characters, or Arabic, Hebrew or Thai when the build has their craft-fonts faces (drawn right to left where the text is); others are refused. It stays editable with content_update. Undoable.",
         )
         .cmd("edit.text")
         .with(schema(
@@ -673,7 +678,7 @@ pub fn tools() -> Vec<ToolDef> {
                 "country": { "type": "string", "description": "Two-letter country code." },
                 "key": { "type": "string", "enum": ["rsa2048", "rsa3072", "rsa4096", "p256"] },
                 "years": { "type": "integer", "minimum": 1, "maximum": 50 },
-                "password": { "type": "string", "minLength": 6 },
+                "password": { "type": "string", "minLength": pdfcraft_engine::sign::pkcs12::MIN_PASSWORD_CHARS },
                 "path": { "type": "string", "description": "The .p12 file to write." },
             }),
             &["name", "password", "path"],
@@ -686,7 +691,7 @@ pub fn tools() -> Vec<ToolDef> {
             .ro()
             .cmd("sign.digital")
             .with(schema(json!({}), &[])),
-        t("sign_document", "Sign a document", "Sign with a digital ID (a .p12/.pfx path, or on macOS a Keychain identity: \"keychain:<common name or fingerprint>\" from sign_keychain_ids, or on Windows a store identity: \"windows:<common name or fingerprint>\" from sign_windows_ids) and save the signed file to `out` (signing always saves, as in Acrobat; the document then shows the signed file). Sign an existing empty signature field (`field`), or a new one on `page` at `rect` (omit rect for an invisible signature). certify: no_changes, form_fill or comments makes a certification signature. graphic shows a picture where the signer's name would be large (Acrobat: Configure Signature Appearance): {\"image\": path} (PNG or JPEG), {\"text\": name} (typed in the Fill & Sign script font) or {\"strokes\": [[[x, y], …], …]} (y up, the drawing pad 1 wide); it needs a visible signature. PAdES B-B, SHA-256 (SHA-384 for P-384 keys).")
+        t("sign_document", "Sign a document", "Sign with a digital ID (a .p12/.pfx path, or on macOS a Keychain identity: \"keychain:<common name or fingerprint>\" from sign_keychain_ids, or on Windows a store identity: \"windows:<common name or fingerprint>\" from sign_windows_ids) and save the signed file to `out` (signing always saves, as in Acrobat; the document then shows the signed file). Sign an existing empty signature field (`field`), or a new one on `page` at `rect` (omit rect for an invisible signature). certify: no_changes, form_fill or comments makes a certification signature. graphic shows a picture where the signer's name would be large (Acrobat: Configure Signature Appearance): {\"image\": path} (PNG or JPEG), {\"text\": name} (typed in the Fill & Sign script font) or {\"strokes\": [[[x, y], …], …]} (y up, the drawing pad 1 wide); it needs a visible signature. appearance chooses what a visible signature shows (default: name, date and labels; reason, location and distinguished_name are off unless turned on). labels gives the words of its labels, e.g. in another language (default English: \"Digitally signed by\", \"DN: \", \"Reason: \", \"Location: \", \"Date: \"; include the separator); each must be in Western European characters (Windows-1252), the only ones the signature's font draws, or the call is refused naming the label and character. PAdES B-B, SHA-256 (SHA-384 for P-384 keys).")
             .cmd("sign.digital")
             .with(schema(
                 json!({
@@ -711,6 +716,31 @@ pub fn tools() -> Vec<ToolDef> {
                         "minProperties": 1,
                         "maxProperties": 1,
                     },
+                    "appearance": {
+                        "type": "object",
+                        "description": "What a visible signature shows; items not given keep their default.",
+                        "properties": {
+                            "name": { "type": "boolean", "description": "Default true." },
+                            "date": { "type": "boolean", "description": "Default true." },
+                            "reason": { "type": "boolean", "description": "Default false." },
+                            "location": { "type": "boolean", "description": "Default false." },
+                            "distinguished_name": { "type": "boolean", "description": "Default false." },
+                            "labels": { "type": "boolean", "description": "Default true." },
+                        },
+                        "additionalProperties": false,
+                    },
+                    "labels": {
+                        "type": "object",
+                        "description": "The words of a visible signature's labels (at most 200 characters each, Western European characters only); labels not given stay English.",
+                        "properties": {
+                            "signed_by": { "type": "string", "description": "Above the name. Default \"Digitally signed by\"." },
+                            "distinguished_name": { "type": "string", "description": "Before the certificate's subject. Default \"DN: \"." },
+                            "reason": { "type": "string", "description": "Default \"Reason: \"." },
+                            "location": { "type": "string", "description": "Default \"Location: \"." },
+                            "date": { "type": "string", "description": "Default \"Date: \"." },
+                        },
+                        "additionalProperties": false,
+                    },
                     "out": { "type": "string", "description": "Where to save the signed document." },
                 }),
                 &["doc", "id", "out"],
@@ -749,13 +779,14 @@ pub fn tools() -> Vec<ToolDef> {
                 json!({ "doc": doc(), "sort": { "type": "string", "enum": ["page", "author", "date", "type"] }, "out": save_out, "open": open }),
                 &["doc"],
             )),
-        t("comment_edit", "Edit a comment", "Change a comment's text, colour, opacity, line width, fill (rectangle/oval/polygon; \"none\" removes it), rectangle (rectangle/oval/text box/stamp) or position (`move` [dx, dy] in points). Stamps keep their original appearance when resized. One undo step.").with(schema(
+        t("comment_edit", "Edit a comment", "Change a comment's text, colour, opacity, line width, font size (text box/typewriter/callout), fill (rectangle/oval/polygon; \"none\" removes it), rectangle (rectangle/oval/text box/stamp) or position (`move` [dx, dy] in points). Stamps keep their original appearance when resized. One undo step.").with(schema(
             comment_ref(json!({
                 "contents": { "type": "string" },
                 "color": color(),
                 "opacity": { "type": "number", "minimum": 0, "maximum": 1 },
                 "width": { "type": "number", "minimum": 0 },
                 "fill": { "type": "string", "description": "Interior colour of a rectangle, oval or polygon: #RRGGBB, a colour name, or \"none\" for no fill." },
+                "font_size": { "type": "number", "minimum": 1, "maximum": 400, "description": "Font size in points of a text box, typewriter text or callout; the box grows to hold the text." },
                 "rect": { "type": "array", "items": { "type": "number" }, "minItems": 4, "maxItems": 4 },
                 "move": point(),
             })),
@@ -794,6 +825,26 @@ pub fn tools() -> Vec<ToolDef> {
         t("page_duplicate", "Duplicate pages", "Insert copies of pages after the last of them (fonts and images are shared, not copied). Undoable.")
             .cmd("page.duplicate")
             .with(schema(json!({ "doc": doc(), "pages": pages("to duplicate") }), &["doc", "pages"])),
+        t(
+            "page_transition_set",
+            "Set page transitions",
+            "Set or remove the transition and display time pages play in a full-screen presentation (ISO 32000-2 §12.4.4; Acrobat's Organize ▸ Page Transitions). style: Split, Blinds, Box, Wipe, Dissolve, Glitter, R (replace, no effect), Fly, Push, Cover, Uncover or Fade, or none to remove the transition; duration in seconds (default 1); dimension horizontal/vertical (Split, Blinds); motion inward/outward (Split, Box, Fly); direction 0, 90, 180, 270, 315 or none (Wipe, Glitter, Fly, Cover, Uncover, Push); scale and opaque for Fly. display: seconds the page stays before advancing; left out, the page waits for the presenter. doc_info lists the result under transitions.",
+        )
+        .with(schema(
+            json!({
+                "doc": doc(),
+                "pages": pages("to change (default: all)"),
+                "style": { "type": "string", "enum": ["none", "Split", "Blinds", "Box", "Wipe", "Dissolve", "Glitter", "R", "Fly", "Push", "Cover", "Uncover", "Fade"] },
+                "duration": { "type": "number", "minimum": 0 },
+                "dimension": { "type": "string", "enum": ["horizontal", "vertical"] },
+                "motion": { "type": "string", "enum": ["inward", "outward"] },
+                "direction": { "description": "0, 90, 180, 270, 315 or \"none\"" },
+                "scale": { "type": "number", "exclusiveMinimum": 0 },
+                "opaque": { "type": "boolean" },
+                "display": { "type": "number", "minimum": 0 },
+            }),
+            &["doc"],
+        )),
         t(
             "page_set_box",
             "Set page boxes / crop",
@@ -878,6 +929,9 @@ pub fn tools() -> Vec<ToolDef> {
             .with(schema(json!({ "doc": doc(), "page": { "type": "integer", "minimum": 1 } }), &["doc", "page"])),
         t("accessibility_autotag_apply", "Automatically tag text-only PDF", "Write marked content, a Document structure element, paragraph tags and a parent tree for every text object in an untagged, text-only PDF. Refuses graphics, images, annotations, forms, existing tags and malformed streams before changing anything. Review all resulting roles; this does not certify accessibility. Undoable.")
             .with(schema(json!({ "doc": doc() }), &["doc"])),
+        t("accessibility_autotag_form_fields", "Tag form fields", "Write `/Form` tags, widget structure-parent keys, and a parent tree for all page widgets in an untagged AcroForm. Existing tag trees are refused for review. Text, figures, links, and other content are not tagged.")
+            .cmd("a11y.autotag_fields")
+            .with(schema(json!({ "doc": doc() }), &["doc"])),
         t("accessibility_check", "Check for accessibility", "Run the Accessibility Checker's full check (32 rules in 7 categories: document, page_content, forms, alternate_text, tables, lists, headings). Each rule is passed, failed (with findings and pages), manual (needs a person) or skipped. Findings on locatable figures, annotations and form widgets include bbox_user_space in PDF coordinates. Colour contrast is off unless all is true; rules (ids such as tagged-pdf, figures-alt-text) or categories narrow the check; pages limit the page rules.")
             .ro()
             .cmd("a11y.check")
@@ -891,6 +945,10 @@ pub fn tools() -> Vec<ToolDef> {
                 }),
                 &["doc"],
             )),
+        t("accessibility_find_untagged", "Find untagged content", "Find untagged painted page content, annotations, and form widgets. This focused check does not modify the PDF or claim that its other accessibility rules pass.")
+            .ro()
+            .cmd("a11y.find_untagged")
+            .with(schema(json!({ "doc": doc(), "pages": pages("to search (default: all)") }), &["doc"])),
         t("accessibility_report", "Accessibility report", "Run the full check and write the accessibility report (HTML) to path; returns the results too. Takes the same options as accessibility_check.")
             .destructive()
             .cmd("a11y.report")
@@ -942,10 +1000,24 @@ pub fn tools() -> Vec<ToolDef> {
         t("accessibility_set_alt", "Set alternate text", "Set a figure's alternate text (alt; empty or omitted clears it), or mark it decorative (decorative: true: its content becomes an artifact and the figure leaves the tags). figure is a number from accessibility_figures. Returns the figures. Undoable.")
             .cmd("a11y.alt_text")
             .with(schema(json!({ "doc": doc(), "figure": { "type": "integer", "minimum": 1 }, "alt": { "type": "string" }, "decorative": { "type": "boolean" } }), &["doc", "figure"])),
-        t("accessibility_tags", "List structure tags", "List reachable indirect structure tags in document order with PDF object number, generation, nearest indirect parent, depth, page, type, title, actual text, alternate text and language. Inline tag dictionaries have no stable object reference and are not listed.")
+        t("accessibility_tags", "List structure tags", "List reachable indirect structure tags in document order with PDF object number, generation, nearest indirect parent, depth, page, type, title, actual text, alternate text and language, one page at a time: count is how many tags match, next the offset of the following page (null at the end). types, pages and max_depth keep only some tags. Inline tag dictionaries have no stable object reference and are not listed.")
             .ro()
             .cmd("a11y.tags")
-            .with(schema(json!({ "doc": doc() }), &["doc"])),
+            .with(schema(
+                json!({
+                    "doc": doc(),
+                    "offset": { "type": "integer", "minimum": 0, "description": "Where the page starts, counted from 0 (the previous page's next)" },
+                    "limit": { "type": "integer", "minimum": 1, "maximum": 1000, "description": "Tags in the page (default 200)" },
+                    "types": { "type": "array", "items": { "type": "string" }, "description": "Only tags of these types, as listed in type (such as H1, H2, Table)" },
+                    "pages": { "type": "array", "items": { "type": "integer", "minimum": 1 }, "description": "Only tags on these pages" },
+                    "max_depth": { "type": "integer", "minimum": 0, "description": "Only tags at most this deep (0 = top level)" }
+                }),
+                &["doc"],
+            )),
+        t("accessibility_tag_content", "List tag content", "List the marked-content references directly owned by one reachable indirect structure tag, including page, MCID and extracted text.")
+            .ro()
+            .cmd("a11y.tags")
+            .with(schema(json!({ "doc": doc(), "object": { "type": "integer", "minimum": 1 }, "generation": { "type": "integer", "minimum": 0, "maximum": 65535 } }), &["doc", "object", "generation"])),
         t("accessibility_set_tag_property", "Edit tag property", "Set or clear one property of a reachable indirect structure tag. Use object and generation from accessibility_tags. Properties: type, title, actual_text, alternate_text, language. Empty or omitted value clears text properties; type requires a nonempty PDF name. Undoable.")
             .with(schema(json!({
                 "doc": doc(), "object": { "type": "integer", "minimum": 1 },
@@ -953,6 +1025,11 @@ pub fn tools() -> Vec<ToolDef> {
                 "property": { "type": "string", "enum": ["type", "title", "actual_text", "alternate_text", "language"] },
                 "value": { "type": "string" },
             }), &["doc", "object", "generation", "property"])),
+        t("accessibility_mark_tag_artifact", "Mark tag content as artifact", "Mark a reachable leaf structure tag's direct marked content as an artifact and remove the tag from the reading structure. Use object and generation from accessibility_tags. Tags with child structure elements, no direct marked content, or content not found on its page are rejected. Undoable.")
+            .with(schema(json!({
+                "doc": doc(), "object": { "type": "integer", "minimum": 1 },
+                "generation": { "type": "integer", "minimum": 0, "maximum": 65535 },
+            }), &["doc", "object", "generation"])),
         t("accessibility_move_tag", "Move structure tag", "Move a reachable indirect structure tag before or after a direct sibling in their parent's /K array, changing tagged reading order without changing page appearance. Use object and generation values from accessibility_tags. Rejects distinct parents, duplicate references and positions that are already current. Undoable.")
             .with(schema(json!({
                 "doc": doc(), "object": { "type": "integer", "minimum": 1 },
@@ -1021,7 +1098,7 @@ pub fn tools() -> Vec<ToolDef> {
         t("doc_compare_mark", "Mark differences as comments", "Add the differences from other (older) to doc (newer) as comments in doc: highlights over replaced (blue) and inserted (green) text, notes where text was deleted (red), authored Compare. Undoable.")
             .cmd("doc.compare")
             .with(schema(json!({ "doc": doc(), "other": { "type": "integer" } }), &["doc", "other"])),
-        t("form_detect_fields", "Detect form fields", "Prepare a form ▸ automatic field detection: find the blanks a printed form asks to be filled (underscore runs, lines, empty boxes, small squares for check boxes) and name each field from its label. With add (default true) the fields are created as one undoable step; otherwise they are only proposed. Returns page (1-based), kind, name and rect (points, origin bottom-left).")
+        t("form_detect_fields", "Detect form fields", "Prepare a form ▸ automatic field detection: find the blanks a printed form asks to be filled (underscore runs, lines, empty boxes, small squares for check boxes; on scanned pages read from the pixels) and name each field from its label. With add (default true) the fields are created as one undoable step; otherwise they are only proposed. Returns page (1-based), kind, name and rect (points, origin bottom-left).")
             .cmd("form.detect")
             .with(schema(json!({ "doc": doc(), "pages": pages("to look at (default: all)"), "add": { "type": "boolean" } }), &["doc"])),
         t("form_actions", "Field actions", "Field Properties ▸ Actions: the field's action for each trigger (mouse_up, mouse_down, mouse_enter, mouse_exit, on_focus, on_blur).")
@@ -1068,7 +1145,7 @@ pub fn tools() -> Vec<ToolDef> {
             .ro()
             .cmd("ocr.recognize")
             .with(schema(json!({}), &[])),
-        t("doc_export_all_images", "Export all images", "Write the images that pages use into a folder (`<name>_Page_<n>_Image_<k>.jpg|png`), each once: JPEG images unchanged, others as PNG with their soft mask as alpha. min_size skips images with fewer pixels on their shorter side. Images that can't be decoded yet (JPEG 2000, JBIG2, CCITT, separations) are listed under skipped. Includes unsaved edits.")
+        t("doc_export_all_images", "Export all images", "Write the images that pages use into a folder (`<name>_Page_<n>_Image_<k>.jpg|png`, n zero-padded to the page count's digits), each once: JPEG images unchanged, others as PNG with their soft mask as alpha. min_size skips images with fewer pixels on their shorter side. Images that can't be decoded yet (JPEG 2000, JBIG2, CCITT, separations) are listed under skipped. Includes unsaved edits.")
             .cmd("export.all_images")
             .with(schema(
                 json!({
@@ -1164,14 +1241,14 @@ pub fn tools() -> Vec<ToolDef> {
             .ro()
             .cmd("edit.edit_text")
             .with(schema(json!({ "doc": doc(), "page": { "type": "integer", "minimum": 1 } }), &["doc", "page"])),
-        t("image_edit", "Edit an image", "Change one of a page's images (number from page_images): action move (rect: new full placement box in top-left-origin points, based on page_images.rect), rotate (quarters clockwise, default 1), flip_horizontal, flip_vertical, replace (path: an image file, drawn in the same place) or delete. Undoable. The selected image crop transforms with its pixels, isolating shared path scopes while retaining neighboring painting. Text-outline clips return a clear error. Rotation/flip use the visible centre. Form artwork supports move/resize/rotate/flip/delete as a group; replace and image_save only support raster images.")
+        t("image_edit", "Edit an image", "Change one of a page's images (number from page_images): action move (rect: new full placement box in top-left-origin points, based on page_images.rect), crop (rect: the part to keep, top-left-origin points; the pixels stay in place and page_images.visible_rect shows the result; a later move carries the crop along), rotate (quarters clockwise, default 1), flip_horizontal, flip_vertical, replace (path: an image file, drawn in the same place) or delete. Undoable. The selected image crop transforms with its pixels, isolating shared path scopes while retaining neighboring painting. Text-outline clips return a clear error. Rotation/flip use the visible centre. Form artwork supports move/resize/rotate/flip/delete as a group; replace and image_save only support raster images.")
             .cmd("edit.edit_text")
             .with(schema(
                 json!({
                     "doc": doc(),
                     "page": { "type": "integer", "minimum": 1 },
                     "image": { "type": "integer", "minimum": 1 },
-                    "action": { "type": "string", "enum": ["move", "rotate", "flip_horizontal", "flip_vertical", "replace", "delete"] },
+                    "action": { "type": "string", "enum": ["move", "crop", "rotate", "flip_horizontal", "flip_vertical", "replace", "delete"] },
                     "rect": { "type": "array", "items": { "type": "number" }, "minItems": 4, "maxItems": 4 },
                     "quarters": { "type": "integer" },
                     "path": { "type": "string" },
@@ -1226,12 +1303,14 @@ pub fn tools() -> Vec<ToolDef> {
             .with(schema(json!({ "doc": doc() }), &["doc"])),
         t("doc_open_revision", "Open a revision", "Open saved revision `revision` (1 = the oldest) of a document as a new, unsaved document, to see the file as it was then.")
             .with(schema(json!({ "doc": doc(), "revision": { "type": "integer", "minimum": 1 } }), &["doc", "revision"])),
-        t("doc_optimize", "Optimize PDF", "Write an optimized copy to `path` (Acrobat's PDF Optimizer). color / gray: { downsample, ppi, above_ppi, compression: jpeg|zip|retain, quality 1–100 } (defaults: downsample to 150 ppi above 225, JPEG 60). Images are measured where pages draw them and replaced only when smaller. discard_*: thumbnails (default true), alternate_images (true), tags, print_settings; flate_unencoded (true); remove_invalid_links and remove_unreferenced_dests (true); images and forms the pages list but never draw are always dropped (unused_xobjects). discard: Remove Hidden Information categories (metadata, attachments, comments, form-fields, hidden-text, hidden-layers, bookmarks, links-actions-scripts, private-data). Signed documents are refused. The open document is unchanged.")
+        t("doc_optimize", "Optimize PDF", "Write an optimized copy to `path` (Acrobat's PDF Optimizer). preset: standard (default; Reduce File Size's choices) or mobile (images to 96 ppi above 144, JPEG high quality); the options below change it. merge_fragments (default true) first puts a page picture drawn as many stacked image strips (as some PDF printers write it) back together into one image, so it can be resampled (merged_images, fragments_merged). color / gray: { downsample, ppi, above_ppi, compression: jpeg|zip|retain, quality 1–100 } (defaults: downsample to 150 ppi above 225, JPEG 60). Images are measured where pages draw them and replaced only when smaller. discard_*: thumbnails (default true), alternate_images (true), tags, print_settings; flate_unencoded (true); remove_invalid_links and remove_unreferenced_dests (true); images and forms the pages list but never draw are always dropped (unused_xobjects). discard: Remove Hidden Information categories (metadata, attachments, comments, form-fields, hidden-text, hidden-layers, bookmarks, links-actions-scripts, private-data). Signed documents are refused. The open document is unchanged.")
             .cmd("optimize.advanced")
             .with(schema(
                 json!({
                     "doc": doc(),
                     "path": { "type": "string" },
+                    "preset": { "type": "string", "enum": ["standard", "mobile"] },
+                    "merge_fragments": { "type": "boolean" },
                     "color": { "type": "object" },
                     "gray": { "type": "object" },
                     "discard_thumbnails": { "type": "boolean" },
@@ -1245,9 +1324,16 @@ pub fn tools() -> Vec<ToolDef> {
                 }),
                 &["doc", "path"],
             )),
-        t("doc_flatten", "Flatten", "Merge comment and/or form field appearances into the page content, so they print and display everywhere but can no longer be edited. Undoable until saved.")
+        t("doc_flatten", "Flatten", "Merge comment and/or form field appearances into the page content, so they print and display everywhere but can no longer be edited. Flattening the fields of an XFA form also takes the XFA out (its template, data and scripts), so Adobe's viewers show the baked pages rather than laying the form out again. Undoable until saved.")
             .destructive()
             .with(schema(json!({ "doc": doc(), "comments": { "type": "boolean", "description": "Default true." }, "fields": { "type": "boolean", "description": "Default true." } }), &["doc"])),
+        t(
+            "xfa_to_static",
+            "Convert an XFA form to a static form",
+            "Make an XFA form an ordinary PDF form: the XFA packets (template, data, scripts) and PdfCraft's private keys go; the pages as laid out and the fields with their values stay, so every viewer shows the same form and none lays it out again. Its scripts no longer run. Undoable until saved.",
+        )
+        .destructive()
+        .with(schema(json!({ "doc": doc() }), &["doc"])),
         t("edit_undo", "Undo", "Undo the last edit of a document.").cmd("edit.undo").with(schema(json!({ "doc": doc() }), &["doc"])),
         t("edit_redo", "Redo", "Redo the last undone edit of a document.").cmd("edit.redo").with(schema(json!({ "doc": doc() }), &["doc"])),
         t("command_list", "List commands", "Every registered PdfCraft command with its menu, shortcut, whether it is enabled now, and the tool that automates it.")
diff --git a/crates/automation/tests/automation.rs b/crates/automation/tests/automation.rs
index e788d9610..1e662d8f3 100644
--- a/crates/automation/tests/automation.rs
+++ b/crates/automation/tests/automation.rs
@@ -115,6 +115,105 @@ fn auto(dir: &Path) -> Automation {
     Automation::new().with_root(dir).unwrap().with_clock(|| 1_700_000_000)
 }
 
+/// Full-screen presentation settings (`/Trans`, `/Dur`) reach `doc_info`, 1-based pages, only
+/// for the pages that carry them.
+#[test]
+fn doc_info_lists_page_transitions_and_display_times() {
+    let dir = workdir("transitions");
+    let objects: Vec<Vec<u8>> = vec![
+        b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R 4 0 R] /Count 2 /MediaBox [0 0 200 300] >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /Trans << /S /Fade /D 0.5 >> /Dur 4 >>".to_vec(),
+    ];
+    let mut bytes = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, object) in objects.iter().enumerate() {
+        offsets.push(bytes.len());
+        bytes.extend_from_slice(format!("{} 0 obj\n", i + 1).as_bytes());
+        bytes.extend_from_slice(object);
+        bytes.extend_from_slice(b"\nendobj\n");
+    }
+    let xref = bytes.len();
+    bytes.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objects.len() + 1).as_bytes());
+    for o in offsets {
+        bytes.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    bytes.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objects.len() + 1).as_bytes());
+    std::fs::write(dir.join("slides.pdf"), bytes).unwrap();
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "slides.pdf" }))["doc"].as_u64().unwrap();
+    let info = ok(&mut a, "doc_info", json!({ "doc": doc }));
+    let t = info["transitions"].as_array().unwrap();
+    assert_eq!(t.len(), 1, "{}", info["transitions"]);
+    assert_eq!(
+        (t[0]["page"].as_u64(), t[0]["style"].as_str(), t[0]["duration"].as_f64(), t[0]["display"].as_f64()),
+        (Some(2), Some("Fade"), Some(0.5), Some(4.0)),
+        "{}",
+        t[0]
+    );
+}
+
+/// Page transitions through the tools: set on chosen pages, written to the file as `/Trans` and
+/// `/Dur`, removed again, bad values refused, and one undo step. (Read through `pdfcraft_cos`,
+/// so this does not lean on `doc_info` listing them.)
+#[test]
+fn page_transitions_are_set_and_removed_through_the_tools() {
+    use pdfcraft_cos::Object;
+    /// `key` of 0-based `page` in the saved file `name`, resolved.
+    fn entry(dir: &Path, name: &str, page: usize, key: &[u8]) -> Option<Object> {
+        let d = pdfcraft_cos::Document::open(std::sync::Arc::new(std::fs::read(dir.join(name)).ok()?)).ok()?;
+        let root = d.root()?;
+        let pages = d.get(root).as_dict()?.reference(b"Pages")?;
+        let kids = d.get(pages).as_dict()?.get(b"Kids")?.clone();
+        let kid = d.resolve(&kids).as_array()?.get(page)?.clone();
+        let o = d.resolve(&kid).as_dict()?.get(key)?.clone();
+        Some((*d.resolve(&o)).clone())
+    }
+    let dir = workdir("transitions-set");
+    std::fs::write(dir.join("a.pdf"), fixture(3)).unwrap();
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+    ok(&mut a, "page_transition_set", json!({ "doc": doc, "pages": [2, 3], "style": "Wipe", "duration": 2, "direction": 270, "display": 5 }));
+    ok(&mut a, "doc_save", json!({ "doc": doc, "path": "out/t1.pdf" }));
+    let t = entry(&dir, "out/t1.pdf", 1, b"Trans").expect("/Trans on page 2");
+    let t = t.as_dict().expect("a dictionary");
+    assert_eq!(
+        (t.name(b"S"), t.get(b"D").and_then(Object::as_f64), t.get(b"Di").and_then(Object::as_f64)),
+        (Some(&b"Wipe"[..]), Some(2.0), Some(270.0)),
+        "{t:?}"
+    );
+    assert_eq!(entry(&dir, "out/t1.pdf", 1, b"Dur").and_then(|o| o.as_f64()), Some(5.0));
+    assert!(entry(&dir, "out/t1.pdf", 2, b"Trans").is_some(), "page 3 too");
+    assert!(entry(&dir, "out/t1.pdf", 0, b"Trans").is_none() && entry(&dir, "out/t1.pdf", 0, b"Dur").is_none(), "page 1 was not asked for");
+    ok(
+        &mut a,
+        "page_transition_set",
+        json!({ "doc": doc, "pages": [3], "style": "Fly", "motion": "outward", "direction": "none", "scale": 0.5, "opaque": true }),
+    );
+    ok(&mut a, "doc_save", json!({ "doc": doc, "path": "out/t2.pdf" }));
+    let t = entry(&dir, "out/t2.pdf", 2, b"Trans").expect("/Trans on page 3");
+    let t = t.as_dict().expect("a dictionary");
+    assert_eq!(
+        (t.name(b"S"), t.name(b"M"), t.name(b"Di"), t.get(b"SS").and_then(Object::as_f64), t.get(b"B")),
+        (Some(&b"Fly"[..]), Some(&b"O"[..]), Some(&b"None"[..]), Some(0.5), Some(&Object::Bool(true))),
+        "{t:?}"
+    );
+    assert!(entry(&dir, "out/t2.pdf", 2, b"Dur").is_none(), "display time left out removes /Dur");
+    assert!(a.call("page_transition_set", &json!({ "doc": doc, "style": "Swirl" })).is_err(), "an unknown style is refused");
+    assert!(a.call("page_transition_set", &json!({ "doc": doc, "style": "Wipe", "direction": 45 })).is_err());
+    assert!(a.call("page_transition_set", &json!({ "doc": doc, "pages": [9], "style": "Fade" })).is_err(), "no such page");
+    ok(&mut a, "page_transition_set", json!({ "doc": doc, "style": "none" }));
+    ok(&mut a, "doc_save", json!({ "doc": doc, "path": "out/t3.pdf" }));
+    assert!((0..3).all(|p| entry(&dir, "out/t3.pdf", p, b"Trans").is_none() && entry(&dir, "out/t3.pdf", p, b"Dur").is_none()), "all removed");
+    ok(&mut a, "edit_undo", json!({ "doc": doc }));
+    ok(&mut a, "doc_save", json!({ "doc": doc, "path": "out/t4.pdf" }));
+    assert!(
+        entry(&dir, "out/t4.pdf", 1, b"Trans").is_some() && entry(&dir, "out/t4.pdf", 2, b"Trans").is_some(),
+        "one undo step brings both pages back"
+    );
+}
+
 #[test]
 fn autotag_preview_proposes_text_without_changing_the_pdf() {
     let dir = workdir("autotag-preview");
@@ -145,6 +244,30 @@ fn autotag_preview_proposes_text_without_changing_the_pdf() {
     assert!(preview["candidates"].as_array().unwrap().iter().any(|c| c["text"] == "First paragraph" && c["type"] == "P"));
 }
 
+#[test]
+fn render_pixels_agrees_with_page_render_and_skips_the_png() {
+    let dir = workdir("render-pixels");
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+
+    let (width, height, pixels) = a.render_pixels(doc, 1, 1.0).unwrap();
+    let png = a.call("page_render", &json!({ "doc": doc, "page": 1, "dpi": 72 })).unwrap();
+    let Content::Png { width: png_width, height: png_height, .. } = png[0] else { panic!("expected an image") };
+    assert_eq!((width, height), (png_width, png_height), "scale 1.0 is 72 dpi, like the tool");
+    assert_eq!(pixels.as_ref().len(), width as usize * height as usize * 4, "RGBA, four bytes a pixel");
+    assert!(pixels.as_ref().as_chunks::<4>().0.iter().any(|p| p[..3] != [255, 255, 255]), "the page text is drawn, not a blank sheet");
+
+    let (double_width, _, _) = a.render_pixels(doc, 1, 2.0).unwrap();
+    assert_eq!(double_width, width * 2, "the scale is pixels per point");
+
+    for scale in [0.0_f32, -1.0, f32::NAN, f32::INFINITY, 1.0e6] {
+        assert!(matches!(a.render_pixels(doc, 1, scale), Err(ToolError::InvalidArgs(_))), "scale {scale} must be refused");
+    }
+    assert!(matches!(a.render_pixels(doc, 0, 1.0), Err(ToolError::InvalidArgs(_))), "pages are 1-based");
+    assert!(matches!(a.render_pixels(doc, 99, 1.0), Err(ToolError::InvalidArgs(_))), "a page past the end");
+    assert!(matches!(a.render_pixels(9_999, 1, 1.0), Err(ToolError::Failed(_))), "a document that is not open");
+}
+
 #[test]
 fn autotag_apply_writes_reviewable_tags_and_survives_save_reopen() {
     let dir = workdir("autotag-apply");
@@ -168,7 +291,22 @@ fn autotag_apply_writes_reviewable_tags_and_survives_save_reopen() {
     let pages = pdfcraft_model::pages(&reopened);
     assert_eq!(pages.len(), 2);
     assert!(pages.iter().all(|page| page.dict.contains(b"StructParents")));
-    assert!(reopened.get(reopened.root().unwrap()).as_dict().unwrap().contains(b"StructTreeRoot"));
+}
+
+#[test]
+fn autotag_form_fields_writes_reviewable_widget_tags() {
+    let dir = workdir("autotag-form-fields");
+    std::fs::write(dir.join("field.pdf"), form_pdf("name")).unwrap();
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "field.pdf" }))["doc"].as_u64().unwrap();
+    let tagged = ok(&mut a, "accessibility_autotag_form_fields", json!({ "doc": doc }));
+    assert_eq!(tagged["status"], "passed");
+    assert_eq!(tagged["remaining_findings"], 0);
+    ok(&mut a, "doc_save", json!({ "doc": doc, "path": "tagged.pdf" }));
+    let reopened = ok(&mut a, "doc_open", json!({ "path": "tagged.pdf" }))["doc"].as_u64().unwrap();
+    let check = ok(&mut a, "accessibility_check", json!({ "doc": reopened, "rules": ["tagged-form-fields"] }));
+    let result = check["results"].as_array().unwrap().iter().find(|result| result["rule"] == "tagged-form-fields").unwrap();
+    assert_eq!(result["status"], "passed");
 }
 
 /// A one-page PDF whose form holds one text field named `name`.
@@ -238,6 +376,9 @@ fn tool_table_is_well_formed() {
             assert!(props.contains_key(r.as_str().unwrap()), "{}: required {r} is not a property", t.name);
         }
         assert!(!(t.read_only && t.destructive), "{} is both read-only and destructive", t.name);
+        for k in ["oneOf", "anyOf", "allOf"] {
+            assert!(t.input_schema.get(k).is_none(), "{}: top-level {k} in input_schema is rejected by MCP clients such as Claude", t.name);
+        }
         if let Some(c) = t.command {
             assert!(pdfcraft_engine::commands::command(c).is_some(), "{} names unregistered command {c}", t.name);
         }
@@ -433,6 +574,29 @@ fn open_inspect_render_and_find() {
     assert_eq!((info.width, info.height), (200, 300));
 }
 
+#[test]
+fn word_count_reads_selected_pages_and_unsaved_edits_without_mutating() {
+    let dir = workdir("word-count");
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+    let before = ok(&mut a, "doc_list", json!({}));
+    let report = ok(&mut a, "text_word_count", json!({ "doc": doc }));
+    assert_eq!(report["total"]["words"], 6);
+    assert_eq!(report["pages"].as_array().unwrap().len(), 3);
+    let subset = ok(&mut a, "text_word_count", json!({ "doc": doc, "pages": [3, 1], "exclude_tables": true }));
+    assert_eq!(subset["total"]["words"], 4);
+    assert_eq!(subset["pages"][0]["page"], 3);
+    assert_eq!(subset["unclassified_structure"], true);
+    assert_eq!(ok(&mut a, "doc_list", json!({})), before);
+    assert!(a.call("text_word_count", &json!({ "doc": doc, "pages": [4] })).is_err());
+    ok(&mut a, "page_delete", json!({ "doc": doc, "pages": [1] }));
+    assert_eq!(ok(&mut a, "text_word_count", json!({ "doc": doc }))["total"]["words"], 4);
+    ok(&mut a, "edit_undo", json!({ "doc": doc }));
+    assert_eq!(ok(&mut a, "text_word_count", json!({ "doc": doc }))["total"]["words"], 6);
+    let def = tools().into_iter().find(|t| t.name == "text_word_count").unwrap();
+    assert!(def.read_only && !def.destructive);
+}
+
 #[test]
 fn text_editor_background_is_read_only_and_removes_source_glyphs() {
     let dir = workdir("text-preview");
@@ -457,6 +621,29 @@ fn text_editor_background_is_read_only_and_removes_source_glyphs() {
     }
 }
 
+#[test]
+fn added_text_editor_background_hides_only_the_item_without_editing() {
+    let dir = workdir("added-text-preview");
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+    let render = json!({"doc":doc,"page":1,"dpi":72});
+    let before = a.call("page_render", &render).unwrap();
+    ok(&mut a, "page_add_text", json!({"doc":doc,"page":1,"text":"Retype this label","at":[20,20],"width":160}));
+    let drawn = a.call("page_render", &render).unwrap();
+    assert_ne!(drawn, before);
+    let state = ok(&mut a, "doc_info", json!({"doc":doc}));
+    let items = ok(&mut a, "content_list", json!({"doc":doc}));
+    let preview = a.call("page_render", &json!({"doc":doc,"page":1,"dpi":72,"hide_added_text":1})).unwrap();
+    assert_eq!(preview, before, "native text and the page background stay intact");
+    assert_eq!(a.call("page_render", &render).unwrap(), drawn);
+    assert_eq!(ok(&mut a, "doc_info", json!({"doc":doc})), state);
+    assert_eq!(ok(&mut a, "content_list", json!({"doc":doc})), items);
+    for index in [-1, 0, 2, i64::MAX] {
+        assert!(a.call("page_render", &json!({"doc":doc,"page":1,"hide_added_text":index})).is_err());
+    }
+    assert!(a.call("page_render", &json!({"doc":doc,"page":1,"hide_added_text":1,"hide_text_block":1})).is_err());
+}
+
 #[test]
 fn edit_undo_redo_and_save_round_trip() {
     let dir = workdir("edit");
@@ -524,11 +711,10 @@ fn an_in_place_save_reports_a_required_rewrite_as_not_incremental() {
     }
 }
 
-/// Issue #1698: a save whose bytes don't reopen is refused before it touches the file. The
-/// catalog's `/Pages` is not a page tree, so the reader finds the page by scanning, while a
-/// full rewrite keeps only what the catalog reaches and drops it.
+/// #1664 repairs the missing page tree on open. The former #1698 failure fixture now
+/// saves successfully, keeping its page and pixels through a full rewrite.
 #[test]
-fn a_save_that_does_not_reopen_leaves_the_file_as_it_was() {
+fn a_recovered_page_tree_survives_a_full_save() {
     let dir = workdir("save-verify-before-write");
     let objs: [&[u8]; 4] = [
         b"<< /Type /Catalog /Pages 3 0 R >>",
@@ -556,10 +742,19 @@ fn a_save_that_does_not_reopen_leaves_the_file_as_it_was() {
     let opened = ok(&mut a, "doc_open", json!({ "path": "damaged.pdf" }));
     assert_eq!(opened["pages"], 1, "{opened}");
     let doc = opened["doc"].as_u64().unwrap();
-    let e = err(&mut a, "doc_save", json!({ "doc": doc, "full": true }));
-    assert!(e.to_string().contains("could not be reopened"), "{e}");
+    let (width, height, pixels) = a.render_pixels(doc, 1, 1.0).unwrap();
+    assert!(pixels.as_ref().as_chunks::<4>().0.iter().any(|p| p[..3] != [255, 255, 255]), "the original page is not blank");
+    let saved = ok(&mut a, "doc_save", json!({ "doc": doc, "full": true }));
+    assert_eq!(saved["document"]["dirty"], false);
     let on_disk = std::fs::read(dir.join("damaged.pdf")).unwrap();
-    assert!(on_disk == original, "the file was replaced by {} bytes that don't reopen", on_disk.len());
+    assert_ne!(on_disk, original, "a full save writes the repaired page tree");
+    let mut reopened = auto(&dir);
+    let opened = ok(&mut reopened, "doc_open", json!({ "path": "damaged.pdf" }));
+    assert_eq!(opened["pages"], 1);
+    let again = opened["doc"].as_u64().unwrap();
+    let (new_width, new_height, new_pixels) = reopened.render_pixels(again, 1, 1.0).unwrap();
+    assert_eq!((new_width, new_height), (width, height));
+    assert_eq!(new_pixels.as_ref(), pixels.as_ref(), "saving must preserve the recovered page's drawing");
 }
 
 /// organize.field-name-conflicts: combining files whose forms share a field name keeps the
@@ -834,7 +1029,10 @@ fn root_refusals_do_not_reveal_what_exists_outside() {
     // Inside the root nothing changes: missing files say so, and existing ones open and save,
     // however the path is spelled.
     let missing = a.call("doc_open", &json!({ "path": "missing-inside.pdf" })).unwrap_err();
-    assert!(matches!(&missing, ToolError::Failed(m) if m.starts_with("missing-inside.pdf: ") && !m.contains("outside")), "{missing:?}");
+    assert!(
+        matches!(&missing, ToolError::Failed(m) if m.starts_with("missing-inside.pdf not found (looked for ") && !m.contains("outside")),
+        "{missing:?}"
+    );
     let not_dir = a.call("doc_open", &json!({ "path": "inside.pdf/x" })).unwrap_err();
     assert!(matches!(&not_dir, ToolError::Failed(m) if !m.contains("outside")), "{not_dir:?}");
     #[cfg_attr(not(windows), allow(unused_mut))]
@@ -1413,6 +1611,54 @@ fn bookmark_list_pages_reach_bookmarks_past_the_hundred_thousandth() {
     assert!(matches!(a.call("bookmark_list", &json!({ "doc": doc, "offset": -1 })), Err(ToolError::InvalidArgs(_))));
 }
 
+/// Bookmarks and links say where on the page they go, in the same top-left points as rect, and a
+/// link through a named destination says which page that is.
+#[test]
+fn destinations_are_listed_with_their_position() {
+    let dir = workdir("destination-positions");
+    let objs: Vec<&str> = vec![
+        "<< /Type /Catalog /Pages 2 0 R /Outlines 5 0 R /Names << /Dests << /Names [(sec-b) [4 0 R /XYZ 72 500 0]] >> >> >>",
+        "<< /Type /Pages /Kids [3 0 R 4 0 R] /Count 2 /MediaBox [0 0 612 792] >>",
+        "<< /Type /Page /Parent 2 0 R /Annots [8 0 R 9 0 R 10 0 R] >>",
+        "<< /Type /Page /Parent 2 0 R >>",
+        "<< /Type /Outlines /First 6 0 R /Last 7 0 R /Count 2 >>",
+        "<< /Title (Section B) /Parent 5 0 R /Next 7 0 R /Dest [4 0 R /XYZ 72 500 0] >>",
+        "<< /Title (Wide view) /Parent 5 0 R /Prev 6 0 R /Dest [4 0 R /FitH 400] >>",
+        "<< /Type /Annot /Subtype /Link /Rect [72 700 300 716] /Border [0 0 0] /Dest [4 0 R /XYZ 72 500 2] >>",
+        "<< /Type /Annot /Subtype /Link /Rect [72 670 300 686] /Border [0 0 0] /Dest (sec-b) >>",
+        "<< /Type /Annot /Subtype /Link /Rect [72 640 300 656] /Border [0 0 0] /A << /S /URI /URI (https://example.com) >> >>",
+    ];
+    let mut pdf = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(pdf.len());
+        pdf.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = pdf.len();
+    pdf.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        pdf.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    pdf.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    std::fs::write(dir.join("dests.pdf"), pdf).unwrap();
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "dests.pdf" }))["doc"].as_u64().unwrap();
+    let marks = ok(&mut a, "bookmark_list", json!({ "doc": doc }));
+    // 792 − 500 = 292 points from the top; a zoom of 0 keeps the reader's zoom.
+    assert_eq!(marks["bookmarks"][0]["destination"], json!({ "fit": "XYZ", "left": 72.0, "top": 292.0, "zoom": null }), "{marks}");
+    assert_eq!(marks["bookmarks"][1]["destination"], json!({ "fit": "FitH", "left": null, "top": 392.0 }), "{marks}");
+    let links = ok(&mut a, "link_list", json!({ "doc": doc }));
+    let explicit = &links["links"][0];
+    assert_eq!(
+        (explicit["to_page"].clone(), explicit["destination"].clone()),
+        (json!(2), json!({ "fit": "XYZ", "left": 72.0, "top": 292.0, "zoom": 2.0 }))
+    );
+    let named = &links["links"][1];
+    assert_eq!((named["to_page"].clone(), named["named"].clone(), named.get("other")), (json!(2), json!(true), None), "{links}");
+    assert_eq!(named["destination"]["top"], 292.0);
+    assert_eq!((links["links"][2]["url"].clone(), links["links"][2].get("destination")), (json!("https://example.com"), None));
+}
+
 #[test]
 fn bookmarks_from_structure_through_tools() {
     let dir = workdir("bookmarks-structure");
@@ -1599,6 +1845,7 @@ fn protecting_through_tools() {
     // Copying wasn't allowed either (#568): no text or images come out, though search works.
     for (tool, args) in [
         ("text_extract", json!({ "doc": re })),
+        ("text_word_count", json!({ "doc": re })),
         ("text_paragraphs", json!({ "doc": re, "page": 1 })),
         ("doc_export_text", json!({ "doc": re, "path": "out.txt" })),
         ("doc_export_images", json!({ "doc": re, "folder": "pages" })),
@@ -1629,7 +1876,7 @@ fn protecting_through_tools() {
 fn signing_an_encrypted_form_through_tools() {
     let dir = workdir("sign-encrypted");
     let mut a = auto(&dir);
-    ok(&mut a, "sign_id_create", json!({ "name": "Ada Lovelace", "key": "p256", "password": "secret1", "path": "ada.p12" }));
+    ok(&mut a, "sign_id_create", json!({ "name": "Ada Lovelace", "key": "p256", "password": "secret12", "path": "ada.p12" }));
     let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
     let field = ok(&mut a, "form_add_field", json!({ "doc": doc, "page": 1, "type": "signature", "rect": [20, 200, 180, 250] }))["field"]
         .as_str()
@@ -1642,12 +1889,12 @@ fn signing_an_encrypted_form_through_tools() {
     assert_eq!(ok(&mut b, "doc_info", json!({ "doc": form }))["security"]["protected"], true);
     match b.call(
         "sign_document",
-        &json!({ "doc": form, "id": "ada.p12", "password": "secret1", "page": 1, "rect": [200, 200, 380, 250], "out": "new.pdf" }),
+        &json!({ "doc": form, "id": "ada.p12", "password": "secret12", "page": 1, "rect": [200, 200, 380, 250], "out": "new.pdf" }),
     ) {
         Err(ToolError::Failed(m)) => assert!(m.contains("adding new signature fields"), "{m}"),
         other => panic!("a new field needs the permissions password: {other:?}"),
     }
-    let r = ok(&mut b, "sign_document", json!({ "doc": form, "id": "ada.p12", "password": "secret1", "field": field, "out": "signed.pdf" }));
+    let r = ok(&mut b, "sign_document", json!({ "doc": form, "id": "ada.p12", "password": "secret12", "field": field, "out": "signed.pdf" }));
     assert_eq!((r["signature"]["signer"].as_str(), r["signature"]["status"].as_str()), (Some("Ada Lovelace"), Some("unknown")));
     let original = std::fs::read(dir.join("form.pdf")).unwrap();
     let signed = std::fs::read(dir.join("signed.pdf")).unwrap();
@@ -1655,7 +1902,7 @@ fn signing_an_encrypted_form_through_tools() {
     let mut c = auto(&dir);
     let re = ok(&mut c, "doc_open", json!({ "path": "signed.pdf" }))["doc"].as_u64().unwrap();
     assert_eq!(ok(&mut c, "doc_info", json!({ "doc": re }))["security"]["protected"], true, "still encrypted");
-    ok(&mut c, "sign_trust", json!({ "paths": ["ada.p12"], "password": "secret1" }));
+    ok(&mut c, "sign_trust", json!({ "paths": ["ada.p12"], "password": "secret12" }));
     let list = ok(&mut c, "sign_list", json!({ "doc": re }));
     assert_eq!((list["all_valid"].as_bool(), list["signatures"][0]["status"].as_str()), (Some(true), Some("valid")), "{list}");
 }
@@ -2047,6 +2294,40 @@ trailer << /Root 1 0 R >>
     assert!(matches!(a.call("accessibility_set_alt", &json!({ "doc": fd, "figure": 6, "alt": "x" })), Err(ToolError::Failed(_))));
 }
 
+#[test]
+fn marking_a_leaf_tag_as_an_artifact_through_automation_is_undoable_and_saved() {
+    let dir = workdir("a11y-artifact");
+    std::fs::write(
+        dir.join("tagged.pdf"),
+        b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R /MarkInfo << /Marked true >> /StructTreeRoot 5 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Contents 4 0 R /StructParents 0 >> endobj
+4 0 obj << /Length 48 >> stream
+/Figure << /MCID 0 >> BDC 10 150 40 20 re f EMC
+endstream endobj
+5 0 obj << /Type /StructTreeRoot /K 6 0 R /ParentTree 8 0 R >> endobj
+6 0 obj << /S /Document /P 5 0 R /K [7 0 R] >> endobj
+7 0 obj << /S /Figure /P 6 0 R /Pg 3 0 R /K 0 >> endobj
+8 0 obj << /Nums [0 [7 0 R]] >> endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+    )
+    .unwrap();
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "tagged.pdf" }))["doc"].as_u64().unwrap();
+    assert_eq!(ok(&mut a, "accessibility_tags", json!({ "doc": doc }))["count"], 2);
+    let tagged = ok(&mut a, "accessibility_mark_tag_artifact", json!({ "doc": doc, "object": 7, "generation": 0 }));
+    assert_eq!(tagged["count"], 1);
+    assert_eq!(ok(&mut a, "accessibility_check", json!({ "doc": doc, "rules": ["tagged-content"] }))["failed"], 0);
+    ok(&mut a, "doc_save", json!({ "doc": doc, "path": "artifact.pdf" }));
+    let saved = pdfcraft_cos::Document::open(std::sync::Arc::new(std::fs::read(dir.join("artifact.pdf")).unwrap())).unwrap();
+    assert_eq!(pdfcraft_engine::a11y::tags(&saved).len(), 1);
+    assert_eq!(ok(&mut a, "edit_undo", json!({ "doc": doc }))["undone"], "Mark content as artifact");
+    assert_eq!(ok(&mut a, "accessibility_tags", json!({ "doc": doc }))["count"], 2);
+    assert!(matches!(a.call("accessibility_mark_tag_artifact", &json!({ "doc": doc, "object": 6, "generation": 0 })), Err(ToolError::Failed(_))));
+}
+
 #[test]
 fn accessibility_review_record_compares_two_versions_without_changing_them() {
     let dir = workdir("a11y-review-record");
@@ -2262,6 +2543,12 @@ fn editing_page_images_through_tools() {
     assert_eq!(r["undo"], "Move image");
     let moved = ok(&mut a, "page_images", json!({ "doc": made, "page": 1 }))["images"][0]["rect"].clone();
     assert_eq!(moved, json!([5.0, 5.0, 25.0, 35.0]));
+    // Crop keeps part of it in place: the placement stays, visible_rect says what shows.
+    let r = ok(&mut a, "image_edit", json!({ "doc": made, "page": 1, "image": 1, "action": "crop", "rect": [10, 10, 25, 30] }));
+    assert_eq!(r["undo"], "Crop image");
+    let cropped = ok(&mut a, "page_images", json!({ "doc": made, "page": 1 }))["images"][0].clone();
+    assert_eq!(cropped["rect"], json!([5.0, 5.0, 25.0, 35.0]));
+    assert_eq!(cropped["visible_rect"], json!([10.0, 10.0, 25.0, 30.0]));
     ok(&mut a, "image_edit", json!({ "doc": made, "page": 1, "image": 1, "action": "rotate" }));
     ok(&mut a, "image_edit", json!({ "doc": made, "page": 1, "image": 1, "action": "flip_horizontal" }));
     let saved = ok(&mut a, "image_save", json!({ "doc": made, "page": 1, "image": 1, "path": "out/picture" }));
@@ -2862,6 +3149,28 @@ fn flattening_through_tools() {
     assert!(matches!(a.call("doc_flatten", &json!({ "doc": doc, "comments": false, "fields": false })), Err(ToolError::InvalidArgs(_))));
 }
 
+/// Inserting a file's pages brings its bookmarks too, under one named after the file, at the
+/// pages' place among the document's own bookmarks.
+#[test]
+fn inserting_a_file_brings_its_bookmarks() {
+    let dir = workdir("insert-bookmarks");
+    let mut a = auto(&dir);
+    let annex = ok(&mut a, "doc_open", json!({ "path": "b.pdf" }))["doc"].as_u64().unwrap();
+    ok(&mut a, "bookmark_add", json!({ "doc": annex, "title": "Annex intro", "page": 1 }));
+    ok(&mut a, "bookmark_add", json!({ "doc": annex, "title": "Annex table", "page": 2 }));
+    ok(&mut a, "doc_save", json!({ "doc": annex, "path": "annex.pdf" }));
+    let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+    ok(&mut a, "bookmark_add", json!({ "doc": doc, "title": "Guide start", "page": 1 }));
+    ok(&mut a, "bookmark_add", json!({ "doc": doc, "title": "Guide end", "page": 3 }));
+    ok(&mut a, "page_insert_file", json!({ "doc": doc, "path": "annex.pdf", "at": 2 }));
+    let list = ok(&mut a, "bookmark_list", json!({ "doc": doc }));
+    let top: Vec<(&str, Value)> = list["bookmarks"].as_array().unwrap().iter().map(|b| (b["title"].as_str().unwrap(), b["page"].clone())).collect();
+    assert_eq!(top, [("Guide start", json!(1)), ("annex", json!(2)), ("Guide end", json!(5))], "{list}");
+    let kids: Vec<(&str, Value)> =
+        list["bookmarks"][1]["children"].as_array().unwrap().iter().map(|b| (b["title"].as_str().unwrap(), b["page"].clone())).collect();
+    assert_eq!(kids, [("Annex intro", json!(2)), ("Annex table", json!(3))], "{list}");
+}
+
 #[test]
 fn replacing_pages_through_tools() {
     let dir = workdir("replace");
@@ -3079,7 +3388,11 @@ fn removing_hidden_information_through_tools() {
 
 /// A one-page PDF whose text "TOP SECRET" sits under an opaque black rectangle.
 fn faux_redacted_fixture() -> Vec<u8> {
-    let body = "BT /F1 24 Tf 100 700 Td (TOP SECRET) Tj ET\n0 g\n90 688 220 32 re f";
+    helvetica_page("BT /F1 24 Tf 100 700 Td (TOP SECRET) Tj ET\n0 g\n90 688 220 32 re f")
+}
+
+/// A one-page US Letter PDF drawing `body` with Helvetica as /F1.
+fn helvetica_page(body: &str) -> Vec<u8> {
     let objs: Vec<Vec<u8>> = vec![
         b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
         b"<< /Type /Pages /Kids [4 0 R] /Count 1 >>".to_vec(),
@@ -3116,11 +3429,94 @@ fn auditing_faux_redactions_through_tools() {
     assert_eq!(f["page"], 1);
     assert_eq!(f["kind"], "covered-text");
     assert!(f["covered_text"].as_str().unwrap().contains("TOP SECRET"), "{f}");
+    // Points from the top-left of the page, like every other tool (the cover is `90 688 220 32 re`
+    // on a 792 pt high page).
+    assert_eq!(f["rect"], json!([90.0, 72.0, 310.0, 104.0]), "{f}");
     // A clean document audits clean.
     let clean = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
     assert_eq!(ok(&mut a, "doc_audit_redactions", json!({ "doc": clean }))["count"], 0);
 }
 
+/// An applied redaction at the end of a line leaves the words before it, then a gap the text
+/// matrix jumps over and the redaction box: nothing is under the box any more, so the audit must
+/// not report the words beside it as covered. In the middle of a line it never did.
+#[test]
+fn an_applied_redaction_at_the_end_of_a_line_audits_clean() {
+    let dir = workdir("audit-applied-end-of-line");
+    let body = "BT /F1 11 Tf 72 692 Td (Mail the team: someone@example.com) Tj ET\nBT /F1 11 Tf 72 662 Td (Account 0042-7788 is in the middle of this line.) Tj ET";
+    std::fs::write(dir.join("mail.pdf"), helvetica_page(body)).unwrap();
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "mail.pdf" }))["doc"].as_u64().unwrap();
+    ok(&mut a, "redact_mark", json!({ "doc": doc, "pattern": "email" }));
+    ok(&mut a, "redact_mark", json!({ "doc": doc, "find": "0042-7788" }));
+    ok(&mut a, "redact_apply", json!({ "doc": doc }));
+    let text = ok(&mut a, "text_extract", json!({ "doc": doc }))["pages"][0]["text"].as_str().unwrap().to_string();
+    assert!(text.contains("Mail the team:") && !text.contains("someone") && !text.contains("0042"), "{text}");
+    let r = ok(&mut a, "doc_audit_redactions", json!({ "doc": doc }));
+    assert_eq!(r["count"], 0, "{r}");
+}
+
+/// A long tagged document lists its tags a page at a time, and only the types, pages or depths
+/// asked for: a 20-page guide has hundreds of tags, more than one tool result should hold.
+#[test]
+fn structure_tags_are_listed_a_page_at_a_time() {
+    let dir = workdir("tags-paging");
+    // A Document holding, on each of 3 pages, one H1 and 149 P: 451 tags.
+    let mut objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R /StructTreeRoot 6 0 R /MarkInfo << /Marked true >> >>".into(),
+        "<< /Type /Pages /Kids [3 0 R 4 0 R 5 0 R] /Count 3 /MediaBox [0 0 200 200] >>".into(),
+        "<< /Type /Page /Parent 2 0 R >>".into(),
+        "<< /Type /Page /Parent 2 0 R >>".into(),
+        "<< /Type /Page /Parent 2 0 R >>".into(),
+        String::new(), // 6: the root, below
+        String::new(), // 7: the Document, below
+    ];
+    let mut kids = Vec::new();
+    for page in 0..3 {
+        for i in 0..150 {
+            let n = objs.len() + 1;
+            kids.push(format!("{n} 0 R"));
+            objs.push(format!("<< /S /{} /P 7 0 R /Pg {} 0 R >>", if i == 0 { "H1" } else { "P" }, 3 + page));
+        }
+    }
+    objs[5] = "<< /Type /StructTreeRoot /K 7 0 R >>".into();
+    objs[6] = format!("<< /S /Document /P 6 0 R /K [{}] >>", kids.join(" "));
+    let mut pdf = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(pdf.len());
+        pdf.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = pdf.len();
+    pdf.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        pdf.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    pdf.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    std::fs::write(dir.join("long.pdf"), pdf).unwrap();
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "long.pdf" }))["doc"].as_u64().unwrap();
+    let first = ok(&mut a, "accessibility_tags", json!({ "doc": doc }));
+    assert_eq!((first["count"].as_u64(), first["tags"].as_array().map(Vec::len), first["next"].as_u64()), (Some(451), Some(200), Some(200)));
+    assert_eq!(first["tags"][0]["type"], "Document");
+    let last = ok(&mut a, "accessibility_tags", json!({ "doc": doc, "offset": 400, "limit": 100 }));
+    assert_eq!((last["tags"].as_array().map(Vec::len), last["next"].clone()), (Some(51), Value::Null));
+    let headings = ok(&mut a, "accessibility_tags", json!({ "doc": doc, "types": ["H1"] }));
+    let pages: Vec<u64> = headings["tags"].as_array().unwrap().iter().map(|t| t["page"].as_u64().unwrap()).collect();
+    assert_eq!((headings["count"].as_u64(), pages), (Some(3), vec![1, 2, 3]));
+    let page2 = ok(&mut a, "accessibility_tags", json!({ "doc": doc, "pages": [2], "types": ["H1", "P"], "limit": 1000 }));
+    assert_eq!((page2["count"].as_u64(), page2["next"].clone()), (Some(150), Value::Null));
+    assert_eq!(ok(&mut a, "accessibility_tags", json!({ "doc": doc, "max_depth": 0 }))["count"], 1, "the Document alone");
+    for bad in [
+        json!({ "doc": doc, "limit": 0 }),
+        json!({ "doc": doc, "limit": 1001 }),
+        json!({ "doc": doc, "offset": -1 }),
+        json!({ "doc": doc, "pages": [0] }),
+    ] {
+        assert!(matches!(a.call("accessibility_tags", &bad), Err(ToolError::InvalidArgs(_))), "{bad}");
+    }
+}
+
 #[test]
 fn printing_through_tools() {
     let dir = workdir("print");
@@ -3207,7 +3603,7 @@ fn text_styling_on_an_image_is_refused_without_an_edit() {
     ok(&mut a, "doc_save", json!({ "doc": doc, "path": "saved.pdf" }));
     let state = |a: &Automation| {
         let d = a.session().docs().iter().find(|d| d.id.0 == doc).unwrap();
-        (format!("{:?}", d.added), d.dirty, d.edit_generation(), d.can_undo().map(str::to_owned), d.can_redo().map(str::to_owned))
+        (format!("{:?}", d.added()), d.dirty, d.edit_generation(), d.can_undo().map(str::to_owned), d.can_redo().map(str::to_owned))
     };
     let before = state(&a);
     assert!(!before.1 && before.4.is_some(), "a clean document with a step to redo: {before:?}");
@@ -3840,6 +4236,33 @@ fn text_the_standard_fonts_cannot_draw_is_never_silent_through_tools() {
     assert!(!text.contains("?? OK"), "{text}");
 }
 
+/// #1908: `comment_edit font_size` resizes the text of a text box, in one undo step, and refuses
+/// sizes outside 1-400 pt and comments without text.
+#[test]
+fn text_box_font_size_through_the_tool() {
+    let dir = workdir("fontsize");
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+    ok(&mut a, "comment_add", json!({ "doc": doc, "page": 1, "type": "textbox", "rect": [20, 40, 200, 80], "contents": "Hello" }));
+    ok(&mut a, "comment_add", json!({ "doc": doc, "page": 1, "type": "rectangle", "rect": [20, 120, 80, 160] }));
+    ok(&mut a, "comment_edit", json!({ "doc": doc, "page": 1, "index": 1, "font_size": 30 }));
+    for bad in [0, 401] {
+        assert!(matches!(a.call("comment_edit", &json!({ "doc": doc, "page": 1, "index": 1, "font_size": bad })), Err(ToolError::InvalidArgs(_))));
+    }
+    assert!(a.call("comment_edit", &json!({ "doc": doc, "page": 1, "index": 2, "font_size": 12 })).is_err());
+    ok(&mut a, "doc_save", json!({ "doc": doc, "path": "sized.pdf" }));
+    let saved = pdfcraft_cos::Document::open(std::sync::Arc::new(std::fs::read(dir.join("sized.pdf")).unwrap())).unwrap();
+    let sizes: Vec<String> = saved
+        .object_numbers()
+        .iter()
+        .filter_map(|n| saved.try_get(*n).ok())
+        .filter_map(|o| o.as_dict().and_then(|d| d.get(b"DA")?.as_string().map(|s| String::from_utf8_lossy(&s.bytes).into_owned())))
+        .collect();
+    assert_eq!(sizes.len(), 1, "{sizes:?}");
+    assert!(sizes[0].ends_with("/Helv 30 Tf"), "{sizes:?}");
+    assert_eq!(ok(&mut a, "edit_undo", json!({ "doc": doc }))["undone"], "Change comment properties");
+}
+
 #[test]
 fn line_endings_through_the_tool() {
     let dir = workdir("endings");
@@ -3965,12 +4388,12 @@ fn signing_with_an_image_typed_or_drawn_graphic_through_tools() {
     std::fs::write(dir.join("logo.png"), png).unwrap();
     std::fs::write(dir.join("broken.png"), b"broken").unwrap();
     let mut a = auto(&dir);
-    ok(&mut a, "sign_id_create", json!({ "name": "Ada Lovelace", "key": "p256", "password": "secret1", "path": "ada.p12" }));
+    ok(&mut a, "sign_id_create", json!({ "name": "Ada Lovelace", "key": "p256", "password": "secret12", "path": "ada.p12" }));
     let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
     let sign = |a: &mut Automation, rect: [f64; 4], graphic: Value, out: &str| {
         a.call(
             "sign_document",
-            &json!({ "doc": doc, "id": "ada.p12", "password": "secret1", "page": 1, "rect": rect, "graphic": graphic, "out": out }),
+            &json!({ "doc": doc, "id": "ada.p12", "password": "secret12", "page": 1, "rect": rect, "graphic": graphic, "out": out }),
         )
     };
     for (graphic, why) in [
@@ -3990,7 +4413,7 @@ fn signing_with_an_image_typed_or_drawn_graphic_through_tools() {
     // A missing file fails as it does for every tool that reads one.
     assert!(matches!(sign(&mut a, [20.0, 200.0, 180.0, 250.0], json!({ "image": "missing.png" }), "bad.pdf"), Err(ToolError::Failed(_))));
     // An invisible signature shows nothing, so a graphic for one is a mistake.
-    let r = a.call("sign_document", &json!({ "doc": doc, "id": "ada.p12", "password": "secret1", "graphic": { "text": "Ada" }, "out": "bad.pdf" }));
+    let r = a.call("sign_document", &json!({ "doc": doc, "id": "ada.p12", "password": "secret12", "graphic": { "text": "Ada" }, "out": "bad.pdf" }));
     assert!(matches!(r, Err(ToolError::InvalidArgs(_))), "{r:?}");
     assert!(!dir.join("bad.pdf").exists());
 
@@ -4026,11 +4449,13 @@ fn digital_ids_signing_and_validation_through_tools() {
     let id = ok(
         &mut a,
         "sign_id_create",
-        json!({ "name": "Ada Lovelace", "organization": "Analytical Engines", "email": "ada@example.com", "country": "GB", "key": "p256", "password": "secret1", "path": "ada.p12" }),
+        json!({ "name": "Ada Lovelace", "organization": "Analytical Engines", "email": "ada@example.com", "country": "GB", "key": "p256", "password": "secret12", "path": "ada.p12" }),
     );
     assert_eq!(id["certificate"]["subject"], "C=GB, O=Analytical Engines, CN=Ada Lovelace, E=ada@example.com");
     assert_eq!(id["certificate"]["self_signed"], true);
     assert!(matches!(a.call("sign_id_create", &json!({ "name": "X", "password": "short", "path": "x.p12" })), Err(ToolError::InvalidArgs(_))));
+    // Eight characters at least (#1847): seven is refused.
+    assert!(matches!(a.call("sign_id_create", &json!({ "name": "X", "password": "seven77", "path": "x.p12" })), Err(ToolError::InvalidArgs(_))));
 
     let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
     assert_eq!(ok(&mut a, "sign_list", json!({ "doc": doc }))["count"], 0);
@@ -4053,7 +4478,7 @@ fn digital_ids_signing_and_validation_through_tools() {
     let r = ok(
         &mut a,
         "sign_document",
-        json!({ "doc": doc, "id": "ada.p12", "password": "secret1", "page": 2, "rect": [20, 200, 180, 250], "reason": "Approved", "location": "London", "out": "signed.pdf" }),
+        json!({ "doc": doc, "id": "ada.p12", "password": "secret12", "page": 2, "rect": [20, 200, 180, 250], "reason": "Approved", "location": "London", "out": "signed.pdf" }),
     );
     assert_eq!(r["signature"]["status"], "unknown");
     assert_eq!(r["signature"]["signer"], "Ada Lovelace");
@@ -4063,7 +4488,7 @@ fn digital_ids_signing_and_validation_through_tools() {
     assert!(dir.join("signed.pdf").exists());
 
     // Trust the ID: valid; comment afterwards: still valid, change allowed.
-    let t = ok(&mut a, "sign_trust", json!({ "paths": ["ada.p12"], "password": "secret1" }));
+    let t = ok(&mut a, "sign_trust", json!({ "paths": ["ada.p12"], "password": "secret12" }));
     assert_eq!(t["trusted"].as_array().unwrap().len(), 1);
     let list = ok(&mut a, "sign_list", json!({ "doc": doc }));
     assert_eq!((list["all_valid"].as_bool(), list["signatures"][0]["status"].as_str()), (Some(true), Some("valid")));
@@ -4085,6 +4510,89 @@ fn digital_ids_signing_and_validation_through_tools() {
     assert_eq!(ok(&mut a, "sign_list", json!({ "doc": doc }))["signatures"][0]["status"], "unknown");
 }
 
+/// The decoded text of every visible signature appearance (Helvetica forms) in a signed file.
+fn signature_appearances(path: &Path) -> String {
+    use pdfcraft_cos::{Document, ObjRef, Object};
+    let doc = Document::open(std::sync::Arc::new(std::fs::read(path).unwrap())).unwrap();
+    let mut text = String::new();
+    for num in doc.object_numbers() {
+        if let Object::Stream(s) = &*doc.get(ObjRef { num, generation: 0 })
+            && s.dict.name(b"Subtype") == Some(b"Form")
+        {
+            let content = String::from_utf8_lossy(&s.decoded().unwrap()).into_owned();
+            if content.contains("/Helv") {
+                text.push_str(&content);
+            }
+        }
+    }
+    text
+}
+
+/// `sign_document` takes the words of a visible signature's labels (say, in German) and which
+/// items it shows, as the interface does. A label the signature's font can't draw is refused,
+/// naming the label, the character and what is allowed, before anything is written.
+#[test]
+fn signing_with_translated_labels_through_tools() {
+    let dir = workdir("signing-labels");
+    let mut a = auto(&dir);
+    ok(&mut a, "sign_id_create", json!({ "name": "Ada Lovelace", "key": "p256", "password": "secret12", "path": "ada.p12" }));
+    let open = |a: &mut Automation| ok(a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+    let doc = open(&mut a);
+    let args = |doc: u64, extra: Value, out: &str| {
+        let mut args = json!({ "doc": doc, "id": "ada.p12", "password": "secret12", "page": 1, "rect": [10, 150, 190, 290], "reason": "Genehmigt", "location": "Berlin", "out": out });
+        for (k, v) in extra.as_object().unwrap() {
+            args[k] = v.clone();
+        }
+        args
+    };
+    for (extra, why, says) in [
+        (
+            json!({ "labels": { "signed_by": "数字签名者" } }),
+            "a label Helvetica can't draw",
+            "labels.signed_by: the standard fonts can't draw \"数\" (U+6570)",
+        ),
+        (json!({ "labels": { "reason": "Причина: " } }), "even one this signature doesn't show", "labels.reason"),
+        (json!({ "labels": { "signer": "Von" } }), "an unknown label", "unknown label \"signer\""),
+        (json!({ "labels": { "date": 1 } }), "not a string", "labels.date must be a string"),
+        (json!({ "labels": "Datum" }), "not an object", "labels must be an object"),
+        (json!({ "labels": { "date": "x".repeat(201) } }), "too long", "longer than 200"),
+        (json!({ "appearance": { "reason": "yes" } }), "not true or false", "appearance.reason must be true or false"),
+        (json!({ "appearance": { "logo": true } }), "an unknown item", "unknown appearance item"),
+        (json!({ "rect": null, "labels": { "date": "Datum: " } }), "labels for an invisible signature", "needs a visible signature"),
+        (json!({ "rect": null, "appearance": { "reason": true } }), "an appearance for an invisible one", "needs a visible signature"),
+    ] {
+        let r = a.call("sign_document", &args(doc, extra, "bad.pdf"));
+        assert!(matches!(&r, Err(ToolError::InvalidArgs(m)) if m.contains(says)), "{why}: {r:?}");
+    }
+    let r = a.call("sign_document", &args(doc, json!({ "labels": { "signed_by": "数字签名者" } }), "bad.pdf"));
+    assert!(matches!(&r, Err(ToolError::InvalidArgs(m)) if m.contains("signed_by label") && m.contains("Western European")), "{r:?}");
+    assert!(!dir.join("bad.pdf").exists(), "nothing is written for a refused call");
+
+    // German labels, with the reason and the location shown: stamped as given.
+    let german = json!({
+        "labels": { "signed_by": "Digital signiert von", "reason": "Grund: ", "location": "Ort: ", "date": "Datum: " },
+        "appearance": { "reason": true, "location": true },
+    });
+    let r = ok(&mut a, "sign_document", args(doc, german, "de.pdf"));
+    assert_eq!(r["signature"]["reason"], "Genehmigt");
+    let stamped = signature_appearances(&dir.join("de.pdf"));
+    // Each line starts with its label (a long one wraps after it).
+    for word in ["(Digital", "(Grund:", "Genehmigt", "(Ort:", "Berlin", "(Datum:"] {
+        assert!(stamped.contains(word), "{word}: {stamped}");
+    }
+    assert!(!stamped.contains("Reason") && !stamped.contains("Date:"), "{stamped}");
+
+    // Labels omitted keep the English; the labels turned off show the values alone.
+    let doc = open(&mut a);
+    ok(&mut a, "sign_document", args(doc, json!({ "labels": { "date": "Datum: " }, "appearance": { "reason": true } }), "mixed.pdf"));
+    let stamped = signature_appearances(&dir.join("mixed.pdf"));
+    assert!(stamped.contains("(Reason:") && stamped.contains("(Datum:") && !stamped.contains("Berlin"), "{stamped}");
+    let doc = open(&mut a);
+    ok(&mut a, "sign_document", args(doc, json!({ "appearance": { "reason": true, "labels": false } }), "bare.pdf"));
+    let stamped = signature_appearances(&dir.join("bare.pdf"));
+    assert!(stamped.contains("(Genehmigt)") && !stamped.contains("Reason") && !stamped.contains("Date"), "{stamped}");
+}
+
 #[test]
 fn optimizing_through_tools() {
     let dir = workdir("optimize");
@@ -4125,6 +4633,125 @@ fn optimizing_through_tools() {
     assert!(matches!(a.call("doc_optimize", &json!({ "doc": doc, "path": "x.pdf", "discard": ["everything"] })), Err(ToolError::InvalidArgs(_))));
 }
 
+/// A one-page PDF whose page picture is drawn as `rows` grey images one pixel row high, 600 px
+/// wide on a 72 pt square (600 ppi), as some PDF printers write it.
+fn printed_in_strips(rows: usize) -> Vec<u8> {
+    let mut objs: Vec<Vec<u8>> = vec![b"<< /Type /Catalog /Pages 2 0 R >>".to_vec()];
+    let names: String = (0..rows).map(|r| format!("/R{r} {} 0 R ", 5 + r)).collect();
+    objs.push(b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec());
+    objs.push(format!("<< /Type /Page /Parent 2 0 R /MediaBox [0 0 72 72] /Resources << /XObject << {names}>> >> /Contents 4 0 R >>").into_bytes());
+    let k = 72.0 / rows as f64;
+    let content: String = (0..rows)
+        .map(|r| {
+            format!(
+                "q 72 0 0 {k} 0 {} cm /R{r} Do Q
+",
+                (rows - 1 - r) as f64 * k
+            )
+        })
+        .collect();
+    objs.push(
+        format!(
+            "<< /Length {} >>
+stream
+{content}
+endstream",
+            content.len() + 1
+        )
+        .into_bytes(),
+    );
+    for r in 0..rows {
+        let px: Vec<u8> = (0..600).map(|x| ((x + r * 7) % 256) as u8).collect();
+        let mut o = format!(
+            "<< /Type /XObject /Subtype /Image /Width 600 /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8 /Length {} >>
+stream
+",
+            px.len()
+        )
+        .into_bytes();
+        o.extend_from_slice(&px);
+        o.extend_from_slice(
+            b"
+endstream",
+        );
+        objs.push(o);
+    }
+    let mut out = b"%PDF-1.5
+"
+    .to_vec();
+    let mut offs = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offs.push(out.len());
+        out.extend_from_slice(
+            format!(
+                "{} 0 obj
+",
+                i + 1
+            )
+            .as_bytes(),
+        );
+        out.extend_from_slice(o);
+        out.extend_from_slice(
+            b"
+endobj
+",
+        );
+    }
+    let x = out.len();
+    out.extend_from_slice(
+        format!(
+            "xref
+0 {}
+0000000000 65535 f 
+",
+            objs.len() + 1
+        )
+        .as_bytes(),
+    );
+    for o in offs {
+        out.extend_from_slice(
+            format!(
+                "{o:010} 00000 n 
+"
+            )
+            .as_bytes(),
+        );
+    }
+    out.extend_from_slice(
+        format!(
+            "trailer
+<< /Size {} /Root 1 0 R >>
+startxref
+{x}
+%%EOF
+",
+            objs.len() + 1
+        )
+        .as_bytes(),
+    );
+    out
+}
+
+#[test]
+fn a_page_printed_in_strips_gets_small_through_tools() {
+    let dir = workdir("optimize-strips");
+    std::fs::write(dir.join("strips.pdf"), printed_in_strips(300)).unwrap();
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "strips.pdf" }))["doc"].as_u64().unwrap();
+    let r = ok(&mut a, "doc_optimize", json!({ "doc": doc, "path": "mobile.pdf", "preset": "mobile" }));
+    assert_eq!((r["merged_images"].as_u64(), r["fragments_merged"].as_u64(), r["unused_xobjects"].as_u64()), (Some(1), Some(300), Some(300)), "{r}");
+    assert!(r["bytes_after"].as_u64().unwrap() * 10 < r["bytes_before"].as_u64().unwrap(), "{r}");
+    // Reduce File Size merges too; with the option off, the strips stay.
+    let reduced = ok(&mut a, "doc_reduce", json!({ "doc": doc, "path": "reduced.pdf" }));
+    assert!(reduced["bytes_after"].as_u64().unwrap() * 10 < reduced["bytes_before"].as_u64().unwrap(), "{reduced}");
+    let off = ok(&mut a, "doc_optimize", json!({ "doc": doc, "path": "off.pdf", "merge_fragments": false }));
+    assert_eq!(off["merged_images"].as_u64(), Some(0), "{off}");
+    // The merged page opens and renders.
+    let mobile = ok(&mut a, "doc_open", json!({ "path": "mobile.pdf" }))["doc"].as_u64().unwrap();
+    assert!(a.call("page_render", &json!({ "doc": mobile, "page": 1, "dpi": 72 })).is_ok());
+    assert!(matches!(a.call("doc_optimize", &json!({ "doc": doc, "path": "x.pdf", "preset": "tiny" })), Err(ToolError::InvalidArgs(_))));
+}
+
 #[test]
 fn initial_view_through_tools() {
     let dir = workdir("initial-view");
@@ -4523,6 +5150,33 @@ fn hundreds_of_xfa_calculations_open_and_recalculate_within_their_budgets() {
     eprintln!("{} calculate scripts: open {open_took:?}, recalculation after a change {change_took:?}", sections * rows + sections);
 }
 
+#[test]
+fn xfa_forms_flatten_and_convert_to_static_through_tools() {
+    let dir = workdir("xfa-flat");
+    let data = "<form><page1><country>JP</country></page1></form>";
+    std::fs::write(dir.join("fields.pdf"), pdfcraft_xfa::fixtures::shell(&pdfcraft_xfa::fixtures::fields_template(data))).unwrap();
+    let mut a = auto(&dir);
+    // Convert to static: the fields stay, the XFA goes.
+    let doc = ok(&mut a, "doc_open", json!({ "path": "fields.pdf" }))["doc"].as_u64().unwrap();
+    assert_eq!(ok(&mut a, "doc_info", json!({ "doc": doc }))["xfa"], "dynamic");
+    let before = ok(&mut a, "form_fields", json!({ "doc": doc }))["fields"].as_array().unwrap().len();
+    ok(&mut a, "xfa_to_static", json!({ "doc": doc }));
+    let info = ok(&mut a, "doc_info", json!({ "doc": doc }));
+    assert!(info["xfa"].is_null(), "{info}");
+    assert_eq!(ok(&mut a, "form_fields", json!({ "doc": doc }))["fields"].as_array().unwrap().len(), before);
+    ok(&mut a, "doc_save", json!({ "doc": doc, "path": "static.pdf" }));
+    let again = ok(&mut a, "doc_open", json!({ "path": "static.pdf" }))["doc"].as_u64().unwrap();
+    assert!(ok(&mut a, "doc_info", json!({ "doc": again }))["xfa"].is_null());
+    assert!(a.call("xfa_to_static", &json!({ "doc": again })).is_err(), "not an XFA form");
+    // Flatten the fields: a plain PDF with the values as page content.
+    let doc = ok(&mut a, "doc_open", json!({ "path": "fields.pdf" }))["doc"].as_u64().unwrap();
+    ok(&mut a, "doc_flatten", json!({ "doc": doc, "comments": false, "fields": true }));
+    assert!(ok(&mut a, "doc_info", json!({ "doc": doc }))["xfa"].is_null());
+    assert_eq!(ok(&mut a, "form_fields", json!({ "doc": doc }))["fields"].as_array().unwrap().len(), 0);
+    let text = ok(&mut a, "text_extract", json!({ "doc": doc, "pages": [1] }));
+    assert!(text.to_string().contains("Japan"), "{text}");
+}
+
 #[test]
 fn xfa_data_files_export_and_import_through_tools() {
     let dir = workdir("xfa-data");
@@ -5145,6 +5799,24 @@ fn command_batch_refuses_more_than_a_thousand_steps() {
     assert!(err.to_string().contains("at most 1000 steps"), "{err}");
 }
 
+#[test]
+fn command_batch_tells_a_tool_name_from_an_unknown_or_toolless_command() {
+    let dir = workdir("batch-ids");
+    let mut a = auto(&dir);
+    let steps = json!([{"id":"page_rotate"}, {"id":"doc_inspect"}, {"id":"no.such.command"}, {"id":"help.about"}]);
+    let r = ok(&mut a, "command_batch", json!({"steps": steps, "stop_on_error": false}));
+    let errors: Vec<&str> = r["results"].as_array().unwrap().iter().map(|s| s["error"].as_str().unwrap()).collect();
+    assert_eq!(
+        errors,
+        [
+            r#""page_rotate" is a tool, not a command id; use the command id "page.rotate", or call the tool directly"#,
+            r#""doc_inspect" is a tool, not a command id; call it directly (command ids are in command_list)"#,
+            r#"unknown command id "no.such.command"; see command_list"#,
+            r#"command "help.about" has no headless tool; see command_list"#,
+        ]
+    );
+}
+
 #[test]
 fn thai_text_through_tools_saves_reopens_extracts_and_renders() {
     let dir = workdir("thai-content");
@@ -5169,6 +5841,33 @@ fn thai_text_through_tools_saves_reopens_extracts_and_renders() {
     assert!(page_text(&mut a, reopened)[0].contains("แก้ไข น้ำ"));
 }
 
+#[test]
+fn hebrew_text_through_tools_saves_reopens_extracts_and_renders() {
+    let dir = workdir("hebrew-content");
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({"path": "a.pdf"}))["doc"].as_u64().unwrap();
+    let text = "שם משפחה: שרון, טל׳ 052-1234567 (נייד)";
+    let args = json!({"doc": doc, "page": 1, "text": text, "rect": [10, 20, 400, 40], "size": 11, "align": "right"});
+    if pdfcraft_fonts::document_hebrew_font(false).is_none() {
+        assert!(a.call("page_add_text", &args).unwrap_err().to_string().contains("U+05E9"));
+        assert_eq!(ok(&mut a, "content_list", json!({"doc": doc}))["count"], 0);
+        return;
+    }
+    ok(&mut a, "page_add_text", args);
+    // Extraction gives back the typing order, not the drawing order.
+    assert!(page_text(&mut a, doc)[0].contains(text), "{:?}", page_text(&mut a, doc));
+    ok(&mut a, "doc_save", json!({"doc": doc, "path": "hebrew.pdf"}));
+    let reopened = ok(&mut a, "doc_open", json!({"path": "hebrew.pdf"}))["doc"].as_u64().unwrap();
+    assert_eq!(ok(&mut a, "content_list", json!({"doc": reopened}))["items"][0]["text"], text);
+    assert!(page_text(&mut a, reopened)[0].contains(text));
+    let found = ok(&mut a, "text_find", json!({"doc": reopened, "query": "שרון"}));
+    assert_eq!(found["matches"].as_array().map(Vec::len), Some(1), "{found}");
+    let rendered = a.call("page_render", &json!({"doc": reopened, "page": 1, "dpi": 144})).unwrap();
+    assert!(rendered.iter().any(|c| matches!(c, Content::Png { data, width, height } if !data.is_empty() && *width > 0 && *height > 0)));
+    ok(&mut a, "content_update", json!({"doc": reopened, "page": 1, "index": 1, "text": "מיכאל שָׁלוֹם"}));
+    assert!(page_text(&mut a, reopened)[0].contains("מיכאל"));
+}
+
 #[test]
 fn mixed_objects_move_through_tools_with_generation_and_one_undo() {
     let dir = workdir("mixed-object-move");
@@ -5466,6 +6165,7 @@ fn architectural_and_iso_papers_through_tools() {
         ("A2", 420.0 * mm, 594.0 * mm),
         ("A1", 594.0 * mm, 841.0 * mm),
         ("A0", 841.0 * mm, 1189.0 * mm),
+        ("A6", 105.0 * mm, 148.0 * mm),
         ("Letter", 612.0, 792.0),
         ("US Legal", 612.0, 1008.0),
         ("Tabloid", 792.0, 1224.0),
@@ -5717,3 +6417,81 @@ fn absolute_gotor_consent_does_not_bypass_validation_or_passwords() {
     assert_eq!(opened["document"]["encrypted"], true);
     assert_eq!(opened["destination_applied"], true);
 }
+
+#[test]
+fn finding_untagged_content_limits_results_to_content_annotations_and_widgets() {
+    let dir = workdir("find-untagged");
+    std::fs::write(dir.join("field.pdf"), form_pdf("name")).unwrap();
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "field.pdf" }))["doc"].as_u64().unwrap();
+    let found = ok(&mut a, "accessibility_find_untagged", json!({ "doc": doc }));
+    let active: Vec<&str> = found["results"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .filter(|result| result["status"] != "skipped")
+        .map(|result| result["rule"].as_str().unwrap())
+        .collect();
+    assert_eq!(active, ["tagged-content", "tagged-annotations", "tagged-form-fields"]);
+    let fields = found["results"].as_array().unwrap().iter().find(|result| result["rule"] == "tagged-form-fields").unwrap();
+    assert_eq!(fields["status"], "failed");
+    assert_eq!(fields["findings"][0]["page"], 1);
+}
+
+#[test]
+fn a_missing_path_under_the_root_names_where_it_was_looked_for() {
+    // #1890: a script written from another working directory repeats the root's folder in its
+    // paths. The refusal names the resolved path and the root, so there is something to correct.
+    let (base, root) = sandbox("resolved-path");
+    let mut a = auto(&root);
+    let looked = |rel: &str| root.join(rel).display().to_string();
+    for (path, rel) in
+        [("root/inside.pdf", "root/inside.pdf"), ("missing/deeper/x.pdf", "missing/deeper/x.pdf"), ("./sub/../root/inside.pdf", "root/inside.pdf")]
+    {
+        let ToolError::Failed(m) = err(&mut a, "doc_open", json!({ "path": path })) else { panic!("{path}: not a failure") };
+        assert_eq!(m, format!("{path} not found (looked for {}, --root {})", looked(rel), root.display()));
+    }
+    // The same mistake with a file that does exist outside still gets the plain refusal (#136).
+    let ToolError::Failed(m) = err(&mut a, "doc_open", json!({ "path": "../outside/secret.pdf" })) else { panic!("not a failure") };
+    assert!(!m.contains("looked for"), "{m}");
+    ok(&mut a, "doc_open", json!({ "path": "inside.pdf" }));
+    let _ = std::fs::remove_dir_all(base);
+}
+
+/// `doc_print` prints as image: pictures at `dpi`, grey with `grayscale`; a resolution outside
+/// 72–600 is refused.
+#[test]
+fn doc_print_as_image() {
+    let dir = workdir("print-image");
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+    let r = ok(&mut a, "doc_print", json!({ "doc": doc, "pages": "1", "as_image": true, "dpi": 150, "grayscale": true, "path": "image.pdf" }));
+    assert_eq!(r["sheets"], 1);
+    let bytes = std::fs::read(dir.join("image.pdf")).unwrap();
+    let out = pdfcraft_cos::Document::open(std::sync::Arc::new(bytes)).unwrap();
+    let pictures =
+        out.scan_objects().filter(|(_, o)| matches!(&**o, pdfcraft_cos::Object::Stream(st) if st.dict.name(b"Subtype") == Some(b"Image"))).count();
+    assert_eq!(pictures, 1);
+    match a.call("doc_print", &json!({ "doc": doc, "as_image": true, "dpi": 20, "path": "x.pdf" })) {
+        Err(ToolError::InvalidArgs(m)) => assert!(m.contains("dpi"), "{m}"),
+        other => panic!("{other:?}"),
+    }
+}
+
+/// Without a root, `write_output` still writes through a staging file (#2166): the folder is
+/// made, nothing is left beside the file, and a folder at the path is refused.
+#[test]
+fn a_root_less_write_output_is_atomic_too() {
+    let dir = std::env::temp_dir().join(format!("pdfcraft-automation-rootless-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    let free = Automation::new();
+    let target = dir.join("new").join("page.png");
+    let written = free.write_output(&target.to_string_lossy(), &[1, 2, 3]).unwrap();
+    assert_eq!(written, target);
+    assert_eq!(std::fs::read(&target).unwrap(), [1, 2, 3]);
+    let names: Vec<_> = std::fs::read_dir(dir.join("new")).unwrap().map(|e| e.unwrap().file_name().to_string_lossy().into_owned()).collect();
+    assert_eq!(names, ["page.png"], "no staging file left beside it");
+    let e = free.write_output(&dir.join("new").to_string_lossy(), &[4]).unwrap_err();
+    assert!(matches!(&e, ToolError::Failed(m) if m.contains("is a folder")), "{e:?}");
+    let _ = std::fs::remove_dir_all(&dir);
+}
diff --git a/crates/automation/tests/automation_roots.rs b/crates/automation/tests/automation_roots.rs
new file mode 100644
index 000000000..94958ea2f
--- /dev/null
+++ b/crates/automation/tests/automation_roots.rs
@@ -0,0 +1,376 @@
+//! `pdfcraft-cli mcp --automation-read-root <dir> --automation-write-root <dir>`: through the MCP
+//! protocol, files open and load only from inside the read root and are written only inside the
+//! write root. Paths that leave a root (`..`, another folder, a sibling with the same prefix, a
+//! link) are refused with the wording VectorCraft uses, nothing is read into the result and
+//! nothing is written outside.
+#![cfg(feature = "mcp")]
+
+use std::path::{Path, PathBuf};
+
+use pdfcraft_automation::Automation;
+use pdfcraft_automation::file_access::AutomationRoots;
+use pdfcraft_automation::mcp::McpServer;
+use serde_json::{Value, json};
+
+/// A 1x1 PNG, so the tools that take a picture have something real to read.
+const PNG: &[u8] = &[
+    0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0x00, 0x00, 0x00, 0x0d, 0x49, 0x48, 0x44, 0x52, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01,
+    0x08, 0x06, 0x00, 0x00, 0x00, 0x1f, 0x15, 0xc4, 0x89, 0x00, 0x00, 0x00, 0x0d, 0x49, 0x44, 0x41, 0x54, 0x78, 0x9c, 0x63, 0xf8, 0xcf, 0xc0, 0xf0,
+    0x1f, 0x00, 0x05, 0x00, 0x01, 0xff, 0x89, 0x99, 0x3d, 0x1d, 0x00, 0x00, 0x00, 0x00, 0x49, 0x45, 0x4e, 0x44, 0xae, 0x42, 0x60, 0x82,
+];
+
+/// A one-page PDF reading `text`, with a 1x1 picture on it.
+fn pdf(text: &str) -> Vec<u8> {
+    let body = format!("q 100 0 0 100 20 20 cm /Im1 Do Q BT /F1 24 Tf 20 150 Td ({text}) Tj ET");
+    let objs: Vec<Vec<u8>> = vec![
+        b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+        b"<< /Type /Pages /Kids [4 0 R] /Count 1 /MediaBox [0 0 200 300] >>".to_vec(),
+        b"<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /Contents 5 0 R /Resources << /Font << /F1 3 0 R >> /XObject << /Im1 6 0 R >> >> >>".to_vec(),
+        format!("<< /Length {} >>\nstream\n{body}\nendstream", body.len()).into_bytes(),
+        b"<< /Type /XObject /Subtype /Image /Width 1 /Height 1 /ColorSpace /DeviceRGB /BitsPerComponent 8 /Length 3 >>\nstream\n\xff\x00\x00\nendstream"
+            .to_vec(),
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n", i + 1).as_bytes());
+        out.extend_from_slice(o);
+        out.extend_from_slice(b"\nendobj\n");
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    out
+}
+
+/// A fresh folder holding `in` (the read root, with `a.pdf`, `b.pdf` and `pic.png`), `out` (the
+/// write root), `outside` (with `secret.pdf` and a picture) and `in2`.
+fn folders(tag: &str) -> PathBuf {
+    let base = std::env::temp_dir().join(format!("pdfcraft-mcp-roots-{tag}-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&base);
+    for d in ["in", "out", "outside", "in2"] {
+        std::fs::create_dir_all(base.join(d)).unwrap();
+    }
+    std::fs::write(base.join("in/a.pdf"), pdf("Inside page")).unwrap();
+    std::fs::write(base.join("in/b.pdf"), pdf("Second inside")).unwrap();
+    std::fs::write(base.join("in/pic.png"), PNG).unwrap();
+    std::fs::write(base.join("outside/secret.pdf"), pdf("TOP SECRET")).unwrap();
+    std::fs::write(base.join("outside/pic.png"), PNG).unwrap();
+    std::fs::write(base.join("in2/c.pdf"), pdf("Sibling")).unwrap();
+    base
+}
+
+/// A server confined to `in` and `out` (either may be left out).
+fn confined(tag: &str, read: bool, write: bool) -> (McpServer, PathBuf) {
+    let base = folders(tag);
+    let (in_dir, out_dir) = (base.join("in"), base.join("out"));
+    let roots = AutomationRoots::new(read.then_some(in_dir.as_path()), write.then_some(out_dir.as_path())).unwrap();
+    (McpServer::new(Automation::new().with_automation_roots(roots).with_clock(|| 1_700_000_000)), base)
+}
+
+fn s(p: &Path) -> String {
+    p.to_string_lossy().into_owned()
+}
+
+fn rpc(server: &mut McpServer, method: &str, params: Value) -> Value {
+    let line = json!({"jsonrpc": "2.0", "id": 1, "method": method, "params": params}).to_string();
+    serde_json::from_str(&server.handle_line(&line).unwrap()).unwrap()
+}
+
+/// `tools/call` -> (isError, all the text of the reply).
+fn call(server: &mut McpServer, name: &str, args: Value) -> (bool, String) {
+    let reply = rpc(server, "tools/call", json!({"name": name, "arguments": args}));
+    let result = &reply["result"];
+    let mut text =
+        result["content"].as_array().map(|c| c.iter().filter_map(|c| c["text"].as_str()).collect::<Vec<_>>().join("\n")).unwrap_or_default();
+    text.push_str(&result["structuredContent"].to_string());
+    text.push_str(&reply["error"].to_string());
+    (result["isError"] == true || reply["error"].is_object(), text)
+}
+
+fn ok(server: &mut McpServer, name: &str, args: Value) -> Value {
+    let reply = rpc(server, "tools/call", json!({"name": name, "arguments": args}));
+    assert!(reply["result"]["isError"] == false, "{name} {args}: {reply}");
+    reply["result"]["structuredContent"].clone()
+}
+
+fn refused(server: &mut McpServer, name: &str, args: Value, why: &str) {
+    let (error, text) = call(server, name, args.clone());
+    assert!(error && text.contains(why), "{name} {args} should be refused ({why}): {text}");
+    assert!(!text.contains("TOP SECRET"), "{name} {args} let the file's text through: {text}");
+}
+
+/// The text of document 1, through the resource a client can read it with.
+fn text_of(server: &mut McpServer, doc: u64) -> String {
+    rpc(server, "resources/read", json!({"uri": format!("pdfcraft://doc/{doc}/text")}))["result"]["contents"][0]["text"]
+        .as_str()
+        .unwrap_or_default()
+        .to_owned()
+}
+
+fn names(dir: &Path) -> Vec<String> {
+    let mut names: Vec<String> = std::fs::read_dir(dir).unwrap().map(|e| e.unwrap().file_name().to_string_lossy().into_owned()).collect();
+    names.sort();
+    names
+}
+
+#[test]
+fn files_open_only_from_inside_the_read_root() {
+    let (mut server, base) = confined("open", true, true);
+    let sep = std::path::MAIN_SEPARATOR;
+    ok(&mut server, "doc_open", json!({"path": s(&base.join("in/a.pdf"))}));
+    assert!(text_of(&mut server, 1).contains("Inside page"));
+
+    refused(&mut server, "doc_open", json!({"path": s(&base.join("outside/secret.pdf"))}), "outside the read root");
+    refused(&mut server, "doc_open", json!({"path": format!("{}{sep}..{sep}outside{sep}secret.pdf", s(&base.join("in")))}), "outside the read root");
+    // A sibling whose name starts with the root's name is not inside it.
+    refused(&mut server, "doc_open", json!({"path": s(&base.join("in2/c.pdf"))}), "outside the read root");
+    // The write root is not readable: the two kinds of access are separate.
+    std::fs::write(base.join("out/d.pdf"), pdf("Written")).unwrap();
+    refused(&mut server, "doc_open", json!({"path": s(&base.join("out/d.pdf"))}), "outside the read root");
+    // A relative path is the working directory's (the crate's folder here): outside.
+    refused(&mut server, "doc_open", json!({"path": "Cargo.toml"}), "outside the read root");
+    // Nothing was opened by the refused calls.
+    assert_eq!(ok(&mut server, "doc_list", json!({}))["documents"].as_array().unwrap().len(), 1);
+}
+
+#[test]
+fn tools_that_read_a_path_are_held_to_the_read_root() {
+    let (mut server, base) = confined("reads", true, true);
+    ok(&mut server, "doc_open", json!({"path": s(&base.join("in/a.pdf"))}));
+    let (secret, pic, gone) = (s(&base.join("outside/secret.pdf")), s(&base.join("outside/pic.png")), s(&base.join("outside/gone.bin")));
+    let out = s(&base.join("out/result.pdf"));
+    for (tool, args) in [
+        ("page_insert_file", json!({"doc": 1, "path": secret, "at": 1})),
+        ("page_replace", json!({"doc": 1, "pages": [1], "path": secret})),
+        ("doc_combine", json!({"paths": [s(&base.join("in/a.pdf")), secret], "out": out})),
+        ("doc_create_multiple", json!({"paths": [secret], "mode": "combine", "out": out})),
+        ("doc_create", json!({"from": "images", "paths": [pic]})),
+        ("stamp_custom", json!({"doc": 1, "page": 1, "path": secret, "at": [10, 10]})),
+        ("page_add_image", json!({"doc": 1, "page": 1, "path": pic})),
+        ("image_edit", json!({"doc": 1, "page": 1, "image": 1, "action": "replace", "path": pic})),
+        ("comment_add", json!({"doc": 1, "page": 1, "type": "attachment", "at": [10, 10], "path": secret})),
+        ("fill_sign_add", json!({"doc": 1, "page": 1, "type": "signature", "at": [10, 10], "path": pic})),
+        ("form_set_image", json!({"doc": 1, "field": "f", "path": pic})),
+        ("doc_import_data", json!({"doc": 1, "path": secret})),
+        ("doc_watermark", json!({"doc": 1, "file": pic})),
+        ("doc_background", json!({"doc": 1, "file": pic})),
+        ("form_merge_data", json!({"paths": [secret], "path": out})),
+        ("ocr_recognize_files", json!({"paths": [secret], "folder": s(&base.join("out/ocr"))})),
+        ("sign_trust", json!({"paths": [secret]})),
+        ("sign_document", json!({"doc": 1, "id": secret, "out": out})),
+        ("text_font_import", json!({"doc": 1, "page": 1, "path": gone})),
+        ("text_font_files", json!({"directories": [s(&base.join("outside"))]})),
+    ] {
+        refused(&mut server, tool, args, "outside the read root");
+    }
+    // The refused calls changed neither the document nor the disk.
+    assert!(!text_of(&mut server, 1).contains("TOP SECRET"));
+    assert_eq!(ok(&mut server, "doc_list", json!({}))["documents"].as_array().unwrap().len(), 1);
+    assert_eq!(names(&base.join("out")), Vec::<String>::new());
+
+    // One file per output: a file that can't be read is reported in its own entry, with the same refusal.
+    let (_, text) = call(&mut server, "doc_create_multiple", json!({"paths": [secret], "mode": "separate", "out_dir": s(&base.join("out/sep"))}));
+    assert!(text.contains("outside the read root") && !text.contains("TOP SECRET"), "{text}");
+    assert!(names(&base.join("out/sep")).is_empty());
+    let (_, text) = call(&mut server, "action_run", json!({"paths": [secret], "folder": s(&base.join("out/act")), "action": "Add Page Numbers"}));
+    assert!(text.contains("outside the read root") && !text.contains("TOP SECRET"), "{text}");
+    assert!(names(&base.join("out/act")).is_empty());
+    std::fs::remove_dir_all(base.join("out/act")).unwrap();
+
+    // The same tools work on files inside the root.
+    std::fs::remove_dir_all(base.join("out/sep")).unwrap();
+    ok(&mut server, "page_insert_file", json!({"doc": 1, "path": s(&base.join("in/b.pdf")), "at": 2}));
+    assert!(text_of(&mut server, 1).contains("Second inside"));
+    ok(&mut server, "page_add_image", json!({"doc": 1, "page": 1, "path": s(&base.join("in/pic.png"))}));
+    ok(&mut server, "doc_combine", json!({"paths": [s(&base.join("in/a.pdf")), s(&base.join("in/b.pdf"))], "out": out}));
+    assert_eq!(names(&base.join("out")), ["result.pdf"]);
+    // Without a folder to list, the installed fonts are outside the read root: it is searched instead.
+    ok(&mut server, "text_font_files", json!({}));
+    ok(&mut server, "text_font_files", json!({"directories": [s(&base.join("in"))]}));
+}
+
+#[test]
+fn tools_that_write_a_path_are_held_to_the_write_root() {
+    let (mut server, base) = confined("writes", true, true);
+    let input = |name: &str| s(&base.join("in").join(name));
+    ok(&mut server, "doc_open", json!({"path": input("a.pdf")}));
+    ok(&mut server, "doc_open", json!({"path": input("b.pdf")}));
+    let writes = |dir: &str| -> Vec<(&'static str, Value)> {
+        let file = |name: &str| s(&base.join(dir).join(name));
+        vec![
+            ("doc_save", json!({"doc": 1, "path": file("saved.pdf")})),
+            ("page_extract", json!({"doc": 1, "pages": [1], "out": file("extract.pdf")})),
+            ("page_extract", json!({"doc": 1, "pages": [1], "separate": true, "out_dir": file("pages")})),
+            ("doc_combine", json!({"paths": [input("a.pdf"), input("b.pdf")], "out": file("combined.pdf")})),
+            ("doc_create_multiple", json!({"paths": [input("a.pdf")], "mode": "combine", "out": file("multiple.pdf")})),
+            ("doc_create_multiple", json!({"paths": [input("a.pdf")], "mode": "separate", "out_dir": file("separate")})),
+            ("doc_split", json!({"doc": 1, "every": 1, "out_dir": file("parts")})),
+            ("doc_reduce", json!({"doc": 1, "path": file("reduced.pdf")})),
+            ("doc_optimize", json!({"doc": 1, "path": file("optimized.pdf")})),
+            ("doc_print", json!({"doc": 1, "path": file("printed.pdf")})),
+            ("doc_export_text", json!({"doc": 1, "path": file("text.txt")})),
+            ("doc_export_office", json!({"doc": 1, "path": file("export.docx")})),
+            ("doc_export_data", json!({"doc": 1, "path": file("data.xfdf")})),
+            ("doc_export_images", json!({"doc": 1, "folder": file("renders")})),
+            ("doc_export_all_images", json!({"doc": 1, "folder": file("images")})),
+            ("image_save", json!({"doc": 1, "page": 1, "image": 1, "path": file("image.png")})),
+            ("measure_export", json!({"doc": 1, "out": file("measurements.csv")})),
+            ("comments_summarize", json!({"doc": 1, "out": file("summary.pdf")})),
+            ("accessibility_report", json!({"doc": 1, "path": file("report.html")})),
+            ("accessibility_review_record", json!({"before": 1, "after": 2, "path": file("record.json")})),
+            ("doc_compare_report", json!({"doc": 1, "other": 2, "path": file("compare.pdf")})),
+            ("form_merge_data", json!({"paths": [input("a.pdf")], "path": file("merged.csv")})),
+            ("action_run", json!({"paths": [input("a.pdf")], "folder": file("actions"), "action": "Add Page Numbers"})),
+            ("ocr_recognize_files", json!({"paths": [input("a.pdf")], "folder": file("ocr")})),
+            ("sign_id_create", json!({"name": "Test", "password": "secret12", "path": file("id.p12"), "key": "p256"})),
+        ]
+    };
+
+    for (tool, args) in writes("outside") {
+        refused(&mut server, tool, args, "outside the write root");
+    }
+    // The read root is not writable either.
+    for (tool, args) in writes("in") {
+        refused(&mut server, tool, args, "outside the write root");
+    }
+    // `..` out of the write root, and a sibling that shares its prefix.
+    let sep = std::path::MAIN_SEPARATOR;
+    refused(
+        &mut server,
+        "doc_save",
+        json!({"doc": 1, "path": format!("{}{sep}..{sep}outside{sep}up.pdf", s(&base.join("out")))}),
+        "outside the write root",
+    );
+    std::fs::create_dir_all(base.join("out2")).unwrap();
+    refused(&mut server, "doc_save", json!({"doc": 1, "path": s(&base.join("out2/x.pdf"))}), "outside the write root");
+    // Saving in place writes to the folder the file was opened from: the read root, not the write root.
+    refused(&mut server, "doc_save", json!({"doc": 1}), "outside the write root");
+
+    assert_eq!(names(&base.join("outside")), ["pic.png", "secret.pdf"], "nothing was written outside the roots");
+    assert_eq!(names(&base.join("in")), ["a.pdf", "b.pdf", "pic.png"], "nothing was written to the read root");
+    assert!(names(&base.join("out2")).is_empty());
+    assert!(names(&base.join("out")).is_empty());
+
+    // The same calls land in the write root.
+    for (tool, args) in writes("out") {
+        let (error, text) = call(&mut server, tool, args.clone());
+        // (Printing to a PDF and the like may not apply to this fixture: a refusal for the roots is the failure.)
+        assert!(!text.contains("automation path rejected") && !text.contains("automation filesystem access"), "{tool} {args}: {text}");
+        let _ = error;
+    }
+    assert!(base.join("out/saved.pdf").is_file() && base.join("out/combined.pdf").is_file() && base.join("out/text.txt").is_file());
+    assert_eq!(names(&base.join("outside")), ["pic.png", "secret.pdf"]);
+}
+
+#[test]
+fn signing_writes_and_reads_only_inside_the_roots() {
+    // One folder for both roots, so a digital ID can be made and then read back.
+    let base = folders("signing");
+    let work = base.join("work");
+    std::fs::create_dir_all(&work).unwrap();
+    std::fs::write(work.join("a.pdf"), pdf("Work page")).unwrap();
+    let roots = AutomationRoots::new(Some(&work), Some(&work)).unwrap();
+    let mut server = McpServer::new(Automation::new().with_automation_roots(roots).with_clock(|| 1_700_000_000));
+    ok(&mut server, "doc_open", json!({"path": s(&work.join("a.pdf"))}));
+    ok(&mut server, "sign_id_create", json!({"name": "Test", "password": "secret12", "path": s(&work.join("id.p12")), "key": "p256"}));
+    refused(
+        &mut server,
+        "sign_id_create",
+        json!({"name": "Test", "password": "secret12", "path": s(&base.join("outside/id.p12")), "key": "p256"}),
+        "outside the write root",
+    );
+    refused(
+        &mut server,
+        "sign_document",
+        json!({"doc": 1, "id": s(&work.join("id.p12")), "password": "secret12", "out": s(&base.join("outside/signed.pdf"))}),
+        "outside the write root",
+    );
+    ok(&mut server, "sign_document", json!({"doc": 1, "id": s(&work.join("id.p12")), "password": "secret12", "out": s(&work.join("signed.pdf"))}));
+    assert!(work.join("signed.pdf").is_file());
+    assert_eq!(names(&base.join("outside")), ["pic.png", "secret.pdf"]);
+}
+
+#[test]
+fn a_root_left_out_grants_none_of_its_access() {
+    let (mut server, base) = confined("read-only", true, false);
+    ok(&mut server, "doc_open", json!({"path": s(&base.join("in/a.pdf"))}));
+    for target in ["out/doc.pdf", "in/doc.pdf"] {
+        refused(&mut server, "doc_save", json!({"doc": 1, "path": s(&base.join(target))}), "write authority is absent");
+    }
+    refused(&mut server, "doc_save", json!({"doc": 1}), "write authority is absent");
+    refused(&mut server, "doc_export_text", json!({"doc": 1, "path": s(&base.join("out/t.txt"))}), "write authority is absent");
+    refused(&mut server, "page_extract", json!({"doc": 1, "pages": [1], "out": s(&base.join("out/e.pdf"))}), "write authority is absent");
+    refused(&mut server, "doc_split", json!({"doc": 1, "every": 1, "out_dir": s(&base.join("out/parts"))}), "write authority is absent");
+    assert!(names(&base.join("out")).is_empty() && names(&base.join("in")) == ["a.pdf", "b.pdf", "pic.png"]);
+    // A tool that gives its result back instead of writing it still can.
+    ok(&mut server, "page_extract", json!({"doc": 1, "pages": [1]}));
+
+    let (mut server, base) = confined("write-only", false, true);
+    refused(&mut server, "doc_open", json!({"path": s(&base.join("in/a.pdf"))}), "read authority is absent");
+    refused(
+        &mut server,
+        "doc_combine",
+        json!({"paths": [s(&base.join("in/a.pdf")), s(&base.join("in/b.pdf"))], "out": s(&base.join("out/c.pdf"))}),
+        "read authority is absent",
+    );
+    refused(&mut server, "text_font_files", json!({}), "read authority is absent");
+    ok(&mut server, "doc_create", json!({"from": "blank", "pages": 1, "width": 200, "height": 300}));
+    ok(&mut server, "doc_save", json!({"doc": 1, "path": s(&base.join("out/blank.pdf"))}));
+    assert!(base.join("out/blank.pdf").is_file());
+}
+
+#[test]
+fn links_out_of_a_root_are_refused() {
+    let (mut server, base) = confined("links", true, true);
+    #[cfg(unix)]
+    let linked = std::os::unix::fs::symlink(base.join("outside"), base.join("out/away")).is_ok()
+        && std::os::unix::fs::symlink(base.join("outside/secret.pdf"), base.join("in/leak.pdf")).is_ok()
+        && std::os::unix::fs::symlink(base.join("outside/nowhere.pdf"), base.join("out/dangling.pdf")).is_ok();
+    #[cfg(windows)]
+    let linked = std::os::windows::fs::symlink_dir(base.join("outside"), base.join("out/away")).is_ok()
+        && std::os::windows::fs::symlink_file(base.join("outside/secret.pdf"), base.join("in/leak.pdf")).is_ok()
+        && std::os::windows::fs::symlink_file(base.join("outside/nowhere.pdf"), base.join("out/dangling.pdf")).is_ok();
+    #[cfg(not(any(unix, windows)))]
+    let linked = false;
+    // Windows needs Developer Mode or elevation to make links.
+    if !linked {
+        eprintln!("skipped: symbolic links can't be made here");
+        return;
+    }
+    ok(&mut server, "doc_open", json!({"path": s(&base.join("in/a.pdf"))}));
+    refused(&mut server, "doc_open", json!({"path": s(&base.join("in/leak.pdf"))}), "outside the read root");
+    refused(&mut server, "doc_save", json!({"doc": 1, "path": s(&base.join("out/away/doc.pdf"))}), "outside the write root");
+    refused(&mut server, "doc_save", json!({"doc": 1, "path": s(&base.join("out/away/deeper/doc.pdf"))}), "outside the write root");
+    refused(&mut server, "doc_save", json!({"doc": 1, "path": s(&base.join("out/dangling.pdf"))}), "a link that leads nowhere");
+    assert_eq!(names(&base.join("outside")), ["pic.png", "secret.pdf"]);
+}
+
+#[test]
+fn without_roots_nothing_is_confined() {
+    let base = folders("none");
+    let mut server = McpServer::new(Automation::new());
+    ok(&mut server, "doc_open", json!({"path": s(&base.join("outside/secret.pdf"))}));
+    assert!(text_of(&mut server, 1).contains("TOP SECRET"));
+    ok(&mut server, "doc_save", json!({"doc": 1, "path": s(&base.join("in2/copy.pdf"))}));
+    assert!(base.join("in2/copy.pdf").is_file());
+}
+
+#[test]
+fn the_roots_apply_on_top_of_a_root() {
+    let base = folders("both");
+    let roots = AutomationRoots::new(Some(&base.join("in")), Some(&base.join("out"))).unwrap();
+    // `--root` resolves relative paths inside `in`, which the read root allows and the write root does not.
+    let mut server = McpServer::new(Automation::new().with_root(base.join("in")).unwrap().with_automation_roots(roots));
+    ok(&mut server, "doc_open", json!({"path": "a.pdf"}));
+    refused(&mut server, "doc_save", json!({"doc": 1, "path": "copy.pdf"}), "outside the write root");
+    refused(&mut server, "doc_open", json!({"path": "../outside/secret.pdf"}), "outside the allowed directory");
+    assert!(!base.join("in/copy.pdf").exists());
+    // The write root alone is not enough: the other root still has its say.
+    refused(&mut server, "doc_save", json!({"doc": 1, "path": "../out/copy.pdf"}), "outside the allowed directory");
+}
diff --git a/crates/content/README.md b/crates/content/README.md
index d9d8af10c..6ab984dd4 100644
--- a/crates/content/README.md
+++ b/crates/content/README.md
@@ -12,3 +12,8 @@ let m = Matrix::from_operands(&op.operands);  // cm / Tm arithmetic, invert, bbo
 The parser is tolerant (unreadable bytes are skipped and counted, never fatal) and never
 panics. `redact` and (later) `edit` build their interpreters on it; the graphics-state tracker
 and the `Patch` API of architecture §6 grow here.
+
+Unfiltered inline images with built-in or Indexed colour spaces, and image masks, use their
+sample layout (including per-row byte padding) to locate `EI`. This preserves pixel bytes
+that look like the terminator. Filtered images and resource-defined colour spaces retain
+the tolerant delimiter heuristic; damaged or truncated layouts fall back to it too.
diff --git a/crates/content/src/lib.rs b/crates/content/src/lib.rs
index 4a8f077fe..32334e047 100644
--- a/crates/content/src/lib.rs
+++ b/crates/content/src/lib.rs
@@ -175,12 +175,83 @@ fn inline_image(data: &[u8], pos: usize) -> Result<(Dict, Vec<u8>, usize), usize
     }
     // One whitespace byte separates ID from the data.
     let begin = (lx.pos + 1).min(data.len());
-    Ok(match end_of_image(data, begin) {
+    let end = unfiltered_image_end(data, begin, &dict).or_else(|| end_of_image(data, begin));
+    Ok(match end {
         Some((end_data, end)) => (dict, data[begin..end_data].to_vec(), end),
         None => (dict, data[begin..].to_vec(), data.len()),
     })
 }
 
+/// An unfiltered image's samples determine its length, including byte padding per row.
+/// Binary samples may themselves contain whitespace + `EI` + whitespace, so use the known
+/// length when the actual terminator follows it. Unknown or damaged layouts keep the heuristic.
+fn unfiltered_image_end(data: &[u8], begin: usize, dict: &Dict) -> Option<(usize, usize)> {
+    for key in [b"Filter".as_slice(), b"F"] {
+        if let Some(filter) = dict.get(key)
+            && !matches!(filter, Object::Null)
+            && !matches!(filter, Object::Array(filters) if filters.is_empty())
+        {
+            return None;
+        }
+    }
+    for (full, short) in
+        [(b"Width".as_slice(), b"W".as_slice()), (b"Height", b"H"), (b"ColorSpace", b"CS"), (b"BitsPerComponent", b"BPC"), (b"ImageMask", b"IM")]
+    {
+        if let (Some(full), Some(short)) = (dict.get(full), dict.get(short))
+            && full != short
+        {
+            return None;
+        }
+    }
+    let get = |full: &[u8], short: &[u8]| dict.get(full).or_else(|| dict.get(short));
+    let width = usize::try_from(get(b"Width", b"W")?.as_int()?).ok().filter(|n| *n > 0)?;
+    let height = usize::try_from(get(b"Height", b"H")?.as_int()?).ok().filter(|n| *n > 0)?;
+    let mask = match get(b"ImageMask", b"IM") {
+        None | Some(Object::Null | Object::Bool(false)) => false,
+        Some(Object::Bool(true)) => true,
+        _ => return None,
+    };
+    let bits = match get(b"BitsPerComponent", b"BPC") {
+        None | Some(Object::Null) => None,
+        Some(value) => Some(value.as_int()?),
+    };
+    let (components, bits) = if mask {
+        if bits.is_some_and(|bits| bits != 1) {
+            return None;
+        }
+        (1usize, 1usize)
+    } else {
+        let (components, max_bits) = match get(b"ColorSpace", b"CS")? {
+            Object::Name(name) => match name.as_slice() {
+                b"DeviceGray" | b"G" => (1, 16),
+                b"DeviceRGB" | b"RGB" => (3, 16),
+                b"DeviceCMYK" | b"CMYK" => (4, 16),
+                _ => return None,
+            },
+            Object::Array(space) if space.len() == 4 && matches!(space.first().and_then(Object::as_name), Some(b"Indexed" | b"I")) => (1, 8),
+            _ => return None,
+        };
+        let bits = match bits? {
+            bits @ (1 | 2 | 4 | 8 | 16) => bits as usize,
+            _ => return None,
+        };
+        if bits > max_bits {
+            return None;
+        }
+        (components, bits)
+    };
+    let row = width.checked_mul(components)?.checked_mul(bits)?.div_ceil(8);
+    let end_data = begin.checked_add(row.checked_mul(height)?)?;
+    let after = data.get(end_data..)?;
+    if !after.first().is_some_and(|b| is_ws(*b)) {
+        return None;
+    }
+    let separator = after.iter().position(|b| !is_ws(*b))?;
+    let ei = end_data.checked_add(separator)?;
+    let end = ei.checked_add(2)?;
+    if data.get(ei..end) == Some(b"EI") && data.get(end).is_none_or(|b| is_ws(*b) || is_delim(*b)) { Some((end_data, end)) } else { None }
+}
+
 /// Where inline image data starting at `begin` ends: (end of the data, position after `EI`). The
 /// data ends at whitespace + `EI` + (whitespace, a delimiter or the end).
 fn end_of_image(data: &[u8], begin: usize) -> Option<(usize, usize)> {
diff --git a/crates/content/src/tests.rs b/crates/content/src/tests.rs
index 99f40d4e3..18e0b8cbc 100644
--- a/crates/content/src/tests.rs
+++ b/crates/content/src/tests.rs
@@ -38,6 +38,171 @@ fn inline_images_stay_whole() {
     assert_eq!(again.ops[2].inline, p.ops[2].inline);
 }
 
+#[test]
+fn unfiltered_inline_image_keeps_whitespace_bounded_ei_pixels() {
+    let src = b"q 4 0 0 1 0 0 cm BI /W 4 /H 1 /BPC 8 /CS /G ID  EI \nEI Q";
+    let parsed = parse(src);
+    assert_eq!(parsed.ops[2].inline.as_ref().unwrap().1, b" EI ");
+    assert_eq!(parsed.ops.iter().map(|op| op.op.as_slice()).collect::<Vec<_>>(), [b"q".as_slice(), b"cm", b"BI", b"Q"]);
+    let rewritten = serialize_ops(&parsed.ops);
+    assert_eq!(parse(&rewritten).ops[2].inline, parsed.ops[2].inline);
+}
+
+fn inline_pixels(parameters: &[u8], pixels: &[u8]) -> Parsed {
+    let mut src = b"q BI ".to_vec();
+    src.extend_from_slice(parameters);
+    src.extend_from_slice(b" ID ");
+    src.extend_from_slice(pixels);
+    src.extend_from_slice(b"\nEI Q");
+    parse(&src)
+}
+
+#[test]
+fn unfiltered_inline_image_lengths_use_components_and_parameter_aliases() {
+    for (parameters, pixels) in [
+        (b"/W 4 /H 1 /CS /G /BPC 8".as_slice(), b" EI ".as_slice()),
+        (b"/W 4 /H 1 /CS /G /BPC 8 /Filter null", b" EI "),
+        (b"/W 4 /H 1 /CS /G /BPC 8 /F []", b" EI "),
+        (b"/W 4 /Width 4 /H 1 /CS /G /BPC 8", b" EI "),
+        (b"/Width 4 /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8", b" EI "),
+        (b"/W 2 /H 1 /CS /RGB /BPC 8", b"\0 EI \xff"),
+        (b"/Width 2 /Height 1 /ColorSpace /DeviceRGB /BitsPerComponent 8", b"\0 EI \xff"),
+        (b"/W 1 /H 1 /CS /CMYK /BPC 8", b" EI "),
+        (b"/Width 1 /Height 1 /ColorSpace /DeviceCMYK /BitsPerComponent 8", b" EI "),
+    ] {
+        let parsed = inline_pixels(parameters, pixels);
+        assert_eq!(parsed.skipped, 0);
+        assert_eq!(parsed.ops.iter().map(|op| op.op.as_slice()).collect::<Vec<_>>(), [b"q".as_slice(), b"BI", b"Q"]);
+        assert_eq!(parsed.ops[1].inline.as_ref().unwrap().1, pixels);
+        assert_eq!(parse(&serialize_ops(&parsed.ops)).ops[1].inline, parsed.ops[1].inline);
+    }
+}
+
+#[test]
+fn unfiltered_inline_image_rows_are_byte_aligned_for_every_sample_depth() {
+    // Two rows of two bytes each. Padding belongs to each row, not only the final row.
+    for (bits, width) in [(1, 9), (2, 5), (4, 3), (8, 2), (16, 1)] {
+        let parameters = format!("/W {width} /H 2 /BPC {bits} /CS /G");
+        let parsed = inline_pixels(parameters.as_bytes(), b" EI ");
+        assert_eq!(parsed.ops[1].inline.as_ref().unwrap().1, b" EI ", "bits={bits}");
+        assert_eq!(parsed.ops.len(), 3);
+    }
+}
+
+#[test]
+fn unfiltered_inline_masks_default_to_one_bit_and_indexed_images_have_one_component() {
+    for parameters in [b"/W 9 /H 2 /IM true".as_slice(), b"/Width 9 /Height 2 /ImageMask true /BitsPerComponent 1"] {
+        let parsed = inline_pixels(parameters, b" EI ");
+        assert_eq!(parsed.ops[1].inline.as_ref().unwrap().1, b" EI ");
+        assert_eq!(parsed.ops.len(), 3);
+    }
+    for name in ["Indexed", "I"] {
+        // A valid 256-entry RGB lookup table; samples are indices regardless of the base space.
+        let parameters = format!("/W 4 /H 1 /BPC 8 /CS [/{name} /DeviceRGB 255 <{}>]", "00".repeat(768));
+        let parsed = inline_pixels(parameters.as_bytes(), b" EI ");
+        assert_eq!(parsed.ops[1].inline.as_ref().unwrap().1, b" EI ");
+        assert_eq!(parsed.ops.len(), 3);
+        // Indexed samples permit at most 8 bits, even though device spaces permit 16.
+        let invalid = parameters.replace("/W 4", "/W 2").replace("/BPC 8", "/BPC 16");
+        let parsed = inline_pixels(invalid.as_bytes(), b" EI ");
+        assert!(parsed.ops[1].inline.as_ref().unwrap().1.is_empty());
+    }
+}
+
+#[test]
+fn unfiltered_inline_image_terminator_must_follow_its_samples() {
+    for separator in [b" ".as_slice(), b"\r\n", b"\0\t\x0c\n"] {
+        let mut src = b"BI /W 4 /H 1 /BPC 8 /CS /G ID  EI ".to_vec();
+        src.extend_from_slice(separator);
+        src.extend_from_slice(b"EI/Q q");
+        let parsed = parse(&src);
+        assert_eq!(parsed.ops[0].inline.as_ref().unwrap().1, b" EI ");
+        assert_eq!(&src[parsed.ops[0].span.clone()], &src[..src.len() - b"/Q q".len()]);
+    }
+    let parsed = parse(b"BI /W 4 /H 1 /BPC 8 /CS /G ID  EI \nEI");
+    assert_eq!(parsed.ops[0].inline.as_ref().unwrap().1, b" EI ");
+    // EI is a keyword: a prefix of a larger token is not a terminator.
+    let parsed = parse(b"BI /W 4 /H 1 /BPC 8 /CS /G ID abcd EIx\nEI Q");
+    assert_eq!(parsed.ops[0].inline.as_ref().unwrap().1, b"abcd EIx");
+}
+
+#[test]
+fn filtered_unknown_and_damaged_inline_images_keep_the_existing_fallback() {
+    for parameters in [
+        b"/W 4 /H 1 /BPC 8 /CS /G /F /A85".as_slice(),
+        b"/W 4 /H 1 /BPC 8 /CS /ResourceColor",
+        b"/W 0 /H 1 /BPC 8 /CS /G",
+        b"/W -1 /H 1 /BPC 8 /CS /G",
+        b"/W 4 /H -1 /BPC 8 /CS /G",
+        b"/W 4 /H 1 /BPC 3 /CS /G",
+        b"/W 4 /H 1 /IM true /BPC 8",
+        b"/W 4 /H 1 /IM true /BPC /Bad",
+        b"/Width 4 /W 1 /H 1 /BPC 8 /CS /G",
+        b"/W 4 /H 1 /BPC 8 /CS /G /ImageMask false /IM true",
+        b"/W 9223372036854775807 /H 9223372036854775807 /BPC 16 /CS /CMYK",
+        b"/W 9223372036854775807 /H 2 /BPC 8 /CS /G",
+    ] {
+        let parsed = inline_pixels(parameters, b"! EI !!~>");
+        assert_eq!(parsed.ops[1].inline.as_ref().unwrap().1, b"!", "{}", String::from_utf8_lossy(parameters));
+    }
+    // A short payload still uses the tolerant recovery, including when there is no EI.
+    for src in [b"BI /W 4 /H 1 /BPC 8 /CS /G ID abc\nEI Q".as_slice(), b"BI /W 4 /H 1 /BPC 8 /CS /G ID abc"] {
+        assert_eq!(parse(src).ops[0].inline.as_ref().unwrap().1, b"abc");
+    }
+}
+
+fn inline_pdf(content: &[u8], object_streams: bool) -> Vec<u8> {
+    use pdfcraft_cos::{Document, SaveOptions, Stream, write_full};
+
+    let mut doc = Document::new_empty();
+    let pages = doc.get(doc.root().unwrap()).as_dict().unwrap().reference(b"Pages").unwrap();
+    let contents = doc.add(Object::Stream(Stream::flate(Dict::new(), content)));
+    let page = doc.add(Object::Dict(
+        [
+            (b"Type".to_vec(), Object::name("Page")),
+            (b"Parent".to_vec(), Object::Ref(pages)),
+            (b"MediaBox".to_vec(), Object::Array([0, 0, 4, 1].map(Object::Int).to_vec())),
+            (b"Resources".to_vec(), Object::Dict(Dict::new())),
+            (b"Contents".to_vec(), Object::Ref(contents)),
+        ]
+        .into_iter()
+        .collect(),
+    ));
+    doc.update_dict(pages, |dict| {
+        dict.set(b"Kids".to_vec(), Object::Array(vec![Object::Ref(page)]));
+        dict.set(b"Count".to_vec(), Object::Int(1));
+    })
+    .unwrap();
+    write_full(&doc, &SaveOptions { object_streams, ..SaveOptions::default() }).unwrap()
+}
+
+#[test]
+fn rewritten_inline_image_pixels_survive_saving_and_reopening_a_pdf() {
+    use pdfcraft_cos::{Document, Object};
+    use std::sync::Arc;
+
+    let original = b"q 4 0 0 1 0 0 cm BI /W 4 /H 1 /BPC 8 /CS /G ID  EI \nEI Q";
+    let rewritten = serialize_ops(&parse(original).ops);
+    for object_streams in [false, true] {
+        let bytes = inline_pdf(&rewritten, object_streams);
+        let doc = Document::open(Arc::new(bytes.clone())).unwrap();
+        assert!(doc.repair_log().is_empty());
+        let pages = doc.get(doc.root().unwrap()).as_dict().unwrap().reference(b"Pages").unwrap();
+        let pages = doc.get(pages);
+        let page = doc.resolve(&pages.as_dict().unwrap().get(b"Kids").unwrap().as_array().unwrap()[0]);
+        let content = doc.resolve(page.as_dict().unwrap().get(b"Contents").unwrap());
+        let Object::Stream(stream) = &*content else { panic!("page content stream") };
+        assert_eq!(parse(&stream.decoded_strict().unwrap()).ops[2].inline.as_ref().unwrap().1, b" EI ");
+        // Opt-in artifacts for independent readers/renderers; synthetic PDFs are never committed.
+        if let Some(dir) = std::env::var_os("PDFCRAFT_INLINE_FIXTURE_DIR") {
+            let dir = std::path::PathBuf::from(dir);
+            std::fs::create_dir_all(&dir).unwrap();
+            std::fs::write(dir.join("original.pdf"), inline_pdf(original, false)).unwrap();
+            std::fs::write(dir.join(if object_streams { "rewritten-packed.pdf" } else { "rewritten-classic.pdf" }), bytes).unwrap();
+        }
+    }
+}
+
 #[test]
 fn damage_is_skipped_not_fatal() {
     let p = parse(b"1 0 0 RG ) ] 10 20 m 30 40 l S (unterminated");
diff --git a/crates/cos/Cargo.toml b/crates/cos/Cargo.toml
index f02f63c52..9ef9126ca 100644
--- a/crates/cos/Cargo.toml
+++ b/crates/cos/Cargo.toml
@@ -14,6 +14,8 @@ pdfcraft-filters = { workspace = true }
 thiserror = { workspace = true }
 
 [dev-dependencies]
+pdfcraft-oracle = { workspace = true }
+pdfcraft-testkit = { workspace = true }
 serde_json = { workspace = true }
 proptest = { workspace = true }
 hayro-syntax = { workspace = true }
diff --git a/crates/cos/README.md b/crates/cos/README.md
index b3ac964d5..ab382219d 100644
--- a/crates/cos/README.md
+++ b/crates/cos/README.md
@@ -53,7 +53,7 @@ another. Edits never touch the original bytes.
   headers. Repairs are *recorded*, never silent, so the UI can say the file was damaged.
 - **Tolerant, never fatal.** The lexer works on a byte slice and a position; it allocates nothing
   for skipped data, bounds-checks every index, and caps nesting depth. Malformed input yields
-  `CosError`, never a panic — this crate is the first thing a hostile file meets.
+  `CosError`, never a panic — this crate is the first thing a hostile file meets. Exhausted xref entries are skipped with a repair log; exhausted /Size hints allocate unused numbers without overflowing or replacing existing objects.
 - **Lazy.** Objects are parsed on first use and cached. (Whole-file buffering is still the case;
   `ByteSource` streaming is `core.lazy-loading`, not yet done.)
 - **Encryption** is handled on load and save through `pdfcraft-crypt`: every standard-security
diff --git a/crates/cos/src/document.rs b/crates/cos/src/document.rs
index 0f05661b2..a0b1f56ee 100644
--- a/crates/cos/src/document.rs
+++ b/crates/cos/src/document.rs
@@ -61,6 +61,245 @@ pub enum XrefEntry {
     InStream { stream: u32, index: u32 },
 }
 
+#[derive(Clone, Copy, Debug)]
+struct XrefRange {
+    start: u32,
+    count: u32,
+    offset: usize,
+    stride: usize,
+}
+
+#[derive(Clone, Debug)]
+enum XrefSectionData {
+    Table,
+    Stream { bytes: Arc<Vec<u8>>, widths: [usize; 3] },
+}
+
+#[derive(Clone, Debug)]
+struct XrefSection {
+    data: XrefSectionData,
+    ranges: Vec<XrefRange>,
+    row_count: usize,
+    max_num: u32,
+    has_entries: bool,
+}
+
+#[derive(Clone, Debug)]
+struct XrefRevisionSection {
+    primary: XrefSection,
+    hybrid: Option<XrefSection>,
+}
+
+#[derive(Clone, Debug)]
+enum XrefIndex {
+    Compact { revisions: Vec<XrefRevisionSection>, max_num: u32, has_entries: bool },
+    Materialized(Arc<BTreeMap<u32, XrefEntry>>),
+}
+
+const MAX_COMPACT_XREF_ROWS: usize = 2_000_000;
+const MAX_COMPACT_XREF_BYTES: usize = 64 * 1024 * 1024;
+
+impl XrefSection {
+    fn has_any_entry(&self) -> bool {
+        match &self.data {
+            XrefSectionData::Table => self.has_entries,
+            XrefSectionData::Stream { bytes, widths } => {
+                let row_width = widths.iter().sum::<usize>();
+                if row_width == 0 {
+                    return false;
+                }
+                for range in &self.ranges {
+                    let available = bytes.len().saturating_sub(range.offset) / row_width;
+                    for i in 0..available.min(range.count as usize) {
+                        let Some(offset) = i.checked_mul(row_width).and_then(|delta| range.offset.checked_add(delta)) else { continue };
+                        let Some(row) = bytes.get(offset..offset.saturating_add(row_width)) else { continue };
+                        let read_field = |from: usize, width: usize, default: u64| -> Option<u64> {
+                            if width == 0 {
+                                return Some(default);
+                            }
+                            let end = from.checked_add(width)?;
+                            Some(row.get(from..end)?.iter().fold(0u64, |acc, byte| acc.wrapping_shl(8) | u64::from(*byte)))
+                        };
+                        let Some(kind) = read_field(0, widths[0], 1) else { continue };
+                        if kind == 0 || kind == 2 {
+                            return true;
+                        }
+                        if kind == 1 && read_field(widths[0], widths[1], 0).is_some_and(|offset| offset != 0) {
+                            return true;
+                        }
+                    }
+                }
+                false
+            }
+        }
+    }
+
+    fn retained_bytes(&self) -> usize {
+        match &self.data {
+            XrefSectionData::Table => 0,
+            XrefSectionData::Stream { bytes, .. } => bytes.capacity(),
+        }
+    }
+
+    fn lookup(&self, num: u32, file: &[u8]) -> Option<XrefEntry> {
+        let after = self.ranges.partition_point(|range| range.start <= num);
+        let range = self.ranges.get(after.checked_sub(1)?)?;
+        let end = u64::from(range.start).checked_add(u64::from(range.count))?;
+        if u64::from(num) >= end {
+            return None;
+        }
+        let row = usize::try_from(num.checked_sub(range.start)?).ok()?;
+        let offset = range.offset.checked_add(row.checked_mul(range.stride)?)?;
+        match &self.data {
+            XrefSectionData::Table => {
+                let mut lexer = Lexer::new(file, offset);
+                lexer.skip_ws();
+                let object_offset = lexer.token();
+                lexer.skip_ws();
+                let generation = lexer.token();
+                lexer.skip_ws();
+                let kind = lexer.token();
+                match kind {
+                    b"n" => {
+                        let object_offset = std::str::from_utf8(object_offset).ok()?.parse::<u64>().ok()?;
+                        if object_offset == 0 {
+                            return None;
+                        }
+                        let generation = std::str::from_utf8(generation).ok()?.parse::<u32>().unwrap_or(0).min(u16::MAX as u32) as u16;
+                        Some(XrefEntry::InFile { offset: object_offset, generation })
+                    }
+                    b"f" => {
+                        let generation = std::str::from_utf8(generation).ok()?.parse::<u32>().unwrap_or(0).min(u16::MAX as u32) as u16;
+                        Some(XrefEntry::Free { next_generation: generation })
+                    }
+                    _ => None,
+                }
+            }
+            XrefSectionData::Stream { bytes, widths } => {
+                let row_width = widths.iter().sum::<usize>();
+                let end = offset.checked_add(row_width)?;
+                let row = bytes.get(offset..end)?;
+                let field = |from: usize, width: usize, default: u64| -> Option<u64> {
+                    if width == 0 {
+                        return Some(default);
+                    }
+                    let end = from.checked_add(width)?;
+                    Some(row.get(from..end)?.iter().fold(0u64, |acc, byte| acc.wrapping_shl(8) | u64::from(*byte)))
+                };
+                let kind = field(0, widths[0], 1)?;
+                let a = field(widths[0], widths[1], 0)?;
+                let b = field(widths[0] + widths[1], widths[2], 0)?;
+                let entry = match kind {
+                    0 => XrefEntry::Free { next_generation: b.min(u16::MAX as u64) as u16 },
+                    1 => XrefEntry::InFile { offset: a, generation: b.min(u16::MAX as u64) as u16 },
+                    2 => XrefEntry::InStream { stream: a.min(u32::MAX as u64) as u32, index: b.min(u32::MAX as u64) as u32 },
+                    _ => return None,
+                };
+                (!matches!(entry, XrefEntry::InFile { offset: 0, .. })).then_some(entry)
+            }
+        }
+    }
+
+    fn extend_numbers(&self, numbers: &mut Vec<u32>) {
+        for range in &self.ranges {
+            let available = match &self.data {
+                XrefSectionData::Table => range.count as usize,
+                XrefSectionData::Stream { bytes, widths } => {
+                    let row_width = widths.iter().sum::<usize>();
+                    bytes.len().saturating_sub(range.offset).checked_div(row_width).unwrap_or(0)
+                }
+            };
+            for i in 0..available.min(range.count as usize) {
+                if let Ok(i) = u32::try_from(i)
+                    && let Some(num) = range.start.checked_add(i)
+                {
+                    numbers.push(num);
+                }
+            }
+        }
+    }
+}
+
+impl XrefRevisionSection {
+    fn lookup(&self, num: u32, file: &[u8]) -> Option<XrefEntry> {
+        let primary = self.primary.lookup(num, file);
+        let hybrid = self.hybrid.as_ref().and_then(|section| section.lookup(num, file));
+        match primary {
+            None | Some(XrefEntry::Free { .. }) => hybrid.or(primary),
+            entry => entry,
+        }
+    }
+
+    fn extend_numbers(&self, numbers: &mut Vec<u32>) {
+        self.primary.extend_numbers(numbers);
+        if let Some(hybrid) = &self.hybrid {
+            hybrid.extend_numbers(numbers);
+        }
+    }
+}
+
+impl XrefIndex {
+    fn empty() -> Self {
+        Self::Materialized(Arc::new(BTreeMap::new()))
+    }
+
+    fn lookup(&self, num: u32, file: &[u8]) -> Option<XrefEntry> {
+        match self {
+            Self::Compact { revisions, .. } => revisions.iter().find_map(|revision| revision.lookup(num, file)),
+            Self::Materialized(entries) => entries.get(&num).copied(),
+        }
+    }
+
+    fn is_empty(&self) -> bool {
+        match self {
+            Self::Compact { has_entries, .. } => !has_entries,
+            Self::Materialized(entries) => entries.is_empty(),
+        }
+    }
+
+    /// Drop an entry for object number 4294967295, which no incremental `/Size` can cover.
+    /// Only a materialized index can hold one: the compact reader requires `max_num < /Size`.
+    fn remove_exhausted(&mut self) -> bool {
+        match self {
+            Self::Compact { .. } => false,
+            Self::Materialized(entries) => Arc::make_mut(entries).remove(&u32::MAX).is_some(),
+        }
+    }
+
+    fn max_num(&self) -> u32 {
+        match self {
+            Self::Compact { max_num, .. } => *max_num,
+            Self::Materialized(entries) => entries.keys().next_back().copied().unwrap_or(0),
+        }
+    }
+
+    fn object_numbers(&self, file: &[u8]) -> Vec<u32> {
+        match self {
+            Self::Materialized(entries) => {
+                entries.iter().filter_map(|(&num, entry)| (!matches!(entry, XrefEntry::Free { .. })).then_some(num)).collect()
+            }
+            Self::Compact { revisions, .. } => {
+                if let [revision] = revisions.as_slice()
+                    && revision.hybrid.is_none()
+                {
+                    let mut numbers = Vec::with_capacity(revision.primary.row_count);
+                    revision.primary.extend_numbers(&mut numbers);
+                    numbers.retain(|num| self.lookup(*num, file).is_some_and(|entry| !matches!(entry, XrefEntry::Free { .. })));
+                    return numbers;
+                }
+                let mut numbers = Vec::new();
+                for revision in revisions {
+                    revision.extend_numbers(&mut numbers);
+                }
+                numbers.sort_unstable();
+                numbers.dedup();
+                numbers.retain(|num| self.lookup(*num, file).is_some_and(|entry| !matches!(entry, XrefEntry::Free { .. })));
+                numbers
+            }
+        }
+    }
+}
+
 /// One cross-reference section of the file (one per save; the first is the original).
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub struct Revision {
@@ -102,7 +341,7 @@ impl Eq for SourceIdentity {}
 pub struct Document {
     data: Arc<Vec<u8>>,
     source_identity: Arc<()>,
-    entries: Arc<BTreeMap<u32, XrefEntry>>,
+    entries: Arc<XrefIndex>,
     trailer: Dict,
     revisions: Arc<Vec<Revision>>,
     /// See [`Self::xref_oddities`].
@@ -207,10 +446,17 @@ fn owned_bytes(object: &Object, data: &Arc<Vec<u8>>, depth: usize) -> usize {
 
 impl std::fmt::Debug for Document {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("Document").field("bytes", &self.data.len()).field("objects", &self.entries.len()).field("edits", &self.overlay.len()).finish()
+        f.debug_struct("Document").field("bytes", &self.data.len()).field("xref", &self.entries).field("edits", &self.overlay.len()).finish()
     }
 }
 
+/// How an encrypted document is opened: with a password, or with the file key of a document
+/// that has the same encryption (an earlier revision of the same file).
+enum Credentials<'a> {
+    Password(Option<&'a str>),
+    Handler { handler: &'a Arc<pdfcraft_crypt::SecurityHandler>, id0: Vec<u8> },
+}
+
 impl Document {
     /// A new document with an empty page tree (for split / extract / combine). It has no
     /// original bytes, so saving always writes a full file.
@@ -218,7 +464,7 @@ impl Document {
         let mut doc = Document {
             data: Arc::new(Vec::new()),
             source_identity: Arc::new(()),
-            entries: Arc::new(BTreeMap::new()),
+            entries: Arc::new(XrefIndex::empty()),
             trailer: Dict::new(),
             revisions: Arc::new(Vec::new()),
             xref_oddities: Arc::default(),
@@ -267,6 +513,23 @@ impl Document {
     /// document is read-only: objects in a larger object stream read as missing, so the
     /// writers refuse to save it ([`CosError::ReadOnlyLimit`]).
     pub fn open_with_stream_limit(data: Arc<Vec<u8>>, password: Option<&str>, stream_limit: usize) -> Result<Self, CosError> {
+        Self::open_as(data, Credentials::Password(password), stream_limit)
+    }
+
+    /// Open `data`, an earlier revision of this file (the bytes a signature covers) or another
+    /// save of it, with this document's credentials: an encrypted one must have the same
+    /// `/Encrypt` dictionary and `/ID` as this document, whose file key is then reused, so no
+    /// password is needed or kept; unencrypted data opens as [`open`](Self::open) does. Data
+    /// encrypted differently fails with `NeedsPassword`.
+    pub fn open_with_same_credentials(&self, data: Arc<Vec<u8>>) -> Result<Self, CosError> {
+        let credentials = match &self.security {
+            Some(handler) => Credentials::Handler { handler, id0: self.first_id() },
+            None => Credentials::Password(None),
+        };
+        Self::open_as(data, credentials, self.stream_limit)
+    }
+
+    fn open_as(data: Arc<Vec<u8>>, credentials: Credentials<'_>, stream_limit: usize) -> Result<Self, CosError> {
         // Viewers accept files whose header is missing or damaged as long as the body looks
         // like PDF; so do we (a note goes to the repair log).
         let header = find(&data, b"%PDF-", 0, 1024);
@@ -282,7 +545,7 @@ impl Document {
         let mut doc = Document {
             data,
             source_identity: Arc::new(()),
-            entries: Arc::new(BTreeMap::new()),
+            entries: Arc::new(XrefIndex::empty()),
             trailer: Dict::new(),
             revisions: Arc::new(Vec::new()),
             xref_oddities: Arc::default(),
@@ -316,7 +579,7 @@ impl Document {
                 // Authenticate before checking the catalog: it may sit in an encrypted object
                 // stream, which reads as garbage until the key is known.
                 if let Some(enc) = doc.trailer.get(b"Encrypt").cloned() {
-                    doc.authenticate(&enc, password)?;
+                    doc.authenticate(&enc, &credentials)?;
                     authenticated = true;
                 }
                 doc.root_is_catalog()
@@ -337,15 +600,21 @@ impl Document {
         if (!ok || !authenticated)
             && let Some(enc) = doc.trailer.get(b"Encrypt").cloned()
         {
-            doc.authenticate(&enc, password)?;
+            doc.authenticate(&enc, &credentials)?;
         }
-        let max = doc.entries.keys().next_back().copied().unwrap_or(0);
-        let size = doc.trailer.int(b"Size").unwrap_or(0).max(0) as u32;
-        doc.next_num = max.max(size.saturating_sub(1)) + 1;
+        if Arc::make_mut(&mut doc.entries).remove_exhausted() {
+            Arc::make_mut(&mut doc.repair_log).push("skipped exhausted xref object number 4294967295".into());
+        }
+        let max = doc.entries.max_num();
+        let size = u32::try_from(doc.trailer.int(b"Size").unwrap_or(0).max(0)).unwrap_or(u32::MAX);
+        if size == u32::MAX {
+            Arc::make_mut(&mut doc.repair_log).push("exhausted trailer /Size; new objects use unused object numbers".into());
+        }
+        doc.next_num = max.saturating_add(1).max(size).max(1);
         Ok(doc)
     }
 
-    fn authenticate(&mut self, enc: &Object, password: Option<&str>) -> Result<(), CosError> {
+    fn authenticate(&mut self, enc: &Object, credentials: &Credentials<'_>) -> Result<(), CosError> {
         // Authentication can change how the same input is decoded.
         self.source_identity = Arc::new(());
         let (num, dict) = match enc {
@@ -363,12 +632,17 @@ impl Document {
         };
         let params = crate::security::encrypt_dict(self, &dict);
         let id0 = self.first_id();
-        let handler = pdfcraft_crypt::SecurityHandler::open(params, &id0, password).map_err(|e| match e {
-            pdfcraft_crypt::CryptError::WrongPassword if password.is_none() => CosError::NeedsPassword,
-            pdfcraft_crypt::CryptError::WrongPassword => CosError::WrongPassword,
-            other => CosError::Security(other.to_string()),
-        })?;
-        self.security = Some(Arc::new(handler));
+        let handler = match credentials {
+            Credentials::Password(password) => Arc::new(pdfcraft_crypt::SecurityHandler::open(params, &id0, *password).map_err(|e| match e {
+                pdfcraft_crypt::CryptError::WrongPassword if password.is_none() => CosError::NeedsPassword,
+                pdfcraft_crypt::CryptError::WrongPassword => CosError::WrongPassword,
+                other => CosError::Security(other.to_string()),
+            })?),
+            // The same encryption as the document whose key this is: that key opens it.
+            Credentials::Handler { handler, id0: known } if *handler.dict() == params && *known == id0 => Arc::clone(handler),
+            Credentials::Handler { .. } => return Err(CosError::NeedsPassword),
+        };
+        self.security = Some(handler);
         self.encrypt_num = num;
         // Objects read while locating the catalog were read before decryption was possible.
         self.cache = Arc::default();
@@ -589,7 +863,7 @@ impl Document {
 
     /// Where object `num` is stored in the file (ignoring unsaved edits).
     pub fn xref_entry(&self, num: u32) -> Option<XrefEntry> {
-        self.entries.get(&num).cloned()
+        self.entries.lookup(num, &self.data)
     }
 
     /// Cross-reference entries this reader did not take at face value, as (byte offset of the
@@ -609,15 +883,15 @@ impl Document {
     /// position of its object stream. When it does not, [`Self::get`] still finds the object by
     /// searching, but another reader may resolve the number differently. Ignores unsaved edits.
     pub fn xref_entry_is_exact(&self, num: u32) -> bool {
-        match self.entries.get(&num) {
+        match self.xref_entry(num) {
             None | Some(XrefEntry::Free { .. }) => true,
             Some(XrefEntry::InFile { offset, .. }) => {
                 let at = |off: usize| matches!(parse_indirect_shared(&self.data, off, &|_| None), Ok((id, _)) if id.num == num);
                 // Offsets may count from a header that does not start the file.
-                usize::try_from(*offset).is_ok_and(|off| at(off) || (self.header_offset != 0 && at(off.saturating_add(self.header_offset))))
+                usize::try_from(offset).is_ok_and(|off| at(off) || (self.header_offset != 0 && at(off.saturating_add(self.header_offset))))
             }
             Some(XrefEntry::InStream { stream, index }) => {
-                self.objstm(*stream).is_ok_and(|stm| usize::try_from(*index).ok().and_then(|i| stm.index.get(i)).is_some_and(|(n, _)| *n == num))
+                self.objstm(stream).is_ok_and(|stm| usize::try_from(index).ok().and_then(|i| stm.index.get(i)).is_some_and(|(n, _)| *n == num))
             }
         }
     }
@@ -798,7 +1072,7 @@ impl Document {
         if depth > 16 {
             return Err(CosError::Syntax { offset: 0, detail: "reference cycle while loading".into() });
         }
-        match self.entries.get(&num) {
+        match self.entries.lookup(num, &self.data) {
             None | Some(XrefEntry::Free { .. }) => Ok(Object::Null),
             Some(XrefEntry::InFile { offset, .. }) => {
                 let resolve = |r: ObjRef| {
@@ -809,7 +1083,7 @@ impl Document {
                     LENGTHS.with(|m| m.borrow_mut().insert(r.num, length));
                     length
                 };
-                let off = *offset as usize;
+                let off = offset as usize;
                 let at = |off: usize| match parse_indirect_shared(&self.data, off, &resolve) {
                     Ok((id, o)) if id.num == num => Some(self.decrypted(id, o)),
                     _ => None,
@@ -821,10 +1095,10 @@ impl Document {
                     .ok_or(CosError::MissingObject(num))
             }
             Some(XrefEntry::InStream { stream, index }) => {
-                let stm = self.objstm(*stream)?;
+                let stm = self.objstm(stream)?;
                 let (n, off) = stm
                     .index
-                    .get(*index as usize)
+                    .get(index as usize)
                     .copied()
                     .or_else(|| stm.index.iter().find(|(n, _)| *n == num).copied())
                     .ok_or(CosError::MissingObject(num))?;
@@ -896,24 +1170,77 @@ impl Document {
         let obj = self.adopt(obj.into());
         self.overlay.insert(r.num, Slot::Set(r.generation, Arc::new(obj)));
         if r.num >= self.next_num {
-            self.next_num = r.num + 1;
+            self.next_num = r.num.saturating_add(1);
         }
     }
 
     /// Add a new indirect object and return its reference.
     pub fn add(&mut self, obj: impl Into<Object>) -> ObjRef {
-        let r = ObjRef::new(self.next_num, 0);
-        self.next_num += 1;
+        let r = ObjRef::new(self.allocate_num(), 0);
         let obj = self.adopt(obj.into());
         self.overlay.insert(r.num, Slot::Set(0, Arc::new(obj)));
         r
     }
 
+    /// Find a never-used number, retaining the high-water mark for incremental /Size.
+    /// Exhausted hints fall back to gaps without replacing source or overlay objects.
+    fn allocate_num(&mut self) -> u32 {
+        let mut num = if self.next_num == u32::MAX { 1 } else { self.next_num.max(1) };
+        while self.entries.lookup(num, &self.data).is_some() || self.overlay.contains_key(&num) {
+            num = if num == u32::MAX - 1 { 1 } else { num + 1 };
+        }
+        self.next_num = self.next_num.max(num.saturating_add(1));
+        num
+    }
+
     /// Delete an object (its number becomes free with the next generation).
     pub fn free(&mut self, r: ObjRef) {
         self.overlay.insert(r.num, Slot::Freed(r.generation.saturating_add(1)));
     }
 
+    /// Record `current`'s object graph as unsaved edits of this document.
+    ///
+    /// Used when the working snapshot was restored from an earlier revision and the next
+    /// incremental save must still append to this file (the last saved revision). Objects
+    /// that already match are left untouched. Reads go through private readers so neither
+    /// document's editing cache is filled.
+    pub fn overlay_changes_from(&mut self, current: &Document) -> Result<(), CosError> {
+        let saved_nums = self.object_numbers();
+        let current_nums = current.object_numbers();
+        let mut freed = Vec::new();
+        let mut changed = Vec::new();
+        {
+            let mut saved_reader = self.object_reader();
+            let mut current_reader = current.object_reader();
+            for &num in &saved_nums {
+                if current_nums.binary_search(&num).is_err() {
+                    freed.push(num);
+                }
+            }
+            for &num in &current_nums {
+                let generation = current.generation(num);
+                let same = saved_nums.binary_search(&num).is_ok()
+                    && self.generation(num) == generation
+                    && saved_reader.try_get(ObjRef::new(num, 0))? == current_reader.try_get(ObjRef::new(num, 0))?;
+                if !same {
+                    changed.push(num);
+                }
+            }
+        }
+        for num in freed {
+            let generation = self.generation(num);
+            self.free(ObjRef::new(num, generation));
+        }
+        let mut current_reader = current.object_reader();
+        for num in changed {
+            let generation = current.generation(num);
+            let object = current_reader.try_get(ObjRef::new(num, 0))?;
+            self.set(ObjRef::new(num, generation), (*object).clone());
+        }
+        *self.trailer_mut() = current.trailer().clone();
+        Ok(())
+    }
+
     /// Edit a dictionary (or stream dictionary) object in place.
     pub fn update_dict(&mut self, r: ObjRef, f: impl FnOnce(&mut Dict)) -> Result<(), CosError> {
         let mut obj = (*self.get(r)).clone();
@@ -928,9 +1255,9 @@ impl Document {
         match self.overlay.get(&num) {
             Some(Slot::Set(g, _)) => *g,
             Some(Slot::Freed(g)) => *g,
-            None => match self.entries.get(&num) {
-                Some(XrefEntry::InFile { generation, .. }) => *generation,
-                Some(XrefEntry::Free { next_generation }) => *next_generation,
+            None => match self.entries.lookup(num, &self.data) {
+                Some(XrefEntry::InFile { generation, .. }) => generation,
+                Some(XrefEntry::Free { next_generation }) => next_generation,
                 _ => 0,
             },
         }
@@ -949,26 +1276,23 @@ impl Document {
 
     /// All object numbers known (file and overlay), excluding freed ones.
     pub fn object_numbers(&self) -> Vec<u32> {
-        // Both maps are ordered. Overlay slots replace source slots, including frees;
-        // merge them directly without a second set and a sort of every object number.
-        let mut numbers = Vec::with_capacity(self.entries.len().max(self.overlay.len()));
-        let mut source = self.entries.iter().peekable();
+        let source_numbers = self.entries.object_numbers(&self.data);
+        let mut numbers = Vec::with_capacity(source_numbers.len().max(self.overlay.len()));
+        let mut source = source_numbers.into_iter().peekable();
         for (&num, slot) in &self.overlay {
-            while source.peek().is_some_and(|(n, _)| **n < num) {
-                if let Some((&n, entry)) = source.next()
-                    && !matches!(entry, XrefEntry::Free { .. })
-                {
+            while source.peek().is_some_and(|n| *n < num) {
+                if let Some(n) = source.next() {
                     numbers.push(n);
                 }
             }
-            if source.peek().is_some_and(|(n, _)| **n == num) {
+            if source.peek().is_some_and(|n| *n == num) {
                 source.next();
             }
             if matches!(slot, Slot::Set(..)) {
                 numbers.push(num);
             }
         }
-        numbers.extend(source.filter_map(|(&num, entry)| (!matches!(entry, XrefEntry::Free { .. })).then_some(num)));
+        numbers.extend(source);
         numbers
     }
 
@@ -986,7 +1310,309 @@ impl Document {
     }
 
     #[allow(clippy::type_complexity)]
-    fn read_xref_chain(&self, log: &mut Vec<String>) -> Result<(BTreeMap<u32, XrefEntry>, Dict, Vec<Revision>, Vec<(u64, u32)>), CosError> {
+    fn read_xref_chain(&self, log: &mut Vec<String>) -> Result<(XrefIndex, Dict, Vec<Revision>, Vec<(u64, u32)>), CosError> {
+        let mut compact_log = Vec::new();
+        if let Ok(Some((index, trailer, revisions))) = self.read_compact_xref_chain(&mut compact_log) {
+            let size = trailer.int(b"Size").unwrap_or(0).max(0);
+            if size > 0 && size <= i64::from(u32::MAX) && u64::from(index.max_num()) < size as u64 {
+                log.extend(compact_log);
+                // The compact reader declines any section with set-aside entries, so there are none here.
+                return Ok((index, trailer, revisions, Vec::new()));
+            }
+        }
+        let (entries, trailer, revisions, oddities) = self.read_xref_chain_materialized(log)?;
+        Ok((XrefIndex::Materialized(Arc::new(entries)), trailer, revisions, oddities))
+    }
+
+    fn read_compact_xref_chain(&self, log: &mut Vec<String>) -> Result<Option<(XrefIndex, Dict, Vec<Revision>)>, CosError> {
+        let data = &self.data;
+        let tail_start = data.len().saturating_sub(4096);
+        let sx = rfind(data, b"startxref", tail_start).ok_or(CosError::Syntax { offset: data.len(), detail: "no startxref".into() })?;
+        let mut lx = Lexer::new(data, sx + 9);
+        let first = match lx.object() {
+            Ok(Object::Int(n)) if n >= 0 => n as u64,
+            _ => return Err(CosError::Syntax { offset: sx, detail: "bad startxref value".into() }),
+        };
+        let mut sections = Vec::new();
+        let mut retained_rows = 0usize;
+        let mut retained_bytes = 0usize;
+        let mut trailer: Option<Dict> = None;
+        let mut revisions = Vec::new();
+        let mut visited = HashSet::new();
+        let mut next = Some(first);
+        while let Some(off) = next.take() {
+            if !visited.insert(off) || visited.len() > 10_000 {
+                log.push(format!("cross-reference chain loops at offset {off}; stopped"));
+                break;
+            }
+            let (primary, sect_trailer, is_stream) = match self.read_compact_section(off as usize) {
+                Ok(Some(v)) => v,
+                Ok(None) => return Ok(None),
+                Err(e) if self.header_offset > 0 => {
+                    log.push(format!("xref at {off} unreadable ({e}); retrying relative to the header"));
+                    match self.read_compact_section(off as usize + self.header_offset)? {
+                        Some(v) => v,
+                        None => return Ok(None),
+                    }
+                }
+                // An unreadable older section loses every object only it locates: the
+                // materialized reader logs it and the file is rebuilt from object headers (#1656).
+                Err(e) => return Err(e),
+            };
+            revisions.push(Revision { xref_offset: off, is_stream });
+            let Some(rows) = retained_rows.checked_add(primary.row_count).filter(|rows| *rows <= MAX_COMPACT_XREF_ROWS) else { return Ok(None) };
+            let Some(bytes) = retained_bytes.checked_add(primary.retained_bytes()).filter(|bytes| *bytes <= MAX_COMPACT_XREF_BYTES) else {
+                return Ok(None);
+            };
+            retained_rows = rows;
+            retained_bytes = bytes;
+            let hybrid = if let Some(x) = sect_trailer.int(b"XRefStm").filter(|x| *x >= 0) {
+                match self.read_compact_section(x as usize) {
+                    Ok(Some((section, _, _))) => {
+                        let Some(rows) = retained_rows.checked_add(section.row_count).filter(|rows| *rows <= MAX_COMPACT_XREF_ROWS) else {
+                            return Ok(None);
+                        };
+                        let Some(bytes) = retained_bytes.checked_add(section.retained_bytes()).filter(|bytes| *bytes <= MAX_COMPACT_XREF_BYTES)
+                        else {
+                            return Ok(None);
+                        };
+                        retained_rows = rows;
+                        retained_bytes = bytes;
+                        Some(section)
+                    }
+                    Ok(None) => return Ok(None),
+                    Err(e) => {
+                        log.push(format!("hybrid /XRefStm at {x} unreadable: {e}"));
+                        None
+                    }
+                }
+            } else {
+                None
+            };
+            if let Some(hybrid) = &hybrid {
+                // A hybrid entry that disagrees with the table is set aside by the materialized reader.
+                let mut numbers = Vec::new();
+                hybrid.extend_numbers(&mut numbers);
+                for num in numbers {
+                    let Some(entry) = hybrid.lookup(num, &self.data) else { continue };
+                    if primary.lookup(num, &self.data).is_some_and(|old| !matches!(old, XrefEntry::Free { .. }) && old != entry) {
+                        return Ok(None);
+                    }
+                }
+            }
+            sections.push(XrefRevisionSection { primary, hybrid });
+            next = sect_trailer.int(b"Prev").filter(|p| *p >= 0).map(|p| p as u64);
+            if trailer.is_none() {
+                trailer = Some(sect_trailer);
+            }
+        }
+        revisions.reverse();
+        let mut trailer = trailer.ok_or(CosError::Syntax { offset: 0, detail: "no trailer".into() })?;
+        for k in [&b"Prev"[..], b"XRefStm", b"Type", b"W", b"Index", b"Filter", b"DecodeParms", b"Length"] {
+            trailer.remove(k);
+        }
+        let mut max_num = 0;
+        let mut has_entries = false;
+        for revision in &sections {
+            max_num = max_num.max(revision.primary.max_num);
+            has_entries |= revision.primary.has_entries;
+            if let Some(hybrid) = &revision.hybrid {
+                max_num = max_num.max(hybrid.max_num);
+                has_entries |= hybrid.has_entries;
+            }
+        }
+        Ok(Some((XrefIndex::Compact { revisions: sections, max_num, has_entries }, trailer, revisions)))
+    }
+
+    fn read_compact_section(&self, off: usize) -> Result<Option<(XrefSection, Dict, bool)>, CosError> {
+        let data = &self.data;
+        let mut lx = Lexer::new(data, off);
+        if lx.eat_keyword(b"xref") {
+            let mut ranges = Vec::new();
+            let mut layout_ok = true;
+            let mut max_num = 0;
+            let mut has_entries = false;
+            let mut previous_end = None;
+            let mut row_count = 0usize;
+            loop {
+                lx.skip_ws();
+                if lx.eat_keyword(b"trailer") {
+                    let t = lx.object()?;
+                    let d = t.as_dict().cloned().ok_or(CosError::Syntax { offset: lx.pos, detail: "trailer is not a dictionary".into() })?;
+                    if !layout_ok {
+                        return Ok(None);
+                    }
+                    return Ok(Some((XrefSection { data: XrefSectionData::Table, ranges, row_count, max_num, has_entries }, d, false)));
+                }
+                let (Ok(Object::Int(start)), Ok(Object::Int(count))) = (lx.object(), lx.object()) else {
+                    return Err(CosError::Syntax { offset: lx.pos, detail: "bad xref subsection header".into() });
+                };
+                if !valid_xref_range(start, count) || count > 10_000_000 {
+                    return Err(CosError::Syntax { offset: lx.pos, detail: "invalid xref object range".into() });
+                }
+                let Some(next_rows) = usize::try_from(count).ok().and_then(|count| row_count.checked_add(count)) else { return Ok(None) };
+                if next_rows > MAX_COMPACT_XREF_ROWS {
+                    return Ok(None);
+                }
+                row_count = next_rows;
+                let mut range_offset = None;
+                let mut stride = None;
+                let mut previous_record = None;
+                for i in 0..count {
+                    lx.skip_ws();
+                    let record = lx.pos;
+                    if range_offset.is_none() {
+                        range_offset = Some(record);
+                    }
+                    if let Some(previous) = previous_record {
+                        let Some(delta) = record.checked_sub(previous) else {
+                            layout_ok = false;
+                            continue;
+                        };
+                        if stride.is_some_and(|known| known != delta) {
+                            layout_ok = false;
+                        }
+                        stride.get_or_insert(delta);
+                    }
+                    previous_record = Some(record);
+                    let o = lx.token();
+                    lx.skip_ws();
+                    let _generation = lx.token();
+                    lx.skip_ws();
+                    let kind = lx.token();
+                    let num = (start + i) as u32;
+                    let offset = std::str::from_utf8(o).ok().and_then(|s| s.parse::<u64>().ok());
+                    match (kind, offset) {
+                        (b"n", Some(offset)) if offset != 0 => {
+                            has_entries = true;
+                            max_num = max_num.max(num);
+                        }
+                        (b"n", Some(_)) => {
+                            // Set aside by the materialized reader, which records it.
+                            if num != 0 {
+                                return Ok(None);
+                            }
+                        }
+                        (b"f", _) => {
+                            has_entries = true;
+                            max_num = max_num.max(num);
+                        }
+                        _ => return Err(CosError::Syntax { offset: lx.pos, detail: "bad xref entry".into() }),
+                    }
+                }
+                if count > 0 {
+                    let range_start = start as u32;
+                    let range_count = count as u32;
+                    let end = u64::from(range_start) + u64::from(range_count);
+                    if previous_end.is_some_and(|previous| u64::from(range_start) < previous) {
+                        layout_ok = false;
+                    }
+                    previous_end = Some(end);
+                    ranges.push(XrefRange {
+                        start: range_start,
+                        count: range_count,
+                        offset: range_offset.unwrap_or(lx.pos),
+                        stride: stride.unwrap_or(1),
+                    });
+                }
+            }
+        }
+        let (_, obj) = parse_indirect(data, off, &|_| None)?;
+        let Object::Stream(stream) = obj else { return Err(CosError::Syntax { offset: off, detail: "expected xref table or stream".into() }) };
+        if stream.dict.name(b"Type") != Some(b"XRef") {
+            return Err(CosError::Syntax { offset: off, detail: "stream at startxref is not /Type /XRef".into() });
+        }
+        let w: Vec<usize> = stream
+            .dict
+            .get(b"W")
+            .and_then(Object::as_array)
+            .map(|a| a.iter().map(|x| x.as_int().unwrap_or(0).clamp(0, 8) as usize).collect())
+            .unwrap_or_default();
+        if w.len() < 3 {
+            return Err(CosError::Syntax { offset: off, detail: "xref stream /W invalid".into() });
+        }
+        let widths = [w[0], w[1], w[2]];
+        let row = widths.iter().sum::<usize>();
+        if row == 0 {
+            return Err(CosError::Syntax { offset: off, detail: "xref stream row width 0".into() });
+        }
+        let size = stream.dict.int(b"Size").unwrap_or(0).max(0);
+        let index: Vec<i64> = match stream.dict.get(b"Index").and_then(Object::as_array) {
+            Some(a) => a.iter().filter_map(Object::as_int).collect(),
+            None => vec![0, size],
+        };
+        let mut requested_rows = 0usize;
+        let mut previous_end = None;
+        for pair in index.chunks(2) {
+            let [start, count] = pair else { break };
+            if !valid_xref_range(*start, *count) {
+                return Err(CosError::Syntax { offset: off, detail: "invalid xref object range".into() });
+            }
+            let Ok(count) = usize::try_from(*count) else { return Ok(None) };
+            let Some(next) = requested_rows.checked_add(count).filter(|rows| *rows <= MAX_COMPACT_XREF_ROWS) else { return Ok(None) };
+            if count > 0 {
+                let end = (*start as u64).saturating_add(count as u64);
+                if previous_end.is_some_and(|previous| (*start as u64) < previous) {
+                    return Ok(None);
+                }
+                previous_end = Some(end);
+            }
+            requested_rows = next;
+        }
+        if requested_rows.checked_mul(row).is_none_or(|bytes| bytes > MAX_COMPACT_XREF_BYTES) {
+            return Ok(None);
+        }
+        let raw = stream.decoded_within(MAX_XREF_OBJECTS.saturating_mul(row).min(self.stream_limit).min(MAX_COMPACT_XREF_BYTES))?;
+        if raw.capacity() > MAX_COMPACT_XREF_BYTES {
+            return Ok(None);
+        }
+        let mut ranges = Vec::new();
+        let mut row_start = 0usize;
+        let available_rows = raw.len() / row;
+        for pair in index.chunks(2) {
+            let [start, count] = pair else { break };
+            let range_start = *start as u32;
+            let Ok(requested) = usize::try_from(*count) else { return Ok(None) };
+            let range_count = requested.min(available_rows.saturating_sub(row_start));
+            if range_count > 0 {
+                let Ok(range_count_u32) = u32::try_from(range_count) else { return Ok(None) };
+                let Some(byte_offset) = row_start.checked_mul(row) else { return Ok(None) };
+                ranges.push(XrefRange { start: range_start, count: range_count_u32, offset: byte_offset, stride: row });
+            }
+            let Some(next) = row_start.checked_add(range_count) else { return Ok(None) };
+            row_start = next;
+        }
+        // Rows the materialized reader sets aside (reserved types, offset 0) are left to it.
+        for range in &ranges {
+            for i in 0..range.count as usize {
+                let at = range.offset + i * row;
+                let Some(r) = raw.get(at..at + row) else { break };
+                let field = |from: usize, width: usize, default: u64| -> u64 {
+                    if width == 0 {
+                        return default;
+                    }
+                    r[from..from + width].iter().fold(0u64, |acc, byte| acc << 8 | u64::from(*byte))
+                };
+                let kind = field(0, widths[0], 1);
+                let offset = field(widths[0], widths[1], 0);
+                if kind > 2 || (kind == 1 && offset == 0 && range.start + i as u32 != 0) {
+                    return Ok(None);
+                }
+            }
+        }
+        let max_num = ranges.iter().filter_map(|range| range.start.checked_add(range.count.saturating_sub(1))).max().unwrap_or(0);
+        let row_count = row_start;
+        let section = XrefSection { data: XrefSectionData::Stream { bytes: Arc::new(raw), widths }, ranges, row_count, max_num, has_entries: false };
+        let has_entries = section.has_any_entry();
+        let section = XrefSection { has_entries, ..section };
+        Ok(Some((section, stream.dict.clone(), true)))
+    }
+
+    #[allow(clippy::type_complexity)]
+    fn read_xref_chain_materialized(
+        &self,
+        log: &mut Vec<String>,
+    ) -> Result<(BTreeMap<u32, XrefEntry>, Dict, Vec<Revision>, Vec<(u64, u32)>), CosError> {
         let data = &self.data;
         let tail_start = data.len().saturating_sub(4096);
         let sx = rfind(data, b"startxref", tail_start).ok_or(CosError::Syntax { offset: data.len(), detail: "no startxref".into() })?;
@@ -1019,11 +1645,12 @@ impl Document {
                     self.read_section(off as usize + self.header_offset, &mut sect, &mut odd)?
                 }
                 Err(e) => {
-                    if revisions.is_empty() {
-                        return Err(e);
+                    // An unreadable older section loses every object only it locates (the page
+                    // tree, often): rebuild from object headers, as readers do (#1656).
+                    if !revisions.is_empty() {
+                        log.push(format!("older cross-reference section at {off} is unreadable: {e}"));
                     }
-                    log.push(format!("older cross-reference section at {off} is unreadable: {e}"));
-                    break;
+                    return Err(e);
                 }
             };
             revisions.push(Revision { xref_offset: off, is_stream });
@@ -1212,7 +1839,7 @@ impl Document {
         if entries.is_empty() {
             return Err(CosError::Syntax { offset: 0, detail: "no objects found".into() });
         }
-        self.entries = Arc::new(entries.clone());
+        self.entries = Arc::new(XrefIndex::Materialized(Arc::new(entries.clone())));
         self.cache.lock().map_err(|_| CosError::Poisoned)?.clear();
         // Objects inside object streams.
         for num in objstms {
@@ -1226,7 +1853,8 @@ impl Document {
                 }
             }
         }
-        self.entries = Arc::new(entries);
+        let object_count = entries.len();
+        self.entries = Arc::new(XrefIndex::Materialized(Arc::new(entries)));
         self.cache.lock().map_err(|_| CosError::Poisoned)?.clear();
         // Trailer: the last `trailer` dictionary with a usable /Root, else the catalog itself.
         let mut trailer = None;
@@ -1245,8 +1873,8 @@ impl Document {
             None => {
                 let catalog = self
                     .entries
-                    .keys()
-                    .copied()
+                    .object_numbers(&self.data)
+                    .into_iter()
                     .find(|n| matches!(self.try_get(*n).as_deref(), Ok(Object::Dict(d)) if d.name(b"Type") == Some(b"Catalog")));
                 let Some(c) = catalog else { return Err(CosError::Syntax { offset: 0, detail: "no document catalog found".into() }) };
                 let mut t = Dict::new();
@@ -1260,7 +1888,7 @@ impl Document {
         }
         self.trailer = trailer;
         self.revisions = Arc::new(Vec::new());
-        log.push(format!("rebuilt cross-reference index from {} object headers", self.entries.len()));
+        log.push(format!("rebuilt cross-reference index from {object_count} object headers"));
         Ok(())
     }
 }
@@ -1324,6 +1952,101 @@ mod tests {
         out
     }
 
+    fn assert_compact_matches_materialized(doc: &Document) {
+        assert!(matches!(doc.entries.as_ref(), XrefIndex::Compact { .. }), "valid xrefs should not retain a per-entry map");
+        let (entries, _, revisions, _) = doc.read_xref_chain_materialized(&mut Vec::new()).unwrap();
+        assert_eq!(revisions.as_slice(), doc.revisions());
+        let max = entries.keys().next_back().copied().unwrap_or(0);
+        assert_eq!(doc.entries.max_num(), max);
+        for num in 0..=max {
+            assert_eq!(doc.xref_entry(num), entries.get(&num).copied(), "object {num}");
+        }
+        let expected: Vec<_> = entries.iter().filter_map(|(&num, entry)| (!matches!(entry, XrefEntry::Free { .. })).then_some(num)).collect();
+        assert_eq!(doc.object_numbers(), expected);
+    }
+
+    #[test]
+    fn compact_xref_tables_streams_and_revisions_match_the_materialized_reader() {
+        let classic = Document::open(Arc::new(build(
+            &["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [] /Count 0 >>", "<< /Value 9 >>"],
+            "/Root 1 0 R",
+        )))
+        .unwrap();
+        assert_compact_matches_materialized(&classic);
+
+        let mut sparse = b"%PDF-1.7\n".to_vec();
+        let root_offset = sparse.len();
+        sparse.extend_from_slice(b"1 0 obj\n<< /Type /Catalog /Pages 5 0 R >>\nendobj\n");
+        let pages_offset = sparse.len();
+        sparse.extend_from_slice(b"5 0 obj\n<< /Type /Pages /Kids [] /Count 0 >>\nendobj\n");
+        let xref = sparse.len();
+        sparse.extend_from_slice(
+            format!(
+                "xref\n0 1\n0000000000 65535 f \n1 1\n{root_offset:010} 00000 n \n5 1\n{pages_offset:010} 00000 n \ntrailer\n<< /Size 6 /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n"
+            )
+            .as_bytes(),
+        );
+        let sparse = Document::open(Arc::new(sparse)).unwrap();
+        assert_eq!(sparse.object_numbers(), vec![1, 5]);
+        assert_compact_matches_materialized(&sparse);
+
+        let mut sparse_stream = b"%PDF-1.7\n".to_vec();
+        let mut offsets = [0u32; 8];
+        offsets[1] = sparse_stream.len() as u32;
+        sparse_stream.extend_from_slice(b"1 0 obj\n<< /Type /Catalog /Pages 5 0 R >>\nendobj\n");
+        offsets[5] = sparse_stream.len() as u32;
+        sparse_stream.extend_from_slice(b"5 0 obj\n<< /Type /Pages /Kids [] /Count 0 >>\nendobj\n");
+        offsets[6] = sparse_stream.len() as u32;
+        sparse_stream.extend_from_slice(b"6 0 obj\n<< /Unused true >>\nendobj\n");
+        offsets[7] = sparse_stream.len() as u32;
+        let xref_row = |kind: u8, offset: u32, generation: u16| {
+            let mut row = Vec::with_capacity(7);
+            row.push(kind);
+            row.extend_from_slice(&offset.to_be_bytes());
+            row.extend_from_slice(&generation.to_be_bytes());
+            row
+        };
+        let mut rows = Vec::new();
+        rows.extend(xref_row(0, 0, u16::MAX));
+        rows.extend(xref_row(1, offsets[1], 0));
+        rows.extend(xref_row(1, offsets[5], 0));
+        rows.extend(xref_row(1, offsets[6], 0));
+        rows.extend(xref_row(1, offsets[7], 0));
+        sparse_stream.extend_from_slice(
+            format!("7 0 obj\n<< /Type /XRef /Size 8 /Root 1 0 R /W [1 4 2] /Index [0 2 5 3] /Length {} >>\nstream\n", rows.len()).as_bytes(),
+        );
+        sparse_stream.extend_from_slice(&rows);
+        sparse_stream.extend_from_slice(format!("\nendstream\nendobj\nstartxref\n{}\n%%EOF\n", offsets[7]).as_bytes());
+        let sparse_stream = Document::open(Arc::new(sparse_stream)).unwrap();
+        assert_eq!(sparse_stream.object_numbers(), vec![1, 5, 6, 7]);
+        assert_compact_matches_materialized(&sparse_stream);
+
+        let stream_bytes = crate::write_full(&classic, &crate::SaveOptions::default()).unwrap();
+        let stream = Document::open(Arc::new(stream_bytes)).unwrap();
+        assert!(stream.revisions().last().is_some_and(|revision| revision.is_stream));
+        assert_compact_matches_materialized(&stream);
+
+        let mut edited = classic.clone();
+        edited.update_dict(ObjRef::new(1, 0), |dict| dict.set(b"Lang".to_vec(), Object::String(crate::PdfString::literal("en")))).unwrap();
+        edited.free(ObjRef::new(3, 0));
+        let incremental = crate::write_incremental(&edited, &crate::SaveOptions::default()).unwrap();
+        let updated = Document::open(Arc::new(incremental)).unwrap();
+        assert_eq!(updated.revisions().len(), 2);
+        assert_compact_matches_materialized(&updated);
+    }
+
+    #[test]
+    fn malformed_size_uses_the_materialized_compatibility_path() {
+        let mut bytes = build(&["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [] /Count 0 >>", "<< /Value 9 >>"], "/Root 1 0 R");
+        let marker = b"/Size 4";
+        let at = bytes.windows(marker.len()).position(|window| window == marker).unwrap();
+        bytes[at..at + marker.len()].copy_from_slice(b"/Size 2");
+        let doc = Document::open(Arc::new(bytes)).unwrap();
+        assert!(matches!(doc.entries.as_ref(), XrefIndex::Materialized(_)));
+        assert_eq!(doc.next_num, 4);
+        assert_eq!(doc.object_numbers(), vec![1, 2, 3]);
+    }
+
     /// Entries the reader sets aside are remembered, so a caller comparing revisions can tell
     /// that another reader may resolve the object differently.
     #[test]
@@ -1362,6 +2085,75 @@ mod tests {
         assert!(doc.xref_entry_is_exact(1) && doc.xref_entry_is_exact(2));
     }
 
+    #[test]
+    fn opening_an_exhausted_classic_xref_repairs_and_allocates() {
+        // The extra in-use row need not be loaded to exhaust the next object number.
+        let bytes = b"%PDF-1.7\n1 0 obj\n<< /Type /Catalog /Pages 2 0 R >>\nendobj\n2 0 obj\n<< /Type /Pages /Kids [] /Count 0 >>\nendobj\nxref\n0 3\n0000000000 65535 f \n0000000009 00000 n \n0000000058 00000 n \n4294967295 1\n0000000058 00000 n \ntrailer\n<< /Size 3 /Root 1 0 R >>\nstartxref\n110\n%%EOF\n";
+        assert_eq!(bytes.len(), 266);
+        let mut doc = Document::open(Arc::new(bytes.to_vec())).unwrap();
+        assert_eq!(doc.root(), Some(ObjRef::new(1, 0)));
+        assert!(doc.repair_log().iter().any(|line| line.contains("exhausted xref")));
+        assert_eq!(doc.add(Object::Null), ObjRef::new(3, 0));
+    }
+
+    #[test]
+    fn opening_an_exhausted_xref_stream_repairs_and_allocates() {
+        let mut bytes =
+            b"%PDF-1.7\n1 0 obj\n<< /Type /Catalog /Pages 2 0 R >>\nendobj\n2 0 obj\n<< /Type /Pages /Kids [] /Count 0 >>\nendobj\n".to_vec();
+        let offset = bytes.len();
+        bytes.extend_from_slice(b"3 0 obj\n<< /Type /XRef /Size 4 /Root 1 0 R /W [1 4 2] /Index [0 3 4294967295 1] /Length 28 >>\nstream\n");
+        for (kind, position, generation) in [(0_u8, 0_u32, 65535_u16), (1, 9, 0), (1, 58, 0), (1, 58, 0)] {
+            bytes.push(kind);
+            bytes.extend_from_slice(&position.to_be_bytes());
+            bytes.extend_from_slice(&generation.to_be_bytes());
+        }
+        bytes.extend_from_slice(format!("\nendstream\nendobj\nstartxref\n{offset}\n%%EOF\n").as_bytes());
+        let mut doc = Document::open(Arc::new(bytes)).unwrap();
+        assert_eq!(doc.root(), Some(ObjRef::new(1, 0)));
+        assert!(doc.repair_log().iter().any(|line| line.contains("exhausted xref")));
+        assert_eq!(doc.add(Object::Null), ObjRef::new(4, 0));
+    }
+
+    #[test]
+    fn exhausted_size_and_high_edits_allocate_without_overwriting_objects() {
+        let ordinary = build(&["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [] /Count 0 >>"], "/Root 1 0 R");
+        for size in ["4294967295", "4294967296", "9223372036854775807"] {
+            let bytes = String::from_utf8(ordinary.clone()).unwrap().replace("/Size 3", &format!("/Size {size}"));
+            let mut doc = Document::open(Arc::new(bytes.into_bytes())).unwrap();
+            assert!(doc.repair_log().iter().any(|line| line.contains("exhausted trailer")));
+            assert_eq!(doc.add(Object::Int(42)), ObjRef::new(3, 0));
+            doc.set(ObjRef::new(u32::MAX, 0), Object::Int(99));
+            doc.set(ObjRef::new(u32::MAX - 1, 0), Object::Int(98));
+            assert_eq!(doc.add(Object::Int(43)), ObjRef::new(4, 0));
+            assert_eq!(doc.get(ObjRef::new(3, 0)).as_int(), Some(42));
+            assert_eq!(doc.get(ObjRef::new(u32::MAX, 0)).as_int(), Some(99));
+            assert_eq!(doc.get(ObjRef::new(1, 0)).as_dict().unwrap().name(b"Type"), Some(b"Catalog".as_slice()));
+        }
+        let mut doc = Document::new_empty();
+        doc.set(ObjRef::new(u32::MAX - 2, 0), Object::Null);
+        assert_eq!(doc.add(Object::Null), ObjRef::new(u32::MAX - 1, 0));
+        assert_eq!(doc.add(Object::Null), ObjRef::new(3, 0));
+        assert_eq!(doc.add(Object::Null), ObjRef::new(4, 0));
+    }
+
+    #[test]
+    fn exhausted_xref_controls_preserve_ordinary_ignored_and_repaired_entries() {
+        let ordinary = build(&["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [] /Count 0 >>"], "/Root 1 0 R");
+        for (extra, repaired) in
+            [("", false), ("4294967295 1\n0000000000 00000 n \n", false), ("4294967295 2\n0000000058 00000 n \n0000000058 00000 n \n", true)]
+        {
+            let bytes = String::from_utf8(ordinary.clone()).unwrap().replacen("trailer\n", &format!("{extra}trailer\n"), 1);
+            let mut doc = Document::open(Arc::new(bytes.into_bytes())).unwrap();
+            assert_eq!(doc.root(), Some(ObjRef::new(1, 0)));
+            assert_eq!(doc.get(ObjRef::new(1, 0)).as_dict().unwrap().name(b"Type"), Some(b"Catalog".as_slice()));
+            assert_eq!(!doc.repair_log().is_empty(), repaired);
+            if repaired {
+                assert!(doc.repair_log().iter().any(|line| line.contains("xref") && line.contains("range")));
+            }
+            assert_eq!(doc.add(Object::Null), ObjRef::new(3, 0));
+        }
+    }
+
     #[test]
     fn invalid_xref_object_ranges_are_reconstructed() {
         // Original in-memory PDF: an intact catalog followed by a damaged xref section.
@@ -1393,6 +2185,32 @@ mod tests {
         }
     }
 
+    #[test]
+    fn objects_only_an_unreadable_older_section_locates_are_found_by_scanning() {
+        // The newest section lists the catalog only; its /Prev points past the end of the file,
+        // so the page tree is reachable only by scanning object headers, as readers do (#1656).
+        let mut bytes = b"%PDF-1.7\n".to_vec();
+        let mut offsets = Vec::new();
+        for (num, body) in
+            [(1, "<< /Type /Catalog /Pages 2 0 R >>"), (2, "<< /Type /Pages /Kids [3 0 R] /Count 1 >>"), (3, "<< /Type /Page /Parent 2 0 R >>")]
+        {
+            offsets.push(bytes.len());
+            bytes.extend_from_slice(format!("{num} 0 obj\n{body}\nendobj\n").as_bytes());
+        }
+        let xref = bytes.len();
+        bytes.extend_from_slice(
+            format!(
+                "xref\n0 2\n0000000000 65535 f \n{:010} 00000 n \ntrailer\n<< /Root 1 0 R /Size 4 /Prev 999999 >>\nstartxref\n{xref}\n%%EOF\n",
+                offsets[0]
+            )
+            .as_bytes(),
+        );
+        let doc = Document::open(Arc::new(bytes)).unwrap();
+        assert_eq!(doc.get(ObjRef::new(2, 0)).as_dict().and_then(|d| d.name(b"Type")), Some(b"Pages".as_slice()));
+        assert_eq!(doc.get(ObjRef::new(3, 0)).as_dict().and_then(|d| d.name(b"Type")), Some(b"Page".as_slice()));
+        assert!(doc.repair_log().iter().any(|l| l.contains("999999")), "{:?}", doc.repair_log());
+    }
+
     #[test]
     fn self_referential_length_does_not_overflow() {
         let bytes = build(
@@ -1439,7 +2257,7 @@ mod tests {
     fn object_numbers_merge_source_and_overlay_in_order() {
         let mut doc = Document::new_empty();
         doc.overlay.clear();
-        doc.entries = Arc::new(BTreeMap::from([
+        doc.entries = Arc::new(XrefIndex::Materialized(Arc::new(BTreeMap::from([
             (0, XrefEntry::Free { next_generation: 65535 }),
             (2, XrefEntry::InFile { offset: 10, generation: 7 }),
             (4, XrefEntry::Free { next_generation: 9 }),
@@ -1447,7 +2265,7 @@ mod tests {
             (8, XrefEntry::InFile { offset: 20, generation: 5 }),
             (10, XrefEntry::InFile { offset: 30, generation: 3 }),
             (u32::MAX, XrefEntry::InFile { offset: 40, generation: 1 }),
-        ]));
+        ]))));
         doc.set(ObjRef::new(1, 2), Object::Int(1)); // before the first live source slot
         doc.set(ObjRef::new(2, 8), Object::Int(2)); // override, without duplication
         doc.set(ObjRef::new(4, 9), Object::Int(4)); // reuse a source free slot
@@ -1463,7 +2281,7 @@ mod tests {
         assert_eq!(doc.generation(10), 4);
         doc.overlay.clear();
         assert_eq!(doc.object_numbers(), vec![2, 6, 8, 10, u32::MAX]);
-        doc.entries = Arc::default();
+        doc.entries = Arc::new(XrefIndex::empty());
         assert!(doc.object_numbers().is_empty());
         doc.set(ObjRef::new(5, 7), Object::Int(5));
         assert_eq!(doc.object_numbers(), vec![5]);
@@ -1694,6 +2512,7 @@ mod tests {
         out.extend_from_slice(format!("trailer << /Size 6 /Root 1 0 R /XRefStm {} >>\nstartxref\n{table}\n%%EOF\n", offs[5]).as_bytes());
         let doc = Document::open(Arc::new(out)).unwrap();
         assert!(doc.repair_log().is_empty(), "{:?}", doc.repair_log());
+        assert_compact_matches_materialized(&doc);
         let hidden = doc.get(ObjRef::new(3, 0));
         assert_eq!(hidden.as_dict().and_then(|d| d.get(b"Hidden").and_then(|h| h.as_string().map(|s| s.to_text()))), Some("yes".into()));
     }
diff --git a/crates/cos/src/security.rs b/crates/cos/src/security.rs
index 2605bb20f..cd0d04a14 100644
--- a/crates/cos/src/security.rs
+++ b/crates/cos/src/security.rs
@@ -34,12 +34,14 @@ pub(crate) fn encrypt_dict(doc: &Document, d: &Dict) -> EncryptDict {
     }
     let v = int(b"V", 0);
     // V4: the key length comes from the standard crypt filter's /Length (bytes, or bits in
-    // some files); /Length on the dictionary is often a stale 40.
+    // some files); /Length on the dictionary is often a stale 40. A length that isn't
+    // positive means nothing and reads as if absent.
     let cf_len = d
         .get(b"CF")
         .map(|c| doc.resolve(c))
         .and_then(|c| c.as_dict().and_then(|c| c.get(b"StdCF").map(|f| doc.resolve(f))))
-        .and_then(|f| f.as_dict().and_then(|f| f.int(b"Length")));
+        .and_then(|f| f.as_dict().and_then(|f| f.int(b"Length")))
+        .filter(|n| *n > 0);
     let length_bits = match (v, cf_len) {
         (5.., _) => 256,
         (4, Some(n)) if n <= 32 => n * 8,
diff --git a/crates/cos/src/writer.rs b/crates/cos/src/writer.rs
index 34254bf37..f8d8fd3d8 100644
--- a/crates/cos/src/writer.rs
+++ b/crates/cos/src/writer.rs
@@ -4,7 +4,8 @@
 //!   as the file's last one (table or stream) and a trailer with `/Prev`. The original bytes are
 //!   never modified, which keeps digital signatures over earlier revisions valid.
 //! * `write_full` writes only objects reachable from the trailer, renumbered densely, with a
-//!   cross-reference table or stream — the "Save As" / garbage-collecting path.
+//!   cross-reference table or stream — the "Save As" / garbage-collecting path. Unknown trailer
+//!   entries are copied, including objects reachable only from them.
 
 use std::borrow::Cow;
 use std::collections::{BTreeMap, HashMap, VecDeque};
@@ -257,6 +258,13 @@ pub fn write_full(doc: &Document, opts: &SaveOptions) -> Result<Vec<u8>, CosErro
             queue.push_back(r);
         }
     }
+    // Unknown trailer entries are document data. Objects they alone reference must be written
+    // too, or a full rewrite would keep the key and drop its value.
+    for (key, value) in trailer_in.iter() {
+        if !trailer_key_rewritten(key) {
+            collect_refs(value, &mut |r| queue.push_back(r));
+        }
+    }
     while let Some(r) = queue.pop_front() {
         if map.contains_key(&r) {
             continue;
@@ -337,6 +345,11 @@ pub fn write_full(doc: &Document, opts: &SaveOptions) -> Result<Vec<u8>, CosErro
     if let Some(id) = trailer_in.get(b"ID") {
         trailer.set(b"ID".to_vec(), id.clone());
     }
+    for (key, value) in trailer_in.iter() {
+        if !trailer_key_rewritten(key) {
+            trailer.set(key.clone(), renumber(value, &map));
+        }
+    }
     if reader.document.output_security().0.is_none() {
         ensure_id(&mut trailer, opts, reader.document.bytes());
     }
@@ -400,6 +413,15 @@ impl ObjectStreamBatch {
     }
 }
 
+/// Trailer keys a full rewrite generates itself. Everything else is copied, with references
+/// renumbered, so a save does not drop metadata the reader accepted.
+fn trailer_key_rewritten(key: &[u8]) -> bool {
+    matches!(
+        key,
+        b"Size" | b"Prev" | b"XRefStm" | b"Type" | b"W" | b"Index" | b"Filter" | b"DecodeParms" | b"Length" | b"Root" | b"Info" | b"Encrypt" | b"ID"
+    )
+}
+
 fn output_number(index: usize) -> Result<u32, CosError> {
     u32::try_from(index).ok().and_then(|n| n.checked_add(1)).ok_or_else(|| CosError::Syntax { offset: 0, detail: "too many objects to save".into() })
 }
diff --git a/crates/cos/tests/encryption.rs b/crates/cos/tests/encryption.rs
index 6868a6dc2..af92cf67c 100644
--- a/crates/cos/tests/encryption.rs
+++ b/crates/cos/tests/encryption.rs
@@ -202,24 +202,23 @@ fn unencrypted_metadata_is_left_readable() {
     let _ = ObjRef::new(1, 0);
 }
 
-/// Second independent oracle when qpdf is installed: it must accept both passwords, identify
-/// the owner password, and find no structural errors.
+/// The second independent oracle: qpdf must accept both passwords, identify the owner password,
+/// and find no structural errors. For R2-R4 this is the *only* check of owner-password
+/// authentication (Algorithm 7) that does not go through our own code, so it is the one place a
+/// silent skip would cost the most -- see `pdfcraft-oracle`, which makes absence loud.
 #[test]
 fn qpdf_agrees() {
-    if std::process::Command::new("qpdf").arg("--version").output().is_err() {
-        eprintln!("qpdf not installed; skipping");
-        return;
-    }
+    let qpdf = pdfcraft_oracle::or_skip!(pdfcraft_oracle::qpdf());
     let dir = std::env::temp_dir().join(format!("pdfcraft-enc-{}", std::process::id()));
     std::fs::create_dir_all(&dir).unwrap();
     for alg in ALL {
         let path = dir.join(format!("{alg:?}.pdf"));
         std::fs::write(&path, protect(alg, "user", "owner", -1)).unwrap();
         for (pw, expect) in [("user", "user password"), ("owner", "owner password")] {
-            let out = std::process::Command::new("qpdf").arg(format!("--password={pw}")).arg("--show-encryption").arg(&path).output().unwrap();
+            let out = qpdf.command().arg(format!("--password={pw}")).arg("--show-encryption").arg(&path).output().unwrap();
             let text = String::from_utf8_lossy(&out.stdout);
             assert!(text.contains(&format!("Supplied password is {expect}")), "{alg:?}/{pw}: {text}");
-            let check = std::process::Command::new("qpdf").arg(format!("--password={pw}")).arg("--check").arg(&path).output().unwrap();
+            let check = qpdf.command().arg(format!("--password={pw}")).arg("--check").arg(&path).output().unwrap();
             assert!(check.status.success(), "{alg:?}/{pw}: {}", String::from_utf8_lossy(&check.stdout));
         }
     }
@@ -279,3 +278,61 @@ fn signature_contents_stay_unencrypted() {
         assert_eq!(string(2, b"Contents"), b"Private note", "{alg:?}");
     }
 }
+
+#[test]
+fn a_nonpositive_crypt_filter_length_reads_as_the_default_key_length() {
+    // A V4 crypt filter's /Length counts bytes (≤ 32) or bits. A zero or negative value is
+    // meaningless and is read as if absent (128 bits), not multiplied into an overflow (#1816).
+    let original = protect(Algorithm::Aes128, "", "owner", -1);
+    for length in [i64::MIN, i64::MIN / 8 - 1, i64::MIN / 8, -1, 0, 16, 128] {
+        let mut doc = Document::open(Arc::new(original.clone())).unwrap();
+        let encrypt = doc.trailer().reference(b"Encrypt").unwrap();
+        doc.update_dict(encrypt, |e| {
+            let Some(Object::Dict(cf)) = e.get(b"CF") else { panic!("no /CF") };
+            let Some(Object::Dict(std_cf)) = cf.get(b"StdCF") else { panic!("no /StdCF") };
+            let (mut cf, mut std_cf) = (cf.clone(), std_cf.clone());
+            std_cf.set(b"Length".to_vec(), Object::Int(length));
+            cf.set(b"StdCF".to_vec(), Object::Dict(std_cf));
+            e.set(b"CF".to_vec(), Object::Dict(cf));
+        })
+        .unwrap();
+        let saved = write_incremental(&doc, &SaveOptions::default()).unwrap();
+        let again = Document::open(Arc::new(saved)).unwrap();
+        assert_eq!(content(&again), SECRET, "/Length {length}");
+    }
+}
+
+#[test]
+fn an_earlier_revision_opens_with_the_documents_own_credentials() {
+    // The bytes a signature covers are an earlier revision of the file: the document that is
+    // open can read them with its own key, so no password has to be kept or asked for again.
+    for alg in ALL {
+        let original = protect(alg, "user", "owner", -1);
+        let mut doc = Document::open_with_password(Arc::new(original.clone()), Some("user")).unwrap();
+        let info = doc.trailer().reference(b"Info").unwrap();
+        doc.update_dict(info, |d| d.set(b"Title".to_vec(), Object::String(PdfString::text("Revised")))).unwrap();
+        let saved = write_incremental(&doc, &SaveOptions::default()).unwrap();
+        let current = Document::open_with_password(Arc::new(saved), Some("user")).unwrap();
+        assert!(matches!(Document::open(Arc::new(original.clone())), Err(CosError::NeedsPassword)), "{alg:?}: not without a password");
+        let earlier = current.open_with_same_credentials(Arc::new(original.clone())).unwrap();
+        assert_eq!(content(&earlier), SECRET, "{alg:?}: the earlier revision is readable");
+        assert_eq!(title(&earlier).as_deref(), Some("Quarterly numbers"), "{alg:?}: and it is the earlier one");
+        // Another file, encrypted with other keys: the document's key is no use, and it says so.
+        let other = {
+            let mut doc = Document::open(Arc::new(fixture())).unwrap();
+            doc.set_encryption(&NewEncryption {
+                algorithm: alg,
+                user_password: "user",
+                owner_password: "owner",
+                permissions: -1,
+                encrypt_metadata: true,
+                seed: [3; 32],
+            })
+            .unwrap();
+            write_full(&doc, &SaveOptions::default()).unwrap()
+        };
+        assert!(matches!(current.open_with_same_credentials(Arc::new(other)), Err(CosError::NeedsPassword)), "{alg:?}");
+        // An unencrypted file opens as it always does.
+        assert_eq!(content(&current.open_with_same_credentials(Arc::new(fixture())).unwrap()), SECRET, "{alg:?}");
+    }
+}
diff --git a/crates/cos/tests/writer.rs b/crates/cos/tests/writer.rs
index b7514cc05..ec18b13f3 100644
--- a/crates/cos/tests/writer.rs
+++ b/crates/cos/tests/writer.rs
@@ -4,34 +4,23 @@
 use std::sync::Arc;
 
 use pdfcraft_cos::{Dict, Document, ObjRef, Object, SaveOptions, Stream, write_full, write_incremental};
+use pdfcraft_testkit::Pdf;
 
 /// Four pages, a shared font, document info with a non-ASCII title.
 fn fixture() -> Vec<u8> {
-    let mut objs: Vec<String> = vec!["<< /Type /Catalog /Pages 2 0 R >>".into()];
     let kids: Vec<String> = (0..4).map(|i| format!("{} 0 R", 4 + 2 * i)).collect();
-    objs.push(format!("<< /Type /Pages /Kids [{}] /Count 4 /MediaBox [0 0 200 300] >>", kids.join(" ")));
-    objs.push("<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".into());
+    let mut pdf = Pdf::new()
+        .version("1.4")
+        .obj("<< /Type /Catalog /Pages 2 0 R >>")
+        .obj(format!("<< /Type /Pages /Kids [{}] /Count 4 /MediaBox [0 0 200 300] >>", kids.join(" ")))
+        .obj("<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>");
     for i in 0..4 {
-        objs.push(format!("<< /Type /Page /Parent 2 0 R /Contents {} 0 R /Resources << /Font << /F1 3 0 R >> >> >>", 5 + 2 * i));
-        let body = format!("BT /F1 24 Tf 20 150 Td (Page {}) Tj ET", i + 1);
-        objs.push(format!("<< /Length {} >>\nstream\n{body}\nendstream", body.len()));
+        pdf = pdf
+            .obj(format!("<< /Type /Page /Parent 2 0 R /Contents {} 0 R /Resources << /Font << /F1 3 0 R >> >> >>", 5 + 2 * i))
+            .stream("", format!("BT /F1 24 Tf 20 150 Td (Page {}) Tj ET", i + 1));
     }
-    objs.push("<< /Title (Caf\\351 \\(draft\\)) >>".into());
-    let mut out = b"%PDF-1.4\n".to_vec();
-    let mut offsets = Vec::new();
-    for (i, o) in objs.iter().enumerate() {
-        offsets.push(out.len());
-        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
-    }
-    let xref = out.len();
-    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
-    for o in offsets {
-        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
-    }
-    out.extend_from_slice(
-        format!("trailer\n<< /Size {} /Root 1 0 R /Info {} 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1, objs.len()).as_bytes(),
-    );
-    out
+    let info = pdf.next_obj();
+    pdf.obj("<< /Title (Caf\\351 \\(draft\\)) >>").trailer_entry(&format!("/Info {info} 0 R")).build()
 }
 
 fn title(doc: &Document) -> Vec<u8> {
@@ -159,18 +148,14 @@ fn classic_table() -> Vec<u8> {
     bytes
 }
 
-fn qpdf_check(bytes: &[u8]) -> Option<std::process::Output> {
-    let Ok(version) = std::process::Command::new("qpdf").arg("--version").output() else {
-        return None;
-    };
-    assert!(version.status.success());
+fn qpdf_check(qpdf: &pdfcraft_oracle::Oracle, bytes: &[u8]) -> std::process::Output {
     static NEXT: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
     let n = NEXT.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
     let path = std::env::temp_dir().join(format!("pdfcraft-xref-{}-{n}.pdf", std::process::id()));
     std::fs::write(&path, bytes).unwrap();
-    let check = std::process::Command::new("qpdf").arg("--check").arg(&path).output().unwrap();
+    let check = qpdf.command().arg("--check").arg(&path).output().unwrap();
     let _ = std::fs::remove_file(&path);
-    Some(check)
+    check
 }
 
 fn page(doc: &Document) -> Dict {
@@ -181,10 +166,8 @@ fn page(doc: &Document) -> Dict {
 }
 
 fn assert_qpdf_clean(bytes: &[u8]) {
-    let Some(check) = qpdf_check(bytes) else {
-        eprintln!("qpdf not installed: skipped");
-        return;
-    };
+    let qpdf = pdfcraft_oracle::or_skip!(pdfcraft_oracle::qpdf());
+    let check = qpdf_check(&qpdf, bytes);
     let report = format!("{}{}", String::from_utf8_lossy(&check.stdout), String::from_utf8_lossy(&check.stderr));
     assert!(check.status.success() && !report.contains("WARNING"), "{report}");
 }
@@ -247,16 +230,12 @@ fn incremental_save_keeps_a_trailer_only_edit() {
 
 #[test]
 fn qpdf_accepts_object_stream_output() {
-    let Ok(out) = std::process::Command::new("qpdf").arg("--version").output() else {
-        eprintln!("qpdf not installed: skipped");
-        return;
-    };
-    assert!(out.status.success());
+    let qpdf = pdfcraft_oracle::or_skip!(pdfcraft_oracle::qpdf());
     let doc = Document::open(Arc::new(fixture())).unwrap();
     let packed = write_full(&doc, &SaveOptions::default()).unwrap();
     let path = std::env::temp_dir().join(format!("pdfcraft-objstm-{}.pdf", std::process::id()));
     std::fs::write(&path, &packed).unwrap();
-    let check = std::process::Command::new("qpdf").arg("--check").arg(&path).output().unwrap();
+    let check = qpdf.command().arg("--check").arg(&path).output().unwrap();
     let _ = std::fs::remove_file(&path);
     let report = String::from_utf8_lossy(&check.stdout);
     assert!(check.status.success() && report.contains("No syntax or stream encoding errors"), "{report}");
@@ -348,3 +327,68 @@ fn page_tree_loops_in_object_streams_do_not_crash_readers() {
     assert!(String::from_utf8_lossy(&packed).contains("/ObjStm"));
     assert_eq!(hayro_pages(&packed), 1);
 }
+
+/// Catalog, empty page tree, and trailer entries a reader must not invent: a direct name, a
+/// direct string, and a string object reachable only from the trailer.
+fn trailer_fixture() -> Vec<u8> {
+    let mut out = b"%PDF-1.4\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, body) in ["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [] /Count 0 >>", "(only from the trailer)"].iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{body}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = out.len();
+    out.extend_from_slice(b"xref\n0 4\n0000000000 65535 f \n");
+    for offset in offsets {
+        out.extend_from_slice(format!("{offset:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(
+        format!("trailer\n<< /Size 4 /Root 1 0 R /Version /1.7 /Custom (keep me) /Note 3 0 R >>\nstartxref\n{xref}\n%%EOF\n").as_bytes(),
+    );
+    out
+}
+
+fn trailer_custom(doc: &Document) -> Option<Vec<u8>> {
+    doc.trailer().get(b"Custom").and_then(Object::as_string).map(|s| s.bytes.clone())
+}
+
+fn trailer_note(doc: &Document) -> Option<Vec<u8>> {
+    doc.trailer().get(b"Note").map(|o| doc.resolve(o)).and_then(|o| o.as_string().map(|s| s.bytes.clone()))
+}
+
+#[test]
+fn full_save_preserves_unknown_trailer_data() {
+    let input = trailer_fixture();
+    let doc = Document::open(Arc::new(input)).unwrap();
+    assert_eq!(trailer_custom(&doc), Some(b"keep me".to_vec()));
+    assert_eq!(trailer_note(&doc).as_deref(), Some(b"only from the trailer".as_slice()));
+    assert_eq!(doc.trailer().get(b"Version").and_then(Object::as_name), Some(&b"1.7"[..]));
+    assert!(doc.repair_log().is_empty());
+    assert!(!doc.full_save_required());
+
+    let inc = Document::open(Arc::new(write_incremental(&doc, &SaveOptions::default()).unwrap())).unwrap();
+    assert_eq!(trailer_custom(&inc), trailer_custom(&doc));
+    assert_eq!(trailer_note(&inc), trailer_note(&doc));
+    assert_eq!(inc.trailer().get(b"Version"), doc.trailer().get(b"Version"));
+    assert!(inc.repair_log().is_empty());
+
+    for object_streams in [true, false] {
+        let opts = SaveOptions { object_streams, ..SaveOptions::default() };
+        let bytes = write_full(&doc, &opts).unwrap();
+        let back = Document::open(Arc::new(bytes)).unwrap();
+        assert!(back.root().is_some());
+        assert!(back.repair_log().is_empty(), "{:?}", back.repair_log());
+        assert_eq!(trailer_custom(&back), trailer_custom(&doc));
+        assert_eq!(trailer_note(&back), trailer_note(&doc));
+        assert_eq!(back.trailer().get(b"Version"), doc.trailer().get(b"Version"));
+    }
+
+    let mut required = doc.clone();
+    required.require_full_save();
+    let back = Document::open(Arc::new(write_incremental(&required, &SaveOptions::default()).unwrap())).unwrap();
+    assert!(back.root().is_some());
+    assert!(back.repair_log().is_empty(), "{:?}", back.repair_log());
+    assert_eq!(trailer_custom(&back), trailer_custom(&doc));
+    assert_eq!(trailer_note(&back), trailer_note(&doc));
+    assert_eq!(back.trailer().get(b"Version"), doc.trailer().get(b"Version"));
+}
diff --git a/crates/create/src/extract.rs b/crates/create/src/extract.rs
index d9a96181a..103448945 100644
--- a/crates/create/src/extract.rs
+++ b/crates/create/src/extract.rs
@@ -179,8 +179,9 @@ fn image(doc: &Document, s: &Stream) -> Result<(&'static str, Vec<u8>), String>
             Space::Gray => rgb.extend_from_slice(&[v(0); 3]),
             Space::Rgb => rgb.extend_from_slice(&[v(0), v(1), v(2)]),
             Space::Cmyk => rgb.extend_from_slice(&cmyk(v(0), v(1), v(2), v(3))),
-            Space::Indexed(base, table) => {
-                let i = px.first().copied().unwrap_or(0) as usize;
+            Space::Indexed(base, hival, table) => {
+                // Indexed samples outside the declared range use the nearest endpoint (ISO 32000-1, 8.6.6.3).
+                let i = px.first().copied().unwrap_or(0).min(*hival) as usize;
                 let k = base.components();
                 let e = table.get(i * k..i * k + k).unwrap_or(&[0, 0, 0, 0][..k]);
                 rgb.extend_from_slice(&match **base {
@@ -310,8 +311,8 @@ enum Space {
     Gray,
     Rgb,
     Cmyk,
-    /// Base space and lookup table (one byte per base component).
-    Indexed(Box<Space>, Vec<u8>),
+    /// Base space, highest valid palette index, and lookup table.
+    Indexed(Box<Space>, u8, Vec<u8>),
 }
 
 impl Space {
@@ -352,12 +353,16 @@ fn space(doc: &Document, cs: Option<&Object>) -> Result<Space, String> {
                 if matches!(base, Space::Indexed(..)) {
                     return Err("nested indexed colour spaces aren't valid".into());
                 }
+                let hival = match a.get(2).map(|value| doc.resolve(value)).as_deref() {
+                    Some(Object::Int(value)) if (0..=255).contains(value) => *value as u8,
+                    _ => return Err("an indexed colour space with an invalid hival".into()),
+                };
                 let table = match a.get(3).map(|t| doc.resolve(t)).as_deref() {
                     Some(Object::String(s)) => s.bytes.clone(),
                     Some(Object::Stream(t)) => t.decoded().map_err(|e| e.to_string())?,
                     _ => return Err("an indexed colour space without a lookup table".into()),
                 };
-                Ok(Space::Indexed(Box::new(base), table))
+                Ok(Space::Indexed(Box::new(base), hival, table))
             }
             Some(other) => unsupported(other),
             None => Err("a damaged colour space".into()),
diff --git a/crates/create/src/tests.rs b/crates/create/src/tests.rs
index 2d76055ec..993c38d9f 100644
--- a/crates/create/src/tests.rs
+++ b/crates/create/src/tests.rs
@@ -744,6 +744,137 @@ fn damaged_masks_and_sizes_never_panic() {
     }
 }
 
+#[test]
+fn indexed_image_export_clamps_samples_to_hival() {
+    for palette in [vec![255, 0, 0, 0, 0, 255], vec![255, 0, 0, 0, 0, 255, 0, 255, 0, 255, 255, 255]] {
+        let mut doc = from_images(&[("flat.png".into(), png_bytes(false))]).unwrap();
+        let page = pdfcraft_model::pages(&doc)[0].clone();
+        let res = doc.resolve(page.dict.get(b"Resources").unwrap()).as_dict().cloned().unwrap();
+        let xo = doc.resolve(res.get(b"XObject").unwrap()).as_dict().cloned().unwrap();
+        let image = xo.iter().next().unwrap().1.as_ref().unwrap();
+        let mut dict = Dict::new();
+        dict.set(b"Type".to_vec(), Object::name("XObject"));
+        dict.set(b"Subtype".to_vec(), Object::name("Image"));
+        dict.set(b"Width".to_vec(), Object::Int(4));
+        dict.set(b"Height".to_vec(), Object::Int(1));
+        dict.set(b"BitsPerComponent".to_vec(), Object::Int(2));
+        dict.set(
+            b"ColorSpace".to_vec(),
+            Object::Array(vec![Object::name("Indexed"), Object::name("DeviceRGB"), Object::Int(1), Object::String(PdfString::literal(palette))]),
+        );
+        // Default Decode preserves sample values0,1,2,3. Values2 and3 clamp to hival1.
+        doc.set(image, Object::Stream(Stream::from_raw(dict, vec![0b0001_1011])));
+        let out = extract_images(&doc, &[0], 0);
+        assert!(out.skipped.is_empty(), "{:?}", out.skipped);
+        assert_eq!(out.images.len(), 1);
+        assert_eq!(exported_png_pixels(&out.images[0].data), vec![255, 0, 0, 0, 0, 255, 0, 0, 255, 0, 0, 255]);
+    }
+}
+
+fn exported_png_pixels(bytes: &[u8]) -> Vec<u8> {
+    let decoder = png::Decoder::new(std::io::Cursor::new(bytes));
+    let mut reader = decoder.read_info().unwrap();
+    let mut pixels = vec![0; reader.output_buffer_size().unwrap()];
+    let info = reader.next_frame(&mut pixels).unwrap();
+    pixels.truncate(info.buffer_size());
+    pixels
+}
+
+fn indexed_export_fixture(
+    hival: Object,
+    palette: Vec<u8>,
+    stream_table: bool,
+    indirect_hival: bool,
+    bpc: i64,
+    samples: Vec<u8>,
+) -> (Document, pdfcraft_cos::ObjRef) {
+    let mut doc = from_images(&[("flat.png".into(), png_bytes(false))]).unwrap();
+    let page = pdfcraft_model::pages(&doc)[0].clone();
+    let res = doc.resolve(page.dict.get(b"Resources").unwrap()).as_dict().cloned().unwrap();
+    let xo = doc.resolve(res.get(b"XObject").unwrap()).as_dict().cloned().unwrap();
+    let image = xo.iter().next().unwrap().1.as_ref().unwrap();
+    let table = if stream_table {
+        Object::Ref(doc.add(Object::Stream(Stream::flate(Dict::new(), &palette))))
+    } else {
+        Object::String(PdfString::literal(palette))
+    };
+    let hival = if indirect_hival { Object::Ref(doc.add(hival)) } else { hival };
+    let mut dict = Dict::new();
+    dict.set(b"Type".to_vec(), Object::name("XObject"));
+    dict.set(b"Subtype".to_vec(), Object::name("Image"));
+    dict.set(b"Width".to_vec(), Object::Int(4));
+    dict.set(b"Height".to_vec(), Object::Int(1));
+    dict.set(b"BitsPerComponent".to_vec(), Object::Int(bpc));
+    dict.set(b"ColorSpace".to_vec(), Object::Array(vec![Object::name("Indexed"), Object::name("DeviceRGB"), hival, table]));
+    doc.set(image, Object::Stream(Stream::from_raw(dict, samples)));
+    (doc, image)
+}
+
+#[test]
+fn indexed_hival_resolves_indirect_values_and_stream_palettes() {
+    for (bpc, samples) in [(2, vec![0x1b]), (4, vec![0x01, 0x23]), (8, vec![0, 1, 2, 255])] {
+        let (doc, image) = indexed_export_fixture(Object::Int(1), vec![255, 0, 0, 0, 0, 255], true, true, bpc, samples);
+        let (ext, bytes) = crate::extract::image_file(&doc, image).unwrap();
+        assert_eq!(ext, "png");
+        assert_eq!(exported_png_pixels(&bytes), vec![255, 0, 0, 0, 0, 255, 0, 0, 255, 0, 0, 255]);
+    }
+}
+
+#[test]
+fn indexed_hival_boundary_values_keep_valid_palette_entries() {
+    let palette: Vec<u8> = (0..=255u8).flat_map(|i| [i, 255 - i, 17]).collect();
+    for high in [0, 255] {
+        let (doc, image) = indexed_export_fixture(Object::Int(high), palette.clone(), false, false, 8, vec![0, 1, 254, 255]);
+        let (_, bytes) = crate::extract::image_file(&doc, image).unwrap();
+        let expected: Vec<u8> = [0u8, 1, 254, 255]
+            .into_iter()
+            .flat_map(|i| {
+                let i = i.min(high as u8);
+                [i, 255 - i, 17]
+            })
+            .collect();
+        assert_eq!(exported_png_pixels(&bytes), expected);
+    }
+}
+
+#[test]
+fn indexed_hival_rejects_invalid_values_without_panicking() {
+    for high in [Object::Int(-1), Object::Int(256), Object::Real(1.0), Object::Null, Object::name("bad")] {
+        let (doc, image) = indexed_export_fixture(high, vec![255, 0, 0], false, false, 8, vec![0; 4]);
+        assert!(crate::extract::image_file(&doc, image).unwrap_err().contains("invalid hival"));
+        let out = extract_images(&doc, &[0], 0);
+        assert!(out.images.is_empty());
+        assert_eq!(out.skipped.len(), 1);
+        assert!(out.skipped[0].2.contains("invalid hival"));
+    }
+}
+
+#[test]
+fn indexed_hival_clamping_preserves_raw_colour_key_mask_samples() {
+    let (mut doc, image) = indexed_export_fixture(Object::Int(1), vec![255, 0, 0, 0, 0, 255], false, false, 2, vec![0x1b]);
+    let Object::Stream(mut stream) = (*doc.get(image)).clone() else { panic!("image stream") };
+    stream.dict.set(b"Mask".to_vec(), Object::Array(vec![Object::Int(2), Object::Int(2)]));
+    doc.set(image, Object::Stream(stream));
+    let (_, bytes) = crate::extract::image_file(&doc, image).unwrap();
+    assert_eq!(exported_png_pixels(&bytes), vec![255, 0, 0, 255, 0, 0, 255, 255, 0, 0, 255, 0, 0, 0, 255, 255]);
+}
+
+#[test]
+fn indexed_hival_missing_element_returns_export_error() {
+    let (mut doc, image) = indexed_export_fixture(Object::Int(1), vec![255, 0, 0], false, false, 8, vec![0; 4]);
+    let Object::Stream(mut stream) = (*doc.get(image)).clone() else { panic!("image stream") };
+    stream.dict.set(b"ColorSpace".to_vec(), Object::Array(vec![Object::name("Indexed"), Object::name("DeviceRGB")]));
+    doc.set(image, Object::Stream(stream));
+    assert!(crate::extract::image_file(&doc, image).unwrap_err().contains("invalid hival"));
+}
+
+#[test]
+fn indexed_hival_keeps_existing_short_palette_fallback() {
+    let (doc, image) = indexed_export_fixture(Object::Int(1), vec![255, 0, 0], false, false, 2, vec![0x1b]);
+    let (_, bytes) = crate::extract::image_file(&doc, image).unwrap();
+    assert_eq!(exported_png_pixels(&bytes), vec![255, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]);
+}
+
 /// An 8×8 baseline JPEG of one flat colour with four components, stored as `samples`, and an
 /// Adobe APP14 segment with `transform` (0: CMYK, 2: YCCK).
 fn flat_four_component_jpeg(samples: [u8; 4], transform: u8) -> Vec<u8> {
diff --git a/crates/crypt/tests/proptests.rs b/crates/crypt/tests/proptests.rs
new file mode 100644
index 000000000..e4f1d78b5
--- /dev/null
+++ b/crates/crypt/tests/proptests.rs
@@ -0,0 +1,464 @@
+//! Property tests for what the security handler does to *content*, and to the ciphertext a
+//! stranger's file hands back.
+//!
+//! `src/tests.rs` covers this handler carefully with fixed vectors — including the `/O`, `/U` and
+//! file keys qpdf 12.4.2 produced for real files — plus one property over malformed dictionaries.
+//! What it does not vary is the *payload*. Upstream's encrypted round trips run three shapes: a
+//! 30-byte text, a 1000-byte ramp, and a 10-byte attachment in `identity_crypt_filters_leave_data_alone`.
+//! The shapes nobody walks are the ones that break CBC and readers: empty content, one block minus
+//! one, a ciphertext cut short by a damaged `/Length`, and keys of a length `create` never builds.
+//!
+//! - plaintext survives encryption at every length, for each algorithm and each crypt filter;
+//! - truncated or mutated ciphertext produces bytes rather than a panic (`AGENTS.md` §4: PdfCraft
+//!   opens files from strangers, and encrypted streams in the wild do get truncated);
+//! - object keys are scoped to their object, and AES-256's documented exception still holds;
+//! - a file opens for exactly the passwords whose effective bytes match, stated as a rule over
+//!   generated Unicode passwords instead of the three examples in `src/tests.rs` (the #1185 rule);
+//! - the AES-CBC and RC4 primitives invert each other for any key length, since `/Length` and
+//!   crypt filters from a damaged file reach them with shapes `create` would never build.
+
+use pdfcraft_crypt::{
+    Algorithm, Auth, CryptError, Method, NewEncryption, PADDING, SecurityHandler, StreamKind, aes_cbc_decrypt, aes_cbc_encrypt, create,
+    effective_password, pdfdoc_byte, rc4,
+};
+use proptest::prelude::*;
+
+/// The first element of `/ID`, which every R2–R4 derivation hashes in (Algorithm 2).
+const ID: &[u8] = b"\x01\x23\x45\x67\x89\xab\xcd\xef\x0f\xed\xcb\xa9\x87\x65\x43\x21";
+
+fn algorithms() -> impl Strategy<Value = Algorithm> {
+    prop::sample::select(vec![Algorithm::Rc4_40, Algorithm::Rc4_128, Algorithm::Aes128, Algorithm::Aes256])
+}
+
+/// Content at the lengths where CBC padding goes wrong, plus anything in between.
+fn payloads() -> impl Strategy<Value = Vec<u8>> {
+    prop_oneof![
+        Just(Vec::new()),
+        Just(vec![0x5cu8; 1]),
+        Just(vec![0xa7u8; 15]),
+        Just(vec![0x3fu8; 16]),
+        Just(vec![0x9du8; 17]),
+        Just(vec![0x10u8; 32]),
+        prop::collection::vec(any::<u8>(), 1..96),
+    ]
+}
+
+/// Passwords from an alphabet the two encodings disagree about: SASLprep deletes U+00AD, folds
+/// U+FF21 to "A", U+FB01 to "fi" and U+3000 to a space (revisions 5–6), while PDFDocEncoding has
+/// no byte for 'ğ' or CJK at all, which sends revisions 2–4 down their UTF-8 fallback.
+const PASSWORD_CHARS: [char; 12] = ['a', 'B', '7', ' ', '-', '\u{AD}', '\u{FF21}', '\u{FB01}', 'ı', 'ğ', '日', '\u{A0}'];
+
+fn passwords() -> impl Strategy<Value = String> {
+    prop::collection::vec(prop::sample::select(PASSWORD_CHARS.to_vec()), 0..12).prop_map(|chars| chars.into_iter().collect())
+}
+
+/// `bytes` cut to 32 and padded with the standard padding string (Algorithm 2, step a).
+fn padded(bytes: &[u8]) -> Vec<u8> {
+    let mut out = PADDING;
+    let n = bytes.len().min(32);
+    out[..n].copy_from_slice(&bytes[..n]);
+    out.to_vec()
+}
+
+/// Every byte string the handler may authenticate `pw` as. Revisions 2–4 use PDFDocEncoding, and
+/// for a password holding characters it lacks they also try the raw UTF-8 bytes (qpdf writes such
+/// passwords that way); revisions 5–6 use the SASLprep bytes. `effective_password` publishes the
+/// first of these per algorithm, and it is what callers such as Protect check before encrypting.
+fn candidates(algorithm: Algorithm, pw: &str) -> Vec<Vec<u8>> {
+    let mut out = vec![effective_password(algorithm, pw)];
+    if algorithm != Algorithm::Aes256 && pw.chars().any(|c| pdfdoc_byte(c).is_none()) {
+        out.push(padded(&pw.as_bytes().iter().copied().take(32).collect::<Vec<u8>>()));
+    }
+    out
+}
+
+/// What `create` keys `/O` from: the owner password, except on revisions 2–4 with no owner
+/// password given, where it falls back to the user password's bytes.
+fn owner_target(algorithm: Algorithm, user: &str, owner: &str) -> Vec<u8> {
+    if algorithm != Algorithm::Aes256 && owner.is_empty() { effective_password(algorithm, user) } else { effective_password(algorithm, owner) }
+}
+
+/// Which password `pw` is for this file. Owners are tried before users, so bytes that match both
+/// authenticate as owner — the order viewers use. `None` means it opens nothing.
+fn expected_auth(algorithm: Algorithm, user_target: &[u8], owner_target: &[u8], pw: &str) -> Option<Auth> {
+    let tried = candidates(algorithm, pw);
+    if tried.iter().any(|c| c == owner_target) {
+        Some(Auth::Owner)
+    } else if tried.iter().any(|c| c == user_target) {
+        Some(Auth::User)
+    } else {
+        None
+    }
+}
+
+fn make(algorithm: Algorithm, user: &str, owner: &str) -> SecurityHandler {
+    create(&NewEncryption { algorithm, user_password: user, owner_password: owner, permissions: -1, encrypt_metadata: true, seed: [0x5e; 32] }, ID)
+        .unwrap()
+}
+
+proptest! {
+    /// Encrypting then decrypting returns the input at every length, as a string and as each kind
+    /// of stream — and is byte-for-byte reproducible, because re-running a save must not silently
+    /// produce different bytes. Payloads of at least one block must come back changed: RC4 would
+    /// need an all-zero keystream to leave them alone, and CBC cannot shrink a padded block.
+    #[test]
+    fn content_survives_the_trip_at_every_length(alg in algorithms(), data in payloads()) {
+        let h = make(alg, "user", "owner");
+
+        // The key width each algorithm promises: 5 bytes for export-grade 40-bit RC4, 16 for
+        // AES-128 and RC4-128, 32 for AES-256. `key_len` is the only place that decides this and
+        // nothing in either suite reads it back, so `if d.r == 2 { 5 }` becoming `{ 4 }` today
+        // produces a file key of the wrong size that every test still calls fine.
+        let want_len = match alg { Algorithm::Rc4_40 => 5, Algorithm::Aes128 | Algorithm::Rc4_128 => 16, Algorithm::Aes256 => 32 };
+        prop_assert_eq!(h.file_key().len(), want_len, "{:?} must use a {} byte file key", alg, want_len);
+
+        let h = make(alg, "user", "owner");
+        for num in [0u32, 1, 4096, u32::MAX] {
+            let generation = (num % 65_535) as u16;
+
+            let enc = h.encrypt_string(num, generation, &data);
+            prop_assert_eq!(h.decrypt_string(num, generation, &enc), &data[..], "string round trip at {} bytes ({:?})", data.len(), alg);
+            prop_assert_eq!(h.encrypt_string(num, generation, &data), enc, "string encryption must be reproducible ({:?})", alg);
+
+            for kind in [StreamKind::Normal, StreamKind::EmbeddedFile, StreamKind::Named(b"StdCF")] {
+                let enc = h.encrypt_stream(num, generation, &data, kind);
+                prop_assert_eq!(h.decrypt_stream(num, generation, &enc, kind), &data[..], "stream round trip at {} bytes ({:?}, {:?})", data.len(), alg, kind);
+                prop_assert_eq!(h.encrypt_stream(num, generation, &data, kind), enc, "{:?} {:?} encryption must be reproducible", alg, kind);
+            }
+
+            if data.len() >= 16 {
+                prop_assert_ne!(h.encrypt_string(num, generation, &data), &data[..], "one block left in plain sight ({:?})", alg);
+            }
+        }
+    }
+
+    /// Ciphertext of any length — truncated by a damaged `/Length`, padded out with garbage, or
+    /// byte-flipped inside — must decrypt to bytes and never read past the end. AES discards a
+    /// trailing partial block and leaves invalid padding in place rather than failing, so its
+    /// output can only be a whole number of blocks minus at most one; RC4 keeps its length
+    /// whatever the bytes are. An input shorter than the IV has nothing left to decode.
+    #[test]
+    fn damaged_ciphertext_never_panics(alg in algorithms(), enc in prop::collection::vec(any::<u8>(), 0..64)) {
+        let h = make(alg, "user", "owner");
+        for cut in 0..=enc.len() {
+            let broken = &enc[..cut];
+            let out = h.decrypt_string(7, 3, broken);
+            if alg == Algorithm::Rc4_40 || alg == Algorithm::Rc4_128 {
+                prop_assert_eq!(out.len(), cut, "RC4 must be length-preserving ({:?})", alg);
+            } else {
+                let blocks = cut.saturating_sub(16) / 16;
+                prop_assert!(out.len() <= blocks * 16, "{:?}: {} bytes of ciphertext yielded {} decrypted bytes", alg, cut, out.len());
+                prop_assert!(blocks * 16 - out.len() <= 16, "{:?}: padding removed more than one block", alg);
+            }
+        }
+
+        // Flip every byte of a real ciphertext in turn: no position may crash the reader.
+        let full = h.encrypt_string(7, 3, b"twenty-four bytes of PDF content");
+        for i in 0..full.len() {
+            let mut mutated = full.clone();
+            mutated[i] ^= 0xFF;
+            let _ = h.decrypt_string(7, 3, &mutated);
+        }
+    }
+
+    /// A crypt filter name decides whether content is encrypted at all: PDF 2.0 permits
+    /// `/StmF /Identity` with attachments still encrypted, and a name that appears in neither `/CF`
+    /// nor as `Identity` resolves to Identity rather than failing. The reported answer and the
+    /// bytes must agree, at every length including empty (where AES still adds a whole block).
+    /// `/EFF` is set here so embedded files and normal streams must take *different* paths: the
+    /// mix-up that leaves an attachment in plain sight, or encrypts a stream its own filter says
+    /// should not be. And sometimes `/CF` carries an entry *named* `Identity` that claims
+    /// `/CFM /AESV2`: a producer writing nonsense. The name wins and the bytes stay plain, since
+    /// encrypting what both sides agreed is plaintext would write a file other readers cannot open.
+    #[test]
+    fn crypt_filters_decide_what_gets_encrypted(
+        data in payloads(),
+        name in prop::sample::select(vec!["Identity", "StdCF", "Nope"]),
+        bogus_identity_in_cf in any::<bool>(),
+    ) {
+        let mut d = make(Algorithm::Aes256, "", "owner").dict().clone();
+        d.str_f = name.as_bytes().to_vec();
+        d.stm_f = b"Identity".to_vec();
+        d.ef_f = b"StdCF".to_vec();
+        if bogus_identity_in_cf {
+            d.crypt_filters.push((b"Identity".to_vec(), Method::Aes256));
+        }
+        let h = SecurityHandler::open(d, ID, None).unwrap();
+
+        // Only `StdCF` really encrypts; `Identity` does not even when `/CF` defines it, and a name
+        // in neither place resolves to Identity rather than failing.
+        let strings_encrypted = name == "StdCF";
+        prop_assert_eq!(h.encrypts_strings(), strings_encrypted, "/StrF /{} reported {}", name, strings_encrypted);
+
+        let enc = h.encrypt_string(3, 0, &data);
+        if strings_encrypted {
+            prop_assert_ne!(&enc, &data, "/StrF /{} left strings in plain sight", name);
+            prop_assert!(enc.len() > data.len(), "AES always pads: {} bytes of ciphertext for {} plaintext", enc.len(), data.len());
+            prop_assert_eq!(h.decrypt_string(3, 0, &enc), &data[..], "/StrF /{} round trip", name);
+        } else {
+            prop_assert_eq!(&enc, &data, "/StrF /{} must pass strings through", name);
+        }
+
+        // A normal stream follows `/StmF /Identity` here, whatever the string filter says.
+        prop_assert_eq!(&h.encrypt_stream(3, 0, &data, StreamKind::Normal), &data[..], "normal streams follow /StmF Identity");
+        // An embedded file follows `/EFF /StdCF`, so it is encrypted at every length — empty
+        // included, where AES still emits a padded block — and comes back intact.
+        let ef = h.encrypt_stream(3, 0, &data, StreamKind::EmbeddedFile);
+        prop_assert_ne!(&ef, &data[..], "/EFF /StdCF left an embedded file in plain sight at {} bytes", data.len());
+        prop_assert_eq!(h.decrypt_stream(3, 0, &ef, StreamKind::EmbeddedFile), &data[..], "embedded file round trip");
+        // An unknown named filter is Identity, not an error; a known one uses its real method.
+        prop_assert_eq!(&h.encrypt_stream(3, 0, &data, StreamKind::Named(b"Missing")), &data[..], "an unknown crypt filter must not encrypt");
+        prop_assert_ne!(&h.encrypt_stream(3, 0, &data, StreamKind::Named(b"StdCF")), &data[..], "a filter named /StdCF must encrypt");
+    }
+
+    /// Object keys are scoped to the object (Algorithm 1, §7.6.3.3): RC4 and AES-128 fold the
+    /// object number and generation into the key, so another object must not read these bytes back.
+    /// AES-256 is the documented exception — revisions 5 and 6 use the file key for every object.
+    /// The comparisons that decrypt under a foreign number carry the weight: wrong keystream bytes
+    /// match the plaintext only by a chance of one in 256 per byte. Checking that *encryption*
+    /// differs would prove less, because our initial vector already covers `/Num`.
+    #[test]
+    fn object_keys_are_scoped_to_their_object(alg in prop::sample::select(vec![Algorithm::Rc4_40, Algorithm::Rc4_128, Algorithm::Aes128]), data in prop::collection::vec(any::<u8>(), 8..40)) {
+        let h = make(alg, "user", "owner");
+
+        let enc = h.encrypt_string(100, 0, &data);
+        prop_assert_eq!(h.decrypt_string(100, 0, &enc), &data[..], "{:?} reads its own object back", alg);
+        prop_assert_ne!(h.decrypt_string(101, 0, &enc), &data[..], "{:?}: another object number must not decrypt these bytes", alg);
+        prop_assert_ne!(h.decrypt_string(100, 1, &enc), &data[..], "{:?}: another generation must not decrypt these bytes", alg);
+
+        // Algorithm 1 folds the LOW THREE bytes of `/Num` into the key. Two directions are pinned:
+        // numbers that differ inside those three bytes must separate (a fold to `[..2]` would let
+        // object 0 and object 65_536 share a key, silently handing one object's plaintext to another),
+        // and numbers that differ only ABOVE them must share it — the fold is three bytes by design,
+        // so a widening to four would break this and nothing else in the crate notices.
+        let low = h.encrypt_string(0, 0, &data);
+        prop_assert_ne!(&h.decrypt_string(65_536, 0, &low)[..], &data[..], "{:?}: /Num is folded three bytes wide; 0 and 65_536 must not share a key", alg);
+        prop_assert_ne!(&h.decrypt_string(1 << 23, 0, &low)[..], &data[..], "{:?}: the third byte of /Num must still reach the key", alg);
+        prop_assert_eq!(&h.decrypt_string(1 << 24, 0, &low)[..], &data[..], "{:?}: /Num is folded three bytes wide, so a difference above bit 23 shares the key by design", alg);
+
+        let r6 = make(Algorithm::Aes256, "user", "owner");
+        let enc6 = r6.encrypt_string(100, 0, &data);
+        prop_assert_eq!(&r6.decrypt_string(101, 3, &enc6)[..], &data[..], "AES-256 uses the file key for every object (§7.6.3.3)");
+        // ...which is exactly why the initial vector has to vary: revisions 5 and 6 reuse one key
+        // for the whole file, so two objects holding the same bytes must still produce different
+        // ciphertext. Identical bytes for a different `/Num` would be CBC initial-vector reuse —
+        // the flaw that leaks structure in encrypted data.
+        prop_assert_ne!(&r6.encrypt_string(101, 0, &data)[..], &enc6[..], "AES-256 reused the same initial vector for two objects");
+        prop_assert_ne!(&r6.encrypt_string(100, 1, &data)[..], &enc6[..], "AES-256 reused the same initial vector across generations");
+    }
+
+    /// A file created for `user` and `owner` opens for exactly the passwords whose effective bytes
+    /// equal one of theirs, and reports the role that match earned — owner first, since viewers try
+    /// `/O` before `/U`. Everything else is `WrongPassword`: never an opening, and no panic on odd
+    /// Unicode. This is the rule #1185 became (bytes decide, so a soft hyphen alone is no password
+    /// and U+FF21 is "A"), stated for all inputs rather than the three examples in `src/tests.rs`.
+    /// It also pins #1762's upgrade path: a user session gains owner rights on the owner password
+    /// and on nothing else.
+    #[test]
+    fn authentication_accepts_exactly_the_matching_passwords(
+        alg in algorithms(),
+        mut user in passwords(),
+        owner in prop::sample::select(vec!["owner".to_string(), String::new(), "Owner\u{AD}".into(), "\u{FF21}".into()]),
+        extra in passwords(),
+    ) {
+        // `user` may have been grown past the 32-byte cut above; create with that spelling.
+        // Grow the legacy password PAST the 32-byte cut BEFORE the file is built from it, so a
+        // partner differing only beyond byte 32 is the same password to this file.
+        if alg != Algorithm::Aes256 {
+            user = format!("{user}{}", "abcdefghijklmnopqrstuvwxyz0123456789".repeat(2));
+        }
+
+        let h = make(alg, &user, &owner);
+        let d = h.dict().clone();
+        let user_bytes = effective_password(alg, &user);
+        let owner_bytes = owner_target(alg, &user, &owner);
+
+        // A collision engineered by construction, not by luck. Revisions 2-4 cut the password at
+        // 32 bytes (Algorithm 2), so any spelling that agrees on the first 32 is ONE password;
+        // revisions 5-6 run SASLprep, which deletes U+00AD. Growing past byte 32 guarantees the
+        // partner is a different string with identical bytes at every draw — earlier drafts here
+        // claimed `(` alone did it, which is false: appending "(" to a short password DISPLACES the
+        // padding (pad("a") is [61,28,BF..], pad("a(") is [61,28,28,BF..]), and this alphabet draws
+        // at most 11 characters, so chance produced zero legacy collisions in 1,566 measured cases.
+
+        let mut suspects: Vec<String> = vec![user.clone(), owner.clone(), String::new()];
+        // Near misses are PREPENDED: appending to a legacy password already past the cut would be
+        // another collision rather than a refusal, which would silently thin the negative testing.
+        let mut near_misses: Vec<String> = vec![format!("q{user}"), extra.clone()];
+        if alg == Algorithm::Aes256 && !user.is_empty() {
+            near_misses.push(format!("{user}q"));
+        }
+
+        let collision_partner = if alg == Algorithm::Aes256 { format!("{user}\u{AD}") } else { format!("{user}Z") };
+        prop_assert_ne!(&collision_partner[..], &user[..], "the collision partner must be a different string");
+        prop_assert_eq!(effective_password(alg, &collision_partner), effective_password(alg, &user), "{:?}: {:?} must become the same bytes as {:?}", alg, collision_partner, user);
+
+        // The mistake itself, pinned so it cannot come back: a short legacy password plus "(" is NOT the
+        // same password, because it shifts the padding by one byte instead of filling a slot.
+        if alg != Algorithm::Aes256 {
+            prop_assert_ne!(effective_password(alg, "a("), effective_password(alg, "a"), "appending ( to a short password displaces the padding; that is not a collision");
+            prop_assert_eq!(effective_password(alg, &"a".repeat(31)), effective_password(alg, &format!("{}(", "a".repeat(31))), "at exactly 31 characters ( does land in the padding slot, and THAT is a collision");
+        }
+
+        suspects.extend(near_misses);
+        suspects.push(collision_partner.clone());
+        suspects.dedup();
+
+        for suspect in &suspects {
+            let want = expected_auth(alg, &user_bytes, &owner_bytes, suspect);
+            match (want, SecurityHandler::open(d.clone(), ID, Some(suspect))) {
+                (Some(role), Ok(got)) => {
+                    prop_assert_eq!(got.auth(), role, "{:?}: {:?} should open as {:?}", alg, suspect, role);
+                    prop_assert_eq!(got.file_key(), h.file_key(), "{:?}: whichever password opens the file, the key is the same", alg);
+                }
+                (Some(role), Err(e)) => prop_assert!(false, "{:?}: {:?} must open as {:?} but gave {:?}", alg, suspect, role, e),
+                (None, Ok(got)) => prop_assert!(false, "{:?}: {:?} is not a password for this file, yet it opened as {:?}", alg, suspect, got.auth()),
+                (None, Err(CryptError::WrongPassword)) => {}
+                (None, Err(e)) => prop_assert!(false, "{:?}: {:?} gave {}, expected WrongPassword", alg, suspect, e),
+            }
+
+            // The owner password upgrades a user session; nothing else does. When the two share
+            // bytes, `create` gave /O the user's own bytes (revisions 2–4) or left it empty
+            // (AES-256, #1185's sharp edge), so the open password *is* an owner password here.
+            if let Ok(session) = SecurityHandler::open(d.clone(), ID, Some(&user)) {
+                let is_owner_password = expected_auth(alg, &user_bytes, &owner_bytes, suspect) == Some(Auth::Owner);
+                let upgrade = session.authenticate_owner(ID, suspect).map(|u| u.auth());
+                if is_owner_password {
+                    prop_assert_eq!(upgrade, Ok(Auth::Owner), "{:?}: {:?} must unlock owner rights", alg, suspect);
+                } else {
+                    prop_assert_eq!(upgrade, Err(CryptError::WrongPassword), "{:?}: {:?} must not grant owner rights", alg, suspect);
+                }
+            }
+        }
+
+        // `None` means no password was offered: the handler tries the empty string, and nothing
+        // else (a file with a real open password never opens silently).
+        let want_none = expected_auth(alg, &user_bytes, &owner_bytes, "");
+        match (want_none, SecurityHandler::open(d.clone(), ID, None)) {
+            (Some(role), Ok(got)) => prop_assert_eq!(got.auth(), role, "{:?}: no password opened as {:?}", alg, got.auth()),
+            (None, Ok(got)) => prop_assert!(false, "{:?}: the empty password is not valid, yet no password opened as {:?}", alg, got.auth()),
+            (Some(role), Err(e)) => prop_assert!(false, "{:?}: the empty password should open as {:?} but gave {:?}", alg, role, e),
+            (None, Err(CryptError::WrongPassword)) => {}
+            (None, Err(e)) => prop_assert!(false, "{:?}: no password gave {}, expected WrongPassword", alg, e),
+        }
+    }
+
+    /// The AES-CBC and RC4 primitives taken directly: a damaged file's `/Length` and crypt filters
+    /// hand them keys and data of shapes `create` would never build, so they must invert each other
+    /// for any key length (`Cipher::new` takes AES-256 at 32 bytes and zero-padded AES-128 below
+    /// it, identically on both sides of the trip) and every payload length.
+    #[test]
+    fn primitives_are_invertible_for_any_key_and_length(
+        key in prop::collection::vec(any::<u8>(), 1..40),
+        data in payloads(),
+        iv in prop::collection::vec(any::<u8>(), 16..24),
+    ) {
+        let iv: [u8; 16] = *iv.as_slice().first_chunk::<16>().expect("the iv strategy draws at least 16 bytes; a silent zero fallback would hide a generator change");
+
+        let enc = aes_cbc_encrypt(&key, &iv, &data, true);
+        prop_assert_eq!(aes_cbc_decrypt(&key, &iv, &enc, true), &data[..], "padded AES round trip at {} bytes", data.len());
+        prop_assert!(enc.len() >= 16 && enc.len().is_multiple_of(16), "PKCS#5 makes whole blocks: {} bytes for {} plaintext", enc.len(), data.len());
+
+        // Without padding, a partial block is zero-padded rather than refused, and extra trailing
+        // bytes decrypt to more output instead of being dropped.
+        let raw = aes_cbc_encrypt(&key, &iv, &data, false);
+        prop_assert_eq!(raw.len(), data.len().div_ceil(16) * 16, "unpadded AES output is whole blocks");
+        let mut longer = raw.clone();
+        longer.extend_from_slice(b"0123456789abcdef");
+        prop_assert_eq!(aes_cbc_decrypt(&key, &iv, &longer, false).len(), raw.len() + 16, "a whole extra block decrypts to a whole extra block");
+
+        // RC4 undoes itself at every length; an empty key encrypts nothing, which is why the
+        // handler never derives an empty object key.
+        prop_assert_eq!(rc4(&key, &rc4(&key, &data)), &data[..], "RC4 round trip at {} bytes", data.len());
+        prop_assert_eq!(rc4(&[], &data), &data[..], "an empty RC4 key passes bytes through");
+    }
+
+    /// `/Perms` certifies the permission bits and `/EncryptMetadata`: decrypted with the file key it
+    /// must hold `/P` little-endian, four set bytes, 'T' or 'F', and the `adb` sentinel (Algorithm 10).
+    /// Nothing else in this crate reads it — `cos` writes it out and no code takes it back apart — so
+    /// without this property a flipped metadata byte would tell every other viewer the wrong thing about
+    /// our own file while all our tests stayed green. The older revisions we create emit no `/Perms`
+    /// at all, which is recorded here as well so a change in what goes out shows up rather than
+    /// shipping quietly.
+    #[test]
+    fn perms_value_agrees_with_the_permissions_it_certifies(permissions in any::<i32>(), encrypt_metadata in any::<bool>()) {
+        let h = create(
+            &NewEncryption { algorithm: Algorithm::Aes256, user_password: "user", owner_password: "owner", permissions, encrypt_metadata, seed: [0x5e; 32] },
+            ID,
+        )
+        .unwrap();
+
+        prop_assert_eq!(h.dict().perms.len(), 16, "/Perms is one encrypted block");
+        let open = aes_cbc_decrypt(h.file_key(), &[0u8; 16], &h.dict().perms, false);
+
+        // Bits 1-2 clear and the reserved bits set (§7.6.4.2 Table 22) is what `/P` must say, and the
+        // encrypted certificate has to repeat it byte for byte.
+        let normalised = (permissions | !0xFFF | 0xC0) & !0x3;
+        prop_assert_eq!(&open[..4], &normalised.to_le_bytes(), "/Perms must carry /P");
+        prop_assert_eq!(h.dict().p, normalised, "the /P written must match the permission bits drawn");
+        prop_assert_eq!(&open[4..8], &[0xFF; 4], "the four bytes following /P are set");
+        prop_assert_eq!(open[8], if encrypt_metadata { b'T' } else { b'F' }, "/Perms must report /EncryptMetadata");
+        prop_assert_eq!(&open[9..12], b"adb", "the adb sentinel must be present");
+
+        // A user session's answers come from those same bits, not from the owner shortcut.
+        let as_user = SecurityHandler::open(h.dict().clone(), ID, Some("user")).unwrap();
+        prop_assert_eq!(as_user.permissions().print(), normalised & 0b100 != 0, "/P bit 3 decides printing");
+        prop_assert_eq!(as_user.permissions().copy(), normalised & 0b1_0000 != 0, "/P bit 5 decides copying");
+        prop_assert!(!as_user.permissions().owner, "the user password must not report owner rights");
+
+        // Bytes 13-16 of /Perms are the non-repeating filler. Nothing reads them, so pinning that
+        // they move with the seed is the only way to notice a producer that freezes them at zero.
+        let other = create(
+            &NewEncryption { algorithm: Algorithm::Aes256, user_password: "user", owner_password: "owner", permissions, encrypt_metadata, seed: [0x11; 32] },
+            ID,
+        )
+        .unwrap();
+        let open_other = aes_cbc_decrypt(other.file_key(), &[0u8; 16], &other.dict().perms, false);
+        prop_assert_ne!(&open[12..16], &open_other[12..16], "the four filler bytes of /Perms must follow the seed, not sit constant");
+
+        // Revisions below 5 carry no /Perms; pinned so the boundary of what we emit is explicit.
+        for older in [Algorithm::Rc4_40, Algorithm::Rc4_128, Algorithm::Aes128] {
+            let legacy = make(older, "user", "owner");
+            prop_assert!(legacy.dict().perms.is_empty(), "{:?} must emit no /Perms", older);
+        }
+    }
+    /// Revisions 4 mix four set bytes into every file key when `/EncryptMetadata` is false (Algorithm
+    /// 2, step f), so the same password over the same `/ID` must produce a *different* key than when
+    /// metadata is encrypted. Every other test in this crate builds `encrypt_metadata: true` only,
+    /// which is exactly why that step is reachable but never walked: switching it off entirely changed
+    /// nothing any test could see. This also records the rule that revisions below 4 always encrypt
+    /// metadata whatever was asked, so the boundary between the two is named rather than assumed.
+    #[test]
+    fn metadata_flag_changes_the_key_it_claims_to_change(data in payloads()) {
+        let build = |encrypt_metadata: bool| {
+            create(&NewEncryption { algorithm: Algorithm::Aes128, user_password: "user", owner_password: "owner", permissions: -1, encrypt_metadata, seed: [0x5e; 32] }, ID).unwrap()
+        };
+        let (yes, no) = (build(true), build(false));
+
+        // Algorithm 2, step f: revisions 4 hash four set bytes into every key when metadata stays
+        // plain, so two files with identical passwords and the same /ID cannot share a key.
+        prop_assert_ne!(yes.file_key(), no.file_key(), "R4 must fold four set bytes into the key when /EncryptMetadata is false (Algorithm 2, step f)");
+        prop_assert_eq!(no.dict().encrypt_metadata, false, "the flag must reach the dictionary");
+        prop_assert!(!no.encrypts_metadata(), "/EncryptMetadata false must report itself honestly");
+        prop_assert!(yes.encrypts_metadata(), "and true must report true");
+
+        // Both still open on the same password and round trip at every length: a derivation that
+        // drifted would show up as an unreadable file rather than passing quietly.
+        for h in [&yes, &no] {
+            let open = SecurityHandler::open(h.dict().clone(), ID, Some("user")).unwrap();
+            prop_assert_eq!(open.file_key(), h.file_key(), "the user password must still derive this file's key");
+            let enc = h.encrypt_string(7, 0, &data);
+            prop_assert_eq!(&open.decrypt_string(7, 0, &enc)[..], &data[..], "round trip at {} bytes", data.len());
+        }
+
+        // And the two files must not read each other's content: different keys, different plaintext.
+        if data.len() >= 8 {
+            prop_assert_ne!(&yes.decrypt_string(7, 0, &no.encrypt_string(7, 0, &data))[..], &data[..], "a key built for plain metadata must not decrypt a file whose keys encrypt it");
+        }
+
+        // Revisions below 4 always encrypt metadata, whatever the caller asked for.
+        let legacy = create(&NewEncryption { algorithm: Algorithm::Rc4_128, user_password: "user", owner_password: "owner", permissions: -1, encrypt_metadata: false, seed: [0x5e; 32] }, ID).unwrap();
+        prop_assert!(legacy.dict().encrypt_metadata && legacy.encrypts_metadata(), "V<4 always encrypts metadata, as create() documents");
+    }
+
+}
diff --git a/crates/edit/src/added.rs b/crates/edit/src/added.rs
index 9f13047b0..d246df725 100644
--- a/crates/edit/src/added.rs
+++ b/crates/edit/src/added.rs
@@ -11,10 +11,12 @@
 use std::collections::{HashMap, HashSet};
 
 use pdfcraft_cos::{Dict, Document, ObjRef, Object, PdfString, Stream};
-use pdfcraft_fonts::{GlyphError, GlyphOutline, ShapedCluster, ShapedScript, Std14, literal, shape_arabic, shape_thai, shaped_glyph, win_ansi};
+use pdfcraft_fonts::{
+    GlyphError, GlyphOutline, ShapedCluster, ShapedScript, Std14, literal, shape_arabic, shape_hebrew, shape_thai, shaped_glyph, win_ansi,
+};
 use unicode_bidi::{Level, ParagraphBidiInfo};
 
-use crate::{EditError, MarkKind, check, contents, n, page_list, place_tagged};
+use crate::{EditError, MarkKind, check, contents, matrix_number, n, page_list, place_tagged};
 
 const TAG: &str = "Added";
 
@@ -239,27 +241,28 @@ fn wrapped(t: &AddedText) -> Vec<(String, bool)> {
     let width = (t.rect[2] - t.rect[0]).max(t.size);
     let mut out = Vec::new();
     for para in t.text.split('\n') {
-        let arabic = para.chars().any(is_arabic);
+        // Arabic or Hebrew: laid out with the bidirectional algorithm and shaped.
+        let rtl_script = para.chars().any(|c| is_arabic(c) || is_hebrew(c));
         let thai = para.chars().any(is_thai);
         if thai
-            && !arabic
+            && !rtl_script
             && let Ok(lines) = thai_lines(t, para, width)
         {
             out.extend(lines.into_iter().map(|line| (line, false)));
             continue;
         }
-        let rtl = arabic && unicode_bidi::get_base_direction(para) == unicode_bidi::Direction::Rtl;
+        let rtl = rtl_script && unicode_bidi::get_base_direction(para) == unicode_bidi::Direction::Rtl;
         // Arabic words are shaped one by one (joining stops at spaces), so a line's width is the
         // sum of its words' and shaping stays linear in the paragraph's length. The space is the
         // paragraph's; a space between Latin words is drawn in the item's font, a few hundredths
         // of an em apart.
-        let measure = |s: &str| if arabic || thai { shaped_width(t, s, rtl) } else { t.family.width(s, t.size, t.bold, t.italic) };
+        let measure = |s: &str| if rtl_script || thai { shaped_width(t, s, rtl) } else { t.family.width(s, t.size, t.bold, t.italic) };
         let space = measure(" ");
         let (mut line, mut line_w) = (String::new(), 0.0);
         for word in para.split(' ') {
             let candidate = if line.is_empty() { word.to_string() } else { format!("{line} {word}") };
             let candidate_w =
-                if arabic || thai { if line.is_empty() { measure(word) } else { line_w + space + measure(word) } } else { measure(&candidate) };
+                if rtl_script || thai { if line.is_empty() { measure(word) } else { line_w + space + measure(word) } } else { measure(&candidate) };
             if !line.is_empty() && candidate_w > width {
                 out.push((std::mem::take(&mut line), rtl));
                 line = word.to_string();
@@ -313,9 +316,16 @@ fn is_arabic(c: char) -> bool {
     matches!(u32::from(c), 0x0600..=0x06FF | 0x0750..=0x077F | 0x0870..=0x08FF | 0xFB50..=0xFDFF | 0xFE70..=0xFEFC)
 }
 
+/// Hebrew letters, points, cantillation marks and punctuation (and the presentation forms): an
+/// item with any of them is drawn with the craft-fonts Hebrew face.
+fn is_hebrew(c: char) -> bool {
+    matches!(u32::from(c), 0x0591..=0x05F4 | 0xFB1D..=0xFB4F)
+}
+
 /// The first character of `t` that would be drawn as `?`: outside WinAnsiEncoding and not drawn
-/// with the craft-fonts Arabic face (#125), or Arabic that the face can't draw (or that has no
-/// face to draw it). Page-content tools refuse such text; the Add-text editor keeps it open.
+/// with the craft-fonts Arabic (#125) or Hebrew (#128) face, or Arabic or Hebrew that the face can't
+/// draw (or that has no face to draw it). Page-content tools refuse such text; the Add-text editor
+/// keeps it open.
 pub fn first_undrawable(t: &AddedText) -> Option<char> {
     if t.text.chars().any(is_thai) {
         if let Some(c) = t.text.chars().find(|c| is_thai(*c) && !pdfcraft_fonts::thai_has(*c)) {
@@ -324,11 +334,13 @@ pub fn first_undrawable(t: &AddedText) -> Option<char> {
         let rest = AddedText { text: t.text.chars().filter(|c| !is_thai(*c)).collect(), ..t.clone() };
         return first_undrawable(&rest);
     }
-    // Arabic that nothing can draw: there's no face, or the face lacks it.
-    if let Some(c) = t.text.chars().find(|c| shaped_arabic(*c) && !pdfcraft_fonts::arabic_has(*c)) {
+    // Arabic or Hebrew that nothing can draw: there's no face, or the face lacks it.
+    if let Some(c) =
+        t.text.chars().find(|c| (shaped_arabic(*c) && !pdfcraft_fonts::arabic_has(*c)) || (is_hebrew(*c) && !pdfcraft_fonts::hebrew_has(*c)))
+    {
         return Some(c);
     }
-    if pdfcraft_fonts::document_arabic_font().is_none() || !t.text.chars().any(is_arabic) {
+    if !shaped_by_a_face(t) {
         // Drawn line by line in the item's standard font (`\n` splits lines). Without the face
         // that is also how `draw` redraws an existing item, so it's checked that way.
         return t.text.split('\n').find_map(pdfcraft_fonts::first_non_win_ansi);
@@ -343,6 +355,13 @@ pub fn first_undrawable(t: &AddedText) -> Option<char> {
     })
 }
 
+/// Whether `t` has Arabic or Hebrew that its craft-fonts face draws (so `draw` lays it out with
+/// [`draw_shaped`]).
+fn shaped_by_a_face(t: &AddedText) -> bool {
+    (pdfcraft_fonts::document_arabic_font().is_some() && t.text.chars().any(is_arabic))
+        || (pdfcraft_fonts::document_hebrew_font(false).is_some() && t.text.chars().any(is_hebrew))
+}
+
 /// An Arabic character the face shapes and draws (U+061C, a direction mark, is dropped).
 fn shaped_arabic(c: char) -> bool {
     is_arabic(c) && !is_bidi_control(c)
@@ -391,12 +410,16 @@ fn shaped_layout(t: &AddedText, line: &str, rtl: bool) -> Result<(Vec<Piece>, f6
         let run_rtl = levels.get(run.start).is_some_and(Level::is_rtl);
         // Runs lie on character boundaries; a missing slice is skipped, never a panic.
         let Some(text) = line.get(run) else { continue };
-        // Arabic letters take the Arabic face; so do spaces and punctuation between them, which the
-        // shaper then mirrors. Latin text (and what the face lacks) keeps the item's font.
+        // Arabic and Hebrew letters take their face; so do spaces and punctuation between them
+        // (Hebrew's when they follow Hebrew), which the shaper then mirrors. Latin text (and what
+        // the faces lack) keeps the item's font.
         let mut segments: Vec<(Option<ShapedScript>, String)> = Vec::new();
         for c in text.chars().filter(|c| !is_bidi_control(*c)) {
+            let after_hebrew = segments.last().is_some_and(|(kind, _)| *kind == Some(ShapedScript::Hebrew));
             let script = if is_thai(c) {
                 Some(ShapedScript::Thai)
+            } else if is_hebrew(c) || (run_rtl && after_hebrew && !c.is_alphanumeric() && pdfcraft_fonts::hebrew_has(c)) {
+                Some(ShapedScript::Hebrew)
             } else if is_arabic(c) || (run_rtl && !c.is_alphanumeric() && pdfcraft_fonts::arabic_has(c)) {
                 Some(ShapedScript::Arabic)
             } else {
@@ -414,6 +437,7 @@ fn shaped_layout(t: &AddedText, line: &str, rtl: bool) -> Result<(Vec<Piece>, f6
             pieces.push(if let Some(script) = script {
                 let shaped = match script {
                     ShapedScript::Arabic => shape_arabic(&s, run_rtl).map_err(|e| arabic_error(e, &s))?,
+                    ShapedScript::Hebrew => shape_hebrew(&s, run_rtl).map_err(|e| hebrew_error(e, &s))?,
                     ShapedScript::Thai => shape_thai(&s).map_err(|e| thai_error(e, &s))?,
                 };
                 Piece::Shaped(shaped)
@@ -450,6 +474,16 @@ fn arabic_error(e: GlyphError, text: &str) -> EditError {
     })
 }
 
+fn hebrew_error(e: GlyphError, text: &str) -> EditError {
+    EditError::Invalid(match e {
+        GlyphError::NoFont => "Hebrew text needs PdfCraft's Hebrew font, which this build doesn't include \
+                               (to build it in, set CRAFT_FONTS_DIR to a craft-fonts checkout that has a Hebr face)"
+            .into(),
+        GlyphError::Missing => format!("the Hebrew font can't show \"{text}\""),
+        GlyphError::TooComplex => format!("the Hebrew font's glyphs for \"{text}\" are too complex"),
+    })
+}
+
 fn thai_error(e: GlyphError, text: &str) -> EditError {
     EditError::Invalid(match e {
         GlyphError::NoFont => {
@@ -467,6 +501,11 @@ pub fn text_rect(t: &AddedText) -> [f64; 4] {
     [r[0], r[3] - h, r[2], r[3]]
 }
 
+/// The widest explicit line before wrapping, measured with the PDF writing fonts.
+pub fn text_width(t: &AddedText) -> f64 {
+    t.text.split('\n').map(|line| shaped_width(t, line, unicode_bidi::get_base_direction(line) == unicode_bidi::Direction::Rtl)).fold(0.0, f64::max)
+}
+
 fn font_name(base: &str) -> String {
     format!("PCF{}", base.replace('-', ""))
 }
@@ -479,7 +518,7 @@ const GLYPHS_PER_FONT: usize = 240;
 /// its pieces in drawing order and its width at the item's size.
 type LaidLine = (String, bool, Vec<Piece>, f64);
 
-/// Draw a text item that has Arabic or Thai in it. Each line is laid out in display order; Arabic glyphs
+/// Draw a text item that has Arabic, Hebrew or Thai in it. Each line is laid out in display order; their glyphs
 /// come from Type 3 fonts drawn from the craft-fonts face's outlines (no font file is embedded),
 /// with a ToUnicode map for copy and search. Other text uses the item's standard font.
 fn draw_shaped(doc: &mut Document, t: &AddedText, taken: &Dict, fonts: &mut Dict, out: &mut Vec<u8>) -> Result<(), EditError> {
@@ -524,6 +563,7 @@ fn draw_laid_shaped(
             if let std::collections::hash_map::Entry::Vacant(entry) = outlines.entry((c.script, *id)) {
                 entry.insert(outline(c.script, *id).map_err(|e| match c.script {
                     ShapedScript::Arabic => arabic_error(e, &c.text),
+                    ShapedScript::Hebrew => hebrew_error(e, &c.text),
                     ShapedScript::Thai => thai_error(e, &c.text),
                 })?);
             }
@@ -663,6 +703,7 @@ fn type3_shaped(doc: &mut Document, clusters: &[&ShapedCluster], outlines: &Hash
         Some(script) => script.font().map_or(
             match script {
                 ShapedScript::Arabic => "Arabic",
+                ShapedScript::Hebrew => "Hebrew",
                 ShapedScript::Thai => "Thai",
             },
             |f| f.family,
@@ -697,11 +738,21 @@ fn type3_shaped(doc: &mut Document, clusters: &[&ShapedCluster], outlines: &Hash
 }
 
 /// Content and resources for an item; `view` maps display space to user space. `taken` holds the
-/// page's font names. `existing`: the item is being replaced, so a build without the Arabic face
-/// keeps drawing its Arabic as `?`, as before Arabic was supported, rather than refusing to move it.
+/// page's font names. `existing`: the item is being replaced, so a build without the Arabic or
+/// Hebrew face keeps drawing that text as `?`, as before it was supported, rather than refusing to
+/// move it.
 fn draw(doc: &mut Document, c: &Content, view: [f64; 6], taken: &Dict, existing: bool) -> Result<(Vec<u8>, Dict), EditError> {
     let mut res = Dict::new();
-    let mut out = format!("q {} {} {} {} {} {} cm\n", n(view[0]), n(view[1]), n(view[2]), n(view[3]), n(view[4]), n(view[5])).into_bytes();
+    let mut out = format!(
+        "q {} {} {} {} {} {} cm\n",
+        matrix_number(view[0]),
+        matrix_number(view[1]),
+        matrix_number(view[2]),
+        matrix_number(view[3]),
+        matrix_number(view[4]),
+        matrix_number(view[5])
+    )
+    .into_bytes();
     match c {
         Content::Text(t) => {
             let base = t.family.base_font(t.bold, t.italic);
@@ -715,7 +766,11 @@ fn draw(doc: &mut Document, c: &Content, view: [f64; 6], taken: &Dict, existing:
             }
             let mut fonts = Dict::new();
             fonts.set(name.clone().into_bytes(), Object::Dict(font));
-            if t.text.chars().any(is_thai) || (t.text.chars().any(is_arabic) && (pdfcraft_fonts::document_arabic_font().is_some() || !existing)) {
+            let face_or_new = |has: fn(char) -> bool, face: bool| t.text.chars().any(has) && (face || !existing);
+            if t.text.chars().any(is_thai)
+                || face_or_new(is_arabic, pdfcraft_fonts::document_arabic_font().is_some())
+                || face_or_new(is_hebrew, pdfcraft_fonts::document_hebrew_font(false).is_some())
+            {
                 draw_shaped(doc, t, taken, &mut fonts, &mut out)?;
                 res.set(b"Font".to_vec(), Object::Dict(fonts));
                 out.extend_from_slice(b"Q\n");
diff --git a/crates/edit/src/flatten.rs b/crates/edit/src/flatten.rs
index a3f6c886a..8202c18d8 100644
--- a/crates/edit/src/flatten.rs
+++ b/crates/edit/src/flatten.rs
@@ -6,7 +6,8 @@
 //! the appearance's bounding box, transformed by its `/Matrix`, mapped onto `/Rect`). Hidden
 //! annotations are left alone; links are kept (they have no ink and stay clickable). Flattened
 //! comments take their pop-ups and replies with them; flattened widgets are removed from the
-//! form's field tree.
+//! form's field tree. An annotation whose appearance cannot be drawn is not flattened: it stays
+//! as it is, so no comment or field value is lost with nothing in its place.
 
 use std::collections::HashSet;
 
@@ -154,6 +155,8 @@ fn flatten_which(doc: &mut Document, pages: &[usize], which: Which) -> Result<us
             .unwrap_or_default();
         let mut gone: HashSet<ObjRef> = HashSet::new();
         let mut gone_inline: HashSet<usize> = HashSet::new();
+        // Selected, but nothing was drawn for it: it stays, pop-up and reply handling included.
+        let mut undrawn: HashSet<ObjRef> = HashSet::new();
         // A viewer draws many comments from their dictionary even when the file stores no
         // appearance (notes, FreeText, ink, stamps…). Build the appearance it would show, so
         // flattening keeps a comment that still has ink on screen instead of deleting it.
@@ -199,9 +202,18 @@ fn flatten_which(doc: &mut Document, pages: &[usize], which: Which) -> Result<us
             }
             // A comment whose ink was not written into the page stays. Removing it would drop
             // the annotation (a cloudy square this builder cannot draw, for example) with nothing
-            // left on the page. Widgets are form fields: flattening still removes them.
-            if !widget && !drew {
-                continue;
+            // left on the page. A widget stays when it has no appearance to draw at all (none
+            // stored, or none for its selected state): removing it would lose the field's value
+            // with nothing in its place (#1794). One whose appearance draws nothing (an empty
+            // stream) shows nothing anywhere, so flattening still removes it.
+            if !drew {
+                let no_appearance = appearance(doc, d).is_none();
+                if no_appearance && let Some(r) = entry.as_ref() {
+                    undrawn.insert(r);
+                }
+                if !widget || no_appearance {
+                    continue;
+                }
             }
             match entry.as_ref() {
                 Some(r) => {
@@ -218,9 +230,13 @@ fn flatten_which(doc: &mut Document, pages: &[usize], which: Which) -> Result<us
         if gone.is_empty() && gone_inline.is_empty() {
             continue;
         }
-        // Pop-ups and replies of what was flattened go too.
+        // Pop-ups and replies of what was flattened go too, except a reply that stayed because
+        // it could not be drawn: its content would go with nothing in its place.
         for entry in &list {
             let Some(r) = entry.as_ref() else { continue };
+            if undrawn.contains(&r) {
+                continue;
+            }
             let obj = doc.get(r);
             let Some(d) = obj.as_dict() else { continue };
             let points_at = |k: &[u8]| d.reference(k).is_some_and(|t| gone.contains(&t));
diff --git a/crates/edit/src/images.rs b/crates/edit/src/images.rs
index 85ae6b391..fb6212588 100644
--- a/crates/edit/src/images.rs
+++ b/crates/edit/src/images.rs
@@ -372,6 +372,10 @@ pub fn reading_images(doc: &Document, page: usize) -> Result<Vec<PageImage>, Edi
 pub enum ImageChange {
     /// Apply a user-space transform after its placement (move, resize, rotate, flip).
     Transform([f64; 6]),
+    /// Show only this part of it (a box in user space): a clipping path around the drawing,
+    /// inside its own scope so a later move or resize carries it along. The pixels stay where
+    /// they are; nothing is scaled.
+    Crop([f64; 4]),
     /// Draw this image XObject instead, in the same place.
     Replace(ObjRef),
     Delete,
@@ -420,6 +424,19 @@ fn exclusive_clip(ops: &[Op], op: usize) -> Option<(usize, Matrix)> {
     Some((at, Matrix(ops.get(at + 3)?.nums::<6>()?)))
 }
 
+/// The `q cm … Q` whose only content after its `cm` is `start..=end` (a `Do`, or a balanced
+/// `q … Q` scope), with the index and value of that `cm`. Another transform of the same
+/// placement is folded into it, so repeated moves and resizes don't nest one more `q` each.
+fn enclosing_transform(ops: &[Op], start: usize, end: usize) -> Option<(usize, Matrix)> {
+    let at = start.checked_sub(1)?;
+    let cm = ops.get(at)?;
+    if !ops.get(at.checked_sub(1)?)?.is("q") || !ops.get(end.checked_add(1)?)?.is("Q") || !cm.is("cm") || cm.operands.len() != 6 {
+        return None;
+    }
+    let m = Matrix(cm.nums::<6>()?);
+    m.0.iter().all(|v| v.is_finite()).then_some((at, m))
+}
+
 /// The `cm` to put before the clip so that user-space transform `t` also moves the clip:
 /// the clip is drawn in the CTM before the image's own `cm` (`cm` · that = `draw`).
 fn clip_matrix(draw: Matrix, cm: Matrix, t: Matrix) -> Option<Matrix> {
@@ -444,6 +461,9 @@ pub fn change_image(doc: &mut Document, page: usize, index: usize, change: &Imag
         ImageChange::Transform(t) => {
             return transform_image(doc, &p, &all, &img, *t);
         }
+        ImageChange::Crop(keep) => {
+            return crop_image(doc, &p, &all, &img, *keep);
+        }
         ImageChange::Replace(r) => {
             if img.is_form {
                 return Err(EditError::Invalid(
@@ -603,6 +623,20 @@ fn transform_image(
     if !local.0.iter().all(|v| v.is_finite() && v.abs() <= 1e12) {
         return Err(EditError::Invalid("the image transform is too large".into()));
     }
+    // Already alone in a `q cm … Q` (its own placement, or the wrapper an earlier edit added):
+    // change that `cm` in place. The CTM inside is `local · cm · outer` either way.
+    if let Some((at, cm)) = enclosing_transform(&ops, start, end) {
+        let folded = local.then(&cm);
+        if !folded.0.iter().all(|v| v.is_finite() && v.abs() <= 1e12) {
+            return Err(EditError::Invalid("the image transform is too large".into()));
+        }
+        let changed = crate::text::splice(&pieces, &ops, |index| {
+            if index == at { (vec![Op::new("cm", folded.0.map(Object::Real).to_vec())], false) } else { (Vec::new(), true) }
+        });
+        let contents = crate::text::rewritten_contents(doc, streams, changed);
+        doc.update_dict(page.obj, |d| d.set(b"Contents".to_vec(), contents))?;
+        return Ok(());
+    }
     let changed = crate::text::splice(&pieces, &ops, |index| {
         if index == start {
             let mut out = vec![Op::new("q", vec![]), Op::new("cm", local.0.map(Object::Real).to_vec())];
@@ -625,6 +659,86 @@ fn transform_image(
     Ok(())
 }
 
+/// Crop: clip the image's drawing to `keep` (user space). The clip goes just inside the scope
+/// that holds the image and its private crop (or a new `q … Q` around the `Do`), written in
+/// that scope's coordinates as the box's four corners, so a turned image crops to an upright
+/// box too and a later transform of the scope moves the crop with the pixels.
+fn crop_image(
+    doc: &mut Document,
+    page: &pdfcraft_model::Page,
+    streams: &[(Object, Vec<u8>)],
+    image: &PageImage,
+    keep: [f64; 4],
+) -> Result<(), EditError> {
+    if !keep.iter().all(|v| v.is_finite() && v.abs() <= 1e12) {
+        return Err(EditError::Invalid("the crop box must be finite and no larger than 1e12".into()));
+    }
+    let [x0, y0, x1, y1] = [keep[0].min(keep[2]), keep[1].min(keep[3]), keep[0].max(keep[2]), keep[1].max(keep[3])];
+    if x1 - x0 < 1e-6 || y1 - y0 < 1e-6 {
+        return Err(EditError::Invalid("the crop box has no area".into()));
+    }
+    let mut offset = 0_usize;
+    for (_, data) in streams.iter().take(image.stream) {
+        offset = offset
+            .checked_add(data.len())
+            .and_then(|n| n.checked_add(1))
+            .ok_or_else(|| EditError::Invalid("the image content is too large".into()))?;
+    }
+    let data = streams.get(image.stream).ok_or_else(|| EditError::Invalid("the image stream is missing".into()))?;
+    let op = parse(&data.1).ops.get(image.op).cloned().ok_or_else(|| EditError::Invalid("the image operation is missing".into()))?;
+    let span = offset.checked_add(op.span.start).ok_or_else(|| EditError::Invalid("the image content is too large".into()))?;
+    let pieces = pdfcraft_content::Pieces::join(&streams.iter().map(|(_, data)| data.as_slice()).collect::<Vec<_>>());
+    let ops = pieces.parse().ops;
+    let target = ops
+        .iter()
+        .position(|op| op.span.start == span && op.is("Do"))
+        .ok_or_else(|| EditError::Invalid("the image operation could not be located".into()))?;
+    let (start, end, placement) = image_transform_scope(&ops, target)?.unwrap_or((target, target, Matrix(image.draw_matrix)));
+    let inverse = placement.invert().ok_or_else(|| EditError::Invalid("the image has no area".into()))?;
+    let corners = [(x0, y0), (x1, y0), (x1, y1), (x0, y1)].map(|(x, y)| inverse.apply(x, y));
+    if !corners.iter().all(|(x, y)| x.is_finite() && y.is_finite() && x.abs() <= 1e12 && y.abs() <= 1e12) {
+        return Err(EditError::Invalid("the crop box is too large for the image's placement".into()));
+    }
+    let clip: Vec<Op> = corners
+        .iter()
+        .enumerate()
+        .map(|(i, (x, y))| Op::new(if i == 0 { "m" } else { "l" }, vec![Object::Real(*x), Object::Real(*y)]))
+        .chain([Op::new("h", vec![]), Op::new("W", vec![]), Op::new("n", vec![])])
+        .collect();
+    // The image's own earlier crop (a clipping path right after the scope's `q`) gives way to
+    // the new one, so a crop can grow again as well as shrink.
+    let old_clip: Option<std::ops::Range<usize>> = (start != end)
+        .then(|| {
+            let mut k = start + 1;
+            while ops.get(k).is_some_and(|o| matches!(o.op.as_slice(), b"m" | b"l" | b"c" | b"v" | b"y" | b"h" | b"re")) {
+                k += 1;
+            }
+            (k > start + 1 && ops.get(k).is_some_and(|o| matches!(o.op.as_slice(), b"W" | b"W*")) && ops.get(k + 1).is_some_and(|o| o.is("n")))
+                .then_some(start + 1..k + 2)
+        })
+        .flatten();
+    let changed = crate::text::splice(&pieces, &ops, |index| {
+        if start == end && index == target {
+            // No scope of its own yet: one around the drawing, with the crop inside.
+            let mut out = vec![Op::new("q", vec![])];
+            out.extend(clip.iter().cloned());
+            out.extend(ops.get(index).cloned());
+            out.push(Op::new("Q", vec![]));
+            (out, false)
+        } else if start != end && index == start + 1 {
+            // Inside the scope's `q`, before whatever it draws (in place of its old crop).
+            (clip.clone(), old_clip.is_none())
+        } else if old_clip.as_ref().is_some_and(|r| r.contains(&index)) {
+            (Vec::new(), false)
+        } else {
+            (Vec::new(), true)
+        }
+    });
+    let contents = crate::text::rewritten_contents(doc, streams, changed);
+    doc.update_dict(page.obj, |d| d.set(b"Contents".to_vec(), contents))?;
+    Ok(())
+}
+
 /// Plan all transforms before changing a stream; indexes refer to the original inventory.
 /// Splice only the chosen Do operators and preserve all other bytes and stream dictionaries.
 pub(crate) fn translate_images(doc: &mut Document, page: usize, indexes: &[usize], offset: [f64; 2]) -> Result<(), EditError> {
@@ -672,10 +786,25 @@ pub(crate) fn translate_images(doc: &mut Document, page: usize, indexes: &[usize
             plans.remove(&(stream, index));
             clips.insert((stream, at), c);
         }
+        // An image already alone in `q cm Do Q` moves by changing that `cm`, not by nesting another.
+        let mut folds = std::collections::BTreeMap::new();
+        for index in 0..ops.len() {
+            let Some(&(movement, _, _)) = plans.get(&(stream, index)) else { continue };
+            let Some((at, cm)) = enclosing_transform(&ops, index, index) else { continue };
+            let folded = movement.then(&cm);
+            if !folded.0.iter().all(|v| v.is_finite() && v.abs() <= 1e12) {
+                return Err(EditError::Invalid("the image move is too large".into()));
+            }
+            plans.remove(&(stream, index));
+            folds.insert(at, folded);
+        }
         let changed = crate::text::splice(&pieces, &ops, |index| {
             if let Some(c) = clips.remove(&(stream, index)) {
                 return (vec![Op::new("cm", c.0.map(Object::Real).to_vec())], true);
             }
+            if let Some(m) = folds.remove(&index) {
+                return (vec![Op::new("cm", m.0.map(Object::Real).to_vec())], false);
+            }
             let Some((matrix, _, _)) = plans.remove(&(stream, index)) else { return (Vec::new(), true) };
             let original = ops.get(index).cloned().into_iter();
             // Local translations can be tiny under a large CTM. Preserve their precision
diff --git a/crates/edit/src/lib.rs b/crates/edit/src/lib.rs
index d92f28405..515f17d8d 100644
--- a/crates/edit/src/lib.rs
+++ b/crates/edit/src/lib.rs
@@ -73,6 +73,17 @@ impl Default for HeaderFooter {
     }
 }
 
+impl HeaderFooter {
+    /// The first character [`add_header_footer`] would refuse, because the standard fonts can't
+    /// draw it (#125). Tokens only add ASCII (Bates prefixes and suffixes are part of the
+    /// template), so checking the templates, split as `expand`'s output is, covers every page
+    /// (and a `\r` that would be drawn is refused too). The dialog asks this too, so its preview
+    /// never offers text that applying refuses (#2013).
+    pub fn first_undrawable(&self) -> Option<char> {
+        self.text.iter().flat_map(|t| t.lines()).find_map(pdfcraft_fonts::first_non_win_ansi)
+    }
+}
+
 /// A picture for a background or watermark (Acrobat: Source ▸ File): an XObject already in
 /// the document, an image (drawn into a unit square) or a form (a page of a PDF).
 #[derive(Clone, Copy, Debug, PartialEq)]
@@ -104,6 +115,17 @@ pub struct Watermark {
     pub offset: [f64; 2],
 }
 
+impl Watermark {
+    /// The first character of a text watermark [`add_watermark`] would refuse, because the
+    /// standard fonts can't draw it (#125). A picture watermark draws no text.
+    pub fn first_undrawable(&self) -> Option<char> {
+        match self.source {
+            Some(_) => None,
+            None => self.text.trim().lines().find_map(pdfcraft_fonts::first_non_win_ansi),
+        }
+    }
+}
+
 impl Default for Watermark {
     fn default() -> Self {
         Self {
@@ -172,6 +194,13 @@ pub struct Context {
     pub date: (i64, u32, u32),
 }
 
+// Model-derived transforms can contain tiny scale factors; retain their PDF decimal precision.
+fn matrix_number(value: f64) -> String {
+    let mut bytes = Vec::new();
+    pdfcraft_cos::serialize(&Object::Real(value), &mut bytes);
+    String::from_utf8_lossy(&bytes).into_owned()
+}
+
 fn n(v: f64) -> String {
     let s = format!("{:.3}", if v.abs() < 5e-4 { 0.0 } else { v });
     let s = s.trim_end_matches('0').trim_end_matches('.');
@@ -365,27 +394,17 @@ fn begin(kind: MarkKind, subtype: &str, matrix: [f64; 6]) -> String {
     format!(
         "q\n/Artifact <</Type /Pagination /Subtype /{subtype} /PCMark /{}>> BDC\n{} {} {} {} {} {} cm\n",
         kind.tag(),
-        n(matrix[0]),
-        n(matrix[1]),
-        n(matrix[2]),
-        n(matrix[3]),
-        n(matrix[4]),
-        n(matrix[5])
+        matrix_number(matrix[0]),
+        matrix_number(matrix[1]),
+        matrix_number(matrix[2]),
+        matrix_number(matrix[3]),
+        matrix_number(matrix[4]),
+        matrix_number(matrix[5])
     )
 }
 
 const END: &str = "EMC\nQ\n";
 
-/// Refuses page text the standard-14 fonts (WinAnsiEncoding) can't draw: written anyway, each
-/// such character would become a `?` on the page (#125). `lines` must split the text the way the
-/// caller draws it, so a `\r` that would be drawn is refused too.
-pub(crate) fn drawable<'a>(lines: impl IntoIterator<Item = &'a str>) -> Result<(), EditError> {
-    match lines.into_iter().find_map(pdfcraft_fonts::first_non_win_ansi) {
-        Some(c) => Err(undrawable(c)),
-        None => Ok(()),
-    }
-}
-
 /// The refusal for page text with `c`, which nothing here can draw.
 pub(crate) fn undrawable(c: char) -> EditError {
     EditError::Invalid(undrawable_message(c))
@@ -411,9 +430,9 @@ pub fn add_header_footer(doc: &mut Document, pages: &[usize], hf: &HeaderFooter,
     if hf.text.iter().all(|t| t.trim().is_empty()) {
         return Err(EditError::Invalid("type the header or footer text first".into()));
     }
-    // Tokens only add ASCII (Bates prefixes and suffixes are part of the template), so checking
-    // the templates, split as `expand`'s output is, covers every page.
-    hf.text.iter().try_for_each(|t| drawable(t.lines()))?;
+    if let Some(c) = hf.first_undrawable() {
+        return Err(undrawable(c));
+    }
     if !(hf.font_size.is_finite() && hf.font_size > 0.0 && hf.font_size <= 200.0 && hf.margins.iter().all(|m| m.is_finite() && *m >= 0.0)) {
         return Err(EditError::Invalid("invalid font size or margins".into()));
     }
@@ -431,18 +450,26 @@ pub fn add_header_footer(doc: &mut Document, pages: &[usize], hf: &HeaderFooter,
             u32::MAX
         )));
     }
+    // The same goes for Bates numbers: the last selected page must still fit in a u64.
+    let bates0 = hf.text.iter().find_map(|t| bates_start(t)).unwrap_or(1);
+    if bates0.checked_add(pages.len().saturating_sub(1) as u64).is_none() {
+        return Err(EditError::Invalid(format!(
+            "the Bates start number {bates0} leaves no room for {} pages (Bates numbers stop at {})",
+            pages.len(),
+            u64::MAX
+        )));
+    }
     if replace {
         remove_marks(doc, pages, MarkKind::HeaderFooter)?;
     }
     let all = page_list(doc);
     let count = all.len();
-    let bates0 = hf.text.iter().find_map(|t| bates_start(t)).unwrap_or(1);
     for (k, &i) in pages.iter().enumerate() {
         let page = &all[i];
         let (w, h) = page.display_size(doc);
         let number =
             u32::try_from(u64::from(hf.start_number) + k as u64).map_err(|_| EditError::Invalid("the header page numbers are too large".into()))?;
-        let bates = bates0 + k as u64;
+        let bates = bates0.checked_add(k as u64).ok_or_else(|| EditError::Invalid("the Bates numbers are too large".into()))?;
         let size = hf.font_size;
         let [top, bottom, left, right] = hf.margins;
         let mut body: Vec<u8> = format!("BT\n/PCHelv {} Tf\n{}\n", n(size), rgb(hf.color)).into_bytes();
@@ -491,8 +518,8 @@ pub fn add_watermark(doc: &mut Document, pages: &[usize], wm: &Watermark, replac
     if text.is_empty() && wm.source.is_none() {
         return Err(EditError::Invalid("type the watermark text first".into()));
     }
-    if wm.source.is_none() {
-        drawable(text.lines())?;
+    if let Some(c) = wm.first_undrawable() {
+        return Err(undrawable(c));
     }
     if !(wm.opacity.is_finite()
         && wm.rotation.is_finite()
@@ -626,6 +653,7 @@ pub mod images;
 pub use images::{ImageChange, PageImage, change_image, page_images, reading_images, rect_to_rect, turn_about_centre};
 pub mod bidi;
 pub mod indic;
+mod linebreak;
 pub mod text;
 pub use text::{
     BlockStyle, LineEdit, RangeStyle, TextBlock, TextLine, clear_block, reading_blocks, replace_block, replace_line, rewrite_block, text_blocks,
diff --git a/crates/edit/src/linebreak.rs b/crates/edit/src/linebreak.rs
new file mode 100644
index 000000000..a4682679f
--- /dev/null
+++ b/crates/edit/src/linebreak.rs
@@ -0,0 +1,124 @@
+//! Where a row of rewrapped text may end besides a space: between two characters when either is
+//! written without spaces between words (Chinese and Japanese ideographs and kana), following the
+//! simple cases of Unicode line breaking (UAX #14, class ID). The row must not then begin with a
+//! character that closes or follows (closing brackets and quotes, commas and full stops, small
+//! kana, the prolonged sound mark, iteration marks) or end with one that opens (opening brackets
+//! and quotes, currency signs before an amount): the line-start and line-end prohibitions of
+//! JIS X 4051 ("kinsoku"), which UAX #14 gives as classes CL, CP, EX, IS, NS and OP, PR.
+//!
+//! Korean is written with spaces between words and keeps breaking only there; so does Thai, whose
+//! words need a dictionary to find.
+
+/// Writing with no spaces between words, where a row may end between two characters (UAX #14 ID).
+fn ideographic(c: char) -> bool {
+    matches!(c,
+        '\u{2e80}'..='\u{2fdf}' // CJK radicals, Kangxi radicals
+        | '\u{3000}'..='\u{303f}' // CJK symbols and punctuation
+        | '\u{3040}'..='\u{30ff}' // hiragana, katakana
+        | '\u{3190}'..='\u{31ff}' // kanbun, CJK strokes, katakana phonetic extensions
+        | '\u{3400}'..='\u{4dbf}' // CJK extension A
+        | '\u{4e00}'..='\u{9fff}' // CJK unified ideographs
+        | '\u{f900}'..='\u{faff}' // CJK compatibility ideographs
+        | '\u{fe30}'..='\u{fe4f}' // CJK compatibility forms
+        | '\u{ff00}'..='\u{ffef}' // half-width and full-width forms
+        | '\u{20000}'..='\u{3fffd}' // supplementary ideographic planes
+    )
+}
+
+/// Characters that must not begin a row: closing brackets and quotes, and the punctuation, small
+/// kana and marks that belong to the character before them (UAX #14 CL, CP, EX, IS, NS). The
+/// ideographic space breaks after itself, not before (BA): it is Japanese spacing and indentation.
+fn no_start(c: char) -> bool {
+    matches!(c,
+        ')' | ']' | '}' | '»' | '’' | '”' | '!' | '?' | ',' | '.' | ':' | ';' | '%' | '‰' | '°' | '℃'
+        | '‐' | '–' | '〜' | '‼' | '⁇' | '⁈' | '⁉' | '・' | '\u{3000}'
+        | '、' | '。' | '〃' | '〆' | '々' | '〻' | '〕' | '〉' | '》' | '」' | '』' | '】' | '〙' | '〗' | '〟' | '〞'
+        | 'ぁ' | 'ぃ' | 'ぅ' | 'ぇ' | 'ぉ' | 'っ' | 'ゃ' | 'ゅ' | 'ょ' | 'ゎ' | 'ゕ' | 'ゖ'
+        | 'ァ' | 'ィ' | 'ゥ' | 'ェ' | 'ォ' | 'ッ' | 'ャ' | 'ュ' | 'ョ' | 'ヮ' | 'ヵ' | 'ヶ'
+        | '゛' | '゜' | 'ゝ' | 'ゞ' | '゠' | 'ー' | 'ヽ' | 'ヾ'
+        | '\u{31f0}'..='\u{31ff}' // small katakana for Ainu
+        | '！' | '％' | '）' | '，' | '．' | '：' | '；' | '？' | '］' | '｝' | '｠' | '～'
+        | '｡' | '｣' | '､' | '･' | 'ｰ' | 'ﾞ' | 'ﾟ'
+        | '\u{ff67}'..='\u{ff6f}' // small half-width katakana
+    )
+}
+
+/// Characters that must not end a row: opening brackets and quotes, and currency signs written
+/// before an amount (UAX #14 OP, PR).
+fn no_end(c: char) -> bool {
+    matches!(
+        c,
+        '(' | '['
+            | '{'
+            | '«'
+            | '‘'
+            | '“'
+            | '$'
+            | '£'
+            | '¥'
+            | '€'
+            | '〈'
+            | '《'
+            | '「'
+            | '『'
+            | '【'
+            | '〔'
+            | '〖'
+            | '〘'
+            | '〝'
+            | '（'
+            | '［'
+            | '｛'
+            | '｟'
+            | '｢'
+            | '＄'
+            | '￡'
+            | '￥'
+    )
+}
+
+/// Whether a row may end between `before` and `after`, neither of them a space.
+pub(crate) fn between(before: char, after: char) -> bool {
+    (ideographic(before) || ideographic(after)) && !no_start(after) && !no_end(before)
+}
+
+/// `word` (text without spaces) cut where a row may end inside it; the pieces join with nothing.
+pub(crate) fn pieces(word: &str) -> Vec<&str> {
+    let mut out = Vec::new();
+    let mut start = 0;
+    let mut prev: Option<char> = None;
+    for (at, c) in word.char_indices() {
+        if let Some(before) = prev
+            && between(before, c)
+        {
+            out.extend(word.get(start..at));
+            start = at;
+        }
+        prev = Some(c);
+    }
+    out.extend(word.get(start..).filter(|rest| !rest.is_empty()));
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn ideographs_and_kana_break_between_characters_except_around_kinsoku_marks() {
+        assert_eq!(pieces("日本語の文章"), ["日", "本", "語", "の", "文", "章"]);
+        // Closing punctuation and small kana stay with the character before them; an opening
+        // bracket stays with the one after it.
+        assert_eq!(pieces("ちょっと、「はい」。"), ["ちょっ", "と、", "「は", "い」。"]);
+        assert_eq!(pieces("コーヒー"), ["コー", "ヒー"]);
+        assert_eq!(pieces("（例）です"), ["（例）", "で", "す"]);
+        // Latin text inside a Japanese sentence breaks before and after it, never inside it.
+        assert_eq!(pieces("PDFを編集"), ["PDF", "を", "編", "集"]);
+        assert_eq!(pieces("価格は￥100です"), ["価", "格", "は", "￥100", "で", "す"]);
+        // Words of space-separated writing are never cut.
+        assert_eq!(pieces("wrapping"), ["wrapping"]);
+        assert_eq!(pieces("한국어"), ["한국어"]);
+        assert_eq!(pieces(""), Vec::<&str>::new());
+        assert!(!between('a', 'b') && between('字', 'a') && !between('字', '。') && !between('「', '字'));
+    }
+}
diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index fce7d5e10..b542142df 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -115,6 +115,23 @@ fn header_start_number_that_would_wrap_is_refused_without_drawing() {
     assert_eq!(marks_present(&doc).len(), 1);
 }
 
+#[test]
+fn header_bates_start_that_would_overflow_is_refused_without_drawing() {
+    // A Bates start of u64::MAX has no room for a second page. The run must be refused up front
+    // instead of overflowing (a panic in debug builds, a wrap to 0 in release builds).
+    let mut doc = fixture();
+    let hf = HeaderFooter {
+        text: [String::new(), String::new(), "<<Bates Number#6#18446744073709551615#A#B>>".into(), String::new(), String::new(), String::new()],
+        ..HeaderFooter::default()
+    };
+    let err = add_header_footer(&mut doc, &[0, 1], &hf, false, &cx()).unwrap_err();
+    assert!(err.to_string().contains("Bates"), "{err}");
+    assert!(marks_present(&doc).is_empty(), "nothing is drawn when the run is refused");
+    // A single page still fits the start number itself.
+    add_header_footer(&mut doc, &[0], &hf, false, &cx()).unwrap();
+    assert_eq!(marks_present(&doc).len(), 1);
+}
+
 #[test]
 fn replace_and_remove_restore_the_original_content() {
     let mut doc = fixture();
@@ -294,6 +311,58 @@ fn flattening_fields_drops_the_ones_on_no_page() {
     assert_eq!(left, [pdfcraft_cos::ObjRef::new(7, 0)], "only the hidden field on the page stays");
 }
 
+/// #1794: a form field whose widget has no usable appearance (none stored, or none for its
+/// selected state) has nothing to draw. Flattening used to remove it anyway, losing its value
+/// with no ink in its place. It stays, in the page and in the form, like a comment that can't be
+/// drawn; a field with an appearance is still baked in and removed.
+#[test]
+fn flattening_keeps_a_valued_widget_it_cannot_draw() {
+    let page = stream("", " ");
+    let mut doc = build(&[
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [5 0 R 6 0 R 7 0 R] >> >>",
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>",
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Resources << >> /Contents 4 0 R /Annots [5 0 R 6 0 R 7 0 R] >>",
+        &page,
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (name) /V (Ada) /Rect [10 10 150 40] /F 4 >>",
+        "<< /Type /Annot /Subtype /Widget /FT /Btn /T (agree) /V /Yes /AS /Yes /Rect [10 50 30 70] /F 4 /AP << /N << /Off 8 0 R >> >> >>",
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (drawn) /V (Bob) /Rect [10 90 150 120] /F 4 /AP << /N 8 0 R >> >>",
+        "<< /Type /XObject /Subtype /Form /BBox [0 0 140 30] /Length 0 >>\nstream\n\nendstream",
+    ]);
+    assert_eq!(flatten(&mut doc, &[0], false, true).unwrap(), 1, "only the field with an appearance is drawn");
+    let doc = reopen(&doc);
+    let refs = |o: &Object| -> Vec<u32> { doc.resolve(o).as_array().unwrap().iter().filter_map(|f| f.as_ref()).map(|r| r.num).collect() };
+    let p = &pdfcraft_model::pages(&doc)[0];
+    assert_eq!(refs(p.dict.get(b"Annots").unwrap()), [5, 6], "the undrawable widgets stay on the page");
+    let root = doc.root().unwrap();
+    let af = doc.resolve(doc.get(root).as_dict().unwrap().get(b"AcroForm").unwrap());
+    assert_eq!(refs(af.as_dict().unwrap().get(b"Fields").unwrap()), [5, 6], "and in the form");
+    let value = |n: u32| doc.get(pdfcraft_cos::ObjRef::new(n, 0)).as_dict().unwrap().get(b"V").cloned();
+    assert_eq!(value(5), Some(Object::String(pdfcraft_cos::PdfString::literal(b"Ada".to_vec()))));
+    assert_eq!(value(6), Some(Object::name("Yes")));
+}
+
+/// #1794: a reply this builder cannot draw stays on the page even when the comment it replies to
+/// is flattened; the comment's pop-up still goes with it.
+#[test]
+fn flattening_keeps_an_undrawn_reply_to_a_flattened_comment() {
+    let page = stream("", " ");
+    let mut doc = build(&[
+        "<< /Type /Catalog /Pages 2 0 R >>",
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>",
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 600 800] /Resources << >> /Contents 4 0 R /Annots [5 0 R 6 0 R 7 0 R] >>",
+        &page,
+        "<< /Type /Annot /Subtype /Square /Rect [100 600 200 650] /C [1 0 0] /Contents (Synthetic comment) /AP << /N 8 0 R >> /Popup 7 0 R >>",
+        "<< /Type /Annot /Subtype /Square /Rect [100 500 200 550] /C [1 0 0] /Contents (Synthetic reply) /BE << /S /C /I 2 >> /IRT 5 0 R >>",
+        "<< /Type /Annot /Subtype /Popup /Rect [300 600 400 700] /Parent 5 0 R >>",
+        "<< /Type /XObject /Subtype /Form /BBox [100 600 200 650] /Length 28 >>\nstream\n1 0 0 RG 100 600 100 50 re S\nendstream",
+    ]);
+    assert_eq!(flatten(&mut doc, &[0], true, false).unwrap(), 1, "the comment is drawn; the cloudy reply cannot be");
+    let doc = reopen(&doc);
+    let p = &pdfcraft_model::pages(&doc)[0];
+    let left: Vec<u32> = doc.resolve(p.dict.get(b"Annots").unwrap()).as_array().unwrap().iter().filter_map(|f| f.as_ref()).map(|r| r.num).collect();
+    assert_eq!(left, [6], "the undrawn reply stays; the comment and its pop-up are gone");
+}
+
 /// Flattening never makes a `?` permanent: it refuses, changing nothing, a text box without an
 /// appearance whose text Helvetica can't draw (another program's), and a comment or form field
 /// whose appearance PdfCraft drew with `?` (marked `PCUndrawn`). A comment another program drew
@@ -641,6 +710,82 @@ fn added_arabic_text_is_shaped_in_display_order_and_stays_searchable() {
     }
 }
 
+#[test]
+fn added_hebrew_text_is_drawn_right_to_left_and_stays_searchable() {
+    let mut doc = fixture();
+    let text = AddedText {
+        rect: [72.0, 600.0, 400.0, 700.0],
+        text: "שלום (עולם) 2026 World".into(),
+        size: 14.0,
+        align: Align::Right,
+        ..AddedText::default()
+    };
+    if pdfcraft_fonts::document_hebrew_font(false).is_none() {
+        eprintln!("skipping the Hebrew drawing checks: built without a craft-fonts Hebr face (set CRAFT_FONTS_DIR)");
+        assert_eq!(first_undrawable(&text), Some('ש'));
+        let err = add_content(&mut doc, 0, &Content::Text(text)).unwrap_err();
+        assert!(matches!(&err, EditError::Invalid(m) if m.contains("U+05E9")), "{err:?}");
+        assert!(!doc.is_modified(), "nothing is written when the font is missing");
+        return;
+    }
+    assert_eq!(first_undrawable(&text), None);
+    add_content(&mut doc, 0, &Content::Text(text.clone())).unwrap();
+    // Points stay on their letters; a Hebrew line in an Arabic item and Arabic in a Hebrew one.
+    for other in ["שָׁלוֹם", "שלום مرحبا"] {
+        let other = AddedText { text: other.into(), rect: [72.0, 500.0, 400.0, 520.0], ..text.clone() };
+        if other.text.chars().any(|c| ('\u{0600}'..='\u{06FF}').contains(&c)) && pdfcraft_fonts::document_arabic_font().is_none() {
+            continue;
+        }
+        add_content(&mut doc, 0, &Content::Text(other)).unwrap();
+    }
+    let doc = reopen(&doc);
+    let added = list_added(&doc);
+    let Content::Text(t) = &added[0].content else { panic!() };
+    assert_eq!(t.text, "שלום (עולם) 2026 World", "the logical text is kept for editing");
+    let s = streams(&doc, 0);
+    let item = s.iter().find(|s| s.contains("(World) Tj")).unwrap();
+    // A right-to-left paragraph: "World", typed last, is drawn left of the Hebrew.
+    let x_before = |s: &str, at: usize| -> f64 {
+        let tm = s[..at].rfind("1 0 0 1 ").unwrap() + 8;
+        s[tm..].split(' ').next().unwrap().parse().unwrap()
+    };
+    let latin_x = x_before(item, item.find("(World) Tj").unwrap());
+    let hebrew_at = item.find("/PCAr").unwrap();
+    let hebrew_x = x_before(item, item[hebrew_at..].find(" Tj").unwrap() + hebrew_at);
+    assert!(latin_x < hebrew_x, "{item}");
+    // Copy and search get the typing order back.
+    let logical: String = t.text.encode_utf16().map(|u| format!("{u:04X}")).collect();
+    assert!(item.contains(&format!("/ActualText <FEFF{logical}>")), "{item}");
+    // The Hebrew glyphs come from a Type 3 font named after the face, whose ToUnicode map gives
+    // back each letter.
+    let p = &pdfcraft_model::pages(&doc)[0];
+    let res = doc.resolve(p.dict.get(b"Resources").unwrap());
+    let fonts = doc.resolve(res.as_dict().unwrap().get(b"Font").unwrap()).as_dict().unwrap().clone();
+    let shaped: Vec<_> = fonts.iter().filter(|(k, _)| k.starts_with(b"PCAr")).map(|(_, v)| doc.resolve(v).as_dict().unwrap().clone()).collect();
+    let mut mapped = String::new();
+    for f in &shaped {
+        assert_eq!(f.name(b"Subtype"), Some(&b"Type3"[..]));
+        mapped += &String::from_utf8_lossy(&stream_bytes(&doc, f.get(b"ToUnicode").unwrap()).unwrap());
+    }
+    for letter in ["05E9", "05DC", "05D5", "05DD", "05E2"] {
+        assert!(mapped.contains(&format!("<{letter}>")), "{letter} in {mapped}");
+    }
+    let font_name = |f: &Dict| doc.resolve(f.get(b"FontDescriptor").unwrap()).as_dict().unwrap().name(b"FontName").map(<[u8]>::to_vec);
+    assert!(shaped.iter().any(|f| font_name(f).as_deref() == Some(&b"NotoSansHebrew"[..])));
+    // A pointed letter is one glyph with its points, mapped back whole.
+    assert!(mapped.contains("<05E905"), "{mapped}");
+}
+
+#[test]
+fn odd_hebrew_text_never_panics() {
+    let mut doc = fixture();
+    let long = "שלום עולם ".repeat(2_000);
+    for s in ["\u{202E}ש\u{05B8}\u{05B8} (]", "\u{05B8}", "א\u{200F}\u{2067}b\u{2069}", "א\n\nב\tc", "׳״ 456", long.as_str()] {
+        let r = add_content(&mut doc, 0, &Content::Text(AddedText { rect: [0.0, 800.0, 300.0, 780.0], text: s.into(), ..AddedText::default() }));
+        assert_eq!(r.is_ok(), pdfcraft_fonts::document_hebrew_font(false).is_some(), "{:?}: {r:?}", s.chars().take(12).collect::<String>());
+    }
+}
+
 /// The `PCAr` font names in page `page`'s resources.
 fn arabic_font_names(doc: &Document, page: usize) -> Vec<String> {
     let p = &pdfcraft_model::pages(doc)[page];
@@ -1277,6 +1422,74 @@ fn a_subset_without_a_space_glyph_keeps_its_font_when_editing_words() {
     }
 }
 
+/// A Chrome (Skia) style subset: Type0/Identity-H over a TrueType program, CID = glyph id.
+/// `/W` lists most used glyphs, writes 0 for some it dropped, and leaves `a` and `y` to `/DW`;
+/// `z` has a ToUnicode entry but no glyph in the program (its CID is past the last glyph).
+fn skia_subset_page() -> Document {
+    // Inter's glyph ids: P 375, o 790, l 736, a 507, n 773, d 597, G 141, e 614, r 852, m 766, y 998, space 1777.
+    let mut doc = text_page(
+        "BT /F3 12 Tf 72 700 Td <0177031602E001FB03050255> Tj ET \
+         BT /F3 12 Tf 72 650 Td <008D0266035402FE01FB030503E606F101FB0305025506F102FE031603540266> Tj ET",
+    );
+    let program = doc.add(Object::Stream(Stream::flate(Dict::new(), include_bytes!("../../../assets/fonts/Inter-Regular.ttf"))));
+    let unicode = doc.add(Object::Stream(Stream::flate(
+        Dict::new(),
+        b"1 begincodespacerange <0000> <FFFF> endcodespacerange 13 beginbfchar <0177> <0050> <0316> <006F> <02E0> <006C> \
+          <01FB> <0061> <0305> <006E> <0255> <0064> <008D> <0047> <0266> <0065> <0354> <0072> <02FE> <006D> <03E6> <0079> \
+          <06F1> <0020> <1000> <007A> endbfchar",
+    )));
+    let widths: Vec<Object> = [(0x8D, 746), (0x177, 639), (0x255, 612), (0x266, 583), (0x2E0, 242), (0x2FE, 876), (0x305, 591), (0x316, 600)]
+        .into_iter()
+        .chain([(0x354, 376), (0x355, 0), (0x356, 0), (0x6F1, 281)])
+        .flat_map(|(cid, width)| [Object::Int(cid), Object::Array(vec![Object::Int(width)])])
+        .collect();
+    let descriptor = Dict::from_iter([
+        (b"Type".to_vec(), Object::name("FontDescriptor")),
+        (b"FontName".to_vec(), Object::name("BAAAAA+SampleSans")),
+        (b"Flags".to_vec(), Object::Int(32)),
+        (b"FontFile2".to_vec(), Object::Ref(program)),
+    ]);
+    let cid_font = Dict::from_iter([
+        (b"Type".to_vec(), Object::name("Font")),
+        (b"Subtype".to_vec(), Object::name("CIDFontType2")),
+        (b"BaseFont".to_vec(), Object::name("BAAAAA+SampleSans")),
+        (b"CIDToGIDMap".to_vec(), Object::name("Identity")),
+        (b"DW".to_vec(), Object::Int(562)),
+        (b"W".to_vec(), Object::Array(widths)),
+        (b"FontDescriptor".to_vec(), Object::Dict(descriptor)),
+    ]);
+    let font = Dict::from_iter([
+        (b"Type".to_vec(), Object::name("Font")),
+        (b"Subtype".to_vec(), Object::name("Type0")),
+        (b"BaseFont".to_vec(), Object::name("BAAAAA+SampleSans")),
+        (b"Encoding".to_vec(), Object::name("Identity-H")),
+        (b"DescendantFonts".to_vec(), Object::Array(vec![Object::Dict(cid_font)])),
+        (b"ToUnicode".to_vec(), Object::Ref(unicode)),
+    ]);
+    let p = pdfcraft_model::pages(&doc)[0].obj;
+    let fonts = Dict::from_iter([(b"F3".to_vec(), Object::Dict(font))]);
+    doc.update_dict(p, |d| d.set(b"Resources".to_vec(), Object::Dict(Dict::from_iter([(b"Font".to_vec(), Object::Dict(fonts))])))).unwrap();
+    doc
+}
+
+#[test]
+fn a_subset_keeps_its_font_for_glyphs_left_to_the_default_width() {
+    let doc = skia_subset_page();
+    let blocks = text::text_blocks(&doc, 0).unwrap();
+    assert_eq!(blocks.iter().map(|b| b.text.as_str()).collect::<Vec<_>>(), ["Poland", "Germany and more"]);
+    // Deleting words only, and replacing a word with one drawn elsewhere on the page (`y` and `a`
+    // have no /W entry): every glyph is in the subset, so the font stays.
+    for (block, text) in [(1, "Germany"), (0, "Germany")] {
+        let mut doc = doc.clone();
+        assert_eq!(text::replace_block(&mut doc, 0, block, text).unwrap().substituted, None, "{text}");
+        let lines = text::text_lines(&reopen(&doc), 0).unwrap();
+        assert_eq!(lines.iter().find(|l| l.text == text).unwrap().font, "F3");
+    }
+    // `z` maps to a CID the program has no glyph for: that still needs another font.
+    let mut doc = doc.clone();
+    assert!(text::replace_block(&mut doc, 0, 0, "Graz").unwrap().substituted.is_some());
+}
+
 #[test]
 fn spaces_in_another_subset_do_not_split_a_line() {
     let mut doc = text_page("BT /F1 12 Tf 72 700 Td (Hello) Tj /F2 12 Tf ( ) Tj /F1 12 Tf (world) Tj ET");
@@ -1346,6 +1559,28 @@ fn independent_text_objects_with_different_transforms_stay_separate() {
     assert_eq!(text::text_lines(&doc, 0).unwrap().len(), 2);
 }
 
+/// A negative font size or `Tz` runs the glyphs backwards along the text matrix: each word's
+/// `ink` box still spans all its glyphs, not only the first.
+#[test]
+fn word_boxes_span_whole_words_when_glyphs_run_backwards() {
+    // "someone@example.com" in Helvetica 11 is 121.814 pt wide.
+    for content in [
+        "BT /F1 -11 Tf -1 0 0 1 300 742 Tm (Mail the team: someone@example.com) Tj ET",
+        "BT /F1 11 Tf -100 Tz 300 742 Td (Mail the team: someone@example.com) Tj ET",
+    ] {
+        let lines = text::text_lines(&text_page(content), 0).unwrap();
+        assert_eq!(lines.len(), 1, "{content}");
+        let ink = &lines[0].ink;
+        assert_eq!(ink.len(), 4, "{content}: {ink:?}");
+        let width = |r: &[f64; 4]| r[2] - r[0];
+        assert!(ink.iter().all(|r| width(r) > 5.0), "{content}: {ink:?}");
+        let address = ink.iter().map(width).fold(0.0, f64::max);
+        assert!((address - 121.814).abs() < 0.01, "{content}: {ink:?}");
+        let (x0, x1) = ink.iter().fold((f64::MAX, f64::MIN), |(a, b), r| (a.min(r[0]), b.max(r[2])));
+        assert!(x0 >= lines[0].rect[0] - 0.01 && x1 <= lines[0].rect[2] + 0.01, "{content}: {ink:?} {:?}", lines[0].rect);
+    }
+}
+
 #[test]
 fn text_lines_are_found_and_replaced_in_place() {
     let mut doc =
@@ -1630,6 +1865,61 @@ fn close(a: [f64; 4], b: [f64; 4]) -> bool {
     a.iter().zip(b).all(|(x, y)| (x - y).abs() < 1e-6)
 }
 
+/// The deepest `q` nesting on the page.
+fn q_depth(doc: &Document) -> usize {
+    let mut depth = 0_usize;
+    let mut deepest = 0;
+    for op in pdfcraft_content::parse(&page_content_bytes(doc, 0)).ops {
+        if op.is("q") {
+            depth += 1;
+            deepest = deepest.max(depth);
+        } else if op.is("Q") {
+            depth = depth.saturating_sub(1);
+        }
+    }
+    deepest
+}
+
+#[test]
+fn repeated_image_edits_change_one_transform_instead_of_nesting() {
+    let variants = [
+        // Its own placement, a private crop, and a bare `Do` that the first edit wraps.
+        "q 200 0 0 100 100 100 cm /Im0 Do Q BT /F1 12 Tf 72 700 Td (Caption) Tj ET",
+        "q 100 100 200 100 re W* n 200 0 0 100 100 100 cm /Im0 Do Q BT /F1 12 Tf 72 700 Td (Caption) Tj ET",
+        "200 0 0 100 100 100 cm /Im0 Do",
+    ];
+    for content in variants {
+        let mut doc = image_page_with(content);
+        let resize = |doc: &mut Document, n: usize| -> usize {
+            let mut depth = 0;
+            for i in 0..n {
+                let r = images::page_images(doc, 0).unwrap()[0].visible_rect.unwrap();
+                // Grow by 3% about the lower-left corner and move right by 2, staying on the page.
+                let target = [r[0] + 2.0, r[1], r[0] + 2.0 + (r[2] - r[0]) * 1.03, r[1] + (r[3] - r[1]) * 1.03];
+                images::change_image(doc, 0, 0, &images::ImageChange::Transform(images::rect_to_rect(r, target))).unwrap();
+                let after = images::page_images(doc, 0).unwrap()[0].visible_rect.unwrap();
+                assert!(after.iter().zip(target).all(|(a, b)| (a - b).abs() < 1e-6), "{content}: {after:?} vs {target:?}");
+                if i == 0 {
+                    depth = q_depth(doc);
+                }
+            }
+            depth
+        };
+        let first = resize(&mut doc, 20);
+        assert_eq!(q_depth(&doc), first, "{content}: twenty resizes nest no deeper than one");
+        let mut doc = reopen(&doc);
+        let before = images::page_images(&doc, 0).unwrap()[0].rect;
+        for _ in 0..20 {
+            images::translate_images(&mut doc, 0, &[0], [1.0, -2.0]).unwrap();
+        }
+        let after = images::page_images(&doc, 0).unwrap()[0].rect;
+        assert!(close(after, [before[0] + 20.0, before[1] - 40.0, before[2] + 20.0, before[3] - 40.0]), "{content}: {after:?}");
+        assert_eq!(q_depth(&doc), first, "{content}: group moves change the same transform");
+        let caption: Vec<_> = text::text_lines(&doc, 0).unwrap().into_iter().map(|l| l.text).collect();
+        assert_eq!(caption.is_empty(), !content.contains("Caption"), "{content}: the text after the image is untouched");
+    }
+}
+
 #[test]
 fn page_images_move_turn_replace_and_delete() {
     let mut doc = image_page();
@@ -2116,6 +2406,33 @@ fn hebrew_edits_are_drawn_right_to_left_and_keep_their_right_edge() {
     assert!((line.rect[0] - before[0]).abs() < 0.5, "left-aligned: {:?} vs {before:?}", line.rect);
 }
 
+/// A generated Type 3 font numbers its glyphs from 1, so code 32 is a character, not the space:
+/// justified rows are stretched after each space, never with word spacing.
+#[test]
+fn justified_text_in_the_type3_fallback_stretches_its_spaces() {
+    let src = "BT /F1 12 Tf 14 TL 100 700 Td (Some words to fill a row of text) Tj T* (and another one below it) Tj T* (end) Tj ET";
+    let mut doc = text_page(src);
+    let rect = text::text_blocks(&doc, 0).unwrap()[0].rect;
+    // More than 32 different characters, so one of them gets code 32.
+    let typed = "日本語の 文章を 書きます 東京 大阪 京都 名古屋 札幌 福岡 神戸 横浜 仙台 広島 千葉 新潟 静岡 熊本 岡山 金沢";
+    let style = text::BlockStyle { align: Some(added::Align::Justify), ..Default::default() };
+    let rewritten = text::rewrite_block(&mut doc, 0, 0, Some(typed), &style);
+    if pdfcraft_fonts::document_japanese_font().is_none() {
+        assert!(rewritten.is_err());
+        eprintln!("built without a craft-fonts Japanese face: the Type 3 path is checked with CRAFT_FONTS_DIR");
+        return;
+    }
+    rewritten.unwrap();
+    let lines = text::text_lines(&doc, 0).unwrap();
+    assert!(lines.len() > 2, "{lines:?}");
+    for l in &lines[..lines.len() - 1] {
+        assert!((l.rect[2] - rect[2]).abs() < 1.0, "{:?} spans {:?}, not {rect:?}", l.text, l.rect);
+    }
+    let ops = pdfcraft_content::parse(&page_content_bytes(&doc, 0)).ops;
+    assert!(ops.iter().any(|o| o.is("TJ")), "{ops:?}");
+    assert!(ops.iter().filter(|o| o.is("Tw")).all(|o| o.operands.first().and_then(|n| n.as_f64()) == Some(0.0)), "{ops:?}");
+}
+
 /// Letters the page's font lacks are drawn with the Hebrew face from craft-fonts; a build
 /// without it says so and changes nothing. Hebrew points are refused, not misdrawn.
 #[test]
@@ -2162,6 +2479,37 @@ fn hebrew_letters_the_page_font_lacks_use_the_hebrew_face() {
     assert_eq!(text::text_blocks(&reopen(&doc), 0).unwrap()[0].text, "עברית מלאה");
 }
 
+/// #2013: the dialog asks `first_undrawable` before offering OK, so it must refuse exactly what
+/// applying refuses: a Cyrillic footer was previewed (in the interface font) and then failed.
+#[test]
+fn header_and_watermark_drawability_matches_what_applying_refuses() {
+    let footer = |t: &str| HeaderFooter {
+        text: [String::new(), String::new(), String::new(), String::new(), String::new(), t.into()],
+        ..HeaderFooter::default()
+    };
+    for (text, refused) in [
+        ("Страница <<1>> из 1 / Page <<1>> of 1", Some('С')),
+        ("TEST-001 <<Page 1 of n>>", None),
+        ("Café — 5€ ™ <<Bates Number#6#1#ACME-#>>", None),
+        ("Left\r\nRight", None),
+        ("A\rB", Some('\r')),
+        ("line one\nΕλληνικά", Some('Ε')),
+    ] {
+        let hf = footer(text);
+        assert_eq!(hf.first_undrawable(), refused, "{text:?}");
+        let mut doc = fixture();
+        let applied = add_header_footer(&mut doc, &[0], &hf, false, &cx());
+        match refused {
+            Some(c) => assert_eq!(applied.unwrap_err().to_string(), undrawable_message(c), "{text:?}"),
+            None => applied.unwrap(),
+        }
+        let wm = Watermark { text: text.into(), ..Watermark::default() };
+        assert_eq!(wm.first_undrawable(), refused, "{text:?}");
+        let applied = add_watermark(&mut fixture(), &[0], &wm, false);
+        assert_eq!(applied.err().map(|e| e.to_string()), refused.map(undrawable_message), "{text:?}");
+    }
+}
+
 /// #125: page-content tools refuse text the standard fonts can't draw instead of writing `?`,
 /// and leave the document untouched.
 #[test]
@@ -2680,6 +3028,55 @@ fn group_moves_keep_split_stream_tokens_and_shared_form_resources() {
     assert_eq!(page_content_bytes(&doc, 1), source_page);
 }
 
+#[test]
+fn justified_text_in_a_composite_font_fills_each_row_with_adjustments_after_its_spaces() {
+    // Two-byte codes, so word spacing (single-byte code 32 only) can't stretch the spaces.
+    let hex = |s: &str| s.bytes().map(|b| format!("00{b:02x}")).collect::<String>();
+    let src = format!(
+        "BT /F1 10 Tf 12 TL 100 700 Td <{}> Tj T* <{}> Tj T* <{}> Tj ET",
+        hex("One two three four five six seven"),
+        hex("eight nine ten eleven twelve"),
+        hex("and then the end of it")
+    );
+    let mut doc = text_page(&src);
+    let unicode = doc.add(Object::Stream(Stream::flate(
+        Dict::new(),
+        b"1 begincodespacerange <0000> <ffff> endcodespacerange 1 beginbfrange <0020> <007e> <0020> endbfrange",
+    )));
+    let font = Dict::from_iter([
+        (b"Type".to_vec(), Object::name("Font")),
+        (b"Subtype".to_vec(), Object::name("Type0")),
+        (b"BaseFont".to_vec(), Object::name("SyntheticCID")),
+        (b"Encoding".to_vec(), Object::name("Identity-H")),
+        (b"ToUnicode".to_vec(), Object::Ref(unicode)),
+        (
+            b"DescendantFonts".to_vec(),
+            Object::Array(vec![Object::Dict(Dict::from_iter([
+                (b"Subtype".to_vec(), Object::name("CIDFontType2")),
+                (b"DW".to_vec(), Object::Int(500)),
+            ]))]),
+        ),
+    ]);
+    let p = pdfcraft_model::pages(&doc)[0].obj;
+    let resources = Dict::from_iter([(b"Font".to_vec(), Object::Dict(Dict::from_iter([(b"F1".to_vec(), Object::Dict(font))])))]);
+    doc.update_dict(p, |d| d.set(b"Resources".to_vec(), Object::Dict(resources))).unwrap();
+    let before = text::text_blocks(&doc, 0).unwrap()[0].clone();
+    let right = before.rect[2];
+    text::rewrite_block(&mut doc, 0, 0, None, &text::BlockStyle { align: Some(added::Align::Justify), ..Default::default() }).unwrap();
+    let lines = text::text_lines(&doc, 0).unwrap();
+    assert!(lines.len() > 2, "{lines:?}");
+    for l in &lines[..lines.len() - 1] {
+        assert!((l.rect[2] - right).abs() < 1.0, "{:?} ends at {} not {right}", l.text, l.rect[2]);
+    }
+    // The source font shows the text, with its spaces, and the text reads as before, rewrapped.
+    let flat = |s: &str| s.replace('\n', " ");
+    assert_eq!(flat(&text::text_blocks(&doc, 0).unwrap()[0].editor_text), flat(&before.editor_text));
+    let ops = pdfcraft_content::parse(&page_content_bytes(&doc, 0)).ops;
+    assert!(ops.iter().all(|o| !o.is("Tf") || o.operands.first().and_then(|n| n.as_name()) == Some(b"F1".as_slice())), "{ops:?}");
+    assert!(ops.iter().any(|o| o.is("TJ")), "{ops:?}");
+    assert!(ops.iter().filter(|o| o.is("Tw")).all(|o| o.operands.first().and_then(|n| n.as_f64()) == Some(0.0)), "{ops:?}");
+}
+
 #[test]
 fn group_moves_preserve_encoded_glyphs_and_refuse_vertical_cmaps() {
     let mut doc = text_page("BT /F1 12 Tf 40 400 Td <004100420043> Tj ET");
@@ -3034,6 +3431,30 @@ fn mixed_styles_and_matrix_sizes_form_visual_regions_without_merging_columns() {
     assert_eq!(blocks[2].text, "Other column");
 }
 
+#[test]
+fn a_single_row_with_mixed_styles_grows_before_wrapping() {
+    let mut doc = text_page("BT /F1 10 Tf 72 582 Td (Plain ) Tj /F2 10 Tf (bold) Tj /F1 10 Tf ( text.) Tj ET");
+    doc.update_dict(pdfcraft_cos::ObjRef::new(6, 0), |f| {
+        *f = Dict::new();
+        f.set(b"Type".to_vec(), Object::name("Font"));
+        f.set(b"Subtype".to_vec(), Object::name("Type1"));
+        f.set(b"BaseFont".to_vec(), Object::name("Helvetica-Bold"));
+    })
+    .unwrap();
+    let blocks = text::text_blocks(&doc, 0).unwrap();
+    let index = blocks.iter().position(|b| b.editor_text == "Plain bold text.").unwrap();
+    let source = &blocks[index];
+    assert_eq!(source.rows.len(), 1);
+    assert!(source.lines.len() > 1);
+    let draft = "Plain bold text. More words on the same line";
+    text::replace_block(&mut doc, 0, index, draft).unwrap();
+    let edited = text::text_blocks(&reopen(&doc), 0).unwrap();
+    let block = edited.iter().find(|b| b.text == draft).unwrap();
+    assert_eq!(block.rows.len(), 1, "a style boundary must not pin a single row to its original width");
+    assert!((block.rect[0] - source.rect[0]).abs() < 0.1);
+    assert!(block.rect[2] > source.rect[2] + 20.0);
+}
+
 #[test]
 fn explicit_editor_rows_survive_single_run_edit_and_reopen() {
     let mut doc = text_page("BT /F1 12 Tf 72 700 Td (Original heading) Tj ET");
@@ -3083,6 +3504,27 @@ fn rich_region_edits_preserve_styles_positions_and_delete_all_runs_after_reopen(
     assert_eq!(text::text_blocks(&original, 0).unwrap().len(), 3);
 }
 
+/// Two edits applied together (heading and footer edited before leaving the editor, #2198): the
+/// runs between them are unchanged and keep their own styles instead of taking the heading's.
+#[test]
+fn unchanged_runs_between_two_edits_keep_their_styles() {
+    let original = mixed_region_page();
+    let look =
+        |doc: &Document| text::text_lines(doc, 0).unwrap().into_iter().map(|l| (l.text.trim().to_string(), l.base_font, l.color)).collect::<Vec<_>>();
+    let before = look(&original);
+    let block = text::text_blocks(&original, 0).unwrap()[1].clone();
+    let mut doc = original.clone();
+    let draft = block.editor_text.replace("About", "About us").replace("footer", "footnote");
+    text::replace_block(&mut doc, 0, 1, &draft).unwrap();
+    let after = look(&reopen(&doc));
+    let style = |lines: &[(String, String, [f64; 3])], word: &str| lines.iter().find(|l| l.0 == word).map(|l| (l.1.clone(), l.2));
+    for word in ["Plain", "bold", "text."] {
+        assert_eq!(style(&after, word), style(&before, word), "{word:?} keeps its own style; lines after the edit: {after:?}");
+    }
+    assert_eq!(style(&after, "About us"), style(&before, "About"));
+    assert_eq!(style(&after, "Italic footnote"), style(&before, "Italic footer"));
+}
+
 #[test]
 fn disjoint_style_ranges_preserve_unselected_runs_and_validate_utf8_atomically() {
     let mut doc = mixed_region_page();
@@ -3420,6 +3862,104 @@ fn subset_indic_font_without_legacy_name_keeps_logical_text() {
     assert_eq!(lines[0].text, "\u{092C}\u{0922}\u{093C}\u{093F}\u{092F}\u{093E}");
 }
 
+/// Lines of a paragraph drawn turned on the page (a landscape page drawn a quarter turn round)
+/// are separate rows, and adding a word keeps them apart (#1443).
+#[test]
+fn turned_paragraph_keeps_its_line_breaks_when_a_word_is_added() {
+    for cm in ["0 1 -1 0 600 0", "0 -1 1 0 0 800", "-1 0 0 -1 600 800"] {
+        let original =
+            text_page(&format!("q {cm} cm BT /F1 12 Tf 72 500 Td (First line here) Tj 0 -14 Td (Second line) Tj 0 -14 Td (Third) Tj ET Q"));
+        let block = text::text_blocks(&original, 0).unwrap().remove(0);
+        assert_eq!(block.editor_text, "First line here\nSecond line\nThird", "{cm}");
+        let mut doc = original.clone();
+        text::rewrite_block(&mut doc, 0, 0, Some("First line here\nSecond line\nThird added"), &text::BlockStyle::default()).unwrap();
+        let reopened = reopen(&doc);
+        assert_eq!(text::text_blocks(&reopened, 0).unwrap()[0].editor_text, "First line here\nSecond line\nThird added", "{cm}");
+        let (before, after) = (text::text_lines(&original, 0).unwrap(), text::text_lines(&reopened, 0).unwrap());
+        assert_eq!(after.len(), 3, "{cm}");
+        for (a, b) in after.iter().zip(&before).take(2) {
+            assert!(close(a.rect, b.rect), "{cm}: untouched rows stay put: {:?} {:?}", a.rect, b.rect);
+        }
+        // The last row grows along its own baseline from where it started.
+        let (grown, old) = (after[2].rect, before[2].rect);
+        assert!((0..2).all(|i| grown[i] <= old[i] + 0.01) && (2..4).all(|i| grown[i] >= old[i] - 0.01), "{cm}: {grown:?} {old:?}");
+        assert!((after[2].origin_baseline() - before[2].origin_baseline()).abs() < 0.01, "{cm}");
+    }
+    // A turned single line grows rather than wrapping across the page's other axis.
+    let mut doc = text_page("BT /F1 12 Tf 0 1 -1 0 300 300 Tm (Only line) Tj ET");
+    text::rewrite_block(&mut doc, 0, 0, Some("Only line with several more words added"), &text::BlockStyle::default()).unwrap();
+    let blocks = text::text_blocks(&reopen(&doc), 0).unwrap();
+    assert_eq!(blocks[0].editor_text, "Only line with several more words added");
+    // Formatting part of turned text isn't laid out yet: refused, not drawn along the page's x axis.
+    let mut doc = text_page("BT /F1 12 Tf 0 1 -1 0 300 300 Tm (Only line) Tj ET");
+    let range = text::RangeStyle {
+        range: 0..4,
+        family: None,
+        resource: None,
+        size: Some(20.0),
+        color: None,
+        underline: None,
+        char_spacing: None,
+        scale: None,
+    };
+    let style = text::BlockStyle { ranges: vec![range], ..Default::default() };
+    assert!(text::rewrite_block(&mut doc, 0, 0, Some("Only line"), &style).is_err());
+}
+
+/// A paragraph in a Chrome-style subset font: `/W` leaves out the glyphs of the `/DW` width.
+/// Adding a word keeps every row as it was and shows the word in the page's own font (#1443).
+#[test]
+fn default_width_subset_paragraph_keeps_its_rows_when_a_word_is_added() {
+    let hex = |s: &str| s.chars().map(|c| format!("00{:02X}", u32::from(c))).collect::<String>();
+    let rows = ["This is the first line", "the second", "and third"];
+    let content = rows
+        .iter()
+        .enumerate()
+        .map(|(i, row)| format!("BT /F3 12 Tf 1 0 0 1 72 {} Tm <{}> Tj ET", 700 - 14 * i, hex(row)))
+        .collect::<Vec<_>>()
+        .join(" ");
+    let mut doc = text_page(&content);
+    let cmap = b"/CIDInit /ProcSet findresource begin 1 begincodespacerange <0000> <FFFF> endcodespacerange \
+        1 beginbfrange <0020> <007E> <0020> endbfrange end";
+    let to_unicode = doc.add(Object::Stream(Stream::from_raw(Dict::new(), cmap.to_vec())));
+    let mut cid = Dict::new();
+    cid.set(b"Type".to_vec(), Object::name("Font"));
+    cid.set(b"Subtype".to_vec(), Object::name("CIDFontType2"));
+    cid.set(b"BaseFont".to_vec(), Object::name("AAAAAA+LiberationSans"));
+    cid.set(b"CIDToGIDMap".to_vec(), Object::name("Identity"));
+    cid.set(b"DW".to_vec(), Object::Int(500));
+    cid.set(
+        b"W".to_vec(),
+        Object::Array(vec![Object::Int(32), Object::Array(vec![Object::Int(278)]), Object::Int(84), Object::Array(vec![Object::Int(611)])]),
+    );
+    let mut font = Dict::new();
+    font.set(b"Type".to_vec(), Object::name("Font"));
+    font.set(b"Subtype".to_vec(), Object::name("Type0"));
+    font.set(b"BaseFont".to_vec(), Object::name("AAAAAA+LiberationSans"));
+    font.set(b"Encoding".to_vec(), Object::name("Identity-H"));
+    font.set(b"DescendantFonts".to_vec(), Object::Array(vec![Object::Dict(cid)]));
+    font.set(b"ToUnicode".to_vec(), Object::Ref(to_unicode));
+    let font = doc.add(Object::Dict(font));
+    let page = pdfcraft_model::pages(&doc)[0].clone();
+    let mut resources = doc.resolve(page.dict.get(b"Resources").unwrap()).as_dict().unwrap().clone();
+    let mut fonts = doc.resolve(resources.get(b"Font").unwrap()).as_dict().unwrap().clone();
+    fonts.set(b"F3".to_vec(), Object::Ref(font));
+    resources.set(b"Font".to_vec(), Object::Dict(fonts));
+    doc.update_dict(page.obj, |d| d.set(b"Resources".to_vec(), Object::Dict(resources))).unwrap();
+    let block = text::text_blocks(&doc, 0).unwrap().remove(0);
+    assert_eq!(block.editor_text, rows.join("\n"));
+    let before = text::text_lines(&doc, 0).unwrap();
+    let edit = text::rewrite_block(&mut doc, 0, 0, Some(&format!("{} added", block.editor_text)), &text::BlockStyle::default()).unwrap();
+    assert_eq!(edit.substituted, None, "the subset shows every letter of the new word");
+    let reopened = reopen(&doc);
+    assert_eq!(text::text_blocks(&reopened, 0).unwrap()[0].editor_text, "This is the first line\nthe second\nand third added");
+    let after = text::text_lines(&reopened, 0).unwrap();
+    for (a, b) in after.iter().zip(&before).take(2) {
+        assert_eq!(a.text, b.text);
+        assert!(close(a.rect, b.rect), "untouched rows keep their place and width: {:?} {:?}", a.rect, b.rect);
+    }
+}
+
 /// An added item is written out as a specific standard-14 face (`/Times-Italic`, `/Helvetica-Bold`
 /// …), so it has to be *measured* with that same face. Measuring the upright face while writing
 /// the italic one mis-sizes every box: Times-Italic `A` is 611 against Times-Roman's 722.
@@ -3443,3 +3983,269 @@ fn an_items_measured_face_is_the_face_it_is_written_as() {
     let courier = |italic| Family::Courier.width("Anna", 12.0, false, italic);
     assert_eq!(courier(false), courier(true));
 }
+
+#[test]
+fn page_marks_and_added_content_preserve_fractional_user_unit_matrices() {
+    for rotation in [0, 90] {
+        let mut doc = fixture();
+        let page = pdfcraft_model::pages(&doc)[2].obj;
+        doc.update_dict(page, |d| {
+            let bounds = Object::Array([0.0, 0.0, 0.1, 0.1].into_iter().map(Object::Real).collect());
+            d.set(b"MediaBox".to_vec(), bounds.clone());
+            d.set(b"CropBox".to_vec(), bounds);
+            d.set(b"UserUnit".to_vec(), Object::Int(4096));
+            d.set(b"Rotate".to_vec(), Object::Int(rotation));
+        })
+        .unwrap();
+        let mut hf = HeaderFooter::default();
+        hf.text[0] = "Matrix header".into();
+        add_header_footer(&mut doc, &[2], &hf, false, &cx()).unwrap();
+        let text = AddedText { rect: [72.0, 100.0, 200.0, 144.0], text: "Matrix text".into(), size: 12.0, ..AddedText::default() };
+        add_content(&mut doc, 2, &Content::Text(text)).unwrap();
+        let saved = reopen(&doc);
+        let contents = streams(&saved, 2);
+        for marker in ["/PCMark /HeaderFooter", "(Matrix text) Tj"] {
+            let matching: Vec<_> = contents.iter().filter(|s| s.contains(marker)).collect();
+            assert_eq!(matching.len(), 1, "{contents:?}");
+            let stream = matching[0];
+            let parsed = pdfcraft_content::parse(stream.as_bytes());
+            assert_eq!(parsed.skipped, 0);
+            let cm = parsed.ops.iter().find(|op| op.is("cm")).unwrap();
+            assert_eq!(cm.operands.len(), 6);
+            assert!(!stream[cm.span.clone()].contains('e') && !stream[cm.span.clone()].contains('E'), "PDF numbers cannot use exponents");
+            let matrix = cm.nums::<6>().unwrap();
+            let expected = if rotation == 0 {
+                [0.000244140625, 0.0, 0.0, 0.000244140625, 0.0, 0.0]
+            } else {
+                [0.0, 0.000244140625, -0.000244140625, 0.0, 0.1, 0.0]
+            };
+            assert_eq!(matrix, expected, "rotation={rotation}, stream={stream}");
+            // A fixed physical display point must remain at its intended raw page position.
+            let raw = [matrix[0] * 72.0 + matrix[2] * 144.0 + matrix[4], matrix[1] * 72.0 + matrix[3] * 144.0 + matrix[5]];
+            let expected_raw = if rotation == 0 { [0.017578125, 0.03515625] } else { [0.06484375, 0.017578125] };
+            for (actual, expected) in raw.into_iter().zip(expected_raw) {
+                assert!((actual - expected).abs() < 1e-12);
+            }
+        }
+    }
+}
+
+#[test]
+fn rows_the_edit_does_not_reach_keep_their_source_operators() {
+    // Word gaps in TJ, as justified text from a layout program has; the text state alone
+    // can't reproduce them, so a rewritten row would lose them.
+    let rows = [
+        "[(justified) -400 ( text) -400 ( uses) -400 ( wide) -400 ( gaps)] TJ",
+        "[(between) -400 ( every) -400 ( single) -400 ( word) -400 ( here)] TJ",
+        "(last line.) Tj",
+    ];
+    let content = format!("BT /F1 12 Tf 14.4 TL 1 0 0 1 72 700 Tm {} T* {} T* {} ET", rows[0], rows[1], rows[2]);
+    let row_texts = |doc: &Document| -> Vec<(String, [f64; 2])> {
+        text::text_lines(doc, 0).unwrap().into_iter().map(|l| (l.text.clone(), l.baseline())).collect()
+    };
+    let source = row_texts(&text_page(&content));
+    assert_eq!(source.len(), 3);
+    for (row, from, to) in [(2, "last line.", "last line!"), (0, "justified", "justify"), (1, "single", "lone")] {
+        let mut doc = text_page(&content);
+        let block = text::text_blocks(&doc, 0).unwrap().into_iter().position(|b| b.text.contains("justified")).unwrap();
+        let draft = text::text_blocks(&doc, 0).unwrap()[block].editor_text.replacen(from, to, 1);
+        text::rewrite_block(&mut doc, 0, block, Some(&draft), &text::BlockStyle::default()).unwrap();
+        let doc = reopen(&doc);
+        let bytes = String::from_utf8_lossy(&page_content_bytes(&doc, 0)).into_owned();
+        let after = row_texts(&doc);
+        assert_eq!(after.len(), 3, "{to}: {after:?}");
+        for (i, ((text, at), (old, was))) in after.iter().zip(&source).enumerate() {
+            assert!((at[0] - was[0]).abs() < 0.01 && (at[1] - was[1]).abs() < 0.01, "{to}: row {i} stays at {was:?}, not {at:?}");
+            if i == row {
+                assert_eq!(*text, old.replacen(from, to, 1), "{to}: the edited row");
+                assert!(!bytes.contains(rows[i]), "{to}: the edited row is rewritten");
+            } else {
+                assert_eq!(text, old, "{to}: row {i}");
+                assert_eq!(bytes.matches(rows[i]).count(), 1, "{to}: row {i} keeps its own operator, kerning included:\n{bytes}");
+            }
+        }
+    }
+    // Colouring a selection in the last row leaves the rows above it as they were.
+    let mut doc = text_page(&content);
+    let block = text::text_blocks(&doc, 0).unwrap().into_iter().position(|b| b.text.contains("justified")).unwrap();
+    let draft = text::text_blocks(&doc, 0).unwrap()[block].editor_text.clone();
+    let at = draft.find("line").unwrap();
+    let range = text::RangeStyle {
+        range: at..at + 4,
+        family: None,
+        resource: None,
+        size: None,
+        color: Some([1.0, 0.0, 0.0]),
+        underline: None,
+        char_spacing: None,
+        scale: None,
+    };
+    text::rewrite_block(&mut doc, 0, block, Some(&draft), &text::BlockStyle { ranges: vec![range], ..Default::default() }).unwrap();
+    let bytes = String::from_utf8_lossy(&page_content_bytes(&doc, 0)).into_owned();
+    assert!(rows[..2].iter().all(|row| bytes.matches(row).count() == 1) && !bytes.contains(rows[2]), "{bytes}");
+    assert!(bytes.contains("1 0 0 rg"), "{bytes}");
+    // The coloured word is its own run now, so only the rows above compare whole.
+    assert_eq!(row_texts(&reopen(&doc))[..2], source[..2]);
+}
+
+#[test]
+fn kept_rows_stay_in_place_when_rows_wrap_or_move_with_quote_operators() {
+    let lines_of = |doc: &Document| -> Vec<(String, [f64; 2])> {
+        text::text_lines(doc, 0).unwrap().into_iter().map(|l| (l.text.clone(), l.baseline())).collect()
+    };
+    let edit = |content: &str, from: &str, to: &str| {
+        let mut doc = text_page(content);
+        let block = text::text_blocks(&doc, 0).unwrap().into_iter().position(|b| b.editor_text.contains(from)).unwrap();
+        let draft = text::text_blocks(&doc, 0).unwrap()[block].editor_text.replacen(from, to, 1);
+        text::rewrite_block(&mut doc, 0, block, Some(&draft), &text::BlockStyle::default()).unwrap();
+        reopen(&doc)
+    };
+    // `'` moves to the next line as it shows: a row after a rewritten `'` row can't stay as it is.
+    for (quoted, from, to) in [
+        ("BT /F1 12 Tf 14 TL 72 700 Td (first row here) Tj (second row here) ' (third row here) ' ET", "second", "2nd"),
+        ("BT /F1 12 Tf 14 TL 72 700 Td (first row here) Tj (second row here) ' (third row here) ' ET", "third", "3rd"),
+        // Here the first row's own `'` makes the step down that the rows after it build on.
+        ("BT /F1 12 Tf 14 TL 72 714 Td (first row here) ' (second row here) ' (third row here) ' ET", "first", "1st"),
+    ] {
+        let source = lines_of(&text_page(quoted));
+        let after = lines_of(&edit(quoted, from, to));
+        assert_eq!(after.len(), 3, "{to}: {after:?}");
+        for ((text, at), (old, was)) in after.iter().zip(&source) {
+            assert_eq!(*text, old.replacen(from, to, 1));
+            assert!((at[0] - was[0]).abs() < 0.01 && (at[1] - was[1]).abs() < 0.01, "{to}: {text} stays at {was:?}, not {at:?}");
+        }
+    }
+    // A row that grows past the paragraph's width wraps and pushes the rows below it down;
+    // those are rewritten in their new places, never left behind as well.
+    let rows = "BT /F1 12 Tf 14.4 TL 72 700 Td (one two three four) Tj T* (five six seven eight) Tj T* (nine ten eleven twelve) Tj ET";
+    let doc = edit(rows, "two", "two and a great many more words");
+    let text: String = lines_of(&doc).into_iter().map(|(t, _)| t + " ").collect();
+    for word in ["one", "five", "nine", "twelve"] {
+        assert_eq!(text.matches(word).count(), 1, "{word} appears once: {text}");
+    }
+    assert!(lines_of(&doc).len() > 3, "the edited row wrapped: {text}");
+}
+
+/// A page whose `/F1` is Inter embedded as a simple WinAnsi TrueType font, under `base_font`.
+fn embedded_program_page(content: &str, base_font: &str) -> Document {
+    let mut doc = text_page(content);
+    let program = doc.add(Object::Stream(Stream::flate(Dict::new(), include_bytes!("../../../assets/fonts/Inter-Regular.ttf"))));
+    let mut descriptor = Dict::new();
+    descriptor.set(b"Type".to_vec(), Object::name("FontDescriptor"));
+    descriptor.set(b"FontName".to_vec(), Object::name(base_font));
+    descriptor.set(b"FontFile2".to_vec(), Object::Ref(program));
+    let mut font = Dict::new();
+    font.set(b"Type".to_vec(), Object::name("Font"));
+    font.set(b"Subtype".to_vec(), Object::name("TrueType"));
+    font.set(b"BaseFont".to_vec(), Object::name(base_font));
+    font.set(b"Encoding".to_vec(), Object::name("WinAnsiEncoding"));
+    font.set(b"FirstChar".to_vec(), Object::Int(32));
+    font.set(b"LastChar".to_vec(), Object::Int(126));
+    font.set(b"Widths".to_vec(), Object::Array((32..=126).map(|_| Object::Int(560)).collect()));
+    font.set(b"FontDescriptor".to_vec(), Object::Dict(descriptor));
+    doc.set(pdfcraft_cos::ObjRef::new(5, 0), Object::Dict(font));
+    reopen(&doc)
+}
+
+/// The font programs and subtypes of the page's font resources.
+fn page_font_programs(doc: &Document) -> Vec<(Vec<u8>, Option<Vec<u8>>)> {
+    let page = pdfcraft_model::pages(doc).remove(0);
+    let resources = page.dict.get(b"Resources").and_then(|r| doc.resolve(r).as_dict().cloned()).unwrap_or_default();
+    let fonts = resources.get(b"Font").and_then(|f| doc.resolve(f).as_dict().cloned()).unwrap_or_default();
+    fonts
+        .iter()
+        .filter_map(|(_, f)| doc.resolve(f).as_dict().cloned())
+        .map(|f| (f.name(b"Subtype").unwrap_or_default().to_vec(), pdfcraft_fonts::pdf::embedded_sfnt(doc, &f)))
+        .collect()
+}
+
+#[test]
+fn a_new_character_comes_from_the_source_fonts_own_embedded_program() {
+    let inter = include_bytes!("../../../assets/fonts/Inter-Regular.ttf");
+    for (content, from, to) in [
+        // One row (the single-style path) and a row of a two-row paragraph (the row editor's path).
+        ("BT /F1 12 Tf 72 700 Td (Stable text) Tj ET", "text", "tőxt"),
+        ("BT /F1 12 Tf 14 TL 72 700 Td (First row) Tj T* (Second row) Tj ET", "Second", "Sőcond"),
+    ] {
+        let mut doc = embedded_program_page(content, "Inter-Regular");
+        let block = text::text_blocks(&doc, 0).unwrap()[0].clone();
+        let draft = block.editor_text.replacen(from, to, 1);
+        let edit = text::rewrite_block(&mut doc, 0, 0, Some(&draft), &text::BlockStyle::default()).unwrap();
+        assert_eq!(edit.substituted, None, "{to}: no other family stands in");
+        let doc = reopen(&doc);
+        // The new character is its own run in the other resource, read back into the same word.
+        assert_eq!(text::text_blocks(&doc, 0).unwrap()[0].editor_text, draft, "{to}");
+        let fonts = page_font_programs(&doc);
+        assert!(fonts.iter().all(|(subtype, _)| subtype != b"Type3"), "{to}: no fallback glyphs");
+        assert!(
+            fonts.iter().any(|(subtype, program)| subtype == b"Type0" && program.as_deref() == Some(inter.as_slice())),
+            "{to}: the source program draws it"
+        );
+    }
+}
+
+#[test]
+fn a_subset_program_is_not_trusted_for_new_characters_and_the_error_names_the_character() {
+    let mut doc = embedded_program_page("BT /F1 12 Tf 72 700 Td (Stable text) Tj ET", "ABCDEF+Inter-Regular");
+    let before = page_content_bytes(&doc, 0);
+    let result = text::rewrite_block(&mut doc, 0, 0, Some("Stable tőxt"), &text::BlockStyle::default());
+    if pdfcraft_fonts::document_japanese_font().is_some() {
+        eprintln!("built with craft-fonts: the fallback font draws the new character");
+        assert!(result.is_ok(), "{result:?}");
+        return;
+    }
+    let Err(EditError::Invalid(msg)) = result else { panic!("expected a clear error, got {result:?}") };
+    assert!(msg.contains("ő (U+0151)") && msg.contains("Load font") && !msg.contains("Japanese"), "{msg}");
+    assert_eq!(page_content_bytes(&doc, 0), before);
+}
+
+#[test]
+fn draft_layout_matches_the_paragraph_an_applied_edit_draws() {
+    let content = "BT /F1 12 Tf 14 TL 72 700 Td (A first paragraph of words) Tj T* (with a second row) Tj ET \
+                   BT /F1 12 Tf 72 600 Td (Another paragraph below) Tj ET BT /F1 12 Tf 320 700 Td (Side note) Tj ET";
+    let doc = text_page(content);
+    let block = text::text_blocks(&doc, 0).unwrap().into_iter().position(|b| b.text.starts_with("A first")).unwrap();
+    let source = text::text_blocks(&doc, 0).unwrap()[block].clone();
+    for draft in [
+        source.editor_text.replacen("words", "many more words than before", 1),
+        source.editor_text.replacen(" of words", "", 1),
+        format!("{}\nand a third row", source.editor_text),
+    ] {
+        let layout = text::text_edit_layout(&doc, 0, block, &draft, &text::BlockStyle::default()).unwrap();
+        // Apply the same edit and measure every run that isn't one of the page's other runs.
+        let mut applied = doc.clone();
+        text::rewrite_block(&mut applied, 0, block, Some(&draft), &text::BlockStyle::default()).unwrap();
+        let others: Vec<_> =
+            text::text_lines(&doc, 0).unwrap().into_iter().enumerate().filter(|(i, _)| !source.lines.contains(i)).map(|(_, l)| l.rect).collect();
+        let drawn = text::text_lines(&applied, 0)
+            .unwrap()
+            .into_iter()
+            .map(|l| l.rect)
+            .filter(|r| !others.contains(r))
+            .reduce(|a, b| [a[0].min(b[0]), a[1].min(b[1]), a[2].max(b[2]), a[3].max(b[3])]);
+        assert_eq!(layout.draft_rect, drawn, "{draft:?}");
+        assert_eq!(layout.source_rect, source.rect);
+    }
+}
+
+#[test]
+fn japanese_paragraphs_wrap_between_characters_without_closing_marks_at_a_row_start() {
+    if pdfcraft_fonts::document_japanese_font().is_none() {
+        eprintln!("skipping the Japanese wrapping checks: built without craft-fonts (set CRAFT_FONTS_DIR)");
+        return;
+    }
+    let text = "日本語の文章は単語の間に空白がないので、どの文字の間でも行を折り返せます。ただし「句読点」や小さい「っ」は行頭に来ません。";
+    // One paragraph (the single-style path), and a heading row before it (the row editor's path).
+    for draft in [text.to_string(), format!("見出し\n{text}")] {
+        let mut doc = text_page("BT /F1 12 Tf 72 700 Td (Placeholder text) Tj ET");
+        text::rewrite_block(&mut doc, 0, 0, Some(&draft), &text::BlockStyle { width: Some(120.0), ..Default::default() }).unwrap();
+        let block = text::text_blocks(&reopen(&doc), 0).unwrap().remove(0);
+        let rows: Vec<&str> = block.editor_text.split('\n').collect();
+        assert!(rows.len() > 4, "{rows:?}");
+        assert_eq!(rows.concat(), draft.replace('\n', ""), "no space is added between the pieces");
+        assert!(block.rect[2] - block.rect[0] <= 120.5, "{:?} {rows:?}", block.rect);
+        for row in &rows {
+            assert!(!row.starts_with(['、', '。', '」', 'っ']) && !row.ends_with('「'), "{row:?} in {rows:?}");
+        }
+    }
+}
diff --git a/crates/edit/src/text.rs b/crates/edit/src/text.rs
index 13233f71d..9c83cf9a3 100644
--- a/crates/edit/src/text.rs
+++ b/crates/edit/src/text.rs
@@ -31,6 +31,10 @@ pub struct TextLine {
     pub text: String,
     /// Its box in user space.
     pub rect: [f64; 4],
+    /// The boxes of the words it draws, in user space: from each word's first glyph to the end of
+    /// its last, without the spaces and `TJ` adjustments around it. `rect` also spans gaps that
+    /// draw nothing, such as the adjustment an applied redaction leaves where text was removed.
+    pub ink: Vec<[f64; 4]>,
     /// The font's resource name and `/BaseFont` (or Type 3 descriptor's `/FontName`), and its size in text space.
     pub font: String,
     pub base_font: String,
@@ -140,7 +144,10 @@ pub struct TextEditLayout {
 }
 
 pub fn text_edit_layout(doc: &Document, page: usize, block: usize, text: &str, style: &BlockStyle) -> Result<TextEditLayout, EditError> {
-    let original = text_blocks(doc, page)?;
+    // This runs on every keystroke: read the page once for the paragraphs, the untouched runs
+    // and the rewrite, which starts from the same unchanged page.
+    let lines = text_lines(doc, page)?;
+    let original = group_blocks(&lines);
     let source = original.get(block).ok_or(EditError::Invalid("text block does not exist".into()))?;
     if text == source.editor_text && *style == BlockStyle::default() {
         return Ok(TextEditLayout { source_rect: source.rect, draft_rect: Some(source.rect), overflow: false });
@@ -150,13 +157,13 @@ pub fn text_edit_layout(doc: &Document, page: usize, block: usize, text: &str, s
     let key =
         |line: &TextLine| (line.text.clone(), line.font.clone(), line.rect.map(f64::to_bits), line.size.to_bits(), line.color.map(f64::to_bits));
     let mut untouched = std::collections::BTreeMap::new();
-    for (index, line) in text_lines(doc, page)?.iter().enumerate() {
+    for (index, line) in lines.iter().enumerate() {
         if !source.lines.contains(&index) {
             *untouched.entry(key(line)).or_insert(0_usize) += 1;
         }
     }
     let mut draft = doc.clone();
-    rewrite_block(&mut draft, page, block, Some(text), style)?;
+    rewrite_block_from(&mut draft, page, lines, block, Some(text), style, MAX_TYPE3_GLYPHS)?;
     let mut rect: Option<[f64; 4]> = None;
     for line in text_lines(&draft, page)? {
         if let Some(count) = untouched.get_mut(&key(&line))
@@ -263,17 +270,17 @@ pub struct TextBlock {
 }
 
 impl TextBlock {
-    /// Preserve styles outside the changed range; inserted characters inherit the surrounding
-    /// source run. Byte ranges are always UTF-8 boundaries. Linear time, including large edits.
+    /// Preserve styles outside the changed ranges; inserted characters inherit the surrounding
+    /// source run. The texts are aligned word by word, so words left untouched between two edits
+    /// keep their own runs (#2198); past [`MAX_CHANGED_WORDS`] the draft counts as one change.
+    /// Byte ranges are always UTF-8 boundaries. Linear time, including large edits.
     pub fn edited_spans(&self, draft: &str) -> Vec<(std::ops::Range<usize>, usize)> {
         if self.editor_text.len() > 4_000_000 || draft.len() > 4_000_000 {
             return vec![(0..draft.len(), self.lines.first().copied().unwrap_or(0))];
         }
         let old: Vec<_> = self.editor_text.chars().collect();
         let new: Vec<_> = draft.char_indices().collect();
-        let prefix = old.iter().zip(&new).take_while(|(a, (_, b))| *a == b).count();
-        let suffix =
-            old.iter().rev().zip(new.iter().rev()).take(old.len().min(new.len()).saturating_sub(prefix)).take_while(|(a, (_, b))| *a == b).count();
+        let chars: Vec<_> = new.iter().map(|(_, c)| *c).collect();
         let mut original = Vec::with_capacity(old.len());
         let mut span = 0;
         for (byte, _) in self.editor_text.char_indices() {
@@ -282,17 +289,36 @@ impl TextBlock {
             }
             original.push(self.spans.get(span).or_else(|| self.spans.last()).map_or(0, |(_, i)| *i));
         }
-        let inherited = original.get(prefix.saturating_sub(1)).or_else(|| original.get(prefix)).copied().unwrap_or(0);
+        let mut sources = Vec::with_capacity(new.len());
+        let slices = |text: &[char]| words(text).into_iter().map(|w| text.get(w).unwrap_or_default().to_vec()).collect::<Vec<_>>();
+        let (old_words, new_words) = (slices(&old), slices(&chars));
+        match edit_script(&old_words, &new_words, MAX_CHANGED_WORDS) {
+            Some(script) => {
+                // `(o, n)`: where the current change starts in the old and new text; `(x, y)`: where it ends.
+                let ((mut o, mut n), (mut x, mut y)) = ((0, 0), (0, 0));
+                let (mut a, mut b) = (old_words.iter(), new_words.iter());
+                for step in script {
+                    match step {
+                        Step::Keep => {
+                            replaced(&original, o, old.get(o..x).unwrap_or_default(), chars.get(n..y).unwrap_or_default(), &mut sources);
+                            let len = a.next().map_or(0, Vec::len);
+                            b.next();
+                            sources.extend(original.get(x..x.saturating_add(len)).unwrap_or_default());
+                            (x, y) = (x.saturating_add(len), y.saturating_add(len));
+                            (o, n) = (x, y);
+                        }
+                        Step::Delete => x = x.saturating_add(a.next().map_or(0, Vec::len)),
+                        Step::Insert => y = y.saturating_add(b.next().map_or(0, Vec::len)),
+                    }
+                }
+                replaced(&original, o, old.get(o..x).unwrap_or_default(), chars.get(n..y).unwrap_or_default(), &mut sources);
+            }
+            None => replaced(&original, 0, &old, &chars, &mut sources),
+        }
+        let fallback = original.first().copied().unwrap_or(0);
         let mut result: Vec<(std::ops::Range<usize>, usize)> = Vec::new();
         for (i, (byte, ch)) in new.iter().enumerate() {
-            let source = if i < prefix {
-                original.get(i).copied()
-            } else if i >= new.len().saturating_sub(suffix) {
-                original.get(old.len().saturating_sub(new.len() - i)).copied()
-            } else {
-                Some(inherited)
-            }
-            .unwrap_or(inherited);
+            let source = sources.get(i).copied().unwrap_or(fallback);
             let end = byte.saturating_add(ch.len_utf8());
             if let Some((range, _)) = result.last_mut().filter(|(_, prev)| *prev == source) {
                 range.end = end;
@@ -304,6 +330,108 @@ impl TextBlock {
     }
 }
 
+/// Changed words [`TextBlock::edited_spans`] aligns before it treats the draft as one change.
+/// Myers' diff costs O((N + M) · D), so bounding D keeps it linear.
+const MAX_CHANGED_WORDS: usize = 64;
+
+/// `text` split into words, each with the whitespace after it, as char ranges.
+fn words(text: &[char]) -> Vec<std::ops::Range<usize>> {
+    let mut out = Vec::new();
+    let mut start = 0;
+    for (i, pair) in text.windows(2).enumerate() {
+        if let [a, b] = pair
+            && a.is_whitespace()
+            && !b.is_whitespace()
+        {
+            out.push(start..i + 1);
+            start = i + 1;
+        }
+    }
+    if start < text.len() {
+        out.push(start..text.len());
+    }
+    out
+}
+
+#[derive(Clone, Copy, Debug, PartialEq)]
+enum Step {
+    Keep,
+    Delete,
+    Insert,
+}
+
+/// Myers' shortest edit script from `a` to `b`, or `None` when it takes more than `max` steps.
+fn edit_script<T: PartialEq>(a: &[T], b: &[T], max: usize) -> Option<Vec<Step>> {
+    let (n, m) = (a.len() as isize, b.len() as isize);
+    let max = max.min(a.len().saturating_add(b.len())) as isize;
+    // Furthest x reached on each diagonal k = x - y, stored at k + max + 1.
+    let at = |v: &[isize], k: isize| usize::try_from(k + max + 1).ok().and_then(|i| v.get(i).copied()).unwrap_or(0);
+    let mut v = vec![0isize; (2 * max + 3) as usize];
+    let mut trace = Vec::new();
+    for d in 0..=max {
+        trace.push(v.clone());
+        for k in (-d..=d).step_by(2) {
+            let down = k == -d || (k != d && at(&v, k - 1) < at(&v, k + 1));
+            let mut x = if down { at(&v, k + 1) } else { at(&v, k - 1) + 1 };
+            let mut y = x - k;
+            while x < n && y < m && a.get(x as usize) == b.get(y as usize) {
+                x += 1;
+                y += 1;
+            }
+            if let Some(slot) = usize::try_from(k + max + 1).ok().and_then(|i| v.get_mut(i)) {
+                *slot = x;
+            }
+            if x >= n && y >= m {
+                return Some(backtrack(&trace, n, m, max));
+            }
+        }
+    }
+    None
+}
+
+/// Walk Myers' saved frontiers back from the end to the edit script.
+fn backtrack(trace: &[Vec<isize>], n: isize, m: isize, max: isize) -> Vec<Step> {
+    let at = |v: &[isize], k: isize| usize::try_from(k + max + 1).ok().and_then(|i| v.get(i).copied()).unwrap_or(0);
+    let mut steps = Vec::new();
+    let (mut x, mut y) = (n, m);
+    for (d, v) in trace.iter().enumerate().rev() {
+        let (d, k) = (d as isize, x - y);
+        let prev_k = if k == -d || (k != d && at(v, k - 1) < at(v, k + 1)) { k + 1 } else { k - 1 };
+        let prev_x = at(v, prev_k);
+        let prev_y = prev_x - prev_k;
+        while x > prev_x && y > prev_y {
+            steps.push(Step::Keep);
+            x -= 1;
+            y -= 1;
+        }
+        if d > 0 {
+            steps.push(if x == prev_x { Step::Insert } else { Step::Delete });
+        }
+        (x, y) = (prev_x, prev_y);
+    }
+    steps.reverse();
+    steps
+}
+
+/// `old`, at char `at` of the source, became `new`: characters kept at either end keep their
+/// runs, and the rest inherit the run just before the change (or the first one it replaces).
+fn replaced(original: &[usize], at: usize, old: &[char], new: &[char], out: &mut Vec<usize>) {
+    let prefix = old.iter().zip(new).take_while(|(a, b)| a == b).count();
+    let suffix = old.iter().rev().zip(new.iter().rev()).take(old.len().min(new.len()).saturating_sub(prefix)).take_while(|(a, b)| a == b).count();
+    let start = at.saturating_add(prefix);
+    let inherited = start.checked_sub(1).and_then(|i| original.get(i)).or_else(|| original.get(start)).copied().unwrap_or(0);
+    for i in 0..new.len() {
+        let source = if i < prefix {
+            original.get(at.saturating_add(i)).copied()
+        } else if i >= new.len().saturating_sub(suffix) {
+            original.get(at.saturating_add(old.len()).saturating_sub(new.len() - i)).copied()
+        } else {
+            Some(inherited)
+        };
+        out.push(source.unwrap_or(inherited));
+    }
+}
+
 impl TextLine {
     /// The baseline's height in user space.
     pub fn origin_baseline(&self) -> f64 {
@@ -322,6 +450,47 @@ impl TextLine {
         let m = Matrix(self.origin.tm).then(&Matrix(self.origin.ctm)).0;
         m[1].atan2(m[0]).to_degrees()
     }
+
+    /// The unit direction its baseline runs in, in user space.
+    fn direction(&self) -> (f64, f64) {
+        direction(&Matrix(self.origin.tm).then(&Matrix(self.origin.ctm)))
+    }
+
+    /// Whether it reads left to right along the page's x axis (most text; a page drawn
+    /// turned a quarter, as landscape pages often are, isn't).
+    pub(crate) fn upright(&self) -> bool {
+        let (x, y) = self.direction();
+        (x - 1.0).abs() < 1e-3 && y.abs() < 1e-3
+    }
+
+    /// Where it starts as `(along, across)` its baseline: user space turned to the text's direction.
+    fn frame_origin(&self) -> (f64, f64) {
+        to_frame(self.direction(), (self.origin.x, self.origin.baseline))
+    }
+
+    /// Its box in the same frame, `[along0, across0, along1, across1]` (for upright text, `rect`).
+    fn frame_rect(&self) -> [f64; 4] {
+        let dir = self.direction();
+        let r = self.rect;
+        [(r[0], r[1]), (r[2], r[1]), (r[0], r[3]), (r[2], r[3])]
+            .into_iter()
+            .map(|p| to_frame(dir, p))
+            .fold([f64::MAX, f64::MAX, f64::MIN, f64::MIN], |b, p| [b[0].min(p.0), b[1].min(p.1), b[2].max(p.0), b[3].max(p.1)])
+    }
+}
+
+/// The unit x axis of a text rendering matrix in user space (`(1, 0)` when it is degenerate).
+fn direction(m: &Matrix) -> (f64, f64) {
+    let (x, y) = (m.0[0], m.0[1]);
+    let length = x.hypot(y);
+    if length.is_finite() && length > 1e-9 { (x / length, y / length) } else { (1.0, 0.0) }
+}
+
+/// User-space point `p` as `(along, across)` a baseline running in unit direction `dir`. Upright
+/// text (`dir` = `(1, 0)`) keeps its coordinates, so lines and rows of turned text are found the
+/// same way (#1443).
+fn to_frame(dir: (f64, f64), p: (f64, f64)) -> (f64, f64) {
+    (p.0 * dir.0 + p.1 * dir.1, p.1 * dir.0 - p.0 * dir.1)
 }
 
 /// What replacing a line did.
@@ -470,9 +639,12 @@ struct Shown {
     bt_state: Ts,
     text: String,
     rect: [f64; 4],
+    /// The boxes of its words (see [`TextLine::ink`]).
+    ink: Vec<[f64; 4]>,
     baseline: f64,
     start_x: f64,
     end_x: f64,
+    end_y: f64,
     bt: usize,
     font: Vec<u8>,
     base_font: String,
@@ -487,6 +659,43 @@ struct Shown {
     actual_text: bool,
 }
 
+impl Shown {
+    /// The unit direction of its baseline, where it starts and ends along it, and the baseline's
+    /// offset across it (for upright text: the user-space x, x and y).
+    fn span(&self) -> ((f64, f64), f64, f64, f64) {
+        let dir = direction(&self.tm.then(&self.state.ctm));
+        let (start, across) = to_frame(dir, (self.start_x, self.baseline));
+        (dir, start, to_frame(dir, (self.end_x, self.end_y)).0, across)
+    }
+}
+
+/// Where the previous run of a line ended: its text object, baseline direction, offset across
+/// the baseline, end along it and size.
+#[derive(Clone, Copy)]
+struct Pen {
+    bt: usize,
+    dir: (f64, f64),
+    across: f64,
+    end: f64,
+    size: f64,
+}
+
+impl Pen {
+    fn after(s: &Shown) -> Self {
+        let (dir, _, end, across) = s.span();
+        Pen { bt: s.bt, dir, across, end, size: s.size.max(1.0) }
+    }
+
+    /// Whether `s` could continue the same line on geometry alone: on the same baseline, starting
+    /// at most a word gap (`reach` sizes) after it. Also the gap along the baseline.
+    fn continues(&self, s: &Shown, reach: f64) -> (bool, f64) {
+        let (dir, start, _, across) = s.span();
+        let gap = start - self.end;
+        let same_dir = (dir.0 - self.dir.0).abs() < 1e-3 && (dir.1 - self.dir.1).abs() < 1e-3;
+        (same_dir && (across - self.across).abs() < self.size * 0.3 && gap > -self.size && gap < self.size * reach, gap)
+    }
+}
+
 /// The graphics state carried from one of a page's content streams to the next: the streams
 /// are one stream in pieces (§7.8.2), so a `cm` (AutoCAD scales the whole page in the first
 /// stream), an unbalanced `q`, the font and the colour still apply in the streams after it.
@@ -564,6 +773,7 @@ fn interpret(
                                 first.rect[2].max(shown.rect[2]),
                                 first.rect[3].max(shown.rect[3]),
                             ];
+                            first.ink.extend(shown.ink);
                         }
                         first.extra_ops.extend([open, i]);
                         // Only right-to-left ActualText is already in typing order and must stay
@@ -574,6 +784,7 @@ fn interpret(
                         first.text = logical;
                         first.start_x = first.rect[0];
                         first.end_x = first.rect[2];
+                        first.end_y = first.baseline;
                         first.advance = (first.end_x - first.start_x) / first.tm.then(&first.state.ctm).0[0].abs().max(1e-6);
                         out.push(first);
                     }
@@ -664,16 +875,34 @@ fn interpret(
                 let mut text = String::new();
                 let mut decodable = true;
                 let mut x_text = 0.0;
+                // Where each word's glyphs start and end along the run (text space), and whether
+                // the next glyph continues the last word.
+                let mut words: Vec<(f64, f64)> = Vec::new();
+                let mut in_word = false;
                 let mut glyph_count = 0_usize;
                 for p in &pieces {
                     match p {
                         Object::String(s) => {
                             for (code, len) in m.codes(&s.bytes) {
                                 glyph_count = glyph_count.saturating_add(1);
-                                match m.text_of(code) {
+                                let shown = m.text_of(code);
+                                let blank =
+                                    m.is_space(code, len) || shown.as_deref().is_some_and(|t| !t.is_empty() && t.chars().all(char::is_whitespace));
+                                match shown {
                                     Some(t) => text.push_str(&t),
                                     None => decodable = false,
                                 }
+                                if !blank {
+                                    let ink_end = x_text + m.width(code) * ts.size * ts.scale;
+                                    // A negative font size or `Tz` runs the glyphs backwards:
+                                    // the word is the union of its glyphs, whichever way they go.
+                                    let (lo, hi) = (x_text.min(ink_end), x_text.max(ink_end));
+                                    match words.last_mut() {
+                                        Some(word) if in_word => *word = (word.0.min(lo), word.1.max(hi)),
+                                        _ => words.push((lo, hi)),
+                                    }
+                                }
+                                in_word = !blank;
                                 let w = m.width(code) * ts.size + ts.char_spacing + if m.is_space(code, len) { ts.word_spacing } else { 0.0 };
                                 x_text += w * ts.scale;
                             }
@@ -685,6 +914,11 @@ fn interpret(
                                 if dx > ts.size * 0.2 && !text.ends_with(' ') {
                                     text.push(' ');
                                 }
+                                // Kerning keeps a word together; a jump either way of more
+                                // than 0.2 em ends it (whatever the sign of the size or `Tz`).
+                                if dx.abs() > (ts.size * ts.scale).abs() * 0.2 {
+                                    in_word = false;
+                                }
                                 x_text += dx;
                             }
                         }
@@ -702,6 +936,15 @@ fn interpret(
                 let rect = corners
                     .iter()
                     .fold([f64::MAX, f64::MAX, f64::MIN, f64::MIN], |b, p| [b[0].min(p.0), b[1].min(p.1), b[2].max(p.0), b[3].max(p.1)]);
+                let ink = words
+                    .iter()
+                    .map(|&(a, b)| {
+                        let (y0, y1) = (ts.rise + m.descent * ts.size, ts.rise + m.ascent * ts.size);
+                        [trm0.apply(a, y0), trm0.apply(b, y0), trm0.apply(a, y1), trm0.apply(b, y1)]
+                            .iter()
+                            .fold([f64::MAX, f64::MAX, f64::MIN, f64::MIN], |r, p| [r[0].min(p.0), r[1].min(p.1), r[2].max(p.0), r[3].max(p.1)])
+                    })
+                    .collect();
                 let size_user = (trm0.0[2].powi(2) + trm0.0[3].powi(2)).sqrt() * ts.size;
                 // A numeric-only TJ adjusts the current text matrix but paints no glyphs.
                 // It must not create a phantom editable line or enlarge its neighbours' boxes.
@@ -720,9 +963,11 @@ fn interpret(
                     bt_state: at_bt.1.clone(),
                     text,
                     rect,
+                    ink,
                     baseline: start.1,
                     start_x: start.0,
                     end_x: end.0,
+                    end_y: end.1,
                     bt,
                     font: name,
                     base_font: m.base_font.clone(),
@@ -759,7 +1004,7 @@ pub fn text_lines(doc: &Document, page: usize) -> Result<Vec<TextLine>, EditErro
     let pieces = Pieces::join(&content_streams(doc, &p.dict).into_iter().map(|(_, d)| d).collect::<Vec<_>>());
     let ops = pieces.parse().ops;
     let shown = interpret(doc, &ops, &fonts_res, &mut cache, &mut carry, None, true);
-    let mut last: Option<(usize, usize, f64, f64, f64)> = None; // (piece, bt, baseline, end_x, size)
+    let mut last: Option<(usize, Pen)> = None; // the stream piece and where its last run ended
     for mut s in shown {
         // A single RTL glyph's ActualText (e.g. lam-alef) is an inline ligature, not a
         // separate logical line. Put its letters into visual order before joining the
@@ -772,7 +1017,9 @@ pub fn text_lines(doc: &Document, page: usize) -> Result<Vec<TextLine>, EditErro
         // A line belongs to one stream piece. Within it, PDF producers often put every word
         // in its own BT/ET: geometry and text state, not object boundaries, define a line.
         let si = ops.get(s.op).map_or(0, |op| pieces.pieces_of(op).0);
-        let joins = last.is_some_and(|(piece, bt, base, end, size)| {
+        let joins = last.is_some_and(|(piece, pen)| {
+            let bt = pen.bt;
+            let (near, gap) = pen.continues(&s, if bt == s.bt { 3.0 } else { 1.5 });
             piece == si
                 && lines.last().is_some_and(|l| l.scope == s.scope && l.logical_order == s.logical_order)
                 && (bt == s.bt || lines.last().is_some_and(|l| compatible_word(l, &s)))
@@ -781,20 +1028,19 @@ pub fn text_lines(doc: &Document, page: usize) -> Result<Vec<TextLine>, EditErro
                     || lines.last().is_some_and(|l| {
                         (s.size - l.size).abs() < 0.01 && s.bold == l.bold && s.italic == l.italic && fill_color(&s.state.fill) == l.color
                     }))
-                && (s.baseline - base).abs() < size * 0.3
-                && s.start_x > end - size
-                && s.start_x - end < size * if bt == s.bt { 3.0 } else { 1.5 }
+                && near
                 // An OCR layer is one text object over the whole scan: its words continue a line
                 // only across a word space, not across a table cell or a tab stop.
-                && (s.state.render_mode != 3 || s.start_x - end < size * 0.6)
+                && (s.state.render_mode != 3 || gap < pen.size * 0.6)
         });
         if joins && let Some(l) = lines.last_mut() {
-            let gap = s.start_x - last.map_or(s.start_x, |x| x.3);
+            let gap = last.map_or(0.0, |(_, pen)| pen.continues(&s, 0.0).1);
             if gap > l.size * 0.2 && !l.text.ends_with(' ') && !s.text.starts_with(' ') {
                 l.text.push(' ');
             }
             l.text.push_str(&s.text);
             l.rect = [l.rect[0].min(s.rect[0]), l.rect[1].min(s.rect[1]), l.rect[2].max(s.rect[2]), l.rect[3].max(s.rect[3])];
+            l.ink.extend(s.ink.iter().copied());
             l.ops.push(s.op);
             l.ops.extend(s.extra_ops.iter().copied());
             l.decodable &= s.decodable;
@@ -805,6 +1051,7 @@ pub fn text_lines(doc: &Document, page: usize) -> Result<Vec<TextLine>, EditErro
             lines.push(TextLine {
                 text: s.text.clone(),
                 rect: s.rect,
+                ink: s.ink.clone(),
                 font: String::from_utf8_lossy(&s.font).into_owned(),
                 base_font: s.base_font.clone(),
                 size: s.size,
@@ -832,7 +1079,7 @@ pub fn text_lines(doc: &Document, page: usize) -> Result<Vec<TextLine>, EditErro
                 },
             });
         }
-        last = Some((si, s.bt, s.baseline, s.end_x, s.size.max(1.0)));
+        last = Some((si, Pen::after(&s)));
     }
     // Content streams draw right-to-left lines in visual order; the editor works in typing order.
     for l in lines.iter_mut().filter(|l| !l.logical_order) {
@@ -862,8 +1109,9 @@ fn compatible_word(line: &TextLine, shown: &Shown) -> bool {
 
 /// The line `s` continues, or a new one: `last` is the previous run of the same stream
 /// (`bt`, baseline, end x, size).
-fn add_shown(lines: &mut Vec<TextLine>, last: &mut Option<(usize, f64, f64, f64)>, s: Shown, stream: usize) {
-    let joins = last.is_some_and(|(bt, base, end, size)| {
+fn add_shown(lines: &mut Vec<TextLine>, last: &mut Option<Pen>, s: Shown, stream: usize) {
+    let joins = last.is_some_and(|pen| {
+        let bt = pen.bt;
         lines.last().is_some_and(|l| l.scope == s.scope && l.logical_order == s.logical_order)
             && (bt == s.bt || lines.last().is_some_and(|l| compatible_word(l, &s)))
             && (s.text.trim().is_empty() || lines.last().is_some_and(|l| same_font(l, &s.font, s.face.as_deref())))
@@ -871,17 +1119,16 @@ fn add_shown(lines: &mut Vec<TextLine>, last: &mut Option<(usize, f64, f64, f64)
                 || lines.last().is_some_and(|l| {
                     (s.size - l.size).abs() < 0.01 && s.bold == l.bold && s.italic == l.italic && fill_color(&s.state.fill) == l.color
                 }))
-            && (s.baseline - base).abs() < size * 0.3
-            && s.start_x > end - size
-            && s.start_x - end < size * if bt == s.bt { 3.0 } else { 1.5 }
+            && pen.continues(&s, if bt == s.bt { 3.0 } else { 1.5 }).0
     });
     if joins && let Some(l) = lines.last_mut() {
-        let gap = s.start_x - last.map_or(s.start_x, |x| x.2);
+        let gap = last.map_or(0.0, |pen| pen.continues(&s, 0.0).1);
         if gap > l.size * 0.2 && !l.text.ends_with(' ') && !s.text.starts_with(' ') {
             l.text.push(' ');
         }
         l.text.push_str(&s.text);
         l.rect = [l.rect[0].min(s.rect[0]), l.rect[1].min(s.rect[1]), l.rect[2].max(s.rect[2]), l.rect[3].max(s.rect[3])];
+        l.ink.extend(s.ink.iter().copied());
         l.ops.push(s.op);
         l.ops.extend(s.extra_ops.iter().copied());
         l.decodable &= s.decodable;
@@ -891,6 +1138,7 @@ fn add_shown(lines: &mut Vec<TextLine>, last: &mut Option<(usize, f64, f64, f64)
         lines.push(TextLine {
             text: s.text.clone(),
             rect: s.rect,
+            ink: s.ink.clone(),
             font: String::from_utf8_lossy(&s.font).into_owned(),
             base_font: s.base_font.clone(),
             size: s.size,
@@ -918,7 +1166,7 @@ fn add_shown(lines: &mut Vec<TextLine>, last: &mut Option<(usize, f64, f64, f64)
             },
         });
     }
-    *last = Some((s.bt, s.baseline, s.end_x, s.size.max(1.0)));
+    *last = Some(Pen::after(&s));
 }
 
 /// How deep form XObjects nest before reading stops (they may also refer to themselves).
@@ -1166,6 +1414,22 @@ fn unicode_hex(ch: char) -> String {
     encoded.iter().map(|u| format!("{u:04X}")).collect()
 }
 
+/// No font this build has can draw `text`. Only Japanese text is about the Japanese face: other
+/// characters are missing from the paragraph's font, and choosing a font that has them works too.
+fn no_fallback_font(text: &str) -> EditError {
+    let japanese = |c: char| matches!(u32::from(c), 0x3000..=0x30FF | 0x3400..=0x4DBF | 0x4E00..=0x9FFF | 0xF900..=0xFAFF | 0xFF00..=0xFFEF);
+    if text.chars().any(japanese) {
+        return no_japanese_font();
+    }
+    let Some(ch) = text.chars().find(|c| !c.is_whitespace() && !is_win_ansi_char(*c)) else { return no_japanese_font() };
+    EditError::Invalid(format!(
+        "the paragraph's font has no glyph for {ch} (U+{:04X}) and this build has no fallback font for it; \
+         choose a font that has it (Load font… or Installed fonts…), or use an official release, which includes \
+         PdfCraft's fallback fonts (to build them in, set CRAFT_FONTS_DIR to a craft-fonts checkout)",
+        u32::from(ch)
+    ))
+}
+
 /// This build has no Japanese face to draw replacement text with.
 fn no_japanese_font() -> EditError {
     EditError::Invalid(
@@ -1230,7 +1494,7 @@ fn type3_font(
     // character. When none has them all, the best face reports the character it lacks. Hebrew
     // text keeps the Hebrew face and takes each character it lacks from the next face that has it.
     let face = if hebrew { faces.first().copied() } else { fallback_face(&faces, &chars, |face, ch| japanese_glyph_from(face, ch).is_ok()) }
-        .ok_or_else(no_japanese_font)?;
+        .ok_or_else(|| no_fallback_font(text))?;
     let others: &[&CraftFont] = if hebrew { faces.get(1..).unwrap_or_default() } else { &[] };
     // Every outline is read before the document is touched, so a character that fails leaves it
     // as it was. Each font takes the next `per_font` characters; codes restart at 1 in each.
@@ -1338,6 +1602,28 @@ fn type3_encode(fallback: &Type3Fallback, text: &str) -> Option<Vec<(String, Vec
     runs.into_iter().map(|(font, bytes)| Some((fallback.names.get(font)?.clone(), bytes))).collect()
 }
 
+/// The source font's own TrueType/OpenType program, when the document embeds a complete one whose
+/// licence allows editable embedding. A subset (an `ABCDEF+` name) is left out: a character can keep
+/// its mapping there after the subsetter dropped its outline.
+fn source_program(doc: &Document, fonts: &Dict, name: &str) -> Option<Vec<u8>> {
+    let font = fonts.get(name.as_bytes()).and_then(|f| doc.resolve(f).as_dict().cloned())?;
+    let base = Metrics::from_dict(doc, &font).base_font;
+    if base.split_once('+').is_some_and(|(tag, _)| tag.len() == 6 && tag.bytes().all(|b| b.is_ascii_uppercase())) {
+        return None;
+    }
+    let bytes = pdfcraft_fonts::pdf::embedded_sfnt(doc, &font)?;
+    pdfcraft_fonts::embedding::validate(&bytes).is_ok().then_some(bytes)
+}
+
+/// Whether `text` has characters `line`'s font can't encode that its own program can draw.
+fn source_program_completes(doc: &Document, fonts: &Dict, line: &TextLine, text: &str) -> bool {
+    let Some(metrics) = fonts.get(line.font.as_bytes()).and_then(|f| doc.resolve(f).as_dict().cloned()).map(|f| Metrics::from_dict(doc, &f)) else {
+        return false;
+    };
+    let missing: String = text.chars().filter(|c| !c.is_whitespace() && !source_encodes(&metrics, &c.to_string())).collect();
+    !missing.is_empty() && source_program(doc, fonts, &line.font).is_some_and(|bytes| pdfcraft_fonts::embedding::covers(&bytes, &missing))
+}
+
 /// A subset may contain all the letters but no space glyph: producers use another subset
 /// or a positioning operator for spaces. Do the same instead of substituting the whole font.
 fn source_encodes(metrics: &Metrics, text: &str) -> bool {
@@ -1611,21 +1897,32 @@ fn paragraph_separator(c: char) -> bool {
     c.is_whitespace() && c != '\u{3000}'
 }
 
-/// Greedy word wrapping to `width` with `advance` giving a string's width.
+/// Greedy word wrapping to `width` with `advance` giving a string's width. Each `\n` starts a
+/// new line. A row may also end inside a word of Chinese or Japanese text ([`crate::linebreak`]);
+/// those pieces join without a space.
 fn wrap(text: &str, width: f64, advance: impl Fn(&str) -> f64) -> Vec<String> {
     let mut out = Vec::new();
-    let mut line = String::new();
-    for word in text.split(paragraph_separator).filter(|word| !word.is_empty()) {
-        let candidate = if line.is_empty() { word.to_string() } else { format!("{line} {word}") };
-        if !line.is_empty() && advance(&candidate) > width {
-            out.push(std::mem::take(&mut line));
-            line = word.to_string();
-        } else {
-            line = candidate;
+    for row in text.split('\n') {
+        let mut line = String::new();
+        let start = out.len();
+        for word in row.split(paragraph_separator).filter(|word| !word.is_empty()) {
+            for (i, piece) in crate::linebreak::pieces(word).into_iter().enumerate() {
+                let candidate = match (line.is_empty(), i) {
+                    (true, _) => piece.to_string(),
+                    (false, 0) => format!("{line} {piece}"),
+                    (false, _) => format!("{line}{piece}"),
+                };
+                if !line.is_empty() && advance(&candidate) > width {
+                    out.push(std::mem::take(&mut line));
+                    line = piece.to_string();
+                } else {
+                    line = candidate;
+                }
+            }
+        }
+        if !line.is_empty() || out.len() == start {
+            out.push(line);
         }
-    }
-    if !line.is_empty() || out.is_empty() {
-        out.push(line);
     }
     out
 }
@@ -1696,6 +1993,19 @@ pub(crate) fn rewrite_block_with_limit(
     max_glyphs: usize,
 ) -> Result<LineEdit, EditError> {
     let lines = text_lines(doc, page)?;
+    rewrite_block_from(doc, page, lines, block, text, style, max_glyphs)
+}
+
+/// [`rewrite_block_with_limit`] with the page's [`text_lines`], read from `doc` as it is now.
+fn rewrite_block_from(
+    doc: &mut Document,
+    page: usize,
+    lines: Vec<TextLine>,
+    block: usize,
+    text: Option<&str>,
+    style: &BlockStyle,
+    max_glyphs: usize,
+) -> Result<LineEdit, EditError> {
     let blocks = group_blocks(&lines);
     let b = blocks.get(block).cloned().ok_or_else(|| EditError::Invalid(format!("page {} has no paragraph {}", page + 1, block + 1)))?;
     let members: Vec<&TextLine> = b.lines.iter().map(|i| &lines[*i]).collect();
@@ -1712,8 +2022,15 @@ pub(crate) fn rewrite_block_with_limit(
             "formatting part of right-to-left (Hebrew) text, or choosing a document font for it, isn't supported yet".into(),
         ));
     }
+    // Text turned on the page (a landscape page drawn a quarter turn round) is rewritten in its
+    // own text space below; the styled region path lays rows out along the page's x axis.
+    let upright = members.iter().all(|line| line.upright());
+    if !upright && (!style.ranges.is_empty() || style.resource.is_some()) {
+        return Err(EditError::Invalid("formatting part of turned text, or choosing a document font for it, isn't supported yet".into()));
+    }
     let visual_indic = members.iter().any(|line| line.visual_order);
-    if !hebrew
+    if upright
+        && !hebrew
         && !visual_indic
         && (!style.ranges.is_empty()
             || style.resource.is_some()
@@ -1722,6 +2039,7 @@ pub(crate) fn rewrite_block_with_limit(
                     || pdfcraft_fonts::source_shaping::required(draft)
                     || !pdfcraft_fonts::embedding::matching_faces(&b.base_font).is_empty()
             }) || registered_face
+                || text.is_some_and(|draft| source_program_completes(doc, &fonts_res, first, draft))
                 || b.rows.iter().any(|row| row.len() > 1)
                 || members.iter().any(|line| line.font != first.font || line.size != first.size || line.color != first.color))
                 && style.family.is_none()
@@ -1732,7 +2050,15 @@ pub(crate) fn rewrite_block_with_limit(
     let streams = content_streams(doc, &p.dict);
     let pieces = Pieces::join(&streams.iter().map(|(_, d)| d.as_slice()).collect::<Vec<_>>());
     let ops = pieces.parse().ops;
-    let text = text.unwrap_or(&b.text).split(paragraph_separator).filter(|word| !word.is_empty()).collect::<Vec<_>>().join(" ");
+    // Explicit line breaks stay (#1443); within a line, runs of white space become one space.
+    let text = text
+        .unwrap_or(&b.text)
+        .split('\n')
+        .map(|row| row.split(paragraph_separator).filter(|word| !word.is_empty()).collect::<Vec<_>>().join(" "))
+        .collect::<Vec<_>>()
+        .join("\n");
+    // The characters to show, for choosing fonts: the breaks are moves, not glyphs.
+    let flat = text.replace('\n', " ");
     let o = &first.origin;
     let (font_name, old_size) = o.state.font.clone().ok_or_else(|| EditError::Invalid("the paragraph has no font".into()))?;
     let k = o.k.max(1e-6);
@@ -1749,7 +2075,7 @@ pub(crate) fn rewrite_block_with_limit(
     let o_state = ts_state.clone();
     let metrics = fonts_res.get(font_name.as_bytes()).and_then(|f| doc.resolve(f).as_dict().cloned()).map(|d| Metrics::from_dict(doc, &d));
     let visual_indic = metrics.as_ref().is_some_and(|m| m.visual_order) || first.visual_order;
-    let indic_text = if visual_indic { crate::indic::to_visual(&text) } else { text.clone() };
+    let indic_text = if visual_indic { crate::indic::to_visual(&flat) } else { flat.clone() };
     let reuse = style.family.is_none() && style.bold.is_none() && metrics.as_ref().is_some_and(|m| source_encodes(m, &indic_text));
     let space = metrics.as_ref().map_or(0.33, |m| source_space(doc, &fonts_res, m));
     // The chosen style also determines the real Japanese fallback outlines and advances.
@@ -1764,14 +2090,22 @@ pub(crate) fn rewrite_block_with_limit(
     }
     // Right-to-left text (more Hebrew or Arabic letters than Latin) is right-aligned unless an
     // alignment is asked for, and a single right-to-left line keeps its right edge as it grows.
-    let rtl = crate::bidi::rtl_base(&text);
-    let anchored_right = rtl && style.width.is_none() && members.len() == 1;
+    let rtl = crate::bidi::rtl_base(&flat);
+    let anchored_right = rtl && upright && style.width.is_none() && members.len() == 1;
+    // The paragraph's width along its lines: in user space unless it is turned.
+    let frame = if upright {
+        b.rect
+    } else {
+        members.iter().map(|l| l.frame_rect()).reduce(|a, f| [a[0].min(f[0]), a[1].min(f[1]), a[2].max(f[2]), a[3].max(f[3])]).unwrap_or(b.rect)
+    };
     // A paragraph keeps its width (or takes the one asked for); a single line grows to the right
     // (to the left when right-to-left), up to the page's margin.
     let width = match style.width {
         // Capped at the largest page PDF allows (14 400 pt).
         Some(w) if w.is_finite() => w.clamp(size * k, 14_400.0),
         Some(_) => return Err(EditError::Invalid("the paragraph's width must be a number".into())),
+        // Turned text: the page's margins are along another axis. A single line grows (below).
+        None if !upright => (frame[2] - frame[0]).max(size * k),
         None if anchored_right => (b.rect[2] - b.rect[0]).max(size * k).max(b.rect[2] + dx - (p.crop(doc)[0] + 36.0)),
         None if members.len() == 1 => (b.rect[2] - b.rect[0]).max(size * k).max(p.crop(doc)[2] - 36.0 - (b.rect[0] + dx)),
         None => (b.rect[2] - b.rect[0]).max(size * k),
@@ -1794,7 +2128,7 @@ pub(crate) fn rewrite_block_with_limit(
     } else {
         None
     };
-    let type3 = if !reuse && needs_type3(&text) { Some(type3_font(doc, &mut fonts_res, &text, family, bold, max_glyphs)?) } else { None };
+    let type3 = if !reuse && needs_type3(&flat) { Some(type3_font(doc, &mut fonts_res, &flat, family, bold, max_glyphs)?) } else { None };
     let advance = |s: &str| -> f64 {
         let t = match (&metrics, reuse) {
             (Some(m), true) => {
@@ -1815,6 +2149,13 @@ pub(crate) fn rewrite_block_with_limit(
         };
         t * o_state.scale * k
     };
+    // A turned single line grows to fit, as far as the largest page PDF allows.
+    let width = if !upright && style.width.is_none() && members.len() == 1 {
+        text.split('\n').map(&advance).fold(width, f64::max).min(14_400.0)
+    } else {
+        width
+    };
+    let right_edge = if anchored_right { right_edge } else { width };
     let wrapped = wrap(&text, width + 0.5, advance);
     let mut substituted = None;
     let new_font = !reuse;
@@ -1826,11 +2167,11 @@ pub(crate) fn rewrite_block_with_limit(
         let first = fallback.names.first().cloned().ok_or_else(no_japanese_font)?;
         (first, Box::new(move |s: &str| type3_encode(&fallback, s)))
     } else {
-        let win = pdfcraft_fonts::win_ansi(&text);
+        let win = pdfcraft_fonts::win_ansi(&flat);
         let back: String = win.iter().map(|c| char::from_u32(u32::from(*c)).unwrap_or('?')).collect();
         let base = family.base_font(bold, italic);
-        if text.chars().zip(back.chars()).any(|(a, c)| c == '?' && a != '?') {
-            return Err(EditError::Invalid(format!("\"{text}\" has characters neither {} nor {base} can show", b.base_font)));
+        if flat.chars().zip(back.chars()).any(|(a, c)| c == '?' && a != '?') {
+            return Err(EditError::Invalid(format!("\"{flat}\" has characters neither {} nor {base} can show", b.base_font)));
         }
         let mut f = Dict::new();
         f.set(b"Type".to_vec(), Object::name("Font"));
@@ -1848,7 +2189,16 @@ pub(crate) fn rewrite_block_with_limit(
     // Line spacing in text space: the paragraph's own (scaled with the size), or 1.2 × the size.
     let lead = match style.line_spacing {
         Some(m) => size * m.clamp(0.5, 5.0),
-        None if members.len() > 1 => (members[0].origin.baseline - members[1].origin.baseline) / k * size / old_size,
+        // From the first two rows (a row may hold several runs).
+        None if let Some((upper, lower)) = b
+            .rows
+            .first()
+            .zip(b.rows.get(1))
+            .and_then(|(upper, lower)| upper.first().zip(lower.first()))
+            .and_then(|(upper, lower)| lines.get(*upper).zip(lines.get(*lower))) =>
+        {
+            (upper.frame_origin().1 - lower.frame_origin().1) / k * size / old_size
+        }
         None if o_state.leading > 0.0 => o_state.leading,
         None => size * 1.2,
     };
@@ -1884,9 +2234,15 @@ pub(crate) fn rewrite_block_with_limit(
             _ => 0.0,
         }
     };
-    // Justify: word spacing (single-byte code 32 only) so each line but the last fills the width.
-    let single_byte = !reuse || metrics.as_ref().is_some_and(|m| !m.composite);
-    let justify = align == Some(crate::added::Align::Justify) && single_byte;
+    // Justify: each line but the last fills the width. Word spacing reaches only single-byte code 32
+    // (ISO 32000-1 §9.3.3), so where a space is shown with another code (a composite font, a
+    // generated Type 3 font, a subset without a space) the extra space follows each space as a
+    // TJ adjustment instead, and code 32, which may then be a letter, gets none.
+    let justify = align == Some(crate::added::Align::Justify);
+    let word_spacing_reaches_spaces = match metrics.as_ref().filter(|_| reuse) {
+        Some(m) => m.encode(" ").is_some_and(|b| m.codes(&b).iter().all(|(c, len)| m.is_space(*c, *len))),
+        None => type3.is_none(),
+    };
     let mut x = 0.0;
     let mut tw_set = 0.0;
     let mut underlines: Vec<(f64, f64, f64)> = Vec::new(); // (x0, x1, y) in text space
@@ -1900,24 +2256,34 @@ pub(crate) fn rewrite_block_with_limit(
             block_ops.push(Op::new("Td", vec![n(dx - x), n(if i > 0 { -lead } else { 0.0 })]));
         }
         x = dx;
+        let stretch = if word_spacing_reaches_spaces { 0.0 } else { tw };
+        let tw = tw - stretch;
         if tw != tw_set {
             block_ops.push(Op::new("Tw", vec![n(tw)]));
             tw_set = tw;
         }
         // Each wrapped line in typing order; drawn left to right (right-to-left runs reversed).
         let visual = crate::bidi::to_visual(line);
-        if let Some(metrics) = metrics.as_ref().filter(|_| reuse) {
-            let indic_line = if metrics.visual_order { crate::indic::to_visual(&visual) } else { visual };
-            block_ops.extend(source_show(metrics, &indic_line, size, space, o_state.char_spacing, tw)?);
-        } else {
-            for (font, bytes) in encode(&visual).ok_or_else(|| EditError::Invalid(format!("\"{line}\" can't be shown")))? {
-                if font != shown_font {
-                    block_ops.push(Op::new("Tf", vec![Object::name(&font), n(size)]));
-                    shown_font = font;
+        // Stretched without word spacing: shown up to and including each space, then moved on.
+        let pieces = if stretch > 0.0 { visual.split_inclusive(' ').collect() } else { vec![visual.as_str()] };
+        for piece in pieces {
+            if let Some(metrics) = metrics.as_ref().filter(|_| reuse) {
+                let indic_piece = if metrics.visual_order { crate::indic::to_visual(piece) } else { piece.to_owned() };
+                block_ops.extend(source_show(metrics, &indic_piece, size, space, o_state.char_spacing, tw)?);
+            } else {
+                for (font, bytes) in encode(piece).ok_or_else(|| EditError::Invalid(format!("\"{line}\" can't be shown")))? {
+                    if font != shown_font {
+                        block_ops.push(Op::new("Tf", vec![Object::name(&font), n(size)]));
+                        shown_font = font;
+                    }
+                    block_ops.push(Op::new("Tj", vec![Object::String(PdfString::literal(bytes))]));
                 }
-                block_ops.push(Op::new("Tj", vec![Object::String(PdfString::literal(bytes))]));
+            }
+            if stretch > 0.0 && piece.ends_with(' ') {
+                block_ops.push(Op::new("TJ", vec![Object::Array(vec![n(-1000.0 * stretch / size)])]));
             }
         }
+        let tw = tw + stretch;
         let w = (advance(line) + tw * spaces as f64 * o_state.scale * k) / k;
         underlines.push((dx, dx + w, -(i as f64) * lead - size * 0.12));
     }
@@ -2205,6 +2571,17 @@ mod tests {
         assert_eq!(wrap(" \tA  B\r\nC ", 3.0, width), ["A B", "C"]);
     }
 
+    #[test]
+    fn japanese_text_wraps_between_characters_but_not_before_closing_marks() {
+        let width = |s: &str| s.chars().count() as f64;
+        assert_eq!(wrap("日本語の文章です。", 3.0, width), ["日本語", "の文章", "です。"]);
+        // The comma can't begin a row, so the character before it moves down with it.
+        assert_eq!(wrap("あいう、えお", 3.0, width), ["あい", "う、え", "お"]);
+        // Pieces of one word join without a space; separate words keep theirs.
+        assert_eq!(wrap("Edit PDFを編集", 6.0, width), ["Edit", "PDFを編集"]);
+        assert_eq!(wrap("一行目　二行目", 4.0, width), ["一行目　", "二行目"]);
+    }
+
     #[test]
     fn fallback_face_moves_on_when_the_best_face_lacks_a_character() {
         static JPAN: &[&str] = &["Jpan"];
diff --git a/crates/edit/src/text_regions.rs b/crates/edit/src/text_regions.rs
index 0213d9040..2d7baf519 100644
--- a/crates/edit/src/text_regions.rs
+++ b/crates/edit/src/text_regions.rs
@@ -25,6 +25,12 @@ fn row_rect(row: &[usize], lines: &[TextLine]) -> Option<[f64; 4]> {
     row.iter().filter_map(|i| lines.get(*i)).map(|l| l.rect).reduce(union)
 }
 
+/// [`row_rect`] in its text's own frame ([`TextLine::frame_rect`]), so rows of turned text
+/// compare along and across their baselines.
+fn frame_row_rect(row: &[usize], lines: &[TextLine]) -> Option<[f64; 4]> {
+    row.iter().filter_map(|i| lines.get(*i)).map(TextLine::frame_rect).reduce(union)
+}
+
 pub(super) fn group_blocks(lines: &[TextLine]) -> Vec<TextBlock> {
     group_layout(lines, true)
 }
@@ -62,14 +68,14 @@ fn group_layout(lines: &[TextLine], mixed: bool) -> Vec<TextBlock> {
     let mut rows: Vec<Vec<usize>> = Vec::new();
     for (i, line) in lines.iter().enumerate() {
         let joins = rows.last().and_then(|r| r.last()).and_then(|i| lines.get(*i)).is_some_and(|prev| {
-            let gap = line.rect[0] - prev.rect[2];
+            let gap = line.frame_rect()[0] - prev.frame_rect()[2];
             // OCR words (invisible text over a scan) join only across a word space: a wider gap
             // is a table cell or a tab stop, which a rewrite would close up.
             let scanned = !mixed || (invisible(prev) == invisible(line) && (!invisible(line) || gap < prev.size.max(line.size) * 0.6));
             scanned
                 && (mixed || same_style(prev, line))
                 && same_plane(prev, line)
-                && (prev.origin.baseline - line.origin.baseline).abs() < prev.size.min(line.size) * 0.2
+                && (prev.frame_origin().1 - line.frame_origin().1).abs() < prev.size.min(line.size) * 0.2
                 && gap >= -prev.size.min(line.size) * 0.2
                 && gap < prev.size.max(line.size) * 1.5
                 // Separate same-style text objects that merely touch or overlap, with no space
@@ -90,14 +96,15 @@ fn group_layout(lines: &[TextLine], mixed: bool) -> Vec<TextBlock> {
     let mut blocks: Vec<TextBlock> = Vec::new();
     for row in rows {
         let Some(first) = row.first().and_then(|i| lines.get(*i)) else { continue };
-        let Some(rect) = row_rect(&row, lines) else { continue };
+        let (Some(rect), Some(frame)) = (row_rect(&row, lines), frame_row_rect(&row, lines)) else { continue };
         let joins = blocks.last().is_some_and(|block| {
             let Some(prev_row) = block.rows.last() else { return false };
             let Some(prev) = prev_row.first().and_then(|i| lines.get(*i)) else { return false };
-            let Some(pr) = row_rect(prev_row, lines) else { return false };
-            let gap = prev.origin.baseline - first.origin.baseline;
+            let Some(pr) = frame_row_rect(prev_row, lines) else { return false };
+            let gap = prev.frame_origin().1 - first.frame_origin().1;
             let tol = prev.size.max(first.size).max(1.0);
-            let aligned = (pr[0] - rect[0]).abs() < tol || ((pr[0] + pr[2] - rect[0] - rect[2]) / 2.0).abs() < tol || (pr[2] - rect[2]).abs() < tol;
+            let aligned =
+                (pr[0] - frame[0]).abs() < tol || ((pr[0] + pr[2] - frame[0] - frame[2]) / 2.0).abs() < tol || (pr[2] - frame[2]).abs() < tol;
             // OCR lines stay apart: the scan fixes where each one is, so they never rewrap together.
             (!mixed || !(invisible(prev) || invisible(first)))
                 && (mixed || same_style(prev, first))
@@ -135,7 +142,7 @@ fn group_layout(lines: &[TextLine], mixed: bool) -> Vec<TextBlock> {
             if let Some(prev) = block.lines.last().filter(|i| row.contains(i)).and_then(|i| lines.get(*i))
                 && !row_text.ends_with(char::is_whitespace)
                 && !line.text.starts_with(char::is_whitespace)
-                && line.rect[0] - prev.rect[2] > line.size * 0.12
+                && line.frame_rect()[0] - prev.frame_rect()[2] > line.size * 0.12
             {
                 row_text.push(' ');
                 block.editor_text.push(' ');
@@ -192,6 +199,46 @@ fn shape_source(
     Err(EditError::Invalid("complex text needs the complete source TrueType/OpenType face; load that font before editing".into()))
 }
 
+/// For each output row (a range of the draft's characters), whether it is exactly the source row
+/// at the same position: the same characters, none of them inserted or changed by the edit.
+fn untouched_rows(block: &TextBlock, draft: &str, rows: &[std::ops::Range<usize>]) -> Vec<bool> {
+    let old: Vec<char> = block.editor_text.chars().collect();
+    let new: Vec<char> = draft.chars().collect();
+    let prefix = old.iter().zip(&new).take_while(|(a, b)| a == b).count();
+    let suffix = old.iter().rev().zip(new.iter().rev()).take(old.len().min(new.len()).saturating_sub(prefix)).take_while(|(a, b)| a == b).count();
+    // The source character a draft character is, if the edit left it alone.
+    let origin = |i: usize| {
+        if i < prefix {
+            Some(i)
+        } else if i >= new.len().saturating_sub(suffix) {
+            (old.len() + i).checked_sub(new.len())
+        } else {
+            None
+        }
+    };
+    let mut source_rows = Vec::new();
+    let mut start = 0;
+    for (i, ch) in old.iter().enumerate() {
+        if *ch == '\n' {
+            source_rows.push(start..i);
+            start = i + 1;
+        }
+    }
+    source_rows.push(start..old.len());
+    // A line break inside a source run would pair editor rows with the wrong visual rows.
+    if source_rows.len() != block.rows.len() {
+        return vec![false; rows.len()];
+    }
+    rows.iter()
+        .enumerate()
+        .map(|(r, range)| {
+            source_rows.get(r).is_some_and(|source| {
+                !range.is_empty() && range.len() == source.len() && range.clone().zip(source.clone()).all(|(i, j)| origin(i) == Some(j))
+            })
+        })
+        .collect()
+}
+
 /// Rewrite visual rows while keeping the source style on each surviving character. Resource
 /// names may differ between Unicode subsets of the same face; encoding searches those subsets.
 pub(super) fn rewrite_styled_block(
@@ -227,6 +274,7 @@ pub(super) fn rewrite_styled_block(
     {
         return Err(EditError::Invalid("text style ranges must be disjoint UTF-8 boundaries with finite formatting (at most 1024 ranges)".into()));
     }
+    let source_count = lines.len();
     let mut styled_lines = lines.to_vec();
     let mut styled_spans = Vec::new();
     let mut underlines = HashMap::new();
@@ -331,8 +379,9 @@ pub(super) fn rewrite_styled_block(
     if !dx.is_finite() || !dy.is_finite() || style.width.is_some_and(|w| !w.is_finite()) {
         return Err(EditError::Invalid("the paragraph's position and width must be finite".into()));
     }
-    // A rewritten OCR line grows to the right rather than wrapping onto the scanned line below.
-    let natural = if block.invisible {
+    // A visual row grows even when it contains several source/font runs. Multi-row
+    // paragraphs retain their container width; an explicit width always wins.
+    let natural = if block.invisible || block.rows.len() == 1 {
         (p.crop(doc)[2] - 36.0 - (block.rect[0] + dx)).max(block.rect[2] - block.rect[0])
     } else {
         block.rect[2] - block.rect[0]
@@ -343,6 +392,7 @@ pub(super) fn rewrite_styled_block(
     let mut substituted = None;
     let mut fallback_names: std::collections::BTreeMap<(String, char), String> = std::collections::BTreeMap::new();
     let mut full_faces: HashMap<String, String> = HashMap::new();
+    let mut programs: HashMap<String, Option<std::sync::Arc<Vec<u8>>>> = HashMap::new();
     for (range, index) in styled_spans {
         let source = lines.get(index).unwrap_or(first);
         for ch in draft.get(range).unwrap_or_default().chars() {
@@ -378,6 +428,28 @@ pub(super) fn rewrite_styled_block(
                     full_faces.insert(key, name.clone());
                     name
                 }
+            } else if let Some(bytes) = programs
+                .entry(source.font.clone())
+                .or_insert_with(|| source_program(doc, &fonts, &source.font).map(std::sync::Arc::new))
+                .clone()
+                .filter(|bytes| pdfcraft_fonts::embedding::covers(bytes, &s))
+            {
+                // The document's own complete program of this font has the glyph: draw it with
+                // that face rather than another family's fallback.
+                let key = format!("source {}", source.font);
+                if let Some(name) = full_faces.get(&key) {
+                    name.clone()
+                } else {
+                    let family = pdfcraft_fonts::embedding::names(&bytes).map_or_else(|_| source.base_font.clone(), |(family, _)| family);
+                    let name = pdfcraft_fonts::embedding::embed(doc, &mut fonts, &bytes, &family).map_err(EditError::Invalid)?;
+                    let font = fonts
+                        .get(name.as_bytes())
+                        .and_then(|f| doc.dict(f))
+                        .ok_or_else(|| EditError::Invalid("the source font could not be loaded".into()))?;
+                    metrics.insert(name.clone(), Metrics::from_dict(doc, &font));
+                    full_faces.insert(key, name.clone());
+                    name
+                }
             } else {
                 let family = source_family(&source.base_font);
                 if needs_type3(&s) {
@@ -488,6 +560,9 @@ pub(super) fn rewrite_styled_block(
         Ok(width)
     };
     let mut rows: Vec<Vec<(char, usize, String)>> = Vec::new();
+    // Each row's characters, as indexes into the draft's characters (`chars` holds all of them).
+    let mut row_ranges = Vec::new();
+    let mut row_start = 0;
     let mut row = Vec::new();
     let mut row_width = 0.0;
     // Wrap at word boundaries, retaining explicit source row breaks and whitespace.
@@ -495,14 +570,20 @@ pub(super) fn rewrite_styled_block(
     while at < chars.len() {
         let Some(item) = chars.get(at) else { break };
         if item.0 == '\n' {
+            row_ranges.push(row_start..row_start + row.len());
             rows.push(std::mem::take(&mut row));
             row_width = 0.0;
             at += 1;
+            row_start = at;
             continue;
         }
         let mut end = at + 1;
         if !item.0.is_whitespace() {
-            while chars.get(end).is_some_and(|c| !c.0.is_whitespace()) {
+            // A word ends at a space, or where Chinese or Japanese text may break between characters.
+            while let (Some(before), Some(c)) = (chars.get(end - 1), chars.get(end))
+                && !c.0.is_whitespace()
+                && !crate::linebreak::between(before.0, c.0)
+            {
                 end += 1;
             }
         }
@@ -512,17 +593,47 @@ pub(super) fn rewrite_styled_block(
             while row.last().is_some_and(|c: &(char, usize, String)| c.0.is_whitespace()) {
                 row.pop();
             }
+            row_ranges.push(row_start..row_start + row.len());
             rows.push(std::mem::take(&mut row));
             row_width = 0.0;
+            row_start = at;
         }
         row.extend_from_slice(word);
         row_width += w;
         at = end;
     }
     if !row.is_empty() {
+        row_ranges.push(row_start..row_start + row.len());
         rows.push(row);
     }
-    for row in &rows {
+    let streams = content_streams(doc, &p.dict);
+    let pieces = Pieces::join(&streams.iter().map(|(_, d)| d.as_slice()).collect::<Vec<_>>());
+    let ops = pieces.parse().ops;
+    // A row the edit doesn't reach keeps its source operators, so its kerning, TJ word gaps and
+    // glyph widths stay exactly as they were instead of being rebuilt from the text state.
+    let plain = BlockStyle { ranges: Vec::new(), ..style.clone() } == BlockStyle::default();
+    let mut kept = if plain {
+        untouched_rows(block, draft, &row_ranges).into_iter().zip(&rows).map(|(same, row)| same && row.iter().all(|c| c.1 < source_count)).collect()
+    } else {
+        vec![false; rows.len()]
+    };
+    let kept_lines: std::collections::HashSet<usize> =
+        kept.iter().enumerate().filter(|(_, k)| **k).filter_map(|(r, _)| block.rows.get(r)).flatten().copied().collect();
+    let rewritten: Vec<&TextLine> = block.lines.iter().filter(|i| !kept_lines.contains(i)).filter_map(|i| lines.get(*i)).collect();
+    // The rewrite goes where the first rewritten row was drawn, so it must share the paragraph's
+    // space. A dropped `'` or `"` also moved to the next line, which a kept row relies on.
+    let lead = rewritten.first().copied().filter(|lead| {
+        lead.origin.ctm.iter().zip(first.origin.ctm).all(|(a, b)| (a - b).abs() < 1e-9)
+            && !rewritten.iter().flat_map(|l| &l.ops).any(|i| ops.get(*i).is_some_and(|op| op.is("'") || op.is("\"")))
+    });
+    let (members, lead) = match lead {
+        Some(lead) if !kept_lines.is_empty() => (rewritten, lead),
+        _ => {
+            kept.iter_mut().for_each(|k| *k = false);
+            (block.lines.iter().filter_map(|i| lines.get(*i)).collect(), first)
+        }
+    };
+    for (row, _) in rows.iter().zip(&kept).filter(|(_, k)| !**k) {
         let text: String = row.iter().map(|v| v.0).collect();
         if pdfcraft_fonts::source_shaping::required(&text) && row.first().is_some_and(|first| row.iter().any(|v| v.1 != first.1 || v.2 != first.2)) {
             return Err(EditError::Invalid(
@@ -534,7 +645,7 @@ pub(super) fn rewrite_styled_block(
     let measured: Vec<_> = rows.iter().map(|r| measure(r)).collect::<Result<_, _>>()?;
     let mut shaped_runs = HashMap::new();
     let mut segment_advances = HashMap::new();
-    for (row_index, row) in rows.iter().enumerate() {
+    for (row_index, row) in rows.iter().enumerate().filter(|(r, _)| !kept.get(*r).copied().unwrap_or(false)) {
         let mut at = 0;
         while let Some(item) = row.get(at) {
             let mut end = at + 1;
@@ -589,6 +700,11 @@ pub(super) fn rewrite_styled_block(
             baseline = anchor.origin.baseline;
         }
         let anchor = anchor.unwrap_or(first);
+        if kept.get(row_index).copied().unwrap_or(false) {
+            // Kept rows only occur without spacing or size changes, so this is the step below.
+            baseline -= source_leading;
+            continue;
+        }
         let w = measured.get(row_index).copied().unwrap_or(0.0);
         let align = style.align.unwrap_or(if centered { crate::added::Align::Center } else { crate::added::Align::Left });
         let original_rect = block.rows.get(row_index).and_then(|row| row_rect(row, lines)).unwrap_or(block.rect);
@@ -692,14 +808,10 @@ pub(super) fn rewrite_styled_block(
         };
     }
     block_ops.push(Op::new("Q", vec![]));
-    let streams = content_streams(doc, &p.dict);
-    let pieces = Pieces::join(&streams.iter().map(|(_, d)| d.as_slice()).collect::<Vec<_>>());
-    let ops = pieces.parse().ops;
-    let members: Vec<_> = block.lines.iter().filter_map(|i| lines.get(*i)).collect();
     let mut drop = coincident_ops(lines, &members);
     drop.extend(members.iter().flat_map(|l| l.ops.iter().copied()));
-    let o = &first.origin;
-    let start = first.ops.first().copied().unwrap_or(o.bt_op);
+    let o = &lead.origin;
+    let start = lead.ops.first().copied().unwrap_or(o.bt_op);
     let split = ops
         .get(o.bt_op..start)
         .unwrap_or_default()
diff --git a/crates/engine/Cargo.toml b/crates/engine/Cargo.toml
index eecbb35c4..7de028763 100644
--- a/crates/engine/Cargo.toml
+++ b/crates/engine/Cargo.toml
@@ -41,6 +41,7 @@ png = "0.18"
 url = "2.5"
 idna = "1.1"
 icu_properties = "2.3"
+unicode-segmentation = "1.13"
 
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
 # Already in the graph through lopdf; used only for the local UTC offset ("today").
diff --git a/crates/engine/README.md b/crates/engine/README.md
index 982d2fb1a..4bf80e3f7 100644
--- a/crates/engine/README.md
+++ b/crates/engine/README.md
@@ -3,6 +3,9 @@
 The façade every frontend talks to. It holds the open documents, their edit history and the tool
 catalogue; frontends never reach past it into the parsing, rendering or editing crates.
 
+`word_count::count` provides cancellable, page-at-a-time Unicode word and character statistics
+with optional semantic exclusions; see [word-count behavior and limits](../../docs/word-count.md).
+
 - **Layer:** L6. It depends on most of L1–L4 and on nothing above itself. **No UI toolkit** —
   `egui`, `winit`, `eframe` and `rfd` are forbidden below L7, and `xtask layers` enforces it.
 - The crate denies `unwrap`/`expect`/`panic!`/`todo!`. Entry points that run untrusted-document
diff --git a/crates/engine/src/catalog.rs b/crates/engine/src/catalog.rs
index 991c86a9c..b46d88acf 100644
--- a/crates/engine/src/catalog.rs
+++ b/crates/engine/src/catalog.rs
@@ -24,6 +24,11 @@ pub struct ToolItem {
     pub icon: &'static str,
     pub command: &'static str,
     pub availability: Availability,
+    /// Further commands of the same tool, shown as a drop-down beside the entry: Acrobat's
+    /// Watermark control offers Add, Update and Remove. The first is `command` itself. A UI
+    /// enables each one by its own command's needs, so Update and Remove stay greyed out until
+    /// the document has that kind of mark. Empty for a plain entry.
+    pub actions: &'static [&'static str],
 }
 
 #[derive(Clone, Copy, Debug)]
@@ -45,7 +50,16 @@ pub struct ToolGroup {
 }
 
 const fn item(label: &'static str, icon: &'static str, command: &'static str, availability: Availability) -> ToolItem {
-    ToolItem { label, icon, command, availability }
+    ToolItem { label, icon, command, availability, actions: &[] }
+}
+
+/// An entry that opens a menu of `actions` (the first one is its `command`).
+const fn menu_item(label: &'static str, icon: &'static str, actions: &'static [&'static str]) -> ToolItem {
+    let command = match actions {
+        [first, ..] => *first,
+        [] => "",
+    };
+    ToolItem { label, icon, command, availability: Ready, actions }
 }
 
 use Availability::{Planned, Provider, Ready};
@@ -115,6 +129,7 @@ pub static TOOL_GROUPS: &[ToolGroup] = &[
             ToolSection {
                 title: "Modify page",
                 items: &[
+                    item("Edit text & images", "text-cursor-input", "edit.edit_text", Ready),
                     item("Rotate pages", "rotate-cw", "page.rotate", Ready),
                     item("Insert pages", "file-plus-2", "page.insert", Ready),
                     item("Delete pages", "trash-2", "page.delete", Ready),
@@ -125,14 +140,13 @@ pub static TOOL_GROUPS: &[ToolGroup] = &[
             ToolSection {
                 title: "Add content",
                 items: &[
-                    item("Edit text & images", "text-cursor-input", "edit.edit_text", Ready),
                     item("Text", "type", "edit.text", Ready),
                     item("Image", "image-plus", "edit.image", Ready),
-                    item("Header and footer", "heading", "edit.header_footer", Ready),
-                    item("Watermark", "stamp", "edit.watermark", Ready),
+                    menu_item("Header and footer", "heading", &["edit.header_footer", "edit.header_footer.update", "edit.header_footer.remove"]),
+                    menu_item("Watermark", "stamp", &["edit.watermark", "edit.watermark.update", "edit.watermark.remove"]),
                     item("Link", "link-2", "edit.link", Ready),
                     item("Bates numbering", "hash", "edit.bates", Ready),
-                    item("Background", "palette", "edit.background", Ready),
+                    menu_item("Background", "palette", &["edit.background", "edit.background.update", "edit.background.remove"]),
                     item("Attach file", "paperclip", "edit.attach", Planned("M12")),
                 ],
             },
@@ -458,8 +472,10 @@ pub static TOOL_GROUPS: &[ToolGroup] = &[
             title: "Accessibility",
             items: &[
                 item("Automatically tag PDF", "tag", "a11y.autotag", Ready),
+                item("Tag form fields", "tag", "a11y.autotag_fields", Ready),
                 item("Change reading options", "book-open", "a11y.reading_options", Ready),
                 item("Check for accessibility", "accessibility", "a11y.check", Ready),
+                item("Find untagged content", "search", "a11y.find_untagged", Ready),
                 item("Open accessibility report", "file-text", "a11y.report", Ready),
                 item("Add alternate text", "image", "a11y.alt_text", Ready),
                 item("Tags panel", "tag", "a11y.tags", Ready),
@@ -555,4 +571,38 @@ mod tests {
             }
         }
     }
+
+    #[test]
+    fn menu_entries_list_registered_commands_starting_with_their_own() {
+        let mut menus = 0;
+        for g in TOOL_GROUPS {
+            for s in g.sections {
+                for i in s.items {
+                    if i.actions.is_empty() {
+                        continue;
+                    }
+                    menus += 1;
+                    assert_eq!(i.actions[0], i.command, "{}: the first action is the entry's command", i.label);
+                    for id in i.actions {
+                        assert!(crate::commands::command(id).is_some(), "{id} is not a registered command");
+                    }
+                }
+            }
+        }
+        // Watermark, Header and footer, Background: Add / Update / Remove each (Acrobat's menu).
+        assert!(menus >= 3);
+    }
+
+    #[test]
+    fn every_update_and_remove_command_is_reachable_from_a_tool_entry() {
+        let reachable: HashSet<&str> =
+            TOOL_GROUPS.iter().flat_map(|g| g.sections.iter().flat_map(|s| s.items.iter())).flat_map(|i| i.actions.iter().copied()).collect();
+        for id in crate::commands::COMMANDS
+            .iter()
+            .map(|c| c.id)
+            .filter(|id| id.starts_with("edit.") && (id.ends_with(".update") || id.ends_with(".remove")))
+        {
+            assert!(reachable.contains(id), "{id} is in no tool menu");
+        }
+    }
 }
diff --git a/crates/engine/src/commands.rs b/crates/engine/src/commands.rs
index cf4038645..b28758e24 100644
--- a/crates/engine/src/commands.rs
+++ b/crates/engine/src/commands.rs
@@ -190,6 +190,7 @@ pub const COMMANDS: &[CommandSpec] = &[
     c("file.revert", "Revert", FILE, None, Undo, "rotate-ccw"),
     c("print.dialog", "Print…", FILE, Some(Shortcut::cmd("P")), Document, "printer"),
     c("file.properties", "Document properties…", FILE, Some(Shortcut::cmd("D")), Document, "info"),
+    c("file.word_count", "Word count…", FILE, None, Copying, "hash"),
     ct("edit.undo", "Undo", EDIT, Some(Shortcut::cmd("Z")), Undo, "undo-2"),
     ct("edit.redo", "Redo", EDIT, Some(Shortcut::cmd_shift("Z")), Redo, "redo-2"),
     c("edit.find", "Find…", EDIT, Some(Shortcut::cmd("F")), Document, "search"),
@@ -212,6 +213,8 @@ pub const COMMANDS: &[CommandSpec] = &[
     // Acrobat's column select: drag a rectangle and select only the text inside it. Alt/Option-
     // drag with the Select tool does the same; this is the way in where the desktop takes
     // Alt-drag for moving windows (several Linux window managers).
+    // Copy events stay with the frontend so focused text inputs and page clipboard routing keep ownership.
+    c("edit.copy", "Copy", EDIT, None, Copying, "copy"),
     c("edit.column_select", "Column select", EDIT, None, Document, "text-select"),
     c("edit.snapshot", "Take a snapshot", EDIT, None, Copying, "camera"),
     c("view.full_screen", "Full screen mode", VIEW, Some(Shortcut::cmd("L")), Document, "maximize"),
@@ -221,6 +224,9 @@ pub const COMMANDS: &[CommandSpec] = &[
     // also run from Combine files, which has no document open.
     c("view.next_tab", "Next tab", VIEW, Some(Shortcut { command: false, shift: false, mac_ctrl: true, key: "Tab" }), Nothing, "chevron-right"),
     c("view.previous_tab", "Previous tab", VIEW, Some(Shortcut { command: false, shift: true, mac_ctrl: true, key: "Tab" }), Nothing, "chevron-left"),
+    // View-local history also appears in the Page navigation section; don't duplicate its menu.
+    c("view.previous_view", "Previous view", None, Some(Shortcut::cmd("[")), Document, "chevron-left"),
+    c("view.next_view", "Next view", None, Some(Shortcut::cmd("]")), Document, "chevron-right"),
     c("view.focus_page_input", "Go to page…", VIEW, Some(Shortcut::cmd_shift("N")), Document, "text-cursor-input"),
     c("ui.dock.reset", "Reset panel layout", VIEW, None, Nothing, "settings"),
     c("view.theme", "Switch light / dark theme", None, None, Nothing, "moon"),
@@ -326,10 +332,12 @@ pub const COMMANDS: &[CommandSpec] = &[
     c("ocr.enhance_camera", "Enhance camera image", None, None, Modification, "camera"),
     c("ocr.recognize_batch", "Recognize text in multiple files…", None, None, Nothing, "files"),
     c("a11y.check", "Check for accessibility…", None, None, Document, "accessibility"),
+    c("a11y.find_untagged", "Find untagged content", None, None, Document, "search"),
     c("a11y.autotag", "Automatically tag PDF", None, None, Document, "tag"),
     c("a11y.report", "Open accessibility report", None, None, Document, "file-text"),
     c("a11y.reading_options", "Change reading options…", None, None, Document, "book-open"),
     c("a11y.alt_text", "Add alternate text…", None, None, Modification, "image"),
+    c("a11y.autotag_fields", "Tag form fields", None, None, Modification, "tag"),
     c("a11y.tags", "Tags panel", None, None, Document, "tag"),
     c("export.all_images", "Export all images…", FILE, None, Copying, "image"),
     c("edit.header_footer", "Add header & footer…", None, None, Modification, "heading"),
@@ -390,7 +398,7 @@ pub fn is_enabled(spec: &CommandSpec, session: &Session, active: Option<DocId>)
         Annotate => doc.is_some_and(|d| d.allows_annotation()),
         Copying => doc.is_some_and(|d| d.allows_copying()),
         FillForms => doc.is_some_and(|d| d.allows_form_filling() && !d.form.is_empty()),
-        Marks(k) => doc.is_some_and(|d| d.allows_modification() && d.marks.contains(&k)),
+        Marks(k) => doc.is_some_and(|d| d.allows_modification() && d.marks().contains(&k)),
         HasComments => doc.is_some_and(|d| d.allows_modification() && !d.info.annotations.is_empty()),
         HasFields => doc.is_some_and(|d| d.allows_modification() && !d.form.is_empty()),
         HasRedactions => doc.is_some_and(|d| d.allows_modification() && d.redaction_marks() > 0),
diff --git a/crates/engine/src/dates.rs b/crates/engine/src/dates.rs
index e26d9ec60..8c14a5b1b 100644
--- a/crates/engine/src/dates.rs
+++ b/crates/engine/src/dates.rs
@@ -56,7 +56,7 @@ const AR_DAYS: [&str; 7] = ["الأحد", "الاثنين", "الثلاثاء",
 
 /// The languages month and weekday names can be written in (Preferences ▸ Date format ▸ Language):
 /// the interface languages, in the same order and with the same names.
-pub static DATE_LANGUAGES: [DateLanguage; 22] = [
+pub static DATE_LANGUAGES: [DateLanguage; 23] = [
     DateLanguage {
         code: "en",
         name: "English",
@@ -360,6 +360,44 @@ pub static DATE_LANGUAGES: [DateLanguage; 22] = [
         days: ["sekmadienis", "pirmadienis", "antradienis", "trečiadienis", "ketvirtadienis", "penktadienis", "šeštadienis"],
         days_short: ["sk", "pr", "an", "tr", "kt", "pn", "št"],
     },
+    // Vietnamese: numeric month forms (`tháng 1` with a day, `Tháng 1` standing alone).
+    // Fill & Sign still refuses any format whose final text fails the existing WinAnsi check
+    // (for example weekday names); `dd.mm.yyyy` remains writable.
+    DateLanguage {
+        code: "vi",
+        name: "Tiếng Việt",
+        months: [
+            "Tháng 1",
+            "Tháng 2",
+            "Tháng 3",
+            "Tháng 4",
+            "Tháng 5",
+            "Tháng 6",
+            "Tháng 7",
+            "Tháng 8",
+            "Tháng 9",
+            "Tháng 10",
+            "Tháng 11",
+            "Tháng 12",
+        ],
+        months_with_day: Some([
+            "tháng 1",
+            "tháng 2",
+            "tháng 3",
+            "tháng 4",
+            "tháng 5",
+            "tháng 6",
+            "tháng 7",
+            "tháng 8",
+            "tháng 9",
+            "tháng 10",
+            "tháng 11",
+            "tháng 12",
+        ]),
+        months_short: ["Thg 1", "Thg 2", "Thg 3", "Thg 4", "Thg 5", "Thg 6", "Thg 7", "Thg 8", "Thg 9", "Thg 10", "Thg 11", "Thg 12"],
+        days: ["Chủ Nhật", "Thứ Hai", "Thứ Ba", "Thứ Tư", "Thứ Năm", "Thứ Sáu", "Thứ Bảy"],
+        days_short: ["CN", "T2", "T3", "T4", "T5", "T6", "T7"],
+    },
 ];
 
 /// The date language for `code` (any case), or `None` when there's none.
@@ -631,6 +669,26 @@ mod tests {
         assert_eq!(s.date_format(), "dd.mm.yyyy", "a rejected pattern keeps the previous one");
     }
 
+    /// 21:30 on 14 Oct 2026 in São Paulo (UTC-3) is 00:30Z on the 15th. The date Fill & Sign
+    /// stamps is the wall-clock day (14th); the time the file records (`/M`, `/ModDate`) is UTC.
+    /// The test shortcut (`with_clock`) takes the injected time as local and says the 15th, which
+    /// is why it cannot serve a host that knows both the UTC time and the zone.
+    #[test]
+    fn a_wall_clock_gives_the_local_day_and_keeps_utc_for_the_file() {
+        let sao_paulo = Session::new().with_wall_clock(|| 1_792_024_200, || -3 * 3600);
+        assert_eq!(sao_paulo.today(), (2026, 10, 14));
+        assert_eq!(sao_paulo.today_text(None, None).as_deref(), Ok("10/14/2026"));
+        assert_eq!(sao_paulo.signing_date(), "D:20261014213000-03'00'");
+        assert_eq!(sao_paulo.stamp_by_line("Ada"), "By Ada at 9:30 pm, Oct 14, 2026");
+        assert_eq!(sao_paulo.now_secs(), 1_792_024_200, "the file's instant stays in UTC");
+
+        let utc = Session::new().with_wall_clock(|| 1_792_024_200, || 0);
+        assert_eq!(utc.today(), (2026, 10, 15));
+
+        let clock_only = Session::new().with_clock(|| 1_792_024_200);
+        assert_eq!(clock_only.today(), (2026, 10, 15), "on its own, an injected clock counts as local time");
+    }
+
     #[test]
     fn names_follow_the_date_language() {
         assert_eq!(in_lang("dddd, d \\de mmmm \\de yyyy", "es"), "sábado, 7 de marzo de 2026");
@@ -683,6 +741,25 @@ mod tests {
         assert_eq!(s.date_language(), None);
     }
 
+    #[test]
+    fn vietnamese_month_and_weekday_names() {
+        let mut s = Session::new().with_clock(|| 1_700_000_000);
+        s.set_date_language(Some("vi")).unwrap();
+        assert_eq!(s.date_language(), Some("vi"));
+        s.set_date_format("d mmmm yyyy").unwrap();
+        assert_eq!(s.today_text(None, None).as_deref(), Ok("14 tháng 11 2023"));
+        s.set_date_format("mmmm yyyy").unwrap();
+        assert_eq!(s.today_text(None, None).as_deref(), Ok("Tháng 11 2023"));
+        s.set_date_format("ddd, d mmm").unwrap();
+        assert_eq!(s.today_text(None, None).as_deref(), Ok("T3, 14 Thg 11"));
+        // Encoding follows the spelled text: `14 tháng 11 2023` is WinAnsi-representable;
+        // a weekday name such as `Thứ Ba` is not, so Fill & Sign refuses that format.
+        assert_eq!(s.today_text_for_pdf(Some("d mmmm yyyy"), Some("vi")).as_deref(), Ok("14 tháng 11 2023"));
+        let e = s.today_text_for_pdf(Some("dddd d mmmm yyyy"), Some("vi")).unwrap_err();
+        assert!(e.contains("can't be written into the PDF yet") && e.contains("dd.mm.yyyy"), "{e}");
+        assert!(s.today_text_for_pdf(Some("dd.mm.yyyy"), Some("vi")).is_ok());
+    }
+
     #[test]
     fn dates_the_pdf_cannot_hold_are_refused_not_damaged() {
         assert_eq!(unwritable("8. října 2026"), "ř");
diff --git a/crates/engine/src/export.rs b/crates/engine/src/export.rs
index a6af0cdf8..579a483ef 100644
--- a/crates/engine/src/export.rs
+++ b/crates/engine/src/export.rs
@@ -46,8 +46,11 @@ pub fn extract_images(src: &ExportSource, pages: &[usize], min_side: u32) -> Res
 }
 
 /// The file name for the `index`-th (1-based) exported image: `<stem>_Page_<n>_Image_<index>.<ext>`.
-pub fn image_file_name(stem: &str, image: &pdfcraft_create::ExtractedImage, index: usize) -> String {
-    format!("{stem}_Page_{}_Image_{index:04}.{}", image.page + 1, image.extension)
+/// The page number has leading zeros for as many digits as the document's `page_count` has, so the
+/// files sort in page order (#2208): page 7 of 120 is `Page_007`.
+pub fn image_file_name(stem: &str, image: &pdfcraft_create::ExtractedImage, index: usize, page_count: usize) -> String {
+    let width = page_count.max(1).to_string().len();
+    format!("{stem}_Page_{:0width$}_Image_{index:04}.{}", image.page + 1, image.extension)
 }
 
 impl Exporter {
@@ -212,3 +215,29 @@ pub fn encode_tiff(width: u32, height: u32, premultiplied: &[u8]) -> Result<Vec<
     image::codecs::tiff::TiffEncoder::new(&mut out).write_image(&rgb, width, height, image::ExtendedColorType::Rgb8).map_err(|e| e.to_string())?;
     Ok(out.into_inner())
 }
+
+#[cfg(test)]
+mod image_name_tests {
+    use super::image_file_name;
+
+    fn image(page: usize) -> pdfcraft_create::ExtractedImage {
+        pdfcraft_create::ExtractedImage {
+            page,
+            object: pdfcraft_cos::ObjRef { num: 1, generation: 0 },
+            width: 1,
+            height: 1,
+            extension: "png",
+            data: Vec::new(),
+        }
+    }
+
+    #[test]
+    fn page_number_is_padded_to_the_page_count() {
+        assert_eq!(image_file_name("doc", &image(0), 1, 1), "doc_Page_1_Image_0001.png");
+        assert_eq!(image_file_name("doc", &image(0), 1, 9), "doc_Page_1_Image_0001.png");
+        assert_eq!(image_file_name("doc", &image(6), 2, 20), "doc_Page_07_Image_0002.png");
+        assert_eq!(image_file_name("doc", &image(6), 3, 120), "doc_Page_007_Image_0003.png");
+        assert_eq!(image_file_name("doc", &image(119), 4, 120), "doc_Page_120_Image_0004.png");
+        assert_eq!(image_file_name("doc", &image(0), 1, 0), "doc_Page_1_Image_0001.png");
+    }
+}
diff --git a/crates/engine/src/js.rs b/crates/engine/src/js.rs
index d636c303f..8958688d2 100644
--- a/crates/engine/src/js.rs
+++ b/crates/engine/src/js.rs
@@ -250,6 +250,15 @@ fn detection_words(text: &pdfcraft_render::PageText, info: &pdfcraft_render::Pag
 /// A page's words in reading order, in user space ([x0, y0, x1, y1]); runs of underscores are
 /// words of their own.
 pub(crate) fn page_words(text: &pdfcraft_render::PageText, info: &pdfcraft_render::PageInfo) -> Vec<(String, [f64; 4])> {
+    words_with(text, |x, y| info.view_to_user(x, y))
+        .into_iter()
+        .map(|(text, r)| (text, [f64::from(r[0]), f64::from(r[1]), f64::from(r[2]), f64::from(r[3])]))
+        .collect()
+}
+
+/// A page's words in reading order, their boxes mapped from view space by `map` (and ordered
+/// again, so that [x0, y0, x1, y1] holds whatever way `map` turns them).
+pub(crate) fn words_with(text: &pdfcraft_render::PageText, map: impl Fn(f32, f32) -> [f32; 2]) -> Vec<(String, [f32; 4])> {
     let mut words: Vec<(String, [f32; 4])> = Vec::new();
     let mut last_line = u32::MAX;
     // A space glyph ends the word before it.
@@ -281,18 +290,23 @@ pub(crate) fn page_words(text: &pdfcraft_render::PageText, info: &pdfcraft_rende
     words
         .into_iter()
         .map(|(text, r)| {
-            let a = info.view_to_user(r[0], r[1]);
-            let b = info.view_to_user(r[2], r[3]);
-            let rect = [a[0].min(b[0]) as f64, a[1].min(b[1]) as f64, a[0].max(b[0]) as f64, a[1].max(b[1]) as f64];
-            (text, rect)
+            let a = map(r[0], r[1]);
+            let b = map(r[2], r[3]);
+            (text, [a[0].min(b[0]), a[1].min(b[1]), a[0].max(b[0]), a[1].max(b[1])])
         })
         .collect()
 }
 
 impl Session {
     /// Prepare a form ▸ automatic field detection: the fields `pages` (0-based; empty = all)
-    /// seem to ask for, named from their labels, as (page, candidate).
+    /// seem to ask for, named from their labels, as (page, candidate). Scanned pages (a picture
+    /// and no drawn shapes) are read from their pixels, see [`crate::scan_fields`].
     pub fn detect_fields(&self, id: DocId, pages: &[usize]) -> Vec<(usize, pdfcraft_forms::detect::Candidate)> {
+        self.detect_fields_turned(id, pages).into_iter().map(|(page, c, _)| (page, c)).collect()
+    }
+
+    /// [`Self::detect_fields`], with how far each field turns (`/MK /R`) to read upright.
+    fn detect_fields_turned(&self, id: DocId, pages: &[usize]) -> Vec<(usize, pdfcraft_forms::detect::Candidate, i64)> {
         let Some(doc) = self.get(id) else { return Vec::new() };
         let Some(cos) = doc.editor.as_ref().map(|e| &e.cos) else { return Vec::new() };
         let config = pdfcraft_render::RenderConfig { password: doc.password.as_deref().map(std::sync::Arc::from), ..Default::default() };
@@ -302,13 +316,19 @@ impl Session {
         let list: Vec<usize> = if pages.is_empty() { (0..all).collect() } else { pages.iter().copied().filter(|p| *p < all).collect() };
         let mut out = Vec::new();
         for page in list {
+            let Some(info) = doc.info.pages.get(page) else { continue };
             let res = r.render(pdfcraft_render::RenderRequest { page, kind: pdfcraft_render::RequestKind::Text, scale: 1.0, ..Default::default() });
-            let words = res.text.map(|t| detection_words(&t, &doc.info.pages[page])).unwrap_or_default();
             let shapes = pdfcraft_forms::detect::page_shapes(cos, page);
             let existing: Vec<[f64; 4]> = doc.form.iter().flat_map(|f| f.widgets.iter()).filter(|w| w.page == Some(page)).map(|w| w.rect).collect();
-            for c in pdfcraft_forms::detect::detect(&words, &shapes, &existing, &taken) {
+            let (found, turn) = if shapes.boxes.is_empty() && shapes.rules.is_empty() && crate::scan_fields::is_scan(doc, page, info) {
+                self.detect_on_scan(id, &mut r, page, res.text.as_deref(), &existing, &taken)
+            } else {
+                let words = res.text.map(|t| detection_words(&t, info)).unwrap_or_default();
+                (pdfcraft_forms::detect::detect(&words, &shapes, &existing, &taken), 0)
+            };
+            for c in found {
                 taken.push(c.name.clone());
-                out.push((page, c));
+                out.push((page, c, turn));
             }
         }
         out
@@ -316,23 +336,29 @@ impl Session {
 
     /// Detect fields and add them, as one undoable step. Returns the new fields' names.
     pub fn auto_detect_fields(&mut self, id: DocId, pages: &[usize]) -> Result<Vec<String>, EditError> {
-        let found = self.detect_fields(id, pages);
+        let found = self.detect_fields_turned(id, pages);
         if found.is_empty() {
             return Ok(Vec::new());
         }
-        let names = found.iter().map(|(_, c)| c.name.clone()).collect();
-        let edits = found
-            .into_iter()
-            .map(|(page, c)| Edit::AddField {
+        let names = found.iter().map(|(_, c, _)| c.name.clone()).collect();
+        let mut edits = Vec::with_capacity(found.len());
+        for (page, c, turn) in found {
+            // A turned field keeps its place: the rectangle is already the one on the page.
+            let props = (turn != 0).then(|| pdfcraft_forms::FieldProps { rotation: Some((0, turn)), rect: Some((0, c.rect)), ..Default::default() });
+            let tall = if turn % 180 == 0 { c.rect[3] - c.rect[1] } else { c.rect[2] - c.rect[0] };
+            edits.push(Edit::AddField {
                 page,
                 rect: c.rect,
                 kind: match c.kind {
-                    pdfcraft_forms::detect::Kind::Text => pdfcraft_forms::NewField::Text { multiline: c.rect[3] - c.rect[1] > 30.0 },
+                    pdfcraft_forms::detect::Kind::Text => pdfcraft_forms::NewField::Text { multiline: tall > 30.0 },
                     pdfcraft_forms::detect::Kind::CheckBox => pdfcraft_forms::NewField::CheckBox,
                 },
-                name: Some(c.name),
-            })
-            .collect();
+                name: Some(c.name.clone()),
+            });
+            if let Some(props) = props {
+                edits.push(Edit::SetFieldProps { name: c.name, props: Box::new(props) });
+            }
+        }
         self.apply(id, Edit::Batch { label: "Detect form fields".into(), edits })?;
         Ok(names)
     }
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index fbe62b2c2..01f162ae7 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -28,20 +28,23 @@ pub mod js;
 pub mod links;
 pub mod ocr;
 pub mod optimizer;
+pub mod print_raster;
 pub mod printcheck;
 mod scan_colours;
+mod scan_fields;
 pub mod signature_image;
 pub mod signature_scan;
 pub mod text_fonts;
 mod text_preview;
 mod upright_image;
+pub mod word_count;
 pub mod xfa;
 
 pub use signature_image::{ImageSignaturePreview, SignatureImage};
 pub use signature_scan::{PhotoRect, ScanError, SignaturePhoto, Turn};
 pub use text_preview::TextEditPreview;
 
-pub use pdfcraft_organize::{BoxSpec, FieldConflicts, PageBox, SplitBy, split_ranges};
+pub use pdfcraft_organize::{BoxSpec, FieldConflicts, PageBox, SplitBy, Transition, TransitionSpec, split_ranges};
 
 /// One file produced by a split: (1-based first page, last page, PDF bytes).
 pub use pdfcraft_organize::LabelStyle;
@@ -49,13 +52,14 @@ pub use pdfcraft_organize::view::{InitialView, Layout as InitialLayout, Magnific
 
 pub use pdfcraft_cos::Algorithm;
 pub use pdfcraft_create::{CONVERTIBLE, CreateError, ImageResolution, SourceKind, decode_text, source_kind};
+pub use pdfcraft_edit::added::{text_rect as added_text_rect, text_width as added_text_width};
 pub use pdfcraft_edit::{
     Added, AddedImage, AddedText, Align as TextAlign, Background, Content as AddedContent, Family as FontFamily, HeaderFooter, MarkKind, Watermark,
 };
 pub use pdfcraft_forms::{
     BorderStyle, CheckStyle, Field as FormField, FieldAction, FieldChange, FieldFont, FieldKind as FormFieldKind, FieldProps, FieldValue,
     Look as FieldLook, LookPatch as FieldLookPatch, NewField, TabOrder, Trigger as FieldTrigger, Widget as FormWidget, af as form_scripts,
-    flags as field_flags,
+    appearance as form_appearance, appearance::auto_text_size_by as field_auto_text_size_by, flags as field_flags,
 };
 
 pub use pdfcraft_a11y as a11y;
@@ -75,6 +79,8 @@ pub enum ImageEdit {
     Flip {
         horizontal: bool,
     },
+    /// Show only this box of it (user space), the pixels staying where they are.
+    Crop([f64; 4]),
     /// Draw this image file (PNG, JPEG, TIFF, GIF, BMP, JPEG 2000) in its place.
     Replace {
         name: String,
@@ -82,7 +88,7 @@ pub enum ImageEdit {
     },
     Delete,
 }
-pub use pdfcraft_fonts::{MAX_SIGNATURE_CHARS, ScriptOutline, script_missing, script_outline};
+pub use pdfcraft_fonts::{MAX_SIGNATURE_CHARS, ScriptOutline, script_missing, script_outline, undrawable_message};
 
 /// Fill & Sign: `text` in the script font as a typed signature, its left edge at `at` (user
 /// space, vertically centred) and `height` points tall. `None` for text with no outlines.
@@ -107,6 +113,19 @@ pub fn typed_signature_shape(at: [f64; 2], text: &str, height: f64, rotation: i6
     let contours = o.contours.iter().map(|c| c.iter().map(|p| to_user((p[0] - left) / width, (p[1] - bottom) / span)).collect()).collect();
     Some(Shape::TypedSignature { rect, contours })
 }
+/// `at` moved `right` and `up` points as displayed on a page turned by `rotation` (its `/Rotate`).
+pub fn displayed_offset(rotation: i64, at: [f64; 2], right: f64, up: f64) -> [f64; 2] {
+    let [a, b, c, d, ..] = pdfcraft_model::view_matrix_for(rotation, [0.0; 4]);
+    [at[0] + a * right + c * up, at[1] + b * right + d * up]
+}
+
+/// The user-space box `width` x `height` points as displayed on a page turned by `rotation`,
+/// with its displayed top-left corner at `at`: where typed text and text boxes go. `None` for a
+/// non-finite point.
+pub fn text_box_at(rotation: i64, at: [f64; 2], width: f64, height: f64) -> Option<[f64; 4]> {
+    signature_image::upright_box(rotation, displayed_offset(rotation, at, 0.0, -height / 2.0), width, height)
+}
+
 /// `text` in the script font as the graphic of a visible digital signature, as Fill & Sign types
 /// it. `None` for text with no outlines.
 pub fn typed_signature_graphic(text: &str) -> Option<pdfcraft_sign::Graphic> {
@@ -147,7 +166,38 @@ pub fn merge_data_files(files: &[(String, Vec<u8>)]) -> Result<String, String> {
 
 pub type SplitPart = (usize, usize, Arc<Vec<u8>>);
 
-use std::sync::Arc;
+use std::sync::{Arc, OnceLock};
+
+#[cfg(test)]
+thread_local! {
+    static SECONDARY_SCAN_COUNTS: std::cell::Cell<(usize, usize)> = const { std::cell::Cell::new((0, 0)) };
+}
+
+#[cfg(test)]
+fn reset_secondary_scan_counts() {
+    SECONDARY_SCAN_COUNTS.with(|counts| counts.set((0, 0)));
+}
+
+#[cfg(test)]
+fn secondary_scan_counts() -> (usize, usize) {
+    SECONDARY_SCAN_COUNTS.with(std::cell::Cell::get)
+}
+
+#[cfg(test)]
+fn record_marker_scan() {
+    SECONDARY_SCAN_COUNTS.with(|counts| {
+        let (markers, links) = counts.get();
+        counts.set((markers + 1, links));
+    });
+}
+
+#[cfg(test)]
+fn record_link_scan() {
+    SECONDARY_SCAN_COUNTS.with(|counts| {
+        let (markers, links) = counts.get();
+        counts.set((markers, links + 1));
+    });
+}
 
 use pdfcraft_cos::{SaveOptions, write_full, write_incremental};
 use pdfcraft_render::{DocInfo, Layer, LayerOp, OpenError, ReadingColors, RenderConfig, RenderPool, inspect};
@@ -179,6 +229,8 @@ enum Scope {
     Comments,
     /// Only form field values (and their widget appearances).
     Form,
+    /// Link annotations; the full inspection is refreshed, but page-content indexes stay valid.
+    Links,
     /// Only page content streams, resources and added content/marks: the page tree,
     /// annotations, form fields, links, outline and fonts are unchanged, so the full
     /// re-inspection is skipped (seconds on very large files).
@@ -214,7 +266,9 @@ fn scope_of(edit: &Edit) -> Scope {
         | Edit::ResizeAnnotation { .. }
         | Edit::StyleAnnotation { .. }
         | Edit::FillAnnotation { .. }
+        | Edit::FontSizeAnnotation { .. }
         | Edit::SetAnnotationInfo { .. } => Scope::Comments,
+        Edit::AddLink { .. } | Edit::SetLink { .. } | Edit::DeleteLink { .. } | Edit::RemoveLinks { .. } | Edit::AddLinks { .. } => Scope::Links,
         Edit::SetFieldValue { .. } | Edit::ResetForm { .. } | Edit::SetFieldImage { .. } | Edit::ApplyScriptChanges { .. } => Scope::Form,
         // Page content, resources and added content/marks only: the page tree, annotations,
         // fields, links and document metadata are untouched (see `refresh_content`).
@@ -247,6 +301,11 @@ type Snapshot = (Label, pdfcraft_cos::Document, Keys, Scope);
 #[derive(Clone)]
 struct Editor {
     cos: pdfcraft_cos::Document,
+    /// The file as last opened or saved. Incremental saves append to it, and Revert opens it.
+    /// Undo may restore a snapshot whose own base is an earlier revision; this does not follow it.
+    saved: Arc<Vec<u8>>,
+    /// Passwords that open [`Self::saved`].
+    saved_keys: Keys,
     undo: Vec<Snapshot>,
     redo: Vec<Snapshot>,
     keys: Keys,
@@ -320,12 +379,8 @@ pub struct Document {
     pub read_only_reason: Option<String>,
     /// Interactive form fields of the current state (empty without a form).
     pub form: Arc<Vec<pdfcraft_forms::Field>>,
-    /// Page marks present (headers and footers, watermarks, backgrounds), for Update/Remove.
-    pub marks: Vec<MarkKind>,
-    /// Text and images added with Edit a PDF ▸ Add content (still editable).
-    pub added: Vec<pdfcraft_edit::Added>,
-    /// Link annotations, for Edit a PDF ▸ Link.
-    pub links: Vec<pdfcraft_annot::links::LinkItem>,
+    marker_scan: OnceLock<pdfcraft_edit::MarkerScan>,
+    links: OnceLock<Vec<pdfcraft_annot::links::LinkItem>>,
     /// Signature fields, validated against the session's trust store (Signatures panel).
     pub signatures: Arc<Vec<SignatureInfo>>,
     trust: Arc<TrustStore>,
@@ -540,6 +595,11 @@ impl Document {
         self.editor.as_ref().map(|e| a11y::tags(&e.cos)).unwrap_or_default()
     }
 
+    /// Marked-content items directly owned by one reachable indirect structure tag.
+    pub fn tag_content(&self, object: pdfcraft_cos::ObjRef) -> Result<Vec<a11y::TagContentItem>, a11y::TagError> {
+        self.editor.as_ref().map(|e| a11y::tag_content(&e.cos, object)).unwrap_or_else(|| Ok(Vec::new()))
+    }
+
     /// The edit that fixes `rule`, for the rules with an automatic fix: the document language
     /// (`value` is the language), the title (`value` replaces it; else the current title or the
     /// file name) and the tab order.
@@ -636,6 +696,54 @@ impl Document {
         self.info.annotations.iter().filter(|a| a.subtype == "Redact").count()
     }
 
+    /// Page marks present (headers and footers, watermarks, backgrounds), for Update/Remove.
+    pub fn marks(&self) -> &[MarkKind] {
+        &self
+            .marker_scan
+            .get_or_init(|| {
+                self.editor
+                    .as_ref()
+                    .map(|e| {
+                        #[cfg(test)]
+                        record_marker_scan();
+                        pdfcraft_edit::scan_markers(&e.cos)
+                    })
+                    .unwrap_or_default()
+            })
+            .marks
+    }
+
+    /// Text and images added with Edit a PDF ▸ Add content (still editable).
+    pub fn added(&self) -> &[pdfcraft_edit::Added] {
+        &self
+            .marker_scan
+            .get_or_init(|| {
+                self.editor
+                    .as_ref()
+                    .map(|e| {
+                        #[cfg(test)]
+                        record_marker_scan();
+                        pdfcraft_edit::scan_markers(&e.cos)
+                    })
+                    .unwrap_or_default()
+            })
+            .added
+    }
+
+    /// Link annotations, for Edit a PDF ▸ Link.
+    pub fn links(&self) -> &[pdfcraft_annot::links::LinkItem] {
+        self.links.get_or_init(|| {
+            self.editor
+                .as_ref()
+                .map(|e| {
+                    #[cfg(test)]
+                    record_link_scan();
+                    pdfcraft_annot::links::list(&e.cos)
+                })
+                .unwrap_or_default()
+        })
+    }
+
     /// Changes to content and document information are allowed.
     pub fn allows_modification(&self) -> bool {
         self.editable() && self.permissions().is_none_or(|p| p.modify())
@@ -743,9 +851,9 @@ impl Document {
     }
 
     /// The file as last opened or saved, without unsaved edits: what an incremental save appends
-    /// to.
+    /// to. This stays that file when undo has restored an older snapshot.
     pub fn saved_bytes(&self) -> Arc<Vec<u8>> {
-        self.editor.as_ref().map_or_else(|| self.bytes.clone(), |e| e.cos.bytes().clone())
+        self.editor.as_ref().map_or_else(|| self.bytes.clone(), |e| e.saved.clone())
     }
 
     /// Notes about damage repaired while opening (Document Properties ▸ Advanced, notices).
@@ -767,6 +875,12 @@ fn is_placeholder_title(title: &str) -> bool {
 /// What is displayed: the working file, plus (in memory only, never saved) the appearances
 /// PdfCraft draws for comments that have none ([`pdfcraft_annot::with_missing_appearances`]).
 /// The working file is unchanged, and so is everything that reads it (saving, signatures, …).
+/// The reader shows the same pages in `a` and `b`: count, displayed size and rotation.
+fn same_pages(a: &[pdfcraft_render::PageInfo], b: &[pdfcraft_render::PageInfo]) -> bool {
+    a.len() == b.len()
+        && a.iter().zip(b).all(|(x, y)| (x.width - y.width).abs() < 0.01 && (x.height - y.height).abs() < 0.01 && x.rotation == y.rotation)
+}
+
 fn display_bytes(editor: Option<&mut Editor>, bytes: &Arc<Vec<u8>>) -> Arc<Vec<u8>> {
     let Some(display) = editor.and_then(|e| pdfcraft_annot::with_missing_appearances_cached(&e.cos, &mut e.appearances)) else {
         return bytes.clone();
@@ -775,6 +889,23 @@ fn display_bytes(editor: Option<&mut Editor>, bytes: &Arc<Vec<u8>>) -> Arc<Vec<u
     write_incremental(&display, &SaveOptions::default()).map(Arc::new).unwrap_or_else(|_| bytes.clone())
 }
 
+/// The copy PDFCraft displays when opening `bytes`: with appearances drawn, in memory only, for
+/// comments that have none. Render paths outside the app, such as the CLI, use this so their page
+/// images agree with the app and independent viewers. It never changes the source document, and an
+/// unparseable file, a write failure or a parser panic falls back to the original bytes.
+pub fn display_bytes_for(bytes: Arc<Vec<u8>>, password: Option<&str>) -> Arc<Vec<u8>> {
+    guard(|| {
+        pdfcraft_cos::Document::open_with_password(bytes.clone(), password)
+            .ok()
+            .and_then(|cos| pdfcraft_annot::with_missing_appearances(&cos))
+            .and_then(|display| write_incremental(&display, &SaveOptions::default()).ok())
+            .map(Arc::new)
+    })
+    .ok()
+    .flatten()
+    .unwrap_or(bytes)
+}
+
 /// Fails when the renderer still draws text under an applied redaction mark.
 ///
 /// Redaction decides what lies under a mark from the positions its own interpreter computes, and
@@ -900,6 +1031,8 @@ pub struct BookmarkRow {
     pub open: bool,
     /// The 0-based page it goes to.
     pub page: Option<usize>,
+    /// Where on that page it goes ([`pdfcraft_render::DestView::Top`] when it doesn't say).
+    pub view: pdfcraft_render::DestView,
 }
 
 /// One page of the bookmark list, in outline order.
@@ -927,7 +1060,7 @@ fn outline_rows(items: &[pdfcraft_render::OutlineItem]) -> Vec<BookmarkRow> {
             top.1 += 1;
         }
         let path: Vec<usize> = levels.iter().map(|(_, listed)| listed.saturating_sub(1)).collect();
-        rows.push(BookmarkRow { path, title: item.title.clone(), open: item.open, page: item.page });
+        rows.push(BookmarkRow { path, title: item.title.clone(), open: item.open, page: item.page, view: item.view });
         if !item.children.is_empty() {
             levels.push((&item.children, 0));
         }
@@ -1131,6 +1264,12 @@ pub enum Edit {
         which: PageBox,
         spec: BoxSpec,
     },
+    /// Set or remove the page transition and display time of pages (ISO 32000-2 §12.4.4),
+    /// Organize ▸ Page Transitions.
+    SetTransition {
+        pages: Vec<usize>,
+        spec: TransitionSpec,
+    },
     SetInfo {
         key: String,
         value: String,
@@ -1280,6 +1419,12 @@ pub enum Edit {
         index: usize,
         fill: Option<Rgb>,
     },
+    /// Change the font size (pt) of a text box, typewriter text or callout.
+    FontSizeAnnotation {
+        page: usize,
+        index: usize,
+        size: f64,
+    },
     /// Comment properties ▸ General / note icon.
     SetAnnotationInfo {
         page: usize,
@@ -1338,6 +1483,8 @@ pub enum Edit {
         figure: u32,
         alt: Option<String>,
     },
+    /// Add `/Form` tags and object references for all widgets in an untagged AcroForm.
+    AutoTagFormFields,
     /// Change one property on a reachable indirect structure tag.
     SetTagProperty {
         object: pdfcraft_cos::ObjRef,
@@ -1354,6 +1501,10 @@ pub enum Edit {
     MarkDecorative {
         figure: u32,
     },
+    /// Tags panel ▸ Mark as artifact: retire a leaf tag and mark its content as an artifact.
+    MarkTagArtifact {
+        object: pdfcraft_cos::ObjRef,
+    },
     /// Document JavaScripts: add, replace (`script`) or remove (`None`) the document-level
     /// script `name`.
     SetDocumentScript {
@@ -1527,6 +1678,11 @@ pub enum Edit {
     },
     /// Sanitize Document: every category, then a full rewrite on save.
     Sanitize,
+    /// An XFA form made an ordinary (static) PDF form: the XFA packets, `/NeedsRendering` and
+    /// PdfCraft's private keys go, the pages as laid out and the fields with their values
+    /// stay, so every viewer shows the same form and none lays it out again. Its scripts no
+    /// longer run.
+    XfaToStatic,
     /// Flatten comments and/or form fields on every page into page content.
     Flatten {
         comments: bool,
@@ -1623,6 +1779,7 @@ pub const EDIT_LABELS: &[&str] = &[
     "Crop page",
     "Crop pages",
     "Set page boxes",
+    "Set page transitions",
     "Change Title",
     "Change Author",
     "Change Subject",
@@ -1758,6 +1915,7 @@ impl Edit {
             Edit::ReplacePages { pages, .. } => plural("Replace page", "Replace pages", pages.len()),
             Edit::SetPageBox { pages, which: PageBox::Crop, .. } => plural("Crop page", "Crop pages", pages.len()),
             Edit::SetPageBox { .. } => Label::of("Set page boxes"),
+            Edit::SetTransition { .. } => Label::of("Set page transitions"),
             // The four `/Info` keys PdfCraft itself offers get a wording of their own, so each can
             // be said in another language; any other key is the document's and goes in as it stands.
             Edit::SetInfo { key, .. } => match key.as_str() {
@@ -1803,7 +1961,9 @@ impl Edit {
             Edit::LockAnnotation { .. } => Label::of("Unlock comment"),
             Edit::MoveAnnotation { .. } => Label::of("Move comment"),
             Edit::ResizeAnnotation { .. } => Label::of("Resize comment"),
-            Edit::StyleAnnotation { .. } | Edit::FillAnnotation { .. } | Edit::SetAnnotationInfo { .. } => Label::of("Change comment properties"),
+            Edit::StyleAnnotation { .. } | Edit::FillAnnotation { .. } | Edit::FontSizeAnnotation { .. } | Edit::SetAnnotationInfo { .. } => {
+                Label::of("Change comment properties")
+            }
             Edit::SetFieldValue { name, .. } => Label::with("Fill in {name}", name.as_str()),
             Edit::SetFieldImage { name, .. } => Label::with("Set the image of {name}", name.as_str()),
             Edit::ResetForm { .. } => Label::of("Clear form"),
@@ -1815,9 +1975,11 @@ impl Edit {
             Edit::SetInitialView(_) => Label::of("Change initial view"),
             Edit::AutoTagText => Label::of("Automatically tag text"),
             Edit::SetAltText { .. } => Label::of("Set alternate text"),
+            Edit::AutoTagFormFields => Label::of("Tag form fields"),
             Edit::SetTagProperty { .. } => Label::of("Change tag properties"),
             Edit::MoveTag { .. } => Label::of("Move object"),
             Edit::MarkDecorative { .. } => Label::of("Mark figure as decorative"),
+            Edit::MarkTagArtifact { .. } => Label::of("Mark content as artifact"),
             Edit::AddOcrText { .. } => Label::of("Recognize text"),
             Edit::ApplyScriptChanges { .. } => Label::of("Run JavaScript"),
             Edit::XfaEvent { .. } => Label::of("Run form script"),
@@ -1832,6 +1994,7 @@ impl Edit {
             Edit::EditPageImage { change, .. } => Label::of(match change {
                 ImageEdit::Move(_) => "Move image",
                 ImageEdit::Rotate(_) => "Rotate image",
+                ImageEdit::Crop(_) => "Crop image",
                 ImageEdit::Flip { .. } => "Flip image",
                 ImageEdit::Replace { .. } => "Replace image",
                 ImageEdit::Delete => "Delete image",
@@ -1860,6 +2023,7 @@ impl Edit {
             Edit::RemoveLinks { .. } => Label::of("Remove all links"),
             Edit::AddLinks { links, .. } => plural("Create link", "Create links", links.len()),
             Edit::Sanitize => Label::of("Sanitize document"),
+            Edit::XfaToStatic => Label::of("Convert to a static form"),
             Edit::Flatten { comments: true, fields: false } => Label::of("Flatten comments"),
             Edit::Flatten { comments: false, fields: true } => Label::of("Flatten form fields"),
             Edit::Flatten { .. } => Label::of("Flatten"),
@@ -1922,6 +2086,7 @@ fn check_permission(edit: &Edit, p: &pdfcraft_cos::Permissions) -> Result<(), Ed
         | Edit::DuplicatePages { .. }
         | Edit::ReplacePages { .. }
         | Edit::SetPageBox { .. }
+        | Edit::SetTransition { .. }
         | Edit::InsertPagesFrom { .. }
         // "Assemble the document: insert, rotate or delete pages and create bookmarks" (Table 22).
         | Edit::AddBookmark { .. }
@@ -1952,6 +2117,7 @@ fn check_permission(edit: &Edit, p: &pdfcraft_cos::Permissions) -> Result<(), Ed
         | Edit::ResizeAnnotation { .. }
         | Edit::StyleAnnotation { .. }
         | Edit::FillAnnotation { .. }
+        | Edit::FontSizeAnnotation { .. }
         | Edit::SetAnnotationInfo { .. }
         | Edit::SetMeasurementScale { .. } => {
             if p.annotate() {
@@ -1996,6 +2162,7 @@ fn check_permission(edit: &Edit, p: &pdfcraft_cos::Permissions) -> Result<(), Ed
         | Edit::RemoveLinks { .. }
         | Edit::AddLinks { .. }
         | Edit::Sanitize
+        | Edit::XfaToStatic
         | Edit::SetFieldProps { .. }
         | Edit::DeleteField { .. }
         | Edit::DuplicateField { .. }
@@ -2004,9 +2171,11 @@ fn check_permission(edit: &Edit, p: &pdfcraft_cos::Permissions) -> Result<(), Ed
         | Edit::SetInitialView(_)
         | Edit::AutoTagText
         | Edit::SetAltText { .. }
+        | Edit::AutoTagFormFields
         | Edit::SetTagProperty { .. }
         | Edit::MoveTag { .. }
         | Edit::MarkDecorative { .. }
+        | Edit::MarkTagArtifact { .. }
         | Edit::AddOcrText { .. }
         | Edit::SetDocumentScript { .. }
         | Edit::SetFieldScript { .. }
@@ -2039,6 +2208,8 @@ struct EditCtx {
     xfa_datasets: Option<pdfcraft_cos::ObjRef>,
     /// A form script ran too long and was abandoned: the document's scripts go off.
     xfa_ran_away: bool,
+    /// The edit took the XFA out of the form: what went with it, for the document's warnings.
+    xfa_removed: Vec<String>,
     /// Pages in the document, for `xfa.layout.pageCount()`.
     pages: usize,
     date: Option<String>,
@@ -2068,6 +2239,7 @@ impl EditCtx {
             xfa_out: Default::default(),
             xfa_datasets: None,
             xfa_ran_away: false,
+            xfa_removed: Vec::new(),
             pages: 0,
             date: now.map(pdfcraft_cos::pdf_date),
             today: (1970, 1, 1),
@@ -2130,13 +2302,16 @@ fn run_edit(doc: &mut pdfcraft_cos::Document, edit: &Edit, cx: &mut EditCtx) ->
             pdfcraft_organize::replace_pages(doc, pages, &src, src_pages)?;
         }
         Edit::SetPageBox { pages, which, spec } => pdfcraft_organize::set_page_box(doc, pages, *which, *spec)?,
+        Edit::SetTransition { pages, spec } => pdfcraft_organize::set_transition(doc, pages, spec)?,
         Edit::InsertPagesFrom { name, bytes, pages, at, field_conflicts } => {
             let src = open_source(name, bytes)?;
             let pages = match pages {
                 Some(p) => p.clone(),
                 None => (0..pdfcraft_organize::page_count(&src)?).collect(),
             };
-            let outcome = pdfcraft_organize::import_pages_with(doc, &src, &pages, *at, *field_conflicts)?;
+            // The file's bookmarks come along under one named after it, as in Combine Files.
+            let title = std::path::Path::new(name).file_stem().map_or_else(|| name.clone(), |s| s.to_string_lossy().into_owned());
+            let outcome = pdfcraft_organize::insert_file_pages(doc, &src, &title, &pages, *at, *field_conflicts)?;
             cx.renamed_fields = outcome.renamed_fields;
         }
         Edit::AddBookmark { parent, index, title, page } => {
@@ -2205,6 +2380,7 @@ fn run_edit(doc: &mut pdfcraft_cos::Document, edit: &Edit, cx: &mut EditCtx) ->
             pdfcraft_annot::set_style(doc, *page, *index, *color, *opacity, *width, endings.as_deref(), &cx.meta())?;
         }
         Edit::FillAnnotation { page, index, fill } => pdfcraft_annot::set_fill(doc, *page, *index, *fill, &cx.meta())?,
+        Edit::FontSizeAnnotation { page, index, size } => pdfcraft_annot::set_font_size(doc, *page, *index, *size, &cx.meta())?,
         Edit::SetAnnotationInfo { page, index, author, subject, icon } => {
             pdfcraft_annot::set_info(doc, *page, *index, author.as_deref(), subject.as_deref(), *icon, &cx.meta())?;
         }
@@ -2284,6 +2460,9 @@ fn run_edit(doc: &mut pdfcraft_cos::Document, edit: &Edit, cx: &mut EditCtx) ->
             let r = pdfcraft_cos::ObjRef::new(*figure, doc.generation(*figure));
             a11y::set_alt(doc, r, alt.as_deref()).map_err(|e| EditError::Accessibility(e.to_string()))?;
         }
+        Edit::AutoTagFormFields => {
+            a11y::tag_form_fields(doc).map_err(EditError::Accessibility)?;
+        }
         Edit::SetTagProperty { object, property, value } => {
             a11y::set_tag_property(doc, *object, *property, value.as_deref()).map_err(|e| EditError::Accessibility(e.to_string()))?;
         }
@@ -2331,6 +2510,7 @@ fn run_edit(doc: &mut pdfcraft_cos::Document, edit: &Edit, cx: &mut EditCtx) ->
                     }
                     pdfcraft_edit::ImageChange::Replace(embed_image(doc, name, bytes)?.0)
                 }
+                ImageEdit::Crop(keep) => pdfcraft_edit::ImageChange::Crop(*keep),
                 ImageEdit::Delete => pdfcraft_edit::ImageChange::Delete,
             };
             pdfcraft_edit::change_image(doc, *page, *index, &c)?;
@@ -2346,6 +2526,9 @@ fn run_edit(doc: &mut pdfcraft_cos::Document, edit: &Edit, cx: &mut EditCtx) ->
             let r = pdfcraft_cos::ObjRef::new(*figure, doc.generation(*figure));
             a11y::mark_decorative(doc, r).map_err(|e| EditError::Accessibility(e.to_string()))?;
         }
+        Edit::MarkTagArtifact { object } => {
+            a11y::mark_tag_artifact(doc, *object).map_err(|e| EditError::Accessibility(e.to_string()))?;
+        }
         Edit::AddHeaderFooter { pages, settings, replace } => {
             let date = cx.today;
             pdfcraft_edit::add_header_footer(doc, pages, settings, *replace, &pdfcraft_edit::Context { date })?;
@@ -2445,8 +2628,26 @@ fn run_edit(doc: &mut pdfcraft_cos::Document, edit: &Edit, cx: &mut EditCtx) ->
             pdfcraft_redact::sanitize::sanitize(doc)?;
         }
         Edit::Flatten { comments, fields } => {
+            // An XFA form's fields baked into the pages: the XFA goes too, or Adobe's viewers
+            // would lay the form out again from its template over the baked pages. A dynamic
+            // form that was never laid out keeps its XFA: without it only placeholders remain.
+            let shape = (*fields).then(|| pdfcraft_xfa::xfa_shape(doc)).flatten();
             let n = pdfcraft_model::pages(doc).len();
             pdfcraft_edit::flatten(doc, &(0..n).collect::<Vec<_>>(), *comments, *fields)?;
+            match shape {
+                Some(shape) if shape.strippable() => strip_xfa(doc, cx)?,
+                Some(_) => cx.xfa_removed.push("The XFA was kept: this dynamic form was not laid out, so its fields were not baked in".into()),
+                None => {}
+            }
+        }
+        Edit::XfaToStatic => {
+            let Some(shape) = pdfcraft_xfa::xfa_shape(doc) else {
+                return Err(EditError::Invalid("this document is not an XFA form".into()));
+            };
+            if !shape.strippable() {
+                return Err(EditError::Invalid("this dynamic XFA form was not laid out, so there is no static form to keep".into()));
+            }
+            strip_xfa(doc, cx)?;
         }
         Edit::FlattenFillSign => {
             let n = pdfcraft_model::pages(doc).len();
@@ -2677,6 +2878,11 @@ pub struct Session {
     next_id: u64,
     /// Seconds since the Unix epoch, injected so saves are deterministic in tests.
     clock: Option<fn() -> i64>,
+    /// Seconds to add to UTC for local time, read from whoever knows the zone (a browser, say).
+    /// Separate from `clock` on purpose: `clock` alone is the test shortcut that takes the
+    /// injected time AS local time and zeroes the zone, so injecting only it leaves either the
+    /// local dates or the UTC ones wrong by the zone's offset.
+    utc_offset: Option<fn() -> i64>,
     /// Certificates trusted for signing (Acrobat: Trusted Certificates).
     trust: Arc<TrustStore>,
     /// Preferences ▸ JavaScript ▸ Enable Acrobat JavaScript, inverted (on by default).
@@ -2832,6 +3038,62 @@ fn decode_data_file(bytes: &[u8]) -> Option<Result<String, String>> {
     }
 }
 
+/// Take the XFA out of `doc` and note what went with it: the packets, data no field showed,
+/// buttons that did nothing but run scripts, and fields whose value differs from the form's
+/// data (data PdfCraft could not read into them, now lost).
+fn strip_xfa(doc: &mut pdfcraft_cos::Document, cx: &mut EditCtx) -> Result<(), EditError> {
+    let fields = pdfcraft_forms::fields(doc);
+    let data = xfa_field_data(doc);
+    let differ = pdfcraft_xfa::read_values(doc, &data)
+        .into_iter()
+        .filter(|(name, value)| {
+            let Some(f) = fields.iter().find(|f| f.name == *name) else { return false };
+            match value {
+                pdfcraft_xfa::FieldData::Text(t) => f.value.join("\n") != *t && !t.trim().is_empty(),
+                pdfcraft_xfa::FieldData::Check(on) => f.value.is_empty() == *on,
+                pdfcraft_xfa::FieldData::Radio(sel) => f.value.first() != sel.as_ref(),
+                pdfcraft_xfa::FieldData::None => false,
+            }
+        })
+        .count();
+    let r = pdfcraft_xfa::strip(doc).map_err(|e| EditError::Write(e.to_string()))?;
+    cx.xfa_removed.extend(r.notes());
+    if differ > 0 {
+        cx.xfa_removed.push(format!(
+            "{differ} field(s) held a value other than the form's XFA data (data PdfCraft could not read into them); the data's version is gone"
+        ));
+    }
+    Ok(())
+}
+
+/// Keep the document's XFA state in step with its file after an edit: a script may have laid
+/// the form out again (rows added, subforms shown), an edit may have taken the XFA out
+/// (flattened, or made static), or an undo put it back.
+fn sync_xfa_state(doc: &mut Document) {
+    let Some(cos) = doc.editor.as_ref().map(|e| &e.cos) else { return };
+    match pdfcraft_xfa::existing_layout(cos) {
+        Some(report) => {
+            if doc.xfa.is_none() {
+                // Back after an undo: the XFA's own warnings apply again, the strip's don't.
+                doc.xfa_warnings.retain(|w| !w.starts_with(XFA_REMOVED_PREFIX));
+                if doc.xfa_template.is_none() && !doc.xfa_scripts_off {
+                    doc.xfa_template = xfa::template(cos);
+                }
+            }
+            doc.xfa = Some(report);
+        }
+        None => {
+            doc.xfa = None;
+            doc.xfa_template = None;
+            // Only what the strip said stays (the XFA's own warnings no longer apply).
+            doc.xfa_warnings.retain(|w| w.starts_with(XFA_REMOVED_PREFIX));
+        }
+    }
+}
+
+/// How the warnings of a strip start, so they can be told from the XFA's own.
+const XFA_REMOVED_PREFIX: &str = "XFA removed: ";
+
 /// Is this an XFA data file (an XDP, a datasets document, a data element or a data document),
 /// rather than XFDF, Acrobat's `<fields>` XML or a table? By its root element.
 fn is_xfa_data_file(text: &str) -> bool {
@@ -2959,6 +3221,28 @@ impl Session {
         self
     }
 
+    /// A real clock for a host that has neither a clock nor a time zone of its own (a
+    /// `wasm32-unknown-unknown` build: `now()` would be empty and `local_utc_offset()` is 0, so
+    /// Fill & Sign stamps 1 Jan 1970 and `/ModDate` is never written). `clock` is the UTC time in
+    /// seconds since the epoch; `utc_offset` is the local zone's seconds east of UTC, asked on every
+    /// use because the zone changes with the date (daylight saving). Unlike
+    /// [`Session::with_clock`], which is a test shortcut, nothing here is taken as local time.
+    pub fn with_wall_clock(mut self, clock: fn() -> i64, utc_offset: fn() -> i64) -> Self {
+        self.clock = Some(clock);
+        self.utc_offset = Some(utc_offset);
+        self
+    }
+
+    /// Seconds to add to UTC for the local time of this session: the injected zone, else 0 under
+    /// the test clock (which is already local), else the system's.
+    fn local_offset(&self) -> i64 {
+        match (self.utc_offset, self.clock) {
+            (Some(zone), _) => zone(),
+            (None, Some(_)) => 0,
+            (None, None) => local_utc_offset(),
+        }
+    }
+
     /// Seconds since the Unix epoch from the session clock (0 when unknown).
     pub fn now_secs(&self) -> i64 {
         self.now().unwrap_or(0)
@@ -2978,7 +3262,7 @@ impl Session {
     /// is taken as local time.
     /// A dynamic stamp's second line: "By Ada at 2:14 pm, Oct 02, 2026" (local time).
     pub fn stamp_by_line(&self, author: &str) -> String {
-        let offset = if self.clock.is_some() { 0 } else { local_utc_offset() };
+        let offset = self.local_offset();
         let d = self.now().map(|t| pdfcraft_cos::pdf_date(t + offset)).unwrap_or_default();
         let num = |a: usize, b: usize| d.get(a..b).and_then(|s| s.parse::<u32>().ok()).unwrap_or(0);
         let (y, mo, day, hh, mm) = (num(2, 6), num(6, 8), num(8, 10), num(10, 12), num(12, 14));
@@ -2989,7 +3273,7 @@ impl Session {
     }
 
     pub fn today(&self) -> (i64, u32, u32) {
-        let offset = if self.clock.is_some() { 0 } else { local_utc_offset() };
+        let offset = self.local_offset();
         self.now().map(|t| pdfcraft_cos::pdf_date(t + offset)).as_deref().and_then(parse_ymd).unwrap_or((1970, 1, 1))
     }
 
@@ -3174,6 +3458,31 @@ impl Session {
             },
             (_, cos) => (bytes, info, cos),
         };
+        // The catalog leads to no page, but the reader found pages by scanning: gather the page
+        // objects into a page tree as one more revision, or page edits address none of them
+        // (#1656). Kept only when the reader then shows the same pages, and never on a signed
+        // document, where writing the repair could rewrite the file under its signatures.
+        let (bytes, info, cos) = match cos {
+            Ok(Ok(cos)) if !info.pages.is_empty() && pdfcraft_organize::page_count(&cos).unwrap_or(0) == 0 => {
+                let mut work = cos.clone();
+                let signed = || pdfcraft_sign::pdf::list(&cos, &bytes, &context.trust).iter().any(|s| s.signed);
+                let rebuilt = match pdfcraft_organize::recover_page_tree(&mut work) {
+                    Ok(n) if n > 0 && !signed() => rebase(&work).ok().filter(|(_, i, _)| same_pages(&i.pages, &info.pages)),
+                    _ => None,
+                };
+                match rebuilt {
+                    Some((b, i, mut c)) => {
+                        for line in cos.repair_log() {
+                            c.note_repair(line.clone());
+                        }
+                        c.note_repair(format!("the page tree is missing; its {} pages were found by scanning the file", i.pages.len()));
+                        (b, i, Ok(Ok(c)))
+                    }
+                    None => (bytes, info, Ok(Ok(cos))),
+                }
+            }
+            cos => (bytes, info, cos),
+        };
         // XFA notes survive the document being re-read after edits.
         let xfa_warnings: Vec<String> = if info.xfa.is_some() { info.warnings.clone() } else { Vec::new() };
         let mut document = Self::build_document(&context.trust, name, path, bytes, info, cos, render_password, password, xfa);
@@ -3205,9 +3514,12 @@ impl Session {
         let (mut editor, read_only_reason) = match cos {
             Ok(Ok(cos)) => {
                 let keys = Keys { render: render_password.clone(), reopen: password.map(str::to_owned) };
+                let saved = cos.bytes().clone();
                 (
                     Some(Editor {
                         cos,
+                        saved,
+                        saved_keys: keys.clone(),
                         undo: Vec::new(),
                         redo: Vec::new(),
                         keys,
@@ -3241,14 +3553,6 @@ impl Session {
             };
             e.cos.note_repair(line);
         }
-        let (marks, added) = editor
-            .as_ref()
-            .map(|e| {
-                let scan = pdfcraft_edit::scan_markers(&e.cos);
-                (scan.marks, scan.added)
-            })
-            .unwrap_or_default();
-        let links = editor.as_ref().map(|e| pdfcraft_annot::links::list(&e.cos)).unwrap_or_default();
         let sig_cache = Arc::new(pdfcraft_sign::DigestCache::default());
         let signatures = editor.as_ref().map(|e| signatures_of(&e.cos, &bytes, trust, &sig_cache)).unwrap_or_default();
         Document {
@@ -3265,9 +3569,8 @@ impl Session {
             snapshot_generation: 0,
             read_only_reason,
             form: Arc::new(form),
-            marks,
-            added,
-            links,
+            marker_scan: OnceLock::new(),
+            links: OnceLock::new(),
             signatures,
             trust: trust.clone(),
             sig_cache,
@@ -3418,8 +3721,9 @@ impl Session {
         }
         // Signed documents are only ever saved incrementally: an edit that needs a full rewrite
         // (applying redactions, changing security, sanitizing) would invalidate the signatures.
+        // So does any edit to a file rebuilt from object headers: it has no chain to append to.
         let rewrites = |c: &pdfcraft_cos::Document| c.full_save_required() || c.encryption_changed();
-        if signed && rewrites(&next) && !rewrites(&editor.cos) {
+        if signed && ((rewrites(&next) && !rewrites(&editor.cos)) || (next.is_modified() && next.revisions().is_empty())) {
             return Err(EditError::SignedRewrite(edit.label().to_string()));
         }
         // What this edit drew with `?` (a value or comment text its font can't draw, stored as
@@ -3458,6 +3762,12 @@ impl Session {
         doc.dirty = true;
         doc.generation += 1;
         doc.edit_notices = notices;
+        if !cx.xfa_removed.is_empty() {
+            let removed: Vec<String> = cx.xfa_removed.iter().map(|n| format!("{XFA_REMOVED_PREFIX}{n}")).collect();
+            doc.xfa_warnings.retain(|w| w.starts_with(XFA_REMOVED_PREFIX));
+            note_warnings(&mut doc.xfa_warnings, &removed);
+            note_warnings(&mut doc.info.warnings, &removed);
+        }
         note_warnings(&mut doc.xfa_warnings, &xfa_notes);
         let notes = doc.xfa_warnings.clone();
         note_warnings(&mut doc.info.warnings, &notes);
@@ -3483,7 +3793,7 @@ impl Session {
         editor.redo.push((label.clone(), current, current_keys, scope));
         Self::adopt_keys(doc);
         Self::refresh_scoped(doc, scope).inspect_err(|_| Self::show_released(doc))?;
-        doc.dirty = true;
+        Self::sync_dirty(doc);
         doc.generation += 1;
         Ok(label)
     }
@@ -3498,11 +3808,18 @@ impl Session {
         editor.undo.push((label.clone(), current, current_keys, scope));
         Self::adopt_keys(doc);
         Self::refresh_scoped(doc, scope).inspect_err(|_| Self::show_released(doc))?;
-        doc.dirty = true;
+        Self::sync_dirty(doc);
         doc.generation += 1;
         Ok(label)
     }
 
+    /// Unsaved when the working graph is not the last opened or saved file. Undo back to that
+    /// file is clean; undo past a later save is not, because the restored snapshot's own base
+    /// is an earlier revision.
+    fn sync_dirty(doc: &mut Document) {
+        doc.dirty = doc.editor.as_ref().is_some_and(|e| e.cos.is_modified() || !Arc::ptr_eq(e.cos.bytes(), &e.saved));
+    }
+
     /// Use the current state's password for viewing (protection edits change it).
     fn adopt_keys(doc: &mut Document) {
         if let Some(e) = doc.editor.as_ref() {
@@ -3522,6 +3839,9 @@ impl Session {
         if scope == Scope::Content {
             return Self::refresh_content(doc, None);
         }
+        if scope == Scope::Links {
+            return Self::refresh_links(doc);
+        }
         // Metadata edits keep the renderer, which holds the working file anyway.
         if scope != Scope::Metadata {
             Self::release_working(doc);
@@ -3559,7 +3879,11 @@ impl Session {
         let form = Arc::new(form);
         match scope {
             Scope::Metadata => return Ok(()),
-            Scope::Comments => doc.info.annotations = comment_list(&editor.cos),
+            Scope::Comments => {
+                doc.info.annotations = comment_list(&editor.cos);
+                // Link indexes are positions in /Annots, so comment insertion/deletion can move them.
+                doc.links = OnceLock::new();
+            }
             Scope::Form => {
                 // PERF: keystroke path, index once. A linear find per field is O(F^2);
                 // forms reach 10k fields.
@@ -3580,6 +3904,7 @@ impl Session {
                     }
                 }
             }
+            Scope::Links => return Self::refresh_links(doc),
             // Handled above; kept as a full refresh so the match stays total.
             Scope::Full => return Self::refresh(doc),
             // Handled above (content-only refresh); the arm keeps the match total.
@@ -3619,13 +3944,8 @@ impl Session {
     /// appearances are kept: content edits leave every annotation dictionary alone.
     fn refresh_content(doc: &mut Document, edit: Option<&Edit>) -> Result<(), EditError> {
         Self::release_working(doc);
+        sync_xfa_state(doc);
         let Some(editor) = doc.editor.as_mut() else { return Ok(()) };
-        // A script may have laid an XFA form out again (rows added, subforms shown).
-        if doc.xfa.is_some()
-            && let Some(report) = pdfcraft_xfa::existing_layout(&editor.cos)
-        {
-            doc.xfa = Some(report);
-        }
         let bytes = if editor.cos.is_modified() {
             Arc::new(write_incremental(&editor.cos, &SaveOptions::default()).map_err(|e| EditError::Write(e.to_string()))?)
         } else {
@@ -3634,11 +3954,8 @@ impl Session {
         // The edit must still leave a file the viewer can open; anything else rolls back above.
         pdfcraft_render::check_pages(bytes.clone(), doc.password.as_deref(), doc.info.pages.len()).map_err(|e| EditError::Reopen(e.to_string()))?;
         let (touches_added, touches_marks) = Self::content_refresh_lists(edit);
-        if touches_added {
-            doc.added = pdfcraft_edit::list_added(&editor.cos);
-        }
-        if touches_marks {
-            doc.marks = pdfcraft_edit::marks_present(&editor.cos);
+        if touches_added || touches_marks {
+            doc.marker_scan = OnceLock::new();
         }
         doc.info.file_size = bytes.len();
         if !doc.signatures.is_empty() {
@@ -3675,19 +3992,23 @@ impl Session {
 
     /// Rebuild working bytes, inspection and renderer from the current edit state.
     fn refresh(doc: &mut Document) -> Result<(), EditError> {
+        Self::refresh_with_indexes(doc, true, true)
+    }
+
+    /// Reinspect a link edit while preserving the page-content marker scan cache.
+    fn refresh_links(doc: &mut Document) -> Result<(), EditError> {
+        Self::refresh_with_indexes(doc, false, true)
+    }
+
+    fn refresh_with_indexes(doc: &mut Document, invalidate_markers: bool, invalidate_links: bool) -> Result<(), EditError> {
         // A full refresh may follow structural or annotation changes: cached appearances
         // may be stale, so they are rebuilt below.
         if let Some(editor) = doc.editor.as_mut() {
             editor.appearances.clear();
         }
         Self::release_working(doc);
+        sync_xfa_state(doc);
         let Some(editor) = doc.editor.as_mut() else { return Ok(()) };
-        // A script may have laid an XFA form out again (rows added, subforms shown).
-        if doc.xfa.is_some()
-            && let Some(report) = pdfcraft_xfa::existing_layout(&editor.cos)
-        {
-            doc.xfa = Some(report);
-        }
         let bytes = if editor.cos.is_modified() {
             Arc::new(write_incremental(&editor.cos, &SaveOptions::default()).map_err(|e| EditError::Write(e.to_string()))?)
         } else {
@@ -3707,10 +4028,12 @@ impl Session {
         let mut form = pdfcraft_forms::fields(&editor.cos);
         xfa::mark_script_buttons(&editor.cos, &mut form);
         doc.form = Arc::new(form);
-        let marker_scan = pdfcraft_edit::scan_markers(&editor.cos);
-        doc.marks = marker_scan.marks;
-        doc.added = marker_scan.added;
-        doc.links = pdfcraft_annot::links::list(&editor.cos);
+        if invalidate_markers {
+            doc.marker_scan = OnceLock::new();
+        }
+        if invalidate_links {
+            doc.links = OnceLock::new();
+        }
         doc.signatures = signatures_of(&editor.cos, &bytes, &doc.trust, &doc.sig_cache);
         doc.display = display_bytes(Some(editor), &bytes);
         doc.renderer = RenderPool::new(doc.display.clone(), render_threads(), doc.config.clone());
@@ -3723,11 +4046,27 @@ impl Session {
     pub fn save_bytes(&self, id: DocId) -> Result<Arc<Vec<u8>>, EditError> {
         let doc = self.get(id).ok_or(EditError::NoDocument)?;
         let Some(editor) = doc.editor.as_ref() else { return Ok(doc.bytes.clone()) };
-        if !editor.cos.is_modified() {
-            return Ok(editor.cos.bytes().clone());
+        let on_saved = Arc::ptr_eq(editor.cos.bytes(), &editor.saved);
+        if !editor.cos.is_modified() && on_saved {
+            return Ok(editor.saved.clone());
         }
         let opts = SaveOptions { mod_date: self.now().map(pdfcraft_cos::pdf_date), ..SaveOptions::default() };
-        guard(|| write_incremental(&editor.cos, &opts)).map_err(EditError::Write)?.map(Arc::new).map_err(|e| EditError::Write(e.to_string()))
+        // A restored snapshot can be based on an earlier revision. Append to the last saved
+        // file so that revision stays in the chain. A full rewrite (redaction, new encryption,
+        // a reconstructed file) still writes the current graph on its own.
+        let rewrite = editor.cos.full_save_required() || editor.cos.encryption_changed() || editor.cos.revisions().is_empty();
+        guard(|| {
+            if on_saved || rewrite {
+                write_incremental(&editor.cos, &opts)
+            } else {
+                let mut base = pdfcraft_cos::Document::open_with_password(editor.saved.clone(), editor.saved_keys.reopen.as_deref())?;
+                base.overlay_changes_from(&editor.cos)?;
+                write_incremental(&base, &opts)
+            }
+        })
+        .map_err(EditError::Write)?
+        .map(Arc::new)
+        .map_err(|e| EditError::Write(e.to_string()))
     }
 
     /// A compact, garbage-collected rewrite (Save As ▸ "Optimized" / Reduce File Size groundwork).
@@ -3758,8 +4097,11 @@ impl Session {
         if let Some(editor) = doc.editor.as_mut() {
             // An encrypted file needs the password it is protected with now (the owner
             // password when known, so saving never downgrades this session's rights).
-            editor.cos = pdfcraft_cos::Document::open_with_password(bytes.clone(), editor.keys.reopen.as_deref())
-                .map_err(|e| EditError::Reopen(e.to_string()))?;
+            let keys = editor.keys.clone();
+            editor.cos =
+                pdfcraft_cos::Document::open_with_password(bytes.clone(), keys.reopen.as_deref()).map_err(|e| EditError::Reopen(e.to_string()))?;
+            editor.saved = bytes;
+            editor.saved_keys = keys;
         }
         if let Some(p) = path {
             doc.name = std::path::Path::new(&p).file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_else(|| p.clone());
@@ -3808,10 +4150,10 @@ impl Session {
     pub fn revert(&mut self, id: DocId) -> Result<(), EditError> {
         let doc = self.doc_mut(id)?;
         let editor = doc.editor.as_mut().ok_or_else(|| EditError::ReadOnly(doc.read_only_reason.clone().unwrap_or_default()))?;
-        let base = editor.cos.bytes().clone();
-        // The saved file opens with the passwords of the state that was saved: try the current
-        // ones, then each earlier state's.
-        let mut candidates = vec![editor.keys.clone()];
+        let base = editor.saved.clone();
+        // The saved file opens with the passwords it was saved with. The current snapshot may
+        // be an older revision (undo past that save), so its own base is not the saved file.
+        let mut candidates = vec![editor.saved_keys.clone(), editor.keys.clone()];
         candidates.extend(editor.undo.iter().rev().map(|s| s.2.clone()));
         candidates.push(Keys::default());
         let (cos, keys) = candidates
@@ -3964,6 +4306,26 @@ impl Session {
         if !doc.allows_printing() {
             return Err(EditError::NotPermitted("printing"));
         }
+        // Print as image: the pages used become pictures first, then the picture document is
+        // imposed in their place (its page k is the k-th distinct source page used).
+        if let Some(raster) = &settings.raster {
+            let mut distinct: Vec<usize> = Vec::new();
+            for &p in &settings.pages {
+                if !distinct.contains(&p) {
+                    distinct.push(p);
+                }
+            }
+            let hide_comments = matches!(settings.content, print::Content::Document | print::Content::FormFieldsOnly);
+            let bytes = print_raster::rasterize(doc, &distinct, raster, hide_comments).map_err(EditError::Print)?;
+            let pictures = pdfcraft_cos::Document::open(Arc::new(bytes)).map_err(|e| EditError::Print(e.to_string()))?;
+            let remapped = print::Settings {
+                pages: settings.pages.iter().map(|p| distinct.iter().position(|d| d == p).unwrap_or(0)).collect(),
+                content: print::Content::Document,
+                raster: None,
+                ..settings.clone()
+            };
+            return pdfcraft_print::impose(&pictures, &remapped).map_err(|e| EditError::Print(e.to_string()));
+        }
         let cos = match doc.editor.as_ref() {
             Some(e) => e.cos.clone(),
             None => {
@@ -3973,6 +4335,20 @@ impl Session {
         pdfcraft_print::impose(&cos, settings).map_err(|e| EditError::Print(e.to_string()))
     }
 
+    /// For each page, whether its text mostly runs bottom-to-top ([`pdfcraft_print::text_reads_up`]);
+    /// only `pages` are read, the others are `false`.
+    pub fn print_text_up(&self, id: DocId, pages: &[usize]) -> Vec<bool> {
+        let Some(doc) = self.get(id) else { return Vec::new() };
+        let cos = match doc.editor.as_ref() {
+            Some(e) => e.cos.clone(),
+            None => match pdfcraft_cos::Document::open_with_password(doc.bytes.clone(), doc.password.as_deref()) {
+                Ok(c) => c,
+                Err(_) => return Vec::new(),
+            },
+        };
+        (0..doc.info.pages.len()).map(|i| pages.contains(&i) && pdfcraft_print::text_reads_up(&cos, i)).collect()
+    }
+
     /// Combine whole files, in order, into new PDF bytes (one bookmark per file).
     pub fn combine(&self, sources: &[(String, Arc<Vec<u8>>)]) -> Result<Arc<Vec<u8>>, EditError> {
         let docs = sources.iter().map(|(n, b)| open_source(n, b)).collect::<Result<Vec<_>, _>>()?;
@@ -4166,7 +4542,7 @@ impl Session {
         let mut cuts = Vec::new();
         let mut used = 0usize;
         for p in 0..n {
-            let size = self.write_new(&pdfcraft_organize::extract_pages(src, &[p])?)?.len();
+            let size = self.write_unchecked(&pdfcraft_organize::extract_pages(src, &[p])?)?.len();
             if used > 0 && used + size > max_bytes {
                 cuts.push(p);
                 used = 0;
@@ -4209,7 +4585,7 @@ impl Session {
                         ]
                     })
                     .filter(|r| {
-                        !doc.links.iter().any(|l| l.page == page && l.rect[0] < r[2] && r[0] < l.rect[2] && l.rect[1] < r[3] && r[1] < l.rect[3])
+                        !doc.links().iter().any(|l| l.page == page && l.rect[0] < r[2] && r[0] < l.rect[2] && l.rect[1] < r[3] && r[1] < l.rect[3])
                     })
                     .collect();
                 if !rects.is_empty() {
@@ -4226,7 +4602,17 @@ impl Session {
         let doc = self.get(id)?;
         if let Some(editor) = doc.editor.as_ref() {
             let page = pdfcraft_organize::bookmark_page(&editor.cos, offset, limit);
-            let rows = page.bookmarks.into_iter().map(|b| BookmarkRow { path: b.path, title: b.title, open: b.open, page: b.page }).collect();
+            let rows = page
+                .bookmarks
+                .into_iter()
+                .map(|b| {
+                    let view = b.view.map_or_else(Default::default, |(kind, numbers)| {
+                        let numbers: Vec<Option<f32>> = numbers.iter().map(|n| n.map(|n| n as f32)).collect();
+                        pdfcraft_render::DestView::from_operands(Some(&kind), &numbers)
+                    });
+                    BookmarkRow { path: b.path, title: b.title, open: b.open, page: b.page, view }
+                })
+                .collect();
             return Some(BookmarkPage { rows, next: page.next, truncated: false });
         }
         let all = outline_rows(&doc.info.outline);
@@ -4264,7 +4650,18 @@ impl Session {
         doc.editor.as_ref().map(|e| &e.cos).ok_or_else(|| EditError::ReadOnly(doc.read_only_reason.clone().unwrap_or_default()))
     }
 
+    /// A new file (Combine, Extract, Split, Create) as bytes, checked like a save before anyone
+    /// writes it (#1698, #2166): it reopens, and shows the pages it was built from.
     fn write_new(&self, doc: &pdfcraft_cos::Document) -> Result<Arc<Vec<u8>>, EditError> {
+        let bytes = self.write_unchecked(doc)?;
+        let expected = pdfcraft_organize::page_count(doc)?;
+        pdfcraft_cos::Document::open(bytes.clone()).map_err(|e| EditError::Reopen(e.to_string()))?;
+        pdfcraft_render::check_pages(bytes.clone(), None, expected).map_err(|e| EditError::Reopen(e.to_string()))?;
+        Ok(bytes)
+    }
+
+    /// [`Self::write_new`] without the check, for bytes nobody writes: measuring a part's size.
+    fn write_unchecked(&self, doc: &pdfcraft_cos::Document) -> Result<Arc<Vec<u8>>, EditError> {
         let opts = SaveOptions { mod_date: self.now().map(pdfcraft_cos::pdf_date), ..SaveOptions::default() };
         write_full(doc, &opts).map(Arc::new).map_err(|e| EditError::Write(e.to_string()))
     }
@@ -4383,7 +4780,7 @@ impl Session {
 
     /// The signing time as a PDF date in local time with its offset (`D:…+02'00'`).
     pub fn signing_date(&self) -> String {
-        let offset = if self.clock.is_some() { 0 } else { local_utc_offset() };
+        let offset = self.local_offset();
         let local = pdfcraft_cos::pdf_date(self.now().unwrap_or(0) + offset);
         let stamp = local.trim_end_matches('Z');
         if offset == 0 {
@@ -4420,7 +4817,10 @@ impl Session {
         if opts.date.is_empty() {
             opts.date = self.signing_date();
         }
-        Ok(Arc::new(pdfcraft_sign::sign_with_timestamp(&editor.cos, id, &opts, tsa)?))
+        let signed = Arc::new(pdfcraft_sign::sign_with_timestamp(&editor.cos, id, &opts, tsa)?);
+        // Checked like a save before anyone writes it (#2166).
+        self.check_save(doc, &signed)?;
+        Ok(signed)
     }
 
     /// Append a standalone document timestamp (RFC 3161, `/ETSI.RFC3161`) covering the file's
@@ -4429,7 +4829,9 @@ impl Session {
         let d = self.get(doc).ok_or(EditError::NoDocument)?;
         let editor = d.editor.as_ref().ok_or_else(|| EditError::ReadOnly(d.read_only_reason.clone().unwrap_or_default()))?;
         let date = if date.is_empty() { self.signing_date() } else { date };
-        Ok(Arc::new(pdfcraft_sign::timestamp_document(&editor.cos, tsa, &date)?))
+        let stamped = Arc::new(pdfcraft_sign::timestamp_document(&editor.cos, tsa, &date)?);
+        self.check_save(doc, &stamped)?;
+        Ok(stamped)
     }
 
     /// Embed revocation evidence into the catalog's `/DSS` with `/VRI` entries per signature
@@ -4437,7 +4839,9 @@ impl Session {
     pub fn embed_ltv(&self, doc: DocId, evidence: &pdfcraft_sign::dss::Evidence) -> Result<Arc<Vec<u8>>, EditError> {
         let d = self.get(doc).ok_or(EditError::NoDocument)?;
         let editor = d.editor.as_ref().ok_or_else(|| EditError::ReadOnly(d.read_only_reason.clone().unwrap_or_default()))?;
-        Ok(Arc::new(pdfcraft_sign::dss::embed(&editor.cos, evidence)?))
+        let embedded = Arc::new(pdfcraft_sign::dss::embed(&editor.cos, evidence)?);
+        self.check_save(doc, &embedded)?;
+        Ok(embedded)
     }
 
     /// Record that the signed file `bytes` was saved (to `path`): like [`Session::mark_saved`],
diff --git a/crates/engine/src/ocr.rs b/crates/engine/src/ocr.rs
index 6bf6dc9c7..dcd4142d7 100644
--- a/crates/engine/src/ocr.rs
+++ b/crates/engine/src/ocr.rs
@@ -30,6 +30,10 @@ pub struct OcrSettings {
 /// text read again, not a word in a picture.
 const ALREADY_ON_PAGE: f32 = 0.5;
 
+/// The long side of an A4 sheet in points (a letter page's, 792, is shorter): "Downsample to"
+/// is a resolution on paper this size or smaller.
+const SHEET: f32 = 842.0;
+
 /// How much of `word` the `text` boxes cover, from 0 to 1. Boxes are `[x0, y0, x1, y1]` in page
 /// view space. Overlaps between the text boxes are counted twice (glyphs rarely overlap), so the
 /// sum is capped at the whole word.
@@ -121,11 +125,7 @@ impl OcrJob {
                 out.push(skip("the page already contains text"));
                 continue;
             }
-            // A scan is read at its own resolution (enlarging it only blurs the letters), at most
-            // the chosen one.
-            let wanted = self.settings.dpi.clamp(72.0, 600.0) / 72.0;
-            let scale = self.native.get(page).copied().flatten().map_or(wanted, |n| n.clamp(1.0, wanted));
-            let shot = r.render(RenderRequest { page, scale, ..Default::default() });
+            let shot = r.render(RenderRequest { page, scale: self.scale(page, info), ..Default::default() });
             if let Some(e) = shot.error {
                 out.push(skip(&e));
                 continue;
@@ -151,6 +151,18 @@ impl OcrJob {
         progress(total, total);
         out
     }
+
+    /// The render scale (pixels per point) `page` is read at. A scan is read at its own
+    /// resolution (enlarging it only blurs the letters), at most the chosen one.
+    fn scale(&self, page: usize, info: &PageInfo) -> f32 {
+        let wanted = self.settings.dpi.clamp(72.0, 600.0) / 72.0;
+        let Some(native) = self.native.get(page).copied().flatten() else { return wanted };
+        // A scan whose page is larger than a sheet (often a box given in pixels, one point per
+        // pixel, #1848) is measured as if shrunk to one: otherwise 1 px/pt is already its full
+        // image, and no "Downsample to" choice could ask for less.
+        let fit = (SHEET / info.width.max(info.height).max(1e-3)).min(1.0);
+        native.clamp(fit, wanted * fit)
+    }
 }
 
 impl Session {
@@ -236,12 +248,16 @@ pub fn recognize_file(
     if s.apply_ocr(id, &pages).map_err(|e| e.to_string())? == 0 {
         return Ok(FileResult { bytes, pages });
     }
-    Ok(FileResult { bytes: s.save_bytes(id).map_err(|e| e.to_string())?, pages })
+    // Checked like a save before the caller writes it (#2166).
+    let bytes = s.save_bytes(id).map_err(|e| e.to_string())?;
+    s.check_save(id, &bytes).map_err(|e| e.to_string())?;
+    Ok(FileResult { bytes, pages })
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::export;
 
     /// #1028: a recognised word over the page's own text is that text again; one in an empty
     /// part of the page (a picture) is new.
@@ -260,6 +276,28 @@ mod tests {
         assert_eq!(covered([100.5, 52.0, 134.0, 61.0], &[]), 0.0);
     }
 
+    /// #1848: an A4 scan at 300 dpi whose page box is its pixel size (2480 x 3508 pt, one pixel
+    /// per point) gets a smaller bitmap for each lower "Downsample to" choice, and a low-resolution
+    /// letter page is still never shrunk below one pixel per point.
+    #[test]
+    fn downsample_shrinks_a_page_box_given_in_pixels() {
+        let mut s = Session::new();
+        let page = |w: u32, h: u32| export::encode_png(w, h, &vec![255; (w * h * 4) as usize]).unwrap();
+        let bytes = s.create_from_images(&[("a4.png".into(), page(2480, 3508)), ("letter.png".into(), page(612, 792))]).unwrap();
+        let id = s.open("scan.pdf", None, bytes, None).unwrap();
+        let mut r = PageRenderer::new(s.get(id).unwrap().bytes.clone(), RenderConfig::default());
+        for (dpi, a4) in [(72.0, [595, 842]), (150.0, [1240, 1754]), (300.0, [2480, 3508]), (600.0, [2480, 3508])] {
+            let job = s.ocr_job(id, &[], OcrSettings { dpi, ..Default::default() }).unwrap();
+            for (page, want) in [(0, a4), (1, [612, 792])] {
+                let scale = job.scale(page, &job.infos[page]);
+                let shot = r.render(RenderRequest { page, scale, ..Default::default() });
+                assert!(shot.error.is_none(), "{:?}", shot.error);
+                let near = |got: u32, want: u32| got.abs_diff(want) <= 1;
+                assert!(near(shot.width, want[0]) && near(shot.height, want[1]), "{dpi} dpi, page {page}: {}x{}", shot.width, shot.height);
+            }
+        }
+    }
+
     #[test]
     fn coverage_of_overlapping_or_broken_boxes_stays_between_zero_and_one() {
         // A glyph drawn twice (fake bold) does not cover more than the whole word.
diff --git a/crates/engine/src/optimizer.rs b/crates/engine/src/optimizer.rs
index 569dd81b0..ee8c957f9 100644
--- a/crates/engine/src/optimizer.rs
+++ b/crates/engine/src/optimizer.rs
@@ -17,6 +17,8 @@ pub enum OptimizeStage {
     /// Removing the user data chosen under Discard User Data.
     #[default]
     Discarding,
+    /// Merging the fragments of a page picture into one image.
+    Fragments,
     /// About to process image `done` (0-based) of `total`.
     Images { done: usize, total: usize },
     /// Discarding objects and compressing unencoded streams.
@@ -33,6 +35,7 @@ impl OptimizeStage {
     pub fn fraction(self) -> f32 {
         match self {
             OptimizeStage::Discarding => 0.0,
+            OptimizeStage::Fragments => 0.03,
             OptimizeStage::Images { done, total } => 0.05 + 0.75 * if total == 0 { 1.0 } else { done.min(total) as f32 / total as f32 },
             OptimizeStage::CleaningUp => 0.8,
             OptimizeStage::Merging => 0.85,
@@ -85,6 +88,7 @@ impl OptimizeJob {
         let discarded = if discard.is_empty() { Vec::new() } else { pdfcraft_redact::sanitize::remove_hidden(&mut cos, &discard)? };
         let report = optimize::optimize_with_progress(&mut cos, &settings, &mut |s| {
             step(match s {
+                optimize::Stage::Fragments => OptimizeStage::Fragments,
                 optimize::Stage::Images { done, total } => OptimizeStage::Images { done, total },
                 optimize::Stage::CleanUp => OptimizeStage::CleaningUp,
             })
diff --git a/crates/engine/src/print_raster.rs b/crates/engine/src/print_raster.rs
new file mode 100644
index 000000000..117c8e14c
--- /dev/null
+++ b/crates/engine/src/print_raster.rs
@@ -0,0 +1,61 @@
+//! Print as image (Acrobat's Advanced Print Setup ▸ Print As Image): every page
+//! sent to the printer as a picture at a chosen resolution, for printers that skip text,
+//! shading or transparency. The pages are rendered the way the viewer shows them (reading
+//! colours off, the print's own colours), made into an image-only document, and that document
+//! is imposed on the paper like any other. The print is no longer searchable text.
+
+use pdfcraft_create::ImageResolution;
+use pdfcraft_print::Raster;
+use pdfcraft_render::{PRINT_TAG, PageRenderer, RenderRequest};
+
+use crate::Document;
+use crate::export::encode_png;
+
+/// `doc`'s pages `pages` (0-based, each once, in the order given) as an image-only PDF, one
+/// page per entry, the size of the source page as displayed. Pages too large for the renderer
+/// at `raster.dpi` render at the largest resolution it allows.
+pub fn rasterize(doc: &Document, pages: &[usize], raster: &Raster, hide_comments: bool) -> Result<Vec<u8>, String> {
+    let dpi = raster.dpi.clamp(72.0, 600.0);
+    let src = doc.export_source();
+    let mut config = src.config.clone();
+    config.hide_comments = hide_comments;
+    let mut renderer = PageRenderer::new(src.bytes, config);
+    let mut images: Vec<(String, Vec<u8>)> = Vec::with_capacity(pages.len());
+    let mut used: Option<f64> = None;
+    for &page in pages {
+        let (w, h) = src.sizes.get(page).copied().ok_or_else(|| format!("page {} does not exist", page + 1))?;
+        let scale = pdfcraft_render::effective_scale(w, h, (dpi / 72.0) as f32);
+        let page_dpi = f64::from(scale) * 72.0;
+        // Every page of the image document shares one resolution, so its pages keep the
+        // source's sizes; the lowest a page needed is used for all.
+        used = Some(used.map_or(page_dpi, |u: f64| u.min(page_dpi)));
+        let r = renderer.render(RenderRequest { page, scale, tag: PRINT_TAG, ..Default::default() });
+        if let Some(e) = r.error {
+            return Err(format!("page {}: {e}", page + 1));
+        }
+        let mut rgba = r.rgba.to_vec();
+        over_white(&mut rgba, raster.grayscale);
+        images.push((format!("page-{}.png", page + 1), encode_png(r.width, r.height, &rgba)?));
+    }
+    let dpi = used.unwrap_or(dpi);
+    let doc = pdfcraft_create::from_images_with_resolution(&images, ImageResolution::Dpi(dpi)).map_err(|e| e.to_string())?;
+    pdfcraft_cos::write_full(&doc, &pdfcraft_cos::SaveOptions::default()).map_err(|e| e.to_string())
+}
+
+/// Premultiplied RGBA composed over white paper (opaque), in grey when asked (Rec. 601 luma).
+fn over_white(rgba: &mut [u8], grayscale: bool) {
+    for px in rgba.as_chunks_mut::<4>().0 {
+        let gap = 255 - u32::from(px[3]);
+        let (r, g, b) = ((u32::from(px[0]) + gap).min(255), (u32::from(px[1]) + gap).min(255), (u32::from(px[2]) + gap).min(255));
+        let (r, g, b) = if grayscale {
+            let y = ((299 * r + 587 * g + 114 * b) / 1000).min(255);
+            (y, y, y)
+        } else {
+            (r, g, b)
+        };
+        px[0] = r as u8;
+        px[1] = g as u8;
+        px[2] = b as u8;
+        px[3] = 255;
+    }
+}
diff --git a/crates/engine/src/scan_fields.rs b/crates/engine/src/scan_fields.rs
new file mode 100644
index 000000000..8287743fc
--- /dev/null
+++ b/crates/engine/src/scan_fields.rs
@@ -0,0 +1,144 @@
+//! Prepare a form ▸ field detection on scanned pages. A page that is a picture has no text and
+//! no drawn shapes to read, so it is rendered and its lines and boxes are read from the pixels
+//! ([`pdfcraft_forms::detect::raster`]). The labels come from the page's text layer (an earlier
+//! Recognize text), else from text recognition when its models are installed. Without either,
+//! the fields are still found and get the default names (Text1, Check Box1, …).
+//!
+//! Detection works in the page as displayed (after `/Rotate`), in points with y up, so a scan
+//! stored sideways and turned upright by `/Rotate` reads like any other page. The fields are
+//! mapped back to user space and turned with the page (`/MK /R`), so typed text reads upright.
+
+use pdfcraft_forms::detect::{Candidate, Word, detect, raster};
+use pdfcraft_render::{PageInfo, PageRenderer, PageText, RenderRequest};
+
+use crate::{DocId, Document, Session, ocr};
+
+/// Pixels per point the page is rendered at for its lines (144 dpi).
+const SCALE: f32 = 2.0;
+/// The longest side of that rendering, in pixels.
+const MAX_SIDE: f32 = 3000.0;
+/// A page is a scan when its images cover at least this share of it.
+const COVERED: f64 = 0.5;
+/// Recognised "words" less tall than this (points) are specks read as letters, and would make
+/// the box they sit on look filled in.
+const MIN_WORD_HEIGHT: f64 = 4.0;
+
+/// Whether `page` is a picture of a page: images cover most of it.
+pub(crate) fn is_scan(doc: &Document, page: usize, info: &PageInfo) -> bool {
+    let [cx0, cy0, cx1, cy1] = info.crop.map(f64::from);
+    let page_area = (cx1 - cx0) * (cy1 - cy0);
+    if !page_area.is_finite() || page_area <= 0.0 {
+        return false;
+    }
+    let covered: f64 = doc
+        .page_images(page)
+        .iter()
+        .filter(|i| !i.is_form && i.width > 1 && i.height > 1)
+        .map(|i| {
+            let r = i.visible_rect.unwrap_or(i.rect);
+            let w = (r[2].min(cx1) - r[0].max(cx0)).max(0.0);
+            let h = (r[3].min(cy1) - r[1].max(cy0)).max(0.0);
+            w * h
+        })
+        .filter(|a| a.is_finite())
+        .sum();
+    covered >= COVERED * page_area
+}
+
+/// The page as displayed, in points with y up: where detection on a scan works.
+struct Frame<'a>(&'a PageInfo);
+
+impl Frame<'_> {
+    /// The box around view-space points (y down).
+    fn view_box(&self, points: impl IntoIterator<Item = [f32; 2]>) -> Option<[f64; 4]> {
+        let h = f64::from(self.0.height);
+        let mut out = [f64::INFINITY, f64::INFINITY, f64::NEG_INFINITY, f64::NEG_INFINITY];
+        for [x, y] in points {
+            let (x, y) = (f64::from(x), h - f64::from(y));
+            out = [out[0].min(x), out[1].min(y), out[2].max(x), out[3].max(y)];
+        }
+        out.iter().all(|v| v.is_finite()).then_some(out)
+    }
+
+    /// A user-space rectangle (or the box around user-space points) in the frame.
+    fn user_box(&self, points: impl IntoIterator<Item = [f64; 2]>) -> Option<[f64; 4]> {
+        self.view_box(points.into_iter().map(|[x, y]| self.0.user_to_view(x as f32, y as f32)))
+    }
+
+    /// A frame rectangle in user space.
+    fn user_rect(&self, r: [f64; 4]) -> [f64; 4] {
+        let h = f64::from(self.0.height);
+        let a = self.0.view_to_user(r[0] as f32, (h - r[1]) as f32);
+        let b = self.0.view_to_user(r[2] as f32, (h - r[3]) as f32);
+        [f64::from(a[0].min(b[0])), f64::from(a[1].min(b[1])), f64::from(a[0].max(b[0])), f64::from(a[1].max(b[1]))]
+    }
+}
+
+fn corners(r: [f64; 4]) -> [[f64; 2]; 4] {
+    [[r[0], r[1]], [r[2], r[1]], [r[2], r[3]], [r[0], r[3]]]
+}
+
+impl Session {
+    /// The fields on scanned `page` of `id`, in user space, and how far the page turns them
+    /// (its `/Rotate`). `text` is the page's text layer, `existing` its widget rectangles.
+    pub(crate) fn detect_on_scan(
+        &self,
+        id: DocId,
+        r: &mut PageRenderer,
+        page: usize,
+        text: Option<&PageText>,
+        existing: &[[f64; 4]],
+        taken: &[String],
+    ) -> (Vec<Candidate>, i64) {
+        let Some(info) = self.get(id).and_then(|d| d.info.pages.get(page)) else { return (Vec::new(), 0) };
+        let frame = Frame(info);
+        let scale = SCALE.min(MAX_SIDE / info.width.max(info.height).max(1.0));
+        let shot = r.render(RenderRequest { page, scale, ..Default::default() });
+        if shot.error.is_some() || shot.width == 0 {
+            return (Vec::new(), 0);
+        }
+        let px_per_pt = f64::from(shot.width) / f64::from(info.width.max(1e-3));
+        let shapes = raster::shapes(&shot.rgba, shot.width, shot.height, px_per_pt);
+        if shapes.boxes.is_empty() && shapes.rules.is_empty() {
+            return (Vec::new(), 0);
+        }
+        let mut words: Vec<Word> = text
+            .map(|t| crate::js::words_with(t, |x, y| [x, y]))
+            .unwrap_or_default()
+            .into_iter()
+            .filter_map(|(text, v)| Some(Word { text, rect: frame.view_box([[v[0], v[1]], [v[2], v[3]]])? }))
+            .collect();
+        if words.is_empty() {
+            words = self.recognized_words(id, page, &frame);
+        }
+        let existing: Vec<[f64; 4]> = existing.iter().filter_map(|r| frame.user_box(corners(*r))).collect();
+        let found = detect(&words, &shapes, &existing, taken);
+        let turn = i64::from(info.rotation % 360);
+        (found.into_iter().map(|c| Candidate { rect: frame.user_rect(c.rect), ..c }).collect(), turn)
+    }
+
+    /// The words text recognition reads on `page`, in the frame; none without the models.
+    fn recognized_words(&self, id: DocId, page: usize, frame: &Frame) -> Vec<Word> {
+        if !ocr::available() {
+            return Vec::new();
+        }
+        let (Ok(engine), Some(job)) = (ocr::engine(), self.ocr_job(id, &[page], ocr::OcrSettings::default())) else {
+            return Vec::new();
+        };
+        job.run(&engine, |_, _| true)
+            .into_iter()
+            .flat_map(|p| p.words)
+            .filter_map(|w| {
+                let o = w.origin;
+                let points = [
+                    o,
+                    [o[0] + w.across[0], o[1] + w.across[1]],
+                    [o[0] + w.up[0], o[1] + w.up[1]],
+                    [o[0] + w.across[0] + w.up[0], o[1] + w.across[1] + w.up[1]],
+                ];
+                Some(Word { rect: frame.user_box(points)?, text: w.text })
+            })
+            .filter(|w| w.rect[3] - w.rect[1] >= MIN_WORD_HEIGHT)
+            .collect()
+    }
+}
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index 37cafd440..ed90eea41 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -196,6 +196,59 @@ fn rubber_stamps_point_left_as_displayed_on_rotated_pages() {
     }
 }
 
+/// Fill & Sign text and text boxes read across as displayed on turned pages (scanned forms are
+/// often stored sideways with `/Rotate`), including after save.
+#[test]
+fn typed_text_reads_across_as_displayed_on_rotated_pages() {
+    for degrees in [0, 90, 180, 270] {
+        let (mut session, id) = rotated_blank(degrees);
+        let info = session.get(id).unwrap().info.pages[0].clone();
+        // Displayed top-left of the text at (40, 60): a wide first line, then one letter below
+        // its start.
+        let at = info.view_to_user(40.0, 60.0);
+        let at = [f64::from(at[0]), f64::from(at[1])];
+        let rect = text_box_at(degrees, at, 120.0, 2.0 * 12.0 * 1.2 + 6.0).unwrap();
+        let shape = Shape::Typewriter { rect, font_size: 12.0 };
+        let style = Style::default_for(&shape);
+        session
+            .apply(
+                id,
+                Edit::AddAnnotation(NewAnnotation {
+                    page: 0,
+                    style,
+                    shape,
+                    contents: "MMMMMMMM
+I"
+                    .into(),
+                    author: "Test".into(),
+                }),
+            )
+            .unwrap();
+        let check = |session: &Session, id: DocId| {
+            let rendered = render_page(session, id);
+            let dark = |x: u32, y: u32| stamp_pixel(&rendered, x, y)[..3].iter().all(|c| *c < 128);
+            let ink: Vec<(u32, u32)> =
+                (0..rendered.height).flat_map(|y| (0..rendered.width).map(move |x| (x, y))).filter(|&(x, y)| dark(x, y)).collect();
+            assert!(!ink.is_empty(), "rotation {degrees}: no text drawn");
+            let (x0, x1) = (ink.iter().map(|p| p.0).min().unwrap(), ink.iter().map(|p| p.0).max().unwrap());
+            let (y0, y1) = (ink.iter().map(|p| p.1).min().unwrap(), ink.iter().map(|p| p.1).max().unwrap());
+            // Rendered at scale 2: the text starts at the clicked point and runs to the right.
+            assert!((x1 - x0) > 2 * (y1 - y0), "rotation {degrees}: ink {x0}..{x1} x {y0}..{y1} should be wide, not tall");
+            assert!(x0.abs_diff(80) < 16 && y0.abs_diff(120) < 16, "rotation {degrees}: text starts at ({x0}, {y0}), not near (80, 120)");
+            // The lone "I" is on the second line under the start of the first, not upside down
+            // (above the end).
+            let mid = (y0 + y1) / 2;
+            let lower: Vec<u32> = ink.iter().filter(|p| p.1 > mid + 2).map(|p| p.0).collect();
+            assert!(!lower.is_empty() && lower.iter().all(|x| *x < x0 + (x1 - x0) / 4), "rotation {degrees}: second line is not under the start");
+        };
+        check(&session, id);
+        let saved = session.save_bytes(id).unwrap();
+        let mut reopened = Session::new().with_clock(|| 1_700_000_000);
+        let again = reopened.open("drawing.pdf", None, saved, None).unwrap();
+        check(&reopened, again);
+    }
+}
+
 /// A one-page PDF whose left half is red and whose right half is white, as displayed.
 fn half_red_page() -> Vec<u8> {
     let content = "1 0 0 rg 0 0 40 40 re f";
@@ -472,12 +525,85 @@ fn undo_still_works_after_save() {
     s.apply(id, Edit::DeletePages { pages: vec![0] }).unwrap();
     let saved = s.save_bytes(id).unwrap();
     s.mark_saved(id, saved, None).unwrap();
+    s.apply(id, Edit::RotatePages { pages: vec![0], degrees: 90 }).unwrap();
+    s.undo(id).unwrap();
+    let doc = s.get(id).unwrap();
+    assert!(!doc.dirty, "undo back to the saved file is clean");
+    assert_eq!(doc.info.pages.len(), 1);
+    assert_eq!(doc.info.pages[0].rotation, 0);
     s.undo(id).unwrap();
     let doc = s.get(id).unwrap();
     assert!(doc.dirty, "undoing past a save makes the document dirty again");
     assert_eq!(doc.info.pages.len(), 2);
 }
 
+#[test]
+fn undo_to_the_opened_file_is_not_dirty() {
+    let mut session = Session::new().with_clock(|| 1_700_000_000);
+    let opened = Arc::new(fixture(2));
+    let id = session.open("existing.pdf", None, opened.clone(), None).unwrap();
+    assert!(!session.get(id).unwrap().dirty);
+    assert!(session.autosave_snapshots().is_empty());
+
+    session.apply(id, Edit::DeletePages { pages: vec![0] }).unwrap();
+    assert_eq!(session.get(id).unwrap().info.pages.len(), 1);
+    session.undo(id).unwrap();
+    let document = session.get(id).unwrap();
+    assert!(!document.dirty, "the opened bytes are the saved version");
+    assert_eq!(document.bytes, opened);
+    assert_eq!(document.info.pages.len(), 2);
+    assert!(session.autosave_snapshots().is_empty(), "nothing unsaved to recover");
+
+    session.redo(id).unwrap();
+    assert!(session.get(id).unwrap().dirty);
+    session.undo(id).unwrap();
+    assert!(!session.get(id).unwrap().dirty);
+}
+
+#[test]
+fn save_after_undo_retains_the_latest_saved_revision() {
+    let (mut session, document) = session_with(3);
+    session.apply(document, Edit::DeletePages { pages: vec![1] }).unwrap();
+    let deleted = session.save_bytes(document).unwrap();
+    session.mark_saved(document, deleted, None).unwrap();
+    session.apply(document, Edit::RotatePages { pages: vec![0], degrees: 90 }).unwrap();
+    let rotated = session.save_bytes(document).unwrap();
+    session.mark_saved(document, rotated.clone(), None).unwrap();
+    let rotated_revisions = pdfcraft_cos::Document::open(rotated.clone()).unwrap().revisions().len();
+
+    session.undo(document).unwrap();
+    session.apply(document, Edit::SetInfo { key: "Title".into(), value: "Report".into() }).unwrap();
+    let saved = session.save_bytes(document).unwrap();
+    assert!(saved.starts_with(rotated.as_slice()), "the saved rotation stays in the file");
+    let reopened = pdfcraft_cos::Document::open(saved.clone()).unwrap();
+    assert!(reopened.revisions().len() > rotated_revisions, "the title is a newer revision, not a rewrite of the earlier one");
+    assert_eq!(pdfcraft_organize::info(&reopened, "Title").as_deref(), Some("Report"));
+
+    session.mark_saved(document, saved, None).unwrap();
+    let doc = session.get(document).unwrap();
+    assert_eq!(page_texts(&session, document), ["Page 1", "Page 3"]);
+    assert_eq!(doc.info.pages[0].rotation, 0, "the undone rotation is the current page");
+    assert_eq!(doc.info_value("Title").as_deref(), Some("Report"));
+}
+
+#[test]
+fn revert_preserves_the_saved_pages_after_undo() {
+    let (mut s, id) = session_with(2);
+    s.apply(id, Edit::DeletePages { pages: vec![0] }).unwrap();
+    s.apply(id, Edit::RotatePages { pages: vec![0], degrees: 90 }).unwrap();
+    let saved_bytes = s.save_bytes(id).unwrap();
+    s.mark_saved(id, saved_bytes, None).unwrap();
+    s.undo(id).unwrap();
+    assert!(s.get(id).unwrap().dirty);
+    assert_eq!(s.get(id).unwrap().info.pages[0].rotation, 0);
+
+    s.revert(id).unwrap();
+    let d = s.get(id).unwrap();
+    assert!(!d.dirty && d.can_undo().is_none() && d.can_redo().is_none());
+    assert_eq!(page_texts(&s, id), ["Page 2"], "the last saved pages, not the file as opened");
+    assert_eq!(d.info.pages[0].rotation, 90);
+}
+
 #[test]
 fn full_save_is_readable_and_smaller_after_deletes() {
     let (mut s, id) = session_with(5);
@@ -1113,8 +1239,14 @@ fn autosave_snapshots_only_changed_documents() {
     assert_eq!(snaps.len(), 1);
     assert_eq!(snaps[0].bytes, s.get(id).unwrap().bytes, "the working file");
     assert!(s.autosave_snapshots().is_empty(), "nothing new since the last snapshot");
+    s.apply(id, Edit::DeletePages { pages: vec![1] }).unwrap();
+    assert_eq!(s.autosave_snapshots().len(), 1);
     s.undo(id).unwrap();
-    assert_eq!(s.autosave_snapshots().len(), 1, "undo is a change too");
+    assert!(s.get(id).unwrap().dirty, "the rotation is still unsaved");
+    assert_eq!(s.autosave_snapshots().len(), 1, "undo that leaves unsaved work is a change");
+    s.undo(id).unwrap();
+    assert!(!s.get(id).unwrap().dirty, "undo back to the opened file is saved");
+    assert!(s.autosave_snapshots().is_empty(), "a clean document needs no recovery");
     let saved = s.save_bytes(id).unwrap();
     s.mark_saved(id, saved, None).unwrap();
     assert!(s.autosave_snapshots().is_empty(), "saved documents need no recovery");
@@ -1679,6 +1811,34 @@ fn form_refresh_keeps_first_value_when_field_names_repeat() {
     assert_eq!(dup.as_deref(), Some("first"));
 }
 
+#[test]
+fn multiselect_choice_indices_stay_sorted_through_engine_save_and_reopen() {
+    let (mut s, id) = session_with(1);
+    s.apply(
+        id,
+        Edit::AddField {
+            page: 0,
+            rect: [20.0, 180.0, 180.0, 240.0],
+            kind: NewField::List { options: vec!["Cheese".into(), "Ham".into(), "Olives".into()], multi: true },
+            name: Some("toppings".into()),
+        },
+    )
+    .unwrap();
+    let chosen = vec!["Olives".to_string(), "Ham".to_string()];
+    s.apply(id, Edit::SetFieldValue { name: "toppings".into(), value: FieldValue::Choice(chosen.clone()) }).unwrap();
+    assert_eq!(s.get(id).unwrap().form[0].value, chosen, "the live engine keeps selection order");
+    let saved = s.save_bytes(id).unwrap();
+    let cos = pdfcraft_cos::Document::open(saved.clone()).unwrap();
+    let all = pdfcraft_forms::fields(&cos);
+    let list = all.iter().find(|field| field.name == "toppings").unwrap();
+    let object = cos.get(list.obj);
+    let indices = object.as_dict().unwrap().get(b"I").unwrap().as_array().unwrap();
+    assert_eq!(indices.iter().map(|index| index.as_int().unwrap()).collect::<Vec<_>>(), [1, 2]);
+    assert_eq!(list.value, chosen, "sorted /I does not reorder /V");
+    let reopened = s.open("reopened.pdf", None, saved, None).unwrap();
+    assert_eq!(s.get(reopened).unwrap().form[0].value, chosen, "reopening keeps selection order");
+}
+
 #[test]
 fn preparing_a_form_adds_renames_and_deletes_fields() {
     let (mut s, id) = session_with(1);
@@ -1802,6 +1962,31 @@ fn redaction_marks_apply_for_good_and_undo() {
     assert!(matches!(s.apply(id, Edit::ApplyRedactions { pages: None }), Err(EditError::Redact(_))));
 }
 
+#[test]
+fn oversized_redaction_overlay_preserves_the_document_and_undo() {
+    let (mut s, id) = session_with(1);
+    let shape = Shape::Redact {
+        quads: vec![pdfcraft_annot::rect_quad([0.0, 0.0, 16000.0, 1600.0])],
+        overlay: "X".into(),
+        look: pdfcraft_annot::OverlayLook { size: 2.0, repeat: true, ..Default::default() },
+    };
+    s.apply(
+        id,
+        Edit::AddAnnotation(NewAnnotation { page: 0, style: Style::default_for(&shape), shape, contents: String::new(), author: "Tester".into() }),
+    )
+    .unwrap();
+    let before = s.get(id).unwrap().bytes.clone();
+    assert!(matches!(s.apply(id, Edit::ApplyRedactions { pages: None }), Err(EditError::Redact(pdfcraft_redact::RedactError::OverlayLimit))));
+    let doc = s.get(id).unwrap();
+    assert_eq!(doc.bytes, before);
+    assert_eq!(doc.redaction_marks(), 1);
+    assert_eq!(doc.can_undo(), Some("Add redaction mark"));
+    assert_eq!(page_texts(&s, id), ["Page 1"]);
+    s.undo(id).unwrap();
+    assert_eq!(s.get(id).unwrap().redaction_marks(), 0);
+    assert_eq!(page_texts(&s, id), ["Page 1"]);
+}
+
 #[test]
 fn printing_lays_out_sheets_that_render() {
     let (s, id) = session_with(5);
@@ -1827,6 +2012,42 @@ fn printing_lays_out_sheets_that_render() {
     assert_eq!(s4.print_pdf(id4, &print::Settings { pages: vec![0], ..Default::default() }), Err(EditError::NotPermitted("printing")));
 }
 
+/// A one-page document whose red square is in a layer; `off` switches the layer off by default.
+fn red_layer_pdf(off: bool) -> Vec<u8> {
+    let content = "/OC /L1 BDC 1 0 0 rg 0 0 100 100 re f EMC";
+    let off = if off { "/OFF [5 0 R] " } else { "" };
+    format!(
+        "%PDF-1.7\n\
+         1 0 obj << /Type /Catalog /Pages 2 0 R /OCProperties << /OCGs [5 0 R] /D << {off}/Order [5 0 R] >> >> >> endobj\n\
+         2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+         3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Contents 4 0 R /Resources << /Properties << /L1 5 0 R >> >> >> endobj\n\
+         4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+         5 0 obj << /Type /OCG /Name (Red) >> endobj\n\
+         trailer << /Root 1 0 R >>\n%%EOF",
+        content.len()
+    )
+    .into_bytes()
+}
+
+/// Does the first page of `pdf` show any red when drawn?
+fn first_page_has_red(pdf: Vec<u8>) -> bool {
+    let mut renderer = pdfcraft_render::PageRenderer::new(Arc::new(pdf), pdfcraft_render::RenderConfig::default());
+    let page = renderer.render(pdfcraft_render::RenderRequest { page: 0, scale: 0.5, ..Default::default() });
+    page.rgba.as_chunks::<4>().0.iter().any(|p| p[0] > 200 && p[1] < 60 && p[2] < 60)
+}
+
+#[test]
+fn a_layer_that_is_off_does_not_print_and_one_that_is_on_does() {
+    for (off, prints) in [(true, false), (false, true)] {
+        let source = red_layer_pdf(off);
+        assert_eq!(first_page_has_red(source.clone()), prints, "on screen (off: {off})");
+        let mut s = Session::new();
+        let id = s.open("layers.pdf", None, Arc::new(source), None).unwrap();
+        let sheet = s.print_pdf(id, &print::Settings { pages: vec![0], ..Default::default() }).unwrap();
+        assert_eq!(first_page_has_red(sheet), prints, "printed (layer off by default: {off})");
+    }
+}
+
 #[test]
 fn crop_and_duplicate_pages_show_in_the_viewer() {
     let (mut s, id) = session_with(2);
@@ -1849,7 +2070,7 @@ fn headers_footers_watermarks_and_backgrounds_show_update_and_remove() {
     s.apply(id, Edit::AddHeaderFooter { pages: vec![0, 1], settings: hf.clone(), replace: false }).unwrap();
     // The session clock is 2023-11-14.
     assert_eq!(page_texts(&s, id)[1], "Page 2\nPage 2 of 2 · 2023-11-14");
-    assert_eq!(s.get(id).unwrap().marks, [MarkKind::HeaderFooter]);
+    assert_eq!(s.get(id).unwrap().marks(), [MarkKind::HeaderFooter]);
     hf.text[4] = "Draft".into();
     s.apply(id, Edit::AddHeaderFooter { pages: vec![0, 1], settings: hf, replace: true }).unwrap();
     assert_eq!(page_texts(&s, id)[0], "Page 1\nDraft");
@@ -1868,19 +2089,19 @@ fn headers_footers_watermarks_and_backgrounds_show_update_and_remove() {
         },
     )
     .unwrap();
-    assert_eq!(s.get(id).unwrap().marks.len(), 3);
+    assert_eq!(s.get(id).unwrap().marks().len(), 3);
     assert!(page_texts(&s, id)[0].contains("SECRET"));
     s.apply(id, Edit::RemoveMarks { kind: MarkKind::HeaderFooter }).unwrap();
     s.apply(id, Edit::RemoveMarks { kind: MarkKind::Watermark }).unwrap();
     s.apply(id, Edit::RemoveMarks { kind: MarkKind::Background }).unwrap();
     assert_eq!(page_texts(&s, id), ["Page 1", "Page 2"]);
-    assert!(s.get(id).unwrap().marks.is_empty());
+    assert!(s.get(id).unwrap().marks().is_empty());
     assert!(matches!(s.apply(id, Edit::RemoveMarks { kind: MarkKind::Watermark }), Err(EditError::Edit(_))));
     assert_eq!(s.get(id).unwrap().can_undo(), Some("Remove background"));
 }
 
 #[test]
-fn open_populates_marks_and_added_from_the_combined_marker_scan() {
+fn marker_indexes_match_after_open_and_save_when_requested() {
     let (mut source, source_id) = session_with(1);
     let mut header = HeaderFooter::default();
     header.text[0] = "Header".into();
@@ -1915,18 +2136,95 @@ fn open_populates_marks_and_added_from_the_combined_marker_scan() {
     let expected_added = pdfcraft_edit::list_added(&reference);
     source.mark_saved(source_id, bytes.clone(), None).unwrap();
     let refreshed = source.get(source_id).unwrap();
-    assert_eq!(refreshed.marks, expected_marks);
-    assert_eq!(refreshed.added, expected_added);
+    assert_eq!(refreshed.marks(), expected_marks);
+    assert_eq!(refreshed.added(), expected_added);
     let mut reopened = Session::new();
     let reopened_id = reopened.open("marked.pdf", None, bytes, None).unwrap();
     let opened = reopened.get(reopened_id).unwrap();
-    assert_eq!(opened.marks, expected_marks);
-    assert_eq!(opened.added, expected_added);
-    assert_eq!(opened.marks.len(), 3);
-    assert!(opened.marks.contains(&MarkKind::HeaderFooter));
-    assert!(opened.marks.contains(&MarkKind::Watermark));
-    assert!(opened.marks.contains(&MarkKind::Background));
-    assert_eq!(opened.added.len(), 1);
+    assert_eq!(opened.marks(), expected_marks);
+    assert_eq!(opened.added(), expected_added);
+    assert_eq!(opened.marks().len(), 3);
+    assert!(opened.marks().contains(&MarkKind::HeaderFooter));
+    assert!(opened.marks().contains(&MarkKind::Watermark));
+    assert!(opened.marks().contains(&MarkKind::Background));
+    assert_eq!(opened.added().len(), 1);
+}
+
+#[test]
+fn secondary_indexes_load_once_and_follow_edit_scopes() {
+    reset_secondary_scan_counts();
+    let (mut session, id) = session_with(1);
+    assert_eq!(secondary_scan_counts(), (0, 0), "open does not scan markers or links");
+
+    {
+        let doc = session.get(id).unwrap();
+        assert!(doc.marks().is_empty());
+        assert!(doc.added().is_empty());
+        assert!(doc.added().is_empty());
+        assert_eq!(secondary_scan_counts(), (1, 0), "marks and added content share one scan");
+        assert!(doc.links().is_empty());
+        assert!(doc.links().is_empty());
+        assert_eq!(secondary_scan_counts(), (1, 1), "repeated reads reuse the link list");
+    }
+
+    session.apply(id, Edit::SetInfo { key: "Title".into(), value: "Changed".into() }).unwrap();
+    assert!(session.get(id).unwrap().links().is_empty());
+    assert!(session.get(id).unwrap().marks().is_empty());
+    assert_eq!(secondary_scan_counts(), (1, 1), "metadata does not invalidate either index");
+
+    session.apply(id, rect_comment(0, [20.0, 20.0, 60.0, 60.0])).unwrap();
+    assert!(session.get(id).unwrap().links().is_empty());
+    assert_eq!(secondary_scan_counts(), (1, 2), "comment edits invalidate the annotation-position link index");
+
+    session
+        .apply(
+            id,
+            Edit::AddLink {
+                page: 0,
+                rect: [10.0, 10.0, 80.0, 30.0],
+                action: LinkAction::Uri("https://example.org".into()),
+                style: LinkStyle::default(),
+            },
+        )
+        .unwrap();
+    assert_eq!(secondary_scan_counts(), (1, 2), "a link edit invalidates only the link list");
+    assert_eq!(session.get(id).unwrap().links()[0].index, 1, "link indexes include earlier annotations");
+    assert_eq!(secondary_scan_counts(), (1, 3));
+    session.undo(id).unwrap();
+    assert_eq!(session.get(id).unwrap().links().len(), 0);
+    assert_eq!(secondary_scan_counts(), (1, 4), "undo rebuilds the link list once");
+    session.redo(id).unwrap();
+    assert_eq!(session.get(id).unwrap().links()[0].index, 1);
+    assert_eq!(secondary_scan_counts(), (1, 5), "redo rebuilds the link list once");
+    session.apply(id, Edit::DeleteAnnotation { page: 0, index: 0 }).unwrap();
+    assert_eq!(session.get(id).unwrap().links()[0].index, 0, "deleting an earlier annotation shifts link indexes");
+    assert_eq!(secondary_scan_counts(), (1, 6), "comment deletion rebuilds annotation-position indexes");
+
+    session
+        .apply(id, Edit::AddText { page: 0, text: AddedText { rect: [20.0, 250.0, 100.0, 280.0], text: "Added".into(), ..Default::default() } })
+        .unwrap();
+    assert_eq!(secondary_scan_counts(), (1, 6), "content edits defer rebuilding until a marker getter is used");
+    assert_eq!(session.get(id).unwrap().added().len(), 1);
+    assert_eq!(session.get(id).unwrap().links().len(), 1);
+    assert_eq!(secondary_scan_counts(), (2, 6), "content edits preserve the link cache");
+
+    let mut header = HeaderFooter::default();
+    header.text[0] = "Header".into();
+    session.apply(id, Edit::AddHeaderFooter { pages: vec![0], settings: header, replace: false }).unwrap();
+    assert_eq!(session.get(id).unwrap().marks(), [MarkKind::HeaderFooter]);
+    assert_eq!(secondary_scan_counts(), (3, 6));
+    session.undo(id).unwrap();
+    assert!(session.get(id).unwrap().marks().is_empty());
+    assert_eq!(secondary_scan_counts(), (4, 6), "undo invalidates marker state");
+    session.undo(id).unwrap();
+    assert!(session.get(id).unwrap().added().is_empty());
+    assert_eq!(secondary_scan_counts(), (5, 6), "undo of added content invalidates marker state");
+    session.redo(id).unwrap();
+    assert_eq!(session.get(id).unwrap().added().len(), 1);
+    assert_eq!(secondary_scan_counts(), (6, 6), "redo of added content rebuilds once");
+    session.redo(id).unwrap();
+    assert_eq!(session.get(id).unwrap().marks(), [MarkKind::HeaderFooter]);
+    assert_eq!(secondary_scan_counts(), (7, 6), "redo of marks rebuilds once");
 }
 
 #[test]
@@ -2169,15 +2467,15 @@ fn added_text_and_images_render_and_stay_editable() {
     }
     s.apply(id, Edit::AddImage { page: 0, rect: None, name: "dot.png".into(), bytes: Arc::new(png) }).unwrap();
     let d = s.get(id).unwrap();
-    assert_eq!(d.added.len(), 2);
-    assert_eq!(d.added[1].content.rect(), [90.0, 145.0, 110.0, 155.0], "20×10 px at 72 dpi, centred on 200×300");
-    let moved = d.added[0].content.with_rect([30.0, 100.0, 190.0, 130.0]);
+    assert_eq!(d.added().len(), 2);
+    assert_eq!(d.added()[1].content.rect(), [90.0, 145.0, 110.0, 155.0], "20×10 px at 72 dpi, centred on 200×300");
+    let moved = d.added()[0].content.with_rect([30.0, 100.0, 190.0, 130.0]);
     s.apply(id, Edit::UpdateContent { page: 0, index: 0, content: moved }).unwrap();
-    assert_eq!(s.get(id).unwrap().added[0].content.rect()[3], 130.0);
+    assert_eq!(s.get(id).unwrap().added()[0].content.rect()[3], 130.0);
     s.apply(id, Edit::DeleteContent { page: 0, index: 1 }).unwrap();
-    assert_eq!(s.get(id).unwrap().added.len(), 1);
+    assert_eq!(s.get(id).unwrap().added().len(), 1);
     s.undo(id).unwrap();
-    assert_eq!(s.get(id).unwrap().added.len(), 2);
+    assert_eq!(s.get(id).unwrap().added().len(), 2);
 }
 
 #[test]
@@ -2209,7 +2507,7 @@ fn added_images_rotate_flip_and_crop_as_drawn() {
     let blue = |c: [u8; 3]| c[2] > 200 && c[0] < 60;
     // Display y 100–200 is rows 100–200 from the top on a 300 pt page.
     assert!(red(colour_at(&s, 70, 150)) && blue(colour_at(&s, 130, 150)), "as placed: red left, blue right");
-    let item = |s: &Session| s.get(id).unwrap().added[0].content.clone();
+    let item = |s: &Session| s.get(id).unwrap().added()[0].content.clone();
     let AddedContent::Image(mut img) = item(&s) else { panic!() };
     img.rotation = 1;
     s.apply(id, Edit::UpdateContent { page: 0, index: 0, content: AddedContent::Image(img.clone()) }).unwrap();
@@ -2310,21 +2608,21 @@ fn links_from_urls_and_link_edits() {
     assert_eq!(found[0].2, "http://www.example.org");
     s.apply(id, Edit::AddLinks { links: found, style: LinkStyle::default() }).unwrap();
     let d = s.get(id).unwrap();
-    assert_eq!(d.links.len(), 1);
+    assert_eq!(d.links().len(), 1);
     assert_eq!(d.info.links.len(), 1, "the viewer follows it");
     assert!(s.find_urls(id).is_empty(), "already linked");
     // Remove all links and undo.
     s.apply(id, Edit::RemoveLinks { pages: None }).unwrap();
-    assert!(s.get(id).unwrap().links.is_empty());
+    assert!(s.get(id).unwrap().links().is_empty());
     assert_eq!(s.get(id).unwrap().can_undo(), Some("Remove all links"));
     s.undo(id).unwrap();
-    assert_eq!(s.get(id).unwrap().links.len(), 1);
+    assert_eq!(s.get(id).unwrap().links().len(), 1);
     // Link Properties and delete.
-    let l = s.get(id).unwrap().links[0].clone();
+    let l = s.get(id).unwrap().links()[0].clone();
     s.apply(id, Edit::SetLink { page: 0, index: l.index, rect: None, action: Some(LinkAction::Page(0)), style: None }).unwrap();
-    assert_eq!(s.get(id).unwrap().links[0].action, LinkAction::Page(0));
+    assert_eq!(s.get(id).unwrap().links()[0].action, LinkAction::Page(0));
     s.apply(id, Edit::DeleteLink { page: 0, index: l.index }).unwrap();
-    assert!(s.get(id).unwrap().links.is_empty());
+    assert!(s.get(id).unwrap().links().is_empty());
     assert!(s.apply(id, Edit::RemoveLinks { pages: None }).is_err(), "nothing left to remove");
 }
 
@@ -2354,14 +2652,14 @@ fn appearance_only_edit_preserves_gotor_action_semantics() {
     let mut session = Session::new();
     let id = session.open("source.pdf", Some("/docs/source.pdf".into()), Arc::new(bytes), None).unwrap();
     let before = session.get(id).unwrap().info.links[0].target.clone();
-    let mut style = session.get(id).unwrap().links[0].style;
+    let mut style = session.get(id).unwrap().links()[0].style;
     style.visible = true;
     style.width = 2.0;
     session.apply(id, Edit::SetLink { page: 0, index: 0, rect: None, action: None, style: Some(style) }).unwrap();
 
     let after = &session.get(id).unwrap().info.links[0].target;
     assert_eq!(*after, before, "the GoToR file, destination and /NewWindow hint must remain unchanged");
-    assert_eq!(session.get(id).unwrap().links[0].style, style, "the appearance edit is applied");
+    assert_eq!(session.get(id).unwrap().links()[0].style, style, "the appearance edit is applied");
 }
 
 #[test]
@@ -2603,7 +2901,8 @@ fn recognize_text_makes_a_scanned_page_searchable() {
     let mut s = Session::new().with_clock(|| 1_700_000_000);
     let text = s.create_from_text("t", "The quick brown fox jumps over the lazy dog.").unwrap();
     let id = s.open("text.pdf", None, text, None).unwrap();
-    let png = export::Exporter::new(s.get(id).unwrap()).png(0, 150.0).unwrap();
+    // A typical 300 DPI scan keeps the small leading glyph in "quick" legible to OCR.
+    let png = export::Exporter::new(s.get(id).unwrap()).png(0, 300.0).unwrap();
     let scan = s.create_from_images(&[("scan.png".into(), png)]).unwrap();
     let id = s.open("scan.pdf", None, scan, None).unwrap();
     assert_eq!(page_texts(&s, id), [""], "a picture has no text");
@@ -2620,7 +2919,9 @@ fn recognize_text_makes_a_scanned_page_searchable() {
     let q = words.iter().find(|w| w.text.to_lowercase().contains("quick")).unwrap();
     let l = words.iter().find(|w| w.text.to_lowercase().contains("lazy")).unwrap();
     let top = |w: &ocr::PlacedWord| w.origin[1] + w.up[1];
-    assert!(q.origin[0] < l.origin[0] && (top(q) - top(l)).abs() < 3.0, "{q:?} {l:?}");
+    // OCR boxes can differ by a few pixels at 300 DPI and still sit on the same line.
+    let line_tolerance = q.up[1].abs().max(l.up[1].abs()) / 4.0;
+    assert!(q.origin[0] < l.origin[0] && (top(q) - top(l)).abs() < line_tolerance, "{q:?} {l:?}");
 
     // A second pass skips the page: it has text now.
     let again = s.recognize_text(id, &[], ocr::OcrSettings::default()).unwrap();
@@ -2794,6 +3095,155 @@ fn detecting_fields_on_a_printed_form() {
     assert!(s.detect_fields(id, &[]).is_empty(), "nothing left to detect");
 }
 
+/// A printed form, 420 × 300 pt: a title, a label with a rule to write on, a box with a small
+/// label in its corner, an empty box with its label above, and two check boxes.
+fn paper_form() -> Vec<u8> {
+    let content = "BT /F1 14 Tf 30 270 Td (Gewerbe-Ummeldung) Tj ET \
+        BT /F1 10 Tf 30 230 Td (Name:) Tj ET 0.75 w 80 228 m 380 228 l S \
+        1 w 30 150 350 50 re S BT /F1 7 Tf 34 191 Td (Anschrift) Tj ET \
+        BT /F1 8 Tf 30 124 Td (Telefon) Tj ET 30 90 350 30 re S \
+        30 50 10 10 re S BT /F1 9 Tf 46 51 Td (Haupt) Tj ET 150 50 10 10 re S BT /F1 9 Tf 166 51 Td (Zweig) Tj ET";
+    let objs = [
+        b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 420 300] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >>".to_vec(),
+        format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len()).into_bytes(),
+        b"<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".to_vec(),
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, obj) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n", i + 1).as_bytes());
+        out.extend_from_slice(obj);
+        out.extend_from_slice(b"\nendobj\n");
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for offset in offsets {
+        out.extend_from_slice(format!("{offset:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    out
+}
+
+/// How the paper form was scanned.
+#[derive(Clone, Copy, Debug)]
+enum Scan {
+    Straight,
+    /// Stored sideways and turned upright by `/Rotate 90`.
+    Sideways,
+    /// Speckled paper, uneven light and lines that lose some pixels.
+    Noisy,
+    /// Laid on the scanner a degree askew.
+    Skewed,
+}
+
+/// The paper form as an image-only PDF at 150 dpi (the page keeps its 420 × 300 pt).
+fn scanned_form(scan: Scan) -> Arc<Vec<u8>> {
+    let mut s = Session::new().with_clock(|| 1_700_000_000);
+    let id = s.open("paper.pdf", None, Arc::new(paper_form()), None).unwrap();
+    let png = export::Exporter::new(s.get(id).unwrap()).png(0, 150.0).unwrap();
+    let mut img = image::load_from_memory(&png).unwrap().to_rgba8();
+    match scan {
+        Scan::Straight => {}
+        Scan::Sideways => img = image::imageops::rotate270(&img),
+        Scan::Skewed => {
+            // Turned a degree about the centre (nearest pixel; the corners stay paper).
+            let (w, h) = (img.width() as f64, img.height() as f64);
+            let (sin, cos) = 1f64.to_radians().sin_cos();
+            let src = img.clone();
+            for (x, y, p) in img.enumerate_pixels_mut() {
+                let (dx, dy) = (x as f64 - w / 2.0, y as f64 - h / 2.0);
+                let (sx, sy) = (cos * dx + sin * dy + w / 2.0, -sin * dx + cos * dy + h / 2.0);
+                *p = if sx >= 0.0 && sy >= 0.0 && sx < w && sy < h { *src.get_pixel(sx as u32, sy as u32) } else { image::Rgba([255; 4]) };
+            }
+        }
+        Scan::Noisy => {
+            let (w, mut seed) = (img.width(), 7u32);
+            for (x, _, p) in img.enumerate_pixels_mut() {
+                seed = seed.wrapping_mul(1_103_515_245).wrapping_add(12345);
+                let noise = ((seed >> 16) % 48) as u8;
+                let shade = (x * 50 / w) as u8;
+                for c in &mut p.0[..3] {
+                    *c = if *c < 128 && noise < 4 { 230 } else { c.saturating_sub(shade).saturating_sub(noise) };
+                }
+            }
+        }
+    }
+    let mut bytes = std::io::Cursor::new(Vec::new());
+    img.write_to(&mut bytes, image::ImageFormat::Png).unwrap();
+    let pdf = s.create_from_images_with_resolution(&[("scan.png".into(), bytes.into_inner())], ImageResolution::Dpi(150.0)).unwrap();
+    if !matches!(scan, Scan::Sideways) {
+        return pdf;
+    }
+    let id = s.open("scan.pdf", None, pdf, None).unwrap();
+    s.apply(id, Edit::RotatePages { pages: vec![0], degrees: 90 }).unwrap();
+    s.save_bytes(id).unwrap()
+}
+
+/// Fields on a scanned paper form are found from its lines and boxes, wherever the page turns
+/// them, and named from the labels when text recognition is installed.
+#[test]
+fn detecting_fields_on_a_scanned_form() {
+    use pdfcraft_forms::detect::Kind::{CheckBox, Text};
+    for scan in [Scan::Straight, Scan::Sideways, Scan::Noisy, Scan::Skewed] {
+        let mut s = Session::new().with_clock(|| 1_700_000_000);
+        let id = s.open("scan.pdf", None, scanned_form(scan), None).unwrap();
+        assert_eq!(page_texts(&s, id), [""], "{scan:?}: a picture has no text");
+        let info = s.get(id).unwrap().info.pages[0].clone();
+        assert_eq!((info.width.round(), info.height.round()), (420.0, 300.0), "{scan:?}");
+        // Where a field shows on the page, in points from the bottom-left as displayed.
+        let shown = |r: [f64; 4]| {
+            let a = info.user_to_view(r[0] as f32, r[1] as f32);
+            let b = info.user_to_view(r[2] as f32, r[3] as f32);
+            [a[0].min(b[0]), 300.0 - a[1].max(b[1]), a[0].max(b[0]), 300.0 - a[1].min(b[1])].map(f64::from)
+        };
+        let found = s.detect_fields(id, &[]);
+        let got: Vec<(pdfcraft_forms::detect::Kind, [f64; 4])> = found.iter().map(|(_, c)| (c.kind.clone(), shown(c.rect))).collect();
+        // In reading order: the rule after "Name:", the box below "Anschrift", the "Telefon"
+        // box, two check boxes.
+        let want = [
+            (Text, [80.0, 229.0, 380.0, 245.0]),
+            (Text, [31.0, 151.0, 379.0, 189.0]),
+            (Text, [31.0, 91.0, 379.0, 119.0]),
+            (CheckBox, [30.0, 50.0, 40.0, 60.0]),
+            (CheckBox, [150.0, 50.0, 160.0, 60.0]),
+        ];
+        assert_eq!(got.len(), want.len(), "{scan:?}: {got:?}");
+        for ((kind, r), (want_kind, w)) in got.iter().zip(&want) {
+            assert_eq!(kind, want_kind, "{scan:?}: {got:?}");
+            // The labelled box's top is wherever the label ends; everything else is close. A
+            // degree askew, a 350 pt line climbs 6 pt, and the field stays inside the box.
+            let tol = if matches!(scan, Scan::Skewed) { [6.5; 4] } else { [2.5, 2.5, 2.5, if w[3] == 189.0 { 6.0 } else { 2.5 }] };
+            assert!(r.iter().zip(w).zip(tol).all(|((a, b), t)| (a - b).abs() <= t), "{scan:?}: {r:?}, want {w:?}");
+        }
+        let names: Vec<&str> = found.iter().map(|(_, c)| c.name.as_str()).collect();
+        if ocr::available() {
+            // (Askew, recognition may read "Haupt" and "Zweig" as one phrase.)
+            assert!(names.contains(&"Name") && names.contains(&"Telefon") && names.iter().any(|n| n.starts_with("Haupt")), "{scan:?}: {names:?}");
+        } else {
+            // Without text recognition the fields get the default names.
+            assert!(names.iter().all(|n| n.starts_with("Text") || n.starts_with("Check Box")), "{scan:?}: {names:?}");
+        }
+
+        // Added as one step, where they were found; on the turned page each field turns with
+        // it, so typing reads upright.
+        let added = s.auto_detect_fields(id, &[]).unwrap();
+        assert_eq!(added.len(), want.len());
+        let d = s.get(id).unwrap();
+        assert_eq!(d.can_undo(), Some("Detect form fields"));
+        let turn = if matches!(scan, Scan::Sideways) { 90 } else { 0 };
+        for (_, c) in &found {
+            let f = d.form.iter().find(|f| f.name == c.name).unwrap();
+            assert_eq!(f.widgets[0].rotation, turn, "{scan:?}: {}", f.name);
+            let r = f.widgets[0].rect;
+            assert!(r.iter().zip(c.rect).all(|(a, b)| (a - b).abs() < 0.01), "{scan:?}: {r:?} moved from {:?}", c.rect);
+        }
+        assert!(s.detect_fields(id, &[]).is_empty(), "{scan:?}: nothing left to detect");
+    }
+}
+
 #[test]
 fn comparing_two_versions_of_a_document() {
     let mut s = Session::new().with_clock(|| 1_700_000_000);
@@ -3573,6 +4023,113 @@ fn a_value_a_script_sets_reaches_every_field_bound_to_the_same_data_node() {
     );
 }
 
+#[test]
+fn flattening_an_xfa_form_bakes_its_pages_and_takes_the_xfa_out() {
+    let data = "<form><page1><country>JP</country><langs>English\nSpanish</langs></page1></form>";
+    let bytes = Arc::new(pdfcraft_xfa::fixtures::shell(&pdfcraft_xfa::fixtures::fields_template(data)));
+    let mut s = Session::new().with_clock(|| 1_700_000_000);
+    let id = s.open("fields.pdf", None, bytes, None).expect("opens");
+    assert_eq!(s.get(id).unwrap().info.xfa, Some(pdfcraft_render::Xfa::Dynamic));
+    s.apply(id, Edit::SetFieldValue { name: "other".into(), value: FieldValue::Text("typed here".into()) }).unwrap();
+    s.apply(id, Edit::Flatten { comments: false, fields: true }).unwrap();
+    let d = s.get(id).unwrap();
+    assert!(d.form.is_empty(), "no fields remain");
+    assert_eq!(d.info.xfa, None, "no longer an XFA form: Adobe's viewers show the baked pages");
+    assert!(d.xfa.is_none());
+    let texts = page_texts(&s, id).join("\n");
+    for want in ["Japan", "typed here", "Country: JP", "12345"] {
+        assert!(texts.contains(want), "{want} is page content now: {texts}");
+    }
+    // Saved and reopened: a plain PDF, the same page content, nothing of the XFA left.
+    let saved = s.save_bytes(id).unwrap();
+    let cos = pdfcraft_cos::Document::open(saved.clone()).unwrap();
+    assert!(pdfcraft_xfa::read_packets(&cos).unwrap().is_none());
+    let id2 = s.open("flat.pdf", None, saved, None).unwrap();
+    let d2 = s.get(id2).unwrap();
+    assert_eq!((d2.info.xfa, d2.form.len()), (None, 0));
+    assert!(page_texts(&s, id2).join("\n").contains("typed here"));
+    // Undone, the form is a laid-out XFA form again.
+    s.undo(id).unwrap();
+    let d = s.get(id).unwrap();
+    assert_eq!(d.info.xfa, Some(pdfcraft_render::Xfa::Dynamic));
+    assert_eq!(d.form.iter().find(|f| f.name == "other").unwrap().value, vec!["typed here".to_string()]);
+    // Flattening comments alone leaves the XFA form as it is.
+    s.apply(id, Edit::Flatten { comments: true, fields: false }).unwrap();
+    assert_eq!(s.get(id).unwrap().info.xfa, Some(pdfcraft_render::Xfa::Dynamic));
+}
+
+#[test]
+fn a_dynamic_xfa_form_that_was_never_laid_out_keeps_its_xfa_and_the_user_is_told_what_went() {
+    // A template that can't be read: the form keeps its placeholder page and its XFA.
+    let broken = "<xdp:xdp xmlns:xdp=\"http://ns.adobe.com/xdp/\"><template xmlns=\"http://www.xfa.org/schema/xfa-template/3.3/\"><subform name=\"form\"</template></xdp:xdp>";
+    let mut s = Session::new().with_clock(|| 1_700_000_000);
+    let id = s.open("broken.pdf", None, Arc::new(pdfcraft_xfa::fixtures::shell(broken)), None).expect("opens");
+    assert_eq!(s.get(id).unwrap().info.xfa, Some(pdfcraft_render::Xfa::Dynamic));
+    assert!(s.get(id).unwrap().xfa.is_none(), "not laid out");
+    assert!(s.apply(id, Edit::XfaToStatic).is_err(), "nothing to keep");
+    s.apply(id, Edit::Flatten { comments: false, fields: true }).unwrap();
+    let d = s.get(id).unwrap();
+    assert_eq!(d.info.xfa, Some(pdfcraft_render::Xfa::Dynamic), "the XFA stays: Adobe can still render the form");
+    assert!(d.info.warnings.iter().any(|w| w.contains("The XFA was kept")), "{:?}", d.info.warnings);
+    // A laid-out form with data no field holds: converting says what went with the XFA, and
+    // the note stays on the document, while the XFA's own warnings go; undo brings those back.
+    let data = "<form><page1><country>JP</country><nobody>holds this</nobody></page1></form>";
+    let id = s.open("fields.pdf", None, Arc::new(pdfcraft_xfa::fixtures::shell(&pdfcraft_xfa::fixtures::fields_template(data))), None).unwrap();
+    let before: Vec<String> = s.get(id).unwrap().info.warnings.clone();
+    assert!(before.iter().any(|w| w.contains("scripts changed it on opening")), "an XFA-only warning: {before:?}");
+    s.apply(id, Edit::XfaToStatic).unwrap();
+    let w = s.get(id).unwrap().info.warnings.clone();
+    assert!(w.iter().any(|n| n.starts_with("XFA removed: The XFA was taken out") && n.contains("template, datasets")), "{w:?}");
+    assert!(w.iter().any(|n| n.contains("1 value(s) the form's XFA data held that no field showed")), "{w:?}");
+    assert!(w.iter().any(|n| n.contains("1 image field(s) do nothing now")), "{w:?}");
+    assert!(!w.iter().any(|n| n.contains("scripts changed it on opening")), "the XFA's own warning is gone: {w:?}");
+    let js = s.take_js_output(id);
+    assert!(js.errors.is_empty(), "{js:?}");
+    s.undo(id).unwrap();
+    let w = s.get(id).unwrap().info.warnings.clone();
+    assert!(!w.iter().any(|n| n.starts_with("XFA removed")), "{w:?}");
+    assert_eq!(s.get(id).unwrap().info.xfa, Some(pdfcraft_render::Xfa::Dynamic));
+}
+
+#[test]
+fn an_xfa_form_converts_to_a_static_form_that_keeps_its_fields() {
+    let bytes = Arc::new(pdfcraft_xfa::fixtures::shell(&pdfcraft_xfa::fixtures::scripted_template()));
+    let mut s = Session::new().with_clock(|| 1_700_000_000);
+    let id = s.open("scripted.pdf", None, bytes, None).expect("opens");
+    let value = |s: &Session, id: DocId, n: &str| s.get(id).unwrap().form.iter().find(|f| f.name == n).map(|f| f.value.clone()).unwrap_or_default();
+    assert_eq!(value(&s, id, "total"), vec!["10".to_string()], "the scripts ran on open");
+    let fields_before = s.get(id).unwrap().form.len();
+    s.apply(id, Edit::XfaToStatic).unwrap();
+    let d = s.get(id).unwrap();
+    assert_eq!(d.info.xfa, None);
+    assert_eq!(d.form.len(), fields_before, "the fields stay");
+    assert_eq!(value(&s, id, "qty"), vec!["2".to_string()]);
+    assert_eq!(value(&s, id, "total"), vec!["10".to_string()]);
+    assert_eq!(s.get(id).unwrap().can_undo(), Some("Convert to a static form"));
+    // The form is an ordinary one now: a change no longer runs the XFA calculation.
+    s.apply(id, Edit::SetFieldValue { name: "qty".into(), value: FieldValue::Text("7".into()) }).unwrap();
+    assert_eq!(value(&s, id, "total"), vec!["10".to_string()]);
+    assert!(s.take_js_output(id).is_empty());
+    // Saved: no XFA, no private keys on the fields, the pages as laid out.
+    let saved = s.save_bytes(id).unwrap();
+    let cos = pdfcraft_cos::Document::open(saved.clone()).unwrap();
+    assert!(pdfcraft_xfa::read_packets(&cos).unwrap().is_none());
+    assert!(pdfcraft_xfa::fields_by_som(&cos).is_empty(), "no /PCSom left");
+    let id2 = s.open("static.pdf", None, saved, None).unwrap();
+    let d2 = s.get(id2).unwrap();
+    assert_eq!(d2.info.xfa, None);
+    assert_eq!(value(&s, id2, "qty"), vec!["7".to_string()]);
+    assert_eq!(d2.info.pages.len(), 1);
+    // Not an XFA form: refused.
+    assert!(s.apply(id2, Edit::XfaToStatic).is_err());
+    // Undone, the XFA form is back and its scripts run again.
+    s.undo(id).unwrap();
+    s.undo(id).unwrap();
+    assert_eq!(s.get(id).unwrap().info.xfa, Some(pdfcraft_render::Xfa::Dynamic));
+    s.apply(id, Edit::SetFieldValue { name: "qty".into(), value: FieldValue::Text("3".into()) }).unwrap();
+    assert_eq!(value(&s, id, "total"), vec!["15".to_string()]);
+}
+
 #[test]
 fn dynamic_xfa_forms_run_formcalc_scripts() {
     let bytes = Arc::new(pdfcraft_xfa::fixtures::shell(&pdfcraft_xfa::fixtures::formcalc_template()));
@@ -3865,6 +4422,51 @@ fn comments_without_appearances_are_drawn_but_not_saved() {
     }
 }
 
+/// A page with a FreeText comment that has no `/AP` stream: the smallest case behind #2371.
+fn free_text_without_appearance() -> Arc<Vec<u8>> {
+    let objs: Vec<&[u8]> = vec![
+        b"<< /Type /Catalog /Pages 2 0 R >>",
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 300] >>",
+        b"<< /Type /Page /Parent 2 0 R /Annots [4 0 R] >>",
+        b"<< /Type /Annot /Subtype /FreeText /Rect [20 200 180 260] /Contents (Box) /DA (/Helv 10 Tf 0 0 1 rg) /Border [0 0 1] /C [.85 .47 .02] >>",
+    ];
+    let mut bytes = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(bytes.len());
+        bytes.extend_from_slice(format!("{} 0 obj\n", i + 1).as_bytes());
+        bytes.extend_from_slice(o);
+        bytes.extend_from_slice(b"\nendobj\n");
+    }
+    let xref = bytes.len();
+    bytes.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        bytes.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    bytes.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    Arc::new(bytes)
+}
+
+/// #2371: a comment without an appearance stream is displayed by the app, so the CLI's page image
+/// must show it too. The helper's copy is for rendering only; documents that need no copy, and
+/// files it can't display, keep exactly the original source bytes.
+#[test]
+fn cli_display_adds_missing_appearances_without_changing_the_source() {
+    let original = free_text_without_appearance();
+    let display = display_bytes_for(original.clone(), None);
+    assert_ne!(display.as_slice(), original.as_slice(), "the display copy draws the missing comment appearance");
+
+    let doc = pdfcraft_cos::Document::open(display).unwrap();
+    let object = doc.get(pdfcraft_cos::ObjRef::new(4, 0));
+    let annot = object.as_dict().unwrap();
+    assert!(annot.contains(b"AP"), "the display copy has an appearance stream");
+
+    let plain = Arc::new(fixture(1));
+    assert!(Arc::ptr_eq(&display_bytes_for(plain.clone(), None), &plain), "a complete document needs no copy");
+    let damaged = Arc::new(b"not a PDF".to_vec());
+    assert!(Arc::ptr_eq(&display_bytes_for(damaged.clone(), None), &damaged), "an unreadable file falls back to its source");
+}
+
 /// Titles a browser writes for a blank page or a pop-up name no document; real titles stay.
 #[test]
 fn placeholder_titles_are_recognised() {
@@ -4031,7 +4633,7 @@ fn group_moves_preserve_rotated_added_content_raster_geometry() {
     image.write_to(&mut png, image::ImageFormat::Png).unwrap();
     s.apply(id, Edit::AddImage { page: 0, rect: Some([40.0, 40.0, 80.0, 70.0]), name: "quadrants.png".into(), bytes: Arc::new(png.into_inner()) })
         .unwrap();
-    let AddedContent::Image(mut image) = s.get(id).unwrap().added[1].content.clone() else { panic!() };
+    let AddedContent::Image(mut image) = s.get(id).unwrap().added()[1].content.clone() else { panic!() };
     image.flip_h = true;
     image.crop = [0.1, 0.0, 0.2, 0.0];
     s.apply(id, Edit::UpdateContent { page: 0, index: 1, content: AddedContent::Image(image) }).unwrap();
@@ -4294,7 +4896,7 @@ fn content_edit_keeps_pages_annotations_fields_and_links() {
     let annotations = format!("{:?}", before.info.annotations);
     let links = format!("{:?}", before.links);
     let form = before.form.clone();
-    let marks = before.marks.clone();
+    let marks = before.marks().to_vec();
     let bytes = before.bytes.clone();
     let text = AddedText {
         rect: [20.0, 20.0, 200.0, 60.0],
@@ -4312,8 +4914,8 @@ fn content_edit_keeps_pages_annotations_fields_and_links() {
     assert_eq!(format!("{:?}", after.info.annotations), annotations);
     assert_eq!(format!("{:?}", after.links), links);
     assert_eq!(after.form, form, "no field was touched");
-    assert_eq!(after.marks, marks, "no mark was touched");
-    assert!(after.added.iter().any(|a| a.page == 1), "the added text is listed");
+    assert_eq!(after.marks(), marks, "no mark was touched");
+    assert!(after.added().iter().any(|a| a.page == 1), "the added text is listed");
     assert_ne!(after.bytes, bytes, "the working file carries the edit");
     assert_ne!(after.display, bytes, "the display copy carries the edit too");
     // The display bytes still open and render the edited page.
@@ -4323,7 +4925,7 @@ fn content_edit_keeps_pages_annotations_fields_and_links() {
     // Undo goes through the same narrow refresh without the edit at hand.
     session.undo(id).unwrap();
     let undone = session.get(id).unwrap();
-    assert!(undone.added.is_empty(), "undo drops the added text");
+    assert!(undone.added().is_empty(), "undo drops the added text");
     assert_eq!(format!("{:?}", undone.info.pages), pages);
 }
 
@@ -4523,3 +5125,285 @@ fn copy_image_finds_a_picture_inside_form_artwork_under_text() {
     assert_eq!(d.page_image_copy_file(0, 0).unwrap(), ("jpg", jpeg));
     assert!(d.page_image_copy_file(0, 1).is_err());
 }
+
+/// `fixture(2)` with the catalog pointing at a page tree object the file does not have (#1656).
+fn fixture_without_page_tree() -> Vec<u8> {
+    let bytes = fixture(2);
+    let catalog = b"<< /Type /Catalog /Pages 2 0 R >>";
+    let at = bytes.windows(catalog.len()).position(|w| w == catalog).unwrap();
+    let mut out = bytes.clone();
+    out[at..at + catalog.len()].copy_from_slice(b"<< /Type /Catalog /Pages 9 0 R >>");
+    out
+}
+
+#[test]
+fn a_recovered_page_tree_opens_unmodified_and_edits_the_pages_shown() {
+    let mut s = Session::new();
+    let id = s.open("damaged.pdf", None, Arc::new(fixture_without_page_tree()), None).unwrap();
+    let doc = s.get(id).unwrap();
+    assert_eq!(doc.info.pages.len(), 2);
+    assert!(!doc.editor.as_ref().unwrap().cos.is_modified(), "the repair is a revision of the opened file, not an unsaved edit");
+    assert!(doc.repair_log().iter().any(|l| l.contains("page tree is missing")), "{:?}", doc.repair_log());
+    s.apply(id, Edit::RotatePages { pages: vec![1], degrees: 90 }).unwrap();
+    assert_eq!(s.get(id).unwrap().info.pages.iter().map(|p| p.rotation).collect::<Vec<_>>(), [0, 90]);
+}
+
+#[test]
+fn a_signed_document_rebuilt_from_object_headers_refuses_edits() {
+    let p12 = std::fs::read(concat!(env!("CARGO_MANIFEST_DIR"), "/../sign/tests/data/ec-p256.p12")).unwrap();
+    let digital_id = sign::pkcs12::open(&p12, "test").unwrap();
+    let mut s = Session::new().with_clock(|| 1_800_000_000);
+    let id = s.open("fixture.pdf", None, Arc::new(fixture(2)), None).unwrap();
+    let opts = SignOptions { page: 1, rect: Some([20.0, 20.0, 180.0, 60.0]), ..SignOptions::default() };
+    let signed = s.sign(id, &digital_id, opts).unwrap();
+    s.mark_signed(id, signed, None).unwrap();
+    // A broken startxref: the file opens only by rebuilding from object headers, and any save
+    // of it is a full rewrite.
+    let mut bytes = s.get(id).unwrap().bytes.as_ref().clone();
+    let sx = bytes.windows(10).rposition(|w| w == b"startxref\n").unwrap() + 10;
+    let end = sx + bytes[sx..].iter().position(|b| !b.is_ascii_digit()).unwrap();
+    bytes.splice(sx..end, b"1".iter().copied());
+    let id = s.open("damaged.pdf", None, Arc::new(bytes), None).unwrap();
+    assert!(s.get(id).unwrap().is_signed());
+    assert!(s.get(id).unwrap().editor.as_ref().unwrap().cos.revisions().is_empty(), "the fixture must be rebuilt");
+    assert!(matches!(s.apply(id, rect_comment(0, [80.0, 80.0, 120.0, 120.0])), Err(EditError::SignedRewrite(_))));
+    assert!(!s.get(id).unwrap().dirty);
+}
+
+/// #1324: marking a figure decorative rewrites that figure only. The header, added text and an
+/// unknown entry on the original stream stay attached to the page. This lives in the engine tests
+/// because edit and a11y are the same layer and cannot depend on each other.
+#[test]
+fn marking_a_figure_decorative_keeps_other_page_streams() {
+    let figure = "/Figure << /MCID 0 >> BDC 10 10 50 50 re f EMC";
+    let header = "BT (HeaderSample) Tj ET";
+    let added = "BT (AddedSample) Tj ET";
+    let objs = [
+        "<< /Type /Catalog /Pages 2 0 R /MarkInfo << /Marked true >> /StructTreeRoot 7 0 R >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Resources << >> /Contents [4 0 R 5 0 R 6 0 R] /StructParents 0 >>".into(),
+        format!("<< /VendorKey 7 /Length {} >>\nstream\n{figure}\nendstream", figure.len()),
+        format!("<< /PCMark /HeaderFooter /Length {} >>\nstream\n{header}\nendstream", header.len()),
+        format!(
+            "<< /PCMark /Added /PCAdded << /Kind /Text /Rect [70 70 150 100] /Text (AddedSample) /Size 12 >> /Length {} >>\nstream\n{added}\nendstream",
+            added.len()
+        ),
+        "<< /Type /StructTreeRoot /K 8 0 R /ParentTree 10 0 R >>".into(),
+        "<< /Type /StructElem /S /Document /P 7 0 R /K [9 0 R] >>".into(),
+        "<< /Type /StructElem /S /Figure /P 8 0 R /Pg 3 0 R /K 0 >>".into(),
+        "<< /Nums [0 [9 0 R]] >>".into(),
+    ];
+    let mut bytes = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, body) in objs.iter().enumerate() {
+        offsets.push(bytes.len());
+        bytes.extend(format!("{} 0 obj\n{body}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = bytes.len();
+    bytes.extend(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for offset in offsets {
+        bytes.extend(format!("{offset:010} 00000 n \n").as_bytes());
+    }
+    bytes.extend(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    let mut doc = pdfcraft_cos::Document::open(Arc::new(bytes)).unwrap();
+    assert_eq!(pdfcraft_edit::scan_markers(&doc).marks, vec![MarkKind::HeaderFooter]);
+    let before = pdfcraft_edit::scan_markers(&doc);
+    assert_eq!(before.added.len(), 1);
+    a11y::mark_decorative(&mut doc, pdfcraft_cos::ObjRef::new(9, 0)).unwrap();
+    assert!(a11y::figures(&doc).is_empty());
+    let page = &pdfcraft_model::pages(&doc)[0];
+    let contents = page.dict.get(b"Contents").and_then(|c| c.as_array()).unwrap();
+    assert_eq!(contents.len(), 3, "the other streams stay in the page's content list");
+    let stream = |doc: &pdfcraft_cos::Document, n: u32| match &*doc.get(pdfcraft_cos::ObjRef::new(n, 0)) {
+        pdfcraft_cos::Object::Stream(s) => s.clone(),
+        other => panic!("object {n} is {other:?}"),
+    };
+    let figure = stream(&doc, 4);
+    assert_eq!(figure.dict.get(b"VendorKey").and_then(pdfcraft_cos::Object::as_int), Some(7));
+    let drawn = String::from_utf8(figure.decoded().unwrap()).unwrap();
+    assert!(drawn.contains("/Artifact BMC") && !drawn.contains("/MCID 0"), "{drawn}");
+    let header = stream(&doc, 5);
+    assert_eq!(header.dict.name(b"PCMark"), Some(&b"HeaderFooter"[..]));
+    assert!(String::from_utf8(header.decoded().unwrap()).unwrap().contains("HeaderSample"));
+    assert!(stream(&doc, 6).dict.get(b"PCAdded").is_some());
+    let after = pdfcraft_edit::scan_markers(&doc);
+    assert_eq!(after.marks, vec![MarkKind::HeaderFooter]);
+    assert_eq!(after.added.len(), 1);
+    assert_eq!(after.added[0].content, before.added[0].content);
+    assert_eq!(pdfcraft_edit::remove_marks(&mut doc, &[0], MarkKind::HeaderFooter).unwrap(), 1);
+    let left = pdfcraft_model::pages(&doc)[0].dict.get(b"Contents").and_then(|c| c.as_array()).cloned().unwrap();
+    let text: String = left
+        .iter()
+        .filter_map(|o| match &*doc.resolve(o) {
+            pdfcraft_cos::Object::Stream(s) => String::from_utf8(s.decoded().unwrap()).ok(),
+            _ => None,
+        })
+        .collect();
+    assert!(!text.contains("HeaderSample"));
+    assert_eq!(pdfcraft_edit::scan_markers(&doc).added[0].content, before.added[0].content);
+    assert_eq!(stream(&doc, 4).dict.get(b"VendorKey").and_then(pdfcraft_cos::Object::as_int), Some(7));
+}
+
+/// Print as image (Acrobat's Advanced Print Setup): the print-ready PDF carries each page as a
+/// picture, the size of the page, with no text left to search; in grayscale the pictures are
+/// grey. A page used on several sheets is rendered once.
+#[test]
+fn printing_as_image_sends_pictures_instead_of_pages() {
+    let (s, id) = session_with(3);
+    let page_size = (s.get(id).unwrap().info.pages[1].width as f64, s.get(id).unwrap().info.pages[1].height as f64);
+    let settings = print::Settings {
+        pages: vec![1, 2, 1],
+        layout: print::Layout::Size(print::SizeMode::Actual),
+        raster: Some(print::Raster { dpi: 100.0, grayscale: false }),
+        ..Default::default()
+    };
+    let bytes = s.print_pdf(id, &settings).unwrap();
+    let mut s2 = Session::new();
+    let id2 = s2.open("print.pdf", None, Arc::new(bytes.clone()), None).unwrap();
+    assert_eq!(s2.get(id2).unwrap().info.pages.len(), 3, "three sheets, one page each");
+    assert!(page_texts(&s2, id2).iter().all(|t| t.trim().is_empty()), "pictures carry no text");
+    let doc = pdfcraft_cos::Document::open(Arc::new(bytes)).unwrap();
+    let images: Vec<pdfcraft_cos::Dict> = doc
+        .scan_objects()
+        .filter_map(|(_, o)| match &*o {
+            pdfcraft_cos::Object::Stream(st) if st.dict.name(b"Subtype") == Some(b"Image") => Some(st.dict.clone()),
+            _ => None,
+        })
+        .collect();
+    assert_eq!(images.len(), 2, "two distinct pages, each rendered once: {images:?}");
+    // 100 dpi: the picture's pixels match the page size.
+    let w = images.iter().map(|d| d.int(b"Width").unwrap_or(0)).max().unwrap();
+    assert!((w as f64 - page_size.0 * 100.0 / 72.0).abs() <= 1.0, "{w} px for {} pt", page_size.0);
+    assert!(images.iter().all(|d| d.name(b"ColorSpace") == Some(b"DeviceRGB")), "{images:?}");
+    // Grayscale renders the pictures grey (the printer is not merely asked for monochrome).
+    let grey = s.print_pdf(id, &print::Settings { raster: Some(print::Raster { dpi: 72.0, grayscale: true }), ..settings.clone() }).unwrap();
+    let mut s3 = Session::new();
+    let id3 = s3.open("grey.pdf", None, Arc::new(grey), None).unwrap();
+    let mut ex = crate::export::Exporter::new(s3.get(id3).unwrap());
+    let png = ex.png(0, 36.0).unwrap();
+    let img = image::load_from_memory(&png).unwrap().to_rgba8();
+    assert!(img.pixels().all(|p| p[0] == p[1] && p[1] == p[2]), "every pixel grey");
+}
+
+/// A one-page PDF: a JPEG logo (DCTDecode) at the top and a big text title below it.
+fn jpeg_cover_pdf(logo_y: i32) -> Vec<u8> {
+    let mut jpeg = Vec::new();
+    let img = image::RgbImage::from_fn(40, 20, |x, y| image::Rgb([(x * 6) as u8, (y * 12) as u8, 90]));
+    image::codecs::jpeg::JpegEncoder::new(&mut jpeg).encode_image(&img).unwrap();
+    let content = format!(
+        "q 200 0 0 100 72 {logo_y} cm /Im1 Do Q BT /F1 30 Tf 72 580 Td (Annual Report) Tj ET \
+BT /F1 11 Tf 72 500 Td (Body text that is long enough to count as the body size of this page.) Tj ET"
+    );
+    let mut pdf = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    let mut add = |pdf: &mut Vec<u8>, n: usize, body: &[u8]| {
+        offsets.push(pdf.len());
+        pdf.extend_from_slice(format!("{n} 0 obj\n").as_bytes());
+        pdf.extend_from_slice(body);
+        pdf.extend_from_slice(b"\nendobj\n");
+    };
+    add(&mut pdf, 1, b"<< /Type /Catalog /Pages 2 0 R >>");
+    add(&mut pdf, 2, b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>");
+    add(
+        &mut pdf,
+        3,
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> /XObject << /Im1 6 0 R >> >> >>",
+    );
+    add(&mut pdf, 4, format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len()).as_bytes());
+    add(&mut pdf, 5, b"<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>");
+    let mut obj = format!("<< /Type /XObject /Subtype /Image /Width 40 /Height 20 /ColorSpace /DeviceRGB /BitsPerComponent 8 /Filter /DCTDecode /Length {} >>\nstream\n", jpeg.len()).into_bytes();
+    obj.extend_from_slice(&jpeg);
+    obj.extend_from_slice(b"\nendstream");
+    add(&mut pdf, 6, &obj);
+    let xref = pdf.len();
+    pdf.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", offsets.len() + 1).as_bytes());
+    for o in &offsets {
+        pdf.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    pdf.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", offsets.len() + 1).as_bytes());
+    pdf
+}
+
+/// #1936: a JPEG logo on a cover page reaches the Word file as the unchanged JPEG, both where it
+/// sits clear of the title (inline) and where it overlaps it (a positioned page).
+#[test]
+fn exporting_a_jpeg_logo_to_word_keeps_the_image() {
+    for (logo_y, overlaps) in [(650, false), (560, true)] {
+        let pdf = jpeg_cover_pdf(logo_y);
+        let mut s = Session::new();
+        let id = s.open("c.pdf", None, Arc::new(pdf), None).unwrap();
+        let d = s.get(id).unwrap();
+        let pages = d.export_pages();
+        assert_eq!((pages[0].images.len(), pages[0].images[0].ext), (1, "jpg"), "overlap {overlaps}");
+        let jpeg = pages[0].images[0].bytes.clone();
+        assert!(jpeg.starts_with(&[0xFF, 0xD8]));
+        let docx = d.export_office(compare::OfficeFormat::Docx);
+        assert!(docx.windows(21).any(|w| w == b"word/media/image1.jpg"), "overlap {overlaps}");
+        assert!(docx.windows(jpeg.len()).any(|w| w == jpeg.as_slice()), "the JPEG is stored unchanged (overlap {overlaps})");
+    }
+}
+
+/// Cropping an existing page image (Acrobat's crop handles on a picture) shows only the chosen
+/// box, the pixels staying where they are: `visible_rect` says what shows, the full placement is
+/// unchanged, and a later move carries the crop along.
+#[test]
+fn cropping_an_existing_image_clips_it_and_moves_with_it() {
+    let mut s = Session::new();
+    let mut px = image::RgbaImage::new(40, 40);
+    for (x, y, p) in px.enumerate_pixels_mut() {
+        *p = if x < 20 {
+            image::Rgba([255, 0, 0, 255])
+        } else if y < 20 {
+            image::Rgba([0, 255, 0, 255])
+        } else {
+            image::Rgba([0, 0, 255, 255])
+        };
+    }
+    let mut png = std::io::Cursor::new(Vec::new());
+    image::DynamicImage::ImageRgba8(px).write_to(&mut png, image::ImageFormat::Png).unwrap();
+    let pic = s.create_from_images(&[("p.png".into(), png.into_inner())]).unwrap();
+    let id = s.open("p.pdf", None, pic, None).unwrap();
+    let full = s.get(id).unwrap().page_images(0)[0].rect;
+    let (w, h) = (full[2] - full[0], full[3] - full[1]);
+    // Keep the right half, upper part.
+    let keep = [full[0] + w / 2.0, full[1] + h / 2.0, full[2], full[3]];
+    s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Crop(keep) }).unwrap();
+    let d = s.get(id).unwrap();
+    assert_eq!(d.can_undo(), Some("Crop image"));
+    let im = &d.page_images(0)[0];
+    assert_eq!(im.rect, full, "the placement is not scaled");
+    let v = im.visible_rect.expect("clipped");
+    assert!(v.iter().zip(keep.iter()).all(|(a, b)| (a - b).abs() < 0.01), "{v:?} vs {keep:?}");
+    // What shows: the kept quarter is green, the cropped-away quarters are paper.
+    let (pw, ph, rgba) = {
+        let mut ex = crate::export::Exporter::new(d);
+        let png = ex.png(0, 72.0).unwrap();
+        let img = image::load_from_memory(&png).unwrap().to_rgba8();
+        (img.width(), img.height(), img)
+    };
+    let at = |fx: f64, fy: f64| rgba.get_pixel((pw as f64 * fx) as u32, (ph as f64 * fy) as u32).0;
+    let page_h = d.info.pages[0].height as f64;
+    let page_w = d.info.pages[0].width as f64;
+    // Fractions of the page from the top-left: the kept box is the top-right quarter of the image.
+    let fx = |x: f64| x / page_w;
+    let fy = |y: f64| 1.0 - y / page_h;
+    assert_eq!(at(fx(full[0] + 0.75 * w), fy(full[1] + 0.75 * h))[1], 255, "kept green");
+    assert_eq!(at(fx(full[0] + 0.25 * w), fy(full[1] + 0.25 * h)), [255, 255, 255, 255], "cropped-away red is gone");
+    // A move takes the crop along (down and left, so the kept part stays on the page).
+    let to = [full[0] - 10.0, full[1] - 10.0, full[2] - 10.0, full[3] - 10.0];
+    s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Move(to) }).unwrap();
+    let im = &s.get(id).unwrap().page_images(0)[0];
+    let v = im.visible_rect.expect("still clipped");
+    let moved_keep = [keep[0] - 10.0, keep[1] - 10.0, keep[2] - 10.0, keep[3] - 10.0];
+    assert!(v.iter().zip(moved_keep.iter()).all(|(a, b)| (a - b).abs() < 0.01), "{v:?} vs {moved_keep:?}");
+    // Cropping again replaces the earlier crop, so the picture can grow back (Remove crop).
+    let full_now = s.get(id).unwrap().page_images(0)[0].rect;
+    s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Crop(full_now) }).unwrap();
+    let im = &s.get(id).unwrap().page_images(0)[0];
+    let v = im.visible_rect.expect("visible");
+    let page = [0.0, 0.0, page_w, page_h];
+    let shown = [full_now[0].max(page[0]), full_now[1].max(page[1]), full_now[2].min(page[2]), full_now[3].min(page[3])];
+    assert!(v.iter().zip(shown.iter()).all(|(a, b)| (a - b).abs() < 0.01), "{v:?} vs {shown:?}");
+    // No area, or a box off the image, is refused.
+    assert!(s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Crop([10.0, 10.0, 10.0, 50.0]) }).is_err());
+}
diff --git a/crates/engine/src/text_preview.rs b/crates/engine/src/text_preview.rs
index d18016967..d533faf7e 100644
--- a/crates/engine/src/text_preview.rs
+++ b/crates/engine/src/text_preview.rs
@@ -33,6 +33,20 @@ impl TextEditPreview {
 }
 
 impl Document {
+    /// Background for retyping an added text item, without changing its saved content.
+    pub fn added_text_preview(&self, page: usize, index: usize) -> Result<TextEditPreview, String> {
+        guard(|| {
+            if !self.added().iter().filter(|a| a.page == page).nth(index).is_some_and(|a| matches!(a.content, crate::AddedContent::Text(_))) {
+                return Err("the selected added item is not text".into());
+            }
+            let editor = self.editor.as_ref().ok_or("the document can't be read")?;
+            let mut cos = editor.cos.clone();
+            pdfcraft_edit::delete_content(&mut cos, page, index).map_err(|e| e.to_string())?;
+            let bytes = Arc::new(pdfcraft_cos::write_incremental(&cos, &pdfcraft_cos::SaveOptions::default()).map_err(|e| e.to_string())?);
+            Ok(TextEditPreview { page, bytes, config: self.config.clone() })
+        })?
+    }
+
     /// Measure a draft without changing bytes, dirty state, or undo history.
     pub fn text_edit_layout(
         &self,
diff --git a/crates/engine/src/word_count.rs b/crates/engine/src/word_count.rs
new file mode 100644
index 000000000..bd31c27e4
--- /dev/null
+++ b/crates/engine/src/word_count.rs
@@ -0,0 +1,336 @@
+//! Read-only document statistics, processing one page at a time without rasterizing it.
+
+use std::collections::{HashMap, HashSet};
+
+use pdfcraft_cos::{Dict, ObjRef, Object};
+use pdfcraft_render::{PageRenderer, text::TextFilter};
+use unicode_segmentation::UnicodeSegmentation;
+
+use crate::export::ExportSource;
+
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub struct Options {
+    pub exclude_tables: bool,
+    pub exclude_code: bool,
+    /// Figure-marked text and invisible text (including OCR). This does not run OCR.
+    pub exclude_images: bool,
+}
+
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub struct Counts {
+    pub words: usize,
+    /// Unicode scalar values, including whitespace.
+    pub characters: usize,
+    pub characters_without_spaces: usize,
+}
+
+impl Counts {
+    pub fn of(text: &str) -> Self {
+        Self {
+            words: text.unicode_words().count(),
+            characters: text.chars().count(),
+            characters_without_spaces: text.chars().filter(|c| !c.is_whitespace()).count(),
+        }
+    }
+
+    fn add(&mut self, other: Self) {
+        self.words = self.words.saturating_add(other.words);
+        self.characters = self.characters.saturating_add(other.characters);
+        self.characters_without_spaces = self.characters_without_spaces.saturating_add(other.characters_without_spaces);
+    }
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct Report {
+    pub total: Counts,
+    /// Zero-based pages, in the requested order, without duplicates.
+    pub pages: Vec<(usize, Counts)>,
+    pub pages_without_text: usize,
+    /// Some structure could not be classified safely; that text was retained.
+    pub unclassified_structure: bool,
+}
+
+/// Count the current document snapshot. `progress` can cancel between pages. A failed page is
+/// an error, never a successful zero or an unlabelled partial total.
+pub fn count(source: ExportSource, pages: &[usize], options: Options, progress: impl FnMut(usize) -> bool) -> Result<Report, String> {
+    crate::guard(|| count_inner(source, pages, options, progress))?
+}
+
+fn count_inner(source: ExportSource, pages: &[usize], options: Options, mut progress: impl FnMut(usize) -> bool) -> Result<Report, String> {
+    if pages.iter().any(|&page| page >= source.pages) {
+        return Err("the word-count page range is out of bounds".into());
+    }
+    if !progress(0) {
+        return Err("word count cancelled".into());
+    }
+    let (mut excluded, unclassified) = if options != Options::default() { exclusions(&source, options)? } else { (HashMap::new(), false) };
+    let mut renderer = PageRenderer::new(source.bytes, source.config);
+    let mut report = Report { unclassified_structure: unclassified, ..Report::default() };
+    let mut seen = HashSet::new();
+    for &page in pages {
+        if !seen.insert(page) {
+            continue;
+        }
+        if !progress(report.pages.len()) {
+            return Err("word count cancelled".into());
+        }
+        let filter = TextFilter {
+            tables: options.exclude_tables,
+            code: options.exclude_code,
+            images: options.exclude_images,
+            mcids: excluded.remove(&page).unwrap_or_default(),
+        };
+        let text = renderer.filtered_text(page, filter).map_err(|e| format!("page {}: {e}", page.saturating_add(1)))?.plain_text();
+        let counts = Counts::of(&text);
+        report.pages_without_text += usize::from(text.trim().is_empty());
+        report.total.add(counts);
+        report.pages.push((page, counts));
+    }
+    if !progress(report.pages.len()) {
+        return Err("word count cancelled".into());
+    }
+    Ok(report)
+}
+
+fn excluded_role(role: &[u8], options: Options) -> bool {
+    (options.exclude_tables && matches!(role, b"Table" | b"TR" | b"TD" | b"TH" | b"THead" | b"TBody" | b"TFoot"))
+        || (options.exclude_code && role == b"Code")
+        || (options.exclude_images && role == b"Figure")
+}
+
+fn standard_role(doc: &pdfcraft_cos::Document, map: &Dict, role: &[u8]) -> Vec<u8> {
+    let mut role = role.to_vec();
+    for _ in 0..32 {
+        let Some(next) = map.get(&role).map(|o| doc.resolve(o)).and_then(|o| o.as_name().map(<[u8]>::to_vec)) else { break };
+        if next == role {
+            break;
+        }
+        role = next;
+    }
+    role
+}
+
+type Exclusions = HashMap<usize, HashSet<i32>>;
+
+/// Resolve page-local MCIDs through the structure hierarchy, including inherited roles and
+/// RoleMap aliases. Form XObjects have a separate MCID namespace that the text device does not
+/// expose: retain their page's MCID-tagged text instead of excluding an unrelated same-numbered
+/// span. Explicit Table/Code/Figure marked-content tags still work on those pages.
+fn exclusions(source: &ExportSource, options: Options) -> Result<(Exclusions, bool), String> {
+    let doc = pdfcraft_cos::Document::open_with_password(source.bytes.clone(), source.config.password.as_deref()).map_err(|e| e.to_string())?;
+    let catalog = doc.root().and_then(|id| doc.get(id).as_dict().cloned()).unwrap_or_default();
+    let Some(root) = catalog.get(b"StructTreeRoot").map(|o| doc.resolve(o)).and_then(|o| o.as_dict().cloned()) else {
+        return Ok((HashMap::new(), options.exclude_tables || options.exclude_code));
+    };
+    let roles = root.get(b"RoleMap").map(|o| doc.resolve(o)).and_then(|o| o.as_dict().cloned()).unwrap_or_default();
+    let pages = pdfcraft_model::pages(&doc);
+    let page_index: HashMap<_, _> = pages.iter().enumerate().map(|(index, page)| (page.obj, index)).collect();
+    let mut stack = root.get(b"K").map(|k| vec![(k.clone(), None::<ObjRef>, false, 0usize)]).unwrap_or_default();
+    let mut seen = HashSet::new();
+    let mut out: Exclusions = HashMap::new();
+    let mut unclassified = false;
+    let mut visited = 0usize;
+    while let Some((object, page, excluded, depth)) = stack.pop() {
+        visited += 1;
+        if visited > 100_000 || depth > 128 {
+            unclassified = true;
+            break;
+        }
+        if let Some(id) = object.as_ref()
+            && !seen.insert(id)
+        {
+            unclassified = true;
+            continue;
+        }
+        let object = doc.resolve(&object);
+        let mut keep = |id: i64, page: Option<ObjRef>| {
+            if excluded {
+                if let Some((page, id)) = page.and_then(|p| page_index.get(&p).copied()).zip(i32::try_from(id).ok().filter(|id| *id >= 0)) {
+                    out.entry(page).or_default().insert(id);
+                } else {
+                    unclassified = true;
+                }
+            }
+        };
+        match &*object {
+            Object::Int(id) => keep(*id, page),
+            Object::Array(items) => {
+                if stack.len().saturating_add(items.len()) > 100_000 {
+                    unclassified = true;
+                    break;
+                }
+                stack.extend(items.iter().rev().map(|child| (child.clone(), page, excluded, depth + 1)));
+            }
+            Object::Dict(dict) => {
+                let page = dict.get(b"Pg").and_then(Object::as_ref).or(page);
+                if dict.contains(b"Stm") {
+                    unclassified = true;
+                } else if let Some(id) = dict.get(b"MCID").and_then(Object::as_int) {
+                    keep(id, page);
+                } else if let Some(kids) = dict.get(b"K") {
+                    let excluded = excluded || dict.name(b"S").is_some_and(|role| excluded_role(&standard_role(&doc, &roles, role), options));
+                    stack.push((kids.clone(), page, excluded, depth + 1));
+                }
+            }
+            _ => {}
+        }
+    }
+    for (index, page) in pages.iter().enumerate() {
+        if !out.contains_key(&index) {
+            continue;
+        }
+        let resources = page.dict.get(b"Resources").map(|o| doc.resolve(o));
+        let objects = resources.as_ref().and_then(|o| o.as_dict()).and_then(|d| d.get(b"XObject")).map(|o| doc.resolve(o));
+        let has_form = objects.as_ref().and_then(|o| o.as_dict()).is_some_and(|d| {
+            d.iter().any(|(_, value)| matches!(&*doc.resolve(value), Object::Stream(s) if s.dict.name(b"Subtype") == Some(b"Form")))
+        });
+        if has_form {
+            out.remove(&index);
+            unclassified = true;
+        }
+    }
+    Ok((out, unclassified))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn source(bodies: &[&str], structure: &str) -> ExportSource {
+        let kids = (0..bodies.len()).map(|i| format!("{} 0 R", 4 + i * 2)).collect::<Vec<_>>().join(" ");
+        let mut objects = vec![
+            format!("<< /Type /Catalog /Pages 2 0 R {structure} >>"),
+            format!("<< /Type /Pages /Kids [{kids}] /Count {} /MediaBox [0 0 200 300] >>", bodies.len()),
+            "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".into(),
+        ];
+        for (i, body) in bodies.iter().enumerate() {
+            objects.push(format!("<< /Type /Page /Parent 2 0 R /Contents {} 0 R /Resources << /Font << /F1 3 0 R >> >> >>", 5 + i * 2));
+            objects.push(format!("<< /Length {} >>\nstream\n{body}\nendstream", body.len()));
+        }
+        let mut bytes = b"%PDF-1.7\n".to_vec();
+        let mut offsets = Vec::new();
+        for (i, object) in objects.iter().enumerate() {
+            offsets.push(bytes.len());
+            bytes.extend_from_slice(format!("{} 0 obj\n{object}\nendobj\n", i + 1).as_bytes());
+        }
+        let xref = bytes.len();
+        bytes.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objects.len() + 1).as_bytes());
+        for offset in offsets {
+            bytes.extend_from_slice(format!("{offset:010} 00000 n \n").as_bytes());
+        }
+        bytes.extend_from_slice(format!("trailer\n<< /Root 1 0 R /Size {} >>\nstartxref\n{xref}\n%%EOF\n", objects.len() + 1).as_bytes());
+        ExportSource { bytes: std::sync::Arc::new(bytes), config: Default::default(), pages: bodies.len(), sizes: vec![(200.0, 300.0); bodies.len()] }
+    }
+
+    const MARKED: &str = "BT /F1 12 Tf 10 270 Td (Body words) Tj ET
+        /Table BMC BT /F1 12 Tf 10 240 Td (Table words) Tj ET EMC
+        /Code BMC BT /F1 12 Tf 10 210 Td (Code words) Tj ET EMC
+        /Figure BMC BT /F1 12 Tf 10 180 Td (Figure words) Tj ET EMC
+        BT /F1 12 Tf 3 Tr 10 150 Td (OCR words) Tj ET";
+
+    #[test]
+    fn word_count_filters_are_independent_and_do_not_change_normal_extraction() {
+        let src = source(&[MARKED], "");
+        for (options, expected) in [
+            (Options::default(), 10),
+            (Options { exclude_tables: true, ..Options::default() }, 8),
+            (Options { exclude_code: true, ..Options::default() }, 8),
+            (Options { exclude_images: true, ..Options::default() }, 6),
+            (Options { exclude_tables: true, exclude_code: true, exclude_images: true }, 2),
+        ] {
+            assert_eq!(count(src.clone(), &[0], options, |_| true).unwrap().total.words, expected);
+        }
+        let mut renderer = PageRenderer::new(src.bytes, src.config);
+        assert_eq!(Counts::of(&renderer.filtered_text(0, TextFilter::default()).unwrap().plain_text()).words, 10);
+        assert_eq!(renderer.stats().rasterizations, 0);
+    }
+
+    #[test]
+    fn word_count_resolves_structure_roles_and_page_local_mcids() {
+        let body = "BT /F1 12 Tf 10 260 Td (Body words) Tj ET /Span << /MCID 0 >> BDC BT /F1 12 Tf 10 220 Td (Tagged words) Tj ET EMC";
+        let src = source(
+            &[body, body],
+            "/StructTreeRoot << /RoleMap << /Grid /Table >> /K [<< /S /Grid /Pg 4 0 R /K << /S /Span /K 0 >> >> << /S /Code /Pg 6 0 R /K << /Type /MCR /MCID 0 >> >>] >>",
+        );
+        let tables = count(src.clone(), &[0, 1], Options { exclude_tables: true, ..Options::default() }, |_| true).unwrap();
+        assert_eq!(tables.pages.iter().map(|(_, c)| c.words).collect::<Vec<_>>(), vec![2, 4]);
+        assert!(!tables.unclassified_structure);
+        let code = count(src, &[1, 0], Options { exclude_code: true, ..Options::default() }, |_| true).unwrap();
+        assert_eq!(code.pages.iter().map(|(_, c)| c.words).collect::<Vec<_>>(), vec![2, 4]);
+    }
+
+    #[test]
+    fn word_count_handles_empty_duplicate_invalid_and_cancelled_ranges() {
+        let src = source(&["BT /F1 12 Tf 10 220 Td (Two words) Tj ET", ""], "");
+        let report = count(src.clone(), &[1, 0, 1], Options::default(), |_| true).unwrap();
+        assert_eq!(report.total.words, 2);
+        assert_eq!(report.pages.len(), 2);
+        assert_eq!(report.pages_without_text, 1);
+        assert_eq!(count(src.clone(), &[], Options::default(), |_| true).unwrap().total, Counts::default());
+        assert!(count(src.clone(), &[2], Options::default(), |_| true).unwrap_err().contains("bounds"));
+        assert!(count(src.clone(), &[0, 1], Options::default(), |done| done < 1).unwrap_err().contains("cancelled"));
+        let invalid = ExportSource { bytes: std::sync::Arc::new(b"not a PDF".to_vec()), ..src };
+        assert!(count(invalid, &[0], Options::default(), |_| true).is_err());
+    }
+
+    #[test]
+    fn word_count_actual_text_cannot_reintroduce_excluded_words() {
+        let all = source(&["/Span << /ActualText (OCR words) >> BDC BT /F1 12 Tf 3 Tr 10 220 Td (xx) Tj ET EMC"], "");
+        let images = Options { exclude_images: true, ..Options::default() };
+        assert_eq!(count(all.clone(), &[0], Options::default(), |_| true).unwrap().total.words, 2);
+        assert_eq!(count(all, &[0], images, |_| true).unwrap().total.words, 0);
+        let mixed = source(
+            &[
+                "/Span << /ActualText (Body and code) >> BDC BT /F1 12 Tf 10 220 Td (body) Tj ET /Code BMC BT /F1 12 Tf 50 220 Td (code) Tj ET EMC EMC",
+            ],
+            "",
+        );
+        assert_eq!(count(mixed.clone(), &[0], Options::default(), |_| true).unwrap().total.words, 3);
+        assert!(count(mixed, &[0], Options { exclude_code: true, ..Options::default() }, |_| true).unwrap_err().contains("replacement text"));
+    }
+
+    #[test]
+    fn word_count_cyclic_structure_is_bounded_and_reported() {
+        // The structure reaches the catalog again instead of a structure child.
+        let src = source(&[MARKED], "/StructTreeRoot << /K << /S /Table /Pg 4 0 R /K [0 1 0 R] >> >> /K 1 0 R");
+        let report = count(src, &[0], Options { exclude_tables: true, ..Options::default() }, |_| true).unwrap();
+        assert!(report.unclassified_structure);
+    }
+
+    #[test]
+    fn word_count_retains_form_namespaces_and_reports_the_limitation() {
+        let body = "/Span << /MCID 0 >> BDC BT /F1 12 Tf 10 220 Td (Page words) Tj ET EMC /Fm Do";
+        let mut src = source(&[body], "/StructTreeRoot << /K << /S /Table /Pg 4 0 R /K 0 >> >>");
+        let mut doc = pdfcraft_cos::Document::open(src.bytes.clone()).unwrap();
+        let page = ObjRef::new(4, 0);
+        let mut resources = doc.get(page).as_dict().unwrap().get(b"Resources").unwrap().as_dict().unwrap().clone();
+        let mut form = Dict::new();
+        form.set(b"Type".to_vec(), Object::Name(b"XObject".to_vec()));
+        form.set(b"Subtype".to_vec(), Object::Name(b"Form".to_vec()));
+        form.set(b"BBox".to_vec(), Object::Array(vec![0.into(), 0.into(), 200.into(), 300.into()]));
+        form.set(b"Resources".to_vec(), resources.clone());
+        let form = doc.add(pdfcraft_cos::Stream::from_raw(form, b"/Span << /MCID 0 >> BDC BT /F1 12 Tf 10 180 Td (Form words) Tj ET EMC".to_vec()));
+        let mut objects = Dict::new();
+        objects.set(b"Fm".to_vec(), form);
+        resources.set(b"XObject".to_vec(), objects);
+        // Inherit resources from the page tree too.
+        doc.update_dict(page, |d| {
+            d.remove(b"Resources");
+        })
+        .unwrap();
+        doc.update_dict(ObjRef::new(2, 0), |d| d.set(b"Resources".to_vec(), resources)).unwrap();
+        src.bytes = std::sync::Arc::new(pdfcraft_cos::write_full(&doc, &Default::default()).unwrap());
+        let report = count(src, &[0], Options { exclude_tables: true, ..Options::default() }, |_| true).unwrap();
+        assert_eq!(report.total.words, 4, "the unrelated form's MCID must not be excluded");
+        assert!(report.unclassified_structure);
+    }
+
+    #[test]
+    fn unicode_words_ignore_punctuation_and_keep_apostrophes() {
+        assert_eq!(Counts::of("Hello, Welt! don't … 123").words, 4);
+        assert_eq!(Counts::of("Привет мир").words, 2);
+        assert_eq!(Counts::of("\t \n...").words, 0);
+        assert_eq!(Counts::of("ä b").characters, 3);
+        assert_eq!(Counts::of("ä b").characters_without_spaces, 2);
+    }
+}
diff --git a/crates/export/src/lib.rs b/crates/export/src/lib.rs
index 52836a05c..16dd2b06d 100644
--- a/crates/export/src/lib.rs
+++ b/crates/export/src/lib.rs
@@ -520,6 +520,36 @@ fn layout_number(n: f64) -> f64 {
     if n.is_finite() { n.clamp(-1584.0, 1584.0) } else { 0.0 }
 }
 
+/// Most images a Word export embeds, and most image bytes (the zip writer has 32-bit sizes and
+/// a 16-bit entry count; a hostile PDF must not be able to overflow them).
+const MAX_MEDIA: usize = 1000;
+const MAX_MEDIA_BYTES: usize = 512 << 20;
+
+/// Whether `im` can still be embedded: it has data, and the package stays within its limits.
+fn room_for(media: &[(String, &Image)], im: &Image) -> bool {
+    !im.bytes.is_empty()
+        && media.len() < MAX_MEDIA
+        && media.iter().map(|(_, m)| m.bytes.len()).fold(im.bytes.len(), usize::saturating_add) <= MAX_MEDIA_BYTES
+}
+
+/// Points as EMU (12700 per point); non-finite values are 0.
+fn emu(pt: f64) -> i64 {
+    if pt.is_finite() { (pt * 12700.0).round() as i64 } else { 0 }
+}
+
+/// The `a:graphic` of one picture (DrawingML), rotated by `rotation` degrees when given.
+fn picture_xml(n: usize, name: &str, (cx, cy): (i64, i64), rotation: Option<f64>) -> String {
+    let rot = rotation.map_or(String::new(), |r| format!(" rot=\"{}\"", (r * 60000.0).round() as i64));
+    format!(
+        "<wp:docPr id=\"{n}\" name=\"Picture {n}\"/><wp:cNvGraphicFramePr/>\
+<a:graphic xmlns:a=\"http://schemas.openxmlformats.org/drawingml/2006/main\"><a:graphicData uri=\"http://schemas.openxmlformats.org/drawingml/2006/picture\">\
+<pic:pic xmlns:pic=\"http://schemas.openxmlformats.org/drawingml/2006/picture\"><pic:nvPicPr><pic:cNvPr id=\"{n}\" name=\"{name}\"/><pic:cNvPicPr/></pic:nvPicPr>\
+<pic:blipFill><a:blip r:embed=\"rIdImg{n}\"/><a:stretch><a:fillRect/></a:stretch></pic:blipFill>\
+<pic:spPr><a:xfrm{rot}><a:off x=\"0\" y=\"0\"/><a:ext cx=\"{cx}\" cy=\"{cy}\"/></a:xfrm><a:prstGeom prst=\"rect\"><a:avLst/></a:prstGeom></pic:spPr></pic:pic>\
+</a:graphicData></a:graphic>"
+    )
+}
+
 fn positioned_page<'a>(page: &'a Page, media: &mut Vec<(String, &'a Image)>, shape_id: &mut usize) -> String {
     // One 1 pt paragraph anchors the whole page. Shapes never reserve body space, so even a
     // page-sized watermark cannot push the invoice footer onto another page.
@@ -552,13 +582,31 @@ fn positioned_page<'a>(page: &'a Page, media: &mut Vec<(String, &'a Image)>, sha
         ));
     }
     for im in &page.images {
+        if !room_for(media, im) {
+            continue;
+        }
         *shape_id = shape_id.saturating_add(1);
         let n = media.len().saturating_add(1);
         let (w, h) = (layout_number(im.size[0]).max(1.0), layout_number(im.size[1]).max(1.0));
         let (x, y) = (layout_number((im.rect[0] + im.rect[2] - w) / 2.0), layout_number(page.height - (im.rect[1] + im.rect[3] + h) / 2.0));
         let rotation = layout_number(-im.rotation).rem_euclid(360.0);
-        s.push_str(&format!("<w:r><w:pict><v:rect id=\"Image{shape_id}\" style=\"position:absolute;margin-left:{x:.3}pt;margin-top:{y:.3}pt;width:{w:.3}pt;height:{h:.3}pt;rotation:{rotation:.3};z-index:-1;mso-position-horizontal-relative:page;mso-position-vertical-relative:page\" stroked=\"f\"><v:imagedata r:id=\"rIdImg{n}\"/><w10:wrap type=\"none\"/></v:rect></w:pict></w:r>"));
-        media.push((format!("image{n}.{}", im.ext), im));
+        let name = format!("image{n}.{}", im.ext);
+        let pic = picture_xml(n, &name, (emu(w), emu(h)), Some(rotation));
+        // A DrawingML anchor, the way Word itself stores a picture placed behind text: a VML
+        // rectangle with an image does not show the picture.
+        s.push_str(&format!(
+            "<w:r><w:drawing><wp:anchor distT=\"0\" distB=\"0\" distL=\"0\" distR=\"0\" simplePos=\"0\" relativeHeight=\"{}\" behindDoc=\"1\" locked=\"0\" layoutInCell=\"1\" allowOverlap=\"1\">\
+<wp:simplePos x=\"0\" y=\"0\"/><wp:positionH relativeFrom=\"page\"><wp:posOffset>{}</wp:posOffset></wp:positionH><wp:positionV relativeFrom=\"page\"><wp:posOffset>{}</wp:posOffset></wp:positionV>\
+<wp:extent cx=\"{}\" cy=\"{}\"/><wp:effectExtent l=\"0\" t=\"0\" r=\"0\" b=\"0\"/><wp:wrapNone/>",
+            n.saturating_add(1),
+            emu(x),
+            emu(y),
+            emu(w),
+            emu(h),
+        ));
+        s.push_str(&pic);
+        s.push_str("</wp:anchor></w:drawing></w:r>");
+        media.push((name, im));
     }
     s.push_str("</w:p>");
     s
@@ -612,21 +660,18 @@ pub fn docx(pages: &[Page], title: &str) -> Vec<u8> {
                         body.push_str(&docx_table(t));
                     }
                     Item::Img(im) => {
-                        let n = media.len() + 1;
-                        let name = format!("image{n}.{}", im.ext);
-                        // Size on the page, in EMU (12700 per point), at most the text width.
-                        let (w, h) = ((im.rect[2] - im.rect[0]).max(1.0), (im.rect[3] - im.rect[1]).max(1.0));
-                        let k = (text_w / w).min(1.0);
-                        let (cx, cy) = ((w * k * 12700.0) as i64, (h * k * 12700.0) as i64);
-                        body.push_str(&format!(
-                    "<w:p><w:r><w:drawing><wp:inline><wp:extent cx=\"{cx}\" cy=\"{cy}\"/><wp:docPr id=\"{n}\" name=\"Picture {n}\"/>\
-<a:graphic xmlns:a=\"http://schemas.openxmlformats.org/drawingml/2006/main\"><a:graphicData uri=\"http://schemas.openxmlformats.org/drawingml/2006/picture\">\
-<pic:pic xmlns:pic=\"http://schemas.openxmlformats.org/drawingml/2006/picture\"><pic:nvPicPr><pic:cNvPr id=\"{n}\" name=\"{name}\"/><pic:cNvPicPr/></pic:nvPicPr>\
-<pic:blipFill><a:blip r:embed=\"rIdImg{n}\"/><a:stretch><a:fillRect/></a:stretch></pic:blipFill>\
-<pic:spPr><a:xfrm><a:off x=\"0\" y=\"0\"/><a:ext cx=\"{cx}\" cy=\"{cy}\"/></a:xfrm><a:prstGeom prst=\"rect\"><a:avLst/></a:prstGeom></pic:spPr></pic:pic>\
-</a:graphicData></a:graphic></wp:inline></w:drawing></w:r></w:p>"
-                ));
-                        media.push((name, im));
+                        if room_for(&media, im) {
+                            let n = media.len() + 1;
+                            let name = format!("image{n}.{}", im.ext);
+                            // Size on the page, at most the text width.
+                            let (w, h) = ((im.rect[2] - im.rect[0]).max(1.0), (im.rect[3] - im.rect[1]).max(1.0));
+                            let k = (text_w / w).min(1.0);
+                            let (cx, cy) = (emu(w * k), emu(h * k));
+                            body.push_str(&format!("<w:p><w:r><w:drawing><wp:inline><wp:extent cx=\"{cx}\" cy=\"{cy}\"/>"));
+                            body.push_str(&picture_xml(n, &name, (cx, cy), None));
+                            body.push_str("</wp:inline></w:drawing></w:r></w:p>");
+                            media.push((name, im));
+                        }
                     }
                     Item::PageBreak => body.push_str("<w:p><w:r><w:br w:type=\"page\"/></w:r></w:p>"),
                 }
@@ -907,8 +952,9 @@ mod tests {
         assert!(xml.contains("margin-left:72.000pt;margin-top:160.000pt"), "Meter field keeps its source position: {xml}");
         let watermark = xml.split(">DRAFT</w:t>").next().unwrap().rsplit("<v:rect ").next().unwrap();
         assert!(watermark.contains("z-index:-2"), "watermark is behind foreground graphics");
-        let image = xml.split("<v:imagedata ").next().unwrap().rsplit("<v:rect ").next().unwrap();
-        assert!(image.contains("z-index:-1"), "foreground graphics cover the watermark");
+        // The picture is a DrawingML anchor behind the text (a VML rectangle shows no picture in Word).
+        assert!(!xml.contains("<v:imagedata"), "{xml}");
+        assert!(xml.contains("<wp:anchor ") && xml.contains("behindDoc=\"1\"") && xml.contains("<a:blip r:embed=\"rIdImg1\"/>"), "{xml}");
     }
 
     #[test]
@@ -1165,4 +1211,42 @@ mod tests {
         let h = html(&[p], "Paper");
         assert!(!h.contains("<table>"), "tall two-column text must stay paragraphs: {h}");
     }
+
+    /// #1936: every picture Word is told to draw (`r:embed`) names a relationship whose target is a
+    /// file in the package, with a content type; JPEG pictures too, inline or placed.
+    #[test]
+    fn word_pictures_resolve_to_media_in_the_package() {
+        let jpeg = Image { ext: "jpg", bytes: vec![0xFF, 0xD8, 0xFF, 0xD9], ..page().images[0].clone() };
+        for placed in [false, true] {
+            let mut p = page();
+            p.images = vec![jpeg.clone()];
+            if placed {
+                p.images[0].rect = [72.0, 640.0, 272.0, 790.0];
+                p.blocks[0].rect = [72.0, 700.0, 300.0, 760.0];
+            }
+            let zip = docx(&[p], "T");
+            let xml = part(&zip, "word/document.xml");
+            assert_eq!(xml.contains("<wp:anchor "), placed, "{xml}");
+            let rels = part(&zip, "word/_rels/document.xml.rels");
+            let embed = xml.split("r:embed=\"").nth(1).and_then(|r| r.split('"').next()).unwrap();
+            let rel = rels.split(&format!("Id=\"{embed}\"")).nth(1).unwrap();
+            assert!(rel.contains("relationships/image\""), "{rels}");
+            let target = rel.split("Target=\"").nth(1).and_then(|t| t.split('"').next()).unwrap();
+            assert_eq!(target, "media/image1.jpg");
+            assert!(zip.windows(21).any(|w| w == b"word/media/image1.jpg"));
+            assert!(part(&zip, "[Content_Types].xml").contains("Extension=\"jpg\" ContentType=\"image/jpeg\""));
+            assert!(xml.matches("<wp:docPr ").count() == 1 && !xml.contains("<v:imagedata"));
+        }
+    }
+
+    #[test]
+    fn word_export_bounds_the_number_of_pictures_and_skips_empty_ones() {
+        let mut p = page();
+        let one = p.images[0].clone();
+        p.images = vec![Image { bytes: Vec::new(), ..one.clone() }];
+        p.images.extend(std::iter::repeat_n(one, MAX_MEDIA + 10));
+        let zip = docx(&[p], "T");
+        let rels = part(&zip, "word/_rels/document.xml.rels");
+        assert_eq!(rels.matches("relationships/image\"").count(), MAX_MEDIA);
+    }
 }
diff --git a/crates/fonts/README.md b/crates/fonts/README.md
index 76fd89dd8..36b305bd9 100644
--- a/crates/fonts/README.md
+++ b/crates/fonts/README.md
@@ -4,9 +4,11 @@ Layer L2. Font helpers for the appearance streams PdfCraft generates (comments,
 
 Today it holds what generated appearances need without a font program:
 
-- `helvetica_width`: an approximation of Helvetica's proportions by character class. No metrics
-  file or font program from any vendor is bundled; widths are PdfCraft's own estimates, good
-  enough for line breaking and alignment, not for typesetting.
+- `helvetica_width`: the **exact** standard-14 advance widths, via `Std14::Helvetica`. It was an
+  estimate by character class until the generated tables landed; those tables are Adobe-authored
+  non-visual technical data, the item `AGENTS.md` §1.1 permits, carried in `std14_metrics.rs` with
+  `adobe_data = true` in `ATTRIBUTION.toml`. **No font program or typeface from any vendor is
+  bundled** — widths and encodings only. Reach for `Std14` directly for any other face.
 - `wrap`: greedy line breaking with that measure (paragraphs on newlines, long words split).
 - `win_ansi`: Unicode → WinAnsiEncoding bytes (`?` for characters it can't represent), and
   `literal` to write bytes as a PDF literal string. Nothing writes that `?` silently. Callers
@@ -35,6 +37,9 @@ set). Without that variable `CRAFT_FONTS` is empty and everything below copes:
   Hebrew interface text, and the face whose outlines become the Type 3 fallback for Hebrew text
   written by Edit text (Bold when asked for and present, else Regular). `None` without a
   craft-fonts input that has one; the editor then reports a clear error.
+- `shape_hebrew` / `hebrew_has`: the Regular `Hebr` face shaped with harfrust for Hebrew Add
+  Text content, one cluster per letter with its points and cantillation marks (positioned by the
+  face), drawn by the same Type 3 writer as Arabic and Thai. `GlyphError::NoFont` without the face.
 - `document_japanese_font` / `japanese_glyph`: the face (Shippori Mincho, then BIZ UDMincho) whose
   outlines become the Type 3 fallback font for Japanese text written into PDFs. Without it,
   `japanese_glyph` returns `GlyphError::NoFont` and the editor reports a clear error.
diff --git a/crates/fonts/src/embedding.rs b/crates/fonts/src/embedding.rs
index fbd361e8b..84801d5fd 100644
--- a/crates/fonts/src/embedding.rs
+++ b/crates/fonts/src/embedding.rs
@@ -172,6 +172,10 @@ pub fn embed_mapping(
     if name.is_empty() || name.len() > 128 {
         return Err("the font family name is invalid".into());
     }
+    let glyph_map = if cff { cid_encoding.as_bytes() } else { gids.as_slice() };
+    if let Some(resource) = same_resource(doc, fonts, &name, bytes, glyph_map, cmap.as_bytes()) {
+        return Ok(resource);
+    }
     let mut descriptor = Dict::new();
     descriptor.set(b"Type".to_vec(), Object::name("FontDescriptor"));
     descriptor.set(b"FontName".to_vec(), Object::name(&name));
@@ -187,10 +191,13 @@ pub fn embed_mapping(
         b"FontBBox".to_vec(),
         Object::Array([bounds.x_min, bounds.y_min, bounds.x_max, bounds.y_max].map(|v| Object::Real(f64::from(v) * scale)).to_vec()),
     );
-    // Reuse a full program registered on another page; source subset programs stay untouched.
-    let existing = doc.scan_objects().take(8192).find_map(|(r, o)| match o.as_ref() {
-        Object::Stream(s) if s.dict.get(b"PCFullFont").is_some() && s.raw.as_ref() == bytes => Some(Object::Ref(r)),
-        _ => None,
+    // Reuse the program another resource of this page already has, else one registered on another
+    // page; source subset programs stay untouched.
+    let existing = written(doc, fonts).find(|w| w.has_program(doc, bytes)).map(|w| w.program).or_else(|| {
+        doc.scan_objects().take(8192).find_map(|(r, o)| match o.as_ref() {
+            Object::Stream(s) if s.dict.get(b"PCFullFont").is_some() && s.raw.as_ref() == bytes => Some(Object::Ref(r)),
+            _ => None,
+        })
     });
     let program = existing.unwrap_or_else(|| {
         let mut d = Dict::new();
@@ -239,6 +246,58 @@ pub fn embed_mapping(
     Ok(resource)
 }
 
+/// The decoded data of the stream `object` refers to.
+fn stream_data(doc: &Document, object: Option<&Object>) -> Option<Vec<u8>> {
+    match doc.resolve(object?).as_ref() {
+        Object::Stream(s) => s.decoded_within(17 << 20).ok(),
+        _ => None,
+    }
+}
+
+/// A `PCFull` resource that [`embed_mapping`] wrote.
+struct Written {
+    resource: String,
+    top: Dict,
+    cid: Dict,
+    /// The reference to its full program.
+    program: Object,
+}
+
+impl Written {
+    /// Whether its program is `bytes`. The length it was written with is compared before decoding.
+    fn has_program(&self, doc: &Document, bytes: &[u8]) -> bool {
+        let Object::Stream(s) = doc.resolve(&self.program).as_ref().clone() else { return false };
+        s.dict.get(b"PCFullFont").is_some()
+            && s.dict.get(b"Length1").and_then(|l| doc.resolve(l).as_int()) == i64::try_from(bytes.len()).ok()
+            && s.decoded_within(17 << 20).is_ok_and(|data| data == bytes)
+    }
+}
+
+/// The `PCFull` resources in `fonts`, in order.
+fn written<'a>(doc: &'a Document, fonts: &'a Dict) -> impl Iterator<Item = Written> + 'a {
+    fonts.iter().filter(|(key, _)| key.starts_with(b"PCFull")).take(256).filter_map(move |(key, value)| {
+        let top = doc.dict(value)?;
+        let cid = doc.dict(doc.resolve(top.get(b"DescendantFonts")?).as_array()?.first()?)?;
+        let descriptor = doc.dict(cid.get(b"FontDescriptor")?)?;
+        let program = descriptor.get(b"FontFile2").or_else(|| descriptor.get(b"FontFile3")).filter(|p| matches!(p, Object::Ref(_)))?.clone();
+        Some(Written { resource: String::from_utf8_lossy(key).into_owned(), top, cid, program })
+    })
+}
+
+/// A resource in `fonts` that already is this embedding: the same font name, program, glyph map
+/// and Unicode map. Editing the same text again reuses it instead of adding another copy.
+fn same_resource(doc: &Document, fonts: &Dict, name: &str, bytes: &[u8], glyph_map: &[u8], unicode: &[u8]) -> Option<String> {
+    written(doc, fonts)
+        .find(|w| {
+            let glyphs = w.cid.get(b"CIDToGIDMap").or_else(|| w.top.get(b"Encoding"));
+            w.top.name(b"BaseFont") == Some(name.as_bytes())
+                && stream_data(doc, w.top.get(b"ToUnicode")).is_some_and(|d| d == unicode)
+                && stream_data(doc, glyphs).is_some_and(|d| d == glyph_map)
+                && w.has_program(doc, bytes)
+        })
+        .map(|w| w.resource)
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -274,4 +333,50 @@ mod tests {
         assert_eq!(doc.scan_objects().filter(|(_, o)| matches!(o.as_ref(), Object::Stream(s) if s.dict.get(b"PCFullFont").is_some())).count(), 1);
         assert_eq!(face_key("ABCDEF+Droid-Sans-Fallback"), face_key("Droid Sans Fallback"));
     }
+
+    #[test]
+    fn embedding_the_same_text_again_reuses_its_resource_and_program() {
+        let bytes = include_bytes!("../../../assets/fonts/Inter-Regular.ttf");
+        let face = FontRef::new(bytes).unwrap();
+        let glyph = |c| face.charmap().map(c).unwrap();
+        let programs = |doc: &Document| {
+            doc.scan_objects().filter(|(_, o)| matches!(o.as_ref(), Object::Stream(s) if s.dict.get(b"PCFullFont").is_some())).count()
+        };
+        // Objects before the program push it past the first 8192 that the document-wide search reads.
+        let mut doc = Document::new_empty();
+        for _ in 0..9000 {
+            doc.add(Object::Null);
+        }
+        let mut fonts = Dict::new();
+        let full = embed(&mut doc, &mut fonts, bytes, "Inter").unwrap();
+        let objects = doc.scan_objects().count();
+        assert_eq!(embed(&mut doc, &mut fonts, bytes, "Inter").unwrap(), full, "the same embedding is the same resource");
+        let shaped = [("fi".to_string(), glyph('f')), ("é".to_string(), glyph('é'))];
+        let first = embed_mapping(&mut doc, &mut fonts, bytes, "Inter", &shaped).unwrap();
+        assert_ne!(first, full, "another mapping is another resource");
+        assert_eq!(embed_mapping(&mut doc, &mut fonts, bytes, "Inter", &shaped).unwrap(), first);
+        assert_eq!(embed_mapping(&mut doc, &mut fonts, bytes, "Inter", &shaped[..1]).map(|r| r != first), Ok(true), "a different mapping");
+        assert_eq!(programs(&doc), 1, "one program for every mapping");
+        assert_eq!(fonts.iter().count(), 3);
+        assert!(doc.scan_objects().count() > objects);
+        // Another writer may have compressed the streams since; the page still recognises them.
+        for (r, o) in doc.scan_objects().collect::<Vec<_>>() {
+            if let Object::Stream(st) = o.as_ref()
+                && st.dict.get(b"Filter").is_none()
+            {
+                let data = st.decoded().unwrap();
+                doc.set(r, Object::Stream(Stream::flate(st.dict.clone(), &data)));
+            }
+        }
+        let objects = doc.scan_objects().count();
+        assert_eq!(embed(&mut doc, &mut fonts, bytes, "Inter").unwrap(), full);
+        assert_eq!(embed_mapping(&mut doc, &mut fonts, bytes, "Inter", &shaped).unwrap(), first);
+        assert_eq!(doc.scan_objects().count(), objects, "nothing new is written");
+        // A different program under the same name is not taken for this one.
+        let other = include_bytes!("../../../assets/fonts/Inter-Medium.ttf");
+        let mut more = fonts.clone();
+        let medium = embed(&mut doc, &mut more, other, "Inter").unwrap();
+        assert!(!fonts.contains(medium.as_bytes()), "{medium} is new");
+        assert_eq!(programs(&doc), 2);
+    }
 }
diff --git a/crates/fonts/src/encodings.rs b/crates/fonts/src/encodings.rs
index 733421b8c..98666802b 100644
--- a/crates/fonts/src/encodings.rs
+++ b/crates/fonts/src/encodings.rs
@@ -6,7 +6,11 @@ pub(crate) static WIN_ANSI: [u32; 256] = [
     80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112,
     113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 0, 8364, 0, 8218, 402, 8222, 8230, 8224, 8225, 710, 8240, 352, 8249, 338,
     0, 381, 0, 0, 8216, 8217, 8220, 8221, 8226, 8211, 8212, 732, 8482, 353, 8250, 339, 0, 382, 376, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169,
-    170, 171, 172, 173, 174, 175, 176, 177, 178, 179, 180, 181, 182, 183, 184, 185, 186, 187, 188, 189, 190, 191, 192, 193, 194, 195, 196, 197, 198,
+    // 0xAD is `hyphen`, not U+00AD: WinAnsiEncoding's table (Annex D.2) gives codes 0x2D and 0xAD
+    // the same glyph name, so the byte a Windows codepage calls a soft hyphen draws, and extracts
+    // as, an ordinary hyphen. Emitting U+00AD instead hides the character from search and from
+    // redaction's pattern matching, because a soft hyphen is invisible and matches nothing.
+    170, 171, 172, 45, 174, 175, 176, 177, 178, 179, 180, 181, 182, 183, 184, 185, 186, 187, 188, 189, 190, 191, 192, 193, 194, 195, 196, 197, 198,
     199, 200, 201, 202, 203, 204, 205, 206, 207, 208, 209, 210, 211, 212, 213, 214, 215, 216, 217, 218, 219, 220, 221, 222, 223, 224, 225, 226, 227,
     228, 229, 230, 231, 232, 233, 234, 235, 236, 237, 238, 239, 240, 241, 242, 243, 244, 245, 246, 247, 248, 249, 250, 251, 252, 253, 254, 255,
 ];
diff --git a/crates/fonts/src/lib.rs b/crates/fonts/src/lib.rs
index a0573b1e3..73b4fbb08 100644
--- a/crates/fonts/src/lib.rs
+++ b/crates/fonts/src/lib.rs
@@ -25,7 +25,9 @@ pub use craft::{
 pub use script::{
     GlyphError, GlyphOutline, INTER_REGULAR, MAX_SIGNATURE_CHARS, ScriptOutline, japanese_glyph, japanese_glyph_from, script_missing, script_outline,
 };
-pub use shaping::{ShapedCluster, ShapedScript, arabic_glyph, arabic_has, shape_arabic, shape_thai, shaped_glyph, thai_has};
+pub use shaping::{
+    ShapedCluster, ShapedScript, arabic_glyph, arabic_has, hebrew_has, shape_arabic, shape_hebrew, shape_thai, shaped_glyph, thai_has,
+};
 pub use std14::Std14;
 
 /// Advance of `s` in Helvetica at `size` points, using the exact standard-14 metrics.
@@ -303,11 +305,39 @@ mod tests {
         assert_eq!(literal(b"a(b)\\c"), b"(a\\(b\\)\\\\c)");
     }
 
+    /// WinAnsiEncoding's 0xAD is the `hyphen` glyph, not U+00AD.
+    ///
+    /// Annex D.2 gives codes 0x2D and 0xAD the same glyph name, so the byte a Windows codepage
+    /// calls a soft hyphen draws an ordinary hyphen and must extract as one. Reading it as U+00AD
+    /// hid the character: a soft hyphen is invisible, so a search for "well-known" missed text
+    /// that drew exactly that, and `redact`'s pattern matching missed it too. One corpus fixture
+    /// alone extracted 104 of them.
+    #[test]
+    fn win_ansi_soft_hyphen_byte_reads_as_an_ordinary_hyphen() {
+        assert_eq!(encodings::WIN_ANSI.get(0xAD), Some(&u32::from('-')));
+        assert_eq!(encodings::WIN_ANSI.get(0x2D), Some(&u32::from('-')));
+        // Writing is unaffected: '-' takes the canonical low code, and a caller holding a literal
+        // U+00AD still writes the 0xAD byte, which is the one that draws a hyphen.
+        assert_eq!(win_ansi_byte('-'), Some(0x2D));
+        assert_eq!(win_ansi_byte('\u{00ad}'), Some(0xAD));
+        assert_eq!(win_ansi("a-b"), b"a-b");
+    }
+
     #[test]
     fn win_ansi_covers_the_0x80_to_0x9f_glyphs() {
-        // Every character in the WinAnsiEncoding table encodes to its code and back (#347).
+        // Every character in the WinAnsiEncoding table encodes to its code and back (#347), except
+        // where two codes share one glyph: 0xAD is `hyphen`, the same glyph as 0x2D, so it decodes
+        // to '-' and '-' encodes back to the canonical 0x2D. Round-tripping the *code* is what
+        // cannot hold there; round-tripping the character still does.
+        const ALIASES: &[u8] = &[0xAD];
         for (code, &u) in encodings::WIN_ANSI.iter().enumerate() {
             let Some(c) = char::from_u32(u).filter(|_| u != 0) else { continue };
+            if ALIASES.contains(&(code as u8)) {
+                let canonical = win_ansi_byte(c).expect("an aliased glyph still encodes");
+                assert!(canonical < code as u8, "{c:?}: the canonical code is the lower one");
+                assert_eq!(encodings::WIN_ANSI.get(usize::from(canonical)), Some(&u), "both codes mean the same character");
+                continue;
+            }
             assert_eq!(win_ansi_byte(c), Some(code as u8), "{c:?} (U+{u:04X})");
             assert_eq!(win_ansi(&c.to_string()), [code as u8]);
         }
diff --git a/crates/fonts/src/pdf.rs b/crates/fonts/src/pdf.rs
index cd53ab0b8..3ad34eead 100644
--- a/crates/fonts/src/pdf.rs
+++ b/crates/fonts/src/pdf.rs
@@ -37,6 +37,9 @@ pub struct Metrics {
     /// Code → CID for embedded non-identity CMaps (`cidrange` / `cidchar`).
     cid_map: Vec<(u32, u32, u32)>,
     default: f64,
+    /// Composite fonts with an explicit `/DW`: `/W` may leave out the glyphs that have that
+    /// width (Chrome and Skia do), so a CID missing from `/W` is not a missing glyph.
+    explicit_default: bool,
     /// The standard-14 face to measure with when the dictionary carries no `/Widths`.
     std14: Option<crate::Std14>,
     /// Glyph units → text space (0.001, or `/FontMatrix[0]` for Type 3).
@@ -61,6 +64,9 @@ pub struct Metrics {
     code_len: usize,
     /// Valid single-character explicit mappings, preindexed once for large full CJK fonts.
     explicit_reverse: HashMap<char, u32>,
+    /// Subset CIDFontType2 only: one bit per CID (below 65 536) whose glyph has an outline in the
+    /// embedded program. See [`cids_with_outlines`].
+    outlined_cids: Vec<u64>,
 }
 
 fn nums(doc: &Document, o: Option<&Object>) -> Vec<f64> {
@@ -129,6 +135,38 @@ pub fn embedded_sfnt(doc: &Document, font: &Dict) -> Option<Vec<u8>> {
     None
 }
 
+/// The CIDs (below 65 536) of a Type 0 font over an embedded TrueType program whose glyph has
+/// outline data, through `/CIDToGIDMap`; empty when the program or the map can't be read.
+/// Subsetters keep glyph ids and empty the glyphs they drop, so an empty glyph is a missing one.
+fn cids_with_outlines(doc: &Document, font: &Dict) -> Vec<u64> {
+    use skrifa::raw::TableProvider as _;
+    let Some(descendant) = dict(doc, font.get(b"DescendantFonts").and_then(|o| doc.resolve(o).as_array().and_then(|a| a.first()).cloned()).as_ref())
+    else {
+        return Vec::new();
+    };
+    let Some(program) = dict(doc, descendant.get(b"FontDescriptor")).and_then(|d| d.get(b"FontFile2").cloned()) else { return Vec::new() };
+    let program = doc.resolve(&program);
+    let Object::Stream(stream) = program.as_ref() else { return Vec::new() };
+    let Ok(bytes) = stream.decoded_within(16 << 20) else { return Vec::new() };
+    let Some(loca) = skrifa::FontRef::from_index(&bytes, 0).ok().and_then(|face| face.loca(None).ok()) else { return Vec::new() };
+    let outlined = |gid: u32| loca.get_raw(gid as usize).zip(loca.get_raw(gid as usize + 1)).is_some_and(|(start, end)| end > start);
+    match descendant.get(b"CIDToGIDMap").map(|o| doc.resolve(o)).as_deref() {
+        None | Some(Object::Name(_)) => bit_set_below_64k((0..loca.len().min(0x1_0000) as u32).filter(|&gid| outlined(gid))),
+        Some(Object::Stream(map)) => {
+            let Ok(map) = map.decoded_within(1 << 17) else { return Vec::new() };
+            bit_set_below_64k(
+                map.as_chunks::<2>()
+                    .0
+                    .iter()
+                    .enumerate()
+                    .filter(|(_, gid)| outlined(u32::from(u16::from_be_bytes(**gid))))
+                    .map(|(cid, _)| cid as u32),
+            )
+        }
+        Some(_) => Vec::new(),
+    }
+}
+
 /// Replace an existing cmap directory entry with a bounded Unicode format-12 table.
 /// Checked ranges prevent damaged sfnt offsets from indexing outside the source program.
 fn append_editor_cmap(bytes: &mut Vec<u8>, mappings: &std::collections::BTreeMap<u32, u32>) -> Option<()> {
@@ -525,6 +563,7 @@ impl Metrics {
             cid_ranges: Vec::new(),
             cid_map: Vec::new(),
             default: 500.0,
+            explicit_default: false,
             std14: Some(crate::Std14::Helvetica),
             scale: 0.001,
             ascent: 0.9,
@@ -538,6 +577,7 @@ impl Metrics {
             visual_order: false,
             code_len: 1,
             explicit_reverse: (32..127u8).map(|c| (char::from(c), u32::from(c))).collect(),
+            outlined_cids: Vec::new(),
         }
     }
 
@@ -558,6 +598,9 @@ impl Metrics {
         m.bold |= bold;
         m.italic |= italic;
         m.base_font = base;
+        if m.composite && m.subset {
+            m.outlined_cids = cids_with_outlines(doc, font);
+        }
         m.code_len = match &m.codes {
             Codes::One => 1,
             Codes::Two => 2,
@@ -611,6 +654,7 @@ impl Metrics {
                 .unwrap_or_default();
             if let Some(dw) = desc.get(b"DW").and_then(|d| doc.resolve(d).as_f64()) {
                 m.default = dw;
+                m.explicit_default = true;
             }
             if let Some(w) = desc.get(b"W").map(|w| doc.resolve(w)).and_then(|w| w.as_array().cloned()) {
                 let mut i = 0;
@@ -749,10 +793,20 @@ impl Metrics {
     }
 
     /// Whether the font has a glyph for `code` (subset fonts lack the glyphs they don't use).
+    /// Only asked for codes the font's Unicode mapping gives: a subset's `ToUnicode` lists the
+    /// glyphs it kept, while its `/W` leaves out those of the default width (#1443).
     fn has_glyph(&self, code: u32) -> bool {
         if self.composite {
             let cid = self.cid(code);
-            return self.cid_widths.contains_key(&cid) || self.cid_ranges.iter().any(|(a, b, _)| cid >= *a && cid <= *b) || !self.subset;
+            // A CID /W leaves out takes /DW, and Skia (Chrome) leaves out every CID of that width: for
+            // those, only the subset's program says whether the glyph is there.
+            return self.cid_widths.contains_key(&cid)
+                || self.cid_ranges.iter().any(|(a, b, _)| cid >= *a && cid <= *b)
+                || !self.subset
+                || self.outlined_cids.get(cid as usize / 64).is_some_and(|w| (*w >> (cid % 64)) & 1 == 1)
+                // No readable TrueType program to ask (e.g. CFF or missing): an explicit /DW
+                // still says /W may leave out glyphs of that width (#1443).
+                || (self.outlined_cids.is_empty() && self.explicit_default);
         }
         match code.checked_sub(self.first).and_then(|i| self.widths.get(i as usize)) {
             Some(w) => *w > 0.0 || code == 32,
@@ -1330,6 +1384,48 @@ mod tests {
         assert_eq!(m.encode("Z"), None);
     }
 
+    /// Chrome's subsets leave the glyphs of `/DW` width out of `/W` (#1443): "s" (CID 0x56) is
+    /// still in the font, but nothing is when the font gives no default width to point at.
+    #[test]
+    fn composite_subset_glyphs_of_the_default_width_are_present() {
+        let metrics = |dw: bool| {
+            let mut doc = Document::new_empty();
+            let cmap = b"/CIDInit /ProcSet findresource begin 1 begincodespacerange <0000> <FFFF> endcodespacerange \
+                1 beginbfrange <0055> <0057> <0072> endbfrange end";
+            let tu = doc.add(Object::Stream(Stream::from_raw(Dict::new(), cmap.to_vec())));
+            let mut desc = Dict::new();
+            desc.set(b"Subtype".to_vec(), Object::name("CIDFontType2"));
+            if dw {
+                desc.set(b"DW".to_vec(), Object::Int(500));
+            }
+            desc.set(
+                b"W".to_vec(),
+                Object::Array(vec![
+                    Object::Int(0x55),
+                    Object::Array(vec![Object::Int(333)]),
+                    Object::Int(0x57),
+                    Object::Array(vec![Object::Int(277)]),
+                ]),
+            );
+            let f = font(
+                &mut doc,
+                vec![
+                    ("Subtype", Object::name("Type0")),
+                    ("BaseFont", Object::name("AAAAAA+LiberationSans")),
+                    ("Encoding", Object::name("Identity-H")),
+                    ("DescendantFonts", Object::Array(vec![Object::Dict(desc)])),
+                    ("ToUnicode", Object::Ref(tu)),
+                ],
+            );
+            Metrics::from_dict(&doc, &f)
+        };
+        let chrome = metrics(true);
+        assert_eq!(chrome.encode("rst").as_deref(), Some(&[0, 0x55, 0, 0x56, 0, 0x57][..]));
+        assert_eq!(chrome.width(0x56), 0.5);
+        assert_eq!(chrome.encode("x"), None, "a character the ToUnicode map doesn't give");
+        assert_eq!(metrics(false).encode("s"), None);
+    }
+
     /// A `/W` run that starts at the last CID stops there instead of overflowing onto CID 0.
     #[test]
     fn composite_width_run_past_the_last_cid_is_dropped() {
diff --git a/crates/fonts/src/shaping.rs b/crates/fonts/src/shaping.rs
index 75b6321cf..f0bd118c1 100644
--- a/crates/fonts/src/shaping.rs
+++ b/crates/fonts/src/shaping.rs
@@ -1,4 +1,4 @@
-//! Arabic and Thai text shaping with the matching craft-fonts face and bounded glyph outlines.
+//! Arabic, Hebrew and Thai text shaping with the matching craft-fonts face and bounded glyph outlines.
 
 use std::sync::OnceLock;
 
@@ -26,6 +26,7 @@ pub struct ShapedCluster {
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
 pub enum ShapedScript {
     Arabic,
+    Hebrew,
     Thai,
 }
 
@@ -33,6 +34,7 @@ impl ShapedScript {
     pub fn font(self) -> Option<&'static crate::CraftFont> {
         match self {
             Self::Arabic => crate::document_arabic_font(),
+            Self::Hebrew => crate::document_hebrew_font(false),
             Self::Thai => crate::document_thai_font(),
         }
     }
@@ -40,9 +42,11 @@ impl ShapedScript {
 
 fn face(script: ShapedScript) -> Option<&'static (FontRef<'static>, ShaperData)> {
     static FACE: OnceLock<Option<(FontRef<'static>, ShaperData)>> = OnceLock::new();
+    static HEBREW: OnceLock<Option<(FontRef<'static>, ShaperData)>> = OnceLock::new();
     static THAI: OnceLock<Option<(FontRef<'static>, ShaperData)>> = OnceLock::new();
     let cache = match script {
         ShapedScript::Arabic => &FACE,
+        ShapedScript::Hebrew => &HEBREW,
         ShapedScript::Thai => &THAI,
     };
     cache
@@ -66,6 +70,17 @@ pub fn shape_arabic(text: &str, rtl: bool) -> Result<Vec<ShapedCluster>, GlyphEr
     shape_script(text, rtl, ShapedScript::Arabic)
 }
 
+/// Whether the Hebrew document face has a glyph for `c` (false without the face).
+pub fn hebrew_has(c: char) -> bool {
+    face(ShapedScript::Hebrew).is_some_and(|(font, _)| font.charmap().map(c).is_some())
+}
+
+/// Shape one directional run of `text` with the Hebrew document face, clusters in drawing order.
+/// Points (niqqud) and cantillation marks stay in their letter's cluster, positioned by the face.
+pub fn shape_hebrew(text: &str, rtl: bool) -> Result<Vec<ShapedCluster>, GlyphError> {
+    shape_script(text, rtl, ShapedScript::Hebrew)
+}
+
 pub fn thai_has(c: char) -> bool {
     face(ShapedScript::Thai).is_some_and(|(font, _)| font.charmap().map(c).is_some())
 }
@@ -85,12 +100,13 @@ fn shape_script(text: &str, rtl: bool, kind: ShapedScript) -> Result<Vec<ShapedC
     buffer.set_direction(if rtl { Direction::RightToLeft } else { Direction::LeftToRight });
     buffer.set_script(match kind {
         ShapedScript::Arabic => script::ARABIC,
+        ShapedScript::Hebrew => script::HEBREW,
         ShapedScript::Thai => script::THAI,
     });
-    // Preserve the historical Arabic per-character mapping; Thai marks stay with their base.
+    // Preserve the historical Arabic per-character mapping; Hebrew and Thai marks stay with their base.
     buffer.set_cluster_level(match kind {
         ShapedScript::Arabic => BufferClusterLevel::Characters,
-        ShapedScript::Thai => BufferClusterLevel::MonotoneGraphemes,
+        ShapedScript::Hebrew | ShapedScript::Thai => BufferClusterLevel::MonotoneGraphemes,
     });
     let shaped = shaper.shape(buffer, ShapeOptions::new());
     // Clusters are byte offsets into `text`; a cluster shows the characters up to the next one.
@@ -250,3 +266,36 @@ mod thai_tests {
         assert_eq!(shaped_glyph(ShapedScript::Thai, u32::MAX).map(|_| ()), Err(GlyphError::Missing));
     }
 }
+
+#[cfg(test)]
+mod hebrew_tests {
+    use super::*;
+
+    #[test]
+    fn hebrew_runs_are_drawn_from_their_last_letter_with_points_on_their_letter() {
+        if crate::document_hebrew_font(false).is_none() {
+            eprintln!("skipping the Hebrew shaping checks: built without a craft-fonts Hebr face (set CRAFT_FONTS_DIR)");
+            assert_eq!(shape_hebrew("ש", true), Err(GlyphError::NoFont));
+            assert!(!hebrew_has('ש'));
+            return;
+        }
+        let g = shape_hebrew("שלום", true).unwrap();
+        assert!(g.iter().all(|c| c.script == ShapedScript::Hebrew && c.advance > 0.0 && !c.glyphs.is_empty()), "{g:?}");
+        let drawn: String = g.iter().map(|c| c.text.as_str()).collect();
+        assert_eq!(drawn.chars().rev().collect::<String>(), "שלום");
+        // A point (qamats) is one cluster with its letter, so copy and search get it once.
+        let pointed = shape_hebrew("שָׁ", true).unwrap();
+        assert_eq!(pointed.len(), 1, "{pointed:?}");
+        assert_eq!(pointed[0].text, "שָׁ");
+        assert!(pointed[0].glyphs.len() >= 2);
+        for c in shape_hebrew("שָׁלוֹם 123", true).unwrap() {
+            for (id, pos) in c.glyphs {
+                assert!(pos.iter().all(|v| v.is_finite()));
+                shaped_glyph(c.script, id).unwrap();
+            }
+        }
+        assert!(hebrew_has('א') && hebrew_has('\u{05B8}') && !hebrew_has('日'));
+        assert_eq!(shape_hebrew("日", true), Err(GlyphError::Missing));
+        assert!(shape_hebrew("", true).unwrap().is_empty());
+    }
+}
diff --git a/crates/forms/src/af.rs b/crates/forms/src/af.rs
index be38a9546..b50ed4c1e 100644
--- a/crates/forms/src/af.rs
+++ b/crates/forms/src/af.rs
@@ -446,7 +446,9 @@ pub fn calculate_js(c: &Calculate) -> Option<String> {
             js_str(op.code()),
             fields.iter().map(|f| js_str(f)).collect::<Vec<_>>().join(", ")
         )),
-        Calculate::Notation(expr) => Some(format!("/** BVCALC {expr} EVCALC **/ event.value = AFMakeNumber(0);")),
+        // Acrobat's own translation follows the comment, so a viewer that runs the script instead
+        // of reading the comment computes the same value (a placeholder here showed 0).
+        Calculate::Notation(expr) => Some(format!("/** BVCALC {expr} EVCALC **/ event.value = {};", notation_js(expr))),
     }
 }
 
@@ -624,10 +626,8 @@ pub fn parse_date(text: &str, fmt: &str) -> Option<DateTime> {
         match k {
             // Literal digits in the format may be typed or left out ("15.05.26" or "15.05"
             // for "dd.mm.26"); a different number there is left over and rejected below.
-            '#' => {
-                if it.peek() == Some(&literal) {
-                    it.next();
-                }
+            '#' if it.peek() == Some(&literal) => {
+                it.next();
             }
             'm' => {
                 dt.m = match month_name {
@@ -866,6 +866,41 @@ pub fn validate(v: &Validate, value: &str) -> Result<(), String> {
     })
 }
 
+/// Simplified field notation as the JavaScript Acrobat writes after its `BVCALC` comment:
+/// each field name becomes `AFMakeNumber(this.getField("name").value)`, the rest stays.
+pub fn notation_js(expr: &str) -> String {
+    let mut out = String::new();
+    let cs: Vec<char> = expr.chars().collect();
+    let mut i = 0;
+    while let Some(&c) = cs.get(i) {
+        if c.is_whitespace() || "+-*/()".contains(c) {
+            out.push(c);
+            i += 1;
+        } else if c.is_ascii_digit() || c == '.' {
+            while let Some(&d) = cs.get(i).filter(|d| d.is_ascii_digit() || **d == '.') {
+                out.push(d);
+                i += 1;
+            }
+        } else {
+            let mut name = String::new();
+            while let Some(&n) = cs.get(i).filter(|n| !(n.is_whitespace() || "+-*/()".contains(**n))) {
+                // `\` escapes a space or an operator inside a name, as Acrobat writes them.
+                if n == '\\'
+                    && let Some(&next) = cs.get(i + 1)
+                {
+                    name.push(next);
+                    i += 2;
+                    continue;
+                }
+                name.push(n);
+                i += 1;
+            }
+            out.push_str(&format!("AFMakeNumber(this.getField({}).value)", js_str(&name)));
+        }
+    }
+    out
+}
+
 /// Evaluate simplified field notation: + - * / and parentheses over numbers and field names
 /// (`\` escapes spaces and operators in names, as Acrobat writes them).
 fn eval_notation(src: &str, value_of: &dyn Fn(&str) -> f64) -> Option<f64> {
@@ -1026,6 +1061,12 @@ mod tests {
         assert_eq!(parse_calculate(&calculate_js(&c).unwrap()), Some(c));
         let c = Calculate::Notation("a + b".into());
         assert_eq!(parse_calculate(&calculate_js(&c).unwrap()), Some(c));
+        // The JavaScript after the comment is Acrobat's translation, so viewers that run it
+        // instead of reading the comment compute the same value (not 0).
+        assert_eq!(
+            calculate_js(&Calculate::Notation("(Unit\\ Price * Qty) / 2".into())).unwrap(),
+            "/** BVCALC (Unit\\ Price * Qty) / 2 EVCALC **/ event.value = (AFMakeNumber(this.getField(\"Unit Price\").value) * AFMakeNumber(this.getField(\"Qty\").value)) / 2;"
+        );
     }
 
     #[test]
diff --git a/crates/forms/src/appearance.rs b/crates/forms/src/appearance.rs
index dc5ffcef1..4ec22f011 100644
--- a/crates/forms/src/appearance.rs
+++ b/crates/forms/src/appearance.rs
@@ -38,6 +38,39 @@ pub fn fmt(v: f64) -> String {
     n(v)
 }
 
+/// The font size an auto-sized (`0 Tf`) text field uses for `text` in a `width` × `height` box
+/// (inside the padding), measured by `width_of(text, size)`: at most 12 pt and at least 4 pt.
+/// Single-line text shrinks until it fits the width; multiline text takes the largest size whose
+/// wrapped lines fit the height. The page appearance and the on-screen editor share this.
+pub fn auto_text_size(text: &str, width: f64, height: f64, multiline: bool, width_of: impl Fn(&str, f64) -> f64) -> f64 {
+    let wrap_width = if width.is_finite() { width.max(1.0) } else { 1.0 };
+    auto_text_size_by(
+        width,
+        height,
+        multiline,
+        |size| width_of(text, size),
+        |size| wrap_with(text, size, wrap_width, &width_of).len() as f64 * size * 1.15,
+    )
+}
+
+/// [`auto_text_size`] with the text measured by the caller: `line_width(size)` is its width on
+/// one line, `wrapped_height(size)` its height wrapped at `width`. The screen measures in its
+/// own font, whose widths and line breaks differ from the page's.
+pub fn auto_text_size_by(width: f64, height: f64, multiline: bool, line_width: impl Fn(f64) -> f64, wrapped_height: impl Fn(f64) -> f64) -> f64 {
+    let (width, height) = (if width.is_finite() { width.max(1.0) } else { 1.0 }, if height.is_finite() { height } else { 0.0 });
+    if multiline {
+        let mut size = 12.0;
+        // A NaN height from the measurer compares false, so it keeps the size it has.
+        while size > 4.0 && wrapped_height(size) > height {
+            size -= 0.5;
+        }
+        return size;
+    }
+    let size = (height / 1.15).clamp(4.0, 12.0);
+    let tw = line_width(size);
+    if tw.is_finite() && tw > width { (size * width / tw).max(4.0) } else { size }
+}
+
 /// `/MK /R` as a quadrant, or 0 when it is missing or not a multiple of 90.
 pub(crate) fn mk_rotation(doc: &Document, wd: &Dict) -> i64 {
     let Some(raw) = wd.get(b"MK") else { return 0 };
@@ -285,6 +318,93 @@ fn frame(doc: &Document, wd: &Dict, w: f64, h: f64) -> (String, f64) {
     (c, 0.0)
 }
 
+/// The width [`frame`] insets the content by: the `/BS` border width when the widget has a
+/// border colour, doubled for beveled and inset borders, and 0 without a border.
+fn border_width(doc: &Document, wd: &Dict) -> f64 {
+    let mk = wd.get(b"MK").map(|m| doc.resolve(m)).and_then(|m| m.as_dict().cloned());
+    let bs = wd.get(b"BS").map(|b| doc.resolve(b)).and_then(|b| b.as_dict().cloned());
+    let bw = bs.as_ref().and_then(|b| b.get(b"W")).and_then(|x| doc.resolve(x).as_f64()).unwrap_or(1.0).max(0.0);
+    if color_array(doc, mk.as_ref(), b"BC").is_none() || bw <= 0.0 {
+        return 0.0;
+    }
+    let style = bs.as_ref().and_then(|b| b.name(b"S").map(<[u8]>::to_vec)).unwrap_or_default();
+    if style == b"B" || style == b"I" { 2.0 * bw } else { bw }
+}
+
+/// Where a list box draws its options: one row per option from the top, starting with option
+/// `top` (`/TI`, §12.7.4.4). The appearance PdfCraft writes and the viewer's in-place list share
+/// it, so a click picks the option drawn under the pointer (#1524).
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct ListRows {
+    /// The first option shown (`/TI`).
+    pub top: usize,
+    /// From the widget's top edge to the first row, in points.
+    pub inset: f64,
+    /// The height of one row, in points.
+    pub row: f64,
+    /// The text size, in points.
+    pub size: f64,
+}
+
+impl ListRows {
+    /// How many whole rows fit in a list box `height` points tall (at least one).
+    pub fn visible(&self, height: f64) -> usize {
+        if !(height.is_finite() && self.row > 0.0) {
+            return 1;
+        }
+        let rows = ((height - self.inset) / self.row).floor();
+        if rows >= 1.0 { rows.min(10_000.0) as usize } else { 1 }
+    }
+
+    /// The option at `y` points below the widget's top edge when the list starts at option `top`,
+    /// or `None` above the first row. The caller checks it against the number of options.
+    pub fn option_at(&self, top: usize, y: f64) -> Option<usize> {
+        if !(y.is_finite() && self.row > 0.0) || y < self.inset {
+            return None;
+        }
+        let k = ((y - self.inset) / self.row).floor();
+        (k < 1.0e6).then(|| top.saturating_add(k as usize))
+    }
+
+    /// The top index that shows as many of the `selected` option indices as fit in `visible`
+    /// rows, staying at `current` when they are all shown already, among `count` options.
+    pub fn top_showing(current: usize, selected: &[usize], visible: usize, count: usize) -> usize {
+        let visible = visible.max(1);
+        let last_top = count.saturating_sub(visible);
+        let (Some(&first), Some(&last)) = (selected.iter().min(), selected.iter().max()) else { return current.min(last_top) };
+        let top = if first >= current && last < current.saturating_add(visible) {
+            current
+        } else if last.saturating_sub(first) >= visible || first < current {
+            first
+        } else {
+            // Scroll down just far enough that the last selected option is the bottom row.
+            last.saturating_add(1).saturating_sub(visible)
+        };
+        top.min(last_top)
+    }
+}
+
+/// `/TI` of a list box: on the widget, else on the field.
+fn top_index(doc: &Document, wd: &Dict, field: Option<&Dict>) -> usize {
+    let ti = |d: &Dict| d.get(b"TI").and_then(|o| doc.resolve(o).as_int());
+    ti(wd).or_else(|| field.and_then(ti)).and_then(|i| usize::try_from(i).ok()).unwrap_or(0)
+}
+
+/// The rows of a list box whose field's `/DA` is `f_da`, in widget `wd`.
+pub(crate) fn list_rows_of(doc: &Document, f_da: &str, field: Option<&Dict>, wd: &Dict) -> ListRows {
+    let da = parse_da(wd.get(b"DA").and_then(|o| doc.resolve(o).as_string().map(|s| s.to_text())).as_deref().unwrap_or(f_da));
+    let size = if da.size > 0.0 { da.size } else { 12.0 };
+    ListRows { top: top_index(doc, wd, field), inset: 2.0 + border_width(doc, wd), row: size * 1.15, size }
+}
+
+/// The rows of list box `f` as drawn in widget `w`.
+pub fn list_rows(doc: &Document, f: &Field, w: &Widget) -> ListRows {
+    let wobj = doc.get(w.obj);
+    let wd = wobj.as_dict().cloned().unwrap_or_default();
+    let fobj = doc.get(f.obj);
+    list_rows_of(doc, &f.da, fobj.as_dict(), &wd)
+}
+
 /// The appearance of a text or choice field's widget showing `values`. Characters its font can't
 /// hold come out as `?`; [`field_appearance_drawn`] says which.
 pub fn field_appearance(doc: &Document, f: &Field, w: &Widget, values: &[String]) -> Stream {
@@ -367,14 +487,13 @@ pub fn field_appearance_drawn(doc: &Document, f: &Field, w: &Widget, values: &[S
     let mut size = da.size;
     match f.kind {
         FieldKind::List => {
-            // Every option, one per line from the top; selected ones highlighted.
-            if size == 0.0 {
-                size = 12.0;
-            }
-            let line = size * 1.15;
-            let top = wd.get(b"TI").and_then(|o| doc.resolve(o).as_int()).unwrap_or(0).max(0) as usize;
-            let mut y = height - pad;
-            for (export, display) in f.options.iter().skip(top) {
+            // Every option, one per line from the top (from `/TI`); selected ones highlighted.
+            let fobj = doc.get(f.obj);
+            let rows = list_rows_of(doc, &f.da, fobj.as_dict(), &wd);
+            size = rows.size;
+            let line = rows.row;
+            let mut y = height - rows.inset;
+            for (export, display) in f.options.iter().skip(rows.top) {
                 if y - line < 0.0 {
                     break;
                 }
@@ -389,11 +508,7 @@ pub fn field_appearance_drawn(doc: &Document, f: &Field, w: &Widget, values: &[S
             let comb = f.has(flags::COMB) && !f.has(flags::MULTILINE) && !f.has(flags::PASSWORD) && f.max_len.is_some_and(|m| m > 0);
             if f.kind == FieldKind::Text && f.has(flags::MULTILINE) {
                 if size == 0.0 {
-                    // Auto size: the largest size (≤ 12) whose wrapped lines fit the height.
-                    size = 12.0;
-                    while size > 4.0 && wrap_with(&text, size, inner_w, width_of).len() as f64 * size * 1.15 > height - 2.0 * pad {
-                        size -= 0.5;
-                    }
+                    size = auto_text_size(&text, inner_w, height - 2.0 * pad, true, width_of);
                 }
                 let mut y = height - pad - size * 0.85;
                 for line in wrap_with(&text, size, inner_w, width_of) {
@@ -405,11 +520,12 @@ pub fn field_appearance_drawn(doc: &Document, f: &Field, w: &Widget, values: &[S
                 }
             } else {
                 if size == 0.0 {
-                    size = ((height - 2.0 * pad) / 1.15).clamp(4.0, 12.0);
-                    let tw = width_of(&text, size);
-                    if tw > inner_w && !comb {
-                        size = (size * inner_w / tw).max(4.0);
-                    }
+                    // Comb cells hold one character each, so only the height limits them.
+                    size = if comb {
+                        ((height - 2.0 * pad) / 1.15).clamp(4.0, 12.0)
+                    } else {
+                        auto_text_size(&text, inner_w, height - 2.0 * pad, false, width_of)
+                    };
                 }
                 // Centre Helvetica's ascent (0.718) and descent (0.207) vertically.
                 let y = (height - 0.925 * size) / 2.0 + 0.207 * size;
@@ -588,4 +704,23 @@ mod tests {
         assert_eq!(parse_da("garbage").font, "Helv");
         assert_eq!(stroke_op("1 0 0 rg"), "1 0 0 RG");
     }
+
+    #[test]
+    fn list_rows_visibility_and_scrolling() {
+        let rows = ListRows { top: 0, inset: 2.0, row: 11.5, size: 10.0 };
+        assert_eq!(rows.visible(46.0), 3);
+        assert_eq!(rows.option_at(0, 1.0), None);
+        assert_eq!(rows.option_at(0, 5.0), Some(0));
+        assert_eq!(rows.option_at(0, 15.0), Some(1));
+        assert_eq!(rows.option_at(2, 5.0), Some(2));
+
+        // When Tue (1) and Thu (3) are selected in 5 options with 3 visible rows:
+        assert_eq!(ListRows::top_showing(0, &[1, 3], 3, 5), 1);
+        // When staying within view:
+        assert_eq!(ListRows::top_showing(1, &[1, 2], 3, 5), 1);
+        // When selecting before current top:
+        assert_eq!(ListRows::top_showing(2, &[0], 3, 5), 0);
+        // When empty selection:
+        assert_eq!(ListRows::top_showing(0, &[], 3, 5), 0);
+    }
 }
diff --git a/crates/forms/src/author.rs b/crates/forms/src/author.rs
index 6d49be100..bb45f38d9 100644
--- a/crates/forms/src/author.rs
+++ b/crates/forms/src/author.rs
@@ -1,8 +1,9 @@
 //! Prepare a form: create, change and delete fields (execution plan M6.6).
 //!
 //! New fields follow Acrobat's conventions: names "Text1", "Check Box1", "Group1" (radio groups),
-//! "Dropdown1", "List Box1", "Button1", "Signature1", "Date1"; 12 pt Helvetica (auto-size for
-//! check boxes), a thin grey border and a white background, and appearance streams generated
+//! "Dropdown1", "List Box1", "Button1", "Signature1", "Date1"; Helvetica at Acrobat's Auto size
+//! for text and date fields (12 pt in a box that has room, smaller in a short one), 12 pt in
+//! choice fields, a thin grey border and a white background, and appearance streams generated
 //! immediately so every viewer shows the empty field.
 
 use pdfcraft_cos::{Dict, Document, ObjRef, Object, PdfString, Stream};
@@ -545,14 +546,15 @@ pub fn add_field(doc: &mut Document, page: usize, rect: [f64; 4], kind: &NewFiel
     match kind {
         NewField::Text { multiline } => {
             w.set(b"FT".to_vec(), Object::name("Tx"));
-            w.set(b"DA".to_vec(), PdfString::literal(b"/Helv 12 Tf 0 g".to_vec()));
+            // Auto size (0): a fixed 12 pt is clipped in a box shorter than that (#1888).
+            w.set(b"DA".to_vec(), PdfString::literal(b"/Helv 0 Tf 0 g".to_vec()));
             if *multiline {
                 w.set(b"Ff".to_vec(), Object::Int(flags::MULTILINE as i64));
             }
         }
         NewField::Date => {
             w.set(b"FT".to_vec(), Object::name("Tx"));
-            w.set(b"DA".to_vec(), PdfString::literal(b"/Helv 12 Tf 0 g".to_vec()));
+            w.set(b"DA".to_vec(), PdfString::literal(b"/Helv 0 Tf 0 g".to_vec()));
             // Acrobat's format and keystroke actions for mm/dd/yyyy (run by its JavaScript engine).
             let js = |s: &str| {
                 let mut a = Dict::new();
@@ -655,6 +657,7 @@ pub fn add_field(doc: &mut Document, page: usize, rect: [f64; 4], kind: &NewFiel
                 locked: false,
                 hidden: false,
                 rotation: 0,
+                list: None,
             };
             let ap = appearance::check_box_states(doc, &w, FieldKind::Radio, export);
             doc.update_dict(widget, |d| d.set(b"AP".to_vec(), Object::Dict(ap)))?;
diff --git a/crates/forms/src/detect.rs b/crates/forms/src/detect.rs
index 685a818a9..dbee788e3 100644
--- a/crates/forms/src/detect.rs
+++ b/crates/forms/src/detect.rs
@@ -3,11 +3,13 @@
 //! field from the label next to it (Acrobat's auto-naming).
 //!
 //! [`detect`] is a pure function over the page's words and drawn shapes; [`page_shapes`] reads
-//! the shapes from a page's content.
+//! the shapes from a page's content, [`raster::shapes`] from a picture of the page (a scan).
 
 use pdfcraft_content::{Matrix, parse};
 use pdfcraft_cos::{Document, Object};
 
+pub mod raster;
+
 /// A piece of text on the page, in user space.
 #[derive(Clone, Debug, PartialEq)]
 pub struct Word {
diff --git a/crates/forms/src/detect/raster.rs b/crates/forms/src/detect/raster.rs
new file mode 100644
index 000000000..d54e36e5c
--- /dev/null
+++ b/crates/forms/src/detect/raster.rs
@@ -0,0 +1,550 @@
+//! Field detection on scanned pages: the [`Shapes`] that [`detect`](super::detect) needs, read
+//! from a picture of the page instead of its content stream.
+//!
+//! Steps:
+//! - Ink is a pixel clearly darker than the paper around it (a local mean, so the uneven paper
+//!   of a scan or photo still reads as paper).
+//! - Straight lines are runs of ink at least [`MIN_LINE`] long, horizontal or vertical, with
+//!   short gaps (noise, a faint print) bridged.
+//! - A box is a patch of paper that the lines enclose and that is close to a rectangle. Its
+//!   writing area is the whole box when it is empty, or else the largest band of empty rows or
+//!   columns in it (many official forms print a small label in the corner of each box).
+//! - The remaining horizontal lines, the ones that are not the edge of a box, are rules.
+//!
+//! Everything is bounded: pictures larger than [`MAX_PIXELS`] are refused (the caller renders
+//! at a resolution that fits), and the results are capped.
+
+use super::Shapes;
+
+/// The largest picture analysed (about A3 at 200 dpi).
+pub const MAX_PIXELS: usize = 12_000_000;
+/// The shortest run of ink that counts as a line, in points (a check box side is at least 5).
+const MIN_LINE: f64 = 4.0;
+/// Gaps up to this long (points) inside a line are bridged.
+const GAP: f64 = 1.0;
+/// Lines thicker than this (points, on average) are dark areas, not rules.
+const MAX_THICKNESS: f64 = 3.0;
+/// The shortest rule reported, in points ([`detect`](super::detect) wants 40 for a field).
+const MIN_RULE: f64 = 20.0;
+/// A box is at least this share of its bounding rectangle (a skewed scan loses a little).
+const RECTANGULAR: f64 = 0.75;
+/// Boxes taller than this (points) are frames around parts of the form, not places to write.
+const MAX_BOX_HEIGHT: f64 = 120.0;
+/// At most this many boxes and rules are reported.
+const MAX_SHAPES: usize = 4000;
+
+/// A grey picture (0 black, 255 white) and its size.
+struct Grey {
+    w: usize,
+    h: usize,
+    v: Vec<u8>,
+}
+
+/// The shapes in `rgba` (premultiplied RGBA8, `width` × `height`, the whole page as displayed),
+/// where `px_per_pt` pixels make a point. Coordinates are points with the origin at the
+/// picture's bottom-left and y up, the frame [`detect`](super::detect) expects. Empty when the
+/// picture is malformed or larger than [`MAX_PIXELS`].
+pub fn shapes(rgba: &[u8], width: u32, height: u32, px_per_pt: f64) -> Shapes {
+    let (w, h) = (width as usize, height as usize);
+    let valid = w >= 8
+        && h >= 8
+        && px_per_pt.is_finite()
+        && (0.25..=20.0).contains(&px_per_pt)
+        && w.checked_mul(h).is_some_and(|n| n <= MAX_PIXELS)
+        && w.checked_mul(h).and_then(|n| n.checked_mul(4)) == Some(rgba.len());
+    if !valid {
+        return Shapes::default();
+    }
+    let grey = grey(rgba, w, h);
+    let ink = ink(&grey, px_per_pt);
+    let px = |pt: f64| (pt * px_per_pt).round().max(1.0) as usize;
+    let (min_line, gap) = (px(MIN_LINE), px(GAP));
+    let horizontal = runs(&ink, w, h, min_line, gap, true);
+    let vertical = runs(&ink, w, h, min_line, gap, false);
+    // The lines, a pixel thicker so that a hairline crack in a corner still encloses.
+    let mut lines: Vec<bool> = horizontal.iter().zip(&vertical).map(|(a, b)| *a || *b).collect();
+    lines = dilate(&lines, w, h);
+    let areas = enclosed(&lines, &ink, w, h, px_per_pt);
+    let to_pt = |x: usize, y: usize| [x as f64 / px_per_pt, (h as f64 - y as f64) / px_per_pt];
+    let mut out = Shapes::default();
+    for [x0, y0, x1, y1] in areas.into_iter().take(MAX_SHAPES) {
+        let (a, b) = (to_pt(x0, y1), to_pt(x1, y0));
+        out.boxes.push([a[0], a[1], b[0], b[1]]);
+    }
+    let tol = px(2.0);
+    // Whether a vertical line passes the end of a horizontal one at column `x`.
+    let attached = |x: usize, l: &Component| {
+        (l.y0.saturating_sub(tol)..l.y1.saturating_add(tol).min(h))
+            .any(|y| (x.saturating_sub(tol)..x.saturating_add(tol + 1).min(w)).any(|x| vertical.get(y * w + x).copied().unwrap_or(false)))
+    };
+    for l in components(&horizontal, w, h) {
+        let len = l.x1 - l.x0;
+        let thick = l.count as f64 / len.max(1) as f64;
+        if (len as f64) < MIN_RULE * px_per_pt || thick > MAX_THICKNESS * px_per_pt {
+            continue;
+        }
+        let y = l.y_sum as f64 / l.count.max(1) as f64;
+        // The scan's own border is not a line on the form.
+        if y < tol as f64 || y > h.saturating_sub(tol) as f64 {
+            continue;
+        }
+        // Closed at both ends: the edge of a box, a table or a frame, not a line to write on.
+        if attached(l.x0, &l) && attached(l.x1 - 1, &l) {
+            continue;
+        }
+        let y = (h as f64 - y) / px_per_pt;
+        if out.rules.len() < MAX_SHAPES {
+            out.rules.push([l.x0 as f64 / px_per_pt, y, l.x1 as f64 / px_per_pt, y]);
+        }
+    }
+    out
+}
+
+/// Luminance over white paper (a transparent pixel is paper).
+fn grey(rgba: &[u8], w: usize, h: usize) -> Grey {
+    let v = rgba
+        .as_chunks::<4>()
+        .0
+        .iter()
+        .map(|&[r, g, b, a]| {
+            let (r, g, b, a) = (u32::from(r), u32::from(g), u32::from(b), u32::from(a));
+            // Premultiplied over white: c + (255 - a).
+            let l = (r * 77 + g * 150 + b * 29) >> 8;
+            (l + (255 - a)).min(255) as u8
+        })
+        .collect();
+    Grey { w, h, v }
+}
+
+/// Which pixels are ink: darker than 80 % of the mean around them (a window of about 20 points),
+/// or dark outright.
+fn ink(g: &Grey, px_per_pt: f64) -> Vec<bool> {
+    let (w, h) = (g.w, g.h);
+    let r = ((10.0 * px_per_pt).round() as usize).clamp(2, 200);
+    // A separable box mean: rows first, then columns. Sums stay below 255 × 401 × 401 < 2^32.
+    let mut rows = vec![0u32; w * h];
+    for y in 0..h {
+        let line = g.v.get(y * w..(y + 1) * w).unwrap_or_default();
+        let mut sum: u32 = line.iter().take(r + 1).map(|v| u32::from(*v)).sum();
+        let mut n = (r + 1).min(w) as u32;
+        for x in 0..w {
+            if let Some(slot) = rows.get_mut(y * w + x) {
+                *slot = sum / n.max(1);
+            }
+            if let Some(v) = line.get(x + r + 1) {
+                sum += u32::from(*v);
+                n += 1;
+            }
+            if x >= r
+                && let Some(v) = line.get(x - r)
+            {
+                sum = sum.saturating_sub(u32::from(*v));
+                n = n.saturating_sub(1);
+            }
+        }
+    }
+    let mut out = vec![false; w * h];
+    for x in 0..w {
+        let at = |y: usize| rows.get(y * w + x).copied().unwrap_or(255);
+        let mut sum: u32 = (0..=r.min(h - 1)).map(at).sum();
+        let mut n = (r + 1).min(h) as u32;
+        for y in 0..h {
+            let mean = sum / n.max(1);
+            let i = y * w + x;
+            let v = u32::from(g.v.get(i).copied().unwrap_or(255));
+            if let Some(slot) = out.get_mut(i) {
+                *slot = v < 96 || (v * 5 < mean * 4 && v < 224);
+            }
+            if y + r + 1 < h {
+                sum += at(y + r + 1);
+                n += 1;
+            }
+            if y >= r {
+                sum = sum.saturating_sub(at(y - r));
+                n = n.saturating_sub(1);
+            }
+        }
+    }
+    out
+}
+
+/// The pixels on straight runs of ink at least `min` long, along rows (`across`) or columns,
+/// with gaps up to `gap` bridged. A run is nearly solid: a word in small print, its letters
+/// run together by noise, has more gaps than a line.
+fn runs(ink: &[bool], w: usize, h: usize, min: usize, gap: usize, across: bool) -> Vec<bool> {
+    let mut out = vec![false; w * h];
+    let (outer, inner) = if across { (h, w) } else { (w, h) };
+    let index = |o: usize, i: usize| if across { o * w + i } else { i * w + o };
+    for o in 0..outer {
+        // The current run: its first and last inked position and how many are inked.
+        let mut run: Option<(usize, usize, usize)> = None;
+        let close = |run: Option<(usize, usize, usize)>, out: &mut Vec<bool>| {
+            if let Some((a, b, n)) = run
+                && b + 1 - a >= min
+                && n * 4 >= (b + 1 - a) * 3
+            {
+                for i in a..=b {
+                    if let Some(slot) = out.get_mut(index(o, i)) {
+                        *slot = true;
+                    }
+                }
+            }
+        };
+        for i in 0..inner {
+            if !ink.get(index(o, i)).copied().unwrap_or(false) {
+                continue;
+            }
+            run = match run {
+                Some((a, b, n)) if i - b <= gap + 1 => Some((a, i, n + 1)),
+                other => {
+                    close(other, &mut out);
+                    Some((i, i, 1))
+                }
+            };
+        }
+        close(run, &mut out);
+    }
+    out
+}
+
+/// `mask` grown by one pixel in each of the four directions.
+fn dilate(mask: &[bool], w: usize, h: usize) -> Vec<bool> {
+    let at = |x: usize, y: usize| mask.get(y * w + x).copied().unwrap_or(false);
+    let mut out = vec![false; w * h];
+    for y in 0..h {
+        for x in 0..w {
+            let on = at(x, y) || (x > 0 && at(x - 1, y)) || (x + 1 < w && at(x + 1, y)) || (y > 0 && at(x, y - 1)) || (y + 1 < h && at(x, y + 1));
+            if let Some(slot) = out.get_mut(y * w + x) {
+                *slot = on;
+            }
+        }
+    }
+    out
+}
+
+/// Where to write in the rectangular patches of paper that `lines` enclose (none that touch
+/// the picture's edge), in pixels: [x0, y0, x1, y1) with y down.
+fn enclosed(lines: &[bool], ink: &[bool], w: usize, h: usize, px_per_pt: f64) -> Vec<[usize; 4]> {
+    let mut label = vec![0u32; w * h];
+    let mut out = Vec::new();
+    let mut stack: Vec<usize> = Vec::new();
+    let mut next: u32 = 0;
+    let max_h = (MAX_BOX_HEIGHT * px_per_pt) as usize;
+    for start in 0..w * h {
+        if lines.get(start).copied().unwrap_or(true) || label.get(start).copied().unwrap_or(1) != 0 {
+            continue;
+        }
+        next = next.saturating_add(1);
+        if next == u32::MAX {
+            break;
+        }
+        let (mut x0, mut y0, mut x1, mut y1) = (usize::MAX, usize::MAX, 0, 0);
+        let mut count = 0usize;
+        let mut border = false;
+        stack.clear();
+        stack.push(start);
+        if let Some(l) = label.get_mut(start) {
+            *l = next;
+        }
+        while let Some(i) = stack.pop() {
+            let (x, y) = (i % w, i / w);
+            count += 1;
+            (x0, y0, x1, y1) = (x0.min(x), y0.min(y), x1.max(x + 1), y1.max(y + 1));
+            border |= x == 0 || y == 0 || x + 1 == w || y + 1 == h;
+            let mut visit = |j: usize| {
+                if !lines.get(j).copied().unwrap_or(true)
+                    && let Some(l) = label.get_mut(j)
+                    && *l == 0
+                {
+                    *l = next;
+                    stack.push(j);
+                }
+            };
+            if x > 0 {
+                visit(i - 1);
+            }
+            if x + 1 < w {
+                visit(i + 1);
+            }
+            if y > 0 {
+                visit(i - w);
+            }
+            if y + 1 < h {
+                visit(i + w);
+            }
+        }
+        let (bw, bh) = (x1.saturating_sub(x0), y1.saturating_sub(y0));
+        let min = (MIN_LINE * px_per_pt) as usize;
+        if border || bw < min || bh < min || bh > max_h || (count as f64) < RECTANGULAR * (bw * bh) as f64 {
+            continue;
+        }
+        if let Some(area) = writing_area(&label, ink, [w, h], [x0, y0, x1, y1], next, px_per_pt) {
+            out.push(area);
+        }
+        if out.len() >= MAX_SHAPES {
+            break;
+        }
+    }
+    out
+}
+
+/// Where to write in the region `id` with bounding rectangle `rect`, in pixels: all of it when it is empty,
+/// else the largest band of empty rows big enough for a line of handwriting (below or above a
+/// label), else the largest such band of columns (beside one). A small square (a check box)
+/// with ink in it is already ticked or is a letter, not a blank. Ink counts anywhere in the
+/// rectangle except inside other regions: the strokes of a label are lines of their own.
+///
+/// A side of the area that is a side of the region reaches out to the middle of the line around
+/// it (the region stops short of it by the dilation and half a line); a side that faces a label
+/// keeps a point away from it.
+fn writing_area(label: &[u32], ink: &[bool], [w, h]: [usize; 2], rect: [usize; 4], id: u32, px_per_pt: f64) -> Option<[usize; 4]> {
+    let [x0, y0, x1, y1] = rect;
+    let px = |pt: f64| (pt * px_per_pt).round().max(1.0) as usize;
+    let (pad, gap) = (1 + px(0.5), px(1.0));
+    // `area` within `rect`: its sides on the region's sides padded, the others moved in.
+    let place = |a: [usize; 4]| {
+        let lo = |v: usize, edge: usize| if v == edge { v.saturating_sub(pad) } else { v + gap };
+        let hi = |v: usize, edge: usize, max: usize| if v == edge { v.saturating_add(pad).min(max) } else { v.saturating_sub(gap) };
+        let out = [lo(a[0], x0), lo(a[1], y0), hi(a[2], x1, w), hi(a[3], y1, h)];
+        (out[0] < out[2] && out[1] < out[3]).then_some(out)
+    };
+    let (bw, bh) = (x1 - x0, y1 - y0);
+    let mut rows = vec![0usize; bh];
+    let mut cols = vec![0usize; bw];
+    for y in y0..y1 {
+        for x in x0..x1 {
+            let i = y * w + x;
+            let mine = matches!(label.get(i), Some(&l) if l == id || l == 0);
+            if mine && ink.get(i).copied().unwrap_or(false) {
+                if let Some(r) = rows.get_mut(y - y0) {
+                    *r += 1;
+                }
+                if let Some(c) = cols.get_mut(x - x0) {
+                    *c += 1;
+                }
+            }
+        }
+    }
+    // A few specks per row are noise, not print.
+    let (row_noise, col_noise) = ((bw / 200).max(1), (bh / 200).max(1));
+    if rows.iter().all(|n| *n <= row_noise) {
+        return place(rect);
+    }
+    if bw as f64 <= 24.0 * px_per_pt && bh as f64 <= 24.0 * px_per_pt {
+        return None;
+    }
+    let longest = |counts: &[usize], allowed: usize| {
+        let (mut best, mut start) = ((0, 0), None);
+        for (i, c) in counts.iter().chain(std::iter::once(&usize::MAX)).enumerate() {
+            match (start, *c <= allowed) {
+                (None, true) => start = Some(i),
+                (Some(s), false) => {
+                    if i - s > best.1 - best.0 {
+                        best = (s, i);
+                    }
+                    start = None;
+                }
+                _ => {}
+            }
+        }
+        best
+    };
+    let (r0, r1) = longest(&rows, row_noise);
+    let (c0, c1) = longest(&cols, col_noise);
+    let tall = |n: usize| n as f64 >= 12.0 * px_per_pt;
+    let wide = |n: usize| n as f64 >= 40.0 * px_per_pt;
+    let band = (tall(r1 - r0) && wide(bw)).then_some([x0, y0 + r0, x1, y0 + r1]);
+    let column = (wide(c1 - c0) && tall(bh)).then_some([x0 + c0, y0, x0 + c1, y1]);
+    band.or(column).and_then(place)
+}
+
+/// A connected piece of a line mask.
+struct Component {
+    x0: usize,
+    x1: usize,
+    y0: usize,
+    y1: usize,
+    count: usize,
+    /// The sum of the rows of its pixels (u64: on 32-bit targets it outgrows `usize`).
+    y_sum: u64,
+}
+
+/// The 8-connected pieces of `mask`.
+fn components(mask: &[bool], w: usize, h: usize) -> Vec<Component> {
+    let mut seen = vec![false; w * h];
+    let mut out = Vec::new();
+    let mut stack: Vec<usize> = Vec::new();
+    for start in 0..w * h {
+        if !mask.get(start).copied().unwrap_or(false) || seen.get(start).copied().unwrap_or(true) {
+            continue;
+        }
+        let mut c = Component { x0: usize::MAX, x1: 0, y0: usize::MAX, y1: 0, count: 0, y_sum: 0 };
+        stack.clear();
+        stack.push(start);
+        if let Some(s) = seen.get_mut(start) {
+            *s = true;
+        }
+        while let Some(i) = stack.pop() {
+            let (x, y) = (i % w, i / w);
+            c.x0 = c.x0.min(x);
+            c.x1 = c.x1.max(x + 1);
+            c.y0 = c.y0.min(y);
+            c.y1 = c.y1.max(y + 1);
+            c.count += 1;
+            c.y_sum = c.y_sum.saturating_add(y as u64);
+            for dy in [-1isize, 0, 1] {
+                for dx in [-1isize, 0, 1] {
+                    let (Some(nx), Some(ny)) = (x.checked_add_signed(dx), y.checked_add_signed(dy)) else { continue };
+                    if nx >= w || ny >= h {
+                        continue;
+                    }
+                    let j = ny * w + nx;
+                    if mask.get(j).copied().unwrap_or(false)
+                        && let Some(s) = seen.get_mut(j)
+                        && !*s
+                    {
+                        *s = true;
+                        stack.push(j);
+                    }
+                }
+            }
+        }
+        out.push(c);
+    }
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// A white page `w` × `h` pixels to draw a form on, two pixels to the point.
+    struct Page {
+        w: usize,
+        h: usize,
+        px: Vec<u8>,
+    }
+
+    const S: f64 = 2.0;
+
+    impl Page {
+        fn new(w: usize, h: usize) -> Self {
+            Page { w, h, px: vec![255; w * h * 4] }
+        }
+        fn fill(&mut self, x0: usize, y0: usize, x1: usize, y1: usize, v: u8) {
+            for y in y0..y1.min(self.h) {
+                for x in x0..x1.min(self.w) {
+                    let i = (y * self.w + x) * 4;
+                    self.px[i..i + 3].copy_from_slice(&[v, v, v]);
+                }
+            }
+        }
+        /// An outlined box, `t` pixels thick.
+        fn frame(&mut self, x0: usize, y0: usize, x1: usize, y1: usize, t: usize) {
+            self.fill(x0, y0, x1, y0 + t, 0);
+            self.fill(x0, y1 - t, x1, y1, 0);
+            self.fill(x0, y0, x0 + t, y1, 0);
+            self.fill(x1 - t, y0, x1, y1, 0);
+        }
+        /// Something like a word: short strokes, none a line.
+        fn word(&mut self, x: usize, y: usize, letters: usize) {
+            for i in 0..letters {
+                self.fill(x + i * 12, y, x + i * 12 + 2, y + 14, 30);
+                self.fill(x + i * 12 + 4, y + 6, x + i * 12 + 9, y + 8, 30);
+            }
+        }
+        fn shapes(&self) -> Shapes {
+            shapes(&self.px, self.w as u32, self.h as u32, S)
+        }
+    }
+
+    /// Points (y up) of a pixel rectangle on a page `h` pixels high.
+    fn pt(h: usize, [x0, y0, x1, y1]: [usize; 4]) -> [f64; 4] {
+        [x0 as f64 / S, (h - y1) as f64 / S, x1 as f64 / S, (h - y0) as f64 / S]
+    }
+
+    fn near(a: [f64; 4], b: [f64; 4], tol: f64) -> bool {
+        a.iter().zip(b).all(|(p, q)| (p - q).abs() <= tol)
+    }
+
+    #[test]
+    fn a_scanned_form_gives_its_rules_boxes_and_check_boxes() {
+        let mut p = Page::new(600, 400);
+        // A label and the rule to write on after it.
+        p.word(20, 40, 4);
+        p.fill(80, 56, 400, 58, 0);
+        // An empty box, and a box with a small label in its top-left corner.
+        p.frame(20, 100, 420, 150, 2);
+        p.frame(20, 180, 420, 260, 2);
+        p.word(26, 186, 3);
+        // A check box (10 pt) with a label to its right.
+        p.frame(20, 300, 40, 320, 2);
+        p.word(50, 303, 5);
+        let s = p.shapes();
+        assert_eq!(s.rules.len(), 1, "{s:?}");
+        let r = s.rules[0];
+        assert!((r[0] - 40.0).abs() < 1.5 && (r[2] - 200.0).abs() < 1.5 && (r[1] - (400.0 - 57.0) / S).abs() < 1.0, "{r:?}");
+        assert_eq!(s.boxes.len(), 3, "{s:?}");
+        // The empty box is the inside of its frame (give or take the line).
+        assert!(s.boxes.iter().any(|b| near(*b, pt(400, [20, 100, 420, 150]), 2.0)), "{s:?}");
+        // The labelled box: only the part below the label.
+        let lower = s.boxes.iter().find(|b| (b[1] - (400.0 - 260.0) / S).abs() < 2.0).expect("labelled box");
+        assert!(lower[3] <= (400.0 - 200.0) / S + 2.0 && lower[3] - lower[1] >= 12.0, "{lower:?}");
+        // The check box is square and about 10 pt.
+        assert!(s.boxes.iter().any(|b| near(*b, pt(400, [20, 300, 40, 320]), 1.5)), "{s:?}");
+    }
+
+    #[test]
+    fn text_and_a_frame_around_the_page_are_not_shapes() {
+        let mut p = Page::new(400, 300);
+        for line in 0..6 {
+            p.word(30, 30 + line * 30, 20);
+        }
+        // A frame around the whole page, and a solid dark bar (a logo, a censored part).
+        p.frame(4, 4, 396, 296, 2);
+        p.fill(40, 240, 360, 270, 0);
+        let s = p.shapes();
+        assert!(s.boxes.is_empty() && s.rules.is_empty(), "{s:?}");
+    }
+
+    #[test]
+    fn noise_and_uneven_paper_do_not_hide_the_lines() {
+        let mut p = Page::new(600, 300);
+        p.fill(80, 56, 400, 58, 0);
+        p.frame(20, 100, 420, 150, 2);
+        p.frame(20, 200, 40, 220, 2);
+        // Paper that darkens to the right (a shadow) and speckled with deterministic noise; the
+        // lines lose some pixels.
+        let mut seed: u32 = 12345;
+        for y in 0..p.h {
+            for x in 0..p.w {
+                seed = seed.wrapping_mul(1_103_515_245).wrapping_add(12345);
+                let noise = (seed >> 16) % 41;
+                let i = (y * p.w + x) * 4;
+                let v = p.px[i];
+                let shade = (x * 60 / p.w) as u8;
+                let v = if v == 0 { if noise < 3 { 200 } else { 40 + noise as u8 } } else { 255u8.saturating_sub(shade).saturating_sub(noise as u8) };
+                p.px[i..i + 3].copy_from_slice(&[v, v, v]);
+            }
+        }
+        let s = p.shapes();
+        assert_eq!(s.rules.len(), 1, "{s:?}");
+        assert_eq!(s.boxes.len(), 2, "{s:?}");
+    }
+
+    #[test]
+    fn malformed_pictures_give_nothing() {
+        let white = vec![255u8; 64 * 64 * 4];
+        assert_eq!(shapes(&white, 64, 64, 2.0), Shapes::default());
+        // Size and data disagree, sizes overflow, or the scale is nonsense.
+        assert_eq!(shapes(&white, 64, 65, 2.0), Shapes::default());
+        assert_eq!(shapes(&white, u32::MAX, u32::MAX, 2.0), Shapes::default());
+        assert_eq!(shapes(&[], 0, 0, 2.0), Shapes::default());
+        for s in [0.0, -1.0, f64::NAN, f64::INFINITY, 1e9] {
+            assert_eq!(shapes(&white, 64, 64, s), Shapes::default(), "{s}");
+        }
+        // All black: one dark area, no lines.
+        let black: Vec<u8> = [0u8, 0, 0, 255].repeat(64 * 64);
+        assert_eq!(shapes(&black, 64, 64, 2.0), Shapes::default());
+    }
+}
diff --git a/crates/forms/src/lib.rs b/crates/forms/src/lib.rs
index 337ae7652..07f4c5484 100644
--- a/crates/forms/src/lib.rs
+++ b/crates/forms/src/lib.rs
@@ -103,6 +103,8 @@ pub struct Widget {
     pub hidden: bool,
     /// `/MK /R` as 0, 90, 180 or 270 degrees counterclockwise. Anything else is stored as 0.
     pub rotation: i64,
+    /// List boxes: where the options are drawn, so a click can pick the one under the pointer.
+    pub list: Option<appearance::ListRows>,
 }
 
 /// A terminal form field.
@@ -800,6 +802,7 @@ fn walk(
                 locked: annot_flags & 128 != 0,
                 hidden: annot_flags & (2 | 32) != 0,
                 rotation: appearance::mk_rotation(doc, wd),
+                list: (kind == FieldKind::List).then(|| appearance::list_rows_of(doc, inh.da.as_deref().unwrap_or("/Helv 0 Tf 0 g"), Some(d), wd)),
             })
         })
         .collect();
@@ -854,10 +857,51 @@ pub fn set_value_with(doc: &mut Document, name: &str, value: &FieldValue, script
         return Err(FormError::ReadOnly(name.into()));
     }
     write_value(doc, f, value, scripts)?;
+    // Fields with the same fully qualified name are one field (§12.7.3.1). Writers that repeat a
+    // name as separate field dictionaries, instead of widgets under one parent, get the value
+    // the first one took after its scripts, without running them again.
+    let twins: Vec<&Field> = all.iter().filter(|t| t.name == name && t.obj != f.obj && t.kind == f.kind).collect();
+    if !twins.is_empty() {
+        let taken = fields(doc).into_iter().find(|x| x.obj == f.obj).map(|x| x.value).unwrap_or_default();
+        for t in twins {
+            share_value(doc, f.obj, t, &taken, scripts)?;
+        }
+    }
     recalculate_with(doc, scripts)?;
     Ok(())
 }
 
+/// Give `twin` the value `source` holds: its `/V` (and a choice's `/I`), drawn in the twin's own
+/// widgets.
+fn share_value(doc: &mut Document, source: ObjRef, twin: &Field, value: &[String], scripts: &mut dyn Scripts) -> Result<(), FormError> {
+    match twin.kind {
+        FieldKind::CheckBox => {
+            let state = twin.widgets.iter().find_map(|w| w.on_state.clone()).unwrap_or_else(|| "Yes".into());
+            set_states(doc, twin, (!value.is_empty()).then_some(state.as_str()))
+        }
+        FieldKind::Radio => {
+            let choice = value.first().filter(|c| twin.widgets.iter().any(|w| w.on_state.as_deref() == Some(c.as_str())));
+            set_states(doc, twin, choice.map(String::as_str))
+        }
+        FieldKind::Text | FieldKind::Combo | FieldKind::List => {
+            let src = doc.get(source).as_dict().cloned().unwrap_or_default();
+            doc.update_dict(twin.obj, |d| {
+                for key in [&b"V"[..], b"I"] {
+                    match src.get(key) {
+                        Some(v) => d.set(key.to_vec(), v.clone()),
+                        None => {
+                            d.remove(key);
+                        }
+                    }
+                }
+                d.remove(b"RV");
+            })?;
+            redraw(doc, twin, value, scripts)
+        }
+        FieldKind::PushButton | FieldKind::Signature => Ok(()),
+    }
+}
+
 /// Run every field's Calculate script in the form's calculation order (`/CO`, then the other
 /// calculated fields), as Acrobat does after any value changes. Returns how many changed.
 pub fn recalculate(doc: &mut Document) -> Result<usize, FormError> {
@@ -1007,8 +1051,21 @@ fn write_value(doc: &mut Document, f: &Field, value: &FieldValue, scripts: &mut
                     }
                 }
             }
-            let indices: Vec<Object> =
+            let mut indices: Vec<Object> =
                 exports.iter().filter_map(|e| f.options.iter().position(|(x, _)| x == e)).map(|i| Object::Int(i as i64)).collect();
+            // /I lists option indices in ascending order; /V keeps the caller's value order.
+            // Every entry above is an integer, so this sorts by its numeric option index.
+            indices.sort_unstable_by_key(Object::as_int);
+            // A list box scrolls (`/TI`) so the picked options are among the rows it draws, as
+            // in other viewers: a pick below the last visible row would otherwise not show (#1524).
+            let top = match (f.kind, f.widgets.first()) {
+                (FieldKind::List, Some(w)) => w.list.map(|rows| {
+                    let height = if matches!(w.rotation, 90 | 270) { w.rect[2] - w.rect[0] } else { w.rect[3] - w.rect[1] };
+                    let picked: Vec<usize> = indices.iter().filter_map(|i| i.as_int()).filter_map(|i| usize::try_from(i).ok()).collect();
+                    (rows.top, appearance::ListRows::top_showing(rows.top, &picked, rows.visible(height), f.options.len()))
+                }),
+                _ => None,
+            };
             doc.update_dict(f.obj, |d| {
                 match exports.as_slice() {
                     [] => {
@@ -1022,7 +1079,22 @@ fn write_value(doc: &mut Document, f: &Field, value: &FieldValue, scripts: &mut
                 } else {
                     d.set(b"I".to_vec(), Object::Array(indices));
                 }
+                if let Some((old, new)) = top
+                    && old != new
+                {
+                    d.set(b"TI".to_vec(), Object::Int(i64::try_from(new).unwrap_or(0)));
+                }
             })?;
+            // A widget with its own `/TI` (read before the field's) scrolls too.
+            if let Some((old, new)) = top
+                && old != new
+            {
+                for w in f.widgets.iter().filter(|w| w.obj != f.obj) {
+                    if doc.get(w.obj).as_dict().is_some_and(|d| d.contains(b"TI")) {
+                        doc.update_dict(w.obj, |d| d.set(b"TI".to_vec(), Object::Int(i64::try_from(new).unwrap_or(0))))?;
+                    }
+                }
+            }
             redraw(doc, f, &exports, scripts)
         }
         (FieldKind::PushButton, _) => invalid(format!("{:?} is a button; it has no value", f.name)),
diff --git a/crates/forms/src/scripting.rs b/crates/forms/src/scripting.rs
index 012dbb831..9a857510b 100644
--- a/crates/forms/src/scripting.rs
+++ b/crates/forms/src/scripting.rs
@@ -6,7 +6,9 @@
 //! calculation order, Format when the appearance is drawn — and applies what the script asks
 //! for: the event's value, `rc`, and changes to other fields.
 
-use pdfcraft_cos::{Document, Object, PdfString};
+use std::collections::HashSet;
+
+use pdfcraft_cos::{Document, ObjRef, Object, PdfString};
 
 use crate::{Field, FieldKind, FieldValue, FormError, fields, flags};
 
@@ -172,18 +174,27 @@ pub fn document_scripts_named(doc: &Document) -> Vec<(String, String)> {
     let Some(root) = doc.root() else { return Vec::new() };
     let cat = doc.get(root);
     let Some(names) = cat.as_dict().and_then(|c| c.get(b"Names")).map(|n| doc.resolve(n)) else { return Vec::new() };
-    let Some(tree) = names.as_dict().and_then(|n| n.get(b"JavaScript")).map(|t| doc.resolve(t)) else { return Vec::new() };
+    let Some(tree) = names.as_dict().and_then(|n| n.get(b"JavaScript")).cloned() else { return Vec::new() };
     let mut out: Vec<(String, String)> = Vec::new();
-    let mut stack = vec![(*tree).clone()];
-    let mut seen = 0;
-    while let Some(node) = stack.pop() {
-        seen += 1;
-        if seen > 10_000 {
+    // Kids stay unresolved on the stack, and each node is read once: a node listed many times,
+    // or among its own kids, must not multiply the work.
+    let mut stack = vec![tree];
+    let mut seen: HashSet<ObjRef> = HashSet::new();
+    let mut visited = 0;
+    while let Some(raw) = stack.pop() {
+        if let Object::Ref(r) = raw
+            && !seen.insert(r)
+        {
+            continue;
+        }
+        visited += 1;
+        if visited > 10_000 {
             break;
         }
+        let node = doc.resolve(&raw);
         let Some(d) = node.as_dict() else { continue };
         if let Some(kids) = d.get(b"Kids").map(|k| doc.resolve(k)).and_then(|k| k.as_array().cloned()) {
-            stack.extend(kids.iter().map(|k| (*doc.resolve(k)).clone()));
+            stack.extend(kids);
         }
         if let Some(pairs) = d.get(b"Names").map(|n| doc.resolve(n)).and_then(|n| n.as_array().cloned()) {
             for pair in pairs.chunks(2) {
diff --git a/crates/forms/src/tests.rs b/crates/forms/src/tests.rs
index 0256bfafb..ef545cd43 100644
--- a/crates/forms/src/tests.rs
+++ b/crates/forms/src/tests.rs
@@ -607,6 +607,57 @@ fn choices_accept_exports_or_display_text() {
     assert!(matches!(set_value(&mut doc, "country", &FieldValue::Choice(vec!["ca".into(), "fr".into()])), Err(FormError::Invalid(_))));
 }
 
+#[test]
+fn list_box_selection_scrolls_to_show_selected_options() {
+    let objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm 4 0 R >>".into(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 600 800] >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Annots [6 0 R] >>".into(),
+        "<< /Fields [6 0 R] /DA (/Helv 10 Tf 0 g) /DR << /Font << /Helv 5 0 R >> >> >>".into(),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >>".into(),
+        "<< /Type /Annot /Subtype /Widget /FT /Ch /T (days) /Ff 2097152 /Opt [(Mon) (Tue) (Wed) (Thu) (Fri)] /Rect [50 700 200 746] /P 3 0 R >>"
+            .into(),
+    ];
+    let mut doc = document(&objs);
+    // Setting value to Tue and Thu (indices 1 and 3) in a 46 pt high box (fits 3 rows).
+    // It should scroll /TI to 1 so Tue (1), Wed (2), Thu (3) are drawn and highlighted.
+    set_value(&mut doc, "days", &FieldValue::Choice(vec!["Tue".into(), "Thu".into()])).unwrap();
+    let doc = reopen(&doc);
+    let all = fields(&doc);
+    let days = field(&all, "days");
+    assert_eq!(days.value, ["Tue", "Thu"]);
+    let ti = doc.get(days.obj).as_dict().unwrap().get(b"TI").and_then(|o| o.as_int());
+    assert_eq!(ti, Some(1), "TI scrolled to 1 so both selected options are visible");
+    let appearance = ap(&doc, &days.widgets[0]);
+    assert!(appearance.contains("(Tue) Tj"), "Tue is drawn: {appearance}");
+    assert!(appearance.contains("(Thu) Tj"), "Thu is drawn: {appearance}");
+    assert_eq!(appearance.matches("0.6 0.75 0.86 rg").count(), 2, "both Tue and Thu highlighted");
+}
+
+#[test]
+fn multiselect_choice_indices_are_sorted_without_reordering_values() {
+    let mut forward_appearance = None;
+    for values in [["Ham", "Olives"], ["Olives", "Ham"]] {
+        let mut doc = fixture();
+        let chosen: Vec<String> = values.iter().map(|value| (*value).into()).collect();
+        set_value(&mut doc, "toppings", &FieldValue::Choice(chosen.clone())).unwrap();
+        let doc = reopen(&doc);
+        let all = fields(&doc);
+        let list = field(&all, "toppings");
+        assert_eq!(list.value, chosen, "saving preserves the caller's /V order");
+        let object = doc.get(list.obj);
+        let indices = object.as_dict().unwrap().get(b"I").unwrap().as_array().unwrap();
+        assert_eq!(indices.iter().map(|index| index.as_int().unwrap()).collect::<Vec<_>>(), [1, 2], "saved option indices are ascending");
+        let appearance = ap(&doc, &list.widgets[0]);
+        assert_eq!(appearance.matches("0.6 0.75 0.86 rg").count(), 2, "both selected rows stay highlighted");
+        if let Some(forward) = &forward_appearance {
+            assert_eq!(&appearance, forward, "the same selected rows have the same appearance in either selection order");
+        } else {
+            forward_appearance = Some(appearance);
+        }
+    }
+}
+
 #[test]
 fn errors_are_specific_and_change_nothing() {
     let mut doc = fixture();
@@ -895,6 +946,34 @@ fn formats_validation_and_calculations_run_like_acrobat() {
     assert_eq!(field(&fields(&doc), "Price").actions.format, Format::None);
 }
 
+#[test]
+fn new_text_fields_fit_their_box() {
+    // #1888: a fixed 12 pt was clipped in a short box. New text and date fields take Acrobat's
+    // Auto size: 12 pt where there is room, smaller where there isn't.
+    let mut doc = one_page();
+    let tf_size = |ap: &str| {
+        ap.split("/Helv ")
+            .nth(1)
+            .and_then(|s| s.split(' ').next())
+            .and_then(|n| n.parse::<f64>().ok())
+            .unwrap_or_else(|| panic!("no /Helv size in {ap}"))
+    };
+    for (kind, name, value) in [(NewField::Text { multiline: false }, "short", "Hello world"), (NewField::Date, "date", "10/13/2026")] {
+        add_field(&mut doc, 0, [20.0, 20.0, 200.0, 28.0], &kind, Some(name)).unwrap();
+        set_value(&mut doc, name, &FieldValue::Text(value.into())).unwrap();
+        let f = field(&fields(&doc), name).clone();
+        assert_eq!(f.da, "/Helv 0 Tf 0 g", "{name}");
+        let size = tf_size(&ap(&doc, &f.widgets[0]));
+        assert!(size > 0.0 && size <= 8.0, "{name}: {size} pt in an 8 pt box");
+    }
+    add_field(&mut doc, 0, [20.0, 50.0, 200.0, 72.0], &NewField::Text { multiline: false }, Some("tall")).unwrap();
+    set_value(&mut doc, "tall", &FieldValue::Text("Hello world".into())).unwrap();
+    assert_eq!(tf_size(&ap(&doc, &field(&fields(&doc), "tall").widgets[0])), 12.0, "a box with room keeps the 12 pt look");
+    // An explicit size still wins.
+    set_props(&mut doc, "short", &FieldProps { font_size: Some(12.0), ..FieldProps::default() }).unwrap();
+    assert_eq!(tf_size(&ap(&doc, &field(&fields(&doc), "short").widgets[0])), 12.0);
+}
+
 #[test]
 fn appearance_properties_restyle_every_widget() {
     let mut doc = one_page();
@@ -1121,6 +1200,49 @@ fn duplicating_a_field_across_pages_shares_its_value() {
     assert!(duplicate_field(&mut doc.clone(), &name, &[7]).is_err());
 }
 
+/// Fields with the same fully qualified name are one field (§12.7.3.1): a parent whose widgets are
+/// its kids, as Duplicate Across Pages writes it, and separate field dictionaries that repeat the
+/// same `/T`, as other writers do. Filling the name fills every one of them.
+#[test]
+fn fields_sharing_a_name_take_the_same_value() {
+    let objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm 5 0 R >>".into(),                         // 1
+        "<< /Type /Pages /Kids [3 0 R 4 0 R] /Count 2 /MediaBox [0 0 600 800] >>".into(),   // 2
+        "<< /Type /Page /Parent 2 0 R /Annots [7 0 R 11 0 R] >>".into(),                    // 3
+        "<< /Type /Page /Parent 2 0 R /Annots [8 0 R 9 0 R 12 0 R] >>".into(),              // 4
+        "<< /Fields [6 0 R 9 0 R 11 0 R 12 0 R] /DA (/Helv 0 Tf 0 g) /DR << /Font << /Helv 10 0 R >> >> >>".into(), // 5
+        "<< /FT /Tx /T (ClientName) /Kids [7 0 R 8 0 R] >>".into(),                         // 6 parent
+        "<< /Type /Annot /Subtype /Widget /Parent 6 0 R /Rect [50 700 250 720] /P 3 0 R >>".into(), // 7 its widget, page 1
+        "<< /Type /Annot /Subtype /Widget /Parent 6 0 R /Rect [50 700 250 720] /P 4 0 R >>".into(), // 8 its widget, page 2
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (ClientName) /Rect [50 600 250 620] /P 4 0 R >>".into(), // 9 same name, own field
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >>".into(), // 10
+        "<< /Type /Annot /Subtype /Widget /FT /Btn /T (Agree) /V /Off /AS /Off /Rect [300 700 315 715] /P 3 0 R /AP << /N << /Yes 13 0 R /Off 14 0 R >> >> >>".into(), // 11
+        "<< /Type /Annot /Subtype /Widget /FT /Btn /T (Agree) /V /Off /AS /Off /Rect [300 700 315 715] /P 4 0 R /AP << /N << /Yes 13 0 R /Off 14 0 R >> >> >>".into(), // 12
+        "<< /Length 0 >>\nstream\n\nendstream".into(),                                      // 13
+        "<< /Length 0 >>\nstream\n\nendstream".into(),                                      // 14
+    ];
+    let mut doc = document(&objs);
+    set_value(&mut doc, "ClientName", &FieldValue::Text("Ada Lovelace".into())).unwrap();
+    set_value(&mut doc, "Agree", &FieldValue::Check(true)).unwrap();
+    let doc = reopen(&doc);
+    let v = |n: u32| doc.get(ObjRef { num: n, generation: 0 }).as_dict().unwrap().get(b"V").cloned();
+    let typed = Some(Object::String(PdfString::text("Ada Lovelace")));
+    assert_eq!((v(6), v(9)), (typed.clone(), typed), "the value sits on the parent and on the field that repeats its name");
+    assert_eq!((v(7), v(8)), (None, None), "the parent's widgets carry no value of their own");
+    let all = fields(&doc);
+    let named: Vec<&Field> = all.iter().filter(|f| f.name == "ClientName").collect();
+    let widgets: Vec<&Widget> = named.iter().flat_map(|f| &f.widgets).collect();
+    assert_eq!(widgets.iter().map(|w| w.obj.num).collect::<Vec<_>>(), [7, 8, 9]);
+    for w in widgets {
+        assert!(ap(&doc, w).contains("Ada Lovelace"), "widget {} shows the value", w.obj.num);
+    }
+    let agree: Vec<&Field> = all.iter().filter(|f| f.name == "Agree").collect();
+    assert_eq!(agree.len(), 2);
+    for f in agree {
+        assert_eq!((f.value.as_slice(), f.widgets[0].state.as_deref()), (&["Yes".to_string()][..], Some("Yes")), "check box {}", f.obj.num);
+    }
+}
+
 #[test]
 fn locked_fields_only_take_unlocking() {
     let mut doc = one_page();
@@ -1943,3 +2065,42 @@ fn page_shapes_closes_only_last_stroked_subpath_but_all_filled_subpaths() {
     assert_eq!(filled.boxes, [[50.0, 100.0, 170.0, 140.0], [200.0, 100.0, 320.0, 140.0]]);
     assert!(filled.rules.is_empty());
 }
+
+#[test]
+fn auto_text_size_fits_single_and_multiline_text() {
+    use crate::appearance::auto_text_size;
+    use pdfcraft_fonts::{helvetica_width, wrap_with};
+    let long = "Weekly progress and diligence: CoBank refi, IL and Redwood Falls";
+    // Single line: the height's size for short text, shrunk to the width for long text.
+    assert_eq!(auto_text_size("Hi", 94.0, 8.0, false, helvetica_width), 8.0 / 1.15);
+    let s = auto_text_size(long, 194.0, 8.0, false, helvetica_width);
+    assert!(s > 4.0 && s < 8.0 / 1.15 && helvetica_width(long, s) <= 194.0 + 1e-9, "{s}");
+    // Never past 12 pt or under 4 pt.
+    assert_eq!(auto_text_size("Hi", 500.0, 500.0, false, helvetica_width), 12.0);
+    assert_eq!(auto_text_size(&long.repeat(20), 20.0, 8.0, false, helvetica_width), 4.0);
+    // Multiline: the largest size whose wrapped lines fit the height.
+    let m = auto_text_size(long, 114.0, 44.0, true, helvetica_width);
+    assert!(wrap_with(long, m, 114.0, helvetica_width).len() as f64 * m * 1.15 <= 44.0, "{m}");
+    assert!(wrap_with(long, m + 0.5, 114.0, helvetica_width).len() as f64 * (m + 0.5) * 1.15 > 44.0, "{m} is the largest that fits");
+    // Hostile boxes and measurements don't panic or return nonsense.
+    for (w, h) in [(f64::NAN, 10.0), (10.0, f64::INFINITY), (-5.0, -5.0), (0.0, 0.0)] {
+        for multiline in [false, true] {
+            let s = auto_text_size(long, w, h, multiline, helvetica_width);
+            assert!((4.0..=12.0).contains(&s), "{w}×{h}: {s}");
+        }
+    }
+    assert_eq!(auto_text_size(long, 50.0, 10.0, false, |_, _| f64::NAN), 10.0 / 1.15);
+}
+
+#[test]
+fn document_scripts_read_each_name_tree_node_once() {
+    // The root lists itself and the leaf twice each.
+    let doc = document(&[
+        "<< /Type /Catalog /Pages 2 0 R /Names << /JavaScript 3 0 R >> >>".into(),
+        "<< /Type /Pages /Kids [] /Count 0 >>".into(),
+        "<< /Kids [3 0 R 4 0 R 3 0 R 4 0 R] >>".into(),
+        "<< /Names [(init) 5 0 R] >>".into(),
+        "<< /S /JavaScript /JS (var ready = true;) >>".into(),
+    ]);
+    assert_eq!(document_scripts_named(&doc), [("init".to_string(), "var ready = true;".to_string())]);
+}
diff --git a/crates/js/src/formcalc.rs b/crates/js/src/formcalc.rs
index 5942391ba..059276e93 100644
--- a/crates/js/src/formcalc.rs
+++ b/crates/js/src/formcalc.rs
@@ -1913,7 +1913,17 @@ fn parse_date(text: &str, picture: &str) -> Option<(i64, u32, u32)> {
         }
     }
     let (y, m, d) = (y?, m.unwrap_or(1), d.unwrap_or(1));
-    ((-200_000..=200_000).contains(&y) && (1..=12).contains(&m) && (1..=31).contains(&d)).then_some((y, m, d))
+    ((-200_000..=200_000).contains(&y) && (1..=12).contains(&m) && (1..=days_in(y, m)).contains(&d)).then_some((y, m, d))
+}
+
+/// Number of days in month `m` (1-12) of year `y`, leap years included.
+fn days_in(y: i64, m: u32) -> u32 {
+    match m {
+        2 if (y % 4 == 0 && y % 100 != 0) || y % 400 == 0 => 29,
+        2 => 28,
+        4 | 6 | 9 | 11 => 30,
+        _ => 31,
+    }
 }
 
 fn format_date(y: i64, m: u32, d: u32, picture: &str) -> String {
diff --git a/crates/js/src/lib.rs b/crates/js/src/lib.rs
index ef2fc0594..d8d9fa8ba 100644
--- a/crates/js/src/lib.rs
+++ b/crates/js/src/lib.rs
@@ -783,8 +783,10 @@ fn printd(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue>
                 out.push_str(if run >= 2 { ampm } else { &ampm[..1] });
             }
             b'\\' if i + 1 < b.len() => {
-                out.push(b[i + 1] as char);
-                i += 2;
+                // The escaped character may be multi-byte; copy it whole.
+                let ch = fmt[i + 1..].chars().next().unwrap_or(' ');
+                out.push(ch);
+                i += 1 + ch.len_utf8();
                 continue;
             }
             _ => {
diff --git a/crates/js/src/tests.rs b/crates/js/src/tests.rs
index c8ee81218..55fa45760 100644
--- a/crates/js/src/tests.rs
+++ b/crates/js/src/tests.rs
@@ -94,6 +94,17 @@ fn util_printf_printd_and_printx() {
     assert_eq!(o.value, "1,234,567.89|00042|hi|FF|1.234,50|Jan 5, 2024 09:07|Friday|(555) 123-4567|ABC");
 }
 
+#[test]
+fn printd_escapes_multibyte_chars() {
+    let o = go(
+        "event.value = [util.printd('yyyy \\\\é', new Date(2024, 0, 5)), util.printd('\\\\€ yyyy', new Date(2024, 0, 5)), \
+         util.printd('\\\\y yyyy', new Date(2024, 0, 5))].join('|');",
+        &Event::field("Calculate", "total", ""),
+    );
+    assert_eq!(o.error, None);
+    assert_eq!(o.value, "2024 é|€ 2024|y 2024");
+}
+
 fn assert_printf_error(script: &str, message: &str) {
     let o = go(script, &Event::doc("Open"));
     assert!(o.error.as_deref().is_some_and(|e| e.starts_with(message)), "{script}: {:?}", o.error);
@@ -681,6 +692,20 @@ mod formcalc {
         assert!(go("Nope(1)", "form1[0].page1[0].total[0]", "calculate").error.unwrap().contains("unknown function"));
     }
 
+    #[test]
+    fn date2num_rejects_days_past_the_end_of_the_month() {
+        assert_eq!(calc(r#"Date2Num("2023-02-30")"#), "0");
+        assert_eq!(calc(r#"Date2Num("31/04/2024", "DD/MM/YYYY")"#), "0");
+        assert_eq!(calc(r#"Date2Num("2023-02-29")"#), "0");
+        assert_eq!(calc(r#"Date2Num("1900-02-29")"#), "0");
+        assert_eq!(calc(r#"Parse("YYYY-MM-DD", "2023-02-30") == null"#), "1");
+        // Valid month ends still work.
+        assert_eq!(calc(r#"Date2Num("2024-02-29")"#), "45350");
+        assert_eq!(calc(r#"Date2Num("2000-02-29") <> 0"#), "1");
+        assert_eq!(calc(r#"Date2Num("2024-04-30") <> 0"#), "1");
+        assert_eq!(calc(r#"Date2Num("2024-12-31") <> 0"#), "1");
+    }
+
     #[test]
     fn control_flow_variables_and_functions_work() {
         assert_eq!(calc("var x = 3\nif (x > 2) then 10 elseif (x > 1) then 20 else 30 endif"), "10");
diff --git a/crates/measure/Cargo.toml b/crates/measure/Cargo.toml
index eb2de9422..66f071c92 100644
--- a/crates/measure/Cargo.toml
+++ b/crates/measure/Cargo.toml
@@ -15,3 +15,6 @@ pdfcraft-content = { workspace = true }
 pdfcraft-annot = { workspace = true }
 serde = { workspace = true }
 thiserror = { workspace = true }
+
+[dev-dependencies]
+pdfcraft-testkit = { workspace = true }
diff --git a/crates/measure/src/tests.rs b/crates/measure/src/tests.rs
index 20a730bed..6af32632f 100644
--- a/crates/measure/src/tests.rs
+++ b/crates/measure/src/tests.rs
@@ -1,30 +1,18 @@
 use super::*;
 use pdfcraft_cos::{SaveOptions, write_full};
+use pdfcraft_testkit::Pdf;
 use std::sync::Arc;
 fn fixture(content: &str, attrs: &str, extra: &[&str]) -> Document {
     fixture_with("4 0 R", content, attrs, extra)
 }
 fn fixture_with(contents: &str, content: &str, attrs: &str, extra: &[&str]) -> Document {
-    let mut objects = vec![
-        "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
-        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 612 792] >>".into(),
-        format!("<< /Type /Page /Parent 2 0 R /Contents {contents} /Resources << /XObject << /Nested 5 0 R >> >> {attrs} >>"),
-        format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len()),
-    ];
-    objects.extend(extra.iter().map(|s| s.to_string()));
-    let mut bytes = b"%PDF-1.7\n".to_vec();
-    let mut offsets = Vec::new();
-    for (i, o) in objects.iter().enumerate() {
-        offsets.push(bytes.len());
-        bytes.extend(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
-    }
-    let xref = bytes.len();
-    bytes.extend(format!("xref\n0 {}\n0000000000 65535 f \n", objects.len() + 1).as_bytes());
-    for o in offsets {
-        bytes.extend(format!("{o:010} 00000 n \n").as_bytes());
-    }
-    bytes.extend(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objects.len() + 1).as_bytes());
-    Document::open(Arc::new(bytes)).unwrap()
+    let pdf = Pdf::new()
+        .obj("<< /Type /Catalog /Pages 2 0 R >>")
+        .obj("<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 612 792] >>")
+        .obj(format!("<< /Type /Page /Parent 2 0 R /Contents {contents} /Resources << /XObject << /Nested 5 0 R >> >> {attrs} >>"))
+        .stream("", content)
+        .objs(extra);
+    Document::open(Arc::new(pdf.build())).unwrap()
 }
 fn close(a: f64, b: f64) {
     assert!((a - b).abs() < 1e-8, "{a} != {b}");
diff --git a/crates/model/README.md b/crates/model/README.md
index 06c30b039..bfc6e42e3 100644
--- a/crates/model/README.md
+++ b/crates/model/README.md
@@ -9,9 +9,14 @@ L3/L4 crates need:
   geometry, and the matrix from "display space" (points, origin at the bottom-left of the page as
   shown, after `/UserUnit` and `/Rotate`) to user space, so content can be placed the way the
   reader sees the page. `/UserUnit` is read as Acrobat reads it: the page's own entry, a number
-  from 1 up, at most 75,000; anything else counts as 1.
+  from 1 up, at most 75,000; anything else counts as 1. A `/Rotate` that isn't a multiple of 90
+  counts as 0, as the renderer draws it.
   `view_matrix_for(rotation, rect)` is the same matrix for any rectangle, e.g. to draw a
   comment's picture upright inside its user-space `/Rect` on a turned page.
 
+The page-tree walk keeps one cursor per ancestor and shares inherited attribute owners.
+Repeated child references are skipped before copying attributes, with first depth-first
+occurrence order preserved. Returned page dictionaries still own their effective attributes.
+
 `organize`, `annot` and `forms` still carry their own small walkers; they move here as the model
 grows (ADR-0004).
diff --git a/crates/model/src/lib.rs b/crates/model/src/lib.rs
index 4e4f3f53b..38bf36f22 100644
--- a/crates/model/src/lib.rs
+++ b/crates/model/src/lib.rs
@@ -37,9 +37,11 @@ impl Page {
         }
     }
 
-    /// Clockwise rotation when displayed: 0, 90, 180 or 270.
+    /// Clockwise rotation when displayed: 0, 90, 180 or 270. A `/Rotate` that isn't a multiple
+    /// of 90 (ISO 32000-2 §7.7.3.3 requires one) counts as 0, as the renderer draws that page.
     pub fn rotation(&self, doc: &Document) -> i64 {
-        self.dict.get(b"Rotate").and_then(|o| doc.resolve(o).as_int()).unwrap_or(0).rem_euclid(360) / 90 * 90
+        let r = self.dict.get(b"Rotate").and_then(|o| doc.resolve(o).as_int()).unwrap_or(0).rem_euclid(360);
+        if r % 90 == 0 { r } else { 0 }
     }
 
     /// The size of the page's user-space unit in points (`/UserUnit`; it isn't inherited), read
@@ -82,44 +84,97 @@ pub fn view_matrix_for(rotation: i64, crop: [f64; 4]) -> [f64; 6] {
 /// Leaf pages in document order, with inherited attributes resolved. Cycles and absurdly deep
 /// trees are cut off rather than followed.
 pub fn pages(doc: &Document) -> Vec<Page> {
-    let Some(root) = doc.root() else { return Vec::new() };
-    let Some(top) = doc.get(root).as_dict().and_then(|d| d.reference(b"Pages")) else { return Vec::new() };
-    let mut out = Vec::new();
-    let mut seen = std::collections::HashSet::new();
-    let mut stack: Vec<(ObjRef, Dict)> = vec![(top, Dict::new())];
-    while let Some((node, inherited)) = stack.pop() {
-        if !seen.insert(node) || seen.len() > 1_000_000 {
-            continue;
-        }
-        let obj = doc.get(node);
-        let Some(d) = obj.as_dict() else { continue };
-        let mut attrs = inherited.clone();
-        for k in INHERITABLE {
-            if let Some(v) = d.get(k) {
-                attrs.set(k.to_vec(), v.clone());
-            }
-        }
-        let is_pages = d.name(b"Type") == Some(b"Pages") || (d.contains(b"Kids") && d.name(b"Type") != Some(b"Page"));
-        if is_pages {
-            let kids = d.get(b"Kids").map(|k| doc.resolve(k)).and_then(|k| k.as_array().cloned()).unwrap_or_default();
-            for k in kids.iter().rev() {
-                if let Some(r) = k.as_ref() {
-                    stack.push((r, attrs.clone()));
-                }
-            }
-        } else {
-            let mut dict = d.clone();
-            for k in INHERITABLE {
-                if !dict.contains(k)
-                    && let Some(v) = attrs.get(k)
-                {
-                    dict.set(k.to_vec(), v.clone());
-                }
-            }
-            out.push(Page { obj: node, dict });
+    PageTree::new(doc).collect()
+}
+
+// Retain the owner of each inherited value rather than deep-cloning direct Resources on
+// every edge. Only the final Page dictionaries need owned copies of those values.
+type Inherited = [Option<std::sync::Arc<Object>>; 4];
+
+struct Children {
+    owner: std::sync::Arc<Object>,
+    next: usize,
+    inherited: Inherited,
+}
+
+impl Children {
+    fn kids(&self) -> Option<&Vec<Object>> {
+        match &*self.owner {
+            Object::Dict(d) => d.get(b"Kids")?.as_array(),
+            other => other.as_array(),
         }
     }
-    out
+}
+
+struct PageTree<'a> {
+    doc: &'a Document,
+    seen: std::collections::HashSet<ObjRef>,
+    // One cursor per ancestor, never one entry per child. This also preserves the first
+    // depth-first occurrence's attributes when malformed trees share a child.
+    pending: Vec<Children>,
+}
+
+impl<'a> PageTree<'a> {
+    fn new(doc: &'a Document) -> Self {
+        let top = doc.root().and_then(|r| doc.get(r).as_dict().and_then(|d| d.reference(b"Pages")));
+        let pending = top
+            .into_iter()
+            .map(|r| Children { owner: std::sync::Arc::new(Object::Array(vec![Object::Ref(r)])), next: 0, inherited: Default::default() })
+            .collect();
+        Self { doc, seen: Default::default(), pending }
+    }
+}
+
+impl Iterator for PageTree<'_> {
+    type Item = Page;
+
+    fn next(&mut self) -> Option<Page> {
+        while let Some(parent) = self.pending.last_mut() {
+            let Some(child) = parent.kids().and_then(|kids| kids.get(parent.next)) else {
+                self.pending.pop();
+                continue;
+            };
+            let node = child.as_ref();
+            // A successful get means next is strictly below the allocated array length.
+            parent.next += 1;
+            let Some(node) = node else { continue };
+            if self.seen.len() >= 1_000_000 {
+                self.pending.clear();
+                return None;
+            }
+            if !self.seen.insert(node) {
+                continue;
+            }
+            let obj = self.doc.get(node);
+            let Some(d) = obj.as_dict() else { continue };
+            let mut inherited = parent.inherited.clone();
+            for (key, owner) in INHERITABLE.iter().zip(&mut inherited) {
+                if d.contains(key) {
+                    *owner = Some(obj.clone());
+                }
+            }
+            let is_pages = d.name(b"Type") == Some(b"Pages") || (d.contains(b"Kids") && d.name(b"Type") != Some(b"Page"));
+            if is_pages {
+                let owner = match d.get(b"Kids") {
+                    Some(Object::Ref(r)) => self.doc.get(*r),
+                    Some(Object::Array(_)) => obj.clone(),
+                    _ => continue,
+                };
+                self.pending.push(Children { owner, next: 0, inherited });
+            } else {
+                let mut dict = d.clone();
+                for (key, owner) in INHERITABLE.iter().zip(&inherited) {
+                    if !dict.contains(key)
+                        && let Some(value) = owner.as_ref().and_then(|o| o.as_dict()).and_then(|d| d.get(key))
+                    {
+                        dict.set(key.to_vec(), value.clone());
+                    }
+                }
+                return Some(Page { obj: node, dict });
+            }
+        }
+        None
+    }
 }
 
 #[cfg(test)]
@@ -154,6 +209,68 @@ mod tests {
         Document::open(Arc::new(out)).unwrap()
     }
 
+    #[test]
+    fn repeated_children_do_not_queue_resource_copies() {
+        let mut d = doc(0);
+        let root = ObjRef { num: 2, generation: 0 };
+        let leaf = ObjRef { num: 3, generation: 0 };
+        d.update_dict(root, |dict| {
+            // Modest fixture: the assertion measures retained work, not an OOM or timing.
+            dict.set(b"Kids".to_vec(), Object::Array(vec![Object::Ref(leaf); 128]));
+            let mut resources = Dict::new();
+            resources.set(b"Payload".to_vec(), Object::Array(vec![Object::Int(42); 1024]));
+            dict.set(b"Resources".to_vec(), Object::Dict(resources));
+        })
+        .unwrap();
+        let mut walk = PageTree::new(&d);
+        let p = walk.next().unwrap();
+        assert_eq!(p.obj, leaf);
+        assert_eq!(p.dict.get(b"Resources").unwrap().as_dict().unwrap().get(b"Payload").unwrap().as_array().unwrap().len(), 1024);
+        assert!(walk.pending.len() <= 2, "duplicate edges retained {} pending entries", walk.pending.len());
+        assert!(walk.next().is_none());
+    }
+
+    #[test]
+    fn shared_children_keep_depth_first_order_and_nearest_attributes() {
+        let mut d = doc(0);
+        let root = ObjRef { num: 2, generation: 0 };
+        let leaf = ObjRef { num: 3, generation: 0 };
+        let mut second = d.get(leaf).as_dict().unwrap().clone();
+        second.set(b"Rotate".to_vec(), Object::Int(180));
+        let second = d.add(second);
+        let mut branch = Dict::new();
+        branch.set(b"Type".to_vec(), Object::name("Pages"));
+        branch.set(b"Rotate".to_vec(), Object::Int(90));
+        // A cycle, a shared child, an invalid entry, and an indirect Kids array.
+        let kids = d.add(Object::Array(vec![Object::Ref(root), Object::Null, Object::Ref(leaf), Object::Ref(second)]));
+        branch.set(b"Kids".to_vec(), Object::Ref(kids));
+        let branch = d.add(branch);
+        d.update_dict(root, |dict| {
+            dict.set(b"Kids".to_vec(), Object::Array(vec![Object::Ref(branch), Object::Ref(leaf), Object::Ref(second)]));
+        })
+        .unwrap();
+        let pages = pages(&d);
+        assert_eq!(pages.iter().map(|p| p.obj).collect::<Vec<_>>(), vec![leaf, second]);
+        assert_eq!(pages[0].rotation(&d), 90, "first depth-first occurrence supplies inheritance");
+        assert_eq!(pages[1].rotation(&d), 180, "a leaf's own attribute wins");
+        assert!(pages.iter().all(|p| p.dict.contains(b"Resources")));
+    }
+
+    #[test]
+    fn wide_page_tree_retains_only_ancestor_cursors() {
+        let mut d = doc(0);
+        let root = ObjRef { num: 2, generation: 0 };
+        let leaf = d.get(ObjRef { num: 3, generation: 0 }).as_dict().unwrap().clone();
+        let kids: Vec<Object> = (0..64).map(|_| Object::Ref(d.add(leaf.clone()))).collect();
+        d.update_dict(root, |dict| dict.set(b"Kids".to_vec(), Object::Array(kids.clone()))).unwrap();
+        let mut walk = PageTree::new(&d);
+        for kid in kids {
+            assert_eq!(walk.next().unwrap().obj, kid.as_ref().unwrap());
+            assert!(walk.pending.len() <= 2);
+        }
+        assert!(walk.next().is_none());
+    }
+
     fn apply(m: [f64; 6], x: f64, y: f64) -> [f64; 2] {
         [m[0] * x + m[2] * y + m[4], m[1] * x + m[3] * y + m[5]]
     }
@@ -184,6 +301,21 @@ mod tests {
         }
     }
 
+    /// A `/Rotate` that isn't a quarter turn counts as 0, as the renderer draws the page
+    /// upright, so display space matches what's on screen.
+    #[test]
+    fn rotate_off_a_quarter_turn_counts_as_upright() {
+        for rotate in [135, 30, -45, 359] {
+            let d = doc(rotate);
+            let p = &pages(&d)[0];
+            assert_eq!(p.rotation(&d), 0, "{rotate}");
+            assert_eq!(p.display_size(&d), (200.0, 300.0), "{rotate}");
+            assert_eq!(p.view_matrix(&d), [1.0, 0.0, 0.0, 1.0, 10.0, 20.0], "{rotate}");
+        }
+        let d = doc(-90);
+        assert_eq!(pages(&d)[0].rotation(&d), 270);
+    }
+
     /// Display space is in points: `/UserUnit 2` doubles it. As in Acrobat, the value isn't
     /// inherited, values below 1 or not numbers count as 1, and values over 75,000 as 75,000.
     #[test]
diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index 7c1c81871..32915af6b 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -5,12 +5,23 @@ Advanced optimization).
 
 ```rust
 let report = optimize(&mut doc, &Settings::default())?;   // Reduce File Size's choices
+let report = optimize(&mut doc, &Preset::Mobile.settings())?; // smaller, for screens
 // Or with progress: called before each image and the clean-up; `false` cancels.
 let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going)?;
 ```
 
+- **Presets:** Standard (Reduce File Size's choices: images above 225 ppi to 150 ppi, JPEG
+  medium) and Mobile (above 144 ppi to 96 ppi, JPEG high), as in Acrobat's Settings menu.
+- **Merge image fragments** (`fragments`, on by default): some PDF printers draw a page picture
+  as thousands of images one pixel row high. Runs of upright 8-bit grey or RGB images in one
+  colour space, sharing their left and right edges and stacked edge to edge (at least four,
+  drawn with nothing else between them), become one lossless image at their finest resolution,
+  which the image settings then resample; the strips are dropped by Clean Up. A real page
+  printed this way went from 4.3 MB to 231 KB (Standard) and 161 KB (Mobile). Not merged yet:
+  side-by-side tiles, rotated strips, masks.
 - **Images:** the effective resolution of each image is measured where pages draw it (the CTM
-  through form XObjects; the smallest over all uses). Colour and grayscale images above a
+  through form XObjects, up to 12 deep; the smallest over all uses). If a use can't be
+  measured (forms nested deeper, or drawn too many times), no image is resampled. Colour and grayscale images above a
   threshold are resampled with a bicubic (Catmull-Rom) filter to a target resolution and
   stored as JPEG (Acrobat's quality steps) or ZIP; soft masks are resampled with their image.
   An image is replaced only if the result is smaller. Left alone: CMYK and other colour spaces,
diff --git a/crates/optimize/src/audit.rs b/crates/optimize/src/audit.rs
index 351d883b4..5aa6669b4 100644
--- a/crates/optimize/src/audit.rs
+++ b/crates/optimize/src/audit.rs
@@ -1,8 +1,10 @@
 //! PDF Optimizer ▸ Audit space usage: how many bytes each kind of content takes.
 //!
-//! Every object is sized as it would be written (dictionary plus stream data) and put in the
-//! first category that reaches it; what remains (the catalog, page tree, info, metadata,
-//! cross-reference data and anything unreachable) is document overhead.
+//! Every object is sized as it would be written (dictionary plus stream data). Resources go by
+//! kind first, wherever they are used: a font or image a form field or comment draws with is
+//! still a font or image. Every other object goes to the first category that reaches it; what
+//! remains (the catalog, page tree, info, metadata, cross-reference data and anything
+//! unreachable) is document overhead.
 
 use std::collections::{HashMap, HashSet};
 
@@ -80,6 +82,11 @@ pub struct SpaceUse {
     pub percent: f64,
 }
 
+/// How deep form XObjects nested in each other's resources are sorted by kind. Deeper forms
+/// (and what they use) are still counted, as X Object Forms; the limit keeps a crafted chain
+/// of nested forms from overflowing the stack.
+const MAX_FORM_DEPTH: usize = 64;
+
 struct Audit<'a> {
     doc: &'a Document,
     owner: HashMap<u32, SpaceCategory>,
@@ -116,24 +123,22 @@ impl Audit<'_> {
         o.map(|x| self.doc.resolve(x)).and_then(|x| x.as_dict().cloned()).unwrap_or_default()
     }
 
-    /// A page's resources, by kind.
-    fn resources(&mut self, res: &Dict) {
+    /// A resource dictionary, by kind; `depth` counts the form XObjects it is nested in.
+    fn resources(&mut self, res: &Dict, depth: usize) {
         let xobjects = self.resolve_dict(res.get(b"XObject"));
         for (_, x) in xobjects.iter() {
             let Some(r) = x.as_ref() else { continue };
-            let is_image = matches!(&*self.doc.get(r), Object::Stream(s) if s.dict.name(b"Subtype") == Some(b"Image"));
-            if is_image {
-                self.claim(x, SpaceCategory::Images);
-            } else {
-                // A form: its own resources first, by kind, then the form itself.
-                if let Object::Stream(s) = &*self.doc.get(r) {
+            match &*self.doc.get(r) {
+                Object::Stream(s) if s.dict.name(b"Subtype") == Some(b"Image") => self.claim(x, SpaceCategory::Images),
+                Object::Stream(s) if depth < MAX_FORM_DEPTH && !self.owner.contains_key(&r.num) => {
+                    // A form: its own resources first, by kind, then the rest of it. Owning it
+                    // first stops a form that draws itself.
+                    self.owner.insert(r.num, SpaceCategory::XObjectForms);
                     let inner = self.resolve_dict(s.dict.get(b"Resources"));
-                    if let std::collections::hash_map::Entry::Vacant(e) = self.owner.entry(r.num) {
-                        e.insert(SpaceCategory::XObjectForms);
-                        self.resources(&inner);
-                    }
+                    self.resources(&inner, depth + 1);
+                    self.claim(&Object::Dict(s.dict.clone()), SpaceCategory::XObjectForms);
                 }
-                self.claim(x, SpaceCategory::XObjectForms);
+                _ => self.claim(x, SpaceCategory::XObjectForms),
             }
         }
         for (key, cat) in [
@@ -148,6 +153,40 @@ impl Audit<'_> {
             }
         }
     }
+
+    /// The resources an annotation's appearances draw with, by kind. Each of /N, /R and /D is
+    /// one appearance stream or a dictionary of them, one per state.
+    fn appearance_resources(&mut self, annot: &Object) {
+        let ap = self.resolve_dict(self.resolve_dict(Some(annot)).get(b"AP"));
+        for (_, v) in ap.iter() {
+            let streams = match &*self.doc.resolve(v) {
+                Object::Stream(s) => vec![s.dict.clone()],
+                Object::Dict(states) => states
+                    .iter()
+                    .filter_map(|(_, s)| match &*self.doc.resolve(s) {
+                        Object::Stream(s) => Some(s.dict.clone()),
+                        _ => None,
+                    })
+                    .collect(),
+                _ => Vec::new(),
+            };
+            for dict in streams {
+                let res = self.resolve_dict(dict.get(b"Resources"));
+                self.resources(&res, 1);
+            }
+        }
+    }
+}
+
+/// A page's annotations.
+fn annotations(doc: &Document, page: &Dict) -> Vec<Object> {
+    page.get(b"Annots").and_then(|a| doc.resolve(a).as_array().cloned()).unwrap_or_default()
+}
+
+/// Form fields' widgets belong to the form; every other annotation is a comment.
+fn annotation_category(doc: &Document, annot: &Object) -> SpaceCategory {
+    let widget = annot.as_ref().is_some_and(|r| doc.get(r).as_dict().is_some_and(|d| d.name(b"Subtype") == Some(b"Widget")));
+    if widget { SpaceCategory::Forms } else { SpaceCategory::Comments }
 }
 
 fn size(doc: &Document, num: u32) -> u64 {
@@ -164,16 +203,27 @@ pub fn audit_space(doc: &Document, file_len: u64) -> Vec<SpaceUse> {
     let mut a = Audit { doc, owner: HashMap::new() };
     let cat = doc.root().and_then(|r| doc.get(r).as_dict().cloned()).unwrap_or_default();
     let pages = pdfcraft_model::pages(doc);
-    // Order matters: the most specific owners first.
+    // Order matters: the most specific owners first. Resources by kind before anything that
+    // uses them: a content stream's dictionary may point at what it draws (PdfCraft's /PCAdded
+    // records an added image), and form fields and comments draw with fonts and images too.
+    for p in &pages {
+        let res = a.resolve_dict(p.dict.get(b"Resources"));
+        a.resources(&res, 0);
+    }
+    let form = a.resolve_dict(cat.get(b"AcroForm"));
+    let form_resources = a.resolve_dict(form.get(b"DR"));
+    a.resources(&form_resources, 0);
+    for p in &pages {
+        for x in annotations(doc, &p.dict) {
+            a.appearance_resources(&x);
+        }
+    }
     if let Some(s) = cat.get(b"StructTreeRoot") {
         // Structure elements point at pages and annotations; those stay out (claim skips pages,
-        // and annotations are claimed first below).
+        // and annotations are claimed first).
         for p in &pages {
-            if let Some(annots) = p.dict.get(b"Annots") {
-                for x in doc.resolve(annots).as_array().cloned().unwrap_or_default() {
-                    let widget = x.as_ref().and_then(|r| doc.get(r).as_dict().map(|d| d.name(b"Subtype") == Some(b"Widget"))).unwrap_or(false);
-                    a.claim(&x, if widget { SpaceCategory::Forms } else { SpaceCategory::Comments });
-                }
+            for x in annotations(doc, &p.dict) {
+                a.claim(&x, annotation_category(doc, &x));
             }
         }
         a.claim(s, SpaceCategory::StructureInfo);
@@ -182,16 +232,9 @@ pub fn audit_space(doc: &Document, file_len: u64) -> Vec<SpaceUse> {
         a.claim(f, SpaceCategory::Forms);
     }
     for p in &pages {
-        if let Some(annots) = p.dict.get(b"Annots") {
-            for x in doc.resolve(annots).as_array().cloned().unwrap_or_default() {
-                let widget = x.as_ref().and_then(|r| doc.get(r).as_dict().map(|d| d.name(b"Subtype") == Some(b"Widget"))).unwrap_or(false);
-                a.claim(&x, if widget { SpaceCategory::Forms } else { SpaceCategory::Comments });
-            }
+        for x in annotations(doc, &p.dict) {
+            a.claim(&x, annotation_category(doc, &x));
         }
-        // Resources before the content: a content stream's dictionary may point at what it
-        // draws (PdfCraft's /PCAdded records an added image), which stays an image or font.
-        let res = a.resolve_dict(p.dict.get(b"Resources"));
-        a.resources(&res);
         if let Some(c) = p.dict.get(b"Contents") {
             a.claim(c, SpaceCategory::ContentStreams);
         }
diff --git a/crates/optimize/src/fragments.rs b/crates/optimize/src/fragments.rs
new file mode 100644
index 000000000..b5967eee0
--- /dev/null
+++ b/crates/optimize/src/fragments.rs
@@ -0,0 +1,299 @@
+//! Merge image fragments: some PDF printers draw a page picture as hundreds or thousands of
+//! images one pixel row high, stacked edge to edge. Each fragment is too small to resample, and
+//! every JPEG fragment carries its own headers, so a one-page document can weigh megabytes and
+//! no image setting makes it smaller. Here the fragments are put back together into one image,
+//! which the image settings then resample and recompress like any other.
+//!
+//! What counts as a run of fragments, and is merged:
+//! - consecutive `q … cm /Name Do Q` groups in a page's content stream, with nothing else
+//!   between them, each drawing an image upright (no rotation, skew or flip);
+//! - the images are 8-bit grey or RGB in the same colour space, without masks or a decode array
+//!   that changes anything, in a codec PdfCraft decodes;
+//! - they share their left and right edges and are stacked edge to edge with no gap or overlap
+//!   (in any drawing order), at least [`MIN_FRAGMENTS`] of them.
+//!
+//! The merged image keeps the finest resolution of its fragments both ways, so nothing is lost
+//! until the image settings downsample it; it is stored losslessly. A page whose content
+//! stream can't be read back exactly is left alone. The fragments are then unused, and Clean Up
+//! drops them.
+
+use pdfcraft_content::{Matrix, Op, parse, serialize_ops};
+use pdfcraft_cos::{Dict, Document, ObjRef, Object, Stream};
+
+use crate::images::{components, content_bytes, decodable, page_resources, pixels, resample};
+use crate::{OptimizeError, Report, Stage};
+
+/// Fewest stacked images treated as fragments of one picture.
+pub const MIN_FRAGMENTS: usize = 4;
+
+/// Most pixels a merged image may have (memory).
+const MAX_PIXELS: u64 = 80_000_000;
+
+/// One fragment: its image, its box in the coordinates the run is drawn in, and its size.
+struct Fragment {
+    image: ObjRef,
+    rect: [f64; 4],
+    width: u32,
+    height: u32,
+}
+
+/// The ops `q`, one or more `cm`, `Do`, `Q` starting at `i`: the index after them, the matrix
+/// and the name drawn.
+fn group_at(ops: &[Op], i: usize) -> Option<(usize, Matrix, Vec<u8>)> {
+    if !ops.get(i)?.is("q") {
+        return None;
+    }
+    let mut j = i + 1;
+    let mut m = Matrix([1.0, 0.0, 0.0, 1.0, 0.0, 0.0]);
+    while let Some(op) = ops.get(j).filter(|o| o.is("cm")) {
+        m = Matrix::from_operands(&op.operands)?.then(&m);
+        j += 1;
+    }
+    let draw = ops.get(j).filter(|o| o.is("Do"))?;
+    let name = draw.name(0)?.to_vec();
+    ops.get(j + 1).filter(|o| o.is("Q"))?;
+    (j > i + 1).then_some((j + 2, m, name))
+}
+
+/// The image `name` draws, if it can be a fragment: its reference, size, colour space and
+/// component count.
+fn fragment_image(doc: &Document, xobjects: &Dict, name: &[u8]) -> Option<(ObjRef, u32, u32, Object, usize)> {
+    let r = xobjects.get(name).and_then(Object::as_ref)?;
+    let obj = doc.get(r);
+    let Object::Stream(s) = &*obj else { return None };
+    let d = &s.dict;
+    if d.name(b"Subtype") != Some(b"Image") || d.int(b"BitsPerComponent") != Some(8) || d.contains(b"Mask") || d.contains(b"SMask") {
+        return None;
+    }
+    if matches!(d.get(b"ImageMask"), Some(Object::Bool(true))) || !decodable(doc, s)? {
+        return None;
+    }
+    let cs = d.get(b"ColorSpace")?.clone();
+    let n = components(doc, &cs)?;
+    let (w, h) = (u32::try_from(d.int(b"Width")?).ok()?, u32::try_from(d.int(b"Height")?).ok()?);
+    (w > 0 && h > 0).then_some((r, w, h, cs, n))
+}
+
+/// Whether `run` tiles one rectangle top to bottom: same left and right edges, edge to edge.
+/// Sorts it from the top down.
+fn stacked(run: &mut [Fragment]) -> bool {
+    let Some(first) = run.first() else { return false };
+    let [x0, _, x1, _] = first.rect;
+    let width = x1 - x0;
+    if !(width.is_finite() && width > 0.0) {
+        return false;
+    }
+    let tol = 1e-3 * width.max(1.0);
+    if run.iter().any(|f| {
+        (f.rect[0] - x0).abs() > tol || (f.rect[2] - x1).abs() > tol || f.rect[3].partial_cmp(&f.rect[1]) != Some(std::cmp::Ordering::Greater)
+    }) {
+        return false;
+    }
+    run.sort_by(|a, b| b.rect[3].total_cmp(&a.rect[3]));
+    run.windows(2).all(|w| match w {
+        [a, b] => (a.rect[1] - b.rect[3]).abs() <= 0.01 * (a.rect[3] - a.rect[1]).min(b.rect[3] - b.rect[1]),
+        _ => true,
+    })
+}
+
+/// The fragment groups from `i` on while each is drawn right under (or right over) the one
+/// before it, in the same direction: a picture drawn row by row, up to a gap or a jump.
+fn drawn_in_sequence(ops: &[Op], i: usize, xobjects: &Dict, doc: &Document) -> Vec<Fragment> {
+    let mut run: Vec<Fragment> = Vec::new();
+    let mut down: Option<bool> = None;
+    let mut j = i;
+    while let Some((next, m, name)) = group_at(ops, j) {
+        let Some((image, width, height, ..)) = fragment_image(doc, xobjects, &name) else { break };
+        let [a, _, _, d, e, f] = m.0;
+        let f2 = Fragment { image, rect: [e, f, e + a, f + d], width, height };
+        if let Some(prev) = run.last() {
+            let tol = 0.01 * (prev.rect[3] - prev.rect[1]).min(f2.rect[3] - f2.rect[1]);
+            let below = (prev.rect[1] - f2.rect[3]).abs() <= tol;
+            let above = (f2.rect[1] - prev.rect[3]).abs() <= tol;
+            let same_x = (prev.rect[0] - f2.rect[0]).abs() <= 1e-3 * a.abs().max(1.0) && (prev.rect[2] - f2.rect[2]).abs() <= 1e-3 * a.abs().max(1.0);
+            match (down, below, above) {
+                _ if !same_x => break,
+                (None | Some(true), true, _) => down = Some(true),
+                (None | Some(false), _, true) => down = Some(false),
+                _ => break,
+            }
+        }
+        run.push(f2);
+        j = next;
+    }
+    run
+}
+
+/// The op index after the first `count` fragment groups from `i`.
+fn run_end(ops: &[Op], i: usize, count: usize) -> usize {
+    let mut j = i;
+    for _ in 0..count {
+        match group_at(ops, j) {
+            Some((next, ..)) => j = next,
+            None => break,
+        }
+    }
+    j
+}
+
+/// The run's pixels as one image, top row first: `(pixels, width, height)`.
+fn merge(doc: &Document, run: &[Fragment], n: usize) -> Option<(Vec<u8>, u32, u32)> {
+    let (top, bottom) = (run.first()?.rect[3], run.last()?.rect[1]);
+    let width = run.iter().map(|f| f.width).max()?;
+    // Pixel rows per unit of height: the finest fragment's.
+    let density = run.iter().map(|f| f.height as f64 / (f.rect[3] - f.rect[1])).fold(0.0, f64::max);
+    let height = ((top - bottom) * density).round();
+    if !(height.is_finite() && height >= 1.0) || (width as u64) * (height as u64) > MAX_PIXELS {
+        return None;
+    }
+    let height = height as u32;
+    let row = width as usize * n;
+    let mut out = vec![255u8; row * height as usize];
+    for f in run {
+        let r0 = (((top - f.rect[3]) * density).round().max(0.0) as u32).min(height);
+        let r1 = (((top - f.rect[1]) * density).round().max(0.0) as u32).min(height);
+        if r1 <= r0 {
+            continue;
+        }
+        let obj = doc.get(f.image);
+        let Object::Stream(s) = &*obj else { return None };
+        let px = pixels(s, n)?;
+        let px = if (f.width, f.height) == (width, r1 - r0) { px } else { resample(&px, n, f.width, f.height, width, r1 - r0)? };
+        out.get_mut(r0 as usize * row..r1 as usize * row)?.copy_from_slice(px.get(..(r1 - r0) as usize * row)?);
+    }
+    Some((out, width, height))
+}
+
+/// A name for the merged image that `xobjects` doesn't use yet.
+fn fresh_name(xobjects: &Dict, k: &mut usize) -> Vec<u8> {
+    loop {
+        *k += 1;
+        let name = format!("PCMerged{k}").into_bytes();
+        if !xobjects.contains(&name) {
+            return name;
+        }
+    }
+}
+
+/// Add `name` → `image` to the page's image resources, wherever they live.
+fn add_xobject(doc: &mut Document, page: ObjRef, name: &[u8], image: ObjRef) -> Result<(), OptimizeError> {
+    let res = doc.get(page).as_dict().and_then(|d| d.get(b"Resources").cloned());
+    let put = |d: &mut Dict| {
+        let mut x = d.get(b"XObject").and_then(Object::as_dict).cloned().unwrap_or_default();
+        x.set(name.to_vec(), Object::Ref(image));
+        d.set(b"XObject".to_vec(), Object::Dict(x));
+    };
+    match res {
+        Some(Object::Ref(r)) => match doc.get(r).as_dict().and_then(|d| d.reference(b"XObject")) {
+            Some(x) => doc.update_dict(x, |d| d.set(name.to_vec(), Object::Ref(image)))?,
+            None => doc.update_dict(r, put)?,
+        },
+        Some(Object::Dict(d)) => match d.reference(b"XObject") {
+            Some(x) => doc.update_dict(x, |d| d.set(name.to_vec(), Object::Ref(image)))?,
+            None => doc.update_dict(page, |p| {
+                let mut d = d.clone();
+                put(&mut d);
+                p.set(b"Resources".to_vec(), Object::Dict(d));
+            })?,
+        },
+        // Inherited (or none): the page gets its own copy with the new image.
+        _ => {
+            let mut d = page_resources(doc, page).unwrap_or_default();
+            if let Some(x) = d.reference(b"XObject") {
+                let x = doc.get(x).as_dict().cloned().unwrap_or_default();
+                d.set(b"XObject".to_vec(), Object::Dict(x));
+            }
+            put(&mut d);
+            doc.update_dict(page, |p| p.set(b"Resources".to_vec(), Object::Dict(d)))?;
+        }
+    }
+    Ok(())
+}
+
+/// Merge the fragment runs of one page; returns how many fragments were merged.
+fn merge_page(doc: &mut Document, page: ObjRef, report: &mut Report, progress: &mut dyn FnMut(Stage) -> bool) -> Result<usize, OptimizeError> {
+    let Some(contents) = doc.get(page).as_dict().and_then(|d| d.get(b"Contents").cloned()) else { return Ok(0) };
+    let parsed = parse(&content_bytes(doc, &contents));
+    if parsed.skipped > 0 {
+        return Ok(0);
+    }
+    let resources = page_resources(doc, page).unwrap_or_default();
+    let mut xobjects = resources.get(b"XObject").map(|x| doc.resolve(x)).and_then(|x| x.as_dict().cloned()).unwrap_or_default();
+    let ops = parsed.ops;
+    let mut out: Vec<Op> = Vec::with_capacity(ops.len());
+    let (mut i, mut merged, mut k) = (0, 0, 0);
+    while i < ops.len() {
+        // The longest run of fragment groups from here with one colour space.
+        let mut run = Vec::new();
+        let mut kind: Option<(Object, usize)> = None;
+        let mut j = i;
+        while let Some((next, m, name)) = group_at(&ops, j) {
+            let Some((image, width, height, cs, n)) = fragment_image(doc, &xobjects, &name) else { break };
+            let [a, b, c, d, e, f] = m.0;
+            if b.abs() > 1e-9 || c.abs() > 1e-9 || !(a > 0.0 && d > 0.0) {
+                break;
+            }
+            match &kind {
+                Some((k_cs, k_n)) if *k_cs != cs || *k_n != n => break,
+                None => kind = Some((cs, n)),
+                _ => {}
+            }
+            run.push(Fragment { image, rect: [e, f, e + a, f + d], width, height });
+            j = next;
+        }
+        // Not one picture as a whole: the rows drawn one under the other from the start may be.
+        if run.len() >= MIN_FRAGMENTS && !stacked(&mut run) {
+            run = drawn_in_sequence(&ops, i, &xobjects, doc);
+            j = run_end(&ops, i, run.len());
+        }
+        let Some((cs, n)) = kind.filter(|_| run.len() >= MIN_FRAGMENTS && stacked(&mut run)) else {
+            // Not a run: keep this op and look again from the next one.
+            if let Some(op) = ops.get(i) {
+                out.push(op.clone());
+            }
+            i += 1;
+            continue;
+        };
+        if !progress(Stage::Fragments) {
+            return Err(OptimizeError::Cancelled);
+        }
+        let Some((px, w, h)) = merge(doc, &run, n) else {
+            out.extend(ops.get(i..j).unwrap_or_default().iter().cloned());
+            i = j;
+            continue;
+        };
+        let mut dict = Dict::new();
+        dict.set(b"Type".to_vec(), Object::name("XObject"));
+        dict.set(b"Subtype".to_vec(), Object::name("Image"));
+        dict.set(b"Width".to_vec(), Object::Int(i64::from(w)));
+        dict.set(b"Height".to_vec(), Object::Int(i64::from(h)));
+        dict.set(b"ColorSpace".to_vec(), cs);
+        dict.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+        let image = doc.add(Object::Stream(Stream::flate(dict, &px)));
+        let name = fresh_name(&xobjects, &mut k);
+        xobjects.set(name.clone(), Object::Ref(image));
+        add_xobject(doc, page, &name, image)?;
+        let (Some(first), Some(last)) = (run.first(), run.last()) else { break };
+        let [x0, y0, x1, y1] = [first.rect[0], last.rect[1], first.rect[2], first.rect[3]];
+        let num = Object::Real;
+        out.push(Op::new("q", Vec::new()));
+        out.push(Op::new("cm", vec![num(x1 - x0), Object::Int(0), Object::Int(0), num(y1 - y0), num(x0), num(y0)]));
+        out.push(Op::new("Do", vec![Object::Name(name)]));
+        out.push(Op::new("Q", Vec::new()));
+        merged += run.len();
+        report.merged_images += 1;
+        i = j;
+    }
+    if merged > 0 {
+        let stream = doc.add(Object::Stream(Stream::flate(Dict::new(), &serialize_ops(&out))));
+        doc.update_dict(page, |p| p.set(b"Contents".to_vec(), Object::Ref(stream)))?;
+    }
+    Ok(merged)
+}
+
+pub(crate) fn run(doc: &mut Document, pages: &[ObjRef], report: &mut Report, progress: &mut dyn FnMut(Stage) -> bool) -> Result<(), OptimizeError> {
+    for p in pages {
+        report.fragments_merged += merge_page(doc, *p, report, progress)?;
+    }
+    Ok(())
+}
diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index 8645c82bf..8cfa82674 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -11,7 +11,7 @@ use crate::{Compression, ImageSettings, OptimizeError, Report, Settings, Stage};
 const MAX_PIXELS: u64 = 80_000_000;
 
 /// The resources of a page, inherited from the page tree if the page has none.
-fn page_resources(doc: &Document, page: ObjRef) -> Option<Dict> {
+pub(crate) fn page_resources(doc: &Document, page: ObjRef) -> Option<Dict> {
     let mut node = Some(page);
     for _ in 0..64 {
         let d = doc.get(node?).as_dict()?.clone();
@@ -23,7 +23,7 @@ fn page_resources(doc: &Document, page: ObjRef) -> Option<Dict> {
     None
 }
 
-fn content_bytes(doc: &Document, contents: &Object) -> Vec<u8> {
+pub(crate) fn content_bytes(doc: &Document, contents: &Object) -> Vec<u8> {
     match &*doc.resolve(contents) {
         Object::Stream(s) => s.decoded().unwrap_or_default(),
         Object::Array(a) => a
@@ -41,77 +41,127 @@ fn content_bytes(doc: &Document, contents: &Object) -> Vec<u8> {
     }
 }
 
-/// Walk one content stream, recording each image's displayed resolution (pixels per inch, the
-/// smaller of the two axes) and descending into form XObjects.
-fn walk(doc: &Document, data: &[u8], resources: &Dict, ctm: Matrix, depth: usize, seen: &mut HashSet<ObjRef>, out: &mut HashMap<ObjRef, f64>) {
-    if depth > 12 {
-        return;
-    }
-    let xobjects = resources.get(b"XObject").map(|x| doc.resolve(x)).and_then(|x| x.as_dict().cloned()).unwrap_or_default();
-    let mut stack = vec![ctm];
-    for op in pdfcraft_content::parse(data).ops {
-        let top = stack.last().copied().unwrap_or(ctm);
-        match op.op.as_slice() {
-            b"q" => stack.push(top),
-            b"Q" if stack.len() > 1 => {
-                stack.pop();
-            }
-            b"cm" => {
-                if let Some(m) = Matrix::from_operands(&op.operands)
-                    && let Some(t) = stack.last_mut()
-                {
-                    *t = m.then(&top);
+/// Forms nested deeper than this aren't followed.
+const MAX_FORM_DEPTH: usize = 12;
+/// Walks of a form already walked once (other scale or caller) before the measurement gives up.
+/// Each form's first walk is free: their number is bounded by the file's object count.
+const MAX_REWALKS: usize = 100_000;
+
+/// State of one [`effective_resolutions`] pass.
+struct Walk<'a> {
+    doc: &'a Document,
+    /// The forms being walked right now, outermost first: a form drawing one of these is a cycle.
+    path: Vec<ObjRef>,
+    /// Forms with their own resources already walked, by the linear part of their matrix. Drawing
+    /// one again at the same scale (only moved) can't change any image's resolution.
+    walked: HashSet<(ObjRef, [u64; 4])>,
+    /// Forms walked at least once.
+    seen: HashSet<ObjRef>,
+    rewalks: usize,
+    /// False once a use may have been missed (depth or work limit).
+    complete: bool,
+    out: HashMap<ObjRef, f64>,
+}
+
+impl Walk<'_> {
+    /// Walk one content stream, recording each image's displayed resolution (pixels per inch, the
+    /// smaller of the two axes) and descending into form XObjects.
+    fn content(&mut self, data: &[u8], resources: &Dict, ctm: Matrix) {
+        let doc = self.doc;
+        let xobjects = resources.get(b"XObject").map(|x| doc.resolve(x)).and_then(|x| x.as_dict().cloned()).unwrap_or_default();
+        let mut stack = vec![ctm];
+        for op in pdfcraft_content::parse(data).ops {
+            let top = stack.last().copied().unwrap_or(ctm);
+            match op.op.as_slice() {
+                b"q" => stack.push(top),
+                b"Q" if stack.len() > 1 => {
+                    stack.pop();
                 }
-            }
-            b"Do" => {
-                let Some(name) = op.name(0) else { continue };
-                let Some(r) = xobjects.get(name).and_then(Object::as_ref) else { continue };
-                let obj = doc.get(r);
-                let Object::Stream(s) = &*obj else { continue };
-                match s.dict.name(b"Subtype") {
-                    Some(b"Image") => {
-                        let (w, h) = (s.dict.int(b"Width").unwrap_or(0) as f64, s.dict.int(b"Height").unwrap_or(0) as f64);
-                        let [a, b, c, d, ..] = top.0;
-                        let (sx, sy) = ((a * a + b * b).sqrt(), (c * c + d * d).sqrt());
-                        if w > 0.0 && h > 0.0 && sx > 1e-6 && sy > 1e-6 {
-                            let ppi = (w / (sx / 72.0)).min(h / (sy / 72.0));
-                            let e = out.entry(r).or_insert(f64::INFINITY);
-                            *e = e.min(ppi);
-                        }
+                b"cm" => {
+                    if let Some(m) = Matrix::from_operands(&op.operands)
+                        && let Some(t) = stack.last_mut()
+                    {
+                        *t = m.then(&top);
                     }
-                    Some(b"Form") => {
-                        if !seen.insert(r) && depth > 4 {
-                            continue;
-                        }
-                        let m = s.dict.get(b"Matrix").map(|m| doc.resolve(m)).and_then(|m| m.as_array().map(|a| Matrix::from_operands(a))).flatten();
-                        let res =
-                            s.dict.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned()).unwrap_or_else(|| resources.clone());
-                        let inner = m.unwrap_or(Matrix([1.0, 0.0, 0.0, 1.0, 0.0, 0.0])).then(&top);
-                        walk(doc, &s.decoded().unwrap_or_default(), &res, inner, depth + 1, seen, out);
-                    }
-                    _ => {}
                 }
+                b"Do" => {
+                    let Some(name) = op.name(0) else { continue };
+                    let Some(r) = xobjects.get(name).and_then(Object::as_ref) else { continue };
+                    let obj = doc.get(r);
+                    let Object::Stream(s) = &*obj else { continue };
+                    match s.dict.name(b"Subtype") {
+                        Some(b"Image") => {
+                            let (w, h) = (s.dict.int(b"Width").unwrap_or(0) as f64, s.dict.int(b"Height").unwrap_or(0) as f64);
+                            let [a, b, c, d, ..] = top.0;
+                            let (sx, sy) = ((a * a + b * b).sqrt(), (c * c + d * d).sqrt());
+                            if w > 0.0 && h > 0.0 && sx > 1e-6 && sy > 1e-6 {
+                                let ppi = (w / (sx / 72.0)).min(h / (sy / 72.0));
+                                let e = self.out.entry(r).or_insert(f64::INFINITY);
+                                *e = e.min(ppi);
+                            }
+                        }
+                        Some(b"Form") => self.form(r, s, resources, top),
+                        _ => {}
+                    }
+                }
+                _ => {}
             }
-            _ => {}
         }
     }
+
+    /// Descend into form `r` drawn with `ctm` from a stream whose resources are `resources`.
+    fn form(&mut self, r: ObjRef, s: &Stream, resources: &Dict, ctm: Matrix) {
+        if self.path.contains(&r) {
+            return;
+        }
+        if self.path.len() >= MAX_FORM_DEPTH {
+            self.complete = false;
+            return;
+        }
+        let doc = self.doc;
+        let m = s.dict.get(b"Matrix").map(|m| doc.resolve(m)).and_then(|m| m.as_array().map(|a| Matrix::from_operands(a))).flatten();
+        let inner = m.unwrap_or(Matrix([1.0, 0.0, 0.0, 1.0, 0.0, 0.0])).then(&ctm);
+        let own = s.dict.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned());
+        // A form without resources uses its caller's, so the same form can draw other images.
+        if own.is_some() {
+            let [a, b, c, d, ..] = inner.0;
+            if !self.walked.insert((r, [a.to_bits(), b.to_bits(), c.to_bits(), d.to_bits()])) {
+                return;
+            }
+        }
+        if !self.seen.insert(r) {
+            if self.rewalks >= MAX_REWALKS {
+                self.complete = false;
+                return;
+            }
+            self.rewalks += 1;
+        }
+        self.path.push(r);
+        self.content(&s.decoded().unwrap_or_default(), own.as_ref().unwrap_or(resources), inner);
+        self.path.pop();
+    }
 }
 
 /// The effective resolution (ppi) of every image drawn by `pages`: the smallest over its uses.
+///
+/// If forms nest too deeply or are drawn too many times to measure every use, every image is
+/// given `INFINITY` (never resampled), since its largest use may be among those missed.
 pub fn effective_resolutions(doc: &Document, pages: &[ObjRef]) -> HashMap<ObjRef, f64> {
-    let mut out = HashMap::new();
-    let mut seen = HashSet::new();
+    let mut walk = Walk { doc, path: Vec::new(), walked: HashSet::new(), seen: HashSet::new(), rewalks: 0, complete: true, out: HashMap::new() };
     for p in pages {
         let Some(d) = doc.get(*p).as_dict().cloned() else { continue };
         let Some(contents) = d.get(b"Contents") else { continue };
         let res = page_resources(doc, *p).unwrap_or_default();
-        walk(doc, &content_bytes(doc, contents), &res, Matrix([1.0, 0.0, 0.0, 1.0, 0.0, 0.0]), 0, &mut seen, &mut out);
+        walk.content(&content_bytes(doc, contents), &res, Matrix([1.0, 0.0, 0.0, 1.0, 0.0, 0.0]));
     }
-    out
+    if !walk.complete {
+        walk.out.values_mut().for_each(|v| *v = f64::INFINITY);
+    }
+    walk.out
 }
 
 /// Colour components of a colour space PdfCraft resamples: gray (1) or RGB (3).
-fn components(doc: &Document, cs: &Object) -> Option<usize> {
+pub(crate) fn components(doc: &Document, cs: &Object) -> Option<usize> {
     let cs = doc.resolve(cs);
     match &*cs {
         Object::Name(n) => match n.as_slice() {
@@ -179,7 +229,7 @@ fn is_dct(s: &Stream) -> Option<bool> {
 }
 
 /// 8-bit samples of an image (`n` components), decoded.
-fn pixels(s: &Stream, n: usize) -> Option<Vec<u8>> {
+pub(crate) fn pixels(s: &Stream, n: usize) -> Option<Vec<u8>> {
     let (w, h) = (s.dict.int(b"Width")? as usize, s.dict.int(b"Height")? as usize);
     if is_dct(s)? {
         let img = image::load_from_memory_with_format(&s.raw, image::ImageFormat::Jpeg).ok()?;
@@ -192,7 +242,7 @@ fn pixels(s: &Stream, n: usize) -> Option<Vec<u8>> {
     }
 }
 
-fn resample(px: &[u8], n: usize, w: u32, h: u32, nw: u32, nh: u32) -> Option<Vec<u8>> {
+pub(crate) fn resample(px: &[u8], n: usize, w: u32, h: u32, nw: u32, nh: u32) -> Option<Vec<u8>> {
     use image::imageops::{FilterType, resize};
     Some(match n {
         1 => resize(&image::GrayImage::from_raw(w, h, px.to_vec())?, nw, nh, FilterType::CatmullRom).into_raw(),
@@ -208,6 +258,13 @@ fn jpeg(px: &[u8], n: usize, w: u32, h: u32, quality: u8) -> Option<Vec<u8>> {
     Some(out)
 }
 
+/// Whether [`pixels`] reads `s` as it is drawn: a codec it decodes and no decode array that
+/// changes anything. `None` when the colour space isn't grey or RGB.
+pub(crate) fn decodable(doc: &Document, s: &Stream) -> Option<bool> {
+    let n = components(doc, s.dict.get(b"ColorSpace")?)?;
+    Some(is_dct(s).is_some() && s.dict.get(b"Decode").is_none_or(|d| is_identity_decode(doc, d, n)))
+}
+
 /// Whether `decode` is the default decode array for `n` components ([0 1] each), which changes
 /// nothing. Scanners write it on page images (#490).
 fn is_identity_decode(doc: &Document, decode: &Object, n: usize) -> bool {
diff --git a/crates/optimize/src/lib.rs b/crates/optimize/src/lib.rs
index 7cfcb09c1..c8b9b6769 100644
--- a/crates/optimize/src/lib.rs
+++ b/crates/optimize/src/lib.rs
@@ -1,6 +1,9 @@
 //! The PDF Optimizer (execution plan M11.1; Acrobat: Reduce File Size and Optimize PDF ▸
 //! Advanced optimization).
 //!
+//! - **Merge image fragments:** a page picture some PDF printers draw as thousands of images one
+//!   pixel row high is put back together into one image first (see [`fragments`]), so the image
+//!   settings can work on it.
 //! - **Images:** each image's effective resolution is measured where pages draw it (the
 //!   smallest over its uses, through form XObjects); colour and grayscale images above a
 //!   threshold are resampled (bicubic) to a target resolution and recompressed as JPEG or Flate.
@@ -20,6 +23,7 @@
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
 mod audit;
+pub mod fragments;
 mod images;
 mod links;
 mod unused;
@@ -45,6 +49,8 @@ pub enum OptimizeError {
 pub enum Stage {
     /// About to process image `done` (0-based) of `total`; `done == total` once all are done.
     Images { done: usize, total: usize },
+    /// Merging the fragments of a page picture into one image (only when a page has some).
+    Fragments,
     /// Discarding objects, cleaning up links and compressing unencoded streams.
     CleanUp,
 }
@@ -73,12 +79,18 @@ pub struct ImageSettings {
 }
 
 impl ImageSettings {
-    /// Reduce File Size: bicubic to 150 ppi above 225 ppi, JPEG medium quality.
+    /// Reduce File Size and the Standard preset: bicubic to 150 ppi above 225 ppi, JPEG medium
+    /// quality.
     pub const REDUCE: ImageSettings = ImageSettings { downsample: true, target_ppi: 150.0, above_ppi: 225.0, compression: Compression::Jpeg(60) };
+    /// The Mobile preset: bicubic to 96 ppi above 144 ppi, JPEG high quality. Pages read on a
+    /// screen; text in scans stays legible.
+    pub const MOBILE: ImageSettings = ImageSettings { downsample: true, target_ppi: 96.0, above_ppi: 144.0, compression: Compression::Jpeg(80) };
 }
 
 #[derive(Clone, Debug, PartialEq)]
 pub struct Settings {
+    /// Put page pictures drawn as many stacked fragments back together first ([`fragments`]).
+    pub merge_fragments: bool,
     pub color: ImageSettings,
     pub gray: ImageSettings,
     pub discard_thumbnails: bool,
@@ -98,6 +110,7 @@ impl Default for Settings {
     /// Acrobat's Reduce File Size choices.
     fn default() -> Self {
         Self {
+            merge_fragments: true,
             color: ImageSettings::REDUCE,
             gray: ImageSettings::REDUCE,
             discard_thumbnails: true,
@@ -111,9 +124,49 @@ impl Default for Settings {
     }
 }
 
+/// The optimizer's ready-made settings, as in Acrobat's Settings menu.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Preset {
+    /// Reduce File Size's choices ([`Settings::default`]).
+    Standard,
+    /// Smaller files for reading on a phone or screen: images to 96 ppi above 144, JPEG high.
+    Mobile,
+}
+
+impl Preset {
+    pub const ALL: [Preset; 2] = [Preset::Standard, Preset::Mobile];
+
+    /// The name tools use.
+    pub fn name(self) -> &'static str {
+        match self {
+            Preset::Standard => "standard",
+            Preset::Mobile => "mobile",
+        }
+    }
+
+    pub fn from_name(name: &str) -> Option<Preset> {
+        Preset::ALL.into_iter().find(|p| p.name() == name)
+    }
+
+    pub fn settings(self) -> Settings {
+        match self {
+            Preset::Standard => Settings::default(),
+            Preset::Mobile => Settings { color: ImageSettings::MOBILE, gray: ImageSettings::MOBILE, ..Settings::default() },
+        }
+    }
+
+    /// The preset `settings` are, if they are one.
+    pub fn of(settings: &Settings) -> Option<Preset> {
+        Preset::ALL.into_iter().find(|p| p.settings() == *settings)
+    }
+}
+
 /// What an optimization did.
 #[derive(Clone, Debug, Default, PartialEq, Eq)]
 pub struct Report {
+    /// Images merged from fragments, and how many fragments went into them.
+    pub merged_images: usize,
+    pub fragments_merged: usize,
     pub images: usize,
     pub images_resampled: usize,
     pub images_recompressed: usize,
@@ -144,6 +197,9 @@ pub fn optimize(doc: &mut Document, settings: &Settings) -> Result<Report, Optim
 pub fn optimize_with_progress(doc: &mut Document, settings: &Settings, progress: &mut dyn FnMut(Stage) -> bool) -> Result<Report, OptimizeError> {
     let mut report = Report::default();
     let pages = pdfcraft_annot::page_refs(doc).map_err(|_| OptimizeError::NoPages)?;
+    if settings.merge_fragments {
+        fragments::run(doc, &pages, &mut report, progress)?;
+    }
     images::run(doc, &pages, settings, &mut report, progress)?;
     if !progress(Stage::CleanUp) {
         return Err(OptimizeError::Cancelled);
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index ac675a390..2a83e8d6a 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -245,6 +245,100 @@ fn space_audit_counts_images_a_content_stream_dictionary_points_at_as_images() {
     assert!(images.percent > 80.0, "{audit:?}");
 }
 
+#[test]
+fn space_audit_counts_what_fields_and_comments_draw_with_by_kind() {
+    // A font or image a form field or comment draws with is still a font or image. The form
+    // was claimed first, so its fonts made a fillable form look like mostly "Forms".
+    let mut doc = Document::new_empty();
+    let p = page(&mut doc, &[], "BT ET");
+    let font = |doc: &mut Document| {
+        let file = doc.add(Object::Stream(Stream::from_raw(Dict::new(), vec![7; 40_000])));
+        let mut desc = Dict::new();
+        desc.set(b"Type".to_vec(), Object::name("FontDescriptor"));
+        desc.set(b"FontFile2".to_vec(), Object::Ref(file));
+        let desc = doc.add(Object::Dict(desc));
+        let mut f = Dict::new();
+        f.set(b"Type".to_vec(), Object::name("Font"));
+        f.set(b"Subtype".to_vec(), Object::name("TrueType"));
+        f.set(b"FontDescriptor".to_vec(), Object::Ref(desc));
+        doc.add(Object::Dict(f))
+    };
+    let (field_font, comment_font) = (font(&mut doc), font(&mut doc));
+    let icon = image(&mut doc, 200, 200, 3, false, None);
+    let appearance = |doc: &mut Document, kind: &str, name: &str, r: ObjRef| {
+        let mut entries = Dict::new();
+        entries.set(name.as_bytes().to_vec(), Object::Ref(r));
+        let mut res = Dict::new();
+        res.set(kind.as_bytes().to_vec(), Object::Dict(entries));
+        let mut d = Dict::new();
+        d.set(b"Subtype".to_vec(), Object::name("Form"));
+        d.set(b"Resources".to_vec(), Object::Dict(res));
+        Object::Ref(doc.add(Object::Stream(Stream::from_raw(d, b"q Q".to_vec()))))
+    };
+    let annot = |doc: &mut Document, subtype: &str, ap: Object| {
+        let mut d = Dict::new();
+        d.set(b"Type".to_vec(), Object::name("Annot"));
+        d.set(b"Subtype".to_vec(), Object::name(subtype));
+        d.set(b"Rect".to_vec(), Object::Array(vec![0.into(), 0.into(), 10.into(), 10.into()]));
+        d.set(b"P".to_vec(), Object::Ref(p));
+        let mut aps = Dict::new();
+        aps.set(b"N".to_vec(), ap);
+        d.set(b"AP".to_vec(), Object::Dict(aps));
+        Object::Ref(doc.add(Object::Dict(d)))
+    };
+    // A text field's appearance uses the form's default font; a check box's "on" state (one of
+    // a dictionary of states) draws an image; a free-text comment has a font of its own.
+    let text_ap = appearance(&mut doc, "Font", "F1", field_font);
+    let text = annot(&mut doc, "Widget", text_ap);
+    let mut states = Dict::new();
+    states.set(b"On".to_vec(), appearance(&mut doc, "XObject", "Im0", icon));
+    let check = annot(&mut doc, "Widget", Object::Dict(states));
+    let comment_ap = appearance(&mut doc, "Font", "F2", comment_font);
+    let comment = annot(&mut doc, "FreeText", comment_ap);
+    doc.update_dict(p, |d| d.set(b"Annots".to_vec(), Object::Array(vec![text.clone(), check.clone(), comment]))).unwrap();
+    let mut fonts = Dict::new();
+    fonts.set(b"F1".to_vec(), Object::Ref(field_font));
+    let mut dr = Dict::new();
+    dr.set(b"Font".to_vec(), Object::Dict(fonts));
+    let mut form = Dict::new();
+    form.set(b"Fields".to_vec(), Object::Array(vec![text, check]));
+    form.set(b"DR".to_vec(), Object::Dict(dr));
+    let root = doc.root().unwrap();
+    doc.update_dict(root, |c| c.set(b"AcroForm".to_vec(), Object::Dict(form))).unwrap();
+    let bytes = write_full(&doc, &SaveOptions { object_streams: false, ..SaveOptions::default() }).unwrap();
+    let doc = Document::open(Arc::new(bytes.clone())).unwrap();
+    let audit = audit_space(&doc, bytes.len() as u64);
+    let get = |c: SpaceCategory| audit.iter().find(|u| u.category == c).unwrap().bytes;
+    assert!(get(SpaceCategory::Fonts) > 80_000, "both fonts are fonts: {audit:?}");
+    assert!(get(SpaceCategory::Images) > 2_000, "the check box's image is an image: {audit:?}");
+    assert!(get(SpaceCategory::Forms) < 2_000 && get(SpaceCategory::Comments) < 1_000, "{audit:?}");
+    assert!(get(SpaceCategory::Forms) > 0 && get(SpaceCategory::Comments) > 0, "the fields and the comment are still counted: {audit:?}");
+}
+
+#[test]
+fn space_audit_survives_deeply_nested_forms() {
+    // Each form draws the next; sorting their resources by kind recursed once per form, so a
+    // long enough chain overflowed the stack.
+    let mut doc = Document::new_empty();
+    let mut next: Option<ObjRef> = None;
+    for _ in 0..20_000 {
+        let mut d = Dict::new();
+        d.set(b"Subtype".to_vec(), Object::name("Form"));
+        if let Some(n) = next {
+            let mut x = Dict::new();
+            x.set(b"X".to_vec(), Object::Ref(n));
+            let mut res = Dict::new();
+            res.set(b"XObject".to_vec(), Object::Dict(x));
+            d.set(b"Resources".to_vec(), Object::Dict(res));
+        }
+        next = Some(doc.add(Object::Stream(Stream::from_raw(d, b"/X Do".to_vec()))));
+    }
+    page(&mut doc, &[("X", next.unwrap())], "/X Do");
+    let audit = audit_space(&doc, 0);
+    let forms = audit.iter().find(|u| u.category == SpaceCategory::XObjectForms).unwrap();
+    assert!(forms.bytes > 20_000 * 40, "every form is counted, however deep: {audit:?}");
+}
+
 #[test]
 fn invalid_links_and_unreferenced_destinations_go() {
     let mut doc = Document::new_empty();
@@ -687,3 +781,244 @@ fn a_second_run_leaves_the_stripped_stream_alone() {
     assert_eq!(r.streams_compressed, 0);
     assert_eq!(stream(&doc, c), once);
 }
+
+/// A grey image `w` px wide and one row high, every pixel `v`; JPEG or Flate.
+fn strip(doc: &mut Document, w: u32, v: u8, jpeg: bool) -> ObjRef {
+    let mut d = Dict::new();
+    d.set(b"Type".to_vec(), Object::name("XObject"));
+    d.set(b"Subtype".to_vec(), Object::name("Image"));
+    d.set(b"Width".to_vec(), Object::Int(w as i64));
+    d.set(b"Height".to_vec(), Object::Int(1));
+    d.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+    d.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+    let px = vec![v; w as usize];
+    let s = if jpeg {
+        let mut out = Vec::new();
+        image::codecs::jpeg::JpegEncoder::new_with_quality(&mut out, 95).encode(&px, w, 1, image::ExtendedColorType::L8).unwrap();
+        d.set(b"Filter".to_vec(), Object::name("DCTDecode"));
+        Stream::from_raw(d, out)
+    } else {
+        Stream::flate(d, &px)
+    };
+    doc.add(Object::Stream(s))
+}
+
+/// A page drawn the way some PDF printers write a page picture: `rows` images one pixel row
+/// high, 1000 units wide, scaled into a 24 pt square (so 600 ppi across at 200 px). Row `r`
+/// from the top is grey `r`; `edit` changes the content of each row.
+fn printed_page(rows: usize, jpeg: impl Fn(usize) -> bool, edit: impl Fn(usize, String) -> String) -> (Document, Vec<ObjRef>) {
+    let mut doc = Document::new_empty();
+    let mut names = Vec::new();
+    let mut refs = Vec::new();
+    let mut content = String::from("q 0.024 0 0 0.024 0 0 cm\n");
+    for r in 0..rows {
+        let img = strip(&mut doc, 200, r as u8, jpeg(r));
+        refs.push(img);
+        let y = (rows - 1 - r) as f64;
+        content += &edit(r, format!("q 1000 0 0 1 0 {y} cm\n/R{r} Do\nQ\n"));
+        names.push(format!("R{r}"));
+    }
+    content += "Q\n";
+    let xo: Vec<(&str, ObjRef)> = names.iter().map(String::as_str).zip(refs.iter().copied()).collect();
+    let p = page(&mut doc, &xo, &content);
+    // No thumbnail: it would be the old content stream, which still names the strips.
+    doc.update_dict(p, |d| {
+        d.remove(b"Thumb");
+    })
+    .unwrap();
+    (doc, refs)
+}
+
+/// The images the first page's content stream draws, by name, with their streams.
+fn drawn_images(doc: &Document) -> Vec<Stream> {
+    let pages = pdfcraft_annot::page_refs(doc).unwrap();
+    let p = doc.get(pages[0]).as_dict().cloned().unwrap();
+    let res = doc.resolve(p.get(b"Resources").unwrap()).as_dict().cloned().unwrap();
+    let xo = doc.resolve(res.get(b"XObject").unwrap()).as_dict().cloned().unwrap();
+    let c = match &*doc.resolve(p.get(b"Contents").unwrap()) {
+        Object::Stream(s) => s.decoded().unwrap(),
+        _ => panic!("contents"),
+    };
+    pdfcraft_content::parse(&c)
+        .ops
+        .iter()
+        .filter(|o| o.is("Do"))
+        .map(|o| match &*doc.resolve(xo.get(o.name(0).unwrap()).unwrap()) {
+            Object::Stream(s) => s.clone(),
+            _ => panic!("image"),
+        })
+        .collect()
+}
+
+#[test]
+fn a_page_picture_printed_as_one_pixel_strips_is_merged_into_one_image() {
+    // 120 strips, every other one JPEG and half as wide (as one PDF printer writes them).
+    let (mut doc, _) = printed_page(120, |r| r % 2 == 1, |_, s| s);
+    let keep = Settings {
+        gray: ImageSettings { downsample: false, target_ppi: 150.0, above_ppi: 225.0, compression: Compression::Retain },
+        ..Settings::default()
+    };
+    let r = optimize(&mut doc, &keep).unwrap();
+    assert_eq!((r.merged_images, r.fragments_merged), (1, 120), "{r:?}");
+    let drawn = drawn_images(&doc);
+    assert_eq!(drawn.len(), 1, "one image instead of 120");
+    let img = &drawn[0];
+    assert_eq!((img.dict.int(b"Width"), img.dict.int(b"Height")), (Some(200), Some(120)), "the finest resolution both ways");
+    let px = img.decoded().unwrap();
+    // Each row is its strip's grey, top row first; JPEG rows within a few levels.
+    for (row, chunk) in px.chunks(200).enumerate() {
+        assert!(chunk.iter().all(|&v| (v as i32 - row as i32).abs() <= 3), "row {row}: {:?}", &chunk[..4]);
+    }
+    assert_eq!(r.unused_xobjects, 120, "the strips are dropped");
+}
+
+#[test]
+fn the_mobile_preset_makes_a_printed_page_small() {
+    use pdfcraft_optimize::Preset;
+    let (doc, _) = printed_page(200, |_| true, |_, s| s);
+    let bytes = |d: &Document| write_full(d, &SaveOptions::default()).unwrap().len();
+    let before = bytes(&doc);
+    let mut mobile = doc.clone();
+    let r = optimize(&mut mobile, &Preset::Mobile.settings()).unwrap();
+    assert_eq!((r.merged_images, r.images_resampled), (1, 1), "{r:?}");
+    let img = &drawn_images(&mobile)[0];
+    // 24 pt = 1/3 in at 96 ppi.
+    assert_eq!((img.dict.int(b"Width"), img.dict.int(b"Height")), (Some(32), Some(32)));
+    assert_eq!(img.dict.name(b"Filter"), Some(&b"DCTDecode"[..]));
+    assert!(bytes(&mobile) * 10 < before, "{} → {}", before, bytes(&mobile));
+    assert_eq!(Preset::of(&Preset::Mobile.settings()), Some(Preset::Mobile));
+    assert_eq!(Preset::from_name("mobile"), Some(Preset::Mobile));
+}
+
+#[test]
+fn images_that_do_not_tile_a_picture_are_left_alone() {
+    let unmerged = |doc: &mut Document, settings: &Settings| {
+        let r = optimize(doc, settings).unwrap();
+        assert_eq!(r.merged_images, 0, "{r:?}");
+    };
+    let all = Settings::default();
+    // A gap between two rows.
+    let (mut gap, _) =
+        printed_page(40, |_| false, |r, s| if r < 20 { s.replace(&format!(" 0 {} cm", 39 - r), &format!(" 0 {} cm", 41 - r)) } else { s });
+    let r = optimize(&mut gap, &all).unwrap();
+    assert_eq!((r.merged_images, r.fragments_merged), (2, 40), "one picture each side of the gap: {r:?}");
+    // Rotated rows.
+    let (mut turned, _) = printed_page(40, |_| false, |_, s| s.replace("q 1000 0 0 1", "q 0 1 -1000 0"));
+    unmerged(&mut turned, &all);
+    // Something else drawn between the rows.
+    let (mut between, _) = printed_page(40, |_| false, |r, s| if r == 10 { format!("0 0 10 10 re f\n{s}") } else { s });
+    let r = optimize(&mut between, &all).unwrap();
+    assert_eq!((r.merged_images, r.fragments_merged), (2, 40), "two runs, each side of the fill: {r:?}");
+    // Too few rows, and the option off.
+    let (mut few, _) = printed_page(3, |_| false, |_, s| s);
+    unmerged(&mut few, &all);
+    let (mut off, _) = printed_page(40, |_| false, |_, s| s);
+    unmerged(&mut off, &Settings { merge_fragments: false, ..Settings::default() });
+}
+
+/// `levels` nested forms with their own resources, the innermost drawing `img` over the unit square.
+fn nested_forms(doc: &mut Document, img: ObjRef, levels: usize) -> ObjRef {
+    let mut inner = form(doc, Some(Object::Dict(resources(xobjects(&[("Im", img)])))), "/Im Do");
+    for _ in 1..levels {
+        inner = form(doc, Some(Object::Dict(resources(xobjects(&[("F", inner)])))), "/F Do");
+    }
+    inner
+}
+
+#[test]
+fn a_deeply_nested_form_is_measured_at_its_largest_use() {
+    // 1200 px drawn 1 in wide (1200 ppi) and then 8 in wide (150 ppi): 150 ppi, so it isn't resampled.
+    let small = "q 72 0 0 72 36 36 cm /F Do Q";
+    let large = "q 576 0 0 576 18 100 cm /F Do Q";
+    for levels in [1, 6, 12] {
+        for (pages, label) in [(vec![format!("{small} {large}")], "one page"), (vec![small.into(), large.into()], "two pages")] {
+            let mut doc = Document::new_empty();
+            let img = image(&mut doc, 1200, 1200, 3, false, None);
+            let outer = nested_forms(&mut doc, img, levels);
+            for c in &pages {
+                page(&mut doc, &[("F", outer)], c);
+            }
+            let refs = pdfcraft_annot::page_refs(&doc).unwrap();
+            assert_eq!(effective_resolutions(&doc, &refs)[&img].round(), 150.0, "{levels} levels, {label}");
+            optimize(&mut doc, &Settings::default()).unwrap();
+            assert_eq!(stream(&doc, img).dict.int(b"Width"), Some(1200), "{levels} levels, {label}");
+        }
+    }
+}
+
+#[test]
+fn a_form_drawing_itself_is_walked_once_per_use() {
+    let mut doc = Document::new_empty();
+    let img = image(&mut doc, 1200, 1200, 3, false, None);
+    let f = form(&mut doc, None, "/Im Do q 2 0 0 2 0 0 cm /F Do Q");
+    let mut x = xobjects(&[("Im", img)]);
+    x.set(b"F".to_vec(), Object::Ref(f));
+    let mut d = match &*doc.get(f) {
+        Object::Stream(s) => s.clone(),
+        _ => unreachable!(),
+    };
+    d.dict.set(b"Resources".to_vec(), Object::Dict(resources(x)));
+    doc.set(f, Object::Stream(d));
+    page(&mut doc, &[("F", f)], "q 72 0 0 72 36 36 cm /F Do Q");
+    let refs = pdfcraft_annot::page_refs(&doc).unwrap();
+    // Only the outer use: the cycle isn't followed, and doesn't count as a missed use.
+    assert_eq!(effective_resolutions(&doc, &refs)[&img].round(), 1200.0);
+}
+
+#[test]
+fn a_shared_form_without_resources_draws_each_callers_image() {
+    // G has no /Resources, so its /Im is whichever image the form drawing it names.
+    let mut doc = Document::new_empty();
+    let a = image(&mut doc, 1200, 1200, 3, false, None);
+    let b = image(&mut doc, 1200, 1200, 3, false, None);
+    let g = form(&mut doc, None, "/Im Do");
+    let mut outers = Vec::new();
+    for img in [a, b] {
+        let mut inner = form(&mut doc, Some(Object::Dict(resources(xobjects(&[("Im", img), ("G", g)])))), "/G Do");
+        for _ in 1..6 {
+            inner = form(&mut doc, Some(Object::Dict(resources(xobjects(&[("F", inner)])))), "/F Do");
+        }
+        outers.push(inner);
+    }
+    page(&mut doc, &[("A", outers[0]), ("B", outers[1])], "q 72 0 0 72 36 36 cm /A Do Q q 576 0 0 576 18 100 cm /B Do Q");
+    let refs = pdfcraft_annot::page_refs(&doc).unwrap();
+    let ppi = effective_resolutions(&doc, &refs);
+    assert_eq!(ppi[&a].round(), 1200.0);
+    assert_eq!(ppi.get(&b).map(|p| p.round()), Some(150.0));
+}
+
+#[test]
+fn images_are_not_resampled_when_some_uses_could_not_be_measured() {
+    // Too deep: the 13th form isn't followed, so its use of the image is unknown.
+    let mut doc = Document::new_empty();
+    let img = image(&mut doc, 1200, 1200, 3, false, None);
+    let other = image(&mut doc, 1200, 1200, 3, false, None);
+    let deep = nested_forms(&mut doc, img, 13);
+    page(
+        &mut doc,
+        &[("F", deep), ("Im", img), ("O", other)],
+        "q 72 0 0 72 36 36 cm /Im Do Q q 72 0 0 72 200 36 cm /O Do Q q 576 0 0 576 18 100 cm /F Do Q",
+    );
+    let refs = pdfcraft_annot::page_refs(&doc).unwrap();
+    let ppi = effective_resolutions(&doc, &refs);
+    assert_eq!((ppi[&img], ppi[&other]), (f64::INFINITY, f64::INFINITY));
+    optimize(&mut doc, &Settings::default()).unwrap();
+    assert_eq!(stream(&doc, img).dict.int(b"Width"), Some(1200));
+
+    // Too much work: forms without resources (so nothing can be skipped), each drawing the next
+    // three times, twelve deep, would be (3^12 - 1) / 2 walks.
+    let mut doc = Document::new_empty();
+    let img = image(&mut doc, 1200, 1200, 3, false, None);
+    let mut names = vec![("Im", img)];
+    let mut next = "Im";
+    let labels = ["F1", "F2", "F3", "F4", "F5", "F6", "F7", "F8", "F9", "F10", "F11", "F12"];
+    for (i, label) in labels.iter().enumerate().rev() {
+        let s = 1.0 + i as f64 / 100.0;
+        let f = form(&mut doc, None, &format!("q {s} 0 0 {s} 0 0 cm /{next} Do Q /{next} Do q 1 0 0 1 1 0 cm /{next} Do Q"));
+        names.push((label, f));
+        next = label;
+    }
+    page(&mut doc, &names, "q 72 0 0 72 36 36 cm /F1 Do Q");
+    let refs = pdfcraft_annot::page_refs(&doc).unwrap();
+    assert_eq!(effective_resolutions(&doc, &refs)[&img], f64::INFINITY);
+}
diff --git a/crates/oracle/Cargo.toml b/crates/oracle/Cargo.toml
new file mode 100644
index 000000000..45b27f5d9
--- /dev/null
+++ b/crates/oracle/Cargo.toml
@@ -0,0 +1,11 @@
+[package]
+name = "pdfcraft-oracle"
+description = "External oracle processes PdfCraft checks its own output against, and the rule that a missing one is loud"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[lints]
+workspace = true
+
+[dependencies]
diff --git a/crates/oracle/README.md b/crates/oracle/README.md
new file mode 100644
index 000000000..7d2996b77
--- /dev/null
+++ b/crates/oracle/README.md
@@ -0,0 +1,101 @@
+# pdfcraft-oracle
+
+The external programs PdfCraft checks its own output against, and one rule: **a missing oracle is
+either a declared skip or a failure, never a silent pass.**
+
+- **Layer:** test support (`Class::Testkit` in `xtask/src/layers.rs`). A dev-dependency only, never
+  compiled into the product, and so usable even from the standalone crates (`cos`, `geom`,
+  `filters`, `crypt`, `arlington`) whose own tests need it.
+- No panicking path of its own. The `or_skip!` macro expands its `assert!` into the caller, which
+  is test code.
+
+## Why it exists
+
+Every test that wanted an oracle used to probe for it by hand and decide on its own what to do when
+it was missing. The common choice — print a line and return — reports as a **pass**, so a suite
+with no oracles installed looked exactly like one in which every oracle agreed.
+
+That was not hypothetical. No CI runner installed `qpdf`, so `cos/tests/encryption.rs::qpdf_agrees`
+had never executed on a runner, while `README.md` said saved output was "independently checked with
+qpdf". For R2–R4 that test is the *only* check of owner-password authentication (Algorithm 7) that
+does not go through our own code.
+
+## API
+
+```rust
+// In a test: bind the oracle, or return after saying why it was skipped.
+let qpdf = pdfcraft_oracle::or_skip!(pdfcraft_oracle::qpdf());
+let out = qpdf.command().arg("--check").arg(&path).output()?;
+
+// Elsewhere (xtask), handle the absence yourself.
+match pdfcraft_oracle::pdftotext() {
+    Ok(tool) => { /* tool.command() */ }
+    Err(absent) => bail!("{absent}"),
+}
+```
+
+| Probe | Tool | Used for |
+|---|---|---|
+| `qpdf()` | qpdf | `--check` structural validation; the independent owner-password oracle |
+| `pdftoppm()` | Poppler | page pixels, for comparing against our own raster output |
+| `pdftotext()` | Poppler | text extraction (`cargo xtask text-oracle` scores word F1 against it) |
+
+Each returns `Result<Oracle, Absent>`. `Oracle::command()` hands back a fresh `Command`;
+`Absent` renders as an actionable sentence naming the install command.
+
+## The gate
+
+`PDFCRAFT_ORACLES_REQUIRED` (any value, including `0` — the same convention as
+`CRAFT_FONTS_REQUIRED`) turns absence from a skip into a failure. CI sets it on the runners that
+install the tools, so a skip notice there becomes a red build.
+
+```
+$ cargo test -p pdfcraft-cos --test encryption qpdf_agrees
+test result: ok. 1 passed            # qpdf absent: skipped, with a notice on stderr
+
+$ PDFCRAFT_ORACLES_REQUIRED=1 cargo test -p pdfcraft-cos --test encryption qpdf_agrees
+oracle `qpdf` is required but is not on PATH (program not found): PDFCRAFT_ORACLES_REQUIRED is
+set, so this is a failure rather than a skip (apt install qpdf / brew install qpdf)
+test result: FAILED. 1 failed
+```
+
+`or_skip!` expands to a `return`, so it belongs in a test returning `()`; a test returning `Result`
+should match on the probe directly.
+
+## Comparing pixels (`pixels`)
+
+Rendering needs more than "did the tool run". A raw pixel-for-pixel difference is useless here:
+two correct renderers disagree on every glyph edge, so a strict comparison calls a perfect page
+badly wrong and tells you nothing about whether a shading is missing.
+
+`pixels::compare` counts a pixel as differing only when it differs from **every** pixel in the
+other image's 3x3 neighbourhood by more than a tolerance. A one-pixel shift or a differently
+weighted edge finds a near match next door and is forgiven; a glyph that is not there, or a region
+painted the wrong colour, has no near match and is counted. The test runs in both directions and
+reports the worse result, so neither argument order flatters the blurrier renderer.
+
+`decode_pgm` reads what `pdftoppm -gray` writes; `decode_pam_gray` reads what
+`pdfcraft-cli render --out x.pam` writes, compositing premultiplied alpha over white first so a
+transparent margin is not scored as black.
+
+`cargo xtask render-oracle` drives it over the corpus. It reports; it does not gate.
+
+A high score is a *disagreement*, not a verdict on us. The worst file of the first 250,
+`bug1552113.pdf` at 84%, is Poppler painting a link's `/Border [0 0 112]` as a band over the text
+the fixture exists to show; ours is the readable rendering. Look at both images before believing
+the number. `--hide-annotations` separates annotation differences from page content, though the
+default shows them: hiding is slightly worse overall, because it then scores Poppler for every
+appearance we do draw.
+
+**Poppler is not a usable oracle for JBIG2.** The 96 `bitmap-*.pdf` corpus fixtures encode one
+picture through every corner of the format, so a correct decoder renders them all identically. We
+render 1 distinct image across all 96; Poppler renders 8, drawing a blank page for seven of them.
+`crates/render/tests/jbig2_invariants.rs` pins that invariant, and needs no oracle to do it.
+
+## Still to do
+
+- Acrobat itself as the reference, rather than other open renderers.
+- Oracles that are not external processes (hayro, `lopdf`) are ordinary dev-dependencies and are
+  not routed through this crate.
+- Two renderers sometimes round the same page box to different pixel sizes, and those files are
+  counted as unmeasurable rather than compared.
diff --git a/crates/oracle/src/lib.rs b/crates/oracle/src/lib.rs
new file mode 100644
index 000000000..e9e7ae372
--- /dev/null
+++ b/crates/oracle/src/lib.rs
@@ -0,0 +1,248 @@
+//! External oracle processes: independent implementations PdfCraft checks its own output against.
+//!
+//! An oracle is only worth having when it runs. Before this crate every test that wanted one
+//! probed for it by hand and decided on its own what to do when it was missing, and the common
+//! choice — print a line and return — reports as a **pass**. A suite with no oracles installed
+//! therefore looked exactly like one in which every oracle agreed, and on this repository's CI,
+//! where none of them were installed, that is precisely what was happening: `qpdf` is the only
+//! independent check of owner-password authentication for R2–R4, and it had never executed on a
+//! runner while `README.md` said the output was "independently checked with qpdf".
+//!
+//! So the rule here is one line of policy: **a missing oracle is either a declared skip or a
+//! failure, never a silent pass.** [`REQUIRED_VAR`] decides which. CI sets it, so absence breaks
+//! the build; a contributor's laptop usually does not, so absence prints why and skips.
+//!
+//! ```no_run
+//! # fn main() {
+//! let qpdf = pdfcraft_oracle::or_skip!(pdfcraft_oracle::qpdf());
+//! let out = qpdf.command().arg("--check").arg("f.pdf").output();
+//! # let _ = out;
+//! # }
+//! ```
+//!
+//! This crate is test scaffolding (`Class::Testkit` in `xtask/src/layers.rs`): a dev-dependency
+//! only, never compiled into the product.
+
+pub mod pixels;
+
+use std::fmt;
+use std::process::Command;
+
+/// Setting this environment variable to any value turns a missing oracle from a skip into a
+/// failure. CI sets it on the runners that install the tools.
+///
+/// Any value counts, including `0` — the same convention as `CRAFT_FONTS_REQUIRED`, which this
+/// deliberately mirrors. The surprising half of that convention errs toward *requiring* an oracle,
+/// which is the safe direction for a gate whose whole purpose is to stop absence passing quietly.
+pub const REQUIRED_VAR: &str = "PDFCRAFT_ORACLES_REQUIRED";
+
+/// An external program found on `PATH`, ready to run.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Oracle {
+    program: &'static str,
+    version: String,
+}
+
+impl Oracle {
+    /// A fresh [`Command`] for the program. Callers add their own arguments.
+    pub fn command(&self) -> Command {
+        Command::new(self.program)
+    }
+
+    /// The program name, as it is looked up on `PATH`.
+    pub fn program(&self) -> &'static str {
+        self.program
+    }
+
+    /// The first line the program printed when asked for its version, for test output. Empty when
+    /// it printed nothing recognisable; presence of the binary is what decides availability, not
+    /// whether its version could be parsed.
+    pub fn version(&self) -> &str {
+        &self.version
+    }
+}
+
+/// An oracle that could not be used, and whether that is fatal.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Absent {
+    program: &'static str,
+    cause: String,
+    required: bool,
+}
+
+impl Absent {
+    /// Whether this absence must fail the run rather than skip it, i.e. whether [`REQUIRED_VAR`]
+    /// was set when the probe ran.
+    pub fn required(&self) -> bool {
+        self.required
+    }
+
+    /// The program that was looked for.
+    pub fn program(&self) -> &'static str {
+        self.program
+    }
+
+    /// How to install it, so a skip notice tells the reader what to do about it.
+    fn install_hint(program: &str) -> &'static str {
+        match program {
+            "qpdf" => "apt install qpdf / brew install qpdf",
+            "pdftoppm" | "pdftotext" => "apt install poppler-utils / brew install poppler",
+            _ => "install it and put it on PATH",
+        }
+    }
+}
+
+impl fmt::Display for Absent {
+    /// Reads as an instruction either way: required absences are failures and name the gate that
+    /// made them one, optional absences name the install command.
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        if self.required {
+            write!(
+                f,
+                "oracle `{}` is required but {}: {} is set, so this is a failure rather than a skip ({})",
+                self.program,
+                self.cause,
+                REQUIRED_VAR,
+                Self::install_hint(self.program),
+            )
+        } else {
+            write!(
+                f,
+                "skipping: oracle `{}` {} ({}); set {} to make this a failure instead",
+                self.program,
+                self.cause,
+                Self::install_hint(self.program),
+                REQUIRED_VAR,
+            )
+        }
+    }
+}
+
+/// Look for `program` on `PATH`, asking it for its version to confirm it runs.
+///
+/// Presence is decided by whether the program could be started at all, not by its exit status: a
+/// tool that runs but reports its version oddly is still an oracle.
+pub fn find(program: &'static str, version_arg: &str) -> Result<Oracle, Absent> {
+    let required = std::env::var_os(REQUIRED_VAR).is_some();
+    match Command::new(program).arg(version_arg).output() {
+        Ok(out) => {
+            // Poppler's tools print their version to stderr, qpdf to stdout.
+            let text = if out.stdout.is_empty() { &out.stderr } else { &out.stdout };
+            let version = String::from_utf8_lossy(text).lines().next().unwrap_or_default().trim().to_owned();
+            Ok(Oracle { program, version })
+        }
+        Err(e) => Err(Absent { program, cause: format!("is not on PATH ({e})"), required }),
+    }
+}
+
+/// qpdf: structural validation (`--check`) and the independent owner-password oracle.
+pub fn qpdf() -> Result<Oracle, Absent> {
+    find("qpdf", "--version")
+}
+
+/// Poppler's `pdftoppm`: renders a page to pixels, for comparing against our own raster output.
+pub fn pdftoppm() -> Result<Oracle, Absent> {
+    find("pdftoppm", "-v")
+}
+
+/// Poppler's `pdftotext`: the text-extraction oracle (`cargo xtask text-oracle` scores word F1
+/// against it over the corpus).
+pub fn pdftotext() -> Result<Oracle, Absent> {
+    find("pdftotext", "-v")
+}
+
+/// Binds an oracle, or returns from the calling test after saying on stderr why it was skipped.
+///
+/// When [`REQUIRED_VAR`] is set the absence fails the test instead. The panic is deliberate and is
+/// how a test reports failure; it expands into the caller, which is test code, so the workspace's
+/// never-panic rule is not weakened — this crate itself contains no panicking path.
+///
+/// The macro expands to a `return`, so it belongs in a test function returning `()`. A test that
+/// returns `Result` should match on the probe itself.
+#[macro_export]
+macro_rules! or_skip {
+    ($probe:expr) => {
+        match $probe {
+            ::core::result::Result::Ok(oracle) => oracle,
+            ::core::result::Result::Err(absent) => {
+                let absent: $crate::Absent = absent;
+                ::core::assert!(!$crate::Absent::required(&absent), "{absent}");
+                ::std::eprintln!("{absent}");
+                return;
+            }
+        }
+    };
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The one behaviour the crate exists for: absence is never silent, and which of the two loud
+    /// forms it takes is decided by the environment variable.
+    #[test]
+    fn a_missing_oracle_is_fatal_exactly_when_it_is_required() {
+        let optional = Absent { program: "qpdf", cause: "is not on PATH".into(), required: false };
+        let required = Absent { required: true, ..optional.clone() };
+
+        assert!(!optional.required());
+        assert!(required.required());
+
+        // Both say what is wrong and how to fix it; only the required one calls itself a failure.
+        let (opt, req) = (optional.to_string(), required.to_string());
+        assert!(opt.contains("skipping"), "{opt}");
+        assert!(opt.contains("apt install qpdf"), "{opt}");
+        assert!(opt.contains(REQUIRED_VAR), "{opt}");
+        assert!(req.contains("required"), "{req}");
+        assert!(req.contains("failure"), "{req}");
+        assert!(!req.contains("skipping"), "{req}");
+    }
+
+    /// A tool that does not exist is reported as absent rather than hanging or panicking, and the
+    /// reason names the program.
+    #[test]
+    fn a_program_that_does_not_exist_is_absent_with_a_reason() {
+        let Err(absent) = find("pdfcraft-no-such-oracle-binary", "--version") else {
+            panic!("a nonexistent program must not be reported as present");
+        };
+        assert_eq!(absent.program(), "pdfcraft-no-such-oracle-binary");
+        let text = absent.to_string();
+        assert!(text.contains("pdfcraft-no-such-oracle-binary"), "{text}");
+        assert!(text.contains("not on PATH"), "{text}");
+    }
+
+    /// Hostile and odd program names must not panic, hang or be mistaken for a working oracle.
+    #[test]
+    fn hostile_program_names_are_absent_not_a_panic() {
+        for name in ["", " ", "\0bad", "../../etc/passwd", &"x".repeat(4096)] {
+            // `find` takes a 'static str; leak the generated ones, which is fine in a test.
+            let name: &'static str = Box::leak(name.to_owned().into_boxed_str());
+            let found = find(name, "--version");
+            if let Ok(o) = found {
+                // Nothing by these names should run; if one somehow does, it must still be sane.
+                assert_eq!(o.program(), name);
+            }
+        }
+    }
+
+    /// The install hint is specific per tool, so a skip notice is actionable.
+    #[test]
+    fn every_known_oracle_has_an_install_hint() {
+        for p in ["qpdf", "pdftoppm", "pdftotext"] {
+            let hint = Absent::install_hint(p);
+            assert!(hint.contains("install"), "{p}: {hint}");
+            assert_ne!(hint, Absent::install_hint("something-else"), "{p} needs its own hint");
+        }
+    }
+
+    /// Probing is read-only and repeatable: asking twice gives the same answer.
+    #[test]
+    fn probing_is_stable() {
+        let a = qpdf().map(|o| o.program());
+        let b = qpdf().map(|o| o.program());
+        assert_eq!(a.is_ok(), b.is_ok());
+        if let (Ok(a), Ok(b)) = (a, b) {
+            assert_eq!(a, b);
+        }
+    }
+}
diff --git a/crates/oracle/src/pixels.rs b/crates/oracle/src/pixels.rs
new file mode 100644
index 000000000..2b1171981
--- /dev/null
+++ b/crates/oracle/src/pixels.rs
@@ -0,0 +1,428 @@
+//! Comparing a rendered page against an independent renderer's pixels.
+//!
+//! A raw pixel-for-pixel difference is useless for this. Two correct renderers disagree on every
+//! glyph edge — antialiasing coverage, hinting, and where a subpixel-positioned stem lands — so a
+//! strict comparison reports a page as badly wrong when it is perfect, and the number it produces
+//! tells you nothing about whether a shading is missing or a glyph is the wrong one.
+//!
+//! [`compare`] uses the usual remedy: a pixel counts as differing only when it differs from
+//! **every** pixel in the other image's 3×3 neighbourhood by more than `tolerance`. A one-pixel
+//! shift in a stem, or a differently-weighted edge, finds a near match next door and is forgiven.
+//! A glyph that is not there, a shading that was not drawn, or a region painted the wrong colour
+//! has no near match anywhere nearby and is counted.
+//!
+//! The test is run in both directions and the worse result reported, because the one-directional
+//! form is asymmetric in a way that flatters whichever image is blurrier: thin content missing
+//! from A is forgiven when scanning A against B's neighbourhood if B's stroke happens to be wide.
+
+/// A single-channel (grayscale) image borrowed for comparison.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Gray<'a> {
+    width: usize,
+    height: usize,
+    pixels: &'a [u8],
+}
+
+impl<'a> Gray<'a> {
+    /// Borrow `pixels` as a `width` × `height` image, or `None` when the buffer is not exactly
+    /// that size — a truncated decode must not be compared as if it were a short page.
+    pub fn new(width: usize, height: usize, pixels: &'a [u8]) -> Option<Self> {
+        (width.checked_mul(height)? == pixels.len()).then_some(Self { width, height, pixels })
+    }
+
+    pub fn width(&self) -> usize {
+        self.width
+    }
+
+    pub fn height(&self) -> usize {
+        self.height
+    }
+
+    /// The pixel at `(x, y)`, or `None` outside the image.
+    pub fn get(&self, x: usize, y: usize) -> Option<u8> {
+        if x >= self.width || y >= self.height {
+            return None;
+        }
+        self.pixels.get(y.checked_mul(self.width)?.checked_add(x)?).copied()
+    }
+}
+
+/// Why two images could not be compared.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct SizeMismatch {
+    pub a: (usize, usize),
+    pub b: (usize, usize),
+}
+
+impl std::fmt::Display for SizeMismatch {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "cannot compare a {}x{} image with a {}x{} one; render both at the same scale", self.a.0, self.a.1, self.b.0, self.b.1)
+    }
+}
+
+/// How far apart two renderings are.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Diff {
+    /// Pixels with no near match in the other image's neighbourhood, in the worse direction.
+    pub differing: usize,
+    /// Pixels in the image.
+    pub total: usize,
+    /// The largest single-pixel difference found, before the neighbourhood is considered. A high
+    /// value with a low [`Diff::fraction`] is the signature of an edge-only disagreement.
+    pub max_delta: u8,
+}
+
+impl Diff {
+    /// The share of pixels with no near match, in `0.0..=1.0`. Zero for an empty image: nothing
+    /// disagreed because there was nothing to disagree about.
+    pub fn fraction(&self) -> f64 {
+        if self.total == 0 {
+            return 0.0;
+        }
+        // total is non-zero, and differing <= total, so this is finite and in 0..=1.
+        self.differing as f64 / self.total as f64
+    }
+
+    /// `fraction` as a percentage, for reports.
+    pub fn percent(&self) -> f64 {
+        self.fraction() * 100.0
+    }
+}
+
+/// Compare two grayscale renderings of the same page at the same size.
+///
+/// `tolerance` is the per-channel difference tolerated outright; 8 or so absorbs ordinary
+/// antialiasing weight differences without hiding a wrong colour.
+pub fn compare(a: Gray<'_>, b: Gray<'_>, tolerance: u8) -> Result<Diff, SizeMismatch> {
+    if a.width != b.width || a.height != b.height {
+        return Err(SizeMismatch { a: (a.width, a.height), b: (b.width, b.height) });
+    }
+    let max_delta = a.pixels.iter().zip(b.pixels).map(|(&p, &q)| p.abs_diff(q)).max().unwrap_or(0);
+    let forward = unmatched(a, b, tolerance);
+    let backward = unmatched(b, a, tolerance);
+    Ok(Diff { differing: forward.max(backward), total: a.pixels.len(), max_delta })
+}
+
+/// Pixels of `a` with no pixel within `tolerance` anywhere in `b`'s surrounding 3x3.
+fn unmatched(a: Gray<'_>, b: Gray<'_>, tolerance: u8) -> usize {
+    let mut count = 0usize;
+    for y in 0..a.height {
+        for x in 0..a.width {
+            let Some(p) = a.get(x, y) else { continue };
+            let mut matched = false;
+            // Saturating bounds keep the window inside the image at the edges; `get` rejects the
+            // rest, so no index is ever derived from an unchecked subtraction.
+            for ny in y.saturating_sub(1)..=y.saturating_add(1) {
+                for nx in x.saturating_sub(1)..=x.saturating_add(1) {
+                    if b.get(nx, ny).is_some_and(|q| p.abs_diff(q) <= tolerance) {
+                        matched = true;
+                        break;
+                    }
+                }
+                if matched {
+                    break;
+                }
+            }
+            if !matched {
+                count = count.saturating_add(1);
+            }
+        }
+    }
+    count
+}
+
+/// Decode a binary netpbm grayscale image (`P5`), which is what `pdftoppm -gray` writes.
+///
+/// Returns the dimensions and the pixel bytes. Only the maxval 255 form is accepted: a 16-bit
+/// image would otherwise be read as twice as many 8-bit pixels and compared against nonsense.
+pub fn decode_pgm(bytes: &[u8]) -> Option<(usize, usize, Vec<u8>)> {
+    let mut fields = Vec::new();
+    let mut rest = bytes.strip_prefix(b"P5")?;
+    // Three whitespace-separated fields follow the magic: width, height, maxval. Comments run
+    // from `#` to end of line and may appear between any of them.
+    while fields.len() < 3 {
+        let skip = rest.iter().position(|b| !b.is_ascii_whitespace())?;
+        rest = rest.get(skip..)?;
+        if rest.first() == Some(&b'#') {
+            let end = rest.iter().position(|&b| b == b'\n')?;
+            rest = rest.get(end.checked_add(1)?..)?;
+            continue;
+        }
+        let end = rest.iter().position(u8::is_ascii_whitespace)?;
+        let field = rest.get(..end)?;
+        fields.push(std::str::from_utf8(field).ok()?.parse::<usize>().ok()?);
+        rest = rest.get(end..)?;
+    }
+    let (&width, &height, &maxval) = (fields.first()?, fields.get(1)?, fields.get(2)?);
+    if maxval != 255 {
+        return None;
+    }
+    // Exactly one whitespace byte separates the header from the data.
+    let pixels = rest.get(1..)?;
+    let wanted = width.checked_mul(height)?;
+    (pixels.len() >= wanted).then(|| (width, height, pixels.get(..wanted).unwrap_or_default().to_vec()))
+}
+
+/// Decode the netpbm `P7` RGB_ALPHA image `pdfcraft-cli render --out x.pam` writes, flattening it
+/// to grayscale the way a viewer would show it: composited over white, then luminance.
+///
+/// The alpha is premultiplied, which is why the composite is `channel + white * (1 - alpha)`
+/// rather than the usual `mix`. A page is normally opaque, but a transparent one must not come out
+/// darker here than it looks on screen, or the comparison blames the renderer for the harness.
+pub fn decode_pam_gray(bytes: &[u8]) -> Option<(usize, usize, Vec<u8>)> {
+    let header_end = find(bytes, b"ENDHDR\n")?.checked_add(b"ENDHDR\n".len())?;
+    let header = std::str::from_utf8(bytes.get(..header_end)?).ok()?;
+    if !header.starts_with("P7") {
+        return None;
+    }
+    let field = |name: &str| -> Option<usize> { header.lines().find_map(|l| l.strip_prefix(name)?.trim().parse::<usize>().ok()) };
+    let (width, height) = (field("WIDTH")?, field("HEIGHT")?);
+    if field("DEPTH")? != 4 || field("MAXVAL")? != 255 || !header.contains("TUPLTYPE RGB_ALPHA") {
+        return None;
+    }
+    let data = bytes.get(header_end..)?;
+    let wanted = width.checked_mul(height)?.checked_mul(4)?;
+    if data.len() < wanted {
+        return None;
+    }
+    let mut out = Vec::with_capacity(width.checked_mul(height)?);
+    for px in data.get(..wanted)?.as_chunks::<4>().0 {
+        let (&r, &g, &b, &a) = (px.first()?, px.get(1)?, px.get(2)?, px.get(3)?);
+        // Composite premultiplied RGB over white, in integer arithmetic that cannot overflow:
+        // each term is at most 255, and the sum is at most 255.
+        let over_white = |c: u8| u32::from(c).saturating_add(255u32.saturating_sub(u32::from(a))).min(255);
+        let (r, g, b) = (over_white(r), over_white(g), over_white(b));
+        // Rec. 601 luma, the usual grayscale for this, rounded. Each term is at most 255*587, so
+        // the sum cannot overflow a u32.
+        let luma = (r * 299 + g * 587 + b * 114 + 500) / 1000;
+        out.push(u8::try_from(luma.min(255)).unwrap_or(255));
+    }
+    Some((width, height, out))
+}
+
+fn find(haystack: &[u8], needle: &[u8]) -> Option<usize> {
+    haystack.windows(needle.len()).position(|w| w == needle)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn gray(w: usize, h: usize, fill: u8) -> Vec<u8> {
+        vec![fill; w * h]
+    }
+
+    fn pam(w: usize, h: usize, px: &[u8]) -> Vec<u8> {
+        let mut out = format!("P7\nWIDTH {w}\nHEIGHT {h}\nDEPTH 4\nMAXVAL 255\nTUPLTYPE RGB_ALPHA\nENDHDR\n").into_bytes();
+        out.extend_from_slice(px);
+        out
+    }
+
+    #[test]
+    fn pam_flattens_to_the_grey_a_viewer_would_show() {
+        // Opaque white, opaque black, opaque mid-grey.
+        let px = [255, 255, 255, 255, 0, 0, 0, 255, 128, 128, 128, 255];
+        let (w, h, g) = decode_pam_gray(&pam(3, 1, &px)).expect("a P7 image");
+        assert_eq!((w, h), (3, 1));
+        assert_eq!(g, vec![255, 0, 128]);
+    }
+
+    /// A fully transparent pixel is white on screen, not black. Getting this wrong would make the
+    /// harness report a blank margin as a difference on every page that has one.
+    #[test]
+    fn transparent_pixels_composite_over_white() {
+        let px = [0, 0, 0, 0, 0, 0, 0, 128];
+        let (_, _, g) = decode_pam_gray(&pam(2, 1, &px)).expect("a P7 image");
+        assert_eq!(g.first().copied(), Some(255), "fully transparent is white");
+        assert_eq!(g.get(1).copied(), Some(127), "half-transparent black over white is mid grey");
+    }
+
+    #[test]
+    fn hostile_pam_headers_are_rejected() {
+        let px = [0u8; 8];
+        assert!(decode_pam_gray(&pam(2, 1, &px)).is_some());
+        let cases: Vec<Vec<u8>> = vec![
+            b"".to_vec(),
+            b"P7\n".to_vec(),
+            b"P7\nWIDTH 2\nHEIGHT 1\nDEPTH 4\nMAXVAL 255\nTUPLTYPE RGB_ALPHA\n".to_vec(), // no ENDHDR
+            pam(2, 1, &[0u8; 4]),                                                         // truncated data
+            b"P6\nWIDTH 2\nHEIGHT 1\nDEPTH 4\nMAXVAL 255\nTUPLTYPE RGB_ALPHA\nENDHDR\n".to_vec(),
+            b"P7\nWIDTH 2\nHEIGHT 1\nDEPTH 3\nMAXVAL 255\nTUPLTYPE RGB\nENDHDR\n".to_vec(), // no alpha
+            b"P7\nWIDTH 2\nHEIGHT 1\nDEPTH 4\nMAXVAL 65535\nTUPLTYPE RGB_ALPHA\nENDHDR\n".to_vec(),
+            b"P7\nWIDTH 99999999999999999999\nHEIGHT 1\nDEPTH 4\nMAXVAL 255\nTUPLTYPE RGB_ALPHA\nENDHDR\n".to_vec(),
+        ];
+        for case in &cases {
+            assert!(decode_pam_gray(case).is_none(), "{:?}", String::from_utf8_lossy(case.get(..40).unwrap_or(case)));
+        }
+        // A declared area far larger than the data must fail on length, not allocate.
+        let huge = b"P7\nWIDTH 4000000000\nHEIGHT 4000000000\nDEPTH 4\nMAXVAL 255\nTUPLTYPE RGB_ALPHA\nENDHDR\n".to_vec();
+        assert!(decode_pam_gray(&huge).is_none());
+    }
+
+    #[test]
+    fn identical_images_do_not_differ() {
+        let buf = gray(16, 16, 128);
+        let a = Gray::new(16, 16, &buf).expect("sized");
+        let d = compare(a, a, 0).expect("same size");
+        assert_eq!(d.differing, 0);
+        assert_eq!(d.max_delta, 0);
+        assert_eq!(d.fraction(), 0.0);
+        assert_eq!(d.total, 256);
+    }
+
+    /// The whole point: a one-pixel shift of a stem is forgiven, because every moved pixel finds
+    /// its match next door. This is what makes the number mean something across renderers.
+    #[test]
+    fn a_one_pixel_shift_is_forgiven() {
+        let (w, h) = (9usize, 9usize);
+        let mut left = gray(w, h, 255);
+        let mut right = gray(w, h, 255);
+        for y in 0..h {
+            left[y * w + 4] = 0; // a vertical stem
+            right[y * w + 5] = 0; // the same stem, one pixel over
+        }
+        let a = Gray::new(w, h, &left).expect("sized");
+        let b = Gray::new(w, h, &right).expect("sized");
+        let d = compare(a, b, 8).expect("same size");
+        assert_eq!(d.differing, 0, "a one-pixel shift must not count as a difference");
+        // ...but it is still visible as a large single-pixel delta, which is the honest signal.
+        assert_eq!(d.max_delta, 255);
+    }
+
+    /// And the point of the point: content that is simply absent is *not* forgiven, however
+    /// tolerant the neighbourhood test is.
+    #[test]
+    fn missing_content_is_not_forgiven() {
+        let (w, h) = (16usize, 16usize);
+        let blank = gray(w, h, 255);
+        let mut drawn = blank.clone();
+        // A filled 6x6 block: its interior is further than one pixel from any white pixel.
+        for y in 5..11 {
+            for x in 5..11 {
+                drawn[y * w + x] = 0;
+            }
+        }
+        let a = Gray::new(w, h, &blank).expect("sized");
+        let b = Gray::new(w, h, &drawn).expect("sized");
+        let d = compare(a, b, 8).expect("same size");
+        // Scanning the blank against the drawn image forgives the block's border, whose
+        // neighbourhood still reaches white, and counts only its 4x4 interior. Scanning the other
+        // way counts all 36 black pixels, since a blank image offers no dark match anywhere. The
+        // worse of the two is reported, so the whole block is -- which is the honest answer.
+        assert_eq!(d.differing, 36, "every pixel of a missing block must be counted");
+        assert!(d.fraction() > 0.0);
+    }
+
+    /// A three-pixel shift is beyond the 3x3 window and is reported.
+    #[test]
+    fn a_shift_wider_than_the_window_is_reported() {
+        let (w, h) = (16usize, 16usize);
+        let mut left = gray(w, h, 255);
+        let mut right = gray(w, h, 255);
+        for y in 0..h {
+            for x in 4..8 {
+                left[y * w + x] = 0;
+            }
+            for x in 11..15 {
+                right[y * w + x] = 0;
+            }
+        }
+        let a = Gray::new(w, h, &left).expect("sized");
+        let b = Gray::new(w, h, &right).expect("sized");
+        assert!(compare(a, b, 8).expect("same size").differing > 0);
+    }
+
+    #[test]
+    fn tolerance_absorbs_small_differences_only() {
+        let flat = gray(8, 8, 100);
+        let near = gray(8, 8, 105);
+        let far = gray(8, 8, 200);
+        let a = Gray::new(8, 8, &flat).expect("sized");
+        assert_eq!(compare(a, Gray::new(8, 8, &near).expect("sized"), 8).expect("ok").differing, 0);
+        assert_eq!(compare(a, Gray::new(8, 8, &far).expect("sized"), 8).expect("ok").differing, 64);
+        // Tolerance is inclusive at the boundary.
+        assert_eq!(compare(a, Gray::new(8, 8, &near).expect("sized"), 5).expect("ok").differing, 0);
+        assert_eq!(compare(a, Gray::new(8, 8, &near).expect("sized"), 4).expect("ok").differing, 64);
+    }
+
+    /// Comparison is symmetric: neither argument order flatters one renderer.
+    #[test]
+    fn comparison_is_symmetric() {
+        let (w, h) = (12usize, 12usize);
+        let mut thin = gray(w, h, 255);
+        let mut thick = gray(w, h, 255);
+        for y in 0..h {
+            thin[y * w + 6] = 0;
+            for x in 4..9 {
+                thick[y * w + x] = 0;
+            }
+        }
+        let a = Gray::new(w, h, &thin).expect("sized");
+        let b = Gray::new(w, h, &thick).expect("sized");
+        let forward = compare(a, b, 8).expect("ok");
+        let backward = compare(b, a, 8).expect("ok");
+        assert_eq!(forward, backward, "argument order must not change the verdict");
+        assert!(forward.differing > 0, "a 1px stem against a 5px bar is a real difference");
+    }
+
+    #[test]
+    fn different_sizes_are_an_error_not_a_score() {
+        let small = gray(4, 4, 0);
+        let large = gray(8, 8, 0);
+        let err = compare(Gray::new(4, 4, &small).expect("sized"), Gray::new(8, 8, &large).expect("sized"), 0).expect_err("mismatch");
+        assert_eq!(err, SizeMismatch { a: (4, 4), b: (8, 8) });
+        assert!(err.to_string().contains("4x4"), "{err}");
+    }
+
+    #[test]
+    fn a_buffer_that_is_not_the_stated_size_is_rejected() {
+        let buf = gray(4, 4, 0);
+        assert!(Gray::new(4, 4, &buf).is_some());
+        assert!(Gray::new(5, 4, &buf).is_none());
+        assert!(Gray::new(4, 5, &buf).is_none());
+        assert!(Gray::new(usize::MAX, usize::MAX, &buf).is_none(), "the area must not overflow into a match");
+        // A zero-sized image is representable and compares as no difference.
+        let empty: [u8; 0] = [];
+        let z = Gray::new(0, 0, &empty).expect("zero is a valid size");
+        assert_eq!(compare(z, z, 0).expect("ok").fraction(), 0.0);
+    }
+
+    #[test]
+    fn pgm_decodes_the_shape_pdftoppm_writes() {
+        let mut bytes = b"P5\n4 2\n255\n".to_vec();
+        bytes.extend_from_slice(&[0, 1, 2, 3, 4, 5, 6, 7]);
+        let (w, h, px) = decode_pgm(&bytes).expect("a P5 image");
+        assert_eq!((w, h), (4, 2));
+        assert_eq!(px, vec![0, 1, 2, 3, 4, 5, 6, 7]);
+    }
+
+    #[test]
+    fn pgm_handles_comments_and_odd_whitespace() {
+        let mut bytes = b"P5\n# written by pdftoppm\n  4\t2\n255 ".to_vec();
+        bytes.extend_from_slice(&[9; 8]);
+        let (w, h, px) = decode_pgm(&bytes).expect("a commented P5 image");
+        assert_eq!((w, h, px.len()), (4, 2, 8));
+    }
+
+    /// Malformed or hostile headers return `None` rather than panicking or inventing a size.
+    #[test]
+    fn hostile_pgm_headers_are_rejected() {
+        let cases: &[&[u8]] = &[
+            b"",
+            b"P5",
+            b"P6\n4 2\n255\n",     // colour, not grayscale
+            b"P5\n4 2\n65535\n",   // 16-bit: would be read as twice the pixels
+            b"P5\n4 2\n255\n\x00", // truncated data
+            b"P5\n-4 2\n255\n",    // negative
+            b"P5\n99999999999999999999 2\n255\n",
+            b"P5\n4\n", // header cut short
+            b"P5\n#unterminated comment",
+        ];
+        for case in cases {
+            assert!(decode_pgm(case).is_none(), "{:?}", String::from_utf8_lossy(case));
+        }
+        // A huge declared area must not allocate: it fails on the data length check.
+        let huge = b"P5\n4000000000 4000000000\n255\n".to_vec();
+        assert!(decode_pgm(&huge).is_none());
+    }
+}
diff --git a/crates/organize/Cargo.toml b/crates/organize/Cargo.toml
index e759a322d..78507197a 100644
--- a/crates/organize/Cargo.toml
+++ b/crates/organize/Cargo.toml
@@ -14,4 +14,5 @@ pdfcraft-cos = { workspace = true }
 thiserror = { workspace = true }
 
 [dev-dependencies]
+pdfcraft-oracle = { workspace = true }
 hayro-syntax = { workspace = true }
diff --git a/crates/organize/src/import.rs b/crates/organize/src/import.rs
index c420d2d59..588539866 100644
--- a/crates/organize/src/import.rs
+++ b/crates/organize/src/import.rs
@@ -28,8 +28,16 @@ use crate::{INHERITABLE, OrganizeError, pages_root, rebuild, walk};
 const SKIP_ON_PAGE: &[&[u8]] = &[b"Parent", b"B", b"StructParents", b"Thumb", b"PieceInfo"];
 const SKIP_ON_ANNOT: &[&[u8]] = &[b"StructParent", b"P"];
 
+/// How deep a copy follows references and nested arrays and dictionaries, counted together.
+/// Real documents stay well under this (a page's resources, fonts and descriptors, nested
+/// form XObjects and field trees are a few levels each); a chain of thousands of indirect
+/// objects, each shallow enough for the parser, would otherwise exhaust the stack (#1800).
+const MAX_COPY_DEPTH: usize = 256;
+
 struct Copier<'a> {
     src: &'a Document,
+    /// Current recursion depth, bounded by [`MAX_COPY_DEPTH`].
+    depth: usize,
     map: HashMap<ObjRef, ObjRef>,
     /// Source page → destination page, for rewriting `/P` and destinations.
     pages: HashMap<ObjRef, ObjRef>,
@@ -41,11 +49,15 @@ struct Copier<'a> {
     ocgs: Vec<(ObjRef, ObjRef)>,
 }
 
-impl Copier<'_> {
+impl<'a> Copier<'a> {
+    fn new(src: &'a Document, map: HashMap<ObjRef, ObjRef>, pages: HashMap<ObjRef, ObjRef>) -> Self {
+        Copier { src, depth: 0, map, pages, annots: Vec::new(), fields: Vec::new(), ocgs: Vec::new() }
+    }
+
     /// Copy an indirect object (once), returning its destination reference.
-    fn copy_ref(&mut self, dst: &mut Document, r: ObjRef) -> ObjRef {
+    fn copy_ref(&mut self, dst: &mut Document, r: ObjRef) -> Result<ObjRef, OrganizeError> {
         if let Some(d) = self.map.get(&r) {
-            return *d;
+            return Ok(*d);
         }
         // Reserve the number first so cycles (field ↔ widget) terminate.
         let new = dst.add(Object::Null);
@@ -54,26 +66,41 @@ impl Copier<'_> {
         if obj.as_dict().is_some_and(|d| d.name(b"Type") == Some(b"OCG")) {
             self.ocgs.push((r, new));
         }
-        let copied = self.copy_value(dst, &obj, Some(new));
+        let copied = self.copy_value(dst, &obj, Some(new))?;
         dst.set(new, copied);
-        new
+        Ok(new)
     }
 
-    fn copy_value(&mut self, dst: &mut Document, o: &Object, this: Option<ObjRef>) -> Object {
-        match o {
-            Object::Ref(r) => Object::Ref(self.copy_ref(dst, *r)),
-            Object::Array(a) => Object::Array(a.iter().map(|x| self.copy_value(dst, x, None)).collect()),
-            Object::Dict(d) => Object::Dict(self.copy_dict(dst, d, this)),
-            Object::Stream(s) => {
-                let mut s = s.clone();
-                s.dict = self.copy_dict(dst, &s.dict, None);
-                Object::Stream(s)
-            }
-            other => other.clone(),
+    /// One level deeper into the object graph, or the refusal when there are too many.
+    fn descend(&mut self) -> Result<(), OrganizeError> {
+        if self.depth >= MAX_COPY_DEPTH {
+            return Err(OrganizeError::Invalid(format!("the pages refer to objects nested more than {MAX_COPY_DEPTH} levels deep")));
         }
+        self.depth += 1;
+        Ok(())
     }
 
-    fn copy_dict(&mut self, dst: &mut Document, d: &Dict, this: Option<ObjRef>) -> Dict {
+    fn copy_value(&mut self, dst: &mut Document, o: &Object, this: Option<ObjRef>) -> Result<Object, OrganizeError> {
+        if !matches!(o, Object::Ref(_) | Object::Array(_) | Object::Dict(_) | Object::Stream(_)) {
+            return Ok(o.clone());
+        }
+        self.descend()?;
+        let copied = match o {
+            Object::Ref(r) => self.copy_ref(dst, *r).map(Object::Ref),
+            Object::Array(a) => a.iter().map(|x| self.copy_value(dst, x, None)).collect::<Result<Vec<_>, _>>().map(Object::Array),
+            Object::Dict(d) => self.copy_dict(dst, d, this).map(Object::Dict),
+            Object::Stream(s) => self.copy_dict(dst, &s.dict, None).map(|dict| {
+                let mut s = s.clone();
+                s.dict = dict;
+                Object::Stream(s)
+            }),
+            other => Ok(other.clone()),
+        };
+        self.depth = self.depth.saturating_sub(1);
+        copied
+    }
+
+    fn copy_dict(&mut self, dst: &mut Document, d: &Dict, this: Option<ObjRef>) -> Result<Dict, OrganizeError> {
         let is_annot = d.name(b"Type") == Some(b"Annot") || (d.contains(b"Subtype") && d.contains(b"Rect") && !d.contains(b"Type"));
         let is_field = d.contains(b"FT") || (d.contains(b"T") && d.contains(b"Kids"));
         let mut out = Dict::new();
@@ -86,7 +113,7 @@ impl Copier<'_> {
                 out.set(k.clone(), v.clone());
                 continue;
             }
-            out.set(k.clone(), self.copy_value(dst, v, None));
+            out.set(k.clone(), self.copy_value(dst, v, None)?);
         }
         if let Some(this) = this {
             if is_annot {
@@ -97,7 +124,7 @@ impl Copier<'_> {
                 self.fields.push(this);
             }
         }
-        out
+        Ok(out)
     }
 
     /// Map a source destination (explicit array or reference to one) to the destination
@@ -162,15 +189,8 @@ impl Copier<'_> {
                         }
                     } else {
                         // Other actions (URI, Launch, JavaScript…) carry no page references.
-                        let mut c = Copier {
-                            src: self.src,
-                            map: self.map.clone(),
-                            pages: HashMap::new(),
-                            annots: Vec::new(),
-                            fields: Vec::new(),
-                            ocgs: Vec::new(),
-                        };
-                        let copied = c.copy_value(dst, &Object::Dict(ad.clone()), None);
+                        let mut c = Copier::new(self.src, self.map.clone(), HashMap::new());
+                        let copied = c.copy_value(dst, &Object::Dict(ad.clone()), None)?;
                         d.set(b"A".to_vec(), copied);
                     }
                 }
@@ -183,9 +203,8 @@ impl Copier<'_> {
 
 /// Copy `o` from `src` into `dst`, reusing the copies listed in `map` (source → destination), so
 /// an object the copied pages already brought along (an ICC profile) is not stored twice.
-pub(crate) fn copy_object(dst: &mut Document, src: &Document, o: &Object, map: HashMap<ObjRef, ObjRef>) -> Object {
-    let mut c = Copier { src, map, pages: HashMap::new(), annots: Vec::new(), fields: Vec::new(), ocgs: Vec::new() };
-    c.copy_value(dst, o, None)
+pub(crate) fn copy_object(dst: &mut Document, src: &Document, o: &Object, map: HashMap<ObjRef, ObjRef>) -> Result<Object, OrganizeError> {
+    Copier::new(src, map, HashMap::new()).copy_value(dst, o, None)
 }
 
 /// How colliding fully-qualified field names are resolved when pages are imported.
@@ -222,12 +241,70 @@ pub fn import_pages_with(
     conflicts: FieldConflicts,
 ) -> Result<ImportOutcome, OrganizeError> {
     let first_new = dst.object_numbers().last().map_or(1, |n| n + 1);
-    let imported = import_pages_mapped(dst, src, src_pages, at, conflicts)?;
+    let imported = match import_pages_mapped(dst, src, src_pages, at, conflicts) {
+        Ok(imported) => imported,
+        Err(e) => {
+            // A refusal while copying (a source too deep to follow) has only added objects:
+            // take them back, so the destination is as it was.
+            for n in dst.object_numbers().into_iter().filter(|n| *n >= first_new) {
+                dst.free(ObjRef::new(n, dst.generation(n)));
+            }
+            return Err(e);
+        }
+    };
     let created: Vec<ObjRef> = dst.object_numbers().into_iter().filter(|n| *n >= first_new).map(|n| ObjRef::new(n, dst.generation(n))).collect();
     crate::dedupe::dedupe_resources(dst, &created, true);
     Ok(ImportOutcome { pages: imported.pages, renamed_fields: imported.renamed_fields })
 }
 
+/// Insert Pages from File: [`import_pages_with`], and the inserted file's bookmarks come along
+/// under one new bookmark titled `title` (the file's name) at its first inserted page, as Combine
+/// Files does for each file. That bookmark goes among the top-level bookmarks where the pages went:
+/// before the first one that points after them. Bookmarks to pages left out lose their destination;
+/// a file without bookmarks adds none.
+pub fn insert_file_pages(
+    dst: &mut Document,
+    src: &Document,
+    title: &str,
+    src_pages: &[usize],
+    at: usize,
+    conflicts: FieldConflicts,
+) -> Result<ImportOutcome, OrganizeError> {
+    let first_new = dst.object_numbers().last().map_or(1, |n| n + 1);
+    let imported = import_pages_mapped(dst, src, src_pages, at, conflicts)?;
+    let created: Vec<ObjRef> = dst.object_numbers().into_iter().filter(|n| *n >= first_new).map(|n| ObjRef::new(n, dst.generation(n))).collect();
+    crate::dedupe::dedupe_resources(dst, &created, true);
+    let outline = source_outline(src, imported.page_map);
+    if let Some(first) = imported.pages.first()
+        && !outline.is_empty()
+    {
+        let after = at.min(crate::page_count(dst)?.saturating_sub(imported.pages.len())).saturating_add(imported.pages.len());
+        insert_file_bookmark(dst, &Mark { title: title.to_string(), page: *first, outline }, after)?;
+    }
+    Ok(ImportOutcome { pages: imported.pages, renamed_fields: imported.renamed_fields })
+}
+
+/// Add `mark` (a file's bookmark holding its own, collapsed) to the top level of `doc`'s outline,
+/// before the first top-level bookmark that points at page `after` (0-based) or later.
+fn insert_file_bookmark(doc: &mut Document, mark: &Mark, after: usize) -> Result<(), OrganizeError> {
+    let index = crate::outline::top_level_bookmarks(doc).iter().position(|b| b.page.is_some_and(|p| p >= after));
+    let root = crate::outline::container(doc, &[])?;
+    let item = doc.add(Object::Null);
+    let mut d = Dict::new();
+    d.set(b"Title".to_vec(), Object::String(pdfcraft_cos::PdfString::text(&mark.title)));
+    d.set(b"Dest".to_vec(), Object::Array(vec![Object::Ref(mark.page), Object::name("Fit")]));
+    if let Some((f, l, n)) = write_outline_level(doc, item, &mark.outline)? {
+        d.set(b"First".to_vec(), Object::Ref(f));
+        d.set(b"Last".to_vec(), Object::Ref(l));
+        d.set(b"Count".to_vec(), Object::Int(-(n as i64))); // collapsed
+    }
+    doc.set(item, Object::Dict(d));
+    let mut top = crate::outline::children(doc, root);
+    top.insert(index.unwrap_or(top.len()).min(top.len()), item);
+    crate::outline::relink_and_recount(doc, root, &top)?;
+    Ok(())
+}
+
 /// Copy pages `src_pages` (0-based, in the given order) of `src` into `dst`, inserting them at
 /// position `at`. Returns the new page references in order.
 ///
@@ -268,7 +345,7 @@ fn import_pages_mapped(
     }
     let mut existing = walk(dst)?;
     let root = pages_root(dst)?;
-    let mut copier = Copier { src, map: HashMap::new(), pages: HashMap::new(), annots: Vec::new(), fields: Vec::new(), ocgs: Vec::new() };
+    let mut copier = Copier::new(src, HashMap::new(), HashMap::new());
     // Allocate every destination page first, so destinations between copied pages resolve.
     let targets: Vec<(ObjRef, ObjRef, Dict)> = src_pages
         .iter()
@@ -291,14 +368,7 @@ fn import_pages_mapped(
         // popup, a widget's place). Destinations still map to the pages copied.
         let repeat = done.contains_key(&page);
         let new = if repeat { dst.add(Object::Null) } else { new };
-        let mut own = repeat.then(|| Copier {
-            src,
-            map: HashMap::new(),
-            pages: copier.pages.clone(),
-            annots: Vec::new(),
-            fields: Vec::new(),
-            ocgs: Vec::new(),
-        });
+        let mut own = repeat.then(|| Copier::new(src, HashMap::new(), copier.pages.clone()));
         let src_dict = src.get(page).as_dict().cloned().unwrap_or_default();
         let resources = resources_with_ancestors(src, &src_dict);
         let mut d = Dict::new();
@@ -321,7 +391,7 @@ fn import_pages_mapped(
                         && let Some(copied) = copier.map.get(&parent).copied()
                     {
                         let r = dst.add(Object::Null);
-                        let c = copier.copy_value(dst, &resolved, Some(r));
+                        let c = copier.copy_value(dst, &resolved, Some(r))?;
                         dst.set(r, c);
                         // `/Kids` may be an array object of its own: add to it there, so the
                         // field keeps its other widgets.
@@ -348,10 +418,10 @@ fn import_pages_mapped(
                     // Direct (inline) annotation dictionaries become indirect objects, so every
                     // copied annotation can be fixed up the same way.
                     let r = match a {
-                        Object::Ref(r) => annots.copy_ref(dst, r),
+                        Object::Ref(r) => annots.copy_ref(dst, r)?,
                         Object::Dict(_) => {
                             let r = dst.add(Object::Null);
-                            let c = annots.copy_value(dst, &a, Some(r));
+                            let c = annots.copy_value(dst, &a, Some(r))?;
                             dst.set(r, c);
                             r
                         }
@@ -363,17 +433,17 @@ fn import_pages_mapped(
                 d.set(b"Annots".to_vec(), Object::Array(out));
                 continue;
             }
-            d.set(k.clone(), copier.copy_value(dst, v, None));
+            d.set(k.clone(), copier.copy_value(dst, v, None)?);
         }
         if let Some(r) = resources {
-            let r = copier.copy_value(dst, &r, None);
+            let r = copier.copy_value(dst, &r, None)?;
             d.set(b"Resources".to_vec(), r);
         }
         for k in INHERITABLE {
             if !d.contains(k)
                 && let Some(v) = inherited.get(k)
             {
-                let v = copier.copy_value(dst, v, None);
+                let v = copier.copy_value(dst, v, None)?;
                 d.set(k.to_vec(), v);
             }
         }
@@ -936,7 +1006,7 @@ impl Combiner {
             let outline = source_outline(src, imported.page_map);
             self.marks.push(Mark { title: title.to_string(), page: *first, outline });
         }
-        collect_attachments(&mut self.out, src, &mut self.attachments);
+        collect_attachments(&mut self.out, src, &mut self.attachments)?;
         let declared = crate::pdfx::PrintStandard::of(src);
         match self.standard.as_ref().map(|first| first.declared.same_as(&declared)) {
             Some(same) => self.agreed &= same,
@@ -1030,7 +1100,7 @@ pub fn combine_grouped_with(runs: &[Run<'_>], conflicts: FieldConflicts) -> Resu
         if let Some(first) = imported.pages.first() {
             marks.push(Mark { title: file.title.to_string(), page: *first, outline: source_outline(file.src, imported.page_map) });
         }
-        collect_attachments(&mut out, file.src, &mut attachments);
+        collect_attachments(&mut out, file.src, &mut attachments)?;
         let declared = crate::pdfx::PrintStandard::of(file.src);
         match &standard {
             None => standard = Some((declared, file.src, imported.objects)),
@@ -1056,22 +1126,23 @@ pub fn combine_grouped_with(runs: &[Run<'_>], conflicts: FieldConflicts) -> Resu
 }
 
 /// Copy a source's document-level attachments (`/Names /EmbeddedFiles`) into `dst`.
-fn collect_attachments(dst: &mut Document, src: &Document, out: &mut Vec<(Vec<u8>, Object)>) {
+fn collect_attachments(dst: &mut Document, src: &Document, out: &mut Vec<(Vec<u8>, Object)>) -> Result<(), OrganizeError> {
     let Some(tree) = src
         .root()
         .and_then(|r| src.get(r).as_dict().cloned())
         .and_then(|c| c.get(b"Names").map(|n| src.resolve(n)))
         .and_then(|n| n.as_dict().and_then(|d| d.get(b"EmbeddedFiles").cloned()))
     else {
-        return;
+        return Ok(());
     };
     let mut entries = Vec::new();
     name_tree_entries(src, &tree, 0, &mut entries);
-    let mut copier = Copier { src, map: HashMap::new(), pages: HashMap::new(), annots: Vec::new(), fields: Vec::new(), ocgs: Vec::new() };
+    let mut copier = Copier::new(src, HashMap::new(), HashMap::new());
     for (k, v) in entries {
-        let v = copier.copy_value(dst, &v, None);
+        let v = copier.copy_value(dst, &v, None)?;
         out.push((k, v));
     }
+    Ok(())
 }
 
 /// Write attachments as a flat, sorted `/EmbeddedFiles` name tree; duplicate names get " (2)"…
@@ -1137,7 +1208,7 @@ fn source_outline(src: &Document, pages: HashMap<ObjRef, ObjRef>) -> Vec<Outline
         .and_then(|r| src.get(r).as_dict().cloned())
         .and_then(|c| c.get(b"Outlines").map(|o| src.resolve(o)))
         .and_then(|o| o.as_dict().and_then(|d| d.reference(b"First")));
-    let mapper = Copier { src, map: HashMap::new(), pages, annots: Vec::new(), fields: Vec::new(), ocgs: Vec::new() };
+    let mapper = Copier::new(src, HashMap::new(), pages);
     let mut budget = 10_000usize;
     outline_level(&mapper, first, 0, &mut budget)
 }
@@ -1288,8 +1359,11 @@ pub fn page_as_form(dst: &mut Document, src: &Document, page: usize) -> Result<(
             }
         }
     }
-    let mut copier = Copier { src, map: HashMap::new(), pages: HashMap::new(), annots: Vec::new(), fields: Vec::new(), ocgs: Vec::new() };
-    let resources = d.get(b"Resources").map(|r| copier.copy_value(dst, r, None)).unwrap_or(Object::Dict(Dict::new()));
+    let mut copier = Copier::new(src, HashMap::new(), HashMap::new());
+    let resources = match d.get(b"Resources") {
+        Some(r) => copier.copy_value(dst, r, None)?,
+        None => Object::Dict(Dict::new()),
+    };
     register_layers(dst, src, &copier.ocgs)?;
     let mut fd = Dict::new();
     fd.set(b"Type".to_vec(), Object::name("XObject"));
diff --git a/crates/organize/src/labels.rs b/crates/organize/src/labels.rs
index aa02be427..8ee04bed5 100644
--- a/crates/organize/src/labels.rs
+++ b/crates/organize/src/labels.rs
@@ -385,7 +385,9 @@ pub fn set_page_label_ranges(doc: &mut Document, ranges: &[LabelRange]) -> Resul
             spec.set(b"St".to_vec(), Object::Int(i64::from(r.first)));
         }
         nums.push(Object::Int(r.start as i64));
-        nums.push(Object::Dict(spec));
+        // Indirect, as Acrobat writes them: a direct dictionary is valid too, but some readers
+        // (pdfannots2json, through unipdf) skip it and show physical page numbers (#1763).
+        nums.push(Object::Ref(doc.add(Object::Dict(spec))));
     }
     let mut tree = Dict::new();
     tree.set(b"Nums".to_vec(), Object::Array(nums));
@@ -394,6 +396,31 @@ pub fn set_page_label_ranges(doc: &mut Document, ranges: &[LabelRange]) -> Resul
     Ok(())
 }
 
+/// After `deleted` pages (0-based, as they were numbered before the delete) are gone, move the label
+/// ranges with the pages they label: a range starts as many pages earlier as were deleted before
+/// it, and keeps its first number, so numbering continues over the gap as in Acrobat. A range whose
+/// first page went starts on the next page left; one left with no pages gives way to the next.
+/// A tree that can't be read is left as it is: the delete still goes ahead.
+pub(crate) fn drop_deleted_pages(doc: &mut Document, deleted: &[usize]) -> Result<(), OrganizeError> {
+    let Ok(old) = checked_ranges(doc) else { return Ok(()) };
+    let mut deleted = deleted.to_vec();
+    deleted.sort_unstable();
+    deleted.dedup();
+    let mut ranges: Vec<LabelRange> = Vec::with_capacity(old.len());
+    for r in &old {
+        let start = r.start.saturating_sub(deleted.partition_point(|d| *d < r.start));
+        match ranges.last_mut() {
+            // The later range is the one on the first page left; ranges stay sorted by start.
+            Some(last) if last.start == start => *last = LabelRange { start, ..r.clone() },
+            _ => ranges.push(LabelRange { start, ..r.clone() }),
+        }
+    }
+    if ranges == old {
+        return Ok(());
+    }
+    set_page_label_ranges(doc, &ranges)
+}
+
 /// Acrobat's "Number pages": label pages `from..=to` (0-based) with `style`, `prefix` and
 /// starting number `first`; pages after `to` keep the labels they had.
 pub fn number_pages(doc: &mut Document, from: usize, to: usize, style: LabelStyle, prefix: &str, first: u32) -> Result<(), OrganizeError> {
diff --git a/crates/organize/src/lib.rs b/crates/organize/src/lib.rs
index 7b366bad9..3b2873abe 100644
--- a/crates/organize/src/lib.rs
+++ b/crates/organize/src/lib.rs
@@ -11,7 +11,7 @@
 
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
-use pdfcraft_cos::{Dict, Document, ObjRef, Object, PdfString};
+use pdfcraft_cos::{Dict, Document, ObjRef, Object, PdfString, XrefEntry};
 
 mod boxes;
 mod dedupe;
@@ -20,6 +20,7 @@ mod labels;
 mod outline;
 mod pdfx;
 mod prune;
+mod transition;
 pub mod view;
 mod xmp;
 
@@ -27,14 +28,15 @@ pub use boxes::{BoxSpec, PageBox, page_boxes, set_page_box};
 pub use dedupe::dedupe_resources;
 pub use import::{
     CombineOutcome, Combiner, FieldConflicts, ImportOutcome, Run, SplitBy, combine, combine_field_conflicts, combine_grouped, combine_grouped_with,
-    combine_selected, combine_selected_with, combine_with, extract_pages, field_name_conflicts, import_pages, import_pages_with, page_as_form, split,
-    split_ranges,
+    combine_selected, combine_selected_with, combine_with, extract_pages, field_name_conflicts, import_pages, import_pages_with, insert_file_pages,
+    page_as_form, split, split_ranges,
 };
 pub use labels::{LabelRange, LabelStyle, PageLabels, number_pages, page_label_ranges, page_labels, set_page_label_ranges};
 pub use outline::{
     Bookmark, BookmarkPage, OutlineEntry, OutlineError, add_bookmark, add_bookmark_tree, bookmark_page, bookmarks, delete_bookmark, move_bookmark,
     rename_bookmark, set_bookmark_open, set_bookmark_page, top_level_bookmarks,
 };
+pub use transition::{TRANSITION_DIRECTIONS, TRANSITION_STYLES, Transition, TransitionSpec, set_transition};
 pub use view::{InitialView, displays_doc_title, initial_view, set_initial_view};
 
 #[derive(Debug, thiserror::Error, PartialEq)]
@@ -146,8 +148,44 @@ fn rebuild(doc: &mut Document, order: &[(ObjRef, Dict)]) -> Result<(), OrganizeE
     Ok(())
 }
 
+/// Gather the document's `/Type /Page` objects into a new page tree when the catalog leads to no
+/// page (its `/Pages` is missing or points at a lost object). Readers then find the pages by
+/// scanning the file, in file order, and edits must address those same pages. Returns how many
+/// pages were gathered; 0 leaves the document unchanged.
+pub fn recover_page_tree(doc: &mut Document) -> Result<usize, OrganizeError> {
+    if walk(doc).is_ok_and(|pages| !pages.is_empty()) {
+        return Ok(0);
+    }
+    let catalog = doc.root().ok_or(OrganizeError::NoPageTree)?;
+    let position = |num: u32| match doc.xref_entry(num) {
+        Some(XrefEntry::InFile { offset, .. }) => (offset, 0),
+        Some(XrefEntry::InStream { stream, index }) => match doc.xref_entry(stream) {
+            Some(XrefEntry::InFile { offset, .. }) => (offset, index),
+            _ => (u64::MAX, index),
+        },
+        _ => (u64::MAX, 0),
+    };
+    let mut found: Vec<((u64, u32), ObjRef)> = doc
+        .scan_objects()
+        .filter(|(_, o)| o.as_dict().is_some_and(|d| d.name(b"Type") == Some(b"Page")))
+        .map(|(r, _)| (position(r.num), r))
+        .collect();
+    if found.is_empty() {
+        return Ok(0);
+    }
+    found.sort();
+    let root = doc.add(Dict::new());
+    doc.update_dict(catalog, |d| d.set(b"Pages".to_vec(), Object::Ref(root)))?;
+    let order: Vec<(ObjRef, Dict)> = found.into_iter().map(|(_, r)| (r, Dict::new())).collect();
+    rebuild(doc, &order)?;
+    Ok(order.len())
+}
+
 fn check(indices: &[usize], n: usize) -> Result<(), OrganizeError> {
     match indices.iter().find(|i| **i >= n) {
+        // A viewer still shows pages a lost page tree leaves out (#1656): "page 1 does not
+        // exist" would contradict it.
+        Some(_) if n == 0 => Err(OrganizeError::Invalid("the document's page tree lists no pages: the file is damaged".into())),
         Some(i) => Err(OrganizeError::NoSuchPage(*i)),
         None => Ok(()),
     }
@@ -179,6 +217,7 @@ pub fn delete_pages(doc: &mut Document, indices: &[usize]) -> Result<(), Organiz
         return Err(OrganizeError::WouldRemoveAllPages);
     }
     rebuild(doc, &keep)?;
+    labels::drop_deleted_pages(doc, indices)?;
     // The deleted pages go for good: bookmarks, links and widgets that still point at one would
     // otherwise keep it, with its content, in the saved file. Their form widgets leave the form,
     // and bookmarks and links that went to them lose that destination.
diff --git a/crates/organize/src/outline.rs b/crates/organize/src/outline.rs
index d3ac207fc..dca0b35ce 100644
--- a/crates/organize/src/outline.rs
+++ b/crates/organize/src/outline.rs
@@ -38,6 +38,9 @@ pub struct Bookmark {
     pub open: bool,
     /// The 0-based page it goes to, when that page is in this document.
     pub page: Option<usize>,
+    /// Where on that page it goes: the destination's type (`XYZ`, `Fit`, `FitH`…) and the numbers
+    /// after it, in PDF user space (`None` for `null` or anything that isn't a number).
+    pub view: Option<(Vec<u8>, Vec<Option<f64>>)>,
 }
 
 /// One page of the outline listing (see [`bookmark_page`]).
@@ -229,43 +232,57 @@ fn dests_dict(doc: &Document, key: &[u8]) -> Option<Object> {
     dests.as_dict()?.get(key).cloned()
 }
 
-/// The page index a destination names: an explicit `[page /XYZ …]` array, a dictionary whose `/D`
-/// is one, or a named destination that resolves to one.
-fn page_of_dest(doc: &Document, targets: &mut Targets, dest: &Object, depth: u8) -> Option<usize> {
+/// The explicit destination array (`[page /XYZ …]`) a destination stands for: itself, a dictionary
+/// whose `/D` is one, or a named destination that resolves to one.
+fn explicit_dest(doc: &Document, targets: &mut Targets, dest: &Object, depth: u8) -> Option<Vec<Object>> {
     if depth > DEST_DEPTH {
         return None;
     }
     let dest = doc.resolve(dest);
     match &*dest {
-        Object::Array(a) => match a.first()? {
-            Object::Ref(page) => targets.pages.get(page).copied(),
-            // Some producers write a page number in a remote-style destination.
-            Object::Int(n) => usize::try_from(*n).ok().filter(|&p| p < targets.pages.len()),
-            _ => None,
-        },
-        Object::Dict(d) => page_of_dest(doc, targets, d.get(b"D")?, depth + 1),
+        Object::Array(a) => Some(a.clone()),
+        Object::Dict(d) => explicit_dest(doc, targets, d.get(b"D")?, depth + 1),
         Object::String(s) => {
             let inner = targets.named(doc, &s.bytes)?;
-            page_of_dest(doc, targets, &inner, depth + 1)
+            explicit_dest(doc, targets, &inner, depth + 1)
         }
         Object::Name(n) => {
             let inner = targets.named(doc, n)?;
-            page_of_dest(doc, targets, &inner, depth + 1)
+            explicit_dest(doc, targets, &inner, depth + 1)
         }
         _ => None,
     }
 }
 
-/// The page an item goes to: its `/Dest`, else the destination of its GoTo action `/A`.
-fn item_page(doc: &Document, targets: &mut Targets, d: &Dict) -> Option<usize> {
-    if let Some(dest) = d.get(b"Dest")
-        && let Some(page) = page_of_dest(doc, targets, dest, 0)
+/// The page index an explicit destination array names.
+fn page_of_explicit(targets: &Targets, dest: &[Object]) -> Option<usize> {
+    match dest.first()? {
+        Object::Ref(page) => targets.pages.get(page).copied(),
+        // Some producers write a page number in a remote-style destination.
+        Object::Int(n) => usize::try_from(*n).ok().filter(|&p| p < targets.pages.len()),
+        _ => None,
+    }
+}
+
+/// The view an explicit destination array asks for: its type and the numbers after it.
+fn view_of_explicit(doc: &Document, dest: &[Object]) -> Option<(Vec<u8>, Vec<Option<f64>>)> {
+    let kind = dest.get(1).map(|k| doc.resolve(k)).and_then(|k| k.as_name().map(<[u8]>::to_vec))?;
+    // At most the four numbers of /FitR.
+    let numbers = dest.iter().skip(2).take(4).map(|n| doc.resolve(n).as_f64().filter(|v| v.is_finite())).collect();
+    Some((kind, numbers))
+}
+
+/// The explicit destination an item goes to: its `/Dest` when that names a page here, else the
+/// destination of its GoTo action `/A`.
+fn item_dest(doc: &Document, targets: &mut Targets, d: &Dict) -> Option<Vec<Object>> {
+    if let Some(dest) = d.get(b"Dest").and_then(|dest| explicit_dest(doc, targets, dest, 0))
+        && page_of_explicit(targets, &dest).is_some()
     {
-        return Some(page);
+        return Some(dest);
     }
     let action = doc.resolve(d.get(b"A")?);
     let dest = action.as_dict()?.get(b"D")?;
-    page_of_dest(doc, targets, dest, 0)
+    explicit_dest(doc, targets, dest, 0)
 }
 
 /// A bookmark's title as viewers show it: the decoded text, without NULs or surrounding space.
@@ -281,11 +298,13 @@ fn title_of(doc: &Document, d: &Dict) -> String {
 
 fn describe(doc: &Document, targets: &mut Targets, obj: ObjRef, path: Vec<usize>) -> Bookmark {
     let item = doc.get(obj);
-    let (title, open, page) = match item.as_dict() {
-        Some(d) => (title_of(doc, d), d.int(b"Count").is_some_and(|c| c > 0), item_page(doc, targets, d)),
+    let (title, open, dest) = match item.as_dict() {
+        Some(d) => (title_of(doc, d), d.int(b"Count").is_some_and(|c| c > 0), item_dest(doc, targets, d)),
         None => (String::new(), false, None),
     };
-    Bookmark { obj, path, title, open, page }
+    let page = dest.as_deref().and_then(|d| page_of_explicit(targets, d));
+    let view = dest.as_deref().filter(|_| page.is_some()).and_then(|d| view_of_explicit(doc, d));
+    Bookmark { obj, path, title, open, page, view }
 }
 
 /// Lists up to `limit` bookmarks from position `offset`, entering no level deeper than `max_depth`.
@@ -345,7 +364,7 @@ fn resolve_path(doc: &Document, path: &[usize]) -> Result<(ObjRef, ObjRef)> {
 }
 
 /// The object that holds children at `parent_path` (`[]` = the outline root, created if needed).
-fn container(doc: &mut Document, parent_path: &[usize]) -> Result<ObjRef> {
+pub(crate) fn container(doc: &mut Document, parent_path: &[usize]) -> Result<ObjRef> {
     if parent_path.is_empty() {
         if let Some(r) = outline_root(doc) {
             return Ok(r);
@@ -375,6 +394,27 @@ fn put(doc: &mut Document, r: ObjRef, key: &[u8], value: Option<Object>) -> Resu
     Ok(())
 }
 
+/// The children of `parent` (an item or the outline root), in order. Cycle-safe.
+pub(crate) fn children(doc: &Document, parent: ObjRef) -> Vec<ObjRef> {
+    children_of(doc, parent, &mut HashSet::from([parent]))
+}
+
+/// [`relink`] `kids` under `parent`, then recompute every `/Count`.
+pub(crate) fn relink_and_recount(doc: &mut Document, parent: ObjRef, kids: &[ObjRef]) -> Result<()> {
+    relink(doc, parent, kids)?;
+    recount(doc)
+}
+
+impl From<OutlineError> for OrganizeError {
+    fn from(e: OutlineError) -> Self {
+        match e {
+            OutlineError::Organize(e) => e,
+            OutlineError::Cos(e) => OrganizeError::Cos(e),
+            other => OrganizeError::Invalid(other.to_string()),
+        }
+    }
+}
+
 /// Make `kids` the children of `parent`, in order: rewires `/Parent`, `/Prev`, `/Next`,
 /// `/First` and `/Last`.
 fn relink(doc: &mut Document, parent: ObjRef, kids: &[ObjRef]) -> Result<()> {
diff --git a/crates/organize/src/pdfx.rs b/crates/organize/src/pdfx.rs
index 1aa4fc503..501d969be 100644
--- a/crates/organize/src/pdfx.rs
+++ b/crates/organize/src/pdfx.rs
@@ -93,7 +93,7 @@ pub(crate) fn carry(dst: &mut Document, src: Option<&Document>, standard: &Print
     let root = dst.root().ok_or(OrganizeError::NoPageTree)?;
     if let Some(intents) = &standard.intents {
         let src = src.ok_or_else(|| OrganizeError::Invalid("the output intents' source document was not kept".into()))?;
-        let copied = crate::import::copy_object(dst, src, intents, map);
+        let copied = crate::import::copy_object(dst, src, intents, map)?;
         dst.update_dict(root, |c| c.set(b"OutputIntents".to_vec(), copied))?;
     }
     let Some(version) = &standard.version else { return Ok(()) };
diff --git a/crates/organize/src/tests.rs b/crates/organize/src/tests.rs
index e07af72a1..d34b1e431 100644
--- a/crates/organize/src/tests.rs
+++ b/crates/organize/src/tests.rs
@@ -267,6 +267,56 @@ fn document_info_edits_round_trip_with_unicode() {
     assert_eq!(info(&doc, "Producer"), None);
 }
 
+/// Page transitions (§12.4.4): written as `/Trans` and `/Dur` with only the entries the style
+/// reads and that differ from the defaults, removed again, checked before any page changes, and
+/// kept through a save.
+#[test]
+fn page_transitions_are_set_removed_and_checked() {
+    let mut doc = open(fixture());
+    let wipe = Transition { duration: 2.5, direction: Some(270), ..Transition::new("Wipe") };
+    set_transition(&mut doc, &[0, 2], &TransitionSpec { transition: Some(wipe), display: Some(5.0) }).unwrap();
+    let d = page_dict(&doc, 0);
+    let t = d.get(b"Trans").and_then(|o| o.as_dict()).expect("/Trans").clone();
+    assert_eq!(t.name(b"Type"), Some(&b"Trans"[..]));
+    assert_eq!(t.name(b"S"), Some(&b"Wipe"[..]));
+    assert_eq!(t.get(b"D"), Some(&Object::Real(2.5)));
+    assert_eq!(t.get(b"Di"), Some(&Object::Int(270)));
+    assert!(
+        t.get(b"Dm").is_none() && t.get(b"M").is_none() && t.get(b"SS").is_none() && t.get(b"B").is_none(),
+        "entries Wipe does not read stay out: {t:?}"
+    );
+    assert_eq!(d.get(b"Dur"), Some(&Object::Real(5.0)));
+    assert!(page_dict(&doc, 1).get(b"Trans").is_none(), "page 2 was not asked for");
+    // Fly with everything non-default; the defaults themselves are not written.
+    let fly = Transition { style: "Fly".into(), duration: 1.0, horizontal: false, inward: false, direction: None, scale: 0.5, opaque: true };
+    set_transition(&mut doc, &[1], &TransitionSpec { transition: Some(fly), display: None }).unwrap();
+    let t = page_dict(&doc, 1).get(b"Trans").and_then(|o| o.as_dict()).expect("/Trans").clone();
+    assert_eq!((t.name(b"S"), t.name(b"M"), t.name(b"Di")), (Some(&b"Fly"[..]), Some(&b"O"[..]), Some(&b"None"[..])));
+    assert_eq!((t.get(b"SS"), t.get(b"B")), (Some(&Object::Real(0.5)), Some(&Object::Bool(true))));
+    assert!(t.get(b"D").is_none() && t.get(b"Dm").is_none(), "{t:?}");
+    // Removed again.
+    set_transition(&mut doc, &[0], &TransitionSpec { transition: None, display: None }).unwrap();
+    let d = page_dict(&doc, 0);
+    assert!(d.get(b"Trans").is_none() && d.get(b"Dur").is_none());
+    // Checked before anything changes.
+    for (what, spec) in [
+        ("style", TransitionSpec { transition: Some(Transition::new("Swirl")), display: None }),
+        ("direction", TransitionSpec { transition: Some(Transition { direction: Some(45), ..Transition::new("Wipe") }), display: None }),
+        ("duration", TransitionSpec { transition: Some(Transition { duration: -1.0, ..Transition::new("Fade") }), display: None }),
+        ("scale", TransitionSpec { transition: Some(Transition { scale: 0.0, ..Transition::new("Fly") }), display: None }),
+        ("display", TransitionSpec { transition: None, display: Some(f32::NAN) }),
+    ] {
+        assert!(set_transition(&mut doc, &[2], &spec).is_err(), "{what} must be refused");
+    }
+    assert!(set_transition(&mut doc, &[7], &TransitionSpec { transition: None, display: None }).is_err(), "no such page");
+    let t = page_dict(&doc, 2).get(b"Trans").and_then(|o| o.as_dict()).expect("page 3 unchanged").clone();
+    assert_eq!(t.name(b"S"), Some(&b"Wipe"[..]));
+    // Kept through a save.
+    let doc = save_and_reopen(&doc);
+    // (A whole number of seconds may come back as an integer: the writer's choice.)
+    assert_eq!(page_dict(&doc, 2).get(b"Dur").and_then(Object::as_f64), Some(5.0));
+}
+
 /// A one-page document whose catalog has `xmp` as its (Flate-compressed) XMP packet, and the
 /// same title and author in `/Info`, as LibreOffice writes them.
 fn doc_with_xmp(xmp: &[u8]) -> Document {
@@ -1052,6 +1102,65 @@ fn combine_nests_source_bookmarks_and_keeps_attachments() {
     assert_eq!(keys, ["notes.txt", "notes.txt (2)"]);
 }
 
+/// Insert Pages from File brings the inserted file's bookmarks along (they used to be dropped),
+/// collapsed under one bookmark named after the file at its first inserted page, placed among the
+/// host's bookmarks where the pages went. Destinations follow the copies; named ones are resolved.
+#[test]
+fn inserting_a_file_brings_its_bookmarks_under_one_named_after_it() {
+    let mut host = open(fixture());
+    add_bookmark(&mut host, &[], 0, "Start", 0).unwrap();
+    add_bookmark(&mut host, &[], 1, "End", 2).unwrap();
+    insert_file_pages(&mut host, &doc_c(), "annex", &[0, 1], 1, FieldConflicts::Rename).unwrap();
+    let host = save_and_reopen(&host);
+    assert_eq!(labels(&host), ["Page 1", "C1", "C2", "Page 2", "Page 3"]);
+    let marks = bookmarks(&host);
+    assert_eq!(titles(&marks), ["Start", "annex[Chapter one[Section]]", "End"]);
+    let page_of = |title: &str| marks.iter().find(|b| b.title == title).and_then(|b| b.page);
+    assert_eq!((page_of("annex"), page_of("Chapter one"), page_of("Section"), page_of("End")), (Some(1), Some(1), Some(2), Some(4)));
+    assert!(!marks.iter().find(|b| b.title == "annex").unwrap().open, "the file's bookmarks start collapsed");
+    // Inserted last, after every bookmark; only the pages chosen keep a destination.
+    let mut host = open(fixture());
+    add_bookmark(&mut host, &[], 0, "Start", 0).unwrap();
+    insert_file_pages(&mut host, &doc_c(), "annex", &[0], 9, FieldConflicts::Rename).unwrap();
+    let marks = bookmarks(&host);
+    assert_eq!(titles(&marks), ["Start", "annex[Chapter one[Section]]"]);
+    assert_eq!(marks.iter().find(|b| b.title == "Section").unwrap().page, None, "its page was left out");
+    // A file without bookmarks adds none, and a host without an outline gets one only when needed.
+    let mut host = open(fixture());
+    insert_file_pages(&mut host, &doc_b(), "plain", &[0], 0, FieldConflicts::Rename).unwrap();
+    assert!(bookmarks(&host).is_empty());
+    assert!(!catalog(&host).contains(b"Outlines"));
+}
+
+/// Bookmarks say where on their page they go, through every kind of destination: explicit,
+/// named (resolved), and a GoTo action's.
+#[test]
+fn bookmarks_report_the_view_their_destination_asks_for() {
+    let mut objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R /Outlines 5 0 R /Names << /Dests << /Names [(sec) [4 0 R /FitH 300]] >> >> >>".into(),
+        "<< /Type /Pages /Kids [3 0 R 4 0 R] /Count 2 /MediaBox [0 0 200 400] >>".into(),
+        "<< /Type /Page /Parent 2 0 R >>".into(),
+        "<< /Type /Page /Parent 2 0 R >>".into(),
+        "<< /Type /Outlines /First 6 0 R /Last 9 0 R /Count 4 >>".into(),
+    ];
+    objs.push("<< /Title (Explicit) /Parent 5 0 R /Next 7 0 R /Dest [4 0 R /XYZ 20 250 null] >>".into()); // 6
+    objs.push("<< /Title (Named) /Parent 5 0 R /Prev 6 0 R /Next 8 0 R /Dest (sec) >>".into()); // 7
+    objs.push("<< /Title (Action) /Parent 5 0 R /Prev 7 0 R /Next 9 0 R /A << /S /GoTo /D [3 0 R /FitR 10 20 110 (x) 999] >> >>".into()); // 8
+    objs.push("<< /Title (Nowhere) /Parent 5 0 R /Prev 8 0 R /Dest (missing) >>".into()); // 9
+    let doc = open(build(&objs, "/Root 1 0 R"));
+    type View = Option<(Vec<u8>, Vec<Option<f64>>)>;
+    let views: Vec<(String, Option<usize>, View)> = bookmarks(&doc).into_iter().map(|b| (b.title, b.page, b.view)).collect();
+    assert_eq!(
+        views,
+        [
+            ("Explicit".into(), Some(1), Some((b"XYZ".to_vec(), vec![Some(20.0), Some(250.0), None]))),
+            ("Named".into(), Some(1), Some((b"FitH".to_vec(), vec![Some(300.0)]))),
+            ("Action".into(), Some(0), Some((b"FitR".to_vec(), vec![Some(10.0), Some(20.0), Some(110.0), None]))),
+            ("Nowhere".into(), None, None),
+        ]
+    );
+}
+
 #[test]
 fn combine_and_insert_share_identical_resources() {
     let a = doc_a();
@@ -1392,6 +1501,38 @@ fn number_pages_like_acrobat() {
     assert!(d.get(d.root().unwrap()).as_dict().unwrap().get(b"PageLabels").is_none());
 }
 
+/// Deleting pages moves the label ranges with the pages they label (#2091): later ranges start that
+/// many pages earlier and keep numbering on, a range whose first page went starts on the next page
+/// left, and a range left with no pages gives way to the one after it.
+#[test]
+fn deleting_pages_keeps_the_label_ranges_on_their_pages() {
+    use crate::{LabelRange, LabelStyle::*};
+    let ten = || {
+        let mut d = doc_a();
+        for at in 3..10 {
+            crate::insert_blank_page(&mut d, at, 300.0, 400.0).unwrap();
+        }
+        let ranges = [
+            LabelRange { start: 0, style: LowerRoman, prefix: String::new(), first: 1 },
+            LabelRange { start: 3, style: Decimal, prefix: String::new(), first: 1 },
+            LabelRange { start: 7, style: Decimal, prefix: "A-".into(), first: 1 },
+        ];
+        crate::set_page_label_ranges(&mut d, &ranges).unwrap();
+        assert_eq!(crate::page_labels(&d).unwrap(), ["i", "ii", "iii", "1", "2", "3", "4", "A-1", "A-2", "A-3"]);
+        d
+    };
+    for (deleted, expected) in [
+        (&[4, 5][..], &["i", "ii", "iii", "1", "2", "A-1", "A-2", "A-3"][..]),
+        (&[3], &["i", "ii", "iii", "1", "2", "3", "A-1", "A-2", "A-3"]),
+        (&[3, 4, 5, 6], &["i", "ii", "iii", "A-1", "A-2", "A-3"]),
+    ] {
+        let mut d = ten();
+        crate::delete_pages(&mut d, deleted).unwrap();
+        assert_eq!(crate::page_labels(&d).unwrap(), expected, "after deleting {deleted:?}");
+        assert_eq!(crate::page_labels(&full_roundtrip(&d)).unwrap(), expected, "reopened after deleting {deleted:?}");
+    }
+}
+
 #[test]
 fn page_label_limits_reject_unsupported_edits_before_mutating() {
     use crate::LabelStyle::*;
@@ -1520,6 +1661,38 @@ fn page_label_limits_validate_the_same_ranges_that_are_written() {
     assert_eq!(nums[2].as_int(), Some(1));
 }
 
+/// Each label dictionary is its own object, referenced from `/Nums`, as Acrobat writes them. A
+/// direct dictionary is just as valid, but some readers (pdfannots2json, through unipdf) skip it
+/// and fall back to physical page numbers (#1763).
+#[test]
+fn page_labels_are_written_as_indirect_dictionaries() {
+    use crate::{LabelRange, LabelStyle};
+    let mut d = doc_a();
+    let ranges = [
+        LabelRange { start: 0, style: LabelStyle::LowerRoman, prefix: String::new(), first: 1 },
+        LabelRange { start: 1, style: LabelStyle::Decimal, prefix: "A-".into(), first: 324 },
+        LabelRange { start: 2, style: LabelStyle::None, prefix: "Cover".into(), first: 1 },
+    ];
+    crate::set_page_label_ranges(&mut d, &ranges).unwrap();
+    let back = full_roundtrip(&d);
+    let catalog = back.get(back.root().unwrap());
+    let tree = back.resolve(catalog.as_dict().unwrap().get(b"PageLabels").unwrap());
+    let nums = tree.as_dict().unwrap().get(b"Nums").unwrap().as_array().unwrap();
+    assert_eq!(nums.len(), 6);
+    let expected = [(0, Some(b"r".as_slice()), None, None), (1, Some(b"D".as_slice()), Some("A-"), Some(324)), (2, None, Some("Cover"), None)];
+    for (pair, (start, style, prefix, first)) in nums.chunks(2).zip(expected) {
+        assert_eq!(pair[0].as_int(), Some(start));
+        let Object::Ref(r) = &pair[1] else { panic!("the label of page {start} is not an indirect object: {:?}", pair[1]) };
+        let spec = back.get(*r);
+        let spec = spec.as_dict().unwrap();
+        assert_eq!(spec.name(b"S"), style);
+        assert_eq!(spec.get(b"P").and_then(|p| p.as_string()).map(|p| p.to_text()).as_deref(), prefix);
+        assert_eq!(spec.int(b"St"), first);
+    }
+    assert_eq!(crate::page_label_ranges(&back), ranges);
+    assert_eq!(crate::page_labels(&back).unwrap(), ["i", "A-324", "Cover"]);
+}
+
 #[test]
 fn page_label_duplicate_starts_keep_the_later_range() {
     let mut d = doc_a();
@@ -2025,9 +2198,12 @@ fn extract_still_prunes_separate_resources_when_many_pages_share_a_type3_font()
     assert_eq!(xobject_names(&part, 0), [b"ImA".to_vec()], "one shared font's direct resource graph is protected once");
 }
 
+// Both sides of the comparison go through the same pdftoppm, so the assertion is about our two
+// documents rather than about Poppler's output, and no Poppler version can change the verdict.
+// It skips where pdftoppm is absent and fails where PDFCRAFT_ORACLES_REQUIRED is set.
 #[test]
-#[ignore = "requires the external Poppler pdftoppm oracle"]
 fn extract_type3_shared_xobjects_matches_poppler_pixels() {
+    let pdftoppm = pdfcraft_oracle::or_skip!(pdfcraft_oracle::pdftoppm());
     let dir = std::env::temp_dir().join(format!("pdfcraft-type3-extract-{}", std::process::id()));
     std::fs::create_dir_all(&dir).unwrap();
     let fixtures = [
@@ -2042,7 +2218,7 @@ fn extract_type3_shared_xobjects_matches_poppler_pixels() {
         let render = |doc: &Document, name: &str| {
             let path = dir.join(format!("{i}-{name}.pdf"));
             std::fs::write(&path, write_full(doc, &SaveOptions::default()).unwrap()).unwrap();
-            let output = std::process::Command::new("pdftoppm").args(["-singlefile", "-r", "72", "-gray"]).arg(path).output().unwrap();
+            let output = pdftoppm.command().args(["-singlefile", "-r", "72", "-gray"]).arg(path).output().unwrap();
             assert!(output.status.success(), "{}", String::from_utf8_lossy(&output.stderr));
             assert!(output.stderr.is_empty(), "{}", String::from_utf8_lossy(&output.stderr));
             output.stdout
@@ -2441,3 +2617,43 @@ fn combine_field_conflicts_previews_each_file_in_order() {
     assert_eq!(preview[1], [("Text1".to_string(), "Text1-1".to_string())]);
     assert_eq!(preview[2], [("Text1".to_string(), "Text1-2".to_string())], "the cascade continues past the earlier rename");
 }
+
+/// #1800: thousands of shallow objects, each referring to the next, used to recurse once per
+/// object and exhaust the stack. The copy is refused instead, and the destination is as it was;
+/// a chain within the budget and a short cycle copy as before.
+#[test]
+fn a_chain_of_objects_too_deep_to_copy_is_refused_and_leaves_the_destination_alone() {
+    fn chained(tail: &[String]) -> Document {
+        let mut b: Vec<String> = vec![
+            "<< /Type /Catalog /Pages 2 0 R >>".into(),
+            "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 400] >>".into(),
+            "<< /Type /Page /Parent 2 0 R /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> /Foo 6 0 R >>".into(),
+            body("C1"),
+            "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".into(),
+        ];
+        b.extend_from_slice(tail);
+        open(build(&b, "/Root 1 0 R"))
+    }
+    fn chain(n: usize) -> Document {
+        let mut tail: Vec<String> = (0..n).map(|i| format!("<< /Next {} 0 R >>", 7 + i)).collect();
+        tail.push("<< /End true >>".into());
+        chained(&tail)
+    }
+    // On a thread with less stack than any platform's main thread, so the budget is proven.
+    let run = std::thread::Builder::new()
+        .stack_size(512 << 10)
+        .spawn(|| {
+            let mut dst = open(fixture());
+            let before = (labels(&dst), dst.object_numbers());
+            let err = import_pages(&mut dst, &chain(20_000), &[0], 0).unwrap_err();
+            assert!(matches!(&err, OrganizeError::Invalid(m) if m.contains("levels deep")), "{err:?}");
+            assert_eq!((labels(&dst), dst.object_numbers()), before, "the destination is as it was");
+            import_pages(&mut dst, &chain(100), &[0], 0).unwrap();
+            let cycle = chained(&["<< /Next 7 0 R >>".into(), "<< /Next 6 0 R >>".into()]);
+            import_pages(&mut dst, &cycle, &[0], 0).unwrap();
+            assert_eq!(labels(&dst)[..3], ["C1", "C1", "Page 1"]);
+        })
+        .unwrap()
+        .join();
+    assert!(run.is_ok(), "the copy must not overflow the stack");
+}
diff --git a/crates/organize/src/transition.rs b/crates/organize/src/transition.rs
new file mode 100644
index 000000000..1960ab069
--- /dev/null
+++ b/crates/organize/src/transition.rs
@@ -0,0 +1,133 @@
+//! Page transitions and display times (ISO 32000-2 §12.4.4): the `/Trans` dictionary and `/Dur`
+//! entry a full-screen presentation plays, as Acrobat's Organize ▸ Page Transitions sets them.
+//! Reading them back is the renderer's `DocInfo::transitions`.
+
+use pdfcraft_cos::{Dict, Document, Object};
+
+use crate::{OrganizeError, check, walk};
+
+/// The transition styles of ISO 32000-2 table 164, as written in `/S` (`R` is "replace": no
+/// effect).
+pub const TRANSITION_STYLES: [&str; 12] = ["Split", "Blinds", "Box", "Wipe", "Dissolve", "Glitter", "R", "Fly", "Push", "Cover", "Uncover", "Fade"];
+
+/// The directions `/Di` allows, in degrees.
+pub const TRANSITION_DIRECTIONS: [u16; 5] = [0, 90, 180, 270, 315];
+
+/// A page transition to write: the `/Trans` dictionary's entries, with the spec's defaults.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Transition {
+    /// One of [`TRANSITION_STYLES`].
+    pub style: String,
+    /// `/D`: seconds the transition takes (default 1).
+    pub duration: f32,
+    /// `/Dm`: horizontal (`/H`, the default) or vertical (`/V`); Split and Blinds.
+    pub horizontal: bool,
+    /// `/M`: inward (`/I`, the default) or outward (`/O`); Split, Box and Fly.
+    pub inward: bool,
+    /// `/Di`: one of [`TRANSITION_DIRECTIONS`] (default 0), or `None` for `/None` (Fly only);
+    /// Wipe, Glitter, Fly, Cover, Uncover and Push.
+    pub direction: Option<u16>,
+    /// `/SS`: the Fly scale (default 1).
+    pub scale: f32,
+    /// `/B`: Fly with an opaque backdrop.
+    pub opaque: bool,
+}
+
+impl Transition {
+    /// A transition of `style` with every other entry at its default.
+    pub fn new(style: &str) -> Self {
+        Self { style: style.to_string(), duration: 1.0, horizontal: true, inward: true, direction: Some(0), scale: 1.0, opaque: false }
+    }
+}
+
+/// What a page gets: its transition (`None` removes `/Trans`) and the seconds it stays before the
+/// presentation advances (`None` removes `/Dur`: the page waits for the presenter).
+#[derive(Clone, Debug, PartialEq)]
+pub struct TransitionSpec {
+    pub transition: Option<Transition>,
+    pub display: Option<f32>,
+}
+
+/// Set (or remove) the transition and display time of `pages` (0-based). Every value is checked
+/// before any page changes: an unknown style, a direction that is not one of the five, a negative
+/// or non-finite duration, scale or display time are refused.
+pub fn set_transition(doc: &mut Document, pages: &[usize], spec: &TransitionSpec) -> Result<(), OrganizeError> {
+    let bad = |m: String| OrganizeError::Invalid(m);
+    if let Some(t) = &spec.transition {
+        if !TRANSITION_STYLES.contains(&t.style.as_str()) {
+            return Err(bad(format!("unknown transition style {:?}; one of {}", t.style, TRANSITION_STYLES.join(", "))));
+        }
+        if !(t.duration.is_finite() && t.duration >= 0.0) {
+            return Err(bad("the transition duration must be zero or more seconds".into()));
+        }
+        if let Some(d) = t.direction
+            && !TRANSITION_DIRECTIONS.contains(&d)
+        {
+            return Err(bad(format!("the direction must be one of {:?} degrees", TRANSITION_DIRECTIONS)));
+        }
+        if !(t.scale.is_finite() && t.scale > 0.0) {
+            return Err(bad("the Fly scale must be more than zero".into()));
+        }
+    }
+    if let Some(s) = spec.display
+        && !(s.is_finite() && s >= 0.0)
+    {
+        return Err(bad("the display time must be zero or more seconds".into()));
+    }
+    let all = walk(doc)?;
+    check(pages, all.len())?;
+    let trans = spec.transition.as_ref().map(trans_dict);
+    for &i in pages {
+        let Some((page, _)) = all.get(i) else { continue };
+        let trans = trans.clone();
+        doc.update_dict(*page, |d| {
+            match trans {
+                Some(t) => d.set(b"Trans".to_vec(), Object::Dict(t)),
+                None => {
+                    d.remove(b"Trans");
+                }
+            }
+            match spec.display {
+                Some(s) => d.set(b"Dur".to_vec(), Object::Real(f64::from(s))),
+                None => {
+                    d.remove(b"Dur");
+                }
+            }
+        })?;
+    }
+    Ok(())
+}
+
+/// The `/Trans` dictionary for `t`: only the entries that differ from the defaults, and only the
+/// ones the style reads (table 164), so the file says no more than it means.
+fn trans_dict(t: &Transition) -> Dict {
+    let style = t.style.as_str();
+    let mut d = Dict::new();
+    d.set(b"Type".to_vec(), Object::name("Trans"));
+    d.set(b"S".to_vec(), Object::name(style));
+    if t.duration != 1.0 {
+        d.set(b"D".to_vec(), Object::Real(f64::from(t.duration)));
+    }
+    if matches!(style, "Split" | "Blinds") && !t.horizontal {
+        d.set(b"Dm".to_vec(), Object::name("V"));
+    }
+    if matches!(style, "Split" | "Box" | "Fly") && !t.inward {
+        d.set(b"M".to_vec(), Object::name("O"));
+    }
+    if matches!(style, "Wipe" | "Glitter" | "Fly" | "Cover" | "Uncover" | "Push") {
+        match t.direction {
+            None if style == "Fly" => d.set(b"Di".to_vec(), Object::name("None")),
+            Some(deg) if deg != 0 => d.set(b"Di".to_vec(), Object::Int(i64::from(deg))),
+            _ => {}
+        }
+    }
+    if style == "Fly" {
+        if t.scale != 1.0 {
+            d.set(b"SS".to_vec(), Object::Real(f64::from(t.scale)));
+        }
+        if t.opaque {
+            d.set(b"B".to_vec(), Object::Bool(true));
+        }
+    }
+    d
+}
diff --git a/crates/platform/Cargo.toml b/crates/platform/Cargo.toml
index cbae93fca..a552a43f8 100644
--- a/crates/platform/Cargo.toml
+++ b/crates/platform/Cargo.toml
@@ -10,6 +10,10 @@ workspace = true
 
 [dependencies]
 
+[target.'cfg(target_os = "macos")'.dependencies]
+# `write_atomically`: a volume that refuses F_FULLFSYNC gets a plain fsync.
+rustix = { version = "1", features = ["fs"] }
+
 [target.'cfg(target_os = "linux")'.dependencies]
 # Already in the dependency graph through the accessibility integration. The portal watcher
 # uses the async API so dropping it can cancel an idle subscription without polling.
diff --git a/crates/platform/src/staging.rs b/crates/platform/src/staging.rs
index 641726117..f7200efb9 100644
--- a/crates/platform/src/staging.rs
+++ b/crates/platform/src/staging.rs
@@ -64,6 +64,62 @@ pub fn staging_suffixes() -> impl Iterator<Item = u64> {
     (0u64..).map(move |i| state.hash_one(i))
 }
 
+/// Write `bytes` to `path` through a staging file beside it (see [`create_staging`]; `form`
+/// names it as the caller always has), flushed to the disk and then renamed over the target: a
+/// crash, a full disk or a refused flush never leaves a half-written file where a good one was,
+/// and the target is untouched until the new file is complete. The target's folder must exist;
+/// a folder at the target is refused by the rename. Flushing is the staging file's own
+/// (`sync_all`); parent-directory durability after a power loss is not promised.
+pub fn write_atomically(path: &Path, bytes: &[u8], form: StagingName) -> std::io::Result<()> {
+    write_atomically_with(path, bytes, form, staging_suffixes(), std::fs::File::sync_all)
+}
+
+/// [`write_atomically`] with the staging-name suffixes and the flush given, so tests can plant
+/// names and refuse flushes. A failure at any step removes the staging file and leaves the
+/// target as it was.
+pub fn write_atomically_with(
+    path: &Path,
+    bytes: &[u8],
+    form: StagingName,
+    suffixes: impl IntoIterator<Item = u64>,
+    sync_all: impl FnOnce(&std::fs::File) -> std::io::Result<()>,
+) -> std::io::Result<()> {
+    use std::io::Write as _;
+    let dir = path.parent().filter(|d| !d.as_os_str().is_empty()).unwrap_or(Path::new("."));
+    let name = path.file_name().and_then(|n| n.to_str()).unwrap_or("save");
+    let (tmp, file) = create_staging(dir, name, form, suffixes)?;
+    let result = (|| {
+        // Closed at the end of the block, before the rename (required on Windows).
+        {
+            let mut file = file;
+            file.write_all(bytes)?;
+            sync_staged(&file, sync_all)?;
+        }
+        std::fs::rename(&tmp, path)
+    })();
+    if result.is_err() {
+        let _ = std::fs::remove_file(&tmp);
+    }
+    result
+}
+
+/// Flush the staging file to the disk before it replaces the target. On macOS `sync_all` asks
+/// for a full flush (`F_FULLFSYNC`), which SMB and FUSE volumes, such as a mounted Cryptomator
+/// vault, refuse as unsupported: there a plain `fsync` is the strongest flush the volume offers.
+/// Any other failure still fails the write.
+fn sync_staged(f: &std::fs::File, sync_all: impl FnOnce(&std::fs::File) -> std::io::Result<()>) -> std::io::Result<()> {
+    #[cfg(target_os = "macos")]
+    {
+        use rustix::io::Errno;
+        match sync_all(f) {
+            Err(e) if matches!(Errno::from_io_error(&e), Some(Errno::NOTSUP | Errno::NOTTY)) => Ok(rustix::fs::fsync(f)?),
+            other => other,
+        }
+    }
+    #[cfg(not(target_os = "macos"))]
+    sync_all(f)
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -126,4 +182,37 @@ mod tests {
         assert!(!name(STAGING_ATTEMPTS as u64 + 1).exists(), "a 17th name was tried");
         let _ = std::fs::remove_dir_all(&dir);
     }
+
+    /// `write_atomically`: the target holds the new bytes only once they are complete; a refused
+    /// flush leaves the old file and removes the staging file; a missing folder writes nothing.
+    #[test]
+    fn an_atomic_write_replaces_the_target_only_when_complete() {
+        let dir = test_dir("write");
+        let target = dir.join("out.pdf");
+        std::fs::write(&target, b"OLD").unwrap();
+        let names = |dir: &Path| {
+            let mut v: Vec<String> = std::fs::read_dir(dir).unwrap().map(|e| file_name(&e.unwrap().path())).collect();
+            v.sort();
+            v
+        };
+        // The staging file is written and flushed before the target changes.
+        let mut seen_old = false;
+        write_atomically_with(&target, b"NEW", StagingName::SuffixThenTag, [7], |f| {
+            seen_old = std::fs::read(&target).unwrap() == b"OLD" && f.metadata().unwrap().len() == 3;
+            Ok(())
+        })
+        .unwrap();
+        assert!(seen_old, "flushed before publication, with the target still the old file");
+        assert_eq!(std::fs::read(&target).unwrap(), b"NEW");
+        assert_eq!(names(&dir), ["out.pdf"], "no staging file is left");
+        // A refused flush keeps the target and cleans up.
+        let e = write_atomically_with(&target, b"NEWER", StagingName::TagThenSuffix, [8], |_| Err(std::io::Error::other("refused"))).unwrap_err();
+        assert!(e.to_string().contains("refused"));
+        assert_eq!(std::fs::read(&target).unwrap(), b"NEW");
+        assert_eq!(names(&dir), ["out.pdf"]);
+        // A folder that does not exist: nothing is written anywhere.
+        assert!(write_atomically(&dir.join("missing").join("out.pdf"), b"X", StagingName::SuffixThenTag).is_err());
+        assert_eq!(names(&dir), ["out.pdf"]);
+        let _ = std::fs::remove_dir_all(&dir);
+    }
 }
diff --git a/crates/preflight/Cargo.toml b/crates/preflight/Cargo.toml
index b0eef0054..b79575fc0 100644
--- a/crates/preflight/Cargo.toml
+++ b/crates/preflight/Cargo.toml
@@ -11,5 +11,6 @@ repository.workspace = true
 workspace = true
 
 [dependencies]
+pdfcraft-content = { workspace = true }
 pdfcraft-cos = { workspace = true }
 pdfcraft-model = { workspace = true }
diff --git a/crates/preflight/src/lib.rs b/crates/preflight/src/lib.rs
index d0e69525d..a4d90d874 100644
--- a/crates/preflight/src/lib.rs
+++ b/crates/preflight/src/lib.rs
@@ -24,7 +24,7 @@
 pub mod icc;
 mod xmp;
 
-use pdfcraft_cos::{Dict, Document, ObjRef, Object, PdfString, Stream, is_whitespace};
+use pdfcraft_cos::{Dict, Document, ObjRef, Object, PdfString, Stream};
 
 /// The PDF/A part and conformance level.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
@@ -255,12 +255,124 @@ impl DeviceColour {
     fn any(self) -> bool {
         self.gray || self.rgb || self.cmyk
     }
+
+    /// Note the device colour space `name`, if it is one. Inline images may also use the
+    /// abbreviations (`G`, `RGB`, `CMYK`); anywhere else those are resource names.
+    fn mark(&mut self, name: &[u8], inline: bool) {
+        match name {
+            b"DeviceGray" => self.gray = true,
+            b"DeviceRGB" => self.rgb = true,
+            b"DeviceCMYK" => self.cmyk = true,
+            b"G" if inline => self.gray = true,
+            b"RGB" if inline => self.rgb = true,
+            b"CMYK" if inline => self.cmyk = true,
+            _ => {}
+        }
+    }
+}
+
+/// How deep [`type3_procs`] looks into an object's direct dictionaries and arrays.
+const MAX_DIRECT_DEPTH: u8 = 8;
+
+/// The glyph procedures of every Type 3 font in `d`: `d` itself, or a font held directly inside
+/// it (a font can sit inline in a resource dictionary).
+fn type3_procs(doc: &Document, d: &Dict, depth: u8, out: &mut std::collections::HashSet<ObjRef>) {
+    if d.name(b"Subtype") == Some(b"Type3")
+        && let Some(procs) = d.get(b"CharProcs").map(|c| doc.resolve(c))
+        && let Some(procs) = procs.as_dict()
+    {
+        out.extend(procs.iter().filter_map(|(_, p)| p.as_ref()));
+    }
+    for (_, v) in d.iter() {
+        type3_procs_within(doc, v, depth.saturating_add(1), out);
+    }
+}
+
+fn type3_procs_within(doc: &Document, o: &Object, depth: u8, out: &mut std::collections::HashSet<ObjRef>) {
+    if depth > MAX_DIRECT_DEPTH {
+        return;
+    }
+    match o {
+        Object::Dict(d) => type3_procs(doc, d, depth, out),
+        Object::Array(a) => {
+            for v in a {
+                type3_procs_within(doc, v, depth.saturating_add(1), out);
+            }
+        }
+        _ => {}
+    }
+}
+
+/// The content streams that only a reference identifies, their dictionaries saying nothing: the
+/// pages' `/Contents` and Type 3 glyph procedures.
+fn referenced_content(doc: &Document, objs: &[(ObjRef, std::sync::Arc<Object>)]) -> std::collections::HashSet<ObjRef> {
+    let mut out = std::collections::HashSet::new();
+    for p in pdfcraft_model::pages(doc) {
+        let contents = match p.dict.get(b"Contents") {
+            Some(Object::Ref(r)) => match &*doc.get(*r) {
+                Object::Array(a) => a.clone(),
+                _ => vec![Object::Ref(*r)],
+            },
+            Some(Object::Array(a)) => a.clone(),
+            _ => Vec::new(),
+        };
+        out.extend(contents.iter().filter_map(Object::as_ref));
+    }
+    for (_, o) in objs {
+        if let Some(d) = dict_of(o) {
+            type3_procs(doc, d, 0, &mut out);
+        }
+    }
+    out
+}
+
+/// Whether a stream's own dictionary says it holds content: a form XObject, or a stream with a
+/// `/BBox` and no `/Subtype` (a tiling pattern, or an appearance stream that leaves out
+/// `/Subtype /Form`). Mesh shadings may carry a `/BBox` too, but their data isn't content.
+fn is_content(d: &Dict) -> bool {
+    match d.name(b"Subtype") {
+        Some(t) => t == b"Form",
+        None => d.get(b"BBox").is_some() && d.get(b"ShadingType").is_none(),
+    }
+}
+
+/// The device colour a content stream sets. It is read operator by operator, so the bytes of a
+/// string, a comment or an inline image are never taken for an operator, and an operator right
+/// before a delimiter (`1 k/GS0 gs`) is still found.
+fn content_colour(data: &[u8], used: &mut DeviceColour) {
+    for op in pdfcraft_content::parse(data).ops {
+        match op.op.as_slice() {
+            b"g" | b"G" => used.gray = true,
+            b"rg" | b"RG" => used.rgb = true,
+            b"k" | b"K" => used.cmyk = true,
+            b"cs" | b"CS" => {
+                if let Some(name) = op.name(0) {
+                    used.mark(name, false);
+                }
+            }
+            b"BI" => {
+                let Some((image, _)) = &op.inline else { continue };
+                match image.get(b"CS").or_else(|| image.get(b"ColorSpace")) {
+                    Some(Object::Name(n)) => used.mark(n, true),
+                    // An indexed space draws in its base: `[/I /DeviceRGB 1 <…>]`.
+                    Some(Object::Array(a)) if a.first().and_then(Object::as_name).is_some_and(|n| n == b"I" || n == b"Indexed") => {
+                        if let Some(base) = a.get(1).and_then(Object::as_name) {
+                            used.mark(base, true);
+                        }
+                    }
+                    _ => {}
+                }
+            }
+            _ => {}
+        }
+    }
 }
 
 /// Whether any content or object uses a device colour space.
 fn uses_device_colour(doc: &Document, objs: &[(ObjRef, std::sync::Arc<Object>)]) -> DeviceColour {
     let mut used = DeviceColour::default();
-    for (_, o) in objs {
+    let referenced = referenced_content(doc, objs);
+    for (r, o) in objs {
         let Some(d) = dict_of(o) else { continue };
         // A resource dictionary's /ColorSpace, whether it is this object or the page's inline
         // /Resources.
@@ -281,20 +393,14 @@ fn uses_device_colour(doc: &Document, objs: &[(ObjRef, std::sync::Arc<Object>)])
                 _ => {}
             }
         }
-        if let Object::Stream(s) = &**o
-            && d.get(b"Type").is_none()
-            && d.get(b"Subtype").is_none_or(|t| t.as_name() == Some(b"Form"))
+        // Content streams only: a font program or an ICC profile is data, whatever bytes it holds.
+        // Parsing is the expensive part, so once content has used all three spaces no more is read.
+        if !(used.gray && used.rgb && used.cmyk)
+            && let Object::Stream(s) = &**o
+            && (referenced.contains(r) || is_content(&s.dict))
             && let Ok(data) = s.decoded()
         {
-            // Content streams: rg/RG/g/G/k/K operators.
-            for token in data.split(|b| is_whitespace(*b)) {
-                match token {
-                    b"g" | b"G" => used.gray = true,
-                    b"rg" | b"RG" => used.rgb = true,
-                    b"k" | b"K" => used.cmyk = true,
-                    _ => {}
-                }
-            }
+            content_colour(&data, &mut used);
         }
     }
     used
diff --git a/crates/preflight/src/tests.rs b/crates/preflight/src/tests.rs
index dd06b6b72..25d06669e 100644
--- a/crates/preflight/src/tests.rs
+++ b/crates/preflight/src/tests.rs
@@ -250,3 +250,124 @@ fn device_colour_is_found_after_any_whitespace() {
         }
     }
 }
+
+/// A page that draws `content` with `resources`, followed by `extra` objects (from object 5 on).
+fn drawing(content: &str, resources: &str, extra: &[&str]) -> Document {
+    let stream = format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len());
+    let page = format!("<< /Type /Page /Parent 2 0 R /Contents 4 0 R /Resources << {resources} >> >>");
+    let mut objs = vec![
+        "<< /Type /Catalog /Pages 2 0 R >>",
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 200] >>",
+        page.as_str(),
+        stream.as_str(),
+    ];
+    objs.extend_from_slice(extra);
+    build(&objs, "")
+}
+
+fn uses_cmyk(doc: &Document) -> bool {
+    messages(&verify(doc, Level::A2b)).contains(&"DeviceCMYK is used: it needs a CMYK output intent (not added automatically)")
+}
+
+/// Issue #2259: a `k` is DeviceCMYK only when it is an operator. Inside a string, a comment, an inline image's
+/// data, a font program, an ICC profile or a mesh shading's data it is just a byte, and the
+/// document still gets its sRGB output intent.
+#[test]
+fn device_colour_is_read_from_operators_not_bytes() {
+    let rgb = "1 0 0 rg 0 0 10 10 re f";
+    let cases: &[(&str, String, &str, Vec<&str>)] = &[
+        (
+            "a string",
+            format!("{rgb} BT /F1 12 Tf 10 10 Td (press k now) Tj ET"),
+            "/Font << /F1 5 0 R >>",
+            vec![
+                "<< /Type /Font /Subtype /TrueType /BaseFont /Sans /FontDescriptor 6 0 R >>",
+                "<< /Type /FontDescriptor /FontName /Sans /FontFile2 7 0 R >>",
+                // A font program whose bytes read " k ", as Chromium and krilla write them.
+                "<< /Length1 3 /Length 3 >>\nstream\n k \nendstream",
+            ],
+        ),
+        ("a comment", format!("{rgb} % 0 0 0 1 k"), "", vec![]),
+        // A 3×1 gray image whose three bytes read " k ".
+        ("inline image data", format!("{rgb} q 10 0 0 10 0 0 cm BI /W 3 /H 1 /CS /G /BPC 8 ID  k  EI Q"), "", vec![]),
+        ("an ICC profile", rgb.to_owned(), "/ColorSpace << /CS0 [/ICCBased 5 0 R] >>", vec!["<< /N 3 /Length 3 >>\nstream\n k \nendstream"]),
+        (
+            "a mesh shading",
+            format!("{rgb} /Sh0 sh"),
+            "/Shading << /Sh0 5 0 R >>",
+            vec![
+                "<< /ShadingType 4 /ColorSpace /DeviceRGB /BitsPerCoordinate 8 /BitsPerComponent 8 /BitsPerFlag 8 /Decode [0 1 0 1 0 1 0 1 0 1] /BBox [0 0 10 10] /Length 3 >>\nstream\n k \nendstream",
+            ],
+        ),
+    ];
+    for (what, content, resources, extra) in cases {
+        let mut doc = drawing(content, resources, extra);
+        assert!(!uses_cmyk(&doc), "a k in {what} was read as DeviceCMYK");
+        let r = convert(&mut doc, Level::A2b).unwrap();
+        assert_eq!(declared(&doc).output_intents, ["sRGB IEC61966-2.1"], "{what}: {:?}", r.fixed);
+    }
+}
+
+/// Issue #2259: DeviceCMYK is found however the content sets it: `k`/`K` right before a delimiter, `cs`/`CS`
+/// with the space's name, or an inline image in `/CMYK` or indexed over it.
+#[test]
+fn device_colour_is_found_however_content_sets_it() {
+    for content in [
+        "0 0 0 1 k/GS0 gs 10 10 50 50 re f",
+        "0 0 0 1 K[]0 d 10 10 m 50 50 l S",
+        "/DeviceCMYK cs 0 0 0 1 sc 10 10 50 50 re f",
+        "/DeviceCMYK CS 0 0 0 1 SC 10 10 m 50 50 l S",
+        "q 10 0 0 10 0 0 cm BI /W 1 /H 1 /CS /CMYK /BPC 8 ID \u{0}\u{0}\u{0}\u{0} EI Q",
+        "q 10 0 0 10 0 0 cm BI /W 1 /H 1 /ColorSpace /DeviceCMYK /BitsPerComponent 8 ID \u{0}\u{0}\u{0}\u{0} EI Q",
+        "q 10 0 0 10 0 0 cm BI /W 1 /H 1 /CS [/I /DeviceCMYK 0 <00000000>] /BPC 8 ID \u{0} EI Q",
+    ] {
+        assert!(uses_cmyk(&drawing(content, "", &[])), "{content:?}");
+    }
+    // A resource named like a device space's abbreviation is a resource, not that space.
+    let named =
+        drawing("/CMYK cs 1 sc 10 10 50 50 re f", "/ColorSpace << /CMYK [/ICCBased 5 0 R] >>", &["<< /N 1 /Length 0 >>\nstream\n\nendstream"]);
+    assert!(!uses_cmyk(&named));
+}
+
+/// Issue #2259: content is not only the page's own stream: form XObjects (with `/Type /XObject`, as almost
+/// every writer gives them), appearance streams, tiling patterns and Type 3 glyphs draw too. A
+/// CMYK logo placed as a form must not get the document an sRGB output intent.
+#[test]
+fn device_colour_in_forms_patterns_and_glyphs_is_found() {
+    let cmyk = "0.75 0 1 0 k 0 0 10 10 re f";
+    let stream = |dict: &str| format!("<< {dict} /Length {} >>\nstream\n{cmyk}\nendstream", cmyk.len());
+    let form = stream("/Type /XObject /Subtype /Form /BBox [0 0 10 10]");
+    let appearance = stream("/BBox [0 0 10 10]");
+    let pattern = stream("/Type /Pattern /PatternType 1 /PaintType 1 /TilingType 1 /BBox [0 0 10 10] /XStep 10 /YStep 10 /Resources << >>");
+    let glyph = format!("<< /Length {} >>\nstream\n1 0 d0 {cmyk}\nendstream", cmyk.len() + 7);
+    let cases: [(&str, Document); 4] = [
+        ("a form XObject", drawing("/Fm0 Do", "/XObject << /Fm0 5 0 R >>", &[&form])),
+        (
+            "an appearance stream without /Subtype",
+            build(
+                &[
+                    "<< /Type /Catalog /Pages 2 0 R >>",
+                    "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 200] >>",
+                    "<< /Type /Page /Parent 2 0 R /Annots [4 0 R] >>",
+                    "<< /Type /Annot /Subtype /Square /Rect [0 0 10 10] /F 4 /P 3 0 R /AP << /N 5 0 R >> >>",
+                    &appearance,
+                ],
+                "",
+            ),
+        ),
+        ("a tiling pattern", drawing("/Pattern cs /P0 scn 0 0 100 100 re f", "/Pattern << /P0 5 0 R >>", &[&pattern])),
+        (
+            "a Type 3 glyph in an inline font",
+            drawing(
+                "BT /T3 1 Tf (a) Tj ET",
+                "/Font << /T3 << /Type /Font /Subtype /Type3 /FontBBox [0 0 10 10] /FontMatrix [1 0 0 1 0 0] /CharProcs << /a 5 0 R >> /Encoding << /Differences [97 /a] >> /FirstChar 97 /LastChar 97 /Widths [10] >> >>",
+                &[&glyph],
+            ),
+        ),
+    ];
+    for (what, mut doc) in cases {
+        assert!(uses_cmyk(&doc), "DeviceCMYK in {what} wasn't found");
+        let r = convert(&mut doc, Level::A2b).unwrap();
+        assert!(declared(&doc).output_intents.is_empty(), "{what}: an sRGB output intent was added to a CMYK document: {:?}", r.fixed);
+    }
+}
diff --git a/crates/print/README.md b/crates/print/README.md
index 6a489977d..c7d6351fa 100644
--- a/crates/print/README.md
+++ b/crates/print/README.md
@@ -56,7 +56,7 @@ grayscale.
 
 ## Architectural sheets and scale
 
-The Paper menu and `doc_print` share Letter, Legal, Tabloid, A3/A4/A5 plus
+The Paper menu and `doc_print` share Letter, Legal, Tabloid, A3/A4/A5/A6 plus
 ARCH A/B/C/D/E1/E, ANSI C/D/E and ISO A0/A1/A2. ARCH D is 24 × 36 inches;
 ANSI D is 22 × 34 inches. Dimensions follow the [HP DesignJet paper-size table](https://support.hp.com/hr-en/document/bpp01676).
 Automation accepts short names such as `"ARCH D"` (case-insensitive) or the full menu label.
diff --git a/crates/print/src/lib.rs b/crates/print/src/lib.rs
index b4ed59959..802d9595b 100644
--- a/crates/print/src/lib.rs
+++ b/crates/print/src/lib.rs
@@ -179,6 +179,11 @@ pub enum Layout {
         overlap: f64,
         cut_marks: bool,
     },
+    /// Shipping label: each page cut to its [`Settings::crops`] box, turned so its text reads
+    /// upright on the sheet and fitted with [`LABEL_MARGIN`]; `flip` turns it a further 180°.
+    Label {
+        flip: bool,
+    },
 }
 
 impl Default for Layout {
@@ -228,22 +233,60 @@ pub struct Settings {
     pub orientation: Orientation,
     pub layout: Layout,
     pub content: Content,
+    /// For [`Layout::Label`], per source page: the area to keep (display space) and whether its
+    /// text runs bottom-to-top (so a quarter turn clockwise makes it upright). `None` or a
+    /// missing entry keeps the whole page.
+    pub crops: Vec<Option<Crop>>,
+    /// Print as image (Acrobat's Advanced Print Setup): every page rendered to a picture at this
+    /// resolution before it is placed on the paper. The engine does the rendering; `impose` is
+    /// then given the image-only document.
+    pub raster: Option<Raster>,
+}
+
+/// How pages are rendered when printing as image.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct Raster {
+    /// Dots per inch, 72–600 (Acrobat offers 150, 300 and 600).
+    pub dpi: f64,
+    /// Render the pictures in grey, so the print-ready PDF itself is grayscale.
+    pub grayscale: bool,
+}
+
+impl Default for Raster {
+    fn default() -> Self {
+        Raster { dpi: 300.0, grayscale: false }
+    }
+}
+
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct Crop {
+    pub rect: [f64; 4],
+    pub text_up: bool,
 }
 
 impl Default for Settings {
     fn default() -> Self {
-        Settings { pages: Vec::new(), paper: PAPERS[0].1, orientation: Orientation::Auto, layout: Layout::default(), content: Content::default() }
+        Settings {
+            pages: Vec::new(),
+            paper: PAPERS[0].1,
+            orientation: Orientation::Auto,
+            layout: Layout::default(),
+            content: Content::default(),
+            raster: None,
+            crops: Vec::new(),
+        }
     }
 }
 
 /// Common paper sizes (points, portrait).
-pub const PAPERS: [(&str, (f64, f64)); 18] = [
+pub const PAPERS: [(&str, (f64, f64)); 20] = [
     ("US Letter", (612.0, 792.0)),
     ("US Legal", (612.0, 1008.0)),
     ("Tabloid", (792.0, 1224.0)),
     ("A3", (841.89, 1190.55)),
     ("A4", (595.28, 841.89)),
     ("A5", (419.53, 595.28)),
+    ("A6", (297.64, 419.53)),
     ("ARCH A (9 x 12 in)", (648.0, 864.0)),
     ("ARCH B (12 x 18 in)", (864.0, 1296.0)),
     ("ARCH C (18 x 24 in)", (1296.0, 1728.0)),
@@ -256,8 +299,91 @@ pub const PAPERS: [(&str, (f64, f64)); 18] = [
     ("A2", (1190.55, 1683.78)),
     ("A1", (1683.78, 2383.94)),
     ("A0", (2383.94, 3370.39)),
+    ("4 x 6 in label (101.6 x 152.4 mm)", (288.0, 432.0)),
 ];
 
+/// `PAPERS` index of the 4 × 6 in shipping label.
+pub const LABEL_PAPER: usize = 19;
+
+/// The CUPS media name for `PAPERS[index]`, so the spooler feeds the sheet the PDF was laid out
+/// on rather than the queue's default (PPD keywords; `w288h432` is the usual 4×6 label).
+pub fn cups_media(index: usize) -> Option<&'static str> {
+    match PAPERS.get(index)?.0 {
+        "US Letter" => Some("Letter"),
+        "US Legal" => Some("Legal"),
+        "Tabloid" => Some("Tabloid"),
+        "A3" => Some("A3"),
+        "A4" => Some("A4"),
+        "A5" => Some("A5"),
+        _ if index == LABEL_PAPER => Some("w288h432"),
+        _ => None,
+    }
+}
+
+/// Whether most of page `index`'s text runs bottom-to-top as the page displays (a label laid
+/// sideways on a letter or A4 sheet), counting each text-showing operator once; form XObjects
+/// are followed a few levels deep.
+pub fn text_reads_up(doc: &Document, index: usize) -> bool {
+    let Some(page) = pdfcraft_model::pages(doc).into_iter().nth(index) else { return false };
+    let to_display = Matrix(page.view_matrix(doc)).invert().unwrap_or_default();
+    let res = page.dict.get(b"Resources").and_then(|r| doc.resolve(r).as_dict().cloned()).unwrap_or_default();
+    let mut score = 0i64;
+    text_direction(doc, &decoded_contents(doc, &page.dict), &res, to_display, 0, &mut score);
+    score > 0
+}
+
+fn text_direction(doc: &Document, data: &[u8], res: &Dict, base: Matrix, depth: usize, score: &mut i64) {
+    let (mut ctm, mut tm, mut stack) = (base, Matrix::IDENTITY, Vec::new());
+    for op in pdfcraft_content::parse(data).ops {
+        match op.op.as_slice() {
+            // Bounded like the renderer's graphics-state stack: deeper saves are ignored.
+            b"q" if stack.len() < 256 => stack.push(ctm),
+            b"Q" => ctm = stack.pop().unwrap_or(base),
+            b"cm" => ctm = Matrix::from_operands(&op.operands).unwrap_or_default().then(&ctm),
+            b"BT" => tm = Matrix::IDENTITY,
+            b"Tm" => tm = Matrix::from_operands(&op.operands).unwrap_or_default(),
+            b"Tj" | b"TJ" | b"'" | b"\"" => {
+                let [a, b, ..] = tm.then(&ctm).0;
+                *score += i64::from(b > a.abs()) - i64::from(-b > a.abs());
+            }
+            b"Do" if depth < 4 => {
+                let Some(name) = op.name(0) else { continue };
+                let Some(xobj) = res.get(b"XObject").and_then(|x| doc.resolve(x).as_dict().and_then(|x| x.get(name).cloned())) else { continue };
+                let Object::Stream(form) = &*doc.resolve(&xobj) else { continue };
+                if form.dict.get(b"Subtype").and_then(|s| doc.resolve(s).as_name().map(<[u8]>::to_vec)).as_deref() != Some(b"Form".as_slice()) {
+                    continue;
+                }
+                let m = form.dict.get(b"Matrix").and_then(|m| doc.resolve(m).as_array().and_then(|a| Matrix::from_operands(a))).unwrap_or_default();
+                let inner = form.dict.get(b"Resources").and_then(|r| doc.resolve(r).as_dict().cloned()).unwrap_or_else(|| res.clone());
+                if let Ok(body) = form.decoded() {
+                    text_direction(doc, &body, &inner, m.then(&ctm), depth + 1, score);
+                }
+            }
+            _ => {}
+        }
+    }
+}
+
+/// Margin kept around a label: thermal heads miss the very edge, and many 4×6 drivers feed
+/// 100 × 150 mm (283 × 425 pt), a little short of the 288 × 432 pt sheet.
+pub const LABEL_MARGIN: f64 = 8.0;
+
+/// Place `crop` (display space) of `page` centred in `cell`, scaled by `s` and turned by
+/// `quarter` quarter turns counter-clockwise (0–3).
+fn place_crop(page: usize, crop: [f64; 4], cell: [f64; 4], s: f64, quarter: u8) -> Placement {
+    let (w, h) = (crop[2] - crop[0], crop[3] - crop[1]);
+    let (pw, ph) = if quarter % 2 == 1 { (h * s, w * s) } else { (w * s, h * s) };
+    let (x, y) = (cell[0] + (cell[2] - cell[0] - pw) / 2.0, cell[1] + (cell[3] - cell[1] - ph) / 2.0);
+    let [a, b, c, d, e, f] = match quarter % 4 {
+        0 => [s, 0.0, 0.0, s, x, y],
+        1 => [0.0, s, -s, 0.0, x + pw, y],
+        2 => [-s, 0.0, 0.0, -s, x + pw, y + ph],
+        _ => [0.0, -s, s, 0.0, x, y + ph],
+    };
+    // Move the crop's corner to the origin first.
+    Placement { page, matrix: Matrix([a, b, c, d, e - a * crop[0] - c * crop[1], f - b * crop[0] - d * crop[1]]), clip: crop }
+}
+
 /// Match a displayed PDF page to a standard sheet, independent of orientation.
 /// Half a point allows rounded metric PDF dimensions without confusing distinct sizes.
 pub fn matching_paper(size: (f64, f64)) -> Option<usize> {
@@ -346,6 +472,34 @@ pub fn layout(sizes: &[(f64, f64)], settings: &Settings) -> Result<Vec<Sheet>, P
                 sheets.push(Sheet { size, placed: vec![place_in(p, d, [0.0, 0.0, size.0, size.1], s, false)], ..Sheet::default() });
             }
         }
+        Layout::Label { flip } => {
+            let size = oriented(paper, settings.orientation, false);
+            let cell = [LABEL_MARGIN, LABEL_MARGIN, size.0 - LABEL_MARGIN, size.1 - LABEL_MARGIN];
+            for &p in &pages {
+                let d = sizes[p];
+                let crop = settings.crops.get(p).copied().flatten();
+                let rect = crop
+                    .map(|c| [c.rect[0].max(0.0), c.rect[1].max(0.0), c.rect[2].min(d.0), c.rect[3].min(d.1)])
+                    .filter(|r| r[2] - r[0] > 1.0 && r[3] - r[1] > 1.0)
+                    .unwrap_or([0.0, 0.0, d.0, d.1]);
+                let (w, h) = (rect[2] - rect[0], rect[3] - rect[1]);
+                let turn = (w > h) != (cell[2] - cell[0] > cell[3] - cell[1]);
+                let mut quarter = match (turn, crop.is_some_and(|c| c.text_up)) {
+                    (false, _) => 0,
+                    (true, true) => 3,
+                    (true, false) => 1,
+                };
+                if flip {
+                    quarter = (quarter + 2) % 4;
+                }
+                let s = if turn {
+                    fit_scale((h, w), (cell[2] - cell[0], cell[3] - cell[1]))
+                } else {
+                    fit_scale((w, h), (cell[2] - cell[0], cell[3] - cell[1]))
+                };
+                sheets.push(Sheet { size, placed: vec![place_crop(p, rect, cell, s, quarter)], ..Sheet::default() });
+            }
+        }
         Layout::Multiple { cols, rows, per_sheet, order, border, auto_rotate } => {
             let cells = cols.checked_mul(rows).filter(|&n| n > 0 && n <= 256);
             let Some(cells) = cells else {
@@ -506,6 +660,13 @@ pub fn layout(sizes: &[(f64, f64)], settings: &Settings) -> Result<Vec<Sheet>, P
     Ok(sheets)
 }
 
+// Model-derived transforms and clipping bounds need their full PDF decimal precision.
+fn geometry_number(value: f64) -> String {
+    let mut bytes = Vec::new();
+    pdfcraft_cos::serialize(&Object::Real(value), &mut bytes);
+    String::from_utf8_lossy(&bytes).into_owned()
+}
+
 fn n(v: f64) -> String {
     let s = format!("{v:.4}");
     let s = s.trim_end_matches('0').trim_end_matches('.');
@@ -669,22 +830,22 @@ pub fn impose(src: &Document, settings: &Settings) -> Result<Vec<u8>, PrintError
             let [x0, y0, x1, y1] = pl.clip;
             c.push_str(&format!(
                 "q {} {} {} {} {} {} cm {} {} {} {} re W n {} {} {} {} {} {} cm /{name} Do Q\n",
-                n(a),
-                n(b),
-                n(cc),
-                n(d),
-                n(e),
-                n(f),
-                n(x0),
-                n(y0),
-                n(x1 - x0),
-                n(y1 - y0),
-                n(ua),
-                n(ub),
-                n(uc),
-                n(ud),
-                n(ue),
-                n(uf)
+                geometry_number(a),
+                geometry_number(b),
+                geometry_number(cc),
+                geometry_number(d),
+                geometry_number(e),
+                geometry_number(f),
+                geometry_number(x0),
+                geometry_number(y0),
+                geometry_number(x1 - x0),
+                geometry_number(y1 - y0),
+                geometry_number(ua),
+                geometry_number(ub),
+                geometry_number(uc),
+                geometry_number(ud),
+                geometry_number(ue),
+                geometry_number(uf)
             ));
         }
         if !sheet.borders.is_empty() || !sheet.lines.is_empty() {
@@ -716,6 +877,12 @@ pub fn impose(src: &Document, settings: &Settings) -> Result<Vec<u8>, PrintError
     let mut cat = Dict::new();
     cat.set(b"Type".to_vec(), Object::name("Catalog"));
     cat.set(b"Pages".to_vec(), Object::Ref(pages_root));
+    // Keep the layers' configuration, or a layer that is off in the document would print: the
+    // pages' marked content still refers to its groups, and without this nothing says they are off.
+    let layers = src.trailer().get(b"Root").and_then(|r| src.resolve(r).as_dict().and_then(|root| root.get(b"OCProperties").cloned()));
+    if let Some(layers) = layers {
+        cat.set(b"OCProperties".to_vec(), layers);
+    }
     let root = doc.add(Object::Dict(cat));
     doc.trailer_mut().set(b"Root".to_vec(), Object::Ref(root));
     doc.trailer_mut().remove(b"Info");
diff --git a/crates/print/src/spool.rs b/crates/print/src/spool.rs
index 5ac6aad97..cf1c0cb76 100644
--- a/crates/print/src/spool.rs
+++ b/crates/print/src/spool.rs
@@ -59,6 +59,12 @@ pub fn submit(pdf: &[u8], job: &Job) -> Result<String, crate::PrintError> {
     craft_print::submit(pdf, job).map_err(|e| crate::PrintError::Spool(e.to_string()))
 }
 
+/// [`submit`], told `(sent, sheets)` as each sheet reaches the spooler (Windows; CUPS takes the
+/// whole PDF at once and reports nothing).
+pub fn submit_with_progress(pdf: &[u8], job: &Job, progress: &mut dyn FnMut(usize, usize)) -> Result<String, crate::PrintError> {
+    craft_print::submit_with_progress(pdf, job, progress).map_err(|e| crate::PrintError::Spool(e.to_string()))
+}
+
 pub fn open_printer_preferences(printer: &str) -> Result<(), crate::PrintError> {
     craft_print::open_printer_preferences(printer).map_err(|e| crate::PrintError::Spool(e.to_string()))
 }
diff --git a/crates/print/src/tests.rs b/crates/print/src/tests.rs
index ee21c2706..d4b0c8ee1 100644
--- a/crates/print/src/tests.rs
+++ b/crates/print/src/tests.rs
@@ -643,3 +643,103 @@ fn paper_matching_accepts_rounded_metric_sizes_but_not_custom_or_invalid_sizes()
         assert_eq!(matching_paper(size), None);
     }
 }
+
+#[test]
+fn label_is_cut_turned_upright_and_fitted_without_distortion() {
+    let label = LABEL_PAPER;
+    assert_eq!(PAPERS[label].0, "4 x 6 in label (101.6 x 152.4 mm)");
+    assert_eq!(PAPERS[label].1, (288.0, 432.0));
+    assert_eq!(cups_media(label), Some("w288h432"));
+    // A sideways label in the lower half of an A4 sheet, text running bottom-to-top.
+    let rect = [40.0, 30.0, 560.0, 420.0];
+    for (text_up, flip, want_text_dir) in [(true, false, (1.0, 0.0)), (false, false, (1.0, 0.0)), (true, true, (-1.0, 0.0))] {
+        // Text direction on the page: up when text_up, down otherwise.
+        let page_dir = if text_up { (0.0, 1.0) } else { (0.0, -1.0) };
+        let s = Settings {
+            pages: vec![0],
+            paper: PAPERS[label].1,
+            layout: Layout::Label { flip },
+            crops: vec![Some(Crop { rect, text_up })],
+            ..Settings::default()
+        };
+        let sheets = layout(&[(595.0, 842.0)], &s).unwrap();
+        assert_eq!(sheets.len(), 1);
+        assert_eq!(sheets[0].size, (288.0, 432.0));
+        let pl = sheets[0].placed[0];
+        assert_eq!(pl.clip, rect);
+        let [a, b, c, d, _, _] = pl.matrix.0;
+        // A pure quarter turn with one scale: no stretching.
+        assert!((a.hypot(b) - c.hypot(d)).abs() < 1e-9 && (a * c + b * d).abs() < 1e-9);
+        let dir = (a * page_dir.0 + c * page_dir.1, b * page_dir.0 + d * page_dir.1);
+        let n = dir.0.hypot(dir.1);
+        assert!((dir.0 / n - want_text_dir.0).abs() < 1e-9 && (dir.1 / n - want_text_dir.1).abs() < 1e-9, "text_up={text_up} flip={flip}");
+        let corners = [(rect[0], rect[1]), (rect[2], rect[1]), (rect[2], rect[3]), (rect[0], rect[3])].map(|(x, y)| pl.matrix.apply(x, y));
+        let (x0, x1) = corners.iter().fold((f64::MAX, f64::MIN), |m, p| (m.0.min(p.0), m.1.max(p.0)));
+        let (y0, y1) = corners.iter().fold((f64::MAX, f64::MIN), |m, p| (m.0.min(p.1), m.1.max(p.1)));
+        assert!(x0 >= LABEL_MARGIN - 1e-6 && x1 <= 288.0 - LABEL_MARGIN + 1e-6 && y0 >= LABEL_MARGIN - 1e-6 && y1 <= 432.0 - LABEL_MARGIN + 1e-6);
+        // Fills the label's width (the crop's height, 390 pt, becomes it).
+        assert!((x1 - x0 - (288.0 - 2.0 * LABEL_MARGIN)).abs() < 1e-6);
+    }
+    // No crop: the whole page, upright.
+    let whole =
+        layout(&[(200.0, 300.0)], &Settings { pages: vec![0], paper: (288.0, 432.0), layout: Layout::Label { flip: false }, ..Settings::default() })
+            .unwrap();
+    assert_eq!(whole[0].placed[0].clip, [0.0, 0.0, 200.0, 300.0]);
+    assert_eq!(whole[0].placed[0].matrix.0[1], 0.0);
+}
+
+#[test]
+fn text_direction_is_read_from_text_and_form_matrices() {
+    let doc = fixture(1);
+    assert!(!text_reads_up(&doc, 0), "upright text");
+    assert!(!text_reads_up(&doc, 9), "no such page");
+}
+
+#[test]
+fn imposed_pages_preserve_large_user_unit_matrices() {
+    let (unit, mode) = (75000.0, SizeMode::Fit);
+    let mut doc = fixture(1);
+    let page = pdfcraft_model::pages(&doc)[0].obj;
+    doc.update_dict(page, |d| d.set(b"UserUnit".to_vec(), Object::Real(unit))).unwrap();
+    let out = impose(&doc, &Settings { content: Content::Document, ..settings(vec![0], Layout::Size(mode)) }).unwrap();
+    let printed = Document::open(Arc::new(out)).unwrap();
+    let page = &pdfcraft_model::pages(&printed)[0];
+    let contents = printed.resolve(page.dict.get(b"Contents").unwrap());
+    let Object::Stream(stream) = &*contents else { panic!("sheet content") };
+    let bytes = stream.decoded().unwrap();
+    let parsed = pdfcraft_content::parse(&bytes);
+    assert_eq!(parsed.skipped, 0);
+    let cms: Vec<_> = parsed.ops.iter().filter(|op| op.is("cm")).collect();
+    assert_eq!(cms.len(), 2, "placement and source-to-display matrices");
+    let normalized = f64::from(unit as f32);
+    let scale = if mode == SizeMode::Actual { 1.0 } else { 756.0 / (300.0 * normalized) };
+    let expected = [
+        [scale, 0.0, 0.0, scale, 306.0 - 100.0 * normalized * scale, 396.0 - 150.0 * normalized * scale],
+        [normalized, 0.0, 0.0, normalized, 0.0, 0.0],
+    ];
+    for (cm, expected) in cms.iter().zip(expected) {
+        assert_eq!(cm.operands.len(), 6);
+        assert!(!bytes[cm.span.clone()].contains(&b'e') && !bytes[cm.span.clone()].contains(&b'E'));
+        for (actual, expected) in cm.nums::<6>().unwrap().into_iter().zip(expected) {
+            assert!((actual - expected).abs() <= 1e-12 * expected.abs(), "unit={unit}: {actual} != {expected}");
+        }
+    }
+    let clip = parsed.ops.iter().find(|op| op.is("re")).unwrap();
+    assert_eq!(clip.operands.len(), 4);
+    let rect = clip.nums::<4>().unwrap();
+    assert_eq!(rect, [0.0, 0.0, 200.0 * normalized, 300.0 * normalized]);
+    assert!(rect[2] > 0.0 && rect[3] > 0.0, "the clip must retain the visible page");
+    let clip_tokens = std::str::from_utf8(&bytes[clip.span.clone()]).unwrap();
+    assert!(clip_tokens.split_whitespace().take(4).all(|token| !token.contains('e') && !token.contains('E')));
+    let apply = |m: [f64; 6], p: [f64; 2]| [m[0] * p[0] + m[2] * p[1] + m[4], m[1] * p[0] + m[3] * p[1] + m[5]];
+    let to_sheet = |p| apply(cms[0].nums::<6>().unwrap(), apply(cms[1].nums::<6>().unwrap(), p));
+    let mut anchors = vec![([100.0, 150.0], [306.0, 396.0])];
+    if mode == SizeMode::Fit {
+        anchors.extend([([0.0, 0.0], [54.0, 18.0]), ([200.0, 300.0], [558.0, 774.0])]);
+    }
+    for (raw, expected) in anchors {
+        for (actual, expected) in to_sheet(raw).into_iter().zip(expected) {
+            assert!((actual - expected).abs() < 1e-9, "unit={unit}: {actual} != {expected}");
+        }
+    }
+}
diff --git a/crates/redact/Cargo.toml b/crates/redact/Cargo.toml
index 4aee20bfc..49593855e 100644
--- a/crates/redact/Cargo.toml
+++ b/crates/redact/Cargo.toml
@@ -16,6 +16,8 @@ pdfcraft-model = { workspace = true }
 pdfcraft-forms = { workspace = true }
 pdfcraft-edit = { workspace = true }
 pdfcraft-annot = { workspace = true }
+pdfcraft-xfa = { workspace = true }
 thiserror = { workspace = true }
 
 [dev-dependencies]
+pdfcraft-testkit = { workspace = true }
diff --git a/crates/redact/README.md b/crates/redact/README.md
index 4a569eaa1..3b2d54e81 100644
--- a/crates/redact/README.md
+++ b/crates/redact/README.md
@@ -20,7 +20,8 @@ clear_marks(&mut doc, None)?;                        // remove marks without app
 - **images**: fully covered → removed; partly covered → a copy with the covered pixels cleared
   (8/16-bit and 1/2/4-bit images, image masks; Flate/LZW/RL/A85/AHx). Codecs PdfCraft can't
   re-encode (DCT, JPX, JBIG2, CCITT) are removed whole (fail-closed); inline images under an
-  area are removed;
+  area are removed. Images with separate `/SMask` or `/Mask` data are removed whole;
+  cleared copies drop `/Alternates` so alternate pixels cannot survive;
 - **vectors**: covered paths are removed; partly covered paths and shadings are clipped so
   nothing paints inside the areas;
 - **form XObjects**: rewritten recursively into new objects (pages sharing the original keep it);
@@ -33,6 +34,13 @@ A verification pass re-reads each redacted page and fails the operation if any g
 image is still under an area. Content that can't be decoded makes the operation fail rather than
 leave it unredacted.
 
+Before changing any page, `apply` prepares the redaction appearances with a shared 8 MiB
+budget for their uncompressed PDF content across the selected pages. It bounds repeated-text
+counts and working line buffers before allocating them, and measures and encodes each repeated
+line once. Invalid or excessive appearances return `RedactError::OverlayLimit` without changing
+the document. Reduce the marked area, disable repeated text, or apply fewer pages at a time.
+This limits appearance generation; it is not a limit on the input PDF or the whole process's memory.
+
 Structure cleanup resolves named MCIDs and indirect content references. Form content
 references are updated to the cleaned copy; unchanged sibling descriptions remain.
 
diff --git a/crates/redact/src/image.rs b/crates/redact/src/image.rs
index 4d61fd6c6..23ef2559a 100644
--- a/crates/redact/src/image.rs
+++ b/crates/redact/src/image.rs
@@ -23,9 +23,9 @@ fn components(doc: &Document, s: &Stream) -> Option<usize> {
         b"DeviceRGB" | b"RGB" | b"CalRGB" | b"Lab" => 3,
         b"DeviceCMYK" | b"CMYK" => 4,
         b"ICCBased" => {
-            // /N lives in the ICC profile stream.
+            // /N lives in the ICC profile stream, and shall be 1, 3 or 4 (ISO 32000-2 §8.6.5.5).
             match &*doc.resolve(cs.as_array()?.get(1)?) {
-                Object::Stream(icc) => icc.dict.int(b"N")? as usize,
+                Object::Stream(icc) => usize::try_from(icc.dict.int(b"N")?).ok().filter(|n| matches!(n, 1 | 3 | 4))?,
                 _ => return None,
             }
         }
@@ -41,6 +41,10 @@ pub(crate) fn clear(doc: &Document, s: &Stream, ctm: &Matrix, rects: &[[f64; 4]]
 }
 
 fn decode_and_clear(doc: &Document, s: &Stream, ctm: &Matrix, rects: &[[f64; 4]]) -> Option<Option<Stream>> {
+    // Separate masks can retain the original image data.
+    if s.dict.contains(b"SMask") || s.dict.contains(b"Mask") {
+        return None;
+    }
     let supported = |n: &[u8]| {
         matches!(
             n,
@@ -66,12 +70,18 @@ fn decode_and_clear(doc: &Document, s: &Stream, ctm: &Matrix, rects: &[[f64; 4]]
     if !matches!(bpc, 1 | 2 | 4 | 8 | 16) {
         return None;
     }
+    // Every size comes from the file: multiply checked, so an overflowing product refuses the image
+    // instead of sizing the writes below.
+    let bits_per_pixel = ncomp.checked_mul(bpc)?;
+    let row = w.checked_mul(bits_per_pixel)?.div_ceil(8);
+    let bytes = row.checked_mul(h)?;
+    let row_bits = row.checked_mul(8)?;
+    bytes.checked_mul(8)?;
     let mut data = s.decoded().ok()?;
-    let row = (w * ncomp * bpc).div_ceil(8);
-    if data.len() < row * h {
+    if data.len() < bytes {
         return None;
     }
-    data.truncate(row * h);
+    data.truncate(bytes);
     // Image masks: a sample of 0 paints unless /Decode is [1 0]; cleared samples must not paint.
     let clear_bit = if mask {
         let inverted = s.dict.get(b"Decode").and_then(Object::as_array).and_then(|d| d.first()).and_then(Object::as_f64) == Some(1.0);
@@ -79,7 +89,6 @@ fn decode_and_clear(doc: &Document, s: &Stream, ctm: &Matrix, rects: &[[f64; 4]]
     } else {
         false
     };
-    let bits_per_pixel = ncomp * bpc;
     let mut cleared = 0usize;
     for j in 0..h {
         // Image space: (0,0) is the bottom-left of the unit square; row 0 is the top.
@@ -97,13 +106,15 @@ fn decode_and_clear(doc: &Document, s: &Stream, ctm: &Matrix, rects: &[[f64; 4]]
                 continue;
             }
             cleared += 1;
-            let start = j * row * 8 + i * bits_per_pixel;
+            // `bytes * 8` fits, and every bit index is below it, so this arithmetic can't overflow.
+            let start = j * row_bits + i * bits_per_pixel;
             for bit in start..start + bits_per_pixel {
                 let (byte, shift) = (bit / 8, 7 - bit % 8);
+                let b = data.get_mut(byte)?;
                 if clear_bit {
-                    data[byte] |= 1 << shift;
+                    *b |= 1 << shift;
                 } else {
-                    data[byte] &= !(1 << shift);
+                    *b &= !(1 << shift);
                 }
             }
         }
@@ -114,5 +125,6 @@ fn decode_and_clear(doc: &Document, s: &Stream, ctm: &Matrix, rects: &[[f64; 4]]
     let mut dict = s.dict.clone();
     dict.remove(b"Length");
     dict.remove(b"DecodeParms");
+    dict.remove(b"Alternates");
     Some(Some(Stream::flate(dict, &data)))
 }
diff --git a/crates/redact/src/lib.rs b/crates/redact/src/lib.rs
index ddacfe234..61231bd98 100644
--- a/crates/redact/src/lib.rs
+++ b/crates/redact/src/lib.rs
@@ -21,6 +21,7 @@ use pdfcraft_cos::{Dict, Document, ObjRef, Object, Stream};
 pub mod codes;
 mod image;
 mod interp;
+mod overlay;
 pub mod patterns;
 pub mod sanitize;
 mod tags;
@@ -46,6 +47,10 @@ pub enum RedactError {
         "page {0} has vertical-writing text while a redaction mark is pending, and PdfCraft cannot tell whether that text lies under the mark yet, so nothing was changed"
     )]
     VerticalText(usize),
+    #[error(
+        "redaction appearance has invalid geometry or exceeds the 8 MiB budget; reduce the marked area, turn off repeated text or apply fewer pages at once (nothing was redacted)"
+    )]
+    OverlayLimit,
     #[error(transparent)]
     Edit(#[from] pdfcraft_edit::EditError),
     #[error(transparent)]
@@ -206,76 +211,6 @@ pub(crate) fn page_streams(doc: &Document, page: &Dict, index: usize) -> Result<
     Ok((list, data))
 }
 
-/// The boxes and overlay text drawn for the applied marks.
-fn overlay_content(marks: &[&Mark]) -> Vec<u8> {
-    let n = |v: f64| {
-        let s = format!("{:.3}", v);
-        s.trim_end_matches('0').trim_end_matches('.').to_string()
-    };
-    let mut c: Vec<u8> = Vec::new();
-    for m in marks {
-        let Some(fill) = m.fill else { continue };
-        c.extend(format!("q {} {} {} rg\n", n(fill[0]), n(fill[1]), n(fill[2])).bytes());
-        for r in &m.rects {
-            c.extend(format!("{} {} {} {} re f\n", n(r[0]), n(r[1]), n(r[2] - r[0]), n(r[3] - r[1])).bytes());
-        }
-        c.extend_from_slice(b"Q\n");
-        if m.overlay.is_empty() {
-            continue;
-        }
-        // The overlay text: its font, colour and alignment; auto-sized to fit unless a size is
-        // set; repeated to fill the area when asked.
-        let look = &m.look;
-        // The published standard-14 metrics, so overlay text is measured as it will be drawn.
-        let (res, face) = match look.font {
-            pdfcraft_annot::OverlayFont::Helvetica => ("PCHelv", pdfcraft_fonts::Std14::Helvetica),
-            pdfcraft_annot::OverlayFont::Times => ("PCTimes", pdfcraft_fonts::Std14::TimesRoman),
-            pdfcraft_annot::OverlayFont::Courier => ("PCCour", pdfcraft_fonts::Std14::Courier),
-        };
-        let width = move |s: &str, size: f64| face.text_width(s, size);
-        let [cr, cg, cb] = look.color.map(|v| v.clamp(0.0, 1.0));
-        for r in &m.rects {
-            let (w, h) = (r[2] - r[0], r[3] - r[1]);
-            let mut size = if look.size > 0.0 { look.size } else { (h * 0.7).min(12.0) };
-            let tw = width(&m.overlay, size);
-            if look.size <= 0.0 && tw > w - 2.0 && tw > 0.0 {
-                size *= (w - 2.0).max(0.0) / tw;
-            }
-            if size < 2.0 {
-                continue;
-            }
-            // One line, or as many repeated lines as fit (each line the text repeated across).
-            let lines: Vec<String> = if look.repeat {
-                let unit = width(&format!("{} ", m.overlay), size).max(0.01);
-                let per_line = ((w - 2.0) / unit).floor().max(1.0) as usize;
-                let count = ((h / (size * 1.2)).floor() as usize).max(1);
-                vec![vec![m.overlay.as_str(); per_line].join(" "); count]
-            } else {
-                vec![m.overlay.clone()]
-            };
-            let block = lines.len() as f64 * size * 1.2;
-            let mut y = r[1] + (h + block) / 2.0 - size * 0.95;
-            c.extend(
-                format!("q {} {} {} {} re W n BT {} {} {} rg /{res} {} Tf ", n(r[0]), n(r[1]), n(w), n(h), n(cr), n(cg), n(cb), n(size)).bytes(),
-            );
-            for line in &lines {
-                let lw = width(line, size);
-                let x = match look.align {
-                    0 => r[0] + 1.0,
-                    2 => r[2] - 1.0 - lw,
-                    _ => r[0] + (w - lw) / 2.0,
-                };
-                c.extend(format!("1 0 0 1 {} {} Tm ", n(x), n(y)).bytes());
-                c.extend_from_slice(&pdfcraft_fonts::literal(&pdfcraft_fonts::win_ansi(line)));
-                c.extend_from_slice(b" Tj ");
-                y -= size * 1.2;
-            }
-            c.extend_from_slice(b"ET Q\n");
-        }
-    }
-    c
-}
-
 /// The nearest ancestor of `page` that holds `/Resources` (where an inheriting page gets them):
 /// `Some(None)` when none does, `None` when the chain can't be followed (a cycle, a broken node or
 /// a tree deeper than any real one), so callers can stay conservative.
@@ -384,9 +319,16 @@ pub fn apply(doc: &mut Document, pages: Option<&[usize]>) -> Result<Report, Reda
         )));
     }
     let mut report = Report { marks: chosen.len(), ..Report::default() };
-    let mut by_page: Vec<usize> = chosen.iter().map(|m| m.page).collect();
-    by_page.sort_unstable();
-    by_page.dedup();
+    // `marks` visits pages in order. Keep slices of that order for appearance generation,
+    // content rewriting and verification instead of scanning all marks for every page.
+    let groups: Vec<_> = chosen.chunk_by(|a, b| a.page == b.page).filter_map(|group| group.first().map(|mark| (mark.page, group))).collect();
+    let by_page: Vec<_> = groups.iter().map(|(page, _)| *page).collect();
+    // Budget failures must leave even a direct library caller's document untouched.
+    let mut remaining = overlay::MAX_BYTES;
+    let overlays = groups
+        .iter()
+        .map(|&(pi, page_marks)| overlay::content(page_marks, &mut remaining).map(|content| (pi, content)))
+        .collect::<Result<Vec<_>, _>>()?;
     report.pages = by_page.len();
     localize_resources(doc, &by_page)?;
     let mut doomed_fields: Vec<String> = Vec::new();
@@ -395,9 +337,8 @@ pub fn apply(doc: &mut Document, pages: Option<&[usize]>) -> Result<Report, Reda
     let widget_owner: Vec<(ObjRef, String)> =
         pdfcraft_forms::fields(doc).into_iter().flat_map(|f| f.widgets.iter().map(|w| (w.obj, f.name.clone())).collect::<Vec<_>>()).collect();
 
-    for &pi in &by_page {
+    for &(pi, page_marks) in &groups {
         let page = pdfcraft_model::pages(doc).swap_remove(pi);
-        let page_marks: Vec<&Mark> = chosen.iter().copied().filter(|m| m.page == pi).collect();
         let rects: Vec<[f64; 4]> = page_marks.iter().flat_map(|m| m.rects.iter().copied()).collect();
 
         // 1. Content.
@@ -529,38 +470,16 @@ pub fn apply(doc: &mut Document, pages: Option<&[usize]>) -> Result<Report, Reda
     // 3b. An XFA form mirrors its field values in the /XFA datasets packet, and a relayout
     // rebuilds fields and pages from that packet, so deleting the AcroForm field alone leaves the
     // redacted value in the file and lets a later relayout put it back. Once redactions are
-    // applied the form stops being XFA: drop /AcroForm /XFA (template and datasets), the catalog's
-    // /NeedsRendering, and PdfCraft's own layout mark (pdfcraft_xfa::LAYOUT_KEY), leaving a plain
-    // already-laid-out AcroForm that neither the saved file nor a relayout can restore from.
-    if let Some(root) = doc.root() {
-        let strip_xfa = |d: &mut Dict| {
-            d.remove(b"XFA");
-            d.remove(b"PCXfaLayout");
-        };
-        match doc.get(root).as_dict().and_then(|d| d.get(b"AcroForm").cloned()) {
-            Some(Object::Ref(af)) if doc.get(af).as_dict().is_some_and(|d| d.contains(b"XFA")) => {
-                doc.update_dict(af, strip_xfa)?;
-                doc.update_dict(root, |d| {
-                    d.remove(b"NeedsRendering");
-                })?;
-                report.xfa_removed = true;
-            }
-            Some(Object::Dict(mut af)) if af.contains(b"XFA") => {
-                strip_xfa(&mut af);
-                doc.update_dict(root, |d| {
-                    d.set(b"AcroForm".to_vec(), Object::Dict(af));
-                    d.remove(b"NeedsRendering");
-                })?;
-                report.xfa_removed = true;
-            }
-            _ => {}
-        }
+    // applied the form stops being XFA: the packets, /NeedsRendering, the layout mark and the
+    // rest go (pdfcraft_xfa::strip), leaving a plain already-laid-out AcroForm that neither the
+    // saved file nor a relayout can restore from.
+    if pdfcraft_xfa::xfa_shape(doc).is_some() {
+        let r = pdfcraft_xfa::strip(doc).map_err(|e| pdfcraft_edit::EditError::Invalid(e.to_string()))?;
+        report.xfa_removed = !r.packets.is_empty();
     }
 
     // 4. The boxes.
-    for &pi in &by_page {
-        let page_marks: Vec<&Mark> = chosen.iter().copied().filter(|m| m.page == pi).collect();
-        let content = overlay_content(&page_marks);
+    for (pi, content) in overlays {
         if !content.is_empty() {
             pdfcraft_edit::stamp(doc, pi, "Redaction", content)?;
         }
@@ -572,9 +491,9 @@ pub fn apply(doc: &mut Document, pages: Option<&[usize]>) -> Result<Report, Reda
 
     // 5. Verify: nothing readable may remain under a region.
     let mut residue = 0;
-    for &pi in &by_page {
+    for &(pi, page_marks) in &groups {
         let page = pdfcraft_model::pages(doc).swap_remove(pi);
-        let rects: Vec<[f64; 4]> = chosen.iter().filter(|m| m.page == pi).flat_map(|m| m.rects.iter().copied()).collect();
+        let rects: Vec<[f64; 4]> = page_marks.iter().flat_map(|m| m.rects.iter().copied()).collect();
         let (list, data) = page_streams(doc, &page.dict, pi)?;
         // The overlay stream (last) draws text of its own: the overlay label is allowed.
         let original: Vec<Vec<u8>> = list
diff --git a/crates/redact/src/overlay.rs b/crates/redact/src/overlay.rs
new file mode 100644
index 000000000..fc8fd1599
--- /dev/null
+++ b/crates/redact/src/overlay.rs
@@ -0,0 +1,129 @@
+//! Prepare bounded redaction appearances before the document is changed.
+
+use std::borrow::Cow;
+
+use super::{Mark, RedactError};
+
+/// Shared by every selected page, including fills, text and PDF operators.
+pub(super) const MAX_BYTES: usize = 8 * 1024 * 1024;
+
+struct Output<'a> {
+    bytes: Vec<u8>,
+    remaining: &'a mut usize,
+}
+
+impl Output<'_> {
+    fn push(&mut self, bytes: impl AsRef<[u8]>) -> Result<(), RedactError> {
+        let bytes = bytes.as_ref();
+        let left = self.remaining.checked_sub(bytes.len()).ok_or(RedactError::OverlayLimit)?;
+        self.bytes.try_reserve(bytes.len()).map_err(|_| RedactError::OverlayLimit)?;
+        self.bytes.extend_from_slice(bytes);
+        *self.remaining = left;
+        Ok(())
+    }
+}
+
+fn repeat_line(text: &str, across: f64, down: f64, remaining: usize) -> Result<(String, usize), RedactError> {
+    // Check floating-point counts before casting, and the product before allocating.
+    if !across.is_finite() || !down.is_finite() || across > remaining as f64 || down > remaining as f64 {
+        return Err(RedactError::OverlayLimit);
+    }
+    let (across, down) = (across as usize, down as usize);
+    let bytes = text.len().checked_add(1).and_then(|n| n.checked_mul(across)).and_then(|n| n.checked_sub(1));
+    let bytes = bytes.filter(|n| *n <= remaining).ok_or(RedactError::OverlayLimit)?;
+    let mut line = String::new();
+    line.try_reserve_exact(bytes).map_err(|_| RedactError::OverlayLimit)?;
+    for i in 0..across {
+        if i > 0 {
+            line.push(' ');
+        }
+        line.push_str(text);
+    }
+    Ok((line, down))
+}
+
+pub(super) fn content(marks: &[&Mark], remaining: &mut usize) -> Result<Vec<u8>, RedactError> {
+    let n = |v: f64| {
+        let s = format!("{:.3}", v);
+        s.trim_end_matches('0').trim_end_matches('.').to_string()
+    };
+    let mut c = Output { bytes: Vec::new(), remaining };
+    for m in marks {
+        let Some(fill) = m.fill else { continue };
+        if !fill.iter().all(|v| v.is_finite()) || m.rects.iter().flatten().any(|v| !v.is_finite()) {
+            return Err(RedactError::OverlayLimit);
+        }
+        c.push(format!("q {} {} {} rg\n", n(fill[0]), n(fill[1]), n(fill[2])))?;
+        for r in &m.rects {
+            let (w, h) = (r[2] - r[0], r[3] - r[1]);
+            if !w.is_finite() || !h.is_finite() {
+                return Err(RedactError::OverlayLimit);
+            }
+            c.push(format!("{} {} {} {} re f\n", n(r[0]), n(r[1]), n(w), n(h)))?;
+        }
+        c.push(b"Q\n")?;
+        if m.overlay.is_empty() {
+            continue;
+        }
+        if m.overlay.len() > *c.remaining {
+            return Err(RedactError::OverlayLimit);
+        }
+        let look = &m.look;
+        if !look.size.is_finite() || !look.color.iter().all(|v| v.is_finite()) {
+            return Err(RedactError::OverlayLimit);
+        }
+        // Keep upstream's standard-14 metrics when preparing the bounded appearance.
+        let (res, face) = match look.font {
+            pdfcraft_annot::OverlayFont::Helvetica => ("PCHelv", pdfcraft_fonts::Std14::Helvetica),
+            pdfcraft_annot::OverlayFont::Times => ("PCTimes", pdfcraft_fonts::Std14::TimesRoman),
+            pdfcraft_annot::OverlayFont::Courier => ("PCCour", pdfcraft_fonts::Std14::Courier),
+        };
+        let width = move |s: &str, size: f64| face.text_width(s, size);
+        let [cr, cg, cb] = look.color.map(|v| v.clamp(0.0, 1.0));
+        for r in &m.rects {
+            let (w, h) = (r[2] - r[0], r[3] - r[1]);
+            let mut size = if look.size > 0.0 { look.size } else { (h * 0.7).min(12.0) };
+            let tw = width(&m.overlay, size);
+            if look.size <= 0.0 && tw > w - 2.0 && tw > 0.0 {
+                size *= (w - 2.0).max(0.0) / tw;
+            }
+            if size < 2.0 {
+                continue;
+            }
+            let (line, count) = if look.repeat {
+                let unit = width(&format!("{} ", m.overlay), size).max(0.01);
+                let across = ((w - 2.0) / unit).floor().max(1.0);
+                let down = (h / (size * 1.2)).floor().max(1.0);
+                let (line, count) = repeat_line(&m.overlay, across, down, *c.remaining)?;
+                (Cow::Owned(line), count)
+            } else {
+                (Cow::Borrowed(m.overlay.as_str()), 1)
+            };
+            // Every row is identical: measure and encode it once, without a Vec of copies.
+            let encoded = pdfcraft_fonts::literal(&pdfcraft_fonts::win_ansi(&line));
+            if encoded.len().checked_add(4).and_then(|n| n.checked_mul(count)).is_none_or(|n| n > *c.remaining) {
+                return Err(RedactError::OverlayLimit);
+            }
+            let lw = width(&line, size);
+            let x = match look.align {
+                0 => r[0] + 1.0,
+                2 => r[2] - 1.0 - lw,
+                _ => r[0] + (w - lw) / 2.0,
+            };
+            let block = count as f64 * size * 1.2;
+            let mut y = r[1] + (h + block) / 2.0 - size * 0.95;
+            if !lw.is_finite() || !x.is_finite() || !y.is_finite() {
+                return Err(RedactError::OverlayLimit);
+            }
+            c.push(format!("q {} {} {} {} re W n BT {} {} {} rg /{res} {} Tf ", n(r[0]), n(r[1]), n(w), n(h), n(cr), n(cg), n(cb), n(size)))?;
+            for _ in 0..count {
+                c.push(format!("1 0 0 1 {} {} Tm ", n(x), n(y)))?;
+                c.push(&encoded)?;
+                c.push(b" Tj ")?;
+                y -= size * 1.2;
+            }
+            c.push(b"ET Q\n")?;
+        }
+    }
+    Ok(c.bytes)
+}
diff --git a/crates/redact/src/patterns.rs b/crates/redact/src/patterns.rs
index 0af3b02a9..18fc65e33 100644
--- a/crates/redact/src/patterns.rs
+++ b/crates/redact/src/patterns.rs
@@ -68,18 +68,41 @@ fn digit_run(s: &[char], start: usize, seps: &[char], max_len: usize) -> (usize,
     (i, n)
 }
 
+/// Whether the separated digit run goes on past `k` in the direction `step` (1 or −1): the next
+/// digit after `k` is reached through separators only.
+fn run_continues(s: &[char], k: usize, step: isize, seps: &[char]) -> bool {
+    let mut j = k;
+    loop {
+        let Some(c) = j.checked_add_signed(step).and_then(|j| s.get(j)) else { return false };
+        if c.is_ascii_digit() {
+            return true;
+        }
+        if !seps.contains(c) {
+            return false;
+        }
+        j = j.wrapping_add_signed(step);
+    }
+}
+
 fn phone(s: &[char], i: usize) -> Option<usize> {
+    const SEPS: [char; 5] = [' ', '-', '.', '(', ')'];
     let start_ok = s[i] == '+' && digit(s.get(i + 1)) || s[i] == '(' && digit(s.get(i + 1)) || s[i].is_ascii_digit();
     if !start_ok || word(i.checked_sub(1).and_then(|p| s.get(p))) || s.get(i.wrapping_sub(1)) == Some(&'+') {
         return None;
     }
+    // A phone number is a whole run of digit groups. The tail of a longer one (an IBAN, a
+    // company or social security number) is not a phone number, however it is grouped (#1884).
+    if run_continues(s, i, -1, &SEPS) {
+        return None;
+    }
     let plus = s[i] == '+';
     let first = if plus { i + 1 } else { i };
-    let (end, n) = digit_run(s, first, &[' ', '-', '.', '(', ')'], 28);
+    let (end, n) = digit_run(s, first, &SEPS, 28);
     let run = s.get(first..end)?;
     let seps = run.iter().filter(|c| !c.is_ascii_digit()).count();
-    // Always grouped by at least one separator, so plain numbers never match.
-    if seps == 0 || digit(s.get(end)) {
+    // Always grouped by at least one separator, so plain numbers never match; nor does the
+    // head of a run too long to be a phone number.
+    if seps == 0 || digit(s.get(end)) || run_continues(s, end - 1, 1, &SEPS) {
         return None;
     }
     let ok = if plus {
@@ -358,6 +381,18 @@ mod tests {
         );
     }
 
+    #[test]
+    fn the_tail_of_a_longer_number_is_not_a_phone_number() {
+        // #1884: the last groups of a French social security number, an IBAN and a SIRET used
+        // to be marked as phone numbers (and the start left visible). Example numbers.
+        for s in ["NIR 1 85 05 78 006 084 36 end", "IBAN FR76 3000 6000 0112 3456 7890 189", "SIRET 123 456 782 00010"] {
+            assert_eq!(found(Pattern::Phone, s), Vec::<String>::new(), "{s}");
+        }
+        assert_eq!(found(Pattern::Phone, "tel 01 23 45 67 89 / +33 1 23 45 67 89"), ["01 23 45 67 89", "+33 1 23 45 67 89"]);
+        // Nor the head of a run too long to be one: 28 characters in, this one still goes on.
+        assert_eq!(found(Pattern::Phone, "01 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7"), Vec::<String>::new());
+    }
+
     #[test]
     fn emails() {
         assert_eq!(
diff --git a/crates/redact/src/tests.rs b/crates/redact/src/tests.rs
index 7fcbc4305..b9a230fc4 100644
--- a/crates/redact/src/tests.rs
+++ b/crates/redact/src/tests.rs
@@ -2,32 +2,12 @@ use std::sync::Arc;
 
 use pdfcraft_annot::{Meta, NewAnnotation, Shape, Style, add_annotation, rect_quad};
 use pdfcraft_cos::{Document, SaveOptions, write_full, write_incremental};
+use pdfcraft_testkit::{Pdf, stream_obj as stream};
 
 use super::*;
 
-fn stream(dict: &str, data: &[u8]) -> Vec<u8> {
-    let mut v = format!("<< {dict} /Length {} >>\nstream\n", data.len()).into_bytes();
-    v.extend_from_slice(data);
-    v.extend_from_slice(b"\nendstream");
-    v
-}
-
 fn pdf(objs: Vec<Vec<u8>>) -> Document {
-    let mut out = b"%PDF-1.7\n".to_vec();
-    let mut offs = Vec::new();
-    for (i, o) in objs.iter().enumerate() {
-        offs.push(out.len());
-        out.extend_from_slice(format!("{} 0 obj\n", i + 1).as_bytes());
-        out.extend_from_slice(o);
-        out.extend_from_slice(b"\nendobj\n");
-    }
-    let x = out.len();
-    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
-    for o in offs {
-        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
-    }
-    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{x}\n%%EOF\n", objs.len() + 1).as_bytes());
-    Document::open(Arc::new(out)).unwrap()
+    Document::open(Arc::new(Pdf::new().objs(objs).build())).unwrap()
 }
 
 /// A font where every glyph is 500 units wide (so a 10 pt glyph advances 5 pt).
@@ -252,7 +232,7 @@ fn vertical_writing_text_under_a_mark_fails_closed() {
 #[test]
 fn images_are_removed_or_have_their_pixels_cleared() {
     // Image 1 is fully covered; image 2 (4×1 gray, all white) is half covered.
-    let img = stream("/Type /XObject /Subtype /Image /Width 4 /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8", &[255, 255, 255, 255]);
+    let img = stream("/Type /XObject /Subtype /Image /Width 4 /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8", [255, 255, 255, 255]);
     let src = b"q 10 0 0 10 10 10 cm /Im1 Do Q q 40 0 0 10 100 100 cm /Im2 Do Q";
     let mut doc = one_page(src, "/XObject << /Im1 7 0 R /Im2 7 0 R >>", vec![img]);
     mark(&mut doc, 0, &[[5.0, 5.0, 25.0, 25.0], [95.0, 95.0, 120.0, 115.0]], "");
@@ -705,6 +685,141 @@ fn overlay_text_takes_its_font_size_colour_alignment_and_repeats() {
     assert!(fonts.contains(b"PCCour") && !fonts.contains(b"PCTimes"));
 }
 
+fn repeated_overlay_document(width: f64, height: f64, repeat: bool) -> Document {
+    pdf(vec![
+        b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 600 800] /Contents 4 0 R /Annots [5 0 R] >>".to_vec(),
+        stream("", b"0 0 20 20 re f"),
+        format!("<< /Type /Annot /Subtype /Redact /Rect [0 0 {width} {height}] /IC [0 0 0] /OverlayText (X) /DA (/Helv 2 Tf) /Repeat {repeat} >>")
+            .into_bytes(),
+    ])
+}
+
+#[test]
+fn oversized_repeated_overlay_is_refused_before_changing_the_document() {
+    // About 11 MiB of generated content before the fix; a bounded reproduction, not an OOM test.
+    let mut doc = repeated_overlay_document(16000.0, 1600.0, true);
+    let before = write_full(&doc, &SaveOptions::default()).unwrap();
+    assert_eq!(apply(&mut doc, None), Err(RedactError::OverlayLimit));
+    assert_eq!(write_full(&doc, &SaveOptions::default()).unwrap(), before);
+    assert_eq!(marks(&doc).len(), 1);
+    let mut single = repeated_overlay_document(16000.0, 1600.0, false);
+    apply(&mut single, None).unwrap();
+    assert_eq!(content(&reopen(&single), 0).matches("(X) Tj").count(), 1);
+}
+
+#[test]
+fn overlay_budget_is_shared_by_pages_and_respects_the_page_selection() {
+    let mut doc = repeated_overlay_document(8000.0, 800.0, true);
+    let page = (*doc.get(ObjRef::new(3, 0))).clone();
+    let mut kids = vec![Object::Ref(ObjRef::new(3, 0))];
+    for _ in 0..2 {
+        let mut page = page.as_dict().unwrap().clone();
+        let annotation = doc.add((*doc.get(ObjRef::new(5, 0))).clone());
+        page.set(b"Annots".to_vec(), Object::Array(vec![Object::Ref(annotation)]));
+        kids.push(Object::Ref(doc.add(Object::Dict(page))));
+    }
+    doc.update_dict(ObjRef::new(2, 0), |d| {
+        d.set(b"Kids".to_vec(), Object::Array(kids));
+        d.set(b"Count".to_vec(), Object::Int(3));
+    })
+    .unwrap();
+    let before = write_full(&doc, &SaveOptions::default()).unwrap();
+    // Each appearance fits on its own; their sum exceeds the operation's budget.
+    assert_eq!(apply(&mut doc, None), Err(RedactError::OverlayLimit));
+    assert_eq!(write_full(&doc, &SaveOptions::default()).unwrap(), before);
+    assert_eq!(marks(&doc).len(), 3);
+    apply(&mut doc, Some(&[1])).unwrap();
+    assert_eq!(marks(&doc).iter().map(|m| m.page).collect::<Vec<_>>(), [0, 2]);
+}
+
+#[test]
+fn grouped_marks_keep_overlay_order_and_ignore_duplicate_page_selections() {
+    let mut doc = repeated_overlay_document(60.0, 30.0, false);
+    let page = doc.get(ObjRef::new(3, 0)).as_dict().unwrap().clone();
+    let original_mark = (*doc.get(ObjRef::new(5, 0))).clone();
+    let mut kids = vec![Object::Ref(ObjRef::new(3, 0))];
+    for _ in 0..2 {
+        let mut copy = page.clone();
+        let mark = doc.add(original_mark.clone());
+        copy.set(b"Annots".to_vec(), Object::Array(vec![Object::Ref(mark)]));
+        kids.push(Object::Ref(doc.add(Object::Dict(copy))));
+    }
+    doc.update_dict(ObjRef::new(2, 0), |d| {
+        d.set(b"Kids".to_vec(), Object::Array(kids));
+        d.set(b"Count".to_vec(), Object::Int(3));
+    })
+    .unwrap();
+    let mut second = original_mark.as_dict().unwrap().clone();
+    second.set(b"OverlayText".to_vec(), Object::String(pdfcraft_cos::PdfString::literal(b"Y".to_vec())));
+    let second = doc.add(Object::Dict(second));
+    doc.update_dict(ObjRef::new(3, 0), |d| {
+        d.set(b"Annots".to_vec(), Object::Array(vec![Object::Ref(ObjRef::new(5, 0)), Object::Ref(second)]));
+    })
+    .unwrap();
+    let untouched = content(&doc, 1);
+    let report = apply(&mut doc, Some(&[2, 0, 2])).unwrap();
+    assert_eq!((report.pages, report.marks), (2, 3));
+    let saved = reopen(&doc);
+    assert_eq!(marks(&saved).iter().map(|m| m.page).collect::<Vec<_>>(), [1]);
+    assert_eq!(content(&saved, 1), untouched);
+    let first = content(&saved, 0);
+    assert!(first.find("(X) Tj").unwrap() < first.find("(Y) Tj").unwrap());
+    assert_eq!(content(&saved, 2).matches("(X) Tj").count(), 1);
+}
+
+#[test]
+fn overlay_extreme_counts_and_invalid_geometry_are_refused_without_large_allocations() {
+    let doc = repeated_overlay_document(20.0, 10.0, true);
+    let original = marks(&doc).remove(0);
+    for rect in [[0.0, 0.0, 1e100, 10.0], [0.0, 0.0, 20.0, 1e100], [-f64::MAX, 0.0, f64::MAX, 10.0], [0.0, 0.0, f64::NAN, 10.0]] {
+        let mut mark = original.clone();
+        mark.rects = vec![rect];
+        let mut remaining = overlay::MAX_BYTES;
+        assert_eq!(overlay::content(&[&mark], &mut remaining), Err(RedactError::OverlayLimit));
+    }
+}
+
+#[test]
+fn repeated_overlay_keeps_its_exact_appearance_and_counts_escaped_bytes() {
+    let doc = repeated_overlay_document(20.0, 10.0, true);
+    let mut mark = marks(&doc).remove(0);
+    let expected = b"q 0 0 0 rg\n0 0 20 10 re f\nQ\nq 0 0 20 10 re W n BT 1 0 0 rg /PCHelv 2 Tf 1 0 0 1 1.773 7.9 Tm (X X X X X X X X X) Tj 1 0 0 1 1.773 5.5 Tm (X X X X X X X X X) Tj 1 0 0 1 1.773 3.1 Tm (X X X X X X X X X) Tj 1 0 0 1 1.773 0.7 Tm (X X X X X X X X X) Tj ET Q\n";
+    let mut remaining = expected.len();
+    assert_eq!(overlay::content(&[&mark], &mut remaining).unwrap(), expected);
+    assert_eq!(remaining, 0);
+    mark.overlay = "é(\\)".into();
+    let mut remaining = overlay::MAX_BYTES;
+    let encoded = overlay::content(&[&mark], &mut remaining).unwrap();
+    let escaped = b"\xe9\\(\\\\\\)";
+    assert!(encoded.windows(escaped.len()).any(|w| w == escaped));
+    assert_eq!(overlay::MAX_BYTES - remaining, encoded.len());
+    let mut too_small = encoded.len() - 1;
+    assert_eq!(overlay::content(&[&mark], &mut too_small), Err(RedactError::OverlayLimit));
+}
+
+#[test]
+#[ignore = "manual overlay timing probe"]
+fn repeated_overlay_timing_probe() {
+    use std::hash::{Hash, Hasher};
+    for (w, h) in [(20.0, 10.0), (2000.0, 200.0), (4000.0, 400.0), (8000.0, 800.0)] {
+        let doc = repeated_overlay_document(w, h, true);
+        let marks = marks(&doc);
+        let refs: Vec<_> = marks.iter().collect();
+        let start = std::time::Instant::now();
+        let mut bytes = Vec::new();
+        for _ in 0..20 {
+            let mut remaining = overlay::MAX_BYTES;
+            bytes = std::hint::black_box(overlay::content(std::hint::black_box(&refs), &mut remaining).unwrap());
+        }
+        let elapsed = start.elapsed().as_secs_f64() * 1000.0 / 20.0;
+        let mut hash = std::collections::hash_map::DefaultHasher::new();
+        bytes.hash(&mut hash);
+        println!("{w}x{h}: bytes={} hash={} ms={elapsed:.3}", bytes.len(), hash.finish());
+    }
+}
+
 /// Overlay text the standard fonts can't draw: refused when it is marked, and for a mark another
 /// program made, refused when it is applied, before anything is redacted, rather than burnt into
 /// the page as `?`.
@@ -940,3 +1055,65 @@ fn redacting_every_inheriting_page_retires_the_parent_resources() {
         assert_eq!(under(&mut saved, page, &[[0.0, 190.0, 300.0, 220.0]]), 0);
     }
 }
+
+#[test]
+fn a_hostile_icc_component_count_is_refused_not_multiplied_into_a_crash() {
+    // /N comes from the file. 2^60 × 8 bpc × width 2 overflows the row size; a negative /N wrapped
+    // to a huge usize. Either way the half-covered image can't be cleared, so it is removed whole.
+    for n in ["1152921504606846976", "-1", "2"] {
+        let img = stream("/Type /XObject /Subtype /Image /Width 2 /Height 1 /ColorSpace [/ICCBased 8 0 R] /BitsPerComponent 8", [255, 255]);
+        let icc = stream(&format!("/N {n}"), b"");
+        let mut doc = one_page(b"q 20 0 0 10 100 100 cm /Im Do Q", "/XObject << /Im 7 0 R >>", vec![img, icc]);
+        mark(&mut doc, 0, &[[95.0, 95.0, 110.0, 115.0]], "");
+        let r = apply(&mut doc, None).unwrap();
+        assert_eq!((r.images_removed, r.images_cleared), (1, 0), "/N {n}: {r:?}");
+        assert!(!content(&doc, 0).contains("/Im Do"), "/N {n}");
+    }
+}
+
+#[test]
+fn image_alternatives_and_masks_cannot_keep_redacted_pixels() {
+    for extra in ["/Alternates [<< /Image 8 0 R >>]", "/SMask 8 0 R", "/Mask 8 0 R", "/Mask [0 0]"] {
+        let mut doc = one_page(
+            b"q 0 0 300 300 re W n 8 0 0 10 10 10 cm /Im Do Q",
+            "/XObject << /Im 7 0 R >>",
+            vec![
+                stream(
+                    &format!("/Type /XObject /Subtype /Image /Width 8 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 8 {extra}"),
+                    b"LEAK_TOPPUBLIC__",
+                ),
+                stream("/Type /XObject /Subtype /Image /Width 8 /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8", b"LEAK_ALT"),
+            ],
+        );
+        mark(&mut doc, 0, &[[10.0, 15.0, 18.0, 20.0]], "");
+        let report = apply(&mut doc, None).unwrap();
+        assert_no_secret(&doc, b"LEAK_");
+        assert_eq!((report.images_cleared, report.images_removed), if extra.starts_with("/Alternates") { (1, 0) } else { (0, 1) });
+    }
+}
+
+#[test]
+fn masks_and_alternates_outside_redaction_stay() {
+    let mut doc = one_page(
+        b"q 8 0 0 10 10 10 cm /Im Do Q",
+        "/XObject << /Im 7 0 R >>",
+        vec![
+            stream(
+                "/Type /XObject /Subtype /Image /Width 8 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 8 /SMask 8 0 R /Alternates [<< /Image 8 0 R >>]",
+                b"PUBLIC_TOPBOTTOM",
+            ),
+            stream("/Type /XObject /Subtype /Image /Width 8 /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8", b"PUBLIC__"),
+        ],
+    );
+    mark(&mut doc, 0, &[[100.0, 100.0, 120.0, 120.0]], "");
+    let report = apply(&mut doc, None).unwrap();
+    assert_eq!((report.images_removed, report.images_cleared), (0, 0));
+    let saved = reopen(&doc);
+    let page = pdfcraft_model::pages(&saved).swap_remove(0);
+    let resources = saved.resolve(page.dict.get(b"Resources").unwrap());
+    let xobjects = saved.resolve(resources.as_dict().unwrap().get(b"XObject").unwrap());
+    let image = saved.resolve(xobjects.as_dict().unwrap().get(b"Im").unwrap());
+    let Object::Stream(image) = &*image else { panic!() };
+    assert!(image.dict.contains(b"SMask") && image.dict.contains(b"Alternates"));
+    assert_eq!(image.decoded().unwrap(), b"PUBLIC_TOPBOTTOM");
+}
diff --git a/crates/render/examples/page_timing.rs b/crates/render/examples/page_timing.rs
new file mode 100644
index 000000000..f1d143a21
--- /dev/null
+++ b/crates/render/examples/page_timing.rs
@@ -0,0 +1,192 @@
+//! Times and hashes the renders the desktop canvas asks for on page 1 of a PDF, for before and after
+//! comparisons (storytold/pdfcraft#623, item 8).
+//!
+//! Each round queues one scenario's requests on a render pool with the engine's worker count and
+//! prints the time to the first answer, the wall time, the slowest request, the text glyph count,
+//! the warning count, the error count, and an FNV-1a hash of every answer's size, pixels and text
+//! layer in request order. Equal hashes mean equal output. Peak memory is not measured here; on
+//! macOS wrap the command in `/usr/bin/time -l`, and subtract the `load` scenario to get the
+//! render's share.
+//!
+//! Usage: `page_timing FILE SCENARIO [ROUNDS] [THREADS]`. Scenarios:
+//! - `load`: open the file and start the pool with no request.
+//! - `fit`: page 1 at 2800 device pixels wide.
+//! - `backdrop`: page 1 at 2048 pixels on its longest side, the canvas's low-resolution backdrop.
+//! - `thumb`: a 240 × 320 thumbnail at density 2.
+//! - `tiles100`, `tiles400`: four 1024 px tiles at 100% and 400% on a 2× display.
+//! - `tiny`: one 16 px tile, which shows the fixed cost of a request.
+//! - `text`: the text layer of page 1.
+//! - `sweep`: whole pages and tiles at six scales, the broadest identity check.
+
+use std::error::Error;
+use std::sync::Arc;
+use std::time::{Duration, Instant};
+
+use pdfcraft_render::{PageText, RenderConfig, RenderPool, RenderRequest, RenderedPage, RequestKind, Tile};
+
+/// The canvas's tile side in device pixels.
+const TILE: u32 = 1024;
+const BACKDROP_SIDE: f32 = 2048.0;
+const FIT_WIDTH: f32 = 2800.0;
+const THUMB_W: f32 = 240.0;
+const THUMB_H: f32 = 320.0;
+const THUMB_DENSITY: f32 = 2.0;
+/// The tag bit that marks a thumbnail request, as the canvas sets it.
+const THUMB_TAG: u64 = 1 << 63;
+const TEXT_TAG: u64 = 1 << 62;
+/// Device pixels per point at 100% on a 2× display.
+const SCREEN_SCALE: f32 = 96.0 / 72.0 * 2.0;
+const TIMEOUT: Duration = Duration::from_secs(600);
+const FNV_OFFSET: u64 = 0xcbf2_9ce4_8422_2325;
+const FNV_PRIME: u64 = 0x0100_0000_01b3;
+
+fn main() -> Result<(), Box<dyn Error>> {
+    let args: Vec<String> = std::env::args().collect();
+    let (Some(path), Some(scenario)) = (args.get(1), args.get(2)) else {
+        return Err("usage: page_timing FILE SCENARIO [ROUNDS] [THREADS]".into());
+    };
+    let rounds: usize = match args.get(3) {
+        Some(s) => s.parse()?,
+        None => 1,
+    };
+    let threads: usize = match args.get(4) {
+        Some(s) => s.parse::<usize>()?.max(1),
+        None => std::thread::available_parallelism().map_or(4, |n| n.get()).clamp(2, 8) - 1,
+    };
+
+    let bytes = Arc::new(std::fs::read(path)?);
+    let (width, height) = {
+        let pdf = hayro_syntax::Pdf::new_with_password(bytes.clone(), "").map_err(|e| format!("{e:?}"))?;
+        let pages = pdf.pages();
+        pages.first().ok_or("the document has no pages")?.render_dimensions()
+    };
+    let requests = scenario_requests(scenario, width, height)?;
+
+    let pool = RenderPool::new(bytes, threads, RenderConfig::default());
+    for round in 0..rounds {
+        let (mut results, first, wall) = run(&pool, &requests)?;
+        results.sort_by_key(|r| (r.request.page, r.request.scale.to_bits(), r.request.tile.map(|t| (t.x, t.y, t.w, t.h))));
+        let slowest = results.iter().map(|r| r.millis).max().unwrap_or(0);
+        let glyphs: usize = results.iter().filter_map(|r| r.text.as_ref()).map(|t| t.glyphs.len()).sum();
+        let warnings: usize = results.iter().map(|r| r.warnings.len()).sum();
+        let errors: Vec<&str> = results.iter().filter_map(|r| r.error.as_deref()).collect();
+        let mut hash = FNV_OFFSET;
+        for r in &results {
+            hash = fnv1a(hash, &r.width.to_le_bytes());
+            hash = fnv1a(hash, &r.height.to_le_bytes());
+            hash = fnv1a(hash, &r.rgba[..]);
+            if let Some(text) = &r.text {
+                hash = hash_text(hash, text);
+            }
+        }
+        println!(
+            "round={round} scenario={scenario} page_pt={width}x{height} threads={threads} requests={} first_ms={} wall_ms={} slowest_ms={slowest} glyphs={glyphs} warnings={warnings} errors={} hash={hash:016x}",
+            requests.len(),
+            first.as_millis(),
+            wall.as_millis(),
+            errors.len()
+        );
+        if let Some(first_error) = errors.first() {
+            println!("first_error={first_error}");
+        }
+        if let Some(first_warning) = results.iter().flat_map(|r| r.warnings.iter()).next() {
+            println!("first_warning={first_warning:?}");
+        }
+    }
+    Ok(())
+}
+
+/// The requests of one scenario for a page of `width` × `height` points.
+fn scenario_requests(scenario: &str, width: f32, height: f32) -> Result<Vec<RenderRequest>, String> {
+    let page = |scale: f32, tile: Option<Tile>, preview: bool| RenderRequest {
+        page: 0,
+        kind: RequestKind::Pixels,
+        tile,
+        scale,
+        tag: scale_tag(scale),
+        preview,
+    };
+    let tiles = |scale: f32| -> Vec<RenderRequest> {
+        [(0, 0), (TILE, 0), (0, TILE), (TILE, TILE)].into_iter().map(|(x, y)| page(scale, Some(Tile { x, y, w: TILE, h: TILE }), false)).collect()
+    };
+    let requests = match scenario {
+        "load" => Vec::new(),
+        "fit" => vec![page(FIT_WIDTH / width, None, false)],
+        "backdrop" => vec![page(BACKDROP_SIDE / width.max(height), None, true)],
+        "thumb" => {
+            let scale = (THUMB_W / width).min(THUMB_H / height) * THUMB_DENSITY;
+            vec![RenderRequest { tag: THUMB_TAG | u64::from(scale.to_bits()), ..page(scale, None, true) }]
+        }
+        "tiles100" => tiles(SCREEN_SCALE),
+        "tiles400" => tiles(4.0 * SCREEN_SCALE),
+        "tiny" => vec![page(SCREEN_SCALE, Some(Tile { x: 0, y: 0, w: 16, h: 16 }), false)],
+        "text" => vec![RenderRequest { kind: RequestKind::Text, tag: TEXT_TAG, ..page(1.0, None, false) }],
+        "sweep" => {
+            let mut out = Vec::new();
+            for scale in [0.37_f32, 1.0, 1.7, 2.666_667, 5.5, 10.666_667] {
+                out.push(page(scale, None, false));
+                for side in [333_u32, 1024, 2048] {
+                    for (x, y) in [(0_u32, 0_u32), (811, 507), (1500, 900)] {
+                        out.push(page(scale, Some(Tile { x, y, w: side, h: side }), false));
+                    }
+                }
+            }
+            out
+        }
+        other => return Err(format!("unknown scenario `{other}`")),
+    };
+    Ok(requests)
+}
+
+/// Queues `requests` as the canvas does and waits for every answer. Returns the answers, the time
+/// to the first one, and the wall time.
+fn run(pool: &RenderPool, requests: &[RenderRequest]) -> Result<(Vec<RenderedPage>, Duration, Duration), String> {
+    let start = Instant::now();
+    pool.set_queue(requests.to_vec());
+    let mut results = Vec::with_capacity(requests.len());
+    let mut first = None;
+    while results.len() < requests.len() {
+        match pool.try_recv() {
+            Some(page) => {
+                first.get_or_insert_with(|| start.elapsed());
+                results.push(page);
+            }
+            None if start.elapsed() > TIMEOUT => {
+                return Err(format!("{} of {} answers after {TIMEOUT:?}", results.len(), requests.len()));
+            }
+            None => std::thread::sleep(Duration::from_millis(1)),
+        }
+    }
+    Ok((results, first.unwrap_or_default(), start.elapsed()))
+}
+
+/// The canvas's tag for a scale: equal tags mean the same scale to 1/65536.
+fn scale_tag(scale: f32) -> u64 {
+    (f64::from(scale) * 65536.0).round() as u64
+}
+
+/// Folds `bytes` into an FNV-1a hash.
+fn fnv1a(mut hash: u64, bytes: &[u8]) -> u64 {
+    for &byte in bytes {
+        hash ^= u64::from(byte);
+        hash = hash.wrapping_mul(FNV_PRIME);
+    }
+    hash
+}
+
+/// Folds a text layer into `hash`: each glyph's text and boxes, then the line and space structure.
+fn hash_text(mut hash: u64, text: &PageText) -> u64 {
+    for glyph in &text.glyphs {
+        hash = fnv1a(hash, glyph.text.as_bytes());
+        for value in glyph.rect.iter().chain(glyph.quad.iter().flatten()).chain(glyph.direction.iter()) {
+            hash = fnv1a(hash, &value.to_bits().to_le_bytes());
+        }
+    }
+    for line in &text.line_of {
+        hash = fnv1a(hash, &line.to_le_bytes());
+    }
+    for &space in &text.space_before {
+        hash = fnv1a(hash, &[u8::from(space)]);
+    }
+    hash
+}
diff --git a/crates/render/examples/search_bench.rs b/crates/render/examples/search_bench.rs
new file mode 100644
index 000000000..f65d959c5
--- /dev/null
+++ b/crates/render/examples/search_bench.rs
@@ -0,0 +1,29 @@
+//! Synthetic search microbenchmark, including normalization and glyph-range mapping.
+//! Run with `cargo run -p pdfcraft-render --example search_bench --locked` on both revisions
+//! with the same toolchain/profile. Timings are diagnostic, never a CI deadline.
+use pdfcraft_render::{PageText, TextGlyph};
+use std::{hint::black_box, time::Instant};
+
+fn main() {
+    for (name, text, query) in [
+        ("repeated prefix", "a".repeat(131072), format!("{}b", "a".repeat(4095))),
+        ("ordinary", "The quick brown fox jumps over the lazy dog. ".repeat(3000), "brown fox".into()),
+        ("unicode", "İSTANBUL κόσμος Straße العربية 日本語 ".repeat(3000), "istanbul".into()),
+    ] {
+        let glyphs: Vec<_> =
+            text.chars().map(|c| TextGlyph { text: c.to_string(), rect: [0.0; 4], quad: [[0.0; 2]; 4], direction: [1.0, 0.0] }).collect();
+        let n = glyphs.len();
+        let page = PageText { glyphs, line_of: vec![0; n], space_before: vec![false; n] };
+        black_box(page.find(&query));
+        let mut times = Vec::new();
+        for _ in 0..7 {
+            let start = Instant::now();
+            black_box(page.find(black_box(&query)));
+            times.push(start.elapsed().as_secs_f64() * 1000.0);
+        }
+        times.sort_by(f64::total_cmp);
+        if let Some(median) = times.get(3) {
+            println!("{name}: median {median:.3} ms (7 runs, {n} glyphs)");
+        }
+    }
+}
diff --git a/crates/render/examples/synth_sheet.rs b/crates/render/examples/synth_sheet.rs
new file mode 100644
index 000000000..2d31dbf7f
--- /dev/null
+++ b/crates/render/examples/synth_sheet.rs
@@ -0,0 +1,154 @@
+//! Writes a synthetic A1 engineering sheet, for timing large vector pages without the proprietary
+//! sample from storytold/pdfcraft#623 (item 8). It follows the sample's content layout: 1684 × 2384
+//! pt with `/Rotate 90`, one Flate stream of unit-length polyline strokes, each in its own `q … Q`
+//! block with `0.12 0 0 0.12 0 0 cm` and integer coordinates. Almost every stroke starts where the
+//! previous one ended, and most run vertically, as hatching does. Strokes are 2 units wide. A colour
+//! change comes before about 29% of strokes, a twelve-rectangle clip with one fill every 50,000
+//! strokes, and 1,143 labels come last, so a cut in the content loses the labels first. The colour
+//! space is named DeviceRGB, because the sample's ICC space renders at about the same cost, while
+//! CalRGB adds about 0.6 s to every request. The labels use non-embedded Helvetica, so the file
+//! carries no profile or font data.
+//!
+//! Usage: `synth_sheet OUT.pdf [STROKES]`. The default is 4,400,000 strokes (about 277 MB decoded).
+
+use std::error::Error;
+use std::io::Write as _;
+
+use flate2::Compression;
+use flate2::write::ZlibEncoder;
+
+const DEFAULT_STROKES: u64 = 4_400_000;
+/// The sheet spans this many content units (0.12 pt each).
+const SPAN: u64 = 14_000;
+const CLIP_EVERY: u64 = 50_000;
+const LABELS: u64 = 1_143;
+const SEED: u64 = 0x9E37_79B9_7F4A_7C15;
+
+/// xorshift64, so every run writes the same sheet.
+struct Rng(u64);
+
+impl Rng {
+    fn below(&mut self, n: u64) -> u64 {
+        let mut x = self.0;
+        x ^= x << 13;
+        x ^= x >> 7;
+        x ^= x << 17;
+        self.0 = x;
+        x % n
+    }
+}
+
+/// The content stream, compressed as it is written.
+struct Content {
+    encoder: ZlibEncoder<Vec<u8>>,
+    decoded: u64,
+}
+
+impl Content {
+    fn push(&mut self, text: &str) -> std::io::Result<()> {
+        self.encoder.write_all(text.as_bytes())?;
+        self.decoded += text.len() as u64;
+        Ok(())
+    }
+}
+
+/// A colour component in millionths, written with six decimals.
+fn micro(v: i64) -> String {
+    format!("{}.{:06}", v / 1_000_000, v % 1_000_000)
+}
+
+fn main() -> Result<(), Box<dyn Error>> {
+    let args: Vec<String> = std::env::args().collect();
+    let out = args.get(1).ok_or("usage: synth_sheet OUT.pdf [STROKES]")?;
+    let strokes: u64 = match args.get(2) {
+        Some(s) => s.parse()?,
+        None => DEFAULT_STROKES,
+    };
+
+    let mut content = Content { encoder: ZlibEncoder::new(Vec::new(), Compression::default()), decoded: 0 };
+    content.push("q\n0 1 -1 0 1684 0 cm\n1 J\n2 w\n")?;
+    let mut rng = Rng(SEED);
+    let mut colour = [49_509_i64, 49_175, 47_727];
+    let (mut x, mut y) = (rng.below(SPAN), rng.below(SPAN));
+    let (mut clips, mut colour_changes) = (0_u64, 0_u64);
+    for i in 0..strokes {
+        if i % CLIP_EVERY == 0 {
+            // A clip of twelve small rectangles with one fill, as the sample's clips are. The clip
+            // wraps no strokes.
+            content.push("q\n")?;
+            for _ in 0..12 {
+                let (rx, ry) = (rng.below(SPAN), rng.below(SPAN));
+                content.push(&format!("{} {} m\n{} {} l\n{} {} l\n{} {} l\nh\n", rx, ry, rx + 14, ry, rx + 14, ry + 30, rx, ry + 30))?;
+            }
+            content.push("W* n\n/Cs1 cs 0.930000 0.940000 0.960000 sc\n")?;
+            let (rx, ry) = (rng.below(SPAN), rng.below(SPAN));
+            content.push(&format!("{rx} {ry} 14 30 re f\nQ\n"))?;
+            clips += 1;
+        }
+        if rng.below(1000) < 293 {
+            for c in &mut colour {
+                *c = (*c + rng.below(4_001) as i64 - 2_000).clamp(0, 1_000_000);
+            }
+            content.push(&format!("/Cs1 CS {} {} {} SC\n", micro(colour[0]), micro(colour[1]), micro(colour[2])))?;
+            colour_changes += 1;
+        }
+        if rng.below(1000) < 11 {
+            x = rng.below(SPAN);
+            y = rng.below(SPAN);
+        }
+        let (dx, dy) = match rng.below(1000) {
+            0..=693 => (0, 1),
+            694..=845 => (1, 1),
+            846..=992 => (1, 0),
+            _ => (0, 0),
+        };
+        let (nx, ny) = (x + dx, y + dy);
+        content.push(&format!("q\n0.12 0 0 0.12 0 0 cm\n{x} {y} m\n{nx} {ny} l\nS\nQ\n"))?;
+        (x, y) = (nx, ny);
+    }
+    for k in 0..LABELS {
+        let text = if k + 1 == LABELS { "END OF SHEET".to_string() } else { format!("CBL -{}", 100 + k) };
+        let (tx, ty) = (1210 + (k % 30) * 40, 497 + (k / 30) * 12);
+        content.push(&format!("q\n1 0 0 1 0 0 cm\n0 g\nBT\n/F3 1 Tf\n4 0 0 4 {tx} {ty} Tm\n({text}) Tj\nET\nQ\n"))?;
+    }
+    content.push("Q\n")?;
+
+    let Content { encoder, decoded } = content;
+    let stream = encoder.finish()?;
+    let mut stream_object = format!("<< /Length {} /Filter /FlateDecode >>\nstream\n", stream.len()).into_bytes();
+    stream_object.extend_from_slice(&stream);
+    stream_object.extend_from_slice(b"\nendstream");
+
+    let objects: Vec<Vec<u8>> = vec![
+        b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 1684 2384] /Rotate 90 /Contents 4 0 R /Resources << /ColorSpace << /Cs1 /DeviceRGB >> /Font << /F3 5 0 R >> >> >>"
+            .to_vec(),
+        stream_object,
+        b"<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >>"
+            .to_vec(),
+    ];
+    let mut pdf = b"%PDF-1.4\n".to_vec();
+    let mut offsets = Vec::with_capacity(objects.len());
+    for (n, body) in objects.iter().enumerate() {
+        offsets.push(pdf.len());
+        pdf.extend_from_slice(format!("{} 0 obj\n", n + 1).as_bytes());
+        pdf.extend_from_slice(body);
+        pdf.extend_from_slice(b"\nendobj\n");
+    }
+    let xref_at = pdf.len();
+    let size = objects.len() + 1;
+    pdf.extend_from_slice(format!("xref\n0 {size}\n0000000000 65535 f \n").as_bytes());
+    for offset in &offsets {
+        pdf.extend_from_slice(format!("{offset:010} 00000 n \n").as_bytes());
+    }
+    pdf.extend_from_slice(format!("trailer\n<< /Size {size} /Root 1 0 R >>\nstartxref\n{xref_at}\n%%EOF\n").as_bytes());
+    std::fs::write(out, &pdf)?;
+
+    println!(
+        "wrote {out}: {strokes} strokes, {colour_changes} colour changes, {clips} clip groups, {LABELS} labels, {decoded} decoded bytes, {} stream bytes ({:.2}:1)",
+        stream.len(),
+        decoded as f64 / stream.len() as f64
+    );
+    Ok(())
+}
diff --git a/crates/render/src/inspect.rs b/crates/render/src/inspect.rs
index a3af3876b..3c3988b7b 100644
--- a/crates/render/src/inspect.rs
+++ b/crates/render/src/inspect.rs
@@ -5,6 +5,7 @@
 //! remains the compatibility fallback. When neither can inspect a renderable file, panels
 //! are empty and `warnings` says why.
 
+use std::cell::OnceCell;
 use std::collections::{BTreeMap, HashMap, HashSet};
 use std::sync::Arc;
 
@@ -75,6 +76,8 @@ pub struct DocInfo {
     pub layer_groups: Vec<Vec<(u32, u16)>>,
     pub fonts: Vec<FontInfo>,
     pub attachments: Vec<Attachment>,
+    /// Pages with a presentation transition (`/Trans`) or display time (`/Dur`), in page order.
+    pub transitions: Vec<PageTransition>,
     pub warnings: Vec<String>,
 }
 
@@ -89,6 +92,89 @@ pub enum Xfa {
     Dynamic,
 }
 
+/// A page's presentation transition and display time (ISO 32000-2 §12.4.4): how the page comes
+/// into view in a full-screen presentation, and how long it stays before advancing. Only pages
+/// carrying `/Trans` or `/Dur` are listed. Values outside the spec's ranges fall back to the
+/// defaults rather than being refused.
+#[derive(Clone, Debug, PartialEq)]
+pub struct PageTransition {
+    pub page: usize,
+    /// `/Trans /S`; `None` when the page has only `/Dur`.
+    pub style: Option<TransitionStyle>,
+    /// `/D`: how long the transition takes, in seconds (default 1).
+    pub duration: f32,
+    /// `/Dm /H` (true) or `/V` (Split, Blinds).
+    pub horizontal: bool,
+    /// `/M /I` (true) or `/O` (Split, Box, Fly).
+    pub inward: bool,
+    /// `/Di`: 0, 90, 180, 270 or 315 degrees (Wipe, Glitter, Fly, Cover, Uncover, Push); `None`
+    /// for `/None` (Fly only).
+    pub direction: Option<u16>,
+    /// `/SS`: the Fly scale (default 1).
+    pub scale: f32,
+    /// `/B`: Fly with an opaque backdrop.
+    pub opaque: bool,
+    /// `/Dur`: seconds the page shows before the presentation advances; `None` waits for the
+    /// presenter.
+    pub display: Option<f32>,
+}
+
+/// The transition styles of ISO 32000-2 table 164 (`/Trans /S`).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum TransitionStyle {
+    Split,
+    Blinds,
+    Box,
+    Wipe,
+    Dissolve,
+    Glitter,
+    /// `/R`: the next page replaces the old one with no effect (the default).
+    Replace,
+    Fly,
+    Push,
+    Cover,
+    Uncover,
+    Fade,
+}
+
+impl TransitionStyle {
+    /// The style a `/S` name means; an unknown name is `Replace`, the spec's default.
+    pub fn from_name(name: &str) -> Self {
+        match name {
+            "Split" => Self::Split,
+            "Blinds" => Self::Blinds,
+            "Box" => Self::Box,
+            "Wipe" => Self::Wipe,
+            "Dissolve" => Self::Dissolve,
+            "Glitter" => Self::Glitter,
+            "Fly" => Self::Fly,
+            "Push" => Self::Push,
+            "Cover" => Self::Cover,
+            "Uncover" => Self::Uncover,
+            "Fade" => Self::Fade,
+            _ => Self::Replace,
+        }
+    }
+
+    /// The name as written in a PDF (`/S`).
+    pub fn name(self) -> &'static str {
+        match self {
+            Self::Split => "Split",
+            Self::Blinds => "Blinds",
+            Self::Box => "Box",
+            Self::Wipe => "Wipe",
+            Self::Dissolve => "Dissolve",
+            Self::Glitter => "Glitter",
+            Self::Replace => "R",
+            Self::Fly => "Fly",
+            Self::Push => "Push",
+            Self::Cover => "Cover",
+            Self::Uncover => "Uncover",
+            Self::Fade => "Fade",
+        }
+    }
+}
+
 #[derive(Clone, Debug)]
 pub struct PageInfo {
     /// Displayed size in points, after `/Rotate` and `/UserUnit`.
@@ -499,13 +585,17 @@ struct Inspector<'a> {
     /// Named destinations (`/Names /Dests` tree), keyed by raw string bytes, built once.
     /// Looking each name up by walking the tree was O(links × names): minutes on manuals.
     named: HashMap<Vec<u8>, &'a Object>,
+    /// The page of each annotation (the first page that lists it), built when a field's widget
+    /// has no `/P`. Searching every page's `/Annots` for each such field was O(fields ×
+    /// annotations): a second on a form of 8,000 fields.
+    annotation_pages: OnceCell<HashMap<ObjectId, usize>>,
 }
 
 impl<'a> Inspector<'a> {
     fn new(doc: &'a dyn Structure) -> Self {
         let page_ids = doc.page_ids();
         let page_index = page_ids.iter().copied().enumerate().map(|(index, id)| (id, index)).collect();
-        let mut me = Self { doc, page_ids, page_index, named: HashMap::new() };
+        let mut me = Self { doc, page_ids, page_index, named: HashMap::new(), annotation_pages: OnceCell::new() };
         let mut named = HashMap::new();
         if let Some(tree) =
             doc.catalog().ok().and_then(|c| c.get(b"Names").ok()).and_then(|o| me.dict(o)).and_then(|n| n.get(b"Dests").ok()).and_then(|o| me.dict(o))
@@ -543,6 +633,7 @@ impl<'a> Inspector<'a> {
             (info.outline, info.outline_more) = self.outline_window(first);
         }
         self.annotations(info);
+        self.transitions(info);
         let mut field_seen = HashSet::new();
         if let Some(form) = catalog.get(b"AcroForm").ok().and_then(|o| self.dict(o))
             && let Ok(fields) = form.get(b"Fields").and_then(|o| self.resolve(o).as_array())
@@ -591,6 +682,53 @@ impl<'a> Inspector<'a> {
 
     // ── object helpers ──────────────────────────────────────────────────────────────────────
 
+    /// `/Trans` and `/Dur` of every page (ISO 32000-2 §12.4.4), in page order. Lenient: a value
+    /// outside the spec's choices takes that entry's default, and a page with neither entry is
+    /// not listed. Bounded by the page count.
+    fn transitions(&self, info: &mut DocInfo) {
+        for (page, &pid) in self.page_ids.iter().enumerate() {
+            let Ok(d) = self.doc.get_dictionary(pid) else { continue };
+            let display = d.get(b"Dur").ok().and_then(|o| self.resolve(o).as_float().ok()).filter(|s| s.is_finite() && *s >= 0.0);
+            let trans = d.get(b"Trans").ok().and_then(|o| self.dict(o));
+            if trans.is_none() && display.is_none() {
+                continue;
+            }
+            let mut t = PageTransition {
+                page,
+                style: None,
+                duration: 1.0,
+                horizontal: true,
+                inward: true,
+                direction: Some(0),
+                scale: 1.0,
+                opaque: false,
+                display,
+            };
+            if let Some(tr) = trans {
+                t.style = Some(self.name(tr, b"S").map_or(TransitionStyle::Replace, |n| TransitionStyle::from_name(&n)));
+                let num = |key: &[u8]| tr.get(key).ok().and_then(|o| self.resolve(o).as_float().ok()).filter(|v| v.is_finite());
+                t.duration = num(b"D").filter(|d| *d >= 0.0).unwrap_or(1.0);
+                t.horizontal = self.name(tr, b"Dm").as_deref() != Some("V");
+                t.inward = self.name(tr, b"M").as_deref() != Some("O");
+                t.direction = match tr.get(b"Di").map(|o| self.resolve(o)) {
+                    Ok(Object::Name(n)) if n.as_slice() == b"None" => None,
+                    Ok(o) => match o.as_i64().ok() {
+                        Some(0) => Some(0),
+                        Some(90) => Some(90),
+                        Some(180) => Some(180),
+                        Some(270) => Some(270),
+                        Some(315) => Some(315),
+                        _ => Some(0),
+                    },
+                    Err(_) => Some(0),
+                };
+                t.scale = num(b"SS").filter(|s| *s > 0.0).unwrap_or(1.0);
+                t.opaque = matches!(tr.get(b"B").map(|o| self.resolve(o)), Ok(Object::Boolean(true)));
+            }
+            info.transitions.push(t);
+        }
+    }
+
     fn resolve(&self, o: &'a Object) -> &'a Object {
         self.doc.dereference(o).map(|(_, o)| o).unwrap_or(o)
     }
@@ -846,11 +984,19 @@ impl<'a> Inspector<'a> {
         for (start, d) in ranges {
             let first = d.get(b"St").ok().and_then(|o| self.resolve(o).as_i64().ok()).unwrap_or(1).max(1) as u64;
             let prefix = match d.get(b"P").ok().map(|o| self.resolve(o)) {
-                Some(Object::String(raw, _) | Object::Name(raw)) => {
+                Some(Object::String(raw, _)) => {
                     if raw.len() > MAX_PREFIX_BYTES {
                         return Err("a raw prefix exceeds 2050 bytes");
                     }
-                    self.text(d, b"P").unwrap_or_default()
+                    // A label prefix is literal text, not trimmed document metadata.
+                    text_string(raw).trim_matches('\0').to_string()
+                }
+                Some(Object::Name(raw)) => {
+                    if raw.len() > MAX_PREFIX_BYTES {
+                        return Err("a raw prefix exceeds 2050 bytes");
+                    }
+                    // Retain the existing name compatibility and boundary-NUL handling.
+                    String::from_utf8_lossy(raw).trim_matches('\0').to_string()
                 }
                 _ => String::new(),
             };
@@ -1184,17 +1330,25 @@ impl<'a> Inspector<'a> {
         out.push(Field { name: full, kind, value, page, tooltip: self.text(d, b"TU"), has_actions, rect });
     }
 
+    /// The first page whose `/Annots` lists the field or one of its kids.
     fn find_widget_page(&self, field: &Object, kids: &[Object]) -> Option<usize> {
-        let targets: HashSet<ObjectId> =
-            std::iter::once(field).chain(kids.iter()).filter_map(|o| if let Object::Reference(id) = o { Some(*id) } else { None }).collect();
-        if targets.is_empty() {
-            return None;
+        let pages = self.annotation_pages.get_or_init(|| self.annotation_pages());
+        std::iter::once(field).chain(kids).filter_map(|o| if let Object::Reference(id) = o { pages.get(id).copied() } else { None }).min()
+    }
+
+    /// Each annotation listed in a page's `/Annots`, with the first page that lists it.
+    fn annotation_pages(&self) -> HashMap<ObjectId, usize> {
+        let mut pages = HashMap::new();
+        for (idx, &pid) in self.page_ids.iter().enumerate() {
+            let Some(annots) = self.doc.get_dictionary(pid).ok().and_then(|d| d.get(b"Annots").ok()) else { continue };
+            let Ok(annots) = self.resolve(annots).as_array() else { continue };
+            for a in annots {
+                if let Object::Reference(id) = a {
+                    pages.entry(*id).or_insert(idx);
+                }
+            }
         }
-        self.page_index.iter().find_map(|(&pid, &idx)| {
-            let annots = self.doc.get_dictionary(pid).ok()?.get(b"Annots").ok()?;
-            let arr = self.resolve(annots).as_array().ok()?;
-            arr.iter().any(|a| matches!(a, Object::Reference(id) if targets.contains(id))).then_some(idx)
-        })
+        pages
     }
 
     /// The topmost field above widget `id` (itself without a `/Parent`), or `None` when it or an
@@ -1794,6 +1948,78 @@ mod tests {
         assert!(info.warnings[0].contains("physical page numbers"), "{:?}", info.warnings);
     }
 
+    // Contributor-original, blank three-page PDFs. The public importer reads both labels and metadata.
+    fn page_prefix_space_pdf(prefix: Vec<u8>, decimal: bool, indirect: bool) -> Vec<u8> {
+        use lopdf::dictionary;
+        let mut doc = Document::with_version("1.7");
+        let pages_id = doc.new_object_id();
+        let kids: Vec<Object> = (0..3)
+            .map(|_| {
+                doc.add_object(dictionary! {
+                    "Type" => "Page",
+                    "Parent" => pages_id,
+                    "MediaBox" => vec![0.into(), 0.into(), 200.into(), 300.into()],
+                    "Resources" => Dictionary::new(),
+                })
+                .into()
+            })
+            .collect();
+        doc.objects.insert(pages_id, dictionary! { "Type" => "Pages", "Kids" => kids, "Count" => 3 }.into());
+        let prefix = Object::String(prefix, lopdf::StringFormat::Hexadecimal);
+        let prefix = if indirect { Object::Reference(doc.add_object(prefix)) } else { prefix };
+        let mut label = Dictionary::new();
+        label.set("P", prefix);
+        if decimal {
+            label.set("S", Object::Name(b"D".to_vec()));
+        }
+        let labels = dictionary! { "Nums" => vec![Object::Integer(0), Object::Dictionary(label)] };
+        let catalog_id = doc.add_object(dictionary! { "Type" => "Catalog", "Pages" => pages_id, "PageLabels" => labels });
+        let info_id = doc.add_object(dictionary! { "Title" => Object::string_literal("  Metadata title  ") });
+        doc.trailer.set("Root", catalog_id);
+        doc.trailer.set("Info", info_id);
+        let mut bytes = Vec::new();
+        doc.save_to(&mut bytes).expect("write original page-prefix fixture");
+        bytes
+    }
+
+    #[test]
+    fn page_label_prefix_spaces_survive_public_inspection() {
+        let mut utf16 = vec![0xfe, 0xff];
+        utf16.extend(" Ω ".encode_utf16().flat_map(u16::to_be_bytes));
+        for (raw, prefix, decimal, indirect) in [
+            (b" leading".to_vec(), " leading", true, false),
+            (b"trailing ".to_vec(), "trailing ", true, false),
+            (b" both ".to_vec(), " both ", false, false),
+            (b" ".to_vec(), " ", false, false),
+            (b" Caf\xe9 ".to_vec(), " Café ", true, false),
+            (utf16.clone(), " Ω ", true, false),
+            (utf16, " Ω ", false, true),
+            (Vec::new(), "", true, false),
+            (Vec::new(), "", false, false),
+        ] {
+            let bytes = page_prefix_space_pdf(raw, decimal, indirect);
+            let info = inspect(Arc::new(bytes), None).expect("public import of original page-prefix fixture");
+            let expected: Vec<String> = (1..=3)
+                .map(|n| {
+                    if decimal {
+                        format!("{prefix}{n}")
+                    } else if prefix.is_empty() {
+                        n.to_string()
+                    } else {
+                        prefix.to_owned()
+                    }
+                })
+                .collect();
+            assert_eq!(
+                info.pages.iter().map(|p| p.label.clone()).collect::<Vec<_>>(),
+                expected,
+                "{prefix:?}, decimal={decimal}, indirect={indirect}"
+            );
+            assert!(info.warnings.is_empty(), "{:?}", info.warnings);
+            assert_eq!(info.title.as_deref(), Some("Metadata title"), "page-prefix decoding must not change metadata normalization");
+        }
+    }
+
     #[test]
     fn page_label_limits_keep_normal_pdf_numbering() {
         for (style, first, expected) in [
@@ -2036,6 +2262,46 @@ trailer << /Root 1 0 R >>
 trailer << /Root 1 0 R >>
 %%EOF";
 
+    /// `/Trans` and `/Dur` (ISO 32000-2 §12.4.4): read with the spec's defaults for what a page
+    /// leaves out, lenient about what is out of range, and only for pages that have either.
+    const TRANSITIONS: &[u8] = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R 4 0 R 5 0 R 6 0 R 7 0 R] /Count 5 /MediaBox [0 0 200 200] >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /Trans << /Type /Trans /S /Wipe /D 2.5 /Di 270 >> /Dur 5 >> endobj
+4 0 obj << /Type /Page /Parent 2 0 R /Dur 3 >> endobj
+5 0 obj << /Type /Page /Parent 2 0 R /Trans 8 0 R >> endobj
+6 0 obj << /Type /Page /Parent 2 0 R /Trans << /S /Bogus /D (slow) /Di 45 /Dm /Q >> /Dur -1 >> endobj
+7 0 obj << /Type /Page /Parent 2 0 R >> endobj
+8 0 obj << /S /Fly /M /O /SS 0.5 /B true /Di /None /Dm /V >> endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+
+    #[test]
+    fn page_transitions_and_display_times_are_read() {
+        use super::TransitionStyle as S;
+        let info = inspect(Arc::new(TRANSITIONS.to_vec()), None).expect("opens");
+        let t = &info.transitions;
+        assert_eq!(t.iter().map(|t| t.page).collect::<Vec<_>>(), [0, 1, 2, 3], "pages with /Trans or /Dur, in order; page 5 has neither");
+        assert_eq!((t[0].style, t[0].duration, t[0].direction, t[0].display), (Some(S::Wipe), 2.5, Some(270), Some(5.0)));
+        assert!((t[0].horizontal, t[0].inward, t[0].scale, t[0].opaque) == (true, true, 1.0, false), "defaults: {:?}", t[0]);
+        assert_eq!((t[1].style, t[1].duration, t[1].display), (None, 1.0, Some(3.0)), "/Dur without /Trans");
+        assert_eq!(
+            (t[2].style, t[2].inward, t[2].scale, t[2].opaque, t[2].direction, t[2].horizontal),
+            (Some(S::Fly), false, 0.5, true, None, false),
+            "an indirect /Trans: {:?}",
+            t[2]
+        );
+        // Out of range: an unknown style is the spec's default R, a non-numeric /D the default
+        // second, a direction that is not one of the five falls back to 0, a bad /Dm to
+        // horizontal, and a negative /Dur is no display time.
+        assert_eq!(
+            (t[3].style, t[3].duration, t[3].direction, t[3].horizontal, t[3].display),
+            (Some(S::Replace), 1.0, Some(0), true, None),
+            "{:?}",
+            t[3]
+        );
+    }
+
     #[test]
     fn radio_button_layer_groups_are_read() {
         let info = inspect(Arc::new(LAYERS.to_vec()), None).expect("opens");
@@ -2062,6 +2328,70 @@ trailer << /Root 1 0 R >>
         assert_eq!(listed, [("alpha", Some("one"), Some(0)), ("beta", None, Some(0))], "{:?}", info.fields);
     }
 
+    /// A `Structure` that counts the objects read through it.
+    struct CountingReads<'a> {
+        doc: &'a Document,
+        reads: std::cell::Cell<usize>,
+    }
+
+    impl Structure for CountingReads<'_> {
+        fn trailer(&self) -> &Dictionary {
+            &self.doc.trailer
+        }
+        fn get_object(&self, id: ObjectId) -> lopdf::Result<&Object> {
+            self.reads.set(self.reads.get() + 1);
+            self.doc.get_object(id)
+        }
+        fn encrypted(&self) -> bool {
+            false
+        }
+    }
+
+    /// Widgets without `/P` are placed on the page that lists them with one pass over the pages'
+    /// `/Annots`, not a search of every page per field: that was O(fields × annotations), a
+    /// second to open a form of 8,000 fields. A widget two pages list is on the first of them.
+    #[test]
+    fn widgets_without_a_page_entry_are_placed_in_one_pass() {
+        const PAGES: usize = 100;
+        const PER_PAGE: usize = 10;
+        let field = |p: usize, k: usize| 4 + PAGES + p * PER_PAGE + k;
+        let mut pdf = String::from("%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R /AcroForm 3 0 R >> endobj\n");
+        let kids: Vec<String> = (0..PAGES).map(|p| format!("{} 0 R", 4 + p)).collect();
+        pdf += &format!("2 0 obj << /Type /Pages /Kids [{}] /Count {PAGES} >> endobj\n", kids.join(" "));
+        let fields: Vec<String> = (0..PAGES).flat_map(|p| (0..PER_PAGE).map(move |k| format!("{} 0 R", field(p, k)))).collect();
+        pdf += &format!("3 0 obj << /Fields [{}] >> endobj\n", fields.join(" "));
+        for p in 0..PAGES {
+            let mut annots: Vec<String> = (0..PER_PAGE).map(|k| format!("{} 0 R", field(p, k))).collect();
+            // The last page lists the first page's first widget too.
+            if p == PAGES - 1 {
+                annots.push(format!("{} 0 R", field(0, 0)));
+            }
+            pdf += &format!("{} 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots [{}] >> endobj\n", 4 + p, annots.join(" "));
+        }
+        for p in 0..PAGES {
+            for k in 0..PER_PAGE {
+                pdf += &format!("{} 0 obj << /Type /Annot /Subtype /Widget /FT /Tx /T (f{p}_{k}) /Rect [10 10 90 30] >> endobj\n", field(p, k));
+            }
+        }
+        pdf += "trailer << /Root 1 0 R >>\n%%EOF";
+        let doc = Document::load_mem(pdf.as_bytes()).expect("loads");
+        let counting = CountingReads { doc: &doc, reads: std::cell::Cell::new(0) };
+        let mut info = DocInfo {
+            pages: (0..PAGES)
+                .map(|_| PageInfo { width: 200.0, height: 200.0, crop: [0.0, 0.0, 200.0, 200.0], rotation: 0, label: String::new() })
+                .collect(),
+            ..Default::default()
+        };
+        Inspector::new(&counting).fill(&mut info);
+        let placed: Vec<_> = info.fields.iter().map(|f| (f.name.clone(), f.page)).collect();
+        let want: Vec<_> = (0..PAGES).flat_map(|p| (0..PER_PAGE).map(move |k| (format!("f{p}_{k}"), Some(p)))).collect();
+        assert_eq!(placed, want);
+        // A handful of reads per page and field; searching the pages for each field read the
+        // page dictionaries about 50,000 times.
+        let reads = counting.reads.get();
+        assert!(reads < 20 * (PAGES + PAGES * PER_PAGE), "{reads} object reads");
+    }
+
     #[test]
     fn lazy_structure_matches_the_compatibility_inspector() {
         // Each fixture as lopdf writes it, and with its objects in object streams.
diff --git a/crates/render/src/lib.rs b/crates/render/src/lib.rs
index ae146779f..cc1e4af2e 100644
--- a/crates/render/src/lib.rs
+++ b/crates/render/src/lib.rs
@@ -14,10 +14,11 @@ mod raster;
 mod reading;
 mod structure;
 pub mod text;
+pub mod transition;
 
 pub use inspect::{
     Annotation, Attachment, AttachmentSource, DestView, DocInfo, Field, FieldKind, FontInfo, Layer, LayerOp, Link, LinkTarget, OutlineItem, PageInfo,
-    RemoteDestination, Xfa, attachment_data, check_pages, inspect, pretty_date,
+    PageTransition, RemoteDestination, TransitionStyle, Xfa, attachment_data, check_pages, inspect, pretty_date,
 };
 pub use pixels::Pixels;
 pub use raster::{
diff --git a/crates/render/src/raster.rs b/crates/render/src/raster.rs
index 4ad719662..17afd82c7 100644
--- a/crates/render/src/raster.rs
+++ b/crates/render/src/raster.rs
@@ -433,6 +433,14 @@ impl PageRenderer {
         self.stats
     }
 
+    /// Extract one page for statistics, with semantic exclusions. Never rasterizes or panics.
+    pub fn filtered_text(&mut self, page: usize, filter: crate::text::TextFilter) -> Result<crate::PageText, String> {
+        let pdf = self.pdf.as_ref().ok_or("the document could not be parsed")?;
+        self.stats.text_interpretations = self.stats.text_interpretations.saturating_add(1);
+        catch_unwind(AssertUnwindSafe(|| crate::text::extract_page_filtered(pdf, page, &self.settings, filter)))
+            .map_err(|e| format!("text extraction failed: {}", panic_message(&e)))?
+    }
+
     /// Render one page. Never panics.
     pub fn render(&mut self, req: RenderRequest) -> RenderedPage {
         let start = Stopwatch::start();
@@ -1110,6 +1118,8 @@ fn worker(
                         if lock(&shared.busy).get_mut(id).is_none_or(|slot| slot.take().is_none()) {
                             return;
                         }
+                        // Release the active key, retrying if demand returned during parsing.
+                        shared.queue.retry(req);
                         continue;
                     }
                     let _ = parsed.set(init);
@@ -2147,6 +2157,62 @@ mod tests {
         }
     }
 
+    #[cfg(not(target_arch = "wasm32"))]
+    fn check_cancelled_parse_request_requeue(renew_before_abort: bool) {
+        use super::*;
+        use std::{sync::mpsc, time::Duration};
+
+        let pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 1, RenderConfig::default());
+        let a = RenderRequest { page: 0, kind: RequestKind::Text, scale: 1.0, tag: 501, ..Default::default() };
+        let b = RenderRequest { page: 1, scale: 1.0, tag: 502, ..Default::default() };
+        let parse = parse_gate();
+        *lock(&pool.shared.parse_gate) = Some(parse.clone());
+        let (entered_tx, entered_rx) = mpsc::channel();
+        let (release_tx, release_rx) = mpsc::channel();
+        *lock(&pool.shared.busy_publish_gate) = Some(BusyPublishGate { request: b, entered: entered_tx, release: Arc::new(Mutex::new(release_rx)) });
+
+        pool.set_queue(vec![a]);
+        parse.entered.wait();
+        pool.set_queue(vec![b]);
+        if renew_before_abort {
+            // B stays first so the worker reaches its gate even when aborting A requeues it.
+            pool.set_queue(vec![b, a]);
+        }
+        parse.release.wait();
+        entered_rx.recv_timeout(Duration::from_secs(2)).expect("the worker finished aborting A and reached B");
+        // The parse hook's lock can span its barrier waits; clear it only after parsing returned.
+        *lock(&pool.shared.parse_gate) = None;
+        if !renew_before_abort {
+            pool.set_queue(vec![a]);
+        }
+        // B holds the sole worker, so this observes queue admission without racing a worker pop.
+        let pending = pool.shared.queue.pop();
+        if let Some(request) = pending {
+            pool.shared.queue.retry(request);
+        }
+        pool.set_queue(vec![a]);
+        // Release the worker before the regression assertion, including on the unfixed baseline.
+        release_tx.send(()).unwrap();
+        assert_eq!(pending, Some(a), "aborting a parse must release its active request identity");
+
+        let page = receive_before_deadline(&pool);
+        assert_eq!(page.request, a);
+        assert!(page.error.is_none(), "renewed text request failed: {:?}", page.error);
+        assert!(page.text.is_some(), "the exact cancelled text request completed");
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn cancelled_parse_request_can_be_requested_again() {
+        check_cancelled_parse_request_requeue(false);
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn cancelled_parse_request_renewed_before_abort_is_requeued() {
+        check_cancelled_parse_request_requeue(true);
+    }
+
     #[cfg(not(target_arch = "wasm32"))]
     #[test]
     fn request_removed_before_busy_publication_skips_parser_acquisition() {
@@ -2968,6 +3034,67 @@ trailer << /Root 1 0 R >>
         }
     }
 
+    /// #1968: the highlight appearance other editors write, a transparency group whose content is
+    /// filled with `/BM /Multiply`, drew as an opaque block over the text. Every `/Group` form
+    /// got a layer of its own, so the Multiply blended with that layer's transparent backdrop
+    /// and the layer then covered the page. Vendored hayro-interpret patch: a group that is not
+    /// isolated (ISO 32000-2 §11.4.7: its elements composite with what is already on the page)
+    /// and is entered at full opacity, with no soft mask and Normal blending, has no backdrop of
+    /// its own to offer, so its content is drawn straight onto the page. An isolated group
+    /// (`/I true`) keeps its blank backdrop, and a group entered at partial opacity still gets
+    /// its layer so that opacity applies to the group as a whole.
+    #[test]
+    fn a_multiply_highlight_inside_a_transparency_group_keeps_the_text() {
+        // `annots`: the form drawn as the highlight's appearance; `page`: drawn from the page
+        // content instead, with the extra graphics state in front of the `Do`.
+        let render = |group: &str, annots: &str, page: &str| {
+            let content = format!("0 g 100 40 10 20 re f {page}");
+            let form = "/GS0 gs 1 1 0 rg 15 35 105 30 re f";
+            let pdf = format!(
+                "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 100] /Contents 4 0 R {annots} /Resources << /XObject << /Fx 6 0 R >> /ExtGState << /Half << /ca 0.5 >> >> >> >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+5 0 obj << /Type /Annot /Subtype /Highlight /Rect [15 35 120 65] /QuadPoints [15 65 120 65 15 35 120 35] /C [1 1 0] /AP << /N 6 0 R >> >> endobj
+6 0 obj << /Type /XObject /Subtype /Form /BBox [15 35 120 65] {group} /Resources << /ExtGState << /GS0 << /BM /Multiply /CA 1 /ca 1 >> >> >> /Length {} >> stream
+{form}
+endstream endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+                content.len(),
+                form.len()
+            );
+            let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+            let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+            assert!(p.error.is_none(), "{group}: {:?}", p.error);
+            p
+        };
+        let px = |p: &RenderedPage, x: u32, y: u32| p.rgba[((y * p.width + x) * 4) as usize..][..4].to_vec();
+        let (white, black, yellow) = (vec![255, 255, 255, 255], vec![0, 0, 0, 255], vec![255, 255, 0, 255]);
+        let annots = "/Annots [5 0 R]";
+        let plain = "/Group << /S /Transparency /CS /DeviceRGB >>";
+        let explicit = "/Group << /S /Transparency /CS /DeviceRGB /I false /K false >>";
+        for group in [plain, explicit, ""] {
+            for (annots, page) in [(annots, ""), ("", "/Fx Do")] {
+                let p = render(group, annots, page);
+                assert_eq!(px(&p, 30, 50), yellow, "{group} {page}: filled with the highlight colour");
+                assert_eq!(px(&p, 105, 50), black, "{group} {page}: Multiply keeps the text underneath");
+                assert_eq!(px(&p, 150, 50), white, "{group} {page}: outside the appearance");
+            }
+        }
+        // Isolated: the group's own transparent backdrop is all the Multiply sees (§11.4.7).
+        let p = render("/Group << /S /Transparency /CS /DeviceRGB /I true >>", annots, "");
+        assert_eq!(px(&p, 105, 50), yellow, "an isolated group starts from a blank backdrop");
+        // Entered at half opacity, the group is still composited as one: half yellow over white.
+        let p = render(plain, "", "/Half gs /Fx Do");
+        let half = px(&p, 30, 50);
+        assert!(half[0] == 255 && half[1] == 255 && (120..=136).contains(&half[2]), "{half:?}");
+        assert_eq!(px(&p, 150, 50), white);
+    }
+
     /// A Highlight annotation without an appearance stream (common in older and generated files)
     /// was not drawn at all. Vendored hayro-interpret patch: its /QuadPoints are filled with /C at
     /// /CA, blended with Multiply, as PdfCraft draws its own highlights (pdfcraft-annot); MuPDF,
@@ -3472,6 +3599,38 @@ trailer << /Root 1 0 R >>
         page(&format!("q 20 0 0 20 5 5 cm /Im1 Do Q {red}"), fax);
     }
 
+    /// Scanners and fax services write Group 4 pages with `/Rows 0`, which ISO 32000-2 Table 11
+    /// defines as "height not predetermined" (the default), not as zero rows. Such a page used to
+    /// render blank. The image is an 8 × 4 all-black Group 4 stream, hand-encoded from ITU-T T.6:
+    /// one horizontal-mode row (white 0, black 8), three V0 rows, then EOFB.
+    #[test]
+    fn group4_fax_with_rows_zero_decodes_to_the_image_height() {
+        const ALL_BLACK_8X4: [u8; 6] = [0x26, 0xa2, 0xfe, 0x00, 0x20, 0x02];
+        for rows in ["", "/Rows 4", "/Rows 0"] {
+            let content = "q 20 0 0 20 5 5 cm /Im1 Do Q";
+            let mut pdf = format!(
+                "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /XObject << /Im1 5 0 R >> >> >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+5 0 obj << /Type /XObject /Subtype /Image /Width 8 /Height 4 /ColorSpace /DeviceGray /BitsPerComponent 1 /Filter /CCITTFaxDecode /DecodeParms << /K -1 /Columns 8 {rows} >> /Length {} >> stream\n",
+                content.len(),
+                ALL_BLACK_8X4.len()
+            )
+            .into_bytes();
+            pdf.extend_from_slice(&ALL_BLACK_8X4);
+            pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF");
+            let mut renderer = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+            let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+            assert!(page.error.is_none(), "{rows:?}: {:?}", page.error);
+            assert_eq!(&page.rgba[((24 * 40 + 15) * 4)..][..4], &[0, 0, 0, 255], "{rows:?}: the fax image paints black");
+            assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 255, 255, 255], "{rows:?}: outside the image stays white");
+        }
+    }
+
     #[test]
     fn tiff_predictor_packed_rgb_rows_keep_their_byte_boundaries() {
         use hayro_syntax::object::{FromBytes, Object};
@@ -4303,8 +4462,8 @@ trailer << /Root 1 0 R >>
     /// Found while triaging `cargo xtask fuzz` on Windows, by hand rather than by the fuzzer
     /// (random mutations almost never make a high-ratio stream): a 2 MB page whose content
     /// stream, or whose 8 × 8 image, inflated to 2 GB took the renderer past 3 GB in under a
-    /// second. Flate (through flate2 and through the fallback inflater), LZW and RunLength expand
-    /// without limit. Vendored hayro-syntax patch: each stops at `MAX_DECODED_STREAM`, and an image
+    /// second. Flate (through flate2 and through the fallback inflater), LZW, RunLength and ASCII85
+    /// (#1796: each `z` is four bytes, here after Flate) expand without limit. Vendored hayro-syntax patch: each stops at `MAX_DECODED_STREAM`, and an image
     /// of known size at its own rows.
     #[test]
     fn decompression_bombs_stop_at_the_stream_limit() {
@@ -4314,11 +4473,14 @@ trailer << /Root 1 0 R >>
         let big = limit + (32 << 20);
         let mut run_length = [0x81u8, 0].repeat(big / 128 + 1); // runs of 128 zeros
         run_length.push(128);
-        let streams: [(&str, Vec<u8>); 4] = [
+        let mut a85 = flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::best());
+        std::io::Write::write_all(&mut a85, &b"z".repeat(big / 4 + 1)).unwrap();
+        let streams: [(&str, Vec<u8>); 5] = [
             ("/FlateDecode", zlib_zeros(big)),
             ("/FlateDecode", deflate_for_the_fallback(big)),
             ("/LZWDecode", lzw_zeros(big / 7_000_000 + 1)),
             ("/RunLengthDecode", run_length),
+            ("[/FlateDecode /ASCII85Decode]", a85.finish().unwrap()),
         ];
         let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] >> endobj\n".to_vec();
         for (i, (filter, data)) in streams.iter().enumerate() {
@@ -4329,7 +4491,7 @@ trailer << /Root 1 0 R >>
         pdf.extend_from_slice(b"trailer << /Root 1 0 R >>\n%%EOF\n");
         let doc = Pdf::new(pdf).expect("parses");
         let found: Vec<Stream<'_>> = doc.objects().into_iter().filter_map(|o| if let Object::Stream(s) = o { Some(s) } else { None }).collect();
-        assert_eq!(found.len(), 4, "all four bomb streams are found");
+        assert_eq!(found.len(), 5, "all five bomb streams are found");
         for stream in &found {
             let what = format!("{:?}", stream.filters());
             let decoded = stream.decoded().expect("a bomb still decodes, up to the limit");
@@ -5135,6 +5297,194 @@ trailer << /Root 1 0 R >>
         }
     }
 
+    // Contributor-original classic-xref vector fixtures; no embedded or external assets.
+    fn raw_crop_unit_pdf(unit: f64, rotation: i32, crop: [f64; 4], marker: Option<[f64; 4]>) -> Vec<u8> {
+        let bounds = crop.map(|n| n.to_string()).join(" ");
+        let body = marker.map(|rect| format!("0 0 0 rg {} re f\n", rect.map(|n| n.to_string()).join(" "))).unwrap_or_default();
+        let objects = [
+            "<< /Type /Catalog /Pages 2 0 R >>".to_owned(),
+            "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_owned(),
+            format!(
+                "<< /Type /Page /Parent 2 0 R /MediaBox [{bounds}] /CropBox [{bounds}] /UserUnit {unit} /Rotate {rotation} /Resources << >> /Contents 4 0 R >>"
+            ),
+            format!("<< /Length {} >>\nstream\n{body}\nendstream", body.len()),
+        ];
+        let mut bytes = b"%PDF-1.7\n".to_vec();
+        let mut offsets = Vec::new();
+        for (i, object) in objects.iter().enumerate() {
+            offsets.push(bytes.len());
+            bytes.extend_from_slice(format!("{} 0 obj\n{object}\nendobj\n", i + 1).as_bytes());
+        }
+        let xref = bytes.len();
+        bytes.extend_from_slice(b"xref\n0 5\n0000000000 65535 f \n");
+        for offset in offsets {
+            bytes.extend_from_slice(format!("{offset:010} 00000 n \n").as_bytes());
+        }
+        bytes.extend_from_slice(format!("trailer << /Size 5 /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n").as_bytes());
+        bytes
+    }
+
+    #[test]
+    fn raw_crop_user_unit_inspection_keeps_observed_dimensions() {
+        let bytes = raw_crop_unit_pdf(4096.0, 0, [0.0, 0.0, 0.1, 0.1], None);
+        let info = crate::inspect(Arc::new(bytes), None).expect("original valid raw-0.1 PDF");
+        assert_eq!(info.pages.len(), 1);
+        assert!(info.warnings.is_empty(), "{:?}", info.warnings);
+        let page = &info.pages[0];
+        assert!(
+            (page.width - 409.6).abs() < 0.0001 && (page.height - 409.6).abs() < 0.0001,
+            "raw 0.1 at UserUnit4096 is 409.6 points, got {} by {}",
+            page.width,
+            page.height
+        );
+    }
+
+    #[test]
+    fn raw_crop_unit_floor_corners_match_nonzero_origin_and_rotations() {
+        use hayro::hayro_interpret::TransformExt;
+
+        for (unit, width, height, dx, dy) in
+            [(1.0, 1.0, 1.0, 0.125, 0.25), (4096.0, 512.0, 1024.0, 512.0, 1024.0), (75000.0, 9375.0, 18750.0, 9375.0, 18750.0)]
+        {
+            for rotation in [0, 90, 180, 270] {
+                let bytes = raw_crop_unit_pdf(unit, rotation, [10.0, 20.0, 10.125, 20.25], None);
+                let info = crate::inspect(Arc::new(bytes.clone()), None).expect("original valid offset crop");
+                assert!(info.warnings.is_empty(), "{:?}", info.warnings);
+                let dimensions = if rotation % 180 == 0 { (width as f32, height as f32) } else { (height as f32, width as f32) };
+                assert_eq!((info.pages[0].width, info.pages[0].height), dimensions, "unit={unit}, rotation={rotation}");
+                let pdf = Pdf::new(Arc::new(bytes)).expect("same PDF parser");
+                let page = pdf.pages().first().expect("one page");
+                assert_eq!(page.base_dimensions(), ((width / unit) as f32, (height / unit) as f32));
+                let transform = page.initial_transform(true).to_kurbo();
+                let (origin, opposite) = match rotation {
+                    0 => ([0.0, height], [dx, height - dy]),
+                    90 => ([0.0, 0.0], [dy, dx]),
+                    180 => ([width, 0.0], [width - dx, dy]),
+                    _ => ([height, width], [height - dy, width - dx]),
+                };
+                for (point, expected) in [(kurbo::Point::new(10.0, 20.0), origin), (kurbo::Point::new(10.125, 20.25), opposite)] {
+                    let actual = transform * point;
+                    assert!(
+                        (actual.x - expected[0]).abs() < 1e-9 && (actual.y - expected[1]).abs() < 1e-9,
+                        "unit={unit}, rotation={rotation}, point={point:?}: {actual:?} != {expected:?}"
+                    );
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn raw_crop_unit_floor_reciprocal_does_not_trigger_letter_fallback() {
+        for unit in [1.0, 41.0, 47.0] {
+            let bytes = raw_crop_unit_pdf(unit, 0, [0.0, 0.0, 0.01, 0.01], None);
+            let pdf = Pdf::new(Arc::new(bytes.clone())).expect("ordinary small crop");
+            let page = pdf.pages().first().expect("one page");
+            let (width, height) = page.base_dimensions();
+            // In f32, the nearest reciprocal of 41 or 47 multiplies back to 0.99999994.
+            assert!(
+                width * page.user_unit() >= 1.0 && height * page.user_unit() >= 1.0,
+                "unit={unit}: floor must not round below one physical point"
+            );
+            let info = crate::inspect(Arc::new(bytes), None).expect("inspect the same small crop");
+            let page = &info.pages[0];
+            assert!(
+                (1.0..=1.000001).contains(&page.width) && (1.0..=1.000001).contains(&page.height),
+                "unit={unit}: one-point floor must not become a Letter placeholder: {} by {}",
+                page.width,
+                page.height
+            );
+            assert!(info.warnings.is_empty(), "{:?}", info.warnings);
+        }
+    }
+
+    #[test]
+    fn raw_crop_unit_floor_preserves_nearly_zero_fallback() {
+        for unit in [1.0, 4096.0, 75000.0] {
+            for side in [0.0, 0.0001] {
+                let bytes = raw_crop_unit_pdf(unit, 0, [0.0, 0.0, side, side], None);
+                let pdf = Pdf::new(Arc::new(bytes)).expect("existing degenerate-page fallback");
+                let page = pdf.pages().first().expect("one page");
+                // Existing A4 raw fallback remains raw A4, then scales by the page unit.
+                let expected = (595.2755905511812_f64 as f32, 841.8897637795277_f64 as f32);
+                assert_eq!(page.base_dimensions(), expected, "unit={unit}, raw side={side}");
+                assert_eq!(page.render_dimensions(), (expected.0 * unit as f32, expected.1 * unit as f32));
+            }
+        }
+    }
+
+    fn raw_crop_ink(page: &RenderedPage) -> ([u32; 4], usize) {
+        let (mut left, mut top, mut right, mut bottom, mut count) = (page.width, page.height, 0, 0, 0);
+        for (i, pixel) in page.rgba.as_chunks::<4>().0.iter().enumerate() {
+            if pixel[0] < 128 && pixel[1] < 128 && pixel[2] < 128 {
+                let (x, y) = (i as u32 % page.width, i as u32 / page.width);
+                left = left.min(x);
+                top = top.min(y);
+                right = right.max(x + 1);
+                bottom = bottom.max(y + 1);
+                count += 1;
+            }
+        }
+        assert!(count > 0, "original vector marker must draw");
+        ([left, top, right, bottom], count)
+    }
+
+    #[test]
+    fn raw_crop_user_unit_vector_rasters_match_physical_controls() {
+        for (unit, scale, width, height, physical_width, physical_height, rects) in [
+            (
+                4096.0,
+                0.5,
+                256,
+                512,
+                512.0,
+                1024.0,
+                [[32.0, 320.0, 96.0, 448.0], [64.0, 32.0, 192.0, 96.0], [160.0, 64.0, 224.0, 192.0], [320.0, 160.0, 448.0, 224.0]],
+            ),
+            (
+                75000.0,
+                0.04,
+                375,
+                750,
+                9375.0,
+                18750.0,
+                [
+                    [46.875, 468.75, 140.625, 656.25],
+                    [93.75, 46.875, 281.25, 140.625],
+                    [234.375, 93.75, 328.125, 281.25],
+                    [468.75, 234.375, 656.25, 328.125],
+                ],
+            ),
+        ] {
+            for (index, rotation) in [0, 90, 180, 270].into_iter().enumerate() {
+                let raw_crop = [10.0, 20.0, 10.125, 20.25];
+                let raw_marker = [10.015625, 20.03125, 0.03125, 0.0625];
+                let control_crop = raw_crop.map(|n| n * unit);
+                let control_marker = raw_marker.map(|n| n * unit);
+                let physical = if rotation % 180 == 0 { (physical_width, physical_height) } else { (physical_height, physical_width) };
+                let pixels = if rotation % 180 == 0 { (width, height) } else { (height, width) };
+                let render = |bytes: Vec<u8>| {
+                    let info = crate::inspect(Arc::new(bytes.clone()), None).expect("bounded original vector PDF");
+                    assert_eq!((info.pages[0].width, info.pages[0].height), physical, "check dimensions before any raster allocation");
+                    let mut renderer = PageRenderer::new(Arc::new(bytes), RenderConfig::default());
+                    let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale, ..Default::default() });
+                    assert!(page.error.is_none(), "{:?}", page.error);
+                    assert_eq!((page.width, page.height), pixels);
+                    page
+                };
+                let high = render(raw_crop_unit_pdf(unit, rotation, raw_crop, Some(raw_marker)));
+                let control = render(raw_crop_unit_pdf(1.0, rotation, control_crop, Some(control_marker)));
+                let (bbox, count) = raw_crop_ink(&high);
+                for (actual, expected) in bbox.into_iter().zip(rects[index]) {
+                    assert!((f64::from(actual) - expected).abs() <= 1.0, "unit={unit}, rotation={rotation}: {bbox:?} != {:?}", rects[index]);
+                }
+                let (control_bbox, control_count) = raw_crop_ink(&control);
+                assert_eq!(bbox, control_bbox, "unit={unit}, rotation={rotation}: marker placement");
+                assert_eq!(count, control_count, "unit={unit}, rotation={rotation}: visible marker ink");
+                assert!(high.rgba == control.rgba, "unit={unit}, rotation={rotation}: physically equivalent crops render identically");
+            }
+        }
+    }
+
     /// A page's `/UserUnit` (the size of its unit in points) scales the page and everything on
     /// it, after the crop box and before `/Rotate`, as Acrobat shows such pages: with
     /// `/UserUnit 2`, scale 1 renders pixel for pixel what scale 2 renders without it. As in
@@ -5267,6 +5617,56 @@ trailer << /Root 1 0 R >>
         assert_eq!(pixel(&on, 150, 55), &[255, 255, 255, 255], "the image's white quadrant stays white");
     }
 
+    /// Reading colours replace *document* colours, never annotation colours (issue #1548): a
+    /// highlight keeps its `/C`, so on a dark background the content under it shows through the
+    /// Multiply blend in the highlight's colour instead of being darkened into invisibility.
+    /// Both annotation paths are covered: the `/AP` appearance stream and the no-`/AP`
+    /// `/QuadPoints` fallback.
+    #[test]
+    fn reading_colors_keep_highlight_annotations_readable() {
+        let content = "0 g 100 40 10 20 re f";
+        let pdf = format!(
+            "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 100] /Contents 4 0 R /Annots [5 0 R] >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+5 0 obj << /Type /Annot /Subtype /Highlight /Rect [15 35 120 65] /QuadPoints [15 65 120 65 15 35 120 35] /C [1 1 0] {{annot}} >> endobj
+6 0 obj << /Type /XObject /Subtype /Form /BBox [15 35 120 65] /Length 24 >> stream
+0 0 1 rg 15 35 50 30 re f
+endstream endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+            content.len()
+        );
+        let render = |annot: &str| {
+            let mut r = PageRenderer::new(
+                Arc::new(pdf.replace("{annot}", annot).into_bytes()),
+                RenderConfig { reading_colors: ReadingColors::WHITE_ON_BLACK, ..Default::default() },
+            );
+            let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+            assert!(p.error.is_none(), "{annot}: {:?}", p.error);
+            p
+        };
+        let px = |p: &RenderedPage, x: u32, y: u32| p.rgba[((y * p.width + x) * 4) as usize..][..4].to_vec();
+
+        // No /AP: the page's black rectangle is remapped to white (document line art), the
+        // yellow fill is not, so Multiply leaves the content under the quad yellow — readable.
+        let p = render("");
+        assert_eq!(px(&p, 5, 5), vec![0, 0, 0, 255], "the page clears to the background");
+        assert_eq!(px(&p, 105, 50), vec![255, 255, 0, 255], "content under the quad shows through in the highlight's colour");
+        assert_eq!(px(&p, 30, 50), vec![0, 0, 0, 255], "the band itself multiplies into the dark background, as in Acrobat");
+        assert_eq!(px(&p, 150, 50), vec![0, 0, 0, 255], "outside the quad");
+
+        // With /AP the appearance's blue is an annotation colour too and stays blue instead of
+        // being remapped towards white by its luminance.
+        let p = render("/AP << /N 6 0 R >>");
+        assert_eq!(px(&p, 30, 50), vec![0, 0, 255, 255], "the appearance keeps its own colour");
+        assert_eq!(px(&p, 90, 50), vec![0, 0, 0, 255], "outside the appearance's own drawing");
+    }
+
     /// A print-preview request (`PRINT_TAG`) renders the document's true colours even though
     /// the document's config carries reading colours: a preview's job is fidelity to the
     /// printout, which is imposed from the uncoloured document. Covers both render paths —
@@ -5579,6 +5979,154 @@ endstream endobj
         assert_eq!(rgb_at(&out.rgba, w, 100, 35), [255, 0, 0]);
     }
 
+    /// Render `pdf`'s first page at 72 dpi with no time limit beyond the test's own.
+    fn render_first_page(pdf: Vec<u8>) -> RenderedPage {
+        let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+        let out = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, preview: false });
+        assert!(out.error.is_none(), "{:?}", out.error);
+        out
+    }
+
+    /// A spot-colour image runs its tint transform once per possible sample, not once per pixel
+    /// (vendored hayro-interpret patch 28). Fillable character sheets draw their background art
+    /// as an 8-bit DeviceN image whose tint transform is a PostScript calculator program: run for
+    /// each of a 3304 × 4105 background's pixels, every page took four seconds and 430 MB to
+    /// draw, again after each field was filled. This image (2048 × 2048, a 9,000-operator
+    /// program) took about 40 seconds that way; from a 256-entry table it takes milliseconds.
+    #[test]
+    fn spot_colour_images_run_their_tint_transform_once_per_sample_value() {
+        const SIDE: usize = 2048;
+        // 8,990 operators that change nothing (the calculator allows 10,000 a run), then
+        // tint t → RGB (1 − t, t, 0).
+        let program = format!("{{ {}dup 1 exch sub exch 0 }}", "dup pop ".repeat(4495));
+        // Each row: tint 0 on the left half, tint 1 on the right.
+        let row: Vec<u8> = [vec![0u8; SIDE / 2], vec![255u8; SIDE / 2]].concat();
+        let data = row.repeat(SIDE);
+        let image = format!(
+            "<< /Type /XObject /Subtype /Image /Width {SIDE} /Height {SIDE} /ColorSpace [/Separation /Spot /DeviceRGB 6 0 R] /BitsPerComponent 8 /Length {} >>",
+            data.len()
+        );
+        let function = format!("<< /FunctionType 4 /Domain [0 1] /Range [0 1 0 1 0 1] /Length {} >>", program.len());
+        let pdf =
+            image_cache_pdf("q 130 0 0 70 0 0 cm /A Do Q", "<< /XObject << /A 5 0 R >> >>", &[(&image, &data), (&function, program.as_bytes())]);
+        let (tx, rx) = std::sync::mpsc::channel();
+        std::thread::spawn(move || {
+            let _ = tx.send(render_first_page(pdf));
+        });
+        let out = rx.recv_timeout(std::time::Duration::from_secs(10)).expect("a spot-colour image must not run its tint transform for every pixel");
+        let w = out.width as usize;
+        assert_eq!(rgb_at(&out.rgba, w, 10, 35), [255, 0, 0], "tint 0");
+        assert_eq!(rgb_at(&out.rgba, w, 120, 35), [0, 255, 0], "tint 1");
+    }
+
+    /// Images converted through patch 28's table keep the colour of every sample: the samples of
+    /// a pixel in order, each through its own `/Decode` range, rows that end mid-byte, and an image
+    /// whose data stops part-way through a row (that row is padded with decoded zeros, as before).
+    #[test]
+    fn images_converted_through_a_table_keep_every_samples_colour() {
+        let close = |got: [u8; 3], want: [u8; 3], at: (usize, usize)| {
+            assert!(got.iter().zip(want).all(|(g, w)| g.abs_diff(w) <= 1), "pixel {at:?}: got {got:?}, want {want:?}");
+        };
+        // DeviceN of two inks at 4 bits (256 possible pixels) shown as RGB (a, b, 0), the first
+        // ink's range reversed. 32 × 16 pixels, each drawn 4 pt square.
+        let mut data = Vec::new();
+        for y in 0..16 {
+            for x in 0..32 {
+                let (a, b) = (x % 16, (x / 16 + 2 * y) % 16);
+                data.push(((a << 4) | b) as u8);
+            }
+        }
+        let image = format!(
+            "<< /Type /XObject /Subtype /Image /Width 32 /Height 16 /ColorSpace [/DeviceN [/A /B] /DeviceRGB 6 0 R] /BitsPerComponent 4 /Decode [1 0 0 1] /Length {} >>",
+            data.len()
+        );
+        let pdf = image_cache_pdf(
+            "q 128 0 0 64 0 0 cm /A Do Q",
+            "<< /XObject << /A 5 0 R >> >>",
+            &[(&image, &data), ("<< /FunctionType 4 /Domain [0 1 0 1] /Range [0 1 0 1 0 1] /Length 5 >>", b"{ 0 }")],
+        );
+        let out = render_first_page(pdf);
+        let w = out.width as usize;
+        for y in 0..16 {
+            for x in 0..32 {
+                let (a, b) = (x % 16, (x / 16 + 2 * y) % 16);
+                // The 64 pt image sits at the bottom of the 70 pt page.
+                close(rgb_at(&out.rgba, w, 4 * x + 2, 6 + 4 * y + 2), [(255 - 17 * a) as u8, (17 * b) as u8, 0], (x, y));
+            }
+        }
+
+        // DeviceGray at 2 bits, reversed: 31 pixels (62 bits, so each row ends mid-byte) by 6.
+        let sample = |x: usize, y: usize| (x + y) % 4;
+        let mut data = Vec::new();
+        for y in 0..6 {
+            let mut row = [0u8; 8];
+            for x in 0..31 {
+                row[x / 4] |= (sample(x, y) as u8) << (6 - 2 * (x % 4));
+            }
+            data.extend_from_slice(&row);
+        }
+        let image = format!(
+            "<< /Type /XObject /Subtype /Image /Width 31 /Height 6 /ColorSpace /DeviceGray /BitsPerComponent 2 /Decode [1 0] /Length {} >>",
+            data.len()
+        );
+        let pdf = image_cache_pdf("q 124 0 0 60 0 0 cm /A Do Q", "<< /XObject << /A 5 0 R >> >>", &[(&image, &data)]);
+        let out = render_first_page(pdf);
+        let w = out.width as usize;
+        for y in 0..6 {
+            for x in 0..31 {
+                // The 60 pt image at the bottom of the page: rows 10 pt high.
+                close(rgb_at(&out.rgba, w, 4 * x + 2, 10 + 10 * y + 5), [(255 - 85 * sample(x, y)) as u8; 3], (x, y));
+            }
+        }
+
+        // DeviceGray at 8 bits through the range [0.2 0.8] (so not drawn from the raw bytes):
+        // 31 × 12 declared, data for 8 rows and the first 12 pixels of the 9th.
+        let sample = |x: usize, y: usize| (x * 7 + y * 3) % 256;
+        let mut data = Vec::new();
+        for y in 0..9 {
+            let row: Vec<u8> = (0..31).map(|x| sample(x, y) as u8).collect();
+            data.extend_from_slice(if y < 8 { &row[..] } else { &row[..12] });
+        }
+        let image = format!(
+            "<< /Type /XObject /Subtype /Image /Width 31 /Height 12 /ColorSpace /DeviceGray /BitsPerComponent 8 /Decode [0.2 0.8] /Length {} >>",
+            data.len()
+        );
+        let pdf = image_cache_pdf("q 124 0 0 60 0 0 cm /A Do Q", "<< /XObject << /A 5 0 R >> >>", &[(&image, &data)]);
+        let out = render_first_page(pdf);
+        let w = out.width as usize;
+        for y in 0..9 {
+            for x in 0..31 {
+                // The rest of the 9th row is decoded zero (black), not sample 0 (0.2 under this range).
+                let gray = if y < 8 || x < 12 { (51.0 + 0.6 * sample(x, y) as f64).round() as u8 } else { 0 };
+                // The rows present keep the declared rows' height: 60 pt / 12.
+                close(rgb_at(&out.rgba, w, 4 * x + 2, 10 + 5 * y + 2), [gray; 3], (x, y));
+            }
+        }
+    }
+
+    /// Patch 28's table converts each entry on its own: a tint transform that gives the wrong
+    /// number of components for a sample value the image never uses leaves the colours of the
+    /// values it does use alone. Converted as one batch, the one component tint 0 gives here
+    /// shifted every later entry, and tint 1's red came out black (PR #1691 review).
+    #[test]
+    fn a_malformed_tint_for_an_unused_sample_keeps_the_used_colours() {
+        // Tint 0 gives one component instead of the three `/Range` declares; any other tint red.
+        let program = b"{ dup 0 eq { pop 0 } { pop 1 0 0 } ifelse }";
+        // 32 × 32 = 1,024 pixels, more than the table's 256 entries, all sample 255 (tint 1).
+        let data = [255u8; 32 * 32];
+        let centre = |space: &str| {
+            let image = format!(
+                "<< /Type /XObject /Subtype /Image /Width 32 /Height 32 /ColorSpace [{space} /DeviceRGB 6 0 R] /BitsPerComponent 8 /Length {} >>",
+                data.len()
+            );
+            let function = format!("<< /FunctionType 4 /Domain [0 1] /Range [0 1 0 1 0 1] /Length {} >>", program.len());
+            let pdf = image_cache_pdf("q 130 0 0 70 0 0 cm /A Do Q", "<< /XObject << /A 5 0 R >> >>", &[(&image, &data), (&function, program)]);
+            let out = render_first_page(pdf);
+            rgb_at(&out.rgba, out.width as usize, 65, 35)
+        };
+        assert_eq!([centre("/Separation /Spot"), centre("/DeviceN [/Spot]")], [[255, 0, 0]; 2], "Separation, then one-ink DeviceN");
+    }
+
     /// A Japanese CID font that isn't embedded (Adobe-Japan1, as `HeiseiMin-W3` with
     /// `UniJIS-UCS2-H` in #260's test file) drew nothing: hayro's substitutes for fonts that
     /// aren't embedded are Latin-only. With craft-fonts (the build input release builds embed),
@@ -5938,6 +6486,38 @@ trailer << /Root 1 0 R >>
         assert_eq!(px(75, 50), vec![255, 255, 255, 255], "outside the mask");
     }
 
+    /// Issue #2128: PowerPoint fades a gradient fill (an axial shading pattern) through a soft
+    /// mask. vello_cpu 0.0.8 copies an opaque gradient straight over fully covered tiles,
+    /// skipping the mask, so the fade came out solid. Images get around that by declaring
+    /// transparency while a mask or blend mode is set; native gradients can't, so they are
+    /// sampled as a texture then.
+    #[test]
+    fn soft_mask_applies_to_a_shading_pattern_fill() {
+        let content = "/Pattern cs /P0 scn /M gs 0 0 100 100 re f";
+        let pdf = format!(
+            "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Contents 4 0 R /Resources << /ExtGState << /M 5 0 R >> /Pattern << /P0 7 0 R >> >> >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+5 0 obj << /Type /ExtGState /SMask << /Type /Mask /S /Alpha /G 6 0 R >> >> endobj
+6 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 100 100] /Group << /S /Transparency /CS /DeviceRGB >> /Length 20 >> stream
+0 g 0 0 50 100 re f
+endstream endobj
+7 0 obj << /PatternType 2 /Shading << /ShadingType 2 /ColorSpace /DeviceRGB /Coords [0 0 100 0] /Extend [true true] /Function << /FunctionType 2 /Domain [0 1] /C0 [1 0 0] /C1 [1 0 0] /N 1 >> >> >> endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+            content.len()
+        );
+        let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+        let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+        let px = |x: u32, y: u32| p.rgba[((y * p.width + x) * 4) as usize..][..4].to_vec();
+        assert_eq!(px(25, 50), vec![255, 0, 0, 255], "inside the mask");
+        assert_eq!(px(75, 50), vec![255, 255, 255, 255], "outside the mask");
+    }
+
     /// ISO 32000-2 §8.5.4: `W` / `W*` clip with the current path once whichever path-painting
     /// operator ends it has painted it, `S`, `f` or `B` as much as `n`. The vendored interpreter
     /// applied the clip only on `n`: after `re W* S` everything later painted outside the clip,
diff --git a/crates/render/src/text.rs b/crates/render/src/text.rs
index c513d5249..ae5ffa9a9 100644
--- a/crates/render/src/text.rs
+++ b/crates/render/src/text.rs
@@ -14,7 +14,29 @@ use hayro::hayro_interpret::{
     BlendMode, ClipPath, Context, Device, GlyphDrawMode, Image, InterpreterCache, InterpreterSettings, Paint, PathDrawMode, SoftMask, interpret_page,
 };
 use kurbo::{Affine, BezPath, Rect, Shape};
-use std::collections::HashMap;
+use std::collections::{HashMap, HashSet};
+
+/// Semantic exclusions for statistics. Untagged text is retained; no layout guess is made.
+#[derive(Clone, Debug, Default)]
+pub struct TextFilter {
+    pub tables: bool,
+    pub code: bool,
+    /// Exclude Figure-marked text and invisible text layers, including OCR.
+    pub images: bool,
+    /// Page-local MCIDs whose structure ancestors match the selected exclusions.
+    pub mcids: HashSet<i32>,
+}
+
+impl TextFilter {
+    fn excludes(&self, tag: &[u8], mcid: Option<i32>) -> bool {
+        (self.tables && matches!(tag, b"Table" | b"TR" | b"TH" | b"TD" | b"THead" | b"TBody" | b"TFoot"))
+            || (self.code && tag == b"Code")
+            || (self.images && tag == b"Figure")
+            || mcid.is_some_and(|id| self.mcids.contains(&id))
+    }
+}
+
+mod search;
 
 /// One glyph on the page.
 #[derive(Clone, Debug, PartialEq)]
@@ -102,47 +124,7 @@ impl PageText {
 
     /// Search with Acrobat's find options, returning at most `limit` glyph ranges.
     pub fn find_opts_limited(&self, needle: &str, case_sensitive: bool, whole_words: bool, limit: usize) -> Vec<std::ops::Range<usize>> {
-        if limit == 0 {
-            return Vec::new();
-        }
-        let fold = |s: &str| if case_sensitive { s.to_string() } else { fold_case(s) };
-        let needle: Vec<char> = fold(needle).split_whitespace().collect::<Vec<_>>().join(" ").chars().collect();
-        if needle.is_empty() {
-            return Vec::new();
-        }
-        // Flatten to chars with the glyph index each char came from.
-        let mut chars: Vec<(char, usize)> = Vec::new();
-        for (i, g) in self.glyphs.iter().enumerate() {
-            if i > 0 && (self.space_before[i] || self.line_of[i] != self.line_of[i - 1]) && chars.last().is_some_and(|c| c.0 != ' ') {
-                chars.push((' ', i));
-            }
-            for c in fold(&g.text).chars() {
-                let c = if c.is_whitespace() { ' ' } else { c };
-                // The query collapses a run of whitespace to one space, so collapse the page too.
-                if c == ' ' && chars.last().is_some_and(|k| k.0 == ' ') {
-                    continue;
-                }
-                chars.push((c, i));
-            }
-        }
-        let word = |k: Option<&(char, usize)>| k.is_some_and(|c| c.0.is_alphanumeric());
-        let mut out = Vec::new();
-        let mut i = 0;
-        while i + needle.len() <= chars.len() {
-            let bounded = !whole_words || (!word(i.checked_sub(1).and_then(|p| chars.get(p))) && !word(chars.get(i + needle.len())));
-            if bounded && chars[i..i + needle.len()].iter().map(|c| c.0).eq(needle.iter().copied()) {
-                let start = chars[i].1;
-                let end = chars[i + needle.len() - 1].1 + 1;
-                out.push(start..end);
-                if out.len() == limit {
-                    break;
-                }
-                i += needle.len();
-            } else {
-                i += 1;
-            }
-        }
-        out
+        search::find(self, needle, case_sensitive, whole_words, limit)
     }
 
     /// Glyph ranges of the matches a character matcher finds in the page text (words and lines
@@ -376,6 +358,10 @@ struct TextDevice {
     actual: Option<(usize, String, Vec<Drawn>)>,
     /// Every `/ActualText` replacement made on the page.
     replaced: Vec<Replaced>,
+    filter: TextFilter,
+    excluded_depth: Option<usize>,
+    actual_filtered: bool,
+    partial_replacement: bool,
 }
 
 /// An `/ActualText` replacement: the glyph standing for it in `TextDevice::glyphs` (none for an
@@ -440,7 +426,16 @@ fn merge(drawn: &[Drawn], text: String) -> Option<Drawn> {
 
 impl TextDevice {
     fn new() -> Self {
-        TextDevice { glyphs: Vec::new(), depth: 0, actual: None, replaced: Vec::new() }
+        TextDevice {
+            glyphs: Vec::new(),
+            depth: 0,
+            actual: None,
+            replaced: Vec::new(),
+            filter: TextFilter::default(),
+            excluded_depth: None,
+            actual_filtered: false,
+            partial_replacement: false,
+        }
     }
 
     /// Ends the open `/ActualText` replacement (ISO 32000-2 §14.9.4): its glyphs become one glyph
@@ -453,6 +448,12 @@ impl TextDevice {
     /// Unicode). An empty one (a soft hyphen at a line break, say) stands for no text at all.
     fn end_actual_text(&mut self) {
         let Some((_, text, drawn)) = self.actual.take() else { return };
+        if std::mem::take(&mut self.actual_filtered) {
+            // ActualText has no mapping from replacement words to individual glyphs. A mixed
+            // span cannot be filtered honestly; a wholly excluded span can simply be omitted.
+            self.partial_replacement |= !drawn.is_empty();
+            return;
+        }
         let Some(glyph) = merge(&drawn, text.clone()) else {
             self.glyphs.extend(drawn.into_iter().filter(|d| !d.2.text.chars().all(|c| c.is_control())));
             return;
@@ -554,7 +555,11 @@ impl<'a> Device<'a> for TextDevice {
     fn draw_path(&mut self, _: &BezPath, _: Affine, _: &Paint<'a>, _: &PathDrawMode) {}
     fn push_clip_path(&mut self, _: &ClipPath) {}
     fn push_transparency_group(&mut self, _: f32, _: Option<SoftMask<'a>>, _: BlendMode) {}
-    fn draw_glyph(&mut self, glyph: &Glyph<'a>, transform: Affine, glyph_transform: Affine, _: &Paint<'a>, _: &GlyphDrawMode) {
+    fn draw_glyph(&mut self, glyph: &Glyph<'a>, transform: Affine, glyph_transform: Affine, _: &Paint<'a>, mode: &GlyphDrawMode) {
+        if self.excluded_depth.is_some() || (self.filter.images && matches!(mode, GlyphDrawMode::Invisible)) {
+            self.actual_filtered |= self.actual.is_some();
+            return;
+        }
         // Inside an `/ActualText` replacement only the glyph's box matters.
         let replaced = self.actual.is_some();
         let text = match glyph.as_unicode() {
@@ -635,12 +640,15 @@ impl<'a> Device<'a> for TextDevice {
     fn draw_image(&mut self, _: Image<'a, '_>, _: Affine) {}
     fn pop_clip_path(&mut self) {}
     fn pop_transparency_group(&mut self) {}
-    fn begin_marked_content(&mut self, _: &[u8], _: Option<i32>) {
+    fn begin_marked_content(&mut self, tag: &[u8], mcid: Option<i32>) {
         self.depth = self.depth.saturating_add(1);
+        if self.excluded_depth.is_none() && self.filter.excludes(tag, mcid) {
+            self.excluded_depth = Some(self.depth);
+        }
     }
     fn actual_text(&mut self, text: &[u8]) {
         // A replacement nested in another is already covered by the outer one.
-        if self.actual.is_none() {
+        if self.actual.is_none() && self.excluded_depth.is_none() {
             self.actual = Some((self.depth, pdfcraft_cos::PdfString::literal(text).to_text(), Vec::new()));
         }
     }
@@ -648,14 +656,21 @@ impl<'a> Device<'a> for TextDevice {
         if self.actual.as_ref().is_some_and(|(depth, _, _)| *depth == self.depth) {
             self.end_actual_text();
         }
+        if self.excluded_depth == Some(self.depth) {
+            self.excluded_depth = None;
+        }
         self.depth = self.depth.saturating_sub(1);
     }
 }
 
 /// Extract the text of one page. Panics inside the interpreter are the caller's to catch.
 pub(crate) fn extract_page(pdf: &Pdf, page: usize, settings: &InterpreterSettings) -> Option<PageText> {
+    extract_page_filtered(pdf, page, settings, TextFilter::default()).ok()
+}
+
+pub(crate) fn extract_page_filtered(pdf: &Pdf, page: usize, settings: &InterpreterSettings, filter: TextFilter) -> Result<PageText, String> {
     let pages = pdf.pages();
-    let p = pages.get(page)?;
+    let p = pages.get(page).ok_or("the page could not be read")?;
     let (w, h) = p.render_dimensions();
     let cache = InterpreterCache::new();
     // Annotation appearances are included: form-field values and comment text are searchable,
@@ -664,9 +679,13 @@ pub(crate) fn extract_page(pdf: &Pdf, page: usize, settings: &InterpreterSetting
     let initial = p.initial_transform(true).to_kurbo();
     let mut ctx = Context::new(initial, Rect::new(0.0, 0.0, w as f64, h as f64), &cache, p.xref(), settings);
     let mut dev = TextDevice::new();
+    dev.filter = filter;
     interpret_page(p, &mut ctx, &mut dev);
     // A replacement the content never closed ends with the page.
     dev.finish();
+    if dev.partial_replacement {
+        return Err("a replacement text span mixes included and excluded content; disable the exclusions to count this page".into());
+    }
     let glyphs = dev.glyphs;
     // Text on a curved path: glyphs that each continue the previous one's line while the
     // direction turns. Each such run is one line.
@@ -781,7 +800,7 @@ pub(crate) fn extract_page(pdf: &Pdf, page: usize, settings: &InterpreterSetting
     for f in extra {
         emit(&mut text, &f.ids, &f.line_of, &f.space_before, None);
     }
-    Some(text)
+    Ok(text)
 }
 
 /// Glyphs in reading order, as indices into the page's glyphs, with their lines and word gaps.
diff --git a/crates/render/src/text/search.rs b/crates/render/src/text/search.rs
new file mode 100644
index 000000000..c68660dbe
--- /dev/null
+++ b/crates/render/src/text/search.rs
@@ -0,0 +1,77 @@
+//! Literal search in normalized page text, retaining the original glyph owners.
+use super::{PageText, fold_case};
+use std::ops::Range;
+
+pub(super) fn find(page: &PageText, query: &str, sensitive: bool, whole_words: bool, limit: usize) -> Vec<Range<usize>> {
+    if limit == 0 {
+        return Vec::new();
+    }
+    let fold = |s: &str| if sensitive { s.to_owned() } else { fold_case(s) };
+    let needle: Vec<char> = fold(query).split_whitespace().collect::<Vec<_>>().join(" ").chars().collect();
+    if needle.is_empty() {
+        return Vec::new();
+    }
+    let mut chars: Vec<(char, usize)> = Vec::new();
+    for (i, glyph) in page.glyphs.iter().enumerate() {
+        let line_break = i.checked_sub(1).and_then(|previous| page.line_of.get(previous)).zip(page.line_of.get(i)).is_some_and(|(a, b)| a != b);
+        let gap = page.space_before.get(i).copied().unwrap_or(false) || line_break;
+        if i > 0 && gap && chars.last().is_some_and(|c| c.0 != ' ') {
+            chars.push((' ', i));
+        }
+        for c in fold(&glyph.text).chars() {
+            let c = if c.is_whitespace() { ' ' } else { c };
+            if c != ' ' || chars.last().is_none_or(|last| last.0 != ' ') {
+                chars.push((c, i));
+            }
+        }
+    }
+    if needle.len() > chars.len() {
+        return Vec::new();
+    }
+    // KMP reuses a matched prefix instead of comparing a long query again at every position.
+    // The table is bounded by the page's already materialized character count.
+    let mut prefix = vec![0; needle.len()];
+    let mut matched = 0;
+    for (i, &c) in needle.iter().enumerate().skip(1) {
+        matched = advance(&needle, &prefix, matched, c);
+        if let Some(slot) = prefix.get_mut(i) {
+            *slot = matched;
+        }
+    }
+    matched = 0;
+    let word = |i: Option<usize>| i.and_then(|i| chars.get(i)).is_some_and(|c| c.0.is_alphanumeric());
+    let mut hits = Vec::new();
+    for (i, &(c, owner)) in chars.iter().enumerate() {
+        matched = advance(&needle, &prefix, matched, c);
+        if matched != needle.len() {
+            continue;
+        }
+        let end = i.saturating_add(1);
+        let start = end.saturating_sub(needle.len());
+        let bounded = !whole_words || (!word(start.checked_sub(1)) && !word(Some(end)));
+        if bounded {
+            if let Some((_, first)) = chars.get(start)
+                && let Some(last) = owner.checked_add(1)
+            {
+                hits.push(*first..last);
+                if hits.len() == limit {
+                    break;
+                }
+            }
+            // Only accepted hits consume their full span: literal search is non-overlapping.
+            matched = 0;
+        } else {
+            // A word-boundary rejection must still allow an overlapping later candidate.
+            matched = prefix.last().copied().unwrap_or_default();
+        }
+    }
+    hits
+}
+
+/// Extend a prefix, falling back through strictly shorter proper prefixes on a mismatch.
+fn advance(needle: &[char], prefix: &[usize], mut matched: usize, c: char) -> usize {
+    while matched > 0 && needle.get(matched) != Some(&c) {
+        matched = prefix.get(matched - 1).copied().unwrap_or_default();
+    }
+    if needle.get(matched) == Some(&c) { matched.saturating_add(1) } else { 0 }
+}
diff --git a/crates/render/src/transition.rs b/crates/render/src/transition.rs
new file mode 100644
index 000000000..15e9c828e
--- /dev/null
+++ b/crates/render/src/transition.rs
@@ -0,0 +1,447 @@
+//! The geometry of a page transition (ISO 32000-2 §12.4.4, table 164) part-way through its run:
+//! which parts of the outgoing and the incoming page a presentation paints, where, and how
+//! opaque. Pure functions in page fractions (0 to 1 across and down the page box on screen), so
+//! the painter only scales them; nothing here touches pixels or time.
+//!
+//! `Effect` is the transition as a presentation plays it (the `/Trans` entries that matter for
+//! each style, with the spec's defaults), `frame` the picture at progress `t`. Every frame starts
+//! with the outgoing page alone (`t = 0`) and ends with the incoming page alone (`t = 1`); the
+//! pieces of a frame never leave the page box.
+
+/// A page transition as it is played: the style with the entries that style reads. Directions
+/// are degrees as `/Di` gives them: 0 left to right, 90 bottom to top, 180 right to left, 270 top
+/// to bottom, 315 top-left to bottom-right (Glitter; Wipe treats it the same way).
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub enum Effect {
+    /// Two halves split along a horizontal (`horizontal`) or vertical line, revealing the new page
+    /// from the edges inward (`inward`) or from the centre outward.
+    Split { horizontal: bool, inward: bool },
+    /// Strips across (`horizontal`) or down the page open together, like Venetian blinds.
+    Blinds { horizontal: bool },
+    /// A rectangle grows from the centre (`inward` false) or the edges close in on the centre.
+    Box { inward: bool },
+    /// A line sweeps across the page in `direction`, revealing the new page behind it.
+    Wipe { direction: u16 },
+    /// Random squares of the new page appear until it is whole.
+    Dissolve,
+    /// Like Dissolve, but the squares appear in a band that sweeps in `direction`.
+    Glitter { direction: u16 },
+    /// No effect: the new page replaces the old one.
+    Replace,
+    /// The new page flies in from off-screen in `direction` (or from the centre, `None`), growing
+    /// from `scale`; `outward` flies the old page off instead. With `opaque` the moving page hides
+    /// what is under it (it always does here: the pieces overlap in paint order).
+    Fly { direction: Option<u16>, inward: bool, scale: f32 },
+    /// The new page pushes the old one off the page in `direction`.
+    Push { direction: u16 },
+    /// The new page slides in over the old one in `direction`.
+    Cover { direction: u16 },
+    /// The old page slides off in `direction`, uncovering the new one beneath.
+    Uncover { direction: u16 },
+    /// The new page fades in over the old one.
+    Fade,
+}
+
+impl Effect {
+    /// The effect for a `/Trans` dictionary read as its parts: the `/S` name, `/Dm` as
+    /// `horizontal`, `/M` as `inward`, `/Di` as `direction` (`None` for `/None`), `/SS` and `/B`.
+    /// An unknown style is `Replace`, as the spec's default; an entry a style does not read is
+    /// ignored.
+    pub fn from_parts(style: &str, horizontal: bool, inward: bool, direction: Option<u16>, scale: f32) -> Self {
+        let dir = direction.filter(|d| matches!(d, 0 | 90 | 180 | 270 | 315)).unwrap_or(0);
+        match style {
+            "Split" => Self::Split { horizontal, inward },
+            "Blinds" => Self::Blinds { horizontal },
+            "Box" => Self::Box { inward },
+            "Wipe" => Self::Wipe { direction: dir },
+            "Dissolve" => Self::Dissolve,
+            "Glitter" => Self::Glitter { direction: dir },
+            "Fly" => Self::Fly {
+                direction: direction.filter(|d| matches!(d, 0 | 90 | 180 | 270)),
+                inward,
+                scale: if scale.is_finite() && scale > 0.0 { scale.min(1.0) } else { 1.0 },
+            },
+            "Push" => Self::Push { direction: dir },
+            "Cover" => Self::Cover { direction: dir },
+            "Uncover" => Self::Uncover { direction: dir },
+            "Fade" => Self::Fade,
+            _ => Self::Replace,
+        }
+    }
+}
+
+/// A part of a page to paint: `src` is the part of that page, `dst` where it goes, both as
+/// fractions `[x0, y0, x1, y1]` of the page box (y down), `alpha` its opacity.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct Piece {
+    pub src: [f32; 4],
+    pub dst: [f32; 4],
+    pub alpha: f32,
+}
+
+/// One moment of a transition: the pieces of the outgoing page, then of the incoming page, in
+/// paint order (later pieces over earlier ones).
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct Frame {
+    pub outgoing: Vec<Piece>,
+    pub incoming: Vec<Piece>,
+}
+
+/// Strips in Blinds, and cells per side in Dissolve and Glitter.
+const BLINDS: usize = 8;
+const GRID: usize = 8;
+/// Strips that approximate a diagonal sweep.
+const DIAGONAL_STRIPS: usize = 16;
+const FULL: [f32; 4] = [0.0, 0.0, 1.0, 1.0];
+
+fn whole(alpha: f32) -> Piece {
+    Piece { src: FULL, dst: FULL, alpha }
+}
+
+/// A piece of the page at `rect` (fractions), shown in place.
+fn at(rect: [f32; 4]) -> Piece {
+    Piece { src: rect, dst: rect, alpha: 1.0 }
+}
+
+/// The whole page shifted by `dx, dy` (fractions), clipped to the page box, or `None` when it is
+/// entirely off the page.
+fn shifted(dx: f32, dy: f32) -> Option<Piece> {
+    let dst = [dx.max(0.0), dy.max(0.0), (1.0 + dx).min(1.0), (1.0 + dy).min(1.0)];
+    if dst[2] - dst[0] <= 0.0 || dst[3] - dst[1] <= 0.0 {
+        return None;
+    }
+    let src = [dst[0] - dx, dst[1] - dy, dst[2] - dx, dst[3] - dy];
+    Some(Piece { src, dst, alpha: 1.0 })
+}
+
+/// Where a page is at `k` of the way along `direction` (0 at the start, 1 at the end of a move
+/// across the whole page), as an offset in fractions.
+fn offset(direction: u16, k: f32) -> (f32, f32) {
+    match direction {
+        90 => (0.0, -k),
+        180 => (-k, 0.0),
+        270 => (0.0, k),
+        _ => (k, 0.0),
+    }
+}
+
+/// A small deterministic hash, so Dissolve and Glitter look random but repeat exactly.
+fn hash(i: u32) -> u32 {
+    let mut x = i.wrapping_mul(0x9E37_79B9).wrapping_add(0x7F4A_7C15);
+    x ^= x >> 15;
+    x = x.wrapping_mul(0x2C1B_3C6D);
+    x ^= x >> 12;
+    x
+}
+
+/// The cells of the dissolve grid in the order they appear: by `key`, ties by position.
+fn cells_in_order(key: impl Fn(usize, usize) -> f32) -> Vec<[f32; 4]> {
+    let mut cells: Vec<(f32, usize, usize)> = (0..GRID * GRID).map(|i| (key(i % GRID, i / GRID), i / GRID, i % GRID)).collect();
+    cells.sort_by(|a, b| a.0.total_cmp(&b.0).then(a.1.cmp(&b.1)).then(a.2.cmp(&b.2)));
+    let side = 1.0 / GRID as f32;
+    cells.into_iter().map(|(_, row, col)| [col as f32 * side, row as f32 * side, (col + 1) as f32 * side, (row + 1) as f32 * side]).collect()
+}
+
+/// The pieces of the incoming page at `t` for a diagonal sweep: a point is revealed once its
+/// distance along the diagonal, `(x + y) / 2`, is within `t`, approximated by vertical strips.
+fn diagonal(t: f32) -> Vec<Piece> {
+    let w = 1.0 / DIAGONAL_STRIPS as f32;
+    (0..DIAGONAL_STRIPS)
+        .filter_map(|k| {
+            let x0 = k as f32 * w;
+            let h = (2.0 * t - (x0 + w / 2.0)).clamp(0.0, 1.0);
+            (h > 0.0).then(|| at([x0, 0.0, x0 + w, h]))
+        })
+        .collect()
+}
+
+/// The incoming page revealed by a straight sweep in `direction` at `t`.
+fn swept(direction: u16, t: f32) -> Vec<Piece> {
+    match direction {
+        90 => vec![at([0.0, 1.0 - t, 1.0, 1.0])],
+        180 => vec![at([1.0 - t, 0.0, 1.0, 1.0])],
+        270 => vec![at([0.0, 0.0, 1.0, t])],
+        315 => diagonal(t),
+        _ => vec![at([0.0, 0.0, t, 1.0])],
+    }
+}
+
+/// The picture of `effect` at progress `t` (0: the outgoing page alone; 1: the incoming page
+/// alone; anything else clamped). Pieces are in paint order and never leave the page box.
+pub fn frame(effect: &Effect, t: f32) -> Frame {
+    let t = if t.is_finite() { t.clamp(0.0, 1.0) } else { 1.0 };
+    if t <= 0.0 {
+        return Frame { outgoing: vec![whole(1.0)], incoming: Vec::new() };
+    }
+    if t >= 1.0 {
+        return Frame { outgoing: Vec::new(), incoming: vec![whole(1.0)] };
+    }
+    let over_old = |incoming: Vec<Piece>| Frame { outgoing: vec![whole(1.0)], incoming };
+    match *effect {
+        Effect::Replace => Frame { outgoing: Vec::new(), incoming: vec![whole(1.0)] },
+        Effect::Fade => Frame { outgoing: vec![whole(1.0)], incoming: vec![whole(t)] },
+        Effect::Wipe { direction } => over_old(swept(direction, t)),
+        Effect::Split { horizontal, inward } => {
+            let h = t / 2.0;
+            let bands = match (horizontal, inward) {
+                (true, true) => vec![at([0.0, 0.0, 1.0, h]), at([0.0, 1.0 - h, 1.0, 1.0])],
+                (true, false) => vec![at([0.0, 0.5 - h, 1.0, 0.5 + h])],
+                (false, true) => vec![at([0.0, 0.0, h, 1.0]), at([1.0 - h, 0.0, 1.0, 1.0])],
+                (false, false) => vec![at([0.5 - h, 0.0, 0.5 + h, 1.0])],
+            };
+            over_old(bands)
+        }
+        Effect::Blinds { horizontal } => {
+            let w = 1.0 / BLINDS as f32;
+            let strips = (0..BLINDS)
+                .map(|k| {
+                    let a = k as f32 * w;
+                    if horizontal { at([0.0, a, 1.0, a + t * w]) } else { at([a, 0.0, a + t * w, 1.0]) }
+                })
+                .collect();
+            over_old(strips)
+        }
+        Effect::Box { inward } => {
+            let h = t / 2.0;
+            let pieces = if inward {
+                vec![at([0.0, 0.0, 1.0, h]), at([0.0, 1.0 - h, 1.0, 1.0]), at([0.0, h, h, 1.0 - h]), at([1.0 - h, h, 1.0, 1.0 - h])]
+            } else {
+                vec![at([0.5 - h, 0.5 - h, 0.5 + h, 0.5 + h])]
+            };
+            over_old(pieces)
+        }
+        Effect::Dissolve => {
+            let cells = cells_in_order(|col, row| hash((row * GRID + col) as u32) as f32);
+            let shown = ((t * cells.len() as f32).round() as usize).min(cells.len());
+            over_old(cells.into_iter().take(shown).map(at).collect())
+        }
+        Effect::Glitter { direction } => {
+            // Ordered by how far along the sweep a cell lies, jittered so the band sparkles.
+            let along = |col: usize, row: usize| -> f32 {
+                let (x, y) = ((col as f32 + 0.5) / GRID as f32, (row as f32 + 0.5) / GRID as f32);
+                match direction {
+                    90 => 1.0 - y,
+                    180 => 1.0 - x,
+                    270 => y,
+                    315 => (x + y) / 2.0,
+                    _ => x,
+                }
+            };
+            let cells = cells_in_order(|col, row| along(col, row) + (hash((row * GRID + col) as u32 + 977) % 1000) as f32 / 4000.0);
+            let shown = ((t * cells.len() as f32).round() as usize).min(cells.len());
+            over_old(cells.into_iter().take(shown).map(at).collect())
+        }
+        Effect::Push { direction } => {
+            let (dx, dy) = offset(direction, t);
+            let (ux, uy) = offset(direction, 1.0);
+            Frame { outgoing: shifted(dx, dy).into_iter().collect(), incoming: shifted(dx - ux, dy - uy).into_iter().collect() }
+        }
+        Effect::Cover { direction } => {
+            let (dx, dy) = offset(direction, t);
+            let (ux, uy) = offset(direction, 1.0);
+            over_old(shifted(dx - ux, dy - uy).into_iter().collect())
+        }
+        Effect::Uncover { direction } => {
+            let (dx, dy) = offset(direction, t);
+            Frame { outgoing: shifted(dx, dy).into_iter().collect(), incoming: vec![whole(1.0)] }
+        }
+        Effect::Fly { direction, inward, scale } => {
+            // The moving page: at `k` of its flight (0 off-screen or small, 1 whole and in place).
+            // `leaving`: the page moves on in `direction` (flying out); else it comes in from the
+            // side it would have left from (flying in).
+            let flight = |k: f32, leaving: bool| -> Option<Piece> {
+                let s = scale + (1.0 - scale) * k;
+                let (dx, dy) = direction.map_or((0.0, 0.0), |d| {
+                    let (ox, oy) = offset(d, 1.0 - k);
+                    if leaving { (ox, oy) } else { (-ox, -oy) }
+                });
+                // The page at scale `s`, centred, shifted by (dx, dy), clipped to the page box.
+                let half = s / 2.0;
+                let dst = [0.5 - half + dx, 0.5 - half + dy, 0.5 + half + dx, 0.5 + half + dy];
+                let clip = [dst[0].max(0.0), dst[1].max(0.0), dst[2].min(1.0), dst[3].min(1.0)];
+                if clip[2] - clip[0] <= 0.0 || clip[3] - clip[1] <= 0.0 || s <= 0.0 {
+                    return None;
+                }
+                let src = [(clip[0] - dst[0]) / s, (clip[1] - dst[1]) / s, (clip[2] - dst[0]) / s, (clip[3] - dst[1]) / s];
+                Some(Piece { src, dst: clip, alpha: 1.0 })
+            };
+            if inward {
+                Frame { outgoing: vec![whole(1.0)], incoming: flight(t, false).into_iter().collect() }
+            } else {
+                Frame { outgoing: flight(1.0 - t, true).into_iter().collect(), incoming: vec![whole(1.0)] }
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn area(p: &Piece) -> f32 {
+        (p.dst[2] - p.dst[0]).max(0.0) * (p.dst[3] - p.dst[1]).max(0.0)
+    }
+
+    fn inside(p: &Piece) -> bool {
+        p.dst.iter().chain(p.src.iter()).all(|v| (-1e-4..=1.0 + 1e-4).contains(v)) && p.dst[0] <= p.dst[2] && p.dst[1] <= p.dst[3]
+    }
+
+    fn all_effects() -> Vec<Effect> {
+        let mut v = vec![
+            Effect::Replace,
+            Effect::Fade,
+            Effect::Dissolve,
+            Effect::Split { horizontal: true, inward: true },
+            Effect::Split { horizontal: false, inward: false },
+            Effect::Blinds { horizontal: true },
+            Effect::Blinds { horizontal: false },
+            Effect::Box { inward: true },
+            Effect::Box { inward: false },
+        ];
+        for d in [0, 90, 180, 270, 315] {
+            v.push(Effect::Wipe { direction: d });
+            v.push(Effect::Glitter { direction: d });
+        }
+        for d in [0, 90, 180, 270] {
+            v.push(Effect::Push { direction: d });
+            v.push(Effect::Cover { direction: d });
+            v.push(Effect::Uncover { direction: d });
+            v.push(Effect::Fly { direction: Some(d), inward: true, scale: 0.5 });
+            v.push(Effect::Fly { direction: Some(d), inward: false, scale: 1.0 });
+        }
+        v.push(Effect::Fly { direction: None, inward: true, scale: 0.25 });
+        v
+    }
+
+    #[test]
+    fn every_effect_starts_with_the_old_page_ends_with_the_new_and_stays_on_the_page() {
+        for e in all_effects() {
+            let start = frame(&e, 0.0);
+            assert_eq!((start.outgoing.len(), start.incoming.len()), (1, 0), "{e:?} at 0");
+            assert_eq!(start.outgoing[0], whole(1.0));
+            let end = frame(&e, 1.0);
+            assert_eq!((end.outgoing.len(), end.incoming.len()), (0, 1), "{e:?} at 1");
+            assert_eq!(end.incoming[0], whole(1.0));
+            assert_eq!(frame(&e, f32::NAN), end, "{e:?}: a non-number is the end");
+            assert_eq!(frame(&e, -3.0), start);
+            for k in 1..20 {
+                let f = frame(&e, k as f32 / 20.0);
+                for p in f.outgoing.iter().chain(f.incoming.iter()) {
+                    assert!(inside(p), "{e:?} at {k}/20: {p:?} leaves the page");
+                    assert!((0.0..=1.0).contains(&p.alpha));
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn reveals_grow_with_time() {
+        // For every effect that reveals the new page in place, the revealed area never shrinks.
+        for e in all_effects().into_iter().filter(|e| {
+            !matches!(e, Effect::Replace | Effect::Fade | Effect::Push { .. } | Effect::Cover { .. } | Effect::Uncover { .. } | Effect::Fly { .. })
+        }) {
+            let mut last = 0.0;
+            for k in 0..=20 {
+                let f = frame(&e, k as f32 / 20.0);
+                let a: f32 = f.incoming.iter().map(area).sum();
+                assert!(a + 1e-4 >= last, "{e:?}: revealed area fell from {last} to {a} at {k}/20");
+                last = a;
+            }
+            assert!((last - 1.0).abs() < 1e-4, "{e:?} ends whole: {last}");
+        }
+    }
+
+    #[test]
+    fn wipes_sweep_in_their_direction() {
+        let f = frame(&Effect::Wipe { direction: 0 }, 0.25);
+        assert_eq!(f.incoming, vec![at([0.0, 0.0, 0.25, 1.0])], "left to right");
+        assert_eq!(frame(&Effect::Wipe { direction: 90 }, 0.25).incoming, vec![at([0.0, 0.75, 1.0, 1.0])], "bottom to top");
+        assert_eq!(frame(&Effect::Wipe { direction: 180 }, 0.25).incoming, vec![at([0.75, 0.0, 1.0, 1.0])], "right to left");
+        assert_eq!(frame(&Effect::Wipe { direction: 270 }, 0.25).incoming, vec![at([0.0, 0.0, 1.0, 0.25])], "top to bottom");
+        // Diagonal: the top-left corner first, the bottom-right last.
+        let d = frame(&Effect::Wipe { direction: 315 }, 0.25);
+        assert!(!d.incoming.is_empty() && d.incoming[0].dst[0] == 0.0 && d.incoming[0].dst[3] > 0.0, "{:?}", d.incoming);
+        assert!(d.incoming.iter().all(|p| p.dst[0] < 0.5), "nothing past the middle yet: {:?}", d.incoming);
+    }
+
+    #[test]
+    fn split_box_and_blinds_open_where_they_say() {
+        let h = frame(&Effect::Split { horizontal: true, inward: true }, 0.5).incoming;
+        assert_eq!(h, vec![at([0.0, 0.0, 1.0, 0.25]), at([0.0, 0.75, 1.0, 1.0])], "from the top and bottom edges");
+        let v = frame(&Effect::Split { horizontal: false, inward: false }, 0.5).incoming;
+        assert_eq!(v, vec![at([0.25, 0.0, 0.75, 1.0])], "a vertical band from the centre");
+        let b = frame(&Effect::Box { inward: false }, 0.5).incoming;
+        assert_eq!(b, vec![at([0.25, 0.25, 0.75, 0.75])]);
+        let bi = frame(&Effect::Box { inward: true }, 0.5).incoming;
+        assert_eq!(bi.len(), 4);
+        assert!((bi.iter().map(area).sum::<f32>() - 0.75).abs() < 1e-5, "a 0.5 hole is left in the middle");
+        let blinds = frame(&Effect::Blinds { horizontal: true }, 0.5).incoming;
+        assert_eq!(blinds.len(), BLINDS);
+        assert_eq!(blinds[1], at([0.0, 0.125, 1.0, 0.1875]), "each strip opens from its top");
+    }
+
+    #[test]
+    fn dissolve_and_glitter_show_a_share_of_cells_in_a_fixed_order() {
+        let half = frame(&Effect::Dissolve, 0.5).incoming;
+        assert_eq!(half.len(), GRID * GRID / 2);
+        assert_eq!(frame(&Effect::Dissolve, 0.5).incoming, half, "the same every time");
+        let quarter = frame(&Effect::Dissolve, 0.25).incoming;
+        assert_eq!(&half[..quarter.len()], &quarter[..], "cells only ever join");
+        assert!(half.windows(2).any(|w| w[0].dst[1] != w[1].dst[1] || w[0].dst[0] + 0.125 != w[1].dst[0]), "not in reading order");
+        // Glitter sweeps: at a third, every cell shown is in the left half for direction 0.
+        let g = frame(&Effect::Glitter { direction: 0 }, 0.3).incoming;
+        assert!(!g.is_empty() && g.iter().all(|p| p.dst[0] < 0.5), "{g:?}");
+        let g = frame(&Effect::Glitter { direction: 270 }, 0.3).incoming;
+        assert!(g.iter().all(|p| p.dst[1] < 0.5), "top first: {g:?}");
+    }
+
+    #[test]
+    fn push_cover_uncover_and_fly_move_whole_pages() {
+        let f = frame(&Effect::Push { direction: 0 }, 0.25);
+        assert_eq!(f.outgoing, vec![Piece { src: [0.0, 0.0, 0.75, 1.0], dst: [0.25, 0.0, 1.0, 1.0], alpha: 1.0 }], "the old page moves right");
+        assert_eq!(
+            f.incoming,
+            vec![Piece { src: [0.75, 0.0, 1.0, 1.0], dst: [0.0, 0.0, 0.25, 1.0], alpha: 1.0 }],
+            "the new page comes in from the left"
+        );
+        let f = frame(&Effect::Push { direction: 270 }, 0.5);
+        assert_eq!(f.incoming[0].dst, [0.0, 0.0, 1.0, 0.5], "top to bottom");
+        let c = frame(&Effect::Cover { direction: 180 }, 0.25);
+        assert_eq!(
+            (c.outgoing, c.incoming[0].dst),
+            (vec![whole(1.0)], [0.75, 0.0, 1.0, 1.0]),
+            "the old page stays, the new slides in from the right"
+        );
+        let u = frame(&Effect::Uncover { direction: 90 }, 0.25);
+        assert_eq!((u.incoming, u.outgoing[0].dst), (vec![whole(1.0)], [0.0, 0.0, 1.0, 0.75]), "the old page slides up off the new one");
+        // Fly in from the centre: a quarter-size page in the middle at the start, growing.
+        let f = frame(&Effect::Fly { direction: None, inward: true, scale: 0.25 }, 0.5);
+        let p = f.incoming[0];
+        assert_eq!(p.src, FULL, "the whole page, small");
+        assert!((p.dst[2] - p.dst[0] - 0.625).abs() < 1e-5 && (p.dst[0] - 0.1875).abs() < 1e-5, "{p:?}");
+        // Fly in from the left: off-page at the start, so nothing to paint yet.
+        assert!(frame(&Effect::Fly { direction: Some(0), inward: true, scale: 1.0 }, 1e-3).incoming.first().is_some_and(|p| p.dst[2] < 0.01));
+        // Fly out: the old page leaves to the right over the new page.
+        let f = frame(&Effect::Fly { direction: Some(0), inward: false, scale: 1.0 }, 0.5);
+        assert_eq!((f.incoming, f.outgoing[0].dst), (vec![whole(1.0)], [0.5, 0.0, 1.0, 1.0]));
+    }
+
+    #[test]
+    fn effects_come_from_trans_parts_with_the_defaults() {
+        assert_eq!(Effect::from_parts("Wipe", true, true, Some(270), 1.0), Effect::Wipe { direction: 270 });
+        assert_eq!(
+            Effect::from_parts("Wipe", true, true, Some(45), 1.0),
+            Effect::Wipe { direction: 0 },
+            "a direction outside the five is the default"
+        );
+        assert_eq!(Effect::from_parts("Split", false, false, Some(90), 1.0), Effect::Split { horizontal: false, inward: false });
+        assert_eq!(Effect::from_parts("Fly", true, true, None, 0.5), Effect::Fly { direction: None, inward: true, scale: 0.5 });
+        assert_eq!(
+            Effect::from_parts("Fly", true, false, Some(315), f32::NAN),
+            Effect::Fly { direction: None, inward: false, scale: 1.0 },
+            "Fly has no diagonal; a bad scale is 1"
+        );
+        assert_eq!(Effect::from_parts("Swirl", true, true, Some(0), 1.0), Effect::Replace);
+        assert_eq!(Effect::from_parts("R", true, true, Some(0), 1.0), Effect::Replace);
+    }
+}
diff --git a/crates/render/tests/jbig2_invariants.rs b/crates/render/tests/jbig2_invariants.rs
new file mode 100644
index 000000000..436782573
--- /dev/null
+++ b/crates/render/tests/jbig2_invariants.rs
@@ -0,0 +1,100 @@
+//! Every JBIG2 conformance fixture in the corpus encodes the same picture.
+//!
+//! The 96 `bitmap-*.pdf` files are a conformance suite: one small drawing, encoded through every
+//! corner of JBIG2 — generic regions with each template and with custom AT pixels, typical
+//! prediction (TPGDON, TPGRON), refinement, halftone regions with and without skip, symbol
+//! dictionaries with Huffman tables, MMR, composition operators, random access, unknown-height
+//! segments. The features change how the bytes are compressed. They do not change the picture.
+//!
+//! So a correct decoder renders all 96 identically, and any file that comes out different is a
+//! decoder bug. That is a real test with no reference image and no external oracle: the suite
+//! checks itself.
+//!
+//! It is worth having because the property settled a question the render oracle raised and could
+//! not answer. `cargo xtask render-oracle` put four JBIG2 fixtures at the top of its disagreement
+//! list against Poppler, and the natural reading was that `hayro-jbig2`, which carries local
+//! patches, had a bug. The opposite is true. Measured over this suite: **we render 1 distinct
+//! image across all 96; Poppler renders 8**, drawing nothing at all for the seven halftone-skip
+//! and symbol fixtures and mis-decoding TPGRON refinement. An oracle is not ground truth. This
+//! invariant is.
+//!
+//! Runs over `corpus/pdfjs/test/pdfs` when present (`cargo xtask corpus` fetches and verifies it);
+//! a no-op when absent, so CI without the corpus stays green. The expectation that every fixture
+//! holds the same picture is a property of the **pinned** corpus; whoever re-pins it to a newer
+//! pdf.js should re-check this test rather than assume it still holds.
+
+use std::collections::BTreeMap;
+use std::sync::Arc;
+
+use pdfcraft_render::{PageRenderer, RenderConfig, RenderRequest, RequestKind};
+
+/// `corpus/pdfjs/test/pdfs`, or `None` when nothing has been fetched.
+///
+/// Panics when the checkout exists without the stamp `cargo xtask corpus` writes on a successful
+/// verification: an unverified corpus must fail loudly rather than skip, as in `pdfcraft-cos`'s
+/// corpus tests.
+fn corpus() -> Option<std::path::PathBuf> {
+    let dir = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../../corpus/pdfjs");
+    if !dir.is_dir() {
+        return None;
+    }
+    assert!(
+        dir.join(".pdfcraft-corpus.json").is_file(),
+        "{} exists but has not been verified against the pin; run `cargo xtask corpus`",
+        dir.display()
+    );
+    Some(dir.join("test/pdfs"))
+}
+
+/// Page 1 as premultiplied RGBA at 1:1, or `None` when it could not be rendered.
+fn render(path: &std::path::Path) -> Option<(u32, u32, Vec<u8>)> {
+    let bytes = std::fs::read(path).ok()?;
+    let mut renderer = PageRenderer::new(Arc::new(bytes), RenderConfig { reject_oversize: true, ..Default::default() });
+    let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, preview: false });
+    page.error.is_none().then_some((page.width, page.height, page.rgba.to_vec()))
+}
+
+#[test]
+#[ignore = "needs corpus/; run with --ignored"]
+fn every_jbig2_conformance_fixture_decodes_to_the_same_picture() {
+    let Some(dir) = corpus() else {
+        eprintln!("corpus not fetched; skipping (cargo xtask corpus)");
+        return;
+    };
+    let mut fixtures: Vec<std::path::PathBuf> = std::fs::read_dir(&dir)
+        .into_iter()
+        .flatten()
+        .flatten()
+        .map(|e| e.path())
+        .filter(|p| p.extension().is_some_and(|e| e == "pdf") && p.file_stem().and_then(|s| s.to_str()).is_some_and(|s| s.starts_with("bitmap")))
+        .collect();
+    fixtures.sort();
+
+    // Group by what each one drew. One group means every feature decoded to the same picture.
+    let mut groups: BTreeMap<(u32, u32, Vec<u8>), Vec<String>> = BTreeMap::new();
+    let mut unrenderable = Vec::new();
+    for path in &fixtures {
+        let name = path.file_stem().map(|s| s.to_string_lossy().into_owned()).unwrap_or_default();
+        match render(path) {
+            Some(image) => groups.entry(image).or_default().push(name),
+            None => unrenderable.push(name),
+        }
+    }
+
+    assert!(fixtures.len() >= 90, "expected the JBIG2 conformance fixtures in the pinned corpus, found {}", fixtures.len());
+    assert!(unrenderable.is_empty(), "every fixture must render: {unrenderable:?}");
+
+    if groups.len() > 1 {
+        // Name the odd ones out: the largest group is what the picture should be, so anything
+        // else is the bug, and saying which files they are is the whole value of the failure.
+        let mut sized: Vec<(usize, &Vec<String>)> = groups.values().map(|names| (names.len(), names)).collect();
+        sized.sort_by_key(|(n, _)| std::cmp::Reverse(*n));
+        let report: Vec<String> = sized.iter().skip(1).map(|(n, names)| format!("{n} file(s): {names:?}")).collect();
+        panic!(
+            "JBIG2 coding features must not change the picture, but {} of {} fixtures decoded differently:\n  {}",
+            fixtures.len().saturating_sub(sized.first().map_or(0, |(n, _)| *n)),
+            fixtures.len(),
+            report.join("\n  ")
+        );
+    }
+}
diff --git a/crates/render/tests/search.rs b/crates/render/tests/search.rs
new file mode 100644
index 000000000..44fbe4935
--- /dev/null
+++ b/crates/render/tests/search.rs
@@ -0,0 +1,112 @@
+use pdfcraft_render::{PageText, TextGlyph, text::fold_case};
+use std::ops::Range;
+
+fn page(parts: &[&str]) -> PageText {
+    PageText {
+        glyphs: parts.iter().map(|text| TextGlyph { text: (*text).into(), rect: [0.0; 4], quad: [[0.0; 2]; 4], direction: [1.0, 0.0] }).collect(),
+        line_of: vec![0; parts.len()],
+        space_before: vec![false; parts.len()],
+    }
+}
+
+// The original straightforward search is an independent oracle for valid page metadata.
+fn reference(page: &PageText, query: &str, sensitive: bool, whole: bool, limit: usize) -> Vec<Range<usize>> {
+    let fold = |s: &str| if sensitive { s.to_owned() } else { fold_case(s) };
+    let needle: Vec<char> = fold(query).split_whitespace().collect::<Vec<_>>().join(" ").chars().collect();
+    if needle.is_empty() || limit == 0 {
+        return Vec::new();
+    }
+    let mut chars = Vec::new();
+    for (i, glyph) in page.glyphs.iter().enumerate() {
+        if i > 0 && (page.space_before[i] || page.line_of[i] != page.line_of[i - 1]) && chars.last().is_some_and(|&(c, _)| c != ' ') {
+            chars.push((' ', i));
+        }
+        for c in fold(&glyph.text).chars() {
+            let c = if c.is_whitespace() { ' ' } else { c };
+            if c != ' ' || chars.last().is_none_or(|&(last, _)| last != ' ') {
+                chars.push((c, i));
+            }
+        }
+    }
+    let word = |i: Option<usize>| i.and_then(|i| chars.get(i)).is_some_and(|&(c, _)| c.is_alphanumeric());
+    let mut hits = Vec::new();
+    let mut start = 0;
+    while start + needle.len() <= chars.len() {
+        let end = start + needle.len();
+        if (!whole || (!word(start.checked_sub(1)) && !word(Some(end)))) && chars[start..end].iter().map(|&(c, _)| c).eq(needle.iter().copied()) {
+            hits.push(chars[start].1..chars[end - 1].1 + 1);
+            if hits.len() == limit {
+                break;
+            }
+            start = end;
+        } else {
+            start += 1;
+        }
+    }
+    hits
+}
+
+#[test]
+fn search_tolerates_missing_layout_metadata() {
+    let mut text = page(&["a", "b", "c"]);
+    text.line_of.clear();
+    text.space_before.clear();
+    assert_eq!(text.find("abc"), vec![0..3]);
+    text.space_before = vec![false, true];
+    assert_eq!(text.find("a bc"), vec![0..3]);
+    text.line_of = vec![0, 1];
+    assert_eq!(text.find("a bc"), vec![0..3]);
+}
+
+#[test]
+fn whole_word_rejection_keeps_overlapping_candidates() {
+    let text = page(&["xaa-aa-aa"]);
+    assert_eq!(text.find_opts("aa-aa", true, true), vec![0..1]);
+    // Accepted matches still do not overlap, even within one multi-character glyph.
+    assert_eq!(page(&["aaaaa"]).find("aaa"), vec![0..1]);
+    assert_eq!(page(&["aaaaa"]).find("aa"), vec![0..1, 0..1]);
+}
+
+#[test]
+fn search_matches_reference_for_unicode_gaps_limits_and_word_boundaries() {
+    let alphabet = ["a", "b", " ", "-", "İ", "ı", "ς", "Σ", "\t", "\n", "ffi", "", "界", "e\u{301}", "العربية"];
+    let mut seed = 1234567u64;
+    let mut next = || {
+        seed = seed.wrapping_mul(6364136223846793005).wrapping_add(1);
+        (seed >> 32) as usize
+    };
+    for case in 0..2000 {
+        let parts: Vec<_> = (0..10 + case % 70).map(|_| alphabet[next() % alphabet.len()]).collect();
+        let query = if case % 2 == 0 {
+            parts.iter().skip(case % 8).take(1 + case % 9).copied().collect::<String>()
+        } else {
+            (0..1 + case % 9).map(|_| alphabet[next() % alphabet.len()]).collect::<String>()
+        };
+        let mut text = page(&parts);
+        for i in 1..parts.len() {
+            text.space_before[i] = next() % 11 == 0;
+            text.line_of[i] = text.line_of[i - 1] + u32::from(next() % 17 == 0);
+        }
+        for sensitive in [false, true] {
+            for whole in [false, true] {
+                for limit in [0, 1, 2, usize::MAX] {
+                    assert_eq!(
+                        text.find_opts_limited(&query, sensitive, whole, limit),
+                        reference(&text, &query, sensitive, whole, limit),
+                        "case {case}: {query:?}, sensitive={sensitive}, whole={whole}, limit={limit}"
+                    );
+                }
+            }
+        }
+    }
+}
+
+#[test]
+fn long_repeated_prefix_search_preserves_the_last_match_and_limit() {
+    let mut parts = vec!["a"; 131072];
+    parts.push("b");
+    let text = page(&parts);
+    let query = format!("{}b", "a".repeat(4095));
+    assert_eq!(text.find_opts_limited(&query, false, false, 1), vec![126977..131073]);
+    assert!(text.find(&format!("{}c", "a".repeat(4095))).is_empty());
+}
diff --git a/crates/sign/src/pdf.rs b/crates/sign/src/pdf.rs
index 012cd43a6..903673769 100644
--- a/crates/sign/src/pdf.rs
+++ b/crates/sign/src/pdf.rs
@@ -156,13 +156,15 @@ impl DigestCache {
         candidates
     }
 
-    /// The signed revision `bytes[..end]`, parsed (and kept).
-    fn revision(&self, bytes: &[u8], end: usize) -> Option<Document> {
+    /// The signed revision `bytes[..end]`, parsed (and kept). An encrypted one is opened with
+    /// `doc`'s own key (the same `/Encrypt` and `/ID`), so a user password the document was
+    /// opened with is neither needed again nor kept here (#1808).
+    fn revision(&self, doc: &Document, bytes: &[u8], end: usize) -> Option<Document> {
         let key = (end, fingerprint(&bytes[..end]));
         if let Some(d) = self.revisions.lock().ok().and_then(|m| m.get(&key).cloned()) {
             return Some(d);
         }
-        let d = Document::open(Arc::new(bytes[..end].to_vec())).ok()?;
+        let d = doc.open_with_same_credentials(Arc::new(bytes[..end].to_vec())).ok()?;
         if let Ok(mut m) = self.revisions.lock() {
             if m.len() > 8 {
                 m.clear();
@@ -726,7 +728,7 @@ fn validate_into(doc: &Document, bytes: &[u8], trust: &TrustStore, v: &Dict, inf
     let covered = o1 + l1;
     info.signed_len = covered;
     // The signed revision's number: its cross-reference sections (1 for a reconstructed file).
-    info.revision = cache.revision(bytes, covered).map_or(1, |d| d.revisions().len().max(1));
+    info.revision = cache.revision(doc, bytes, covered).map_or(1, |d| d.revisions().len().max(1));
     // What can't be checked is unknown, not invalid: only data that is wrong or fails its check
     // is "invalid".
     let unsupported = |info: &mut SignatureInfo, why: &str| {
@@ -853,7 +855,7 @@ fn finish_validation(
     info.modification = if covered == bytes.len() || bytes[covered..].iter().all(|b| b.is_ascii_whitespace() || *b == 0) {
         Modification::None
     } else {
-        classify_changes(doc, cache.revision(bytes, covered), info.certify)
+        classify_changes(doc, cache.revision(doc, bytes, covered), info.certify)
     };
     let mut problems = false;
     // The changes are handed over as the words they are, not stitched into the sentence, so an
@@ -1015,7 +1017,7 @@ fn validate_doc_timestamp(doc: &Document, bytes: &[u8], v: &Dict, info: &mut Sig
     };
     let covered = o1 + l1;
     info.signed_len = covered;
-    info.revision = cache.revision(bytes, covered).map_or(1, |d| d.revisions().len().max(1));
+    info.revision = cache.revision(doc, bytes, covered).map_or(1, |d| d.revisions().len().max(1));
     let token = match crate::timestamp::parse_token(&contents) {
         Ok(t) => t,
         Err(e) => return invalid(info, Detail::of("The timestamp token could not be read ({}).", Fill::Reason(e.to_string()))),
@@ -1038,7 +1040,7 @@ fn validate_doc_timestamp(doc: &Document, bytes: &[u8], v: &Dict, info: &mut Sig
     info.modification = if covered == bytes.len() || bytes[covered..].iter().all(|b| b.is_ascii_whitespace() || *b == 0) {
         Modification::None
     } else {
-        classify_changes(doc, cache.revision(bytes, covered), None)
+        classify_changes(doc, cache.revision(doc, bytes, covered), None)
     };
     match &info.modification {
         Modification::None => info.details.push(Detail::plain("This document has not been modified since this timestamp was applied.")),
@@ -1203,6 +1205,8 @@ fn classify_changes(doc: &Document, old: Option<Document>, p: Option<u8>) -> Mod
     // attacker-written version carries (relabelling a signed page /Type /Sig, or dropping its
     // /Type and adding /ModDate, must not reclassify it away from page content).
     let signed_pages: HashSet<ObjRef> = pdfcraft_annot::page_refs(&old).unwrap_or_default().into_iter().collect();
+    // What each signed page draws from, by the role it held when signed (#1787).
+    let signed_resources = signed_page_resources(&old, &signed_pages);
     let old_info = old.trailer().get(b"Info").and_then(Object::as_ref);
     let (mut allowed, mut disallowed): (Vec<&'static str>, Vec<&'static str>) = (Vec::new(), Vec::new());
     let dss = dss_parts(doc, &old);
@@ -1248,10 +1252,23 @@ fn classify_changes(doc: &Document, old: Option<Document>, p: Option<u8>) -> Mod
             }
             continue;
         }
-        let what = match &*new {
+        // A resource of a signed page is page content whatever keys its new version carries
+        // (#1787): a /FT or /Subtype /Widget written by whoever rewrote a font, an XObject or a
+        // graphics state does not make that a form fill. A container (the resources dictionary,
+        // a category dictionary) that kept every entry it had and only gained names changes
+        // nothing the signed content draws, and is judged as before.
+        let kept_entries = |d: &Dict| before.as_deref().and_then(Object::as_dict).is_some_and(|b| b.iter().all(|(k, v)| d.get(k) == Some(v)));
+        let resource_kind = match (signed_resources.get(&r), &*new) {
+            (Some(false), _) => Some(kind::PAGE_CONTENT),
+            (Some(true), Object::Dict(d)) if kept_entries(d) => None,
+            (Some(true), _) => Some(kind::PAGE_CONTENT),
+            (None, _) => None,
+        };
+        let what = match (resource_kind, &*new) {
+            (Some(k), _) => k,
             // The Document Security Store's own arrays and dictionaries, when they only grew.
-            _ if dss.contains(&num) => kind::SECURITY_STORE,
-            Object::Dict(d) => {
+            (_, _) if dss.contains(&num) => kind::SECURITY_STORE,
+            (_, Object::Dict(d)) => {
                 let was = before.as_deref().and_then(Object::as_dict);
                 if signed_pages.contains(&r) {
                     // A signed page is always judged by what the page shows, whatever it is now
@@ -1264,7 +1281,7 @@ fn classify_changes(doc: &Document, old: Option<Document>, p: Option<u8>) -> Mod
                     change_kind(doc, &old, d, was)
                 }
             }
-            Object::Stream(s) => {
+            (_, Object::Stream(s)) => {
                 // File plumbing is what the stream was when signed: the /Type it has now is
                 // written by whoever changed it, and the renderer ignores /Type (a page's Form
                 // XObject relabelled /ObjStm still draws its new content).
@@ -1485,6 +1502,88 @@ fn is_signature_dict(d: &Dict) -> bool {
     matches!(d.name(b"Type"), Some(b"Sig" | b"DocTimeStamp" | b"SigRef" | b"TransformParams")) || d.name(b"FT") == Some(b"Sig")
 }
 
+/// The objects the signed pages draw from, by reference, with the role each held when signed
+/// (#1787): `true` for a container (a page's resources dictionary, or one of its category
+/// dictionaries), where a name added later can't be reached by unchanged content; `false` for
+/// everything reached from a container's entries (fonts and their files, XObjects and their own
+/// resources, graphics states and soft masks, colour spaces, patterns, shadings, optional-content
+/// properties), where any change changes what the page shows. Resources are the page's own or
+/// inherited. Bounded by depth and by the number of objects visited; past the bound the rest is
+/// judged as before.
+fn signed_page_resources(old: &Document, pages: &HashSet<ObjRef>) -> HashMap<ObjRef, bool> {
+    const CATEGORIES: [&[u8]; 7] = [b"Font", b"XObject", b"ExtGState", b"ColorSpace", b"Pattern", b"Shading", b"Properties"];
+    const MAX_VISITED: usize = 50_000;
+    const MAX_DEPTH: u8 = 32;
+    const MAX_INHERITANCE: usize = 64;
+
+    /// Everything reachable from `o` is content the page draws (a leaf role, overriding a
+    /// container one reached by another path). A signed page or the catalog reached this way
+    /// (a `/P` or `/Parent` back-reference) keeps the role of its own: the walk stops there.
+    fn reach(old: &Document, o: &Object, depth: u8, stop: &HashSet<ObjRef>, roles: &mut HashMap<ObjRef, bool>) {
+        if roles.len() >= MAX_VISITED || depth > MAX_DEPTH {
+            return;
+        }
+        let resolved;
+        let o = match o {
+            Object::Ref(r) => {
+                if stop.contains(r) || roles.insert(*r, false).is_some() {
+                    return;
+                }
+                resolved = old.get(*r);
+                &*resolved
+            }
+            other => other,
+        };
+        match o {
+            Object::Dict(d) => d.iter().for_each(|(_, v)| reach(old, v, depth + 1, stop, roles)),
+            Object::Stream(s) => s.dict.iter().for_each(|(_, v)| reach(old, v, depth + 1, stop, roles)),
+            Object::Array(a) => a.iter().for_each(|v| reach(old, v, depth + 1, stop, roles)),
+            _ => {}
+        }
+    }
+
+    /// A page's `/Resources`, its own or the nearest ancestor's.
+    fn resources(old: &Document, page: ObjRef) -> Option<Object> {
+        let mut seen = HashSet::new();
+        let mut cur = page;
+        while seen.insert(cur) && seen.len() <= MAX_INHERITANCE {
+            let d = old.get(cur);
+            let d = d.as_dict()?;
+            if let Some(r) = d.get(b"Resources") {
+                return Some(r.clone());
+            }
+            cur = d.get(b"Parent").and_then(Object::as_ref)?;
+        }
+        None
+    }
+
+    let mut roles = HashMap::new();
+    let mut stop = pages.clone();
+    stop.extend(old.root());
+    for page in pages {
+        let Some(res) = resources(old, *page) else { continue };
+        let container = |o: &Object, roles: &mut HashMap<ObjRef, bool>| -> Arc<Object> {
+            match o {
+                Object::Ref(r) => {
+                    roles.entry(*r).or_insert(true);
+                    old.get(*r)
+                }
+                other => Arc::new(other.clone()),
+            }
+        };
+        let res = container(&res, &mut roles);
+        let Some(d) = res.as_dict() else { continue };
+        for category in CATEGORIES {
+            let Some(v) = d.get(category) else { continue };
+            let category = container(v, &mut roles);
+            if let Some(entries) = category.as_dict() {
+                entries.iter().for_each(|(_, entry)| reach(old, entry, 0, &stop, &mut roles));
+            }
+        }
+    }
+    roles
+}
+
 /// A changed object that was a page in the signed revision, judged by what the page shows rather
 /// than by any `/Type` its new version carries. Only added annotations are permitted; any other
 /// difference (content, resources, a relabelled or dropped `/Type`) is a page content change.
@@ -1605,6 +1704,27 @@ impl Default for AppearanceLabels {
     }
 }
 
+impl AppearanceLabels {
+    /// Each label with its field name (`signed_by`, `distinguished_name`, `reason`, `location`,
+    /// `date`), in the order the visible signature shows them.
+    pub fn fields(&self) -> [(&'static str, &str); 5] {
+        [
+            ("signed_by", self.signed_by.as_str()),
+            ("distinguished_name", self.distinguished_name.as_str()),
+            ("reason", self.reason.as_str()),
+            ("location", self.location.as_str()),
+            ("date", self.date.as_str()),
+        ]
+    }
+
+    /// The first label, with its field name, that has a character the visible signature's font
+    /// can't draw, and that character. Signing refuses such a label when it is shown, so an
+    /// interface checks its translated labels here and falls back to [`Default`] if one fails.
+    pub fn first_undrawable(&self) -> Option<(&'static str, char)> {
+        self.fields().into_iter().find_map(|(field, text)| pdfcraft_fonts::first_undrawable(text).map(|c| (field, c)))
+    }
+}
+
 #[derive(Clone, Debug, Default)]
 pub struct SignOptions {
     /// Sign this existing, unsigned signature field.
@@ -1948,6 +2068,7 @@ pub fn display_date(pdf: &str) -> String {
 /// Helvetica (the signer's name, the certificate's subject, the reason or the location) has a
 /// character Helvetica can't draw: signing invisibly, or leaving that part out, still works. A
 /// graphic doesn't change this: the name it replaces on the left is still among the details.
+/// A label that is drawn ([`AppearanceLabels`], the caller's words) is refused the same way.
 fn appearance(doc: &mut Document, rect: [f64; 4], name: &str, cert: &Certificate, opts: &SignOptions) -> Result<Stream, SignError> {
     use pdfcraft_fonts::{first_undrawable, helvetica_width, literal, undrawable_message, win_ansi, wrap};
     let (w, h) = ((rect[2] - rect[0]).max(0.0), (rect[3] - rect[1]).max(0.0));
@@ -1968,6 +2089,17 @@ fn appearance(doc: &mut Document, rect: [f64; 4], name: &str, cert: &Certificate
                 )));
             }
         }
+        // The labels are the caller's words (a translation), checked as the details are: only
+        // those that are drawn, as each is drawn only beside its detail.
+        let has = |v: Option<&str>| v.is_some_and(|v| !v.is_empty());
+        let drawn = [a.name, a.distinguished_name, a.reason && has(opts.reason.as_deref()), a.location && has(opts.location.as_deref()), a.date];
+        let mut labels = opts.appearance_labels.fields().into_iter().zip(drawn).filter(|&(_, on)| a.labels && on);
+        if let Some((field, c)) = labels.find_map(|((field, text), _)| first_undrawable(text).map(|c| (field, c))) {
+            return Err(SignError::Unsupported(format!(
+                "{}; pass that label in Western European characters, or leave the labels out of the visible signature",
+                undrawable_message(&format!("the {field} label of the visible signature"), c)
+            )));
+        }
     }
     let mut lines: Vec<String> = Vec::new();
     let label = |l: &str, v: &str| if a.labels { format!("{l}{v}") } else { v.to_string() };
diff --git a/crates/sign/src/pkcs12.rs b/crates/sign/src/pkcs12.rs
index ab83e747c..a71d5c858 100644
--- a/crates/sign/src/pkcs12.rs
+++ b/crates/sign/src/pkcs12.rs
@@ -6,7 +6,8 @@
 //! Files that aren't clean DER still open: trailing whitespace, PEM armour or a bare
 //! base64 body (#159).
 //! Writing uses PBES2 AES-256-CBC with PBKDF2-HMAC-SHA-256 and an HMAC-SHA-256 MAC, OpenSSL 3's
-//! defaults.
+//! algorithms, at [`WRITE_ROUNDS`] rather than OpenSSL's 2048. Opening stops at a fixed amount
+//! of key-derivation work, whatever the file asks for.
 //!
 //! The envelope is read as BER, not DER: Windows writes `.p12` files with indefinite lengths and
 //! the AuthenticatedSafe split into OCTET STRING segments, and nothing in the envelope is signed
@@ -48,6 +49,42 @@ const PBE_SHA_2DES: &str = "1.2.840.113549.1.12.1.4";
 const PBE_SHA_RC2_128: &str = "1.2.840.113549.1.12.1.5";
 const PBE_SHA_RC2_40: &str = "1.2.840.113549.1.12.1.6";
 
+/// Key-derivation rounds for new files: OWASP's figure for PBKDF2-HMAC-SHA-256. The MAC uses the
+/// same count, because checking it alone tells whether a guessed password is right (#1847).
+pub const WRITE_ROUNDS: u32 = 600_000;
+
+/// The shortest password a new digital ID may have (NIST SP 800-63B). Opening an existing file
+/// takes any password, so nobody is locked out of an ID made before this minimum.
+pub const MIN_PASSWORD_CHARS: usize = 8;
+
+/// The most key-derivation work one [`open`] does, in hash blocks summed over every derivation
+/// in the file. The file names its own iteration counts, so without a budget a crafted file
+/// hangs the caller on the password check (#1847). A file written by [`write`] needs about
+/// 2 million; real files from other tools need far less.
+const OPEN_BUDGET: u64 = 10_000_000;
+
+/// What is left of [`OPEN_BUDGET`] while one file is opened.
+struct Budget(u64);
+
+impl Budget {
+    /// Spend `rounds` iterations to derive `len` bytes with `alg`, and return them as the `u32`
+    /// the derivation takes, or refuse the file if the budget runs out.
+    fn spend(&mut self, alg: DigestAlg, rounds: u64, len: usize) -> Result<u32, SignError> {
+        // Every derivation hashes at least once, and repeats the rounds for each output block.
+        let blocks = len.div_ceil(alg.digest(&[]).len().max(1)).max(1) as u64;
+        let cost = rounds.max(1).saturating_mul(blocks);
+        match (self.0.checked_sub(cost), u32::try_from(rounds)) {
+            (Some(left), Ok(rounds)) => {
+                self.0 = left;
+                Ok(rounds)
+            }
+            _ => {
+                Err(SignError::Unsupported(format!("PKCS #12 files that need more than {OPEN_BUDGET} rounds of key derivation ({rounds} asked for)")))
+            }
+        }
+    }
+}
+
 /// What a digital ID file holds: the signing key, its certificate and any others (issuers).
 #[derive(Debug)]
 pub struct DigitalId {
@@ -182,7 +219,7 @@ fn pbkdf2(prf: DigestAlg, password: &[u8], salt: &[u8], rounds: u32, len: usize)
 }
 
 /// Decrypt `ct` with the password-based scheme `alg` (an AlgorithmIdentifier).
-fn pbe_decrypt(alg: &Tlv<'_>, password: &str, ct: &[u8]) -> Result<Vec<u8>, SignError> {
+fn pbe_decrypt(alg: &Tlv<'_>, password: &str, ct: &[u8], budget: &mut Budget) -> Result<Vec<u8>, SignError> {
     let parts = alg.children()?;
     let o = parts.first().ok_or_else(|| bad("algorithm"))?.oid()?;
     let params = parts.get(1).ok_or_else(|| bad("algorithm parameters"))?;
@@ -196,7 +233,7 @@ fn pbe_decrypt(alg: &Tlv<'_>, password: &str, ct: &[u8]) -> Result<Vec<u8>, Sign
             }
             let kp = kdf.get(1).ok_or_else(|| bad("PBKDF2 parameters"))?.children()?;
             let salt = kp.first().ok_or_else(|| bad("salt"))?.octets("salt")?;
-            let rounds = kp.get(1).ok_or_else(|| bad("iterations"))?.u64()? as u32;
+            let rounds = kp.get(1).ok_or_else(|| bad("iterations"))?.u64()?;
             let prf = match kp
                 .iter()
                 .skip(2)
@@ -222,13 +259,14 @@ fn pbe_decrypt(alg: &Tlv<'_>, password: &str, ct: &[u8]) -> Result<Vec<u8>, Sign
                 other => return Err(SignError::Unsupported(format!("PBES2 cipher {}", other.unwrap_or("?")))),
             };
             let iv = sc.get(1).ok_or_else(|| bad("IV"))?.octets("IV")?;
+            let rounds = budget.spend(prf, rounds, cipher.key_len())?;
             let key = pbkdf2(prf, password.as_bytes(), &salt, rounds, cipher.key_len())?;
             cipher.decrypt(&key, &iv, ct)
         }
         PBE_SHA_3DES | PBE_SHA_2DES | PBE_SHA_RC2_128 | PBE_SHA_RC2_40 => {
             let p = params.children()?;
             let salt = p.first().ok_or_else(|| bad("salt"))?.octets("salt")?;
-            let rounds = p.get(1).ok_or_else(|| bad("iterations"))?.u64()? as u32;
+            let rounds = p.get(1).ok_or_else(|| bad("iterations"))?.u64()?;
             let (cipher, key_len, iv_len) = match o.as_str() {
                 PBE_SHA_3DES => (Cipher::TripleDes, 24, 8),
                 PBE_SHA_2DES => (Cipher::TripleDes, 16, 8),
@@ -236,6 +274,9 @@ fn pbe_decrypt(alg: &Tlv<'_>, password: &str, ct: &[u8]) -> Result<Vec<u8>, Sign
                 _ => (Cipher::Rc2(40), 5, 8),
             };
             let pw = bmp(password);
+            // Two derivations from the same count: the key, then the IV.
+            let rounds = budget.spend(DigestAlg::Sha1, rounds, key_len)?;
+            budget.spend(DigestAlg::Sha1, u64::from(rounds), iv_len)?;
             let mut key = pkcs12_kdf(DigestAlg::Sha1, &pw, &salt, 1, rounds, key_len);
             if key.len() == 16 && matches!(cipher, Cipher::TripleDes) {
                 // Two-key 3DES: K1 K2 K1.
@@ -260,7 +301,7 @@ enum BagKind {
     Cert(Vec<u8>),
 }
 
-fn bags(safe_contents: &[u8], password: &str, out: &mut Vec<Bag>) -> Result<(), SignError> {
+fn bags(safe_contents: &[u8], password: &str, out: &mut Vec<Bag>, budget: &mut Budget) -> Result<(), SignError> {
     for bag in Tlv::parse_all_ber(safe_contents)?.children()? {
         let f = bag.children()?;
         let Some(id) = f.first().and_then(|o| o.oid().ok()) else { continue };
@@ -282,7 +323,7 @@ fn bags(safe_contents: &[u8], password: &str, out: &mut Vec<Bag>) -> Result<(),
             SHROUDED_KEY_BAG => {
                 let p = value.children()?;
                 let [alg, data] = p.as_slice() else { return Err(bad("EncryptedPrivateKeyInfo")) };
-                BagKind::Key(pbe_decrypt(alg, password, &data.octets("encrypted private key")?)?)
+                BagKind::Key(pbe_decrypt(alg, password, &data.octets("encrypted private key")?, budget)?)
             }
             CERT_BAG => {
                 let p = value.children()?;
@@ -355,6 +396,7 @@ pub fn open(bytes: &[u8], password: &str) -> Result<DigitalId, SignError> {
         return Err(SignError::Unsupported("public-key protected PKCS #12 files".into()));
     }
     let content = auth_safe.get(1).ok_or_else(|| bad("authSafe content"))?.inner()?.octets("authSafe")?;
+    let mut budget = Budget(OPEN_BUDGET);
     // The MAC proves the password before anything is decrypted. It covers the contents of that
     // OCTET STRING — the segments joined, if the file is segmented, which is what wrote them.
     if let Some(mac) = pfx.get(2) {
@@ -367,8 +409,9 @@ pub fn open(bytes: &[u8], password: &str) -> Result<DigitalId, SignError> {
             .ok_or_else(|| SignError::Unsupported(format!("MAC digest {alg_oid}")))?;
         let expected = digest_info.get(1).ok_or_else(|| bad("MAC"))?.octets("MAC")?;
         let salt = m.get(1).ok_or_else(|| bad("MAC salt"))?.octets("MAC salt")?;
-        let iterations = m.get(2).map(|i| i.u64()).transpose()?.unwrap_or(1) as u32;
+        let iterations = m.get(2).map(|i| i.u64()).transpose()?.unwrap_or(1);
         let key_len = alg.digest(&[]).len();
+        let iterations = budget.spend(alg, iterations, key_len)?;
         let key = pkcs12_kdf(alg, &bmp(password), &salt, 3, iterations, key_len);
         if hmac(alg, &key, &content)? != *expected {
             return Err(SignError::WrongPassword);
@@ -380,7 +423,7 @@ pub fn open(bytes: &[u8], password: &str) -> Result<DigitalId, SignError> {
         let kind = p.first().ok_or_else(|| bad("ContentInfo"))?.oid()?;
         let body = p.get(1).ok_or_else(|| bad("ContentInfo content"))?.inner()?;
         match kind.as_str() {
-            DATA => bags(&body.octets("SafeContents")?, password, &mut all)?,
+            DATA => bags(&body.octets("SafeContents")?, password, &mut all, &mut budget)?,
             ENCRYPTED_DATA => {
                 let ed = body.children()?;
                 let eci = ed.get(1).ok_or_else(|| bad("EncryptedContentInfo"))?.children()?;
@@ -397,8 +440,8 @@ pub fn open(bytes: &[u8], password: &str) -> Result<DigitalId, SignError> {
                     }
                     _ => return Err(bad("encryptedContent")),
                 };
-                let plain = pbe_decrypt(alg, password, &ct)?;
-                bags(&plain, password, &mut all)?;
+                let plain = pbe_decrypt(alg, password, &ct, &mut budget)?;
+                bags(&plain, password, &mut all, &mut budget)?;
             }
             _ => {}
         }
@@ -441,16 +484,15 @@ fn random(n: usize) -> Result<Vec<u8>, SignError> {
 
 /// Write a digital ID as a `.p12` protected by `password`.
 pub fn write(id: &DigitalId, password: &str) -> Result<Vec<u8>, SignError> {
-    const ITER: u32 = 2048;
     let encrypt = |plain: &[u8]| -> Result<Vec<u8>, SignError> {
         let (salt, iv) = (random(16)?, random(16)?);
-        let key = pbkdf2(DigestAlg::Sha256, password.as_bytes(), &salt, ITER, 32)?;
+        let key = pbkdf2(DigestAlg::Sha256, password.as_bytes(), &salt, WRITE_ROUNDS, 32)?;
         let ct = cbc::Encryptor::<aes::Aes256>::new_from_slices(&key, &iv)
             .map_err(|_| SignError::Crypto("AES".into()))?
             .encrypt_padded_vec::<Pkcs7>(plain);
         let kdf = der::seq(&[
             &der::oid(PBKDF2),
-            &der::seq(&[&der::octets(&salt), &der::int(ITER as u64), &der::seq(&[&der::oid(HMAC_SHA256), &der::null()])]),
+            &der::seq(&[&der::octets(&salt), &der::int(WRITE_ROUNDS as u64), &der::seq(&[&der::oid(HMAC_SHA256), &der::null()])]),
         ]);
         let alg = der::seq(&[&der::oid(PBES2), &der::seq(&[&kdf, &der::seq(&[&der::oid(AES256_CBC), &der::octets(&iv)])])]);
         Ok(der::seq(&[&alg, &der::octets(&ct)]))
@@ -480,8 +522,31 @@ pub fn write(id: &DigitalId, password: &str) -> Result<Vec<u8>, SignError> {
     let ci_key = der::seq(&[&der::oid(DATA), &der::explicit(0, &der::octets(&der::seq(&[&key_bag])))]);
     let auth_safe = der::seq(&[&ci_certs, &ci_key]);
     let salt = random(16)?;
-    let mac_key = pkcs12_kdf(DigestAlg::Sha256, &bmp(password), &salt, 3, ITER, 32);
+    let mac_key = pkcs12_kdf(DigestAlg::Sha256, &bmp(password), &salt, 3, WRITE_ROUNDS, 32);
     let mac = hmac(DigestAlg::Sha256, &mac_key, &auth_safe)?;
-    let mac_data = der::seq(&[&der::seq(&[&DigestAlg::Sha256.algorithm(), &der::octets(&mac)]), &der::octets(&salt), &der::int(ITER as u64)]);
+    let mac_data = der::seq(&[&der::seq(&[&DigestAlg::Sha256.algorithm(), &der::octets(&mac)]), &der::octets(&salt), &der::int(WRITE_ROUNDS as u64)]);
     Ok(der::seq(&[&der::int(3), &der::seq(&[&der::oid(DATA), &der::explicit(0, &der::octets(&auth_safe))]), &mac_data]))
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn one_budget_covers_every_derivation_in_a_file() {
+        let mut budget = Budget(OPEN_BUDGET);
+        // What a file from `write` needs: the MAC and two PBKDF2 derivations.
+        for _ in 0..3 {
+            assert_eq!(budget.spend(DigestAlg::Sha256, WRITE_ROUNDS.into(), 32).ok(), Some(WRITE_ROUNDS));
+        }
+        // Six million rounds fit once, but not twice.
+        assert!(budget.spend(DigestAlg::Sha256, 6_000_000, 32).is_ok());
+        assert!(budget.spend(DigestAlg::Sha256, 6_000_000, 32).is_err());
+        // Each output block repeats the rounds: 24 bytes of SHA-1 are two blocks.
+        let mut budget = Budget(OPEN_BUDGET);
+        assert!(budget.spend(DigestAlg::Sha1, 6_000_000, 24).is_err());
+        // Zero rounds still hashes once.
+        assert_eq!(budget.spend(DigestAlg::Sha1, 0, 20).ok(), Some(0));
+        assert_eq!(budget.0, OPEN_BUDGET - 1);
+    }
+}
diff --git a/crates/sign/src/x509.rs b/crates/sign/src/x509.rs
index e3e784bae..1a0ef58ad 100644
--- a/crates/sign/src/x509.rs
+++ b/crates/sign/src/x509.rs
@@ -231,11 +231,15 @@ impl Extensions {
                     self.authority_key_id = aki.children().ok().and_then(|c| c.into_iter().find(|t| t.tag == tag::ctx(0))).map(|t| t.value.to_vec());
                 }
             }
-            // ExtendedKeyUsage: a SEQUENCE OF OID.
+            // ExtendedKeyUsage: a SEQUENCE OF OID. Like keyUsage, one that is present restricts
+            // the key even when it doesn't parse: an unreadable one allows no purpose at all.
             "2.5.29.37" => {
-                if let Ok(eku) = Tlv::parse_all(value.value) {
-                    self.extended_key_usage = eku.children().ok().map(|c| c.into_iter().filter_map(|t| t.oid().ok()).collect::<Vec<_>>());
-                }
+                let purposes = Tlv::parse_all(value.value)
+                    .ok()
+                    .filter(|eku| eku.tag == tag::SEQUENCE)
+                    .and_then(|eku| eku.children().ok())
+                    .and_then(|c| c.iter().map(|t| t.oid().ok()).collect::<Option<Vec<_>>>());
+                self.extended_key_usage = Some(purposes.unwrap_or_default());
             }
             // Authority Information Access: OCSP and CA-issuer locations.
             "1.3.6.1.5.5.7.1.1" => {
diff --git a/crates/sign/tests/chain.rs b/crates/sign/tests/chain.rs
index e8fd01274..ece529765 100644
--- a/crates/sign/tests/chain.rs
+++ b/crates/sign/tests/chain.rs
@@ -298,3 +298,30 @@ fn unreadable_constraint_extensions_fail_closed() {
     let c = issue("Garbled Constraints", None, FOREVER, &[garbage]);
     assert!(c.cert.has_basic_constraints && !c.cert.is_ca && !c.cert.may_issue());
 }
+
+#[test]
+fn an_unreadable_extended_key_usage_allows_no_purpose() {
+    // An extendedKeyUsage that is present restricts the key even when it doesn't parse (#1807):
+    // truncated, critical or not; a SET instead of a SEQUENCE; or a member that isn't an OID.
+    // Each would otherwise read as "no restriction", or as only its readable members.
+    let r = root();
+    let any = der::oid("2.5.29.37.0");
+    let truncated = [0x30, 0x05, 0x06];
+    let malformed = [
+        ext("2.5.29.37", &truncated),
+        der::seq(&[&der::oid("2.5.29.37"), &der::octets(&truncated)]),
+        ext("2.5.29.37", &der::tlv(tag::SET, &any)),
+        ext("2.5.29.37", &der::seq(&[&der::int(1), &any])),
+    ];
+    for (i, eku) in malformed.into_iter().enumerate() {
+        let signer = signer_with("Malformed EKU", &r, &[key_usage(DIGITAL_SIGNATURE), eku]);
+        assert_eq!(signer.cert.extended_key_usage.as_deref(), Some(&[][..]), "case {i}");
+        let (status, details) = verdict(signer, vec![], &r.cert);
+        assert_eq!(status, Status::Unknown, "case {i}: {details:?}");
+        assert!(details.iter().any(|d| d.contains("not issued for signing documents")), "case {i}: {details:?}");
+    }
+    // The same document-signing purpose, well formed, may sign.
+    let (status, details) =
+        verdict(signer_with("Good EKU", &r, &[key_usage(DIGITAL_SIGNATURE), extended_key_usage(&["2.5.29.37.0"])]), vec![], &r.cert);
+    assert_eq!(status, Status::Valid, "{details:?}");
+}
diff --git a/crates/sign/tests/crypto.rs b/crates/sign/tests/crypto.rs
index a7e6931c5..ef3d5976d 100644
--- a/crates/sign/tests/crypto.rs
+++ b/crates/sign/tests/crypto.rs
@@ -185,6 +185,48 @@ fn new_digital_ids_are_self_signed_and_survive_a_p12_round_trip() {
     }
 }
 
+#[test]
+fn new_digital_ids_use_the_stronger_round_count_for_the_key_and_the_mac() {
+    let name = Name::build("Grace Hopper", "", "", "", "");
+    let now = Time { year: 2026, month: 10, day: 14, hour: 12, minute: 0, second: 0 };
+    let key = pdfcraft_sign::PrivateKey::generate_p256().unwrap();
+    let certificate = Certificate::self_signed(&name, &key, now, 5, &[0x42]).unwrap();
+    let id = pkcs12::DigitalId { key, certificate, chain: Vec::new(), friendly_name: None };
+    let p12 = pkcs12::write(&id, "s3cret12").unwrap();
+    // OWASP's figure for PBKDF2-HMAC-SHA-256, spelled out so lowering the constant fails here.
+    const ROUNDS: u64 = 600_000;
+    // MacData's iteration count, the last field of the file.
+    let pfx = Tlv::parse_all(&p12).unwrap().children().unwrap();
+    let mac = pfx[2].children().unwrap();
+    assert_eq!(mac[2].u64().unwrap(), ROUNDS);
+    // The same INTEGER three times: the MAC and the PBKDF2 parameters of both encrypted parts.
+    let rounds = pdfcraft_sign::der::int(ROUNDS);
+    assert_eq!(p12.windows(rounds.len()).filter(|w| *w == rounds.as_slice()).count(), 3);
+    assert_eq!(pkcs12::open(&p12, "s3cret12").unwrap().certificate, id.certificate);
+}
+
+/// A `.p12` whose MAC asks for `rounds` iterations. Its content is empty: opening it must stop
+/// at the MAC, before the content is read.
+fn p12_with_mac_rounds(rounds: u64) -> Vec<u8> {
+    use pdfcraft_sign::der;
+    let auth_safe = der::seq(&[]);
+    let digest = der::seq(&[&DigestAlg::Sha256.algorithm(), &der::octets(&[0; 32])]);
+    let mac_data = der::seq(&[&digest, &der::octets(&[1; 16]), &der::int(rounds)]);
+    der::seq(&[&der::int(3), &der::seq(&[&der::oid("1.2.840.113549.1.7.1"), &der::explicit(0, &der::octets(&auth_safe))]), &mac_data])
+}
+
+#[test]
+fn a_p12_asking_for_too_many_rounds_is_refused_before_hashing() {
+    // 2^32 + 1 used to wrap to one round; 20 million took seconds and 4 billion about an hour,
+    // all spent on the password check (#1847).
+    for rounds in [(1u64 << 32) + 1, 20_000_000, 4_000_000_000] {
+        let err = pkcs12::open(&p12_with_mac_rounds(rounds), "password").expect_err("refused");
+        assert!(matches!(err, SignError::Unsupported(_)), "{rounds}: {err}");
+    }
+    // An ordinary count still gets as far as the password.
+    assert!(matches!(pkcs12::open(&p12_with_mac_rounds(2048), "password"), Err(SignError::WrongPassword)));
+}
+
 #[test]
 fn certificates_load_from_pem_and_der_and_export_as_pem() {
     let pem_text = data("rsa.crt.pem");
diff --git a/crates/sign/tests/pdf.rs b/crates/sign/tests/pdf.rs
index 609926f3b..908a5c0fe 100644
--- a/crates/sign/tests/pdf.rs
+++ b/crates/sign/tests/pdf.rs
@@ -942,7 +942,7 @@ fn a_dss_entry_does_not_make_the_object_it_names_part_of_the_store() {
 #[test]
 fn an_existing_dictionary_is_not_a_store_part_because_the_store_names_it() {
     // The font dictionary (object 5), rewritten and then listed as the store, its /VRI, a VRI
-    // entry, or simply labelled /Type /DSS.
+    // entry, or simply labelled /Type /DSS. The page draws it, so each is page content (#1787).
     let rewrite_font = |doc: &mut Document, extra: Option<(&str, Object)>| {
         let mut d = dict_of(vec![("Type", Object::name("Font")), ("Subtype", Object::name("Type1")), ("BaseFont", Object::name("Courier"))]);
         if let Some((k, v)) = extra {
@@ -950,19 +950,19 @@ fn an_existing_dictionary_is_not_a_store_part_because_the_store_names_it() {
         }
         doc.set(pdfcraft_cos::ObjRef { num: 5, generation: 0 }, Object::Dict(d));
     };
-    assert_refused_at_every_level(&fixture(), "other changes", |doc| {
+    assert_refused_at_every_level(&fixture(), "page content", |doc| {
         rewrite_font(doc, Some(("Type", Object::name("DSS"))));
     });
-    assert_refused_at_every_level(&fixture(), "other changes", |doc| {
+    assert_refused_at_every_level(&fixture(), "page content", |doc| {
         set_dss(doc, oref(5));
         rewrite_font(doc, None);
     });
-    assert_refused_at_every_level(&fixture(), "other changes", |doc| {
+    assert_refused_at_every_level(&fixture(), "page content", |doc| {
         set_dss(doc, Object::Dict(dict_of(vec![("VRI", oref(5))])));
         rewrite_font(doc, None);
     });
     // An existing dictionary with only DSS-looking keys that the signed file never had as a store.
-    assert_refused_at_every_level(&fixture(), "other changes", |doc| {
+    assert_refused_at_every_level(&fixture(), "page content", |doc| {
         doc.set(
             pdfcraft_cos::ObjRef { num: 5, generation: 0 },
             Object::Dict(dict_of(vec![("Type", Object::name("Font")), ("Cert", Object::Array(vec![]))])),
@@ -985,7 +985,8 @@ fn an_existing_array_stays_what_it_is_when_the_store_points_at_it() {
 #[test]
 fn a_dictionary_labelled_metadata_is_not_a_metadata_change() {
     // Only the catalog's XMP stream is metadata (a stream, not a dictionary a label was put on).
-    assert_refused_at_every_level(&fixture(), "other changes", |doc| {
+    // The dictionary is the page's font, so the rewrite is page content (#1787).
+    assert_refused_at_every_level(&fixture(), "page content", |doc| {
         doc.set(
             pdfcraft_cos::ObjRef { num: 5, generation: 0 },
             Object::Dict(dict_of(vec![
@@ -1042,9 +1043,10 @@ fn fixture_with_stream_7(catalog_extra: &str, drawn: bool, dict: &str, body: &[u
 #[test]
 fn a_stream_already_labelled_metadata_when_signed_is_not_metadata_unless_the_catalog_names_it() {
     // A Form XObject the page draws, labelled /Type /Metadata before signing (the renderer ignores
-    // /Type). Rewriting it later changes what the page shows, so it is not a metadata change.
+    // /Type). Rewriting it later changes what the page shows, so it is not a metadata change
+    // but page content (#1787).
     let base = fixture_with_stream_7("", true, "/Type /Metadata /Subtype /Form /BBox [0 0 300 300]", b"0 0 1 rg 10 10 100 100 re f");
-    assert_refused_at_every_level(&base, "other changes", |doc| {
+    assert_refused_at_every_level(&base, "page content", |doc| {
         let d = dict_of(vec![
             ("Type", Object::name("Metadata")),
             ("Subtype", Object::name("Form")),
@@ -1193,7 +1195,8 @@ fn a_form_xobject_relabelled_as_file_plumbing_is_still_judged() {
             });
             let s = signatures(&open(&edited), &edited, &trust).into_iter().find(|s| s.signed).unwrap();
             assert_eq!(s.status, Status::Invalid, "{certify:?} /{label}: {:?}", s.details);
-            assert!(matches!(&s.modification, Modification::Disallowed(k) if k.contains(&"other changes")), "{:?}", s.modification);
+            // The page draws the XObject: its rewrite is page content (#1787).
+            assert!(matches!(&s.modification, Modification::Disallowed(k) if k.contains(&"page content")), "{:?}", s.modification);
         }
     }
 }
@@ -1638,10 +1641,15 @@ fn validates_the_legacy_adbe_x509_rsa_sha1_format() {
 /// `fixture()` protected with an empty user password (opens without asking, like most
 /// "secured" forms) and an owner password, then saved.
 fn protected(alg: pdfcraft_cos::Algorithm, permissions: i32) -> Vec<u8> {
+    protected_with(alg, "", permissions)
+}
+
+/// `fixture()` protected with the user password `user` and an owner password, then saved.
+fn protected_with(alg: pdfcraft_cos::Algorithm, user: &str, permissions: i32) -> Vec<u8> {
     let mut doc = open(&fixture());
     doc.set_encryption(&pdfcraft_cos::NewEncryption {
         algorithm: alg,
-        user_password: "",
+        user_password: user,
         owner_password: "owner",
         permissions,
         encrypt_metadata: true,
@@ -1651,6 +1659,38 @@ fn protected(alg: pdfcraft_cos::Algorithm, permissions: i32) -> Vec<u8> {
     pdfcraft_cos::write_full(&doc, &SaveOptions::default()).unwrap()
 }
 
+/// #1808: a document that asks for its user password, signed and then counter-signed. The
+/// first signature no longer covers the whole file, so its revision is reopened to classify the
+/// change; that revision is encrypted too, and used to be unreadable without the password,
+/// which made the first signature Invalid. It opens with the document's own key.
+#[test]
+fn a_user_password_document_keeps_its_earlier_signature_valid_when_counter_signed() {
+    let id = pkcs12::open(&data("ec-p256.p12"), "test").unwrap();
+    let id2 = pkcs12::open(&data("rsa-aes.p12"), "test").unwrap();
+    let trust = TrustStore { certs: vec![id.certificate.clone(), id2.certificate.clone()] };
+    for alg in ALL_ALGORITHMS {
+        let base = protected_with(alg, "secret", -1);
+        assert!(Document::open_with_password(Arc::new(base.clone()), None).is_err(), "{alg:?}: the file asks for its password");
+        let signed = pdfcraft_sign::sign(&open_pw(&base, Some("secret")), &id, &opts()).unwrap();
+        let both = pdfcraft_sign::sign(&open_pw(&signed, Some("secret")), &id2, &SignOptions { field: Some("Approval".into()), ..opts() }).unwrap();
+        let sigs = signatures(&open_pw(&both, Some("secret")), &both, &trust);
+        let first = sigs.iter().find(|s| s.field == "Signature1").unwrap();
+        assert_eq!(first.modification, Modification::Allowed(vec![kind::SIGNATURE]), "{alg:?}: {:?}", first.details);
+        assert_eq!(first.status, Status::Valid, "{alg:?}: {:?}", first.details);
+        let second = sigs.iter().find(|s| s.field == "Approval").unwrap();
+        assert_eq!((second.status, second.revision), (Status::Valid, 3), "{alg:?}: {:?}", second.details);
+        // Opened as owner, the same.
+        let sigs = signatures(&open_pw(&both, Some("owner")), &both, &trust);
+        assert!(sigs.iter().filter(|s| s.signed).all(|s| s.status == Status::Valid), "{alg:?}");
+        // Tampering inside the first signature's range still breaks both.
+        let mut tampered = both.clone();
+        let at = base.len() / 2;
+        tampered[at] ^= 1;
+        let tampered_sigs = signatures(&open_pw(&tampered, Some("secret")), &tampered, &trust);
+        assert!(tampered_sigs.iter().filter(|s| s.signed).all(|s| s.status == Status::Invalid), "{alg:?}");
+    }
+}
+
 fn open_pw(b: &[u8], pw: Option<&str>) -> Document {
     Document::open_with_password(Arc::new(b.to_vec()), pw).unwrap()
 }
@@ -1815,6 +1855,58 @@ fn visible_appearance_text_helvetica_cannot_draw_is_refused() {
     assert_eq!(s.reason.as_deref(), Some("同意此文件"));
 }
 
+/// The labels are the caller's words (a translation), so they are checked as the details are: a
+/// label Helvetica can't draw is refused with the label and the character, never drawn as `?`.
+/// Only labels that are drawn count: one whose detail is hidden, or empty, or with the labels
+/// turned off or the signature invisible, signs. Labels it can draw are what the stamp says.
+#[test]
+fn appearance_labels_helvetica_cannot_draw_are_refused() {
+    use pdfcraft_sign::{Appearance, AppearanceLabels};
+    let id = pkcs12::open(&data("ec-p256.p12"), "test").unwrap();
+    assert_eq!(AppearanceLabels::default().first_undrawable(), None, "the English labels are drawable");
+    let chinese = AppearanceLabels { signed_by: "数字签名者".into(), reason: "原因：".into(), ..AppearanceLabels::default() };
+    assert_eq!(chinese.first_undrawable(), Some(("signed_by", '数')));
+    let sign = |labels: AppearanceLabels, appearance: Appearance, o: SignOptions| {
+        pdfcraft_sign::sign(&open(&fixture()), &id, &SignOptions { appearance_labels: labels, appearance, ..o })
+    };
+
+    // The name is shown with its label (the default appearance): refused, saying which and what.
+    let err = sign(chinese.clone(), Appearance::default(), opts()).unwrap_err();
+    let m = err.to_string();
+    assert!(matches!(err, SignError::Unsupported(_)), "{err:?}");
+    assert!(m.contains("\"数\" (U+6570)") && m.contains("the signed_by label") && m.contains("leave the labels out"), "{m}");
+    let russian_date = AppearanceLabels { date: "Дата: ".into(), ..AppearanceLabels::default() };
+    let m = sign(russian_date.clone(), Appearance::default(), opts()).unwrap_err().to_string();
+    assert!(m.contains("the date label") && m.contains("U+0414"), "{m}");
+    let reason_only = AppearanceLabels { reason: "原因：".into(), ..AppearanceLabels::default() };
+    let shown = Appearance { reason: true, ..Appearance::default() };
+    assert!(sign(reason_only.clone(), shown.clone(), opts()).unwrap_err().to_string().contains("the reason label"));
+
+    // Not drawn: the reason hidden, or empty; the labels off; the signature invisible.
+    sign(reason_only.clone(), Appearance::default(), opts()).unwrap();
+    sign(reason_only.clone(), shown.clone(), SignOptions { reason: None, ..opts() }).unwrap();
+    sign(reason_only, shown, SignOptions { reason: Some(String::new()), ..opts() }).unwrap();
+    sign(chinese.clone(), Appearance { labels: false, ..Appearance::default() }, opts()).unwrap();
+    sign(russian_date, Appearance { date: false, ..Appearance::default() }, opts()).unwrap();
+    sign(chinese, Appearance::default(), SignOptions { rect: None, ..opts() }).unwrap();
+
+    // Labels Helvetica can draw are stamped as given, in place of the English ones.
+    let german = AppearanceLabels {
+        signed_by: "Digital signiert von".into(),
+        distinguished_name: "DN: ".into(),
+        reason: "Grund: ".into(),
+        location: "Ort: ".into(),
+        date: "Datum: ".into(),
+    };
+    let all = Appearance { reason: true, location: true, ..Appearance::default() };
+    let signed = sign(german, all, opts()).unwrap();
+    let (content, _) = appearance_of(&signed, "Signature1");
+    for word in ["(Digital", "(Grund:", "(Ort:", "(Datum:"] {
+        assert!(content.contains(word), "{word}: {content}");
+    }
+    assert!(!content.contains("Reason") && !content.contains("Date:") && !content.contains('?'), "{content}");
+}
+
 /// Every sentence this crate says about a signature is listed in `WORDINGS`, and every sentence on
 /// that list is one it still says: the details are written as `Detail::plain`/`Detail::of`, the
 /// sentences the modules that read a signature word for themselves are pushed as notes and quirks,
@@ -1978,3 +2070,132 @@ fn a_cross_reference_entry_that_misses_its_object_is_not_an_unchanged_object() {
     let s = signatures(&open(&honest), &honest, &trust).into_iter().find(|s| s.signed).unwrap();
     assert_eq!(s.status, Status::Valid, "{:?}", s.details);
 }
+
+/// `fixture()` with the page's resources indirect: object 7 is the resources dictionary, 8 its
+/// `/Font` dictionary, 9 an `/ExtGState` the content uses, and 5 the font as before.
+fn fixture_with_indirect_resources() -> Vec<u8> {
+    let objs: Vec<&[u8]> = vec![
+        b"<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [6 0 R] >> >>",
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>",
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 4 0 R /Resources 7 0 R /Annots [6 0 R] >>",
+        b"<< /Length 52 >>\nstream\n/GS1 gs BT /F1 14 Tf 20 250 Td (Contract text) Tj ET\nendstream",
+        b"<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>",
+        b"<< /Type /Annot /Subtype /Widget /FT /Sig /T (Approval) /Rect [150 20 280 70] /P 3 0 R /F 4 >>",
+        b"<< /Font 8 0 R /ExtGState << /GS1 9 0 R >> >>",
+        b"<< /F1 5 0 R >>",
+        b"<< /Type /ExtGState /ca 1 >>",
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n", i + 1).as_bytes());
+        out.extend_from_slice(o);
+        out.extend_from_slice(b"\nendobj\n");
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    out
+}
+
+/// A signed page's resources are judged by the role they held when signed, not by the keys a
+/// later revision writes into them (#1787): rewriting the page's resources dictionary, a
+/// category dictionary, a font or a graphics state changes what the page shows, however the
+/// new version is labelled (/FT, /DR, /T + /Kids, /Subtype /Widget, /Type /Annot + /Rect, which
+/// otherwise read as form filling or a comment, permitted under P=2 and P=3). A category
+/// dictionary that only gained a name changes nothing drawn and is judged as before.
+#[test]
+fn rewritten_page_resources_are_page_content_whatever_keys_they_carry() {
+    /// Replace object `num` with a dictionary; each attack runs once per certification level,
+    /// so the entries are cloned into each.
+    fn set(num: u32, entries: Vec<(&'static str, Object)>) -> impl Fn(&mut Document) {
+        move |doc| doc.set(pdfcraft_cos::ObjRef { num, generation: 0 }, Object::Dict(dict_of(entries.clone())))
+    }
+    /// A second font, so a name can be made to resolve elsewhere.
+    fn courier(doc: &mut Document) -> pdfcraft_cos::ObjRef {
+        doc.add(Object::Dict(dict_of(vec![
+            ("Type", Object::name("Font")),
+            ("Subtype", Object::name("Type1")),
+            ("BaseFont", Object::name("Courier")),
+        ])))
+    }
+    // The resources dictionary: another font under the same name, plus /FT.
+    assert_refused_at_every_level(&fixture_with_indirect_resources(), "page content", |doc| {
+        let f = courier(doc);
+        set(
+            7,
+            vec![
+                ("Font", Object::Dict(dict_of(vec![("F1", Object::Ref(f))]))),
+                ("ExtGState", Object::Dict(dict_of(vec![("GS1", oref(9))]))),
+                ("FT", Object::name("Tx")),
+            ],
+        )(doc);
+    });
+    // The /Font dictionary: the name now resolves elsewhere, plus /DR.
+    assert_refused_at_every_level(&fixture_with_indirect_resources(), "page content", |doc| {
+        let f = courier(doc);
+        set(8, vec![("F1", Object::Ref(f)), ("DR", Object::Dict(dict_of(vec![])))])(doc);
+    });
+    // The graphics state: everything drawn through it becomes invisible, plus /T and /Kids.
+    assert_refused_at_every_level(
+        &fixture_with_indirect_resources(),
+        "page content",
+        set(
+            9,
+            vec![
+                ("Type", Object::name("ExtGState")),
+                ("ca", Object::Real(0.0)),
+                ("T", Object::String(PdfString::literal("x"))),
+                ("Kids", Object::Array(vec![])),
+            ],
+        ),
+    );
+    // The font itself, relabelled a widget.
+    assert_refused_at_every_level(
+        &fixture_with_indirect_resources(),
+        "page content",
+        set(5, vec![("Type", Object::name("Font")), ("BaseFont", Object::name("Courier")), ("Subtype", Object::name("Widget"))]),
+    );
+    // The resources dictionary relabelled a comment (permitted under P=3 and by an approval signature).
+    assert_refused_at_every_level(&fixture_with_indirect_resources(), "page content", |doc| {
+        let f = courier(doc);
+        set(
+            7,
+            vec![
+                ("Type", Object::name("Annot")),
+                ("Subtype", Object::name("Square")),
+                ("Rect", Object::Array(vec![Object::Int(0), Object::Int(0), Object::Int(10), Object::Int(10)])),
+                ("Font", Object::Dict(dict_of(vec![("F1", Object::Ref(f))]))),
+            ],
+        )(doc);
+    });
+    // The same page resources inline in the page keep being page content through the page itself.
+    assert_refused_at_every_level(&fixture(), "page content", |doc| {
+        let f = courier(doc);
+        doc.update_dict(pdfcraft_cos::ObjRef { num: 3, generation: 0 }, |page| {
+            page.set(b"Resources".to_vec(), Object::Dict(dict_of(vec![("Font", Object::Dict(dict_of(vec![("F1", Object::Ref(f))])))])));
+        })
+        .unwrap();
+    });
+
+    // Positive control: a /Font dictionary that only gained a name changes nothing the signed
+    // content draws, so it is not page content (it is still an unclassified change, refused as
+    // "other", as before).
+    let id = pkcs12::open(&data("rsa-aes.p12"), "test").unwrap();
+    let trust = TrustStore { certs: vec![id.certificate.clone()] };
+    let signed = pdfcraft_sign::sign(&open(&fixture_with_indirect_resources()), &id, &SignOptions { certify: Some(3), ..opts() }).unwrap();
+    let grown = edit_after(&signed, |doc| {
+        let f = courier(doc);
+        set(8, vec![("F1", oref(5)), ("F2", Object::Ref(f))])(doc);
+    });
+    let s = signatures(&open(&grown), &grown, &trust).into_iter().find(|s| s.signed).unwrap();
+    assert!(
+        matches!(&s.modification, Modification::Disallowed(k) if !k.contains(&"page content") && k.contains(&"other changes")),
+        "{:?}",
+        s.modification
+    );
+}
diff --git a/crates/testkit/Cargo.toml b/crates/testkit/Cargo.toml
new file mode 100644
index 000000000..4237f341b
--- /dev/null
+++ b/crates/testkit/Cargo.toml
@@ -0,0 +1,11 @@
+[package]
+name = "pdfcraft-testkit"
+description = "Synthetic PDF fixtures for PdfCraft's tests: one way to write the bytes, so the tests differ only where they mean to"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[lints]
+workspace = true
+
+[dependencies]
diff --git a/crates/testkit/README.md b/crates/testkit/README.md
new file mode 100644
index 000000000..44388b1b2
--- /dev/null
+++ b/crates/testkit/README.md
@@ -0,0 +1,57 @@
+# pdfcraft-testkit
+
+Synthetic PDF fixtures: **one way to write the bytes, so tests differ only where they mean to.**
+
+- **Layer:** test support (`Class::Testkit` in `xtask/src/layers.rs`). A dev-dependency only, never
+  compiled into the product.
+- **No workspace dependencies**, deliberately. The crates at the bottom of the layering (`cos`,
+  `geom`, `filters`, `crypt`, `arlington`) can use it in their own tests without a cycle, which is
+  also why it hands back bytes rather than a parsed `Document`.
+
+## Why it exists
+
+55 files hand-rolled the same serialiser — number the objects, record each one's offset, emit a
+classic cross-reference table and a trailer — **111 times over**. The object *bodies* are properly
+the business of the crate under test. The envelope around them is not, and every copy is a place
+for a fixture to be quietly wrong in a way that makes a test prove less than it appears to.
+
+## API
+
+```rust
+use pdfcraft_testkit::Pdf;
+
+let bytes = Pdf::new()
+    .version("1.4")                                        // default 1.7
+    .obj("<< /Type /Catalog /Pages 2 0 R >>")              // becomes 1 0 R
+    .obj("<< /Type /Pages /Kids [3 0 R] /Count 1 >>")
+    .obj("<< /Type /Page /Parent 2 0 R /Contents 4 0 R >>")
+    .stream("", b"BT /F1 12 Tf (hi) Tj ET")                // /Length computed
+    .trailer_entry("/Info 5 0 R")
+    .build();
+```
+
+Objects are numbered from 1 in the order they are added, all at generation 0; the trailer always
+names `1 0 R` as `/Root` and carries the right `/Size`. `next_obj()` gives the number the next
+object will get, for forward references. `stream_obj(dict, data)` builds a stream body on its own,
+for callers that assemble their object list first.
+
+## Byte-identical by construction
+
+`the_builder_is_byte_identical_to_the_serialiser_it_replaces` keeps a verbatim copy of the
+hand-rolled serialiser and asserts the builder agrees with it, across versions and trailer
+variations. Migrating a crate must not change a single byte of its fixtures — otherwise the test
+that fixture feeds silently starts testing something else.
+
+The one intended difference: an empty stream dictionary gives `<< /Length N >>` rather than the
+doubled space `<<  /Length N >>` that some copies produced. Parsers accept both.
+
+## Migration status
+
+Three crates are migrated (`cos`, `measure`, `redact`), taking the count from 111 copies in 55
+files to **108 in 53**. The rest are follow-ups, deliberately not done in one sweep: `ui-egui`
+alone accounts for 27 of those files and is the most contested area in the repository, so a single
+large mechanical change there would rot before it landed.
+
+Not every copy should move. A test that is *about* a malformed or unusual cross-reference table
+needs to write its own bytes; this builder is for the fixtures that are merely scaffolding for
+something else.
diff --git a/crates/testkit/src/lib.rs b/crates/testkit/src/lib.rs
new file mode 100644
index 000000000..c9f5e55ef
--- /dev/null
+++ b/crates/testkit/src/lib.rs
@@ -0,0 +1,253 @@
+//! Synthetic PDF fixtures: one way to write the bytes, so tests differ only where they mean to.
+//!
+//! 55 files across the workspace hand-rolled the same serialiser — number the objects, record each
+//! one's offset, emit a classic cross-reference table and a trailer — 111 times over. The object
+//! *bodies* are properly the business of the crate under test; the envelope around them is not,
+//! and every copy of it is a place for a fixture to be subtly wrong in a way that makes a test
+//! prove less than it looks like it proves.
+//!
+//! [`Pdf`] writes that envelope. It is deliberately dependency-free, so the crates at the bottom of
+//! the layering (`cos`, `geom`, `filters`, `crypt`) can use it in their own tests without a cycle,
+//! and it hands back bytes rather than a parsed document for the same reason.
+//!
+//! ```
+//! use pdfcraft_testkit::Pdf;
+//! let bytes = Pdf::new()
+//!     .obj("<< /Type /Catalog /Pages 2 0 R >>")
+//!     .obj("<< /Type /Pages /Kids [3 0 R] /Count 1 >>")
+//!     .obj("<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 300] /Contents 4 0 R >>")
+//!     .stream("", b"BT /F1 12 Tf (hi) Tj ET")
+//!     .build();
+//! assert!(bytes.starts_with(b"%PDF-1.7\n"));
+//! assert!(bytes.ends_with(b"%%EOF\n"));
+//! ```
+//!
+//! This crate is test scaffolding (`Class::Testkit` in `xtask/src/layers.rs`): a dev-dependency
+//! only, never compiled into the product.
+
+/// A small PDF with a classic cross-reference table, built one object at a time.
+///
+/// Objects are numbered from 1 in the order they are added, all at generation 0, so the first
+/// object added is `1 0 R`. The trailer names `1 0 R` as `/Root`, which is what every caller of
+/// this builder wants; [`Pdf::trailer_entry`] adds the rest.
+#[derive(Debug, Clone)]
+pub struct Pdf {
+    version: String,
+    objects: Vec<Vec<u8>>,
+    trailer: Vec<String>,
+}
+
+impl Default for Pdf {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl Pdf {
+    /// An empty PDF 1.7 file. Add objects with [`Pdf::obj`].
+    pub fn new() -> Self {
+        Self { version: "1.7".to_owned(), objects: Vec::new(), trailer: Vec::new() }
+    }
+
+    /// Set the header version, as it appears after `%PDF-` (for example `"1.4"`).
+    #[must_use]
+    pub fn version(mut self, version: &str) -> Self {
+        self.version = version.to_owned();
+        self
+    }
+
+    /// Append one object body — everything between `N 0 obj` and `endobj`.
+    #[must_use]
+    pub fn obj(mut self, body: impl AsRef<[u8]>) -> Self {
+        self.objects.push(body.as_ref().to_vec());
+        self
+    }
+
+    /// Append several object bodies, in order.
+    #[must_use]
+    pub fn objs<I: IntoIterator<Item = T>, T: AsRef<[u8]>>(mut self, bodies: I) -> Self {
+        self.objects.extend(bodies.into_iter().map(|b| b.as_ref().to_vec()));
+        self
+    }
+
+    /// Append a stream object: `dict` holds any entries besides `/Length`, which is computed.
+    #[must_use]
+    pub fn stream(self, dict: &str, data: impl AsRef<[u8]>) -> Self {
+        self.obj(stream_obj(dict, data))
+    }
+
+    /// Add an entry to the trailer dictionary, such as `"/Info 9 0 R"`. `/Size` and `/Root` are
+    /// always written.
+    #[must_use]
+    pub fn trailer_entry(mut self, entry: &str) -> Self {
+        self.trailer.push(entry.to_owned());
+        self
+    }
+
+    /// The number the next object added will get, so a caller can refer forward to it.
+    ///
+    /// ```
+    /// # use pdfcraft_testkit::Pdf;
+    /// let mut p = Pdf::new().obj("<< /Type /Catalog /Pages 2 0 R >>");
+    /// assert_eq!(p.next_obj(), 2);
+    /// ```
+    pub fn next_obj(&self) -> usize {
+        self.objects.len().saturating_add(1)
+    }
+
+    /// Serialise the file.
+    pub fn build(&self) -> Vec<u8> {
+        let mut out = format!("%PDF-{}\n", self.version).into_bytes();
+        let mut offsets = Vec::with_capacity(self.objects.len());
+        for (i, body) in self.objects.iter().enumerate() {
+            offsets.push(out.len());
+            out.extend_from_slice(format!("{} 0 obj\n", i.saturating_add(1)).as_bytes());
+            out.extend_from_slice(body);
+            out.extend_from_slice(b"\nendobj\n");
+        }
+        let startxref = out.len();
+        let size = self.objects.len().saturating_add(1);
+        out.extend_from_slice(format!("xref\n0 {size}\n0000000000 65535 f \n").as_bytes());
+        for offset in offsets {
+            out.extend_from_slice(format!("{offset:010} 00000 n \n").as_bytes());
+        }
+        let extra = self.trailer.iter().map(|e| format!(" {e}")).collect::<String>();
+        out.extend_from_slice(format!("trailer\n<< /Size {size} /Root 1 0 R{extra} >>\nstartxref\n{startxref}\n%%EOF\n").as_bytes());
+        out
+    }
+}
+
+/// A stream object body with `/Length` filled in, for callers assembling object lists themselves.
+///
+/// `dict` holds any entries besides `/Length`; an empty one gives `<< /Length N >>` rather than
+/// the doubled space the hand-rolled copies produced, which parsers accept but readers trip over.
+pub fn stream_obj(dict: &str, data: impl AsRef<[u8]>) -> Vec<u8> {
+    let data = data.as_ref();
+    let dict = dict.trim();
+    let sep = if dict.is_empty() { "" } else { " " };
+    let mut out = format!("<<{sep}{dict} /Length {} >>\nstream\n", data.len()).into_bytes();
+    out.extend_from_slice(data);
+    out.extend_from_slice(b"\nendstream");
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The serialiser the workspace had 111 copies of, kept here verbatim as the thing [`Pdf`] has
+    /// to agree with. Migrating a crate to the builder must not change a single byte of its
+    /// fixtures, or the test that fixture feeds silently starts testing something else.
+    fn hand_rolled(version: &str, objs: &[Vec<u8>], trailer_extra: &str) -> Vec<u8> {
+        let mut out = format!("%PDF-{version}\n").into_bytes();
+        let mut offs = Vec::new();
+        for (i, o) in objs.iter().enumerate() {
+            offs.push(out.len());
+            out.extend_from_slice(format!("{} 0 obj\n", i + 1).as_bytes());
+            out.extend_from_slice(o);
+            out.extend_from_slice(b"\nendobj\n");
+        }
+        let x = out.len();
+        out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+        for o in offs {
+            out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+        }
+        out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R{trailer_extra} >>\nstartxref\n{x}\n%%EOF\n", objs.len() + 1).as_bytes());
+        out
+    }
+
+    fn sample_objects() -> Vec<Vec<u8>> {
+        vec![
+            b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+            b"<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 612 792] >>".to_vec(),
+            b"<< /Type /Page /Parent 2 0 R /Contents 4 0 R >>".to_vec(),
+            stream_obj("", b"BT /F1 24 Tf 20 150 Td (Page 1) Tj ET"),
+        ]
+    }
+
+    #[test]
+    fn the_builder_is_byte_identical_to_the_serialiser_it_replaces() {
+        let objs = sample_objects();
+        for version in ["1.4", "1.7", "2.0"] {
+            let built = Pdf::new().version(version).objs(objs.clone()).build();
+            assert_eq!(built, hand_rolled(version, &objs, ""), "version {version}");
+        }
+        // ...including the trailer entries the copies varied on.
+        let built = Pdf::new().objs(objs.clone()).trailer_entry("/Info 5 0 R").build();
+        assert_eq!(built, hand_rolled("1.7", &objs, " /Info 5 0 R"));
+    }
+
+    /// Offsets must point at the `N 0 obj` that starts each object, counted from the file's first
+    /// byte. A fixture whose table is wrong tests the repair path, not the path it meant to.
+    #[test]
+    fn every_offset_in_the_table_points_at_its_object() {
+        let bytes = Pdf::new().objs(sample_objects()).build();
+        let text = String::from_utf8_lossy(&bytes);
+        let table = text.split("xref\n0 ").nth(1).expect("an xref table");
+        let rows: Vec<&str> = table.lines().skip(1).take_while(|l| l.ends_with(" n ") || l.ends_with(" f ")).collect();
+        assert_eq!(rows.len(), 5, "free entry plus four objects: {rows:?}");
+        for (i, row) in rows.iter().enumerate().skip(1) {
+            let offset: usize = row.split_whitespace().next().and_then(|n| n.parse().ok()).expect("an offset");
+            let expected = format!("{i} 0 obj\n");
+            assert!(bytes.get(offset..).is_some_and(|rest| rest.starts_with(expected.as_bytes())), "object {i} at {offset}");
+        }
+    }
+
+    /// `/Size` is one more than the object count (object 0 is the free head), and `startxref`
+    /// points at the table.
+    #[test]
+    fn the_trailer_agrees_with_the_body() {
+        let bytes = Pdf::new().objs(sample_objects()).build();
+        let text = String::from_utf8_lossy(&bytes);
+        assert!(text.contains("/Size 5"), "{text}");
+        let startxref: usize = text.rsplit("startxref\n").next().and_then(|t| t.lines().next()).and_then(|n| n.parse().ok()).expect("startxref");
+        assert!(bytes.get(startxref..).is_some_and(|rest| rest.starts_with(b"xref\n")), "startxref {startxref}");
+    }
+
+    #[test]
+    fn stream_length_counts_the_data_not_the_keywords() {
+        let obj = stream_obj("/Filter /FlateDecode", b"abc");
+        assert_eq!(obj, b"<< /Filter /FlateDecode /Length 3 >>\nstream\nabc\nendstream".to_vec());
+        // Binary data, including NUL and bytes that are not UTF-8, survives untouched.
+        let data = [0u8, 0xFF, b'\n', 0x80];
+        let obj = stream_obj("", data);
+        assert!(obj.ends_with(b"stream\n\0\xff\n\x80\nendstream"), "{obj:?}");
+        // An empty dict gives one space, not two.
+        assert!(obj.starts_with(b"<< /Length 4 >>"), "{obj:?}");
+        assert_eq!(stream_obj("  /Type /XObject  ", b""), stream_obj("/Type /XObject", b""));
+    }
+
+    /// An empty file is still a parseable shape rather than something that panics or truncates.
+    #[test]
+    fn a_file_with_no_objects_is_still_well_formed() {
+        let bytes = Pdf::new().build();
+        let text = String::from_utf8_lossy(&bytes);
+        assert!(text.starts_with("%PDF-1.7\n"), "{text}");
+        assert!(text.contains("xref\n0 1\n0000000000 65535 f \n"), "{text}");
+        assert!(text.contains("/Size 1 /Root 1 0 R"), "{text}");
+        assert!(text.ends_with("%%EOF\n"), "{text}");
+    }
+
+    #[test]
+    fn next_obj_tracks_what_has_been_added() {
+        let p = Pdf::new();
+        assert_eq!(p.next_obj(), 1);
+        let p = p.obj("<< >>").obj("<< >>");
+        assert_eq!(p.next_obj(), 3);
+        // Forward references are the reason this exists: the page can name a stream not yet added.
+        let n = p.next_obj();
+        let bytes = p.obj(format!("<< /Contents {n} 0 R >>")).build();
+        assert!(String::from_utf8_lossy(&bytes).contains("/Contents 3 0 R"));
+    }
+
+    /// Hostile and awkward object bodies must not panic or corrupt the offsets.
+    #[test]
+    fn odd_object_bodies_keep_the_table_honest() {
+        let bodies: Vec<Vec<u8>> = vec![Vec::new(), b"\n".to_vec(), vec![0u8; 1024], "<< /T (\u{1F4A5}) >>".as_bytes().to_vec(), b"endobj".to_vec()];
+        let bytes = Pdf::new().objs(bodies.clone()).build();
+        assert_eq!(bytes, hand_rolled("1.7", &bodies, ""));
+        // The offsets still land on their objects even when a body contains `endobj` itself.
+        let text = String::from_utf8_lossy(&bytes);
+        assert!(text.contains("/Size 6"), "{text}");
+    }
+}
diff --git a/crates/ui-egui/Cargo.toml b/crates/ui-egui/Cargo.toml
index 5400829cd..aa9fe54f6 100644
--- a/crates/ui-egui/Cargo.toml
+++ b/crates/ui-egui/Cargo.toml
@@ -11,6 +11,8 @@ workspace = true
 
 [dependencies]
 craft-ui = { workspace = true }
+# macOS: a window close quits through `terminate:` (the Touch Bar crash, #1136); elsewhere a no-op.
+craft-quit = { workspace = true, features = ["egui"] }
 pdfcraft-fonts = { workspace = true }
 pdfcraft-engine = { workspace = true }
 pdfcraft-cos = { workspace = true }
@@ -31,6 +33,9 @@ png = "0.18"
 base64 = "0.22"
 # Right-to-left file names in the chrome (egui shapes but does not reorder); already in the tree.
 unicode-bidi = "0.3"
+# Checks that an installed fallback font parses and has the glyphs, and reads the vertical metrics
+# that put fallback faces on the interface's baseline (#1676); the same skrifa egui uses.
+skrifa = "0.44"
 
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
 # Control-channel tokens.
@@ -39,8 +44,10 @@ getrandom = "0.4"
 arboard = { version = "3.6", default-features = false, features = ["image-data"] }
 # Waits for native file pickers off the UI thread (already in the tree through wgpu).
 pollster = "1.0"
-# Checks that an installed fallback font parses and has the glyphs; the same skrifa egui uses.
-skrifa = "0.44"
+
+[target.'cfg(all(unix, not(target_os = "macos"), not(target_arch = "wasm32")))'.dependencies]
+# Discover configured font directories without linking libfontconfig or running a subprocess.
+fontconfig-parser = "0.5.8"
 
 [target.'cfg(target_os = "macos")'.dependencies]
 # Where the pointer is while files are dragged over the window (winit doesn't say): safe AppKit
@@ -55,8 +62,9 @@ rustix = { version = "1", features = ["fs"] }
 [target.'cfg(windows)'.dependencies]
 # Auto interface language: the Windows display language, without starting a process.
 sys-locale = "0.3"
-# Region ▸ Measurement system for the default Units, read from the registry without starting reg.exe.
-winsafe = { version = "0.0.29", default-features = false, features = ["advapi"] }
+# Region ▸ Measurement system for the default Units, read from the registry without starting reg.exe;
+# where the pointer is while files are dragged over the window (winit doesn't say).
+winsafe = { version = "0.0.29", default-features = false, features = ["advapi", "user"] }
 
 [target.'cfg(target_arch = "wasm32")'.dependencies]
 rfd = { workspace = true, features = ["file-handle-inner"] }
diff --git a/crates/ui-egui/src/a11y_ui.rs b/crates/ui-egui/src/a11y_ui.rs
index 67683beb5..2130c927a 100644
--- a/crates/ui-egui/src/a11y_ui.rs
+++ b/crates/ui-egui/src/a11y_ui.rs
@@ -343,6 +343,27 @@ pub(crate) fn panel(ui: &mut egui::Ui, t: &Tokens, state: &mut A11yState, doc: D
 }
 
 impl PdfCraftApp {
+    /// Prepare for accessibility ▸ Find untagged content.
+    pub(crate) fn find_untagged_content(&mut self) {
+        let Some((_, id)) = self.active_ids() else { return };
+        let Some(doc) = self.session.get(id) else { return };
+        let options = Options { rules: [Rule::TaggedContent, Rule::TaggedAnnotations, Rule::TaggedFormFields].into_iter().collect(), pages: None };
+        let Some(report) = doc.accessibility_check(&options) else {
+            self.notify_tr("This document can't be checked: it couldn't be read for editing");
+            return;
+        };
+        let failed = report.count(Status::Failed);
+        self.a11y.previous = None;
+        self.a11y.options = Some(options);
+        self.a11y.report = Some((id, report));
+        self.right = Some(RightPanel::Accessibility);
+        self.notify(if failed == 0 {
+            tl!("No untagged content was found.").to_string()
+        } else {
+            crate::i18n::fmt(tl!("Found {n} untagged content problems."), &[("n", &failed.to_string())])
+        });
+    }
+
     /// Check for accessibility: the options first, unless they are turned off.
     pub(crate) fn start_accessibility_check(&mut self) {
         if self.a11y_options.show_dialog {
@@ -608,6 +629,12 @@ pub(crate) fn alt_body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) ->
 }
 
 impl PdfCraftApp {
+    /// Prepare for accessibility ▸ Tag form fields.
+    pub(crate) fn autotag_form_fields(&mut self) {
+        self.apply_edit(pdfcraft_engine::Edit::AutoTagFormFields);
+        self.choose_right_panel(Some(RightPanel::Tags));
+    }
+
     /// Prepare for accessibility ▸ Add alternate text.
     pub(crate) fn start_alt_text(&mut self) {
         let Some((_, id)) = self.active_ids() else { return };
diff --git a/crates/ui-egui/src/appearance.rs b/crates/ui-egui/src/appearance.rs
index 5782b3d59..0d607cc91 100644
--- a/crates/ui-egui/src/appearance.rs
+++ b/crates/ui-egui/src/appearance.rs
@@ -83,9 +83,9 @@ fn preview(ui: &mut egui::Ui, kind: ThemeKind, width: f32) {
 }
 
 /// One theme card: its title, Active when it is what shows now, a preview of the chosen theme
-/// and a radio row per theme.
-fn card(ui: &mut egui::Ui, t: &Tokens, title: &str, active: bool, themes: &[(ThemeKind, &str)]) {
-    egui::Frame::new()
+/// and a radio row per theme. Returns true when the card or one of its radio rows was clicked.
+fn card(ui: &mut egui::Ui, t: &Tokens, title: &str, active: bool, themes: &[(ThemeKind, &str)]) -> bool {
+    let inner = egui::Frame::new()
         .fill(t.card)
         .stroke(egui::Stroke::new(1.0, if active { t.accent } else { t.border }))
         .corner_radius(6.0)
@@ -102,16 +102,21 @@ fn card(ui: &mut egui::Ui, t: &Tokens, title: &str, active: bool, themes: &[(The
             let shown = themes.first().map_or(ThemeKind::Light, |(kind, _)| *kind);
             preview(ui, shown, ui.available_width());
             ui.add_space(4.0);
+            let mut clicked = false;
             for (kind, label) in themes {
                 // One theme per card today, so it is always the chosen one.
-                let _ = ui.add(widgets::radio(*kind == shown, tl!(label)));
+                clicked |= ui.add(widgets::radio(*kind == shown, tl!(label))).clicked();
             }
+            clicked
         });
+    // The whole card picks its theme, not just the radio row.
+    let whole = inner.response.interact(egui::Sense::click()).on_hover_cursor(egui::CursorIcon::PointingHand);
+    inner.inner || whole.clicked()
 }
 
 /// The Appearance section of Preferences.
 pub fn preferences_section(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) {
-    ui.label(RichText::new(tl!("Appearance")).font(theme::semibold(13.0)));
+    ui.label(RichText::new(tl_ctx!("theme", "Appearance")).font(theme::semibold(13.0)));
     ui.horizontal(|ui| {
         ui.label(tl!("Appearance mode"));
         egui::ComboBox::from_id_salt("appearance-mode").selected_text(tl!(mode_label(app.theme_preference))).show_ui(ui, |ui| {
@@ -127,8 +132,12 @@ pub fn preferences_section(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens)
     let light_active = app.theme == ThemeKind::Light;
     ui.columns(2, |cols| {
         let [light, dark] = cols else { return };
-        card(light, t, tl!("Light theme"), light_active, LIGHT_THEMES);
-        card(dark, t, tl!("Dark theme"), !light_active, DARK_THEMES);
+        if card(light, t, tl!("Light theme"), light_active, LIGHT_THEMES) {
+            app.execute(mode_command(ThemePreference::Light));
+        }
+        if card(dark, t, tl!("Dark theme"), !light_active, DARK_THEMES) {
+            app.execute(mode_command(ThemePreference::Dark));
+        }
     });
 }
 
@@ -179,4 +188,32 @@ mod tests {
         h.run();
         assert_eq!(h.state().theme_preference, ThemePreference::System);
     }
+
+    /// Clicking a theme card, or its radio row, picks that theme, not only the mode combo box.
+    #[test]
+    fn clicking_a_theme_card_picks_that_theme() {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        let mut fonts = false;
+        let mut h = Harness::builder().with_size(egui::vec2(640.0, 400.0)).build_ui_state(
+            move |ui, app: &mut PdfCraftApp| {
+                if !fonts {
+                    ui.ctx().set_fonts(theme::font_definitions());
+                    fonts = true;
+                    return;
+                }
+                let t = Tokens::get(ui.ctx());
+                preferences_section(ui, app, &t);
+            },
+            app,
+        );
+        h.run();
+        h.get_by_label("Dark gray").click();
+        h.run();
+        assert_eq!((h.state().theme_preference, h.state().theme), (ThemePreference::Dark, ThemeKind::Dark));
+        // The card's title is not a widget of its own: the click lands on the card.
+        h.get_by_label("Light theme").click();
+        h.run();
+        assert_eq!((h.state().theme_preference, h.state().theme), (ThemePreference::Light, ThemeKind::Light));
+    }
 }
diff --git a/crates/ui-egui/src/autoscroll.rs b/crates/ui-egui/src/autoscroll.rs
index 139bdaed8..14751ffc5 100644
--- a/crates/ui-egui/src/autoscroll.rs
+++ b/crates/ui-egui/src/autoscroll.rs
@@ -1,6 +1,7 @@
 //! Middle-button scrolling for the document viewport: Linux latches auto-scroll, other
 //! platforms pan while the button is held. Either way the page tools never see the button,
-//! because egui's drag responses accept every pointer button.
+//! because egui's drag responses accept every pointer button. Also the edge scrolling of a
+//! text-selection drag.
 
 use egui::{Context, CursorIcon, Event, Key, PointerButton, Pos2, Stroke, Vec2, vec2};
 
@@ -187,6 +188,55 @@ impl AutoScroll {
     }
 }
 
+/// Width of the band along each edge of the viewport where a drawing in progress scrolls the view.
+const EDGE_BAND: f32 = 32.0;
+/// Scroll speed at the inner edge of the band, in points per second. It grows with the square of
+/// how far into the band (or past the edge) the pointer is, up to 1.5 bands deep.
+const DRAW_EDGE_SPEED: f32 = 700.0;
+
+/// How far to scroll the content this frame while a drawing is in progress and the pointer is in
+/// the band along an edge of `viewport` (or just past it): up, down, left and right. Positive
+/// moves the content down or right, like [`AutoScroll::update`]. The pointer must be within the
+/// viewport grown by one band, so a pointer over a neighbouring panel never scrolls the page.
+pub(crate) fn edge_scroll(pointer: Option<Pos2>, viewport: egui::Rect, dt: f32) -> Vec2 {
+    let Some(p) = pointer.filter(|p| p.is_finite()) else { return Vec2::ZERO };
+    if !dt.is_finite() || !viewport.is_positive() || !viewport.expand(EDGE_BAND).contains(p) {
+        return Vec2::ZERO;
+    }
+    let dt = dt.clamp(0.0, 0.05);
+    let axis = |p: f32, lo: f32, hi: f32| {
+        // A viewport narrower than two bands would scroll both ways at once: scroll neither.
+        if hi - lo < 2.0 * EDGE_BAND {
+            return 0.0;
+        }
+        let depth = |d: f32| (d / EDGE_BAND).clamp(0.0, 1.5);
+        let (before, after) = (depth(lo + EDGE_BAND - p), depth(p - (hi - EDGE_BAND)));
+        (before * before - after * after) * DRAW_EDGE_SPEED * dt
+    };
+    vec2(axis(p.x, viewport.left(), viewport.right()), axis(p.y, viewport.top(), viewport.bottom()))
+}
+
+/// Within this distance of the viewport's top or bottom edge, a text-selection drag scrolls.
+const EDGE: f32 = 30.0;
+/// Points per second for each point the pointer is into the edge band or past the viewport.
+const EDGE_SPEED: f32 = 20.0;
+
+/// How far a selection drag scrolls this frame with the pointer at `y`, near or past the top or
+/// bottom of `viewport` (#1670); faster the farther it goes. egui's delta moves the content.
+pub(crate) fn edge_delta(y: f32, viewport: egui::Rect, dt: f32) -> f32 {
+    if !y.is_finite() || !dt.is_finite() || viewport.height() < 4.0 * EDGE {
+        return 0.0;
+    }
+    let distance = if y > viewport.bottom() - EDGE {
+        y - (viewport.bottom() - EDGE)
+    } else if y < viewport.top() + EDGE {
+        y - (viewport.top() + EDGE)
+    } else {
+        return 0.0;
+    };
+    -distance.clamp(-MAX_DISPLACEMENT, MAX_DISPLACEMENT) * EDGE_SPEED * dt.clamp(0.0, 0.05)
+}
+
 fn scroll_delta(displacement: f32, dt: f32) -> f32 {
     if !displacement.is_finite() || !dt.is_finite() {
         return 0.0;
@@ -281,6 +331,20 @@ mod tests {
         assert!(!scroll.escape(&ctx));
     }
 
+    #[test]
+    fn edge_delta_scrolls_toward_the_edge_the_pointer_is_at() {
+        let viewport = egui::Rect::from_min_max(egui::pos2(0.0, 100.0), egui::pos2(400.0, 500.0));
+        assert_eq!(edge_delta(300.0, viewport, 0.016), 0.0, "nothing away from the edges");
+        assert!(edge_delta(495.0, viewport, 0.016) < 0.0, "the bottom edge moves the content up");
+        assert!(edge_delta(105.0, viewport, 0.016) > 0.0, "the top edge moves it down");
+        assert!(edge_delta(600.0, viewport, 0.016) < edge_delta(495.0, viewport, 0.016), "faster past the viewport");
+        for invalid in [f32::NAN, f32::INFINITY, f32::NEG_INFINITY] {
+            assert_eq!(edge_delta(invalid, viewport, 0.016), 0.0);
+            assert_eq!(edge_delta(495.0, viewport, invalid), 0.0);
+        }
+        assert!(edge_delta(f32::MAX, viewport, 0.016).is_finite());
+    }
+
     #[test]
     fn chromium_curve_is_gentle_near_the_anchor_and_accelerates_farther_away() {
         // Reference speeds in screen points/second from Chromium's distance exponent (2.2),
@@ -330,3 +394,44 @@ mod tests {
         }
     }
 }
+
+#[cfg(test)]
+mod edge_tests {
+    use super::*;
+
+    fn view() -> egui::Rect {
+        egui::Rect::from_min_max(egui::pos2(100.0, 50.0), egui::pos2(900.0, 650.0))
+    }
+
+    #[test]
+    fn scrolls_toward_each_of_the_four_edges() {
+        let dt = 1.0 / 60.0;
+        // Near the top or left edge the content moves down or right (positive), and the reverse
+        // near the bottom or right edge.
+        assert!(edge_scroll(Some(egui::pos2(500.0, 55.0)), view(), dt).y > 0.0);
+        assert!(edge_scroll(Some(egui::pos2(500.0, 645.0)), view(), dt).y < 0.0);
+        assert!(edge_scroll(Some(egui::pos2(105.0, 300.0)), view(), dt).x > 0.0);
+        assert!(edge_scroll(Some(egui::pos2(895.0, 300.0)), view(), dt).x < 0.0);
+        // Only the axis whose edge is near moves.
+        assert_eq!(edge_scroll(Some(egui::pos2(500.0, 55.0)), view(), dt).x, 0.0);
+    }
+
+    #[test]
+    fn the_middle_and_far_away_pointers_do_not_scroll() {
+        let dt = 1.0 / 60.0;
+        assert_eq!(edge_scroll(Some(egui::pos2(500.0, 300.0)), view(), dt), Vec2::ZERO);
+        assert_eq!(edge_scroll(Some(egui::pos2(500.0, 900.0)), view(), dt), Vec2::ZERO, "over another panel");
+        assert_eq!(edge_scroll(None, view(), dt), Vec2::ZERO);
+        assert_eq!(edge_scroll(Some(egui::pos2(f32::NAN, 55.0)), view(), dt), Vec2::ZERO);
+        assert_eq!(edge_scroll(Some(egui::pos2(500.0, 55.0)), view(), f32::INFINITY), Vec2::ZERO);
+    }
+
+    #[test]
+    fn it_speeds_up_the_closer_to_the_edge_and_past_it() {
+        let dt = 1.0 / 60.0;
+        let shallow = edge_scroll(Some(egui::pos2(500.0, 70.0)), view(), dt).y;
+        let deep = edge_scroll(Some(egui::pos2(500.0, 51.0)), view(), dt).y;
+        let past = edge_scroll(Some(egui::pos2(500.0, 40.0)), view(), dt).y;
+        assert!(0.0 < shallow && shallow < deep && deep < past, "{shallow} {deep} {past}");
+    }
+}
diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 9dc2c98df..989b731b7 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -25,10 +25,13 @@ const THUMB_TAG: u64 = 1 << 63;
 const TEXT_TAG: u64 = 1 << 62;
 /// A page rendered for the organize grid at the size it is drawn there.
 const GRID_TAG: u64 = 1 << 61;
+/// Preview rasters tagged with this bit are converted to luminance on receipt, matching the
+/// monochrome print requested by Print ▸ Print in grayscale.
+const GRAYSCALE_TAG: u64 = 1 << 60;
 /// The tag of a raster that is out of date (shown until its replacement arrives).
 const STALE_TAG: u64 = u64::MAX;
 /// Pages whose raster would exceed this many device pixels on a side are drawn in tiles.
-const TILE_THRESHOLD: f32 = 4096.0;
+pub(crate) const TILE_THRESHOLD: f32 = 4096.0;
 /// Base device-pixel side of a page tile. The actual side grows with the zoom
 /// ([`tile_side`]), so a zoomed viewport is covered by a few tiles instead of many.
 const TILE: u32 = 1024;
@@ -266,6 +269,16 @@ impl Selection {
     }
 }
 
+/// The glyphs `clicks` quick clicks select around glyph `a`: two the word, three the line, more
+/// the page.
+fn click_unit(text: &PageText, clicks: u32, a: usize) -> Option<(usize, usize)> {
+    match clicks {
+        2 => text.word_at(a),
+        3 => text.line_at(a),
+        _ => text.glyphs.len().checked_sub(1).map(|last| (0, last)),
+    }
+}
+
 struct PageTex {
     tag: u64,
     tex: TextureHandle,
@@ -299,6 +312,8 @@ pub struct DocView {
     pub organize: bool,
     pub highlight_fields: bool,
     pub page_input: String,
+    /// Select the replacement page label once if its editor remains focused.
+    pub(crate) page_input_reselect: bool,
     pub notice_dismissed: bool,
     /// The user has been told that the form's scripts were turned off (it is said once).
     pub scripts_off_noted: bool,
@@ -346,6 +361,8 @@ pub struct DocView {
     current_scale_tag: u64,
     /// Print dialog: the current sheet's pages at the preview pane's device resolution.
     print_pages: HashMap<usize, (u64, TextureHandle)>,
+    /// Print dialog: preview rasters become luminance when Print ▸ Print in grayscale is on.
+    grayscale: bool,
     /// Sharp tiles of large pages: (page, scale tag, tile x, tile y) → texture. Tiles of an
     /// earlier zoom stay, drawn stretched, until those of the current one cover the page.
     tiles: HashMap<(usize, u64, u32, u32), TextureHandle>,
@@ -384,10 +401,12 @@ pub struct DocView {
     /// (#759). The window outlasts a single frame so egui's internal easing tail is suppressed as
     /// it decays, instead of adding on top of the 1:1 motion.
     precise_scroll_until: f64,
+    /// Touchpad momentum after the fingers lift (#531).
+    fling: crate::fling::Fling,
     pub(crate) auto_scroll: crate::autoscroll::AutoScroll,
     /// Pages selected in the organize grid or the Pages panel (0-based). Empty means "the current page".
     pub selected: BTreeSet<usize>,
-    organize_range: crate::page_selection_ui::PageSelectionInput,
+    pub(crate) organize_range: crate::page_selection_ui::PageSelectionInput,
     /// Anchor for ⇧-click range selection in the organize grid.
     select_anchor: Option<usize>,
     /// An edit requested by the view (organize toolbar, keys), applied by the app this frame.
@@ -396,6 +415,9 @@ pub struct DocView {
     /// line being edited.
     pub(crate) edit_lines: HashMap<usize, (u64, Vec<pdfcraft_engine::TextBlock>)>,
     pub line_editor: Option<crate::edit_text_ui::LineEditor>,
+    /// The box a click switched to while another paragraph was being edited: it opens once the
+    /// queued edit has applied, so its index and geometry come from the document it now is (#2022).
+    pub(crate) pending_text_open: Option<(usize, usize)>,
     pub(crate) text_background: crate::edit_text_ui::TextBackground,
     pub(crate) move_background: crate::content_ui::MoveBackground,
     /// Edit text & images: the images per page (by document generation), and the selected one.
@@ -449,6 +471,11 @@ pub struct DocView {
     /// The page-grid gap under the pointer this frame (where dropped files go), when it can
     /// take pages.
     pub grid_gap: Option<usize>,
+    /// The visible part of the Pages panel as last drawn, when it can take dropped files
+    /// (cleared each frame before the panels draw).
+    pub pages_panel: Option<Rect>,
+    /// The Pages-panel gap under the pointer (where dropped files go), when it can take pages.
+    pub panel_gap: Option<usize>,
     /// How large the page grid draws its pages (1.0 = the usual thumbnails).
     grid_zoom: f32,
     /// A zoom asked for this frame (toolbar, pinch, keys); the grid applies it once it has laid
@@ -457,6 +484,8 @@ pub struct DocView {
     /// The page to keep in place after a grid zoom, and how far below the top of the grid its
     /// cell was.
     grid_anchor: Option<(usize, f32)>,
+    /// The page the grid scrolls into view on its next frame (Organize just opened on it).
+    grid_reveal: Option<usize>,
     /// Sharp renders of the pages the grid shows larger than a thumbnail: only those in view,
     /// at the size drawn (device pixels wide).
     grid_pages: HashMap<usize, (u32, TextureHandle)>,
@@ -472,7 +501,9 @@ pub struct DocView {
     /// interpret, so a drag would otherwise queue a storm of them (one per frame) while the
     /// in-flight ones cannot be cancelled mid-operator. Older tiles and the backdrop stay
     /// stretched meanwhile; fresh tiles go out once the pan settles.
-    last_scroll: Vec2,
+    pub(crate) last_scroll: Vec2,
+    /// Side-by-side compare: scroll to here this frame, following the other half.
+    pub(crate) sync_scroll: Option<Vec2>,
     pan_hold_until: f64,
     /// Pages whose raster proved slow (see `SLOW_MILLIS`): only these get the zoom/pan
     /// settle holds. Fast pages render straight through, with no added latency.
@@ -588,6 +619,7 @@ impl DocView {
             organize: false,
             highlight_fields: defaults.highlight_fields,
             page_input: "1".into(),
+            page_input_reselect: false,
             notice_dismissed: false,
             scripts_off_noted: false,
             disk_changed: false,
@@ -611,6 +643,7 @@ impl DocView {
             stale_tiles: HashSet::new(),
             current_scale_tag: 0,
             print_pages: HashMap::new(),
+            grayscale: false,
             tiles: HashMap::new(),
             texts: HashMap::new(),
             text_failed: HashSet::new(),
@@ -632,6 +665,7 @@ impl DocView {
             shown: false,
             wheel: Default::default(),
             precise_scroll_until: 0.0,
+            fling: Default::default(),
             auto_scroll: Default::default(),
             selected: BTreeSet::new(),
             select_anchor: None,
@@ -639,6 +673,7 @@ impl DocView {
             pending_edit: None,
             edit_lines: HashMap::new(),
             line_editor: None,
+            pending_text_open: None,
             text_background: Default::default(),
             move_background: Default::default(),
             edit_images: HashMap::new(),
@@ -649,13 +684,17 @@ impl DocView {
             pending_action: None,
             insert_at: None,
             grid_gap: None,
+            pages_panel: None,
+            panel_gap: None,
             grid_zoom: 1.0,
             grid_zoom_request: None,
             grid_anchor: None,
+            grid_reveal: None,
             grid_pages: HashMap::new(),
             last_scale: 0.0,
             sharp_hold_until: 0.0,
             last_scroll: Vec2::ZERO,
+            sync_scroll: None,
             pan_hold_until: 0.0,
             slow_pages: HashSet::new(),
             comments: Default::default(),
@@ -688,7 +727,6 @@ impl DocView {
         self.page_heights = info.pages.iter().map(|p| p.height).collect();
         let last = self.page_count.saturating_sub(1);
         self.current = self.current.min(last);
-        self.page_input = (self.current + 1).to_string();
         self.selected.retain(|p| *p <= last);
         // Text being typed on a page that no longer exists goes with the page.
         if self.content.draft.as_ref().is_some_and(|d| d.page > last || self.page_count == 0) {
@@ -715,6 +753,7 @@ impl DocView {
         fresh.zoom = self.zoom;
         fresh.fit = self.fit;
         fresh.layout = self.layout;
+        fresh.continuous = self.continuous;
         fresh.rotation = self.rotation;
         fresh.current = self.current;
         fresh.organize = self.organize;
@@ -735,6 +774,20 @@ impl DocView {
         *self = fresh;
         // Marks the kept images out of date and clamps the page to the new page count.
         self.document_changed(info);
+        self.page_input = self.current_page_label(info.pages.get(self.current).map(|page| page.label.as_str()));
+        self.page_input_reselect = true;
+    }
+
+    /// Open Organize Pages on the page being read (issue #1910). An empty selection means the
+    /// current page, so a selection left from earlier that does not include it is dropped, and
+    /// the grid scrolls its cell into view. Every way into the grid goes through here; closing
+    /// it is a plain `organize = false`.
+    pub fn open_organize(&mut self) {
+        self.organize = true;
+        if !self.selected.is_empty() && !self.selected.contains(&self.current) {
+            self.clear_page_selection(Some(self.current));
+        }
+        self.grid_reveal = Some(self.current);
     }
 
     /// Pages an organize command acts on: the selection, or the current page.
@@ -789,10 +842,19 @@ impl DocView {
         !self.last_queue.is_empty() || self.text_background.pending() || self.move_background.pending()
     }
 
+    /// The cached tile keys of a page, as (scale tag, tile x, tile y) (diagnostics and tests).
+    pub fn tiles_debug(&self, page: usize) -> Vec<(u64, u32, u32)> {
+        let mut k: Vec<(u64, u32, u32)> = self.tiles.keys().filter(|key| key.0 == page).map(|key| (key.1, key.2, key.3)).collect();
+        k.sort_unstable();
+        k
+    }
+
     /// Re-render every page and text layer (the document's appearance changed, e.g. a layer
     /// was toggled). Out-of-date rasters stay on screen until their replacements arrive, so the
     /// view never flashes blank.
     pub fn invalidate_content(&mut self) {
+        // Undo, redo and other document-wide changes: a released drawing's preview would be a ghost.
+        self.comments.settling.clear();
         for p in self.pages.values_mut() {
             p.tag = STALE_TAG;
         }
@@ -876,6 +938,11 @@ impl DocView {
         self.thumbs.get(&page).map(|t| t.tex.id())
     }
 
+    /// The whole-page raster on screen for `page` (the low-res backdrop of a tiled page), if any.
+    pub(crate) fn page_raster(&self, page: usize) -> Option<egui::TextureId> {
+        self.pages.get(&page).map(|p| p.tex.id())
+    }
+
     /// The print preview's picture of `page`: the sheet raster when it has arrived, otherwise the
     /// thumbnail.
     pub(crate) fn page_preview(&self, page: usize) -> Option<egui::TextureId> {
@@ -955,6 +1022,8 @@ impl DocView {
         let Some(f) = self.find.as_mut() else { return };
         let Some(&(p, _)) = f.matches.get(i) else { return };
         f.current = Some(i);
+        self.go_to_page(p);
+        self.goto_point = None;
         self.flash_match(p);
     }
 
@@ -969,6 +1038,9 @@ impl DocView {
         let next = if forward { (c + 1) % n } else { (c + n - 1) % n };
         f.current = Some(next);
         let p = f.matches[next].0;
+        // Only explicit search navigation joins history; background refresh uses flash_match alone.
+        self.go_to_page(p);
+        self.goto_point = None;
         self.flash_match(p);
     }
 
@@ -1020,7 +1092,6 @@ impl DocView {
         self.wheel.clear_motion();
         self.goto = Some((page, 0.0));
         self.current = page;
-        self.page_input = (page + 1).to_string();
     }
 
     /// Go to a destination, a bookmark's or a link's (ISO 32000-2 §12.3.2.2): its page, scrolled
@@ -1088,26 +1159,49 @@ impl DocView {
     /// page of the spread is already on screen, so stepping to it wouldn't move the view (#70).
     pub fn step_page(&mut self, forward: bool) {
         let c = self.current;
-        let target = match self.layout {
+        let last = self.page_count.saturating_sub(1);
+        let (target, first) = match self.layout {
             PageLayout::TwoUp => {
                 // Spreads are [0, 1], [2, 3], … or, with a cover page, [0], [1, 2], [3, 4], ….
                 let first = if self.cover { c.saturating_sub((c + 1) % 2) } else { c - c % 2 };
-                match (forward, self.cover && c == 0) {
+                let target = match (forward, self.cover && c == 0) {
                     (true, true) => 1,
                     (true, false) => first.saturating_add(2),
                     (false, _) if self.cover && first <= 1 => 0,
                     (false, _) => first.saturating_sub(2),
-                }
+                };
+                (target, first)
             }
-            PageLayout::Single if forward => c + 1,
-            PageLayout::Single => c.saturating_sub(1),
+            PageLayout::Single if forward => (c + 1, c),
+            PageLayout::Single => (c.saturating_sub(1), c),
         };
+        // Past either end there is nowhere to go: stay put rather than re-align the view, which
+        // would scroll the page back to its top.
+        if if forward { target > last } else { first == 0 } {
+            return;
+        }
         self.go_to_page(target);
     }
 
-    /// Go to the page typed in the page box: a page label (logical page numbers, as Acrobat
-    /// does), else a page number. `false` when it names no page.
+    /// Page-editor focus and drafts belong to a document, even while another tab is active.
+    pub(crate) fn page_input_id(&self) -> egui::Id {
+        egui::Id::new(("page-input", self.id.0))
+    }
+
+    /// The idle page box and unchanged-input lookup share the same label fallback.
+    pub(crate) fn current_page_label(&self, label: Option<&str>) -> String {
+        label.filter(|l| !l.is_empty()).map(str::to_owned).unwrap_or_else(|| (self.current + 1).to_string())
+    }
+
+    /// Retain the current page when `typed` exactly matches its displayed label, even if
+    /// another page has that label. Otherwise resolve a trimmed label (case-insensitive),
+    /// then a physical page number. `false` when it names no page.
     pub fn go_to_typed(&mut self, typed: &str, labels: &[String]) -> bool {
+        // Compare the displayed value before trimming: a label may itself contain spaces.
+        // Repeated labels occur in restarted sections and prefix-only ranges.
+        if self.current < self.page_count && self.current_page_label(labels.get(self.current).map(String::as_str)) == typed {
+            return true;
+        }
         let t = typed.trim();
         let page = labels
             .iter()
@@ -1130,7 +1224,6 @@ impl DocView {
         let page = page.min(self.page_count.saturating_sub(1));
         self.goto = Some((page, 0.0));
         self.current = page;
-        self.page_input = (page + 1).to_string();
         true
     }
 
@@ -1222,6 +1315,33 @@ impl DocView {
         self.current != before
     }
 
+    /// One wheel event in a non-continuous view whose page is taller than the window, where the
+    /// wheel pans (#1924). Once the view is at the bottom (top) edge, scrolling on turns to the
+    /// next (previous) page, which shows its top (bottom). A smooth gesture that panned the page
+    /// has to end first (see `WheelPager::feed_edge`). `can_turn` is false when something else
+    /// owns the wheel. Returns whether the page turned.
+    pub fn single_page_wheel_edge(&mut self, unit: egui::MouseWheelUnit, dy: f32, phase: egui::TouchPhase, now: f64, can_turn: bool) -> bool {
+        if self.continuous {
+            return false;
+        }
+        // Only an up-to-date view counts: the page drawn is the shown one, with no jump pending.
+        let edge = self.goto.is_none()
+            && self.goto_point.is_none()
+            && self.single_edges.is_some_and(|(page, top, bottom)| page == self.current && if dy < 0.0 { bottom } else { top });
+        let Some(forward) = self.wheel.feed_edge(unit, dy, phase, now, can_turn && edge) else { return false };
+        let before = self.current;
+        self.step_page(forward);
+        if self.current == before {
+            return false;
+        }
+        if !forward {
+            // Going back lands on the bottom of the previous page.
+            self.goto = Some((self.current, 1.0));
+        }
+        self.single_edges = None;
+        true
+    }
+
     /// Displayed page size in points for this view rotation.
     fn display_size(&self, p: &pdfcraft_render::PageInfo) -> (f32, f32) {
         if self.rotation % 180 == 90 { (p.height, p.width) } else { (p.width, p.height) }
@@ -1315,6 +1435,8 @@ impl DocView {
 
     /// Start collecting demand from every consumer before scheduling or uploading results.
     pub(crate) fn begin_render_frame(&mut self) {
+        self.pages_panel = None;
+        self.panel_gap = None;
         self.thumb_demand.clear();
         self.frame_queue.clear();
         self.frame_visible.clear();
@@ -1453,8 +1575,13 @@ impl DocView {
         }
         self.pages.retain(|p, _| pages.contains(p));
         // Tiles of an earlier zoom (not a demanded scale) stay while the canvas keeps them, a
-        // bounded few under a page whose current tiles are still missing (OLD_TILES).
-        self.tiles.retain(|key, _| tiles.contains(key) || !tile_tags.contains(&key.1));
+        // bounded few under a page whose current tiles are still missing (OLD_TILES). Tiles of a
+        // page on screen stay too even when this frame does not demand them (#2196): the viewport
+        // moves while zooming, so a tile that was sharp a moment ago falls outside the demanded
+        // rectangle, and dropping it made every pan or zoom back a cold miss that re-blurred the
+        // page and re-interpreted it once per tile. The per-frame cap below (OLD_TILES,
+        // nearest scale first) is what bounds how much of that stays.
+        self.tiles.retain(|key, _| tiles.contains(key) || !tile_tags.contains(&key.1) || self.frame_visible.contains(&key.0));
         self.stale_tiles.retain(|key| self.tiles.contains_key(key));
         queue.extend(grid);
         // Opening (or turning to) a page queues its pixels alongside thumbnails and
@@ -1606,9 +1733,14 @@ impl DocView {
             self.stale_tiles.remove(&key);
             if !self.stale_tiles.iter().any(|k| k.0 == page) {
                 self.forms.unbaked.retain(|(_, p)| *p != page);
+                self.comments.page_rendered(page);
             }
         } else if r.request.tag & PRINT_TAG != 0 {
-            let tex = ctx.load_texture(format!("print-{:?}-{page}", self.id), img, TextureOptions::LINEAR);
+            let tex = ctx.load_texture(
+                format!("print-{:?}-{page}", self.id),
+                if r.request.tag & GRAYSCALE_TAG != 0 { grayscale(img) } else { img },
+                TextureOptions::LINEAR,
+            );
             self.print_pages.insert(page, (r.request.tag, tex));
         } else if r.request.tag & GRID_TAG != 0 {
             let tex = ctx.load_texture(format!("grid-{:?}-{page}", self.id), img, TextureOptions::LINEAR);
@@ -1622,6 +1754,7 @@ impl DocView {
             self.pages.insert(page, PageTex { tag: r.request.tag, tex });
             self.signature_drag.page_received(page);
             self.move_background.page_received(page);
+            self.comments.page_rendered(page);
             self.waiting_since.remove(&page);
             if !self.stale_tiles.iter().any(|k| k.0 == page) {
                 self.forms.unbaked.retain(|(_, p)| *p != page);
@@ -1743,6 +1876,15 @@ impl DocView {
         self.zoom * PT * ppp
     }
 
+    /// Set whether the print preview rasters become luminance before upload. Toggling it drops
+    /// the colour previews: new requests carry the grayscale tag, so stale ones are replaced.
+    pub(crate) fn set_print_grayscale(&mut self, grayscale: bool) {
+        if self.grayscale != grayscale {
+            self.grayscale = grayscale;
+            self.print_pages.clear();
+        }
+    }
+
     /// Queue sharp rasters for the print preview. Pages that leave the nearby sheets are dropped.
     /// Previews render with reading colours off (the request's tag tells the renderer): they must
     /// match the printout, which is imposed from the uncoloured document.
@@ -1752,7 +1894,7 @@ impl DocView {
             if self.errors.contains_key(&page) || !scale.is_finite() || scale <= 0.0 {
                 continue;
             }
-            let tag = scale_tag(scale) | PRINT_TAG;
+            let tag = scale_tag(scale) | PRINT_TAG | if self.grayscale { GRAYSCALE_TAG } else { 0 };
             let fresh = self.print_pages.get(&page).is_some_and(|(have, _)| *have == tag);
             if !fresh {
                 self.frame_queue.push(RenderRequest { page, kind: RequestKind::Pixels, tile: None, scale, tag, preview: false });
@@ -1925,7 +2067,7 @@ impl PageXform {
     }
 }
 
-pub fn shortcuts(view: &mut DocView, ctx: &egui::Context) {
+pub fn shortcuts(view: &mut DocView, ctx: &egui::Context, speed: crate::scroll_speed::ScrollSpeed) {
     use egui::{Key, KeyboardShortcut, Modifiers};
     if ctx.input_mut(|i| i.consume_shortcut(&KeyboardShortcut::new(Modifiers::COMMAND, Key::F))) {
         view.open_find();
@@ -2015,9 +2157,12 @@ pub fn shortcuts(view: &mut DocView, ctx: &egui::Context) {
     // ↓ / ↑ scroll a line, and Page Down / Page Up a screen where the pages scroll. In
     // single-page view, ↓ / ↑ turn the page once there is nothing left to scroll that way, as
     // the wheel does (#273): always on a page that fits.
+    // The Scroll speed preference sets how far ↓ / ↑ go as well as the wheel (#985); Page Down /
+    // Page Up keep a screen.
     if !command {
+        let line = KEY_SCROLL_LINE * speed.factor();
         let screen = (view.viewport_h - KEY_SCROLL_LINE).max(KEY_SCROLL_LINE);
-        let steps = [(Key::ArrowDown, KEY_SCROLL_LINE), (Key::ArrowUp, -KEY_SCROLL_LINE), (Key::PageDown, screen), (Key::PageUp, -screen)];
+        let steps = [(Key::ArrowDown, line), (Key::ArrowUp, -line), (Key::PageDown, screen), (Key::PageUp, -screen)];
         for (k, by) in steps {
             let arrow = matches!(k, Key::ArrowDown | Key::ArrowUp);
             if !key(k) || !(scrolls || arrow) {
@@ -2043,8 +2188,8 @@ pub fn shortcuts(view: &mut DocView, ctx: &egui::Context) {
     }
 }
 
-/// How far ↓ / ↑ scroll: a mouse-wheel line on the desktop. Page Down / Page Up keep this much
-/// of the previous screen in view.
+/// How far ↓ / ↑ scroll at Normal speed (Scroll speed halves or doubles it). Page Down / Page Up
+/// keep this much of the previous screen in view.
 const KEY_SCROLL_LINE: f32 = 40.0;
 
 pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
@@ -2146,6 +2291,18 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         Vec2::ZERO
     };
 
+    // Drawing a comment: the pointer in a band along any edge (or just past it) scrolls the view
+    // that way, so a point beyond what is shown can be reached without letting go of the tool.
+    let edge_delta = if unobstructed && matches!(view.comments.gesture, Some(comments::Gesture::Draw { .. })) {
+        let (pointer, dt) = ui.input(|i| (if i.pointer.any_down() { i.pointer.latest_pos() } else { i.pointer.hover_pos() }, i.stable_dt));
+        crate::autoscroll::edge_scroll(pointer, avail, dt)
+    } else {
+        Vec2::ZERO
+    };
+    if edge_delta != Vec2::ZERO {
+        ui.ctx().request_repaint();
+    }
+
     let content_w = view.content_width(info, avail.width());
     let rects = view.layout(info, content_w);
     // When not scrolling continuously, only one row is shown at a time: the current page, or the
@@ -2167,17 +2324,19 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
     };
     let middle_gesture = view.auto_scroll.blocks_input();
     // Not scrolling: when the whole page or spread fits, the wheel would do nothing, so it turns
-    // pages instead; zoomed in far enough to pan, it pans. Touch drags are untouched: with
+    // pages instead; zoomed in far enough to pan, it pans, and at the edge it turns the page on
+    // (#1924, `single_page_wheel_edge`). Touch drags are untouched: with
     // nothing to pan, touch users turn pages with the rail buttons, the page box and the arrow
     // keys. Runs before `visible_pages` so the frame that turns the page draws it.
     let mut single_paging = false;
+    let mut edge_turned = false;
     if !view.continuous {
         // The row's bounding box on screen (one page, or a two-page spread).
         let row_rect = row.iter().filter_map(|&i| rects.get(i)).copied().reduce(Rect::union);
         // Within a point, so layout rounding can't stop a fitting page from turning.
         let fits = row_rect.is_some_and(|r| r.height() + 2.0 * MARGIN <= avail.height() + 1.0);
-        let can_turn = fits && !middle_gesture && unobstructed && ui.rect_contains_pointer(avail);
-        single_paging = can_turn;
+        let can_turn = !middle_gesture && unobstructed && ui.rect_contains_pointer(avail);
+        single_paging = can_turn && fits;
         // Every wheel event goes to the pager, so it follows each trackpad touch to its end
         // even while the page can't turn.
         ui.input(|i| {
@@ -2185,11 +2344,15 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                 if let egui::Event::MouseWheel { unit, delta, phase, modifiers } = e {
                     // Zooming (⌘ or Ctrl) and sideways scrolling (Shift) never turn pages.
                     let dy = if modifiers.command || modifiers.ctrl || modifiers.shift { 0.0 } else { delta.y };
-                    view.single_page_wheel(*unit, dy, *phase, i.time, can_turn);
+                    if fits {
+                        view.single_page_wheel(*unit, dy, *phase, i.time, can_turn);
+                    } else {
+                        edge_turned |= view.single_page_wheel_edge(*unit, dy, *phase, i.time, can_turn);
+                    }
                 }
             }
         });
-        if can_turn {
+        if single_paging {
             // Paging owns vertical wheel motion here. A diagonal gesture keeps its sideways
             // part, as `ScrollArea` itself handles each axis.
             ui.input_mut(|i| i.smooth_scroll_delta.y = 0.0);
@@ -2226,8 +2389,16 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
             view.precise_scroll_until = now + 0.25;
         }
     }
+    if edge_turned {
+        // The turn leaves egui's eased copy of the notch to decay for a few frames; it must not
+        // scroll the page just shown away from its top (or bottom).
+        view.precise_scroll_until = now + 0.25;
+    }
     // Paging owns the vertical axis in single-page view; leave it to the pager.
-    if single_paging {
+    // The rest of a gesture that turned the page is swallowed too, or it would pan the new page
+    // away from the edge it was shown at.
+    let paging_owns_vertical = single_paging || (!view.continuous && view.wheel.gesture_turned());
+    if paging_owns_vertical {
         precise_scroll.y = 0.0;
     }
     if now < view.precise_scroll_until {
@@ -2235,9 +2406,25 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
     } else {
         precise_scroll = Vec2::ZERO;
     }
+    // Touchpad momentum (#531): a swipe over the page lifted at speed glides on and slows to a
+    // stop, through the same un-eased path. Never while the pager owns the wheel, a gesture or
+    // dialog has the input, or animations are off; any click, key, zoom or other scrolling ends it.
+    // Asked of the preference, not of egui's animation time, which test harnesses zero.
+    let animates = app.animation_effects.animates(app.motion.reduced);
+    let may_glide = !paging_owns_vertical && !middle_gesture && navigation_enabled && unobstructed && animates;
+    let over_page = ui.rect_contains_pointer(avail);
+    ui.input(|i| view.fling.read(&i.events, now, may_glide && over_page));
+    let interrupted = ui.input(|i| i.pointer.any_pressed() || i.events.iter().any(|e| matches!(e, egui::Event::Key { pressed: true, .. })));
+    if !may_glide || interrupted || key_scroll != 0.0 || auto_delta != Vec2::ZERO || zoom_delta != 1.0 {
+        view.fling.stop();
+    }
+    let glide = view.fling.step(now);
+    if view.fling.gliding() {
+        ui.ctx().request_repaint();
+    }
     let visible_pages: Vec<usize> = if view.continuous { (0..rects.len()).collect() } else { row.clone() };
     let (y_shift, content_h) = if view.continuous {
-        (0.0, rects.last().map(|r| r.bottom() + MARGIN).unwrap_or(0.0))
+        (0.0, rects.iter().map(|r| r.bottom()).reduce(f32::max).map(|bottom| bottom + MARGIN).unwrap_or(0.0))
     } else {
         // Only the current row scrolls into view; the content is its bounding box plus margins.
         match row.iter().filter_map(|&i| rects.get(i)).copied().reduce(Rect::union) {
@@ -2258,16 +2445,25 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
     });
     // Each document keeps its own scroll position when switching tabs (#189).
     scroll = scroll.id_salt(("page-view", view.id));
+    // Every scroll here asks for no animation. An animated area would still queue a zero-length
+    // offset target for the next frame, which overwrites the jump a page turn just set.
+    scroll = scroll.animated(false);
     // A newly opened document starts at the top. eframe saves egui's memory with the settings
     // and document ids start again at 1 every launch, so the offset stored under this id can be
     // where an earlier session left another document.
     if !std::mem::replace(&mut view.shown, true) {
         scroll = scroll.scroll_offset(Vec2::ZERO);
     }
+    if let Some(v) = view.sync_scroll.take() {
+        scroll = scroll.scroll_offset(v);
+    }
     if let Some((page, fx, fy, rel)) = view.zoom_anchor.take() {
         let r = rects[page.min(rects.len() - 1)];
         let point = pos2(r.left() + fx * r.width(), r.top() - y_shift + fy * r.height());
         scroll = scroll.scroll_offset(vec2((point.x - rel.x).max(0.0), (point.y - rel.y).max(0.0)));
+    } else if edge_turned {
+        // The row above was laid out for the page before the turn: place the new one next frame.
+        ui.ctx().request_repaint();
     } else if let Some((page, frac)) = view.goto.take() {
         let page = page.min(rects.len() - 1);
         let r = rects[page];
@@ -2312,8 +2508,11 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         | QuickTool::Snapshot => false,
     };
     let prefs = &app.comment_prefs;
+    let redact_mark = (app.redact_prefs.hover_fill, app.redact_prefs.opacity);
     let units = app.units;
     let allowed = doc.allows_annotation();
+    let can_copy = doc.allows_copying();
+    let mut copy_selected = false;
     let comments_hidden = doc.comments_hidden();
     let form = doc.form.clone();
     let can_fill = doc.allows_form_filling();
@@ -2359,9 +2558,9 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         view.prepare.selected = None;
     }
     view.objects.prepare(doc, tool == QuickTool::EditText && can_modify, ui.ctx());
-    view.text_background.prepare(ui.ctx(), doc, view.line_editor.as_ref(), scale);
-    let added = doc.added.clone();
-    let doc_links = if tool == QuickTool::Link { doc.links.clone() } else { Vec::new() };
+    view.text_background.prepare(ui.ctx(), doc, view.line_editor.as_ref(), view.content.draft.as_ref(), scale);
+    let added = if editing_content { doc.added().to_vec() } else { Vec::new() };
+    let doc_links = if tool == QuickTool::Link { doc.links().to_vec() } else { Vec::new() };
     if editing_content {
         crate::content_ui::after_refresh(view, &added);
     } else {
@@ -2391,9 +2590,10 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
             // Only interactions pause; the document must keep its original colours.
             ui.set_opacity(opacity);
         }
-        // Middle-button auto-scroll, the keyboard and precise touchpad input (#759); positive y
-        // moves the content down. All three scroll without easing, unlike egui's wheel default.
-        let delta = auto_delta - vec2(0.0, key_scroll) + precise_scroll;
+        // Middle-button auto-scroll, the keyboard, precise touchpad input (#759) and its glide
+        // (#531), and a drawing's edge scroll; positive y moves the content down. All scroll
+        // without easing, unlike egui's wheel default.
+        let delta = auto_delta + edge_delta - vec2(0.0, key_scroll) + precise_scroll + glide;
         if delta != Vec2::ZERO {
             ui.scroll_with_delta_animation(delta, egui::style::ScrollAnimation::none());
         }
@@ -2426,6 +2626,11 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         let mut current_overlap = -1.0f32;
         let mut current_height = f32::INFINITY;
         let pointer = ui.input(|i| i.pointer.hover_pos());
+        // A press on a page makes it the current one (as in Acrobat), so a page command with
+        // no selection (Rotate, Delete) acts on the page the reader pointed at, not on a page
+        // gone to earlier that still shows whole beside it.
+        let pressed = unobstructed && ui.input(|i| i.pointer.primary_pressed()) && ui.rect_contains_pointer(avail);
+        let mut pressed_page = None;
         if resp.secondary_clicked() {
             // Set again below when the right-click lands on a link.
             view.links.context = None;
@@ -2435,6 +2640,9 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
             if !r.intersects(visible.expand(400.0)) {
                 continue;
             }
+            if pressed && pressed_page.is_none() && pointer.is_some_and(|p| r.contains(p)) {
+                pressed_page = Some(i);
+            }
             if r.intersects(visible) {
                 visible_now.push(i);
                 view.screen_rects.push((i, r));
@@ -2570,7 +2778,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                     }
                 }
             }
-            view.text_background.paint(painter, &xf, i, view.line_editor.as_ref());
+            view.text_background.paint(painter, &xf, i, view.line_editor.as_ref(), view.content.draft.as_ref());
             if editing_content {
                 let page_tex = view.pages.get(&i).map(|p| p.tex.id());
                 view.move_background.paint(ui, painter, &xf, i, info, &view.content, page_tex);
@@ -2578,7 +2786,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
             painter.rect_stroke(r, CornerRadius::ZERO, Stroke::new(0.5, t.border.gamma_multiply(0.8)), egui::StrokeKind::Outside);
 
             // Comments: tools, selection, moving and resizing come before text selection.
-            let pcx = comments::PageCx { page: i, xf: &xf, info, tool, prefs, allowed, hidden: comments_hidden };
+            let pcx = comments::PageCx { page: i, xf: &xf, info, tool, prefs, allowed, hidden: comments_hidden, redact_mark };
             if let QuickTool::Measure(measure_tool) = tool {
                 crate::measure_ui::page_input(ui, &resp, doc, view, &pcx, measure_tool, units);
             }
@@ -2673,7 +2881,8 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                 view.current = i;
                 open_boxes = true;
             }
-            let on_field = if preparing {
+            // `over_field`: a form field is under the pointer and has set its cursor.
+            let (on_field, over_field) = if preparing {
                 let field_tool = match tool {
                     QuickTool::Field(f) => Some(f),
                     _ => None,
@@ -2681,11 +2890,18 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                 let o = crate::prepare::page_input(ui, &resp, &xf, i, info, &form, field_tool, can_modify, view);
                 field_props |= o.properties;
                 field_placed |= o.placed;
-                o.consumed || field_tool.is_some()
+                (o.consumed || field_tool.is_some(), false)
             } else {
-                tool == QuickTool::Select
+                use crate::forms_ui::FieldPointer;
+                let field = if tool == QuickTool::Select
+                    && !(editing_content && can_modify && crate::content_ui::select_grabs(ui, &xf, i, info, &added, view))
                     && !comments::select_grabs(ui, &pcx, view)
-                    && crate::forms_ui::page_input(ui, &resp, &xf, i, info, &form, can_fill, view)
+                {
+                    crate::forms_ui::page_input(ui, &resp, &xf, i, info, &form, can_fill, view)
+                } else {
+                    FieldPointer::Away
+                };
+                (field == FieldPointer::Owned, field == FieldPointer::Over)
             };
             // Redact draws boxes off text; so does Highlight (an area highlight, as in Acrobat).
             let area_tool = tool == QuickTool::Redact && can_modify || tool == QuickTool::Comment(comments::CommentTool::Highlight) && allowed;
@@ -2700,21 +2916,55 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
             let image_owns_pointer = tool == QuickTool::EditText && crate::edit_text_ui::image_owns_pointer(ui, &xf, i, info, view);
             let on_objects =
                 !image_owns_pointer && tool == QuickTool::EditText && can_modify && crate::object_ui::page_input(ui, &resp, &xf, i, doc, view);
-            let on_content = !on_objects && editing_content && can_modify && {
-                crate::content_ui::page_input(ui, &resp, &xf, i, info, &added, tool == QuickTool::AddText, &text_style, view)
-                    || tool == QuickTool::AddText
-            };
-            // Added content owns its gesture; its source text must not queue a second edit.
-            let on_edit_text = !on_objects && !on_content && tool == QuickTool::EditText && can_modify && {
+            let lines = if matches!(tool, QuickTool::AddText | QuickTool::EditText) && can_modify {
                 let generation = doc.edit_generation();
-                let lines = match view.edit_lines.get(&i) {
+                match view.edit_lines.get(&i) {
                     Some((g, l)) if *g == generation => l.clone(),
                     _ => {
                         let l = doc.text_blocks(i);
                         view.edit_lines.insert(i, (generation, l.clone()));
                         l
                     }
-                };
+                }
+            } else {
+                Vec::new()
+            };
+            let over_source = tool == QuickTool::AddText
+                && pointer.is_some_and(|p| {
+                    !crate::content_ui::hits_added(&xf, info, i, &added, p)
+                        && lines.iter().any(|line| xf.user_rect(info, i, line.rect.map(|v| v as f32)).expand(2.0).contains(p))
+                });
+            let source_blocked = over_source && view.content.hold_blocked();
+            if over_source && resp.clicked() && !source_blocked {
+                if let Some(edit) = view.content.finish_draft(&added) {
+                    view.pending_edit = Some(edit);
+                }
+                view.content.selected = None;
+            }
+            let on_content = !on_objects && editing_content && can_modify && {
+                source_blocked
+                    || crate::content_ui::page_input(
+                        ui,
+                        &resp,
+                        &xf,
+                        i,
+                        info,
+                        &added,
+                        tool == QuickTool::AddText && !over_source,
+                        matches!(tool, QuickTool::AddText | QuickTool::EditText),
+                        &text_style,
+                        view,
+                    )
+                    || tool == QuickTool::AddText && !over_source
+            };
+            // Added content owns its gesture; its source text must not queue a second edit.
+            // Edit text & images boxes every paragraph and image whenever the tool is on. Only the
+            // input waits while selected objects or added content own the pointer, or while page
+            // input is blocked (another tab, a dialog, the window unfocused): the boxes stay drawn
+            // instead of vanishing until the pointer comes back.
+            let others_own_pointer = on_objects || on_content;
+            let on_edit_text = (tool == QuickTool::EditText || over_source) && can_modify && {
+                let generation = doc.edit_generation();
                 let images = match view.edit_images.get(&i) {
                     Some((g, l)) if *g == generation => l.clone(),
                     _ => {
@@ -2725,17 +2975,26 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                 };
                 // Editable text takes precedence over background/overlapping artwork. Both
                 // inventories are painted every frame, even when text owns the pointer.
-                let text_used = crate::edit_text_ui::page_input(ui, &resp, &xf, i, doc, &lines, view, !image_owns_pointer);
-                let image_used =
-                    crate::edit_text_ui::image_input(ui, &resp, &xf, i, info, &images, view, &mut image_action, image_owns_pointer || !text_used);
-                text_used || image_used
+                let text_used = crate::edit_text_ui::page_input(ui, &resp, &xf, i, doc, &lines, view, !others_own_pointer && !image_owns_pointer);
+                let image_used = crate::edit_text_ui::image_input(
+                    ui,
+                    &resp,
+                    &xf,
+                    i,
+                    info,
+                    &images,
+                    view,
+                    &mut image_action,
+                    !others_own_pointer && (image_owns_pointer || !text_used),
+                );
+                !others_own_pointer && (text_used || image_used)
             };
             let on_link = tool == QuickTool::Link && can_modify && crate::link_ui::page_input(ui, &resp, &xf, i, info, &doc_links, view);
             if tool == QuickTool::Select
                 && resp.secondary_clicked()
                 && can_modify
                 && let Some(p) = pointer.filter(|p| xf.rect.contains(*p))
-                && let Some(l) = doc.links.iter().find(|l| l.page == i && crate::link_ui::screen_rect(&xf, info, i, l.rect).expand(2.0).contains(p))
+                && let Some(l) = doc.links().iter().find(|l| l.page == i && crate::link_ui::screen_rect(&xf, info, i, l.rect).expand(2.0).contains(p))
             {
                 view.links.context = Some((i, l.index));
             }
@@ -2787,12 +3046,30 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                     // Column select (#740): the Column select tool, or Alt (Option on macOS) held
                     // while a drag starts, as in Acrobat.
                     let column = tool == QuickTool::ColumnSelect || ui.input(|inp| inp.modifiers.alt);
-                    if column && !over_link {
+                    // A link or a form field under the pointer keeps its own cursor: a check box
+                    // drawn with a glyph, or set on printed text, shows the hand, not the I-beam.
+                    let cursor_free = !over_link && !over_field;
+                    if column && cursor_free {
                         ui.ctx().set_cursor_icon(egui::CursorIcon::Crosshair);
-                    } else if over_text && !over_link {
+                    } else if over_text && cursor_free {
                         ui.ctx().set_cursor_icon(egui::CursorIcon::Text);
                     }
-                    let press_here = ui.input(|inp| inp.pointer.press_origin()).is_some_and(|o| r.contains(o));
+                    let press_here = ui
+                        .input(|inp| {
+                            inp.pointer.press_origin().or_else(|| {
+                                // A press and release can arrive in one pass; egui has already
+                                // cleared press_origin, but the press still starts multi-click selection.
+                                inp.events.iter().find_map(|event| match event {
+                                    egui::Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed: true, .. }
+                                        if pos.is_finite() =>
+                                    {
+                                        Some(*pos)
+                                    }
+                                    _ => None,
+                                })
+                            })
+                        })
+                        .is_some_and(|o| r.contains(o));
                     let pressed = ui.input(|inp| inp.pointer.primary_pressed());
                     if pressed && press_here && !over_link {
                         let now = ui.input(|inp| inp.time);
@@ -2807,11 +3084,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                         // Multi-click highlights immediately on pointer press instead of release (#1024).
                         let clicks = if view.clicks > 2 && tool != QuickTool::Select { 1 } else { view.clicks };
                         if clicks >= 2 && over_text {
-                            let span = text.nearest(vx, vy).and_then(|a| match clicks {
-                                2 => text.word_at(a),
-                                3 => text.line_at(a),
-                                _ => text.glyphs.len().checked_sub(1).map(|last| (0, last)),
-                            });
+                            let span = text.nearest(vx, vy).and_then(|a| click_unit(&text, clicks, a));
                             if let Some((first, last)) = span {
                                 view.selection = Some(Selection::run(i, first, last));
                             }
@@ -2829,10 +3102,22 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                             };
                         }
                     }
+                    let clicks = if view.clicks > 2 && tool != QuickTool::Select { 1 } else { view.clicks };
                     if resp.dragged()
                         && let Some(sel) = view.selection.as_mut().filter(|s| s.page == i)
                     {
                         match &mut sel.span {
+                            // After a multi-click the drag extends by its unit (#1685), as in
+                            // Acrobat and browsers: whole words or lines, always keeping the one
+                            // clicked, which holds the anchor whichever way the drag went.
+                            Span::Run { anchor, head } if clicks >= 2 => {
+                                if let Some(h) = text.nearest(vx, vy)
+                                    && let Some((first, last)) = click_unit(&text, clicks, *anchor)
+                                {
+                                    let (to_first, to_last) = click_unit(&text, clicks, h).unwrap_or((h, h));
+                                    (*anchor, *head) = if to_first < first { (last, to_first) } else { (first, to_last.max(last)) };
+                                }
+                            }
                             Span::Run { head, .. } => {
                                 if let Some(h) = text.nearest(vx, vy) {
                                     *head = h;
@@ -2868,11 +3153,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                     // (a highlight made by the double-click left its word selected).
                     if release_clicks > 0 && clicks >= 2 && over_text {
                         if view.selection.is_none() {
-                            let span = text.nearest(vx, vy).and_then(|a| match clicks {
-                                2 => text.word_at(a),
-                                3 => text.line_at(a),
-                                _ => text.glyphs.len().checked_sub(1).map(|last| (0, last)),
-                            });
+                            let span = text.nearest(vx, vy).and_then(|a| click_unit(&text, clicks, a));
                             if let Some((first, last)) = span {
                                 view.selection = Some(Selection::run(i, first, last));
                             }
@@ -2974,8 +3255,10 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                 let gesturing = view.comments.gesture.is_some() || freehand;
                 for a in info.annotations.iter().filter(|a| a.page == i && !gesturing) {
                     let sr = xf.user_rect(info, i, a.rect);
+                    let hidden = prefs.hide_empty_highlight_hover && a.subtype == "Highlight" && a.contents.as_deref().is_none_or(str::is_empty);
                     if sr.contains(p)
                         && hover_text.is_none()
+                        && !hidden
                         && let Some(text) = annotation_hover_text(a)
                     {
                         hover_text = Some((p, text));
@@ -3027,6 +3310,21 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                 ui.scroll_with_delta_animation(delta, egui::style::ScrollAnimation::none());
             }
         }
+        // Held at the top or bottom edge, or dragged past it, a text selection scrolls the view
+        // so it can reach text off screen (#1670); the selection follows the pointer on its page.
+        if view.selection_drag
+            && navigation_enabled
+            && unobstructed
+            && !single_paging
+            && let Some(p) = ui.input(|i| i.pointer.latest_pos())
+        {
+            let dy = crate::autoscroll::edge_delta(p.y, avail, ui.input(|i| i.stable_dt));
+            if dy != 0.0 {
+                ui.scroll_with_delta_animation(vec2(0.0, dy), egui::style::ScrollAnimation::none());
+                // Keep scrolling while the pointer rests there and sends no events.
+                ui.ctx().request_repaint();
+            }
+        }
         // The page navigated to stays current while no page shows more of itself, so the next
         // page step starts from it rather than from a page further down the screen (#188).
         // It also stays current while it is wholly on screen: a short page (a cheque) gone to
@@ -3035,11 +3333,11 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         if current_overlap >= best_overlap - TIE || current_overlap >= current_height - TIE {
             current = view.current;
         }
+        if let Some(p) = pressed_page {
+            current = p;
+        }
         if view.continuous {
             view.current = current;
-            if !ui.memory(|m| m.has_focus(egui::Id::new("page-input"))) {
-                view.page_input = (current + 1).to_string();
-            }
         }
         resp.context_menu(|ui| {
             // Preparing a form: the selected field's menu.
@@ -3110,6 +3408,15 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                 }
                 return;
             }
+            if view.comments.selected.is_none() {
+                let selected = view.selected_text().is_some_and(|t| !t.is_empty());
+                let key = crate::commands::shortcut_label(ui.ctx(), crate::commands::COPY);
+                if ui.add_enabled(can_copy && selected, egui::Button::new(tl!("Copy")).shortcut_text(key)).clicked() {
+                    copy_selected = true;
+                    ui.close();
+                }
+                ui.separator();
+            }
             // Over a picture (and no comment): Copy Image, as in Acrobat's page menu.
             let mut copy_image = None;
             if view.comments.selected.is_none()
@@ -3153,7 +3460,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
     view.viewport_screen = out.inner_rect;
     view.auto_scroll.paint(ui, avail);
     if unobstructed && matches!(tool, QuickTool::Select | QuickTool::ColumnSelect) {
-        selection_actions(ui, avail, view, info, prefs, allowed && !comments_hidden);
+        copy_selected |= selection_actions(ui, avail, view, info, prefs, allowed && !comments_hidden, can_copy);
     }
 
     // Collect all main-page demand, including cached surfaces, for byte admission later.
@@ -3168,23 +3475,45 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         view.pan_hold_until = now_settle + 0.25;
         ui.ctx().request_repaint_after(std::time::Duration::from_millis(280));
     }
+    if glide != Vec2::ZERO {
+        view.fling.moved((scroll_offset - view.last_scroll).length() > 0.01);
+    }
     view.last_scroll = scroll_offset;
     let pan_held = now_settle < view.pan_hold_until;
     let (mut wanted, visible_now) = out.inner;
     let cur = view.current;
     wanted.sort_by_key(|w| (!visible_now.contains(&w.0), w.0.abs_diff(cur), w.3.is_some()));
-    // Tiles of far-away pages are useless: free them. Tiles of other zooms stay only while a
-    // current tile of their page is still missing, at most `OLD_TILES` of them, nearest scale first.
+    // Tiles of far-away pages are useless: free them. Tiles of an earlier zoom stay for a page
+    // that is on screen, whether or not the page is tiled at this zoom (#2196): a zoom out below
+    // the tiling threshold used to drop the tiles of the zoom just left, so coming back to it
+    // was a cold miss and the page re-blurred through the backdrop while every tile was
+    // interpreted again. `OLD_TILES` still bounds how many older tiles are kept, nearest scale
+    // first, and admission keeps them inside `TILE_BYTES`.
     let missing: HashSet<usize> = wanted.iter().filter(|w| w.3.is_some()).map(|w| w.0).collect();
-    view.tiles.retain(|(p, t, _, _), _| p.abs_diff(cur) <= 2 && (*t == tag || missing.contains(p)));
+    let on_screen: HashSet<usize> = visible_now.iter().copied().collect();
+    view.tiles.retain(|(p, t, _, _), _| p.abs_diff(cur) <= 2 && (*t == tag || missing.contains(p) || on_screen.contains(p)));
     let mut older: Vec<(f32, (usize, u64, u32, u32))> =
         view.tiles.keys().filter(|k| k.1 != tag).map(|k| ((tag_scale(k.1) / scale).ln().abs(), *k)).collect();
-    if older.len() > OLD_TILES {
-        older.sort_by(|a, b| a.0.total_cmp(&b.0));
-        for (_, k) in older.drain(OLD_TILES..) {
-            view.tiles.remove(&k);
+    // Tiles of earlier zooms are kept nearest scale first, and bounded by count *and* bytes: a
+    // large scan renders a tile up to 4096² (about 67 MiB), so a count alone let a few tiles of
+    // a few zooms run far past the tile allowance. #2196 keeps a zoom already visited, which
+    // makes that reachable in ordinary zooming, so the byte bound has to be here too.
+    older.sort_by(|a, b| a.0.total_cmp(&b.0));
+    let mut kept = 0usize;
+    let mut kept_bytes = 0usize;
+    let mut drop: Vec<(usize, u64, u32, u32)> = Vec::new();
+    for (_dist, key) in older {
+        let bytes = view.tiles.get(&key).map_or(0, texture_bytes);
+        if kept >= OLD_TILES || kept_bytes.saturating_add(bytes) > TILE_BYTES {
+            drop.push(key);
+        } else {
+            kept = kept.saturating_add(1);
+            kept_bytes = kept_bytes.saturating_add(bytes);
         }
     }
+    for key in drop {
+        view.tiles.remove(&key);
+    }
     let mut queue: Vec<RenderRequest> = wanted
         .iter()
         .map(|&(page, wanted_scale, wanted_tag, tile)| RenderRequest {
@@ -3258,6 +3587,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         });
     }
     find_bar(view, info.pages.len(), avail, ui, &t);
+    page_size_hint(view, info, units, avail, unobstructed, ui, &t);
     if tool == QuickTool::EnhanceCamera {
         crate::camera_ui::bar(ui.ctx(), view, avail, &t, can_modify);
     }
@@ -3399,8 +3729,17 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
     match image_action {
         Some(crate::edit_text_ui::ImageAction::Replace(page, index)) => app.replace_page_image_dialog(page, index),
         Some(crate::edit_text_ui::ImageAction::Save(page, index)) => app.save_page_image(page, index),
-        Some(crate::edit_text_ui::ImageAction::Copy(page, index)) => app.copy_page_image(page, index),
+        Some(crate::edit_text_ui::ImageAction::Copy(page, index)) => {
+            app.copy_page_image(page, index);
+        }
         Some(crate::edit_text_ui::ImageAction::CopyFile(page, index)) => app.copy_page_image_file(page, index),
+        Some(crate::edit_text_ui::ImageAction::Cut(page, image)) => {
+            app.views[index].image_selection = None;
+            app.cut_page_image(page, image);
+        }
+        Some(crate::edit_text_ui::ImageAction::Redact(page, index)) => app.redact_page_image(page, index),
+        Some(crate::edit_text_ui::ImageAction::Link(page, index)) => app.link_page_image(page, index),
+        Some(crate::edit_text_ui::ImageAction::Recognize(page)) => app.recognize_text_on_page(page),
         None => {}
     }
     if let Some(why) = refused {
@@ -3425,6 +3764,9 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
     if let Some((name, action)) = app.views[index].forms.button.take() {
         run_button(app, index, &name, action);
     }
+    if copy_selected {
+        app.execute("edit.copy");
+    }
     quick_bar(app, avail, ui);
     if let Some((source, file, destination)) = remote_open {
         app.open_remote_link(source, file, destination);
@@ -3440,21 +3782,29 @@ enum SelectionAction {
 }
 
 /// Actions on an existing text selection, next to the selected words.
-fn selection_actions(ui: &mut egui::Ui, viewport: Rect, view: &mut DocView, info: &DocInfo, prefs: &comments::CommentPrefs, can_comment: bool) {
+fn selection_actions(
+    ui: &mut egui::Ui,
+    viewport: Rect,
+    view: &mut DocView,
+    info: &DocInfo,
+    prefs: &comments::CommentPrefs,
+    can_comment: bool,
+    can_copy: bool,
+) -> bool {
     if ui.input(|input| input.pointer.is_decidedly_dragging()) {
-        return;
+        return false;
     }
-    let Some(selection) = view.selection else { return };
-    let Some(text) = view.texts.get(&selection.page) else { return };
-    let Some(xf) = view.page_xform(selection.page) else { return };
-    let Some(last) = selection.rects(text).last().copied() else { return };
+    let Some(selection) = view.selection else { return false };
+    let Some(text) = view.texts.get(&selection.page) else { return false };
+    let Some(xf) = view.page_xform(selection.page) else { return false };
+    let Some(last) = selection.rects(text).last().copied() else { return false };
     let selected = selection.text(text);
     if selected.is_empty() {
-        return;
+        return false;
     }
     let rect = xf.view_rect(last);
     if !viewport.intersects(rect) {
-        return;
+        return false;
     }
     let x = rect.left().clamp(viewport.left() + 8.0, (viewport.right() - 520.0).max(viewport.left() + 8.0));
     let y = if rect.bottom() + 48.0 < viewport.bottom() { rect.bottom() + 6.0 } else { (rect.top() - 44.0).max(viewport.top() + 6.0) };
@@ -3473,18 +3823,17 @@ fn selection_actions(ui: &mut egui::Ui, viewport: Rect, view: &mut DocView, info
                         chosen = Some(action);
                     }
                 }
-                if ui.button(tl!("Copy")).clicked() {
+                if ui.add_enabled(can_copy, egui::Button::new(tl!("Copy"))).clicked() {
                     chosen = Some(SelectionAction::Copy);
                 }
             });
         });
     });
-    let Some(action) = chosen else { return };
+    let Some(action) = chosen else { return false };
     if let SelectionAction::Copy = action {
-        ui.ctx().copy_text(selected);
-        return;
+        return true;
     }
-    let Some((page, quads)) = view.selection_quads(info) else { return };
+    let Some((page, quads)) = view.selection_quads(info) else { return false };
     let last = quads.last().copied().unwrap_or_default();
     let at = [last[2].max(last[6]), last[1].max(last[3])];
     view.clear_selection();
@@ -3503,7 +3852,7 @@ fn selection_actions(ui: &mut egui::Ui, viewport: Rect, view: &mut DocView, info
         }
         SelectionAction::Markup(tool) => {
             // Every markup button carries a markup tool; anything else adds nothing.
-            let Some(kind) = tool.markup() else { return };
+            let Some(kind) = tool.markup() else { return false };
             view.pending_edit = Some(Edit::AddAnnotation(pdfcraft_engine::NewAnnotation {
                 page,
                 shape: pdfcraft_engine::Shape::TextMarkup { kind, quads },
@@ -3512,9 +3861,10 @@ fn selection_actions(ui: &mut egui::Ui, viewport: Rect, view: &mut DocView, info
                 author: prefs.author.clone(),
             }));
         }
-        // Copied above.
+        // Copy is dispatched through the app after the view borrow ends.
         SelectionAction::Copy => {}
     }
+    false
 }
 
 /// Run a push button's action (the ones that need no JavaScript engine).
@@ -3606,6 +3956,37 @@ fn set_layers(app: &mut PdfCraftApp, index: usize, changes: &[(LayerOp, (u32, u1
     }
 }
 
+/// Whether `p` lies in the bottom-left quadrant of `area`, where the page size shows (#1855).
+fn in_size_hint_zone(area: Rect, p: Pos2) -> bool {
+    p.x >= area.min.x && p.x < area.center().x && p.y > area.center().y && p.y <= area.max.y
+}
+
+/// The current page's size, floating at the bottom-left of the document area while the pointer is
+/// in that quadrant, as Acrobat does. Same formatter and unit as Document Properties.
+fn page_size_hint(view: &DocView, info: &DocInfo, units: crate::units::Unit, area: Rect, unobstructed: bool, ui: &mut egui::Ui, t: &Tokens) {
+    let Some(page) = info.pages.get(view.current) else { return };
+    let inside = unobstructed && ui.input(|i| i.pointer.hover_pos()).is_some_and(|p| in_size_hint_zone(area, p));
+    if !inside {
+        return;
+    }
+    let text = units.size(f64::from(page.width), f64::from(page.height));
+    egui::Area::new(egui::Id::new("page-size-hint"))
+        .order(egui::Order::Foreground)
+        .interactable(false)
+        .pivot(egui::Align2::LEFT_BOTTOM)
+        .fixed_pos(area.left_bottom() + vec2(14.0, -14.0))
+        .show(ui.ctx(), |ui| {
+            egui::Frame::NONE
+                .fill(t.card)
+                .stroke(Stroke::new(1.0, t.border))
+                .corner_radius(CornerRadius::same(6))
+                .inner_margin(egui::Margin::symmetric(8, 4))
+                .show(ui, |ui| {
+                    ui.add(egui::Label::new(egui::RichText::new(text).color(t.text)).selectable(false));
+                });
+        });
+}
+
 /// Acrobat-style floating find bar at the top-right of the document area.
 fn find_bar(view: &mut DocView, pages: usize, area: Rect, ui: &mut egui::Ui, t: &Tokens) {
     let Some(find) = view.find.as_mut() else { return };
@@ -3744,8 +4125,10 @@ fn notices(
             ui.horizontal(|ui| {
                 ui.add(icons::image("rotate-cw", 16.0, t.accent_text));
                 ui.label(
-                    egui::RichText::new(tl!("This file changed on disk. Reload it to see the new version; your unsaved changes will be lost."))
-                        .color(t.text),
+                    egui::RichText::new(tl!(
+                        "This file changed on disk. Reload shows the new version and drops your unsaved changes; Save replaces it with this version."
+                    ))
+                    .color(t.text),
                 );
                 ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                     if icons::button(ui, "x", 22.0, false, tl!("Dismiss")).clicked() {
@@ -3961,6 +4344,18 @@ fn quick_bar(app: &mut PdfCraftApp, area: Rect, ui: &mut egui::Ui) {
                                 }
                             });
                     }
+                    // Edit text & images, while the Edit workspace is open (Acrobat's Edit toolbar)
+                    // or the tool is in use.
+                    if app.mode == crate::Mode::Edit || app.quick_tool == QuickTool::EditText {
+                        let on = app.quick_tool == QuickTool::EditText;
+                        if icons::button(ui, "text-cursor-input", 32.0, on, tl!("Edit text & images")).clicked() {
+                            if on {
+                                app.put_down_edit_text();
+                            } else {
+                                app.quick_tool = QuickTool::EditText;
+                            }
+                        }
+                    }
                     // Fill & Sign ▸ (text, marks, date, signature).
                     let current_fill = match app.quick_tool {
                         QuickTool::Fill(f) => Some(f),
@@ -4071,14 +4466,28 @@ fn quick_bar(app: &mut PdfCraftApp, area: Rect, ui: &mut egui::Ui) {
     });
 }
 
+/// Where a page of `page` size (points, as shown: after its rotation) is drawn in the grid cell
+/// `cell`: as large as the picture area allows and centred in it, so a landscape or rotated page
+/// fills the cell's width in its middle, as Acrobat draws it, instead of a small strip at the top.
+/// The picture area leaves room for the page number and actions below. Its sides narrow only when
+/// a picture that wide would reach the selection checkbox in the cell's corner.
+pub(crate) fn grid_page_rect(cell: Rect, page: Vec2) -> Rect {
+    let area = Rect::from_min_max(pos2(cell.left(), cell.top() + 16.0), pos2(cell.right(), cell.bottom() - 72.0));
+    // A page size from a damaged file can be zero, NaN or infinite; draw such a page square.
+    let side = |v: f32| if v.is_finite() { v.max(1.0) } else { 1.0 };
+    let (w, h) = (side(page.x), side(page.y));
+    let fit = |margin: f32| {
+        let s = ((area.width() - 2.0 * margin).max(1.0) / w).min(area.height().max(1.0) / h);
+        Rect::from_center_size(area.center(), vec2(w * s, h * s))
+    };
+    let wide = fit(16.0);
+    // The checkbox sits at (8, 8)-(28, 28) from the cell's corner; keep 4 px clear of it.
+    let checkbox = Rect::from_min_size(cell.min + vec2(8.0, 8.0), Vec2::splat(20.0)).expand(4.0);
+    if wide.intersects(checkbox) { fit(30.0) } else { wide }
+}
+
 /// The organize toolbar: page operations on the selection (Acrobat's Organize Pages bar).
 fn organize_toolbar(view: &mut DocView, info: &DocInfo, editable: bool, dirty: bool, unobstructed: bool, ui: &mut egui::Ui, t: &Tokens) {
-    egui::Frame::NONE.fill(t.chrome).inner_margin(egui::Margin::symmetric(16, 4)).show(ui, |ui| {
-        let pages = ui.add_enabled_ui(unobstructed, |ui| view.organize_range.show(ui, &view.selected, info.pages.len())).inner;
-        if let Some(pages) = pages {
-            view.select_pages(&pages);
-        }
-    });
     let targets = view.target_pages();
     let n = info.pages.len();
     let (first, last) = (targets.first().copied().unwrap_or(0), targets.last().copied().unwrap_or(0));
@@ -4093,56 +4502,6 @@ fn organize_toolbar(view: &mut DocView, info: &DocInfo, editable: bool, dirty: b
             // Fixed width so the buttons never shift as the selection text changes.
             ui.add_sized([150.0, 30.0], egui::Label::new(egui::RichText::new(label).font(theme::medium(13.0)).color(t.text_muted)).truncate());
             ui.add_enabled_ui(editable, |ui| {
-                if icons::button(ui, "rotate-ccw", 30.0, false, tl!("Rotate counterclockwise")).clicked() {
-                    view.pending_edit = Some(Edit::RotatePages { pages: targets.clone(), degrees: -90 });
-                }
-                if icons::button(ui, "rotate-cw", 30.0, false, tl!("Rotate clockwise")).clicked() {
-                    view.pending_edit = Some(Edit::RotatePages { pages: targets.clone(), degrees: 90 });
-                }
-                let can_delete = targets.len() < n;
-                if ui.add_enabled_ui(can_delete, |ui| icons::button(ui, "trash-2", 30.0, false, tl!("Delete pages (Delete)"))).inner.clicked() {
-                    view.pending_edit = Some(Edit::DeletePages { pages: targets.clone() });
-                }
-                if icons::button(ui, "file-plus", 30.0, false, tl!("Insert a blank page after the selection")).clicked() {
-                    let c = info.pages[last].crop;
-                    let (w, h) = ((c[2] - c[0]).abs().max(1.0) as f64, (c[3] - c[1]).abs().max(1.0) as f64);
-                    view.pending_edit = Some(Edit::InsertBlankPage { at: last + 1, width: w, height: h });
-                }
-                if icons::button(ui, "file-input", 30.0, false, tl!("Insert pages from a file…")).clicked() {
-                    view.pending_action = Some(ViewAction::InsertFromFile);
-                }
-                if icons::button(ui, "replace", 30.0, false, tl!("Replace pages…")).clicked() {
-                    view.pending_action = Some(ViewAction::ReplacePages);
-                }
-                if icons::button(ui, "file-output", 30.0, false, tl!("Extract pages to a new document")).clicked() {
-                    view.pending_action = Some(ViewAction::Extract);
-                }
-                if icons::button(ui, "scissors", 30.0, false, tl!("Split into files…")).clicked() {
-                    view.pending_action = Some(ViewAction::Split);
-                }
-                // Select ▸ all, odd, even, landscape, portrait pages (Acrobat's page range
-                // selection in Organize Pages).
-                let sel = icons::button(ui, "list", 30.0, false, tl!("Select pages"));
-                egui::Popup::menu(&sel).show(|ui| {
-                    use pdfcraft_engine::{PageOrientation as O, PageParity as P, filter_pages};
-                    let all: Vec<usize> = (0..n).collect();
-                    for (label, parity, orient) in [
-                        ("All pages", P::Both, O::Both),
-                        ("Odd pages", P::Odd, O::Both),
-                        ("Even pages", P::Even, O::Both),
-                        ("Landscape pages", P::Both, O::Landscape),
-                        ("Portrait pages", P::Both, O::Portrait),
-                    ] {
-                        if ui.button(tl!(label)).clicked() {
-                            view.select_pages(&filter_pages(info, &all, parity, orient));
-                            ui.close();
-                        }
-                    }
-                    if ui.button(tl!("None")).clicked() {
-                        view.select_pages(&[]);
-                        ui.close();
-                    }
-                });
                 ui.add_space(8.0);
                 if ui.add_enabled_ui(first > 0, |ui| icons::button(ui, "chevron-left", 30.0, false, tl!("Move earlier"))).inner.clicked() {
                     view.pending_edit = Some(Edit::MovePages { pages: targets.clone(), to: first - 1 });
@@ -4245,6 +4604,7 @@ fn organize_grid(view: &mut DocView, info: &DocInfo, editable: bool, dirty: bool
     // The page image scales with the zoom; the padding and the page number don't.
     let cell = vec2(146.0 * view.grid_zoom + 44.0, 194.0 * view.grid_zoom + 88.0);
     let anchor = view.grid_anchor.take();
+    let reveal = view.grid_reveal.take();
     let mut open_page = None;
     organize_toolbar(view, info, editable, dirty, unobstructed, ui, t);
     let viewport = ui.available_rect_before_wrap();
@@ -4276,6 +4636,14 @@ fn organize_grid(view: &mut DocView, info: &DocInfo, editable: bool, dirty: bool
         let rows = info.pages.len().div_ceil(cols);
         let left = (ui.available_width() - cols as f32 * cell.x) / 2.0;
         let (grid, _) = ui.allocate_exact_size(vec2(ui.available_width(), rows as f32 * cell.y), Sense::hover());
+        // The page Organize opened on may lie in a row the virtualized grid has not laid out,
+        // so its cell is computed rather than found.
+        if let Some(page) = reveal.filter(|p| *p < info.pages.len()) {
+            let row = page / cols;
+            let col = page % cols;
+            let c = Rect::from_min_size(pos2(grid.left() + left + col as f32 * cell.x, grid.top() + row as f32 * cell.y), cell);
+            ui.scroll_to_rect_animation(c, Some(egui::Align::Center), egui::style::ScrollAnimation::none());
+        }
         for row in thumbnail_rows(clip.top() - 20.0, clip.bottom() - 20.0, cell.y, rows) {
             let row_rect = Rect::from_min_size(grid.min + vec2(0.0, row as f32 * cell.y), vec2(grid.width(), cell.y));
             for col in 0..cols {
@@ -4303,9 +4671,8 @@ fn organize_grid(view: &mut DocView, info: &DocInfo, editable: bool, dirty: bool
                 }
                 let page_label = crate::i18n::fmt(tl!("Page {label}"), &[("label", &p.label)]);
                 resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::Checkbox, true, view.selected.contains(&i), page_label.clone()));
-                let s = ((cell.x - 60.0) / p.width.max(1.0)).min((cell.y - 88.0) / p.height.max(1.0));
-                let size = vec2(p.width * s, p.height * s);
-                let pr = Rect::from_center_size(pos2(c.center().x, c.top() + 16.0 + size.y / 2.0), size);
+                let pr = grid_page_rect(c, vec2(p.width, p.height));
+                let size = pr.size();
                 let selected = view.selected.contains(&i) || (view.selected.is_empty() && i == view.current);
                 if selected || resp.hovered() {
                     ui.painter().rect_filled(c.shrink(6.0), CornerRadius::same(8), if selected { t.accent_soft } else { t.hover });
@@ -4359,7 +4726,9 @@ fn organize_grid(view: &mut DocView, info: &DocInfo, editable: bool, dirty: bool
                 check.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::Checkbox, true, checked, label.clone()));
                 if check.on_hover_text(label).changed() {
                     view.click_page(i, egui::Modifiers::COMMAND, false);
-                    view.current = i;
+                    // The document shows the page picked here when the grid closes, as after a
+                    // Pages-panel click, so reopening the grid keeps the pick (issue #1910).
+                    view.go_to_page(i);
                 }
                 // Local actions always target the labelled page. The toolbar above the grid
                 // remains the place for actions on the whole selection.
@@ -4389,7 +4758,7 @@ fn organize_grid(view: &mut DocView, info: &DocInfo, editable: bool, dirty: bool
                 if resp.clicked() {
                     let m = ui.input(|i| i.modifiers);
                     view.click_page(i, m, false);
-                    view.current = i;
+                    view.go_to_page(i);
                 }
                 if resp.double_clicked() {
                     open_page = Some(i);
@@ -4398,7 +4767,7 @@ fn organize_grid(view: &mut DocView, info: &DocInfo, editable: bool, dirty: bool
                 resp.context_menu(|ui| {
                     if !view.selected.contains(&i) {
                         view.selected = [i].into();
-                        view.current = i;
+                        view.go_to_page(i);
                     }
                     if ui.button(tl!("Extract pages")).clicked() {
                         view.pending_action = Some(ViewAction::Extract);
@@ -4542,10 +4911,66 @@ pub(crate) fn texture_image(size: [usize; 2], pixels: pdfcraft_render::Pixels) -
     }
 }
 
+/// A luminance preview for a monochrome print. `Color32` stores premultiplied pixels, so a
+/// non-opaque colour's alpha is restored after multiplying the unmultiplied RGB by its
+/// luminance. This uses the display gamma-space weights users expect in editors/print dialogs,
+/// not the linear-light coefficients of a colour-managed render.
+fn grayscale(mut img: egui::ColorImage) -> egui::ColorImage {
+    for c in img.pixels.iter_mut() {
+        let a = c.a();
+        let luminance = f32::from(c.r()) * 0.299_f32 + f32::from(c.g()) * 0.587_f32 + f32::from(c.b()) * 0.114_f32;
+        let gray = if a == 0 || a == 255 {
+            luminance.round() as u8
+        } else {
+            // Unmultiply first, so translucent content keeps its paper-relative luminance.
+            let f = f32::from(a) / 255.0;
+            let un = [f32::from(c.r()) / f, f32::from(c.g()) / f, f32::from(c.b()) / f];
+            let l = un[0] * 0.299_f32 + un[1] * 0.587_f32 + un[2] * 0.114_f32;
+            (f * l).round() as u8
+        };
+        *c = Color32::from_rgba_premultiplied(gray, gray, gray, a);
+    }
+    img
+}
+
 #[cfg(test)]
 mod tests {
+    #[test]
+    fn page_size_hint_zone_is_the_bottom_left_quadrant() {
+        let area = Rect::from_min_max(pos2(100.0, 50.0), pos2(500.0, 450.0));
+        assert!(in_size_hint_zone(area, pos2(110.0, 440.0)));
+        assert!(!in_size_hint_zone(area, pos2(110.0, 100.0)), "top-left");
+        assert!(!in_size_hint_zone(area, pos2(400.0, 440.0)), "bottom-right");
+        assert!(!in_size_hint_zone(area, pos2(50.0, 440.0)), "outside");
+        assert!(!in_size_hint_zone(area, pos2(f32::NAN, 440.0)));
+    }
+
     use super::*;
 
+    /// A rotated (landscape) page is drawn as wide as the cell allows and centred in the picture
+    /// area, as Acrobat draws it, not as a small strip pinned to the top; a portrait page still
+    /// fills the area's height; neither covers the checkbox corner or the label below.
+    #[test]
+    fn grid_pages_are_centred_and_as_large_as_the_cell_allows() {
+        let cell = Rect::from_min_size(pos2(100.0, 50.0), vec2(190.0, 282.0));
+        let area = Rect::from_min_max(pos2(cell.left(), cell.top() + 16.0), pos2(cell.right(), cell.bottom() - 72.0));
+        let checkbox = Rect::from_min_size(cell.min + vec2(8.0, 8.0), Vec2::splat(20.0));
+        let landscape = grid_page_rect(cell, vec2(842.0, 595.0));
+        assert!((landscape.center().y - area.center().y).abs() < 0.01, "centred vertically: {landscape:?}");
+        assert!((landscape.center().x - cell.center().x).abs() < 0.01);
+        assert!((landscape.width() - (cell.width() - 32.0)).abs() < 0.01, "as wide as the cell allows: {landscape:?}");
+        assert!(!landscape.intersects(checkbox));
+        let portrait = grid_page_rect(cell, vec2(595.0, 842.0));
+        assert!(area.contains_rect(portrait), "inside the picture area: {portrait:?}");
+        assert!((portrait.center().y - area.center().y).abs() < 0.01);
+        assert!(portrait.left() >= checkbox.right(), "clear of the checkbox: {portrait:?}");
+        // Degenerate sizes still give a finite rectangle inside the cell.
+        for page in [vec2(0.0, 0.0), vec2(1e9, 1.0), vec2(1.0, 1e9), vec2(f32::NAN, 10.0), vec2(f32::INFINITY, 10.0)] {
+            let r = grid_page_rect(cell, page);
+            assert!(r.is_finite() && cell.contains_rect(r), "{page:?} -> {r:?}");
+        }
+    }
+
     fn annotation(fill_sign: bool) -> pdfcraft_render::Annotation {
         pdfcraft_render::Annotation {
             page: 0,
@@ -4572,6 +4997,26 @@ mod tests {
         assert_eq!(annotation_hover_text(&annotation(true)), None);
     }
 
+    #[test]
+    fn grayscale_converts_colours_to_their_luminance() {
+        let img = egui::ColorImage::new([2, 1], vec![Color32::from_rgb(255, 0, 0), Color32::from_rgba_premultiplied(0, 51, 102, 128)]);
+        let gray = grayscale(img);
+        let opaque = gray.pixels[0];
+        assert_eq!(opaque.to_array(), [76, 76, 76, 255]);
+        // Unmultiply RGB first, so a translucent colour keeps its paper-relative luminance.
+        let translucent = gray.pixels[1];
+        assert_eq!(translucent.to_array(), [42, 42, 42, 128]);
+    }
+
+    #[test]
+    fn black_white_and_transparents_are_preserved_by_grayscale() {
+        let img = egui::ColorImage::new([3, 1], vec![Color32::BLACK, Color32::WHITE, Color32::TRANSPARENT]);
+        let gray = grayscale(img);
+        assert_eq!(gray.pixels[0].to_array(), [0, 0, 0, 255]);
+        assert_eq!(gray.pixels[1].to_array(), [255, 255, 255, 255]);
+        assert_eq!(gray.pixels[2].to_array(), [0, 0, 0, 0]);
+    }
+
     #[test]
     fn rendered_rasters_become_texture_images_without_a_copy() {
         let pdf = b"%PDF-1.4
@@ -4639,6 +5084,76 @@ trailer << /Root 1 0 R >>
         DocView::new(DocId(1), &info, ViewDefaults { layout, continuous, ..Default::default() })
     }
 
+    fn history_search_view() -> DocView {
+        let mut v = view(5, PageLayout::Single, true);
+        v.texts.insert(
+            3,
+            pdfcraft_render::PageText {
+                glyphs: vec![pdfcraft_render::TextGlyph {
+                    text: "match".into(),
+                    rect: [20.0, 260.0, 60.0, 280.0],
+                    quad: [[20.0, 260.0], [60.0, 260.0], [60.0, 280.0], [20.0, 280.0]],
+                    direction: [1.0, 0.0],
+                }],
+                line_of: vec![0],
+                space_before: vec![false],
+            }
+            .into(),
+        );
+        v.find = Some(Find { matches: vec![(3, 0..1), (3, 0..1), (1, 0..1)], current: Some(2), ..Default::default() });
+        v
+    }
+
+    #[test]
+    fn explicit_search_jumps_record_history_and_keep_match_destination() {
+        for step in [None, Some(true), Some(false)] {
+            let mut v = history_search_view();
+            v.page_input = "draft in progress".into();
+            v.goto_point = Some((3, Some(0.8), Some(0.9), Vec2::ZERO));
+            if let Some(forward) = step {
+                v.find_step(forward);
+            } else {
+                v.go_to_match(0);
+            }
+            assert_eq!(v.back, vec![0], "explicit search jump must remember its origin");
+            assert_eq!(v.goto, Some((3, 0.5)), "keep the match offset instead of the page top");
+            assert_eq!(v.current, 3);
+            assert_eq!(v.current_page_label(None), "4");
+            // Chrome refreshes the idle page box; navigation must not overwrite a draft
+            // that may still be focused. DocView does not own the editor's focus state.
+            assert_eq!(v.page_input, "draft in progress");
+            assert!(v.goto_point.is_none(), "an earlier link destination cannot override the search offset");
+            v.go_to_match(1);
+            assert_eq!(v.back, vec![0], "same-page matches do not duplicate history");
+            assert!(v.view_history(false));
+            assert_eq!(v.current, 0);
+            assert!(v.view_history(true));
+            assert_eq!(v.current, 3);
+            assert!(v.view_history(false));
+            v.go_to_match(2);
+            assert!(v.forward.is_empty(), "a new explicit jump discards Forward");
+            assert_eq!(v.back, vec![0]);
+        }
+    }
+
+    #[test]
+    fn automatic_search_updates_do_not_record_history_or_discard_forward() {
+        let mut v = history_search_view();
+        v.forward = vec![4];
+        v.find = Some(Find { query: "match".into(), ..Default::default() });
+        v.rerun_find();
+        assert_eq!(v.current, 3);
+        assert_eq!(v.goto, Some((3, 0.5)));
+        assert!(v.back.is_empty());
+        assert_eq!(v.forward, vec![4]);
+        v.current = 0;
+        v.find.as_mut().unwrap().current = None;
+        v.refresh_find_page(3);
+        assert_eq!(v.current, 3);
+        assert!(v.back.is_empty());
+        assert_eq!(v.forward, vec![4]);
+    }
+
     #[test]
     fn text_layers_evict_far_pages_but_keep_visible_and_matches() {
         let info = thumbnail_info(100);
@@ -5085,6 +5600,29 @@ trailer << /Root 1 0 R >>
         assert!(view.frame_queue.is_empty() && view.frame_visible.is_empty() && view.thumb_demand.is_empty());
     }
 
+    /// Edit text & images keeps its boxes while page input is blocked (the window unfocused, a
+    /// dialog or the palette open): the page's paragraphs are still measured for the latest edit
+    /// and drawn, instead of vanishing until the pointer comes back.
+    #[test]
+    fn edit_text_boxes_stay_drawn_while_page_input_is_blocked() {
+        let mut h = egui_kittest::Harness::builder().with_size(vec2(1400.0, 900.0)).build_eframe(|_cc| {
+            let mut app = PdfCraftApp::new();
+            let bytes = app.session.create_blank(300.0, 400.0, 1).unwrap();
+            app.open_bytes("blank.pdf", None, bytes.as_ref().clone()).unwrap();
+            app.quick_tool = QuickTool::EditText;
+            app
+        });
+        h.run_steps(3);
+        // Block page input the way the window losing focus does.
+        h.state_mut().palette_open = true;
+        h.run_steps(2);
+        assert!(h.state_mut().apply_edit(Edit::RotatePages { pages: vec![0], degrees: 90 }));
+        h.run_steps(3);
+        let app = h.state();
+        let generation = app.session.get(app.views[0].id).unwrap().edit_generation();
+        assert_eq!(app.views[0].edit_lines.get(&0).map(|(g, _)| *g), Some(generation), "the boxes follow the edit while input is blocked");
+    }
+
     #[test]
     fn virtualized_organizer_keeps_insert_gaps_at_document_positions() {
         use egui_kittest::kittest::Queryable;
diff --git a/crates/ui-egui/src/chrome.rs b/crates/ui-egui/src/chrome.rs
index 9617bf67d..e8bf3b48d 100644
--- a/crates/ui-egui/src/chrome.rs
+++ b/crates/ui-egui/src/chrome.rs
@@ -170,6 +170,11 @@ pub fn tab_strip(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                                 if response.clicked() {
                                     app.active = Some(i);
                                 }
+                                // A middle click closes the tab, as in Acrobat and browsers (#1853);
+                                // unsaved changes ask first, as the close button does.
+                                if response.middle_clicked() {
+                                    close = Some(i);
+                                }
                             }
                             // Dragging a tab moves it (#1537): a line marks the gap it will land
                             // in, and releasing the button drops it there.
@@ -186,6 +191,10 @@ pub fn tab_strip(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                                     ui.ctx().set_cursor_icon(egui::CursorIcon::Grabbing);
                                     if let Some(marker) = drop_marker(&slots, from, to, ui.spacing().item_spacing.x) {
                                         let span = slots.first().map_or(ui.max_rect().y_range(), |(_, r)| r.y_range());
+                                        // In front of the first tab the gap lies outside the scroll area's
+                                        // clip rect (#2225): keep the whole line inside it.
+                                        let clip = ui.clip_rect();
+                                        let marker = marker.clamp(clip.left() + 1.0, (clip.right() - 1.0).max(clip.left() + 1.0));
                                         ui.painter().vline(marker, span.shrink(4.0), Stroke::new(2.0, t.accent));
                                     }
                                 }
@@ -222,7 +231,7 @@ pub fn tab_strip(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                                 if response.clicked() {
                                     app.open_combine_tab();
                                 }
-                                if close.is_some() {
+                                if close.is_some() || response.middle_clicked() {
                                     app.close_combine_tab();
                                 }
                             }
@@ -695,9 +704,32 @@ pub fn right_rail(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                 if icons::button(ui, "chevron-up", 30.0, false, tl!("Previous page")).clicked() {
                     view.step_page(false);
                 }
+                // History is distinct from stepping to the adjacent page, and belongs to this tab.
+                for (forward, icon, label, shortcut, enabled) in [
+                    (true, "chevron-right", tl!("Next view"), crate::commands::NEXT_VIEW, !view.forward.is_empty()),
+                    (false, "chevron-left", tl!("Previous view"), crate::commands::PREV_VIEW, !view.back.is_empty()),
+                ] {
+                    let tip = format!("{label} ({})", crate::commands::shortcut_label(ui.ctx(), shortcut));
+                    if ui.add_enabled_ui(enabled, |ui| icons::button(ui, icon, 30.0, false, &tip)).inner.clicked() {
+                        view.view_history(forward);
+                    }
+                }
                 ui.label(egui::RichText::new(page_count.to_string()).font(theme::regular(11.0)).color(t.text_muted));
+                let page_input_id = view.page_input_id();
+                // Consume replacement selection once, including when the editor has lost focus.
+                let reselect = std::mem::take(&mut view.page_input_reselect);
+                // Navigation updates the idle display, never the text being edited.
+                if !ui.memory(|m| m.has_focus(page_input_id)) {
+                    view.page_input = view.current_page_label(labels.get(view.current).map(String::as_str));
+                } else if reselect {
+                    // The replacement changed the label while egui retained this editor's cursor.
+                    let mut state = egui::TextEdit::load_state(ui.ctx(), page_input_id).unwrap_or_default();
+                    let end = egui::text::CCursor::new(view.page_input.chars().count());
+                    state.cursor.set_char_range(Some(egui::text::CCursorRange::two(egui::text::CCursor::new(0), end)));
+                    state.store(ui.ctx(), page_input_id);
+                }
                 let edit = egui::TextEdit::singleline(&mut view.page_input)
-                    .id(egui::Id::new("page-input"))
+                    .id(page_input_id)
                     .desired_width(34.0)
                     .horizontal_align(Align::Center)
                     .font(theme::medium(12.0))
@@ -709,12 +741,13 @@ pub fn right_rail(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                     .show(ui, |ui| ui.add(edit))
                     .inner
                     .on_hover_text(tl!("Current page — type a page number or label (such as iv) and press Enter"));
-                if r.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter)) {
-                    // A page label first (logical page numbers, as Acrobat), then a number.
-                    let typed = view.page_input.clone();
-                    if !view.go_to_typed(&typed, &labels) {
-                        view.page_input = (view.current + 1).to_string();
+                if r.lost_focus() {
+                    if ui.input(|i| i.key_pressed(egui::Key::Enter)) {
+                        // A page label first (logical page numbers, as Acrobat), then a number.
+                        let typed = view.page_input.clone();
+                        view.go_to_typed(&typed, &labels);
                     }
+                    view.page_input = view.current_page_label(labels.get(view.current).map(String::as_str));
                 }
             });
             if let Some(id) = page_display {
diff --git a/crates/ui-egui/src/commands.rs b/crates/ui-egui/src/commands.rs
index a8deee258..c46d93d62 100644
--- a/crates/ui-egui/src/commands.rs
+++ b/crates/ui-egui/src/commands.rs
@@ -85,7 +85,14 @@ impl PdfCraftApp {
             return self.combine_can_undo(spec.needs == commands::Needs::Undo);
         }
         commands::is_enabled(spec, &self.session, self.active_ids().map(|(_, id)| id))
+            && (spec.id != "edit.copy"
+                || self.active.and_then(|i| self.views.get(i)).is_some_and(|v| !v.organize && v.selected_text().is_some_and(|t| !t.is_empty())))
             && (spec.needs != commands::Needs::TwoPageView || self.active.and_then(|i| self.views.get(i)).is_some_and(crate::DocView::cover_applies))
+            && match spec.id {
+                "view.previous_view" => self.active.and_then(|i| self.views.get(i)).is_some_and(|v| !v.back.is_empty()),
+                "view.next_view" => self.active.and_then(|i| self.views.get(i)).is_some_and(|v| !v.forward.is_empty()),
+                _ => true,
+            }
     }
 
     /// Run a registered command by id. Returns `false` when the id is unknown or the command
@@ -174,6 +181,7 @@ impl PdfCraftApp {
             "file.close_all" => self.close_all(),
             "file.revert" => self.dialog = Some(Dialog::Revert),
             "file.properties" => self.dialog = Some(Dialog::Properties(PropsTab::Description)),
+            "file.word_count" => self.dialog = Some(Dialog::WordCount),
             "protect.properties" => self.dialog = Some(Dialog::Properties(PropsTab::Security)),
             // A restricted document's security changes once its permissions password is entered.
             "protect.password" | "protect.remove" if self.active_ids().and_then(|(_, id)| self.session.get(id)).is_some_and(|d| d.can_unlock()) => {
@@ -214,9 +222,15 @@ impl PdfCraftApp {
                 }
             }
             "view.focus_page_input" => {
-                if let (Some(ctx), Some(view)) = (self.ctx.clone(), active.and_then(|i| self.views.get(i))) {
-                    // The page box in the toolbar (chrome.rs); select its number so typing replaces it.
-                    let id = egui::Id::new("page-input");
+                if let (Some(ctx), Some(view)) = (self.ctx.clone(), active.and_then(|i| self.views.get_mut(i))) {
+                    // The page box in the toolbar (chrome.rs); select its label so typing replaces it.
+                    let id = view.page_input_id();
+                    if !ctx.memory(|m| m.has_focus(id))
+                        && let Some(doc) = self.session.get(view.id)
+                    {
+                        // Navigation and this command can arrive before the next rail frame.
+                        view.page_input = view.current_page_label(doc.info.pages.get(view.current).map(|p| p.label.as_str()));
+                    }
                     ctx.memory_mut(|m| m.request_focus(id));
                     let mut state = egui::TextEdit::load_state(&ctx, id).unwrap_or_default();
                     let len = view.page_input.chars().count();
@@ -260,6 +274,11 @@ impl PdfCraftApp {
                 }
             }
             "view.read_mode" => self.switch_mode(if self.mode == Mode::Read { Mode::AllTools } else { Mode::Read }, false),
+            "view.previous_view" | "view.next_view" => {
+                if let Some(v) = active.and_then(|i| self.views.get_mut(i)) {
+                    return v.view_history(id == "view.next_view");
+                }
+            }
             "view.next_tab" => self.step_tab(true),
             "view.previous_tab" => self.step_tab(false),
             "view.theme" => {
@@ -310,8 +329,12 @@ impl PdfCraftApp {
                 self.apply_edit(Edit::ResetForm { names: None });
             }
             "page.organize" => {
-                if let Some(i) = active {
-                    self.views[i].organize = !self.views[i].organize;
+                if let Some(v) = active.and_then(|i| self.views.get_mut(i)) {
+                    if v.organize {
+                        v.organize = false;
+                    } else {
+                        v.open_organize();
+                    }
                 }
             }
             "page.rotate" => {
@@ -372,6 +395,7 @@ impl PdfCraftApp {
             "export.image" => self.dialog = Some(Dialog::Export(crate::export_ui::ExportKind::Image)),
             "export.text" => self.dialog = Some(Dialog::Export(crate::export_ui::ExportKind::Text)),
             "a11y.check" => self.start_accessibility_check(),
+            "a11y.find_untagged" => self.find_untagged_content(),
             "ocr.recognize" => self.dialog = Some(Dialog::RecognizeText),
             "tools.js_console" => self.dialog = Some(Dialog::JsConsole),
             "tools.document_js" => {
@@ -401,6 +425,7 @@ impl PdfCraftApp {
                 }
             }
             "a11y.alt_text" => self.start_alt_text(),
+            "a11y.autotag_fields" => self.autotag_form_fields(),
             "a11y.tags" => self.choose_right_panel(Some(RightPanel::Tags)),
             "a11y.reading_options" => self.dialog = Some(Dialog::Properties(crate::PropsTab::Advanced)),
             "export.all_images" => self.dialog = Some(Dialog::Export(crate::export_ui::ExportKind::AllImages)),
@@ -443,7 +468,10 @@ impl PdfCraftApp {
                 self.redact_search.found = None;
                 self.dialog = Some(Dialog::RedactSearch);
             }
-            "redact.properties" => self.dialog = Some(Dialog::RedactProps),
+            "redact.properties" => {
+                self.redact_before = Some(self.redact_prefs.clone());
+                self.dialog = Some(Dialog::RedactProps);
+            }
             "redact.apply" => {
                 let marks = active.and_then(|i| self.session.get(self.views[i].id)).map_or(0, |d| d.redaction_marks());
                 if marks == 0 {
@@ -503,6 +531,12 @@ impl PdfCraftApp {
                 self.quick_tool = crate::QuickTool::Snapshot;
                 self.notify_tr("Drag a rectangle around the area to copy");
             }
+            "edit.copy" => {
+                if let (Some(i), Some(ctx)) = (active, self.ctx.clone()) {
+                    return self.copy_selected_text(i, &ctx);
+                }
+                return false;
+            }
             "page.copy" => self.copy_pages(false),
             "page.cut" => self.copy_pages(true),
             "page.paste" => self.paste_pages(),
@@ -667,6 +701,10 @@ impl PdfCraftApp {
         specs.sort_by_key(|c| std::cmp::Reverse(c.shortcut.map(|s| s.modifier_count()).unwrap_or(0)));
         for spec in specs {
             let Some(s) = spec.shortcut else { continue };
+            // Keep the canvas's silent no-op when there is no previous/next view to visit.
+            if matches!(spec.id, "view.previous_view" | "view.next_view") && !self.command_enabled(spec) {
+                continue;
+            }
             if typing && !spec.in_text {
                 continue;
             }
@@ -757,7 +795,7 @@ pub(crate) fn registry_menu(app: &mut PdfCraftApp, ui: &mut egui::Ui, menu: &str
             }
             continue;
         }
-        let shortcut = spec.shortcut.map(|s| shortcut_label(ui.ctx(), s)).unwrap_or_default();
+        let shortcut = spec.shortcut.or((spec.id == "edit.copy").then_some(COPY)).map(|s| shortcut_label(ui.ctx(), s)).unwrap_or_default();
         let enabled = app.command_enabled(spec);
         let resp = ui.add_enabled(enabled, egui::Button::new(label).shortcut_text(shortcut));
         if resp.clicked() {
diff --git a/crates/ui-egui/src/comment_props.rs b/crates/ui-egui/src/comment_props.rs
index 48d3571e1..052fcd55f 100644
--- a/crates/ui-egui/src/comment_props.rs
+++ b/crates/ui-egui/src/comment_props.rs
@@ -23,6 +23,9 @@ pub struct PropsDraft {
     pub tab: PropsTab,
     pub original: CommentProps,
     pub edited: CommentProps,
+    /// Acrobat's Make Properties Default box: on OK, new comments of this kind take the edited
+    /// colour, opacity and line width too.
+    pub make_default: bool,
 }
 
 const ICONS: [NoteIcon; 7] =
@@ -87,23 +90,31 @@ impl PdfCraftApp {
     /// Make Current Properties Default: new comments of this kind take this one's colour,
     /// opacity and line width.
     pub fn make_comment_default(&mut self, page: usize, index: usize) {
+        let Some(p) = self.active_ids().and_then(|(_, id)| self.session.get(id)).and_then(|doc| doc.comment_props(page, index)) else { return };
+        self.make_props_default(page, index, &p);
+    }
+
+    /// New comments of the kind at `(page, index)` take the look in `p`: its colour, opacity,
+    /// line width and (for shapes) fill. `p` may be a Comment Properties draft not applied yet.
+    pub fn make_props_default(&mut self, page: usize, index: usize, p: &CommentProps) {
         let Some((_, id)) = self.active_ids() else { return };
         let Some(doc) = self.session.get(id) else { return };
         let Some(a) = doc.info.annotations.iter().find(|a| a.page == page && a.index == index && a.in_reply_to.is_none()) else { return };
-        let Some(p) = doc.comment_props(page, index) else { return };
         let Some(tool) = crate::comments::tool_for_default(a, p.endings.as_deref()) else { return };
         let mut style = self.comment_prefs.style(tool);
         if let Some(c) = p.color {
             style.color = c;
         }
-        style.opacity = p.opacity;
-        if let Some(w) = p.width {
-            style.width = w;
-        }
         if p.fillable && tool.has_fill() {
             style.fill = p.fill;
         }
         self.comment_prefs.set_style(tool, style);
+        // Opacity and width go through the clamping setters: the dialog allows 0% opacity, and a
+        // default that draws invisible comments can't be found again.
+        self.comment_prefs.set_opacity(tool, p.opacity);
+        if let Some(w) = p.width {
+            self.comment_prefs.set_width(tool, w);
+        }
         self.notify_fmt("New {tool} comments will look like this one", &[("tool", &crate::i18n::in_sentence(tl!(tool.label())))]);
     }
 
@@ -111,7 +122,7 @@ impl PdfCraftApp {
     pub fn open_comment_props(&mut self, page: usize, index: usize) {
         let Some((_, id)) = self.active_ids() else { return };
         let Some(p) = self.session.get(id).and_then(|d| d.comment_props(page, index)) else { return };
-        self.comment_props = Some(PropsDraft { page, index, tab: PropsTab::Appearance, original: p.clone(), edited: p });
+        self.comment_props = Some(PropsDraft { page, index, tab: PropsTab::Appearance, original: p.clone(), edited: p, make_default: false });
         self.dialog = Some(crate::Dialog::CommentProps);
     }
 }
@@ -134,6 +145,11 @@ pub fn edits(d: &PropsDraft) -> Vec<Edit> {
     if e.restylable && e.fillable && e.fill != o.fill {
         out.push(Edit::FillAnnotation { page: d.page, index: d.index, fill: e.fill });
     }
+    if e.restylable
+        && let Some(size) = e.font_size.filter(|s| Some(*s) != o.font_size)
+    {
+        out.push(Edit::FontSizeAnnotation { page: d.page, index: d.index, size });
+    }
     let author = (e.author != o.author).then(|| e.author.clone());
     let subject = (e.subject != o.subject).then(|| e.subject.clone());
     let icon = (e.icon != o.icon).then_some(e.icon).flatten();
@@ -163,6 +179,12 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> (boo
                 .collect()
         })
         .unwrap_or_default();
+    let default_tool = app.comment_props.as_ref().and_then(|d| {
+        let (_, id) = app.active_ids()?;
+        let doc = app.session.get(id)?;
+        let a = doc.info.annotations.iter().find(|a| a.page == d.page && a.index == d.index && a.in_reply_to.is_none())?;
+        crate::comments::tool_for_default(a, d.edited.endings.as_deref())
+    });
     let Some(d) = app.comment_props.as_mut() else { return (false, true) };
     let kind = tl!(crate::comments_panel::subtype_label(&d.edited.subtype)).to_string();
     ui.label(egui::RichText::new(crate::i18n::fmt(tl!("{kind} Properties"), &[("kind", &kind)])).font(theme::semibold(18.0)));
@@ -207,6 +229,11 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> (boo
                         }
                         ui.end_row();
                     }
+                    if let Some(size) = e.font_size.as_mut() {
+                        ui.label(tl!("Font size"));
+                        ui.add(egui::DragValue::new(size).range(1.0..=400.0).speed(0.5).suffix(" pt"));
+                        ui.end_row();
+                    }
                     ui.label(tl!("Opacity"));
                     let mut pct = e.opacity * 100.0;
                     if ui.add(egui::Slider::new(&mut pct, 0.0..=100.0).suffix("%")).changed() {
@@ -260,7 +287,13 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> (boo
         }
     }
     ui.add_space(12.0);
-    ui.add(widgets::checkbox(&mut d.edited.locked, tl!("Locked")));
+    ui.horizontal(|ui| {
+        ui.add(widgets::checkbox(&mut d.edited.locked, tl!("Locked")));
+        ui.add_space(16.0);
+        // Acrobat's box beside Locked. Only a comment whose look can change, made by a tool.
+        let defaultable = d.edited.restylable && default_tool.is_some();
+        ui.add_enabled(defaultable, widgets::checkbox(&mut d.make_default, tl!("Make Properties Default")));
+    });
     let (mut apply, mut cancel) = (false, false);
     ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
         if widgets::pill_button(ui, tl!("OK"), true).clicked() {
diff --git a/crates/ui-egui/src/comments.rs b/crates/ui-egui/src/comments.rs
index 774e37b30..5a708c14f 100644
--- a/crates/ui-egui/src/comments.rs
+++ b/crates/ui-egui/src/comments.rs
@@ -250,6 +250,8 @@ pub struct CommentPrefs {
     pub pinned: bool,
     /// The tool each flyout group shows (the last one used).
     pub group_tool: [CommentTool; 3],
+    /// Hide hover previews on highlight annotations when they contain no comment text beyond the author.
+    pub hide_empty_highlight_hover: bool,
 }
 
 impl Default for CommentPrefs {
@@ -259,6 +261,7 @@ impl Default for CommentPrefs {
             styles: ALL.iter().map(|t| (*t, Style::default_for(&t.sample()))).collect(),
             pinned: false,
             group_tool: [CommentTool::Note, CommentTool::Highlight, CommentTool::Ink],
+            hide_empty_highlight_hover: false,
         }
     }
 }
@@ -409,12 +412,53 @@ pub struct Composer {
     pub focus: bool,
 }
 
+/// A released drawing gesture waiting for the page raster to show its annotation.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct Settling {
+    pub page: usize,
+    pub tool: CommentTool,
+    pub points: Vec<[f64; 2]>,
+    /// Frame time (seconds) at release; a raster that never arrives must not leave a ghost.
+    pub since: f64,
+}
+
+/// Longest a released drawing stays painted without its page raster, and how many are kept.
+const SETTLE_SECS: f64 = 20.0;
+const SETTLE_MAX: usize = 16;
+
+impl CommentView {
+    /// Remember a released drag drawing so it stays on screen until its page is re-rendered.
+    fn settle(&mut self, now: f64, page: usize, tool: CommentTool, points: &[[f64; 2]]) {
+        if !matches!(tool, CommentTool::Ink | CommentTool::Line | CommentTool::Arrow | CommentTool::Rectangle | CommentTool::Oval) {
+            return;
+        }
+        self.settling.retain(|s| now - s.since < SETTLE_SECS);
+        if self.settling.len() >= SETTLE_MAX {
+            self.settling.remove(0);
+        }
+        self.settling.push(Settling { page, tool, points: points.to_vec(), since: now });
+    }
+
+    /// How many released drawings are still painted from their points (waiting for a raster).
+    pub fn settling_len(&self) -> usize {
+        self.settling.len()
+    }
+
+    /// A fresh raster of `page` is on screen: it draws the committed annotation itself.
+    pub(crate) fn page_rendered(&mut self, page: usize) {
+        self.settling.retain(|s| s.page != page);
+    }
+}
+
 /// Per-document commenting state.
 #[derive(Clone, Debug, Default)]
 pub struct CommentView {
     /// The selected comment: (page, index in `/Annots`).
     pub selected: Option<(usize, usize)>,
     pub gesture: Option<Gesture>,
+    /// Drawings just released: shown from their points until the page raster that includes the
+    /// committed annotation arrives, so the stroke never vanishes in between (#1858).
+    pub(crate) settling: Vec<Settling>,
     /// Escape ends egui's drag too; ignore its synthetic release until the mouse is up.
     cancelled_drag: bool,
     pub composer: Option<Composer>,
@@ -437,6 +481,8 @@ pub struct CommentView {
     pub hidden_checks: Vec<String>,
     /// How the panel orders comments.
     pub sort: SortBy,
+    /// Pages whose group is folded in the panel (when sorted by page).
+    pub collapsed_pages: Vec<usize>,
     /// Comment Properties was asked for from the panel: (page, index).
     pub props_request: Option<(usize, usize)>,
     /// Make Current Properties Default was asked for: (page, index).
@@ -452,6 +498,22 @@ pub struct CommentView {
     pub tool_done: bool,
 }
 
+impl CommentView {
+    /// Takes back the last point of a polygon, cloud or connected lines being drawn; the first
+    /// point's removal cancels the drawing. Returns whether there was such a drawing.
+    pub fn undo_point(&mut self) -> bool {
+        let Some(Gesture::Draw { tool, points, .. }) = self.gesture.as_mut() else { return false };
+        if !tool.clicks_points() {
+            return false;
+        }
+        points.pop();
+        if points.is_empty() {
+            self.gesture = None;
+        }
+        true
+    }
+}
+
 /// Comments panel order (Acrobat: Sort by page, author, date, type, colour).
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
 pub enum SortBy {
@@ -470,6 +532,9 @@ pub(crate) struct PageCx<'a> {
     pub info: &'a DocInfo,
     pub tool: QuickTool,
     pub prefs: &'a CommentPrefs,
+    /// A redaction mark's fill while the pointer is over it, and its opacity (Redaction Tool
+    /// Properties).
+    pub redact_mark: ([f64; 3], f64),
     /// The document allows commenting.
     pub allowed: bool,
     /// Comments are hidden (Hide all comments): nothing to select.
@@ -515,6 +580,23 @@ impl PageCx<'_> {
         }
     }
 
+    /// A redaction mark's areas: one per marked quad, or its rectangle.
+    fn redact_rects(&self, a: &Annotation) -> Vec<Rect> {
+        if a.quads.is_empty() {
+            return vec![self.screen_rect(a)];
+        }
+        a.quads
+            .iter()
+            .map(|q| {
+                let xs = [q[0], q[2], q[4], q[6]];
+                let ys = [q[1], q[3], q[5], q[7]];
+                let (x0, x1) = (xs.iter().copied().fold(f32::MAX, f32::min), xs.iter().copied().fold(f32::MIN, f32::max));
+                let (y0, y1) = (ys.iter().copied().fold(f32::MAX, f32::min), ys.iter().copied().fold(f32::MIN, f32::max));
+                self.xf.user_rect(self.info, self.page, [x0, y0, x1, y1])
+            })
+            .collect()
+    }
+
     /// The topmost comment under `p`.
     fn hit(&self, p: Pos2) -> Option<&Annotation> {
         self.comments().filter(|a| self.screen_rects(a).iter().any(|r| r.expand(3.0).contains(p))).last()
@@ -530,7 +612,15 @@ impl PageCx<'_> {
     }
 
     /// The same geometry drives the live image, its handles, and the edit on release.
-    pub(crate) fn adjusted_rect(&self, a: &Annotation, gesture: Option<&Gesture>, pointer: Option<Pos2>, pending: Option<&Edit>) -> Rect {
+    /// `shift` is whether Shift is held now: it keeps the box's proportions from a corner.
+    pub(crate) fn adjusted_rect(
+        &self,
+        a: &Annotation,
+        gesture: Option<&Gesture>,
+        pointer: Option<Pos2>,
+        shift: bool,
+        pending: Option<&Edit>,
+    ) -> Rect {
         let r = self.screen_rect(a);
         if let Some(Edit::ResizeAnnotation { page, index, rect }) = pending
             && (*page, *index) == (self.page, a.index)
@@ -549,7 +639,7 @@ impl PageCx<'_> {
         match (gesture, pointer) {
             (Some(Gesture::Move { page, index, from }), Some(p)) if (*page, *index) == (self.page, a.index) => r.translate(p - *from),
             (Some(Gesture::Resize { page, index, handle, from, aspect_ratio }), Some(p)) if (*page, *index) == (self.page, a.index) => {
-                resized(r, *handle, p - *from, *aspect_ratio)
+                resized(r, *handle, p - *from, corner_ratio(r, *aspect_ratio, shift))
             }
             _ => r,
         }
@@ -582,7 +672,13 @@ fn handle_pos(r: Rect, (hx, hy): (i8, i8)) -> Pos2 {
     pos2(x, y)
 }
 
-fn resized(r: Rect, (hx, hy): (i8, i8), d: egui::Vec2, aspect_ratio: Option<f32>) -> Rect {
+/// The proportions a corner drag of `r` keeps: the box's own fixed ratio (an image signature's),
+/// else `r`'s current one while Shift is held, else none.
+pub(crate) fn corner_ratio(r: Rect, fixed: Option<f32>, shift: bool) -> Option<f32> {
+    fixed.or_else(|| (shift && r.width() > 0.0 && r.height() > 0.0).then(|| r.width() / r.height()))
+}
+
+pub(crate) fn resized(r: Rect, (hx, hy): (i8, i8), d: egui::Vec2, aspect_ratio: Option<f32>) -> Rect {
     if hx != 0
         && hy != 0
         && let Some(ratio) = aspect_ratio.filter(|v| v.is_finite() && *v > 0.0)
@@ -616,6 +712,7 @@ pub(crate) fn page_input(ui: &egui::Ui, resp: &egui::Response, cx: &PageCx<'_>,
     let pressed_here = origin.is_some_and(|o| page_rect.contains(o));
     let over_page = pointer.is_some_and(|p| page_rect.contains(p));
     let fill_grab = fill_grabs(ui, cx, view);
+    let draw_grab = draw_grabs(ui, cx, view);
     let caret_text = if cx.tool == QuickTool::Comment(CommentTool::Caret) { view.page_text(cx.page) } else { None };
     let cv = &mut view.comments;
     if cv.gesture.is_some() && ui.input_mut(|i| i.consume_key(egui::Modifiers::NONE, egui::Key::Escape)) {
@@ -633,6 +730,9 @@ pub(crate) fn page_input(ui: &egui::Ui, resp: &egui::Response, cx: &PageCx<'_>,
         cv.selected = cx.hit(p).map(|a| (cx.page, a.index));
     }
     match cx.tool {
+        // The shape just drawn is selected with its handles showing: they resize it without a
+        // trip to the Select tool (#2338). Anywhere else the tool keeps drawing.
+        QuickTool::Comment(_) if draw_grab => select_input(ui, resp, cx, view, pointer, origin, pressed_here),
         QuickTool::Comment(tool) if tool.draws() => {
             if !cx.allowed {
                 return false;
@@ -671,6 +771,8 @@ pub(crate) fn page_input(ui: &egui::Ui, resp: &egui::Response, cx: &PageCx<'_>,
                 if tool == CommentTool::Eraser {
                     view.pending_edit = erase(cx, &points);
                 } else if let Some(shape) = drawn_shape(tool, &points) {
+                    let now = ui.input(|i| i.time);
+                    cv.settle(now, page, tool, &points);
                     view.pending_edit = Some(new_comment(cx, tool, shape, String::new()));
                 }
             }
@@ -684,6 +786,8 @@ pub(crate) fn page_input(ui: &egui::Ui, resp: &egui::Response, cx: &PageCx<'_>,
                 && let Some(shape) = drawn_shape(tool, &[cx.to_user(p)])
             {
                 cv.selected = None;
+                let now = ui.input(|i| i.time);
+                cv.settle(now, cx.page, tool, &[cx.to_user(p)]);
                 view.pending_edit = Some(new_comment(cx, tool, shape, String::new()));
             }
             true
@@ -696,6 +800,17 @@ pub(crate) fn page_input(ui: &egui::Ui, resp: &egui::Response, cx: &PageCx<'_>,
                 ui.ctx().set_cursor_icon(egui::CursorIcon::Crosshair);
             }
             let finish = resp.double_clicked() || ui.input(|i| i.key_pressed(egui::Key::Enter));
+            // Backspace (or Delete) takes back the last point, e.g. after a wrong click; Undo does too.
+            // Only while a drawing is in progress: otherwise Delete belongs to the selected comment.
+            if matches!(cv.gesture, Some(Gesture::Draw { page, .. }) if page == cx.page)
+                && !ui.ctx().egui_wants_keyboard_input()
+                && ui.input_mut(|i| {
+                    i.consume_key(egui::Modifiers::NONE, egui::Key::Backspace) || i.consume_key(egui::Modifiers::NONE, egui::Key::Delete)
+                })
+            {
+                cv.undo_point();
+                return true;
+            }
             if resp.clicked()
                 && over_page
                 && let Some(p) = pointer
@@ -844,25 +959,53 @@ pub(crate) fn select_grabs(ui: &egui::Ui, cx: &PageCx<'_>, view: &DocView) -> bo
     cx.tool == QuickTool::Select && grabs(ui, cx, view, |a| !is_markup(&a.subtype))
 }
 
+/// With a shape tool (rectangle, oval, line, polygon…), the selected comment's resize handles
+/// are picked up as with the Select tool, so the shape just drawn can be resized straight away
+/// (#2338). Only the handles: a press anywhere else, the shape itself included, still draws.
+pub(crate) fn draw_grabs(ui: &egui::Ui, cx: &PageCx<'_>, view: &DocView) -> bool {
+    let QuickTool::Comment(tool) = cx.tool else { return false };
+    if !(tool.draws() || tool.clicks_points()) || tool == CommentTool::Eraser || cx.hidden {
+        return false;
+    }
+    let cv = &view.comments;
+    if matches!(cv.gesture, Some(Gesture::Resize { page, .. }) if page == cx.page) {
+        return true;
+    }
+    // A polygon being clicked out keeps its clicks, even near an old shape's handle.
+    if cv.gesture.is_some() {
+        return false;
+    }
+    press_point(ui, cx).is_some_and(|p| on_handle(cx, view, p, |_| true))
+}
+
 /// Whether the press (or, with no button down, the pointer) is on a `pick` comment or on the
 /// selected one's resize handles.
 fn grabs(ui: &egui::Ui, cx: &PageCx<'_>, view: &DocView, pick: impl Fn(&Annotation) -> bool) -> bool {
     if cx.hidden {
         return false;
     }
-    let cv = &view.comments;
-    if matches!(cv.gesture, Some(Gesture::Move { page, .. } | Gesture::Resize { page, .. }) if page == cx.page) {
+    if matches!(view.comments.gesture, Some(Gesture::Move { page, .. } | Gesture::Resize { page, .. }) if page == cx.page) {
         return true;
     }
+    let Some(p) = press_point(ui, cx) else { return false };
+    on_handle(cx, view, p, &pick) || cx.hit(p).is_some_and(pick)
+}
+
+/// Where a gesture on this page is decided: the press while the button is down, otherwise the
+/// pointer (egui clears the press origin on release). `None` off the page.
+fn press_point(ui: &egui::Ui, cx: &PageCx<'_>) -> Option<Pos2> {
     let (pointer, origin, down) = ui.input(|i| (i.pointer.hover_pos(), i.pointer.press_origin(), i.pointer.any_down()));
-    let Some(p) = (if down { origin } else { pointer }).filter(|p| cx.xf.rect.contains(*p)) else { return false };
-    let on_handle = cv
+    (if down { origin } else { pointer }).filter(|p| cx.xf.rect.contains(*p))
+}
+
+/// Whether `p` is on a resize handle of the selected comment, when it is a resizable `pick`.
+fn on_handle(cx: &PageCx<'_>, view: &DocView, p: Pos2, pick: impl Fn(&Annotation) -> bool) -> bool {
+    view.comments
         .selected
         .filter(|(page, _)| *page == cx.page)
         .and_then(|(_, i)| cx.get(i))
         .filter(|a| pick(a) && cx.allowed && resizable(a))
-        .is_some_and(|a| HANDLES.into_iter().any(|h| handle_pos(cx.screen_rect(a), h).distance(p) <= 7.0));
-    on_handle || cx.hit(p).is_some_and(pick)
+        .is_some_and(|a| HANDLES.into_iter().any(|h| handle_pos(cx.screen_rect(a), h).distance(p) <= 7.0))
 }
 
 fn clamp_to(r: Rect, p: Pos2) -> Pos2 {
@@ -945,7 +1088,9 @@ fn select_input(
             Some(Gesture::Resize { page, index, handle, from, aspect_ratio }) if page == cx.page => {
                 cv.gesture = None;
                 if let Some(a) = cx.get(index) {
-                    let r = resized(cx.screen_rect(a), handle, p - from, aspect_ratio);
+                    let from_rect = cx.screen_rect(a);
+                    let shift = ui.input(|i| i.modifiers.shift);
+                    let r = resized(from_rect, handle, p - from, corner_ratio(from_rect, aspect_ratio, shift));
                     let rect = cx.rect_to_user(r);
                     if r.width() >= 4.0 && r.height() >= 4.0 {
                         view.pending_edit = Some(Edit::ResizeAnnotation { page, index, rect });
@@ -1026,6 +1171,18 @@ pub(crate) fn page_after_text(resp: &egui::Response, cx: &PageCx<'_>, view: &mut
 pub(crate) fn paint_page(ui: &egui::Ui, painter: &egui::Painter, cx: &PageCx<'_>, view: &DocView) {
     let cv = &view.comments;
     let pointer = ui.input(|i| i.pointer.hover_pos());
+    // A redaction mark shows its fill while the pointer is over it, as Acrobat's does, so the
+    // marked area reads before anything is applied.
+    if cv.gesture.is_none()
+        && let Some(a) = pointer.and_then(|p| cx.hit(p))
+        && a.subtype == "Redact"
+    {
+        let ([r, g, b], opacity) = cx.redact_mark;
+        let fill = Color32::from_rgba_unmultiplied((r * 255.0) as u8, (g * 255.0) as u8, (b * 255.0) as u8, (opacity.clamp(0.0, 1.0) * 255.0) as u8);
+        for rect in cx.redact_rects(a) {
+            painter.rect_filled(rect, CornerRadius::ZERO, fill);
+        }
+    }
     if cv.gesture.is_none()
         && let Some(a) = pointer.and_then(|p| cx.hit(p))
         && (cx.tool == QuickTool::Select || matches!(cx.tool, QuickTool::Fill(_)) && a.fill_sign)
@@ -1049,7 +1206,8 @@ pub(crate) fn paint_page(ui: &egui::Ui, painter: &egui::Painter, cx: &PageCx<'_>
         {
             return paint_gesture(painter, cx, view);
         }
-        let r = cx.adjusted_rect(a, cv.gesture.as_ref(), pointer, view.pending_edit.as_ref()).expand(2.0);
+        let shift = ui.input(|i| i.modifiers.shift);
+        let r = cx.adjusted_rect(a, cv.gesture.as_ref(), pointer, shift, view.pending_edit.as_ref()).expand(2.0);
         painter.rect_stroke(r, CornerRadius::ZERO, Stroke::new(1.0, SELECT_BLUE), egui::StrokeKind::Middle);
         if cx.allowed && resizable(a) {
             for h in HANDLES {
@@ -1062,8 +1220,19 @@ pub(crate) fn paint_page(ui: &egui::Ui, painter: &egui::Painter, cx: &PageCx<'_>
 }
 
 fn paint_gesture(painter: &egui::Painter, cx: &PageCx<'_>, view: &DocView) {
+    let now = painter.ctx().input(|i| i.time);
+    for s in view.comments.settling.iter().filter(|s| s.page == cx.page && now - s.since < SETTLE_SECS) {
+        paint_draw(painter, cx, &s.tool, &s.points);
+    }
     if let Some(Gesture::Draw { page, tool, points }) = &view.comments.gesture
         && *page == cx.page
+    {
+        paint_draw(painter, cx, tool, points);
+    }
+}
+
+/// A drawing tool's shape from its points (a live drag, or a released one still settling).
+fn paint_draw(painter: &egui::Painter, cx: &PageCx<'_>, tool: &CommentTool, points: &[[f64; 2]]) {
     {
         let style = cx.prefs.style(*tool);
         let zoom = cx.xf.rect.width() / cx.xf.pw.max(1.0);
@@ -1175,7 +1344,7 @@ pub(crate) fn composer(ctx: &egui::Context, view: &mut DocView, info: &DocInfo,
         // Scrolled away: keep the draft until the page is back.
         return None;
     };
-    let cx = PageCx { page, xf: &xf, info, tool: QuickTool::Select, prefs, allowed: true, hidden: false };
+    let cx = PageCx { page, xf: &xf, info, tool: QuickTool::Select, prefs, allowed: true, hidden: false, redact_mark: ([0.89, 0.13, 0.13], 1.0) };
     let anchor = cx.to_screen(c.at);
     let t = Tokens::get(ctx);
     let mut post = false;
@@ -1210,7 +1379,7 @@ pub(crate) fn composer(ctx: &egui::Context, view: &mut DocView, info: &DocInfo,
                 edit.request_focus();
                 c.focus = false;
             }
-            let enter = ui.input(|i| i.key_pressed(egui::Key::Enter) && i.modifiers.command);
+            let enter = submit_key(ui, &edit, false);
             if ui.input(|i| i.key_pressed(egui::Key::Escape)) {
                 cancel = true;
             }
@@ -1252,11 +1421,17 @@ pub(crate) fn composer(ctx: &egui::Context, view: &mut DocView, info: &DocInfo,
         }
         ComposerKind::TextBox => {
             view.comments.tool_done = true;
-            Some(new_comment(&cx, CommentTool::TextBox, Shape::TextBox { rect: text_box_rect(c.at, &text, 12.0), font_size: 12.0 }, text))
+            Some(new_comment(
+                &cx,
+                CommentTool::TextBox,
+                Shape::TextBox { rect: text_box_rect(c.at, &text, 12.0, page_rotation(info, page)), font_size: 12.0 },
+                text,
+            ))
         }
         ComposerKind::Callout { point } => {
             view.comments.tool_done = true;
-            let rect = text_box_rect(c.at, &text, 10.0);
+            // A callout's leader and box stay in user-space axes (its appearance isn't turned).
+            let rect = text_box_rect(c.at, &text, 10.0, 0);
             let side = if point[0] < rect[0] {
                 rect[0]
             } else if point[0] > rect[2] {
@@ -1288,6 +1463,27 @@ pub(crate) fn composer(ctx: &egui::Context, view: &mut DocView, info: &DocInfo,
     }
 }
 
+/// Submit only from the focused comment editor. Match each key event's modifiers exactly,
+/// so Shift+Enter stays a newline and another editor cannot submit this draft. Replies also
+/// keep their existing unmodified Enter-to-post behavior.
+pub(crate) fn submit_key(ui: &mut egui::Ui, field: &egui::Response, plain_enter: bool) -> bool {
+    field.has_focus()
+        && ui.input_mut(|input| {
+            let mut submit = false;
+            input.events.retain(|event| {
+                let matched = matches!(event,
+                    egui::Event::Key { key: egui::Key::Enter, pressed: true, modifiers, .. }
+                        if modifiers.matches_exact(egui::Modifiers::CTRL)
+                            || modifiers.matches_exact(egui::Modifiers::COMMAND)
+                            || plain_enter && modifiers.matches_exact(egui::Modifiers::NONE)
+                );
+                submit |= matched;
+                !matched
+            });
+            submit
+        })
+}
+
 /// The side of the caret's box, in user space units, away from text.
 const CARET_SIZE: f64 = 8.0;
 
@@ -1340,14 +1536,21 @@ pub(crate) fn caret_snap(text: &PageText, vx: f32, vy: f32) -> Option<([f32; 2],
 }
 
 /// A text box sized to its text (at most 300 pt wide), hanging from its top-left corner.
-pub fn text_box_rect(at: [f64; 2], text: &str, size: f64) -> [f64; 4] {
+/// The box for `text` at `size` with its displayed top-left corner at `at`, on a page turned by
+/// `rotation` (its `/Rotate`): on a quarter-turned page it is taller than wide in user space.
+pub fn text_box_rect(at: [f64; 2], text: &str, size: f64, rotation: i64) -> [f64; 4] {
     use pdfcraft_engine::annot_text::{text_width, wrap};
     let pad = 2.0;
     let longest = text.lines().map(|l| text_width(l, size)).fold(0.0, f64::max);
     let w = (longest + 2.0 * pad + 4.0).clamp(40.0, 300.0);
     let lines = wrap(text, size, w - 2.0 * pad).len().max(1);
     let h = lines as f64 * size * 1.2 + 2.0 * pad + 2.0;
-    [at[0], at[1] - h, at[0] + w, at[1]]
+    pdfcraft_engine::text_box_at(rotation, at, w, h).unwrap_or([at[0], at[1] - h, at[0] + w, at[1]])
+}
+
+/// The `/Rotate` of `page` (0 when it is unknown).
+pub(crate) fn page_rotation(info: &DocInfo, page: usize) -> i64 {
+    info.pages.get(page).map_or(0, |p| i64::from(p.rotation))
 }
 
 /// Delete / Escape handling for comments (only while no text field has focus).
@@ -1855,6 +2058,22 @@ mod tests {
         assert_eq!(h.query_all_by_label("Apply").count(), 1, "only the first grid's picker opens");
     }
 
+    #[test]
+    fn shift_keeps_the_current_proportions_unless_the_box_has_its_own() {
+        let r = Rect::from_min_max(pos2(100.0, 100.0), pos2(196.0, 132.0));
+        assert_eq!(corner_ratio(r, None, false), None);
+        assert_eq!(corner_ratio(r, None, true), Some(3.0));
+        assert_eq!(corner_ratio(r, Some(2.0), false), Some(2.0));
+        assert_eq!(corner_ratio(r, Some(2.0), true), Some(2.0));
+        // A degenerate box has no proportions to keep (no division by zero).
+        let flat = Rect::from_min_max(pos2(100.0, 100.0), pos2(196.0, 100.0));
+        assert_eq!(corner_ratio(flat, None, true), None);
+        // Dragging a corner with Shift held scales the box instead of stretching it.
+        let out = resized(r, (1, 1), vec2(48.0, 0.0), corner_ratio(r, None, true));
+        assert_eq!(out.min, r.min);
+        assert!((out.width() / out.height() - 3.0).abs() < 0.001);
+    }
+
     #[test]
     fn proportional_corners_keep_the_opposite_anchor_and_edges_stretch_one_axis() {
         let r = Rect::from_min_max(pos2(100.0, 100.0), pos2(196.0, 132.0));
@@ -1899,10 +2118,10 @@ mod tests {
 
     #[test]
     fn text_boxes_fit_their_text() {
-        let r = text_box_rect([100.0, 500.0], "Hi", 12.0);
+        let r = text_box_rect([100.0, 500.0], "Hi", 12.0, 0);
         assert_eq!((r[0], r[3]), (100.0, 500.0));
         assert!(r[2] - r[0] < 60.0);
-        let long = text_box_rect([0.0, 500.0], &"word ".repeat(80), 12.0);
+        let long = text_box_rect([0.0, 500.0], &"word ".repeat(80), 12.0, 0);
         assert_eq!(long[2], 300.0);
         assert!(long[3] - long[1] > 50.0);
     }
diff --git a/crates/ui-egui/src/comments_panel.rs b/crates/ui-egui/src/comments_panel.rs
index 901493adf..c5fbbd0ce 100644
--- a/crates/ui-egui/src/comments_panel.rs
+++ b/crates/ui-egui/src/comments_panel.rs
@@ -199,6 +199,13 @@ pub(crate) fn show(
             SortBy::Date => None,
         }
     };
+    // A comment selected elsewhere (on the page, or just added) opens its folded group, or the
+    // card it should scroll to would not be drawn.
+    if view.comments.reveal
+        && let Some((p, _)) = view.comments.selected
+    {
+        view.comments.collapsed_pages.retain(|&c| c != p);
+    }
     let mut page = usize::MAX;
     let mut group: Option<String> = None;
     for a in roots {
@@ -215,18 +222,38 @@ pub(crate) fn show(
         } else if a.page != page {
             page = a.page;
             let n = info.annotations.iter().filter(|x| x.page == page && x.in_reply_to.is_none()).count();
+            let open = !view.comments.collapsed_pages.contains(&page);
             ui.add_space(6.0);
-            ui.horizontal(|ui| {
-                ui.add(icons::image("chevron-down", 14.0, t.text_muted));
-                ui.label(
-                    egui::RichText::new(crate::i18n::fmt(tl!("Page {label}"), &[("label", &info.pages[page].label)]))
-                        .font(theme::semibold(12.5))
-                        .color(t.text_muted),
-                );
-                ui.with_layout(Layout::right_to_left(Align::Center), |ui| ui.label(egui::RichText::new(n.to_string()).color(t.text_faint).small()));
-            });
+            let clicked = ui
+                .horizontal(|ui| {
+                    let chevron = if open { "chevron-down" } else { "chevron-right" };
+                    let toggle = icons::button(ui, chevron, 18.0, false, if open { tl!("Collapse") } else { tl!("Expand") }).clicked();
+                    let label = ui.add(
+                        egui::Label::new(
+                            egui::RichText::new(crate::i18n::fmt(tl!("Page {label}"), &[("label", &info.pages[page].label)]))
+                                .font(theme::semibold(12.5))
+                                .color(t.text_muted),
+                        )
+                        .sense(Sense::click()),
+                    );
+                    ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
+                        ui.label(egui::RichText::new(n.to_string()).color(t.text_faint).small())
+                    });
+                    toggle || label.clicked()
+                })
+                .inner;
+            if clicked {
+                if open {
+                    view.comments.collapsed_pages.push(page);
+                } else {
+                    view.comments.collapsed_pages.retain(|&c| c != page);
+                }
+            }
             ui.add_space(2.0);
         }
+        if sort == SortBy::Page && view.comments.collapsed_pages.contains(&a.page) {
+            continue;
+        }
         let thread = replies_of(a);
         if let Some(e) = card(ui, t, a, &thread, view, prefs, allowed, nav) {
             edit = Some(e);
@@ -299,10 +326,12 @@ fn card(
                     if !r.has_focus() && !ui.memory(|m| m.focused().is_some()) {
                         r.request_focus();
                     }
+                    let submit = crate::comments::submit_key(ui, &r, false);
                     ui.horizontal(|ui| {
-                        if ui
+                        if (ui
                             .add(egui::Button::new(egui::RichText::new(tl!("Save")).color(Color32::WHITE)).fill(t.accent).corner_radius(12))
                             .clicked()
+                            || submit)
                             && let Some((page, index, text)) = view.comments.editing.take()
                         {
                             edit = Some(Edit::SetAnnotationContents { page, index, text });
@@ -359,12 +388,14 @@ fn card(
                     // around the button can't fit every language's "Post" exactly, and any overflow
                     // would widen the resizable panel again on every repaint.
                     let r = ui.add(
-                        crate::widgets::line(&mut view.comments.reply)
+                        crate::widgets::block(&mut view.comments.reply)
+                            .desired_rows(1)
+                            .return_key(egui::KeyboardShortcut::new(egui::Modifiers::SHIFT, egui::Key::Enter))
                             .hint_text(tl!("Add a reply"))
                             .desired_width(f32::INFINITY)
                             .id_salt(("comment-reply", key)),
                     );
-                    let enter = r.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter));
+                    let enter = crate::comments::submit_key(ui, &r, true);
                     let ok = !view.comments.reply.trim().is_empty();
                     let post =
                         ui.with_layout(Layout::right_to_left(Align::Min), |ui| ui.add_enabled(ok, egui::Button::new(tl!("Post")).corner_radius(12)));
@@ -515,6 +546,20 @@ pub(crate) fn header_controls(ui: &mut egui::Ui, info: &DocInfo, view: &mut DocV
                 ui.close();
             }
         }
+        // Only the page sort has folding groups.
+        if cv.sort == SortBy::Page {
+            ui.separator();
+            if ui.button(tl!("Collapse all pages")).clicked() {
+                cv.collapsed_pages = info.annotations.iter().map(|a| a.page).collect();
+                cv.collapsed_pages.sort_unstable();
+                cv.collapsed_pages.dedup();
+                ui.close();
+            }
+            if ui.button(tl!("Expand all pages")).clicked() {
+                cv.collapsed_pages.clear();
+                ui.close();
+            }
+        }
         ui.separator();
         for (id, label) in [
             ("comment.hide_all", if hidden { tl!("Show all comments") } else { tl!("Hide all comments") }),
diff --git a/crates/ui-egui/src/compare_ui.rs b/crates/ui-egui/src/compare_ui.rs
index e84cc34dc..f9c1cbcee 100644
--- a/crates/ui-egui/src/compare_ui.rs
+++ b/crates/ui-egui/src/compare_ui.rs
@@ -17,6 +17,13 @@ pub struct CompareState {
     /// Regions that look different (page, user-space box), page n against page n.
     pub visual: Vec<(usize, [f64; 4])>,
     pub selected: Option<usize>,
+    /// Side by side: the old file on the left, the new on the right, scrolled and zoomed
+    /// together.
+    pub side_by_side: bool,
+    /// Which half leads the other (the one the pointer was over last): 0 old, 1 new.
+    pub leader: usize,
+    /// Each half's scroll offset last frame, to tell which one moved.
+    pub prev_scroll: [egui::Vec2; 2],
 }
 
 /// Visual differences are shaded orange.
@@ -28,6 +35,7 @@ pub enum PanelAction {
     Mark,
     Report,
     Clear,
+    SideBySide(bool),
 }
 
 pub fn colour(kind: Kind) -> Color32 {
@@ -99,6 +107,16 @@ pub(crate) fn panel(ui: &mut egui::Ui, t: &Tokens, state: &Option<CompareState>,
         ui.label(crate::i18n::fmt(tl!("{n} {kind}"), &[("n", &s.visual.len().to_string()), ("kind", tl!("Visual"))]));
     });
     ui.add_space(6.0);
+    // Side by side, or the new file alone.
+    ui.horizontal(|ui| {
+        if widgets::pill_button(ui, tl!("Side by side"), s.side_by_side).clicked() {
+            action = Some(PanelAction::SideBySide(true));
+        }
+        if widgets::pill_button(ui, tl!("New file only"), !s.side_by_side).clicked() {
+            action = Some(PanelAction::SideBySide(false));
+        }
+    });
+    ui.add_space(4.0);
     ui.horizontal(|ui| {
         if ui.button(tl!("Mark as comments")).clicked() {
             action = Some(PanelAction::Mark);
@@ -166,8 +184,37 @@ impl PdfCraftApp {
                         self.views[i].compare_marks.push((*p, r, VISUAL));
                     }
                 }
+                // The old file's pages too: what was deleted or replaced, and the visual
+                // differences, so both versions read with their own shading.
+                if let Some(oi) = self.views.iter().position(|v| v.id == old) {
+                    let mut marks: Vec<(usize, [f32; 4], Color32)> = result
+                        .changes
+                        .iter()
+                        .filter(|ch| ch.kind != Kind::Inserted)
+                        .flat_map(|ch| ch.old.rects.iter().map(move |r| (ch.old.page, r.map(|v| v as f32), colour(ch.kind))))
+                        .collect();
+                    for (p, r) in &visual {
+                        let r = r.map(|v| v as f32);
+                        let covered = marks.iter().any(|(mp, m, _)| *mp == *p && m[0] <= r[2] && r[0] <= m[2] && m[1] <= r[3] && r[1] <= m[3]);
+                        if !covered {
+                            marks.push((*p, r, VISUAL));
+                        }
+                    }
+                    self.views[oi].compare_marks = marks;
+                }
                 let n = result.changes.len();
-                self.compare = Some(crate::compare_ui::CompareState { old, new, result, visual, selected: None });
+                // Side by side when the old version is open in a tab and the window has the room.
+                let side_by_side = self.views.iter().any(|v| v.id == old) && self.ctx.as_ref().is_none_or(|c| c.content_rect().width() >= 1000.0);
+                self.compare = Some(crate::compare_ui::CompareState {
+                    old,
+                    new,
+                    result,
+                    visual,
+                    selected: None,
+                    side_by_side,
+                    leader: 1,
+                    prev_scroll: [egui::Vec2::ZERO; 2],
+                });
                 self.right = Some(RightPanel::Compare);
                 self.notify(if n == 0 {
                     tl!("The text is the same").to_string()
@@ -190,9 +237,20 @@ impl PdfCraftApp {
                 let Some(ch) = s.result.changes.get(i) else { return };
                 let rect = ch.new.rects.first().copied().or(ch.new.near).unwrap_or_default();
                 let page = ch.new.page;
+                let old_target = (ch.old.page, ch.old.rects.first().copied().or(ch.old.near).unwrap_or_default());
                 let v = &mut self.views[index];
                 v.go_to_page(page);
                 v.flash = Some((page, rect.map(|x| x as f32), 0.0));
+                // The old file's half jumps to its side of the change too.
+                if let Some(oi) = self.views.iter().position(|v| v.id == old) {
+                    let v = &mut self.views[oi];
+                    v.go_to_page(old_target.0);
+                    v.flash = Some((old_target.0, old_target.1.map(|x| x as f32), 0.0));
+                }
+            }
+            PanelAction::SideBySide(on) => {
+                s.side_by_side = on;
+                s.leader = 1;
             }
             PanelAction::Mark => match self.session.mark_differences(old, new) {
                 Ok(n) => {
@@ -218,8 +276,88 @@ impl PdfCraftApp {
             PanelAction::Clear => {
                 self.compare = None;
                 self.views[index].compare_marks.clear();
+                if let Some(oi) = self.views.iter().position(|v| v.id == old) {
+                    self.views[oi].compare_marks.clear();
+                }
                 self.right = None;
             }
         }
     }
 }
+
+/// The two halves of a side-by-side comparison, as view indexes (old, new), when the active
+/// document is the new file of a comparison shown side by side and the old file is open too.
+pub(crate) fn side_by_side(app: &PdfCraftApp, index: usize) -> Option<(usize, usize)> {
+    let c = app.compare.as_ref().filter(|c| c.side_by_side)?;
+    let new = app.views.get(index).filter(|v| v.id == c.new)?;
+    let old = app.views.iter().position(|v| v.id == c.old)?;
+    (old != index).then_some((old, app.views.iter().position(|v| v.id == new.id)?))
+}
+
+/// Side by side: the old file on the left, the new on the right, each a page view of its own
+/// with its shading, scrolled and zoomed together. The half the pointer is over leads; the
+/// other follows its zoom, layout and scroll offset.
+pub(crate) fn compare_area(app: &mut PdfCraftApp, old: usize, new: usize, ui: &mut egui::Ui) {
+    let t = Tokens::get(ui.ctx());
+    let rect = ui.available_rect_before_wrap();
+    let gap = 1.0;
+    let half_w = ((rect.width() - gap) / 2.0).max(1.0);
+    let caption_h = 22.0;
+    let left = egui::Rect::from_min_size(rect.min, egui::vec2(half_w, rect.height()));
+    let right = egui::Rect::from_min_size(egui::pos2(rect.min.x + half_w + gap, rect.min.y), egui::vec2(half_w, rect.height()));
+    // Who leads: the half under the pointer (remembered), the new file at first.
+    if let Some(p) = ui.input(|i| i.pointer.hover_pos())
+        && let Some(c) = app.compare.as_mut()
+    {
+        if left.contains(p) {
+            c.leader = 0;
+        } else if right.contains(p) {
+            c.leader = 1;
+        }
+    }
+    let leader = app.compare.as_ref().map_or(1, |c| c.leader);
+    let (lead, follow) = if leader == 0 { (old, new) } else { (new, old) };
+    // The follower takes the leader's zoom and layout before either is drawn.
+    let (zoom, fit, layout, continuous, rotation) = {
+        let v = &app.views[lead];
+        (v.zoom, v.fit, v.layout, v.continuous, v.rotation)
+    };
+    {
+        let v = &mut app.views[follow];
+        if v.zoom != zoom || v.fit != fit || v.layout != layout || v.continuous != continuous || v.rotation != rotation {
+            v.zoom = zoom;
+            v.fit = fit;
+            v.layout = layout;
+            v.continuous = continuous;
+            v.rotation = rotation;
+        }
+    }
+    let names = [old, new].map(|i| app.session.get(app.views[i].id).map(|d| d.name.clone()).unwrap_or_default());
+    ui.painter().vline(rect.min.x + half_w, rect.y_range(), egui::Stroke::new(gap, t.border));
+    for (k, (r, index)) in [(left, old), (right, new)].into_iter().enumerate() {
+        let caption = egui::Rect::from_min_size(r.min, egui::vec2(r.width(), caption_h));
+        ui.painter().rect_filled(caption, 0.0, t.panel);
+        let label = crate::i18n::fmt(if k == 0 { tl!("Old file: {name}") } else { tl!("New file: {name}") }, &[("name", &names[k])]);
+        ui.painter().text(
+            egui::pos2(caption.min.x + 10.0, caption.center().y),
+            egui::Align2::LEFT_CENTER,
+            label,
+            egui::FontId::proportional(12.0),
+            t.text_muted,
+        );
+        let body = egui::Rect::from_min_max(egui::pos2(r.min.x, r.min.y + caption_h), r.max);
+        let mut child = ui.new_child(egui::UiBuilder::new().max_rect(body).id_salt(("compare-half", k)));
+        child.set_clip_rect(body);
+        crate::canvas::document_area(app, index, &mut child);
+    }
+    // After both drew: the leader's scroll, when it moved, is the follower's next offset.
+    let offsets = [app.views[old].last_scroll, app.views[new].last_scroll];
+    if let Some(c) = app.compare.as_mut() {
+        let lead_k = if leader == 0 { 0 } else { 1 };
+        if (offsets[lead_k] - c.prev_scroll[lead_k]).length() > 0.5 && (offsets[1 - lead_k] - offsets[lead_k]).length() > 0.5 {
+            app.views[follow].sync_scroll = Some(offsets[lead_k]);
+            ui.ctx().request_repaint();
+        }
+        c.prev_scroll = offsets;
+    }
+}
diff --git a/crates/ui-egui/src/content_ui.rs b/crates/ui-egui/src/content_ui.rs
index 39355e691..5f5ef32f7 100644
--- a/crates/ui-egui/src/content_ui.rs
+++ b/crates/ui-egui/src/content_ui.rs
@@ -12,7 +12,7 @@ use crate::theme::Tokens;
 use crate::widgets;
 
 /// The colour of the warning under text the standard fonts can't draw.
-const UNDRAWABLE: Color32 = Color32::from_rgb(0xD7, 0x37, 0x3F);
+pub(crate) const UNDRAWABLE: Color32 = Color32::from_rgb(0xD7, 0x37, 0x3F);
 
 /// The first character of a draft that can't be drawn, as the engine decides it (it refuses
 /// such text, #125): outside the standard fonts and not shaped with the Arabic face.
@@ -86,9 +86,13 @@ pub struct ContentView {
     pub select_added: Option<(usize, usize)>,
     grab: Option<(usize, Grab, Pos2)>,
     undrawable: UndrawableMemo,
+    layout: Option<(AddedText, f32, f64, [f64; 4])>,
 }
 
 impl ContentView {
+    pub(crate) fn finish_draft(&mut self, added: &[Added]) -> Option<Edit> {
+        self.draft.take().and_then(|d| finish(self, d, added))
+    }
     /// The draft's first character the standard fonts can't draw. Such a draft is kept open, and
     /// counts as unsaved work, until it is corrected or discarded.
     pub(crate) fn blocked(&self) -> Option<char> {
@@ -134,7 +138,7 @@ impl MoveBackground {
             *self = Self { key, ..Default::default() };
             if let Some((_, page, index)) = key {
                 self.renderer = doc.added_content_preview(page, index).ok().map(|p| p.renderer());
-                self.from = on_page(&doc.added, page).into_iter().find(|(i, _)| *i == index).map(|(_, a)| a.content.rect());
+                self.from = on_page(doc.added(), page).into_iter().find(|(i, _)| *i == index).map(|(_, a)| a.content.rect());
             }
         }
         if self.settling.is_some() {
@@ -248,6 +252,10 @@ fn on_page(added: &[Added], page: usize) -> Vec<(usize, &Added)> {
     added.iter().filter(|a| a.page == page).enumerate().collect()
 }
 
+pub(crate) fn hits_added(xf: &PageXform, info: &DocInfo, page: usize, added: &[Added], point: Pos2) -> bool {
+    on_page(added, page).iter().any(|(_, a)| screen_rect(xf, info, page, a.content.rect()).expand(2.0).contains(point))
+}
+
 fn handles(r: Rect) -> [(Pos2, bool, bool); 4] {
     [(r.left_top(), true, true), (r.right_top(), false, true), (r.left_bottom(), true, false), (r.right_bottom(), false, false)]
 }
@@ -279,6 +287,22 @@ fn dragged(r: Rect, grab: Grab, d: egui::Vec2, keep_aspect: bool) -> Rect {
     }
 }
 
+/// Added text and images keep pointer ownership over a form field while editing content.
+pub(crate) fn select_grabs(ui: &egui::Ui, xf: &PageXform, page: usize, info: &DocInfo, added: &[Added], view: &DocView) -> bool {
+    let cv = &view.content;
+    if cv.grab.is_some_and(|(grab_page, _, _)| grab_page == page) {
+        return true;
+    }
+    let Some(p) = ui.input(|i| i.pointer.hover_pos().or(i.pointer.interact_pos())).filter(|p| xf.rect.contains(*p)) else {
+        return false;
+    };
+    on_page(added, page).into_iter().any(|(index, item)| {
+        let rect = screen_rect(xf, info, page, item.content.rect());
+        rect.expand(2.0).contains(p)
+            || cv.selected == Some((page, index)) && handles(rect).into_iter().any(|(corner, _, _)| corner.distance(p) <= 6.0)
+    })
+}
+
 /// Pointer input on one page in Edit mode (`adding_text` with the Text tool). `true` when it
 /// used the input.
 #[allow(clippy::too_many_arguments)]
@@ -290,6 +314,7 @@ pub(crate) fn page_input(
     info: &DocInfo,
     added: &[Added],
     adding_text: bool,
+    edit_on_click: bool,
     style: &AddedText,
     view: &mut DocView,
 ) -> bool {
@@ -347,14 +372,10 @@ pub(crate) fn page_input(
             let at = to_display(xf, info, page, p);
             let mut style = style.clone();
             style.text.clear();
-            cv.draft = Some(TextDraft {
-                page,
-                index: None,
-                rect: [at[0], at[1] - style.size * 1.2, at[0] + 200.0, at[1]],
-                text: String::new(),
-                style,
-                focus: true,
-            });
+            let page_width = info.pages.get(page).map_or(f64::INFINITY, |p| p.width as f64);
+            let rect = [at[0], at[1] - style.size * 1.2, (at[0] + 200.0).min(page_width), at[1]];
+            style.rect = rect;
+            cv.draft = Some(TextDraft { page, index: None, rect, text: String::new(), style, focus: true });
             consumed = true;
             if typed.is_some() {
                 view.pending_edit = typed;
@@ -379,13 +400,19 @@ pub(crate) fn page_input(
         }
         return consumed;
     }
-    if resp.double_clicked()
+    if (resp.double_clicked() || edit_on_click && resp.clicked() && corner.is_none())
         && let Some((i, a)) = hit
         && let AddedContent::Text(t) = &a.content
     {
         if cv.hold_blocked() {
             return true;
         }
+        if cv.draft.as_ref().is_some_and(|d| d.page == page && d.index == Some(i)) {
+            return true;
+        }
+        if let Some(edit) = cv.finish_draft(added) {
+            view.pending_edit = Some(edit);
+        }
         cv.draft = Some(TextDraft { page, index: Some(i), rect: t.rect, text: t.text.clone(), style: t.clone(), focus: true });
         cv.selected = Some((page, i));
         consumed = true;
@@ -462,16 +489,46 @@ pub(crate) fn after_refresh(view: &mut DocView, added: &[Added]) {
 /// committed (a click away, or Done), and whether Done finished adding text. Discard or Escape
 /// throws the draft away.
 pub(crate) fn editor(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, added: &[Added]) -> (Option<Edit>, bool) {
-    let Some((page, rect)) = view.content.draft.as_ref().map(|d| (d.page, d.rect)) else { return (None, false) };
+    let Some(page) = view.content.draft.as_ref().map(|d| d.page) else { return (None, false) };
     let Some(xf) = view.page_xform(page) else { return (None, false) };
-    let r = screen_rect(&xf, info, page, rect);
     let zoom = xf.rect.width() / xf.pw.max(1.0);
+    let Some(draft) = view.content.draft.as_mut() else { return (None, false) };
+    let font = crate::edit_text_ui::editor_font(&draft.style, (draft.style.size as f32 * zoom).clamp(1.0, 300.0));
+    let text = AddedText { text: draft.text.clone(), ..draft.style.clone() };
+    let Some(page_width) = info.pages.get(page).map(|p| p.width as f64) else { return (None, false) };
+    if let Some((key, z, width, rect)) = &view.content.layout
+        && *key == text
+        && *z == zoom
+        && *width == page_width
+    {
+        draft.rect = *rect;
+    } else {
+        let source = draft.style.rect;
+        if draft.index.is_some() && draft.text == draft.style.text {
+            draft.rect = source;
+        } else {
+            let natural = ctx.fonts_mut(|f| f.layout_no_wrap(draft.text.clone(), font.clone(), Color32::BLACK).size().x) as f64 / zoom as f64;
+            let width = natural.max(pdfcraft_engine::added_text_width(&text)) + 2.0;
+            let available = page_width - source[0];
+            let width = width.max(source[2] - source[0]).min(available.max(1.0));
+            draft.rect = [source[0], source[1], source[0] + width, source[3]];
+            draft.rect = pdfcraft_engine::added_text_rect(&AddedText { rect: draft.rect, ..text.clone() });
+        }
+        view.content.layout = Some((text, zoom, page_width, draft.rect));
+    }
+    let r = screen_rect(&xf, info, page, draft.rect);
+    let source_rect = draft.index.map(|_| screen_rect(&xf, info, page, draft.style.rect));
+    let background_ready = draft.index.is_some_and(|index| view.text_background.ready_added(page, index));
     let tokens = Tokens::get(ctx);
     let (mut commit, mut cancel, mut done) = (false, false, false);
     let mut undrawable = None;
     let memo = &view.content.undrawable;
-    egui::Area::new(egui::Id::new(("added-text", view.id.0))).order(egui::Order::Foreground).fixed_pos(r.min).show(ctx, |ui| {
+    egui::Area::new(egui::Id::new(("added-text", view.id.0))).order(egui::Order::Foreground).fixed_pos(r.min).constrain(false).show(ctx, |ui| {
         let Some(t) = view.content.draft.as_mut() else { return };
+        ui.set_width(r.width() + 64.0);
+        if let Some(source_rect) = source_rect.filter(|_| !background_ready) {
+            ui.painter().rect_filled(source_rect.union(r).expand(1.0), CornerRadius::ZERO, Color32::WHITE);
+        }
         // The box is white in every theme, so the caret must not follow the theme (pale in dark mode) (#655).
         ui.visuals_mut().text_cursor.stroke.color = crate::edit_text_ui::caret_color_on(Color32::WHITE);
         let [cr, cg, cb] = t.style.color.map(|v| (v.clamp(0.0, 1.0) * 255.0) as u8);
@@ -479,10 +536,10 @@ pub(crate) fn editor(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, ad
             ui.spacing_mut().item_spacing.x = 4.0;
             let resp = ui.add(
                 egui::TextEdit::multiline(&mut t.text)
-                    .font(egui::FontId::proportional((t.style.size as f32 * zoom).max(8.0)))
+                    .font(font)
                     .desired_width(r.width().max(60.0))
                     .desired_rows(1)
-                    .background_color(Color32::from_rgba_unmultiplied(255, 255, 255, 235))
+                    .background_color(if background_ready { Color32::TRANSPARENT } else { Color32::WHITE })
                     .text_color(Color32::from_rgb(cr, cg, cb))
                     .hint_text(tl!("Type text"))
                     .id_salt("added-text-edit"),
@@ -542,7 +599,8 @@ fn finish(cv: &mut ContentView, d: TextDraft, added: &[Added]) -> Option<Edit> {
         Some(i) => {
             let (_, a) = on_page(added, d.page).into_iter().find(|(k, _)| *k == i)?;
             let AddedContent::Text(old) = &a.content else { return None };
-            (old.text != text).then(|| Edit::UpdateContent { page: d.page, index: i, content: AddedContent::Text(AddedText { text, ..old.clone() }) })
+            let updated = AddedText { text, rect: d.rect, ..d.style };
+            (*old != updated).then_some(Edit::UpdateContent { page: d.page, index: i, content: AddedContent::Text(updated) })
         }
     }
 }
@@ -672,12 +730,12 @@ impl crate::PdfCraftApp {
     }
 
     /// Copy Image: image `index` on `page`, at its own resolution, to the clipboard.
-    pub(crate) fn copy_page_image(&mut self, page: usize, index: usize) {
-        let Some((_, id)) = self.active_ids() else { return };
+    pub(crate) fn copy_page_image(&mut self, page: usize, index: usize) -> bool {
+        let Some((_, id)) = self.active_ids() else { return false };
         if !self.may_copy(id) {
-            return;
+            return false;
         }
-        let Some(pixels) = self.session.get(id).map(|d| d.page_image_rgba(page, index)) else { return };
+        let Some(pixels) = self.session.get(id).map(|d| d.page_image_rgba(page, index)) else { return false };
         let copied = pixels.and_then(|(w, h, rgba)| {
             #[cfg(not(target_arch = "wasm32"))]
             if self.system_clipboard {
@@ -692,11 +750,57 @@ impl crate::PdfCraftApp {
             Ok((w, h))
         });
         match copied {
-            Ok((w, h)) => self.notify_fmt("The image has been copied ({w} × {h} pixels)", &[("w", &w.to_string()), ("h", &h.to_string())]),
-            Err(e) => self.notify_fmt("Couldn't copy the image: {e}", &[("e", &e)]),
+            Ok((w, h)) => {
+                self.notify_fmt("The image has been copied ({w} × {h} pixels)", &[("w", &w.to_string()), ("h", &h.to_string())]);
+                true
+            }
+            Err(e) => {
+                self.notify_fmt("Couldn't copy the image: {e}", &[("e", &e)]);
+                false
+            }
         }
     }
 
+    /// The picture's visible box on its page, in user space.
+    fn page_image_box(&self, page: usize, index: usize) -> Option<[f64; 4]> {
+        let (_, id) = self.active_ids()?;
+        let image = self.session.get(id)?.page_images(page).into_iter().nth(index)?;
+        Some(image.visible_rect.unwrap_or(image.rect))
+    }
+
+    /// Cut: copy the picture, and only when that worked take it off the page (one undo step).
+    pub(crate) fn cut_page_image(&mut self, page: usize, index: usize) {
+        if self.copy_page_image(page, index) {
+            self.apply_edit(Edit::EditPageImage { page, index, change: pdfcraft_engine::ImageEdit::Delete });
+        }
+    }
+
+    /// Redact image: a redaction mark over the whole picture. It is applied, like any mark, from
+    /// Redact a PDF.
+    pub(crate) fn redact_page_image(&mut self, page: usize, index: usize) {
+        let Some(rect) = self.page_image_box(page, index) else { return };
+        let author = self.comment_prefs.author.clone();
+        let mark = self.redact_prefs.mark(page, vec![pdfcraft_engine::rect_quad(rect)], &author);
+        if self.apply_edit(mark) {
+            self.notify_tr("The image is marked for redaction. Apply it with Redact a PDF");
+        }
+    }
+
+    /// Create link: the link properties for a new link over the picture.
+    pub(crate) fn link_page_image(&mut self, page: usize, index: usize) {
+        if let Some(rect) = self.page_image_box(page, index) {
+            self.open_link_props(page, Some(rect), None);
+        }
+    }
+
+    /// Recognize text: the Recognize Text dialog, set to this page.
+    pub fn recognize_text_on_page(&mut self, page: usize) {
+        self.ocr_draft.pages = crate::ocr_ui::OcrPages::Range;
+        self.ocr_draft.from = page + 1;
+        self.ocr_draft.to = page + 1;
+        self.dialog = Some(crate::Dialog::RecognizeText);
+    }
+
     /// Click an image field: pick a picture for it.
     pub fn choose_field_image(&mut self, name: &str) {
         #[cfg(not(target_arch = "wasm32"))]
@@ -727,7 +831,7 @@ impl crate::PdfCraftApp {
     pub fn add_image(&mut self, name: String, bytes: Vec<u8>) {
         let Some((i, id)) = self.active_ids() else { return };
         let page = self.views[i].current;
-        let before = self.session.get(id).map_or(0, |d| d.added.iter().filter(|a| a.page == page).count());
+        let before = self.session.get(id).map_or(0, |d| d.added().iter().filter(|a| a.page == page).count());
         if self.apply_edit(Edit::AddImage { page, rect: None, name, bytes: std::sync::Arc::new(bytes) }) {
             self.views[i].content.select_added = Some((page, before));
             self.left = crate::LeftPanel::Tool("edit");
@@ -742,6 +846,11 @@ pub(crate) enum ImageAction {
     Replace,
 }
 
+// Lucide names a flip icon after the axis it draws, Acrobat names the flip after the direction the
+// picture moves: Flip horizontal (left and right swap) shows Lucide's vertical axis.
+const FLIP_HORIZONTAL_ICON: &str = "flip-vertical-2";
+const FLIP_VERTICAL_ICON: &str = "flip-horizontal-2";
+
 /// Edit image: rotate, flip, crop, replace (shown while an added image is selected).
 pub(crate) fn image_panel(ui: &mut egui::Ui, t: &Tokens, img: &pdfcraft_engine::AddedImage) -> Option<ImageAction> {
     let mut out = None;
@@ -763,11 +872,11 @@ pub(crate) fn image_panel(ui: &mut egui::Ui, t: &Tokens, img: &pdfcraft_engine::
             turn(&mut i, 3);
             out = Some(ImageAction::Update(AddedContent::Image(i.clone())));
         }
-        if crate::icons::button(ui, "flip-horizontal-2", 28.0, false, tl!("Flip horizontal")).clicked() {
+        if crate::icons::button(ui, FLIP_HORIZONTAL_ICON, 28.0, false, tl!("Flip horizontal")).clicked() {
             i.flip_h = !i.flip_h;
             out = Some(ImageAction::Update(AddedContent::Image(i.clone())));
         }
-        if crate::icons::button(ui, "flip-vertical-2", 28.0, false, tl!("Flip vertical")).clicked() {
+        if crate::icons::button(ui, FLIP_VERTICAL_ICON, 28.0, false, tl!("Flip vertical")).clicked() {
             i.flip_v = !i.flip_v;
             out = Some(ImageAction::Update(AddedContent::Image(i.clone())));
         }
@@ -795,3 +904,53 @@ pub(crate) fn image_panel(ui: &mut egui::Ui, t: &Tokens, img: &pdfcraft_engine::
     }
     out
 }
+
+#[cfg(test)]
+mod tests {
+    use egui_kittest::kittest::Queryable;
+
+    use super::*;
+
+    /// The image a flip button leaves behind, as the panel returns it.
+    fn flipped(tooltip: &str) -> pdfcraft_engine::AddedImage {
+        let img = pdfcraft_engine::AddedImage::new([0.0, 0.0, 100.0, 50.0], pdfcraft_cos::ObjRef::new(7, 0));
+        let mut fonts = false;
+        let mut h = egui_kittest::Harness::new_ui_state(
+            move |ui, out: &mut Option<pdfcraft_engine::AddedImage>| {
+                // The app's fonts (the semibold section title) take effect from the next frame.
+                if !fonts {
+                    ui.ctx().set_fonts(crate::theme::font_definitions());
+                    fonts = true;
+                    return;
+                }
+                let t = Tokens::get(ui.ctx());
+                if let Some(ImageAction::Update(AddedContent::Image(i))) = image_panel(ui, &t, &img) {
+                    *out = Some(i);
+                }
+            },
+            None,
+        );
+        h.run();
+        h.get_by_label(tooltip).click();
+        h.run();
+        h.state().clone().expect("the button updates the image")
+    }
+
+    #[test]
+    fn flip_buttons_show_the_mirror_axis_of_the_flip_they_make() {
+        // #1834: Acrobat's Flip horizontal swaps left and right across a vertical axis. Lucide names
+        // its flip icons after the axis drawn, so that is its flip-vertical-2.
+        let svg = |name: &str| {
+            let (_, bytes) = crate::icon_data::ICONS.iter().find(|(n, _)| *n == name).expect("bundled icon");
+            String::from_utf8_lossy(bytes).into_owned()
+        };
+        let (h, v) = (svg(FLIP_HORIZONTAL_ICON), svg(FLIP_VERTICAL_ICON));
+        assert!(h.contains("M12 2v2") && !h.contains("M4 12H2"), "Flip horizontal draws a vertical axis:\n{h}");
+        assert!(v.contains("M4 12H2") && !v.contains("M12 2v2"), "Flip vertical draws a horizontal axis:\n{v}");
+
+        let i = flipped("Flip horizontal");
+        assert!(i.flip_h && !i.flip_v, "Flip horizontal mirrors left and right");
+        let i = flipped("Flip vertical");
+        assert!(i.flip_v && !i.flip_h, "Flip vertical mirrors top and bottom");
+    }
+}
diff --git a/crates/ui-egui/src/control.rs b/crates/ui-egui/src/control.rs
index eaa102b56..742641330 100644
--- a/crates/ui-egui/src/control.rs
+++ b/crates/ui-egui/src/control.rs
@@ -428,7 +428,8 @@ impl Control {
             let pos = egui::pos2(point("x", x)?, point("y", y)?);
             let which = pointer_button(p, "ui.click")?;
             let button = |pressed| egui::Event::PointerButton { pos, button: which, pressed, modifiers: egui::Modifiers::NONE };
-            let frames = self.inject(vec![vec![egui::Event::PointerMoved(pos)], vec![button(true)], vec![button(false)]]);
+            // Keep hover/layout warmup, then make an instantaneous click even on slow frames.
+            let frames = self.inject(vec![vec![egui::Event::PointerMoved(pos)], vec![button(true), button(false)]]);
             return Ok(Handled::AfterFrames(frames, json!({ "clicked": [x, y] })));
         }
         let s = self.shared.lock().map_err(|_| "control state poisoned")?;
@@ -780,27 +781,113 @@ pub struct Endpoint {
     pub token: String,
 }
 
+/// What a connection may do before it authenticates, so an unauthenticated local client cannot
+/// hold a thread for ever or exhaust them (#1806).
+#[cfg(not(target_arch = "wasm32"))]
+#[derive(Clone, Copy)]
+struct Limits {
+    /// How long a connection has to authenticate, counted from its acceptance: an absolute
+    /// deadline, so a client feeding one byte at a time cannot extend it.
+    auth_deadline: std::time::Duration,
+    /// How many connections may wait for authentication at once; further ones are refused.
+    max_unauthenticated: usize,
+    /// How long a write may block on a client that never reads its replies.
+    write_timeout: std::time::Duration,
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+const LIMITS: Limits =
+    Limits { auth_deadline: std::time::Duration::from_secs(10), max_unauthenticated: 8, write_timeout: std::time::Duration::from_secs(30) };
+
+/// One of the [`Limits::max_unauthenticated`] places, given back when dropped: when the
+/// connection authenticates, and on every way its thread can end.
+#[cfg(not(target_arch = "wasm32"))]
+struct Slot(std::sync::Arc<std::sync::atomic::AtomicUsize>);
+
+#[cfg(not(target_arch = "wasm32"))]
+impl Slot {
+    fn take(waiting: &std::sync::Arc<std::sync::atomic::AtomicUsize>, max: usize) -> Option<Self> {
+        use std::sync::atomic::Ordering;
+        let mut n = waiting.load(Ordering::Acquire);
+        loop {
+            if n >= max {
+                return None;
+            }
+            match waiting.compare_exchange_weak(n, n.saturating_add(1), Ordering::AcqRel, Ordering::Acquire) {
+                Ok(_) => return Some(Slot(waiting.clone())),
+                Err(now) => n = now,
+            }
+        }
+    }
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+impl Drop for Slot {
+    fn drop(&mut self) {
+        self.0.fetch_sub(1, std::sync::atomic::Ordering::AcqRel);
+    }
+}
+
+/// The reading half of a connection, with the authentication deadline: every read before it
+/// gets the time left as its timeout, and none at all once it has passed.
+#[cfg(not(target_arch = "wasm32"))]
+struct Reading {
+    stream: std::net::TcpStream,
+    until: Option<std::time::Instant>,
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+impl std::io::Read for Reading {
+    fn read(&mut self, buf: &mut [u8]) -> std::io::Result<usize> {
+        if let Some(until) = self.until {
+            let left = until.saturating_duration_since(std::time::Instant::now());
+            if left.is_zero() {
+                return Err(std::io::Error::new(std::io::ErrorKind::TimedOut, "the authentication deadline passed"));
+            }
+            self.stream.set_read_timeout(Some(left))?;
+        }
+        self.stream.read(buf)
+    }
+}
+
 /// Listen on `127.0.0.1` (random port) and forward authenticated requests to `client`.
 ///
 /// Protocol: newline-delimited JSON-RPC 2.0. The first request on a connection must be
 /// `{"method": "auth", "params": {"token": …}}`; anything else closes the connection, and so does
-/// a line longer than [`MAX_AUTH_LINE`] before that.
+/// a line longer than [`MAX_AUTH_LINE`] before that, or [`LIMITS`] passing without it.
 #[cfg(not(target_arch = "wasm32"))]
 pub fn serve(client: ControlClient) -> std::io::Result<Endpoint> {
+    serve_with(client, LIMITS)
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+fn serve_with(client: ControlClient, limits: Limits) -> std::io::Result<Endpoint> {
     use std::io::{BufReader, Write};
     let listener = std::net::TcpListener::bind(("127.0.0.1", 0))?;
     let port = listener.local_addr()?.port();
     let token = random_token()?;
     let expected = token.clone();
+    let waiting = std::sync::Arc::new(std::sync::atomic::AtomicUsize::new(0));
     std::thread::Builder::new().name("pdfcraft-control".into()).spawn(move || {
         for stream in listener.incoming().flatten() {
+            let _ = stream.set_write_timeout(Some(limits.write_timeout));
+            // Admitted only while fewer than the limit wait to authenticate: refused on the
+            // accepting thread, so a refused connection costs no thread at all.
+            let Some(slot) = Slot::take(&waiting, limits.max_unauthenticated) else {
+                let mut write = stream;
+                let e = rpc_error(Value::Null, -32003, "too many connections waiting to authenticate; try again later");
+                let _ = writeln!(write, "{e}").and_then(|_| write.flush());
+                continue;
+            };
             let client = client.clone();
             let expected = expected.clone();
             let _ = std::thread::Builder::new().name("pdfcraft-control-conn".into()).spawn(move || {
+                // Held until `auth` succeeds; given back however this thread ends.
+                let mut slot = Some(slot);
                 let Ok(read) = stream.try_clone() else { return };
                 let mut write = stream;
                 let mut authed = false;
-                let mut reader = BufReader::new(read);
+                let mut reader = BufReader::new(Reading { stream: read, until: Some(std::time::Instant::now() + limits.auth_deadline) });
                 let mut buf = Vec::new();
                 loop {
                     // Until `auth` succeeds, lines are capped at MAX_AUTH_LINE; afterwards they
@@ -808,6 +895,13 @@ pub fn serve(client: ControlClient) -> std::io::Result<Endpoint> {
                     let max = if authed { usize::MAX } else { MAX_AUTH_LINE };
                     match read_line_limited(&mut reader, &mut buf, max) {
                         Ok(LineRead::Line) => {}
+                        // The deadline passed before `auth`: say so and close.
+                        Err(e) if !authed && matches!(e.kind(), std::io::ErrorKind::TimedOut | std::io::ErrorKind::WouldBlock) => {
+                            let secs = limits.auth_deadline.as_secs_f64();
+                            let e = rpc_error(Value::Null, -32004, &format!("not authenticated within {secs} s"));
+                            let _ = writeln!(write, "{e}").and_then(|_| write.flush());
+                            break;
+                        }
                         // End of stream or a failed read ends the connection, as before.
                         Ok(LineRead::End) | Err(_) => break,
                         Ok(LineRead::TooLong) => {
@@ -833,6 +927,10 @@ pub fn serve(client: ControlClient) -> std::io::Result<Endpoint> {
                                     method == "auth" && params.get("token").and_then(Value::as_str).is_some_and(|t| constant_time_eq(t, &expected));
                                 authed = ok;
                                 if ok {
+                                    // Authenticated: no deadline from here on, and its place is free.
+                                    reader.get_mut().until = None;
+                                    let _ = reader.get_mut().stream.set_read_timeout(None);
+                                    drop(slot.take());
                                     (json!({ "jsonrpc": "2.0", "id": id, "result": { "ok": true } }), false)
                                 } else {
                                     (rpc_error(id, -32001, "authenticate first: auth {token}"), true)
@@ -985,6 +1083,109 @@ mod transport_tests {
         assert!(closed, "the connection stayed open: {next:?}");
     }
 
+    /// Small limits for the tests below: a 300 ms deadline, two places to wait in.
+    #[cfg(not(target_arch = "wasm32"))]
+    const TEST_LIMITS: super::Limits = super::Limits {
+        auth_deadline: std::time::Duration::from_millis(300),
+        max_unauthenticated: 2,
+        write_timeout: std::time::Duration::from_secs(5),
+    };
+
+    /// The next line the server sends, as JSON, or `None` when it closed the connection instead.
+    #[cfg(not(target_arch = "wasm32"))]
+    fn next_line(r: &mut std::io::BufReader<std::net::TcpStream>) -> Option<serde_json::Value> {
+        use std::io::BufRead;
+        let mut line = String::new();
+        match r.read_line(&mut line) {
+            Ok(0) | Err(_) => None,
+            Ok(_) => Some(serde_json::from_str(&line).unwrap()),
+        }
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    fn connect(port: u16) -> std::net::TcpStream {
+        let s = std::net::TcpStream::connect(("127.0.0.1", port)).unwrap();
+        s.set_read_timeout(Some(std::time::Duration::from_secs(5))).unwrap();
+        s
+    }
+
+    /// #1806: a connection that never authenticates is closed at the deadline, counted from its
+    /// acceptance, and a client feeding a byte at a time cannot push that deadline back.
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn an_unauthenticated_connection_is_closed_at_the_deadline() {
+        use std::io::{BufReader, Write};
+        let (_control, client) = super::attach(&egui::Context::default());
+        let ep = super::serve_with(client, TEST_LIMITS).unwrap();
+        // Idle.
+        let started = std::time::Instant::now();
+        let mut r = BufReader::new(connect(ep.port));
+        let reply = next_line(&mut r).expect("the server says why before closing");
+        assert_eq!(reply["error"]["code"], -32004, "{reply}");
+        let took = started.elapsed();
+        assert!(took >= std::time::Duration::from_millis(250) && took < std::time::Duration::from_secs(3), "{took:?}");
+        assert!(next_line(&mut r).is_none(), "then the connection is closed");
+        // Dripping: a byte every 50 ms for as long as the server keeps the connection.
+        let started = std::time::Instant::now();
+        let s = connect(ep.port);
+        let mut w = s.try_clone().unwrap();
+        let drip = std::thread::spawn(move || {
+            while w.write_all(b"x").is_ok() {
+                std::thread::sleep(std::time::Duration::from_millis(50));
+                if started.elapsed() > std::time::Duration::from_secs(3) {
+                    break;
+                }
+            }
+        });
+        let mut r = BufReader::new(s);
+        let reply = next_line(&mut r).expect("the server says why before closing");
+        assert_eq!(reply["error"]["code"], -32004, "{reply}");
+        let took = started.elapsed();
+        assert!(took < std::time::Duration::from_secs(2), "the deadline is absolute: {took:?}");
+        drop(r);
+        drip.join().unwrap();
+    }
+
+    /// #1806: only so many connections may wait to authenticate at once. One more is refused
+    /// on the spot; once a waiting one authenticates or times out, its place is free again.
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn only_so_many_connections_may_wait_to_authenticate() {
+        use std::io::{BufReader, Write};
+        let (_control, client) = super::attach(&egui::Context::default());
+        let ep = super::serve_with(client, TEST_LIMITS).unwrap();
+        let auth = serde_json::json!({ "jsonrpc": "2.0", "id": 1, "method": "auth", "params": { "token": ep.token } });
+        let first = connect(ep.port);
+        let second = connect(ep.port);
+        // The kernel accepts a connection before the listener admits it: give the listener a
+        // moment to admit both, well within their deadline.
+        std::thread::sleep(std::time::Duration::from_millis(100));
+        // The third finds both places taken.
+        let mut r3 = BufReader::new(connect(ep.port));
+        let reply = next_line(&mut r3).expect("refused with a reason");
+        assert_eq!(reply["error"]["code"], -32003, "{reply}");
+        assert!(next_line(&mut r3).is_none(), "and closed");
+        // The second authenticates: its place is free, so a new connection is admitted.
+        let mut r2 = BufReader::new(second.try_clone().unwrap());
+        let mut w2 = second.try_clone().unwrap();
+        writeln!(w2, "{auth}").unwrap();
+        assert_eq!(next_line(&mut r2).unwrap()["result"]["ok"], true);
+        let fourth = connect(ep.port);
+        let mut r4 = BufReader::new(fourth.try_clone().unwrap());
+        let mut w4 = fourth.try_clone().unwrap();
+        writeln!(w4, "{auth}").unwrap();
+        assert_eq!(next_line(&mut r4).unwrap()["result"]["ok"], true, "admitted and authenticated");
+        // The first was closed at the deadline (its place freed on that way out too): after it,
+        // another connection is admitted even though the first never authenticated.
+        drop(first);
+        std::thread::sleep(TEST_LIMITS.auth_deadline + std::time::Duration::from_millis(100));
+        let fifth = connect(ep.port);
+        let mut r5 = BufReader::new(fifth.try_clone().unwrap());
+        let mut w5 = fifth.try_clone().unwrap();
+        writeln!(w5, "{auth}").unwrap();
+        assert_eq!(next_line(&mut r5).unwrap()["result"]["ok"], true);
+    }
+
     /// After `auth` the limit no longer applies: a long line is read as before (here it isn't
     /// JSON, so it gets a parse error and the connection stays open).
     #[cfg(not(target_arch = "wasm32"))]
@@ -1011,3 +1212,129 @@ mod transport_tests {
         assert_eq!(reply(&mut r)["error"]["code"], -32700, "and the connection is still open");
     }
 }
+
+#[cfg(test)]
+mod pointer_tests {
+    use super::*;
+    use egui_kittest::Harness;
+    use egui_kittest::kittest::Queryable;
+
+    #[test]
+    fn coordinate_clicks_activate_once_with_slow_frames() {
+        struct Probe {
+            control: Option<Control>,
+            client: Option<ControlClient>,
+            host: crate::PdfCraftApp,
+            primary: usize,
+            secondary: usize,
+            disabled: usize,
+            discard: bool,
+            discarded: bool,
+            events: Vec<(f64, egui::PointerButton, bool, egui::Pos2)>,
+        }
+        fn request(h: &mut Harness<'_, Probe>, c: &ControlClient, params: Value) -> Reply {
+            let rx = c.send("ui.click", params);
+            for _ in 0..8 {
+                let before = h.ctx.input(|i| i.time);
+                h.step();
+                assert!(h.ctx.input(|i| i.time) > before, "simulated input time advances");
+                if let Ok(reply) = rx.try_recv() {
+                    return reply;
+                }
+            }
+            panic!("coordinate click did not reply within eight steps");
+        }
+        let max_duration = egui::Context::default().options(|o| o.input_options.max_click_duration);
+        let slow_dt = (max_duration + 0.25) as f32;
+        assert!(f64::from(slow_dt) > max_duration);
+        for discard in [false, true] {
+            let state = Probe {
+                control: None,
+                client: None,
+                host: crate::PdfCraftApp::new(),
+                primary: 0,
+                secondary: 0,
+                disabled: 0,
+                discard,
+                discarded: false,
+                events: Vec::new(),
+            };
+            let mut h = Harness::builder().with_size(egui::vec2(320.0, 200.0)).with_step_dt(slow_dt).build_ui_state(
+                |ui, state: &mut Probe| {
+                    if state.control.is_none() {
+                        let (control, client) = attach(ui.ctx());
+                        state.control = Some(control);
+                        state.client = Some(client);
+                        ui.ctx().options_mut(|o| o.max_passes = if state.discard { 2 } else { 1 }.try_into().unwrap());
+                    }
+                    state.control.as_mut().unwrap().tick(ui.ctx(), &mut state.host);
+                    ui.input(|i| {
+                        for event in &i.events {
+                            if let egui::Event::PointerButton { pos, button, pressed, .. } = event {
+                                assert!(state.events.len() < 32, "bounded pointer trace");
+                                state.events.push((i.time, *button, *pressed, *pos));
+                            }
+                        }
+                    });
+                    let response = ui.button("Click probe");
+                    if response.clicked() {
+                        state.primary += 1;
+                        if state.discard && !state.discarded {
+                            state.discarded = true;
+                            ui.ctx().request_discard("control click must not replay across passes");
+                        }
+                    }
+                    if response.secondary_clicked() {
+                        state.secondary += 1;
+                    }
+                    let disabled = ui.add_enabled(false, egui::Button::new("Disabled probe"));
+                    if disabled.clicked() || disabled.secondary_clicked() {
+                        state.disabled += 1;
+                    }
+                },
+                state,
+            );
+            h.run_steps(3);
+            let c = h.state().client.as_ref().unwrap().clone();
+            assert_eq!(h.ctx.options(|o| o.input_options.max_click_duration), max_duration);
+            let pos = h.get_by_label("Click probe").rect().center();
+            assert_eq!((h.state().primary, h.state().secondary, h.state().disabled), (0, 0, 0));
+            let reply = request(&mut h, &c, json!({"x":pos.x,"y":pos.y})).unwrap();
+            assert_eq!(reply["clicked"], json!([pos.x, pos.y]));
+            println!("slow control click discard={discard} duration_limit={max_duration} step_dt={slow_dt} pointer_events={:?}", h.state().events);
+            let events = &h.state().events;
+            assert_eq!(
+                events.iter().map(|(_, button, pressed, point)| (*button, *pressed, *point)).collect::<Vec<_>>(),
+                [(egui::PointerButton::Primary, true, pos), (egui::PointerButton::Primary, false, pos)]
+            );
+            let elapsed = events[1].0 - events[0].0;
+            assert!(elapsed == 0.0 || elapsed >= f64::from(slow_dt) - 1e-6, "the pair is atomic or crosses a simulated slow frame");
+            assert_eq!(h.state().primary, 1, "a coordinate click activates the real button once on slow frames");
+            h.run_steps(3);
+            assert_eq!(h.state().primary, 1, "later passes must not replay the click");
+            assert_eq!(h.state().discarded, discard);
+            request(&mut h, &c, json!({"x":pos.x,"y":pos.y,"button":"secondary"})).unwrap();
+            assert_eq!((h.state().primary, h.state().secondary), (1, 1));
+            let disabled = h.get_by_label("Disabled probe").rect().center();
+            request(&mut h, &c, json!({"x":disabled.x,"y":disabled.y})).unwrap();
+            assert_eq!((h.state().primary, h.state().secondary, h.state().disabled), (1, 1, 0));
+            let disabled_id = h
+                .state()
+                .control
+                .as_ref()
+                .unwrap()
+                .shared
+                .lock()
+                .unwrap()
+                .nodes
+                .iter()
+                .find(|(_, node)| node.label() == Some("Disabled probe"))
+                .unwrap()
+                .0
+                .0;
+            assert!(request(&mut h, &c, json!({"id":disabled_id})).unwrap_err().contains("disabled"));
+            assert!(h.state().host.views.is_empty(), "pointer probes create no document edits");
+            assert_eq!(h.ctx.options(|o| o.input_options.max_click_duration), max_duration);
+        }
+    }
+}
diff --git a/crates/ui-egui/src/create_multiple_ui.rs b/crates/ui-egui/src/create_multiple_ui.rs
index a89f5d592..54d2181d0 100644
--- a/crates/ui-egui/src/create_multiple_ui.rs
+++ b/crates/ui-egui/src/create_multiple_ui.rs
@@ -148,7 +148,7 @@ impl PdfCraftApp {
         if self.views.len() > before
             && let Some(view) = self.active.and_then(|i| self.views.get_mut(i))
         {
-            view.organize = true;
+            view.open_organize();
         }
     }
 }
diff --git a/crates/ui-egui/src/dialogs.rs b/crates/ui-egui/src/dialogs.rs
index 6eceff17e..2d2407629 100644
--- a/crates/ui-egui/src/dialogs.rs
+++ b/crates/ui-egui/src/dialogs.rs
@@ -20,7 +20,11 @@ fn dialogs(app: &mut PdfCraftApp, ctx: &egui::Context) {
     save_prompt(app, ctx);
     link_prompt(app, ctx);
     remote_link_prompt(app, ctx);
+    full_screen_prompt(app, ctx);
     crate::updates::dialog(app, ctx);
+    if app.dialog != Some(Dialog::WordCount) {
+        app.word_count_draft.cancel();
+    }
     let Some(dialog) = app.dialog else {
         app.props_draft = None;
         app.view_draft = None;
@@ -59,6 +63,8 @@ fn dialogs(app: &mut PdfCraftApp, ctx: &egui::Context) {
     let mut import_words = false;
     let mut print_go = false;
     let mut revert_now = false;
+    let mut overwrite_now = false;
+    let mut overwrite_elsewhere = false;
     let mut summarize_now = false;
     let mut optimize_now = false;
     let mut duplicate_now: Option<Edit> = None;
@@ -82,6 +88,9 @@ fn dialogs(app: &mut PdfCraftApp, ctx: &egui::Context) {
             _ => 520.0,
         });
         match dialog {
+            Dialog::WordCount => {
+                close = crate::word_count_ui::body(ui, app);
+            }
             Dialog::CreateImages => {
                 let (go, cancel) = crate::create_ui::image_import_body(ui, app);
                 images_now = go;
@@ -112,7 +121,12 @@ fn dialogs(app: &mut PdfCraftApp, ctx: &egui::Context) {
                 let row = |ui: &mut egui::Ui, k: &str, v: String| {
                     // Row labels are UI chrome; values are document data and stay as they are.
                     ui.label(egui::RichText::new(tl!(k)).color(t.text_muted));
-                    ui.label(if v.is_empty() { egui::RichText::new("—").color(t.text_faint) } else { egui::RichText::new(v) });
+                    ui.scope(|ui| {
+                        ui.set_max_width(420.0);
+                        ui.add(
+                            egui::Label::new(if v.is_empty() { egui::RichText::new("—").color(t.text_faint) } else { egui::RichText::new(v) }).wrap(),
+                        );
+                    });
                     ui.end_row();
                 };
                 egui::ScrollArea::vertical().max_height(460.0).auto_shrink([false, true]).show(ui, |ui| {
@@ -470,14 +484,17 @@ fn dialogs(app: &mut PdfCraftApp, ctx: &egui::Context) {
                 ui.add_space(8.0);
                 d.to = d.to.clamp(1, count);
                 d.from = d.from.clamp(1, d.to);
-                let n = d.to - d.from + 1;
                 ui.horizontal(|ui| {
                     ui.label(tl!("Original: replace pages"));
-                    ui.add(egui::DragValue::new(&mut d.from).range(1..=count));
+                    let from = ui.add(egui::DragValue::new(&mut d.from).range(1..=count));
                     ui.label(tl!("to"));
-                    ui.add(egui::DragValue::new(&mut d.to).range(1..=count));
+                    let to = ui.add(egui::DragValue::new(&mut d.to).range(1..=count));
+                    if from.changed() || to.changed() {
+                        d.range_edited = true;
+                    }
                     ui.label(egui::RichText::new(crate::i18n::fmt(tl!("of {name}"), &[("name", &count.to_string())])).color(t.text_muted));
                 });
+                let n = if d.range_edited { d.to - d.from + 1 } else { d.pages.len().max(1) };
                 let max_start = d.src_pages.saturating_sub(n) + 1;
                 d.src_from = d.src_from.clamp(1, max_start.max(1));
                 ui.horizontal(|ui| {
@@ -531,6 +548,15 @@ fn dialogs(app: &mut PdfCraftApp, ctx: &egui::Context) {
                 let mut prefs = app.redact_prefs.clone();
                 let (ok, cancel) = crate::redact_ui::props_body(ui, &mut prefs, &t);
                 app.redact_prefs = prefs;
+                if ok && app.redact_prefs.remember {
+                    app.redact_defaults = app.redact_prefs.clone();
+                }
+                if cancel && let Some(before) = app.redact_before.take() {
+                    app.redact_prefs = before;
+                }
+                if ok {
+                    app.redact_before = None;
+                }
                 close = ok || cancel;
                 return;
             }
@@ -778,11 +804,41 @@ fn dialogs(app: &mut PdfCraftApp, ctx: &egui::Context) {
                 });
                 return;
             }
+            Dialog::OverwriteChanged => {
+                #[cfg(not(target_arch = "wasm32"))]
+                let name = app.pending_overwrite.as_ref().and_then(|p| app.session.get(p.id)).map(|d| d.name.clone()).unwrap_or_default();
+                #[cfg(target_arch = "wasm32")]
+                let name = String::new();
+                ui.label(egui::RichText::new(tl!("Save over the changed file?")).font(theme::semibold(18.0)));
+                ui.add_space(8.0);
+                ui.label(crate::i18n::fmt(
+                    tl!("“{name}” changed on disk after it was opened or last saved. Saving now replaces that newer version with this one."),
+                    &[("name", &name)],
+                ));
+                ui.add_space(12.0);
+                ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
+                    if widgets::pill_button(ui, tl!("Save anyway"), true).clicked() {
+                        overwrite_now = true;
+                        close = true;
+                    }
+                    if widgets::pill_button(ui, tl!("Save as…"), false).clicked() {
+                        overwrite_elsewhere = true;
+                        close = true;
+                    }
+                    if widgets::pill_button(ui, tl!("Cancel"), false).clicked() {
+                        close = true;
+                    }
+                });
+                return;
+            }
             Dialog::Print => {
                 let Some((i, id)) = app.active_ids() else {
                     close = true;
                     return;
                 };
+                if app.print_draft.handling == crate::print_ui::Handling::Label {
+                    app.read_label_crops(id);
+                }
                 let Some(doc) = app.session.get(id) else { return };
                 let sizes: Vec<(f64, f64)> = doc.info.pages.iter().map(|p| (p.width as f64, p.height as f64)).collect();
                 let labels: Vec<String> = doc.info.pages.iter().map(|p| p.label.clone()).collect();
@@ -794,6 +850,7 @@ fn dialogs(app: &mut PdfCraftApp, ctx: &egui::Context) {
                     ui.ctx().input(|i| i.max_texture_side) as f32,
                 );
                 let view = &mut app.views[i];
+                view.set_print_grayscale(app.print_draft.grayscale);
                 view.queue_print_previews(&rasters);
                 let (go, cancel) = crate::print_ui::body(ui, &mut app.print_draft, &t, &sizes, &labels, &mut |p| {
                     view.need_thumbnail(p, true);
@@ -1178,9 +1235,10 @@ fn dialogs(app: &mut PdfCraftApp, ctx: &egui::Context) {
         && let Some(d) = app.replace_draft.take()
         && app.still_pick_target(d.target)
     {
-        let n = d.to - d.from + 1;
+        let pages = if d.range_edited { (d.from - 1..d.to).collect() } else { d.pages.clone() };
+        let n = pages.len();
         app.apply_edit(Edit::ReplacePages {
-            pages: (d.from - 1..d.to).collect(),
+            pages,
             name: d.name.clone(),
             bytes: d.bytes.clone(),
             src_pages: (d.src_from - 1..d.src_from - 1 + n).collect(),
@@ -1193,6 +1251,22 @@ fn dialogs(app: &mut PdfCraftApp, ctx: &egui::Context) {
     if revert_now {
         app.revert_active();
     }
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        if overwrite_now {
+            app.overwrite_changed_file();
+        }
+        if overwrite_elsewhere {
+            app.save_changed_file_elsewhere();
+        }
+    }
+    #[cfg(target_arch = "wasm32")]
+    let _ = (overwrite_now, overwrite_elsewhere);
+    // Cancelled or dismissed: the save is dropped.
+    #[cfg(not(target_arch = "wasm32"))]
+    if dialog == Dialog::OverwriteChanged && (modal.should_close() || close) {
+        app.pending_overwrite = None;
+    }
     if summarize_now {
         app.summarize_comments();
     }
@@ -1272,6 +1346,10 @@ fn dialogs(app: &mut PdfCraftApp, ctx: &egui::Context) {
                 app.apply_edit(Edit::Batch { label: "Change comment properties".into(), edits });
             }
         }
+        // Make Properties Default: the look chosen here, even when it was already the comment's.
+        if d.make_default && d.edited.restylable {
+            app.make_props_default(d.page, d.index, &d.edited);
+        }
     }
     if export_now && let Dialog::Export(kind) = dialog {
         app.start_export(kind);
@@ -1512,6 +1590,48 @@ fn link_prompt(app: &mut PdfCraftApp, ctx: &egui::Context) {
     }
 }
 
+/// A document that asks to open in Full Screen mode (`/PageMode /FullScreen`) is asked about
+/// first, as Acrobat does: full screen hides every control, so it is the person's choice.
+fn full_screen_prompt(app: &mut PdfCraftApp, ctx: &egui::Context) {
+    let Some(id) = app.pending_full_screen else { return };
+    // The document was closed before an answer: nothing to ask any more.
+    if app.session.get(id).is_none() {
+        app.pending_full_screen = None;
+        return;
+    }
+    let t = Tokens::get(ctx);
+    let mut choice = None;
+    let modal = widgets::show_modal(ctx, "full_screen_prompt", |ui| {
+        ui.set_width(460.0);
+        ui.horizontal(|ui| {
+            ui.add(crate::icons::image("maximize", 22.0, t.accent));
+            ui.label(egui::RichText::new(tl!("Open in Full Screen mode?")).font(theme::semibold(16.0)));
+        });
+        ui.add_space(6.0);
+        ui.add(
+            egui::Label::new(tl!(
+                "This document asks to open in Full Screen mode: the page fills the screen and nothing else shows. Press Esc at any time to leave it."
+            ))
+            .wrap(),
+        );
+        ui.add_space(14.0);
+        ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
+            if widgets::pill_button(ui, tl!("Not now"), true).clicked() {
+                choice = Some(false);
+            }
+            if widgets::pill_button(ui, tl!("Full Screen"), false).clicked() {
+                choice = Some(true);
+            }
+        });
+    });
+    if choice.is_none() && modal.should_close() {
+        choice = Some(false);
+    }
+    if let Some(allow) = choice {
+        app.resolve_full_screen_prompt(ctx, allow);
+    }
+}
+
 /// Absolute document-controlled local paths require consent before any filesystem access.
 fn remote_link_prompt(app: &mut PdfCraftApp, ctx: &egui::Context) {
     let Some(pending) = app.pending_remote_link.clone() else { return };
diff --git a/crates/ui-egui/src/docking.rs b/crates/ui-egui/src/docking.rs
index fe4c0390d..58fd71a67 100644
--- a/crates/ui-egui/src/docking.rs
+++ b/crates/ui-egui/src/docking.rs
@@ -409,7 +409,10 @@ pub fn show(app: &mut crate::PdfCraftApp, ui: &mut egui::Ui) {
                 match app.active {
                     None if app.combine_showing() => crate::combine_ui::page(app, ui),
                     None => crate::home::show(app, ui),
-                    Some(index) => crate::canvas::document_area(app, index, ui),
+                    Some(index) => match crate::compare_ui::side_by_side(app, index) {
+                        Some((old, new)) => crate::compare_ui::compare_area(app, old, new, ui),
+                        None => crate::canvas::document_area(app, index, ui),
+                    },
                 }
             }
             Panel::Tools => crate::panels::left_panel(app, ui),
diff --git a/crates/ui-egui/src/drag_pointer.rs b/crates/ui-egui/src/drag_pointer.rs
index 898d319fe..05ef05c42 100644
--- a/crates/ui-egui/src/drag_pointer.rs
+++ b/crates/ui-egui/src/drag_pointer.rs
@@ -19,7 +19,22 @@ pub(crate) fn in_window(ctx: &egui::Context) -> Option<egui::Pos2> {
     (pos.x.is_finite() && pos.y.is_finite()).then_some(pos)
 }
 
-#[cfg(not(target_os = "macos"))]
+/// The pointer in this window's coordinates (egui points), when the system can tell.
+#[cfg(windows)]
+pub(crate) fn in_window(ctx: &egui::Context) -> Option<egui::Pos2> {
+    // Physical screen pixels, whatever this thread's DPI awareness.
+    let pointer = winsafe::GetPhysicalCursorPos().ok()?;
+    let inner = ctx.input(|i| i.viewport().inner_rect)?;
+    // egui places the window in points: physical pixels over the pixels per point (zoom included).
+    let ppp = ctx.pixels_per_point();
+    if !(ppp.is_finite() && ppp > 0.0) {
+        return None;
+    }
+    let pos = egui::pos2(pointer.x as f32 / ppp - inner.min.x, pointer.y as f32 / ppp - inner.min.y);
+    (pos.x.is_finite() && pos.y.is_finite()).then_some(pos)
+}
+
+#[cfg(not(any(target_os = "macos", windows)))]
 pub(crate) fn in_window(_ctx: &egui::Context) -> Option<egui::Pos2> {
     None
 }
diff --git a/crates/ui-egui/src/edit_text_ui.rs b/crates/ui-egui/src/edit_text_ui.rs
index 65c50528e..d8881ba47 100644
--- a/crates/ui-egui/src/edit_text_ui.rs
+++ b/crates/ui-egui/src/edit_text_ui.rs
@@ -15,11 +15,17 @@ use crate::canvas::{DocView, PageXform};
 
 const ACCENT: Color32 = Color32::from_rgb(0x14, 0x73, 0xE6);
 
+#[derive(Clone, Copy, PartialEq)]
+enum TextTarget {
+    Block(usize),
+    Added(usize),
+}
+
 /// A cached, read-only page background. The source glyphs are removed before rasterization;
 /// colour, pictures and unselected text beneath the editor remain visible.
 #[derive(Default)]
 pub(crate) struct TextBackground {
-    key: Option<(u64, usize, usize)>,
+    key: Option<(u64, usize, TextTarget)>,
     renderer: Option<pdfcraft_render::RenderPool>,
     texture: Option<egui::TextureHandle>,
     tag: Option<u64>,
@@ -33,12 +39,26 @@ impl TextBackground {
         self.renderer.is_some() && self.received != self.tag
     }
 
-    pub fn prepare(&mut self, ctx: &egui::Context, doc: &pdfcraft_engine::Document, editor: Option<&LineEditor>, scale: f32) {
-        let key = editor.map(|ed| (doc.edit_generation(), ed.page, ed.block));
+    pub fn prepare(
+        &mut self,
+        ctx: &egui::Context,
+        doc: &pdfcraft_engine::Document,
+        editor: Option<&LineEditor>,
+        draft: Option<&crate::content_ui::TextDraft>,
+        scale: f32,
+    ) {
+        let key = editor
+            .map(|ed| (doc.edit_generation(), ed.page, TextTarget::Block(ed.block)))
+            .or_else(|| draft.and_then(|d| d.index.map(|index| (doc.edit_generation(), d.page, TextTarget::Added(index)))));
         if self.key != key {
             *self = Self { key, ..Default::default() };
-            if let Some((_, page, block)) = key {
-                self.renderer = doc.text_edit_preview(page, block).ok().map(|p| p.renderer());
+            if let Some((_, page, target)) = key {
+                self.renderer = match target {
+                    TextTarget::Block(block) => doc.text_edit_preview(page, block),
+                    TextTarget::Added(index) => doc.added_text_preview(page, index),
+                }
+                .ok()
+                .map(|p| p.renderer());
             }
         }
         if let Some(ed) = editor {
@@ -50,8 +70,12 @@ impl TextBackground {
         }
         let (Some((_, page, _)), Some(renderer)) = (self.key, self.renderer.as_ref()) else { return };
         let Some(p) = doc.info.pages.get(page) else { return };
+        // One raster stands in for the page's tiles while a paragraph is open, so everything
+        // around the editor is drawn from it: at the tiling threshold it stays sharp on a Retina
+        // display up to about 2.5x on a Letter or A4 page, where the backdrop side (2048) went
+        // soft past 1.2x.
         let max_side = ctx.input(|i| i.max_texture_side) as f32;
-        let scale = scale.min(crate::canvas::BASE_SIDE.min(max_side) / p.width.max(p.height).max(1.0));
+        let scale = scale.min(crate::canvas::TILE_THRESHOLD.min(max_side) / p.width.max(p.height).max(1.0));
         let tag = (scale * 1000.0) as u64;
         if self.tag != Some(tag) {
             renderer.set_queue(vec![pdfcraft_render::RenderRequest { page, scale, tag, ..Default::default() }]);
@@ -78,11 +102,26 @@ impl TextBackground {
     }
 
     pub fn ready(&self, page: usize, block: usize) -> bool {
-        self.key.is_some_and(|(_, p, b)| (p, b) == (page, block)) && self.texture.is_some()
+        self.key.is_some_and(|(_, p, target)| (p, target) == (page, TextTarget::Block(block))) && self.texture.is_some()
     }
 
-    pub fn paint(&self, painter: &egui::Painter, xf: &PageXform, page: usize, editor: Option<&LineEditor>) {
-        let Some(_) = editor.filter(|ed| ed.page == page && self.ready(page, ed.block)) else { return };
+    pub fn ready_added(&self, page: usize, index: usize) -> bool {
+        self.key.is_some_and(|(_, p, target)| (p, target) == (page, TextTarget::Added(index))) && self.texture.is_some()
+    }
+
+    pub fn paint(
+        &self,
+        painter: &egui::Painter,
+        xf: &PageXform,
+        page: usize,
+        editor: Option<&LineEditor>,
+        draft: Option<&crate::content_ui::TextDraft>,
+    ) {
+        let ready = editor.is_some_and(|ed| ed.page == page && self.ready(page, ed.block))
+            || draft.is_some_and(|d| d.page == page && d.index.is_some_and(|index| self.ready_added(page, index)));
+        if !ready {
+            return;
+        }
         let Some(tex) = &self.texture else { return };
         // Font metrics can underestimate the actual glyph ink. Paint the complete textless
         // page so overhanging glyphs cannot remain outside the estimated source rectangle.
@@ -269,7 +308,7 @@ fn look_of(b: &pdfcraft_engine::TextBlock) -> pdfcraft_engine::AddedText {
     source_look(&b.base_font, b.size, b.color, b.bold, b.italic)
 }
 
-fn editor_font(look: &pdfcraft_engine::AddedText, size: f32) -> FontId {
+pub(crate) fn editor_font(look: &pdfcraft_engine::AddedText, size: f32) -> FontId {
     let family = match (look.family, look.bold) {
         (pdfcraft_engine::FontFamily::Courier, _) => FontFamily::Monospace,
         (_, true) => FontFamily::Name("semibold".into()),
@@ -317,6 +356,175 @@ pub struct ImageSelection {
     pub index: usize,
     /// Dragging: the start point and, for a corner, the opposite corner (screen).
     drag: Option<(Pos2, Option<Pos2>)>,
+    /// Crop mode (Acrobat's crop handles): the box kept so far.
+    pub crop: Option<CropMode>,
+}
+
+/// Cropping a page image: the handles trim instead of resizing, the part that will go is
+/// dimmed, Enter or Done applies and Esc or Cancel leaves it.
+#[derive(Clone, Debug, PartialEq)]
+pub struct CropMode {
+    /// The box to keep (user space).
+    pub keep: [f64; 4],
+    /// A drag in progress: the grip (0–3 corners, 4–7 edges, 8 the inside), where it started
+    /// and the box then.
+    drag: Option<(usize, Pos2, [f64; 4])>,
+}
+
+impl CropMode {
+    pub fn new(keep: [f64; 4]) -> Self {
+        Self { keep, drag: None }
+    }
+}
+
+/// The screen boxes of the crop's eight handles: corners, then the top, right, bottom and left
+/// edge midpoints.
+fn crop_handles(k: Rect) -> [Pos2; 8] {
+    [k.left_top(), k.right_top(), k.left_bottom(), k.right_bottom(), k.center_top(), k.right_center(), k.center_bottom(), k.left_center()]
+}
+
+/// Crop mode for the selected image `i` whose visible frame is `b` (screen). Returns `true`
+/// (the pointer and keys are the crop's while it lasts).
+#[allow(clippy::too_many_arguments)]
+fn crop_input(
+    ui: &egui::Ui,
+    resp: &egui::Response,
+    xf: &PageXform,
+    page: usize,
+    info: &DocInfo,
+    view: &mut DocView,
+    i: usize,
+    b: Rect,
+    allow_interaction: bool,
+) -> bool {
+    let painter = ui.painter();
+    let Some(mode) = view.image_selection.as_mut().and_then(|s| s.crop.as_mut()) else { return false };
+    let hover_pos = ui.input(|inp| inp.pointer.hover_pos());
+    let keep_screen = |keep: [f64; 4]| xf.user_rect(info, page, keep.map(|v| v as f32)).intersect(b);
+    // A drag in progress moves a grip; the box stays inside the picture and at least 6 px.
+    if allow_interaction
+        && resp.drag_started()
+        && let Some(o) = ui.input(|inp| inp.pointer.press_origin())
+    {
+        let k = keep_screen(mode.keep);
+        let grip = crop_handles(k).iter().position(|h| h.distance(o) < 8.0).or_else(|| k.contains(o).then_some(8));
+        if let Some(g) = grip {
+            mode.drag = Some((g, o, mode.keep));
+        }
+    }
+    if let Some((grip, start, at_start)) = mode.drag
+        && let Some(p) = hover_pos
+    {
+        let d = p - start;
+        let k0 = keep_screen(at_start);
+        let (mut min, mut max) = (k0.min, k0.max);
+        match grip {
+            0 => {
+                min.x += d.x;
+                min.y += d.y;
+            }
+            1 => {
+                max.x += d.x;
+                min.y += d.y;
+            }
+            2 => {
+                min.x += d.x;
+                max.y += d.y;
+            }
+            3 => {
+                max.x += d.x;
+                max.y += d.y;
+            }
+            4 => min.y += d.y,
+            5 => max.x += d.x,
+            6 => max.y += d.y,
+            7 => min.x += d.x,
+            _ => {
+                let shift = egui::vec2(d.x.clamp(b.min.x - k0.min.x, b.max.x - k0.max.x), d.y.clamp(b.min.y - k0.min.y, b.max.y - k0.max.y));
+                min += shift;
+                max += shift;
+            }
+        }
+        let (min_w, min_h) = (6.0_f32.min(b.width()), 6.0_f32.min(b.height()));
+        min.x = min.x.clamp(b.min.x, b.max.x - min_w);
+        min.y = min.y.clamp(b.min.y, b.max.y - min_h);
+        max.x = max.x.clamp(min.x + min_w, b.max.x);
+        max.y = max.y.clamp(min.y + min_h, b.max.y);
+        mode.keep = user_box(xf, info, page, Rect::from_min_max(min, max));
+        if resp.drag_stopped() || !ui.input(|inp| inp.pointer.primary_down()) {
+            mode.drag = None;
+        }
+    }
+    let k = keep_screen(mode.keep);
+    // What goes is dimmed; what stays keeps its frame and handles.
+    let dim = Color32::from_black_alpha(96);
+    for r in [
+        Rect::from_min_max(b.min, Pos2::new(b.max.x, k.min.y)),
+        Rect::from_min_max(Pos2::new(b.min.x, k.max.y), b.max),
+        Rect::from_min_max(Pos2::new(b.min.x, k.min.y), Pos2::new(k.min.x, k.max.y)),
+        Rect::from_min_max(Pos2::new(k.max.x, k.min.y), Pos2::new(b.max.x, k.max.y)),
+    ] {
+        if r.is_positive() {
+            painter.rect_filled(r.intersect(xf.rect), CornerRadius::ZERO, dim);
+        }
+    }
+    painter.rect_stroke(k, CornerRadius::ZERO, Stroke::new(1.5, ACCENT), egui::StrokeKind::Outside);
+    for h in crop_handles(k) {
+        painter.rect(
+            Rect::from_center_size(h, egui::vec2(8.0, 8.0)),
+            CornerRadius::ZERO,
+            Color32::WHITE,
+            Stroke::new(1.0, ACCENT),
+            egui::StrokeKind::Middle,
+        );
+    }
+    // Done and Cancel, painted under the box (above it near the bottom of the view).
+    let font = egui::FontId::proportional(12.5);
+    let pill = |label: &str, right: f32, y: f32| -> Rect {
+        let w = painter.layout_no_wrap(label.to_string(), font.clone(), Color32::WHITE).size().x + 20.0;
+        Rect::from_min_size(Pos2::new(right - w, y), egui::vec2(w, 22.0))
+    };
+    let y = if k.max.y + 30.0 < xf.rect.max.y { k.max.y + 6.0 } else { k.min.y - 28.0 };
+    let done = pill(tl!("Done"), k.max.x, y);
+    let cancel = pill(tl!("Cancel"), done.min.x - 6.0, y);
+    let t = crate::theme::Tokens::get(ui.ctx());
+    painter.rect_filled(done, CornerRadius::same(11), ACCENT);
+    painter.text(done.center(), egui::Align2::CENTER_CENTER, tl!("Done"), font.clone(), Color32::WHITE);
+    painter.rect(cancel, CornerRadius::same(11), t.panel, Stroke::new(1.0, t.border), egui::StrokeKind::Inside);
+    painter.text(cancel.center(), egui::Align2::CENTER_CENTER, tl!("Cancel"), font, t.text);
+    if let Some(p) = hover_pos {
+        let icon = if let Some(g) = crop_handles(k).iter().position(|h| h.distance(p) < 8.0) {
+            match g {
+                0 | 3 => egui::CursorIcon::ResizeNwSe,
+                1 | 2 => egui::CursorIcon::ResizeNeSw,
+                4 | 6 => egui::CursorIcon::ResizeVertical,
+                _ => egui::CursorIcon::ResizeHorizontal,
+            }
+        } else if done.contains(p) || cancel.contains(p) {
+            egui::CursorIcon::PointingHand
+        } else if k.contains(p) {
+            egui::CursorIcon::Move
+        } else {
+            egui::CursorIcon::Default
+        };
+        ui.ctx().set_cursor_icon(icon);
+    }
+    let clicked = |r: Rect| allow_interaction && resp.clicked() && hover_pos.is_some_and(|p| r.contains(p));
+    let keys = |key: egui::Key| allow_interaction && ui.input(|inp| inp.key_pressed(key)) && !ui.ctx().egui_wants_keyboard_input();
+    if clicked(done) || keys(egui::Key::Enter) {
+        let keep = mode.keep;
+        if let Some(s) = view.image_selection.as_mut() {
+            s.crop = None;
+        }
+        if keep_screen(keep) != b {
+            view.pending_edit = Some(Edit::EditPageImage { page, index: i, change: pdfcraft_engine::ImageEdit::Crop(keep) });
+        }
+    } else if (clicked(cancel) || keys(egui::Key::Escape))
+        && let Some(s) = view.image_selection.as_mut()
+    {
+        s.crop = None;
+    }
+    true
 }
 
 impl ImageSelection {
@@ -362,6 +570,8 @@ pub struct BlockDrag {
 
 /// How far an edge grip reaches either side of a box's edge (screen pixels).
 const EDGE_REACH: f32 = 6.0;
+/// How far outside an open paragraph's frame the pointer still means the frame (screen pixels).
+const FRAME_REACH: f32 = 4.0;
 
 /// The rewrap handles drawn on a paragraph box's left and right edges (screen).
 fn width_handles(b: Rect) -> [Rect; 2] {
@@ -400,6 +610,14 @@ pub(crate) enum ImageAction {
     Save(usize, usize),
     Copy(usize, usize),
     CopyFile(usize, usize),
+    /// Copy the picture, then remove it from the page.
+    Cut(usize, usize),
+    /// Mark the picture for redaction (applied later from Redact a PDF).
+    Redact(usize, usize),
+    /// Create a link over the picture.
+    Link(usize, usize),
+    /// Open Recognize Text for the picture's page.
+    Recognize(usize),
 }
 
 fn user_box(xf: &PageXform, info: &DocInfo, page: usize, r: Rect) -> [f64; 4] {
@@ -464,6 +682,9 @@ pub(crate) fn image_input(
     // The selected image: frame, corner handles, dragging.
     if let Some(i) = selected.filter(|i| boxes.get(*i).is_some_and(|b| b.is_positive())) {
         let b = boxes[i];
+        if view.image_selection.as_ref().is_some_and(|s| s.crop.is_some()) {
+            return crop_input(ui, resp, xf, page, info, view, i, b, allow_interaction);
+        }
         let corners = [b.left_top(), b.right_top(), b.left_bottom(), b.right_bottom()];
         let handles = |rect: Rect| {
             for c in [rect.left_top(), rect.right_top(), rect.left_bottom(), rect.right_bottom()] {
@@ -527,6 +748,28 @@ pub(crate) fn image_input(
             let target = Rect::from_min_max(preview.min + (raw.min - b.min) * factor, preview.min + (raw.max - b.min) * factor);
             let visible = preview.intersect(xf.rect);
             if visible.is_positive() {
+                // The pixels follow the frame: the page raster's picture of the image, stretched
+                // into the preview over a blank where it was. Re-rendering every frame of a drag
+                // would lag; the edit renders it properly on release.
+                if preview != b
+                    && let Some(tex) = view.page_raster(page)
+                {
+                    let clipped = painter.with_clip_rect(painter.clip_rect().intersect(xf.rect));
+                    clipped.rect_filled(b, CornerRadius::ZERO, Color32::WHITE);
+                    let mut mesh = egui::Mesh::with_texture(tex);
+                    for (from, to) in [
+                        (b.left_top(), preview.left_top()),
+                        (b.right_top(), preview.right_top()),
+                        (b.right_bottom(), preview.right_bottom()),
+                        (b.left_bottom(), preview.left_bottom()),
+                    ] {
+                        let (u, v) = xf.screen_to_norm(from);
+                        mesh.vertices.push(egui::epaint::Vertex { pos: to, uv: Pos2::new(u, v), color: Color32::WHITE });
+                    }
+                    mesh.add_triangle(0, 1, 2);
+                    mesh.add_triangle(0, 2, 3);
+                    clipped.add(egui::Shape::mesh(mesh));
+                }
                 painter.rect_filled(visible, CornerRadius::ZERO, ACCENT.gamma_multiply(0.04));
                 painter.rect_stroke(visible, CornerRadius::ZERO, Stroke::new(1.5, ACCENT), egui::StrokeKind::Outside);
                 handles(preview);
@@ -543,7 +786,7 @@ pub(crate) fn image_input(
             ui.ctx().set_cursor_icon(match opposite {
                 Some(fixed) if (start.x - fixed.x) * (start.y - fixed.y) < 0.0 => egui::CursorIcon::ResizeNeSw,
                 Some(_) => egui::CursorIcon::ResizeNwSe,
-                None => egui::CursorIcon::Grabbing,
+                None => egui::CursorIcon::Move,
             });
             return true;
         }
@@ -559,6 +802,22 @@ pub(crate) fn image_input(
     if !allow_interaction {
         return false;
     }
+    // An open menu stays drawn wherever the pointer is: most of its items lie outside the picture
+    // (a logo is smaller than its menu), and a menu that is not drawn for a frame cannot be clicked.
+    // Only a menu opened by a right-click on the picture: one opened over text or empty page while
+    // a picture stays selected is the page's own menu.
+    let menu_key = resp.id.with("image-menu");
+    if resp.secondary_clicked() {
+        ui.ctx().data_mut(|d| d.insert_temp(menu_key, false));
+    }
+    let mut menu_drawn = false;
+    if let Some(sel) = selected
+        && resp.context_menu_opened()
+        && ui.ctx().data(|d| d.get_temp::<bool>(menu_key)).unwrap_or(false)
+    {
+        resp.context_menu(|ui| image_menu(ui, page, sel, images, view, action));
+        menu_drawn = true;
+    }
     let Some(p) = hover_pos.filter(|p| xf.rect.contains(*p)) else { return false };
     let Some(hit) = boxes.iter().enumerate().rposition(|(i, b)| b.contains(p) && image_contains(i, p)) else { return false };
     if selected != Some(hit) {
@@ -573,52 +832,144 @@ pub(crate) fn image_input(
         _ => egui::CursorIcon::PointingHand,
     });
     if resp.clicked() || resp.secondary_clicked() {
-        view.image_selection = Some(ImageSelection { page, index: hit, drag: None });
+        view.image_selection = Some(ImageSelection { page, index: hit, drag: None, crop: None });
     }
-    if selected == Some(hit) {
-        resp.context_menu(|ui| {
-            use pdfcraft_engine::ImageEdit as E;
-            let items: [(&str, Option<E>); 4] = [
-                (tl!("Rotate Clockwise"), Some(E::Rotate(1))),
-                (tl!("Rotate Counterclockwise"), Some(E::Rotate(3))),
-                (tl!("Flip Horizontal"), Some(E::Flip { horizontal: true })),
-                (tl!("Flip Vertical"), Some(E::Flip { horizontal: false })),
-            ];
-            for (label, change) in items {
-                if ui.button(label).clicked() {
-                    view.pending_edit = change.map(|c| Edit::EditPageImage { page, index: hit, change: c });
-                    ui.close();
-                }
-            }
-            let raster = images.get(hit).is_some_and(|image| !image.is_form);
-            if ui.add_enabled(raster, egui::Button::new(tl!("Replace Image…"))).clicked() {
-                *action = Some(ImageAction::Replace(page, hit));
-                ui.close();
-            }
-            if ui.add_enabled(raster, egui::Button::new(tl!("Save Image As…"))).clicked() {
-                *action = Some(ImageAction::Save(page, hit));
-                ui.close();
-            }
-            // Copying also finds the picture inside grouped Form artwork.
-            if ui.button(tl!("Copy Image")).clicked() {
-                *action = Some(ImageAction::Copy(page, hit));
-                ui.close();
-            }
-            if ui.button(tl!("Copy Image in Original Format")).clicked() {
-                *action = Some(ImageAction::CopyFile(page, hit));
-                ui.close();
-            }
-            ui.separator();
-            if ui.button(tl!("Delete")).clicked() {
-                view.image_selection = None;
-                view.pending_edit = Some(Edit::EditPageImage { page, index: hit, change: E::Delete });
-                ui.close();
-            }
-        });
+    if resp.secondary_clicked() {
+        ui.ctx().data_mut(|d| d.insert_temp(menu_key, true));
+    }
+    if selected == Some(hit) && !menu_drawn {
+        resp.context_menu(|ui| image_menu(ui, page, hit, images, view, action));
     }
     true
 }
 
+/// The right-click menu of the picture `hit` (its rotate, flip, replace, copy, cut, redact, link,
+/// recognize and delete items).
+fn image_menu(
+    ui: &mut egui::Ui,
+    page: usize,
+    hit: usize,
+    images: &[pdfcraft_engine::PageImage],
+    view: &mut DocView,
+    action: &mut Option<ImageAction>,
+) {
+    use pdfcraft_engine::ImageEdit as E;
+    let items: [(&str, Option<E>); 4] = [
+        (tl!("Rotate Clockwise"), Some(E::Rotate(1))),
+        (tl!("Rotate Counterclockwise"), Some(E::Rotate(3))),
+        (tl!("Flip Horizontal"), Some(E::Flip { horizontal: true })),
+        (tl!("Flip Vertical"), Some(E::Flip { horizontal: false })),
+    ];
+    for (label, change) in items {
+        if ui.button(label).clicked() {
+            view.pending_edit = change.map(|c| Edit::EditPageImage { page, index: hit, change: c });
+            ui.close();
+        }
+    }
+    // Crop: the handles trim instead of resizing until Done.
+    if ui.button(tl!("Crop Image")).clicked() {
+        if let (Some(s), Some(im)) = (view.image_selection.as_mut(), images.get(hit)) {
+            s.crop = Some(CropMode::new(im.visible_rect.unwrap_or(im.rect)));
+        }
+        ui.close();
+    }
+    let cropped = images.get(hit).is_some_and(|im| im.visible_rect.is_some_and(|v| v.iter().zip(im.rect.iter()).any(|(a, b)| (a - b).abs() > 0.01)));
+    if ui.add_enabled(cropped, egui::Button::new(tl!("Remove Crop"))).clicked() {
+        if let Some(im) = images.get(hit) {
+            view.pending_edit = Some(Edit::EditPageImage { page, index: hit, change: E::Crop(im.rect) });
+        }
+        ui.close();
+    }
+    let raster = images.get(hit).is_some_and(|image| !image.is_form);
+    if ui.add_enabled(raster, egui::Button::new(tl!("Replace Image…"))).clicked() {
+        *action = Some(ImageAction::Replace(page, hit));
+        ui.close();
+    }
+    if ui.add_enabled(raster, egui::Button::new(tl!("Save Image As…"))).clicked() {
+        *action = Some(ImageAction::Save(page, hit));
+        ui.close();
+    }
+    // Cutting and copying also find the picture inside grouped Form artwork.
+    if ui.button(tl!("Cut Image")).clicked() {
+        *action = Some(ImageAction::Cut(page, hit));
+        ui.close();
+    }
+    if ui.button(tl!("Copy Image")).clicked() {
+        *action = Some(ImageAction::Copy(page, hit));
+        ui.close();
+    }
+    if ui.button(tl!("Copy Image in Original Format")).clicked() {
+        *action = Some(ImageAction::CopyFile(page, hit));
+        ui.close();
+    }
+    ui.separator();
+    if ui.button(tl!("Redact Image")).clicked() {
+        *action = Some(ImageAction::Redact(page, hit));
+        ui.close();
+    }
+    if ui.button(tl!("Create Link…")).clicked() {
+        *action = Some(ImageAction::Link(page, hit));
+        ui.close();
+    }
+    if ui.button(tl!("Recognize Text…")).clicked() {
+        *action = Some(ImageAction::Recognize(page));
+        ui.close();
+    }
+    ui.separator();
+    if ui.button(tl!("Delete")).clicked() {
+        view.image_selection = None;
+        view.pending_edit = Some(Edit::EditPageImage { page, index: hit, change: E::Delete });
+        ui.close();
+    }
+}
+
+/// Open `block` on `page` in the inline editor. The box's geometry and source are read from the
+/// `lines` handed in, so callers pass the document's current inventory.
+#[allow(clippy::too_many_arguments)]
+fn open_editor(
+    ui: &egui::Ui,
+    xf: &PageXform,
+    doc: &pdfcraft_engine::Document,
+    lines: &[pdfcraft_engine::TextBlock],
+    boxes: &[Rect],
+    page: usize,
+    block: usize,
+    view: &mut DocView,
+) {
+    view.pending_text_open = None;
+    let (Some(l), Some(b)) = (lines.get(block), boxes.get(block)) else { return };
+    view.image_selection = None;
+    let source_lines = doc.text_lines(page);
+    let text = l.editor_text.clone();
+    // Screen pixels per point, from the box's width.
+    let scale = (b.width() - 4.0) / ((l.rect[2] - l.rect[0]).max(1.0) as f32);
+    // How far the editor box may grow: a single-line paragraph's rewrite grows to the
+    // page's right edge, a multi-line paragraph rewraps to its own width.
+    let right = xf.rect.right().min(view.viewport_rect().right()) - 6.0;
+    let max_width = if l.rows.len() == 1 { (right - b.left()).max(b.width()) } else { b.width() };
+    view.line_editor = Some(LineEditor {
+        selection: None,
+        font_resource: None,
+        page,
+        block,
+        text: text.clone(),
+        original: text,
+        rect: *b,
+        source_rect: l.rect.map(|v| v as f32),
+        multiline: l.rows.len() > 1,
+        source: Some((l.clone(), source_lines)),
+        fonts: install_source_fonts(ui.ctx(), doc, page),
+        overflow: false,
+        max_width,
+        size: (l.size as f32 * scale).clamp(8.0, 72.0),
+        focus: true,
+        look: look_of(l),
+        look0: look_of(l),
+        extras: Extras::default(),
+        extras0: Extras::default(),
+    });
+}
+
 /// Lines and their screen boxes for a page; hover outlines, click opens the editor. Returns
 /// `true` when the pointer was used.
 #[allow(clippy::too_many_arguments)]
@@ -645,6 +996,15 @@ pub(crate) fn page_input(
             painter.rect_stroke(*b, CornerRadius::same(2), Stroke::new(0.75, ACCENT.gamma_multiply(0.35)), egui::StrokeKind::Outside);
         }
     }
+    // A box a switching click asked for opens now, once the edit queued with that click has
+    // applied and `lines`/`boxes` are the document's new inventory (#2022).
+    if allow_interaction
+        && active.is_none()
+        && let Some((open_page, block)) = view.pending_text_open
+        && open_page == page
+    {
+        open_editor(ui, xf, doc, lines, &boxes, page, block, view);
+    }
     if !allow_interaction {
         return false;
     }
@@ -672,7 +1032,7 @@ pub(crate) fn page_input(
         if resizing {
             draw_handles(preview);
         }
-        ui.ctx().set_cursor_icon(if resizing { egui::CursorIcon::ResizeHorizontal } else { egui::CursorIcon::Grabbing });
+        ui.ctx().set_cursor_icon(if resizing { egui::CursorIcon::ResizeHorizontal } else { egui::CursorIcon::Move });
         if resp.drag_stopped() || !ui.input(|i| i.pointer.any_down()) {
             view.block_drag = None;
             let (from, to) = (user_box(xf, info, page, b), user_box(xf, info, page, preview));
@@ -720,39 +1080,35 @@ pub(crate) fn page_input(
     if upright && active.is_none() {
         draw_handles(boxes[hit]);
     }
-    ui.ctx().set_cursor_icon(if on_edge { egui::CursorIcon::ResizeHorizontal } else { egui::CursorIcon::Text });
+    // A closed paragraph moves when dragged (the four-way arrow says so; a click still opens it
+    // for typing); an edge rewraps it. The open one takes the text cursor.
+    ui.ctx().set_cursor_icon(if on_edge {
+        egui::CursorIcon::ResizeHorizontal
+    } else if active.is_none() {
+        egui::CursorIcon::Move
+    } else {
+        egui::CursorIcon::Text
+    });
     if resp.clicked() {
         view.image_selection = None;
-        let l = &lines[hit];
-        let source_lines = doc.text_lines(page);
-        let text = l.editor_text.clone();
-        // Screen pixels per point, from the box's width.
-        let scale = (boxes[hit].width() - 4.0) / ((l.rect[2] - l.rect[0]).max(1.0) as f32);
-        // How far the editor box may grow: a single-line paragraph's rewrite grows to the
-        // page's right edge, a multi-line paragraph rewraps to its own width.
-        let right = xf.rect.right().min(view.viewport_rect().right()) - 6.0;
-        let max_width = if l.rows.len() == 1 { (right - boxes[hit].left()).max(boxes[hit].width()) } else { boxes[hit].width() };
-        view.line_editor = Some(LineEditor {
-            selection: None,
-            font_resource: None,
-            page,
-            block: hit,
-            text: text.clone(),
-            original: text,
-            rect: boxes[hit],
-            source_rect: l.rect.map(|v| v as f32),
-            multiline: l.rows.len() > 1,
-            source: Some((l.clone(), source_lines)),
-            fonts: install_source_fonts(ui.ctx(), doc, page),
-            overflow: false,
-            max_width,
-            size: (l.size as f32 * scale).clamp(8.0, 72.0),
-            focus: true,
-            look: look_of(l),
-            look0: look_of(l),
-            extras: Extras::default(),
-            extras0: Extras::default(),
-        });
+        // A click that moves the editor to another paragraph applies the open one first, so its
+        // typed text is not dropped with the switched-away editor (#2022). A click on the open
+        // box's own frame, which the editor's overlay does not cover, keeps it open instead.
+        if let Some(open) = view.line_editor.as_ref().filter(|e| e.has_changes()) {
+            if open.page == page && open.block == hit {
+                return true;
+            }
+            if let Some(old) = view.line_editor.take() {
+                let style = old.style();
+                if old.text != old.original || style != pdfcraft_engine::BlockStyle::default() {
+                    view.pending_edit = Some(Edit::EditTextBlock { page: old.page, block: old.block, text: old.text, style });
+                }
+            }
+            // The clicked box opens next frame, from the document with that edit applied.
+            view.pending_text_open = Some((page, hit));
+            return true;
+        }
+        open_editor(ui, xf, doc, lines, &boxes, page, hit, view);
     }
     true
 }
@@ -983,7 +1339,7 @@ pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo) -
             // extent: single rows grow toward the page edge, paragraphs rewrap at their
             // source width, and the visible frame grows/shrinks vertically with their rows.
             // An OCR phrase (several stretched words on one scanned line) also grows rightwards.
-            let single_run = ed.source.as_ref().is_some_and(|(block, _)| block.lines.len() == 1 || block.invisible);
+            let single_run = ed.source.as_ref().is_some_and(|(block, _)| block.rows.len() == 1 || block.invisible);
             let width = if !ed.multiline && single_run && !ed.text.contains('\n') && ed.has_changes() {
                 let job = editor_job(ui, ed, &ed.text, scale, f32::INFINITY);
                 let natural = ui.fonts_mut(|f| f.layout_job(job)).size().x;
@@ -999,6 +1355,14 @@ pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo) -
             // can differ from the PDF's. Keep every visible row inside the growing frame.
             let live = draft_rect.map_or(visible, |bounds| bounds.union(visible));
             ui.painter().rect_stroke(live.expand(2.0), CornerRadius::ZERO, Stroke::new(1.5, ACCENT), egui::StrokeKind::Outside);
+            // On the frame, a press takes hold of the box (a click selects it, a drag moves it):
+            // the pointer says so there, and reads as text inside.
+            if let Some(p) = ui.input(|i| i.pointer.hover_pos())
+                && live.expand(2.0 + FRAME_REACH).contains(p)
+                && !live.expand(2.0).contains(p)
+            {
+                ui.ctx().set_cursor_icon(egui::CursorIcon::Move);
+            }
             // White, unless the text is too pale to read on white (white text from a coloured
             // banner, #913): then a dark box, with a caret that shows on it.
             let fill = if background_ready { Color32::TRANSPARENT } else { editor_fill(text_color) };
@@ -1053,18 +1417,23 @@ pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo) -
     match done {
         Some(apply) => {
             let ed = view.line_editor.take()?;
-            let style = ed.style();
-            (apply && (ed.text != ed.original || style != pdfcraft_engine::BlockStyle::default())).then_some(Edit::EditTextBlock {
-                page: ed.page,
-                block: ed.block,
-                text: ed.text,
-                style,
-            })
+            if apply { finished_edit(ed) } else { None }
         }
         None => None,
     }
 }
 
+/// The edit a closed paragraph editor applies, or `None` when nothing in it changed.
+pub(crate) fn finished_edit(ed: LineEditor) -> Option<Edit> {
+    let style = ed.style();
+    (ed.text != ed.original || style != pdfcraft_engine::BlockStyle::default()).then_some(Edit::EditTextBlock {
+        page: ed.page,
+        block: ed.block,
+        text: ed.text,
+        style,
+    })
+}
+
 /// Caret colour that stays visible on a field filled with `fill`: black on light fills, white on dark ones.
 pub(crate) fn caret_color_on(fill: Color32) -> Color32 {
     let luma = 299 * u32::from(fill.r()) + 587 * u32::from(fill.g()) + 114 * u32::from(fill.b());
@@ -1075,15 +1444,13 @@ pub(crate) fn caret_color_on(fill: Color32) -> Color32 {
 mod tests {
     use super::*;
 
-    #[test]
-    fn text_background_is_cached_without_editing_and_released_on_cancel() {
+    /// An app with one text document open, and an editor on its first paragraph.
+    fn preview_app() -> (crate::PdfCraftApp, LineEditor) {
         let mut app = crate::PdfCraftApp::new();
         let bytes = app.session.create_from_text("Preview", "Preview text").unwrap();
         app.open_bytes("preview.pdf", None, bytes.as_ref().clone()).unwrap();
         let doc = app.session.get(app.views[0].id).unwrap();
         let block = doc.text_blocks(0).remove(0);
-        let source = doc.bytes.clone();
-        let generation = doc.edit_generation();
         let ed = LineEditor {
             selection: None,
             font_resource: None,
@@ -1105,10 +1472,19 @@ mod tests {
             extras: Extras::default(),
             extras0: Extras::default(),
         };
+        (app, ed)
+    }
+
+    #[test]
+    fn text_background_is_cached_without_editing_and_released_on_cancel() {
+        let (app, ed) = preview_app();
+        let doc = app.session.get(app.views[0].id).unwrap();
+        let source = doc.bytes.clone();
+        let generation = doc.edit_generation();
         let ctx = egui::Context::default();
         let mut background = TextBackground::default();
         for _ in 0..100 {
-            background.prepare(&ctx, doc, Some(&ed), 1.0);
+            background.prepare(&ctx, doc, Some(&ed), None, 1.0);
             if background.ready(0, 0) {
                 break;
             }
@@ -1117,15 +1493,39 @@ mod tests {
         assert!(background.ready(0, 0));
         assert!(!background.pending());
         let texture = background.texture.as_ref().unwrap().id();
-        background.prepare(&ctx, doc, Some(&ed), 1.0);
+        background.prepare(&ctx, doc, Some(&ed), None, 1.0);
         assert_eq!(background.texture.as_ref().unwrap().id(), texture);
         assert_eq!(doc.bytes, source);
         assert_eq!(doc.edit_generation(), generation);
         assert!(!doc.dirty && doc.can_undo().is_none());
-        background.prepare(&ctx, doc, None, 1.0);
+        background.prepare(&ctx, doc, None, None, 1.0);
         assert!(background.texture.is_none() && background.renderer.is_none());
     }
 
+    #[test]
+    fn the_editing_background_stays_sharp_on_a_zoomed_page() {
+        // While a paragraph is open, the page around it is drawn from this one raster: it is
+        // asked for at the tiling threshold, not the 2048-pixel backdrop side, which went soft
+        // beyond about 1.2x on a Retina display.
+        let (app, ed) = preview_app();
+        let doc = app.session.get(app.views[0].id).unwrap();
+        let page = &doc.info.pages[0];
+        let ctx = egui::Context::default();
+        ctx.begin_pass(egui::RawInput { max_texture_side: Some(16384), ..Default::default() });
+        let mut background = TextBackground::default();
+        background.prepare(&ctx, doc, Some(&ed), None, 8.0);
+        let expected = 8.0f32.min(crate::canvas::TILE_THRESHOLD / page.width.max(page.height));
+        assert!(expected > crate::canvas::BASE_SIDE / page.width.max(page.height), "the test page needs the larger side");
+        assert_eq!(background.tag, Some((expected * 1000.0) as u64));
+        // A GPU that can't hold such a texture caps it.
+        ctx.end_pass().textures_delta.clear();
+        ctx.begin_pass(egui::RawInput { max_texture_side: Some(2048), ..Default::default() });
+        let mut small = TextBackground::default();
+        small.prepare(&ctx, doc, Some(&ed), None, 8.0);
+        assert_eq!(small.tag, Some(((2048.0 / page.width.max(page.height)) * 1000.0) as u64));
+        ctx.end_pass().textures_delta.clear();
+    }
+
     #[test]
     fn pale_text_is_edited_on_a_dark_box() {
         // #913: white text from a coloured banner was typed onto a white box and vanished.
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index dc7226ef6..be1347d68 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -2,7 +2,7 @@
 //! "save changes?" prompt when closing a tab or quitting with unsaved edits.
 
 use pdfcraft_engine::Edit;
-use pdfcraft_platform::staging::{StagingName, create_staging, staging_suffixes};
+use pdfcraft_platform::staging::{StagingName, staging_suffixes};
 
 use crate::PdfCraftApp;
 
@@ -18,6 +18,16 @@ pub enum CloseRequest {
     All,
 }
 
+/// A save held back by [`Dialog::OverwriteChanged`](crate::Dialog::OverwriteChanged): the file
+/// on disk is another version than the document came from (#2166).
+#[cfg(not(target_arch = "wasm32"))]
+pub struct PendingOverwrite {
+    pub id: pdfcraft_engine::DocId,
+    pub dest: String,
+    /// What was to run once the document is written (close its tab, quit).
+    after: Box<dyn FnOnce(&mut PdfCraftApp) + Send>,
+}
+
 /// Where Save writes.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum SaveTarget {
@@ -42,6 +52,10 @@ impl PdfCraftApp {
                 let Some(doc) = self.session.get(id) else { return true };
                 let info = &doc.info;
                 let view = &mut self.views[i];
+                if !matches!(edit, Edit::AddAnnotation(_)) {
+                    // Only a new drawing waits on its raster; any other edit may remove or move it.
+                    view.comments.settling.clear();
+                }
                 view.signature_drag.committed(&edit, doc.edit_generation());
                 view.move_background.committed(&edit, doc.edit_generation());
                 if let Some(page) = comment_page(&edit).or_else(|| content_page(&edit)) {
@@ -158,6 +172,13 @@ impl PdfCraftApp {
 
     /// Undo the last change: to the Combine files list while its tab shows, else the document.
     pub fn undo(&mut self) {
+        // While a polygon, cloud or run of connected lines is being drawn, Undo takes back its
+        // last point instead of the last finished edit.
+        if let Some((i, _)) = self.active_ids()
+            && self.views[i].comments.undo_point()
+        {
+            return;
+        }
         if self.combine_showing() {
             self.combine_history_step(true);
         } else {
@@ -509,7 +530,8 @@ impl PdfCraftApp {
             return true;
         }
         let author = self.comment_prefs.author.clone();
-        let edit = crate::fill_sign::typed(tb.page, tb.at, &text, tb.size, &author);
+        let rotation = self.session.get(id).map_or(0, |doc| crate::comments::page_rotation(&doc.info, tb.page));
+        let edit = crate::fill_sign::typed(tb.page, tb.at, &text, tb.size, rotation, &author);
         if self.apply_edit(edit) {
             if let Some(view) = self.views.get_mut(i) {
                 view.fill_text = None;
@@ -592,18 +614,12 @@ impl PdfCraftApp {
                     let dialog = rfd::AsyncFileDialog::new().add_filter("PDF", &["pdf"]).set_file_name(name);
                     // The bytes are taken once the user has chosen, so edits made meanwhile are saved too.
                     self.ask_one(crate::pickers::Ask::Save(dialog), None, move |app, dest| {
-                        if app.save_doc_to(id, &dest.to_string_lossy()) {
-                            after(app);
-                        }
+                        app.save_doc_to_then(id, &dest.to_string_lossy(), Box::new(after));
                     });
                     return false;
                 }
             };
-            let saved = self.save_doc_to(id, &destination);
-            if saved {
-                after(self);
-            }
-            saved
+            self.save_doc_to_then(id, &destination, Box::new(after))
         }
         #[cfg(target_arch = "wasm32")]
         {
@@ -652,6 +668,44 @@ impl PdfCraftApp {
         }
     }
 
+    /// [`Self::save_doc_to`], then `after`. When `dest` is the document's own file and it is
+    /// another version on disk than the one the document came from (something else wrote it
+    /// since the open or the last save, #2166), it asks first: the save waits in
+    /// `pending_overwrite` behind [`Dialog::OverwriteChanged`](crate::Dialog::OverwriteChanged).
+    /// Returns `true` if written now.
+    #[cfg(not(target_arch = "wasm32"))]
+    fn save_doc_to_then(&mut self, id: pdfcraft_engine::DocId, dest: &str, after: Box<dyn FnOnce(&mut Self) + Send>) -> bool {
+        let own = self.session.get(id).and_then(|d| d.path.as_deref()).is_some_and(|p| crate::same_file(p, dest));
+        if own && self.watch.disk_differs(id, dest) {
+            self.pending_overwrite = Some(PendingOverwrite { id, dest: dest.to_string(), after });
+            self.dialog = Some(crate::Dialog::OverwriteChanged);
+            return false;
+        }
+        let saved = self.save_doc_to(id, dest);
+        if saved {
+            after(self);
+        }
+        saved
+    }
+
+    /// The dialog's Save anyway: write over the changed file.
+    #[cfg(not(target_arch = "wasm32"))]
+    pub(crate) fn overwrite_changed_file(&mut self) {
+        let Some(p) = self.pending_overwrite.take() else { return };
+        if self.save_doc_to(p.id, &p.dest) {
+            (p.after)(self);
+        }
+    }
+
+    /// The dialog's Save as…: leave the file on disk as it is and ask where to put this version.
+    #[cfg(not(target_arch = "wasm32"))]
+    pub(crate) fn save_changed_file_elsewhere(&mut self) {
+        let Some(p) = self.pending_overwrite.take() else { return };
+        if let Some(index) = self.views.iter().position(|v| v.id == p.id) {
+            self.save_then(index, SaveTarget::As, p.after);
+        }
+    }
+
     /// Write document `id` to `dest` and make it the document's file. Returns `true` if written.
     #[cfg(not(target_arch = "wasm32"))]
     fn save_doc_to(&mut self, id: pdfcraft_engine::DocId, dest: &str) -> bool {
@@ -835,6 +889,17 @@ impl PdfCraftApp {
 
     /// Intercept window close while documents have unsaved changes.
     pub(crate) fn guard_quit(&mut self, ctx: &egui::Context) {
+        // egui's default quit shortcut ignores extra Alt/Shift, including Ctrl+Alt+Q for '@'.
+        ctx.options_mut(|o| o.quit_shortcuts.clear());
+        let shortcut = ctx.input(|i| {
+            i.events.iter().any(|e| {
+                matches!(e, egui::Event::Key { key: egui::Key::Q, pressed: true, modifiers, .. }
+                    if modifiers.matches_exact(egui::Modifiers::COMMAND))
+            })
+        });
+        if shortcut {
+            self.request_quit(ctx);
+        }
         self.sync_unsaved_flag();
         if !ctx.input(|i| i.viewport().close_requested()) {
             return;
@@ -878,6 +943,7 @@ fn comment_page(edit: &Edit) -> Option<usize> {
         | Edit::ResizeAnnotation { page, .. }
         | Edit::StyleAnnotation { page, .. }
         | Edit::FillAnnotation { page, .. }
+        | Edit::FontSizeAnnotation { page, .. }
         | Edit::SetAnnotationInfo { page, .. } => Some(*page),
         _ => None,
     }
@@ -927,48 +993,15 @@ fn write_atomically_with(path: &str, bytes: &[u8], suffixes: impl IntoIterator<I
 }
 
 /// [`write_atomically_with`], flushing the staging file with `sync_all` (the standard library's
-/// in the app, a failing one in tests).
+/// in the app, a failing one in tests). The writer itself is the platform crate's, shared with
+/// the tools and the CLI (#2166); the desktop app keeps its staging-name form.
 fn write_atomically_syncing(
     path: &str,
     bytes: &[u8],
     suffixes: impl IntoIterator<Item = u64>,
     sync_all: impl FnOnce(&std::fs::File) -> std::io::Result<()>,
 ) -> std::io::Result<()> {
-    use std::io::Write;
-    let target = std::path::Path::new(path);
-    let dir = target.parent().filter(|d| !d.as_os_str().is_empty()).unwrap_or(std::path::Path::new("."));
-    let name = target.file_name().and_then(|n| n.to_str()).unwrap_or("save");
-    let (tmp, f) = create_staging(dir, name, StagingName::TagThenSuffix, suffixes)?;
-    let result = (|| {
-        // Closed at the end of the block, before the rename.
-        {
-            let mut f = f;
-            f.write_all(bytes)?;
-            sync_staged(&f, sync_all)?;
-        }
-        std::fs::rename(&tmp, target)
-    })();
-    if result.is_err() {
-        let _ = std::fs::remove_file(&tmp);
-    }
-    result
-}
-
-/// Flush the staging file to the disk before it replaces the original. On macOS `sync_all` asks
-/// for a full flush (`F_FULLFSYNC`), which SMB and FUSE volumes, such as a mounted Cryptomator
-/// vault, refuse as unsupported: there a plain `fsync` is the strongest flush the volume offers.
-/// Any other failure still fails the save.
-fn sync_staged(f: &std::fs::File, sync_all: impl FnOnce(&std::fs::File) -> std::io::Result<()>) -> std::io::Result<()> {
-    #[cfg(target_os = "macos")]
-    {
-        use rustix::io::Errno;
-        match sync_all(f) {
-            Err(e) if matches!(Errno::from_io_error(&e), Some(Errno::NOTSUP | Errno::NOTTY)) => Ok(rustix::fs::fsync(f)?),
-            other => other,
-        }
-    }
-    #[cfg(not(target_os = "macos"))]
-    sync_all(f)
+    pdfcraft_platform::staging::write_atomically_with(std::path::Path::new(path), bytes, StagingName::TagThenSuffix, suffixes, sync_all)
 }
 
 #[cfg(not(target_arch = "wasm32"))]
@@ -1341,6 +1374,7 @@ mod revert_draft_tests {
             picked: Vec::new(),
             request_focus: false,
             select_all: false,
+            press: None,
             calendar: None,
             calendar_rect: None,
         }
diff --git a/crates/ui-egui/src/export_ui.rs b/crates/ui-egui/src/export_ui.rs
index bc6f353a1..fae075e30 100644
--- a/crates/ui-egui/src/export_ui.rs
+++ b/crates/ui-egui/src/export_ui.rs
@@ -153,7 +153,7 @@ fn run(
             Err(e) => return crate::i18n::fmt(tl!("Export stopped: {e}"), &[("e", &e.to_string())]),
         };
         for (k, img) in out.images.iter().enumerate() {
-            if let Err(e) = sink(&pdfcraft_engine::export::image_file_name(&stem, img, k + 1), img.data.clone()) {
+            if let Err(e) = sink(&pdfcraft_engine::export::image_file_name(&stem, img, k + 1, src.pages), img.data.clone()) {
                 return crate::i18n::fmt(tl!("Export stopped: {e}"), &[("e", &e.to_string())]);
             }
         }
diff --git a/crates/ui-egui/src/file_watch.rs b/crates/ui-egui/src/file_watch.rs
index e0e653e0e..533842d7e 100644
--- a/crates/ui-egui/src/file_watch.rs
+++ b/crates/ui-egui/src/file_watch.rs
@@ -247,6 +247,10 @@ pub struct FileWatch {
     inline: Watcher,
     /// The version of each document's file that PdfCraft last read or wrote.
     known: HashMap<DocId, Stamp>,
+    /// The version each document came from (its open, reload or last save). Unlike `known`,
+    /// a version found on disk and not applied (the document had unsaved changes) is not
+    /// recorded here, so Save can tell that the file is not the one the document came from.
+    basis: HashMap<DocId, Stamp>,
     /// How many times PdfCraft has read or written each document's file: a version the watcher
     /// found before the latest one is older than the document in memory, and is not applied
     /// (#1802).
@@ -259,20 +263,29 @@ impl FileWatch {
     /// PdfCraft read or wrote `path` for `doc`: that version is not a change, and anything the
     /// watcher found before it is stale.
     pub fn known_now(&mut self, doc: DocId, path: &str) {
-        if let Some(stamp) = Stamp::at(path) {
-            self.known.insert(doc, stamp);
-        }
-        self.bump(doc);
+        self.known_as(doc, Stamp::at(path));
     }
 
     /// Remember `stamp`, read before the file was, for `doc`.
     pub fn known_as(&mut self, doc: DocId, stamp: Option<Stamp>) {
         if let Some(stamp) = stamp {
             self.known.insert(doc, stamp);
+            self.basis.insert(doc, stamp);
         }
         self.bump(doc);
     }
 
+    /// Whether the file at `path` is another version than the one `doc` came from: something
+    /// else wrote it since the document was opened, reloaded or last saved (#2166). A file
+    /// that is missing or can't be looked at, or a document whose version was never recorded,
+    /// is not a difference.
+    pub fn disk_differs(&self, doc: DocId, path: &str) -> bool {
+        match (Stamp::at(path), self.basis.get(&doc)) {
+            (Some(now), Some(basis)) => now != *basis,
+            _ => false,
+        }
+    }
+
     fn bump(&mut self, doc: DocId) {
         let epoch = self.epoch.entry(doc).or_default();
         *epoch = epoch.wrapping_add(1);
@@ -307,6 +320,7 @@ impl PdfCraftApp {
             let list: Vec<Watched> = self.watched().map(|(doc, path, known, epoch)| Watched { doc, path: path.to_owned(), known, epoch }).collect();
             let open: Vec<DocId> = self.views.iter().map(|v| v.id).collect();
             self.watch.known.retain(|doc, _| open.contains(doc));
+            self.watch.basis.retain(|doc, _| open.contains(doc));
             self.watch.epoch.retain(|doc, _| open.contains(doc));
             if self.send_to_watcher(list.clone()) {
                 self.watch.sent = list;
@@ -514,7 +528,12 @@ mod tests {
         let app = h.state_mut();
         app.views[0].select_pages(&[0]);
         app.apply_edit(pdfcraft_engine::Edit::RotatePages { pages: vec![0], degrees: 90 });
-        assert!(app.save_active(SaveTarget::InPlace), "saved version C");
+        // B is on disk, not the A the document came from: Save asks first (#2166), and the
+        // user saves C over it.
+        assert!(!app.save_active(SaveTarget::InPlace), "asks before writing over B");
+        app.overwrite_changed_file();
+        assert!(!doc(&h).dirty, "saved version C");
+        let app = h.state_mut();
         app.watch.found.lock().unwrap().extend(stale);
         h.run_steps(3);
         let d = doc(&h);
diff --git a/crates/ui-egui/src/files.rs b/crates/ui-egui/src/files.rs
index bbeb20727..23754e13e 100644
--- a/crates/ui-egui/src/files.rs
+++ b/crates/ui-egui/src/files.rs
@@ -82,6 +82,11 @@ pub struct ReplaceDraft {
     pub from: usize,
     pub to: usize,
     pub src_from: usize,
+    /// The selection when the dialog opened (0-based). OK replaces these pages until the
+    /// original range is edited, so a gap between selected pages is left alone.
+    pub pages: Vec<usize>,
+    /// The user changed the original from/to range, so OK uses that span.
+    pub range_edited: bool,
     /// The document whose pages are replaced, as it was when the dialog opened: OK replaces
     /// nothing if another document is active by then (a file opened meanwhile), or it changed.
     pub(crate) target: Option<PickTarget>,
@@ -516,10 +521,10 @@ impl PdfCraftApp {
                 return;
             }
         };
-        let targets = self.views[i].target_pages();
-        let (from, to) = (targets.first().map_or(1, |p| p + 1), targets.last().map_or(1, |p| p + 1));
+        let pages = self.views[i].target_pages();
+        let (from, to) = (pages.first().map_or(1, |p| p + 1), pages.last().map_or(1, |p| p + 1));
         let target = self.pick_target(self.active_ids().map(|(_, id)| id));
-        self.replace_draft = Some(ReplaceDraft { name, bytes, src_pages, from, to, src_from: 1, target });
+        self.replace_draft = Some(ReplaceDraft { name, bytes, src_pages, from, to, src_from: 1, pages, range_edited: false, target });
         self.dialog = Some(crate::Dialog::ReplacePages);
     }
 
diff --git a/crates/ui-egui/src/fill_sign.rs b/crates/ui-egui/src/fill_sign.rs
index d1b5f0e59..794fe0bf1 100644
--- a/crates/ui-egui/src/fill_sign.rs
+++ b/crates/ui-egui/src/fill_sign.rs
@@ -103,6 +103,22 @@ impl SigDraft {
         }
     }
 
+    /// Take back the last drawn stroke (and any dot-less empty one a bare click left behind it).
+    /// Returns whether a visible stroke was removed.
+    pub fn undo_stroke(&mut self) -> bool {
+        while let Some(s) = self.strokes.pop() {
+            if s.len() > 1 {
+                return true;
+            }
+        }
+        false
+    }
+
+    /// The Draw tab is showing (not Type, Image or Scan).
+    fn draw_tab(&self) -> bool {
+        self.drawing && !self.image_mode && !self.scan_mode
+    }
+
     fn ready(&self) -> bool {
         if self.scan_mode {
             // A preview made while the frame or slider is still moving is not the result.
@@ -411,9 +427,10 @@ fn new(page: usize, shape: Shape, contents: String, author: &str) -> Edit {
     Edit::AddAnnotation(NewAnnotation { page, shape, style, contents, author: author.to_string() })
 }
 
-/// A typewriter annotation sized to its text.
-pub fn typed(page: usize, at: [f64; 2], text: &str, size: f64, author: &str) -> Edit {
-    let rect = crate::comments::text_box_rect(at, text, size);
+/// A typewriter annotation sized to its text, its displayed top-left at `at` on a page turned by
+/// `rotation` (its `/Rotate`).
+pub fn typed(page: usize, at: [f64; 2], text: &str, size: f64, rotation: i64, author: &str) -> Edit {
+    let rect = crate::comments::text_box_rect(at, text, size, rotation);
     new(page, Shape::Typewriter { rect, font_size: size }, text.to_string(), author)
 }
 
@@ -633,16 +650,20 @@ pub(crate) fn page_input(
     if !resp.clicked() {
         return None;
     }
+    // Typed text starts a little above the click, as displayed.
+    let rotation = i64::from(p.rotation);
+    let top = pdfcraft_engine::displayed_offset(rotation, at, 0.0, text_size * 0.6);
     match tool {
         FillTool::Text => {
             // Clicking away from an open box commits it: the page sees this click before the box
             // sees its lost focus, so replacing the box first would drop what was typed.
-            let open =
-                view.fill_text.replace(TypeBox { page, at: [at[0], at[1] + text_size * 0.6], text: String::new(), size: text_size, focus: true });
-            open.filter(|tb| !tb.text.trim().is_empty()).map(|tb| FillAction::Edit(Box::new(typed(tb.page, tb.at, tb.text.trim(), tb.size, author))))
+            let open = view.fill_text.replace(TypeBox { page, at: top, text: String::new(), size: text_size, focus: true });
+            open.filter(|tb| !tb.text.trim().is_empty()).map(|tb| {
+                FillAction::Edit(Box::new(typed(tb.page, tb.at, tb.text.trim(), tb.size, crate::comments::page_rotation(info, tb.page), author)))
+            })
         }
         FillTool::Date => Some(match date_text {
-            Ok(text) => FillAction::Edit(Box::new(typed(page, [at[0], at[1] + text_size * 0.6], text, text_size, author))),
+            Ok(text) => FillAction::Edit(Box::new(typed(page, top, text, text_size, rotation, author))),
             Err(why) => FillAction::Refused(why.clone()),
         }),
         FillTool::Signature => match signature {
@@ -719,7 +740,7 @@ pub(crate) fn type_box(ctx: &egui::Context, view: &mut DocView, info: &DocInfo,
     if commit {
         let tb = view.fill_text.take()?;
         if !tb.text.trim().is_empty() {
-            return Some(typed(tb.page, tb.at, tb.text.trim(), tb.size, author));
+            return Some(typed(tb.page, tb.at, tb.text.trim(), tb.size, crate::comments::page_rotation(info, tb.page), author));
         }
     }
     None
@@ -804,6 +825,11 @@ pub(crate) fn signature_pad(
         return (apply, cancel, false);
     }
     ui.label(egui::RichText::new(crate::i18n::fmt(tl!("Draw your {what} below."), &[("what", what)])).color(t.text_muted));
+    // The dialog is modal, so ⌘Z / Ctrl+Z here can only mean the last stroke (the document's own
+    // undo is blocked while it is open).
+    if ui.input_mut(|i| i.consume_key(egui::Modifiers::COMMAND, egui::Key::Z)) {
+        d.undo_stroke();
+    }
     let strokes = &mut d.strokes;
     let (rect, resp) = ui.allocate_exact_size(vec2(460.0, 150.0), Sense::drag());
     let painter = ui.painter_at(rect);
@@ -1027,6 +1053,9 @@ fn pad_buttons(ui: &mut egui::Ui, d: &mut SigDraft) -> (bool, bool) {
     ui.add_space(10.0);
     let (mut apply, mut cancel) = (false, false);
     ui.horizontal(|ui| {
+        if d.draw_tab() && ui.add_enabled(!d.strokes.is_empty(), egui::Button::new(tl!("Undo"))).clicked() {
+            d.undo_stroke();
+        }
         if ui.button(tl!("Clear")).clicked() {
             d.strokes.clear();
             d.text.clear();
@@ -1212,6 +1241,18 @@ impl crate::PdfCraftApp {
 
 #[cfg(test)]
 mod tests {
+    #[test]
+    fn undo_removes_the_last_stroke_and_skips_empty_ones() {
+        let mut d = super::SigDraft { drawing: true, ..Default::default() };
+        assert!(!d.undo_stroke());
+        d.strokes = vec![vec![[0.1, 0.1], [0.2, 0.2]], vec![[0.3, 0.3], [0.4, 0.4]], vec![[0.5, 0.5]], vec![]];
+        assert!(d.undo_stroke());
+        assert_eq!(d.strokes.len(), 1);
+        assert!(d.undo_stroke());
+        assert!(d.strokes.is_empty());
+        assert!(!d.undo_stroke());
+    }
+
     #[test]
     fn long_signature_previews_have_clear_margins() {
         for text in ["Alexandria Catherine Elizabeth Montgomery-Wellington", "Jg Jg Jg Jg Jg Jg Jg Jg Jg Jg Jg"] {
diff --git a/crates/ui-egui/src/fling.rs b/crates/ui-egui/src/fling.rs
new file mode 100644
index 000000000..cce004ce5
--- /dev/null
+++ b/crates/ui-egui/src/fling.rs
@@ -0,0 +1,276 @@
+//! Touchpad momentum (#531): a two-finger swipe keeps gliding after the fingers lift, and slows
+//! to a stop.
+//!
+//! Wayland compositors leave momentum to the client. libinput reports the swipe as pixel deltas
+//! (`MouseWheelUnit::Point`) and the lift as an axis stop, which winit passes on as
+//! `TouchPhase::End`; GTK and Firefox glide on from there, and so does the page view.
+//!
+//! macOS sends its own momentum as a second `Start`…`End`, so gliding there would glide twice,
+//! and the web has no touch phases: [`Fling::enabled`] is off on both. Windows and X11 report no
+//! touch phases through winit either, so no `End` ever starts a glide there.
+
+use egui::{Event, MouseWheelUnit, TouchPhase, Vec2};
+
+/// Seconds of the gesture the lift speed is measured over.
+const WINDOW: f64 = 0.1;
+/// A lift this long after the last motion is a finger that stopped first: no glide.
+const STILL: f64 = 0.05;
+/// The glide slows by `e` every this many seconds; it travels the lift speed times this.
+const TAU: f32 = 0.35;
+/// Below this speed (points per second) a lift doesn't glide, and a glide stops.
+const START_SPEED: f32 = 150.0;
+const STOP_SPEED: f32 = 10.0;
+/// Fastest glide, in points per second: a flick the system measured over a hiccup can't throw
+/// the document to its end.
+const MAX_SPEED: f32 = 8000.0;
+/// A pass this long after the last one (the view was hidden, the app stalled) ends a glide.
+const STALE: f64 = 0.1;
+
+pub(crate) struct Fling {
+    /// Whether a lift glides on this platform (see the module docs).
+    pub(crate) enabled: bool,
+    /// The gesture in progress: when each pass's motion arrived, and how far it went.
+    samples: Vec<(f64, Vec2)>,
+    /// The glide's speed in points per second (positive moves the content down), or zero.
+    velocity: Vec2,
+    /// When the glide last moved.
+    at: f64,
+    /// Passes in a row the glide moved the view not at all: it is against an edge.
+    stalled: u8,
+}
+
+impl Default for Fling {
+    fn default() -> Self {
+        Self::new(!cfg!(any(target_os = "macos", target_arch = "wasm32")))
+    }
+}
+
+impl Fling {
+    pub(crate) fn new(enabled: bool) -> Self {
+        Self { enabled, samples: Vec::new(), velocity: Vec2::ZERO, at: 0.0, stalled: 0 }
+    }
+
+    pub(crate) fn gliding(&self) -> bool {
+        self.velocity != Vec2::ZERO
+    }
+
+    pub(crate) fn stop(&mut self) {
+        self.velocity = Vec2::ZERO;
+        self.stalled = 0;
+    }
+
+    /// Reads one pass's wheel events, at time `now`. Any wheel input stops a glide; a touchpad
+    /// gesture's `End` may start one. `glide` is false where the view must not glide this pass
+    /// (animations off, single-page paging, a zoom, a dialog).
+    pub(crate) fn read(&mut self, events: &[Event], now: f64, glide: bool) {
+        for event in events {
+            let Event::MouseWheel { unit, delta, phase, modifiers } = event else { continue };
+            self.stop();
+            // Zooming, a mouse wheel and sideways Shift scrolling never glide.
+            if *unit != MouseWheelUnit::Point || modifiers.command || modifiers.ctrl || modifiers.shift {
+                self.samples.clear();
+                continue;
+            }
+            match phase {
+                TouchPhase::Start => {
+                    self.samples.clear();
+                    self.push(now, *delta);
+                }
+                TouchPhase::Move => self.push(now, *delta),
+                TouchPhase::End => {
+                    if glide && self.enabled {
+                        self.velocity = self.lift_velocity(now);
+                        self.at = now;
+                    }
+                    self.samples.clear();
+                }
+                TouchPhase::Cancel => self.samples.clear(),
+            }
+        }
+    }
+
+    fn push(&mut self, now: f64, delta: Vec2) {
+        if !(delta.x.is_finite() && delta.y.is_finite()) {
+            return;
+        }
+        match self.samples.last_mut() {
+            // Several events in one pass are one sample: they share its time.
+            Some((at, d)) if *at == now => *d += delta,
+            _ => self.samples.push((now, delta)),
+        }
+        self.samples.retain(|(at, _)| now - at <= WINDOW);
+    }
+
+    /// The finger's speed as it lifted at `now`, or zero when it should not glide.
+    fn lift_velocity(&self, now: f64) -> Vec2 {
+        let recent: Vec<&(f64, Vec2)> = self.samples.iter().filter(|(at, _)| now - at <= WINDOW).collect();
+        let (Some(first), Some(last)) = (recent.first(), recent.last()) else { return Vec2::ZERO };
+        let span = (last.0 - first.0) as f32;
+        if recent.len() < 2 || span <= 0.0 || now - last.0 > STILL {
+            return Vec2::ZERO;
+        }
+        // Each sample is the motion since the pass before it, so the first one's motion
+        // happened before the span starts.
+        let moved = recent.iter().skip(1).fold(Vec2::ZERO, |sum, (_, d)| sum + *d);
+        let v = moved / span;
+        if !(v.x.is_finite() && v.y.is_finite()) || v.length() < START_SPEED {
+            return Vec2::ZERO;
+        }
+        if v.length() > MAX_SPEED { v * (MAX_SPEED / v.length()) } else { v }
+    }
+
+    /// How far the glide moves the view in the pass at `now` (zero when not gliding), as the
+    /// exact distance a speed decaying with [`TAU`] covers since the last pass.
+    pub(crate) fn step(&mut self, now: f64) -> Vec2 {
+        if !self.gliding() {
+            return Vec2::ZERO;
+        }
+        let dt = now - self.at;
+        if !(0.0..=STALE).contains(&dt) {
+            self.stop();
+            return Vec2::ZERO;
+        }
+        self.at = now;
+        let decay = (-(dt as f32) / TAU).exp();
+        let moved = self.velocity * TAU * (1.0 - decay);
+        self.velocity *= decay;
+        if self.velocity.length() < STOP_SPEED {
+            self.stop();
+        }
+        moved
+    }
+
+    /// After a pass the glide moved the view in: whether the offset changed. Two passes that
+    /// didn't move it mean an edge, and the glide ends there.
+    pub(crate) fn moved(&mut self, moved: bool) {
+        if moved {
+            self.stalled = 0;
+        } else {
+            self.stalled = self.stalled.saturating_add(1);
+            if self.stalled >= 2 {
+                self.stop();
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use egui::{Modifiers, vec2};
+
+    fn wheel(dy: f32, phase: TouchPhase) -> Event {
+        Event::MouseWheel { unit: MouseWheelUnit::Point, delta: vec2(0.0, dy), phase, modifiers: Modifiers::NONE }
+    }
+
+    /// A swipe of `moves` passes of `dy` each, 60 per second, lifted the pass after the last.
+    fn swipe(fling: &mut Fling, dy: f32, moves: usize) -> f64 {
+        let dt = 1.0 / 60.0;
+        let mut now = 0.0;
+        fling.read(&[wheel(dy, TouchPhase::Start)], now, true);
+        for _ in 0..moves {
+            now += dt;
+            fling.read(&[wheel(dy, TouchPhase::Move)], now, true);
+        }
+        now += dt;
+        fling.read(&[wheel(0.0, TouchPhase::End)], now, true);
+        now
+    }
+
+    #[test]
+    fn a_flick_glides_on_at_its_lift_speed_and_stops() {
+        let mut fling = Fling::new(true);
+        let mut now = swipe(&mut fling, -25.0, 6);
+        assert!(fling.gliding());
+        // 25 points a pass at 60 passes a second.
+        assert!((fling.velocity.y + 1500.0).abs() < 1.0, "{:?}", fling.velocity);
+        let mut travelled = 0.0;
+        let mut passes = 0;
+        while fling.gliding() {
+            now += 1.0 / 60.0;
+            let d = fling.step(now);
+            assert!(d.y <= 0.0 && d.x == 0.0, "keeps the swipe's direction: {d:?}");
+            travelled += d.y;
+            passes += 1;
+            assert!(passes < 600, "the glide ends");
+        }
+        // Speed × TAU, less the tail under STOP_SPEED.
+        assert!((-travelled - 1500.0 * TAU).abs() < 10.0, "travelled {travelled}");
+        assert_eq!(fling.step(now + 1.0 / 60.0), Vec2::ZERO);
+    }
+
+    #[test]
+    fn a_slow_drag_or_a_pause_before_lifting_does_not_glide() {
+        let mut fling = Fling::new(true);
+        swipe(&mut fling, -1.0, 6);
+        assert!(!fling.gliding(), "60 points a second is below the start speed");
+
+        let mut fling = Fling::new(true);
+        let dt = 1.0 / 60.0;
+        fling.read(&[wheel(-25.0, TouchPhase::Start)], 0.0, true);
+        fling.read(&[wheel(-25.0, TouchPhase::Move)], dt, true);
+        fling.read(&[wheel(0.0, TouchPhase::End)], dt + 0.2, true);
+        assert!(!fling.gliding(), "the finger rested before it lifted");
+    }
+
+    #[test]
+    fn new_input_stops_a_glide() {
+        let mut fling = Fling::new(true);
+        let now = swipe(&mut fling, -25.0, 6);
+        fling.read(&[wheel(-2.0, TouchPhase::Start)], now + 0.1, true);
+        assert!(!fling.gliding(), "fingers back on the touchpad");
+
+        let mut fling = Fling::new(true);
+        let now = swipe(&mut fling, -25.0, 6);
+        let notch = Event::MouseWheel { unit: MouseWheelUnit::Line, delta: vec2(0.0, -1.0), phase: TouchPhase::Move, modifiers: Modifiers::NONE };
+        fling.read(&[notch], now + 0.1, true);
+        assert!(!fling.gliding(), "a wheel notch");
+    }
+
+    #[test]
+    fn no_glide_where_it_is_off_or_not_wanted() {
+        let mut off = Fling::new(false);
+        swipe(&mut off, -25.0, 6);
+        assert!(!off.gliding(), "macOS and the web glide by themselves or not at all");
+
+        let mut fling = Fling::new(true);
+        let dt = 1.0 / 60.0;
+        fling.read(&[wheel(-25.0, TouchPhase::Start)], 0.0, true);
+        fling.read(&[wheel(-25.0, TouchPhase::Move)], dt, true);
+        fling.read(&[wheel(-25.0, TouchPhase::Move)], 2.0 * dt, true);
+        fling.read(&[wheel(0.0, TouchPhase::End)], 3.0 * dt, false);
+        assert!(!fling.gliding(), "animations off, paging or a dialog");
+
+        let mut zoom = Fling::new(true);
+        let ctrl = |phase| Event::MouseWheel { unit: MouseWheelUnit::Point, delta: vec2(0.0, -25.0), phase, modifiers: Modifiers::COMMAND };
+        zoom.read(&[ctrl(TouchPhase::Start)], 0.0, true);
+        zoom.read(&[ctrl(TouchPhase::Move)], dt, true);
+        zoom.read(&[ctrl(TouchPhase::Move)], 2.0 * dt, true);
+        zoom.read(&[ctrl(TouchPhase::End)], 3.0 * dt, true);
+        assert!(!zoom.gliding(), "a pinch or ⌘/Ctrl swipe zooms");
+    }
+
+    #[test]
+    fn an_edge_a_stall_or_a_wild_speed_ends_or_caps_the_glide() {
+        let mut fling = Fling::new(true);
+        let now = swipe(&mut fling, -25.0, 6);
+        fling.step(now + 1.0 / 60.0);
+        fling.moved(false);
+        assert!(fling.gliding(), "one pass may not show the move yet");
+        fling.moved(false);
+        assert!(!fling.gliding(), "against the edge");
+
+        let mut fling = Fling::new(true);
+        let now = swipe(&mut fling, -25.0, 6);
+        assert_eq!(fling.step(now + 1.0), Vec2::ZERO, "a second-long gap (the tab was hidden)");
+        assert!(!fling.gliding());
+
+        let mut fling = Fling::new(true);
+        swipe(&mut fling, -5000.0, 6);
+        assert!((fling.velocity.length() - MAX_SPEED).abs() < 1.0, "{:?}", fling.velocity);
+
+        let mut fling = Fling::new(true);
+        swipe(&mut fling, f32::NAN, 6);
+        assert!(!fling.gliding(), "a speed that isn't a number");
+    }
+}
diff --git a/crates/ui-egui/src/forms_ui.rs b/crates/ui-egui/src/forms_ui.rs
index 339389b18..8020e868b 100644
--- a/crates/ui-egui/src/forms_ui.rs
+++ b/crates/ui-egui/src/forms_ui.rs
@@ -1,18 +1,19 @@
 //! Filling in forms on the page (execution plan M6; Acrobat fills fields in every viewing mode).
 //!
 //! Text fields open an in-place editor over the widget (Enter or clicking away commits, Escape
-//! cancels, Tab moves to the next field). Check boxes and radio buttons toggle on click. Combo
-//! and list boxes open a list of their options. Every change is one undoable engine edit.
+//! cancels, Tab moves to the next field). Check boxes and radio buttons toggle on click. List
+//! boxes are directly selectable in-place on the page (clicking picks an option; Ctrl-click
+//! toggles on multi-select lists). Combo boxes open a list of their options. Every change is one
+//! undoable engine edit.
 
 use std::collections::HashSet;
 
 use egui::{Color32, CornerRadius, Rect, Stroke, vec2};
-use pdfcraft_engine::{Edit, FieldValue, FormField, FormFieldKind, FormWidget, field_flags};
+use pdfcraft_engine::{Edit, FieldValue, FormField, FormFieldKind, FormWidget, field_flags, form_appearance};
 use pdfcraft_render::DocInfo;
 
 use crate::canvas::{DocView, PageXform};
 use crate::theme::Tokens;
-use crate::widgets;
 
 const FOCUS_BLUE: Color32 = Color32::from_rgb(0x14, 0x73, 0xE6);
 /// Background of the in-place text field editor, the same in every theme.
@@ -31,6 +32,9 @@ pub struct Focus {
     pub request_focus: bool,
     /// Select the whole value when the editor opens (entered with Tab), so typing replaces it.
     pub select_all: bool,
+    /// Where the press that opened the editor landed: the editor puts its caret there and takes
+    /// over the drag, so press-and-drag selects text in a field that was not focused (#2213).
+    pub press: Option<egui::Pos2>,
     /// Date fields: the month the calendar shows (year, month 1–12), and where it was drawn.
     pub calendar: Option<(i32, u32)>,
     pub calendar_rect: Option<egui::Rect>,
@@ -42,6 +46,10 @@ pub struct FormView {
     /// The draft whose edit is queued (`DocView::pending_edit`): if the field refuses the value,
     /// the editor reopens with it rather than losing the typing.
     pub(crate) committed: Option<Focus>,
+    /// A press on a text field committed the field before it (#2213). Until the button is
+    /// released, that field losing focus to the same gesture must not commit it again: a
+    /// refused value would be validated (and alerted) twice.
+    pub(crate) pressed: bool,
     /// Fields modified by the user whose appearance stream has not been rasterized by the render worker yet.
     /// Tracked as (field_name, page_index) so committed edits stay immediately visible without flicker.
     pub unbaked: HashSet<(String, usize)>,
@@ -79,12 +87,26 @@ fn open_focus(f: &FormField, widget: usize) -> Focus {
         picked: f.value.clone(),
         request_focus: true,
         select_all: false,
+        press: None,
         calendar: None,
         calendar_rect: None,
     }
 }
 
-/// Clicks on form widgets of one page. Returns `true` when the click belongs to a field.
+/// Where the pointer is relative to one page's form widgets.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum FieldPointer {
+    /// Not over a field.
+    Away,
+    /// Over a field, which has set the cursor. Nothing is pressed, so the layers below still see
+    /// the hover, but they must not replace the cursor: a check box drawn with a glyph, or set
+    /// on printed text, is a button, not text to select.
+    Over,
+    /// The field owns the press or click.
+    Owned,
+}
+
+/// Clicks on form widgets of one page.
 #[allow(clippy::too_many_arguments)]
 pub(crate) fn page_input(
     ui: &egui::Ui,
@@ -95,9 +117,9 @@ pub(crate) fn page_input(
     form: &[FormField],
     allowed: bool,
     view: &mut DocView,
-) -> bool {
+) -> FieldPointer {
     let pointer = ui.input(|i| i.pointer.hover_pos());
-    let Some(p) = pointer.filter(|p| xf.rect.contains(*p)) else { return false };
+    let Some(p) = pointer.filter(|p| xf.rect.contains(*p)) else { return FieldPointer::Away };
     let hit = form.iter().find_map(|f| {
         f.widgets
             .iter()
@@ -105,7 +127,7 @@ pub(crate) fn page_input(
             .find(|(_, w)| w.page == Some(page) && !w.hidden && widget_rect(xf, info, page, w.rect).contains(p))
             .map(|(i, w)| (f, i, w))
     });
-    let Some((f, wi, w)) = hit else { return false };
+    let Some((f, wi, w)) = hit else { return FieldPointer::Away };
     // Empty signature fields are signed by clicking them (Use a certificate); push buttons run
     // their action.
     let pressable = f.kind == FormFieldKind::PushButton && !f.read_only() && f.button.is_some();
@@ -115,12 +137,20 @@ pub(crate) fn page_input(
         (true, FormFieldKind::Text) => egui::CursorIcon::Text,
         _ => egui::CursorIcon::PointingHand,
     });
+    // A text field opens on the press rather than the click, so a drag that starts on it
+    // selects its text (#2213).
+    let pressed = f.kind == FormFieldKind::Text && usable && resp.is_pointer_button_down_on() && ui.input(|i| i.pointer.primary_pressed());
+    if pressed && view.forms.focus.as_ref().is_none_or(|x| x.name != f.name || x.widget != wi) {
+        commit(view, form);
+        view.forms.focus = Some(Focus { press: Some(p), ..open_focus(f, wi) });
+        view.forms.pressed = true;
+    }
     if !resp.clicked() {
-        return resp.is_pointer_button_down_on();
+        return if resp.is_pointer_button_down_on() { FieldPointer::Owned } else { FieldPointer::Over };
     }
     if !allowed {
         view.forms.notice = Some(FormNotice::Security);
-        return true;
+        return FieldPointer::Owned;
     }
     match f.kind {
         _ if f.read_only() => view.forms.notice = Some(FormNotice::ReadOnly(f.name.clone())),
@@ -142,14 +172,60 @@ pub(crate) fn page_input(
                 view.pending_edit = Some(Edit::SetFieldValue { name: f.name.clone(), value: FieldValue::Radio(value) });
             }
         }
-        FormFieldKind::Text | FormFieldKind::Combo | FormFieldKind::List => {
+        // The press already committed the previous field and opened this one (above), unless
+        // press and release came in one frame. Committing again would re-run a validation that
+        // refused the value on the press.
+        FormFieldKind::Text if !ui.input(|i| i.pointer.primary_pressed()) => {
+            // An editor opened by the press cannot be hit until a frame has laid it out: the
+            // release lands on the page and would take its focus away.
+            if let Some(x) = view.forms.focus.as_mut().filter(|x| x.name == f.name && x.widget == wi) {
+                x.request_focus = true;
+            }
+        }
+        FormFieldKind::Text | FormFieldKind::Combo => {
             if view.forms.focus.as_ref().is_none_or(|x| x.name != f.name || x.widget != wi) {
                 commit(view, form);
                 view.forms.focus = Some(open_focus(f, wi));
             }
         }
+        FormFieldKind::List => {
+            commit(view, form);
+            view.forms.focus = Some(open_focus(f, wi));
+            let r = widget_rect(xf, info, page, w.rect);
+            let height_pt = if matches!(w.rotation, 90 | 270) { (w.rect[2] - w.rect[0]).max(1.0) } else { (w.rect[3] - w.rect[1]).max(1.0) };
+            let zoom = (r.height() as f64) / height_pt;
+            let y_pt = (p.y - r.min.y) as f64 / zoom;
+            let rows = w.list.unwrap_or(form_appearance::ListRows { top: 0, inset: 2.0, row: 12.0 * 1.15, size: 12.0 });
+            let picked_indices: Vec<usize> = f.value.iter().filter_map(|v| f.options.iter().position(|(e, _)| e == v)).collect();
+            let top = form_appearance::ListRows::top_showing(rows.top, &picked_indices, rows.visible(height_pt), f.options.len());
+            if let Some(opt_idx) = rows.option_at(top, y_pt).filter(|&i| i < f.options.len()) {
+                let export = &f.options[opt_idx].0;
+                let ctrl = ui.input(|i| i.modifiers.command || i.modifiers.ctrl);
+                let shift = ui.input(|i| i.modifiers.shift);
+                let multi = f.has(field_flags::MULTI_SELECT);
+                let new_value = if multi && ctrl {
+                    let mut picked = f.value.clone();
+                    if let Some(pos) = picked.iter().position(|x| x == export) {
+                        picked.remove(pos);
+                    } else {
+                        picked.push(export.clone());
+                    }
+                    FieldValue::Choice(picked)
+                } else if multi && shift && !f.value.is_empty() {
+                    let anchor = f.value.last().and_then(|last| f.options.iter().position(|(e, _)| e == last)).unwrap_or(opt_idx);
+                    let (min, max) = (anchor.min(opt_idx), anchor.max(opt_idx));
+                    let picked = f.options[min..=max].iter().map(|(e, _)| e.clone()).collect();
+                    FieldValue::Choice(picked)
+                } else {
+                    FieldValue::Choice(vec![export.clone()])
+                };
+                if new_value != FieldValue::Choice(f.value.clone()) {
+                    view.pending_edit = Some(Edit::SetFieldValue { name: f.name.clone(), value: new_value });
+                }
+            }
+        }
     }
-    true
+    FieldPointer::Owned
 }
 
 /// The edit the focused field's draft makes, if it differs from the field's value.
@@ -157,7 +233,6 @@ pub(crate) fn draft_edit(focus: &Focus, form: &[FormField]) -> Option<Edit> {
     let f = form.iter().find(|f| f.name == focus.name)?;
     let value = match f.kind {
         FormFieldKind::Text if f.value.first().map(String::as_str).unwrap_or("") != focus.text => FieldValue::Text(focus.text.clone()),
-        FormFieldKind::List if f.has(field_flags::MULTI_SELECT) && focus.picked != f.value => FieldValue::Choice(focus.picked.clone()),
         _ => return None,
     };
     Some(Edit::SetFieldValue { name: f.name.clone(), value })
@@ -270,35 +345,55 @@ pub(crate) fn paint_page(ui: &egui::Ui, painter: &egui::Painter, xf: &PageXform,
             let focused = view.forms.focus.as_ref().is_some_and(|x| x.name == f.name && x.widget == wi);
             if focused {
                 painter.rect_stroke(r.expand(1.0), CornerRadius::same(2), Stroke::new(2.0, FOCUS_BLUE), egui::StrokeKind::Outside);
-            } else {
-                if view.forms.unbaked.contains(&(f.name.clone(), page)) {
-                    paint_unbaked_widget(painter, xf, f, w, r);
-                }
-                if fillable(f) && pointer.is_some_and(|p| r.contains(p)) {
-                    painter.rect_stroke(r, CornerRadius::same(1), Stroke::new(1.0, FOCUS_BLUE.gamma_multiply(0.8)), egui::StrokeKind::Outside);
-                }
+            }
+            if view.forms.unbaked.contains(&(f.name.clone(), page)) {
+                paint_unbaked_widget(painter, xf, f, w, r);
+            } else if fillable(f) && pointer.is_some_and(|p| r.contains(p)) {
+                painter.rect_stroke(r, CornerRadius::same(1), Stroke::new(1.0, FOCUS_BLUE.gamma_multiply(0.8)), egui::StrokeKind::Outside);
             }
         }
     }
 }
 
+/// The size, in points, a text field shows `text` at on screen: its `/DA` size, or for auto size
+/// (`0 Tf`) the page appearance's fit, measured in the font the screen draws with so the text
+/// stays inside the box (the interface font runs wider than the page's Helvetica).
+pub fn field_text_size(painter: &egui::Painter, f: &FormField, w: &FormWidget, text: &str) -> f32 {
+    let da = f.da.split_whitespace().collect::<Vec<_>>();
+    let fixed = da
+        .iter()
+        .position(|x| *x == "Tf")
+        .and_then(|i| i.checked_sub(1))
+        .and_then(|i| da.get(i))
+        .and_then(|s| s.parse::<f64>().ok())
+        .filter(|s| s.is_finite() && *s > 0.0);
+    let size = fixed.unwrap_or_else(|| {
+        // The appearance's padding: 2 pt inside a 1 pt border.
+        let pad = 3.0;
+        let (width, height) = ((w.rect[2] - w.rect[0]).abs() - 2.0 * pad, (w.rect[3] - w.rect[1]).abs() - 2.0 * pad);
+        // Comb cells hold one character each, so only the height limits them.
+        let comb = f.has(field_flags::COMB) && f.max_len.is_some_and(|m| m > 0);
+        let fit = if comb { "" } else { text };
+        let font = |size: f64| egui::FontId::proportional(size as f32);
+        let line_width = |size: f64| f64::from(painter.layout_no_wrap(fit.to_string(), font(size), Color32::BLACK).size().x);
+        // Wrapped as the editor and the page preview wrap it.
+        let wrap = width.max(1.0) as f32;
+        let wrapped_height = |size: f64| f64::from(painter.layout(fit.to_string(), font(size), Color32::BLACK, wrap).size().y);
+        pdfcraft_engine::field_auto_text_size_by(width, height, f.has(field_flags::MULTILINE), line_width, wrapped_height)
+    });
+    size.min(300.0) as f32
+}
+
 fn paint_unbaked_widget(painter: &egui::Painter, xf: &PageXform, f: &FormField, w: &FormWidget, r: Rect) {
     match f.kind {
-        FormFieldKind::Text | FormFieldKind::Combo | FormFieldKind::List => {
+        FormFieldKind::Text | FormFieldKind::Combo => {
             let text = f.value.first().map(String::as_str).unwrap_or("");
             painter.rect_filled(r, CornerRadius::same(1), Color32::from_rgb(0xFF, 0xFF, 0xF4));
             painter.rect_stroke(r, CornerRadius::same(1), Stroke::new(1.0, Color32::from_gray(180)), egui::StrokeKind::Inside);
             if !text.is_empty() {
                 let unrotated_w = if xf.rot % 180 == 90 { xf.ph } else { xf.pw };
                 let zoom = xf.rect.width() / unrotated_w.max(1.0);
-                let da = f.da.split_whitespace().collect::<Vec<_>>();
-                let size = da
-                    .iter()
-                    .position(|x| *x == "Tf")
-                    .and_then(|i| da.get(i.wrapping_sub(1)))
-                    .and_then(|s| s.parse::<f32>().ok())
-                    .filter(|s| *s > 0.0);
-                let font_size = (size.unwrap_or(((w.rect[3] - w.rect[1]) as f32 * 0.6).clamp(6.0, 12.0)) * zoom).clamp(6.0, 64.0);
+                let font_size = (field_text_size(painter, f, w, text) * zoom).clamp(3.0, 64.0);
                 let display_text = if f.has(field_flags::PASSWORD) { "•".repeat(text.chars().count()) } else { text.to_string() };
                 let p = painter.with_clip_rect(r);
                 let (align, pos) = match f.quadding {
@@ -306,7 +401,43 @@ fn paint_unbaked_widget(painter: &egui::Painter, xf: &PageXform, f: &FormField,
                     2 => (egui::Align2::RIGHT_TOP, egui::pos2(r.max.x - 3.0, r.min.y + 1.0)),
                     _ => (egui::Align2::LEFT_TOP, egui::pos2(r.min.x + 3.0, r.min.y + 1.0)),
                 };
-                p.text(pos, align, display_text, egui::FontId::proportional(font_size), Color32::BLACK);
+                // Multiline fields wrap at the box, as their page appearance does.
+                // At the width the size was fitted to: the box less 3 pt each side, scaled.
+                let wrap = if f.has(field_flags::MULTILINE) { (r.width() - 6.0 * zoom).max(1.0) } else { f32::INFINITY };
+                let galley = p.layout(display_text, egui::FontId::proportional(font_size), Color32::BLACK, wrap);
+                p.galley(align.anchor_size(pos, galley.size()).min, galley, Color32::BLACK);
+            }
+        }
+        FormFieldKind::List => {
+            painter.rect_filled(r, CornerRadius::same(1), Color32::from_rgb(0xFF, 0xFF, 0xF4));
+            painter.rect_stroke(r, CornerRadius::same(1), Stroke::new(1.0, Color32::from_gray(180)), egui::StrokeKind::Inside);
+            let unrotated_w = if xf.rot % 180 == 90 { xf.ph } else { xf.pw };
+            let zoom = (xf.rect.width() / unrotated_w.max(1.0)) as f64;
+            let rows = w.list.unwrap_or(form_appearance::ListRows { top: 0, inset: 2.0, row: 12.0 * 1.15, size: 12.0 });
+            let height_pt = if matches!(w.rotation, 90 | 270) { (w.rect[2] - w.rect[0]).max(1.0) } else { (w.rect[3] - w.rect[1]).max(1.0) };
+            let picked_indices: Vec<usize> = f.value.iter().filter_map(|v| f.options.iter().position(|(e, _)| e == v)).collect();
+            let top = form_appearance::ListRows::top_showing(rows.top, &picked_indices, rows.visible(height_pt), f.options.len());
+            let font_size = (rows.size * zoom).clamp(6.0, 64.0) as f32;
+            let row_h = (rows.row * zoom) as f32;
+            let inset = (rows.inset * zoom) as f32;
+            let p = painter.with_clip_rect(r);
+            let mut y = r.min.y + inset;
+            for (export, display) in f.options.iter().skip(top) {
+                if y + row_h > r.max.y {
+                    break;
+                }
+                let row_rect = Rect::from_min_size(egui::pos2(r.min.x + 1.0, y), egui::vec2(r.width() - 2.0, row_h));
+                if f.value.contains(export) {
+                    p.rect_filled(row_rect, CornerRadius::ZERO, Color32::from_rgb(0x99, 0xC0, 0xDC));
+                }
+                p.text(
+                    egui::pos2(r.min.x + 3.0, y + font_size * 0.15),
+                    egui::Align2::LEFT_TOP,
+                    display,
+                    egui::FontId::proportional(font_size),
+                    Color32::BLACK,
+                );
+                y += row_h;
             }
         }
         FormFieldKind::CheckBox => {
@@ -333,6 +464,10 @@ fn paint_unbaked_widget(painter: &egui::Painter, xf: &PageXform, f: &FormField,
 
 /// The in-place editor or option list for the focused field. Returns an edit to apply.
 pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, form: &[FormField], today: (i64, u32, u32)) -> Option<Edit> {
+    let pressed = view.forms.pressed;
+    if !ctx.input(|i| i.pointer.primary_down()) {
+        view.forms.pressed = false;
+    }
     let focus = view.forms.focus.clone()?;
     let Some(f) = form.iter().find(|f| f.name == focus.name) else {
         view.forms.focus = None;
@@ -349,19 +484,19 @@ pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, f
     let mut next: Option<bool> = None; // Tab / Shift+Tab
     match f.kind {
         FormFieldKind::Text => {
-            let da = f.da.split_whitespace().collect::<Vec<_>>();
-            let size =
-                da.iter().position(|x| *x == "Tf").and_then(|i| da.get(i.wrapping_sub(1))).and_then(|s| s.parse::<f32>().ok()).filter(|s| *s > 0.0);
             let multiline = f.has(field_flags::MULTILINE);
-            let font = (size.unwrap_or(((w.rect[3] - w.rect[1]) as f32 * 0.6).clamp(6.0, 12.0)) * zoom).clamp(6.0, 64.0);
             egui::Area::new(egui::Id::new(("form-editor", view.id.0))).order(egui::Order::Foreground).fixed_pos(rect.min).show(ctx, |ui| {
                 ui.set_min_size(rect.size());
                 let Some(fx) = view.forms.focus.as_mut() else { return };
+                // Sized from the text being typed, so an auto-sized field shrinks to keep it in view.
+                let font = (field_text_size(ui.painter(), f, w, &fx.text) * zoom).clamp(3.0, 64.0);
                 // The field is pale yellow in every theme, so the caret must not follow the theme (pale in dark mode) (#655).
                 ui.visuals_mut().text_cursor.stroke.color = crate::edit_text_ui::caret_color_on(FIELD_FILL);
                 let mut te = if multiline { egui::TextEdit::multiline(&mut fx.text) } else { egui::TextEdit::singleline(&mut fx.text) };
                 te = te
-                    .desired_width(rect.width() - 6.0)
+                    // Wraps (inside the 3 px side margins) at the width the size was fitted to:
+                    // the box less 3 pt each side, scaled.
+                    .desired_width((rect.width() - 6.0 * zoom + 6.0).max(1.0))
                     .font(egui::FontId::proportional(font))
                     .background_color(FIELD_FILL)
                     .text_color(Color32::BLACK)
@@ -374,7 +509,24 @@ pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, f
                 if multiline {
                     te = te.desired_rows(((rect.height() / (font * 1.3)).floor() as usize).max(1));
                 }
-                let r = ui.add_sized(rect.size(), te);
+                let mut laid_out = None;
+                let r = ui.add_sized(rect.size(), |ui: &mut egui::Ui| {
+                    let out = te.show(ui);
+                    laid_out = Some((out.galley, out.galley_pos));
+                    out.response.response
+                });
+                if let Some(press) = fx.press.take()
+                    && let Some((galley, pos)) = laid_out
+                    && let Some(mut st) = egui::TextEdit::load_state(ui.ctx(), r.id)
+                {
+                    // The press went to the page, not to this editor, which did not exist yet.
+                    let at = galley.cursor_from_pos(press - pos + vec2(galley.rect.left(), 0.0));
+                    st.cursor.set_char_range(Some(egui::text::CCursorRange::one(at)));
+                    st.store(ui.ctx(), r.id);
+                    if ui.input(|i| i.pointer.primary_down()) {
+                        ui.ctx().set_dragged_id(r.id);
+                    }
+                }
                 if fx.request_focus {
                     r.request_focus();
                     fx.request_focus = false;
@@ -396,8 +548,13 @@ pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, f
                     && (!multiline || !enter)
                     && !fx.calendar_rect.is_some_and(|c| ui.input(|i| i.pointer.interact_pos().is_some_and(|p| c.contains(p))))
                 {
-                    // Enter in a single-line field, or clicking elsewhere, commits.
-                    commit(view, form);
+                    if pressed {
+                        // The field reopened with a refused value; keep it open and focused.
+                        fx.request_focus = true;
+                    } else {
+                        // Enter in a single-line field, or clicking elsewhere, commits.
+                        commit(view, form);
+                    }
                 }
             });
             // Date fields: a calendar under the field (Acrobat's date picker).
@@ -411,8 +568,7 @@ pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, f
                 return view.pending_edit.take();
             }
         }
-        FormFieldKind::Combo | FormFieldKind::List => {
-            let multi = f.kind == FormFieldKind::List && f.has(field_flags::MULTI_SELECT);
+        FormFieldKind::Combo => {
             let resp = egui::Area::new(egui::Id::new(("form-choices", view.id.0)))
                 .order(egui::Order::Foreground)
                 .fixed_pos(rect.left_bottom() + vec2(0.0, 2.0))
@@ -421,27 +577,14 @@ pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, f
                         ui.set_min_width(rect.width().max(160.0));
                         ui.label(egui::RichText::new(&f.name).small().color(t.text_faint));
                         egui::ScrollArea::vertical().max_height(260.0).show(ui, |ui| {
-                            let Some(fx) = view.forms.focus.as_mut() else { return };
                             for (export, display) in &f.options {
-                                let on = if multi { fx.picked.contains(export) } else { f.value.first() == Some(export) };
-                                if multi {
-                                    let mut c = on;
-                                    if ui.add(widgets::checkbox(&mut c, display)).changed() {
-                                        if c {
-                                            fx.picked.push(export.clone());
-                                        } else {
-                                            fx.picked.retain(|x| x != export);
-                                        }
-                                    }
-                                } else if ui.selectable_label(on, display).clicked() {
+                                let on = f.value.first() == Some(export);
+                                if ui.selectable_label(on, display).clicked() {
                                     edit = Some(Edit::SetFieldValue { name: f.name.clone(), value: FieldValue::Choice(vec![export.clone()]) });
                                     close = true;
                                 }
                             }
                         });
-                        if multi && ui.button(tl!("Done")).clicked() {
-                            commit(view, form);
-                        }
                     });
                 });
             let clicked_away = ctx.input(|i| i.pointer.any_click())
@@ -454,6 +597,35 @@ pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, f
                 next = Some(!shift);
             } else if clicked_away {
                 commit(view, form);
+                close = true;
+            }
+        }
+        FormFieldKind::List => {
+            let (up, down, esc, tab, shift) = ctx.input_mut(|i| {
+                (
+                    // Consumed, so the arrows move the selection without also scrolling the page.
+                    i.consume_key(egui::Modifiers::NONE, egui::Key::ArrowUp),
+                    i.consume_key(egui::Modifiers::NONE, egui::Key::ArrowDown),
+                    i.key_pressed(egui::Key::Escape),
+                    i.key_pressed(egui::Key::Tab),
+                    i.modifiers.shift,
+                )
+            });
+            if esc {
+                close = true;
+            } else if tab {
+                next = Some(!shift);
+            } else if (up || down) && !f.options.is_empty() {
+                let current_idx = f.value.last().and_then(|v| f.options.iter().position(|(e, _)| e == v)).unwrap_or(0);
+                let next_idx = if up { current_idx.saturating_sub(1) } else { (current_idx + 1).min(f.options.len().saturating_sub(1)) };
+                if next_idx != current_idx && next_idx < f.options.len() {
+                    let export = f.options[next_idx].0.clone();
+                    edit = Some(Edit::SetFieldValue { name: f.name.clone(), value: FieldValue::Choice(vec![export]) });
+                }
+            }
+            let clicked_away = ctx.input(|i| i.pointer.any_click()) && !ctx.input(|i| i.pointer.hover_pos()).is_some_and(|p| rect.contains(p));
+            if clicked_away {
+                close = true;
             }
         }
         _ => close = true,
diff --git a/crates/ui-egui/src/i18n/ar.tsv b/crates/ui-egui/src/i18n/ar.tsv
index a8c7d5382..01bb1679e 100644
--- a/crates/ui-egui/src/i18n/ar.tsv
+++ b/crates/ui-egui/src/i18n/ar.tsv
@@ -34,6 +34,7 @@
 	Auto follows the system's text size. Pages always render at the display's full resolution.	يتبع الوضع التلقائي حجم النص في النظام. تُعرض الصفحات دائمًا بالدقة الكاملة للشاشة.
 	Identity	الهوية
 	Name on new comments	الاسم على التعليقات الجديدة
+	Hide hover previews for highlights without comment text	إخفاء معاينات التمرير للتظليلات التي لا تحتوي على نص تعليق
 	Open…	فتح…
 	Open Recent	فتح الملفات الأخيرة
 	Pin folder to Home…	تثبيت مجلد في الصفحة الرئيسية…
@@ -370,6 +371,7 @@
 	Split	تقسيم
 	More	المزيد
 	Set page boxes	ضبط مربعات الصفحة
+	Set page transitions	تعيين انتقالات الصفحات
 	Page labels	تسميات الصفحات
 	Page transitions	انتقالات الصفحات
 	Add comments	إضافة تعليقات
@@ -582,6 +584,7 @@
 	Remove unused objects and merge identical ones	إزالة الكائنات غير المستخدمة ودمج المتطابقة
 	Audit space usage…	تدقيق استخدام المساحة…
 	Space Audit	تدقيق المساحة
+	What takes up the space in this file, by kind of content.	ما الذي يشغل المساحة في هذا الملف، حسب نوع المحتوى.
 	Bytes	بايت
 	Content Streams	تدفقات المحتوى
 	X Object Forms	نماذج X Object
@@ -855,6 +858,12 @@
 	Windows store  ·  	مخزن Windows  ·  
 	Issued by: 	صادرة عن: 
 	, Expires: 	، تنتهي: 
+	Digitally signed by	موقع رقميا من
+	DN: 	DN: 
+	Reason: 	السبب: 
+	Location: 	الموقع: 
+	Date: 	التاريخ: 
+	The labels are in English: the signature's font can't draw them in this language.	التسميات بالإنجليزية: لا يستطيع خط التوقيع رسمها بهذه اللغة.
 	No digital IDs yet.	لا توجد معرّفات رقمية بعد.
 	Configure New Digital ID	إعداد معرّف رقمي جديد
 	Remove "{name}" from this list? The file itself is not deleted.	إزالة "{name}" من هذه القائمة؟ لن يُحذف الملف نفسه.
@@ -1146,6 +1155,7 @@
 	Redaction code:	رمز الحجب:
 	Font:	الخط:
 	Font size:	حجم الخط:
+	Font size	حجم الخط
 	Auto-size text to fit redaction region	تحجيم النص تلقائيًا ليلائم منطقة الحجب
 	Font colour:	لون الخط:
 	Repeat overlay text	تكرار نص التراكب
@@ -1286,6 +1296,7 @@
 	Copy text	نسخ النص
 	Properties…	خصائص…
 	Make Current Properties Default	جعل الخصائص الحالية افتراضية
+	Make Properties Default	جعل الخصائص افتراضية
 	More options	خيارات أخرى
 	Sort by	فرز حسب
 	Author	المؤلف
@@ -1407,6 +1418,9 @@
 	Sort comments by:	فرز التعليقات حسب:
 	Create PDF Comment Summary	إنشاء ملخص تعليقات PDF
 	Revert to the previously saved version of “{name}”? Changes since then can't be undone afterwards.	هل تريد الرجوع إلى آخر نسخة محفوظة من «{name}»؟ لا يمكن التراجع بعدها عن التغييرات التي أُجريت منذ ذلك الحين.
+	Save over the changed file?	الحفظ فوق الملف الذي تغيّر؟
+	“{name}” changed on disk after it was opened or last saved. Saving now replaces that newer version with this one.	تغيّر «{name}» على القرص بعد فتحه أو حفظه آخر مرة. الحفظ الآن يستبدل تلك النسخة الأحدث بهذه.
+	Save anyway	الحفظ على أي حال
 	Number pages	ترقيم الصفحات
 	Style	النمط
 	None (prefix only)	لا شيء (البادئة فقط)
@@ -1603,6 +1617,8 @@
 	Sent to {printer}	أُرسل إلى {printer}
 	Sent to {printer}: {msg}	أُرسل إلى {printer}: {msg}
 	Looking for printers…	جارٍ البحث عن الطابعات…
+	Sending sheet {s} of {n} to {printer}…	جارٍ إرسال الورقة {s} من {n} إلى {printer}…
+	No printers were found. Check that the printer is installed and the print spooler is running, then open Print again.	لم يُعثر على أي طابعة. تحقّق من أن الطابعة مثبّتة وأن خدمة التخزين المؤقت للطباعة تعمل، ثم افتح «طباعة» مرة أخرى.
 	Sending to {printer}…	جارٍ الإرسال إلى {printer}…
 	Choose a folder for the searchable files	اختر مجلدًا للملفات القابلة للبحث
 	Files are combined from top to bottom. Leave Pages empty to take every page.	تُدمج الملفات من الأعلى إلى الأسفل. اترك «الصفحات» فارغًا لأخذ كل الصفحات.
@@ -2263,6 +2279,8 @@ key	Space	مسافة
 	Switch to List view to change the pages it takes.	انتقل إلى عرض القائمة لتغيير الصفحات التي يأخذها.
 	Expand all	توسيع الكل
 	Collapse all	طي الكل
+	Collapse all pages	طي كل الصفحات
+	Expand all pages	توسيع كل الصفحات
 	Remove page	إزالة الصفحة
 	Remove {n} pages	إزالة {n} صفحات
 
@@ -2281,14 +2299,14 @@ key	Space	مسافة
 	Printer paper and scaling may differ. Check driver settings.	قد يختلف ورق الطابعة ومقياس الطباعة. تحقق من إعدادات برنامج التشغيل.
 	Drawing scale changes. Use Actual size for full-scale plans.	يتغير مقياس الرسم. استخدم الحجم الفعلي لطباعة المخططات بمقياسها الأصلي.
 	Reload documents when their files change on disk	إعادة تحميل المستندات عند تغيّر ملفاتها على القرص
-	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	تغيّر هذا الملف على القرص. أعد تحميله لعرض النسخة الجديدة؛ ستفقد تغييراتك غير المحفوظة.
+	This file changed on disk. Reload shows the new version and drops your unsaved changes; Save replaces it with this version.	تغيّر هذا الملف على القرص. «إعادة التحميل» تعرض النسخة الجديدة وتُسقط تغييراتك غير المحفوظة؛ و«حفظ» يستبدلها بهذه النسخة.
 	Reload	إعادة تحميل
 	Couldn't reload {name}: {e}	تعذّرت إعادة تحميل {name}: {e}
 	Select page {label}	تحديد الصفحة {label}
 	Rotate page {label} counterclockwise	تدوير الصفحة {label} عكس اتجاه عقارب الساعة
 	Rotate page {label} clockwise	تدوير الصفحة {label} باتجاه عقارب الساعة
 	Delete page {label}	حذف الصفحة {label}
-	Mouse wheel scroll speed	سرعة التمرير بعجلة الماوس
+	Scroll speed (mouse wheel and arrow keys)	سرعة التمرير (عجلة الفأرة ومفاتيح الأسهم)
 scroll speed	Slow	بطيئة
 scroll speed	Normal	عادية
 scroll speed	Fast	سريعة
@@ -2362,6 +2380,10 @@ animation effects	Off	معطّلة
 	The linked PDF opened, but its named destination was not applied.	فُتح ملف PDF المرتبط، لكن لم تُطبَّق وجهته المسماة.
 	The linked PDF opened, but its page destination was out of range.	فُتح ملف PDF المرتبط، لكن وجهة الصفحة خارج النطاق.
 	Local cross-PDF links require the desktop app	تتطلب الروابط المحلية بين ملفات PDF تطبيق سطح المكتب
+	Cut Image	قص الصورة
+	Redact Image	حجب الصورة
+	Create Link…	إنشاء رابط…
+	Recognize Text…	التعرف على النص…
 	Minimize	تصغير
 	Maximize	تكبير
 	Restore	استعادة
@@ -2371,7 +2393,316 @@ animation effects	Off	معطّلة
 # Absolute local GoToR confirmation (#1364).
 	Allow	السماح
 	Only allow this if you trust the source document.	لا تسمح بذلك إلا إذا كنت تثق بالمستند المصدر.
+	Open in Full Screen mode?	فتح في وضع ملء الشاشة؟
+	This document asks to open in Full Screen mode: the page fills the screen and nothing else shows. Press Esc at any time to leave it.	يطلب هذا المستند أن يُفتح في وضع ملء الشاشة: تملأ الصفحة الشاشة ولا يظهر شيء آخر. اضغط Esc في أي وقت للخروج منه.
+	Full Screen	ملء الشاشة
+	Not now	ليس الآن
 	Open this local PDF?	هل تريد فتح ملف PDF المحلي هذا؟
 	This document is trying to open a local file:	يحاول هذا المستند فتح ملف محلي:
 	Move tag earlier	نقل العلامة للأعلى
 	Move tag later	نقل العلامة للأسفل
+
+# Completion: the rows the newer catalogs (lt, cs, es …) grew — certificates,
+# digital-signature verification detail, accessibility checks, calendar weekdays
+# and the newer plural counts — same clean-room Arabic as the rest of the file.
+	 on page {label}	 في الصفحة {label}
+	A font isn't embedded	أحد الخطوط غير مدمج
+	A {} action isn't allowed	إجراء {} غير مسموح
+	A {} annotation has additional actions	للتعليق التوضيحي {} إجراءات إضافية
+	A {} annotation has no appearance stream	للتعليق التوضيحي {} بلا مظهر متدفق
+	A {} annotation isn't set to print, or is hidden	التعليق التوضيحي {} غير مضبوط للطباعة أو مخفي
+	Accessibility Report	تقرير الوصول
+	Add the PDFs to combine	أضف ملفات PDF للدمج
+	Added the first {n} PDFs in {folder}	أضيفت أول {n} ملف PDF في {folder}
+	Always	دائماً
+	Automatically	تلقائياً
+	CRL Signing	توقيع CRL
+	Certificate Signing	توقيع الشهادات
+	Change Author	تغيير المؤلف
+	Change Keywords	تغيير الكلمات المفتاحية
+	Change Subject	تغيير الموضوع
+	Change Title	تغيير العنوان
+	Choose a digital ID.	اختر معرّفاً رقمياً.
+	Choose a file…	اختيار ملف…
+	Choose a folder…	اختيار مجلد…
+	Choose…	اختيار…
+	Color	اللون
+	Comment	تعليق
+	Comment and review	التعليق والمراجعة
+	Copied to clipboard	نُسخ إلى الحافظة
+	Copy to clipboard	نسخ إلى الحافظة
+	Create folder	إنشاء مجلد
+	Create links	إنشاء ارتباطات
+	Creator	المنشئ
+	Cut and stack needs Two-sided: Off. Print single-sided sheets.	يحتاج القص والتكديس إلى «على الوجهين: إيقاف». اطبع أوراقاً أحادية الوجه.
+	Data Encipherment	تشفير البيانات
+	Decipher Only	فك التشفير فقط
+	Detailed Report	تقرير مفصل
+	DeviceCMYK is used, but the PDF/A output intent isn't a CMYK profile	يُستخدم DeviceCMYK، لكن غرض إخراج PDF/A ليس ملف CMYK
+	DeviceRGB is used, but the PDF/A output intent isn't an RGB profile	يُستخدم DeviceRGB، لكن غرض إخراج PDF/A ليس ملف RGB
+	Digital Signature	توقيع رقمي
+	Disabled	معطّل
+	Document properties (⌘D)	خصائص المستند (⌘D)
+	Drop PDFs or folders here, or choose them.	أفلت ملفات PDF أو المجلدات هنا، أو اخترها.
+	Duplicate	تكرار
+	Enabled	ممكّن
+	Encipher Only	التشفير فقط
+	English	إنجليزي
+	Enter a URL	أدخل URL
+	Enter a name.	أدخل اسماً.
+	Enter a page number	أدخل رقم صفحة
+	Enter the field names	أدخل أسماء الحقول
+	Error	خطأ
+	Every PDF in the folder	كل ملف PDF في المجلد
+	Every PDF in the folder and the folders inside it	كل ملف PDF في المجلد والمجلدات داخله
+	Field "{}" on page {p} has no description (tooltip)	الحقل "{}" في الصفحة {p} بلا وصف (تلميح)
+	Filename	اسم الملف
+	Flatten Fill & Sign	تسطيح التعبئة والتوقيع
+	Folder	مجلد
+	Font	الخط
+	Font (unnamed) on page {p} doesn't map its characters to Unicode	الخط (غير المسمى) في الصفحة {p} لا يربط محارفه بيونيكود
+	Font {} on page {p} doesn't map its characters to Unicode	الخط {} في الصفحة {p} لا يربط محارفه بيونيكود
+	Form field on page {p} isn't tagged	حقل النموذج في الصفحة {p} غير موسوم
+	Help…	تعليمات…
+	H{n} follows an H{d}; headings should not skip levels	يتبع H{n} عنوان H{d}؛ لا ينبغي للعناوين تخطي المستويات
+	Import	استيراد
+	Information	معلومات
+	Inspector	المفتش
+	Key Agreement	اتفاقية المفاتيح
+	Key Encipherment	تشفير المفاتيح
+	Loading…	يُحمَّل…
+	Move	نقل
+	Never	أبداً
+	New bookmark (⌘B)	إشارة مرجعية جديدة (⌘B)
+	Next	التالي
+	Next (⌘G)	التالي (⌘G)
+	No PDFs found in {folder}	لم يُعثر على ملفات PDF في {folder}
+	No document language is set	لم تُحدد لغة المستند
+	No page has text: the document appears to be images of pages	لا صفحة تحوي نصاً: يبدو المستند صوراً للصفحات
+	No results	لا نتائج
+	Non-Repudiation	عدم الجحود
+	On	تشغيل
+	Only the document's owner can change its security (open it with the permissions password)	مالك المستند وحده يستطيع تغيير أمانه (افتحه بكلمة مرور الأذونات)
+	Open a PDF (⌘O)	فتح PDF‏ (⌘O)
+	Open folder	فتح المجلد
+	Organize	تنظيم
+	Page {n}	صفحة {n}
+	Page {n} of {total}	صفحة {n} من {total}
+	Page {p} doesn't tab in structure order	الصفحة {p} لا تترتب بترتيب البنية
+	Page {p}: {n} untagged content item	الصفحة {p}: {n} عنصر محتوى غير موسوم
+	Page {p}: {n} untagged content items	الصفحة {p}: {n} عناصر محتوى غير موسومة
+	Page {} has additional actions	للصفحة {} إجراءات إضافية
+	Panel layout could not be restored: {error}	تعذرت استعادة تخطيط اللوحات: {error}
+	Panel move was not applied: {error}	لم يُطبَّق نقل اللوحة: {error}
+	Paste	لصق
+	PdfCraft can't check this signature yet: {}.	لا يستطيع PdfCraft التحقق من هذا التوقيع بعد: {}.
+	Previous	السابق
+	Previous (⇧⌘G)	السابق (⇧⌘G)
+	Print (⌘P)	طباعة (⌘P)
+	Producer	المنتج
+	Refresh	تحديث
+	Rendering…	يُعرض…
+	Report created	أُنشئ التقرير
+	Rev. {rev}: Certified by an unknown signer	المراجعة {rev}: معتمد من موقّع مجهول
+	Rev. {rev}: Certified by {name}	المراجعة {rev}: معتمد من {name}
+	Rev. {rev}: Signed by an unknown signer	المراجعة {rev}: موقع من موقع مجهول
+	Rev. {rev}: Signed by {name}	المراجعة {rev}: موقع من {name}
+	Rotate view clockwise (⇧⌘+)	تدوير العرض مع عقارب الساعة (⇧⌘+)
+	Rule Name	اسم القاعدة
+	Save (M4)	حفظ (M4)
+	Save as {level}	حفظ كـ {level}
+	Save changes?	حفظ التغييرات؟
+	Save file	حفظ الملف
+	Search results	نتائج البحث
+	Select all	تحديد الكل
+	Signature is invalid	التوقيع غير صالح
+	Signature is valid	التوقيع صالح
+	Signature validity is unknown	صلاحية التوقيع مجهولة
+	Signing time is from the clock on the signer's computer.	وقت التوقيع من ساعة حاسوب الموقّع.
+	Still rendering — this page is unusually complex…	لا يزال العرض جارياً — هذه الصفحة معقدة على غير العادة…
+	Success	نجاح
+	System	النظام
+	The ECDSA signature is not in canonical DER (trailing bytes, padding or a missing sign byte); it was read anyway.	توقيع ECDSA ليس بصيغة DER القياسية (بايتات زائدة أو حشو أو بايت إشارة ناقص)؛ قُرئ مع ذلك.
+	The ECDSA signature is the raw r and s values instead of a DER sequence; it was read anyway.	توقيع ECDSA هو قيمتا r وs الخام بدلاً من متتابعة DER؛ قُرئ مع ذلك.
+	The RSA signature value does not have the length of the key's modulus (leading zero bytes dropped or added); it was read anyway.	قيمة توقيع RSA ليست بطول معامل المفتاح (بايتات صفرية بادئة حُذفت أو أُضيفت)؛ قُرئ مع ذلك.
+	The RSA signature's DigestInfo has no NULL parameter (older signers write it so); it was read anyway.	لا يحوي DigestInfo لتوقيع RSA معلمة NULL (كذلك تكتبها الموقّعات القديمة)؛ قُرئ مع ذلك.
+	The certificate of {} does not allow this many CA certificates below it (path length), so it is not used to vouch for {}.	شهادة {} لا تسمح بهذا العدد من شهادات CA تحتها (طول المسار)، لذا لا تُستخدم للضمان عن {}.
+	The certificate of {} is not a CA certificate that may issue certificates, so it is not used to vouch for {}.	شهادة {} ليست شهادة CA يجوز لها إصدار الشهادات، لذا لا تُستخدم للضمان عن {}.
+	The certificate of {} was not valid at the time of signing, so it is not used to vouch for {}.	شهادة {} لم تكن صالحة وقت التوقيع، لذا لا تُستخدم للضمان عن {}.
+	The checker found problems which may prevent the document from being fully accessible.	وجد الفاحص مشكلات قد تمنع وصولاً كاملاً إلى المستند.
+	The document has been altered or corrupted since the signature was applied.	عُدّل المستند أو تلف منذ تطبيق التوقيع.
+	The document has been altered or corrupted since the timestamp was applied.	عُدّل المستند أو تلف منذ تطبيق الطابع الزمني.
+	The document has been altered since this signature was applied in ways it does not permit ({}).	عُدّل المستند منذ تطبيق هذا التوقيع بطرق لا يسمح بها ({}).
+	The document has been altered since this timestamp was applied in ways it does not permit ({}).	عُدّل المستند منذ تطبيق هذا الطابع الزمني بطرق لا يسمح بها ({}).
+	The document has been modified since this signature was applied, but the changes are permitted ({}).	عُدّل المستند منذ تطبيق هذا التوقيع، لكن التغييرات مسموحة ({}).
+	The document has been modified since this timestamp was applied, but the changes are permitted ({}).	عُدّل المستند منذ تطبيق هذا الطابع الزمني، لكن التغييرات مسموحة ({}).
+	The document has no tags (structure tree)	لا وسوم في المستند (شجرة البنية)
+	The document has no title	لا عنوان للمستند
+	The document isn't marked as tagged (MarkInfo Marked)	المستند غير معلّم كموسوم (MarkInfo Marked)
+	The document isn't tagged, so none of its content is	المستند غير موسوم، لذا لا شيء من محتواه موسوم
+	The document's embedded revocation information shows that the signer's certificate has not been revoked.	تُظهر معلومات الإلغاء المدمجة في المستند أن شهادة الموقّع لم تُلغَ.
+	The embedded timestamp token is valid and its authority is trusted; trusted time is {}.	رمز الطابع الزمني المدمج صالح وسلطته موثوقة؛ الوقت الموثوق هو {}.
+	The font {} isn't embedded	الخط {} غير مدمج
+	The metadata doesn't identify the file as {}	البيانات الوصفية لا تحدد الملف كـ {}
+	The password is incorrect.	كلمة المرور غير صحيحة.
+	The password must have at least 6 characters.	يجب أن تحوي كلمة المرور 6 محارف على الأقل.
+	The passwords do not match.	كلمتا المرور غير متطابقتين.
+	The security settings don't allow screen readers to read the text	إعدادات الأمان لا تسمح لقارئات الشاشة بقراءة النص
+	The signature algorithm and the SignerInfo's digest algorithm name different hashes; the signature was made with the SignerInfo's.	خوارزمية التوقيع وخوارزمية الهضم في SignerInfo تسمّيان هضمين مختلفين؛ صُنع التوقيع بخوارزمية SignerInfo.
+	The signature carries an unverified timestamp ({}): the timestamp authority is not in your list of trusted certificates, so the signing time claimed by the signer is used instead.	يحمل التوقيع طابعاً زمنياً غير موثق ({}): سلطة الطابع الزمني ليست في قائمة شهاداتك الموثوقة، لذا يُستخدم وقت التوقيع الذي زعمه الموقّع بدلاً منه.
+	The signature contents are not hexadecimal.	محتويات التوقيع ليست سداسية عشرية.
+	The signature could not be checked ({}).	تعذر التحقق من التوقيع ({}).
+	The signature could not be read ({}).	تعذرت قراءة التوقيع ({}).
+	The signature could not be verified ({}).	تعذر التثبت من التوقيع ({}).
+	The signature has no valid byte range.	لا نطاق بايتات صالحاً للتوقيع.
+	The signature includes an embedded timestamp.	يتضمن التوقيع طابعاً زمنياً مدمجاً.
+	The signature is BER-encoded (indefinite lengths) rather than DER; it was read leniently.	التوقيع مرمّز BER (أطوال غير محددة) لا DER؛ قُرئ بتساهل.
+	The signature uses the legacy adbe.x509.rsa_sha1 format.	يستخدم التوقيع تنسيق adbe.x509.rsa_sha1 القديم.
+	The signature value does not match the signer's certificate: the signature is corrupt.	قيمة التوقيع لا تطابق شهادة الموقّع: التوقيع تالف.
+	The signature's byte range does not exclude exactly its contents.	نطاق بايتات التوقيع لا يستبعد محتوياته بالضبط.
+	The signature's byte range does not match the file.	نطاق بايتات التوقيع لا يطابق الملف.
+	The signature's timestamp token could not be verified ({}).	تعذر تثبت رمز الطابع الزمني للتوقيع ({}).
+	The signature's timestamp token does not cover the signature value.	رمز الطابع الزمني للتوقيع لا يغطي قيمة التوقيع.
+	The signed content is a constructed (segmented) OCTET STRING, as BER allows; it was read anyway.	المحتوى الموقّع OCTET STRING مركّب (مقسم) كما يسمح BER؛ قُرئ مع ذلك.
+	The signer's certificate does not allow digital signatures (its key usage has neither digital signature nor non-repudiation).	شهادة الموقّع لا تسمح بالتواقيع الرقمية (استخدام مفتاحها لا يضم توقيعاً رقمياً ولا عدم جحود).
+	The signer's certificate has been revoked ({}).	أُلغيت شهادة الموقّع ({}).
+	The signer's certificate has critical extensions PdfCraft does not recognize ({}).	لشهادة الموقّع امتدادات حرجة لا يتعرّف عليها PdfCraft ({}).
+	The signer's certificate is not in the signature.	شهادة الموقّع ليست في التوقيع.
+	The signer's certificate is not issued for signing documents (its extended key usage has no document-signing purpose).	شهادة الموقّع لم تُصدر لتوقيع المستندات (استخدامها الممتد للمفتاح لا يضم غرض توقيع مستندات).
+	The signer's certificate was not valid at the time of signing.	شهادة الموقّع لم تكن صالحة وقت التوقيع.
+	The signer's identity is unknown because it has not been included in your list of trusted certificates and none of its parent certificates are trusted certificates.	هوية الموقّع مجهولة لأنها ليست في قائمة شهاداتك الموثوقة ولا أي من شهاداتها الأم موثوقة.
+	The signer's identity is valid.	هوية الموقّع صحيحة.
+	The timestamp authority's certificate was not valid at the time of timestamping.	شهادة سلطة الطابع الزمني لم تكن صالحة وقت التوقيت.
+	The timestamp contents are not hexadecimal.	محتويات الطابع الزمني ليست سداسية عشرية.
+	The timestamp has no valid byte range.	لا نطاق بايتات صالحاً للطابع الزمني.
+	The timestamp token could not be read ({}).	تعذرت قراءة رمز الطابع الزمني ({}).
+	The timestamp token is valid and its authority is trusted.	رمز الطابع الزمني صالح وسلطته موثوقة.
+	The timestamp token is valid, but the timestamp authority is not in your list of trusted certificates.	رمز الطابع الزمني صالح، لكن سلطة الطابع الزمني ليست في قائمة شهاداتك الموثوقة.
+	The timestamp's byte range does not exclude exactly its contents.	نطاق بايتات الطابع الزمني لا يستبعد محتوياته بالضبط.
+	The timestamp's byte range does not match the file.	نطاق بايتات الطابع الزمني لا يطابق الملف.
+	The window shows the file name, not the title (Initial View > Show)	تُظهر النافذة اسم الملف لا العنوان (العرض الأولي > إظهار)
+	Theme	السمة
+	There is no folder to save the digital ID in.	لا مجلد لحفظ المعرّف الرقمي فيه.
+	This document has not been modified since this signature was applied.	لم يُعدَّل المستند منذ تطبيق هذا التوقيع.
+	This document has not been modified since this timestamp was applied.	لم يُعدَّل المستند منذ تطبيق هذا الطابع الزمني.
+	This signature uses RIPEMD-160, a legacy 160-bit hash algorithm that is no longer recommended for signatures. It still validates, but it should not be relied on.	يستخدم هذا التوقيع RIPEMD-160، خوارزمية هضم قديمة بطول 160 بت لم تعد موصى بها للتواقيع. لا يزال يصح، لكن لا ينبغي الاعتماد عليه.
+	This signature uses SHA-1, a weak hash algorithm: collisions in it have been demonstrated. It still validates because many documents signed years ago use it, but it should not be relied on.	يستخدم هذا التوقيع SHA-1، خوارزمية هضم ضعيفة: أُثبتت تصادمات فيها. لا يزال يصح لأن مستندات كثيرة وقّعت قبل سنوات تستخدمه، لكن لا ينبغي الاعتماد عليه.
+	Tools	الأدوات
+	Unsigned signature field	حقل توقيع غير موقع
+	Unsigned signature field: {name}	حقل توقيع غير موقع: {name}
+	Warning	تحذير
+	Zoom in (⌘+)	تكبير (⌘+)
+	Zoom in / out (also pinch or ⌘-scroll)	تكبير / تصغير (أيضاً قرص أو ⌘-تمرير)
+	Zoom out (⌘−)	تصغير (⌘−)
+	alternate text hides an annotation inside it	النص البديل يخفي تعليقاً توضيحياً داخله
+	alternate text on an element with no page content	نص بديل على عنصر بلا محتوى صفحة
+	comments	تعليقات
+	document security store	مخزن أمان المستند
+	document structure	بنية المستند
+	form fill	تعبئة نموذج
+	its alternate text is inside another element's and will never be read	نصه البديل داخل نص عنصر آخر ولن يُقرأ أبداً
+	links	ارتباطات
+	metadata	بيانات وصفية
+	no alternate text	لا نص بديل
+	no header cells (TH)	لا خلايا رأس (TH)
+	no summary	لا ملخصاً
+	not in a TR	ليس في TR
+	not in a Table, THead, TBody or TFoot	ليس في Table أو THead أو TBody أو TFoot
+	not in an L (list)	ليس في L (قائمة)
+	not in an LI (list item)	ليس في LI (عنصر قائمة)
+	of	من
+	other changes	تغييرات أخرى
+	page content	محتوى الصفحة
+	page {n} is out of range (1–{count})	الصفحة {n} خارج النطاق (1–{count})
+	pages added or removed	صفحات أُضيفت أو حُذفت
+	rows have between {min} and {max} columns	للصفوف بين {min} و{max} عموداً
+	the first heading is an H{n}; headings should not skip levels	العنوان الأول H{n}؛ لا ينبغي للعناوين تخطي المستويات
+	the signed version could not be read	تعذرت قراءة النسخة الموقعة
+	{n} pages and no bookmarks	{n} صفحات ولا إشارات مرجعية
+	{page} is not a page number or label	{page} ليس رقم صفحة أو تسمية
+	{ty} element on page {p}: {what}	عنصر {ty} في الصفحة {p}: {what}
+	{ty} element: {what}	عنصر {ty}: {what}
+	{who}, certificate issued by an unknown issuer.	{who}، شهادة صادرة من مُصدر مجهول.
+	{who}, certificate issued by {issuer}.	{who}، شهادة صادرة من {issuer}.
+	{} annotation on page {p} isn't tagged	التعليق التوضيحي {} في الصفحة {p} غير موسوم
+	{} annotations aren't allowed	التعليقات التوضيحية {} غير مسموحة
+	… and {n} more	… و{n} أخرى
+@plural	Delete {n} field|Delete {n} fields	حذف {n} حقل|حذف {n} حقل|حذف {n} حقلين|حذف {n} حقول|حذف {n} حقلاً|حذف {n} حقل
+@plural	{n} byte|{n} bytes	{n} بايت|{n} بايت|{n} بايتان|{n} بايتات|{n} بايتاً|{n} بايت
+@plural	{n} comment|{n} comments	{n} تعليق|{n} تعليق|{n} تعليقان|{n} تعليقات|{n} تعليقاً|{n} تعليق
+@plural	{n} file|{n} files	{n} ملف|{n} ملف|{n} ملفان|{n} ملفات|{n} ملفاً|{n} ملف
+@plural	{n} image optimized|{n} images optimized	{n} صورة محسّنة|{n} صورة محسّنة|{n} صورتان محسّنتان|{n} صور محسّنة|{n} صورة محسّنة|{n} صورة محسّنة
+@plural	{n} item discarded|{n} items discarded	{n} عنصر مهمل|{n} عنصر مهمل|{n} عنصران مهملان|{n} عناصر مهملة|{n} عنصراً مهملًا|{n} عنصر مهمل
+@plural	{n} pixel|{n} pixels	{n} بكسل|{n} بكسل|{n} بكسلان|{n} بكسلات|{n} بكسلاً|{n} بكسل
+@plural	{n} result|{n} results	{n} نتيجة|{n} نتيجة|{n} نتيجتان|{n} نتائج|{n} نتيجةً|{n} نتيجة
+calendar weekday	Fr	جمعة
+calendar weekday	Mo	إثنين
+calendar weekday	Sa	سبت
+calendar weekday	Su	أحد
+calendar weekday	Th	خميس
+calendar weekday	Tu	ثلاثاء
+calendar weekday	We	أربعاء
+certificate	Basic constraints	القيود الأساسية
+certificate	Intended usage	الاستخدام المقصود
+certificate	Issued by	صادر من
+certificate	Issued to	مُصدر إلى
+certificate	Issuer	المُصدر
+certificate	Key usage	استخدام المفتاح
+certificate	Public key	المفتاح العام
+certificate	SHA-1 digest	بصمة SHA-1
+certificate	SHA-256 digest	بصمة SHA-256
+certificate	Self-signed	ذاتي التوقيع
+certificate	Serial number	الرقم التسلسلي
+certificate	Valid from	صالح من
+certificate	Valid to	صالح إلى
+certificate	Validity ends	تنتهي الصلاحية
+certificate	Validity starts	تبدأ الصلاحية
+certificate	Version	الإصدار
+	Turn upside down (180°)	اقلب رأسًا على عقب (180°)
+	4 x 6 in label (101.6 x 152.4 mm)	ملصق 4 × 6 بوصة (101.6 × 152.4 مم)
+	Cuts each page to its printed area, turns it upright and fits it to the sheet without stretching. One label per sheet.	يقص كل صفحة إلى المنطقة المطبوعة، ويديرها لتصبح مستقيمة ويلائمها مع الورقة دون تمديد. ملصق واحد لكل ورقة.
+	Find untagged content	العثور على محتوى غير مُعلَّم
+	No untagged content was found.	لم يتم العثور على محتوى غير معلَّم.
+	Found {n} untagged content problems.	تم العثور على {n} مشكلة في محتوى غير معلَّم.
+	Tag form fields	وضع علامات على حقول النموذج
+	Mark as artifact	وضع علامة كعنصر زخرفي
+	Remove this leaf tag from reading order and mark its direct content as an artifact	أزل هذه العلامة من ترتيب القراءة وضع علامة على محتواها المباشر كعنصر زخرفي
+	Mark content as artifact	وضع علامة على المحتوى كعنصر زخرفي
+	Word count	عدد الكلمات
+	Current page only	الصفحة الحالية فقط
+	Exclude tagged tables	استبعاد الجداول الموسومة
+	Exclude tagged code blocks	استبعاد كتل التعليمات البرمجية الموسومة
+	Exclude image/OCR text	استبعاد نص الصور والتعرف الضوئي على الحروف
+	Exclusions use PDF tags. Untagged tables and code remain included. Image exclusion also removes invisible text.	تعتمد الاستثناءات على وسوم PDF. تبقى الجداول والتعليمات البرمجية غير الموسومة ضمن العدد. يستبعد خيار الصور النص غير المرئي أيضًا.
+	Words	الكلمات
+	Characters	الأحرف
+	Characters without spaces	الأحرف دون مسافات
+	Pages counted	الصفحات المحسوبة
+	Some pages contain no countable text. Scanned images need OCR first.	لا تحتوي بعض الصفحات على نص قابل للعد. تتطلب الصور الممسوحة ضوئيًا التعرف الضوئي على الحروف أولًا.
+	Some content could not be classified safely and was kept in the count.	تعذر تصنيف بعض المحتوى بشكل موثوق، لذا بقي ضمن العدد.
+	Counting words… {n} pages read	جارٍ عد الكلمات… تمت قراءة {n} من الصفحات
+	Word counting stopped unexpectedly.	توقف عد الكلمات بشكل غير متوقع.
+	Word count…	عدد الكلمات…
+@id	file.word_count	عدد الكلمات…
+	Standard	قياسي
+	Mobile	الهاتف المحمول
+	Merge image fragments	دمج أجزاء الصور
+	Optimizing… merging image fragments	جارٍ التحسين… دمج أجزاء الصور
+	Side by side	جنبًا إلى جنب
+	New file only	الملف الجديد فقط
+	Old file: {name}	الملف القديم: {name}
+	New file: {name}	الملف الجديد: {name}
+	Print as image	الطباعة كصورة
+	Resolution:	الدقة:
+	Use it when a printer skips text, shading or transparency. The print is no longer searchable text; with Print in grayscale, the pictures are grey.	استخدمه عندما تتجاهل الطابعة النص أو التظليل أو الشفافية. لا تعود المطبوعة نصًا قابلًا للبحث؛ ومع الطباعة بتدرج الرمادي تكون الصور رمادية.
+	Crop Image	قص الصورة
+	Remove Crop	إزالة القص
+	Trim the picture with its handles; Enter or Done applies	قص الصورة بمقابضها؛ يطبّق Enter أو تم
+	Redaction mark appearance	مظهر علامة الحجب
+	Outline colour:	لون الحد الخارجي:
+	Fill colour:	لون التعبئة:
+	Shown while the pointer is over a mark.	يظهر أثناء وجود المؤشر فوق علامة.
+	Opacity:	العتامة:
+	Make properties default	جعل الخصائص افتراضية
+	Pages selected	الصفحات المحددة
+	Page properties	خصائص الصفحة
diff --git a/crates/ui-egui/src/i18n/bg.tsv b/crates/ui-egui/src/i18n/bg.tsv
index e107408e2..8f2fea70e 100644
--- a/crates/ui-egui/src/i18n/bg.tsv
+++ b/crates/ui-egui/src/i18n/bg.tsv
@@ -60,6 +60,7 @@
 	Auto follows the system's text size. Pages always render at the display's full resolution.	Автоматично следва размера на текста в системата. Страниците винаги се изобразяват с пълната разделителна способност на екрана.
 	Identity	Самоличност
 	Name on new comments	Име в новите коментари
+	Hide hover previews for highlights without comment text	Скриване на прегледите при посочване за маркирания без текст на коментар
 	Open…	Отвори…
 	Open Recent	Последно отваряни
 	Pin folder to Home…	Закачи папка в Начало…
@@ -257,6 +258,7 @@
 	Remove unused objects and merge identical ones	Премахни неизползваните обекти и обедини еднаквите
 	Audit space usage…	Анализ на използваното място…
 	Space Audit	Анализ на мястото
+	What takes up the space in this file, by kind of content.	Какво заема мястото в този файл, по вид съдържание.
 	Bytes	Байтове
 	Content Streams	Потоци на съдържанието
 	X Object Forms	Форми X Object
@@ -530,6 +532,12 @@
 	Windows store  ·  	Хранилище на Windows  ·  
 	Issued by: 	Издаден от: 
 	, Expires: 	, валиден до: 
+	Digitally signed by	Цифрово подписано от
+	DN: 	DN: 
+	Reason: 	Причина: 
+	Location: 	Местоположение: 
+	Date: 	Дата: 
+	The labels are in English: the signature's font can't draw them in this language.	Етикетите са на английски: шрифтът на подписа не може да ги изобрази на този език.
 	No digital IDs yet.	Все още няма цифрови идентификатори.
 	Configure New Digital ID	Конфигурирай нов цифров идентификатор
 	Remove "{name}" from this list? The file itself is not deleted.	Да се премахне ли „{name}“ от този списък? Самият файл няма да бъде изтрит.
@@ -828,6 +836,7 @@
 	Redaction code:	Код за заличаване:
 	Font:	Шрифт:
 	Font size:	Размер на шрифта:
+	Font size	Размер на шрифта
 	Auto-size text to fit redaction region	Автоматично оразмеряване на текста според областта на заличаване
 	Font colour:	Цвят на шрифта:
 	Repeat overlay text	Повтаряй текста върху заличаването
@@ -973,6 +982,7 @@
 	Replace	Замени
 	Split	Раздели
 	Set page boxes	Задай полета на страницата
+	Set page transitions	Задаване на преходи между страници
 	Page labels	Етикети на страниците
 	Page transitions	Преходи между страниците
 	Sticky note	Бележка
@@ -1227,6 +1237,7 @@
 	Copy text	Копирай текста
 	Properties…	Свойства…
 	Make Current Properties Default	Направи текущите свойства подразбиращи се
+	Make Properties Default	Направи свойствата подразбиращи се
 	More options	Още опции
 	Sort by	Сортиране по
 	Author	Автор
@@ -1359,6 +1370,9 @@
 	Sort comments by:	Сортирай коментарите по:
 	Create PDF Comment Summary	Създай PDF обобщение на коментарите
 	Revert to the previously saved version of “{name}”? Changes since then can't be undone afterwards.	Да се върне ли последната записана версия на „{name}“? Промените след нея няма да могат да бъдат отменени.
+	Save over the changed file?	Да се запише ли върху променения файл?
+	“{name}” changed on disk after it was opened or last saved. Saving now replaces that newer version with this one.	„{name}“ беше променен на диска след отварянето или последното записване. Записването сега заменя тази по-нова версия с настоящата.
+	Save anyway	Запис въпреки това
 	Number pages	Номерирай страниците
 	Style	Стил
 	None (prefix only)	Без (само префикс)
@@ -1564,6 +1578,8 @@
 	Sent to {printer}	Изпратено до {printer}
 	Sent to {printer}: {msg}	Изпратено до {printer}: {msg}
 	Looking for printers…	Търсене на принтери…
+	Sending sheet {s} of {n} to {printer}…	Изпращане на лист {s} от {n} до {printer}…
+	No printers were found. Check that the printer is installed and the print spooler is running, then open Print again.	Не са намерени принтери. Проверете дали принтерът е инсталиран и дали услугата за опашка за печат работи, след което отворете „Печат“ отново.
 	Sending to {printer}…	Изпращане до {printer}…
 	Choose a folder for the searchable files	Изберете папка за файловете с възможност за търсене
 	Files are combined from top to bottom. Leave Pages empty to take every page.	Файловете се обединяват отгоре надолу. Оставете „Страници“ празно, за да се вземат всички страници.
@@ -2203,6 +2219,8 @@ key	Space	Интервал
 	Switch to List view to change the pages it takes.	Превключете към изглед списък, за да промените кои страници се вземат.
 	Expand all	Разгъни всички
 	Collapse all	Свий всички
+	Collapse all pages	Свий всички страници
+	Expand all pages	Разгъни всички страници
 	Remove page	Премахни страницата
 	Remove {n} pages	Премахни {n} страници
 
@@ -2223,14 +2241,14 @@ key	Space	Интервал
 	Printer paper and scaling may differ. Check driver settings.	Хартията и мащабът на принтера може да се различават. Проверете настройките на драйвера.
 	Drawing scale changes. Use Actual size for full-scale plans.	Мащабът на чертежа се променя. Използвайте Действителен размер за планове в оригинален мащаб.
 	Reload documents when their files change on disk	Презареждай документите, когато файловете им се променят на диска
-	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	Този файл е променен на диска. Презаредете го, за да видите новата версия; незаписаните ви промени ще бъдат загубени.
+	This file changed on disk. Reload shows the new version and drops your unsaved changes; Save replaces it with this version.	Този файл беше променен на диска. „Презареждане“ показва новата версия и отхвърля незаписаните ви промени; „Запис“ я заменя с тази версия.
 	Reload	Презареди
 	Couldn't reload {name}: {e}	Неуспешно презареждане на {name}: {e}
 	Select page {label}	Избиране на страница {label}
 	Rotate page {label} counterclockwise	Завъртане на страница {label} обратно на часовниковата стрелка
 	Rotate page {label} clockwise	Завъртане на страница {label} по часовниковата стрелка
 	Delete page {label}	Изтриване на страница {label}
-	Mouse wheel scroll speed	Скорост на превъртане с колелцето на мишката
+	Scroll speed (mouse wheel and arrow keys)	Скорост на превъртане (колелце на мишката и клавиши със стрелки)
 scroll speed	Slow	Ниска
 scroll speed	Normal	Нормална
 scroll speed	Fast	Висока
@@ -2304,6 +2322,10 @@ animation effects	Off	Изключени
 	The linked PDF opened, but its named destination was not applied.	Свързаният PDF се отвори, но именуваната му цел не беше приложена.
 	The linked PDF opened, but its page destination was out of range.	Свързаният PDF се отвори, но целевата му страница е извън обхвата.
 	Local cross-PDF links require the desktop app	Локалните връзки между PDF файлове изискват настолното приложение
+	Cut Image	Изрежи изображението
+	Redact Image	Заличи изображението
+	Create Link…	Създай връзка…
+	Recognize Text…	Разпознаване на текст…
 	Minimize	Минимизиране
 	Maximize	Максимизиране
 	Restore	Възстановяване
@@ -2313,7 +2335,59 @@ animation effects	Off	Изключени
 # Absolute local GoToR confirmation (#1364).
 	Allow	Разреши
 	Only allow this if you trust the source document.	Разрешете това само ако имате доверие на изходния документ.
+	Open in Full Screen mode?	Отваряне в режим на цял екран?
+	This document asks to open in Full Screen mode: the page fills the screen and nothing else shows. Press Esc at any time to leave it.	Този документ иска да се отвори в режим на цял екран: страницата изпълва екрана и нищо друго не се показва. Натиснете Esc по всяко време, за да излезете.
+	Full Screen	Цял екран
+	Not now	Не сега
 	Open this local PDF?	Да се отвори ли този локален PDF?
 	This document is trying to open a local file:	Този документ се опитва да отвори локален файл:
 	Move tag earlier	Преместване на етикета по-рано
 	Move tag later	Преместване на етикета по-късно
+	Turn upside down (180°)	Обърни наопаки (180°)
+	4 x 6 in label (101.6 x 152.4 mm)	Етикет 4 × 6 in (101,6 × 152,4 mm)
+	Cuts each page to its printed area, turns it upright and fits it to the sheet without stretching. One label per sheet.	Изрязва всяка страница до отпечатаната ѝ област, завърта я изправено и я побира в листа без разтягане. Един етикет на лист.
+	Find untagged content	Намиране на немаркирано съдържание
+	No untagged content was found.	Не е намерено немаркирано съдържание.
+	Found {n} untagged content problems.	Открити са {n} проблема с немаркирано съдържание.
+	Tag form fields	Маркиране на полетата на формуляра
+	Mark as artifact	Маркиране като артефакт
+	Remove this leaf tag from reading order and mark its direct content as an artifact	Премахнете този листов етикет от реда на четене и маркирайте прякото му съдържание като артефакт
+	Mark content as artifact	Маркиране на съдържание като артефакт
+	Word count	Брой думи
+	Current page only	Само текущата страница
+	Exclude tagged tables	Изключване на маркираните таблици
+	Exclude tagged code blocks	Изключване на маркираните блокове с код
+	Exclude image/OCR text	Изключване на текст от изображения/OCR
+	Exclusions use PDF tags. Untagged tables and code remain included. Image exclusion also removes invisible text.	Изключването използва PDF тагове. Немаркираните таблици и код остават включени. Изключването на изображения премахва и невидимия текст.
+	Words	Думи
+	Characters	Знаци
+	Characters without spaces	Знаци без интервали
+	Pages counted	Преброени страници
+	Some pages contain no countable text. Scanned images need OCR first.	Някои страници не съдържат текст за преброяване. Сканираните изображения първо изискват OCR.
+	Some content could not be classified safely and was kept in the count.	Част от съдържанието не може да бъде класифицирана надеждно и е включена в броя.
+	Counting words… {n} pages read	Преброяване на думи… прочетени страници: {n}
+	Word counting stopped unexpectedly.	Преброяването на думи спря неочаквано.
+	Word count…	Брой думи…
+@id	file.word_count	Брой думи…
+	Standard	Стандартни
+	Mobile	Мобилни устройства
+	Merge image fragments	Обединяване на фрагменти от изображения
+	Optimizing… merging image fragments	Оптимизиране… обединяване на фрагменти от изображения
+	Side by side	Един до друг
+	New file only	Само новият файл
+	Old file: {name}	Стар файл: {name}
+	New file: {name}	Нов файл: {name}
+	Print as image	Печат като изображение
+	Resolution:	Разделителна способност:
+	Use it when a printer skips text, shading or transparency. The print is no longer searchable text; with Print in grayscale, the pictures are grey.	Използвайте го, когато принтерът пропуска текст, сенки или прозрачност. Отпечатаното вече не е текст за търсене; с печат в сиво изображенията са сиви.
+	Crop Image	Изрязване на изображението
+	Remove Crop	Премахване на изрязването
+	Trim the picture with its handles; Enter or Done applies	Изрежете картината чрез дръжките; Enter или Готово прилага
+	Redaction mark appearance	Вид на маркировката за заличаване
+	Outline colour:	Цвят на контура:
+	Fill colour:	Цвят на запълването:
+	Shown while the pointer is over a mark.	Показва се, докато показалецът е над маркировка.
+	Opacity:	Непрозрачност:
+	Make properties default	Задаване като свойства по подразбиране
+	Pages selected	Избрани страници
+	Page properties	Свойства на страницата
diff --git a/crates/ui-egui/src/i18n/cs.tsv b/crates/ui-egui/src/i18n/cs.tsv
index 835388f40..bad5c497e 100644
--- a/crates/ui-egui/src/i18n/cs.tsv
+++ b/crates/ui-egui/src/i18n/cs.tsv
@@ -40,6 +40,7 @@
 	Auto follows the system's text size. Pages always render at the display's full resolution.	Automaticky se řídí velikostí textu v systému. Stránky se vždy vykreslují v plném rozlišení displeje.
 	Identity	Identita
 	Name on new comments	Jméno autora nových komentářů
+	Hide hover previews for highlights without comment text	Skrýt náhledy při najetí u zvýraznění bez textu komentáře
 	Enable Acrobat JavaScript	Povolit Acrobat JavaScript
 	OK	OK
 	Open…	Otevřít…
@@ -137,7 +138,7 @@
 	Used when a PDF doesn't ask for a layout or zoom. Continuous scrolling never snaps between pages.	Používá se, když PDF nepožaduje rozložení ani zvětšení. Plynulé posouvání mezi stránkami neskáče.
 	Reopen the files that were open when PdfCraft last closed	Znovu otevřít soubory, které byly otevřené při posledním zavření aplikace PdfCraft
 	Reload documents when their files change on disk	Znovu načítat dokumenty při změně jejich souborů na disku
-	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	Tento soubor se na disku změnil. Znovu jej načtěte, abyste viděli novou verzi; neuložené změny budou ztraceny.
+	This file changed on disk. Reload shows the new version and drops your unsaved changes; Save replaces it with this version.	Tento soubor se na disku změnil. Znovu načíst zobrazí novou verzi a zahodí neuložené změny; Uložit ji nahradí touto verzí.
 	Reload	Znovu načíst
 	Couldn't reload {name}: {e}	Soubor {name} nelze znovu načíst: {e}
 	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	Vyberte obrázek PNG nebo JPEG (nejvýše 4 MiB). Průhlednost bude zachována.
@@ -451,6 +452,7 @@ key	Space	Mezerník
 	Split	Rozdělit
 	More	Další
 	Set page boxes	Nastavit rámečky stránek
+	Set page transitions	Nastavit přechody stránek
 	Page labels	Označení stránek
 	Page transitions	Přechody stránek
 	Add comments	Přidat komentáře
@@ -662,6 +664,7 @@ key	Space	Mezerník
 	Remove unused objects and merge identical ones	Odebrat nepoužívané objekty a sloučit shodné
 	Audit space usage…	Analyzovat využití místa…
 	Space Audit	Analýza využití místa
+	What takes up the space in this file, by kind of content.	Co zabírá místo v tomto souboru, podle druhu obsahu.
 	Bytes	Bajty
 	Content Streams	Proudy obsahu
 	X Object Forms	Objekty Form XObject
@@ -929,6 +932,12 @@ key	Space	Mezerník
 	Windows store  ·  	Úložiště Windows  ·  
 	Issued by: 	Vydal: 
 	, Expires: 	, platnost do: 
+	Digitally signed by	Digitálně podepsal
+	DN: 	DN: 
+	Reason: 	Důvod: 
+	Location: 	Místo: 
+	Date: 	Datum: 
+	The labels are in English: the signature's font can't draw them in this language.	Popisky jsou v angličtině: písmo podpisu je v tomto jazyce nedokáže vykreslit.
 	No digital IDs yet.	Zatím žádná digitální ID.
 	Configure New Digital ID	Nastavit nové digitální ID
 	Remove "{name}" from this list? The file itself is not deleted.	Odebrat „{name}“ z tohoto seznamu? Samotný soubor se nesmaže.
@@ -1214,6 +1223,7 @@ key	Space	Mezerník
 	Redaction code:	Kód začernění:
 	Font:	Písmo:
 	Font size:	Velikost písma:
+	Font size	Velikost písma
 	Auto-size text to fit redaction region	Automaticky přizpůsobit velikost textu oblasti začernění
 	Font colour:	Barva písma:
 	Repeat overlay text	Opakovat překryvný text
@@ -1354,6 +1364,7 @@ key	Space	Mezerník
 	Copy text	Kopírovat text
 	Properties…	Vlastnosti…
 	Make Current Properties Default	Nastavit aktuální vlastnosti jako výchozí
+	Make Properties Default	Nastavit vlastnosti jako výchozí
 	More options	Další možnosti
 	Sort by	Seřadit podle
 	Author	Autor
@@ -1475,6 +1486,9 @@ key	Space	Mezerník
 	Sort comments by:	Seřadit komentáře podle:
 	Create PDF Comment Summary	Vytvořit souhrn komentářů v PDF
 	Revert to the previously saved version of “{name}”? Changes since then can't be undone afterwards.	Vrátit se k dříve uložené verzi „{name}“? Změny provedené od té doby pak nepůjde vrátit zpět.
+	Save over the changed file?	Uložit přes změněný soubor?
+	“{name}” changed on disk after it was opened or last saved. Saving now replaces that newer version with this one.	Soubor „{name}“ se na disku změnil po otevření nebo posledním uložení. Uložení nyní nahradí tuto novější verzi touto.
+	Save anyway	Přesto uložit
 	Number pages	Očíslovat stránky
 	Style	Styl
 	None (prefix only)	Žádný (jen předpona)
@@ -2243,6 +2257,8 @@ certificate	Subject	Subjekt
 	List view	Zobrazení seznamu
 	Expand all	Rozbalit vše
 	Collapse all	Sbalit vše
+	Collapse all pages	Sbalit všechny stránky
+	Expand all pages	Rozbalit všechny stránky
 	Files are combined in the order shown. Drag them to change it.	Soubory se slučují v zobrazeném pořadí. Pořadí změníte přetažením.
 	Pages: {k} of {n}	Stránky: {k} z {n}
 	Check the pages	Zkontrolujte stránky
@@ -2251,6 +2267,8 @@ certificate	Subject	Subjekt
 	Remove page	Odebrat stránku
 	Remove {n} pages	Odebrat stránky ({n})
 	Looking for printers…	Hledání tiskáren…
+	Sending sheet {s} of {n} to {printer}…	Odesílání listu {s} z {n} na {printer}…
+	No printers were found. Check that the printer is installed and the print spooler is running, then open Print again.	Nebyly nalezeny žádné tiskárny. Zkontrolujte, že je tiskárna nainstalovaná a zařazování tisku běží, a pak znovu otevřete Tisk.
 	Sending to {printer}…	Odesílání na {printer}…
 	Fill colour	Barva výplně
 	Fill colour: none	Barva výplně: žádná
@@ -2276,7 +2294,7 @@ certificate	Subject	Subjekt
 
 # Digital ID errors, the Signatures panel and the certificate viewer.
 	Enter a name.	Zadejte jméno.
-	The password must have at least 6 characters.	Heslo musí mít alespoň 6 znaků.
+	The password must have at least 8 characters.	Heslo musí mít alespoň 8 znaků.
 	The passwords do not match.	Hesla se neshodují.
 	There is no folder to save the digital ID in.	Není k dispozici složka, do které by se digitální ID uložilo.
 	The password is incorrect.	Heslo není správné.
@@ -2318,7 +2336,7 @@ certificate	Subject	Subjekt
 	Active	Aktivní
 	Dark theme	Tmavý motiv
 	Appearance settings…	Nastavení vzhledu…
-	Mouse wheel scroll speed	Rychlost posouvání kolečkem myši
+	Scroll speed (mouse wheel and arrow keys)	Rychlost posouvání (kolečko myši a šipky)
 scroll speed	Slow	Pomalá
 scroll speed	Normal	Normální
 scroll speed	Fast	Rychlá
@@ -2415,6 +2433,10 @@ animation effects	Off	Vypnuto
 	The linked PDF opened, but its named destination was not applied.	Odkazovaný PDF se otevřel, ale jeho pojmenovaný cíl nebyl použit.
 	The linked PDF opened, but its page destination was out of range.	Odkazovaný PDF se otevřel, ale cílová stránka je mimo rozsah.
 	Local cross-PDF links require the desktop app	Místní odkazy mezi soubory PDF vyžadují desktopovou aplikaci
+	Cut Image	Vyjmout obrázek
+	Redact Image	Začernit obrázek
+	Create Link…	Vytvořit odkaz…
+	Recognize Text…	Rozpoznat text…
 	Minimize	Minimalizovat
 	Maximize	Maximalizovat
 	Restore	Obnovit
@@ -2424,7 +2446,59 @@ animation effects	Off	Vypnuto
 # Absolute local GoToR confirmation (#1364).
 	Allow	Povolit
 	Only allow this if you trust the source document.	Povolte tuto akci pouze v případě, že důvěřujete zdrojovému dokumentu.
+	Open in Full Screen mode?	Otevřít v režimu celé obrazovky?
+	This document asks to open in Full Screen mode: the page fills the screen and nothing else shows. Press Esc at any time to leave it.	Tento dokument žádá o otevření v režimu celé obrazovky: stránka vyplní obrazovku a nic jiného se nezobrazí. Stisknutím Esc jej kdykoli opustíte.
+	Full Screen	Celá obrazovka
+	Not now	Teď ne
 	Open this local PDF?	Otevřít tento místní soubor PDF?
 	This document is trying to open a local file:	Tento dokument se pokouší otevřít místní soubor:
 	Move tag earlier	Přesunout značku dříve
 	Move tag later	Přesunout značku později
+	Turn upside down (180°)	Otočit vzhůru nohama (180°)
+	4 x 6 in label (101.6 x 152.4 mm)	Štítek 4 × 6 in (101,6 × 152,4 mm)
+	Cuts each page to its printed area, turns it upright and fits it to the sheet without stretching. One label per sheet.	Ořízne každou stránku na potištěnou oblast, otočí ji svisle a přizpůsobí listu bez deformace. Jeden štítek na list.
+	Find untagged content	Najít neoznačený obsah
+	No untagged content was found.	Nebyl nalezen žádný neoznačený obsah.
+	Found {n} untagged content problems.	Nalezeno problémů s neoznačeným obsahem: {n}.
+	Tag form fields	Označit pole formuláře
+	Mark as artifact	Označit jako artefakt
+	Remove this leaf tag from reading order and mark its direct content as an artifact	Odeberte tuto značku listu z pořadí čtení a označte její přímý obsah jako artefakt
+	Mark content as artifact	Označit obsah jako artefakt
+	Word count	Počet slov
+	Current page only	Pouze aktuální stránka
+	Exclude tagged tables	Vynechat označené tabulky
+	Exclude tagged code blocks	Vynechat označené bloky kódu
+	Exclude image/OCR text	Vynechat text obrázků a OCR
+	Exclusions use PDF tags. Untagged tables and code remain included. Image exclusion also removes invisible text.	Vynechávání využívá tagy PDF. Neoznačené tabulky a kód zůstávají zahrnuty. Vynechání obrázků odstraní i neviditelný text.
+	Words	Slova
+	Characters	Znaky
+	Characters without spaces	Znaky bez mezer
+	Pages counted	Započítané stránky
+	Some pages contain no countable text. Scanned images need OCR first.	Některé stránky neobsahují text k počítání. U naskenovaných obrázků je nejprve nutné OCR.
+	Some content could not be classified safely and was kept in the count.	Část obsahu nebylo možné spolehlivě zařadit a zůstala zahrnuta v počtu.
+	Counting words… {n} pages read	Počítání slov… přečtené stránky: {n}
+	Word counting stopped unexpectedly.	Počítání slov se neočekávaně zastavilo.
+	Word count…	Počet slov…
+@id	file.word_count	Počet slov…
+	Standard	Standardní
+	Mobile	Mobilní zařízení
+	Merge image fragments	Sloučit fragmenty obrázků
+	Optimizing… merging image fragments	Optimalizace… slučování fragmentů obrázků
+	Side by side	Vedle sebe
+	New file only	Jen nový soubor
+	Old file: {name}	Starý soubor: {name}
+	New file: {name}	Nový soubor: {name}
+	Print as image	Tisknout jako obrázek
+	Resolution:	Rozlišení:
+	Use it when a printer skips text, shading or transparency. The print is no longer searchable text; with Print in grayscale, the pictures are grey.	Použijte, když tiskárna vynechává text, stínování nebo průhlednost. Výtisk už není prohledávatelný text; s tiskem v odstínech šedi jsou obrázky šedé.
+	Crop Image	Oříznout obrázek
+	Remove Crop	Odebrat oříznutí
+	Trim the picture with its handles; Enter or Done applies	Ořízněte obrázek úchyty; Enter nebo Hotovo použije
+	Redaction mark appearance	Vzhled značky začernění
+	Outline colour:	Barva obrysu:
+	Fill colour:	Barva výplně:
+	Shown while the pointer is over a mark.	Zobrazí se, když je ukazatel nad značkou.
+	Opacity:	Neprůhlednost:
+	Make properties default	Nastavit vlastnosti jako výchozí
+	Pages selected	Vybrané stránky
+	Page properties	Vlastnosti stránky
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
index 7a418b54e..b5baed7ba 100644
--- a/crates/ui-egui/src/i18n/de.tsv
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -23,6 +23,7 @@
 	Auto follows the system's text size. Pages always render at the display's full resolution.	Automatisch folgt der Textgröße des Systems. Seiten werden immer in der vollen Auflösung des Bildschirms dargestellt.
 	Identity	Identität
 	Name on new comments	Name für neue Kommentare
+	Hide hover previews for highlights without comment text	Hover-Vorschau für Hervorhebungen ohne Kommentartext ausblenden
 	Open…	Öffnen…
 	New blank PDF	Neues leeres PDF
 	Create PDF from file…	PDF aus Datei erstellen…
@@ -343,6 +344,7 @@
 	Split	Teilen
 	More	Mehr
 	Set page boxes	Seitenrahmen festlegen
+	Set page transitions	Seitenübergänge festlegen
 	Page labels	Seitenbeschriftungen
 	Page transitions	Seitenübergänge
 	Add comments	Kommentare hinzufügen
@@ -555,6 +557,7 @@
 	Remove unused objects and merge identical ones	Unbenutzte Objekte entfernen und identische zusammenführen
 	Audit space usage…	Speicherbelegung prüfen…
 	Space Audit	Speicherbelegung
+	What takes up the space in this file, by kind of content.	Wofür der Platz in dieser Datei verwendet wird, nach Art des Inhalts.
 	Bytes	Bytes
 	Content Streams	Inhalts-Streams
 	X Object Forms	XObject-Formulare
@@ -833,6 +836,12 @@
 	Windows store  ·  	Windows-Zertifikatspeicher  ·  
 	Issued by: 	Ausgestellt von: 
 	, Expires: 	, läuft ab: 
+	Digitally signed by	Digital signiert von
+	DN: 	DN: 
+	Reason: 	Grund: 
+	Location: 	Ort: 
+	Date: 	Datum: 
+	The labels are in English: the signature's font can't draw them in this language.	Die Beschriftungen sind auf Englisch: Die Schrift der Signatur kann sie in dieser Sprache nicht darstellen.
 	No digital IDs yet.	Noch keine digitalen IDs.
 	Configure New Digital ID	Neue digitale ID einrichten
 	Remove "{name}" from this list? The file itself is not deleted.	„{name}“ aus dieser Liste entfernen? Die Datei selbst wird nicht gelöscht.
@@ -1132,6 +1141,7 @@
 	Redaction code:	Schwärzungscode:
 	Font:	Schrift:
 	Font size:	Schriftgröße:
+	Font size	Schriftgröße
 	Auto-size text to fit redaction region	Textgröße automatisch an Schwärzungsbereich anpassen
 	Font colour:	Schriftfarbe:
 	Repeat overlay text	Überlagerungstext wiederholen
@@ -1272,6 +1282,7 @@
 	Copy text	Text kopieren
 	Properties…	Eigenschaften…
 	Make Current Properties Default	Als Standard festlegen
+	Make Properties Default	Eigenschaften als Standard festlegen
 	More options	Weitere Optionen
 	Sort by	Sortieren nach
 	Author	Verfasser
@@ -1392,6 +1403,9 @@
 	Sort comments by:	Kommentare sortieren nach:
 	Create PDF Comment Summary	Kommentarübersicht erstellen
 	Revert to the previously saved version of “{name}”? Changes since then can't be undone afterwards.	Zur zuletzt gespeicherten Version von „{name}“ zurückkehren? Seitdem vorgenommene Änderungen lassen sich danach nicht wiederherstellen.
+	Save over the changed file?	Die geänderte Datei überschreiben?
+	“{name}” changed on disk after it was opened or last saved. Saving now replaces that newer version with this one.	„{name}“ wurde auf dem Datenträger geändert, seit es geöffnet oder zuletzt gespeichert wurde. Speichern ersetzt diese neuere Version durch diese hier.
+	Save anyway	Trotzdem speichern
 	Number pages	Seiten nummerieren
 	Style	Stil
 	None (prefix only)	Keiner (nur Präfix)
@@ -1597,6 +1611,8 @@
 	Sent to {printer}	An {printer} gesendet
 	Sent to {printer}: {msg}	An {printer} gesendet: {msg}
 	Looking for printers…	Drucker werden gesucht…
+	Sending sheet {s} of {n} to {printer}…	Blatt {s} von {n} wird an {printer} gesendet…
+	No printers were found. Check that the printer is installed and the print spooler is running, then open Print again.	Es wurden keine Drucker gefunden. Prüfen Sie, ob der Drucker installiert ist und die Druckwarteschlange läuft, und öffnen Sie dann „Drucken“ erneut.
 	Sending to {printer}…	Wird an {printer} gesendet…
 	Choose a folder for the searchable files	Wähle einen Ordner für die durchsuchbaren Dateien
 	Files are combined in this order. Leave Pages empty to take every page.	Die Dateien werden in dieser Reihenfolge kombiniert. Lass „Seiten“ leer, um alle Seiten zu übernehmen.
@@ -2245,6 +2261,8 @@ key	Space	Leertaste
 	Switch to List view to change the pages it takes.	Wechsle zur Listenansicht, um die übernommenen Seiten zu ändern.
 	Expand all	Alle ausklappen
 	Collapse all	Alle einklappen
+	Collapse all pages	Alle Seiten einklappen
+	Expand all pages	Alle Seiten ausklappen
 	Remove page	Seite entfernen
 	Remove {n} pages	{n} Seiten entfernen
 
@@ -2265,10 +2283,10 @@ key	Space	Leertaste
 	Printer paper and scaling may differ. Check driver settings.	Druckerpapier und Skalierung können abweichen. Treibereinstellungen prüfen.
 	Drawing scale changes. Use Actual size for full-scale plans.	Der Zeichnungsmaßstab ändert sich. Für maßstabsgetreue Pläne Tatsächliche Größe verwenden.
 	Reload documents when their files change on disk	Dokumente neu laden, wenn sich ihre Dateien auf dem Datenträger ändern
-	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	Diese Datei wurde auf dem Datenträger geändert. Lade sie neu, um die neue Version zu sehen; deine nicht gespeicherten Änderungen gehen dabei verloren.
+	This file changed on disk. Reload shows the new version and drops your unsaved changes; Save replaces it with this version.	Diese Datei wurde auf dem Datenträger geändert. „Neu laden“ zeigt die neue Version und verwirft Ihre ungespeicherten Änderungen; „Speichern“ ersetzt sie durch diese Version.
 	Reload	Neu laden
 	Couldn't reload {name}: {e}	{name} konnte nicht neu geladen werden: {e}
-	Mouse wheel scroll speed	Scrollgeschwindigkeit des Mausrads
+	Scroll speed (mouse wheel and arrow keys)	Bildlaufgeschwindigkeit (Mausrad und Pfeiltasten)
 scroll speed	Slow	Langsam
 scroll speed	Normal	Normal
 scroll speed	Fast	Schnell
@@ -2342,6 +2360,10 @@ animation effects	Off	Aus
 	The linked PDF opened, but its named destination was not applied.	Die verknüpfte PDF wurde geöffnet, aber ihr benanntes Ziel wurde nicht angewendet.
 	The linked PDF opened, but its page destination was out of range.	Die verknüpfte PDF wurde geöffnet, aber ihr Seitenziel liegt außerhalb des Bereichs.
 	Local cross-PDF links require the desktop app	Lokale Verknüpfungen zwischen PDFs erfordern die Desktop-App
+	Cut Image	Bild ausschneiden
+	Redact Image	Bild schwärzen
+	Create Link…	Link erstellen…
+	Recognize Text…	Text erkennen…
 	Minimize	Minimieren
 	Maximize	Maximieren
 	Restore	Wiederherstellen
@@ -2351,7 +2373,59 @@ animation effects	Off	Aus
 # Absolute local GoToR confirmation (#1364).
 	Allow	Zulassen
 	Only allow this if you trust the source document.	Lassen Sie dies nur zu, wenn Sie dem Quelldokument vertrauen.
+	Open in Full Screen mode?	Im Vollbildmodus öffnen?
+	This document asks to open in Full Screen mode: the page fills the screen and nothing else shows. Press Esc at any time to leave it.	Dieses Dokument möchte im Vollbildmodus geöffnet werden: Die Seite füllt den Bildschirm, sonst wird nichts angezeigt. Mit Esc verlassen Sie ihn jederzeit.
+	Full Screen	Vollbild
+	Not now	Jetzt nicht
 	Open this local PDF?	Diese lokale PDF-Datei öffnen?
 	This document is trying to open a local file:	Dieses Dokument versucht, eine lokale Datei zu öffnen:
 	Move tag earlier	Tag früher verschieben
 	Move tag later	Tag später verschieben
+	Turn upside down (180°)	Auf den Kopf drehen (180°)
+	4 x 6 in label (101.6 x 152.4 mm)	Etikett 4 × 6 Zoll (101,6 × 152,4 mm)
+	Cuts each page to its printed area, turns it upright and fits it to the sheet without stretching. One label per sheet.	Schneidet jede Seite auf ihren bedruckten Bereich zu, richtet sie auf und passt sie ohne Verzerrung an das Blatt an. Ein Etikett pro Blatt.
+	Find untagged content	Nicht markierten Inhalt suchen
+	No untagged content was found.	Es wurde kein unmarkierter Inhalt gefunden.
+	Found {n} untagged content problems.	{n} Probleme mit unmarkiertem Inhalt gefunden.
+	Tag form fields	Formularfelder taggen
+	Mark as artifact	Als Artefakt markieren
+	Remove this leaf tag from reading order and mark its direct content as an artifact	Dieses Blatt-Tag aus der Lesereihenfolge entfernen und seinen direkten Inhalt als Artefakt markieren
+	Mark content as artifact	Inhalt als Artefakt markieren
+@id	file.word_count	Wörter zählen…
+	Word count	Wörter zählen
+	Word count…	Wörter zählen…
+	Current page only	Nur aktuelle Seite
+	Exclude tagged tables	Als Tabellen gekennzeichnete Inhalte ausschließen
+	Exclude tagged code blocks	Als Codeblöcke gekennzeichnete Inhalte ausschließen
+	Exclude image/OCR text	Bildtext und OCR-Text ausschließen
+	Exclusions use PDF tags. Untagged tables and code remain included. Image exclusion also removes invisible text.	Ausschlüsse verwenden PDF-Tags. Tabellen und Code ohne Tags werden weiterhin gezählt. Beim Ausschluss von Bildtext wird auch unsichtbarer Text ausgeschlossen.
+	Words	Wörter
+	Characters	Zeichen
+	Characters without spaces	Zeichen ohne Leerzeichen
+	Pages counted	Gezählte Seiten
+	Some pages contain no countable text. Scanned images need OCR first.	Einige Seiten enthalten keinen zählbaren Text. Führen Sie für gescannte Bilder zuerst eine Texterkennung durch.
+	Some content could not be classified safely and was kept in the count.	Einige Inhalte konnten nicht sicher zugeordnet werden und wurden mitgezählt.
+	Counting words… {n} pages read	Wörter werden gezählt… {n} Seiten gelesen
+	Word counting stopped unexpectedly.	Die Wortzählung wurde unerwartet beendet.
+	Standard	Standard
+	Mobile	Mobilgerät
+	Merge image fragments	Bildfragmente zusammenführen
+	Optimizing… merging image fragments	Optimieren… Bildfragmente werden zusammengeführt
+	Side by side	Nebeneinander
+	New file only	Nur neue Datei
+	Old file: {name}	Alte Datei: {name}
+	New file: {name}	Neue Datei: {name}
+	Print as image	Als Bild drucken
+	Resolution:	Auflösung:
+	Use it when a printer skips text, shading or transparency. The print is no longer searchable text; with Print in grayscale, the pictures are grey.	Verwenden, wenn ein Drucker Text, Schattierungen oder Transparenz auslässt. Der Ausdruck ist kein durchsuchbarer Text mehr; mit Graustufendruck sind die Bilder grau.
+	Crop Image	Bild zuschneiden
+	Remove Crop	Zuschnitt entfernen
+	Trim the picture with its handles; Enter or Done applies	Bild mit den Griffen zuschneiden; Eingabe oder Fertig übernimmt
+	Redaction mark appearance	Aussehen der Schwärzungsmarkierung
+	Outline colour:	Konturfarbe:
+	Fill colour:	Füllfarbe:
+	Shown while the pointer is over a mark.	Wird angezeigt, solange der Zeiger über einer Markierung ist.
+	Opacity:	Deckkraft:
+	Make properties default	Eigenschaften als Standard festlegen
+	Pages selected	Ausgewählte Seiten
+	Page properties	Seiteneigenschaften
diff --git a/crates/ui-egui/src/i18n/el.tsv b/crates/ui-egui/src/i18n/el.tsv
index 3a99376d6..57de6eef0 100644
--- a/crates/ui-egui/src/i18n/el.tsv
+++ b/crates/ui-egui/src/i18n/el.tsv
@@ -16,6 +16,7 @@
 	Auto follows the system's text size. Pages always render at the display's full resolution.	Η αυτόματη ρύθμιση ακολουθεί το μέγεθος κειμένου του συστήματος. Οι σελίδες αποδίδονται πάντα στην πλήρη ανάλυση της οθόνης.
 	Identity	Ταυτότητα
 	Name on new comments	Όνομα στα νέα σχόλια
+	Hide hover previews for highlights without comment text	Απόκρυψη προεπισκοπήσεων κατά την αιώρηση για επισημάνσεις χωρίς κείμενο σχολίου
 	Open…	Άνοιγμα…
 	Open Recent	Άνοιγμα πρόσφατων
 	Clear Recent Files	Εκκαθάριση πρόσφατων αρχείων
@@ -464,6 +465,12 @@
 	Choose the digital ID that you want to use for signing:	Επιλέξτε την ψηφιακή ταυτότητα με την οποία θέλετε να υπογράψετε:
 	Issued by: 	Εκδότης: 
 	, Expires: 	, Λήξη: 
+	Digitally signed by	Ψηφιακή υπογραφή από
+	DN: 	DN: 
+	Reason: 	Αιτία: 
+	Location: 	Τοποθεσία: 
+	Date: 	Ημερομηνία: 
+	The labels are in English: the signature's font can't draw them in this language.	Οι ετικέτες είναι στα αγγλικά: η γραμματοσειρά της υπογραφής δεν μπορεί να τις σχεδιάσει σε αυτή τη γλώσσα.
 	No digital IDs yet.	Δεν υπάρχουν ακόμη ψηφιακές ταυτότητες.
 	Configure New Digital ID	Ρύθμιση νέας ψηφιακής ταυτότητας
 	Remove "{name}" from this list? The file itself is not deleted.	Αφαίρεση του «{name}» από αυτή τη λίστα; Το ίδιο το αρχείο δεν διαγράφεται.
@@ -729,6 +736,7 @@
 	Redaction code:	Κωδικός απόκρυψης:
 	Font:	Γραμματοσειρά:
 	Font size:	Μέγεθος γραμματοσειράς:
+	Font size	Μέγεθος γραμματοσειράς
 	Auto-size text to fit redaction region	Αυτόματη προσαρμογή μεγέθους κειμένου στην περιοχή απόκρυψης
 	Font colour:	Χρώμα γραμματοσειράς:
 	Repeat overlay text	Επανάληψη κειμένου επικάλυψης
@@ -845,6 +853,7 @@
 	Set status	Ορισμός κατάστασης
 	Properties…	Ιδιότητες…
 	Make Current Properties Default	Ορισμός τρεχουσών ιδιοτήτων ως προεπιλογών
+	Make Properties Default	Ορισμός ιδιοτήτων ως προεπιλογών
 	Colour	Χρώμα
 	Show all comments	Εμφάνιση όλων των σχολίων
 	Create PDF comment summary…	Δημιουργία σύνοψης σχολίων σε PDF…
@@ -943,6 +952,9 @@
 	Sort comments by:	Ταξινόμηση σχολίων κατά:
 	Create PDF Comment Summary	Δημιουργία σύνοψης σχολίων PDF
 	Revert to the previously saved version of “{name}”? Changes since then can't be undone afterwards.	Επαναφορά της τελευταίας αποθηκευμένης έκδοσης του «{name}»; Οι μεταγενέστερες αλλαγές δεν θα μπορούν να αναιρεθούν.
+	Save over the changed file?	Αποθήκευση πάνω στο αλλαγμένο αρχείο;
+	“{name}” changed on disk after it was opened or last saved. Saving now replaces that newer version with this one.	Το «{name}» άλλαξε στον δίσκο μετά το άνοιγμα ή την τελευταία αποθήκευση. Η αποθήκευση τώρα αντικαθιστά αυτή τη νεότερη έκδοση με αυτήν εδώ.
+	Save anyway	Αποθήκευση ούτως ή άλλως
 	Number pages	Αρίθμηση σελίδων
 	Style	Στυλ
 	None (prefix only)	Κανένα (μόνο πρόθεμα)
@@ -1607,6 +1619,8 @@
 	Switch to List view to change the pages it takes.	Μεταβείτε στην προβολή λίστας για να αλλάξετε ποιες σελίδες θα συμπεριληφθούν.
 	Expand all	Ανάπτυξη όλων
 	Collapse all	Σύμπτυξη όλων
+	Collapse all pages	Σύμπτυξη όλων των σελίδων
+	Expand all pages	Ανάπτυξη όλων των σελίδων
 	Remove {n} pages	Αφαίρεση {n} σελίδων
 	Add an image field	Προσθήκη πεδίου εικόνας
 	Add a date field	Προσθήκη πεδίου ημερομηνίας
@@ -1705,6 +1719,7 @@
 	Page grid	Πλέγμα σελίδων
 	Extract	Εξαγωγή
 	Set page boxes	Ορισμός πλαισίων σελίδας
+	Set page transitions	Ορισμός εναλλαγών σελίδων
 	Page transitions	Μεταβάσεις σελίδων
 	Add comments	Προσθήκη σχολίων
 	Markup	Σημειώσεις επισήμανσης
@@ -1875,6 +1890,7 @@
 	Remove unused objects and merge identical ones	Αφαίρεση αχρησιμοποίητων αντικειμένων και συγχώνευση πανομοιότυπων
 	Audit space usage…	Έλεγχος χρήσης χώρου…
 	Space Audit	Έλεγχος χώρου
+	What takes up the space in this file, by kind of content.	Τι καταλαμβάνει τον χώρο σε αυτό το αρχείο, ανά είδος περιεχομένου.
 	Bytes	Byte
 	Content Streams	Ροές περιεχομένου
 	X Object Forms	Φόρμες XObject
@@ -2235,6 +2251,8 @@ comment menu	Edit	Επεξεργασία
 	Fill & Sign signature	Υπογραφή από το εργαλείο «Συμπλήρωση και υπογραφή»
 	Choose image…	Επιλογή εικόνας…
 	Looking for printers…	Αναζήτηση εκτυπωτών…
+	Sending sheet {s} of {n} to {printer}…	Αποστολή φύλλου {s} από {n} στον {printer}…
+	No printers were found. Check that the printer is installed and the print spooler is running, then open Print again.	Δεν βρέθηκαν εκτυπωτές. Ελέγξτε ότι ο εκτυπωτής είναι εγκατεστημένος και ότι η ουρά εκτύπωσης εκτελείται και, στη συνέχεια, ανοίξτε ξανά την Εκτύπωση.
 	Sending to {printer}…	Αποστολή στον {printer}…
 	Enter permissions password…	Εισαγωγή κωδικού δικαιωμάτων…
 	Permissions password	Κωδικός δικαιωμάτων
@@ -2269,10 +2287,10 @@ comment menu	Edit	Επεξεργασία
 	Printer paper and scaling may differ. Check driver settings.	Το χαρτί και η κλίμακα του εκτυπωτή μπορεί να διαφέρουν. Ελέγξτε τις ρυθμίσεις του προγράμματος οδήγησης.
 	Drawing scale changes. Use Actual size for full-scale plans.	Η κλίμακα του σχεδίου αλλάζει. Για σχέδια σε πλήρη κλίμακα χρησιμοποιήστε το Πραγματικό μέγεθος.
 	Reload documents when their files change on disk	Επαναφόρτωση εγγράφων όταν αλλάζουν τα αρχεία τους στον δίσκο
-	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	Αυτό το αρχείο άλλαξε στον δίσκο. Επαναφορτώστε το για να δείτε τη νέα έκδοση· οι μη αποθηκευμένες αλλαγές θα χαθούν.
+	This file changed on disk. Reload shows the new version and drops your unsaved changes; Save replaces it with this version.	Αυτό το αρχείο άλλαξε στον δίσκο. Η επαναφόρτωση δείχνει τη νέα έκδοση και απορρίπτει τις μη αποθηκευμένες αλλαγές σας· η αποθήκευση την αντικαθιστά με αυτή την έκδοση.
 	Reload	Επαναφόρτωση
 	Couldn't reload {name}: {e}	Δεν ήταν δυνατή η επαναφόρτωση του {name}: {e}
-	Mouse wheel scroll speed	Ταχύτητα κύλισης τροχού ποντικιού
+	Scroll speed (mouse wheel and arrow keys)	Ταχύτητα κύλισης (τροχός ποντικιού και πλήκτρα βέλους)
 scroll speed	Slow	Αργή
 scroll speed	Normal	Κανονική
 scroll speed	Fast	Γρήγορη
@@ -2351,6 +2369,10 @@ animation effects	Off	Ανενεργά
 	Local cross-PDF links require the desktop app	Οι τοπικοί σύνδεσμοι μεταξύ PDF απαιτούν την εφαρμογή υπολογιστή
 	The existing action will be preserved.	Η υπάρχουσα ενέργεια θα διατηρηθεί.
 	This form's scripts are turned off because one ran too long. Reopen the document to run them again.	Τα σενάρια αυτής της φόρμας είναι απενεργοποιημένα, επειδή ένα από αυτά εκτελούνταν για πολύ ώρα. Ανοίξτε ξανά το έγγραφο για να εκτελεστούν ξανά.
+	Cut Image	Αποκοπή εικόνας
+	Redact Image	Απόκρυψη ευαίσθητου περιεχομένου εικόνας
+	Create Link…	Δημιουργία συνδέσμου…
+	Recognize Text…	Αναγνώριση κειμένου…
 	Minimize	Ελαχιστοποίηση
 	Maximize	Μεγιστοποίηση
 	Restore	Επαναφορά
@@ -2360,7 +2382,59 @@ animation effects	Off	Ανενεργά
 # Absolute local GoToR confirmation (#1364).
 	Allow	Να επιτραπεί
 	Only allow this if you trust the source document.	Επιτρέψτε το μόνο αν εμπιστεύεστε το έγγραφο προέλευσης.
+	Open in Full Screen mode?	Άνοιγμα σε λειτουργία πλήρους οθόνης;
+	This document asks to open in Full Screen mode: the page fills the screen and nothing else shows. Press Esc at any time to leave it.	Αυτό το έγγραφο ζητά να ανοίξει σε λειτουργία πλήρους οθόνης: η σελίδα γεμίζει την οθόνη και τίποτα άλλο δεν εμφανίζεται. Πατήστε Esc οποιαδήποτε στιγμή για έξοδο.
+	Full Screen	Πλήρης οθόνη
+	Not now	Όχι τώρα
 	Open this local PDF?	Να ανοίξει αυτό το τοπικό PDF;
 	This document is trying to open a local file:	Αυτό το έγγραφο προσπαθεί να ανοίξει ένα τοπικό αρχείο:
 	Move tag earlier	Μετακίνηση ετικέτας νωρίτερα
 	Move tag later	Μετακίνηση ετικέτας αργότερα
+	Turn upside down (180°)	Αναποδογύρισμα (180°)
+	4 x 6 in label (101.6 x 152.4 mm)	Ετικέτα 4 × 6 in (101,6 × 152,4 mm)
+	Cuts each page to its printed area, turns it upright and fits it to the sheet without stretching. One label per sheet.	Περικόπτει κάθε σελίδα στην τυπωμένη περιοχή της, την ισιώνει και την προσαρμόζει στο φύλλο χωρίς παραμόρφωση. Μία ετικέτα ανά φύλλο.
+	Find untagged content	Εύρεση μη επισημασμένου περιεχομένου
+	No untagged content was found.	Δεν βρέθηκε μη επισημασμένο περιεχόμενο.
+	Found {n} untagged content problems.	Βρέθηκαν {n} προβλήματα μη επισημασμένου περιεχομένου.
+	Tag form fields	Επισήμανση πεδίων φόρμας
+	Mark as artifact	Σήμανση ως τεχνούργημα
+	Remove this leaf tag from reading order and mark its direct content as an artifact	Αφαιρέστε αυτήν την ετικέτα φύλλου από τη σειρά ανάγνωσης και σημειώστε το άμεσο περιεχόμενό της ως τεχνούργημα
+	Mark content as artifact	Σήμανση περιεχομένου ως τεχνούργημα
+	Word count	Καταμέτρηση λέξεων
+	Current page only	Μόνο η τρέχουσα σελίδα
+	Exclude tagged tables	Εξαίρεση πινάκων με ετικέτες
+	Exclude tagged code blocks	Εξαίρεση μπλοκ κώδικα με ετικέτες
+	Exclude image/OCR text	Εξαίρεση κειμένου εικόνων/OCR
+	Exclusions use PDF tags. Untagged tables and code remain included. Image exclusion also removes invisible text.	Οι εξαιρέσεις χρησιμοποιούν ετικέτες PDF. Οι πίνακες και ο κώδικας χωρίς ετικέτες παραμένουν στην καταμέτρηση. Η εξαίρεση εικόνων αφαιρεί και το αόρατο κείμενο.
+	Words	Λέξεις
+	Characters	Χαρακτήρες
+	Characters without spaces	Χαρακτήρες χωρίς κενά
+	Pages counted	Σελίδες που καταμετρήθηκαν
+	Some pages contain no countable text. Scanned images need OCR first.	Ορισμένες σελίδες δεν περιέχουν κείμενο για καταμέτρηση. Οι σαρωμένες εικόνες χρειάζονται πρώτα OCR.
+	Some content could not be classified safely and was kept in the count.	Ορισμένο περιεχόμενο δεν ήταν δυνατό να ταξινομηθεί αξιόπιστα και παρέμεινε στην καταμέτρηση.
+	Counting words… {n} pages read	Καταμέτρηση λέξεων… αναγνώστηκαν {n} σελίδες
+	Word counting stopped unexpectedly.	Η καταμέτρηση λέξεων σταμάτησε απροσδόκητα.
+	Word count…	Καταμέτρηση λέξεων…
+@id	file.word_count	Καταμέτρηση λέξεων…
+	Standard	Τυπικές
+	Mobile	Κινητό
+	Merge image fragments	Συγχώνευση τμημάτων εικόνας
+	Optimizing… merging image fragments	Βελτιστοποίηση… συγχώνευση τμημάτων εικόνας
+	Side by side	Δίπλα-δίπλα
+	New file only	Μόνο το νέο αρχείο
+	Old file: {name}	Παλιό αρχείο: {name}
+	New file: {name}	Νέο αρχείο: {name}
+	Print as image	Εκτύπωση ως εικόνα
+	Resolution:	Ανάλυση:
+	Use it when a printer skips text, shading or transparency. The print is no longer searchable text; with Print in grayscale, the pictures are grey.	Χρησιμοποιήστε το όταν ένας εκτυπωτής παραλείπει κείμενο, σκίαση ή διαφάνεια. Η εκτύπωση δεν είναι πλέον κείμενο με δυνατότητα αναζήτησης· με εκτύπωση σε αποχρώσεις του γκρι, οι εικόνες είναι γκρι.
+	Crop Image	Περικοπή εικόνας
+	Remove Crop	Κατάργηση περικοπής
+	Trim the picture with its handles; Enter or Done applies	Περικόψτε την εικόνα με τις λαβές της· Enter ή Τέλος για εφαρμογή
+	Redaction mark appearance	Εμφάνιση σήμανσης απαλοιφής
+	Outline colour:	Χρώμα περιγράμματος:
+	Fill colour:	Χρώμα γεμίσματος:
+	Shown while the pointer is over a mark.	Εμφανίζεται όσο ο δείκτης είναι πάνω από μια σήμανση.
+	Opacity:	Αδιαφάνεια:
+	Make properties default	Ορισμός ιδιοτήτων ως προεπιλογή
+	Pages selected	Επιλεγμένες σελίδες
+	Page properties	Ιδιότητες σελίδας
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index f69380564..548daf0ca 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -23,6 +23,7 @@
 	Auto follows the system's text size. Pages always render at the display's full resolution.	Automático sigue el tamaño del texto del sistema. Las páginas siempre se muestran con la resolución completa de la pantalla.
 	Identity	Identidad
 	Name on new comments	Nombre en los comentarios nuevos
+	Hide hover previews for highlights without comment text	Ocultar las vistas previas al pasar el puntero en resaltados sin texto de comentario
 	Open…	Abrir…
 	Open Recent	Abrir recientes
 	Clear Recent Files	Borrar archivos recientes
@@ -366,6 +367,7 @@
 	Split	Dividir
 	More	Más
 	Set page boxes	Definir cuadros de página
+	Set page transitions	Definir transiciones de página
 	Page labels	Etiquetas de página
 	Page transitions	Transiciones de página
 	Add comments	Añadir comentarios
@@ -578,6 +580,7 @@
 	Remove unused objects and merge identical ones	Quitar objetos sin usar y fusionar los idénticos
 	Audit space usage…	Auditar uso del espacio…
 	Space Audit	Auditoría de espacio
+	What takes up the space in this file, by kind of content.	Qué ocupa el espacio de este archivo, por tipo de contenido.
 	Bytes	Bytes
 	Content Streams	Secuencias de contenido
 	X Object Forms	Formularios XObject
@@ -849,6 +852,12 @@
 	Windows store  ·  	Almacén de Windows  ·  
 	Issued by: 	Emitido por: 
 	, Expires: 	, caduca: 
+	Digitally signed by	Firmado digitalmente por
+	DN: 	DN: 
+	Reason: 	Motivo: 
+	Location: 	Ubicación: 
+	Date: 	Fecha: 
+	The labels are in English: the signature's font can't draw them in this language.	Las etiquetas están en inglés: la fuente de la firma no puede dibujarlas en este idioma.
 	No digital IDs yet.	Aún no hay ningún ID digital.
 	Configure New Digital ID	Configurar un nuevo ID digital
 	Remove "{name}" from this list? The file itself is not deleted.	¿Quitar «{name}» de esta lista? El archivo en sí no se elimina.
@@ -1141,6 +1150,7 @@
 	Redaction code:	Código de censura:
 	Font:	Fuente:
 	Font size:	Tamaño de fuente:
+	Font size	Tamaño de fuente
 	Auto-size text to fit redaction region	Ajustar automáticamente el tamaño del texto a la zona censurada
 	Font colour:	Color de fuente:
 	Repeat overlay text	Repetir el texto superpuesto
@@ -1281,6 +1291,7 @@
 	Copy text	Copiar texto
 	Properties…	Propiedades…
 	Make Current Properties Default	Usar las propiedades actuales como predeterminadas
+	Make Properties Default	Usar las propiedades como predeterminadas
 	More options	Más opciones
 	Sort by	Ordenar por
 	Author	Autor
@@ -1402,6 +1413,9 @@
 	Sort comments by:	Ordenar comentarios por:
 	Create PDF Comment Summary	Crear resumen de comentarios en PDF
 	Revert to the previously saved version of “{name}”? Changes since then can't be undone afterwards.	¿Revertir a la última versión guardada de «{name}»? Los cambios hechos desde entonces no se podrán deshacer después.
+	Save over the changed file?	¿Guardar sobre el archivo modificado?
+	“{name}” changed on disk after it was opened or last saved. Saving now replaces that newer version with this one.	«{name}» cambió en el disco después de abrirse o guardarse por última vez. Guardar ahora reemplaza esa versión más reciente por esta.
+	Save anyway	Guardar de todos modos
 	Number pages	Numerar páginas
 	Style	Estilo
 	None (prefix only)	Ninguno (solo prefijo)
@@ -1607,6 +1621,8 @@
 	Sent to {printer}	Enviado a {printer}
 	Sent to {printer}: {msg}	Enviado a {printer}: {msg}
 	Looking for printers…	Buscando impresoras…
+	Sending sheet {s} of {n} to {printer}…	Enviando la hoja {s} de {n} a {printer}…
+	No printers were found. Check that the printer is installed and the print spooler is running, then open Print again.	No se encontró ninguna impresora. Compruebe que la impresora está instalada y que la cola de impresión está en marcha, y vuelva a abrir Imprimir.
 	Sending to {printer}…	Enviando a {printer}…
 	Choose a folder for the searchable files	Elige una carpeta para los archivos con búsqueda
 	Files are combined in this order. Leave Pages empty to take every page.	Los archivos se combinan en este orden. Deja Páginas vacío para incluir todas las páginas.
@@ -1639,6 +1655,7 @@
 comment menu	Edit	Editar
 	Undo {action}	Deshacer {action}
 	Redo {action}	Rehacer {action}
+signature pad	Type	Escribir
 certificate	Subject	Titular
 action wizard	Start	Iniciar
 	Click to sort, drag to move the column. Drag its edge to resize it.	Haz clic para ordenar; arrastra para mover la columna. Arrastra su borde para cambiar el ancho.
@@ -2135,7 +2152,7 @@ action wizard	Start	Iniciar
 	Home / End	Inicio / Fin
 	H / Space (hold)	H / Espacio (mantener)
 	Reload documents when their files change on disk	Recargar los documentos cuando sus archivos cambien en el disco
-	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	Este archivo ha cambiado en el disco. Recárgalo para ver la nueva versión; se perderán tus cambios sin guardar.
+	This file changed on disk. Reload shows the new version and drops your unsaved changes; Save replaces it with this version.	Este archivo cambió en el disco. Recargar muestra la versión nueva y descarta los cambios sin guardar; Guardar la reemplaza por esta versión.
 	Reload	Recargar
 	Couldn't reload {name}: {e}	No se pudo recargar {name}: {e}
 	Created a PDF from {n} files	Se creó un PDF a partir de {n} archivos
@@ -2157,7 +2174,7 @@ action wizard	Start	Iniciar
 	Only continue if you trust this document. An address can carry information from the document, such as what you typed into its form.	Continúa solo si confías en este documento. Una dirección puede llevar información del documento, como lo que escribiste en su formulario.
 	Print single-sided. Keep the sheets in order, cut at the marks, then stack the piles left to right, top to bottom.	Imprime a una cara. Mantén las hojas en orden, corta por las marcas y apila los montones de izquierda a derecha y de arriba abajo.
 	For page sizes and margins.	Para tamaños de página y márgenes.
-	The PDF text fonts can't draw “{c}” ({code}). Choose supported text.	Las fuentes de texto PDF no pueden mostrar «{c}» ({code}). Elija texto compatible.
+	The PDF text fonts can't draw “{c}” ({code}). Choose supported text.	Las fuentes de texto PDF no pueden mostrar «{c}» ({code}). Elige texto compatible.
 	The standard fonts can't draw “{c}” ({code}). Only Western European characters can be added as text for now.	Las fuentes estándar no pueden mostrar «{c}» ({code}). Por ahora solo se pueden añadir como texto caracteres de Europa occidental.
 	This field's font can't draw “{c}” ({code}), so PdfCraft shows ? in its place. The value is saved, and other PDF viewers redraw the field from it.	La fuente de este campo no puede mostrar «{c}» ({code}), así que PdfCraft muestra ? en su lugar. El valor se guarda y los demás visores de PDF vuelven a dibujar el campo a partir de él.
 	The fonts PdfCraft writes with can't draw “{c}” ({code}), so it shows as ? in every PDF viewer. The text is saved.	Las fuentes con las que escribe PdfCraft no pueden mostrar «{c}» ({code}), así que aparece como ? en todos los visores de PDF. El texto se guarda.
@@ -2380,6 +2397,8 @@ key	Space	Espacio
 	Switch to List view to change the pages it takes.	Cambia a la vista de lista para cambiar las páginas que se incluyen.
 	Expand all	Expandir todo
 	Collapse all	Contraer todo
+	Collapse all pages	Contraer todas las páginas
+	Expand all pages	Expandir todas las páginas
 	Remove page	Quitar página
 	Remove {n} pages	Quitar {n} páginas
 
@@ -2392,11 +2411,18 @@ key	Space	Espacio
 	Resize panel window	Cambiar tamaño de la ventana del panel
 	Tools	Herramientas
 	Inspector	Inspector
+
+# Architectural print controls (follow-up to #599).
+	PDF page: {size}	Página PDF: {size}
+	Match page at 100%	Ajustar el papel a la página al 100 %
+	PDF scale: {scale}%	Escala del PDF: {scale} %
+	Printer paper and scaling may differ. Check driver settings.	El papel y la escala de la impresora pueden variar. Revisa los ajustes del controlador.
+	Drawing scale changes. Use Actual size for full-scale plans.	La escala del dibujo cambia. Usa Tamaño real para los planos a escala.
 	Select page {label}	Seleccionar la página {label}
 	Rotate page {label} counterclockwise	Girar la página {label} a la izquierda
 	Rotate page {label} clockwise	Girar la página {label} a la derecha
 	Delete page {label}	Eliminar la página {label}
-	Mouse wheel scroll speed	Velocidad de desplazamiento de la rueda del ratón
+	Scroll speed (mouse wheel and arrow keys)	Velocidad de desplazamiento (rueda del ratón y teclas de flecha)
 scroll speed	Slow	Lenta
 scroll speed	Normal	Normal
 scroll speed	Fast	Rápida
@@ -2406,13 +2432,15 @@ animation effects	Off	Desactivados
 	Enhance camera image	Mejorar foto de cámara
 	Drag the corners onto the document's edges, then choose Enhance page.	Arrastra las esquinas hasta los bordes del documento y elige Mejorar página.
 	Enhance page	Mejorar página
+	Done adding text	Terminar de añadir texto
+	Discard this text (Esc)	Descartar este texto (Esc)
 	Certificate authority	Autoridad de certificación
 	End entity	Entidad final
 	Clean-up	Limpieza
 	Original	Original
 	Greyscale	Escala de grises
 	Black and white	Blanco y negro
-	This printer's driver doesn't take two-sided settings from other programs, so its own setting applies. Change it in Properties…	El controlador de esta impresora no acepta los ajustes de doble cara de otros programas, así que se aplica su propio ajuste. Cámbielo en Propiedades…
+	This printer's driver doesn't take two-sided settings from other programs, so its own setting applies. Change it in Properties…	El controlador de esta impresora no acepta los ajustes de doble cara de otros programas, así que se aplica su propio ajuste. Cámbialo en Propiedades…
 	Browser's print dialog	Diálogo de impresión del navegador
 	Copies, two-sided printing and colour are chosen in the browser's print dialog.	Las copias, la impresión a doble cara y el color se eligen en el diálogo de impresión del navegador.
 	Preparing {n} sheets for printing…	Preparando {n} hojas para imprimir…
@@ -2441,12 +2469,12 @@ animation effects	Off	Desactivados
 	no output folder was chosen	no se eligió ninguna carpeta de salida
 @plural	Downloaded {n} PDF|Downloaded {n} PDFs	Se descargó {n} PDF|Se descargaron {n} PDF
 	Scan	Escanear
-	Sign a sheet of white paper and take a photo of it in bright, even light (use the flash). Choose the photo or drop it here: PdfCraft finds the signature and removes the paper.	Firme en una hoja de papel blanco y hágale una foto con luz intensa y uniforme (use el flash). Elija la foto o suéltela aquí: PdfCraft encuentra la firma y elimina el papel.
+	Sign a sheet of white paper and take a photo of it in bright, even light (use the flash). Choose the photo or drop it here: PdfCraft finds the signature and removes the paper.	Firma en una hoja de papel blanco y hazle una foto con luz intensa y uniforme (usa el flash). Elige la foto o suéltala aquí: PdfCraft encuentra la firma y elimina el papel.
 	Choose photo…	Elegir foto…
 	No photo chosen	No se ha elegido ninguna foto
 	Photo	Foto
 	Ink sensitivity	Sensibilidad de la tinta
-	No signature was found in the frame. Move the frame over the signature or raise the ink sensitivity.	No se encontró ninguna firma en el marco. Mueva el marco sobre la firma o aumente la sensibilidad de la tinta.
+	No signature was found in the frame. Move the frame over the signature or raise the ink sensitivity.	No se encontró ninguna firma en el marco. Mueve el marco sobre la firma o aumenta la sensibilidad de la tinta.
 	Couldn't use the photo: {e}	No se puede usar la foto: {e}
 
 # PDF tab context menu (#1233)
@@ -2471,6 +2499,10 @@ animation effects	Off	Desactivados
 	The linked PDF opened, but its page destination was out of range.	El PDF vinculado se abrió, pero su página de destino está fuera de rango.
 	Local cross-PDF links require the desktop app	Los enlaces locales entre PDF requieren la aplicación de escritorio
 	The existing action will be preserved.	Se conservará la acción existente.
+	Cut Image	Cortar imagen
+	Redact Image	Censurar imagen
+	Create Link…	Crear enlace…
+	Recognize Text…	Reconocer texto…
 	Minimize	Minimizar
 	Maximize	Maximizar
 	Restore	Restaurar
@@ -2480,7 +2512,59 @@ animation effects	Off	Desactivados
 # Absolute local GoToR confirmation (#1364).
 	Allow	Permitir
 	Only allow this if you trust the source document.	Permite esta acción solo si confías en el documento de origen.
+	Open in Full Screen mode?	¿Abrir en modo de pantalla completa?
+	This document asks to open in Full Screen mode: the page fills the screen and nothing else shows. Press Esc at any time to leave it.	Este documento pide abrirse en modo de pantalla completa: la página llena la pantalla y no se muestra nada más. Pulse Esc en cualquier momento para salir.
+	Full Screen	Pantalla completa
+	Not now	Ahora no
 	Open this local PDF?	¿Abrir este PDF local?
 	This document is trying to open a local file:	Este documento intenta abrir un archivo local:
 	Move tag earlier	Mover etiqueta antes
 	Move tag later	Mover etiqueta después
+	Turn upside down (180°)	Girar boca abajo (180°)
+	4 x 6 in label (101.6 x 152.4 mm)	Etiqueta 4 × 6 in (101,6 × 152,4 mm)
+	Cuts each page to its printed area, turns it upright and fits it to the sheet without stretching. One label per sheet.	Recorta cada página a su área impresa, la endereza y la ajusta a la hoja sin deformarla. Una etiqueta por hoja.
+	Find untagged content	Buscar contenido sin etiquetar
+	No untagged content was found.	No se encontró contenido sin etiquetar.
+	Found {n} untagged content problems.	Se encontraron {n} problemas de contenido sin etiquetar.
+	Tag form fields	Etiquetar campos de formulario
+	Mark as artifact	Marcar como artefacto
+	Remove this leaf tag from reading order and mark its direct content as an artifact	Quite esta etiqueta hoja del orden de lectura y marque su contenido directo como artefacto
+	Mark content as artifact	Marcar contenido como artefacto
+	Word count	Recuento de palabras
+	Current page only	Solo la página actual
+	Exclude tagged tables	Excluir tablas etiquetadas
+	Exclude tagged code blocks	Excluir bloques de código etiquetados
+	Exclude image/OCR text	Excluir texto de imágenes/OCR
+	Exclusions use PDF tags. Untagged tables and code remain included. Image exclusion also removes invisible text.	Las exclusiones usan etiquetas PDF. Las tablas y el código sin etiquetas siguen incluidos. Excluir imágenes también elimina el texto invisible.
+	Words	Palabras
+	Characters	Caracteres
+	Characters without spaces	Caracteres sin espacios
+	Pages counted	Páginas contadas
+	Some pages contain no countable text. Scanned images need OCR first.	Algunas páginas no contienen texto que se pueda contar. Las imágenes escaneadas requieren OCR primero.
+	Some content could not be classified safely and was kept in the count.	Parte del contenido no se pudo clasificar de forma fiable y se mantuvo en el recuento.
+	Counting words… {n} pages read	Contando palabras… {n} páginas leídas
+	Word counting stopped unexpectedly.	El recuento de palabras se detuvo inesperadamente.
+	Word count…	Recuento de palabras…
+@id	file.word_count	Recuento de palabras…
+	Standard	Estándar
+	Mobile	Móvil
+	Merge image fragments	Combinar fragmentos de imagen
+	Optimizing… merging image fragments	Optimizando… combinando fragmentos de imagen
+	Side by side	Lado a lado
+	New file only	Solo el archivo nuevo
+	Old file: {name}	Archivo antiguo: {name}
+	New file: {name}	Archivo nuevo: {name}
+	Print as image	Imprimir como imagen
+	Resolution:	Resolución:
+	Use it when a printer skips text, shading or transparency. The print is no longer searchable text; with Print in grayscale, the pictures are grey.	Úsalo cuando una impresora omite texto, sombreados o transparencias. La impresión deja de ser texto que se puede buscar; con Imprimir en escala de grises, las imágenes son grises.
+	Crop Image	Recortar imagen
+	Remove Crop	Quitar recorte
+	Trim the picture with its handles; Enter or Done applies	Recorta la imagen con sus tiradores; Intro o Hecho lo aplica
+	Redaction mark appearance	Aspecto de la marca de censura
+	Outline colour:	Color del contorno:
+	Fill colour:	Color de relleno:
+	Shown while the pointer is over a mark.	Se muestra mientras el puntero está sobre una marca.
+	Opacity:	Opacidad:
+	Make properties default	Usar como propiedades predeterminadas
+	Pages selected	Páginas seleccionadas
+	Page properties	Propiedades de página
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index 76be27ca7..c082789bc 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -23,6 +23,7 @@
 	Auto follows the system's text size. Pages always render at the display's full resolution.	Automatique suit la taille du texte du système. Les pages sont toujours rendues à la pleine résolution de l'écran.
 	Identity	Identité
 	Name on new comments	Nom sur les nouveaux commentaires
+	Hide hover previews for highlights without comment text	Masquer les aperçus au survol des surlignages sans texte de commentaire
 	Open…	Ouvrir…
 	New blank PDF	Nouveau PDF vierge
 	Create PDF from file…	Créer un PDF à partir d'un fichier…
@@ -343,6 +344,7 @@
 	Split	Fractionner
 	More	Plus
 	Set page boxes	Définir les zones de page
+	Set page transitions	Définir les transitions de page
 	Page labels	Étiquettes de page
 	Page transitions	Transitions de page
 	Add comments	Ajouter des commentaires
@@ -555,6 +557,7 @@
 	Remove unused objects and merge identical ones	Retirer les objets inutilisés et fusionner les identiques
 	Audit space usage…	Auditer l'espace utilisé…
 	Space Audit	Audit de l'espace
+	What takes up the space in this file, by kind of content.	Ce qui occupe l'espace dans ce fichier, par type de contenu.
 	Bytes	Octets
 	Content Streams	Flux de contenu
 	X Object Forms	Formulaires XObject
@@ -829,6 +832,12 @@
 	Windows store  ·  	Magasin Windows  ·  
 	Issued by: 	Émis par : 
 	, Expires: 	, expire : 
+	Digitally signed by	Signé numériquement par
+	DN: 	DN : 
+	Reason: 	Motif : 
+	Location: 	Lieu : 
+	Date: 	Date : 
+	The labels are in English: the signature's font can't draw them in this language.	Les libellés sont en anglais : la police de la signature ne peut pas les afficher dans cette langue.
 	No digital IDs yet.	Aucun ID numérique pour l'instant.
 	Configure New Digital ID	Configurer un nouvel ID numérique
 	Remove "{name}" from this list? The file itself is not deleted.	Retirer « {name} » de cette liste ? Le fichier lui-même n’est pas supprimé.
@@ -1127,6 +1136,7 @@
 	Redaction code:	Code de biffure :
 	Font:	Police :
 	Font size:	Corps :
+	Font size	Corps
 	Auto-size text to fit redaction region	Ajuster automatiquement le corps du texte à la zone de biffure
 	Font colour:	Couleur de police :
 	Repeat overlay text	Répéter le texte en superposition
@@ -1267,6 +1277,7 @@
 	Copy text	Copier le texte
 	Properties…	Propriétés…
 	Make Current Properties Default	Utiliser les propriétés actuelles par défaut
+	Make Properties Default	Utiliser ces propriétés par défaut
 	More options	Plus d'options
 	Sort by	Trier par
 	Author	Auteur
@@ -1387,6 +1398,9 @@
 	Sort comments by:	Trier les commentaires par :
 	Create PDF Comment Summary	Créer un résumé des commentaires en PDF
 	Revert to the previously saved version of “{name}”? Changes since then can't be undone afterwards.	Revenir à la version précédemment enregistrée de «{name}» ? Les modifications faites depuis ne pourront plus être annulées.
+	Save over the changed file?	Enregistrer par-dessus le fichier modifié ?
+	“{name}” changed on disk after it was opened or last saved. Saving now replaces that newer version with this one.	« {name} » a été modifié sur le disque après son ouverture ou son dernier enregistrement. Enregistrer maintenant remplace cette version plus récente par celle-ci.
+	Save anyway	Enregistrer quand même
 	Number pages	Numéroter les pages
 	Style	Style
 	None (prefix only)	Aucun (préfixe seulement)
@@ -1592,6 +1606,8 @@
 	Sent to {printer}	Envoyé à {printer}
 	Sent to {printer}: {msg}	Envoyé à {printer} : {msg}
 	Looking for printers…	Recherche des imprimantes…
+	Sending sheet {s} of {n} to {printer}…	Envoi de la feuille {s} sur {n} à {printer}…
+	No printers were found. Check that the printer is installed and the print spooler is running, then open Print again.	Aucune imprimante trouvée. Vérifiez que l’imprimante est installée et que le spouleur d’impression fonctionne, puis rouvrez Imprimer.
 	Sending to {printer}…	Envoi à {printer}…
 	Choose a folder for the searchable files	Choisissez un dossier pour les fichiers recherchables
 	Files are combined in this order. Leave Pages empty to take every page.	Les fichiers sont combinés dans cet ordre. Laissez Pages vide pour prendre toutes les pages.
@@ -1985,7 +2001,7 @@
 	Used when a PDF doesn't ask for a layout or zoom. Continuous scrolling never snaps between pages.	Utilisé lorsqu'un PDF ne demande ni présentation ni zoom. Le défilement continu ne saute jamais d'une page à l'autre.
 	Reopen the files that were open when PdfCraft last closed	Rouvrir les fichiers qui étaient ouverts lors de la dernière fermeture de PdfCraft
 	Reload documents when their files change on disk	Recharger les documents lorsque leurs fichiers sont modifiés sur le disque
-	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	Ce fichier a été modifié sur le disque. Rechargez-le pour voir la nouvelle version ; vos modifications non enregistrées seront perdues.
+	This file changed on disk. Reload shows the new version and drops your unsaved changes; Save replaces it with this version.	Ce fichier a été modifié sur le disque. Recharger affiche la nouvelle version et abandonne vos modifications non enregistrées ; Enregistrer la remplace par cette version.
 	Reload	Recharger
 	Couldn't reload {name}: {e}	Impossible de recharger {name} : {e}
 	Show	Afficher
@@ -2244,6 +2260,8 @@ key	Space	Espace
 	Switch to List view to change the pages it takes.	Passez à la vue en liste pour modifier les pages prises.
 	Expand all	Tout développer
 	Collapse all	Tout réduire
+	Collapse all pages	Réduire toutes les pages
+	Expand all pages	Développer toutes les pages
 	Remove page	Retirer la page
 	Remove {n} pages	Retirer {n} pages
 
@@ -2267,7 +2285,7 @@ key	Space	Espace
 	Rotate page {label} counterclockwise	Faire pivoter la page {label} dans le sens antihoraire
 	Rotate page {label} clockwise	Faire pivoter la page {label} dans le sens horaire
 	Delete page {label}	Supprimer la page {label}
-	Mouse wheel scroll speed	Vitesse de défilement de la molette
+	Scroll speed (mouse wheel and arrow keys)	Vitesse de défilement (molette et touches fléchées)
 scroll speed	Slow	Lente
 scroll speed	Normal	Normale
 scroll speed	Fast	Rapide
@@ -2341,6 +2359,10 @@ animation effects	Off	Désactivés
 	The linked PDF opened, but its named destination was not applied.	Le PDF lié s'est ouvert, mais sa destination nommée n'a pas été appliquée.
 	The linked PDF opened, but its page destination was out of range.	Le PDF lié s'est ouvert, mais sa page de destination est hors limites.
 	Local cross-PDF links require the desktop app	Les liens locaux entre PDF nécessitent l'application de bureau
+	Cut Image	Couper l'image
+	Redact Image	Biffer l'image
+	Create Link…	Créer un lien…
+	Recognize Text…	Reconnaître le texte…
 	Minimize	Réduire
 	Maximize	Agrandir
 	Restore	Restaurer
@@ -2350,7 +2372,59 @@ animation effects	Off	Désactivés
 # Absolute local GoToR confirmation (#1364).
 	Allow	Autoriser
 	Only allow this if you trust the source document.	N'autorisez cette action que si vous faites confiance au document source.
+	Open in Full Screen mode?	Ouvrir en mode plein écran ?
+	This document asks to open in Full Screen mode: the page fills the screen and nothing else shows. Press Esc at any time to leave it.	Ce document demande à s’ouvrir en mode plein écran : la page remplit l’écran et rien d’autre n’est affiché. Appuyez sur Échap à tout moment pour le quitter.
+	Full Screen	Plein écran
+	Not now	Pas maintenant
 	Open this local PDF?	Ouvrir ce PDF local ?
 	This document is trying to open a local file:	Ce document tente d’ouvrir un fichier local :
 	Move tag earlier	Déplacer la balise plus tôt
 	Move tag later	Déplacer la balise plus tard
+	Turn upside down (180°)	Retourner (180°)
+	4 x 6 in label (101.6 x 152.4 mm)	Étiquette 4 × 6 po (101,6 × 152,4 mm)
+	Cuts each page to its printed area, turns it upright and fits it to the sheet without stretching. One label per sheet.	Rogne chaque page à sa zone imprimée, la redresse et l’ajuste à la feuille sans la déformer. Une étiquette par feuille.
+	Find untagged content	Rechercher le contenu non balisé
+	No untagged content was found.	Aucun contenu non balisé n’a été trouvé.
+	Found {n} untagged content problems.	{n} problèmes de contenu non balisé trouvés.
+	Tag form fields	Baliser les champs de formulaire
+	Mark as artifact	Marquer comme artefact
+	Remove this leaf tag from reading order and mark its direct content as an artifact	Retirez cette balise feuille de l’ordre de lecture et marquez son contenu direct comme artefact
+	Mark content as artifact	Marquer le contenu comme artefact
+	Word count	Nombre de mots
+	Current page only	Page actuelle uniquement
+	Exclude tagged tables	Exclure les tableaux balisés
+	Exclude tagged code blocks	Exclure les blocs de code balisés
+	Exclude image/OCR text	Exclure le texte des images/OCR
+	Exclusions use PDF tags. Untagged tables and code remain included. Image exclusion also removes invisible text.	Les exclusions utilisent les balises PDF. Les tableaux et le code non balisés restent inclus. L’exclusion des images retire aussi le texte invisible.
+	Words	Mots
+	Characters	Caractères
+	Characters without spaces	Caractères sans espaces
+	Pages counted	Pages comptées
+	Some pages contain no countable text. Scanned images need OCR first.	Certaines pages ne contiennent aucun texte à compter. Les images numérisées nécessitent d’abord une reconnaissance OCR.
+	Some content could not be classified safely and was kept in the count.	Certains contenus n’ont pas pu être classés de manière fiable et restent inclus dans le décompte.
+	Counting words… {n} pages read	Comptage des mots… {n} pages lues
+	Word counting stopped unexpectedly.	Le comptage des mots s’est arrêté de manière inattendue.
+	Word count…	Nombre de mots…
+@id	file.word_count	Nombre de mots…
+	Standard	Standard
+	Mobile	Mobile
+	Merge image fragments	Fusionner les fragments d’image
+	Optimizing… merging image fragments	Optimisation… fusion des fragments d’image
+	Side by side	Côte à côte
+	New file only	Nouveau fichier seul
+	Old file: {name}	Ancien fichier : {name}
+	New file: {name}	Nouveau fichier : {name}
+	Print as image	Imprimer comme image
+	Resolution:	Résolution :
+	Use it when a printer skips text, shading or transparency. The print is no longer searchable text; with Print in grayscale, the pictures are grey.	À utiliser quand une imprimante saute du texte, des dégradés ou de la transparence. L'impression n'est plus du texte consultable ; avec l'impression en niveaux de gris, les images sont grises.
+	Crop Image	Recadrer l'image
+	Remove Crop	Supprimer le recadrage
+	Trim the picture with its handles; Enter or Done applies	Recadrez l'image avec ses poignées ; Entrée ou Terminé applique
+	Redaction mark appearance	Apparence de la marque de biffure
+	Outline colour:	Couleur du contour :
+	Fill colour:	Couleur de remplissage :
+	Shown while the pointer is over a mark.	Affichée tant que le pointeur survole une marque.
+	Opacity:	Opacité :
+	Make properties default	Définir comme propriétés par défaut
+	Pages selected	Pages sélectionnées
+	Page properties	Propriétés de la page
diff --git a/crates/ui-egui/src/i18n/hu.tsv b/crates/ui-egui/src/i18n/hu.tsv
index 221ad21f9..b47da5b41 100644
--- a/crates/ui-egui/src/i18n/hu.tsv
+++ b/crates/ui-egui/src/i18n/hu.tsv
@@ -23,6 +23,7 @@
 	Auto follows the system's text size. Pages always render at the display's full resolution.	Az Automatikus beállítás a rendszer szövegméretét követi. Az oldalak mindig a kijelző teljes felbontásában jelennek meg.
 	Identity	Személyazonosság
 	Name on new comments	Név az új megjegyzéseken
+	Hide hover previews for highlights without comment text	Megjegyzésszöveg nélküli kiemelések előnézetének elrejtése rámutatáskor
 	Open…	Megnyitás…
 	New blank PDF	Új üres PDF
 	Create PDF from file…	PDF létrehozása fájlból…
@@ -341,6 +342,7 @@
 	Split	Felosztás
 	More	Továbbiak
 	Set page boxes	Oldalkeretek beállítása
+	Set page transitions	Oldalátmenetek beállítása
 	Page labels	Oldalcímkék
 	Page transitions	Oldalváltások
 	Add comments	Megjegyzések hozzáadása
@@ -553,6 +555,7 @@
 	Remove unused objects and merge identical ones	Nem használt objektumok eltávolítása és az azonosak egyesítése
 	Audit space usage…	Helyfoglalás vizsgálata…
 	Space Audit	Helyfoglalás
+	What takes up the space in this file, by kind of content.	Mi foglalja a helyet ebben a fájlban, tartalomtípusonként.
 	Bytes	Bájt
 	Content Streams	Tartalomfolyamok
 	X Object Forms	XObject-űrlapok
@@ -826,6 +829,12 @@
 	Windows store  ·  	Windows-tároló  ·  
 	Issued by: 	Kiállította: 
 	, Expires: 	, lejár: 
+	Digitally signed by	Digitálisan aláírta
+	DN: 	DN: 
+	Reason: 	Indok: 
+	Location: 	Hely: 
+	Date: 	Dátum: 
+	The labels are in English: the signature's font can't draw them in this language.	A címkék angolul jelennek meg: az aláírás betűtípusa ezen a nyelven nem tudja megjeleníteni őket.
 	No digital IDs yet.	Még nincs digitális azonosító.
 	Configure New Digital ID	Új digitális azonosító beállítása
 	Remove "{name}" from this list? The file itself is not deleted.	Eltávolítja a(z) „{name}” elemet erről a listáról? Maga a fájl nem törlődik.
@@ -1117,6 +1126,7 @@
 	Redaction code:	Kitakarási kód:
 	Font:	Betűtípus:
 	Font size:	Betűméret:
+	Font size	Betűméret
 	Auto-size text to fit redaction region	A szöveg automatikus méretezése a kitakarási területhez
 	Font colour:	Betű színe:
 	Repeat overlay text	Fedőszöveg ismétlése
@@ -1257,6 +1267,7 @@
 	Copy text	Szöveg másolása
 	Properties…	Tulajdonságok…
 	Make Current Properties Default	A jelenlegi tulajdonságok legyenek az alapértelmezettek
+	Make Properties Default	A tulajdonságok legyenek az alapértelmezettek
 	More options	További beállítások
 	Sort by	Rendezés szempontja
 	Author	Szerző
@@ -1377,6 +1388,9 @@
 	Sort comments by:	Megjegyzések rendezése eszerint:
 	Create PDF Comment Summary	PDF-megjegyzésösszefoglaló létrehozása
 	Revert to the previously saved version of “{name}”? Changes since then can't be undone afterwards.	Visszatérsz „{name}” előzőleg mentett változatához? Az azóta tett módosítások utána nem vonhatók vissza.
+	Save over the changed file?	Felülírja a megváltozott fájlt?
+	“{name}” changed on disk after it was opened or last saved. Saving now replaces that newer version with this one.	A(z) „{name}” megváltozott a lemezen a megnyitás vagy az utolsó mentés óta. A mentés most ezt az újabb változatot cseréli le erre.
+	Save anyway	Mentés mindenképp
 	Number pages	Oldalak számozása
 	Style	Stílus
 	None (prefix only)	Nincs (csak előtag)
@@ -1582,6 +1596,8 @@
 	Sent to {printer}	Elküldve ide: {printer}
 	Sent to {printer}: {msg}	Elküldve ide: {printer}: {msg}
 	Looking for printers…	Nyomtatók keresése…
+	Sending sheet {s} of {n} to {printer}…	{s}. lap / {n} küldése ide: {printer}…
+	No printers were found. Check that the printer is installed and the print spooler is running, then open Print again.	Nem található nyomtató. Ellenőrizze, hogy a nyomtató telepítve van-e, és fut-e a nyomtatási sorkezelő, majd nyissa meg újra a Nyomtatást.
 	Sending to {printer}…	Küldés ide: {printer}…
 	Choose a folder for the searchable files	Válassz mappát a kereshető fájloknak
 	Files are combined in this order. Leave Pages empty to take every page.	A fájlok ebben a sorrendben egyesülnek. Hagyd üresen az Oldalak mezőt, ha minden oldalt kéred.
@@ -2239,6 +2255,8 @@ key	Space	Szóköz
 	Switch to List view to change the pages it takes.	Válts listanézetre, ha módosítanád, mely oldalak kerüljenek bele.
 	Expand all	Összes kibontása
 	Collapse all	Összes összecsukása
+	Collapse all pages	Összes oldal összecsukása
+	Expand all pages	Összes oldal kibontása
 	Remove page	Oldal eltávolítása
 	Remove {n} pages	{n} oldal eltávolítása
 
@@ -2259,14 +2277,14 @@ key	Space	Szóköz
 	Printer paper and scaling may differ. Check driver settings.	A nyomtató papírja és méretezése eltérhet. Ellenőrizze az illesztőprogram beállításait.
 	Drawing scale changes. Use Actual size for full-scale plans.	A rajz méretaránya változik. Méretarányos tervekhez használja a Tényleges méret beállítást.
 	Reload documents when their files change on disk	Dokumentumok újratöltése, ha a fájljuk megváltozik a lemezen
-	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	Ez a fájl megváltozott a lemezen. Töltsd újra az új változat megtekintéséhez; a nem mentett módosításaid elvesznek.
+	This file changed on disk. Reload shows the new version and drops your unsaved changes; Save replaces it with this version.	Ez a fájl megváltozott a lemezen. Az Újratöltés az új változatot mutatja, és eldobja a nem mentett módosításokat; a Mentés erre a változatra cseréli le.
 	Reload	Újratöltés
 	Couldn't reload {name}: {e}	{name} újratöltése nem sikerült: {e}
 	Select page {label}	{label}. oldal kijelölése
 	Rotate page {label} counterclockwise	{label}. oldal elforgatása az óramutató járásával ellentétesen
 	Rotate page {label} clockwise	{label}. oldal elforgatása az óramutató járásával megegyezően
 	Delete page {label}	{label}. oldal törlése
-	Mouse wheel scroll speed	Egérgörgő görgetési sebessége
+	Scroll speed (mouse wheel and arrow keys)	Görgetési sebesség (egérgörgő és nyílbillentyűk)
 scroll speed	Slow	Lassú
 scroll speed	Normal	Normál
 scroll speed	Fast	Gyors
@@ -2340,6 +2358,10 @@ animation effects	Off	Ki
 	The linked PDF opened, but its named destination was not applied.	A hivatkozott PDF megnyílt, de a nevesített cél nem lett alkalmazva.
 	The linked PDF opened, but its page destination was out of range.	A hivatkozott PDF megnyílt, de a céloldal a tartományon kívül esik.
 	Local cross-PDF links require the desktop app	A PDF-ek közötti helyi hivatkozásokhoz az asztali alkalmazás szükséges
+	Cut Image	Kép kivágása
+	Redact Image	Kép kitakarása
+	Create Link…	Hivatkozás létrehozása…
+	Recognize Text…	Szövegfelismerés…
 	Minimize	Minimalizálás
 	Maximize	Maximalizálás
 	Restore	Visszaállítás
@@ -2349,7 +2371,59 @@ animation effects	Off	Ki
 # Absolute local GoToR confirmation (#1364).
 	Allow	Engedélyezés
 	Only allow this if you trust the source document.	Csak akkor engedélyezze ezt, ha megbízik a forrásdokumentumban.
+	Open in Full Screen mode?	Megnyitás teljes képernyős módban?
+	This document asks to open in Full Screen mode: the page fills the screen and nothing else shows. Press Esc at any time to leave it.	Ez a dokumentum teljes képernyős módban kér megnyitást: az oldal kitölti a képernyőt, és semmi más nem látszik. Az Esc billentyűvel bármikor kiléphet.
+	Full Screen	Teljes képernyő
+	Not now	Most nem
 	Open this local PDF?	Megnyitja ezt a helyi PDF-fájlt?
 	This document is trying to open a local file:	Ez a dokumentum egy helyi fájlt próbál megnyitni:
 	Move tag earlier	Címke korábbra helyezése
 	Move tag later	Címke későbbre helyezése
+	Turn upside down (180°)	Fejjel lefelé fordítás (180°)
+	4 x 6 in label (101.6 x 152.4 mm)	4 × 6 hüvelykes címke (101,6 × 152,4 mm)
+	Cuts each page to its printed area, turns it upright and fits it to the sheet without stretching. One label per sheet.	Minden oldalt a nyomtatott területére vág, függőlegesre fordítja, és torzítás nélkül a laphoz igazítja. Laponként egy címke.
+	Find untagged content	Címkézetlen tartalom keresése
+	No untagged content was found.	Nem található címkézetlen tartalom.
+	Found {n} untagged content problems.	{n} címkézetlen tartalmi probléma található.
+	Tag form fields	Űrlapmezők címkézése
+	Mark as artifact	Megjelölés műtárgyként
+	Remove this leaf tag from reading order and mark its direct content as an artifact	Távolítsa el ezt a levélcímkét az olvasási sorrendből, és jelölje meg a közvetlen tartalmát műtárgyként
+	Mark content as artifact	Tartalom megjelölése műtárgyként
+	Word count	Szavak száma
+	Current page only	Csak az aktuális oldal
+	Exclude tagged tables	Címkézett táblázatok kizárása
+	Exclude tagged code blocks	Címkézett kódblokkok kizárása
+	Exclude image/OCR text	Képek és OCR szövegének kizárása
+	Exclusions use PDF tags. Untagged tables and code remain included. Image exclusion also removes invisible text.	A kizárások PDF-címkéket használnak. A címkézetlen táblázatok és kódok továbbra is beleszámítanak. A képek kizárása a láthatatlan szöveget is eltávolítja.
+	Words	Szavak
+	Characters	Karakterek
+	Characters without spaces	Karakterek szóközök nélkül
+	Pages counted	Megszámolt oldalak
+	Some pages contain no countable text. Scanned images need OCR first.	Egyes oldalakon nincs megszámolható szöveg. A beolvasott képeken először OCR-t kell futtatni.
+	Some content could not be classified safely and was kept in the count.	Egyes tartalmakat nem lehetett megbízhatóan besorolni, ezért beleszámítanak az eredménybe.
+	Counting words… {n} pages read	Szavak számlálása… {n} oldal beolvasva
+	Word counting stopped unexpectedly.	A szavak számlálása váratlanul leállt.
+	Word count…	Szavak száma…
+@id	file.word_count	Szavak száma…
+	Standard	Normál
+	Mobile	Mobil
+	Merge image fragments	Képtöredékek egyesítése
+	Optimizing… merging image fragments	Optimalizálás… képtöredékek egyesítése
+	Side by side	Egymás mellett
+	New file only	Csak az új fájl
+	Old file: {name}	Régi fájl: {name}
+	New file: {name}	Új fájl: {name}
+	Print as image	Nyomtatás képként
+	Resolution:	Felbontás:
+	Use it when a printer skips text, shading or transparency. The print is no longer searchable text; with Print in grayscale, the pictures are grey.	Akkor használja, ha a nyomtató kihagy szöveget, árnyékolást vagy átlátszóságot. A nyomat már nem kereshető szöveg; szürkeárnyalatos nyomtatással a képek szürkék.
+	Crop Image	Kép körülvágása
+	Remove Crop	Körülvágás eltávolítása
+	Trim the picture with its handles; Enter or Done applies	Vágja körül a képet a fogantyúival; Enter vagy Kész alkalmazza
+	Redaction mark appearance	Kitakarási jelölés megjelenése
+	Outline colour:	Körvonal színe:
+	Fill colour:	Kitöltés színe:
+	Shown while the pointer is over a mark.	Akkor látszik, amikor a mutató egy jelölés fölött van.
+	Opacity:	Átlátszatlanság:
+	Make properties default	Tulajdonságok beállítása alapértelmezettként
+	Pages selected	Kijelölt oldalak
+	Page properties	Oldaltulajdonságok
diff --git a/crates/ui-egui/src/i18n/it.tsv b/crates/ui-egui/src/i18n/it.tsv
index 94eeab157..9d54a4bea 100644
--- a/crates/ui-egui/src/i18n/it.tsv
+++ b/crates/ui-egui/src/i18n/it.tsv
@@ -29,6 +29,7 @@
 	Auto follows the system's text size. Pages always render at the display's full resolution.	Auto segue la dimensione del testo del sistema. Le pagine vengono sempre visualizzate alla piena risoluzione dello schermo.
 	Identity	Identità
 	Name on new comments	Nome sui nuovi commenti
+	Hide hover previews for highlights without comment text	Nascondi le anteprime al passaggio del puntatore per le evidenziazioni senza testo di commento
 	Open…	Apri…
 	Open Recent	Apri recenti
 	Pin folder to Home…	Fissa una cartella sulla Home…
@@ -367,6 +368,7 @@
 	Split	Dividi
 	More	Altro
 	Set page boxes	Imposta riquadri pagina
+	Set page transitions	Imposta transizioni di pagina
 	Page labels	Etichette pagina
 	Page transitions	Transizioni pagina
 	Add comments	Aggiungi commenti
@@ -579,6 +581,7 @@
 	Remove unused objects and merge identical ones	Rimuovi oggetti inutilizzati e unisci quelli identici
 	Audit space usage…	Analizza uso dello spazio…
 	Space Audit	Analisi dello spazio
+	What takes up the space in this file, by kind of content.	Cosa occupa lo spazio in questo file, per tipo di contenuto.
 	Bytes	Byte
 	Content Streams	Flussi di contenuto
 	X Object Forms	Form XObject
@@ -852,6 +855,12 @@
 	Windows store  ·  	Archivio Windows  ·  
 	Issued by: 	Rilasciato da: 
 	, Expires: 	, Scadenza: 
+	Digitally signed by	Firmato digitalmente da
+	DN: 	DN: 
+	Reason: 	Motivo: 
+	Location: 	Luogo: 
+	Date: 	Data: 
+	The labels are in English: the signature's font can't draw them in this language.	Le etichette sono in inglese: il carattere della firma non può disegnarle in questa lingua.
 	No digital IDs yet.	Ancora nessun ID digitale.
 	Configure New Digital ID	Configura nuovo ID digitale
 	Remove "{name}" from this list? The file itself is not deleted.	Rimuovere "{name}" da questo elenco? Il file non viene eliminato.
@@ -1143,6 +1152,7 @@
 	Redaction code:	Codice di oscuramento:
 	Font:	Carattere:
 	Font size:	Dimensione carattere:
+	Font size	Dimensione carattere
 	Auto-size text to fit redaction region	Adatta automaticamente il testo all'area oscurata
 	Font colour:	Colore carattere:
 	Repeat overlay text	Ripeti testo sovrapposto
@@ -1282,6 +1292,7 @@
 	Copy text	Copia testo
 	Properties…	Proprietà…
 	Make Current Properties Default	Imposta le proprietà correnti come predefinite
+	Make Properties Default	Imposta le proprietà come predefinite
 	More options	Altre opzioni
 	Sort by	Ordina per
 	Author	Autore
@@ -1403,6 +1414,9 @@
 	Sort comments by:	Ordina commenti per:
 	Create PDF Comment Summary	Crea riepilogo commenti PDF
 	Revert to the previously saved version of “{name}”? Changes since then can't be undone afterwards.	Ripristinare la versione salvata in precedenza di “{name}”? Le modifiche successive non potranno essere recuperate.
+	Save over the changed file?	Salvare sopra il file modificato?
+	“{name}” changed on disk after it was opened or last saved. Saving now replaces that newer version with this one.	“{name}” è cambiato sul disco dopo l’apertura o l’ultimo salvataggio. Salvando ora, quella versione più recente viene sostituita da questa.
+	Save anyway	Salva comunque
 	Number pages	Numera pagine
 	Style	Stile
 	None (prefix only)	Nessuno (solo prefisso)
@@ -1608,6 +1622,8 @@
 	Sent to {printer}	Inviato a {printer}
 	Sent to {printer}: {msg}	Inviato a {printer}: {msg}
 	Looking for printers…	Ricerca delle stampanti…
+	Sending sheet {s} of {n} to {printer}…	Invio del foglio {s} di {n} a {printer}…
+	No printers were found. Check that the printer is installed and the print spooler is running, then open Print again.	Nessuna stampante trovata. Verifica che la stampante sia installata e che lo spooler di stampa sia in esecuzione, quindi riapri Stampa.
 	Sending to {printer}…	Invio a {printer}…
 	Choose a folder for the searchable files	Scegli una cartella per i file ricercabili
 	Files are combined from top to bottom. Leave Pages empty to take every page.	I file vengono combinati dall'alto verso il basso. Lascia vuoto Pagine per prendere tutte le pagine.
@@ -2251,6 +2267,8 @@ key	Space	Spazio
 	Switch to List view to change the pages it takes.	Passa alla vista elenco per cambiare le pagine incluse.
 	Expand all	Espandi tutto
 	Collapse all	Comprimi tutto
+	Collapse all pages	Comprimi tutte le pagine
+	Expand all pages	Espandi tutte le pagine
 	Remove page	Rimuovi pagina
 	Remove {n} pages	Rimuovi {n} pagine
 
@@ -2269,14 +2287,14 @@ key	Space	Spazio
 	Printer paper and scaling may differ. Check driver settings.	Carta e scala della stampante possono differire. Controlla le impostazioni del driver.
 	Drawing scale changes. Use Actual size for full-scale plans.	La scala del disegno cambia. Usa Dimensioni effettive per le planimetrie in scala.
 	Reload documents when their files change on disk	Ricarica i documenti quando i loro file cambiano sul disco
-	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	Questo file è cambiato sul disco. Ricaricalo per vedere la nuova versione; le modifiche non salvate andranno perse.
+	This file changed on disk. Reload shows the new version and drops your unsaved changes; Save replaces it with this version.	Questo file è cambiato sul disco. Ricarica mostra la nuova versione e scarta le modifiche non salvate; Salva la sostituisce con questa versione.
 	Reload	Ricarica
 	Couldn't reload {name}: {e}	Impossibile ricaricare {name}: {e}
 	Select page {label}	Seleziona pagina {label}
 	Rotate page {label} counterclockwise	Ruota pagina {label} in senso antiorario
 	Rotate page {label} clockwise	Ruota pagina {label} in senso orario
 	Delete page {label}	Elimina pagina {label}
-	Mouse wheel scroll speed	Velocità di scorrimento della rotellina del mouse
+	Scroll speed (mouse wheel and arrow keys)	Velocità di scorrimento (rotellina del mouse e tasti freccia)
 scroll speed	Slow	Lenta
 scroll speed	Normal	Normale
 scroll speed	Fast	Veloce
@@ -2350,6 +2368,10 @@ animation effects	Off	Disattivati
 	The linked PDF opened, but its named destination was not applied.	Il PDF collegato è stato aperto, ma la sua destinazione con nome non è stata applicata.
 	The linked PDF opened, but its page destination was out of range.	Il PDF collegato è stato aperto, ma la pagina di destinazione è fuori intervallo.
 	Local cross-PDF links require the desktop app	I collegamenti locali tra PDF richiedono l'app desktop
+	Cut Image	Taglia immagine
+	Redact Image	Oscura immagine
+	Create Link…	Crea collegamento…
+	Recognize Text…	Riconosci testo…
 	Minimize	Riduci a icona
 	Maximize	Ingrandisci
 	Restore	Ripristina
@@ -2359,7 +2381,262 @@ animation effects	Off	Disattivati
 # Absolute local GoToR confirmation (#1364).
 	Allow	Consenti
 	Only allow this if you trust the source document.	Consenti questa operazione solo se ti fidi del documento di origine.
+	Open in Full Screen mode?	Aprire in modalità schermo intero?
+	This document asks to open in Full Screen mode: the page fills the screen and nothing else shows. Press Esc at any time to leave it.	Questo documento chiede di aprirsi in modalità schermo intero: la pagina riempie lo schermo e non viene mostrato altro. Premi Esc in qualsiasi momento per uscire.
+	Full Screen	Schermo intero
+	Not now	Non ora
 	Open this local PDF?	Aprire questo PDF locale?
 	This document is trying to open a local file:	Questo documento sta tentando di aprire un file locale:
 	Move tag earlier	Sposta tag prima
 	Move tag later	Sposta tag dopo
+	Turn upside down (180°)	Capovolgi (ruota di 180°)
+	4 x 6 in label (101.6 x 152.4 mm)	Etichetta 4×6 - 101,6 × 152,4 mm
+	Cuts each page to its printed area, turns it upright and fits it to the sheet without stretching. One label per sheet.	Ritaglia l'area stampata di ogni pagina, la raddrizza e la adatta al foglio senza deformarla. Un'etichetta per foglio.
+	Find untagged content	Trova contenuto senza tag
+	No untagged content was found.	Non è stato trovato contenuto senza tag.
+	Found {n} untagged content problems.	Trovati {n} problemi di contenuto senza tag.
+	Tag form fields	Assegna tag ai campi del modulo
+	Mark as artifact	Segna come artefatto
+	Remove this leaf tag from reading order and mark its direct content as an artifact	Rimuovi questo tag foglia dall'ordine di lettura e segna il suo contenuto diretto come artefatto
+	Mark content as artifact	Segna il contenuto come artefatto
+	Word count	Conteggio parole
+	Current page only	Solo la pagina corrente
+	Exclude tagged tables	Escludi le tabelle con tag
+	Exclude tagged code blocks	Escludi i blocchi di codice con tag
+	Exclude image/OCR text	Escludi il testo di immagini/OCR
+	Exclusions use PDF tags. Untagged tables and code remain included. Image exclusion also removes invisible text.	Le esclusioni usano i tag PDF. Le tabelle e il codice senza tag restano inclusi. L’esclusione delle immagini rimuove anche il testo invisibile.
+	Words	Parole
+	Characters	Caratteri
+	Characters without spaces	Caratteri senza spazi
+	Pages counted	Pagine conteggiate
+	Some pages contain no countable text. Scanned images need OCR first.	Alcune pagine non contengono testo da contare. Le immagini acquisite richiedono prima il riconoscimento OCR.
+	Some content could not be classified safely and was kept in the count.	Alcuni contenuti non sono stati classificati in modo affidabile e sono rimasti nel conteggio.
+	Counting words… {n} pages read	Conteggio parole… {n} pagine lette
+	Word counting stopped unexpectedly.	Il conteggio delle parole si è interrotto in modo imprevisto.
+	Word count…	Conteggio parole…
+@id	file.word_count	Conteggio parole…
+	Standard	Standard
+	Mobile	Cellulare
+	Merge image fragments	Unisci frammenti di immagine
+	Optimizing… merging image fragments	Ottimizzazione… unione dei frammenti di immagine
+	Side by side	Affiancati
+	New file only	Solo il nuovo file
+	Old file: {name}	File vecchio: {name}
+	New file: {name}	File nuovo: {name}
+	Print as image	Stampa come immagine
+	Resolution:	Risoluzione:
+	Use it when a printer skips text, shading or transparency. The print is no longer searchable text; with Print in grayscale, the pictures are grey.	Usalo quando una stampante salta testo, sfumature o trasparenze. La stampa non è più testo ricercabile; con Stampa in scala di grigi le immagini sono grigie.
+	Crop Image	Ritaglia immagine
+	Remove Crop	Rimuovi ritaglio
+	Trim the picture with its handles; Enter or Done applies	Ritaglia l'immagine con le maniglie; Invio o Fatto applica
+	Redaction mark appearance	Aspetto del segno di redazione
+	Outline colour:	Colore contorno:
+	Fill colour:	Colore riempimento:
+	Shown while the pointer is over a mark.	Visibile mentre il puntatore è su un segno.
+	Opacity:	Opacità:
+	Make properties default	Imposta proprietà come predefinite
+	Pages selected	Pagine selezionate
+	Page properties	Proprietà pagina
+
+# Entries the other catalogs had and Italian lacked (2026-10-14)
+	Tools	Strumenti
+	Inspector	Ispettore
+calendar date	January	gennaio
+calendar date	February	febbraio
+calendar date	March	marzo
+calendar date	April	aprile
+calendar date	May	maggio
+calendar date	June	giugno
+calendar date	July	luglio
+calendar date	August	agosto
+calendar date	September	settembre
+calendar date	October	ottobre
+calendar date	November	novembre
+calendar date	December	dicembre
+	Creator	Applicazione
+	Producer	Produttore PDF
+	A font isn't embedded	Un carattere non è incorporato
+	A {} action isn't allowed	Un'azione {} non è consentita
+	A {} annotation has additional actions	Un'annotazione {} ha azioni aggiuntive
+	A {} annotation has no appearance stream	Un'annotazione {} non ha un flusso di aspetto
+	A {} annotation isn't set to print, or is hidden	Un'annotazione {} non è impostata per la stampa oppure è nascosta
+	Accessibility Report	Rapporto di accessibilità
+	CRL Signing	Firma CRL
+	Certificate Signing	Firma di certificati
+	Change Author	Modifica autore
+	Change Keywords	Modifica parole chiave
+	Change Subject	Modifica oggetto
+	Change Title	Modifica titolo
+	Choose a digital ID.	Scegli un ID digitale.
+	Create links	Crea collegamenti
+	Cut and stack needs Two-sided: Off. Print single-sided sheets.	Taglia e impila richiede Fronte-retro: Disattivato. Stampa fogli solo fronte.
+	Data Encipherment	Cifratura dei dati
+	Decipher Only	Solo decifratura
+	Detailed Report	Rapporto dettagliato
+	DeviceCMYK is used, but the PDF/A output intent isn't a CMYK profile	Viene usato DeviceCMYK, ma l'output intent PDF/A non è un profilo CMYK
+	DeviceRGB is used, but the PDF/A output intent isn't an RGB profile	Viene usato DeviceRGB, ma l'output intent PDF/A non è un profilo RGB
+	Digital Signature	Firma digitale
+	Encipher Only	Solo cifratura
+	English	Inglese
+	Enter a URL	Inserisci un URL
+	Enter a name.	Inserisci un nome.
+	Enter a page number	Inserisci un numero di pagina
+	Enter the field names	Inserisci i nomi dei campi
+	Field "{}" on page {p} has no description (tooltip)	Il campo "{}" a pagina {p} non ha una descrizione comando
+	Filename	Nome file
+	Flatten Fill & Sign	Appiattisci Compila e firma
+	Font (unnamed) on page {p} doesn't map its characters to Unicode	Il carattere (senza nome) a pagina {p} non associa i propri glifi a Unicode
+	Font {} on page {p} doesn't map its characters to Unicode	Il carattere {} a pagina {p} non associa i propri glifi a Unicode
+	Form field on page {p} isn't tagged	Il campo modulo a pagina {p} non ha tag
+	H{n} follows an H{d}; headings should not skip levels	H{n} segue un H{d}; i titoli non dovrebbero saltare livelli
+	Key Agreement	Accordo di chiavi
+	Key Encipherment	Cifratura delle chiavi
+	No document language is set	Nessuna lingua impostata per il documento
+	No page has text: the document appears to be images of pages	Nessuna pagina contiene testo: il documento sembra composto da immagini delle pagine
+	Non-Repudiation	Non ripudio
+	Page {p} doesn't tab in structure order	La pagina {p} non segue l'ordine della struttura con il tasto Tab
+	Page {p}: {n} untagged content item	Pagina {p}: {n} elemento di contenuto senza tag
+	Page {p}: {n} untagged content items	Pagina {p}: {n} elementi di contenuto senza tag
+	Page {} has additional actions	La pagina {} ha azioni aggiuntive
+	Panel layout could not be restored: {error}	Impossibile ripristinare la disposizione dei pannelli: {error}
+	Panel move was not applied: {error}	Lo spostamento del pannello non è stato applicato: {error}
+	PdfCraft can't check this signature yet: {}.	PdfCraft non può ancora verificare questa firma: {}.
+	Rendering…	Rendering in corso…
+	Report created	Rapporto creato
+	Rev. {rev}: Certified by an unknown signer	Rev. {rev}: certificata da un firmatario sconosciuto
+	Rev. {rev}: Certified by {name}	Rev. {rev}: certificata da {name}
+	Rev. {rev}: Signed by an unknown signer	Rev. {rev}: firmata da un firmatario sconosciuto
+	Rev. {rev}: Signed by {name}	Rev. {rev}: firmata da {name}
+	Rule Name	Nome regola
+	Save as {level}	Salva come {level}
+	Signature is invalid	La firma non è valida
+	Signature is valid	La firma è valida
+	Signature validity is unknown	La validità della firma è sconosciuta
+	Signing time is from the clock on the signer's computer.	L'ora della firma proviene dall'orologio del computer del firmatario.
+	Still rendering — this page is unusually complex…	Rendering ancora in corso: questa pagina è insolitamente complessa…
+	The ECDSA signature is not in canonical DER (trailing bytes, padding or a missing sign byte); it was read anyway.	La firma ECDSA non è in DER canonico (byte in coda, riempimento o byte di segno mancante); è stata letta comunque.
+	The ECDSA signature is the raw r and s values instead of a DER sequence; it was read anyway.	La firma ECDSA contiene i valori r e s grezzi invece di una sequenza DER; è stata letta comunque.
+	The RSA signature value does not have the length of the key's modulus (leading zero bytes dropped or added); it was read anyway.	Il valore della firma RSA non ha la lunghezza del modulo della chiave (byte zero iniziali rimossi o aggiunti); è stato letto comunque.
+	The RSA signature's DigestInfo has no NULL parameter (older signers write it so); it was read anyway.	Il DigestInfo della firma RSA non ha il parametro NULL (alcuni firmatari meno recenti lo scrivono così); è stato letto comunque.
+	The certificate of {} does not allow this many CA certificates below it (path length), so it is not used to vouch for {}.	Il certificato di {} non consente così tanti certificati CA sotto di sé (lunghezza del percorso), quindi non viene usato per garantire {}.
+	The certificate of {} is not a CA certificate that may issue certificates, so it is not used to vouch for {}.	Il certificato di {} non è un certificato CA autorizzato a emettere certificati, quindi non viene usato per garantire {}.
+	The certificate of {} was not valid at the time of signing, so it is not used to vouch for {}.	Il certificato di {} non era valido al momento della firma, quindi non viene usato per garantire {}.
+	The checker found problems which may prevent the document from being fully accessible.	Il controllo ha rilevato problemi che potrebbero impedire al documento di essere pienamente accessibile.
+	The document has been altered or corrupted since the signature was applied.	Il documento è stato alterato o danneggiato dopo l'applicazione della firma.
+	The document has been altered or corrupted since the timestamp was applied.	Il documento è stato alterato o danneggiato dopo l'applicazione della marca temporale.
+	The document has been altered since this signature was applied in ways it does not permit ({}).	Dopo l'applicazione di questa firma il documento è stato alterato in modi che essa non consente ({}).
+	The document has been altered since this timestamp was applied in ways it does not permit ({}).	Dopo l'applicazione di questa marca temporale il documento è stato alterato in modi che essa non consente ({}).
+	The document has been modified since this signature was applied, but the changes are permitted ({}).	Il documento è stato modificato dopo l'applicazione di questa firma, ma le modifiche sono consentite ({}).
+	The document has been modified since this timestamp was applied, but the changes are permitted ({}).	Il documento è stato modificato dopo l'applicazione di questa marca temporale, ma le modifiche sono consentite ({}).
+	The document has no tags (structure tree)	Il documento non ha tag (albero della struttura)
+	The document has no title	Il documento non ha un titolo
+	The document isn't marked as tagged (MarkInfo Marked)	Il documento non è contrassegnato come dotato di tag (MarkInfo Marked)
+	The document isn't tagged, so none of its content is	Il documento non ha tag, quindi nessuno dei suoi contenuti ne ha
+	The document's embedded revocation information shows that the signer's certificate has not been revoked.	Le informazioni di revoca incorporate nel documento indicano che il certificato del firmatario non è stato revocato.
+	The embedded timestamp token is valid and its authority is trusted; trusted time is {}.	Il token della marca temporale incorporata è valido e la sua autorità è attendibile; l'ora attendibile è {}.
+	The font {} isn't embedded	Il carattere {} non è incorporato
+	The metadata doesn't identify the file as {}	I metadati non identificano il file come {}
+	The password is incorrect.	La password non è corretta.
+	The password must have at least 6 characters.	La password deve contenere almeno 6 caratteri.
+	The passwords do not match.	Le password non corrispondono.
+	The security settings don't allow screen readers to read the text	Le impostazioni di sicurezza non consentono ai lettori di schermo di leggere il testo
+	The signature algorithm and the SignerInfo's digest algorithm name different hashes; the signature was made with the SignerInfo's.	L'algoritmo di firma e l'algoritmo di digest del SignerInfo indicano hash diversi; la firma è stata creata con quello del SignerInfo.
+	The signature carries an unverified timestamp ({}): the timestamp authority is not in your list of trusted certificates, so the signing time claimed by the signer is used instead.	La firma contiene una marca temporale non verificata ({}): l'autorità di marcatura temporale non è nel tuo elenco di certificati attendibili, quindi viene usata l'ora di firma dichiarata dal firmatario.
+	The signature contents are not hexadecimal.	Il contenuto della firma non è esadecimale.
+	The signature could not be checked ({}).	Impossibile controllare la firma ({}).
+	The signature could not be read ({}).	Impossibile leggere la firma ({}).
+	The signature could not be verified ({}).	Impossibile verificare la firma ({}).
+	The signature has no valid byte range.	La firma non ha un intervallo di byte valido.
+	The signature includes an embedded timestamp.	La firma include una marca temporale incorporata.
+	The signature is BER-encoded (indefinite lengths) rather than DER; it was read leniently.	La firma è codificata in BER (lunghezze indefinite) anziché in DER; è stata letta in modo tollerante.
+	The signature uses the legacy adbe.x509.rsa_sha1 format.	La firma usa il formato obsoleto adbe.x509.rsa_sha1.
+	The signature value does not match the signer's certificate: the signature is corrupt.	Il valore della firma non corrisponde al certificato del firmatario: la firma è danneggiata.
+	The signature's byte range does not exclude exactly its contents.	L'intervallo di byte della firma non esclude esattamente il suo contenuto.
+	The signature's byte range does not match the file.	L'intervallo di byte della firma non corrisponde al file.
+	The signature's timestamp token could not be verified ({}).	Impossibile verificare il token della marca temporale della firma ({}).
+	The signature's timestamp token does not cover the signature value.	Il token della marca temporale della firma non copre il valore della firma.
+	The signed content is a constructed (segmented) OCTET STRING, as BER allows; it was read anyway.	Il contenuto firmato è una OCTET STRING costruita (segmentata), come consentito da BER; è stato letto comunque.
+	The signer's certificate does not allow digital signatures (its key usage has neither digital signature nor non-repudiation).	Il certificato del firmatario non consente firme digitali (il suo utilizzo chiave non include né firma digitale né non ripudio).
+	The signer's certificate has been revoked ({}).	Il certificato del firmatario è stato revocato ({}).
+	The signer's certificate has critical extensions PdfCraft does not recognize ({}).	Il certificato del firmatario ha estensioni critiche che PdfCraft non riconosce ({}).
+	The signer's certificate is not in the signature.	Il certificato del firmatario non è presente nella firma.
+	The signer's certificate is not issued for signing documents (its extended key usage has no document-signing purpose).	Il certificato del firmatario non è emesso per firmare documenti (il suo utilizzo chiave esteso non prevede la firma di documenti).
+	The signer's certificate was not valid at the time of signing.	Il certificato del firmatario non era valido al momento della firma.
+	The signer's identity is unknown because it has not been included in your list of trusted certificates and none of its parent certificates are trusted certificates.	L'identità del firmatario è sconosciuta perché non è stata inclusa nel tuo elenco di certificati attendibili e nessuno dei suoi certificati padre è attendibile.
+	The signer's identity is valid.	L'identità del firmatario è valida.
+	The timestamp authority's certificate was not valid at the time of timestamping.	Il certificato dell'autorità di marcatura temporale non era valido al momento della marcatura.
+	The timestamp contents are not hexadecimal.	Il contenuto della marca temporale non è esadecimale.
+	The timestamp has no valid byte range.	La marca temporale non ha un intervallo di byte valido.
+	The timestamp token could not be read ({}).	Impossibile leggere il token della marca temporale ({}).
+	The timestamp token is valid and its authority is trusted.	Il token della marca temporale è valido e la sua autorità è attendibile.
+	The timestamp token is valid, but the timestamp authority is not in your list of trusted certificates.	Il token della marca temporale è valido, ma l'autorità di marcatura temporale non è nel tuo elenco di certificati attendibili.
+	The timestamp's byte range does not exclude exactly its contents.	L'intervallo di byte della marca temporale non esclude esattamente il suo contenuto.
+	The timestamp's byte range does not match the file.	L'intervallo di byte della marca temporale non corrisponde al file.
+	The window shows the file name, not the title (Initial View > Show)	La finestra mostra il nome del file, non il titolo (Vista iniziale > Mostra)
+	There is no folder to save the digital ID in.	Non c'è una cartella in cui salvare l'ID digitale.
+	This document has not been modified since this signature was applied.	Il documento non è stato modificato dopo l'applicazione di questa firma.
+	This document has not been modified since this timestamp was applied.	Il documento non è stato modificato dopo l'applicazione di questa marca temporale.
+	This signature uses RIPEMD-160, a legacy 160-bit hash algorithm that is no longer recommended for signatures. It still validates, but it should not be relied on.	Questa firma usa RIPEMD-160, un algoritmo di hash a 160 bit obsoleto e non più consigliato per le firme. Risulta ancora valida, ma non andrebbe considerata affidabile.
+	This signature uses SHA-1, a weak hash algorithm: collisions in it have been demonstrated. It still validates because many documents signed years ago use it, but it should not be relied on.	Questa firma usa SHA-1, un algoritmo di hash debole per cui sono state dimostrate collisioni. Risulta ancora valida perché molti documenti firmati anni fa lo usano, ma non andrebbe considerata affidabile.
+	Unsigned signature field	Campo firma non firmato
+	Unsigned signature field: {name}	Campo firma non firmato: {name}
+	alternate text hides an annotation inside it	il testo alternativo nasconde un'annotazione al suo interno
+	alternate text on an element with no page content	testo alternativo su un elemento senza contenuto di pagina
+	comments	commenti
+	document security store	archivio di sicurezza del documento
+	document structure	struttura del documento
+	form fill	compilazione moduli
+	its alternate text is inside another element's and will never be read	il suo testo alternativo si trova dentro quello di un altro elemento e non verrà mai letto
+	links	collegamenti
+	metadata	metadati
+	no alternate text	nessun testo alternativo
+	no header cells (TH)	nessuna cella di intestazione (TH)
+	no summary	nessun riepilogo
+	not in a TR	non in un TR
+	not in a Table, THead, TBody or TFoot	non in un Table, THead, TBody o TFoot
+	not in an L (list)	non in un L (elenco)
+	not in an LI (list item)	non in un LI (voce di elenco)
+	other changes	altre modifiche
+	page content	contenuto della pagina
+	page {n} is out of range (1–{count})	la pagina {n} è fuori intervallo (1–{count})
+	pages added or removed	pagine aggiunte o rimosse
+	rows have between {min} and {max} columns	le righe hanno da {min} a {max} colonne
+	the first heading is an H{n}; headings should not skip levels	il primo titolo è un H{n}; i titoli non dovrebbero saltare livelli
+	the signed version could not be read	impossibile leggere la versione firmata
+	{n} pages and no bookmarks	{n} pagine e nessun segnalibro
+	{page} is not a page number or label	{page} non è un numero o un'etichetta di pagina
+	{ty} element on page {p}: {what}	Elemento {ty} a pagina {p}: {what}
+	{ty} element: {what}	Elemento {ty}: {what}
+	{who}, certificate issued by an unknown issuer.	{who}, certificato rilasciato da un'autorità sconosciuta.
+	{who}, certificate issued by {issuer}.	{who}, certificato rilasciato da {issuer}.
+	{} annotation on page {p} isn't tagged	L'annotazione {} a pagina {p} non ha tag
+	{} annotations aren't allowed	Le annotazioni {} non sono consentite
+	… and {n} more	… e altri {n}
+@plural	Delete {n} field|Delete {n} fields	Elimina {n} campo|Elimina {n} campi
+@plural	{n} byte|{n} bytes	{n} byte|{n} byte
+@plural	{n} image optimized|{n} images optimized	{n} immagine ottimizzata|{n} immagini ottimizzate
+@plural	{n} item discarded|{n} items discarded	{n} elemento eliminato|{n} elementi eliminati
+@plural	{n} pixel|{n} pixels	{n} pixel|{n} pixel
+calendar weekday	Su	Do
+calendar weekday	Mo	Lu
+calendar weekday	Tu	Ma
+calendar weekday	We	Me
+calendar weekday	Th	Gi
+calendar weekday	Fr	Ve
+calendar weekday	Sa	Sa
+certificate	Issued to	Rilasciato a
+certificate	Issued by	Rilasciato da
+certificate	Valid from	Valido dal
+certificate	Valid to	Valido fino al
+certificate	Intended usage	Uso previsto
+certificate	Version	Versione
+certificate	Serial number	Numero di serie
+certificate	Issuer	Autorità emittente
+certificate	Validity starts	Inizio validità
+certificate	Validity ends	Fine validità
+certificate	Public key	Chiave pubblica
+certificate	Basic constraints	Vincoli di base
+certificate	Key usage	Utilizzo chiave
+certificate	Self-signed	Autofirmato
+certificate	SHA-1 digest	Impronta SHA-1
+certificate	SHA-256 digest	Impronta SHA-256
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index 777410e90..461e07493 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -29,6 +29,7 @@
 	Auto follows the system's text size. Pages always render at the display's full resolution.	自動にすると、システムの文字サイズに合わせます。ページは常にディスプレイの最大解像度で描画されます。
 	Identity	個人情報
 	Name on new comments	新しい注釈の作成者名
+	Hide hover previews for highlights without comment text	コメントテキストのないハイライトのホバープレビューを非表示にする
 	Open…	開く…
 	Open Recent	最近のファイルを開く
 	Clear Recent Files	最近のファイルをクリア
@@ -370,6 +371,7 @@
 	Split	分割
 	More	その他
 	Set page boxes	ページボックスを設定
+	Set page transitions	ページ切り替え効果を設定
 	Page labels	ページラベル
 	Page transitions	ページ切り替え効果
 	Add comments	コメントを追加
@@ -582,6 +584,7 @@
 	Remove unused objects and merge identical ones	未使用オブジェクトを削除し同一オブジェクトを統合
 	Audit space usage…	容量の使用状況を確認…
 	Space Audit	容量の使用状況
+	What takes up the space in this file, by kind of content.	このファイルの容量を何が占めているか、コンテンツの種類別に示します。
 	Bytes	バイト数
 	Content Streams	コンテンツストリーム
 	X Object Forms	フォーム XObject
@@ -856,6 +859,12 @@
 	Windows store  ·  	Windows 証明書ストア · 
 	Issued by: 	発行者: 
 	, Expires: 	、有効期限: 
+	Digitally signed by	デジタル署名者
+	DN: 	DN: 
+	Reason: 	理由: 
+	Location: 	場所: 
+	Date: 	日付: 
+	The labels are in English: the signature's font can't draw them in this language.	署名のフォントではこの言語のラベルを描画できないため、ラベルは英語になります。
 	No digital IDs yet.	デジタル ID はまだありません。
 	Configure New Digital ID	新しいデジタル ID を設定
 	Remove "{name}" from this list? The file itself is not deleted.	「{name}」をこの一覧から削除しますか？ファイル自体は削除されません。
@@ -1147,6 +1156,7 @@
 	Redaction code:	墨消しコード:
 	Font:	フォント:
 	Font size:	フォントサイズ:
+	Font size	フォントサイズ
 	Auto-size text to fit redaction region	墨消し領域に合わせて文字サイズを自動調整
 	Font colour:	文字色:
 	Repeat overlay text	オーバーレイテキストを繰り返す
@@ -1287,6 +1297,7 @@
 	Copy text	テキストをコピー
 	Properties…	プロパティ…
 	Make Current Properties Default	現在のプロパティを既定にする
+	Make Properties Default	プロパティを既定にする
 	More options	詳細オプション
 	Sort by	並べ替え
 	Author	作成者
@@ -1408,6 +1419,9 @@
 	Sort comments by:	注釈の並べ替え:
 	Create PDF Comment Summary	PDF 注釈の一覧を作成
 	Revert to the previously saved version of “{name}”? Changes since then can't be undone afterwards.	「{name}」を保存済みの状態に戻しますか？それ以降の変更は後から取り消せません。
+	Save over the changed file?	変更されたファイルに上書きしますか？
+	“{name}” changed on disk after it was opened or last saved. Saving now replaces that newer version with this one.	「{name}」は開いた後または最後に保存した後にディスク上で変更されました。今保存すると、その新しい版がこの版で置き換えられます。
+	Save anyway	それでも保存
 	Number pages	ページ番号を設定
 	Style	スタイル
 	None (prefix only)	なし（接頭辞のみ）
@@ -1613,6 +1627,8 @@
 	Sent to {printer}	{printer} に送信しました
 	Sent to {printer}: {msg}	{printer} に送信しました: {msg}
 	Looking for printers…	プリンターを検索しています…
+	Sending sheet {s} of {n} to {printer}…	{printer} に用紙 {s} / {n} を送信しています…
+	No printers were found. Check that the printer is installed and the print spooler is running, then open Print again.	プリンターが見つかりません。プリンターがインストールされ、印刷スプーラーが動作していることを確認してから、もう一度［印刷］を開いてください。
 	Sending to {printer}…	{printer} に送信しています…
 	Choose a folder for the searchable files	検索可能なファイルの保存先フォルダーを選択
 	Files are combined from top to bottom. Leave Pages empty to take every page.	ファイルは上から順に結合されます。すべてのページを使用する場合は「ページ」を空欄にしてください。
@@ -2240,6 +2256,8 @@ key	Space	スペース
 	Switch to List view to change the pages it takes.	使用するページを変更するには、リスト表示に切り替えてください。
 	Expand all	すべて展開
 	Collapse all	すべて折りたたむ
+	Collapse all pages	すべてのページを折りたたむ
+	Expand all pages	すべてのページを展開
 	Remove page	ページを削除
 	Remove {n} pages	{n} ページを削除
 
@@ -2260,14 +2278,14 @@ key	Space	スペース
 	Printer paper and scaling may differ. Check driver settings.	プリンターの用紙や倍率は異なる場合があります。ドライバーの設定を確認してください。
 	Drawing scale changes. Use Actual size for full-scale plans.	図面の縮尺が変わります。原寸で印刷するには「実際のサイズ」を使用してください。
 	Reload documents when their files change on disk	ディスク上のファイルが変更されたら文書を再読み込みする
-	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	このファイルはディスク上で変更されました。再読み込みすると新しいバージョンが表示されますが、未保存の変更は失われます。
+	This file changed on disk. Reload shows the new version and drops your unsaved changes; Save replaces it with this version.	このファイルはディスク上で変更されました。「再読み込み」は新しい版を表示して未保存の変更を破棄し、「保存」はこの版で置き換えます。
 	Reload	再読み込み
 	Couldn't reload {name}: {e}	{name} を再読み込みできませんでした: {e}
 	Select page {label}	ページ {label} を選択
 	Rotate page {label} counterclockwise	ページ {label} を反時計回りに回転
 	Rotate page {label} clockwise	ページ {label} を時計回りに回転
 	Delete page {label}	ページ {label} を削除
-	Mouse wheel scroll speed	マウスホイールのスクロール速度
+	Scroll speed (mouse wheel and arrow keys)	スクロール速度（マウスホイールと矢印キー）
 scroll speed	Slow	遅い
 scroll speed	Normal	標準
 scroll speed	Fast	速い
@@ -2341,6 +2359,10 @@ animation effects	Off	オフ
 	The linked PDF opened, but its named destination was not applied.	リンク先の PDF を開きましたが、名前付き移動先は適用されませんでした。
 	The linked PDF opened, but its page destination was out of range.	リンク先の PDF を開きましたが、移動先のページが範囲外です。
 	Local cross-PDF links require the desktop app	PDF 間のローカルリンクにはデスクトップアプリが必要です
+	Cut Image	画像を切り取り
+	Redact Image	画像を墨消し
+	Create Link…	リンクを作成…
+	Recognize Text…	テキストを認識…
 	Minimize	最小化
 	Maximize	最大化
 	Restore	元のサイズに戻す
@@ -2350,7 +2372,59 @@ animation effects	Off	オフ
 # Absolute local GoToR confirmation (#1364).
 	Allow	許可
 	Only allow this if you trust the source document.	元の文書を信頼できる場合にのみ許可してください。
+	Open in Full Screen mode?	フルスクリーンモードで開きますか？
+	This document asks to open in Full Screen mode: the page fills the screen and nothing else shows. Press Esc at any time to leave it.	この文書はフルスクリーンモードで開くよう求めています。ページが画面全体を占め、他には何も表示されません。Esc キーでいつでも終了できます。
+	Full Screen	フルスクリーン
+	Not now	今はしない
 	Open this local PDF?	このローカルPDFを開きますか？
 	This document is trying to open a local file:	この文書はローカルファイルを開こうとしています：
 	Move tag earlier	タグを前へ移動
 	Move tag later	タグを後へ移動
+	Turn upside down (180°)	上下反転 (180°)
+	4 x 6 in label (101.6 x 152.4 mm)	4 × 6 インチ ラベル (101.6 × 152.4 mm)
+	Cuts each page to its printed area, turns it upright and fits it to the sheet without stretching. One label per sheet.	各ページを印刷領域で切り抜き、正しい向きに回転して、伸縮させずに用紙に合わせます。1 枚に 1 ラベル。
+	Find untagged content	タグなしのコンテンツを検索
+	No untagged content was found.	タグなしのコンテンツは見つかりませんでした。
+	Found {n} untagged content problems.	タグなしのコンテンツの問題が {n} 件見つかりました。
+	Tag form fields	フォームフィールドにタグを付ける
+	Mark as artifact	アーティファクトとしてマーク
+	Remove this leaf tag from reading order and mark its direct content as an artifact	このリーフタグを読み上げ順序から削除し、その直接のコンテンツをアーティファクトとしてマークします
+	Mark content as artifact	コンテンツをアーティファクトとしてマーク
+	Word count	文字数と単語数
+	Current page only	現在のページのみ
+	Exclude tagged tables	タグ付きの表を除外
+	Exclude tagged code blocks	タグ付きのコードブロックを除外
+	Exclude image/OCR text	画像・OCRのテキストを除外
+	Exclusions use PDF tags. Untagged tables and code remain included. Image exclusion also removes invisible text.	除外にはPDFタグを使用します。タグのない表やコードは集計に含まれます。画像の除外では非表示のテキストも除外されます。
+	Words	単語数
+	Characters	文字数
+	Characters without spaces	空白を除く文字数
+	Pages counted	集計したページ数
+	Some pages contain no countable text. Scanned images need OCR first.	一部のページには集計できるテキストがありません。スキャン画像には先にOCRを実行してください。
+	Some content could not be classified safely and was kept in the count.	正確に分類できなかった内容は集計に含まれています。
+	Counting words… {n} pages read	単語を集計中… {n}ページ読み取り済み
+	Word counting stopped unexpectedly.	単語の集計が予期せず停止しました。
+	Word count…	文字数と単語数…
+@id	file.word_count	文字数と単語数…
+	Standard	標準
+	Mobile	モバイル
+	Merge image fragments	画像の断片を結合
+	Optimizing… merging image fragments	最適化中… 画像の断片を結合しています
+	Side by side	並べて表示
+	New file only	新しいファイルのみ
+	Old file: {name}	古いファイル: {name}
+	New file: {name}	新しいファイル: {name}
+	Print as image	画像として印刷
+	Resolution:	解像度:
+	Use it when a printer skips text, shading or transparency. The print is no longer searchable text; with Print in grayscale, the pictures are grey.	プリンターが文字、グラデーション、透明部分を印刷しないときに使います。印刷物は検索できる文字ではなくなります。グレースケール印刷と併用すると画像はグレーになります。
+	Crop Image	画像を切り抜き
+	Remove Crop	切り抜きを解除
+	Trim the picture with its handles; Enter or Done applies	ハンドルで画像を切り抜きます。Enter または完了で適用
+	Redaction mark appearance	墨消しマークの外観
+	Outline colour:	枠線の色:
+	Fill colour:	塗りの色:
+	Shown while the pointer is over a mark.	ポインターがマーク上にあるときに表示されます。
+	Opacity:	不透明度:
+	Make properties default	プロパティをデフォルトに設定
+	Pages selected	選択したページ
+	Page properties	ページのプロパティ
diff --git a/crates/ui-egui/src/i18n/kk.tsv b/crates/ui-egui/src/i18n/kk.tsv
index 2ce5830af..af140d3a0 100644
--- a/crates/ui-egui/src/i18n/kk.tsv
+++ b/crates/ui-egui/src/i18n/kk.tsv
@@ -9,6 +9,7 @@
 	Interface language	Интерфейс тілі
 	Identity	Жеке деректер
 	Name on new comments	Жаңа түсініктемелердегі аты
+	Hide hover previews for highlights without comment text	Түсініктеме мәтіні жоқ белгілеулер үшін меңзер алдын ала қарауын жасыру
 	Open…	Ашу…
 	Open Recent	Соңғы файлдарды ашу
 	Pin folder to Home…	Қалтаны Басты бетке бекіту…
@@ -330,6 +331,7 @@
 	Split	Бөлу
 	More	Қосымша
 	Set page boxes	Бет шектерін орнату
+	Set page transitions	Бет ауысуларын орнату
 	Page labels	Бет белгілері
 	Page transitions	Бет ауысуы
 	Add comments	Түсініктеме қосу
@@ -542,6 +544,7 @@
 	Remove unused objects and merge identical ones	Пайдаланылмаған нысандарды алып тастау және ұқсастарын біріктіру
 	Audit space usage…	Кеңістікті пайдалануды тексеру…
 	Space Audit	Кеңістікті пайдалану аудиті
+	What takes up the space in this file, by kind of content.	Бұл файлдағы орынды не алып жатыр, мазмұн түрі бойынша.
 	Bytes	Байт
 	Content Streams	Мазмұн ағындары
 	X Object Forms	XObject формалары
@@ -811,6 +814,12 @@
 	Windows store  ·  	Windows қоймасы  ·  
 	Issued by: 	Шығарушы: 
 	, Expires: 	, Жарамдылық мерзімі: 
+	Digitally signed by	Цифрлық қолтаңба қойған
+	DN: 	DN: 
+	Reason: 	Себебі: 
+	Location: 	Орны: 
+	Date: 	Күні: 
+	The labels are in English: the signature's font can't draw them in this language.	Белгілер ағылшын тілінде: қолтаңба қаріпі оларды бұл тілде сала алмайды.
 	No digital IDs yet.	Әзірге цифрлық ID жоқ.
 	Configure New Digital ID	Жаңа цифрлық ID теңшеу
 	Remove "{name}" from this list? The file itself is not deleted.	«{name}» осы тізімнен алып тасталсын ба? Файлдың өзі жойылмайды.
@@ -1091,6 +1100,7 @@
 	Custom text:	Жеке мәтін:
 	Font:	Қаріп:
 	Font size:	Қаріп өлшемі:
+	Font size	Қаріп өлшемі
 	Auto-size text to fit redaction region	Мәтін өлшемін жасыру аймағына автоматты бейімдеу
 	Font colour:	Қаріп түсі:
 	Repeat overlay text	Үстеме мәтінді қайталау
@@ -1230,6 +1240,7 @@
 	Copy text	Мәтінді көшіру
 	Properties…	Сипаттар…
 	Make Current Properties Default	Ағымдағы сипаттарды әдепкі етіп орнату
+	Make Properties Default	Сипаттарды әдепкі етіп орнату
 	More options	Қосымша параметрлер
 	Sort by	Бойынша сұрыптау
 	Author	Автор
@@ -1348,6 +1359,9 @@
 	Sort comments by:	Түсініктемелерді сұрыптау:
 	Create PDF Comment Summary	Түсініктемелердің PDF қорытындысын жасау
 	Revert to the previously saved version of “{name}”? Changes since then can't be undone afterwards.	«{name}» бұрын сақталған нұсқасына оралу керек пе? Осы уақыттан кейінгі өзгерістерді кейін болдырмауға болмайды.
+	Save over the changed file?	Өзгертілген файлдың үстіне сақтау керек пе?
+	“{name}” changed on disk after it was opened or last saved. Saving now replaces that newer version with this one.	«{name}» ашылғаннан немесе соңғы сақталғаннан кейін дискіде өзгертілді. Қазір сақтау сол жаңарақ нұсқаны осымен алмастырады.
+	Save anyway	Бәрібір сақтау
 	Number pages	Беттерді нөмірлеу
 	Style	Стиль
 	None (prefix only)	Жоқ (тек префикс)
@@ -2128,6 +2142,8 @@ calendar date	December	Желтоқсан
 	Check the pages	Беттерді белгілеу
 	Closed arrow	Жабық көрсеткі
 	Collapse all	Барлығын жию
+	Collapse all pages	Барлық беттерді жию
+	Expand all pages	Барлық беттерді жаю
 	Column select	Баған бойынша таңдау
 	Comb of characters	Таңбалар торы
 	Custom font	Арнаулы қаріп
@@ -2225,6 +2241,8 @@ key	Space	Бос орын
 	Fill & Sign signature	«Толтыру және қол қою» қолтаңбасы
 	Choose image…	Сурет таңдау…
 	Looking for printers…	Принтерлер ізделуде…
+	Sending sheet {s} of {n} to {printer}…	{n} парақтың {s}-парағы {printer} құрылғысына жіберілуде…
+	No printers were found. Check that the printer is installed and the print spooler is running, then open Print again.	Принтерлер табылмады. Принтердің орнатылғанын және басып шығару кезегі қызметінің жұмыс істеп тұрғанын тексеріп, «Басып шығару» терезесін қайта ашыңыз.
 	Sending to {printer}…	{printer} құрылғысына жіберілуде…
 	Enter permissions password…	Рұқсаттар құпиясөзін енгізу…
 	Permissions password	Рұқсаттар құпиясөзі
@@ -2259,10 +2277,10 @@ key	Space	Бос орын
 	Printer paper and scaling may differ. Check driver settings.	Принтер қағазы мен масштабы өзгеше болуы мүмкін. Драйвер параметрлерін тексеріңіз.
 	Drawing scale changes. Use Actual size for full-scale plans.	Сызба масштабы өзгереді. Толық масштабты жоспарлар үшін Нақты өлшемді пайдаланыңыз.
 	Reload documents when their files change on disk	Дискідегі файлдары өзгергенде құжаттарды қайта жүктеу
-	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	Бұл файл дискіде өзгерді. Жаңа нұсқасын көру үшін оны қайта жүктеңіз; сақталмаған өзгерістер жоғалады.
+	This file changed on disk. Reload shows the new version and drops your unsaved changes; Save replaces it with this version.	Бұл файл дискіде өзгертілді. «Қайта жүктеу» жаңа нұсқаны көрсетіп, сақталмаған өзгерістеріңізді тастайды; «Сақтау» оны осы нұсқамен алмастырады.
 	Reload	Қайта жүктеу
 	Couldn't reload {name}: {e}	{name} қайта жүктеу мүмкін болмады: {e}
-	Mouse wheel scroll speed	Тінтуір дөңгелегімен айналдыру жылдамдығы
+	Scroll speed (mouse wheel and arrow keys)	Айналдыру жылдамдығы (тінтуір дөңгелегі және көрсеткі пернелері)
 scroll speed	Slow	Баяу
 scroll speed	Normal	Қалыпты
 scroll speed	Fast	Жылдам
@@ -2339,6 +2357,10 @@ animation effects	Off	Өшірулі
 	The linked PDF opened, but its named destination was not applied.	Байланысты PDF ашылды, бірақ оның аталған мақсаты қолданылмады.
 	The linked PDF opened, but its page destination was out of range.	Байланысты PDF ашылды, бірақ оның мақсатты беті ауқымнан тыс.
 	Local cross-PDF links require the desktop app	PDF файлдары арасындағы жергілікті сілтемелер үшін жұмыс үстелі қолданбасы қажет
+	Cut Image	Суретті кесу
+	Redact Image	Суретті жасыру
+	Create Link…	Сілтеме жасау…
+	Recognize Text…	Мәтінді тану…
 	Minimize	Жию
 	Maximize	Жаю
 	Restore	Қалпына келтіру
@@ -2348,7 +2370,59 @@ animation effects	Off	Өшірулі
 # Absolute local GoToR confirmation (#1364).
 	Allow	Рұқсат беру
 	Only allow this if you trust the source document.	Бастапқы құжатқа сенсеңіз ғана рұқсат беріңіз.
+	Open in Full Screen mode?	Толық экран режимінде ашу керек пе?
+	This document asks to open in Full Screen mode: the page fills the screen and nothing else shows. Press Esc at any time to leave it.	Бұл құжат толық экран режимінде ашылуды сұрайды: бет экранды толтырады және басқа ештеңе көрсетілмейді. Шығу үшін кез келген уақытта Esc басыңыз.
+	Full Screen	Толық экран
+	Not now	Қазір емес
 	Open this local PDF?	Осы жергілікті PDF файлын ашу керек пе?
 	This document is trying to open a local file:	Бұл құжат жергілікті файлды ашуға әрекеттеніп жатыр:
 	Move tag earlier	Тегті ертерек жылжыту
 	Move tag later	Тегті кейінірек жылжыту
+	Turn upside down (180°)	Төңкеру (180°)
+	4 x 6 in label (101.6 x 152.4 mm)	4 × 6 дюйм жапсырма (101,6 × 152,4 мм)
+	Cuts each page to its printed area, turns it upright and fits it to the sheet without stretching. One label per sheet.	Әр бетті басылған аймағына дейін қиып, тік бұрып, созбай параққа сыйғызады. Әр параққа бір жапсырма.
+	Find untagged content	Тегтелмеген мазмұнды табу
+	No untagged content was found.	Тегтелмеген мазмұн табылмады.
+	Found {n} untagged content problems.	Тегтелмеген мазмұнға қатысты {n} мәселе табылды.
+	Tag form fields	Пішін өрістерін тегтеу
+	Mark as artifact	Артефакт ретінде белгілеу
+	Remove this leaf tag from reading order and mark its direct content as an artifact	Осы жапырақ тегін оқу ретінен алып тастап, оның тікелей мазмұнын артефакт ретінде белгілеңіз
+	Mark content as artifact	Мазмұнды артефакт ретінде белгілеу
+	Word count	Сөздер саны
+	Current page only	Тек ағымдағы бет
+	Exclude tagged tables	Белгіленген кестелерді есепке алмау
+	Exclude tagged code blocks	Белгіленген код блоктарын есепке алмау
+	Exclude image/OCR text	Сурет/OCR мәтінін есепке алмау
+	Exclusions use PDF tags. Untagged tables and code remain included. Image exclusion also removes invisible text.	Есептен шығару PDF тегтерін пайдаланады. Тегсіз кестелер мен код есепте қалады. Суреттерді алып тастау көрінбейтін мәтінді де алып тастайды.
+	Words	Сөздер
+	Characters	Таңбалар
+	Characters without spaces	Бос орынсыз таңбалар
+	Pages counted	Есептелген беттер
+	Some pages contain no countable text. Scanned images need OCR first.	Кейбір беттерде санауға болатын мәтін жоқ. Сканерленген суреттерге алдымен OCR қажет.
+	Some content could not be classified safely and was kept in the count.	Кейбір мазмұнды сенімді түрде жіктеу мүмкін болмады, сондықтан ол есепте қалды.
+	Counting words… {n} pages read	Сөздер саналуда… {n} бет оқылды
+	Word counting stopped unexpectedly.	Сөздерді санау күтпеген жерден тоқтады.
+	Word count…	Сөздер саны…
+@id	file.word_count	Сөздер саны…
+	Standard	Стандартты
+	Mobile	Мобильді құрылғы
+	Merge image fragments	Сурет фрагменттерін біріктіру
+	Optimizing… merging image fragments	Оңтайландыру… сурет фрагменттерін біріктіру
+	Side by side	Қатар
+	New file only	Тек жаңа файл
+	Old file: {name}	Ескі файл: {name}
+	New file: {name}	Жаңа файл: {name}
+	Print as image	Сурет ретінде басып шығару
+	Resolution:	Ажыратымдылық:
+	Use it when a printer skips text, shading or transparency. The print is no longer searchable text; with Print in grayscale, the pictures are grey.	Принтер мәтінді, көлеңкені немесе мөлдірлікті өткізіп жіберсе, қолданыңыз. Басылған құжат енді іздеуге болатын мәтін емес; сұр реңкпен басып шығарғанда суреттер сұр болады.
+	Crop Image	Суретті қию
+	Remove Crop	Қиюды алып тастау
+	Trim the picture with its handles; Enter or Done applies	Суретті тұтқаларымен қиыңыз; Enter немесе Дайын қолданады
+	Redaction mark appearance	Жасыру белгісінің көрінісі
+	Outline colour:	Контур түсі:
+	Fill colour:	Толтыру түсі:
+	Shown while the pointer is over a mark.	Меңзер белгінің үстінде тұрғанда көрсетіледі.
+	Opacity:	Мөлдірсіздік:
+	Make properties default	Қасиеттерді әдепкі ету
+	Pages selected	Таңдалған беттер
+	Page properties	Бет қасиеттері
diff --git a/crates/ui-egui/src/i18n/lt.tsv b/crates/ui-egui/src/i18n/lt.tsv
index 36c698c81..936590768 100644
--- a/crates/ui-egui/src/i18n/lt.tsv
+++ b/crates/ui-egui/src/i18n/lt.tsv
@@ -22,6 +22,7 @@
 	Auto ({percent}%)	Automatiškai ({percent} %)
 	Identity	Tapatybė
 	Name on new comments	Naujų komentarų autoriaus vardas
+	Hide hover previews for highlights without comment text	Slėpti užvedimo peržiūras paryškinimams be komentaro teksto
 	Open…	Atverti…
 	Open Recent	Atverti paskiausiai naudotus failus
 	Clear Recent Files	Išvalyti paskiausiai naudotų failų sąrašą
@@ -197,6 +198,12 @@
 	 · password-protected	 · apsaugotas slaptažodžiu
 	(none)	(nėra)
 	, Expires: 	, galiojimo pabaiga: 
+	Digitally signed by	Skaitmeniniu parašu pasirašė
+	DN: 	DN: 
+	Reason: 	Priežastis: 
+	Location: 	Vieta: 
+	Date: 	Data: 
+	The labels are in English: the signature's font can't draw them in this language.	Etiketės rodomos angliškai: parašo šriftas negali jų atvaizduoti šia kalba.
 	1 difference found	Rastas 1 skirtumas
 	1 file	1 failas
 	1 file done	1 failas apdorotas
@@ -370,6 +377,8 @@
 	Closed arrow	Uždara rodyklė
 	Collapse	Suskleisti
 	Collapse all	Suskleisti viską
+	Collapse all pages	Suskleisti visus puslapius
+	Expand all pages	Išskleisti visus puslapius
 	Collapse all bookmarks	Suskleisti visas žymeles
 	Collapse tag	Suskleisti žymą
 	Collate	Rūšiuoti komplektais
@@ -588,6 +597,7 @@
 	Font colour:	Šrifto spalva:
 	Font size 0 uses automatic sizing.	Šrifto dydis 0 reiškia, kad dydis parenkamas automatiškai.
 	Font size:	Šrifto dydis:
+	Font size	Šrifto dydis
 	Font:	Šriftas:
 	Font: Helvetica	Šriftas: „Helvetica“
 	Fonts	Šriftai
@@ -698,10 +708,12 @@
 	Locked	Užrakinta
 	Looking for PDFs…	Ieškoma PDF failų…
 	Looking for printers…	Ieškoma spausdintuvų…
+	No printers were found. Check that the printer is installed and the print spooler is running, then open Print again.	Spausdintuvų nerasta. Patikrinkite, ar spausdintuvas įdiegtas ir ar veikia spausdinimo eilė, tada vėl atverkite Spausdinti.
 	Low Resolution (150 dpi)	Maža raiška (150 dpi)
 	Low resolution	Maža raiška
 	Magnification	Didinimas
 	Make Current Properties Default	Dabartines savybes nustatyti kaip numatytąsias
+	Make Properties Default	Savybes nustatyti kaip numatytąsias
 	Margins	Paraštės
 	Mark Page Range	Pažymėti puslapių intervalą
 	Mark as comments	Pažymėti kaip komentarus
@@ -716,7 +728,7 @@
 	More options	Daugiau parinkčių
 	More options:	Daugiau parinkčių:
 	More ways to add files	Daugiau būdų pridėti failų
-	Mouse wheel scroll speed	Slinkimo ratuku greitis
+	Scroll speed (mouse wheel and arrow keys)	Slinkimo greitis (pelės ratukas ir rodyklių klavišai)
 	Move down	Perkelti žemyn
 	Move earlier	Perkelti anksčiau
 	Move later	Perkelti vėliau
@@ -962,6 +974,9 @@
 	Reverse pages	Apversti puslapius
 	Revert changes	Atšaukti pakeitimus
 	Revert to the previously saved version of “{name}”? Changes since then can't be undone afterwards.	Grąžinti anksčiau įrašytą „{name}“ versiją? Po to atliktų pakeitimų nebegalėsite atkurti.
+	Save over the changed file?	Įrašyti ant pakeisto failo?
+	“{name}” changed on disk after it was opened or last saved. Saving now replaces that newer version with this one.	„{name}“ diske pasikeitė po atidarymo arba paskutinio įrašymo. Įrašius dabar ta naujesnė versija bus pakeista šia.
+	Save anyway	Vis tiek įrašyti
 	Review History	Pakeitimų retrospektyva
 	Revisions	Versijos
 	Right	Dešinė
@@ -1036,6 +1051,7 @@
 	Selected pages	Pasirinkti puslapiai
 	Selection	Pasirinkimas
 	Sending to {printer}…	Siunčiama į {printer}…
+	Sending sheet {s} of {n} to {printer}…	Siunčiamas lapas {s} iš {n} į {printer}…
 	Sensitivity	Jautrumas
 	Sent to {printer}	Išsiųsta į {printer}
 	Sent to {printer}: {msg}	Išsiųsta į {printer}: {msg}
@@ -1089,6 +1105,7 @@
 	Sort items	Rūšiuoti elementus
 	Source	Šaltinis
 	Space Audit	Vietos naudojimo analizė
+	What takes up the space in this file, by kind of content.	Kas užima vietą šiame faile, pagal turinio rūšį.
 	Special	Specialusis
 	Split document	Skaidyti dokumentą
 	Split into files…	Skaidyti į failus…
@@ -1168,7 +1185,7 @@
 	This document isn't password-protected	Šis dokumentas neapsaugotas slaptažodžiu
 	This drawing exceeds the snapping limit; only the first paths are used.	Brėžinys viršija pritraukimo ribą; naudojami tik pirmieji keliai.
 	This field is locked. Unlock it to change its properties.	Šis laukas užrakintas. Atrakinkite jį, kad galėtumėte keisti savybes.
-	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	Failas diske pasikeitė. Įkelkite jį iš naujo, kad matytumėte naują versiją; neįrašyti pakeitimai bus prarasti.
+	This file changed on disk. Reload shows the new version and drops your unsaved changes; Save replaces it with this version.	Šis failas diske pasikeitė. „Įkelti iš naujo“ parodo naują versiją ir atmeta neįrašytus pakeitimus; „Įrašyti“ pakeičia ją šia versija.
 	This file was damaged and has been repaired. Saving keeps the repaired version.	Failas buvo pažeistas ir pataisytas. Įrašius bus išsaugota pataisyta versija.
 	This folder isn't available right now. It may have moved, or its drive or cloud sync is offline.	Aplankas šiuo metu nepasiekiamas. Jis galėjo būti perkeltas arba diskas ar sinchronizavimas su debesija neveikia.
 	This form's scripts are turned off because one ran too long. Reopen the document to run them again.	Šios formos scenarijai išjungti, nes vienas jų veikė per ilgai. Atverkite dokumentą iš naujo, kad scenarijai būtų vykdomi vėl.
@@ -1542,6 +1559,7 @@
 	Separate PDFs	Atskiri PDF dokumentai
 	Set measurement scale	Nustatyti matavimo mastelį
 	Set page boxes	Nustatyti puslapio sritis
+	Set page transitions	Nustatyti puslapių perėjimus
 	Set page boxes…	Nustatyti puslapio sritis…
 	Set properties	Nustatyti savybes
 	Show cover page in two-page view	Rodyti viršelio puslapį dviejų puslapių rodinyje
@@ -1694,7 +1712,7 @@
 	The font {} isn't embedded	Šriftas {} neįdėtas
 	The metadata doesn't identify the file as {}	Metaduomenys nenurodo, kad failas atitinka {}
 	The password is incorrect.	Slaptažodis netinkamas.
-	The password must have at least 6 characters.	Slaptažodį turi sudaryti bent 6 simboliai.
+	The password must have at least 8 characters.	Slaptažodį turi sudaryti bent 8 simboliai.
 	The passwords do not match.	Slaptažodžiai nesutampa.
 	The security settings don't allow screen readers to read the text	Saugos nuostatos neleidžia ekrano skaitymo programoms skaityti teksto
 	The signature algorithm and the SignerInfo's digest algorithm name different hashes; the signature was made with the SignerInfo's.	Parašo algoritmas ir „SignerInfo“ santraukos algoritmas nurodo skirtingas maišos funkcijas; pasirašyta naudojant „SignerInfo“ nurodytą funkciją.
@@ -2585,6 +2603,10 @@ key	Esc	Esc
 key	Home	Home
 key	End	End
 key	Space	Tarpas
+	Cut Image	Iškirpti paveikslėlį
+	Redact Image	Pašalinti konfidencialią informaciją iš paveikslėlio
+	Create Link…	Kurti saitą…
+	Recognize Text…	Atpažinti tekstą…
 	Minimize	Sumažinti
 	Maximize	Išdidinti
 	Restore	Atkurti
@@ -2594,7 +2616,66 @@ key	Space	Tarpas
 # Absolute local GoToR confirmation (#1364).
 	Allow	Leisti
 	Only allow this if you trust the source document.	Leiskite tai tik tuo atveju, jei pasitikite pirminiu dokumentu.
+	Open in Full Screen mode?	Atidaryti viso ekrano režimu?
+	This document asks to open in Full Screen mode: the page fills the screen and nothing else shows. Press Esc at any time to leave it.	Šis dokumentas prašo būti atidarytas viso ekrano režimu: puslapis užpildo ekraną ir daugiau niekas nerodoma. Norėdami išeiti, bet kada paspauskite Esc.
+	Full Screen	Visas ekranas
+	Not now	Ne dabar
 	Open this local PDF?	Atverti šį vietinį PDF failą?
 	This document is trying to open a local file:	Šis dokumentas bando atverti vietinį failą:
 	Move tag earlier	Perkelti žymą anksčiau
 	Move tag later	Perkelti žymą vėliau
+	Turn upside down (180°)	Apversti aukštyn kojomis (180°)
+	4 x 6 in label (101.6 x 152.4 mm)	4 × 6 col. etiketė (101,6 × 152,4 mm)
+	Cuts each page to its printed area, turns it upright and fits it to the sheet without stretching. One label per sheet.	Apkerpa kiekvieną puslapį iki spausdinamos srities, pasuka tiesiai ir pritaiko lapui neiškraipydama. Viena etiketė lape.
+	Find untagged content	Rasti nepažymėtą turinį
+	No untagged content was found.	Nepažymėto turinio nerasta.
+	Found {n} untagged content problems.	Rasta nepažymėto turinio problemų: {n}.
+	Tag form fields	Žymėti formos laukus
+	Mark as artifact	Pažymėti kaip artefaktą
+	Remove this leaf tag from reading order and mark its direct content as an artifact	Pašalinkite šią lapo žymą iš skaitymo tvarkos ir pažymėkite jos tiesioginį turinį kaip artefaktą
+	Mark content as artifact	Pažymėti turinį kaip artefaktą
+	Word count	Žodžių skaičius
+	Current page only	Tik dabartinis puslapis
+	Exclude tagged tables	Neįtraukti pažymėtų lentelių
+	Exclude tagged code blocks	Neįtraukti pažymėtų kodo blokų
+	Exclude image/OCR text	Neįtraukti vaizdų ir OCR teksto
+	Exclusions use PDF tags. Untagged tables and code remain included. Image exclusion also removes invisible text.	Išimtys naudoja PDF žymas. Nepažymėtos lentelės ir kodas lieka įtraukti. Vaizdų išimtis pašalina ir nematomą tekstą.
+	Words	Žodžiai
+	Characters	Simboliai
+	Characters without spaces	Simboliai be tarpų
+	Pages counted	Suskaičiuoti puslapiai
+	Some pages contain no countable text. Scanned images need OCR first.	Kai kuriuose puslapiuose nėra skaičiuojamo teksto. Nuskaitytiems vaizdams pirmiausia reikia OCR.
+	Some content could not be classified safely and was kept in the count.	Dalies turinio nepavyko patikimai klasifikuoti, todėl jis liko įtrauktas į skaičių.
+	Counting words… {n} pages read	Skaičiuojami žodžiai… perskaityta puslapių: {n}
+	Word counting stopped unexpectedly.	Žodžių skaičiavimas netikėtai sustojo.
+	Word count…	Žodžių skaičius…
+@id	file.word_count	Žodžių skaičius…
+	Standard	Standartinis
+	Mobile	Mobilusis
+	Merge image fragments	Sujungti vaizdo fragmentus
+	Optimizing… merging image fragments	Optimizuojama… jungiami vaizdo fragmentai
+	Side by side	Greta
+	New file only	Tik naujas failas
+	Old file: {name}	Senas failas: {name}
+	New file: {name}	Naujas failas: {name}
+	Print as image	Spausdinti kaip vaizdą
+	Resolution:	Raiška:
+	Use it when a printer skips text, shading or transparency. The print is no longer searchable text; with Print in grayscale, the pictures are grey.	Naudokite, kai spausdintuvas praleidžia tekstą, šešėliavimą ar skaidrumą. Atspaudas nebėra ieškomas tekstas; spausdinant pilkais atspalviais vaizdai yra pilki.
+	Crop Image	Apkarpyti vaizdą
+	Remove Crop	Pašalinti apkarpymą
+	Trim the picture with its handles; Enter or Done applies	Apkarpykite paveikslėlį rankenėlėmis; Enter arba Atlikta pritaiko
+	Redaction mark appearance	Užtamsinimo žymės išvaizda
+	Outline colour:	Kontūro spalva:
+	Fill colour:	Užpildo spalva:
+	Shown while the pointer is over a mark.	Rodoma, kol žymeklis yra virš žymės.
+	Opacity:	Nepermatomumas:
+	Make properties default	Nustatyti ypatybes kaip numatytąsias
+	Pages selected	Pasirinkti puslapiai
+	Page properties	Puslapio ypatybės
+
+# AI-assisted additions for concurrently merged UI features (2026-10-15).
+# These additions have not had separate native-speaker review.
+	Mouse wheel scroll speed	Pelės ratuko slinkimo greitis
+	The password must have at least 6 characters.	Slaptažodį turi sudaryti bent 6 simboliai.
+	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	Šis failas diske pasikeitė. Įkelkite jį iš naujo, kad pamatytumėte naują versiją; neįrašyti pakeitimai bus prarasti.
+theme	Appearance	Išvaizda
diff --git a/crates/ui-egui/src/i18n/mod.rs b/crates/ui-egui/src/i18n/mod.rs
index 18a0fc54b..5bb2889c9 100644
--- a/crates/ui-egui/src/i18n/mod.rs
+++ b/crates/ui-egui/src/i18n/mod.rs
@@ -147,7 +147,7 @@ fn plural_sl(n: u64) -> usize {
 }
 
 /// The registry. English first: it is the fallback and the source language.
-pub static LANGUAGES: [LangInfo; 22] = [
+pub static LANGUAGES: [LangInfo; 23] = [
     LangInfo { code: "en", name: "English", source: "", plural: plural_one_other, rtl: false, catalog: OnceLock::new() },
     LangInfo { code: "ja", name: "日本語", source: include_str!("ja.tsv"), plural: plural_none, rtl: false, catalog: OnceLock::new() },
     // Simplified Chinese; `zh`, `zh-CN`, `zh-SG` and `zh-Hans-*` locales resolve here (see `candidates`).
@@ -207,6 +207,9 @@ pub static LANGUAGES: [LangInfo; 22] = [
     LangInfo { code: "tr", name: "Türkçe", source: include_str!("tr.tsv"), plural: plural_none, rtl: false, catalog: OnceLock::new() },
     // Lithuanian; every `lt-*` locale (`lt-LT`, `lt_LT.UTF-8`) resolves here. Three plural forms (one, few, other).
     LangInfo { code: "lt", name: "Lietuvių", source: include_str!("lt.tsv"), plural: plural_lithuanian, rtl: false, catalog: OnceLock::new() },
+    // Vietnamese; every `vi-*` locale (`vi-VN`, `vi_VN.UTF-8`) resolves here. CLDR `vi` counts have
+    // one form ("other"), so `@plural` entries list a single form.
+    LangInfo { code: "vi", name: "Tiếng Việt", source: include_str!("vi.tsv"), plural: plural_none, rtl: false, catalog: OnceLock::new() },
 ];
 
 impl LangInfo {
@@ -938,6 +941,26 @@ mod tests {
         }
     }
 
+    /// Every catalog says the labels of a visible signature, which are looked up by the sign
+    /// crate's own English words (so the `tl!` scan can't see them), and the note shown when they
+    /// fall back to English. Each label that runs into its value keeps a separator at its end.
+    #[test]
+    fn signature_appearance_labels_are_in_every_catalog() {
+        let english = pdfcraft_engine::sign::AppearanceLabels::default();
+        let note = "The labels are in English: the signature's font can't draw them in this language.";
+        for language in LANGUAGES.iter().filter(|language| !language.source.is_empty()) {
+            let lang = Lang::from_code(language.code).expect("registered language");
+            assert!(has(lang, note), "{} lacks the labels note", language.code);
+            for (field, label) in english.fields() {
+                assert!(has(lang, label), "{} lacks the signature label {field}: {label:?}", language.code);
+                let said = tr(lang, label);
+                if field != "signed_by" && !lang.rtl() {
+                    assert!(said.ends_with(' ') || said.ends_with('：'), "{}: the {field} label runs into its value: {said:?}", language.code);
+                }
+            }
+        }
+    }
+
     /// Japanese translates every `tl!("…")` literal in the UI source, so a new string can't ship in
     /// English by accident (the same check French, German, Russian and Simplified Chinese have).
     #[test]
@@ -1163,6 +1186,8 @@ mod tests {
         assert_eq!(tr(es, "Informe del usuario.pdf"), "Informe del usuario.pdf");
         assert_eq!(trn(es, 1, "{n} page", "{n} pages"), "1 página");
         assert_eq!(trn(es, 3, "{n} page", "{n} pages"), "3 páginas");
+        // The signature pad's Type is the verb (type your name), not the noun "Tipo".
+        assert_eq!(tr_ctx(es, "signature pad", "Type"), "Escribir");
         let mut app = crate::PdfCraftApp::default();
         app.set_option("language", "es").unwrap();
         assert_eq!(app.language, "es");
@@ -1177,6 +1202,9 @@ mod tests {
         let es = Lang::from_code("es").expect("es registered");
         for command in pdfcraft_engine::commands::COMMANDS {
             assert!(has(es, command.label), "missing command: {}", command.label);
+            if let Some(menu) = command.menu {
+                assert!(has(es, menu), "missing menu: {menu}");
+            }
         }
         for group in pdfcraft_engine::catalog::TOOL_GROUPS {
             assert!(has(es, group.label), "missing group: {}", group.label);
@@ -1189,6 +1217,16 @@ mod tests {
         }
     }
 
+    /// New tl!("literal") labels must not silently fall back to English in Spanish.
+    #[test]
+    fn spanish_covers_ui_literals() {
+        let es = Lang::from_code("es").expect("es registered");
+        let literals = ui_literals();
+        assert!(literals.len() > 900, "source scan found only {} literals", literals.len());
+        let missing: Vec<_> = literals.iter().filter(|label| !has(es, label)).collect();
+        assert!(missing.is_empty(), "untranslated Spanish UI literals: {missing:#?}");
+    }
+
     /// Spanish says everything the layers below word for themselves: what the accessibility
     /// checker finds and what its saved report calls things, what the PDF/A verifier reports, what
     /// a signature's details say and the changes they name, what can be wrong with the pages to
@@ -1283,8 +1321,9 @@ mod tests {
         let te = Lang::from_code("te").expect("te registered");
         assert_eq!(tr_ctx(te, "signature pad", "Type"), "టైప్ చేయి");
         assert_eq!(tr(te, "Type"), "రకం");
+        // A context no catalog defines, so the fallback stays tested as catalogs fill their gaps.
         let es = Lang::from_code("es").expect("es registered");
-        assert_eq!(tr_ctx(es, "signature pad", "Type"), tr(es, "Type"));
+        assert_eq!(tr_ctx(es, "no such context", "Type"), tr(es, "Type"));
     }
 
     /// Telugu translates every registered command and every All tools group, section and item.
@@ -1367,6 +1406,8 @@ mod tests {
             "ΔLOC",
             "+Bin",
             "−Bin",
+            // The distinguished name of a certificate, abbreviated as in X.500.
+            "DN: ",
         ];
         let (entries, errors) = parse_entries(cs.0.source, cs.0.plural_forms());
         assert!(errors.is_empty(), "{errors:?}");
@@ -1479,6 +1520,8 @@ mod tests {
             "−Bin",
             "Model",
             "Home / End",
+            // The distinguished name of a certificate, abbreviated as in X.500.
+            "DN: ",
         ];
         let (entries, errors) = parse_entries(tr_lang.0.source, tr_lang.0.plural_forms());
         assert!(errors.is_empty(), "Turkish catalog errors: {errors:?}");
@@ -2259,6 +2302,243 @@ mod tests {
         );
     }
 
+    #[test]
+    fn vietnamese_is_registered_and_persists() {
+        let vi = Lang::from_code("vi").expect("vi registered");
+        assert_eq!(vi.name(), "Tiếng Việt");
+        assert_eq!(normalize_pref("Vi"), Some("vi"));
+        for tag in ["vi", "vi-VN", "vi_VN.UTF-8", "VI-vn"] {
+            assert_eq!(lang_from_tag(tag), Some(vi), "{tag}");
+        }
+        assert_eq!(first_supported("vi-VN\r\nen-US"), Some(vi));
+        assert_eq!(tr(vi, "File"), "Tệp");
+        assert_eq!(tr(vi, "Edit"), "Chỉnh sửa");
+        assert_eq!(tr(vi, "Save"), "Lưu");
+        assert_eq!(tr(vi, "Save as…"), "Lưu thành…");
+        assert_eq!(tr(vi, "Bookmarks"), "Dấu trang");
+        assert_eq!(tr(vi, "Fill & Sign"), "Điền & Ký");
+        assert_eq!(tr(vi, "Interface language"), "Ngôn ngữ giao diện");
+        assert_eq!((0..=3).map(|n| (vi.0.plural)(n)).collect::<Vec<_>>(), [0, 0, 0, 0]);
+        for n in [0, 1, 2, 5] {
+            assert_eq!(trn(vi, n, "{n} page", "{n} pages"), format!("{n} trang"));
+            assert_eq!(trn(vi, n, "{n} field", "{n} fields"), format!("{n} trường"));
+        }
+        let mut app = crate::PdfCraftApp::default();
+        app.set_option("language", "vi").unwrap();
+        assert_eq!(app.language, "vi");
+        let mut restored = crate::PdfCraftApp::default();
+        restored.restore(&app.persist());
+        assert_eq!(restored.language, "vi");
+        assert!(restored.set_option("language", "xx").is_err());
+        assert_eq!(restored.language, "vi");
+    }
+
+    #[test]
+    fn vietnamese_covers_commands_and_catalogue() {
+        let vi = Lang::from_code("vi").expect("vi registered");
+        let mut missing = std::collections::BTreeSet::new();
+        for command in pdfcraft_engine::commands::COMMANDS {
+            if !has(vi, command.label) {
+                missing.insert(command.label);
+            }
+            if let Some(menu) = command.menu
+                && !has(vi, menu)
+            {
+                missing.insert(menu);
+            }
+        }
+        for group in pdfcraft_engine::catalog::TOOL_GROUPS {
+            if !has(vi, group.label) {
+                missing.insert(group.label);
+            }
+            for section in group.sections {
+                if !has(vi, section.title) {
+                    missing.insert(section.title);
+                }
+                for item in section.items {
+                    if !has(vi, item.label) {
+                        missing.insert(item.label);
+                    }
+                }
+            }
+        }
+        assert!(missing.is_empty(), "Vietnamese misses commands/tools: {missing:#?}");
+    }
+
+    #[test]
+    fn vietnamese_covers_ui_literals() {
+        let vi = Lang::from_code("vi").expect("vi registered");
+        let literals = scan_ui_literals(true);
+        let missing: Vec<_> = literals.iter().filter(|label| !has(vi, label)).collect();
+        assert!(missing.is_empty(), "Untranslated Vietnamese UI labels: {missing:#?}");
+    }
+
+    #[test]
+    fn vietnamese_covers_contextual_calendar_certificate_and_preference_labels() {
+        let vi = Lang::from_code("vi").expect("vi registered");
+        assert_eq!(tr_ctx(vi, "comment menu", "Edit"), "Sửa");
+        assert_eq!(tr_ctx(vi, "signature pad", "Type"), "Nhập chữ");
+        assert_eq!(tr_ctx(vi, "action wizard", "Start"), "Bắt đầu");
+        assert_eq!(["Slow", "Normal", "Fast"].map(|label| tr_ctx(vi, "scroll speed", label)), ["Chậm", "Bình thường", "Nhanh"]);
+        let months = [
+            ("January", "Tháng 1", "tháng 1"),
+            ("February", "Tháng 2", "tháng 2"),
+            ("March", "Tháng 3", "tháng 3"),
+            ("April", "Tháng 4", "tháng 4"),
+            ("May", "Tháng 5", "tháng 5"),
+            ("June", "Tháng 6", "tháng 6"),
+            ("July", "Tháng 7", "tháng 7"),
+            ("August", "Tháng 8", "tháng 8"),
+            ("September", "Tháng 9", "tháng 9"),
+            ("October", "Tháng 10", "tháng 10"),
+            ("November", "Tháng 11", "tháng 11"),
+            ("December", "Tháng 12", "tháng 12"),
+        ];
+        for (source, standalone, in_date) in months {
+            assert_eq!(tr(vi, source), standalone);
+            assert_eq!(tr_ctx(vi, "calendar date", source), in_date);
+        }
+        assert_eq!(
+            ["Su", "Mo", "Tu", "We", "Th", "Fr", "Sa"].map(|day| tr_ctx(vi, "calendar weekday", day)),
+            ["CN", "T2", "T3", "T4", "T5", "T6", "T7"]
+        );
+        assert_eq!(tr_ctx(vi, "certificate", "Subject"), "Chủ thể chứng chỉ");
+        assert_eq!(tr(vi, "Subject"), "Chủ đề");
+        // Appearance: object/comment/signature look vs Preferences theme section.
+        assert_eq!(tr(vi, "Appearance"), "Diện mạo");
+        assert_eq!(tr_ctx(vi, "theme", "Appearance"), "Giao diện");
+        // PDF form Field — never the visual-box sense "ô".
+        assert_eq!(tr(vi, "Field"), "Trường");
+        assert_eq!(tr(vi, "Fields"), "Các trường");
+        assert_eq!(tr(vi, "Form fields"), "Các trường biểu mẫu");
+        assert_eq!(tr(vi, "Text field"), "Trường văn bản");
+        assert_eq!(tr(vi, "Date field"), "Trường ngày");
+        assert_eq!(tr(vi, "Image field"), "Trường hình ảnh");
+        assert_eq!(tr(vi, "Field properties"), "Thuộc tính trường");
+        assert_eq!(tr(vi, "Field list"), "Danh sách trường");
+        assert_eq!(tr(vi, "{kind} field"), "Trường {kind}");
+        // Redaction: permanent removal, not temporary cover.
+        assert_eq!(tr(vi, "Mark for redaction"), "Đánh dấu để xóa");
+        assert_eq!(tr(vi, "Apply redactions"), "Xóa vĩnh viễn nội dung đã đánh dấu");
+        assert_eq!(tr(vi, "Redact text and images"), "Xóa nội dung nhạy cảm trong văn bản và hình ảnh");
+        assert_eq!(tr(vi, "Clear form"), "Xóa dữ liệu biểu mẫu");
+        // Fill & Sign tool section title — fill-in, not paint fill.
+        assert_eq!(tr(vi, "Fill"), "Điền");
+        assert_eq!(tr(vi, "Fill & Sign"), "Điền & Ký");
+        assert_eq!(
+            tr(vi, "Remove \"{name}\" from this list? The file itself is not deleted."),
+            "Gỡ \"{name}\" khỏi danh sách này? Bản thân tệp không bị xóa."
+        );
+        for field in [
+            "Issued to",
+            "Issued by",
+            "Valid from",
+            "Valid to",
+            "Intended usage",
+            "Serial number",
+            "Issuer",
+            "Validity starts",
+            "Validity ends",
+            "Public key",
+            "Basic constraints",
+            "Key usage",
+            "Self-signed",
+            "SHA-1 digest",
+            "SHA-256 digest",
+        ] {
+            assert_ne!(tr_ctx(vi, "certificate", field), field, "certificate field remains untranslated: {field}");
+        }
+    }
+
+    #[test]
+    fn vietnamese_covers_bundled_catalog_keys() {
+        let vi = Lang::from_code("vi").expect("vi registered");
+        let mut missing = std::collections::BTreeSet::new();
+        for reference in LANGUAGES.iter().filter(|language| language.code != "vi") {
+            let (entries, errors) = catalog::parse_entries(reference.source, reference.plural_forms());
+            assert!(errors.is_empty(), "{}: invalid reference catalog: {errors:?}", reference.code);
+            for entry in entries {
+                let translated = match entry.context.as_str() {
+                    "" => vi.catalog().plain(&entry.source),
+                    "@id" => vi.catalog().id(&entry.source),
+                    "@plural" => entry.source.split_once('|').and_then(|(one, other)| vi.catalog().plural(one, other, 0)),
+                    context => vi.catalog().contextual(context, &entry.source),
+                };
+                if translated.is_none() {
+                    missing.insert((entry.context, entry.source));
+                }
+            }
+        }
+        assert!(missing.is_empty(), "Vietnamese misses bundled catalog keys: {missing:#?}");
+    }
+
+    #[test]
+    fn vietnamese_covers_credits_labels() {
+        let vi = Lang::from_code("vi").expect("vi registered");
+        let labels = crate::credits::NameMode::ALL
+            .iter()
+            .map(|mode| mode.label())
+            .chain(crate::credits::SortKey::ALL.iter().flat_map(|key| {
+                let (menu, heading) = key.label();
+                [menu, heading]
+            }))
+            .chain(crate::credits::MODEL_COLUMNS.iter().copied());
+        let missing: Vec<_> = labels.filter(|label| !has(vi, label)).collect();
+        assert!(missing.is_empty(), "Vietnamese misses credits labels: {missing:#?}");
+    }
+
+    #[test]
+    fn vietnamese_leaves_no_unapproved_english_fallbacks() {
+        let vi = Lang::from_code("vi").expect("vi registered");
+        // Authoritative allowlist for intentional English-identical Vietnamese rows.
+        const KEEP_AS_IS: &[&str] = &[
+            "OK",
+            "Digital ID",
+            "ZIP",
+            "JavaScript",
+            "Microsoft Word (.docx)",
+            "PDF/A…",
+            "PostScript / EPS",
+            "Rich Text Format (.rtf)",
+            "CheckBox",
+            "Combo",
+            "Home / End",
+            "PushButton",
+            "Radio",
+            "Standard Business",
+            "Keychain  ·  ",
+            "{0}: {1}",
+            "{field}: {e}",
+            "{month} {y}",
+            "{n} {kind}",
+            "{rule} - {status}",
+            "+LOC",
+            "−LOC",
+            "ΔLOC",
+            "+Bin",
+            "−Bin",
+            "`{command}` {when}",
+            "English",
+        ];
+        const KEY_CAPS: &[&str] = &["Ctrl", "Shift", "Delete", "Esc", "Home", "End", "Space"];
+        let (entries, errors) = catalog::parse_entries(vi.0.source, vi.0.plural_forms());
+        assert!(errors.is_empty(), "{errors:?}");
+        let edges = |s: &str| (s.len() - s.trim_start().len(), s.len() - s.trim_end().len());
+        let mut unchanged = Vec::new();
+        for e in &entries {
+            let key_cap = e.context == "key" && KEY_CAPS.contains(&e.source.as_str());
+            if e.source == e.translation && !KEEP_AS_IS.contains(&e.source.as_str()) && !key_cap {
+                unchanged.push((e.context.clone(), e.source.clone()));
+            }
+            assert!(!e.translation.contains("..."), "use … rather than three dots: {:?}", e.translation);
+            assert_eq!(edges(&e.translation), edges(&e.source), "stray whitespace: {:?}", e.translation);
+            if e.context == "@plural" {
+                assert!(!e.translation.contains('|'), "Vietnamese @plural is one form: {:?}", e.translation);
+            }
+        }
+        assert!(unchanged.is_empty(), "unapproved English Vietnamese catalog entries: {unchanged:#?}");
+    }
+
     #[test]
     fn slovene_is_registered_and_persists() {
         let sl = Lang::from_code("sl").expect("sl registered");
@@ -2694,6 +2974,8 @@ mod tests {
             "ΔLOC",
             "+Bin",
             "−Bin",
+            // The distinguished name of a certificate, abbreviated as in X.500.
+            "DN: ",
         ];
         let unchanged: Vec<_> = entries
             .iter()
@@ -2772,6 +3054,8 @@ mod tests {
             "ΔLOC",
             "+Bin",
             "−Bin",
+            // The distinguished name of a certificate, abbreviated as in X.500.
+            "DN: ",
         ];
         let unchanged: Vec<_> = entries
             .iter()
diff --git a/crates/ui-egui/src/i18n/pl.tsv b/crates/ui-egui/src/i18n/pl.tsv
index b443c8415..3dbb24705 100644
--- a/crates/ui-egui/src/i18n/pl.tsv
+++ b/crates/ui-egui/src/i18n/pl.tsv
@@ -26,6 +26,7 @@
 	Interface language	Język interfejsu
 	Identity	Tożsamość
 	Name on new comments	Autor nowych komentarzy
+	Hide hover previews for highlights without comment text	Ukryj podglądy po najechaniu dla wyróżnień bez tekstu komentarza
 	Open…	Otwórz…
 	Open Recent	Otwórz ostatnie
 	Clear Recent Files	Wyczyść listę ostatnich plików
@@ -365,6 +366,7 @@
 	Split	Podziel
 	More	Więcej
 	Set page boxes	Ustaw obszary strony
+	Set page transitions	Ustaw przejścia stron
 	Page labels	Etykiety stron
 	Page transitions	Przejścia stron
 	Add comments	Dodaj komentarze
@@ -577,6 +579,7 @@
 	Remove unused objects and merge identical ones	Usuń nieużywane obiekty i scal identyczne
 	Audit space usage…	Analiza wykorzystania miejsca…
 	Space Audit	Analiza miejsca
+	What takes up the space in this file, by kind of content.	Co zajmuje miejsce w tym pliku, według rodzaju zawartości.
 	Bytes	Bajty
 	Content Streams	Strumienie zawartości
 	X Object Forms	Obiekty Form XObject
@@ -847,6 +850,12 @@
 	Windows store  ·  	Magazyn Windows  ·  
 	Issued by: 	Wystawca: 
 	, Expires: 	, Wygasa: 
+	Digitally signed by	Podpisany cyfrowo przez
+	DN: 	DN: 
+	Reason: 	Powód: 
+	Location: 	Lokalizacja: 
+	Date: 	Data: 
+	The labels are in English: the signature's font can't draw them in this language.	Etykiety są po angielsku: czcionka podpisu nie potrafi ich wyświetlić w tym języku.
 	No digital IDs yet.	Brak identyfikatorów cyfrowych.
 	Configure New Digital ID	Skonfiguruj nowy identyfikator cyfrowy
 	Remove "{name}" from this list? The file itself is not deleted.	Usunąć „{name}” z tej listy? Sam plik nie zostanie usunięty.
@@ -1130,6 +1139,7 @@
 	Custom text:	Własny tekst:
 	Font:	Czcionka:
 	Font size:	Rozmiar czcionki:
+	Font size	Rozmiar czcionki
 	Auto-size text to fit redaction region	Dopasuj rozmiar tekstu do utajnianego obszaru
 	Font colour:	Kolor czcionki:
 	Repeat overlay text	Powtarzaj tekst nakładany
@@ -1270,6 +1280,7 @@
 	Copy text	Kopiuj tekst
 	Properties…	Właściwości…
 	Make Current Properties Default	Ustaw bieżące właściwości jako domyślne
+	Make Properties Default	Ustaw właściwości jako domyślne
 	More options	Więcej opcji
 	Sort by	Sortuj według
 	Author	Autor
@@ -1299,6 +1310,8 @@
 	Expand all bookmarks	Rozwiń wszystkie zakładki
 	Expand top-level bookmarks	Rozwiń zakładki najwyższego poziomu
 	Collapse all bookmarks	Zwiń wszystkie zakładki
+	Collapse all pages	Zwiń wszystkie strony
+	Expand all pages	Rozwiń wszystkie strony
 	New bookmark (⌘B)	Nowa zakładka (⌘B)
 	This document has no bookmarks.	Ten dokument nie zawiera zakładek.
 	This document has no layers.	Ten dokument nie zawiera warstw.
@@ -1391,6 +1404,9 @@
 	Sort comments by:	Sortuj komentarze według:
 	Create PDF Comment Summary	Utwórz podsumowanie komentarzy w PDF
 	Revert to the previously saved version of “{name}”? Changes since then can't be undone afterwards.	Przywrócić ostatnio zapisaną wersję „{name}”? Późniejszych zmian nie będzie można odzyskać.
+	Save over the changed file?	Zapisać na zmienionym pliku?
+	“{name}” changed on disk after it was opened or last saved. Saving now replaces that newer version with this one.	Plik „{name}” zmienił się na dysku po otwarciu lub ostatnim zapisie. Zapisanie teraz zastąpi tę nowszą wersję bieżącą.
+	Save anyway	Zapisz mimo to
 	Number pages	Ponumeruj strony
 	Style	Styl
 	None (prefix only)	Brak (tylko prefiks)
@@ -1594,6 +1610,8 @@
 	Sent to {printer}	Wysłano do {printer}
 	Sent to {printer}: {msg}	Wysłano do {printer}: {msg}
 	Looking for printers…	Wyszukiwanie drukarek…
+	Sending sheet {s} of {n} to {printer}…	Wysyłanie arkusza {s} z {n} do {printer}…
+	No printers were found. Check that the printer is installed and the print spooler is running, then open Print again.	Nie znaleziono drukarek. Sprawdź, czy drukarka jest zainstalowana, a bufor wydruku działa, i ponownie otwórz Drukuj.
 	Sending to {printer}…	Wysyłanie do {printer}…
 	Choose a folder for the searchable files	Wybierz folder dla plików z możliwością wyszukiwania
 	Files are combined from top to bottom. Leave Pages empty to take every page.	Pliki są łączone od góry do dołu. Pozostaw pole Strony puste, aby uwzględnić wszystkie strony.
@@ -2240,14 +2258,14 @@ key	Space	Spacja
 	These objects could not be moved. Select them again and try a smaller move.	Nie udało się przenieść tych obiektów. Zaznacz je ponownie i spróbuj mniejszego przesunięcia.
 	This page contains objects that cannot be selected together.	Ta strona zawiera obiekty, których nie można zaznaczyć razem.
 	Reload documents when their files change on disk	Wczytuj ponownie dokumenty, gdy ich pliki zmienią się na dysku
-	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	Ten plik zmienił się na dysku. Wczytaj go ponownie, aby zobaczyć nową wersję; niezapisane zmiany zostaną utracone.
+	This file changed on disk. Reload shows the new version and drops your unsaved changes; Save replaces it with this version.	Ten plik zmienił się na dysku. Wczytaj ponownie pokazuje nową wersję i odrzuca niezapisane zmiany; Zapisz zastępuje ją tą wersją.
 	Reload	Wczytaj ponownie
 	Couldn't reload {name}: {e}	Nie można ponownie wczytać {name}: {e}
 	Select page {label}	Wybierz stronę {label}
 	Rotate page {label} counterclockwise	Obróć stronę {label} w lewo
 	Rotate page {label} clockwise	Obróć stronę {label} w prawo
 	Delete page {label}	Usuń stronę {label}
-	Mouse wheel scroll speed	Szybkość przewijania kółkiem myszy
+	Scroll speed (mouse wheel and arrow keys)	Szybkość przewijania (kółko myszy i klawisze strzałek)
 scroll speed	Slow	Wolna
 scroll speed	Normal	Normalna
 scroll speed	Fast	Szybka
@@ -2321,6 +2339,10 @@ animation effects	Off	Wyłączone
 	Local cross-PDF links require the desktop app	Lokalne łącza między plikami PDF wymagają aplikacji komputerowej
 	The existing action will be preserved.	Istniejąca akcja zostanie zachowana.
 	This form's scripts are turned off because one ran too long. Reopen the document to run them again.	Skrypty tego formularza są wyłączone, ponieważ jeden z nich działał zbyt długo. Otwórz dokument ponownie, aby znów je uruchomić.
+	Cut Image	Wytnij obraz
+	Redact Image	Utajnij obraz
+	Create Link…	Utwórz łącze…
+	Recognize Text…	Rozpoznaj tekst…
 	Minimize	Zminimalizuj
 	Maximize	Zmaksymalizuj
 	Restore	Przywróć
@@ -2330,7 +2352,59 @@ animation effects	Off	Wyłączone
 # Absolute local GoToR confirmation (#1364).
 	Allow	Zezwól
 	Only allow this if you trust the source document.	Zezwól na to tylko wtedy, gdy ufasz dokumentowi źródłowemu.
+	Open in Full Screen mode?	Otworzyć w trybie pełnoekranowym?
+	This document asks to open in Full Screen mode: the page fills the screen and nothing else shows. Press Esc at any time to leave it.	Ten dokument prosi o otwarcie w trybie pełnoekranowym: strona wypełnia ekran i nic innego nie jest widoczne. Naciśnij Esc w dowolnej chwili, aby go opuścić.
+	Full Screen	Pełny ekran
+	Not now	Nie teraz
 	Open this local PDF?	Otworzyć ten lokalny plik PDF?
 	This document is trying to open a local file:	Ten dokument próbuje otworzyć plik lokalny:
 	Move tag earlier	Przenieś znacznik wcześniej
 	Move tag later	Przenieś znacznik później
+	Turn upside down (180°)	Obróć do góry nogami (180°)
+	4 x 6 in label (101.6 x 152.4 mm)	Etykieta 4 × 6 cali (101,6 × 152,4 mm)
+	Cuts each page to its printed area, turns it upright and fits it to the sheet without stretching. One label per sheet.	Przycina każdą stronę do zadrukowanego obszaru, obraca ją pionowo i dopasowuje do arkusza bez rozciągania. Jedna etykieta na arkusz.
+	Find untagged content	Znajdź nieoznaczoną zawartość
+	No untagged content was found.	Nie znaleziono nieoznaczonej zawartości.
+	Found {n} untagged content problems.	Znaleziono problemów z nieoznaczoną zawartością: {n}.
+	Tag form fields	Oznacz pola formularza
+	Mark as artifact	Oznacz jako artefakt
+	Remove this leaf tag from reading order and mark its direct content as an artifact	Usuń ten znacznik liścia z kolejności odczytu i oznacz jego bezpośrednią zawartość jako artefakt
+	Mark content as artifact	Oznacz zawartość jako artefakt
+	Word count	Liczba słów
+	Current page only	Tylko bieżąca strona
+	Exclude tagged tables	Wyklucz oznaczone tabele
+	Exclude tagged code blocks	Wyklucz oznaczone bloki kodu
+	Exclude image/OCR text	Wyklucz tekst obrazów/OCR
+	Exclusions use PDF tags. Untagged tables and code remain included. Image exclusion also removes invisible text.	Wykluczenia używają znaczników PDF. Nieoznaczone tabele i kod nadal są uwzględniane. Wykluczenie obrazów usuwa również niewidoczny tekst.
+	Words	Słowa
+	Characters	Znaki
+	Characters without spaces	Znaki bez spacji
+	Pages counted	Policzone strony
+	Some pages contain no countable text. Scanned images need OCR first.	Niektóre strony nie zawierają tekstu do policzenia. Zeskanowane obrazy wymagają najpierw OCR.
+	Some content could not be classified safely and was kept in the count.	Części treści nie udało się wiarygodnie sklasyfikować, więc pozostała uwzględniona w liczbie.
+	Counting words… {n} pages read	Liczenie słów… odczytane strony: {n}
+	Word counting stopped unexpectedly.	Liczenie słów zostało nieoczekiwanie przerwane.
+	Word count…	Liczba słów…
+@id	file.word_count	Liczba słów…
+	Standard	Standardowe
+	Mobile	Urządzenie mobilne
+	Merge image fragments	Scal fragmenty obrazów
+	Optimizing… merging image fragments	Optymalizacja… scalanie fragmentów obrazów
+	Side by side	Obok siebie
+	New file only	Tylko nowy plik
+	Old file: {name}	Stary plik: {name}
+	New file: {name}	Nowy plik: {name}
+	Print as image	Drukuj jako obraz
+	Resolution:	Rozdzielczość:
+	Use it when a printer skips text, shading or transparency. The print is no longer searchable text; with Print in grayscale, the pictures are grey.	Użyj, gdy drukarka pomija tekst, cieniowanie lub przezroczystość. Wydruk nie jest już tekstem do przeszukiwania; przy druku w skali szarości obrazy są szare.
+	Crop Image	Przytnij obraz
+	Remove Crop	Usuń przycięcie
+	Trim the picture with its handles; Enter or Done applies	Przytnij obraz uchwytami; Enter lub Gotowe stosuje
+	Redaction mark appearance	Wygląd znacznika redakcji
+	Outline colour:	Kolor obrysu:
+	Fill colour:	Kolor wypełnienia:
+	Shown while the pointer is over a mark.	Widoczny, gdy wskaźnik jest nad znacznikiem.
+	Opacity:	Krycie:
+	Make properties default	Ustaw właściwości jako domyślne
+	Pages selected	Zaznaczone strony
+	Page properties	Właściwości strony
diff --git a/crates/ui-egui/src/i18n/pt-br.tsv b/crates/ui-egui/src/i18n/pt-br.tsv
index 9b2a68394..3e5517316 100644
--- a/crates/ui-egui/src/i18n/pt-br.tsv
+++ b/crates/ui-egui/src/i18n/pt-br.tsv
@@ -23,6 +23,7 @@
 	Auto follows the system's text size. Pages always render at the display's full resolution.	Automático segue o tamanho do texto do sistema. As páginas sempre são exibidas na resolução total da tela.
 	Identity	Identidade
 	Name on new comments	Nome nos novos comentários
+	Hide hover previews for highlights without comment text	Ocultar as prévias ao passar o ponteiro em destaques sem texto de comentário
 	Open…	Abrir…
 	Open Recent	Abrir recentes
 	Clear Recent Files	Limpar arquivos recentes
@@ -213,6 +214,7 @@
 	Remove unused objects and merge identical ones	Remover objetos não utilizados e mesclar os idênticos
 	Audit space usage…	Auditar uso de espaço…
 	Space Audit	Auditoria de espaço
+	What takes up the space in this file, by kind of content.	O que ocupa o espaço deste arquivo, por tipo de conteúdo.
 	Bytes	Bytes
 	Content Streams	Fluxos de conteúdo
 	X Object Forms	Formulários XObject
@@ -264,7 +266,7 @@
 	characters	caracteres
 	Field is used for file selection	O campo é usado para seleção de arquivo
 	Check spelling	Verificar ortografia
-	Comb of	Pente de
+	Comb of	Caixas para
 	Export Value: {on}	Valor de exportação: {on}
 	Check box is checked by default	A caixa de seleção fica marcada por padrão
 	Button is checked by default	O botão fica selecionado por padrão
@@ -484,6 +486,12 @@
 	Keychain  ·  	Chaveiro  ·  
 	Issued by: 	Emitido por: 
 	, Expires: 	, Expira em: 
+	Digitally signed by	Assinado digitalmente por
+	DN: 	DN: 
+	Reason: 	Motivo: 
+	Location: 	Local: 
+	Date: 	Data: 
+	The labels are in English: the signature's font can't draw them in this language.	Os rótulos estão em inglês: a fonte da assinatura não consegue desenhá-los neste idioma.
 	No digital IDs yet.	Nenhuma ID digital ainda.
 	Configure New Digital ID	Configurar nova ID digital
 	Remove "{name}" from this list? The file itself is not deleted.	Remover "{name}" desta lista? O arquivo em si não é excluído.
@@ -774,6 +782,7 @@
 	Redaction code:	Código de ocultação:
 	Font:	Fonte:
 	Font size:	Tamanho da fonte:
+	Font size	Tamanho da fonte
 	Auto-size text to fit redaction region	Ajustar tamanho do texto automaticamente à região de ocultação
 	Font colour:	Cor da fonte:
 	Repeat overlay text	Repetir texto de sobreposição
@@ -917,6 +926,7 @@
 	Replace	Substituir
 	Split	Dividir
 	Set page boxes	Definir limites da página
+	Set page transitions	Definir transições de página
 	Page labels	Rótulos de página
 	Page transitions	Transições de página
 	Sticky note	Nota adesiva
@@ -1171,6 +1181,7 @@
 	Copy text	Copiar texto
 	Properties…	Propriedades…
 	Make Current Properties Default	Tornar as propriedades atuais padrão
+	Make Properties Default	Tornar as propriedades padrão
 	More options	Mais opções
 	Sort by	Classificar por
 	Author	Autor
@@ -1192,7 +1203,7 @@
 	Pink	Rosa
 	Purple	Roxo
 	Blue	Azul
-	Light blue	Azul claro
+	Light blue	Azul-claro
 	Green	Verde
 	Gray	Cinza
 	Black	Preto
@@ -1302,6 +1313,9 @@
 	Sort comments by:	Classificar comentários por:
 	Create PDF Comment Summary	Criar resumo de comentários do PDF
 	Revert to the previously saved version of “{name}”? Changes since then can't be undone afterwards.	Reverter para a versão salva anteriormente de “{name}”? As alterações feitas desde então não poderão ser desfeitas depois.
+	Save over the changed file?	Salvar sobre o arquivo alterado?
+	“{name}” changed on disk after it was opened or last saved. Saving now replaces that newer version with this one.	“{name}” foi alterado no disco depois de ser aberto ou salvo pela última vez. Salvar agora substitui essa versão mais recente por esta.
+	Save anyway	Salvar mesmo assim
 	Number pages	Numerar páginas
 	Style	Estilo
 	None (prefix only)	Nenhum (apenas prefixo)
@@ -1498,6 +1512,8 @@
 	Sent to {printer}	Enviado para {printer}
 	Sent to {printer}: {msg}	Enviado para {printer}: {msg}
 	Looking for printers…	Procurando impressoras…
+	Sending sheet {s} of {n} to {printer}…	Enviando a folha {s} de {n} para {printer}…
+	No printers were found. Check that the printer is installed and the print spooler is running, then open Print again.	Nenhuma impressora encontrada. Verifique se a impressora está instalada e se o spooler de impressão está em execução e abra Imprimir novamente.
 	Sending to {printer}…	Enviando para {printer}…
 	Choose a folder for the searchable files	Escolha uma pasta para os arquivos pesquisáveis
 	Files are combined in this order. Leave Pages empty to take every page.	Os arquivos são combinados nesta ordem. Deixe Páginas em branco para incluir todas as páginas.
@@ -1913,7 +1929,7 @@
 	the image is empty	a imagem está vazia
 	The operation failed.	A operação falhou.
 	the password is incorrect	a senha está incorreta
-	The title in the metadata and the document information differ	O título nos metadados e nas informações do documento são diferentes
+	The title in the metadata and the document information differ	Os títulos nos metadados e nas informações do documento são diferentes
 	the title must not be empty	o título não deve estar vazio
 	there are no pages to print	não há páginas para imprimir
 	this document is signed: rewriting it would invalidate its signatures (save it incrementally instead)	este documento está assinado: regravá-lo invalidaria suas assinaturas (salve de forma incremental)
@@ -2035,7 +2051,7 @@
 	{name} can't be combined: {why}	{name} não pode ser combinado: {why}
 	Selected pages	Páginas selecionadas
 	No pages selected	Nenhuma página selecionada
-	Created a PDF from {n} files; left out: {names}	Criado um PDF de {n} arquivos; deixando de fora: {names}
+	Created a PDF from {n} files; left out: {names}	PDF criado a partir de {n} arquivos; deixados de fora: {names}
 	Created a PDF from the first {n} files	Criado um PDF dos primeiros {n} arquivos
 	Created a PDF from {n} files	Criado um PDF de {n} arquivos
 	Folders	Pastas
@@ -2108,7 +2124,7 @@ action wizard	Start	Iniciar
 	Choose a folder on this computer to pin	Escolha uma pasta deste computador para fixar
 	Commits	Commits
 	Company	Empresa
-	Contributors	Colaboradores
+	Contributors	Contribuidores
 	Couldn't open the printer's preferences: {e}	Não foi possível abrir as preferências da impressora: {e}
 	Couldn't optimize the file	Não foi possível otimizar o arquivo
 	Couldn't show the file picker. Please try again.	Não foi possível mostrar o seletor de arquivos. Tente novamente.
@@ -2199,7 +2215,7 @@ comment menu	Edit	Editar
 	Character limit:	Limite de caracteres:
 	Character limit 0 means no limit. A comb of characters needs a limit.	O limite de caracteres 0 significa sem limite. As caixas de caracteres precisam de um limite.
 	To change locked fields, also set Locked to No.	Para alterar campos bloqueados, defina também “Bloqueado” como “Não”.
-	Comb of characters	Pente de caracteres
+	Comb of characters	Caixas de caracteres
 	The document changed while you were editing field properties.	O documento mudou enquanto você editava as propriedades dos campos.
 	The document is no longer open.	O documento não está mais aberto.
 	The field properties dialog is no longer open.	A caixa de propriedades dos campos não está mais aberta.
@@ -2242,6 +2258,8 @@ key	Space	Espaço
 	Switch to List view to change the pages it takes.	Mude para a exibição em lista para alterar as páginas incluídas.
 	Expand all	Expandir tudo
 	Collapse all	Recolher tudo
+	Collapse all pages	Recolher todas as páginas
+	Expand all pages	Expandir todas as páginas
 	Remove page	Remover página
 	Remove {n} pages	Remover {n} páginas
 
@@ -2262,7 +2280,7 @@ key	Space	Espaço
 	Printer paper and scaling may differ. Check driver settings.	O papel e a escala da impressora podem variar. Confira as configurações do driver.
 	Drawing scale changes. Use Actual size for full-scale plans.	A escala do desenho muda. Use Tamanho real para plantas em escala.
 	Reload documents when their files change on disk	Recarregar documentos quando os arquivos mudarem no disco
-	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	Este arquivo foi alterado no disco. Recarregue-o para ver a nova versão; suas alterações não salvas serão perdidas.
+	This file changed on disk. Reload shows the new version and drops your unsaved changes; Save replaces it with this version.	Este arquivo foi alterado no disco. Recarregar mostra a nova versão e descarta suas alterações não salvas; Salvar a substitui por esta versão.
 	Reload	Recarregar
 	Couldn't reload {name}: {e}	Não foi possível recarregar {name}: {e}
 	Select page {label}	Selecionar página {label}
@@ -2281,7 +2299,7 @@ calendar date	September	setembro
 calendar date	October	outubro
 calendar date	November	novembro
 calendar date	December	dezembro
-	Mouse wheel scroll speed	Velocidade de rolagem da roda do mouse
+	Scroll speed (mouse wheel and arrow keys)	Velocidade de rolagem (roda do mouse e teclas de seta)
 scroll speed	Slow	Lenta
 scroll speed	Normal	Normal
 scroll speed	Fast	Rápida
@@ -2355,6 +2373,10 @@ animation effects	Off	Desativados
 	The linked PDF opened, but its named destination was not applied.	O PDF vinculado foi aberto, mas seu destino nomeado não foi aplicado.
 	The linked PDF opened, but its page destination was out of range.	O PDF vinculado foi aberto, mas sua página de destino está fora do intervalo.
 	Local cross-PDF links require the desktop app	Links locais entre PDFs exigem o aplicativo para desktop
+	Cut Image	Recortar imagem
+	Redact Image	Ocultar dados da imagem
+	Create Link…	Criar link…
+	Recognize Text…	Reconhecer texto…
 	Minimize	Minimizar
 	Maximize	Maximizar
 	Restore	Restaurar
@@ -2364,7 +2386,59 @@ animation effects	Off	Desativados
 # Absolute local GoToR confirmation (#1364).
 	Allow	Permitir
 	Only allow this if you trust the source document.	Permita esta ação somente se confiar no documento de origem.
+	Open in Full Screen mode?	Abrir no modo de tela cheia?
+	This document asks to open in Full Screen mode: the page fills the screen and nothing else shows. Press Esc at any time to leave it.	Este documento pede para abrir no modo de tela cheia: a página preenche a tela e nada mais é exibido. Pressione Esc a qualquer momento para sair.
+	Full Screen	Tela cheia
+	Not now	Agora não
 	Open this local PDF?	Abrir este PDF local?
 	This document is trying to open a local file:	Este documento está tentando abrir um arquivo local:
 	Move tag earlier	Mover tag para antes
 	Move tag later	Mover tag para depois
+	Turn upside down (180°)	Virar de cabeça para baixo (180°)
+	4 x 6 in label (101.6 x 152.4 mm)	Etiqueta 4 × 6 pol (101,6 × 152,4 mm)
+	Cuts each page to its printed area, turns it upright and fits it to the sheet without stretching. One label per sheet.	Recorta cada página na área impressa, deixa-a na vertical e ajusta-a à folha sem distorcer. Uma etiqueta por folha.
+	Find untagged content	Encontrar conteúdo sem marcação
+	No untagged content was found.	Nenhum conteúdo sem marcação foi encontrado.
+	Found {n} untagged content problems.	Foram encontrados {n} problemas de conteúdo sem marcação.
+	Tag form fields	Marcar campos de formulário
+	Mark as artifact	Marcar como artefato
+	Remove this leaf tag from reading order and mark its direct content as an artifact	Remova esta tag folha da ordem de leitura e marque seu conteúdo direto como artefato
+	Mark content as artifact	Marcar conteúdo como artefato
+	Word count	Contagem de palavras
+	Current page only	Somente a página atual
+	Exclude tagged tables	Excluir tabelas com tags
+	Exclude tagged code blocks	Excluir blocos de código com tags
+	Exclude image/OCR text	Excluir texto de imagens/OCR
+	Exclusions use PDF tags. Untagged tables and code remain included. Image exclusion also removes invisible text.	As exclusões usam tags de PDF. Tabelas e código sem tags continuam incluídos. A exclusão de imagens também remove o texto invisível.
+	Words	Palavras
+	Characters	Caracteres
+	Characters without spaces	Caracteres sem espaços
+	Pages counted	Páginas contadas
+	Some pages contain no countable text. Scanned images need OCR first.	Algumas páginas não contêm texto para contar. As imagens digitalizadas precisam primeiro de OCR.
+	Some content could not be classified safely and was kept in the count.	Parte do conteúdo não pôde ser classificada de forma confiável e foi mantida na contagem.
+	Counting words… {n} pages read	Contando palavras… {n} páginas lidas
+	Word counting stopped unexpectedly.	A contagem de palavras parou inesperadamente.
+	Word count…	Contagem de palavras…
+@id	file.word_count	Contagem de palavras…
+	Standard	Padrão
+	Mobile	Celular
+	Merge image fragments	Mesclar fragmentos de imagem
+	Optimizing… merging image fragments	Otimizando… mesclando fragmentos de imagem
+	Side by side	Lado a lado
+	New file only	Somente o arquivo novo
+	Old file: {name}	Arquivo antigo: {name}
+	New file: {name}	Arquivo novo: {name}
+	Print as image	Imprimir como imagem
+	Resolution:	Resolução:
+	Use it when a printer skips text, shading or transparency. The print is no longer searchable text; with Print in grayscale, the pictures are grey.	Use quando uma impressora omite texto, sombreamento ou transparência. A impressão deixa de ser texto pesquisável; com Imprimir em tons de cinza, as imagens ficam cinza.
+	Crop Image	Cortar imagem
+	Remove Crop	Remover corte
+	Trim the picture with its handles; Enter or Done applies	Corte a imagem com as alças; Enter ou Concluído aplica
+	Redaction mark appearance	Aparência da marca de redação
+	Outline colour:	Cor do contorno:
+	Fill colour:	Cor de preenchimento:
+	Shown while the pointer is over a mark.	Mostrada enquanto o ponteiro está sobre uma marca.
+	Opacity:	Opacidade:
+	Make properties default	Tornar propriedades padrão
+	Pages selected	Páginas selecionadas
+	Page properties	Propriedades da página
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
index 834e55282..1ac9c10ba 100644
--- a/crates/ui-egui/src/i18n/ru.tsv
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -22,6 +22,7 @@
 	Auto follows the system's text size. Pages always render at the display's full resolution.	В режиме «Авто» используется размер текста из настроек системы. Страницы всегда отображаются в полном разрешении экрана.
 	Identity	Идентификация
 	Name on new comments	Имя в новых комментариях
+	Hide hover previews for highlights without comment text	Скрывать всплывающий просмотр для выделений без текста комментария
 	Open…	Открыть…
 	Open Recent	Открыть недавние
 	Clear Recent Files	Очистить недавние файлы
@@ -363,6 +364,7 @@
 	Split	Разделить
 	More	Ещё
 	Set page boxes	Задать поля страниц
+	Set page transitions	Задать переходы между страницами
 	Page labels	Метки страниц
 	Page transitions	Переходы страниц
 	Add comments	Добавить комментарии
@@ -575,6 +577,7 @@
 	Remove unused objects and merge identical ones	Удалить неиспользуемые объекты и объединить одинаковые
 	Audit space usage…	Анализ использования места…
 	Space Audit	Анализ места
+	What takes up the space in this file, by kind of content.	Что занимает место в этом файле, по типу содержимого.
 	Bytes	Байты
 	Content Streams	Потоки содержимого
 	X Object Forms	Формы X Object
@@ -849,6 +852,12 @@
 	Windows store  ·  	Хранилище Windows  ·
 	Issued by: 	Выдан:
 	, Expires: 	, Истекает:
+	Digitally signed by	Цифровая подпись
+	DN: 	DN: 
+	Reason: 	Причина: 
+	Location: 	Местоположение: 
+	Date: 	Дата: 
+	The labels are in English: the signature's font can't draw them in this language.	Метки на английском: шрифт подписи не может отобразить их на этом языке.
 	No digital IDs yet.	Нет цифровых идентификаторов.
 	Configure New Digital ID	Настроить новый цифровой идентификатор
 	Remove "{name}" from this list? The file itself is not deleted.	Убрать «{name}» из этого списка? Сам файл не удаляется.
@@ -1147,6 +1156,7 @@
 	Redaction code:	Код сокрытия:
 	Font:	Шрифт:
 	Font size:	Размер шрифта:
+	Font size	Размер шрифта
 	Auto-size text to fit redaction region	Автоподбор размера текста по области сокрытия
 	Font colour:	Цвет шрифта:
 	Repeat overlay text	Повторять текст поверх
@@ -1287,6 +1297,7 @@
 	Copy text	Копировать текст
 	Properties…	Свойства…
 	Make Current Properties Default	Сделать текущие свойства по умолчанию
+	Make Properties Default	Сделать свойства по умолчанию
 	More options	Ещё
 	Sort by	Сортировать по
 	Author	Автор
@@ -1408,6 +1419,9 @@
 	Sort comments by:	Сортировать комментарии по:
 	Create PDF Comment Summary	Создать сводку комментариев в PDF
 	Revert to the previously saved version of “{name}”? Changes since then can't be undone afterwards.	Вернуть к ранее сохранённой версии «{name}»? Изменения с тех пор нельзя будет отменить.
+	Save over the changed file?	Сохранить поверх изменённого файла?
+	“{name}” changed on disk after it was opened or last saved. Saving now replaces that newer version with this one.	«{name}» был изменён на диске после открытия или последнего сохранения. Сохранение сейчас заменит ту более новую версию этой.
+	Save anyway	Всё равно сохранить
 	Number pages	Пронумеровать страницы
 	Style	Стиль
 	None (prefix only)	Нет (только префикс)
@@ -1604,6 +1618,8 @@
 	Sent to {printer}	Отправлено на {printer}
 	Sent to {printer}: {msg}	Отправлено на {printer}: {msg}
 	Looking for printers…	Поиск принтеров…
+	Sending sheet {s} of {n} to {printer}…	Отправка листа {s} из {n} на {printer}…
+	No printers were found. Check that the printer is installed and the print spooler is running, then open Print again.	Принтеры не найдены. Проверьте, что принтер установлен, а диспетчер печати запущен, и снова откройте «Печать».
 	Sending to {printer}…	Отправка на {printer}…
 	Choose a folder for the searchable files	Выберите папку для доступных для поиска файлов
 	Files are combined from top to bottom. Leave Pages empty to take every page.	Файлы объединяются сверху вниз. Оставьте «Страницы» пустыми, чтобы взять все страницы.
@@ -2052,7 +2068,7 @@
 	Used when a PDF doesn't ask for a layout or zoom. Continuous scrolling never snaps between pages.	Используется, когда PDF не запрашивает макет или масштаб. Непрерывная прокрутка никогда не привязывается между страницами.
 	Reopen the files that were open when PdfCraft last closed	Повторно открывать файлы, которые были открыты при последнем закрытии PdfCraft
 	Reload documents when their files change on disk	Перезагружать документы при изменении их файлов на диске
-	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	Этот файл был изменён на диске. Перезагрузите его, чтобы увидеть новую версию; несохранённые изменения будут потеряны.
+	This file changed on disk. Reload shows the new version and drops your unsaved changes; Save replaces it with this version.	Этот файл был изменён на диске. «Перезагрузить» покажет новую версию и отбросит несохранённые изменения; «Сохранить» заменит её этой версией.
 	Reload	Перезагрузить
 	Couldn't reload {name}: {e}	Не удалось перезагрузить {name}: {e}
 	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	Выберите изображение PNG или JPEG (до 4 МиБ). Прозрачность сохраняется.
@@ -2157,6 +2173,8 @@ key	Space	Пробел
 	Switch to List view to change the pages it takes.	Переключитесь на вид списком, чтобы изменить, какие страницы взять.
 	Expand all	Развернуть все
 	Collapse all	Свернуть все
+	Collapse all pages	Свернуть все страницы
+	Expand all pages	Развернуть все страницы
 	Remove page	Удалить страницу
 	Remove {n} pages	Удалить страницы: {n}
 
@@ -2180,7 +2198,7 @@ key	Space	Пробел
 	Rotate page {label} counterclockwise	Повернуть страницу {label} против часовой стрелки
 	Rotate page {label} clockwise	Повернуть страницу {label} по часовой стрелке
 	Delete page {label}	Удалить страницу {label}
-	Mouse wheel scroll speed	Скорость прокрутки колесом мыши
+	Scroll speed (mouse wheel and arrow keys)	Скорость прокрутки (колесо мыши и клавиши со стрелками)
 scroll speed	Slow	Низкая
 scroll speed	Normal	Обычная
 scroll speed	Fast	Высокая
@@ -2254,6 +2272,10 @@ animation effects	Off	Выкл
 	The linked PDF opened, but its named destination was not applied.	Связанный PDF открыт, но его именованное назначение не применено.
 	The linked PDF opened, but its page destination was out of range.	Связанный PDF открыт, но страница назначения вне допустимого диапазона.
 	Local cross-PDF links require the desktop app	Локальные ссылки между PDF работают только в настольном приложении
+	Cut Image	Вырезать изображение
+	Redact Image	Скрыть изображение
+	Create Link…	Создать ссылку…
+	Recognize Text…	Распознать текст…
 	Minimize	Свернуть
 	Maximize	Развернуть
 	Restore	Восстановить
@@ -2263,7 +2285,59 @@ animation effects	Off	Выкл
 # Absolute local GoToR confirmation (#1364).
 	Allow	Разрешить
 	Only allow this if you trust the source document.	Разрешите это действие, только если доверяете исходному документу.
+	Open in Full Screen mode?	Открыть в полноэкранном режиме?
+	This document asks to open in Full Screen mode: the page fills the screen and nothing else shows. Press Esc at any time to leave it.	Этот документ просит открыть его в полноэкранном режиме: страница занимает весь экран, и больше ничего не отображается. Нажмите Esc в любой момент, чтобы выйти.
+	Full Screen	Полный экран
+	Not now	Не сейчас
 	Open this local PDF?	Открыть этот локальный PDF?
 	This document is trying to open a local file:	Этот документ пытается открыть локальный файл:
 	Move tag earlier	Переместить тег раньше
 	Move tag later	Переместить тег позже
+	Turn upside down (180°)	Перевернуть (180°)
+	4 x 6 in label (101.6 x 152.4 mm)	Этикетка 4 × 6 дюйма (101,6 × 152,4 мм)
+	Cuts each page to its printed area, turns it upright and fits it to the sheet without stretching. One label per sheet.	Обрезает каждую страницу по напечатанной области, разворачивает её прямо и вписывает в лист без искажений. Одна этикетка на лист.
+	Find untagged content	Найти нетегированный контент
+	No untagged content was found.	Нетегированный контент не найден.
+	Found {n} untagged content problems.	Найдено проблем с нетегированным контентом: {n}.
+	Tag form fields	Пометить поля формы
+	Mark as artifact	Пометить как артефакт
+	Remove this leaf tag from reading order and mark its direct content as an artifact	Удалите этот конечный тег из порядка чтения и пометьте его непосредственное содержимое как артефакт
+	Mark content as artifact	Пометить содержимое как артефакт
+	Word count	Количество слов
+	Current page only	Только текущая страница
+	Exclude tagged tables	Исключить таблицы с тегами
+	Exclude tagged code blocks	Исключить блоки кода с тегами
+	Exclude image/OCR text	Исключить текст изображений и OCR
+	Exclusions use PDF tags. Untagged tables and code remain included. Image exclusion also removes invisible text.	Исключения используют теги PDF. Таблицы и код без тегов остаются в подсчёте. Исключение изображений также удаляет невидимый текст.
+	Words	Слова
+	Characters	Символы
+	Characters without spaces	Символы без пробелов
+	Pages counted	Подсчитанные страницы
+	Some pages contain no countable text. Scanned images need OCR first.	На некоторых страницах нет текста для подсчёта. Для отсканированных изображений сначала требуется OCR.
+	Some content could not be classified safely and was kept in the count.	Часть содержимого не удалось надёжно классифицировать, поэтому она осталась в подсчёте.
+	Counting words… {n} pages read	Подсчёт слов… прочитано страниц: {n}
+	Word counting stopped unexpectedly.	Подсчёт слов неожиданно остановился.
+	Word count…	Количество слов…
+@id	file.word_count	Количество слов…
+	Standard	Стандартные
+	Mobile	Мобильные устройства
+	Merge image fragments	Объединять фрагменты изображений
+	Optimizing… merging image fragments	Оптимизация… объединение фрагментов изображений
+	Side by side	Рядом
+	New file only	Только новый файл
+	Old file: {name}	Старый файл: {name}
+	New file: {name}	Новый файл: {name}
+	Print as image	Печать как изображение
+	Resolution:	Разрешение:
+	Use it when a printer skips text, shading or transparency. The print is no longer searchable text; with Print in grayscale, the pictures are grey.	Используйте, когда принтер пропускает текст, заливки или прозрачность. Отпечаток больше не текст с поиском; при печати в оттенках серого изображения серые.
+	Crop Image	Обрезать изображение
+	Remove Crop	Убрать обрезку
+	Trim the picture with its handles; Enter or Done applies	Обрежьте изображение за маркеры; Enter или «Готово» применяет
+	Redaction mark appearance	Вид метки скрытия
+	Outline colour:	Цвет контура:
+	Fill colour:	Цвет заливки:
+	Shown while the pointer is over a mark.	Показывается, пока указатель над меткой.
+	Opacity:	Непрозрачность:
+	Make properties default	Сделать свойства стандартными
+	Pages selected	Выделенные страницы
+	Page properties	Свойства страницы
diff --git a/crates/ui-egui/src/i18n/sl.tsv b/crates/ui-egui/src/i18n/sl.tsv
index 506e52ee4..416590999 100644
--- a/crates/ui-egui/src/i18n/sl.tsv
+++ b/crates/ui-egui/src/i18n/sl.tsv
@@ -29,6 +29,12 @@
 	+Bin	+Bin
 	+LOC	+LOC
 	, Expires: 	, poteče: 
+	Digitally signed by	Digitalno podpisal
+	DN: 	DN: 
+	Reason: 	Razlog: 
+	Location: 	Lokacija: 
+	Date: 	Datum: 
+	The labels are in English: the signature's font can't draw them in this language.	Oznake so v angleščini: pisava podpisa jih v tem jeziku ne more prikazati.
 	1 difference found	1 razlika najdena
 	1 file	1 datoteka
 	1 file done	1 datoteka dokončana
@@ -836,6 +842,7 @@
 	Font Size:	Velikost pisave:
 	Font colour:	Barva pisave:
 	Font size:	Velikost pisave:
+	Font size	Velikost pisave
 	Font:	Pisava:
 	Font: Helvetica	Pisava: Helvetica
 	Fonts	Pisave
@@ -1044,6 +1051,7 @@
 	Low resolution	Nizka ločljivost
 	Magnification	Povečava
 	Make Current Properties Default	Nastavi kot privzeto
+	Make Properties Default	Lastnosti nastavi kot privzete
 	Make accessible	Naredi dostopno
 	Make scans searchable, then make them smaller.	Skenirane dokumente naredite iskalne, nato pa jih zmanjšajte.
 	Manage embedded index	Upravljaj vdelani indeks
@@ -1113,6 +1121,7 @@
 	Name	Ime
 	Name (A–Z)	Ime (A–Ž)
 	Name on new comments	Ime na novih komentarjih
+	Hide hover previews for highlights without comment text	Skrij predoglede ob lebdenju za označitve brez besedila komentarja
 	Name:	Ime:
 	Named Destinations	Poimenovani cilji
 	Navigation links	Navigacijske povezave
@@ -1495,6 +1504,9 @@
 	Reverse the order	Obrni vrstni red
 	Revert	Povrni
 	Revert to the previously saved version of “{name}”? Changes since then can't be undone afterwards.	Povrniti na prej shranjeno različico dokumenta „{name}“? Sprememb od takrat pozneje ni mogoče razveljaviti.
+	Save over the changed file?	Shranim čez spremenjeno datoteko?
+	“{name}” changed on disk after it was opened or last saved. Saving now replaces that newer version with this one.	»{name}« se je na disku spremenila po odprtju ali zadnjem shranjevanju. Shranjevanje zdaj zamenja to novejšo različico s to.
+	Save anyway	Vseeno shrani
 	Reverted to the last saved version	Povrnjeno na zadnjo shranjeno različico
 	Review	Pregled
 	Review History	Zgodovina pregledov
@@ -1626,6 +1638,7 @@
 	Set layer visibility	Nastavi vidnost plasti
 	Set measurement scale	Nastavi merilo meritev
 	Set page boxes	Nastavi robove strani
+	Set page transitions	Nastavi prehode strani
 	Set page boxes…	Nastavi robove strani…
 	Set properties	Nastavi lastnosti
 	Set status	Nastavi status
@@ -1697,6 +1710,7 @@
 	Sort items	Razvrsti elemente
 	Source	Vir
 	Space Audit	Pregled prostora
+	What takes up the space in this file, by kind of content.	Kaj zaseda prostor v tej datoteki, po vrsti vsebine.
 	Special	Posebno
 	Split	Razdeli
 	Split document	Razdeli dokument
@@ -2178,6 +2192,8 @@ signature pad	Type	Vtipkaj
 	Auto follows the system's text size. Pages always render at the display's full resolution.	Samodejno sledi velikosti besedila v sistemu. Strani se vedno izrišejo v polni ločljivosti zaslona.
 	Check the pages	Preveri strani
 	Collapse all	Strni vse
+	Collapse all pages	Strni vse strani
+	Expand all pages	Razširi vse strani
 	Column select	Izbira stolpcev
 	Drag the selection to move it. Esc clears the selection.	Povlecite izbor, da ga premaknete. Esc počisti izbor.
 	Expand all	Razširi vse
@@ -2214,6 +2230,8 @@ key	Shift	Shift
 key	Space	Preslednica
 @plural	{n} object selected|{n} objects selected	{n} izbran objekt|{n} izbrana objekta|{n} izbrani objekti|{n} izbranih objektov
 	Looking for printers…	Iskanje tiskalnikov…
+	Sending sheet {s} of {n} to {printer}…	Pošiljanje lista {s} od {n} na {printer}…
+	No printers were found. Check that the printer is installed and the print spooler is running, then open Print again.	Ni najdenih tiskalnikov. Preverite, ali je tiskalnik nameščen in ali tiskalna vrsta deluje, nato znova odprite Natisni.
 	Sending to {printer}…	Pošiljanje na {printer}…
 	Float panel	Odtrgaj razdelek
 	Inspector	Inšpektor
@@ -2266,10 +2284,10 @@ key	Space	Preslednica
 	Printer paper and scaling may differ. Check driver settings.	Papir in merilo tiskalnika se lahko razlikujeta. Preverite nastavitve gonilnika.
 	Drawing scale changes. Use Actual size for full-scale plans.	Merilo risbe se spremeni. Za načrte v polnem merilu uporabite Dejansko velikost.
 	Reload documents when their files change on disk	Znova naloži dokumente, ko se njihove datoteke na disku spremenijo
-	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	Ta datoteka se je na disku spremenila. Znova jo naložite, da vidite novo različico; neshranjene spremembe bodo izgubljene.
+	This file changed on disk. Reload shows the new version and drops your unsaved changes; Save replaces it with this version.	Ta datoteka se je na disku spremenila. Ponovno naloži pokaže novo različico in zavrže neshranjene spremembe; Shrani jo zamenja s to različico.
 	Reload	Znova naloži
 	Couldn't reload {name}: {e}	Datoteke {name} ni bilo mogoče znova naložiti: {e}
-	Mouse wheel scroll speed	Hitrost drsenja s kolescem miške
+	Scroll speed (mouse wheel and arrow keys)	Hitrost drsenja (kolesce miške in puščične tipke)
 scroll speed	Slow	Počasi
 scroll speed	Normal	Običajno
 scroll speed	Fast	Hitro
@@ -2346,6 +2364,10 @@ animation effects	Off	Izklopljeni
 	The linked PDF opened, but its named destination was not applied.	Povezani PDF se je odprl, vendar njegov poimenovani cilj ni bil uporabljen.
 	The linked PDF opened, but its page destination was out of range.	Povezani PDF se je odprl, vendar je ciljna stran zunaj obsega.
 	Local cross-PDF links require the desktop app	Lokalne povezave med PDF-ji zahtevajo namizno aplikacijo
+	Cut Image	Izreži sliko
+	Redact Image	Počrni sliko
+	Create Link…	Ustvari povezavo…
+	Recognize Text…	Prepoznaj besedilo…
 	Minimize	Pomanjšaj
 	Maximize	Povečaj
 	Restore	Obnovi
@@ -2355,7 +2377,59 @@ animation effects	Off	Izklopljeni
 # Absolute local GoToR confirmation (#1364).
 	Allow	Dovoli
 	Only allow this if you trust the source document.	To dovolite le, če zaupate izvornemu dokumentu.
+	Open in Full Screen mode?	Odpri v celozaslonskem načinu?
+	This document asks to open in Full Screen mode: the page fills the screen and nothing else shows. Press Esc at any time to leave it.	Ta dokument želi, da se odpre v celozaslonskem načinu: stran zapolni zaslon in nič drugega ni prikazano. Za izhod kadar koli pritisnite Esc.
+	Full Screen	Celoten zaslon
+	Not now	Ne zdaj
 	Open this local PDF?	Želite odpreti ta lokalni PDF?
 	This document is trying to open a local file:	Ta dokument poskuša odpreti lokalno datoteko:
 	Move tag earlier	Premakni oznako prej
 	Move tag later	Premakni oznako pozneje
+	Turn upside down (180°)	Obrni na glavo (180°)
+	4 x 6 in label (101.6 x 152.4 mm)	Nalepka 4 × 6 in (101,6 × 152,4 mm)
+	Cuts each page to its printed area, turns it upright and fits it to the sheet without stretching. One label per sheet.	Vsako stran obreže na natisnjeno območje, jo poravna pokonci in prilagodi listu brez raztegovanja. Ena nalepka na list.
+	Find untagged content	Poišči neoznačeno vsebino
+	No untagged content was found.	Neoznačene vsebine ni bilo mogoče najti.
+	Found {n} untagged content problems.	Najdenih je {n} težav z neoznačeno vsebino.
+	Tag form fields	Označi polja obrazca
+	Mark as artifact	Označi kot artefakt
+	Remove this leaf tag from reading order and mark its direct content as an artifact	Odstranite to listno oznako iz vrstnega reda branja in označite njeno neposredno vsebino kot artefakt
+	Mark content as artifact	Označi vsebino kot artefakt
+	Word count	Število besed
+	Current page only	Samo trenutna stran
+	Exclude tagged tables	Izključi označene tabele
+	Exclude tagged code blocks	Izključi označene bloke kode
+	Exclude image/OCR text	Izključi besedilo slik/OCR
+	Exclusions use PDF tags. Untagged tables and code remain included. Image exclusion also removes invisible text.	Izključitve uporabljajo oznake PDF. Neoznačene tabele in koda ostanejo vključene. Izključitev slik odstrani tudi nevidno besedilo.
+	Words	Besede
+	Characters	Znaki
+	Characters without spaces	Znaki brez presledkov
+	Pages counted	Preštete strani
+	Some pages contain no countable text. Scanned images need OCR first.	Nekatere strani ne vsebujejo besedila za štetje. Optično prebrane slike najprej potrebujejo OCR.
+	Some content could not be classified safely and was kept in the count.	Nekatere vsebine ni bilo mogoče zanesljivo razvrstiti, zato je ostala vključena v štetje.
+	Counting words… {n} pages read	Štetje besed… prebrane strani: {n}
+	Word counting stopped unexpectedly.	Štetje besed se je nepričakovano ustavilo.
+	Word count…	Število besed…
+@id	file.word_count	Število besed…
+	Standard	Standardno
+	Mobile	Mobilna naprava
+	Merge image fragments	Združi delce slik
+	Optimizing… merging image fragments	Optimiziranje… združevanje delcev slik
+	Side by side	Drug ob drugem
+	New file only	Samo nova datoteka
+	Old file: {name}	Stara datoteka: {name}
+	New file: {name}	Nova datoteka: {name}
+	Print as image	Natisni kot sliko
+	Resolution:	Ločljivost:
+	Use it when a printer skips text, shading or transparency. The print is no longer searchable text; with Print in grayscale, the pictures are grey.	Uporabite, ko tiskalnik izpusti besedilo, senčenje ali prosojnost. Natis ni več iskalno besedilo; s tiskanjem v sivinah so slike sive.
+	Crop Image	Obreži sliko
+	Remove Crop	Odstrani obrezovanje
+	Trim the picture with its handles; Enter or Done applies	Obrežite sliko z ročicami; Enter ali Končano uporabi
+	Redaction mark appearance	Videz oznake za zakritje
+	Outline colour:	Barva obrobe:
+	Fill colour:	Barva polnila:
+	Shown while the pointer is over a mark.	Prikazano, ko je kazalec nad oznako.
+	Opacity:	Prekrivnost:
+	Make properties default	Nastavi lastnosti kot privzete
+	Pages selected	Izbrane strani
+	Page properties	Lastnosti strani
diff --git a/crates/ui-egui/src/i18n/te.tsv b/crates/ui-egui/src/i18n/te.tsv
index 08c53e84f..07b716eac 100644
--- a/crates/ui-egui/src/i18n/te.tsv
+++ b/crates/ui-egui/src/i18n/te.tsv
@@ -27,6 +27,7 @@ comment menu	Edit	సవరించు
 	Auto follows the system's text size. Pages always render at the display's full resolution.	ఆటో సిస్టమ్ టెక్స్ట్ పరిమాణాన్ని అనుసరిస్తుంది. పేజీలు ఎల్లప్పుడూ డిస్‌ప్లే పూర్తి రిజల్యూషన్‌లో చూపబడతాయి.
 	Identity	గుర్తింపు
 	Name on new comments	కొత్త వ్యాఖ్యలపై చూపే పేరు
+	Hide hover previews for highlights without comment text	వ్యాఖ్య వచనం లేని హైలైట్‌లకు హోవర్ ప్రివ్యూలను దాచు
 	Open…	తెరువు…
 	New blank PDF	కొత్త ఖాళీ PDF
 	Create PDF from file…	ఫైల్ నుండి PDF సృష్టించు…
@@ -347,6 +348,7 @@ comment menu	Edit	సవరించు
 	Split	విభజించు
 	More	మరిన్ని
 	Set page boxes	పేజీ బాక్స్‌లను సెట్ చేయి
+	Set page transitions	పేజీ పరివర్తనలను సెట్ చేయండి
 	Page labels	పేజీ లేబుల్‌లు
 	Page transitions	పేజీ ట్రాన్సిషన్‌లు
 	Add comments	వ్యాఖ్యలను జోడించు
@@ -559,6 +561,7 @@ comment menu	Edit	సవరించు
 	Remove unused objects and merge identical ones	ఉపయోగించని ఆబ్జెక్ట్‌లను తీసివేసి, ఒకేలా ఉన్నవాటిని విలీనం చేయి
 	Audit space usage…	స్థల వినియోగాన్ని పరిశీలించు…
 	Space Audit	స్థల వినియోగ పరిశీలన
+	What takes up the space in this file, by kind of content.	ఈ ఫైల్‌లో స్థలాన్ని ఏవి ఆక్రమిస్తున్నాయి, కంటెంట్ రకం వారీగా.
 	Bytes	బైట్‌లు
 	Content Streams	కంటెంట్ స్ట్రీమ్‌లు
 	X Object Forms	X ఆబ్జెక్ట్ ఫారాలు
@@ -828,6 +831,12 @@ comment menu	Edit	సవరించు
 	Keychain  ·  	Keychain  ·  
 	Issued by: 	జారీ చేసినవారు: 
 	, Expires: 	, గడువు: 
+	Digitally signed by	డిజిటల్ సంతకం చేసినవారు
+	DN: 	DN: 
+	Reason: 	కారణం: 
+	Location: 	స్థానం: 
+	Date: 	తేదీ: 
+	The labels are in English: the signature's font can't draw them in this language.	లేబుళ్లు ఆంగ్లంలో ఉన్నాయి: సంతకం ఫాంట్ ఈ భాషలో వాటిని చూపించలేదు.
 	No digital IDs yet.	ఇంకా డిజిటల్ ఐడీలు ఏవీ లేవు.
 	Configure New Digital ID	కొత్త డిజిటల్ ఐడీని కాన్ఫిగర్ చేయి
 	Remove "{name}" from this list? The file itself is not deleted.	ఈ జాబితా నుండి "{name}"ని తీసివేయాలా? ఫైల్ తొలగించబడదు.
@@ -1117,6 +1126,7 @@ comment menu	Edit	సవరించు
 	Redaction code:	రెడాక్షన్ కోడ్:
 	Font:	ఫాంట్:
 	Font size:	ఫాంట్ పరిమాణం:
+	Font size	ఫాంట్ పరిమాణం
 	Auto-size text to fit redaction region	రెడాక్షన్ ప్రాంతానికి సరిపోయేలా టెక్స్ట్ పరిమాణాన్ని స్వయంచాలకంగా మార్చు
 	Font colour:	ఫాంట్ రంగు:
 	Repeat overlay text	ఓవర్‌లే టెక్స్ట్‌ను పునరావృతం చేయి
@@ -1256,6 +1266,7 @@ comment menu	Edit	సవరించు
 	Copy text	టెక్స్ట్‌ను కాపీ చేయి
 	Properties…	లక్షణాలు…
 	Make Current Properties Default	ప్రస్తుత లక్షణాలను డిఫాల్ట్‌గా చేయి
+	Make Properties Default	లక్షణాలను డిఫాల్ట్‌గా చేయి
 	More options	మరిన్ని ఎంపికలు
 	Sort by	క్రమపరిచే విధానం
 	Author	రచయిత
@@ -1377,6 +1388,9 @@ signature pad	Type	టైప్ చేయి
 	Sort comments by:	వ్యాఖ్యలను క్రమపరిచే విధానం:
 	Create PDF Comment Summary	PDF వ్యాఖ్యల సారాంశాన్ని సృష్టించు
 	Revert to the previously saved version of “{name}”? Changes since then can't be undone afterwards.	“{name}”ను గతంలో సేవ్ చేసిన వెర్షన్‌కు తిరిగి మార్చాలా? అప్పటి నుండి చేసిన మార్పులు పోతాయి, వాటిని తర్వాత తిరిగి పొందలేరు.
+	Save over the changed file?	మార్చబడిన ఫైల్‌పై సేవ్ చేయాలా?
+	“{name}” changed on disk after it was opened or last saved. Saving now replaces that newer version with this one.	“{name}” తెరిచిన తర్వాత లేదా చివరిసారి సేవ్ చేసిన తర్వాత డిస్క్‌లో మారింది. ఇప్పుడు సేవ్ చేస్తే ఆ కొత్త వెర్షన్ స్థానంలో ఇది వస్తుంది.
+	Save anyway	ఏమైనా సేవ్ చేయి
 	Number pages	పేజీలకు సంఖ్యలు వేయి
 	Style	శైలి
 	None (prefix only)	ఏదీ లేదు (ప్రిఫిక్స్ మాత్రమే)
@@ -1583,6 +1597,8 @@ action wizard	Start	ప్రారంభించు
 	Sent to {printer}	{printer}కు పంపబడింది
 	Sent to {printer}: {msg}	{printer}కు పంపబడింది: {msg}
 	Looking for printers…	ప్రింటర్ల కోసం వెతుకుతోంది…
+	Sending sheet {s} of {n} to {printer}…	{printer}కు {n}లో {s}వ షీట్ పంపుతోంది…
+	No printers were found. Check that the printer is installed and the print spooler is running, then open Print again.	ప్రింటర్లు ఏవీ కనుగొనబడలేదు. ప్రింటర్ ఇన్‌స్టాల్ అయిందో, ప్రింట్ స్పూలర్ నడుస్తోందో తనిఖీ చేసి, ముద్రణను మళ్లీ తెరవండి.
 	Sending to {printer}…	{printer}కు పంపుతోంది…
 	Choose a folder for the searchable files	వెతకగలిగే ఫైల్‌ల కోసం ఒక ఫోల్డర్‌ను ఎంచుకోండి
 	Files are combined in this order. Leave Pages empty to take every page.	ఫైల్‌లు ఈ క్రమంలో కలపబడతాయి. అన్ని పేజీలను తీసుకోవడానికి పేజీలు ఫీల్డ్‌ను ఖాళీగా వదలండి.
@@ -1971,7 +1987,7 @@ action wizard	Start	ప్రారంభించు
 	Used when a PDF doesn't ask for a layout or zoom. Continuous scrolling never snaps between pages.	PDF ఏ లేఅవుట్‌ను గానీ జూమ్‌ను గానీ కోరనప్పుడు ఉపయోగించబడుతుంది. నిరంతర స్క్రోలింగ్ పేజీల మధ్య ఎప్పుడూ స్నాప్ అవ్వదు.
 	Reopen the files that were open when PdfCraft last closed	PdfCraftను చివరిసారి మూసివేసినప్పుడు తెరిచి ఉన్న ఫైల్‌లను మళ్లీ తెరువు
 	Reload documents when their files change on disk	డిస్క్‌లో వాటి ఫైల్‌లు మారినప్పుడు పత్రాలను మళ్లీ లోడ్ చేయి
-	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	ఈ ఫైల్ డిస్క్‌లో మారింది. కొత్త వెర్షన్‌ను చూడటానికి దాన్ని మళ్లీ లోడ్ చేయండి; సేవ్ చేయని మీ మార్పులు పోతాయి.
+	This file changed on disk. Reload shows the new version and drops your unsaved changes; Save replaces it with this version.	ఈ ఫైల్ డిస్క్‌లో మారింది. రీలోడ్ కొత్త వెర్షన్‌ను చూపించి సేవ్ చేయని మార్పులను వదిలేస్తుంది; సేవ్ దాని స్థానంలో ఈ వెర్షన్‌ను ఉంచుతుంది.
 	Reload	మళ్లీ లోడ్ చేయి
 	Couldn't reload {name}: {e}	{name}ను మళ్లీ లోడ్ చేయడం సాధ్యం కాలేదు: {e}
 	About	పరిచయం
@@ -2165,6 +2181,8 @@ key	Space	స్పేస్
 	Reset page size	పేజీ పరిమాణాన్ని రీసెట్ చేయి
 	Expand all	అన్నీ విస్తరించు
 	Collapse all	అన్నీ ముడుచు
+	Collapse all pages	అన్ని పేజీలను ముడుచు
+	Expand all pages	అన్ని పేజీలను విస్తరించు
 	Remove page	పేజీని తీసివేయి
 	Remove {n} pages	{n} పేజీలను తీసివేయి
 
@@ -2181,7 +2199,7 @@ key	Space	స్పేస్
 	Rotate page {label} counterclockwise	{label} పేజీని అపసవ్య దిశలో తిప్పండి
 	Rotate page {label} clockwise	{label} పేజీని సవ్య దిశలో తిప్పండి
 	Delete page {label}	{label} పేజీని తొలగించండి
-	Mouse wheel scroll speed	మౌస్ వీల్ స్క్రోల్ వేగం
+	Scroll speed (mouse wheel and arrow keys)	స్క్రోల్ వేగం (మౌస్ వీల్ మరియు బాణం కీలు)
 scroll speed	Slow	నెమ్మదిగా
 scroll speed	Normal	సాధారణం
 scroll speed	Fast	వేగంగా
@@ -2254,6 +2272,10 @@ animation effects	Off	ఆఫ్
 	Local cross-PDF links require the desktop app	PDFల మధ్య స్థానిక లింక్‌లకు డెస్క్‌టాప్ యాప్ అవసరం
 	The existing action will be preserved.	ఉన్న చర్య అలాగే ఉంచబడుతుంది.
 	This form's scripts are turned off because one ran too long. Reopen the document to run them again.	ఒక స్క్రిప్ట్ చాలా సేపు నడిచినందున ఈ ఫారమ్ స్క్రిప్ట్‌లు ఆపివేయబడ్డాయి. వాటిని మళ్లీ నడపడానికి పత్రాన్ని మళ్లీ తెరవండి.
+	Cut Image	చిత్రాన్ని కత్తిరించు
+	Redact Image	చిత్రాన్ని రెడాక్ట్ చేయి
+	Create Link…	లింక్ సృష్టించు…
+	Recognize Text…	టెక్స్ట్‌ను గుర్తించు…
 	Minimize	కనిష్ఠీకరించు
 	Maximize	గరిష్ఠీకరించు
 	Restore	పునరుద్ధరించు
@@ -2263,7 +2285,59 @@ animation effects	Off	ఆఫ్
 # Absolute local GoToR confirmation (#1364).
 	Allow	అనుమతించు
 	Only allow this if you trust the source document.	మూల పత్రాన్ని విశ్వసిస్తే మాత్రమే దీన్ని అనుమతించండి.
+	Open in Full Screen mode?	పూర్తి తెర మోడ్‌లో తెరవాలా?
+	This document asks to open in Full Screen mode: the page fills the screen and nothing else shows. Press Esc at any time to leave it.	ఈ పత్రం పూర్తి తెర మోడ్‌లో తెరవమని అడుగుతోంది: పేజీ తెరను నింపుతుంది, ఇంకేమీ కనిపించదు. బయటకు రావడానికి ఎప్పుడైనా Esc నొక్కండి.
+	Full Screen	పూర్తి తెర
+	Not now	ఇప్పుడు కాదు
 	Open this local PDF?	ఈ స్థానిక PDF ఫైల్‌ను తెరవాలా?
 	This document is trying to open a local file:	ఈ పత్రం ఒక స్థానిక ఫైల్‌ను తెరవడానికి ప్రయత్నిస్తోంది:
 	Move tag earlier	ట్యాగ్‌ను ముందుకు తరలించు
 	Move tag later	ట్యాగ్‌ను వెనుకకు తరలించు
+	Turn upside down (180°)	తలకిందులుగా తిప్పు (180°)
+	4 x 6 in label (101.6 x 152.4 mm)	4 × 6 అం. లేబుల్ (101.6 × 152.4 మి.మీ.)
+	Cuts each page to its printed area, turns it upright and fits it to the sheet without stretching. One label per sheet.	ప్రతి పేజీని ముద్రిత ప్రాంతానికి కత్తిరించి, నిటారుగా తిప్పి, సాగదీయకుండా షీట్‌కు సరిపెడుతుంది. ఒక్కో షీట్‌కు ఒక లేబుల్.
+	Find untagged content	ట్యాగ్ చేయని కంటెంట్‌ను కనుగొను
+	No untagged content was found.	ట్యాగ్ చేయని కంటెంట్ కనుగొనబడలేదు.
+	Found {n} untagged content problems.	ట్యాగ్ చేయని కంటెంట్‌లో {n} సమస్యలు కనుగొనబడ్డాయి.
+	Tag form fields	ఫారమ్ ఫీల్డ్‌లకు ట్యాగ్‌లు జోడించు
+	Mark as artifact	ఆర్టిఫాక్ట్‌గా గుర్తించు
+	Remove this leaf tag from reading order and mark its direct content as an artifact	ఈ లీఫ్ ట్యాగ్‌ను పఠన క్రమం నుంచి తీసివేసి, దాని ప్రత్యక్ష కంటెంట్‌ను ఆర్టిఫాక్ట్‌గా గుర్తించండి
+	Mark content as artifact	కంటెంట్‌ను ఆర్టిఫాక్ట్‌గా గుర్తించు
+	Word count	పదాల లెక్క
+	Current page only	ప్రస్తుత పేజీ మాత్రమే
+	Exclude tagged tables	ట్యాగ్ చేసిన పట్టికలను మినహాయించు
+	Exclude tagged code blocks	ట్యాగ్ చేసిన కోడ్ బ్లాక్‌లను మినహాయించు
+	Exclude image/OCR text	చిత్రాలు/OCR వచనాన్ని మినహాయించు
+	Exclusions use PDF tags. Untagged tables and code remain included. Image exclusion also removes invisible text.	మినహాయింపులు PDF ట్యాగ్‌లను ఉపయోగిస్తాయి. ట్యాగ్‌లు లేని పట్టికలు, కోడ్ లెక్కలో ఉంటాయి. చిత్రాలను మినహాయిస్తే కనిపించని వచనం కూడా తొలగించబడుతుంది.
+	Words	పదాలు
+	Characters	అక్షరాలు
+	Characters without spaces	ఖాళీలు లేని అక్షరాలు
+	Pages counted	లెక్కించిన పేజీలు
+	Some pages contain no countable text. Scanned images need OCR first.	కొన్ని పేజీల్లో లెక్కించగల వచనం లేదు. స్కాన్ చేసిన చిత్రాలకు ముందుగా OCR అవసరం.
+	Some content could not be classified safely and was kept in the count.	కొంత కంటెంట్‌ను విశ్వసనీయంగా వర్గీకరించలేకపోయాం, కాబట్టి దాన్ని లెక్కలో ఉంచాం.
+	Counting words… {n} pages read	పదాలను లెక్కిస్తోంది… {n} పేజీలు చదివింది
+	Word counting stopped unexpectedly.	పదాల లెక్క అనుకోకుండా ఆగిపోయింది.
+	Word count…	పదాల లెక్క…
+@id	file.word_count	పదాల లెక్క…
+	Standard	ప్రామాణికం
+	Mobile	మొబైల్
+	Merge image fragments	చిత్ర శకలాలను విలీనం చేయి
+	Optimizing… merging image fragments	ఆప్టిమైజ్ చేస్తోంది… చిత్ర శకలాలను విలీనం చేస్తోంది
+	Side by side	పక్కపక్కన
+	New file only	కొత్త ఫైల్ మాత్రమే
+	Old file: {name}	పాత ఫైల్: {name}
+	New file: {name}	కొత్త ఫైల్: {name}
+	Print as image	చిత్రంగా ముద్రించు
+	Resolution:	రిజల్యూషన్:
+	Use it when a printer skips text, shading or transparency. The print is no longer searchable text; with Print in grayscale, the pictures are grey.	ప్రింటర్ వచనం, షేడింగ్ లేదా పారదర్శకతను వదిలేసినప్పుడు దీన్ని వాడండి. ముద్రణ ఇక శోధించగల వచనం కాదు; బూడిద రంగులో ముద్రించినప్పుడు చిత్రాలు బూడిద రంగులో ఉంటాయి.
+	Crop Image	చిత్రాన్ని కత్తిరించు
+	Remove Crop	కత్తిరింపును తీసివేయి
+	Trim the picture with its handles; Enter or Done applies	హ్యాండిల్‌లతో చిత్రాన్ని కత్తిరించండి; Enter లేదా పూర్తయింది వర్తింపజేస్తుంది
+	Redaction mark appearance	రెడాక్షన్ గుర్తు రూపం
+	Outline colour:	అంచు రంగు:
+	Fill colour:	నింపు రంగు:
+	Shown while the pointer is over a mark.	పాయింటర్ గుర్తుపై ఉన్నప్పుడు కనిపిస్తుంది.
+	Opacity:	అపారదర్శకత:
+	Make properties default	లక్షణాలను డిఫాల్ట్‌గా చేయి
+	Pages selected	ఎంచుకున్న పేజీలు
+	Page properties	పేజీ లక్షణాలు
diff --git a/crates/ui-egui/src/i18n/tr.tsv b/crates/ui-egui/src/i18n/tr.tsv
index eb03e7f99..9fbd4dc96 100644
--- a/crates/ui-egui/src/i18n/tr.tsv
+++ b/crates/ui-egui/src/i18n/tr.tsv
@@ -15,6 +15,7 @@
 	Interface language	Arayüz dili
 	Identity	Kimlik
 	Name on new comments	Yeni yorumlardaki ad
+	Hide hover previews for highlights without comment text	Yorum metni olmayan vurgular için üzerine gelme önizlemelerini gizle
 	Open…	Aç…
 	New blank PDF	Yeni boş PDF
 	Create PDF from file…	Dosyadan PDF oluştur…
@@ -328,6 +329,7 @@
 	Split	Böl
 	More	Daha fazla
 	Set page boxes	Sayfa kutularını ayarla
+	Set page transitions	Sayfa geçişlerini ayarla
 	Page labels	Sayfa etiketleri
 	Page transitions	Sayfa geçişleri
 	Add comments	Yorum ekle
@@ -540,6 +542,7 @@
 	Remove unused objects and merge identical ones	Kullanılmayan nesneleri kaldır ve aynı olanları birleştir
 	Audit space usage…	Alan kullanımını denetle…
 	Space Audit	Alan Denetimi
+	What takes up the space in this file, by kind of content.	Bu dosyadaki alanı neyin kapladığı, içerik türüne göre.
 	Bytes	Bayt
 	Content Streams	İçerik Akışları
 	X Object Forms	XObject Formları
@@ -810,6 +813,12 @@
 	Windows store  ·  	Windows depolama alanı  ·  
 	Issued by: 	Veren: 
 	, Expires: 	, Son kullanma tarihi: 
+	Digitally signed by	Dijital olarak imzalayan
+	DN: 	DN: 
+	Reason: 	Neden: 
+	Location: 	Konum: 
+	Date: 	Tarih: 
+	The labels are in English: the signature's font can't draw them in this language.	Etiketler İngilizce: imzanın yazı tipi bu dilde onları çizemiyor.
 	No digital IDs yet.	Henüz dijital kimlik yok.
 	Configure New Digital ID	Yeni Dijital Kimlik Yapılandır
 	Remove "{name}" from this list? The file itself is not deleted.	"{name}" bu listeden kaldırılsın mı? Dosyanın kendisi silinmez.
@@ -1104,6 +1113,7 @@
 	Redaction code:	Karartma kodu:
 	Font:	Yazı tipi:
 	Font size:	Yazı tipi boyutu:
+	Font size	Yazı tipi boyutu
 	Auto-size text to fit redaction region	Metni karartma bölgesine sığacak şekilde otomatik boyutlandır
 	Font colour:	Yazı tipi rengi:
 	Repeat overlay text	Üst metni yinele
@@ -1244,6 +1254,7 @@
 	Copy text	Metni kopyala
 	Properties…	Özellikler…
 	Make Current Properties Default	Geçerli Özellikleri Varsayılan Yap
+	Make Properties Default	Özellikleri Varsayılan Yap
 	More options	Diğer seçenekler
 	Sort by	Sırala
 	Author	Yazar
@@ -1364,6 +1375,9 @@
 	Sort comments by:	Yorumları şuna göre sırala:
 	Create PDF Comment Summary	PDF Yorum Özeti Oluştur
 	Revert to the previously saved version of “{name}”? Changes since then can't be undone afterwards.	“{name}” belgesinin daha önce kaydedilmiş sürümüne geri dönülsün mü? O andan sonraki değişiklikler geri alınamaz.
+	Save over the changed file?	Değiştirilen dosyanın üzerine kaydedilsin mi?
+	“{name}” changed on disk after it was opened or last saved. Saving now replaces that newer version with this one.	“{name}” açıldıktan veya son kaydedildikten sonra diskte değişti. Şimdi kaydetmek o daha yeni sürümü bununla değiştirir.
+	Save anyway	Yine de kaydet
 	Number pages	Sayfaları numaralandır
 	Style	Stil
 	None (prefix only)	Yok (yalnızca önek)
@@ -2171,6 +2185,8 @@ key	Space	Boşluk
 
 # Printing and multi-object selection
 	Looking for printers…	Yazıcılar aranıyor…
+	Sending sheet {s} of {n} to {printer}…	{n} yapraktan {s}. yaprak {printer} yazıcısına gönderiliyor…
+	No printers were found. Check that the printer is installed and the print spooler is running, then open Print again.	Yazıcı bulunamadı. Yazıcının yüklü olduğunu ve yazdırma biriktiricisinin çalıştığını denetleyip Yazdır'ı yeniden açın.
 	Sending to {printer}…	{printer} yazıcısına gönderiliyor…
 	Column select	Sütun seçimi
 @plural	{n} object selected|{n} objects selected	{n} nesne seçildi
@@ -2199,6 +2215,8 @@ key	Space	Boşluk
 	Some bookmarks are not shown here: the panel lists a limited number, nested a limited depth.	Bazı yer imleri burada gösterilmiyor: panel sınırlı sayıda ve sınırlı derinlikte listeler.
 	Expand all	Tümünü genişlet
 	Collapse all	Tümünü daralt
+	Collapse all pages	Tüm sayfaları daralt
+	Expand all pages	Tüm sayfaları genişlet
 	Remove page	Sayfayı kaldır
 	Remove {n} pages	{n} sayfayı kaldır
 
@@ -2257,10 +2275,10 @@ key	Space	Boşluk
 	Printer paper and scaling may differ. Check driver settings.	Yazıcı kâğıdı ve ölçekleme farklı olabilir. Sürücü ayarlarını kontrol edin.
 	Drawing scale changes. Use Actual size for full-scale plans.	Çizim ölçeği değişir. Tam ölçekli planlar için Gerçek boyutu kullanın.
 	Reload documents when their files change on disk	Diskteki dosyaları değiştiğinde belgeleri yeniden yükle
-	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	Bu dosya diskte değişti. Yeni sürümü görmek için yeniden yükleyin; kaydedilmemiş değişiklikleriniz kaybolacak.
+	This file changed on disk. Reload shows the new version and drops your unsaved changes; Save replaces it with this version.	Bu dosya diskte değişti. Yeniden yükle yeni sürümü gösterir ve kaydedilmemiş değişikliklerinizi atar; Kaydet onu bu sürümle değiştirir.
 	Reload	Yeniden yükle
 	Couldn't reload {name}: {e}	{name} yeniden yüklenemedi: {e}
-	Mouse wheel scroll speed	Fare tekerleği kaydırma hızı
+	Scroll speed (mouse wheel and arrow keys)	Kaydırma hızı (fare tekerleği ve ok tuşları)
 scroll speed	Slow	Yavaş
 scroll speed	Normal	Orta
 scroll speed	Fast	Hızlı
@@ -2337,6 +2355,10 @@ animation effects	Off	Kapalı
 	The linked PDF opened, but its named destination was not applied.	Bağlantılı PDF açıldı, ancak adlandırılmış hedefi uygulanmadı.
 	The linked PDF opened, but its page destination was out of range.	Bağlantılı PDF açıldı, ancak sayfa hedefi aralık dışında.
 	Local cross-PDF links require the desktop app	PDF'ler arası yerel bağlantılar masaüstü uygulamasını gerektirir
+	Cut Image	Resmi Kes
+	Redact Image	Resmi karart
+	Create Link…	Bağlantı oluştur…
+	Recognize Text…	Metni Tanı…
 	Minimize	Küçült
 	Maximize	Büyüt
 	Restore	Geri yükle
@@ -2346,7 +2368,59 @@ animation effects	Off	Kapalı
 # Absolute local GoToR confirmation (#1364).
 	Allow	İzin ver
 	Only allow this if you trust the source document.	Buna yalnızca kaynak belgeye güveniyorsanız izin verin.
+	Open in Full Screen mode?	Tam ekran modunda açılsın mı?
+	This document asks to open in Full Screen mode: the page fills the screen and nothing else shows. Press Esc at any time to leave it.	Bu belge tam ekran modunda açılmak istiyor: sayfa ekranı doldurur ve başka hiçbir şey görünmez. Çıkmak için istediğiniz zaman Esc tuşuna basın.
+	Full Screen	Tam ekran
+	Not now	Şimdi değil
 	Open this local PDF?	Bu yerel PDF açılsın mı?
 	This document is trying to open a local file:	Bu belge yerel bir dosya açmaya çalışıyor:
 	Move tag earlier	Etiketi daha erken taşı
 	Move tag later	Etiketi daha geç taşı
+	Turn upside down (180°)	Baş aşağı çevir (180°)
+	4 x 6 in label (101.6 x 152.4 mm)	4 × 6 inç etiket (101,6 × 152,4 mm)
+	Cuts each page to its printed area, turns it upright and fits it to the sheet without stretching. One label per sheet.	Her sayfayı basılı alanına göre kırpar, dik çevirir ve germeden sayfaya sığdırır. Sayfa başına bir etiket.
+	Find untagged content	Etiketlenmemiş içeriği bul
+	No untagged content was found.	Etiketlenmemiş içerik bulunamadı.
+	Found {n} untagged content problems.	{n} etiketlenmemiş içerik sorunu bulundu.
+	Tag form fields	Form alanlarını etiketle
+	Mark as artifact	Yapıt olarak işaretle
+	Remove this leaf tag from reading order and mark its direct content as an artifact	Bu yaprak etiketini okuma sırasından kaldırın ve doğrudan içeriğini yapıt olarak işaretleyin
+	Mark content as artifact	İçeriği yapıt olarak işaretle
+	Word count	Sözcük sayısı
+	Current page only	Yalnızca geçerli sayfa
+	Exclude tagged tables	Etiketli tabloları hariç tut
+	Exclude tagged code blocks	Etiketli kod bloklarını hariç tut
+	Exclude image/OCR text	Görüntü/OCR metnini hariç tut
+	Exclusions use PDF tags. Untagged tables and code remain included. Image exclusion also removes invisible text.	Hariç tutma işlemleri PDF etiketlerini kullanır. Etiketsiz tablolar ve kod sayılmaya devam eder. Görüntüleri hariç tutmak görünmez metni de kaldırır.
+	Words	Sözcükler
+	Characters	Karakterler
+	Characters without spaces	Boşluksuz karakterler
+	Pages counted	Sayılan sayfalar
+	Some pages contain no countable text. Scanned images need OCR first.	Bazı sayfalarda sayılabilecek metin yok. Taranmış görüntüler için önce OCR gerekir.
+	Some content could not be classified safely and was kept in the count.	Bazı içerikler güvenilir biçimde sınıflandırılamadığı için sayıma dahil edildi.
+	Counting words… {n} pages read	Sözcükler sayılıyor… {n} sayfa okundu
+	Word counting stopped unexpectedly.	Sözcük sayımı beklenmedik şekilde durdu.
+	Word count…	Sözcük sayısı…
+@id	file.word_count	Sözcük sayısı…
+	Standard	Standart
+	Mobile	Mobil
+	Merge image fragments	Görüntü parçalarını birleştir
+	Optimizing… merging image fragments	İyileştiriliyor… görüntü parçaları birleştiriliyor
+	Side by side	Yan yana
+	New file only	Yalnızca yeni dosya
+	Old file: {name}	Eski dosya: {name}
+	New file: {name}	Yeni dosya: {name}
+	Print as image	Resim olarak yazdır
+	Resolution:	Çözünürlük:
+	Use it when a printer skips text, shading or transparency. The print is no longer searchable text; with Print in grayscale, the pictures are grey.	Yazıcı metni, gölgelendirmeyi veya saydamlığı atladığında kullanın. Çıktı artık aranabilir metin değildir; gri tonlamalı yazdırmayla resimler gri olur.
+	Crop Image	Resmi kırp
+	Remove Crop	Kırpmayı kaldır
+	Trim the picture with its handles; Enter or Done applies	Resmi tutamaçlarıyla kırpın; Enter veya Bitti uygular
+	Redaction mark appearance	Karartma işareti görünümü
+	Outline colour:	Kenar rengi:
+	Fill colour:	Dolgu rengi:
+	Shown while the pointer is over a mark.	İşaretçi bir işaretin üzerindeyken gösterilir.
+	Opacity:	Opaklık:
+	Make properties default	Özellikleri varsayılan yap
+	Pages selected	Seçilen sayfalar
+	Page properties	Sayfa özellikleri
diff --git a/crates/ui-egui/src/i18n/uk.tsv b/crates/ui-egui/src/i18n/uk.tsv
index eb1cea0e1..53bc832f5 100644
--- a/crates/ui-egui/src/i18n/uk.tsv
+++ b/crates/ui-egui/src/i18n/uk.tsv
@@ -32,6 +32,7 @@
 	Auto follows the system's text size. Pages always render at the display's full resolution.	Автоматичний режим використовує розмір тексту із системних налаштувань. Сторінки завжди відображаються в повній роздільній здатності екрана.
 	Identity	Особисті дані
 	Name on new comments	Ім’я в нових коментарях
+	Hide hover previews for highlights without comment text	Приховувати спливний перегляд для виділень без тексту коментаря
 	Open…	Відкрити…
 	Open Recent	Відкрити нещодавні
 	Pin folder to Home…	Закріпити теку на головній…
@@ -368,6 +369,7 @@
 	Split	Розділити
 	More	Більше
 	Set page boxes	Задати межі сторінок
+	Set page transitions	Задати переходи між сторінками
 	Page labels	Позначки сторінок
 	Page transitions	Переходи між сторінками
 	Add comments	Додати коментарі
@@ -580,6 +582,7 @@
 	Remove unused objects and merge identical ones	Видалити невикористані об’єкти й об’єднати однакові
 	Audit space usage…	Аналіз використання місця…
 	Space Audit	Аналіз місця
+	What takes up the space in this file, by kind of content.	Що займає місце в цьому файлі, за типом вмісту.
 	Bytes	Байти
 	Content Streams	Потоки вмісту
 	X Object Forms	Форми XObject
@@ -853,6 +856,12 @@
 	Windows store  ·  	Сховище Windows  ·  
 	Issued by: 	Видавець: 
 	, Expires: 	, Дійсний до: 
+	Digitally signed by	Цифровий підпис
+	DN: 	DN: 
+	Reason: 	Причина: 
+	Location: 	Місце: 
+	Date: 	Дата: 
+	The labels are in English: the signature's font can't draw them in this language.	Мітки англійською: шрифт підпису не може відобразити їх цією мовою.
 	No digital IDs yet.	Ще немає цифрових посвідчень.
 	Configure New Digital ID	Налаштувати нове цифрове посвідчення
 	Remove "{name}" from this list? The file itself is not deleted.	Прибрати «{name}» з цього списку? Сам файл не видаляється.
@@ -1144,6 +1153,7 @@
 	Redaction code:	Код вилучення:
 	Font:	Шрифт:
 	Font size:	Розмір шрифту:
+	Font size	Розмір шрифту
 	Auto-size text to fit redaction region	Автоматично добирати розмір тексту до області вилучення
 	Font colour:	Колір шрифту:
 	Repeat overlay text	Повторювати накладений текст
@@ -1284,6 +1294,7 @@
 	Copy text	Копіювати текст
 	Properties…	Властивості…
 	Make Current Properties Default	Зробити поточні властивості типовими
+	Make Properties Default	Зробити властивості типовими
 	More options	Додаткові параметри
 	Sort by	Сортувати за
 	Author	Автор
@@ -1405,6 +1416,9 @@
 	Sort comments by:	Сортувати коментарі за:
 	Create PDF Comment Summary	Створити PDF зі зведенням коментарів
 	Revert to the previously saved version of “{name}”? Changes since then can't be undone afterwards.	Повернутися до попередньої збереженої версії «{name}»? Після цього зміни, внесені відтоді, неможливо буде повернути.
+	Save over the changed file?	Зберегти поверх зміненого файлу?
+	“{name}” changed on disk after it was opened or last saved. Saving now replaces that newer version with this one.	«{name}» змінено на диску після відкриття або останнього збереження. Збереження зараз замінить ту новішу версію цією.
+	Save anyway	Усе одно зберегти
 	Number pages	Пронумерувати сторінки
 	Style	Стиль
 	None (prefix only)	Немає (лише префікс)
@@ -1601,6 +1615,8 @@
 	Sent to {printer}	Надіслано на {printer}
 	Sent to {printer}: {msg}	Надіслано на {printer}: {msg}
 	Looking for printers…	Пошук принтерів…
+	Sending sheet {s} of {n} to {printer}…	Надсилання аркуша {s} із {n} на {printer}…
+	No printers were found. Check that the printer is installed and the print spooler is running, then open Print again.	Принтери не знайдено. Перевірте, що принтер установлено, а диспетчер друку працює, і знову відкрийте «Друк».
 	Sending to {printer}…	Надсилання на {printer}…
 	Choose a folder for the searchable files	Виберіть теку для файлів із пошуком
 	Files are combined from top to bottom. Leave Pages empty to take every page.	Файли об’єднуються згори донизу. Залиште «Сторінки» порожнім, щоб узяти всі сторінки.
@@ -2264,6 +2280,8 @@ key	Space	Пробіл
 	Switch to List view to change the pages it takes.	Перейдіть до вигляду списком, щоб змінити, які сторінки взяти.
 	Expand all	Розгорнути всі
 	Collapse all	Згорнути всі
+	Collapse all pages	Згорнути всі сторінки
+	Expand all pages	Розгорнути всі сторінки
 	Remove page	Видалити сторінку
 	Remove {n} pages	Видалити сторінки: {n}
 
@@ -2282,14 +2300,14 @@ key	Space	Пробіл
 	Printer paper and scaling may differ. Check driver settings.	Папір і масштаб принтера можуть відрізнятися. Перевірте налаштування драйвера.
 	Drawing scale changes. Use Actual size for full-scale plans.	Масштаб креслення змінюється. Для друку в початковому масштабі виберіть Фактичний розмір.
 	Reload documents when their files change on disk	Перезавантажувати документи, коли їхні файли змінюються на диску
-	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	Цей файл змінено на диску. Перезавантажте його, щоб побачити нову версію; незбережені зміни буде втрачено.
+	This file changed on disk. Reload shows the new version and drops your unsaved changes; Save replaces it with this version.	Цей файл змінено на диску. «Перезавантажити» покаже нову версію й відкине незбережені зміни; «Зберегти» замінить її цією версією.
 	Reload	Перезавантажити
 	Couldn't reload {name}: {e}	Не вдалося перезавантажити {name}: {e}
 	Select page {label}	Вибрати сторінку {label}
 	Rotate page {label} counterclockwise	Повернути сторінку {label} проти годинникової стрілки
 	Rotate page {label} clockwise	Повернути сторінку {label} за годинниковою стрілкою
 	Delete page {label}	Видалити сторінку {label}
-	Mouse wheel scroll speed	Швидкість прокручування коліщатком миші
+	Scroll speed (mouse wheel and arrow keys)	Швидкість прокручування (коліщатко миші та клавіші зі стрілками)
 scroll speed	Slow	Повільна
 scroll speed	Normal	Звичайна
 scroll speed	Fast	Швидка
@@ -2363,6 +2381,10 @@ animation effects	Off	Вимкнено
 	The linked PDF opened, but its named destination was not applied.	Пов’язаний PDF відкрито, але його іменоване призначення не застосовано.
 	The linked PDF opened, but its page destination was out of range.	Пов’язаний PDF відкрито, але сторінка призначення поза межами діапазону.
 	Local cross-PDF links require the desktop app	Локальні посилання між PDF працюють лише в настільному застосунку
+	Cut Image	Вирізати зображення
+	Redact Image	Вилучити вміст зображення
+	Create Link…	Створити посилання…
+	Recognize Text…	Розпізнати текст…
 	Minimize	Згорнути
 	Maximize	Розгорнути
 	Restore	Відновити
@@ -2372,7 +2394,59 @@ animation effects	Off	Вимкнено
 # Absolute local GoToR confirmation (#1364).
 	Allow	Дозволити
 	Only allow this if you trust the source document.	Дозволяйте це лише тоді, коли довіряєте вихідному документу.
+	Open in Full Screen mode?	Відкрити в повноекранному режимі?
+	This document asks to open in Full Screen mode: the page fills the screen and nothing else shows. Press Esc at any time to leave it.	Цей документ просить відкрити його в повноекранному режимі: сторінка заповнює екран, і більше нічого не показано. Натисніть Esc будь-коли, щоб вийти.
+	Full Screen	Повний екран
+	Not now	Не зараз
 	Open this local PDF?	Відкрити цей локальний PDF?
 	This document is trying to open a local file:	Цей документ намагається відкрити локальний файл:
 	Move tag earlier	Перемістити тег раніше
 	Move tag later	Перемістити тег пізніше
+	Turn upside down (180°)	Перевернути (180°)
+	4 x 6 in label (101.6 x 152.4 mm)	Етикетка 4 × 6 дюйма (101,6 × 152,4 мм)
+	Cuts each page to its printed area, turns it upright and fits it to the sheet without stretching. One label per sheet.	Обрізає кожну сторінку за надрукованою областю, розвертає її прямо та вписує в аркуш без спотворень. Одна етикетка на аркуш.
+	Find untagged content	Знайти нетегований вміст
+	No untagged content was found.	Нетегованого вмісту не знайдено.
+	Found {n} untagged content problems.	Знайдено проблем із нетегованим вмістом: {n}.
+	Tag form fields	Позначити поля форми
+	Mark as artifact	Позначити як артефакт
+	Remove this leaf tag from reading order and mark its direct content as an artifact	Вилучіть цей кінцевий тег із порядку читання та позначте його безпосередній вміст як артефакт
+	Mark content as artifact	Позначити вміст як артефакт
+	Word count	Кількість слів
+	Current page only	Лише поточна сторінка
+	Exclude tagged tables	Виключити таблиці з тегами
+	Exclude tagged code blocks	Виключити блоки коду з тегами
+	Exclude image/OCR text	Виключити текст зображень та OCR
+	Exclusions use PDF tags. Untagged tables and code remain included. Image exclusion also removes invisible text.	Виключення використовують теги PDF. Таблиці й код без тегів залишаються в підрахунку. Виключення зображень також видаляє невидимий текст.
+	Words	Слова
+	Characters	Символи
+	Characters without spaces	Символи без пробілів
+	Pages counted	Пораховані сторінки
+	Some pages contain no countable text. Scanned images need OCR first.	Деякі сторінки не містять тексту для підрахунку. Для відсканованих зображень спочатку потрібне OCR.
+	Some content could not be classified safely and was kept in the count.	Частину вмісту не вдалося надійно класифікувати, тому вона залишилася в підрахунку.
+	Counting words… {n} pages read	Підрахунок слів… прочитано сторінок: {n}
+	Word counting stopped unexpectedly.	Підрахунок слів несподівано зупинився.
+	Word count…	Кількість слів…
+@id	file.word_count	Кількість слів…
+	Standard	Стандартні
+	Mobile	Мобільні пристрої
+	Merge image fragments	Об’єднувати фрагменти зображень
+	Optimizing… merging image fragments	Оптимізація… об’єднання фрагментів зображень
+	Side by side	Поруч
+	New file only	Лише новий файл
+	Old file: {name}	Старий файл: {name}
+	New file: {name}	Новий файл: {name}
+	Print as image	Друкувати як зображення
+	Resolution:	Роздільність:
+	Use it when a printer skips text, shading or transparency. The print is no longer searchable text; with Print in grayscale, the pictures are grey.	Використовуйте, коли принтер пропускає текст, заливки або прозорість. Відбиток більше не текст із пошуком; під час друку у відтінках сірого зображення сірі.
+	Crop Image	Обрізати зображення
+	Remove Crop	Прибрати обрізання
+	Trim the picture with its handles; Enter or Done applies	Обріжте зображення за маркери; Enter або «Готово» застосовує
+	Redaction mark appearance	Вигляд позначки приховування
+	Outline colour:	Колір контуру:
+	Fill colour:	Колір заливки:
+	Shown while the pointer is over a mark.	Показується, поки вказівник над позначкою.
+	Opacity:	Непрозорість:
+	Make properties default	Зробити властивості типовими
+	Pages selected	Вибрані сторінки
+	Page properties	Властивості сторінки
diff --git a/crates/ui-egui/src/i18n/vi.tsv b/crates/ui-egui/src/i18n/vi.tsv
new file mode 100644
index 000000000..3a4f3903f
--- /dev/null
+++ b/crates/ui-egui/src/i18n/vi.tsv
@@ -0,0 +1,2683 @@
+# Vietnamese (vi) catalog. Columns, separated by a TAB: context <TAB> source <TAB> translation
+#
+# Clean-room translations from PdfCraft's English UI labels. Reviewed by a native
+# Vietnamese-speaking contributor for the original catalog; later additions are marked below. PhotoCraft/VectorCraft Vietnamese catalogs were used only as
+# translation memory when the English source and its meaning in context matched. Product and
+# format names (PdfCraft, PDF, PDF/A, OCR, XFA, Word…) remain names where appropriate.
+# Plural rule: `plural_none` — every @plural row lists exactly one form.
+# Context-sensitive wording and intentional unchanged strings are regression-tested in i18n/mod.rs.
+#
+	Menu	Trình đơn
+	Edit	Chỉnh sửa
+	Pages	Trang
+	View	Xem
+	Help	Trợ giúp
+	Zoom	Thu phóng
+	Actual size	Kích thước thực
+	Zoom to page level	Thu phóng vừa trang
+	Fit to width	Vừa chiều rộng
+	Display theme	Chủ đề hiển thị
+	Side panels	Bảng bên
+	Preferences	Tùy chọn
+	Preferences…	Tùy chọn…
+	Interface language	Ngôn ngữ giao diện
+	Interface size	Kích thước giao diện
+	Auto ({percent}%)	Tự động ({percent}%)
+	Identity	Danh tính
+	Name on new comments	Tên trên bình luận mới
+	Hide hover previews for highlights without comment text	Ẩn bản xem trước khi di chuột cho các phần tô sáng không có nội dung nhận xét
+	Open…	Mở…
+	Open Recent	Mở gần đây
+	Clear Recent Files	Xóa tệp gần đây
+	Remove from Recent	Xóa khỏi Gần đây
+	No recent files	Không có tệp gần đây
+	New blank PDF	PDF trống mới
+	Create PDF from file…	Tạo PDF từ tệp…
+	Create PDF from images…	Tạo PDF từ hình ảnh…
+	Create PDF from multiple files…	Tạo PDF từ nhiều tệp…
+	Create separate PDFs…	Tạo các PDF riêng biệt…
+	Create PDF from clipboard	Tạo PDF từ bảng tạm
+	Combine files…	Kết hợp tệp…
+	Save	Lưu
+	Save as…	Lưu thành…
+	Close file	Đóng tệp
+	Close all	Đóng tất cả
+	Revert	Hoàn nguyên
+	Print…	In…
+	Document properties…	Thuộc tính tài liệu…
+	Find…	Tìm…
+	Advanced search…	Tìm nâng cao…
+	Copy	Sao chép
+	Cut	Cắt
+	Paste	Dán
+	Delete	Xóa
+	Select all	Chọn tất cả
+	Cancel	Hủy
+	OK	OK
+	Apply	Áp dụng
+	Close	Đóng
+	Back	Quay lại
+	Next	Tiếp theo
+	Previous	Trước
+	Name	Tên
+	File name	Tên tệp
+	Location	Vị trí
+	Browse…	Duyệt…
+	Choose…	Chọn…
+	Search	Tìm
+	Clear	Xóa
+	Refresh	Làm mới
+	Loading…	Đang tải…
+	Save changes?	Lưu các thay đổi?
+	Don't save	Không lưu
+	Page	Trang
+	Page {n}	Trang {n}
+	of	trên
+	Fit one full page	Vừa một trang đầy đủ
+	Single page	Một trang
+	Two-page view	Chế độ hai trang
+	Continuous scrolling	Cuộn liên tục
+	Page display	Hiển thị trang
+	Default page display	Hiển thị trang mặc định
+	Default zoom	Thu phóng mặc định
+	Full screen mode	Chế độ toàn màn hình
+	Read mode	Chế độ đọc
+	Comments	Bình luận
+	Comment	Bình luận
+	Add comment	Thêm bình luận
+	Delete comment	Xóa bình luận
+	Reply	Trả lời
+	Highlight	Tô sáng
+	Underline	Gạch chân
+	Strikethrough	Gạch ngang
+	Text	Văn bản
+	Font	Phông chữ
+	Size	Kích thước
+	Color	Màu
+	Opacity	Độ mờ
+	Width	Chiều rộng
+	Height	Chiều cao
+	Rotation	Xoay
+	More	Thêm
+	Settings	Cài đặt
+	General	Chung
+	Language	Ngôn ngữ
+	Appearance	Diện mạo
+theme	Appearance	Giao diện
+	Theme	Chủ đề
+	Light	Sáng
+	Dark	Tối
+	System	Hệ thống
+	Open file	Mở tệp
+	Save file	Lưu tệp
+	Export	Xuất
+	Import	Nhập
+	Export to image…	Xuất ra hình ảnh…
+	Export to text…	Xuất ra văn bản…
+	Export to Word…	Xuất ra Word…
+	Export to HTML…	Xuất ra HTML…
+	Export to RTF…	Xuất ra RTF…
+	Reduce file size…	Giảm kích thước tệp…
+	Optimize PDF…	Tối ưu hóa PDF…
+	Protect using password…	Bảo vệ bằng mật khẩu…
+	Remove security	Gỡ bảo mật
+	Security properties…	Thuộc tính bảo mật…
+	Organize pages	Sắp xếp trang
+	Rotate pages…	Xoay trang…
+	Delete pages	Xóa trang
+	Insert blank page	Chèn trang trống
+	Insert pages from file…	Chèn trang từ tệp…
+	Replace pages…	Thay thế trang…
+	Extract pages…	Trích xuất trang…
+	Split document…	Tách tài liệu…
+	Number pages…	Đánh số trang…
+	Bookmarks	Dấu trang
+	New bookmark	Dấu trang mới
+	Forms	Biểu mẫu
+	Form fields	Các trường biểu mẫu
+	Signatures	Chữ ký
+	Sign	Ký
+	Fill & Sign	Điền & Ký
+	Accessibility	Trợ năng
+	Help…	Trợ giúp…
+	Check for updates…	Kiểm tra bản cập nhật…
+	About PdfCraft	Giới thiệu PdfCraft
+	Automatically	Tự động
+	Never	Không bao giờ
+	Always	Luôn luôn
+	Yes	Có
+	No	Không
+	On	Bật
+	Off	Tắt
+	Enabled	Đã bật
+	Disabled	Đã tắt
+	Required	Bắt buộc
+	Optional	Không bắt buộc
+	None	Không có
+	Unknown	Không rõ
+	Error	Lỗi
+	Warning	Cảnh báo
+	Information	Thông tin
+	Success	Thành công
+	Failed	Thất bại
+	File	Tệp
+	Folder	Thư mục
+	Choose a file…	Chọn một tệp…
+	Choose a folder…	Chọn một thư mục…
+	Open folder	Mở thư mục
+	Create folder	Tạo thư mục
+	Remove	Gỡ bỏ
+	Rename	Đổi tên
+	Duplicate	Nhân bản
+	Move	Di chuyển
+	Copy to clipboard	Sao chép vào bảng tạm
+	Copied to clipboard	Đã sao chép vào bảng tạm
+	Undo	Hoàn tác
+	Redo	Làm lại
+	Keyboard shortcuts	Phím tắt
+	Find tools and commands…	Tìm công cụ và lệnh…
+	Take a snapshot	Chụp ảnh nhanh
+	Organize	Sắp xếp
+	Comment and review	Bình luận và duyệt
+	Prepare a form	Chuẩn bị biểu mẫu
+	Protect	Bảo vệ
+	Print	In
+	Create	Tạo
+	Convert	Chuyển đổi
+	Optimize	Tối ưu hóa
+	Measure	Đo
+	Redact	Xóa nội dung nhạy cảm
+	Search results	Kết quả tìm
+	No results	Không có kết quả
+	Page {n} of {total}	Trang {n} trên {total}
+	{n} pages selected	Đã chọn {n} trang
+	  · not fixable here	  · không thể sửa tại đây
+	 (page {p})	 (trang {p})
+	 (searching… {s} of {p} pages)	 (đang tìm… {s} trên {p} trang)
+	 ({n} at {dpi} dpi, the largest size they can be drawn at)	 ({n} ở {dpi} dpi, kích thước lớn nhất có thể vẽ)
+	 ({s} not exported: {first})	 ({s} chưa được xuất: {first})
+	 on page {p}	 trên trang {p}
+	 · password-protected	 · được bảo vệ bằng mật khẩu
+	(none)	(không có)
+	, Expires: 	, Hết hạn: 
+	1 difference found	Tìm thấy 1 điểm khác biệt
+	1 file	1 tệp
+	1 file done	1 tệp đã xong
+	1 file needs attention	1 tệp cần chú ý
+	1 instance	1 lần xuất hiện
+	1 issue	1 vấn đề
+	1 mark	1 dấu
+	1 page	1 trang
+	1 page selected	Đã chọn 1 trang
+	1 page selected.	Đã chọn 1 trang.
+	180 degrees	180 độ
+	9 digit, A letter, O letter or digit, X any character	9 chữ số, A chữ cái, O chữ cái hoặc chữ số, X ký tự bất kỳ
+	; 1 page already had text	; 1 trang đã có văn bản
+	; failed: {list}	; thất bại: {list}
+	; {n} pages already had text	; {n} trang đã có văn bản
+	? of {n}	? trên {n}
+	A clean-room, open-source PDF application written in Rust. MIT OR Apache-2.0.	Ứng dụng PDF mã nguồn mở, viết lại độc lập (clean-room) bằng Rust. MIT OR Apache-2.0.
+	Accessibility Checker	Trình kiểm tra trợ năng
+	Accessibility Checker Options	Tùy chọn trình kiểm tra trợ năng
+	Acrobat 3.0 and later (40-bit RC4)	Acrobat 3.0 trở lên (RC4 40 bit)
+	Acrobat 5.0 and later (128-bit RC4)	Acrobat 5.0 trở lên (RC4 128 bit)
+	Acrobat 7.0 and later (128-bit AES)	Acrobat 7.0 trở lên (AES 128 bit)
+	Acrobat X and later (256-bit AES)	Acrobat X trở lên (AES 256 bit)
+	Action name:	Tên hành động:
+	Actions	Hành động
+	Active	Đang dùng
+	Actual Size	Kích thước thực
+	Actual text	Văn bản thực tế
+	Add	Thêm
+	Add Step	Thêm bước
+	Add a comment	Thêm bình luận
+	Add a reply	Thêm câu trả lời
+	Add a sticky note here	Thêm ghi chú dán tại đây
+	Add an Action	Thêm hành động
+	Add at least two files	Thêm ít nhất hai tệp
+	Add files…	Thêm tệp…
+	Add folder	Thêm thư mục
+	Add folder and subfolders	Thêm thư mục và thư mục con
+	Add folder and subfolders…	Thêm thư mục và thư mục con…
+	Add folder…	Thêm thư mục…
+	Add open documents	Thêm tài liệu đang mở
+	Add the choices people pick from.	Thêm các lựa chọn để người dùng chọn.
+	Add the files to combine	Thêm các tệp cần kết hợp
+	Add the steps this action runs, in order.	Thêm các bước mà hành động này chạy, theo thứ tự.
+	Add to Trusted Certificates	Thêm vào Chứng chỉ tin cậy
+	Add to trusted certificates	Thêm vào chứng chỉ tin cậy
+	Added 1 comment	Đã thêm 1 bình luận
+	Added more than once	Đã thêm nhiều lần
+	Added {n} comments	Đã thêm {n} bình luận
+	Adds invisible text over each word; the page image is not changed	Thêm văn bản ẩn lên từng từ; hình ảnh trang không bị thay đổi
+	Advanced	Nâng cao
+	Advanced Options {chevron}	Tùy chọn nâng cao {chevron}
+	Align	Căn chỉnh
+	Align left	Căn trái
+	Align right	Căn phải
+	Alignment:	Căn lề:
+	All	Tất cả
+	All document contents	Toàn bộ nội dung tài liệu
+	All document contents except metadata	Toàn bộ nội dung tài liệu trừ siêu dữ liệu
+	All open documents	Tất cả tài liệu đang mở
+	All pages	Tất cả các trang
+	All pages in document	Tất cả các trang trong tài liệu
+	All pages in range	Tất cả các trang trong phạm vi
+	Allow	Cho phép
+	Allow Rich Text Formatting	Cho phép định dạng văn bản phong phú
+	Allow user to enter custom text	Cho phép người dùng nhập văn bản tùy ý
+	Also recognize pages that already have text	Nhận dạng cả các trang đã có văn bản
+	Alternate text	Văn bản thay thế
+	An action with this name already exists.	Đã có hành động với tên này.
+	An open-source PDF workbench — local, private, and scriptable.	Bộ công cụ PDF mã nguồn mở — chạy cục bộ, riêng tư và có thể viết kịch bản.
+	Angle	Góc
+	Animation effects	Hiệu ứng hoạt họa
+	Annotations, form fill-in, and digital signatures	Chú thích, điền biểu mẫu và chữ ký số
+	Any	Bất kỳ
+	Any except extracting pages	Bất kỳ trừ trích xuất trang
+	Anyone opening the document will need this password. It's applied when you save.	Bất kỳ ai mở tài liệu đều cần mật khẩu này. Mật khẩu được áp dụng khi bạn lưu.
+	Appear behind page	Hiện phía sau trang
+	Appear on top of page	Hiện phía trên trang
+	Appearance mode	Chế độ giao diện
+	Appearance settings…	Cài đặt giao diện…
+	Applies to 1 page	Áp dụng cho 1 trang
+	Applies to {n} pages	Áp dụng cho {n} trang
+	Apply redactions	Xóa vĩnh viễn nội dung đã đánh dấu
+	Apply scale	Áp dụng tỷ lệ
+	Asks GitHub for the latest release. Nothing is downloaded or installed automatically.	Hỏi GitHub về bản phát hành mới nhất. Không có gì được tải xuống hoặc cài đặt tự động.
+	At most	Tối đa
+	Attachments	Tệp đính kèm
+	Attachments Panel and Page	Bảng Tệp đính kèm và trang
+	Audit space usage…	Kiểm tra dung lượng sử dụng…
+	Author	Tác giả
+	Auto	Tự động
+	Auto follows the system's text size. Pages always render at the display's full resolution.	Chế độ Tự động theo kích thước chữ của hệ thống. Các trang luôn được hiển thị ở độ phân giải đầy đủ của màn hình.
+	Auto portrait/landscape	Tự động dọc/ngang
+	Auto-rotate pages	Tự động xoay trang
+	Auto-size text to fit redaction region	Tự động chỉnh cỡ chữ vừa vùng xóa
+	Available	Có sẵn
+	Back side only	Chỉ mặt sau
+	Back to all tools	Quay lại tất cả công cụ
+	Back to the document	Quay lại tài liệu
+	Before each selected page (select pages in Organize)	Trước mỗi trang đã chọn (chọn trang trong Sắp xếp)
+	Before the number	Trước số
+	Bicubic downsampling to	Giảm mẫu song khối (Bicubic) xuống
+	Binding	Đóng gáy
+	Binding:	Đóng gáy:
+	Black and white	Đen trắng
+	Bold	Đậm
+	Booklet	Sách nhỏ
+	Booklet subset:	Tập con sách nhỏ:
+	Bookmark options	Tùy chọn dấu trang
+	Bookmarks Panel and Page	Bảng Dấu trang và trang
+	Border Color:	Màu viền:
+	Borders and Colors	Viền và màu
+	Both sides	Cả hai mặt
+	Bottom	Dưới cùng
+	Bottom:	Dưới:
+	Box	Hộp
+	Browser's print dialog	Hộp thoại in của trình duyệt
+	Butt	Cụt
+	Button is checked by default	Nút được chọn theo mặc định
+	Buttons with the same name and value are selected in unison	Các nút có cùng tên và giá trị được chọn đồng thời
+	Bytes	Byte
+	Calibrate from two points	Hiệu chuẩn từ hai điểm
+	Can't be read: {e}	Không thể đọc: {e}
+	Cancelling…	Đang hủy…
+	Case-sensitive	Phân biệt chữ hoa/thường
+	Category:	Danh mục:
+	Center	Giữa
+	Center window on screen	Căn giữa cửa sổ trên màn hình
+	Centre	Giữa
+	Certify	Chứng nhận
+	Change settings…	Thay đổi cài đặt…
+	Change the colour of line art as well as text	Đổi màu của nét vẽ đường cũng như văn bản
+	Change {what}	Thay đổi {what}
+	Changes allowed	Các thay đổi được phép
+	Character limit 0 means no limit. A comb of characters needs a limit.	Giới hạn ký tự bằng 0 nghĩa là không giới hạn. Ô dạng lược ký tự cần có giới hạn.
+	Character spacing	Khoảng cách ký tự
+	Check Again	Kiểm tra lại
+	Check again	Kiểm tra lại
+	Check box is checked by default	Hộp kiểm được chọn theo mặc định
+	Check for updates	Kiểm tra bản cập nhật
+	Check spelling	Kiểm tra chính tả
+	Check the pages	Kiểm tra các trang
+	Check the pages of {name}: {why}	Kiểm tra các trang của {name}: {why}
+	Checking Options ({on} of 32 in all categories)	Tùy chọn kiểm tra ({on} trên 32 ở tất cả danh mục)
+	Checking for a newer version…	Đang kiểm tra phiên bản mới hơn…
+	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	Chọn ảnh PNG hoặc JPEG (tối đa 4 MiB). Độ trong suốt được giữ nguyên.
+	Choose a folder for the exported files	Chọn thư mục cho các tệp đã xuất
+	Choose a folder for the extracted pages	Chọn thư mục cho các trang đã trích xuất
+	Choose a folder for the results	Chọn thư mục cho kết quả
+	Choose a folder for the searchable files	Chọn thư mục cho các tệp có thể tìm kiếm
+	Choose a layout:	Chọn bố cục:
+	Choose a stamp, then click on the page to place it.	Chọn một con dấu, sau đó bấm vào trang để đặt.
+	Choose an image	Chọn một hình ảnh
+	Choose images	Chọn hình ảnh
+	Choose image…	Chọn hình ảnh…
+	Choose photo…	Chọn ảnh…
+	Choose the digital ID that you want to use for signing:	Chọn Digital ID mà bạn muốn dùng để ký:
+	Circle	Hình tròn
+	Clean Up	Dọn dẹp
+	Clean-up	Dọn dẹp
+	Clear All	Xóa tất cả
+	Clear all	Xóa tất cả
+	Clear selection / close find	Bỏ chọn / đóng tìm
+	Click on the page to add text; each click starts a new box, and ✓ finishes. Drag items to move them, drag a corner to resize, double-click text to edit it.	Bấm vào trang để thêm văn bản; mỗi lần bấm sẽ tạo một khung mới, và ✓ để hoàn tất. Kéo các mục để di chuyển, kéo một góc để đổi kích thước, bấm đúp vào văn bản để chỉnh sửa.
+	Click the first point to begin.	Bấm vào điểm đầu tiên để bắt đầu.
+	Click to sort, drag to move the column. Drag its edge to resize it.	Bấm để sắp xếp, kéo để di chuyển cột. Kéo cạnh cột để đổi kích thước.
+	Click vertices. Enter or double-click finishes a perimeter or area. Click the first point to close an area.	Bấm vào các đỉnh. Nhấn Enter hoặc bấm đúp để kết thúc chu vi hoặc diện tích. Bấm vào điểm đầu tiên để đóng một vùng diện tích.
+	Clockwise 90 degrees	Theo chiều kim đồng hồ 90 độ
+	Close (Esc)	Đóng (Esc)
+	Close Tab	Đóng thẻ
+	Close panel	Đóng bảng
+	Closed arrow	Mũi tên đóng
+	Collapse	Thu gọn
+	Collapse all	Thu gọn tất cả
+	Collapse all pages	Thu gọn tất cả các trang
+	Expand all pages	Mở rộng tất cả các trang
+	Collapse all bookmarks	Thu gọn tất cả dấu trang
+	Collapse tag	Thu gọn thẻ
+	Collate	Sắp theo bộ
+	Color:	Màu:
+	Colour	Màu
+	Colours are remapped while rendering; the document itself never changes.	Màu được ánh xạ lại khi hiển thị; bản thân tài liệu không bao giờ thay đổi.
+	Comb of	Dạng lược gồm
+	Combine the rest	Kết hợp phần còn lại
+	Combined {n} files	Đã kết hợp {n} tệp
+	Coming in milestone	Sẽ có ở cột mốc
+	Comment and form data	Dữ liệu bình luận và biểu mẫu
+	Commenting, filling in form fields, and signing existing signature fields	Bình luận, điền các trường biểu mẫu và ký vào các trường chữ ký có sẵn
+	Comments & Forms	Bình luận & Biểu mẫu
+	Comments only	Chỉ bình luận
+	Commit selected value immediately	Lưu giá trị đã chọn ngay lập tức
+	Common Properties	Thuộc tính chung
+	Compare Files	So sánh tệp
+	Compare this file with an older version: Compare files… in All tools.	So sánh tệp này với phiên bản cũ hơn: So sánh tệp… trong Tất cả công cụ.
+	Compatibility	Tương thích
+	Compress document structure (object streams)	Nén cấu trúc tài liệu (luồng đối tượng)
+	Compression	Nén
+	Configure New Digital ID	Cấu hình Digital ID mới
+	Confirm Password	Xác nhận mật khẩu
+	Conformance level:	Mức tuân thủ:
+	Continue	Tiếp tục
+	Copies, two-sided printing and colour are chosen in the browser's print dialog.	Số bản sao, in hai mặt và màu được chọn trong hộp thoại in của trình duyệt.
+	Copies:	Số bản sao:
+	Copy selected text	Sao chép văn bản đã chọn
+	Copy text	Sao chép văn bản
+	Couldn't check for updates: {e}	Không thể kiểm tra bản cập nhật: {e}
+	Couldn't open the printer's preferences: {e}	Không thể mở tùy chọn của máy in: {e}
+	Counterclockwise 90 degrees	Ngược chiều kim đồng hồ 90 độ
+	Country/Region	Quốc gia/Khu vực
+	Create Custom Stamp	Tạo con dấu tùy chỉnh
+	Create Link	Tạo liên kết
+	Create PDF Comment Summary	Tạo bản tóm tắt bình luận PDF
+	Create PDF comment summary…	Tạo bản tóm tắt bình luận PDF…
+	Create PDF from images	Tạo PDF từ hình ảnh
+	Create a new Digital ID (self-signed, saved to a password-protected file)	Tạo Digital ID mới (tự ký, lưu vào tệp được bảo vệ bằng mật khẩu)
+	Create accessibility report	Tạo báo cáo trợ năng
+	Create custom stamp…	Tạo con dấu tùy chỉnh…
+	Create {what}	Tạo {what}
+	Created a PDF from {n} files	Đã tạo một PDF từ {n} tệp
+	Created a PDF from {n} files; left out: {names}	Đã tạo một PDF từ {n} tệp; đã bỏ qua: {names}
+	Creates 1 file from {n} pages.	Tạo 1 tệp từ {n} trang.
+	Creates {f} files from {n} pages.	Tạo {f} tệp từ {n} trang.
+	Crop (% trimmed from each side)	Cắt xén (% bị cắt từ mỗi cạnh)
+	Currency symbol:	Ký hiệu tiền tệ:
+	Current page	Trang hiện tại
+	Current page ({n})	Trang hiện tại ({n})
+	Current page — type a page number or label (such as iv) and press Enter	Trang hiện tại — nhập số trang hoặc nhãn (như iv) rồi nhấn Enter
+	Custom	Tùy chỉnh
+	Custom scale:	Tỷ lệ tùy chỉnh:
+	Custom text:	Văn bản tùy chỉnh:
+	Custom:	Tùy chỉnh:
+	Cut and stack	Cắt và xếp chồng
+	Cut marks	Dấu cắt
+	DPI sets the printed page size without resampling the image.	DPI đặt kích thước trang in mà không lấy mẫu lại hình ảnh.
+	Dark theme	Chủ đề tối
+	Date format	Định dạng ngày
+	Decimal places:	Số chữ số thập phân:
+	Decimals	Số thập phân
+	Declared conformance: {shown}	Tuân thủ đã khai báo: {shown}
+	Decorative figure	Hình trang trí
+	Default	Mặc định
+	Default Value:	Giá trị mặc định:
+	Default workspace mode	Chế độ không gian làm việc mặc định
+	Default:	Mặc định:
+	Delete page {label}	Xóa trang {label}
+	Delete pages (Delete)	Xóa trang (Delete)
+	Delete pages after extracting	Xóa trang sau khi trích xuất
+	Delete selected pages (Organize)	Xóa các trang đã chọn (Sắp xếp)
+	Delete stamp	Xóa con dấu
+	Delete {o}	Xóa {o}
+	Describe the figure	Mô tả hình
+	Description	Mô tả
+	Description:	Mô tả:
+	Details	Chi tiết
+	Diamond	Hình thoi
+	Digital ID	Digital ID
+	Digital ID password	Mật khẩu Digital ID
+	Direction:	Hướng:
+	Discard	Loại bỏ
+	Discard Objects	Loại bỏ đối tượng
+	Discard User Data	Loại bỏ dữ liệu người dùng
+	Discard alternate images	Loại bỏ hình ảnh thay thế
+	Discard document tags	Loại bỏ thẻ tài liệu
+	Discard embedded page thumbnails	Loại bỏ hình thu nhỏ trang nhúng
+	Discard embedded print settings	Loại bỏ cài đặt in nhúng
+	Discard this text (Esc)	Loại bỏ văn bản này (Esc)
+	Dismiss	Đóng
+	Distinguished name	Tên phân biệt
+	Distribute	Phân bố
+	Document	Tài liệu
+	Document Properties	Thuộc tính tài liệu
+	Document Title	Tiêu đề tài liệu
+	Document and markups	Tài liệu và chú thích đánh dấu
+	Document and stamps	Tài liệu và con dấu
+	Document language	Ngôn ngữ tài liệu
+	Document properties ({key})	Thuộc tính tài liệu ({key})
+	Documents and view	Tài liệu và chế độ xem
+	Done	Xong
+	Done adding text	Đã thêm văn bản xong
+	Download	Tải xuống
+	Downsample to	Giảm mẫu xuống
+	Drag the selection to move it. Esc clears the selection.	Kéo vùng chọn để di chuyển. Esc để bỏ chọn.
+	Drag to reorder	Kéo để sắp xếp lại
+	Draw	Vẽ
+	Draw your {what} below.	Vẽ {what} của bạn bên dưới.
+	Drawing scale changes. Use Actual size for full-scale plans.	Tỷ lệ bản vẽ thay đổi. Dùng Kích thước thực cho các bản vẽ tỷ lệ đầy đủ.
+	Drop PDFs, images, text files or folders here, or choose them.	Thả PDF, hình ảnh, tệp văn bản hoặc thư mục vào đây, hoặc chọn chúng.
+	Duplicate "{name}" onto:	Nhân bản "{name}" sang:
+	Duplicate Field	Nhân bản trường
+	Duplicate…	Nhân bản…
+	Dynamic	Động
+	Dynamic XFA form laid out from its template: {pages}, {fields}.	Biểu mẫu XFA động được bố trí từ mẫu của nó: {pages}, {fields}.
+	Each file holds as many of the {n} pages as fit.	Mỗi tệp chứa càng nhiều trang trong số {n} trang càng tốt.
+	Each image is measured where pages draw it; an image is replaced only if the result is smaller.	Mỗi hình ảnh được đo tại nơi các trang vẽ nó; hình ảnh chỉ được thay thế nếu kết quả nhỏ hơn.
+	Each image once, named after the document and page. JPEG images are saved unchanged; others as PNG.	Mỗi hình ảnh một lần, đặt tên theo tài liệu và trang. Ảnh JPEG được lưu nguyên vẹn; các ảnh khác lưu dưới dạng PNG.
+	Earlier in tab order	Sớm hơn theo thứ tự tab
+	Edit Action	Chỉnh sửa hành động
+	Edit image	Chỉnh sửa hình ảnh
+	Edit text…	Chỉnh sửa văn bản…
+	Edit…	Chỉnh sửa…
+	Email Address	Địa chỉ email
+	Enable Acrobat JavaScript	Bật Acrobat JavaScript
+	Enable copying of text, images, and other content	Cho phép sao chép văn bản, hình ảnh và nội dung khác
+	Enable text access for screen reader devices for the visually impaired	Cho phép truy cập văn bản cho thiết bị đọc màn hình dành cho người khiếm thị
+	Encrypt	Mã hóa
+	Endpoints	Điểm cuối
+	Enhance page	Nâng cao chất lượng trang
+	Enter the password that opens it	Nhập mật khẩu để mở tài liệu
+	Enter the permissions password to allow combining	Nhập mật khẩu quyền hạn để cho phép kết hợp
+	Entire page	Toàn bộ trang
+	Even Pages Only	Chỉ các trang chẵn
+	Even and Odd Pages	Các trang chẵn và lẻ
+	Even pages only	Chỉ các trang chẵn
+	Every PDF, image and text file in the folder	Mọi tệp PDF, hình ảnh và văn bản trong thư mục
+	Every PDF, image and text file in the folder and the folders inside it	Mọi tệp PDF, hình ảnh và văn bản trong thư mục và các thư mục con của nó
+	Example: {sample}	Ví dụ: {sample}
+	Exclude images smaller than	Loại trừ hình ảnh nhỏ hơn
+	Expand	Mở rộng
+	Expand all	Mở rộng tất cả
+	Expand all bookmarks	Mở rộng tất cả dấu trang
+	Expand tag	Mở rộng thẻ
+	Expand top-level bookmarks	Mở rộng các dấu trang cấp cao nhất
+	Explain	Giải thích
+	Export All Images	Xuất tất cả hình ảnh
+	Export Value: {on}	Giá trị xuất: {on}
+	Export all to data file…	Xuất tất cả ra tệp dữ liệu…
+	Export certificate…	Xuất chứng chỉ…
+	Export comments	Xuất bình luận
+	Export form data	Xuất dữ liệu biểu mẫu
+	Export stopped: {e}	Việc xuất đã dừng: {e}
+	Export to Image	Xuất ra hình ảnh
+	Export to Text	Xuất ra văn bản
+	Exported 1 image	Đã xuất 1 hình ảnh
+	Exported the text of 1 page	Đã xuất văn bản của 1 trang
+	Exported the text of {n} pages	Đã xuất văn bản của {n} trang
+	Exported {n} images	Đã xuất {n} hình ảnh
+	Exporting… {d} of {t}	Đang xuất… {d} trên {t}
+	Export…	Xuất…
+	Extract pages as separate files	Trích xuất trang thành các tệp riêng
+	Extract pages to a new document	Trích xuất trang sang tài liệu mới
+	Extracted 1 page	Đã trích xuất 1 trang
+	Extracted {n} pages	Đã trích xuất {n} trang
+	Field is used for file selection	Trường được dùng để chọn tệp
+	Field names (comma-separated)	Tên trường (phân tách bằng dấu phẩy)
+	Field names with + - * / and parentheses; put \\ before spaces in names.	Tên trường với + - * / và dấu ngoặc đơn; đặt \\ trước dấu cách trong tên.
+
+	Field value is in range:	Giá trị trường nằm trong phạm vi:
+	Field value is not validated	Giá trị trường không được kiểm tra hợp lệ
+	Field: {field} on page {p}	Trường: {field} trên trang {p}
+	Fields to reset (comma-separated; empty: all)	Các trường cần đặt lại (phân tách bằng dấu phẩy; để trống: tất cả)
+	Figure {i} of {n}{page}	Hình {i} trên {n}{page}
+	File (.p12, .pfx)	Tệp (.p12, .pfx)
+	File Name	Tên tệp
+	File size	Kích thước tệp
+	Files are combined from top to bottom. Leave Pages empty to take every page.	Các tệp được kết hợp từ trên xuống dưới. Để trống mục Trang để lấy mọi trang.
+	Files are combined in the order shown. Drag them to change it.	Các tệp được kết hợp theo thứ tự hiển thị. Kéo chúng để thay đổi.
+	Files for {name}	Tệp cho {name}
+	Files you open in PdfCraft appear here. Drop a PDF anywhere to open it.	Các tệp bạn mở trong PdfCraft sẽ xuất hiện ở đây. Thả một PDF vào bất kỳ đâu để mở.
+	Fill & Sign dates	Ngày của Điền & Ký
+	Fill & Sign signature	Chữ ký của Điền & Ký
+	Fill Color:	Màu tô:
+	Fill colour	Màu tô
+	Fill colour: none	Màu tô: không có
+	Filling in form fields and signing existing signature fields	Điền các trường biểu mẫu và ký vào các trường chữ ký có sẵn
+	Filter comments	Lọc bình luận
+	Find a tag	Tìm một thẻ
+	Find options	Tùy chọn tìm
+	Find text	Tìm văn bản
+	Find tools and commands	Tìm công cụ và lệnh
+	Finding document fonts…	Đang tìm phông chữ của tài liệu…
+	Finish or discard the text being edited before selecting several objects.	Hãy hoàn tất hoặc loại bỏ văn bản đang chỉnh sửa trước khi chọn nhiều đối tượng.
+	First / last page	Trang đầu / cuối
+	Fit	Vừa khớp
+	Fit Height	Vừa chiều cao
+	Fit Page	Vừa trang
+	Fit Visible	Vừa vùng hiển thị
+	Fit Width	Vừa chiều rộng
+	Fit to height	Vừa chiều cao
+	Fit to page	Vừa trang
+	Fix	Sửa lỗi
+	Fixed what could be fixed; 1 problem remains	Đã sửa những gì có thể sửa; còn lại 1 vấn đề
+	Fixed what could be fixed; {n} problems remain	Đã sửa những gì có thể sửa; còn lại {n} vấn đề
+	Flatten Fill & Sign when saving	Làm phẳng Điền & Ký khi lưu
+	Flip Horizontal	Lật ngang
+	Flip Vertical	Lật dọc
+	Flip horizontal	Lật ngang
+	Flip on long edge	Lật theo cạnh dài
+	Flip on short edge	Lật theo cạnh ngắn
+	Flip vertical	Lật dọc
+	Folders	Thư mục
+	Font Size:	Cỡ chữ:
+	Font colour:	Màu chữ:
+	Font size 0 uses automatic sizing.	Cỡ chữ 0 sẽ dùng kích thước tự động.
+	Font size:	Cỡ chữ:
+	Font:	Phông chữ:
+	Font: Helvetica	Phông chữ: Helvetica
+	Fonts	Phông chữ
+	For page sizes and margins.	Dành cho kích thước trang và lề.
+	Form data and PDF forms	Dữ liệu biểu mẫu và biểu mẫu PDF
+	Form fields are flattened: their values stay visible. Saving rewrites the whole file.	Các trường biểu mẫu được làm phẳng: giá trị của chúng vẫn hiển thị. Việc lưu sẽ ghi lại toàn bộ tệp.
+	Form fields only	Chỉ các trường biểu mẫu
+	Form fill-in and digital signatures	Điền biểu mẫu và chữ ký số
+	Format	Định dạng
+	Format text	Định dạng văn bản
+	Format:	Định dạng:
+	From	Từ
+	From a PDF page or an image	Từ một trang PDF hoặc một hình ảnh
+	From colour	Từ màu
+	From {file}	Từ {file}
+	From:	Từ:
+	Front side only	Chỉ mặt trước
+	Get help, share feedback and follow development on Discord.	Nhận trợ giúp, chia sẻ phản hồi và theo dõi quá trình phát triển trên Discord.
+	Go to a page view	Đi tới một chế độ xem trang
+	Go to page {p}	Đi tới trang {p}
+	Go to the page	Đi tới trang
+	Go to this result	Đi tới kết quả này
+	Graphic	Đồ họa
+	Greyscale	Thang xám
+	Grid view	Dạng lưới
+	Hand (H)	Bàn tay (H)
+	Has JavaScript actions (run in M6)	Có các hành động JavaScript (chạy ở M6)
+	Height:	Chiều cao:
+	Hide field highlights	Ẩn tô sáng trường
+	Hide layer	Ẩn lớp
+	Hide menu bar	Ẩn thanh trình đơn
+	Hide password	Ẩn mật khẩu
+	Hide toolbars	Ẩn thanh công cụ
+	Hide window controls	Ẩn các nút điều khiển cửa sổ
+	High Resolution	Độ phân giải cao
+	High resolution	Độ phân giải cao
+	Highlight Style:	Kiểu tô sáng:
+	Highlight fields	Tô sáng các trường
+	Home	Trang chủ
+	Horizontal	Ngang
+	Horizontal reversed	Ngang đảo ngược
+	Horizontal scale	Tỷ lệ ngang
+	Icon	Biểu tượng
+	Images and text	Hình ảnh và văn bản
+	Images and text (converted to PDF)	Hình ảnh và văn bản (đã chuyển thành PDF)
+	Import list…	Nhập danh sách…
+	Includes unsaved changes	Bao gồm các thay đổi chưa lưu
+	Indent	Thụt lề
+	Initial View	Chế độ xem ban đầu
+	Ink sensitivity	Độ nhạy nét mực
+	Insert Date	Chèn ngày
+	Insert Page Number	Chèn số trang
+	Insert a blank page after the selection	Chèn một trang trống sau vùng chọn
+	Insert a file at the end	Chèn một tệp vào cuối
+	Insert a file before page {label}	Chèn một tệp trước trang {label}
+	Insert pages from a file…	Chèn trang từ một tệp…
+	Inserting, deleting, and rotating pages	Chèn, xóa và xoay trang
+	Installed fonts…	Phông chữ đã cài đặt…
+	Intersections	Giao điểm
+	Invisible Rectangle	Hình chữ nhật ẩn
+	Issued by: 	Cấp bởi: 
+	Italic	Nghiêng
+	Item List	Danh sách mục
+	Item:	Mục:
+	Items marked Ready work today.	Các mục được đánh dấu Sẵn sàng hoạt động ngay hôm nay.
+	Its security settings don't allow copying pages	Cài đặt bảo mật của nó không cho phép sao chép trang
+	JavaScript Console	Bảng điều khiển JavaScript
+	JavaScript is turned off (Preferences ▸ JavaScript).	JavaScript đã bị tắt (Tùy chọn > JavaScript).
+	JavaScript, e.g. getField("total").value	JavaScript, ví dụ getField("total").value
+	Join our Discord	Tham gia Discord của chúng tôi
+	Join the ArtCraft community	Tham gia cộng đồng ArtCraft
+	Justify	Căn đều
+	Keep source fonts	Giữ phông chữ nguồn
+	Keep tool selected	Giữ công cụ được chọn
+	Keep tool selected: on	Giữ công cụ được chọn: bật
+	Key Algorithm	Thuật toán khóa
+	Keychain  ·  	Keychain  ·  
+	Label	Nhãn
+	Labels	Nhãn
+	Labels: {preview}. Later pages keep their labels.	Nhãn: {preview}. Các trang sau giữ nhãn của chúng.
+	Landscape	Ngang
+	Landscape Pages	Trang ngang
+	Landscape and Portrait Pages	Trang ngang và dọc
+	Larger pages	Trang lớn hơn
+	Later	Để sau
+	Later in tab order	Muộn hơn theo thứ tự tab
+	Layers	Các lớp
+	Layers Panel and Page	Bảng Các lớp và trang
+	Layout and Magnification	Bố cục và độ phóng đại
+	Leave out files that can't be read?	Bỏ qua các tệp không đọc được?
+	Left	Trái
+	Left Edge	Cạnh trái
+	Left out: {names}	Đã bỏ qua: {names}
+	Left:	Trái:
+	Light theme	Chủ đề sáng
+	Limit of	Giới hạn
+	Line Style:	Kiểu đường:
+	Line Thickness:	Độ dày đường:
+	Line ending	Kiểu đầu đường
+	Line spacing	Giãn dòng
+	Line thickness	Độ dày đường
+	Link Action	Hành động liên kết
+	Link Appearance	Diện mạo liên kết
+	Link Properties	Thuộc tính liên kết
+	Link Type:	Loại liên kết:
+	List view	Dạng danh sách
+	Load font…	Tải phông chữ…
+	Locked	Đã khóa
+	Looking for PDFs…	Đang tìm PDF…
+	Looking for printers…	Đang tìm máy in…
+	Low Resolution (150 dpi)	Độ phân giải thấp (150 dpi)
+	Low resolution	Độ phân giải thấp
+	Magnification	Độ phóng đại
+	Make Current Properties Default	Đặt thuộc tính hiện tại làm mặc định
+	Make Properties Default	Đặt thuộc tính làm mặc định
+	Margins	Lề
+	Mark Page Range	Đánh dấu phạm vi trang
+	Mark as comments	Đánh dấu là bình luận
+	Mark with checkmark	Đánh dấu bằng dấu kiểm
+	Marked	Đã đánh dấu
+	Mask:	Mặt nạ:
+	Match page at 100%	Khớp trang ở mức 100%
+	Medium	Vừa
+	Midpoints	Điểm giữa
+	Mixed	Hỗn hợp
+	Modified	Đã sửa đổi
+	More options	Thêm tùy chọn
+	More options:	Thêm tùy chọn:
+	More ways to add files	Thêm cách để thêm tệp
+	Mouse wheel scroll speed	Tốc độ cuộn bánh xe chuột
+	Move down	Chuyển xuống
+	Move earlier	Chuyển lên trước
+	Move later	Chuyển ra sau
+	Move up	Chuyển lên
+	Multi-line	Nhiều dòng
+	Multiple	Nhiều
+	Multiple selection	Chọn nhiều
+	Multiple words or phrases	Nhiều từ hoặc cụm từ
+	Name:	Tên:
+	Navigation tab	Thẻ điều hướng
+	Needs manual check	Cần kiểm tra thủ công
+	Negative number style:	Kiểu số âm:
+	New Action	Hành động mới
+	New Action…	Hành động mới…
+	New bookmark ({key})	Dấu trang mới ({key})
+	New file:	Tệp mới:
+	Next ({key})	Tiếp theo ({key})
+	Next / previous match	Kết quả khớp tiếp theo / trước đó
+	Next figure	Hình tiếp theo
+	Next month	Tháng sau
+	Next page	Trang tiếp theo
+	Next sheet	Tờ tiếp theo
+	Next view	Chế độ xem tiếp theo
+	No PDFs in this folder yet	Chưa có PDF nào trong thư mục này
+	No actions	Không có hành động
+	No changes allowed	Không cho phép thay đổi
+	No changes to save	Không có thay đổi để lưu
+	No check has run yet.	Chưa chạy lần kiểm tra nào.
+	No color	Không màu
+	No colour	Không màu
+	No comments match.	Không có bình luận nào khớp.
+	No comments yet.	Chưa có bình luận.
+	No differences in the text.	Không có khác biệt trong văn bản.
+	No digital IDs yet.	Chưa có Digital ID nào.
+	No documents are open	Không có tài liệu nào đang mở
+	No file chosen	Chưa chọn tệp
+	No fill	Không tô
+	No fonts are referenced by the pages.	Không có phông chữ nào được các trang tham chiếu.
+	No issues found	Không tìm thấy vấn đề
+	No limit	Không giới hạn
+	No matches	Không có kết quả khớp
+	No matches.	Không có kết quả khớp.
+	No matching tools	Không có công cụ phù hợp
+	No openly licensed document fonts found. Load a font file.	Không tìm thấy phông chữ tài liệu có giấy phép mở. Hãy tải một tệp phông chữ.
+	No pages selected	Chưa chọn trang
+	No photo chosen	Chưa chọn ảnh
+	No preview	Không có bản xem trước
+	No problems found: the document conforms to {level}.	Không tìm thấy vấn đề: tài liệu tuân thủ {level}.
+	No security	Không có bảo mật
+	No sheets	Không có tờ
+	No signature was found in the frame. Move the frame over the signature or raise the ink sensitivity.	Không tìm thấy chữ ký trong khung. Hãy di chuyển khung lên chữ ký hoặc tăng độ nhạy nét mực.
+	No status has been set.	Chưa đặt trạng thái.
+	None (prefix only)	Không có (chỉ tiền tố)
+	None found	Không tìm thấy
+	None — everything is allowed	Không có — mọi thứ đều được phép
+	Not allowed	Không được phép
+	Not present	Không có mặt
+	Nothing to redo	Không có gì để làm lại
+	Nothing to undo	Không có gì để hoàn tác
+	Number	Số
+	Number of pages	Số trang
+	Number pages	Đánh số trang
+	Odd Pages Only	Chỉ các trang lẻ
+	Odd pages only	Chỉ các trang lẻ
+	Offset from centre	Độ lệch so với tâm
+	Old file:	Tệp cũ:
+	One word or phrase per line	Mỗi dòng một từ hoặc cụm từ
+	One {f} file per page, named after the document.	Mỗi trang một tệp {f}, đặt tên theo tài liệu.
+	Only change the colour of black text or line art	Chỉ đổi màu văn bản hoặc nét vẽ đường màu đen
+	Only checked properties will change. Mixed means the selected fields have different values.	Chỉ các thuộc tính được đánh dấu mới thay đổi. Hỗn hợp nghĩa là các trường đã chọn có giá trị khác nhau.
+	Only the page content changes: links, comments, form fields and bookmarks on the original pages stay.	Chỉ nội dung trang thay đổi: liên kết, bình luận, trường biểu mẫu và dấu trang trên các trang gốc được giữ nguyên.
+	Open	Mở
+	Open a PDF ({key})	Mở một PDF ({key})
+	Open a PDF to measure it.	Mở một PDF để đo.
+	Open a document first	Hãy mở một tài liệu trước
+	Open a web page	Mở một trang web
+	Open arrow	Mũi tên mở
+	Open email app	Mở ứng dụng email
+	Open in Full Screen mode	Mở ở chế độ toàn màn hình
+	Open in a new tab	Mở trong thẻ mới
+	Open link	Mở liên kết
+	Open the file as it was saved then	Mở tệp như khi nó được lưu lúc đó
+	Open the older version first	Hãy mở phiên bản cũ hơn trước
+	Open this web page?	Mở trang web này?
+	Open to page	Mở tại trang
+	Opened, but its security settings don't allow combining. Enter the permissions password.	Đã mở, nhưng cài đặt bảo mật của nó không cho phép kết hợp. Hãy nhập mật khẩu quyền hạn.
+	Opens the printer driver's preferences. They are saved for every print from this computer; the copies, two-sided, grayscale and paper chosen here still apply.	Mở tùy chọn của trình điều khiển máy in. Các tùy chọn này được lưu cho mọi lần in từ máy tính này; số bản sao, in hai mặt, thang xám và giấy được chọn ở đây vẫn được áp dụng.
+	Optimizing… cleaning up	Đang tối ưu hóa… dọn dẹp
+	Optimizing… image {d} of {t}	Đang tối ưu hóa… hình ảnh {d} trên {t}
+	Optimizing… merging identical objects	Đang tối ưu hóa… gộp các đối tượng giống nhau
+	Optimizing… removing user data	Đang tối ưu hóa… xóa dữ liệu người dùng
+	Optimizing… writing the copy	Đang tối ưu hóa… ghi bản sao
+	Optional: needs an AI provider you configure	Không bắt buộc: cần nhà cung cấp AI mà bạn cấu hình
+	Options…	Tùy chọn…
+	Organization Name	Tên tổ chức
+	Organizational Unit	Đơn vị tổ chức
+	Orientation:	Hướng:
+	Original	Bản gốc
+	Original: replace pages	Bản gốc: thay thế trang
+	Other colour…	Màu khác…
+	Outdent	Giảm thụt lề
+	Output	Đầu ra
+	Output appears here.	Đầu ra xuất hiện ở đây.
+	Output intent: {list}	Mục đích đầu ra: {list}
+	Overlap:	Chồng lấp:
+	Owner password (no restrictions apply)	Mật khẩu chủ sở hữu (không áp dụng hạn chế)
+	PDF Optimizer	Trình tối ưu hóa PDF
+	PDF or image	PDF hoặc hình ảnh
+	PDF page: {size}	Trang PDF: {size}
+	PDF scale: {scale}%	Tỷ lệ PDF: {scale}%
+	PDF, images and text	PDF, hình ảnh và văn bản
+	Page Only	Chỉ trang
+	Page Range Options	Tùy chọn phạm vi trang
+	Page Sizing & Handling	Định cỡ & xử lý trang
+	Page background	Nền trang
+	Page display: {layout}	Hiển thị trang: {layout}
+	Page layout	Bố cục trang
+	Page navigation	Điều hướng trang
+	Page number	Số trang
+	Page order:	Thứ tự trang:
+	Page size	Khổ trang
+	Page {label}	Trang {label}
+	Page {p} of {n}	Trang {p} trên {n}
+	Pages Panel and Page	Bảng Trang và trang
+	Pages from	Các trang từ
+	Pages of {name} to combine, e.g. 1-3, 6	Các trang của {name} cần kết hợp, ví dụ 1-3, 6
+	Pages per file	Số trang mỗi tệp
+	Pages per sheet:	Số trang mỗi tờ:
+	Pages to Print	Các trang cần in
+	Pages:	Trang:
+	Pages: {k} of {n}	Trang: {k} trên {n}
+	Paper:	Giấy:
+	Part of	Một phần của
+	Password	Mật khẩu
+	Password required	Yêu cầu mật khẩu
+	Password security	Bảo mật bằng mật khẩu
+	Password-protected	Được bảo vệ bằng mật khẩu
+	Paste after	Dán sau
+	Paths	Đường dẫn
+	Pattern	Họa tiết
+	Patterns	Họa tiết
+	Patterns (graphics objects)	Họa tiết (đối tượng đồ họa)
+	PdfCraft didn't shut down normally. These documents had changes that were autosaved:	PdfCraft không đóng bình thường. Các tài liệu này có thay đổi đã được tự động lưu:
+	PdfCraft works offline. No telemetry, no account, and no cloud processing unless you add a provider.	PdfCraft hoạt động ngoại tuyến. Không thu thập dữ liệu sử dụng, không cần tài khoản, và không xử lý đám mây trừ khi bạn thêm nhà cung cấp.
+	PdfCraft {c} is up to date.	PdfCraft {c} đã là bản mới nhất.
+	PdfCraft {v} is available.	PdfCraft {v} đã có sẵn.
+	Percentage	Phần trăm
+	Permissions password	Mật khẩu quyền hạn
+	Permitted actions after certifying	Các hành động được phép sau khi chứng nhận
+	Photo	Ảnh
+	Pick a tool in the quick bar, or type above.	Chọn một công cụ trên thanh nhanh, hoặc nhập ở phía trên.
+	Pictures on those pages are recognized too; words already in the page's text are not added again	Hình ảnh trên các trang đó cũng được nhận dạng; các từ đã có trong văn bản của trang sẽ không được thêm lại
+	Pin a folder to Home	Ghim một thư mục vào Trang chủ
+	Pin a folder to list its newest PDFs here, such as where your scanner or a synced cloud drive saves them.	Ghim một thư mục để liệt kê các PDF mới nhất của nó tại đây, chẳng hạn nơi máy quét hoặc ổ đám mây đồng bộ lưu chúng.
+	Pin a folder…	Ghim một thư mục…
+	Plain text in reading order; pages are separated by form feeds.	Văn bản thuần theo thứ tự đọc; các trang được phân tách bằng ký tự sang trang.
+	Planned	Đã lên kế hoạch
+	Planned for milestone	Dự kiến ở cột mốc
+	Points from the page's bottom-left corner.	Điểm tính từ góc dưới bên trái của trang.
+	Portrait	Dọc
+	Portrait Pages	Trang dọc
+	Post	Đăng
+	Poster	Áp phích
+	Prefix	Tiền tố
+	Preview	Xem trước
+	Preview unavailable: {e}	Không có bản xem trước: {e}
+	Preview: page {p} of {n}	Xem trước: trang {p} trên {n}
+	Previous ({key})	Trước ({key})
+	Previous / next page	Trang trước / tiếp theo
+	Previous figure	Hình trước
+	Previous month	Tháng trước
+	Previous page	Trang trước
+	Previous sheet	Tờ trước
+	Previous view	Chế độ xem trước
+	Print ({key})	In ({key})
+	Print in grayscale	In thang xám
+	Print page border	In viền trang
+	Print, NextPage, PrevPage, FirstPage or LastPage	Print, NextPage, PrevPage, FirstPage hoặc LastPage
+	Printer paper and scaling may differ. Check driver settings.	Giấy in và tỷ lệ của máy in có thể khác. Hãy kiểm tra cài đặt trình điều khiển.
+	Printer properties	Thuộc tính máy in
+	Printer:	Máy in:
+	Printing allowed	Cho phép in
+	Privacy	Quyền riêng tư
+	Properties…	Thuộc tính…
+	Protect Using Password	Bảo vệ bằng mật khẩu
+	Protected: the combined file won't keep its security settings	Đã bảo vệ: tệp kết hợp sẽ không giữ cài đặt bảo mật của chúng
+	Quality	Chất lượng
+	Read Only	Chỉ đọc
+	Reading colours	Màu khi đọc
+	Ready	Sẵn sàng
+	Reason	Lý do
+	Recent	Gần đây
+	Recent colours	Màu gần đây
+	Recognize Text	Nhận dạng văn bản
+	Recognized 1 word	Đã nhận dạng 1 từ
+	Recognized {n} words	Đã nhận dạng {n} từ
+	Recognized {w} words in 1 file	Đã nhận dạng {w} từ trong 1 tệp
+	Recognized {w} words in {n} files	Đã nhận dạng {w} từ trong {n} tệp
+	Recognizing text… file {d} of {t}	Đang nhận dạng văn bản… tệp {d} trên {t}
+	Recognizing text… page {d} of {t}	Đang nhận dạng văn bản… trang {d} trên {t}
+	Recommended tools	Công cụ được đề xuất
+	Recover	Khôi phục
+	Recover unsaved documents?	Khôi phục các tài liệu chưa lưu?
+	Redact all	Xóa tất cả nội dung đã đánh dấu
+	Redacted area fill colour:	Màu tô vùng đã xóa:
+	Redaction Tool Properties	Thuộc tính công cụ xóa nội dung nhạy cảm
+	Redaction code:	Mã xóa nội dung nhạy cảm:
+	Reload	Tải lại
+	Reload documents when their files change on disk	Tải lại tài liệu khi tệp của chúng thay đổi trên đĩa
+	Remove checkmark	Bỏ dấu kiểm
+	Remove invalid links and bookmarks	Gỡ các liên kết và dấu trang không hợp lệ
+	Remove page	Gỡ trang
+	Remove unreferenced named destinations	Gỡ các đích đến có tên không được tham chiếu
+	Remove unused objects and merge identical ones	Gỡ các đối tượng không dùng và gộp các đối tượng giống nhau
+	Remove {name}	Gỡ {name}
+	Remove {name} from Recent	Xóa {name} khỏi Gần đây
+	Remove {n} files	Gỡ {n} tệp
+	Remove {n} pages	Gỡ {n} trang
+	Reopen Closed Tab	Mở lại thẻ đã đóng
+	Reopen the files that were open when PdfCraft last closed	Mở lại các tệp đã mở khi PdfCraft đóng lần trước
+	Repair log	Nhật ký sửa chữa
+	Repeat overlay text	Lặp lại văn bản phủ
+	Replace Image…	Thay thế hình ảnh…
+	Replace Pages	Thay thế trang
+	Replace document colours	Thay thế màu của tài liệu
+	Replace image	Thay thế hình ảnh
+	Replacement text	Văn bản được thay vào
+	Replacement: pages of {name}	Thay thế: các trang của {name}
+	Replaces the existing one on those pages.	Thay thế cái hiện có trên các trang đó.
+	Report	Báo cáo
+	Report…	Báo cáo…
+	Requires user to enter a password for:	Yêu cầu người dùng nhập mật khẩu cho:
+	Reset columns	Đặt lại các cột
+	Reset page size	Đặt lại khổ trang
+	Reset to printer defaults	Đặt lại về mặc định của máy in
+	Resize window to initial page	Đổi kích thước cửa sổ theo trang ban đầu
+	Resolution	Độ phân giải
+	Retain existing	Giữ nguyên hiện có
+	Reveal in File Explorer	Hiện trong File Explorer
+	Reveal in Finder	Hiện trong Finder
+	Reverse closed arrow	Mũi tên đóng đảo ngược
+	Reverse open arrow	Mũi tên mở đảo ngược
+	Reverse pages	Đảo ngược các trang
+	Revert changes	Hoàn nguyên các thay đổi
+	Revert to the previously saved version of “{name}”? Changes since then can't be undone afterwards.	Hoàn nguyên về phiên bản đã lưu trước đó của “{name}”? Sau đó sẽ không thể hoàn tác các thay đổi kể từ lúc ấy.
+	Review History	Lịch sử duyệt
+	Revisions	Các bản sửa đổi
+	Right	Phải
+	Right Edge	Cạnh phải
+	Rotate Clockwise	Xoay theo chiều kim đồng hồ
+	Rotate Counterclockwise	Xoay ngược chiều kim đồng hồ
+	Rotate Pages	Xoay trang
+	Rotate clockwise	Xoay theo chiều kim đồng hồ
+	Rotate counterclockwise	Xoay ngược chiều kim đồng hồ
+	Rotate view	Xoay chế độ xem
+	Rotate view clockwise	Xoay chế độ xem theo chiều kim đồng hồ
+	Rotate view clockwise ({key})	Xoay chế độ xem theo chiều kim đồng hồ ({key})
+	Rotate view counterclockwise	Xoay chế độ xem ngược chiều kim đồng hồ
+	Rotate:	Xoay:
+	Rotation:	Xoay:
+	Running action… file {d} of {t}	Đang chạy hành động… tệp {d} trên {t}
+	Same as interface ({language})	Giống giao diện ({language})
+	Sanitizing removes hidden information from the document: metadata, file attachments, comments, form fields (flattened), hidden text and layers, bookmarks, links, actions and scripts, and private application data.	Làm sạch sẽ loại bỏ thông tin ẩn khỏi tài liệu: siêu dữ liệu, tệp đính kèm, bình luận, trường biểu mẫu (được làm phẳng), văn bản và lớp ẩn, dấu trang, liên kết, hành động và script, cùng dữ liệu riêng của ứng dụng.
+	Save & Close	Lưu & Đóng
+	Save ({key})	Lưu ({key})
+	Save Image As…	Lưu hình ảnh thành…
+	Copy Image	Sao chép hình ảnh
+	The image has been copied ({w} × {h} pixels)	Đã sao chép hình ảnh ({w} × {h} điểm ảnh)
+	Couldn't copy the image: {e}	Không thể sao chép hình ảnh: {e}
+	Copy Image in Original Format	Sao chép hình ảnh ở định dạng gốc
+	The image has been copied as a {ext} file	Đã sao chép hình ảnh dưới dạng tệp {ext}
+	The page has changed; select the image again	Trang đã thay đổi; hãy chọn lại hình ảnh
+	Save as PDF	Lưu dưới dạng PDF
+	Save attachment…	Lưu tệp đính kèm…
+	Save changes to “{name}” before closing?	Lưu các thay đổi của “{name}” trước khi đóng?
+	Save pages	Lưu trang
+	Save tag properties	Lưu thuộc tính thẻ
+	Save the accessibility report	Lưu báo cáo trợ năng
+	Save the document afterwards: saving rewrites the whole file so no trace of the removed content stays in it.	Hãy lưu tài liệu sau đó: việc lưu sẽ ghi lại toàn bộ tệp để không còn dấu vết nội dung đã gỡ.
+	Save the document afterwards; saving rewrites the whole file so nothing removed stays in it.	Hãy lưu tài liệu sau đó; việc lưu sẽ ghi lại toàn bộ tệp để không còn nội dung đã gỡ nào sót lại.
+	Save the spreadsheet	Lưu bảng tính
+	Save these pages as one PDF	Lưu các trang này thành một PDF
+	Saved measurements	Đã lưu các phép đo
+	Saved measurements.	Đã lưu các phép đo.
+	Scale relative to target page	Tỷ lệ so với trang đích
+	Scan	Quét
+	Script Name:	Tên script:
+	Script:	Nội dung script:
+	Scripts run in a sandbox without file or network access. A script that asks to open a web page needs your permission first. With JavaScript off, Acrobat's standard format, validate and calculate functions still work.	Script chạy trong hộp cát không có quyền truy cập tệp hoặc mạng. Script yêu cầu mở một trang web cần có sự cho phép của bạn trước. Khi tắt JavaScript, các hàm định dạng, xác thực và tính toán chuẩn của Acrobat vẫn hoạt động.
+	Scroll long text	Cuộn văn bản dài
+	Scroll tabs left	Cuộn các thẻ sang trái
+	Scroll tabs right	Cuộn các thẻ sang phải
+	Search comments	Tìm bình luận
+	Search tools and commands…	Tìm công cụ và lệnh…
+	Searchable Image (Exact)	Ảnh có thể tìm kiếm (Chính xác)
+	Searching… {s} of {p} pages	Đang tìm… {s} trên {p} trang
+	Searching… {s}/{p}	Đang tìm… {s}/{p}
+	Security	Bảo mật
+	Security settings	Cài đặt bảo mật
+	Select (V)	Chọn (V)
+	Select Action:	Chọn hành động:
+	Select All	Chọn tất cả
+	Select Icon	Chọn biểu tượng
+	Select Trigger:	Chọn trình kích hoạt:
+	Select a file first	Hãy chọn một tệp trước
+	Select a file for the stamp	Chọn một tệp cho con dấu
+	Select a password-protected file first	Hãy chọn một tệp được bảo vệ bằng mật khẩu trước
+	Select a word	Chọn một từ
+	Select all pages (Organize)	Chọn tất cả trang (Sắp xếp)
+	Select at most 1000 objects at a time.	Chọn tối đa 1000 đối tượng mỗi lần.
+	Select data files to merge	Chọn các tệp dữ liệu cần gộp
+	Select format category:	Chọn danh mục định dạng:
+	Select page {label}	Chọn trang {label}
+	Select pages	Chọn trang
+	Select the items to remove from this document.	Chọn các mục cần gỡ khỏi tài liệu này.
+	Selected image files: {count}	Tệp hình ảnh đã chọn: {count}
+	Selected pages	Các trang đã chọn
+	Selection	Vùng chọn
+	Sending to {printer}…	Đang gửi đến {printer}…
+	Sending sheet {s} of {n} to {printer}…	Đang gửi tờ {s}/{n} đến {printer}…
+	Sensitivity	Độ nhạy
+	Sent to {printer}	Đã gửi đến {printer}
+	Sent to {printer}: {msg}	Đã gửi đến {printer}: {msg}
+	Separator style:	Kiểu dấu phân cách:
+	Set Alternate Text	Đặt văn bản thay thế
+	Set Fields to Same Size	Đặt các trường về cùng kích thước
+	Set Page Boxes	Đặt các hộp trang
+	Set layer visibility	Đặt chế độ hiển thị lớp
+	Set status	Đặt trạng thái
+	Set to current page ({n})	Đặt thành trang hiện tại ({n})
+	Set to zero	Đặt về 0
+	Shared Field Properties	Thuộc tính trường dùng chung
+	Sheet {s} of {n}	Tờ {s} trên {n}
+	Shift constrains to 45 degrees. Backspace removes a vertex. Escape cancels.	Shift giới hạn ở góc 45 độ. Backspace xóa một đỉnh. Escape để hủy.
+	Shift- or Ctrl/Command-click to select several fields.	Nhấn Shift hoặc Ctrl/Command khi bấm để chọn nhiều trường.
+	Shift-click to select several objects. Drag empty space to select an area.	Nhấn Shift khi bấm để chọn nhiều đối tượng. Kéo vùng trống để chọn một khu vực.
+	Show Report	Hiện báo cáo
+	Show all	Hiện tất cả
+	Show all comments	Hiện tất cả bình luận
+	Show certificate…	Hiện chứng chỉ…
+	Show layer	Hiện lớp
+	Show less	Hiện ít hơn
+	Show password	Hiện mật khẩu
+	Show the accessibility report	Hiện báo cáo trợ năng
+	Show this dialog when the Checker starts	Hiện hộp thoại này khi Trình kiểm tra khởi động
+	Show {n} more	Hiện thêm {n}
+	Show:	Hiện:
+	Shrink oversized pages	Thu nhỏ các trang quá khổ
+	Sign Here	Ký tại đây
+	Sign this field…	Ký vào trường này…
+	Sign yourself	Tự ký
+	Signature Details	Chi tiết chữ ký
+	Signature is INVALID:	Chữ ký KHÔNG HỢP LỆ:
+	Signature is valid:	Chữ ký hợp lệ:
+	Signature panel	Bảng chữ ký
+	Signature validity is UNKNOWN:	Tính hợp lệ của chữ ký KHÔNG RÕ:
+	Signer's name	Tên người ký
+	Simplified field notation:	Ký hiệu trường rút gọn:
+	Single Page	Một trang
+	Single Page Continuous	Một trang liên tục
+	Single word or phrase	Một từ hoặc cụm từ
+	Skip Rule	Bỏ qua quy tắc
+	Skipped	Đã bỏ qua
+	Slash	Dấu gạch chéo
+	Smaller pages	Trang nhỏ hơn
+	Snap to drawing	Bắt dính vào bản vẽ
+	Some bookmarks are not shown here: the panel lists a limited number, nested a limited depth.	Một số dấu trang không được hiển thị ở đây: bảng chỉ liệt kê một số lượng giới hạn, lồng ở độ sâu giới hạn.
+	Some page content couldn't be read; snapping uses the rest.	Một số nội dung trang không đọc được; việc bắt dính dùng phần còn lại.
+	Sort by	Sắp xếp theo
+	Sort comments by:	Sắp xếp bình luận theo:
+	Sort items	Sắp xếp các mục
+	Source	Nguồn
+	Space Audit	Kiểm tra dung lượng
+	Special	Đặc biệt
+	Split document	Tách tài liệu
+	Split into files…	Tách thành các tệp…
+	Square	Hình vuông
+	Standard Business	Standard Business
+	Start	Bắt đầu
+	Start Checking	Bắt đầu kiểm tra
+	Start page number	Số trang bắt đầu
+	Status	Trạng thái
+	Steps	Các bước
+	Strength: {s}	Độ mạnh: {s}
+	Style	Kiểu
+	Subject	Chủ đề
+	Subset	Tập con
+	Summarize Options	Tùy chọn tóm tắt
+	Summary	Tóm tắt
+	Switch to List view to change the pages it takes.	Chuyển sang dạng danh sách để thay đổi các trang mà nó lấy.
+	Switch to two-page view first to show the cover page	Hãy chuyển sang chế độ hai trang trước để hiển thị trang bìa
+	Tab order: move a field with its arrows.	Thứ tự tab: di chuyển một trường bằng các mũi tên của nó.
+	Tag type	Loại thẻ
+	Tags	Thẻ
+	Text Color:	Màu văn bản:
+	Text alignment:	Căn chỉnh văn bản:
+	Text in images isn't found; recognise text (OCR) first.	Văn bản trong hình ảnh không được tìm thấy; hãy nhận dạng văn bản (OCR) trước.
+	Text is compared word by word; the differences are shown on the new file.	Văn bản được so sánh từng từ; các khác biệt được hiển thị trên tệp mới.
+	Text recognition isn't installed: its model files are missing. Reinstall PdfCraft, or set PDFCRAFT_MODELS to the folder that holds them.	Tính năng nhận dạng văn bản chưa được cài đặt: thiếu các tệp mô hình. Hãy cài đặt lại PdfCraft, hoặc đặt PDFCRAFT_MODELS thành thư mục chứa chúng.
+	Text to find	Văn bản cần tìm
+	Text to insert	Văn bản cần chèn
+	Text used as a clipping path cannot be moved with this selection.	Văn bản dùng làm đường cắt xén không thể di chuyển cùng vùng chọn này.
+	Text, marks and signatures become part of the page. Other comments stay editable.	Văn bản, dấu và chữ ký trở thành một phần của trang. Các bình luận khác vẫn có thể chỉnh sửa.
+	Thai and Arabic use regular fallback fonts when available.	Tiếng Thái và tiếng Ả Rập dùng phông chữ dự phòng thông thường khi có.
+	The PDF text fonts can't draw “{c}” ({code}). Choose supported text.	Phông chữ văn bản PDF không thể vẽ “{c}” ({code}). Hãy chọn văn bản được hỗ trợ.
+	The checker found 1 problem which may prevent the document from being fully accessible.	Trình kiểm tra tìm thấy 1 vấn đề có thể khiến tài liệu không thể tiếp cận đầy đủ.
+	The checker found no problems in this document.	Trình kiểm tra không tìm thấy vấn đề nào trong tài liệu này.
+	The checker found {n} problems which may prevent the document from being fully accessible.	Trình kiểm tra tìm thấy {n} vấn đề có thể khiến tài liệu không thể tiếp cận đầy đủ.
+	The document now conforms to {level}; save it to keep the changes	Tài liệu hiện tuân thủ {level}; hãy lưu để giữ các thay đổi
+	The document opens without a password; this password is needed to change the restrictions. It's applied when you save.	Tài liệu mở không cần mật khẩu; mật khẩu này cần để thay đổi các hạn chế. Mật khẩu được áp dụng khi bạn lưu.
+	The document's security settings don't allow copying text and images	Cài đặt bảo mật của tài liệu không cho phép sao chép văn bản và hình ảnh
+	The document's security settings don't allow this change	Cài đặt bảo mật của tài liệu không cho phép thay đổi này
+	The existing action will be preserved.	Hành động hiện có sẽ được giữ nguyên.
+	The fonts PdfCraft writes with can't draw “{c}” ({code}), so it shows as ? in every PDF viewer. The text is saved.	Phông chữ mà PdfCraft dùng để ghi không thể vẽ “{c}” ({code}), nên nó hiển thị là ? trong mọi trình xem PDF. Văn bản vẫn được lưu.
+	The key is in the Windows certificate store, which may ask to allow PdfCraft to use it.	Khóa nằm trong kho chứng chỉ Windows, nơi có thể yêu cầu cho phép PdfCraft sử dụng nó.
+	The key is in the macOS Keychain, which may ask to allow PdfCraft to use it.	Khóa nằm trong macOS Keychain, nơi có thể yêu cầu cho phép PdfCraft sử dụng nó.
+	The newest {n} of {total} PDFs	{n} PDF mới nhất trong tổng số {total}
+	The password is only used to read the file; it isn't saved.	Mật khẩu chỉ được dùng để đọc tệp; nó không được lưu.
+	The printer driver's own settings for this print: paper tray, paper type, finishing and more.	Cài đặt riêng của trình điều khiển máy in cho lần in này: khay giấy, loại giấy, hoàn thiện và nhiều hơn nữa.
+	The replacement file doesn't have that many pages.	Tệp thay thế không có nhiều trang như vậy.
+	The same password is tried on each file.	Cùng một mật khẩu được thử trên từng tệp.
+	The signature will be invisible.	Chữ ký sẽ không hiển thị.
+	The text is the same	Văn bản giống nhau
+	The value is shown as typed.	Giá trị được hiển thị như đã nhập.
+	There are no redaction marks (mark text, areas or pages first)	Không có dấu đánh dấu xóa nào (hãy đánh dấu văn bản, vùng hoặc trang trước)
+	These files can't be read, so they won't be in the combined PDF:	Không đọc được các tệp này, nên chúng sẽ không có trong PDF kết hợp:
+	These objects could not be moved. Select them again and try a smaller move.	Không thể di chuyển các đối tượng này. Hãy chọn lại chúng và thử di chuyển ít hơn.
+	Thick	Dày
+	Thickness	Độ dày
+	Thin	Mỏng
+	This area has too many overlapping paths; intersection snapping is limited.	Vùng này có quá nhiều đường chồng lên nhau; việc bắt dính giao điểm bị giới hạn.
+	This certificate is in your list of trusted certificates.	Chứng chỉ này nằm trong danh sách chứng chỉ tin cậy của bạn.
+	This certificate is not trusted. Signatures made with it show an unknown identity.	Chứng chỉ này không được tin cậy. Các chữ ký tạo bằng nó hiển thị danh tính không rõ.
+	This certificate is trusted through a certificate above it in the chain.	Chứng chỉ này được tin cậy thông qua một chứng chỉ ở cấp trên trong chuỗi.
+	This comment's appearance can't be changed yet.	Chưa thể thay đổi diện mạo của bình luận này.
+	This dialog shows the details of a certificate and its chain.	Hộp thoại này hiển thị chi tiết của một chứng chỉ và chuỗi chứng chỉ của nó.
+	This document contains {n} interactive form fields.	Tài liệu này chứa {n} trường biểu mẫu tương tác.
+	This document has no comments to flatten	Tài liệu này không có bình luận nào để làm phẳng
+	This document has no document-level scripts.	Tài liệu này không có script cấp tài liệu.
+	This document has no editable structure tags.	Tài liệu này không có thẻ cấu trúc có thể chỉnh sửa.
+	This document has no form fields to flatten	Tài liệu này không có trường biểu mẫu nào để làm phẳng
+	This document has no form fields you can fill in	Tài liệu này không có trường biểu mẫu nào bạn có thể điền
+	This document has no pages.	Tài liệu này không có trang nào.
+	This document has no restrictions to lift	Tài liệu này không có hạn chế nào để gỡ bỏ
+	This document has no signatures.	Tài liệu này không có chữ ký.
+	This document has no tagged figures.	Tài liệu này không có hình nào được gắn thẻ.
+	This document has no {kind} to change	Tài liệu này không có {kind} để thay đổi
+	This document hasn't been checked yet.	Tài liệu này chưa được kiểm tra.
+	This document is secured. Some changes are restricted by its security settings.	Tài liệu này được bảo mật. Một số thay đổi bị hạn chế bởi cài đặt bảo mật của nó.
+	This document isn't password-protected	Tài liệu này không được bảo vệ bằng mật khẩu
+	This drawing exceeds the snapping limit; only the first paths are used.	Bản vẽ này vượt quá giới hạn bắt dính; chỉ các đường đầu tiên được sử dụng.
+	This field is locked. Unlock it to change its properties.	Trường này đã bị khóa. Hãy mở khóa để thay đổi thuộc tính của nó.
+	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	Tệp này đã thay đổi trên đĩa. Hãy tải lại để xem phiên bản mới; các thay đổi chưa lưu của bạn sẽ bị mất.
+	This file was damaged and has been repaired. Saving keeps the repaired version.	Tệp này bị hỏng và đã được sửa chữa. Việc lưu sẽ giữ phiên bản đã sửa.
+	This folder isn't available right now. It may have moved, or its drive or cloud sync is offline.	Thư mục này hiện không khả dụng. Nó có thể đã bị di chuyển, hoặc ổ đĩa hay đồng bộ đám mây của nó đang ngoại tuyến.
+	This form's scripts are turned off because one ran too long. Reopen the document to run them again.	Các script của biểu mẫu này đã bị tắt vì một script chạy quá lâu. Hãy mở lại tài liệu để chạy chúng lại.
+	This is a dynamic XFA form, which PdfCraft can't display yet. What you see is the file's placeholder page.	Đây là biểu mẫu XFA động, mà PdfCraft chưa thể hiển thị. Những gì bạn thấy là trang giữ chỗ của tệp.
+	This measurement needs at least {n} points.	Phép đo này cần ít nhất {n} điểm.
+	This page contains objects that cannot be selected together.	Trang này chứa các đối tượng không thể chọn cùng nhau.
+	This page couldn't be displayed.\n{e}	Không thể hiển thị trang này.\n{e}
+	This printer offers no settings of its own.	Máy in này không có cài đặt riêng.
+	This printer's driver doesn't take two-sided settings from other programs, so its own setting applies. Change it in Properties…	Trình điều khiển của máy in này không nhận cài đặt in hai mặt từ các chương trình khác, nên cài đặt riêng của nó được áp dụng. Hãy thay đổi trong Thuộc tính…
+	This web address mixes letters from different alphabets, a common way to imitate another site's name.	Địa chỉ web này trộn lẫn các chữ cái từ nhiều bảng chữ cái khác nhau, một cách phổ biến để giả mạo tên của trang khác.
+	This web address uses letters from another alphabet, which can look like familiar ones.	Địa chỉ web này dùng chữ cái từ một bảng chữ cái khác, có thể trông giống các chữ quen thuộc.
+	Tile scale:	Tỷ lệ lát:
+	Time	Thời gian
+	Title	Tiêu đề
+	To change locked fields, also set Locked to No.	Để thay đổi các trường đã khóa, hãy đặt thêm Đã khóa thành Không.
+	To:	Đến:
+	Today: {date}	Hôm nay: {date}
+	Toggle fit page / fit width	Chuyển đổi vừa trang / vừa chiều rộng
+	Tool	Công cụ
+	Tools panel side	Phía của bảng công cụ
+	Tooltip:	Chú giải công cụ:
+	Top	Trên
+	Top-level bookmarks ({n})	Dấu trang cấp cao nhất ({n})
+	Total	Tổng
+	Trust	Tin cậy
+	Try the form as people filling it in will see it	Dùng thử biểu mẫu như người điền sẽ thấy
+	Two-Up (Cover Page)	Hai trang (Có trang bìa)
+	Two-Up (Facing)	Hai trang (Đối diện)
+	Two-Up Continuous (Cover Page)	Hai trang liên tục (Có trang bìa)
+	Two-Up Continuous (Facing)	Hai trang liên tục (Đối diện)
+	Two-sided:	Hai mặt:
+	Type	Loại
+	Type text	Nhập văn bản
+	Type the web address.	Nhập địa chỉ web.
+	Type your {what}.	Nhập {what} của bạn.
+	URL to submit to	URL để gửi đến
+	Unit	Đơn vị
+	Units	Đơn vị
+	Unknown author	Tác giả không rõ
+	Unlock	Mở khóa
+	Unlock {name}	Mở khóa {name}
+	Unlock {n} files	Mở khóa {n} tệp
+	Unlocked: the combined file won't be password-protected	Đã mở khóa: tệp kết hợp sẽ không được bảo vệ bằng mật khẩu
+	Unlock…	Mở khóa…
+	Unpin	Bỏ ghim
+	Unpin {folder}	Bỏ ghim {folder}
+	Unplaced	Chưa đặt
+	Unsupported measurements	Các phép đo không được hỗ trợ
+	Up	Lên
+	Update	Cập nhật
+	Use 72 DPI (one point per pixel)	Dùng 72 DPI (một điểm cho mỗi điểm ảnh)
+	Use Flate to encode streams that are not encoded	Dùng Flate để mã hóa các luồng chưa được mã hóa
+	Use a Digital ID from a file	Dùng Digital ID từ một tệp
+	Use custom DPI	Dùng DPI tùy chỉnh
+	Use each image's embedded DPI; use 72 DPI when it is absent.	Dùng DPI nhúng của từng hình ảnh; dùng 72 DPI khi không có.
+	Use image resolution	Dùng độ phân giải hình ảnh
+	Use now	Dùng ngay
+	Use overlay text	Dùng văn bản phủ
+	Used when a PDF doesn't ask for a layout or zoom. Continuous scrolling never snaps between pages.	Được dùng khi PDF không yêu cầu bố cục hoặc mức thu phóng. Cuộn liên tục không bao giờ bắt dính giữa các trang.
+	Used when opening PDFs. An explicit launch or control mode takes precedence for the session.	Được dùng khi mở PDF. Chế độ khởi chạy hoặc điều khiển chỉ định rõ sẽ được ưu tiên trong phiên làm việc.
+	User Interface Options	Tùy chọn giao diện người dùng
+	User password	Mật khẩu người dùng
+	Valid for 5 years, for digital signatures. Self-signed IDs are usually not trusted by others.	Có hiệu lực trong 5 năm, dùng cho chữ ký số. Các ID tự ký thường không được người khác tin cậy.
+	Validate all	Xác thực tất cả
+	Value is not calculated	Giá trị không được tính toán
+	Value is the	Giá trị là
+	Value:	Giá trị:
+	Verify	Xác minh
+	Verify to see what the document needs.	Hãy xác minh để biết tài liệu cần gì.
+	Version {v}	Phiên bản {v}
+	Vertical	Dọc
+	Vertical reversed	Dọc đảo ngược
+	Vertical text cannot be moved with this selection.	Văn bản dọc không thể di chuyển cùng vùng chọn này.
+	View revision {n}	Xem bản sửa đổi {n}
+	View signed version	Xem phiên bản đã ký
+	Viewport	Khung nhìn
+	Viewport rectangle in page points (x, y, width, height)	Hình chữ nhật khung nhìn theo điểm trang (x, y, chiều rộng, chiều cao)
+	Visible Rectangle	Hình chữ nhật hiển thị
+	Visual	Trực quan
+	Warnings	Cảnh báo
+	Welcome to PdfCraft	Chào mừng đến với PdfCraft
+	What word or phrase would you like to search for?	Bạn muốn tìm từ hoặc cụm từ nào?
+	Whole words only	Chỉ khớp toàn bộ từ
+	Width:	Chiều rộng:
+	Window Options	Tùy chọn cửa sổ
+	Windows store  ·  	Kho Windows  ·  
+	Write this email?	Soạn email này?
+	Wrong password	Sai mật khẩu
+	XFA form: its fields and its XFA data are kept in step, so other viewers show what you fill in.	Biểu mẫu XFA: các trường và dữ liệu XFA của nó được giữ đồng bộ, nên các trình xem khác hiển thị những gì bạn điền.
+	You are about to apply 1 redaction mark. Text, images and drawings under the marks, and comments and form fields that overlap them, are removed permanently.	Bạn sắp áp dụng 1 dấu xóa. Văn bản, hình ảnh và bản vẽ nằm dưới các dấu, cũng như bình luận và trường biểu mẫu chồng lên chúng, sẽ bị xóa vĩnh viễn.
+	You are about to apply {n} redaction marks. Text, images and drawings under the marks, and comments and form fields that overlap them, are removed permanently.	Bạn sắp áp dụng {n} dấu xóa. Văn bản, hình ảnh và bản vẽ nằm dưới các dấu, cũng như bình luận và trường biểu mẫu chồng lên chúng, sẽ bị xóa vĩnh viễn.
+	You have version {c}. All releases are listed at {page}.	Bạn đang dùng phiên bản {c}. Tất cả các bản phát hành được liệt kê tại {page}.
+	You have version {c}. Download the new version from its release page.	Bạn đang dùng phiên bản {c}. Hãy tải phiên bản mới từ trang phát hành của nó.
+	Your changes will be lost if you don't save them.	Các thay đổi của bạn sẽ bị mất nếu bạn không lưu.
+	ZIP	ZIP
+	Zoom in	Phóng to
+	Zoom in ({key})	Phóng to ({key})
+	Zoom in / out (also pinch or {key}-scroll)	Phóng to / thu nhỏ (cũng có thể chụm ngón tay hoặc {key}-cuộn)
+	Zoom out	Thu nhỏ
+	Zoom out ({key})	Thu nhỏ ({key})
+	already a PDF	đã là PDF
+	and {n} more	và {n} mục nữa
+	background	nền
+	characters	ký tự
+	e.g. My stamps	ví dụ: Con dấu của tôi
+	e.g. en-US	ví dụ: en-US
+	for images above	cho hình ảnh lớn hơn
+	header or footer	đầu trang hoặc chân trang
+	initials	chữ viết tắt
+	is available	có sẵn
+	is not available yet	chưa có sẵn
+	just now	vừa xong
+	yesterday	hôm qua
+	needs an AI provider (off by default)	cần nhà cung cấp AI (mặc định tắt)
+	no output folder was chosen	chưa chọn thư mục đầu ra
+	no unused output name	không có tên đầu ra chưa dùng
+	none	không có
+	of the following fields:	trong các trường sau:
+	AI assistant	Trợ lý AI
+	Action Wizard	Trình hướng dẫn hành động
+	Action Wizard…	Trình hướng dẫn hành động…
+	Actions list	Danh sách hành động
+	Add Bates numbering…	Thêm đánh số Bates…
+	Add a button	Thêm một nút
+	Add a callout	Thêm một khung chú thích
+	Add a checkbox	Thêm một hộp kiểm
+	Add a date field	Thêm một trường ngày
+	Add a digital signature field	Thêm một trường chữ ký số
+	Add a drop-down list	Thêm một danh sách thả xuống
+	Add a list box	Thêm một hộp danh sách
+	Add a radio button	Thêm một nút radio
+	Add a stamp	Thêm một con dấu
+	Add a sticky note	Thêm một ghi chú dán
+	Add a text box	Thêm một khung văn bản
+	Add a text field	Thêm một trường văn bản
+	Add alternate text	Thêm văn bản thay thế
+	Add alternate text…	Thêm văn bản thay thế…
+	Add an image field	Thêm một trường hình ảnh
+	Add background…	Thêm nền…
+	Add comments	Thêm bình luận
+	Add content	Thêm nội dung
+	Add files to combine	Thêm tệp để kết hợp
+	Add form components	Thêm thành phần biểu mẫu
+	Add header & footer…	Thêm đầu trang & chân trang…
+	Add image…	Thêm hình ảnh…
+	Add or edit links	Thêm hoặc chỉnh sửa liên kết
+	Add printer marks	Thêm dấu máy in
+	Add search index	Thêm chỉ mục tìm kiếm
+	Add text	Thêm văn bản
+	Add watermark…	Thêm hình mờ…
+	Advanced optimization	Tối ưu hóa nâng cao
+	Advanced options	Tùy chọn nâng cao
+	Apply PDF standards	Áp dụng chuẩn PDF
+	Apply redactions…	Xóa vĩnh viễn nội dung đã đánh dấu…
+	Archive documents	Lưu trữ tài liệu
+	Area	Diện tích
+	Arrow	Mũi tên
+	ArtCraft website	Trang web ArtCraft
+	Ask about this document	Hỏi về tài liệu này
+	Attach a file	Đính kèm một tệp
+	Attach file	Đính kèm tệp
+	Audit space usage	Kiểm tra dung lượng sử dụng
+	Automatically tag PDF	Tự động gắn thẻ PDF
+	Background	Nền
+	Bates numbering	Đánh số Bates
+	Blank page	Trang trống
+	Bring your own model (off by default)	Dùng mô hình của riêng bạn (mặc định tắt)
+	Button	Nút
+	Certificates	Chứng chỉ
+	Certify (invisible signature)	Chứng nhận (chữ ký ẩn)
+	Certify (visible signature)	Chứng nhận (chữ ký hiển thị)
+	Change initials	Đổi chữ viết tắt
+	Change reading options	Thay đổi tùy chọn đọc
+	Change reading options…	Thay đổi tùy chọn đọc…
+	Change signature	Đổi chữ ký
+	Check for accessibility	Kiểm tra trợ năng
+	Check for accessibility…	Kiểm tra trợ năng…
+	Checkbox	Hộp kiểm
+	Checkmark	Dấu kiểm
+	Clear form	Xóa dữ liệu biểu mẫu
+	Clear redaction marks	Xóa các dấu đánh dấu
+	Clipboard	Bảng tạm
+	Cloud	Đám mây
+	Column select	Chọn cột
+	Combine	Kết hợp
+	Combine files	Kết hợp tệp
+	Comment list	Danh sách bình luận
+	Comments panel	Bảng bình luận
+	Compare	So sánh
+	Compare files	So sánh tệp
+	Compare files…	So sánh tệp…
+	Compress a PDF	Nén một PDF
+	Console	Bảng điều khiển
+	Convert colors	Chuyển đổi màu
+	Copy pages	Sao chép trang
+	Correct recognized text	Sửa văn bản đã nhận dạng
+	Create a PDF	Tạo một PDF
+	Create from	Tạo từ
+	Create links from URLs	Tạo liên kết từ URL
+	Crop pages	Cắt xén trang
+	Cross	Dấu chéo
+	Cut pages	Cắt trang
+	Dark gray	Xám đậm
+	Date	Ngày
+	Date field	Trường ngày
+	Detect form fields	Phát hiện trường biểu mẫu
+	Digital signature	Chữ ký số
+	Digitally sign	Ký số
+	Distance	Khoảng cách
+	Document JavaScripts	JavaScript của tài liệu
+	Document JavaScripts…	JavaScript của tài liệu…
+	Document actions	Hành động của tài liệu
+	Dot	Dấu chấm
+	Draw a cloud	Vẽ một đám mây
+	Draw a line	Vẽ một đường thẳng
+	Draw a polygon	Vẽ một đa giác
+	Draw a rectangle	Vẽ một hình chữ nhật
+	Draw an arrow	Vẽ một mũi tên
+	Draw an oval	Vẽ một hình bầu dục
+	Draw connected lines	Vẽ các đường nối liền
+	Draw freehand	Vẽ tự do
+	Drawing	Bản vẽ
+	Drawing scale	Tỷ lệ bản vẽ
+	Drop-down list	Danh sách thả xuống
+	Duplicate pages	Nhân bản trang
+	Edit a PDF	Chỉnh sửa một PDF
+	Edit text & images	Chỉnh sửa văn bản & hình ảnh
+	Encrypt with certificate	Mã hóa bằng chứng chỉ
+	Enhance camera image	Nâng cao chất lượng ảnh chụp từ máy ảnh
+	Enhance scanned file	Nâng cao chất lượng tệp quét
+	Enter permissions password…	Nhập mật khẩu quyền hạn…
+	Erase drawings	Xóa bản vẽ
+	Export a PDF	Xuất một PDF
+	Export all comments to data file…	Xuất tất cả bình luận ra tệp dữ liệu…
+	Export all images	Xuất tất cả hình ảnh
+	Export all images…	Xuất tất cả hình ảnh…
+	Export data	Xuất dữ liệu
+	Export form data…	Xuất dữ liệu biểu mẫu…
+	Export measurements	Xuất các phép đo
+	Export measurements as CSV	Xuất các phép đo dưới dạng CSV
+	Export to	Xuất ra
+	Export to PowerPoint…	Xuất ra PowerPoint…
+	Extract	Trích xuất
+	Extract pages	Trích xuất trang
+	Field list	Danh sách trường
+	Field properties	Thuộc tính trường
+	Field properties…	Thuộc tính trường…
+	Fields	Các trường
+	Fill	Điền
+	Fill & Sign: add text	Điền & Ký: thêm văn bản
+	Fill & Sign: change initials	Điền & Ký: đổi chữ viết tắt
+	Fill & Sign: change signature	Điền & Ký: đổi chữ ký
+	Fill & Sign: checkmark	Điền & Ký: dấu kiểm
+	Fill & Sign: cross	Điền & Ký: dấu chéo
+	Fill & Sign: date	Điền & Ký: ngày
+	Fill & Sign: dot	Điền & Ký: dấu chấm
+	Fill & Sign: initials	Điền & Ký: chữ viết tắt
+	Fill & Sign: line	Điền & Ký: đường thẳng
+	Fill & Sign: remove saved initials	Điền & Ký: xóa chữ viết tắt đã lưu
+	Fill & Sign: remove saved signature	Điền & Ký: xóa chữ ký đã lưu
+	Fill & Sign: sign	Điền & Ký: ký
+	Find text and redact	Tìm văn bản và đánh dấu xóa
+	Find text and redact…	Tìm văn bản và đánh dấu xóa…
+	Fit to width scrolling	Cuộn vừa chiều rộng
+	Fit visible	Vừa vùng hiển thị
+	Fix hairlines	Sửa các đường siêu mảnh
+	Fix reading order	Sửa thứ tự đọc
+	Flatten comments	Làm phẳng bình luận
+	Flatten form fields	Làm phẳng trường biểu mẫu
+	Form fields panel	Bảng trường biểu mẫu
+	Geospatial location	Vị trí địa lý
+	Go to page…	Đi tới trang…
+	HTML web page	Trang web HTML
+	Header and footer	Đầu trang và chân trang
+	Hide all comments	Ẩn tất cả bình luận
+	Highlight text	Tô sáng văn bản
+	Image	Hình ảnh
+	Image (PNG)	Hình ảnh (PNG)
+	Image field	Trường hình ảnh
+	Images	Hình ảnh
+	Import comments…	Nhập bình luận…
+	Import data	Nhập dữ liệu
+	Import form data…	Nhập dữ liệu biểu mẫu…
+	In multiple files	Trong nhiều tệp
+	In this file	Trong tệp này
+	Index	Chỉ mục
+	Initials	Chữ viết tắt
+	Insert	Chèn
+	Insert pages	Chèn trang
+	Insert text	Chèn văn bản
+	JavaScript	JavaScript
+	JavaScript console…	Bảng điều khiển JavaScript…
+	Join the ArtCraft Discord	Tham gia Discord của ArtCraft
+	Light gray	Xám nhạt
+	Line	Đường thẳng
+	Link	Liên kết
+	List box	Hộp danh sách
+	Make accessible	Cải thiện khả năng tiếp cận
+	Manage embedded index	Quản lý chỉ mục nhúng
+	Markup	Chú thích đánh dấu
+	Marquee zoom	Thu phóng theo vùng chọn
+	Measure area	Đo diện tích
+	Measure distance	Đo khoảng cách
+	Measure objects	Đo đối tượng
+	Measure perimeter	Đo chu vi
+	Measurement information	Thông tin phép đo
+	Measurement snapping	Bắt dính phép đo
+	Merge data files into spreadsheet…	Gộp các tệp dữ liệu vào bảng tính…
+	Microsoft Word (.docx)	Microsoft Word (.docx)
+	Modify page	Sửa đổi trang
+	Multiple files	Nhiều tệp
+	New bookmarks from structure	Dấu trang mới từ cấu trúc
+	Open accessibility report	Mở báo cáo trợ năng
+	Optimize scanned documents	Tối ưu hóa tài liệu quét
+	Optimize scanned documents…	Tối ưu hóa tài liệu quét…
+	Output preview	Xem trước đầu ra
+	Oval	Hình bầu dục
+	PDF/A…	PDF/A…
+	Page grid	Lưới trang
+	Page labels	Nhãn trang
+	Page options	Tùy chọn trang
+	Page transitions	Hiệu ứng chuyển trang
+	Paste pages	Dán trang
+	PdfCraft on GitHub	PdfCraft trên GitHub
+	PdfCraft web page	Trang web PdfCraft
+	Perimeter	Chu vi
+	Pin folder to Home…	Ghim thư mục vào Trang chủ…
+	PostScript / EPS	PostScript / EPS
+	Preflight	Kiểm tra trước in
+	Prepare for accessibility	Chuẩn bị cho trợ năng
+	Prepare for distribution	Chuẩn bị để phân phối
+	Prepare for distribution…	Chuẩn bị để phân phối…
+	Presentation (.pptx)	Bản trình bày (.pptx)
+	Print production	Sản xuất in ấn
+	Protect a PDF	Bảo vệ một PDF
+	Protect with password	Bảo vệ bằng mật khẩu
+	Radio button	Nút radio
+	Recognize text	Nhận dạng văn bản
+	Recognize text in multiple files…	Nhận dạng văn bản trong nhiều tệp…
+	Recognize text…	Nhận dạng văn bản…
+	Rectangle	Hình chữ nhật
+	Redact a PDF	Xóa nội dung nhạy cảm trong PDF
+	Redact pages	Xóa nội dung nhạy cảm trên trang
+	Redact pages…	Xóa nội dung nhạy cảm trên trang…
+	Redact text and images	Xóa nội dung nhạy cảm trong văn bản và hình ảnh
+	Redaction properties…	Thuộc tính xóa nội dung nhạy cảm…
+	Reduce file size	Giảm kích thước tệp
+	Remove all links	Gỡ tất cả liên kết
+	Remove background	Gỡ nền
+	Remove header & footer	Gỡ đầu trang & chân trang
+	Remove hidden information	Gỡ thông tin ẩn
+	Remove hidden information…	Gỡ thông tin ẩn…
+	Remove watermark	Gỡ hình mờ
+	Replace	Thay thế
+	Replace text	Thay thế văn bản
+	Reset panel layout	Đặt lại bố cục bảng
+	Review	Duyệt
+	Rich Text Format (.rtf)	Rich Text Format (.rtf)
+	Rotate	Xoay
+	Rotate pages	Xoay trang
+	Rotate pages clockwise	Xoay trang theo chiều kim đồng hồ
+	Rotate pages counterclockwise	Xoay trang ngược chiều kim đồng hồ
+	Sanitize document	Làm sạch tài liệu
+	Sanitize document…	Làm sạch tài liệu…
+	Save as PDF/A	Lưu thành PDF/A
+	Save as PDF/UA	Lưu thành PDF/UA
+	Save as PDF/X	Lưu thành PDF/X
+	Scan & OCR	Quét & OCR
+	Security properties	Thuộc tính bảo mật
+	Select files to compare	Chọn các tệp để so sánh
+	Separate PDFs	Các PDF riêng biệt
+	Set measurement scale	Đặt tỷ lệ đo
+	Set page boxes	Đặt các hộp trang
+	Set page boxes…	Đặt các hộp trang…
+	Set properties	Đặt thuộc tính
+	Show cover page in two-page view	Hiện trang bìa ở chế độ hai trang
+	Signature	Chữ ký
+	Signatures panel	Bảng chữ ký
+	Single file	Một tệp
+	Snapping	Bắt dính
+	Split	Tách
+	Spreadsheet (.xlsx)	Bảng tính (.xlsx)
+	Squiggly underline	Gạch chân lượn sóng
+	Squiggly underline text	Gạch chân lượn sóng cho văn bản
+	Stamp	Con dấu
+	Stamp palette	Bảng chọn con dấu
+	Stamps	Con dấu
+	Standards	Chuẩn
+	Sticky note	Ghi chú dán
+	Strikethrough text	Gạch ngang văn bản
+	Summarize	Tóm tắt
+	Summarize comments	Tóm tắt bình luận
+	Switch light / dark theme	Chuyển chủ đề sáng / tối
+	Tab order by columns	Thứ tự tab theo cột
+	Tab order by rows	Thứ tự tab theo hàng
+	Tab order: by columns	Thứ tự tab: theo cột
+	Tab order: by document structure	Thứ tự tab: theo cấu trúc tài liệu
+	Tab order: by rows	Thứ tự tab: theo hàng
+	Tags panel	Bảng thẻ
+	Text (plain)	Văn bản (thuần)
+	Text box	Khung văn bản
+	Text field	Trường văn bản
+	Timestamp	Dấu thời gian
+	Translate	Dịch
+	Underline text	Gạch chân văn bản
+	Update background…	Cập nhật nền…
+	Update header & footer…	Cập nhật đầu trang & chân trang…
+	Update watermark…	Cập nhật hình mờ…
+	Use JavaScript	Dùng JavaScript
+	Use a certificate	Dùng chứng chỉ
+	Use guided actions	Dùng hành động có hướng dẫn
+	Use print production	Dùng sản xuất in ấn
+	Use system setting	Dùng cài đặt hệ thống
+	Validate all signatures	Xác thực tất cả chữ ký
+	Watermark	Hình mờ
+	Move object	Di chuyển đối tượng
+	Move objects	Di chuyển các đối tượng
+	All tools	Tất cả công cụ
+	Read	Đọc
+	E-Sign	Ký điện tử
+	Tools	Công cụ
+	Inspector	Trình thanh tra
+	 on page {label}	 trên trang {label}
+	A font isn't embedded	Một phông chữ chưa được nhúng
+	A {} action isn't allowed	Hành động {} không được phép
+	A {} annotation has additional actions	Chú thích {} có các hành động bổ sung
+	A {} annotation has no appearance stream	Chú thích {} không có luồng diện mạo
+	A {} annotation isn't set to print, or is hidden	Chú thích {} không được đặt để in, hoặc bị ẩn
+	Accessibility Report	Báo cáo trợ năng
+	Add the PDFs to combine	Thêm các PDF cần kết hợp
+	Added the first {n} PDFs in {folder}	Đã thêm {n} PDF đầu tiên trong {folder}
+	CRL Signing	Ký CRL
+	Certificate Signing	Ký chứng chỉ
+	Change Author	Đổi tác giả
+	Change Keywords	Đổi từ khóa
+	Change Subject	Đổi chủ đề
+	Change Title	Đổi tiêu đề
+	Choose a digital ID.	Chọn một Digital ID.
+	Create links	Tạo liên kết
+	Creator	Ứng dụng tạo
+	Cut and stack needs Two-sided: Off. Print single-sided sheets.	Cắt và xếp chồng cần đặt Hai mặt: Tắt. Hãy in các tờ một mặt.
+	Data Encipherment	Mã hóa dữ liệu
+	Decipher Only	Chỉ giải mã
+	Detailed Report	Báo cáo chi tiết
+	DeviceCMYK is used, but the PDF/A output intent isn't a CMYK profile	DeviceCMYK được dùng, nhưng mục đích đầu ra PDF/A không phải là hồ sơ CMYK
+	DeviceRGB is used, but the PDF/A output intent isn't an RGB profile	DeviceRGB được dùng, nhưng mục đích đầu ra PDF/A không phải là hồ sơ RGB
+	Digital Signature	Chữ ký số
+	Document properties (⌘D)	Thuộc tính tài liệu (⌘D)
+	Drop PDFs or folders here, or choose them.	Thả PDF hoặc thư mục vào đây, hoặc chọn chúng.
+	Encipher Only	Chỉ mã hóa
+	English	English
+	Enter a URL	Nhập một URL
+	Enter a name.	Nhập một tên.
+	Enter a page number	Nhập một số trang
+	Enter the field names	Nhập tên các trường
+	Every PDF in the folder	Mọi PDF trong thư mục
+	Every PDF in the folder and the folders inside it	Mọi PDF trong thư mục và các thư mục con của nó
+	Field "{}" on page {p} has no description (tooltip)	Trường "{}" trên trang {p} không có mô tả (chú giải công cụ)
+	Filename	Tên tệp
+	Flatten Fill & Sign	Làm phẳng Điền & Ký
+	Font (unnamed) on page {p} doesn't map its characters to Unicode	Phông chữ (không tên) trên trang {p} không ánh xạ các ký tự của nó sang Unicode
+	Font {} on page {p} doesn't map its characters to Unicode	Phông chữ {} trên trang {p} không ánh xạ các ký tự của nó sang Unicode
+	Form field on page {p} isn't tagged	Trường biểu mẫu trên trang {p} chưa được gắn thẻ
+	H{n} follows an H{d}; headings should not skip levels	H{n} theo sau H{d}; các đề mục không nên bỏ qua cấp
+	Inserted text	Văn bản được chèn
+	Key Agreement	Thỏa thuận khóa
+	Key Encipherment	Mã hóa khóa
+	Margins (in)	Lề (inch)
+	New bookmark (⌘B)	Dấu trang mới (⌘B)
+	Next (⌘G)	Tiếp theo (⌘G)
+	No PDFs found in {folder}	Không tìm thấy PDF nào trong {folder}
+	No document language is set	Chưa đặt ngôn ngữ cho tài liệu
+	No page has text: the document appears to be images of pages	Không trang nào có văn bản: tài liệu có vẻ là hình ảnh của các trang
+	Non-Repudiation	Chống chối bỏ
+	Only the document's owner can change its security (open it with the permissions password)	Chỉ chủ sở hữu tài liệu mới có thể thay đổi bảo mật của nó (hãy mở bằng mật khẩu quyền hạn)
+	Open a PDF (⌘O)	Mở một PDF (⌘O)
+	Page {p} doesn't tab in structure order	Trang {p} không chuyển tab theo thứ tự cấu trúc
+	Page {p}: {n} untagged content item	Trang {p}: {n} mục nội dung chưa gắn thẻ
+	Page {p}: {n} untagged content items	Trang {p}: {n} mục nội dung chưa gắn thẻ
+	Page {} has additional actions	Trang {} có các hành động bổ sung
+	Panel layout could not be restored: {error}	Không thể khôi phục bố cục bảng: {error}
+	Panel move was not applied: {error}	Việc di chuyển bảng chưa được áp dụng: {error}
+	PdfCraft can't check this signature yet: {}.	PdfCraft chưa thể kiểm tra chữ ký này: {}.
+	Previous (⇧⌘G)	Trước (⇧⌘G)
+	Print (⌘P)	In (⌘P)
+	Producer	Ứng dụng sản xuất
+	Redo {action}	Làm lại {action}
+	Rendering…	Đang kết xuất…
+	Report created	Đã tạo báo cáo
+	Rev. {rev}: Certified by an unknown signer	Bản sửa đổi {rev}: Được chứng nhận bởi người ký không rõ
+	Rev. {rev}: Certified by {name}	Bản sửa đổi {rev}: Được chứng nhận bởi {name}
+	Rev. {rev}: Signed by an unknown signer	Bản sửa đổi {rev}: Được ký bởi người ký không rõ
+	Rev. {rev}: Signed by {name}	Bản sửa đổi {rev}: Được ký bởi {name}
+	Rotate view clockwise (⇧⌘+)	Xoay chế độ xem theo chiều kim đồng hồ (⇧⌘+)
+	Rule Name	Tên quy tắc
+	Save (M4)	Lưu (M4)
+	Save as {level}	Lưu thành {level}
+	Signature is invalid	Chữ ký không hợp lệ
+	Signature is valid	Chữ ký hợp lệ
+	Signature validity is unknown	Không rõ tính hợp lệ của chữ ký
+	Signing time is from the clock on the signer's computer.	Thời gian ký lấy từ đồng hồ trên máy tính của người ký.
+	Still rendering — this page is unusually complex…	Vẫn đang kết xuất — trang này phức tạp bất thường…
+	The ECDSA signature is not in canonical DER (trailing bytes, padding or a missing sign byte); it was read anyway.	Chữ ký ECDSA không ở dạng DER chuẩn (có byte thừa ở cuối, phần đệm hoặc thiếu byte dấu); nó vẫn được đọc.
+	The ECDSA signature is the raw r and s values instead of a DER sequence; it was read anyway.	Chữ ký ECDSA là các giá trị r và s thô thay vì một chuỗi DER; nó vẫn được đọc.
+	The RSA signature value does not have the length of the key's modulus (leading zero bytes dropped or added); it was read anyway.	Giá trị chữ ký RSA không có độ dài bằng môđun của khóa (các byte không ở đầu bị bỏ hoặc thêm); nó vẫn được đọc.
+	The RSA signature's DigestInfo has no NULL parameter (older signers write it so); it was read anyway.	DigestInfo của chữ ký RSA không có tham số NULL (các trình ký cũ ghi như vậy); nó vẫn được đọc.
+	The certificate of {} does not allow this many CA certificates below it (path length), so it is not used to vouch for {}.	Chứng chỉ của {} không cho phép có nhiều chứng chỉ CA ở dưới nó như vậy (độ dài đường dẫn), nên nó không được dùng để bảo chứng cho {}.
+	The certificate of {} is not a CA certificate that may issue certificates, so it is not used to vouch for {}.	Chứng chỉ của {} không phải là chứng chỉ CA được phép cấp chứng chỉ, nên nó không được dùng để bảo chứng cho {}.
+	The certificate of {} was not valid at the time of signing, so it is not used to vouch for {}.	Chứng chỉ của {} không hợp lệ tại thời điểm ký, nên nó không được dùng để bảo chứng cho {}.
+	The checker found problems which may prevent the document from being fully accessible.	Trình kiểm tra tìm thấy các vấn đề có thể khiến tài liệu không thể tiếp cận đầy đủ.
+	The document has been altered or corrupted since the signature was applied.	Tài liệu đã bị thay đổi hoặc hỏng kể từ khi chữ ký được áp dụng.
+	The document has been altered or corrupted since the timestamp was applied.	Tài liệu đã bị thay đổi hoặc hỏng kể từ khi dấu thời gian được áp dụng.
+	The document has been altered since this signature was applied in ways it does not permit ({}).	Tài liệu đã bị thay đổi kể từ khi chữ ký này được áp dụng theo những cách mà nó không cho phép ({}).
+	The document has been altered since this timestamp was applied in ways it does not permit ({}).	Tài liệu đã bị thay đổi kể từ khi dấu thời gian này được áp dụng theo những cách mà nó không cho phép ({}).
+	The document has been modified since this signature was applied, but the changes are permitted ({}).	Tài liệu đã được sửa đổi kể từ khi chữ ký này được áp dụng, nhưng các thay đổi được phép ({}).
+	The document has been modified since this timestamp was applied, but the changes are permitted ({}).	Tài liệu đã được sửa đổi kể từ khi dấu thời gian này được áp dụng, nhưng các thay đổi được phép ({}).
+	The document has no tags (structure tree)	Tài liệu không có thẻ (cây cấu trúc)
+	The document has no title	Tài liệu không có tiêu đề
+	The document isn't marked as tagged (MarkInfo Marked)	Tài liệu không được đánh dấu là có gắn thẻ (MarkInfo Marked)
+	The document isn't tagged, so none of its content is	Tài liệu chưa được gắn thẻ, nên không nội dung nào của nó được gắn thẻ
+	The document's embedded revocation information shows that the signer's certificate has not been revoked.	Thông tin thu hồi được nhúng trong tài liệu cho thấy chứng chỉ của người ký chưa bị thu hồi.
+	The embedded timestamp token is valid and its authority is trusted; trusted time is {}.	Mã thông báo dấu thời gian được nhúng hợp lệ và cơ quan cấp nó được tin cậy; thời gian tin cậy là {}.
+	The font {} isn't embedded	Phông chữ {} chưa được nhúng
+	The metadata doesn't identify the file as {}	Siêu dữ liệu không xác định tệp là {}
+	The password is incorrect.	Mật khẩu không đúng.
+	The password must have at least 6 characters.	Mật khẩu phải có ít nhất 6 ký tự.
+	The passwords do not match.	Các mật khẩu không khớp.
+	The security settings don't allow screen readers to read the text	Cài đặt bảo mật không cho phép trình đọc màn hình đọc văn bản
+	The signature algorithm and the SignerInfo's digest algorithm name different hashes; the signature was made with the SignerInfo's.	Thuật toán chữ ký và thuật toán băm của SignerInfo chỉ định các hàm băm khác nhau; chữ ký được tạo bằng hàm băm của SignerInfo.
+	The signature carries an unverified timestamp ({}): the timestamp authority is not in your list of trusted certificates, so the signing time claimed by the signer is used instead.	Chữ ký mang một dấu thời gian chưa được xác minh ({}): cơ quan cấp dấu thời gian không nằm trong danh sách chứng chỉ tin cậy của bạn, nên thời gian ký do người ký tuyên bố được dùng thay thế.
+	The signature contents are not hexadecimal.	Nội dung chữ ký không phải là thập lục phân.
+	The signature could not be checked ({}).	Không thể kiểm tra chữ ký ({}).
+	The signature could not be read ({}).	Không thể đọc chữ ký ({}).
+	The signature could not be verified ({}).	Không thể xác minh chữ ký ({}).
+	The signature has no valid byte range.	Chữ ký không có dải byte hợp lệ.
+	The signature includes an embedded timestamp.	Chữ ký bao gồm một dấu thời gian được nhúng.
+	The signature is BER-encoded (indefinite lengths) rather than DER; it was read leniently.	Chữ ký được mã hóa BER (độ dài không xác định) thay vì DER; nó được đọc một cách khoan dung.
+	The signature uses the legacy adbe.x509.rsa_sha1 format.	Chữ ký dùng định dạng cũ adbe.x509.rsa_sha1.
+	The signature value does not match the signer's certificate: the signature is corrupt.	Giá trị chữ ký không khớp với chứng chỉ của người ký: chữ ký bị hỏng.
+	The signature's byte range does not exclude exactly its contents.	Dải byte của chữ ký không loại trừ chính xác nội dung của nó.
+	The signature's byte range does not match the file.	Dải byte của chữ ký không khớp với tệp.
+	The signature's timestamp token could not be verified ({}).	Không thể xác minh mã thông báo dấu thời gian của chữ ký ({}).
+	The signature's timestamp token does not cover the signature value.	Mã thông báo dấu thời gian của chữ ký không bao phủ giá trị chữ ký.
+	The signed content is a constructed (segmented) OCTET STRING, as BER allows; it was read anyway.	Nội dung được ký là một OCTET STRING dạng cấu trúc (phân đoạn), như BER cho phép; nó vẫn được đọc.
+	The signer's certificate does not allow digital signatures (its key usage has neither digital signature nor non-repudiation).	Chứng chỉ của người ký không cho phép chữ ký số (mục đích sử dụng khóa của nó không có chữ ký số cũng không có chống chối bỏ).
+	The signer's certificate has been revoked ({}).	Chứng chỉ của người ký đã bị thu hồi ({}).
+	The signer's certificate has critical extensions PdfCraft does not recognize ({}).	Chứng chỉ của người ký có các phần mở rộng quan trọng mà PdfCraft không nhận ra ({}).
+	The signer's certificate is not in the signature.	Chứng chỉ của người ký không có trong chữ ký.
+	The signer's certificate is not issued for signing documents (its extended key usage has no document-signing purpose).	Chứng chỉ của người ký không được cấp để ký tài liệu (mục đích sử dụng khóa mở rộng của nó không có mục đích ký tài liệu).
+	The signer's certificate was not valid at the time of signing.	Chứng chỉ của người ký không hợp lệ tại thời điểm ký.
+	The signer's identity is unknown because it has not been included in your list of trusted certificates and none of its parent certificates are trusted certificates.	Danh tính của người ký không rõ vì nó chưa được đưa vào danh sách chứng chỉ tin cậy của bạn và không chứng chỉ cấp trên nào của nó là chứng chỉ tin cậy.
+	The signer's identity is valid.	Danh tính của người ký hợp lệ.
+	The timestamp authority's certificate was not valid at the time of timestamping.	Chứng chỉ của cơ quan cấp dấu thời gian không hợp lệ tại thời điểm đóng dấu thời gian.
+	The timestamp contents are not hexadecimal.	Nội dung dấu thời gian không phải là thập lục phân.
+	The timestamp has no valid byte range.	Dấu thời gian không có dải byte hợp lệ.
+	The timestamp token could not be read ({}).	Không thể đọc mã thông báo dấu thời gian ({}).
+	The timestamp token is valid and its authority is trusted.	Mã thông báo dấu thời gian hợp lệ và cơ quan cấp nó được tin cậy.
+	The timestamp token is valid, but the timestamp authority is not in your list of trusted certificates.	Mã thông báo dấu thời gian hợp lệ, nhưng cơ quan cấp dấu thời gian không nằm trong danh sách chứng chỉ tin cậy của bạn.
+	The timestamp's byte range does not exclude exactly its contents.	Dải byte của dấu thời gian không loại trừ chính xác nội dung của nó.
+	The timestamp's byte range does not match the file.	Dải byte của dấu thời gian không khớp với tệp.
+	The window shows the file name, not the title (Initial View > Show)	Cửa sổ hiển thị tên tệp, không phải tiêu đề (Chế độ xem ban đầu > Hiện)
+	There is no folder to save the digital ID in.	Không có thư mục nào để lưu Digital ID.
+	This document has not been modified since this signature was applied.	Tài liệu này chưa bị sửa đổi kể từ khi chữ ký này được áp dụng.
+	This document has not been modified since this timestamp was applied.	Tài liệu này chưa bị sửa đổi kể từ khi dấu thời gian này được áp dụng.
+	This signature uses RIPEMD-160, a legacy 160-bit hash algorithm that is no longer recommended for signatures. It still validates, but it should not be relied on.	Chữ ký này dùng RIPEMD-160, một thuật toán băm 160 bit cũ không còn được khuyến nghị cho chữ ký. Nó vẫn xác thực được, nhưng không nên dựa vào nó.
+	This signature uses SHA-1, a weak hash algorithm: collisions in it have been demonstrated. It still validates because many documents signed years ago use it, but it should not be relied on.	Chữ ký này dùng SHA-1, một thuật toán băm yếu: các va chạm trong nó đã được chứng minh. Nó vẫn xác thực được vì nhiều tài liệu được ký từ nhiều năm trước dùng nó, nhưng không nên dựa vào nó.
+	Undo {action}	Hoàn tác {action}
+	Unsigned signature field	Trường chữ ký chưa ký
+	Unsigned signature field: {name}	Trường chữ ký chưa ký: {name}
+	Zoom in (⌘+)	Phóng to (⌘+)
+	Zoom in / out (also pinch or ⌘-scroll)	Phóng to / thu nhỏ (cũng có thể chụm ngón tay hoặc ⌘-cuộn)
+	Zoom out (⌘−)	Thu nhỏ (⌘−)
+	alternate text hides an annotation inside it	văn bản thay thế che khuất một chú thích bên trong nó
+	alternate text on an element with no page content	văn bản thay thế trên phần tử không có nội dung trang
+	comments	bình luận
+	document security store	kho bảo mật tài liệu
+	document structure	cấu trúc tài liệu
+	form fill	điền biểu mẫu
+	its alternate text is inside another element's and will never be read	văn bản thay thế của nó nằm trong văn bản thay thế của phần tử khác và sẽ không bao giờ được đọc
+	links	liên kết
+	metadata	siêu dữ liệu
+	no alternate text	không có văn bản thay thế
+	no header cells (TH)	không có ô tiêu đề (TH)
+	no summary	không có tóm tắt
+	not in a TR	không nằm trong TR
+	not in a Table, THead, TBody or TFoot	không nằm trong Table, THead, TBody hoặc TFoot
+	not in an L (list)	không nằm trong L (danh sách)
+	not in an LI (list item)	không nằm trong LI (mục danh sách)
+	other changes	các thay đổi khác
+	page content	nội dung trang
+	page {n} is out of range (1–{count})	trang {n} nằm ngoài phạm vi (1–{count})
+	pages added or removed	trang được thêm hoặc xóa
+	rows have between {min} and {max} columns	các hàng có từ {min} đến {max} cột
+	the first heading is an H{n}; headings should not skip levels	đề mục đầu tiên là H{n}; các đề mục không nên bỏ qua cấp
+	the signed version could not be read	không thể đọc phiên bản đã ký
+	{n} pages and no bookmarks	{n} trang và không có dấu trang
+	{page} is not a page number or label	{page} không phải là số trang hoặc nhãn
+	{ty} element on page {p}: {what}	Phần tử {ty} trên trang {p}: {what}
+	{ty} element: {what}	Phần tử {ty}: {what}
+	{who}, certificate issued by an unknown issuer.	{who}, chứng chỉ do tổ chức không rõ cấp.
+	{who}, certificate issued by {issuer}.	{who}, chứng chỉ do {issuer} cấp.
+	{} annotation on page {p} isn't tagged	Chú thích {} trên trang {p} chưa được gắn thẻ
+	{} annotations aren't allowed	Chú thích {} không được phép
+	… and {n} more	… và {n} mục nữa
+@plural	Delete {n} field|Delete {n} fields	Xóa {n} trường
+@plural	{n} byte|{n} bytes	{n} byte
+@plural	{n} image optimized|{n} images optimized	Đã tối ưu hóa {n} hình ảnh
+@plural	{n} item discarded|{n} items discarded	Đã loại bỏ {n} mục
+@plural	{n} pixel|{n} pixels	{n} điểm ảnh
+action wizard	Start	Bắt đầu
+comment menu	Edit	Sửa
+	A button	Một nút
+	A diagonal CONFIDENTIAL watermark on every page.	Hình mờ CONFIDENTIAL nằm chéo trên mọi trang.
+	A document needs at least one page: copy instead	Một tài liệu cần ít nhất một trang: hãy sao chép thay vào đó
+	A form field has additional actions	Một trường biểu mẫu có các hành động bổ sung
+	A link	Một liên kết
+	A script	Một script
+	A selected field has no widget on any page, so the fields can't be edited together.	Một trường đã chọn không có widget trên trang nào, nên các trường không thể được chỉnh sửa cùng nhau.
+	A stream refers to an external file	Một luồng tham chiếu đến tệp bên ngoài
+	A stream uses LZW compression	Một luồng dùng nén LZW
+	A summary describes the table's purpose and layout. Add a Summary attribute to each table.	Phần tóm tắt mô tả mục đích và bố cục của bảng. Hãy thêm thuộc tính Summary cho mỗi bảng.
+	About	Giới thiệu
+	Accepted	Đã chấp nhận
+	Accessibility permission flag	Cờ quyền trợ năng
+	Accessibility permission flag is set	Cờ quyền trợ năng đã được đặt
+	Add Page Numbers	Thêm số trang
+	Add arrow	Thêm mũi tên
+	Add background	Thêm nền
+	Add bookmark	Thêm dấu trang
+	Add callout	Thêm khung chú thích
+	Add checkmark	Thêm dấu kiểm
+	Add cloud	Thêm đám mây
+	Add connected lines	Thêm các đường nối liền
+	Add cross	Thêm dấu chéo
+	Add dot	Thêm dấu chấm
+	Add drawing	Thêm bản vẽ
+	Add field	Thêm trường
+	Add file attachment	Thêm tệp đính kèm
+	Add footer	Thêm chân trang
+	Add header	Thêm đầu trang
+	Add header & footer	Thêm đầu trang & chân trang
+	Add highlight	Thêm tô sáng
+	Add image	Thêm hình ảnh
+	Add inserted text	Thêm văn bản được chèn
+	Add line	Thêm đường thẳng
+	Add link	Thêm liên kết
+	Add oval	Thêm hình bầu dục
+	Add polygon	Thêm đa giác
+	Add rectangle	Thêm hình chữ nhật
+	Add redaction mark	Thêm dấu đánh dấu xóa
+	Add signature	Thêm chữ ký
+	Add squiggly underline	Thêm gạch chân lượn sóng
+	Add stamp	Thêm con dấu
+	Add sticky note	Thêm ghi chú dán
+	Add strikethrough	Thêm gạch ngang
+	Add text box	Thêm khung văn bản
+	Add underline	Thêm gạch chân
+	Add watermark	Thêm hình mờ
+	Add {what}	Thêm {what}
+	Added the first {n} files in {folder}	Đã thêm {n} tệp đầu tiên trong {folder}
+	Adding images arrives on the web with file pickers for images	Việc thêm hình ảnh sẽ có trên web cùng với bộ chọn tệp hình ảnh
+	Algorithm	Thuật toán
+	Align fields	Căn chỉnh các trường
+	All annotations are tagged	Tất cả chú thích đã được gắn thẻ
+	All form fields are tagged	Tất cả trường biểu mẫu đã được gắn thẻ
+	All form fields have description	Tất cả trường biểu mẫu đều có mô tả
+	All multimedia objects are tagged	Tất cả đối tượng đa phương tiện đã được gắn thẻ
+	All page content is tagged	Tất cả nội dung trang đã được gắn thẻ
+	Allowed	Được phép
+	Alternate Text	Văn bản thay thế
+	Alternate text inside an element that already has alternate text is never read. Remove the inner alternate text.	Văn bản thay thế bên trong phần tử đã có văn bản thay thế sẽ không bao giờ được đọc. Hãy gỡ văn bản thay thế bên trong.
+	Alternate text must be associated with some content	Văn bản thay thế phải được liên kết với một nội dung nào đó
+	Alternate text on an element that contains a link or field hides that annotation from assistive technology. Move the alternate text.	Văn bản thay thế trên phần tử chứa liên kết hoặc trường sẽ che chú thích đó khỏi công nghệ hỗ trợ. Hãy chuyển văn bản thay thế.
+	Alternate text on an element without page content is never reached. Remove it or attach the element to content.	Văn bản thay thế trên phần tử không có nội dung trang sẽ không bao giờ được truy cập tới. Hãy gỡ nó hoặc gắn phần tử vào nội dung.
+	Alternate text should not hide annotation	Văn bản thay thế không nên che chú thích
+	Alternate text that will never be read	Văn bản thay thế sẽ không bao giờ được đọc
+	An action is already running	Một hành động đang chạy
+	An embedded file has no AFRelationship	Một tệp nhúng không có AFRelationship
+	An image asks to be interpolated	Một hình ảnh yêu cầu được nội suy
+	An image has alternates or OPI information	Một hình ảnh có bản thay thế hoặc thông tin OPI
+	Animation that flashes can cause seizures. Check scripts and media for flicker.	Hoạt ảnh nhấp nháy có thể gây co giật. Hãy kiểm tra script và phương tiện xem có nhấp nháy không.
+	Another file dialog is still open. Finish with it first.	Một hộp thoại tệp khác vẫn đang mở. Hãy hoàn tất nó trước.
+	Application	Ứng dụng
+	Applied 1 redaction mark. Save to remove the content from the file.	Đã áp dụng 1 dấu xóa. Hãy lưu để loại bỏ nội dung khỏi tệp.
+	Applied {n} redaction marks. Save to remove the content from the file.	Đã áp dụng {n} dấu xóa. Hãy lưu để loại bỏ nội dung khỏi tệp.
+	Appropriate nesting	Lồng ghép phù hợp
+	Arbitrary Mask	Mặt nạ tùy ý
+	Associated with content	Được liên kết với nội dung
+	At least one signature has problems.	Ít nhất một chữ ký có vấn đề.
+	At least one signature is invalid.	Ít nhất một chữ ký không hợp lệ.
+	Attachment	Tệp đính kèm
+	Basic constraints	Ràng buộc cơ bản
+	Beveled	Vát cạnh
+	Black	Đen
+	Black on white	Đen trên nền trắng
+	Blue	Xanh dương
+	Bookmarks are present in large documents	Dấu trang có mặt trong các tài liệu lớn
+	Both	Cả hai
+	Button Properties	Thuộc tính nút
+	Button Style:	Kiểu nút:
+	Calculate	Tính toán
+	Callout	Khung chú thích
+	Cancelled	Đã hủy
+	Center Footer Text	Văn bản chân trang giữa
+	Center Header Text	Văn bản đầu trang giữa
+	Center horizontally	Căn giữa theo chiều ngang
+	Center vertically	Căn giữa theo chiều dọc
+	Certificate Viewer	Trình xem chứng chỉ
+	Certified by {by}	Được chứng nhận bởi {by}
+	Change comment properties	Thay đổi thuộc tính bình luận
+	Change document properties	Thay đổi thuộc tính tài liệu
+	Change field properties	Thay đổi thuộc tính trường
+	Change initial view	Thay đổi chế độ xem ban đầu
+	Change link properties	Thay đổi thuộc tính liên kết
+	Change tag properties	Thay đổi thuộc tính thẻ
+	Change {key}	Thay đổi {key}
+	Changing the document	Thay đổi tài liệu
+	Character encoding	Mã hóa ký tự
+	Character limit:	Giới hạn ký tự:
+	Check	Đánh dấu chọn
+	Check Box Properties	Thuộc tính hộp kiểm
+	Check Box Style:	Kiểu hộp kiểm:
+	Check that the tags read in the order a sighted reader would. Use the Reading Order tool or the Tags panel to correct it.	Hãy kiểm tra rằng các thẻ được đọc theo thứ tự mà người đọc nhìn thấy được sẽ đọc. Dùng công cụ Thứ tự đọc hoặc bảng Thẻ để sửa.
+	CheckBox	CheckBox
+	Checked	Đã đánh dấu chọn
+	Choose a folder for the split files	Chọn thư mục cho các tệp đã tách
+	Choose a folder on this computer to pin	Chọn một thư mục trên máy tính này để ghim
+	Click on the page to add a {tool}, or drag to set its size	Bấm vào trang để thêm {tool}, hoặc kéo để đặt kích thước
+	Click text or an image to edit it	Bấm vào văn bản hoặc hình ảnh để chỉnh sửa
+	Color Images	Ảnh màu
+	Color Spaces	Không gian màu
+	Color contrast	Độ tương phản màu
+	Comb of characters	Dạng lược gồm các ký tự
+	Combo	Combo
+	Coming in milestone {m}. Items marked Ready work today.	Sẽ có ở cột mốc {m}. Các mục được đánh dấu Sẵn sàng hoạt động ngay hôm nay.
+	Command	Lệnh
+	Commenting	Bình luận
+	Comments and markups	Bình luận và chú thích đánh dấu
+	Comments, links and fields must be in the tag tree to be announced. Tag the annotations.	Bình luận, liên kết và trường phải nằm trong cây thẻ để được đọc to. Hãy gắn thẻ cho các chú thích.
+	Completed	Đã hoàn thành
+	Configure a Digital ID for Signing	Cấu hình Digital ID để ký
+	Connected lines	Các đường nối liền
+	Content Streams	Luồng nội dung
+	Content copying	Sao chép nội dung
+	Content copying for accessibility	Sao chép nội dung cho trợ năng
+	Contributors	Người đóng góp
+	Copied {what}	Đã sao chép {what}
+	Copy or cut pages first	Hãy sao chép hoặc cắt trang trước
+	Could not save: {e}	Không thể lưu: {e}
+	Couldn't add {name}: {e}	Không thể thêm {name}: {e}
+	Couldn't combine files: {e}	Không thể kết hợp các tệp: {e}
+	Couldn't create a PDF: {e}	Không thể tạo PDF: {e}
+	Couldn't download {name}: {e}	Không thể tải xuống {name}: {e}
+	Couldn't extract pages: {e}	Không thể trích xuất trang: {e}
+	Couldn't fit the visible content: {e}	Không thể làm vừa nội dung hiển thị: {e}
+	Couldn't follow linked PDF: {reason}	Không thể theo liên kết đến PDF: {reason}
+	Couldn't import the signature image: {e}	Không thể nhập hình ảnh chữ ký: {e}
+	Couldn't open revision {n}: {e}	Không thể mở bản sửa đổi {n}: {e}
+	Couldn't open the result: {e}	Không thể mở kết quả: {e}
+	Couldn't open the signed version: {e}	Không thể mở phiên bản đã ký: {e}
+	Couldn't open {name}: {e}	Không thể mở {name}: {e}
+	Couldn't optimize the file	Không thể tối ưu hóa tệp
+	Couldn't optimize the file: {e}	Không thể tối ưu hóa tệp: {e}
+	Couldn't print from the browser ({e}); downloaded {name} to print instead	Không thể in từ trình duyệt ({e}); đã tải {name} xuống để in thay thế
+	Couldn't read {name}: {e}	Không thể đọc {name}: {e}
+	Couldn't recover {name}: {e}	Không thể khôi phục {name}: {e}
+	Couldn't reload {name}: {e}	Không thể tải lại {name}: {e}
+	Couldn't save the image: {e}	Không thể lưu hình ảnh: {e}
+	Couldn't save {name}: {e}	Không thể lưu {name}: {e}
+	Couldn't save: {e}	Không thể lưu: {e}
+	Couldn't show the file picker. Please try again.	Không thể hiển thị bộ chọn tệp. Vui lòng thử lại.
+	Couldn't split: {e}	Không thể tách: {e}
+	Couldn't summarize comments: {e}	Không thể tóm tắt bình luận: {e}
+	Couldn't take the snapshot: {e}	Không thể chụp ảnh nhanh: {e}
+	Couldn't unlock {name}: {e}	Không thể mở khóa {name}: {e}
+	Couldn't use the photo: {e}	Không thể dùng ảnh: {e}
+	Couldn't use {name}: {e}	Không thể dùng {name}: {e}
+	Couldn't write {name}: {e}	Không thể ghi {name}: {e}
+	Couldn't write {path}: {e}	Không thể ghi {path}: {e}
+	Create link	Tạo liên kết
+	Created 1 link	Đã tạo 1 liên kết
+	Created a PDF from the first {n} files	Đã tạo một PDF từ {n} tệp đầu tiên
+	Created a comment summary	Đã tạo bản tóm tắt bình luận
+	Created {n} links	Đã tạo {n} liên kết
+	Credit Cards	Thẻ tín dụng
+	Crop page	Cắt xén trang
+	Custom font	Phông chữ tùy chỉnh
+	Custom stamps arrive on the web with file pickers for images	Con dấu tùy chỉnh sẽ có trên web cùng với bộ chọn tệp hình ảnh
+	Cut {what}	Đã cắt {what}
+	Dark gray theme	Chủ đề xám đậm
+	Dashed	Nét đứt
+	Dates	Ngày tháng
+	Delete bookmark	Xóa dấu trang
+	Delete content	Xóa nội dung
+	Delete document JavaScript	Xóa JavaScript của tài liệu
+	Delete field	Xóa trường
+	Delete image	Xóa hình ảnh
+	Delete link	Xóa liên kết
+	Delete page	Xóa trang
+	Delete selected fields	Xóa các trường đã chọn
+	Deleted	Đã xóa
+	Detected 1 form field	Đã phát hiện 1 trường biểu mẫu
+	Detected {n} form fields	Đã phát hiện {n} trường biểu mẫu
+	Device colour is used, but there is no PDF/A output intent	Màu thiết bị được dùng, nhưng không có mục đích đầu ra PDF/A
+	DeviceCMYK is used: it needs a CMYK output intent (not added automatically)	DeviceCMYK được dùng: cần có mục đích đầu ra CMYK (không được thêm tự động)
+	Diagnostic details	Chi tiết chẩn đoán
+	Digital Signature Properties	Thuộc tính chữ ký số
+	Discard all comments, forms and multimedia	Loại bỏ tất cả bình luận, biểu mẫu và đa phương tiện
+	Discard all links, actions and JavaScript	Loại bỏ tất cả liên kết, hành động và JavaScript
+	Discard all object data (file attachments)	Loại bỏ tất cả dữ liệu đối tượng (tệp đính kèm)
+	Discard bookmarks	Loại bỏ dấu trang
+	Discard document information and metadata	Loại bỏ thông tin tài liệu và siêu dữ liệu
+	Discard hidden layer content	Loại bỏ nội dung lớp ẩn
+	Discard hidden text	Loại bỏ văn bản ẩn
+	Discard private data of other applications	Loại bỏ dữ liệu riêng của các ứng dụng khác
+	Distribute fields	Phân bố các trường
+	Document Overhead	Chi phí cấu trúc tài liệu
+	Document assembly	Lắp ráp tài liệu
+	Document has appropriate color contrast	Tài liệu có độ tương phản màu phù hợp
+	Document is not image-only PDF	Tài liệu không phải PDF chỉ có hình ảnh
+	Document is tagged PDF	Tài liệu là PDF có gắn thẻ
+	Document sanitized. Save to finish: saving rewrites the whole file.	Đã làm sạch tài liệu. Hãy lưu để hoàn tất: việc lưu sẽ ghi lại toàn bộ tệp.
+	Document structure provides a logical reading order	Cấu trúc tài liệu cung cấp thứ tự đọc hợp lý
+	Document title is showing in title bar	Tiêu đề tài liệu đang hiển thị trên thanh tiêu đề
+	Documents of more than 20 pages need bookmarks for navigation. Add bookmarks for the main sections.	Tài liệu có hơn 20 trang cần dấu trang để điều hướng. Hãy thêm dấu trang cho các phần chính.
+	Double-click	Bấm đúp
+	Downloaded {name}	Đã tải xuống {name}
+	Downloading attachments on the web arrives with M3.10 ({n} bytes ready)	Việc tải tệp đính kèm trên web sẽ có cùng M3.10 (đã sẵn sàng {n} byte)
+	Drag a rectangle around the area to copy	Kéo một hình chữ nhật quanh vùng cần sao chép
+	Drag a rectangle on a page to crop it; double-click a page for Set Page Boxes	Kéo một hình chữ nhật trên trang để cắt xén; bấm đúp vào trang để mở Đặt các hộp trang
+	Drag a rectangle to create a link; double-click a link to edit it	Kéo một hình chữ nhật để tạo liên kết; bấm đúp vào liên kết để chỉnh sửa
+	Drag the corners onto the document's edges, then choose Enhance page.	Kéo các góc vào cạnh của tài liệu, rồi chọn Nâng cao chất lượng trang.
+	Drag to draw the area where the signature should appear.	Kéo để vẽ vùng nơi chữ ký sẽ xuất hiện.
+	Dropdown Properties	Thuộc tính danh sách thả xuống
+	Duplicate field	Nhân bản trường
+	Duplicate page	Nhân bản trang
+	Each field needs a tooltip that says what to enter. Add one in Field Properties > General > Tooltip.	Mỗi trường cần có chú giải công cụ nói rõ cần nhập gì. Hãy thêm trong Thuộc tính trường > Chung > Chú giải công cụ.
+	Edit comment	Chỉnh sửa bình luận
+	Edit content	Chỉnh sửa nội dung
+	Edit document JavaScript	Chỉnh sửa JavaScript của tài liệu
+	Edit fields	Chỉnh sửa các trường
+	Edit script of {name}	Chỉnh sửa script của {name}
+	Edit text	Chỉnh sửa văn bản
+	Editing	Chỉnh sửa
+	Email Addresses	Địa chỉ email
+	Embedded Files	Tệp nhúng
+	Embedded files must be PDF/A files themselves (use PDF/A-3 for others)	Các tệp nhúng phải tự là tệp PDF/A (dùng PDF/A-3 cho các tệp khác)
+	Encryption	Mã hóa
+	Endpoint	Điểm cuối
+	Erase	Tẩy
+	Eraser	Cục tẩy
+	Even pages	Các trang chẵn
+	Everything on a page must be tagged or marked as an artifact (decoration, headers, footers). Tag the untagged content.	Mọi thứ trên trang phải được gắn thẻ hoặc đánh dấu là phần trang trí (trang trí, đầu trang, chân trang). Hãy gắn thẻ cho nội dung chưa gắn thẻ.
+	Execute a menu item	Thực thi một mục trình đơn
+	Export certificate	Xuất chứng chỉ
+	Exported to {path}	Đã xuất ra {path}
+	Extended Graphics States	Trạng thái đồ họa mở rộng
+	Field	Trường
+	Field descriptions	Mô tả trường
+	Figures alternate text	Văn bản thay thế của hình
+	Figures require alternate text	Hình yêu cầu văn bản thay thế
+	File attachments	Tệp đính kèm
+	Files are combined in this order. Leave Pages empty to take every page.	Các tệp được kết hợp theo thứ tự này. Để trống mục Trang để lấy mọi trang.
+	Fill in {name}	Điền {name}
+	Filling of form fields	Điền trường biểu mẫu
+	Flatten	Làm phẳng
+	Flip image	Lật hình ảnh
+	Fonts must map their characters to Unicode so text can be read and copied. Fix the fonts or recreate the PDF.	Phông chữ phải ánh xạ ký tự của chúng sang Unicode để văn bản có thể được đọc và sao chép. Hãy sửa phông chữ hoặc tạo lại PDF.
+	Form fields must be in the tag tree (Form tags) to be announced. Tag the form fields.	Trường biểu mẫu phải nằm trong cây thẻ (thẻ Form) để được đọc to. Hãy gắn thẻ cho các trường biểu mẫu.
+	Formulas and similar non-text elements need alternate text. Add alternate text to them.	Công thức và các phần tử không phải văn bản tương tự cần có văn bản thay thế. Hãy thêm văn bản thay thế cho chúng.
+	Gray	Xám
+	Grayscale Images	Ảnh thang xám
+	Green	Xanh lá
+	Green on black	Xanh lá trên nền đen
+	H / Space (hold)	H / Space (giữ)
+	Header cells (TH) tell listeners what each column or row holds. Mark the header cells.	Ô tiêu đề (TH) cho người nghe biết mỗi cột hoặc hàng chứa gì. Hãy đánh dấu các ô tiêu đề.
+	Headers	Tiêu đề đầu mục
+	Heading levels shouldn't skip (an H1 followed by an H3). Retag the headings.	Cấp đề mục không nên bị bỏ qua (H1 theo sau là H3). Hãy gắn thẻ lại các đề mục.
+	Headings	Đề mục
+	Hidden layers	Lớp ẩn
+	Hidden text	Văn bản ẩn
+	Hide a field	Ẩn một trường
+	Hides annotation	Che chú thích
+	High	Cao
+	Home / End	Home / End
+	Horizontally	Theo chiều ngang
+	Image-only PDF	PDF chỉ có hình ảnh
+	Import {name}	Nhập {name}
+	Importing data arrives on the web with file pickers for data files	Việc nhập dữ liệu sẽ có trên web cùng với bộ chọn tệp dữ liệu
+	Incorrect password. Try again.	Mật khẩu không đúng. Hãy thử lại.
+	Insert pages from {name}	Chèn trang từ {name}
+	Insert pages from {name} — 1 field renamed	Chèn trang từ {name} — 1 trường được đổi tên
+	Insert pages from {name} — fields renamed	Chèn trang từ {name} — các trường được đổi tên
+	Inserted	Đã chèn
+	Inset	Lõm
+	Intended usage	Mục đích sử dụng
+	Intersection	Giao điểm
+	Invert	Đảo màu
+	Irregular tables confuse cell navigation. Give every row the same number of cells (counting spans).	Các bảng không đều gây khó cho việc điều hướng ô. Hãy cho mọi hàng cùng số ô (tính cả các ô gộp).
+	Issued by	Cấp bởi
+	Issued to	Cấp cho
+	Issuer	Tổ chức cấp
+	Key usage	Mục đích sử dụng khóa
+	Keywords	Từ khóa
+	LI must be a child of L	LI phải là con của L
+	Landscape pages	Các trang ngang
+	Lbl and LBody	Lbl và LBody
+	Lbl and LBody must be children of LI	Lbl và LBody phải là con của LI
+	Left Footer Text	Văn bản chân trang trái
+	Left Header Text	Văn bản đầu trang trái
+	Light blue	Xanh lam nhạt
+	Links, actions and JavaScripts	Liên kết, hành động và JavaScript
+	List	Danh sách
+	List Box Properties	Thuộc tính hộp danh sách
+	List items	Mục danh sách
+	List items belong in a list. Fix the list's tags.	Các mục danh sách phải nằm trong một danh sách. Hãy sửa thẻ của danh sách.
+	List labels and bodies belong in a list item. Fix the list's tags.	Nhãn và nội dung danh sách phải nằm trong một mục danh sách. Hãy sửa thẻ của danh sách.
+	Lists	Danh sách
+	Load document font	Tải phông chữ của tài liệu
+	Local cross-PDF links require the desktop app	Liên kết PDF cục bộ giữa các tệp yêu cầu ứng dụng máy tính
+	Lock comment	Khóa bình luận
+	Logical Reading Order	Thứ tự đọc hợp lý
+	Low	Thấp
+	Make scans searchable, then make them smaller.	Làm cho bản quét có thể tìm kiếm được, rồi làm cho chúng nhỏ hơn.
+	Mark all	Đánh dấu tất cả
+	Mark as Confidential	Đánh dấu là Bí mật
+	Mark differences	Đánh dấu khác biệt
+	Mark figure as decorative	Đánh dấu hình là trang trí
+	Mark for redaction	Đánh dấu để xóa
+	Mark pages for redaction	Đánh dấu trang để xóa
+	Match field sizes	Khớp kích thước trường
+	Maximum	Tối đa
+	Measuring tool	Công cụ đo
+	Merged 1 file into {path}	Đã gộp 1 tệp vào {path}
+	Merged {n} files into {path}	Đã gộp {n} tệp vào {path}
+	Merging data files needs the desktop app	Việc gộp tệp dữ liệu yêu cầu ứng dụng máy tính
+	Metadata	Siêu dữ liệu
+	Midpoint	Điểm giữa
+	Minimum	Tối thiểu
+	Models	Mô hình
+	Mouse Down	Nhấn chuột
+	Mouse Enter	Chuột vào
+	Mouse Exit	Chuột ra
+	Mouse Up	Nhả chuột
+	Move bookmark	Di chuyển dấu trang
+	Move comment	Di chuyển bình luận
+	Move image	Di chuyển hình ảnh
+	Move page	Di chuyển trang
+	Move pages	Di chuyển các trang
+	Named Destinations	Đích đến có tên
+	Navigation links	Liên kết điều hướng
+	Navigation links are not repetitive	Liên kết điều hướng không lặp lại
+	Nested alternate text	Văn bản thay thế lồng nhau
+	New {tool} comments will look like this one	Các bình luận {tool} mới sẽ trông giống bình luận này
+	No PDFs, images or text files found in {folder}	Không tìm thấy PDF, hình ảnh hoặc tệp văn bản nào trong {folder}
+	No form fields were detected	Không phát hiện trường biểu mẫu nào
+	No inaccessible scripts	Không có script không thể tiếp cận
+	No links to remove	Không có liên kết nào để gỡ
+	No pages match those choices	Không có trang nào khớp với các lựa chọn đó
+	No unlinked web addresses were found in the text	Không tìm thấy địa chỉ web nào chưa được liên kết trong văn bản
+	None of those files can be made into a PDF; use PDFs, images or .txt files	Không tệp nào trong số đó có thể chuyển thành PDF; hãy dùng PDF, hình ảnh hoặc tệp .txt
+	Note	Ghi chú
+	Number every page in the footer.	Đánh số mọi trang ở chân trang.
+	Odd pages	Các trang lẻ
+	On Blur	Khi mất tiêu điểm
+	On Focus	Khi có tiêu điểm
+	On the web, open or drop an image to convert it	Trên web, hãy mở hoặc thả một hình ảnh để chuyển đổi
+	Open a web link	Mở một liên kết web
+	Opened with	Mở bằng
+	Opening the browser's print dialog…	Đang mở hộp thoại in của trình duyệt…
+	Optimization cancelled	Đã hủy tối ưu hóa
+	Optimization is already running	Việc tối ưu hóa đang chạy
+	Optimize Scanned Documents	Tối ưu hóa tài liệu quét
+	Options	Tùy chọn
+	Orange	Cam
+	Other elements alternate text	Văn bản thay thế của các phần tử khác
+	Other elements that require alternate text	Các phần tử khác cần văn bản thay thế
+	Outline	Đường bao
+	PDF producer	Ứng dụng sản xuất PDF
+	PDF version	Phiên bản PDF
+	Page Content	Nội dung trang
+	Page Range	Phạm vi trang
+	Page does not require timed responses	Trang không yêu cầu phản hồi có giới hạn thời gian
+	Page thumbnails	Hình thu nhỏ trang
+	Page will not cause screen flicker	Trang sẽ không gây nhấp nháy màn hình
+	Pages that are only pictures of text can't be read aloud or searched. Recognize text (OCR) to add a text layer.	Các trang chỉ là hình chụp của văn bản không thể được đọc to hoặc tìm kiếm. Hãy nhận dạng văn bản (OCR) để thêm lớp văn bản.
+	Pages with links, comments or fields should tab in structure order. The fix sets each page's tab order to Use Document Structure.	Các trang có liên kết, bình luận hoặc trường nên chuyển tab theo thứ tự cấu trúc. Cách sửa đặt thứ tự tab của mỗi trang thành Dùng cấu trúc tài liệu.
+	Passed	Đạt
+	Password protection will be applied when you save	Bảo vệ bằng mật khẩu sẽ được áp dụng khi bạn lưu
+	Path	Đường dẫn
+	PdfCraft is drawing without a graphics processor, so it may be slow. Updating the graphics driver may help.	PdfCraft đang vẽ mà không có bộ xử lý đồ họa, nên có thể chậm. Cập nhật trình điều khiển đồ họa có thể giúp ích.
+	People may need more time to respond. Check that nothing has a time limit.	Mọi người có thể cần thêm thời gian để phản hồi. Hãy kiểm tra rằng không có gì bị giới hạn thời gian.
+	Phone Number	Số điện thoại
+	Phone Numbers	Số điện thoại
+	Pictures need alternate text that describes them, or must be marked decorative. Add alternate text to each figure.	Hình ảnh cần văn bản thay thế mô tả chúng, hoặc phải được đánh dấu là trang trí. Hãy thêm văn bản thay thế cho mỗi hình.
+	Pink	Hồng
+	Pinned folders need the desktop app	Thư mục được ghim yêu cầu ứng dụng máy tính
+	Pinned {folder} to Home	Đã ghim {folder} vào Trang chủ
+	Place saved {what}	Đặt {what} đã lưu
+	Planned for milestone {m} — open to see what it will include	Dự kiến ở cột mốc {m} — mở để xem nó sẽ bao gồm những gì
+	Planned · {m}	Đã lên kế hoạch · {m}
+	Polygon	Đa giác
+	Polyline	Đa tuyến
+	Portable mode is off: {folder} can't be written ({error}). Settings are kept in your user folder instead.	Chế độ di động đang tắt: không thể ghi vào {folder} ({error}). Cài đặt được lưu trong thư mục người dùng của bạn thay thế.
+	Portrait pages	Các trang dọc
+	Position	Vị trí
+	PostScript XObjects aren't allowed	PostScript XObject không được phép
+	Prepare for Distribution	Chuẩn bị để phân phối
+	Preparing sheet {done} of {total} for printing…	Đang chuẩn bị tờ {done} trên {total} để in…
+	Preparing {n} sheets for printing…	Đang chuẩn bị {n} tờ để in…
+	Primary language	Ngôn ngữ chính
+	Printing	In ấn
+	Private data of other applications	Dữ liệu riêng của các ứng dụng khác
+	Public key	Khóa công khai
+	Purple	Tím
+	PushButton	PushButton
+	Radio	Radio
+	Radio Button Properties	Thuộc tính nút radio
+	Re-type Password	Nhập lại mật khẩu
+	Red	Đỏ
+	Redid {label}	Đã làm lại {label}
+	Regularity	Tính đều đặn
+	Rejected	Đã từ chối
+	Reliable character encoding is provided	Có mã hóa ký tự đáng tin cậy
+	Remove hidden information and flatten comments and form fields, so recipients see only the pages.	Gỡ thông tin ẩn và làm phẳng bình luận cùng trường biểu mẫu, để người nhận chỉ thấy các trang.
+	Remove hidden information, metadata, scripts and embedded content, and rewrite the files.	Gỡ thông tin ẩn, siêu dữ liệu, script và nội dung nhúng, rồi ghi lại các tệp.
+	Remove redaction marks	Gỡ các dấu đánh dấu
+	Remove saved {what}	Xóa {what} đã lưu
+	Removed 1 hidden item. Save to remove them from the file.	Đã gỡ 1 mục ẩn. Hãy lưu để xóa chúng khỏi tệp.
+	Removed 1 link	Đã gỡ 1 liên kết
+	Removed {n} hidden items. Save to remove them from the file.	Đã gỡ {n} mục ẩn. Hãy lưu để xóa chúng khỏi tệp.
+	Removed {n} links	Đã gỡ {n} liên kết
+	Rename bookmark	Đổi tên dấu trang
+	Rendering: hayro (bootstrap) · UI: egui · Icons: Lucide (ISC) · Fonts: Inter, JetBrains Mono, Dancing Script (OFL)	Kết xuất: hayro (khởi tạo) · Giao diện: egui · Biểu tượng: Lucide (ISC) · Phông chữ: Inter, JetBrains Mono, Dancing Script (OFL)
+	Repairs	Sửa chữa
+	Repeated navigation links should be skippable. Check links that appear on every page.	Các liên kết điều hướng lặp lại nên có thể bỏ qua được. Hãy kiểm tra các liên kết xuất hiện trên mọi trang.
+	Replace page	Thay thế trang
+	Replace pages	Thay thế trang
+	Replaced	Đã thay thế
+	Replacing images arrives on the web with image file pickers	Việc thay thế hình ảnh sẽ có trên web cùng với bộ chọn tệp hình ảnh
+	Replacing images on page {p} arrives on the web with image pickers ({i})	Việc thay thế hình ảnh trên trang {p} sẽ có trên web cùng với bộ chọn hình ảnh ({i})
+	Report Options	Tùy chọn báo cáo
+	Reset a form	Đặt lại một biểu mẫu
+	Resize comment	Đổi kích thước bình luận
+	Restrictions	Hạn chế
+	Restrictions lifted	Đã gỡ các hạn chế
+	Reverted to the last saved version	Đã hoàn nguyên về phiên bản đã lưu gần nhất
+	Right Footer Text	Văn bản chân trang phải
+	Right Header Text	Văn bản đầu trang phải
+	Rotate image	Xoay hình ảnh
+	Rotate page	Xoay trang
+	Rotate page {label} clockwise	Xoay trang {label} theo chiều kim đồng hồ
+	Rotate page {label} counterclockwise	Xoay trang {label} ngược chiều kim đồng hồ
+	Rows	Hàng
+	Run	Chạy
+	Run JavaScript	Chạy JavaScript
+	Run a JavaScript	Chạy một JavaScript
+	Run form script	Chạy script biểu mẫu
+	SHA-1 digest	Giá trị băm SHA-1
+	SHA-256 digest	Giá trị băm SHA-256
+	Sanitize	Làm sạch
+	Sanitize Documents	Làm sạch tài liệu
+	Save as PDF/A-1b	Lưu thành PDF/A-1b
+	Save as PDF/A-2b	Lưu thành PDF/A-2b
+	Save as PDF/A-3b	Lưu thành PDF/A-3b
+	Save image	Lưu hình ảnh
+	Save or revert changes before selecting another tag.	Hãy lưu hoặc hoàn nguyên các thay đổi trước khi chọn thẻ khác.
+	Saved the print-ready PDF to {path}	Đã lưu PDF sẵn sàng in vào {path}
+	Saved {name}	Đã lưu {name}
+	Saved {place}: {before} → {after} (not smaller){detail}	Đã lưu {place}: {before} → {after} (không nhỏ hơn){detail}
+	Saved {place}: {before} → {after} ({pct}% smaller){detail}	Đã lưu {place}: {before} → {after} (nhỏ hơn {pct}%){detail}
+	Saved, but reopening failed: {e}	Đã lưu, nhưng mở lại thất bại: {e}
+	Screen flicker	Nhấp nháy màn hình
+	Screen readers choose their voice from the document's language. Set it in Document Properties > Advanced > Language.	Trình đọc màn hình chọn giọng đọc dựa trên ngôn ngữ của tài liệu. Hãy đặt trong Thuộc tính tài liệu > Nâng cao > Ngôn ngữ.
+	Scripted content must be usable with a keyboard and assistive technology. Check the document's scripts.	Nội dung có script phải dùng được bằng bàn phím và công nghệ hỗ trợ. Hãy kiểm tra các script của tài liệu.
+	Scripts	Script
+	Scripts run in a sandbox without file or network access. With JavaScript off, Acrobat's standard format, validate and calculate functions still work.	Script chạy trong hộp cát không có quyền truy cập tệp hoặc mạng. Khi tắt JavaScript, các hàm định dạng, xác thực và tính toán chuẩn của Acrobat vẫn hoạt động.
+	Security method	Phương thức bảo mật
+	Security settings must allow assistive technology to read the content ("Enable text access for screen reader devices"). Change the document's security to allow it.	Cài đặt bảo mật phải cho phép công nghệ hỗ trợ đọc nội dung ("Cho phép truy cập văn bản cho thiết bị đọc màn hình"). Hãy thay đổi bảo mật của tài liệu để cho phép.
+	Security will be removed when you save	Bảo mật sẽ bị gỡ khi bạn lưu
+	Self-signed	Tự ký
+	Serial number	Số sê-ri
+	Set alternate text	Đặt văn bản thay thế
+	Set bookmark destination	Đặt đích của dấu trang
+	Set document title	Đặt tiêu đề tài liệu
+	Set status Accepted	Đặt trạng thái Đã chấp nhận
+	Set status Cancelled	Đặt trạng thái Đã hủy
+	Set status Completed	Đặt trạng thái Đã hoàn thành
+	Set status None	Đặt trạng thái Không có
+	Set status Rejected	Đặt trạng thái Đã từ chối
+	Set status Unmarked	Đặt trạng thái Chưa đánh dấu
+	Set tab order	Đặt thứ tự tab
+	Set the image of {name}	Đặt hình ảnh của {name}
+	Shadings	Chuyển sắc
+	Show a field	Hiện một trường
+	Sign with a Digital ID	Ký bằng Digital ID
+	Signed and all signatures are valid.	Đã ký và tất cả chữ ký đều hợp lệ.
+	Signed and saved to {path}	Đã ký và lưu vào {path}
+	Signer	Người ký
+	Signing time	Thời gian ký
+	Social Security Number	Số an sinh xã hội
+	Social Security Numbers	Số an sinh xã hội
+	Solid	Liền
+	Squiggly	Lượn sóng
+	Star	Ngôi sao
+	Strong	Mạnh
+	Structure Info	Thông tin cấu trúc
+	Submit a form	Gửi một biểu mẫu
+	TH and TD	TH và TD
+	TH and TD must be children of TR	TH và TD phải là con của TR
+	TR must be a child of Table, THead, TBody, or TFoot	TR phải là con của Table, THead, TBody hoặc TFoot
+	Tab order	Thứ tự tab
+	Tab order is consistent with structure order	Thứ tự tab nhất quán với thứ tự cấu trúc
+	Table cells belong in a row. Fix the table's tags.	Các ô bảng phải nằm trong một hàng. Hãy sửa thẻ của bảng.
+	Table rows belong directly in a table or its head, body or foot. Fix the table's tags.	Các hàng bảng phải nằm trực tiếp trong bảng hoặc phần đầu, thân hay chân của nó. Hãy sửa thẻ của bảng.
+	Tables	Bảng
+	Tables must contain the same number of columns in each row and rows in each column	Bảng phải có cùng số cột trong mỗi hàng và cùng số hàng trong mỗi cột
+	Tables must have a summary	Bảng phải có phần tóm tắt
+	Tables should have headers	Bảng nên có ô tiêu đề
+	Tagged PDF	PDF có gắn thẻ
+	Tagged annotations	Chú thích có gắn thẻ
+	Tagged content	Nội dung có gắn thẻ
+	Tagged form fields	Trường biểu mẫu có gắn thẻ
+	Tagged multimedia	Đa phương tiện có gắn thẻ
+	Tags give the document a logical structure that assistive technology follows. Tag the document (Automatically tag PDF).	Thẻ cung cấp cho tài liệu một cấu trúc hợp lý mà công nghệ hỗ trợ dựa theo. Hãy gắn thẻ cho tài liệu (Tự động gắn thẻ PDF).
+	Text Field Properties	Thuộc tính trường văn bản
+	Text language is specified	Đã chỉ định ngôn ngữ văn bản
+	Text must contrast enough with its background for people with low vision. Check the colours by eye or with a contrast tool.	Văn bản phải đủ tương phản với nền để người kém thị lực nhìn được. Hãy kiểm tra màu bằng mắt hoặc bằng công cụ đo độ tương phản.
+	Text recognition is already running	Việc nhận dạng văn bản đang chạy
+	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PDFCRAFT_MODELS).	Tính năng nhận dạng văn bản chưa được cài đặt: thiếu các mô hình (hãy chạy `cargo xtask models`, hoặc đặt PDFCRAFT_MODELS).
+	That didn't work: an internal error stopped it ({m}).	Không thành công: một lỗi nội bộ đã dừng nó ({m}).
+	That didn't work: an internal error stopped it ({m}). Your documents are unchanged.	Không thành công: một lỗi nội bộ đã dừng nó ({m}). Các tài liệu của bạn không thay đổi.
+	The Keychain's digital IDs couldn't be listed: {e}	Không thể liệt kê các Digital ID của Keychain: {e}
+	The Windows store's digital IDs couldn't be listed: {e}	Không thể liệt kê các Digital ID của kho Windows: {e}
+	The clipboard has no image or text	Bảng tạm không có hình ảnh hoặc văn bản
+	The document changed while you were choosing a file, so nothing was changed.	Tài liệu đã thay đổi trong lúc bạn chọn tệp, nên không có gì bị thay đổi.
+	The document changed while you were editing field properties.	Tài liệu đã thay đổi trong lúc bạn chỉnh sửa thuộc tính trường.
+	The document has additional actions (/AA)	Tài liệu có các hành động bổ sung (/AA)
+	The document has document-level JavaScript	Tài liệu có JavaScript cấp tài liệu
+	The document has no XMP metadata	Tài liệu không có siêu dữ liệu XMP
+	The document is encrypted	Tài liệu đã được mã hóa
+	The document is no longer open.	Tài liệu không còn được mở.
+	The document was closed before it could be saved.	Tài liệu đã bị đóng trước khi kịp lưu.
+	The document's security settings don't allow filling in form fields	Cài đặt bảo mật của tài liệu không cho phép điền các trường biểu mẫu
+	The field properties could not be changed.	Không thể thay đổi thuộc tính của trường.
+	The field properties dialog is no longer open.	Hộp thoại thuộc tính trường không còn được mở.
+	The form asks to be submitted to {u}; PdfCraft doesn't send form data. Save the document to keep your entries.	Biểu mẫu yêu cầu được gửi đến {u}; PdfCraft không gửi dữ liệu biểu mẫu. Hãy lưu tài liệu để giữ các mục bạn đã nhập.
+	The form asks viewers to make appearances (NeedAppearances)	Biểu mẫu yêu cầu trình xem tạo diện mạo (NeedAppearances)
+	The linked PDF opened, but its named destination was not applied.	PDF được liên kết đã mở, nhưng đích đến có tên của nó chưa được áp dụng.
+	The linked PDF opened, but its page destination was out of range.	PDF được liên kết đã mở, nhưng đích đến trang của nó nằm ngoài phạm vi.
+	The operation failed.	Thao tác thất bại.
+	The pages were extracted but not deleted, because the document changed while you were choosing a folder.	Các trang đã được trích xuất nhưng chưa bị xóa, vì tài liệu đã thay đổi trong lúc bạn chọn thư mục.
+	The passwords don't match.	Các mật khẩu không khớp.
+	The selected area has been copied ({w} × {h} pixels)	Đã sao chép vùng đã chọn ({w} × {h} điểm ảnh)
+	The selected fields could not be found. Select them again.	Không tìm thấy các trường đã chọn. Hãy chọn lại.
+	The standard fonts can't draw “{c}” ({code}). Only Western European characters can be added as text for now.	Phông chữ chuẩn không thể vẽ “{c}” ({code}). Hiện chỉ có thể thêm các ký tự Tây Âu làm văn bản.
+	The title in the metadata and the document information differ	Tiêu đề trong siêu dữ liệu và trong thông tin tài liệu khác nhau
+	The window should show a meaningful title rather than the file name. Set a title and Initial View > Show: Document Title.	Cửa sổ nên hiển thị một tiêu đề có ý nghĩa thay vì tên tệp. Hãy đặt tiêu đề và Chế độ xem ban đầu > Hiện: Tiêu đề tài liệu.
+	There are no redaction marks to apply	Không có dấu đánh dấu xóa nào để áp dụng
+	This PDF uses the unsupported {s} action.	PDF này dùng hành động {s} chưa được hỗ trợ.
+	This compatibility level supports only plain ASCII passwords.	Mức tương thích này chỉ hỗ trợ mật khẩu ASCII thuần.
+	This document can't be checked: it couldn't be read for editing	Không thể kiểm tra tài liệu này: không đọc được để chỉnh sửa
+	This document has no attachments.	Tài liệu này không có tệp đính kèm.
+	This document has no bookmarks.	Tài liệu này không có dấu trang.
+	This document has no form fields.	Tài liệu này không có trường biểu mẫu.
+	This document has no layers.	Tài liệu này không có lớp.
+	This file is already as small as it can be made ({size}). No copy was saved.	Tệp này đã nhỏ hết mức có thể ({size}). Không có bản sao nào được lưu.
+	This form also contains XFA data, which PdfCraft doesn't read yet. You can fill its fields, but Acrobat may show the XFA values instead.	Biểu mẫu này còn chứa dữ liệu XFA mà PdfCraft chưa đọc được. Bạn có thể điền các trường của nó, nhưng Acrobat có thể hiển thị giá trị XFA thay thế.
+	Thumbnails	Hình thu nhỏ
+	Timed responses	Phản hồi có giới hạn thời gian
+	Type Password	Nhập mật khẩu
+	Type a password.	Nhập một mật khẩu.
+	Typewriter	Máy đánh chữ
+	Unchecked	Chưa đánh dấu chọn
+	Undid {label}	Đã hoàn tác {label}
+	Unlock comment	Mở khóa bình luận
+	Unlocked {n} of {m} files	Đã mở khóa {n} trên {m} tệp
+	Update background	Cập nhật nền
+	Update header & footer	Cập nhật đầu trang & chân trang
+	Update watermark	Cập nhật hình mờ
+	Use {what}	Dùng {what}
+	Valid	Hợp lệ
+	Valid from	Có hiệu lực từ
+	Valid to	Có hiệu lực đến
+	Validate	Xác thực
+	Validity ends	Hiệu lực kết thúc
+	Validity starts	Hiệu lực bắt đầu
+	Vertically	Theo chiều dọc
+	Video, sound and rich media must be tagged to be announced. Tag the multimedia annotations.	Video, âm thanh và đa phương tiện phong phú phải được gắn thẻ để được đọc to. Hãy gắn thẻ cho các chú thích đa phương tiện.
+	Viewing	Xem
+	Weak	Yếu
+	White on black	Trắng trên nền đen
+	Wrote 1 file to {dir}	Đã ghi 1 tệp vào {dir}
+	Wrote {n} files to {dir}	Đã ghi {n} tệp vào {dir}
+	X Object Forms	Đối tượng biểu mẫu X
+	Yellow	Vàng
+	Yellow on black	Vàng trên nền đen
+	You can pin up to {n} folders. Unpin one first.	Bạn có thể ghim tối đa {n} thư mục. Hãy bỏ ghim một thư mục trước.
+	Your name	Tên của bạn
+	Zip Code	Mã bưu chính
+	Zip Code + 4	Mã bưu chính + 4
+	`{command}` {when}	`{command}` {when}
+	a bookmark cannot be moved inside itself	không thể di chuyển dấu trang vào bên trong chính nó
+	a document must keep at least one page	tài liệu phải giữ ít nhất một trang
+	average	trung bình
+	maximum	tối đa
+	minimum	tối thiểu
+	no such document	không có tài liệu như vậy
+	nothing in the file matches this document	không có gì trong tệp khớp với tài liệu này
+	nothing to redo	không có gì để làm lại
+	nothing to undo	không có gì để hoàn tác
+	pages	trang
+	product (x)	tích (x)
+	sum (+)	tổng (+)
+	the document has no form fields	tài liệu không có trường biểu mẫu
+	the document has no page tree	tài liệu không có cây trang
+	the document has no tags	tài liệu không có thẻ
+	the document is protected by a password	tài liệu được bảo vệ bằng mật khẩu
+	the image is empty	hình ảnh trống
+	the password is incorrect	mật khẩu không đúng
+	the text recognition models are not installed (reinstall PdfCraft, or set PDFCRAFT_MODELS to the folder that holds them)	các mô hình nhận dạng văn bản chưa được cài đặt (hãy cài đặt lại PdfCraft, hoặc đặt PDFCRAFT_MODELS thành thư mục chứa chúng)
+	the title must not be empty	tiêu đề không được để trống
+	there are no pages to print	không có trang nào để in
+	there are no redaction marks to apply	không có dấu đánh dấu xóa nào để áp dụng
+	this document is signed: rewriting it would invalidate its signatures (save it incrementally instead)	tài liệu này đã được ký: việc ghi lại nó sẽ làm mất hiệu lực các chữ ký của nó (hãy lưu tăng dần thay vào đó)
+	this file isn't XFDF, FDF, XML or text form data	tệp này không phải dữ liệu biểu mẫu XFDF, FDF, XML hoặc văn bản
+	{0}: {1}	{0}: {1}
+	{field}: {e}	{field}: {e}
+	{file} is too large for a stamp (at most {n} MB)	{file} quá lớn để làm con dấu (tối đa {n} MB)
+	{folder} is already pinned to Home	{folder} đã được ghim vào Trang chủ
+	{label} failed: {e}	{label} thất bại: {e}
+	{name} has no action	{name} không có hành động
+	{name} is too large for a word list (at most 1 MB).	{name} quá lớn để làm danh sách từ (tối đa 1 MB).
+	{name} submits the form to {url}; PdfCraft doesn't send form data. Save the document to keep your entries.	{name} gửi biểu mẫu đến {url}; PdfCraft không gửi dữ liệu biểu mẫu. Hãy lưu tài liệu để giữ các mục bạn đã nhập.
+	{name}: choosing images arrives on the web with file pickers for images	{name}: việc chọn hình ảnh sẽ có trên web cùng với bộ chọn tệp hình ảnh
+	{name}: the {other} action isn't supported yet	{name}: hành động {other} chưa được hỗ trợ
+	{who} in this document tried to open an address PdfCraft won't open: {e}.	{who} trong tài liệu này đã cố mở một địa chỉ mà PdfCraft sẽ không mở: {e}.
+	{who} in this document tried to open an address PdfCraft won't open: {e}. Only web (http, https) and email (mailto) links open from documents.	{who} trong tài liệu này đã cố mở một địa chỉ mà PdfCraft sẽ không mở: {e}. Chỉ các liên kết web (http, https) và email (mailto) mới được mở từ tài liệu.
+animation effects	Off	Tắt
+animation effects	On	Bật
+	View more	Xem thêm
+	View less	Xem ít hơn
+	Only continue if you trust this document. An address can carry information from the document, such as what you typed into its form.	Chỉ tiếp tục nếu bạn tin cậy tài liệu này. Một địa chỉ có thể mang thông tin từ tài liệu, chẳng hạn những gì bạn đã nhập vào biểu mẫu của nó.
+	Print single-sided. Keep the sheets in order, cut at the marks, then stack the piles left to right, top to bottom.	In một mặt. Giữ các tờ theo thứ tự, cắt theo các dấu, rồi xếp các chồng từ trái sang phải, từ trên xuống dưới.
+	Sign a sheet of white paper and take a photo of it in bright, even light (use the flash). Choose the photo or drop it here: PdfCraft finds the signature and removes the paper.	Hãy ký lên một tờ giấy trắng và chụp ảnh dưới ánh sáng sáng, đều (dùng đèn flash). Chọn ảnh hoặc thả vào đây: PdfCraft sẽ tìm chữ ký và loại bỏ phần giấy.
+	This field's font can't draw “{c}” ({code}), so PdfCraft shows ? in its place. The value is saved, and other PDF viewers redraw the field from it.	Phông chữ của trường này không thể vẽ “{c}” ({code}), nên PdfCraft hiển thị ? thay thế. Giá trị vẫn được lưu, và các trình xem PDF khác vẽ lại trường từ giá trị đó.
+	{chars} can't be written into the PDF yet: Fill & Sign text is Western European only. Pick a numeric format such as dd.mm.yyyy.	Chưa thể ghi {chars} vào PDF: văn bản của Điền & Ký chỉ hỗ trợ ký tự Tây Âu. Hãy chọn định dạng số như dd.mm.yyyy.
+	January	Tháng 1
+	February	Tháng 2
+	March	Tháng 3
+	April	Tháng 4
+	May	Tháng 5
+	June	Tháng 6
+	July	Tháng 7
+	August	Tháng 8
+	September	Tháng 9
+	October	Tháng 10
+	November	Tháng 11
+	December	Tháng 12
+calendar date	January	tháng 1
+calendar date	February	tháng 2
+calendar date	March	tháng 3
+calendar date	April	tháng 4
+calendar date	May	tháng 5
+calendar date	June	tháng 6
+calendar date	July	tháng 7
+calendar date	August	tháng 8
+calendar date	September	tháng 9
+calendar date	October	tháng 10
+calendar date	November	tháng 11
+calendar date	December	tháng 12
+calendar weekday	Su	CN
+calendar weekday	Mo	T2
+calendar weekday	Tu	T3
+calendar weekday	We	T4
+calendar weekday	Th	T5
+calendar weekday	Fr	T6
+calendar weekday	Sa	T7
+signature pad	Type	Nhập chữ
+scroll speed	Slow	Chậm
+scroll speed	Normal	Bình thường
+scroll speed	Fast	Nhanh
+certificate	Subject	Chủ thể chứng chỉ
+certificate	Issued to	Cấp cho
+certificate	Issued by	Cấp bởi
+certificate	Valid from	Có hiệu lực từ
+certificate	Valid to	Có hiệu lực đến
+certificate	Intended usage	Mục đích sử dụng
+certificate	Version	Phiên bản
+certificate	Serial number	Số sê-ri
+certificate	Issuer	Tổ chức cấp
+certificate	Validity starts	Hiệu lực bắt đầu
+certificate	Validity ends	Hiệu lực kết thúc
+certificate	Public key	Khóa công khai
+certificate	Basic constraints	Ràng buộc cơ bản
+certificate	Key usage	Mục đích sử dụng khóa
+certificate	Self-signed	Tự ký
+certificate	SHA-1 digest	Giá trị băm SHA-1
+certificate	SHA-256 digest	Giá trị băm SHA-256
+	Certificate authority	Tổ chức chứng thực
+	End entity	Thực thể cuối
+	Float panel	Cho bảng nổi
+	Move to group	Chuyển vào nhóm
+	Panels	Bảng
+	Resize panel window	Đổi kích thước cửa sổ bảng
+	Resize panels	Đổi kích thước các bảng
+	Grab bag	Tổng hợp
+	No contributor data was built into this copy.	Bản sao này không có dữ liệu người đóng góp.
+	No model credits were built into this copy.	Bản sao này không có ghi công mô hình.
+	Reverse the order	Đảo thứ tự
+	Show	Hiện
+	Sort	Sắp xếp
+	Table	Bảng
+	The field {name} no longer exists.	Trường {name} không còn tồn tại.
+	{n} contributors · {c} commits	{n} người đóng góp · {c} commit
+	Username	Tên người dùng
+	Display name	Tên hiển thị
+	Real name	Tên thật
+	Name (A–Z)	Tên (A–Z)
+	Merged PRs	PR đã gộp
+	PRs	PR
+	Commits	Commit
+	Lines added	Dòng thêm
+	+LOC	+LOC
+	Lines deleted	Dòng xóa
+	−LOC	−LOC
+	Line delta	Chênh lệch dòng
+	ΔLOC	ΔLOC
+	Binary assets added	Tài nguyên nhị phân đã thêm
+	+Bin	+Bin
+	Binary assets removed	Tài nguyên nhị phân đã xóa
+	−Bin	−Bin
+	First commit	Commit đầu tiên
+	First	Đầu tiên
+	Last commit	Commit cuối cùng
+	Last	Cuối cùng
+	Company	Công ty
+	Model	Mô hình
+	Version	Phiên bản
+	% of all commits	% tổng số commit
+	Lines +/−	Dòng +/−
+	@{login}: {prs} PRs, {commits} commits, +{added} / −{deleted} lines (Δ {delta}), +{bin_added} / −{bin_deleted} binary assets, {first} – {last}	@{login}: {prs} PR, {commits} commit, +{added} / −{deleted} dòng (Δ {delta}), +{bin_added} / −{bin_deleted} tài nguyên nhị phân, {first} – {last}
+	of {name}	của {name}
+	of {pages}	trên {pages}
+	on page {label}	trên trang {label}
+	open to see what it will include	mở để xem nó sẽ bao gồm những gì
+	ships in milestone {m}	sẽ phát hành ở cột mốc {m}
+	signature	chữ ký
+	sorted ascending	sắp xếp tăng dần
+	sorted descending	sắp xếp giảm dần
+	to	đến
+	to {n}	đến {n}
+	watermark	hình mờ
+	yyyy or yy year · m or mm month · mmm or mmmm month name · d or dd day · ddd or dddd weekday. H, h, M, s and t are time letters and can't be used on their own: put {escape} before a letter to show it as is.	yyyy hoặc yy năm · m hoặc mm tháng · mmm hoặc mmmm tên tháng · d hoặc dd ngày · ddd hoặc dddd thứ trong tuần. H, h, M, s và t là các chữ cái chỉ thời gian và không thể dùng riêng lẻ: hãy đặt {escape} trước một chữ cái để hiển thị nguyên văn.
+	{c} of {n}{more}	{c} trên {n}{more}
+	{dpi} pixels/inch	{dpi} điểm ảnh/inch
+	{kind} Properties	Thuộc tính {kind}
+	{kind} field	Trường {kind}
+	{kind} · page {p}	{kind} · trang {p}
+	{kind} — click to show it on the page	{kind} — bấm để hiển thị nó trên trang
+	{k} of {n}	{k} trên {n}
+	{label} (1 issue)	{label} (1 vấn đề)
+	{label} ({n} issues)	{label} ({n} vấn đề)
+	{month} {day}, {y}	{day} {month}, {y}
+	{month} {y}	{month} {y}
+	{msg} to {dir}	{msg} vào {dir}
+	{name} (default)	{name} (mặc định)
+	{name} can't be combined: {why}	Không thể kết hợp {name}: {why}
+	{name} is read-only	{name} chỉ đọc
+	{name} — unsaved changes	{name} — có thay đổi chưa lưu
+	{n} days ago	{n} ngày trước
+	{n} differences found	Tìm thấy {n} điểm khác biệt
+	{n} fields selected	Đã chọn {n} trường
+	{n} files	{n} tệp
+	{n} files done	{n} tệp đã xong
+	{n} files need attention	{n} tệp cần chú ý
+	{n} h ago	{n} giờ trước
+	{n} instances	{n} lần xuất hiện
+	{n} issues	{n} vấn đề
+	{n} marks	{n} dấu
+	{n} match(es) marked for redaction.	Đã đánh dấu {n} kết quả khớp để xóa.
+	{n} measurements use an unsupported format and are left out.	{n} phép đo dùng định dạng không được hỗ trợ và bị bỏ qua.
+	{n} min ago	{n} phút trước
+	{n} pages	{n} trang
+	{n} pages selected.	Đã chọn {n} trang.
+	{n} selected	Đã chọn {n}
+	{n} tags	{n} thẻ
+	{n} word(s) or phrase(s)	{n} từ hoặc cụm từ
+	{n} {kind}	{n} {kind}
+	{rule} - {status}	{rule} - {status}
+	{s} action	Hành động {s}
+	{verb} Background	{verb} nền
+	{verb} Header and Footer	{verb} đầu trang và chân trang
+	{verb} Watermark	{verb} hình mờ
+	{verb} as "{name}"	{verb} thành "{name}"
+	{who} in this document wants to open this address in your browser:	{who} trong tài liệu này muốn mở địa chỉ này trong trình duyệt của bạn:
+	{who} in this document wants to open your email app with this address:	{who} trong tài liệu này muốn mở ứng dụng email của bạn với địa chỉ này:
+	{words} on {pages}	{words} trên {pages}
+	— (protection is applied when you save)	— (việc bảo vệ được áp dụng khi bạn lưu)
+	“{name}” has security restrictions. Enter its permissions password to lift them.	“{name}” có các hạn chế bảo mật. Hãy nhập mật khẩu quyền hạn của nó để gỡ bỏ chúng.
+	“{name}” is protected. Enter a password to open it.	“{name}” được bảo vệ. Hãy nhập mật khẩu để mở.
+@plural	{n} page|{n} pages	{n} trang
+@plural	{n} file|{n} files	{n} tệp
+@plural	{n} field|{n} fields	{n} trường
+@plural	{n} comment|{n} comments	{n} bình luận
+@plural	{n} result|{n} results	{n} kết quả
+@plural	{n} field name collides with earlier files and will be renamed: {list}|{n} field names collide with earlier files and will be renamed: {list}	{n} tên trường trùng với các tệp trước và sẽ được đổi tên: {list}
+@plural	{n} object selected|{n} objects selected	Đã chọn {n} đối tượng
+@plural	Downloaded {n} PDF|Downloaded {n} PDFs	Đã tải xuống {n} PDF
+key	Ctrl	Ctrl
+key	Shift	Shift
+key	Delete	Delete
+key	Esc	Esc
+key	Home	Home
+key	End	End
+key	Space	Space
+	Move tag earlier	Chuyển thẻ lên trước
+	Move tag later	Chuyển thẻ ra sau
+	Tag form fields	Gắn thẻ các trường biểu mẫu
+	Only allow this if you trust the source document.	Chỉ cho phép nếu bạn tin tưởng tài liệu nguồn.
+	Open this local PDF?	Mở PDF cục bộ này?
+	This document is trying to open a local file:	Tài liệu này đang cố mở một tệp cục bộ:
+	Remove "{name}" from this list? The file itself is not deleted.	Gỡ "{name}" khỏi danh sách này? Bản thân tệp không bị xóa.
+	Minimize	Thu nhỏ
+	Maximize	Phóng to
+	Restore	Khôi phục
+	Use system title bar	Dùng thanh tiêu đề hệ thống
+	Show a basic title bar for the window buttons instead of the tab strip. GNOME doesn't draw title bars for apps, so this one doesn't follow its theme.	Hiện thanh tiêu đề đơn giản cho các nút cửa sổ thay vì dải tab. GNOME không vẽ thanh tiêu đề cho ứng dụng, nên thanh này không theo chủ đề của nó.
+	Turn upside down (180°)	Lật ngược (180°)
+	4 x 6 in label (101.6 x 152.4 mm)	Nhãn 4 × 6 in (101,6 × 152,4 mm)
+	Cuts each page to its printed area, turns it upright and fits it to the sheet without stretching. One label per sheet.	Cắt mỗi trang theo vùng được in, xoay thẳng và vừa với tờ giấy mà không kéo giãn. Mỗi tờ một nhãn.
+	Find untagged content	Tìm nội dung chưa được gắn thẻ
+	No untagged content was found.	Không tìm thấy nội dung nào chưa được gắn thẻ.
+	Found {n} untagged content problems.	Đã tìm thấy {n} vấn đề về nội dung chưa được gắn thẻ.
+	Cut Image	Cắt hình ảnh
+	Redact Image	Xóa nội dung nhạy cảm của hình ảnh
+	Create Link…	Tạo liên kết…
+	Recognize Text…	Nhận dạng văn bản…
+
+# AI-assisted additions for concurrently merged UI features (2026-10-15).
+# These additions have not had separate native-speaker review.
+	Characters	Ký tự
+	Characters without spaces	Ký tự không tính dấu cách
+	Counting words… {n} pages read	Đang đếm từ… đã đọc {n} trang
+	Crop Image	Xén hình ảnh
+	Current page only	Chỉ trang hiện tại
+	DN: 	Tên phân biệt: 
+	Date: 	Ngày: 
+	Digitally signed by	Được ký số bởi
+	Exclude image/OCR text	Loại trừ văn bản trong ảnh/OCR
+	Exclude tagged code blocks	Loại trừ khối mã đã gắn thẻ
+	Exclude tagged tables	Loại trừ bảng đã gắn thẻ
+	Exclusions use PDF tags. Untagged tables and code remain included. Image exclusion also removes invisible text.	Việc loại trừ dựa trên thẻ PDF. Bảng và mã chưa gắn thẻ vẫn được tính. Loại trừ hình ảnh cũng loại bỏ văn bản ẩn.
+	Fill colour:	Màu tô:
+	Font size	Cỡ chữ
+	Full Screen	Toàn màn hình
+	Location: 	Vị trí: 
+	Make properties default	Đặt thuộc tính làm mặc định
+	Mark as artifact	Đánh dấu là thành phần trang trí
+	Mark content as artifact	Đánh dấu nội dung là thành phần trang trí
+	Merge image fragments	Gộp các mảnh hình ảnh
+	Mobile	Di động
+	New file only	Chỉ tệp mới
+	New file: {name}	Tệp mới: {name}
+	Next tab	Thẻ tiếp theo
+	No printers were found. Check that the printer is installed and the print spooler is running, then open Print again.	Không tìm thấy máy in. Kiểm tra xem máy in đã được cài đặt và dịch vụ hàng đợi in đang chạy, rồi mở lại hộp thoại In.
+	Not now	Để sau
+	Old file: {name}	Tệp cũ: {name}
+	Opacity:	Độ mờ:
+	Open in Full Screen mode?	Mở ở chế độ toàn màn hình?
+	Optimizing… merging image fragments	Đang tối ưu hóa… gộp các mảnh hình ảnh
+	Outline colour:	Màu đường viền:
+	Page properties	Thuộc tính trang
+	Pages counted	Số trang đã đếm
+	Pages selected	Số trang đã chọn
+	Previous tab	Thẻ trước
+	Print as image	In dưới dạng hình ảnh
+	Reason: 	Lý do: 
+	Redaction mark appearance	Hình thức dấu xóa nội dung nhạy cảm
+	Remove Crop	Bỏ xén
+	Remove this leaf tag from reading order and mark its direct content as an artifact	Xóa thẻ lá này khỏi thứ tự đọc và đánh dấu nội dung trực tiếp của nó là thành phần trang trí
+	Resolution:	Độ phân giải:
+	Save anyway	Vẫn lưu
+	Save over the changed file?	Lưu đè lên tệp đã thay đổi?
+	Scroll speed (mouse wheel and arrow keys)	Tốc độ cuộn (con lăn chuột và phím mũi tên)
+	Set page transitions	Đặt hiệu ứng chuyển trang
+	Shown while the pointer is over a mark.	Hiển thị khi con trỏ nằm trên một dấu.
+	Side by side	Cạnh nhau
+	Some content could not be classified safely and was kept in the count.	Một số nội dung không thể được phân loại an toàn và vẫn được tính.
+	Some pages contain no countable text. Scanned images need OCR first.	Một số trang không có văn bản có thể đếm. Ảnh quét cần được nhận dạng văn bản (OCR) trước.
+	Standard	Tiêu chuẩn
+	The labels are in English: the signature's font can't draw them in this language.	Các nhãn được hiển thị bằng tiếng Anh: phông chữ của chữ ký không thể hiển thị chúng bằng ngôn ngữ này.
+	The password must have at least 8 characters.	Mật khẩu phải có ít nhất 8 ký tự.
+	This document asks to open in Full Screen mode: the page fills the screen and nothing else shows. Press Esc at any time to leave it.	Tài liệu này yêu cầu mở ở chế độ toàn màn hình: trang chiếm toàn bộ màn hình và không hiển thị nội dung nào khác. Nhấn Esc bất kỳ lúc nào để thoát.
+	This file changed on disk. Reload shows the new version and drops your unsaved changes; Save replaces it with this version.	Tệp này đã thay đổi trên đĩa. Tải lại sẽ hiển thị phiên bản mới và bỏ các thay đổi chưa lưu của bạn; Lưu sẽ thay thế tệp bằng phiên bản này.
+	Trim the picture with its handles; Enter or Done applies	Xén hình bằng các tay nắm; nhấn Enter hoặc Xong để áp dụng
+	Use it when a printer skips text, shading or transparency. The print is no longer searchable text; with Print in grayscale, the pictures are grey.	Dùng khi máy in bỏ sót văn bản, chuyển sắc hoặc độ trong suốt. Bản in không còn chứa văn bản có thể tìm kiếm; với In thang độ xám, hình ảnh sẽ có màu xám.
+	What takes up the space in this file, by kind of content.	Dung lượng mà từng loại nội dung chiếm trong tệp này.
+	Word count	Số từ
+	Word counting stopped unexpectedly.	Việc đếm từ đã dừng đột ngột.
+	Word count…	Đếm từ…
+	Words	Từ
+	“{name}” changed on disk after it was opened or last saved. Saving now replaces that newer version with this one.	“{name}” đã thay đổi trên đĩa sau khi được mở hoặc lưu lần cuối. Lưu lúc này sẽ thay thế phiên bản mới hơn đó bằng phiên bản này.
+@id	file.word_count	Đếm từ…
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index d13078e7a..3274ff473 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -63,6 +63,7 @@
 	Auto follows the system's text size. Pages always render at the display's full resolution.	“自动”会跟随系统的文字大小。页面始终以显示器的完整分辨率渲染。
 	Identity	身份
 	Name on new comments	新注释的作者姓名
+	Hide hover previews for highlights without comment text	隐藏无评论文字的高亮的悬停预览
 	Open…	打开…
 	Open Recent	打开最近的文件
 	Clear Recent Files	清除最近的文件
@@ -263,6 +264,7 @@
 	Remove unused objects and merge identical ones	删除未使用的对象并合并相同的对象
 	Audit space usage…	审计空间使用情况…
 	Space Audit	空间审计
+	What takes up the space in this file, by kind of content.	此文件的空间被哪些内容占用，按内容类型列出。
 	Bytes	字节
 	Content Streams	内容流
 	X Object Forms	XObject 表单
@@ -537,6 +539,12 @@
 	Windows store  ·  	Windows 证书存储 · 
 	Issued by: 	颁发者：
 	, Expires: 	，有效期至：
+	Digitally signed by	数字签名者
+	DN: 	DN：
+	Reason: 	原因：
+	Location: 	位置：
+	Date: 	日期：
+	The labels are in English: the signature's font can't draw them in this language.	签名所用的字体无法显示此语言的标签，因此标签使用英文。
 	No digital IDs yet.	尚无数字 ID。
 	Configure New Digital ID	配置新数字 ID
 	Remove "{name}" from this list? The file itself is not deleted.	从此列表中移除“{name}”？文件本身不会被删除。
@@ -835,6 +843,7 @@
 	Redaction code:	密文代码：
 	Font:	字体：
 	Font size:	字号：
+	Font size	字号
 	Auto-size text to fit redaction region	自动调整文本大小以适应密文区域
 	Font colour:	字体颜色：
 	Repeat overlay text	重复覆盖文本
@@ -980,6 +989,7 @@
 	Replace	替换
 	Split	拆分
 	Set page boxes	设置页面框
+	Set page transitions	设置页面切换效果
 	Page labels	页面标签
 	Page transitions	页面切换
 	Sticky note	附注
@@ -1234,6 +1244,7 @@
 	Copy text	复制文本
 	Properties…	属性…
 	Make Current Properties Default	将当前属性设为默认
+	Make Properties Default	将属性设为默认
 	More options	更多选项
 	Sort by	排序方式
 	Author	作者
@@ -1366,6 +1377,9 @@
 	Sort comments by:	注释排序依据：
 	Create PDF Comment Summary	创建 PDF 注释摘要
 	Revert to the previously saved version of “{name}”? Changes since then can't be undone afterwards.	还原到“{name}”的上次保存版本？此后的更改将无法撤销。
+	Save over the changed file?	覆盖已更改的文件？
+	“{name}” changed on disk after it was opened or last saved. Saving now replaces that newer version with this one.	“{name}”在打开或上次保存后已在磁盘上更改。现在保存会用此版本替换那个较新的版本。
+	Save anyway	仍然保存
 	Number pages	页面编号
 	Style	样式
 	None (prefix only)	无（仅前缀）
@@ -1571,6 +1585,8 @@
 	Sent to {printer}	已发送到{printer}
 	Sent to {printer}: {msg}	已发送到{printer}：{msg}
 	Looking for printers…	正在查找打印机…
+	Sending sheet {s} of {n} to {printer}…	正在将第 {s} 张（共 {n} 张）发送到{printer}…
+	No printers were found. Check that the printer is installed and the print spooler is running, then open Print again.	未找到打印机。请检查打印机是否已安装、打印后台处理程序是否在运行，然后重新打开“打印”。
 	Sending to {printer}…	正在发送到{printer}…
 	Choose a folder for the searchable files	选择可搜索文件的文件夹
 	Files are combined from top to bottom. Leave Pages empty to take every page.	文件按从上到下的顺序合并。页码留空表示取全部页面。
@@ -2086,7 +2102,7 @@
 	Used when a PDF doesn't ask for a layout or zoom. Continuous scrolling never snaps between pages.	PDF 未指定布局或缩放时使用。连续滚动时页面不会逐页吸附。
 	Reopen the files that were open when PdfCraft last closed	重新打开上次关闭 PdfCraft 时打开的文件
 	Reload documents when their files change on disk	文件在磁盘上更改时重新加载对应的文档
-	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	此文件已在磁盘上更改。请重新加载以查看新版本；未保存的更改将会丢失。
+	This file changed on disk. Reload shows the new version and drops your unsaved changes; Save replaces it with this version.	此文件已在磁盘上更改。“重新加载”显示新版本并放弃未保存的更改；“保存”则用此版本替换它。
 	Reload	重新加载
 	Couldn't reload {name}: {e}	无法重新加载{name}：{e}
 	Write this email?	是否撰写此邮件？
@@ -2208,6 +2224,8 @@ key	Space	空格
 	Switch to List view to change the pages it takes.	切换到列表视图以更改要使用的页面。
 	Expand all	全部展开
 	Collapse all	全部折叠
+	Collapse all pages	折叠所有页面
+	Expand all pages	展开所有页面
 	Remove page	删除页面
 	Remove {n} pages	删除 {n} 页
 
@@ -2231,7 +2249,7 @@ key	Space	空格
 	Rotate page {label} counterclockwise	逆时针旋转页面 {label}
 	Rotate page {label} clockwise	顺时针旋转页面 {label}
 	Delete page {label}	删除页面 {label}
-	Mouse wheel scroll speed	鼠标滚轮滚动速度
+	Scroll speed (mouse wheel and arrow keys)	滚动速度（鼠标滚轮和方向键）
 scroll speed	Slow	慢
 scroll speed	Normal	正常
 scroll speed	Fast	快
@@ -2305,6 +2323,10 @@ animation effects	Off	关
 	The linked PDF opened, but its named destination was not applied.	已打开链接的 PDF，但未应用其命名目标。
 	The linked PDF opened, but its page destination was out of range.	已打开链接的 PDF，但其页面目标超出范围。
 	Local cross-PDF links require the desktop app	PDF 之间的本地链接需要桌面应用
+	Cut Image	剪切图像
+	Redact Image	密文图像
+	Create Link…	创建链接…
+	Recognize Text…	识别文本…
 	Minimize	最小化
 	Maximize	最大化
 	Restore	还原
@@ -2314,7 +2336,59 @@ animation effects	Off	关
 # Absolute local GoToR confirmation (#1364).
 	Allow	允许
 	Only allow this if you trust the source document.	仅在您信任源文档时才允许此操作。
+	Open in Full Screen mode?	以全屏模式打开？
+	This document asks to open in Full Screen mode: the page fills the screen and nothing else shows. Press Esc at any time to leave it.	此文档要求以全屏模式打开：页面充满屏幕，不显示其他内容。随时按 Esc 即可退出。
+	Full Screen	全屏
+	Not now	暂不
 	Open this local PDF?	是否打开此本地 PDF？
 	This document is trying to open a local file:	此文档正尝试打开本地文件：
 	Move tag earlier	将标签前移
 	Move tag later	将标签后移
+	Turn upside down (180°)	上下颠倒 (180°)
+	4 x 6 in label (101.6 x 152.4 mm)	4 × 6 英寸标签 (101.6 × 152.4 毫米)
+	Cuts each page to its printed area, turns it upright and fits it to the sheet without stretching. One label per sheet.	将每页裁切到其打印区域，转正后不拉伸地适合纸张。每张纸一个标签。
+	Find untagged content	查找未标记的内容
+	No untagged content was found.	未找到未标记的内容。
+	Found {n} untagged content problems.	发现 {n} 个未标记内容问题。
+	Tag form fields	标记表单字段
+	Mark as artifact	标记为工件
+	Remove this leaf tag from reading order and mark its direct content as an artifact	从阅读顺序中移除此叶标签，并将其直接内容标记为工件
+	Mark content as artifact	将内容标记为工件
+	Word count	字词统计
+	Current page only	仅当前页
+	Exclude tagged tables	排除带标签的表格
+	Exclude tagged code blocks	排除带标签的代码块
+	Exclude image/OCR text	排除图像/OCR文本
+	Exclusions use PDF tags. Untagged tables and code remain included. Image exclusion also removes invisible text.	排除规则使用PDF标签。无标签的表格和代码仍计入统计。排除图像时也会排除不可见文本。
+	Words	词数
+	Characters	字符数
+	Characters without spaces	不含空白的字符数
+	Pages counted	已统计页数
+	Some pages contain no countable text. Scanned images need OCR first.	部分页面没有可统计的文本。扫描图像需要先进行OCR识别。
+	Some content could not be classified safely and was kept in the count.	部分内容无法可靠分类，已保留在统计中。
+	Counting words… {n} pages read	正在统计字词… 已读取{n}页
+	Word counting stopped unexpectedly.	字词统计意外停止。
+	Word count…	字词统计…
+@id	file.word_count	字词统计…
+	Standard	标准
+	Mobile	移动设备
+	Merge image fragments	合并图像碎片
+	Optimizing… merging image fragments	正在优化… 正在合并图像碎片
+	Side by side	并排
+	New file only	仅新文件
+	Old file: {name}	旧文件：{name}
+	New file: {name}	新文件：{name}
+	Print as image	作为图像打印
+	Resolution:	分辨率：
+	Use it when a printer skips text, shading or transparency. The print is no longer searchable text; with Print in grayscale, the pictures are grey.	当打印机漏印文字、渐变或透明效果时使用。打印结果不再是可搜索的文字；配合灰度打印时图像为灰色。
+	Crop Image	裁剪图像
+	Remove Crop	移除裁剪
+	Trim the picture with its handles; Enter or Done applies	用控制柄裁剪图片;按 Enter 或“完成”应用
+	Redaction mark appearance	涂黑标记外观
+	Outline colour:	轮廓颜色:
+	Fill colour:	填充颜色:
+	Shown while the pointer is over a mark.	指针位于标记上方时显示。
+	Opacity:	不透明度:
+	Make properties default	将属性设为默认
+	Pages selected	选定的页面
+	Page properties	页面属性
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index 9f8856ae1..2ddb33dd6 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -22,6 +22,7 @@
 	Auto follows the system's text size. Pages always render at the display's full resolution.	「自動」會跟隨系統的文字大小。頁面一律以螢幕的完整解析度呈現。
 	Identity	個人資訊
 	Name on new comments	新註解的作者名稱
+	Hide hover previews for highlights without comment text	隱藏沒有註解文字的螢光標示的停留預覽
 	Open…	開啟…
 	Open Recent	開啟最近的檔案
 	Clear Recent Files	清除最近的檔案
@@ -102,15 +103,15 @@
 	Close	關閉
 	Don't save	不儲存
 	Delete	刪除
-	Apply	應用
+	Apply	套用
 	Run	執行
 	Clear	清除
 	Sanitize	清理
 	Mark all	全部標記
-	Save changes to “{name}” before closing?	在關閉前儲存對“{name}”的更改？
+	Save changes to “{name}” before closing?	在關閉前儲存對「{name}」的更改？
 	Your changes will be lost if you don't save them.	如果不儲存，更改將會丟失。
 	Password required	需要密碼
-	“{name}” is protected. Enter a password to open it.	“{name}”受保護。請輸入密碼以開啟。
+	“{name}” is protected. Enter a password to open it.	「{name}」受保護。請輸入密碼以開啟。
 	Password	密碼
 	Incorrect password. Try again.	密碼不正確，請重試。
 	Export a PDF	匯出 PDF
@@ -147,7 +148,7 @@
 	Review	審閱
 	Recognize text	辨識文字
 	Recognize Text	辨識文字
-	Password protection will be applied when you save	儲存時將應用密碼保護
+	Password protection will be applied when you save	儲存時將套用密碼保護
 	Saved the print-ready PDF to {path}	列印就緒的 PDF 已儲存到{path}
 	Could not save: {e}	無法儲存：{e}
 	Earlier in tab order	在 Tab 順序中前移
@@ -156,7 +157,7 @@
 	To:	至：
 	High Resolution	高解析度
 	Print	列印
-	Save as PDF/A	另存為 PDF/A
+	Save as PDF/A	另存新檔為 PDF/A
 	Verify to see what the document needs.	驗證以檢視文件需要什麼。
 	Set Page Boxes	設定頁面框
 	Signature panel	簽名面板
@@ -179,14 +180,14 @@
 	November	十一月
 	December	十二月
 	Done	完成
-	This certificate is in your list of trusted certificates.	此憑證位於受信任憑證列表中。
+	This certificate is in your list of trusted certificates.	此憑證位於受信任憑證清單中。
 	This certificate is trusted through a certificate above it in the chain.	此憑證透過鏈中上方的憑證受到信任。
 	This certificate is not trusted. Signatures made with it show an unknown identity.	此憑證不受信任。使用它製作的簽名顯示未知身份。
 	Add to Trusted Certificates	新增到受信任的憑證
 	Export…	匯出…
 	PDF Optimizer	PDF 最佳化器
-	Discard Objects	丟棄物件
-	Discard User Data	丟棄使用者資料
+	Discard Objects	捨棄物件
+	Discard User Data	捨棄使用者資料
 	Clean Up	清理
 	Color Images	彩色圖片
 	Grayscale Images	灰度圖片
@@ -200,18 +201,18 @@
 	High	高
 	Maximum	最高
 	Each image is measured where pages draw it; an image is replaced only if the result is smaller.	按頁面繪製位置測量每個圖片；僅在結果更小時替換圖片。
-	Discard all links, actions and JavaScript	丟棄所有連結、動作和 JavaScript
-	Discard alternate images	丟棄備用圖片
-	Discard embedded page thumbnails	丟棄嵌入的頁面縮圖
-	Discard document tags	丟棄文件標記
-	Discard embedded print settings	丟棄嵌入的列印設定
-	Discard bookmarks	丟棄書籤
-	Discard hidden layer content	丟棄隱藏圖層內容
-	Discard all comments, forms and multimedia	丟棄所有註解、表單和多媒體
-	Discard document information and metadata	丟棄文件資訊和中繼資料
-	Discard all object data (file attachments)	丟棄所有物件資料（檔案附件）
-	Discard private data of other applications	丟棄其他應用程式的私有資料
-	Discard hidden text	丟棄隱藏文字
+	Discard all links, actions and JavaScript	捨棄所有連結、動作和 JavaScript
+	Discard alternate images	捨棄備用圖片
+	Discard embedded page thumbnails	捨棄嵌入的頁面縮圖
+	Discard document tags	捨棄文件標記
+	Discard embedded print settings	捨棄嵌入的列印設定
+	Discard bookmarks	捨棄書籤
+	Discard hidden layer content	捨棄隱藏圖層內容
+	Discard all comments, forms and multimedia	捨棄所有註解、表單和多媒體
+	Discard document information and metadata	捨棄文件資訊和中繼資料
+	Discard all object data (file attachments)	捨棄所有物件資料（檔案附件）
+	Discard private data of other applications	捨棄其他應用程式的私有資料
+	Discard hidden text	捨棄隱藏文字
 	Use Flate to encode streams that are not encoded	使用 Flate 編碼未編碼的流
 	Remove invalid links and bookmarks	刪除無效連結和書籤
 	Remove unreferenced named destinations	刪除未引用的命名目標
@@ -219,6 +220,7 @@
 	Remove unused objects and merge identical ones	刪除未使用的物件併合並相同的物件
 	Audit space usage…	審計空間使用情況…
 	Space Audit	空間審計
+	What takes up the space in this file, by kind of content.	此檔案的空間被哪些內容佔用，依內容類型列出。
 	Bytes	位元組
 	Content Streams	內容流
 	X Object Forms	XObject 表單
@@ -236,7 +238,7 @@
 	Check Box Properties	核取方塊屬性
 	Radio Button Properties	選項按鈕屬性
 	Dropdown Properties	下拉選單屬性
-	List Box Properties	列表框屬性
+	List Box Properties	清單方塊屬性
 	Button Properties	按鈕屬性
 	Digital Signature Properties	數位簽章屬性
 	Position	位置
@@ -246,10 +248,10 @@
 	Actions	操作
 	This field is locked. Unlock it to change its properties.	此欄位已鎖定。解鎖後可更改其屬性。
 	Tooltip:	提示：
-	Common Properties	常規屬性
+	Common Properties	一般屬性
 	Read Only	唯讀
 	Required	必填
-	Font Size:	字號：
+	Font Size:	字型大小：
 	Auto	自動
 	Text Color:	文字顏色：
 	Borders and Colors	邊框和顏色
@@ -274,9 +276,9 @@
 	Check spelling	檢驗拼字
 	Comb of	梳狀（每格一字元），共
 	Export Value: {on}	匯出值：{on}
-	Check box is checked by default	預設選中核取方塊
-	Button is checked by default	預設選中按鈕
-	Buttons with the same name and value are selected in unison	同名同值的按鈕一起選中
+	Check box is checked by default	預設選取核取方塊
+	Button is checked by default	預設選取按鈕
+	Buttons with the same name and value are selected in unison	同名同值的按鈕一起選取
 	Item:	項目：
 	Item List	項目清單
 	Up	上移
@@ -285,7 +287,7 @@
 	Default:	預設值：
 	(none)	（無）
 	Sort items	排序項目
-	Allow user to enter custom text	允許使用者輸入自定義文字
+	Allow user to enter custom text	允許使用者輸入自訂文字
 	Multiple selection	多選
 	Commit selected value immediately	立即提交所選值
 	Number	數字
@@ -300,7 +302,7 @@
 	Before the number	在數字之前
 	Negative number style:	負數樣式：
 	Format:	格式：
-	Custom:	自定義：
+	Custom:	自訂：
 	Zip Code	郵政編碼
 	Zip Code + 4	郵政編碼 + 4
 	Phone Number	電話號碼
@@ -308,7 +310,7 @@
 	Arbitrary Mask	任意掩碼
 	Mask:	掩碼：
 	9 digit, A letter, O letter or digit, X any character	9 表示數字，A 表示字母，O 表示字母或數字，X 表示任意字元
-	Example: {sample}	示例：{sample}
+	Example: {sample}	範例：{sample}
 	Field value is not validated	不驗證欄位值
 	Field value is in range:	欄位值在範圍內：
 	Add an Action	新增操作
@@ -321,15 +323,15 @@
 	On Blur	失去焦點
 	Select Action:	選擇操作：
 	Open a web link	開啟網頁連結
-	Reset a form	重置表單
+	Reset a form	重設表單
 	Execute a menu item	執行選單項
 	Show a field	顯示欄位
 	Hide a field	隱藏欄位
-	Submit a form	提交表單
-	Fields to reset (comma-separated; empty: all)	要重置的欄位（逗號分隔；為空表示全部）
+	Submit a form	送出表單
+	Fields to reset (comma-separated; empty: all)	要重設的欄位（逗號分隔；為空表示全部）
 	Print, NextPage, PrevPage, FirstPage or LastPage	Print、NextPage、PrevPage、FirstPage 或 LastPage
 	Field names (comma-separated)	欄位名（逗號分隔）
-	URL to submit to	要提交到的 URL
+	URL to submit to	要送出到的 URL
 	Script:	指令碼：
 	Value:	值：
 	No actions	無操作
@@ -352,7 +354,7 @@
 	Bold	粗體
 	Italic	斜體
 	Align left	左對齊
-	Centre	居中
+	Centre	置中
 	Align right	右對齊
 	Justify	兩端對齊
 	Thai and Arabic use regular fallback fonts when available.	泰語和阿拉伯語使用可用的一般樣式備用字型。
@@ -379,14 +381,14 @@
 	Create {what}	建立{what}
 	initials	姓名首字母
 	signature	簽名
-	Create Custom Stamp	建立自定義戳記
+	Create Custom Stamp	建立自訂戳記
 	From {file}	來自 {file}
 	Category:	類別：
 	e.g. My stamps	例如：我的戳記
 	Name:	名稱：
-	Custom	自定義
+	Custom	自訂
 	Delete stamp	刪除戳記
-	Create custom stamp…	建立自定義戳記…
+	Create custom stamp…	建立自訂戳記…
 	From a PDF page or an image	來自 PDF 頁面或圖片
 	Line spacing	行距
 	Character spacing	字元間距
@@ -396,7 +398,7 @@
 	Flip Horizontal	水平翻轉
 	Flip Vertical	垂直翻轉
 	Replace Image…	替換圖片…
-	Save Image As…	圖片另存為…
+	Save Image As…	圖片另存新檔…
 	Copy Image	複製圖片
 	The image has been copied ({w} × {h} pixels)	圖片已複製（{w} × {h} 畫素）
 	Couldn't copy the image: {e}	無法複製圖片：{e}
@@ -407,10 +409,10 @@
 	No check has run yet.	尚未執行檢驗。
 	Checking for a newer version…	正在檢驗新版本…
 	PdfCraft {v} is available.	PdfCraft {v} 可用。
-	You have version {c}. Download the new version from its release page.	當前版本為 {c}。請從其釋出頁面下載新版本。
+	You have version {c}. Download the new version from its release page.	目前版本為 {c}。請從其釋出頁面下載新版本。
 	PdfCraft {c} is up to date.	PdfCraft {c} 已是最新。
 	Couldn't check for updates: {e}	無法檢驗更新：{e}
-	You have version {c}. All releases are listed at {page}.	當前版本為 {c}。所有版本列在 {page}。
+	You have version {c}. All releases are listed at {page}.	目前版本為 {c}。所有版本列在 {page}。
 	Asks GitHub for the latest release. Nothing is downloaded or installed automatically.	向 GitHub 搜尋最新版本。不會自動下載或安裝任何內容。
 	Download	下載
 	Later	稍後
@@ -425,19 +427,19 @@
 	Box	框
 	Units	單位
 	Set to zero	置零
-	Current page ({n})	當前頁（第 {n} 頁）
+	Current page ({n})	目前頁（第 {n} 頁）
 	Subset	子集
 	Update	更新
 	Add	新增
 	{verb} Header and Footer	{verb}頁首和頁尾
-	{verb} Watermark	{verb}水印
+	{verb} Watermark	{verb}浮水印
 	{verb} Background	{verb}背景
 	Margins	邊距
 	Left Header Text	左頁首文字
-	Center Header Text	居中頁首文字
+	Center Header Text	置中頁首文字
 	Right Header Text	右頁首文字
 	Left Footer Text	左頁尾文字
-	Center Footer Text	居中頁尾文字
+	Center Footer Text	置中頁尾文字
 	Right Footer Text	右頁尾文字
 	Insert Page Number	插入頁碼
 	Insert Date	插入日期
@@ -450,8 +452,8 @@
 	From colour	使用顏色
 	Page Range Options	頁面範圍選項
 	Preview: page {p} of {n}	預覽：第 {p} 頁，共 {n} 頁
-	Applies to 1 page	應用於 1 頁
-	Applies to {n} pages	應用於 {n} 頁
+	Applies to 1 page	套用於 1 頁
+	Applies to {n} pages	套用於 {n} 頁
 	Replaces the existing one on those pages.	替換這些頁面上的現有內容。
 	PDF or image	PDF 或圖片
 	No file chosen	未選擇檔案
@@ -463,7 +465,7 @@
 	Link Type:	連結型別：
 	Visible Rectangle	可見矩形
 	Invisible Rectangle	不可見矩形
-	Highlight Style:	高亮樣式：
+	Highlight Style:	醒目提示樣式：
 	Invert	反轉
 	Outline	輪廓
 	Inset	嵌入
@@ -489,6 +491,12 @@
 	Windows store  ·  	Windows 憑證存放區 · 
 	Issued by: 	頒發者：
 	, Expires: 	，有效期至：
+	Digitally signed by	數位簽署者
+	DN: 	DN：
+	Reason: 	原因：
+	Location: 	位置：
+	Date: 	日期：
+	The labels are in English: the signature's font can't draw them in this language.	簽名使用的字型無法顯示此語言的標籤，因此標籤以英文顯示。
 	No digital IDs yet.	尚無數位 ID。
 	Configure New Digital ID	配置新數位 ID
 	Remove "{name}" from this list? The file itself is not deleted.	從此清單中移除「{name}」？檔案本身不會被刪除。
@@ -507,7 +515,7 @@
 	File (.p12, .pfx)	檔案 (.p12, .pfx)
 	Digital ID	數位 ID
 	Browse…	瀏覽…
-	{verb} as "{name}"	{verb}為“{name}”
+	{verb} as "{name}"	{verb}為「{name}」
 	Certify	認證
 	The signature will be invisible.	簽名將不可見。
 	Distinguished name	可分辨名稱
@@ -543,7 +551,7 @@
 	Show certificate…	顯示憑證…
 	Export certificate…	匯出憑證…
 	Certificate Viewer	憑證檢視器
-	This dialog shows the details of a certificate and its chain.	此對話框顯示憑證及其鏈的詳細資訊。
+	This dialog shows the details of a certificate and its chain.	此對話方塊顯示憑證及其鏈的詳細資訊。
 	Trust	信任
 	Issued to	頒發給
 	Valid from	有效期自
@@ -569,19 +577,19 @@
 	An action with this name already exists.	已存在同名的操作。
 	New Action…	新建操作…
 	Edit…	編輯…
-	Add watermark	新增水印
+	Add watermark	新增浮水印
 	Add header	新增頁首
 	Add footer	新增頁尾
 	Set document title	設定文件標題
 	Run a JavaScript	執行 JavaScript
 	Prepare for Distribution	準備分發
-	Remove hidden information and flatten comments and form fields, so recipients see only the pages.	刪除隱藏資訊並拼合註解和表單欄位，使接收者僅看到頁面。
+	Remove hidden information and flatten comments and form fields, so recipients see only the pages.	刪除隱藏資訊並平面化註解和表單欄位，使收件者僅看到頁面。
 	Optimize Scanned Documents	最佳化掃描文件
 	Make scans searchable, then make them smaller.	使掃描件可搜尋，然後將其變小。
 	Add Page Numbers	新增頁碼
 	Number every page in the footer.	在頁尾為每頁編號。
 	Mark as Confidential	標為機密
-	A diagonal CONFIDENTIAL watermark on every page.	每頁上的對角線 CONFIDENTIAL 水印。
+	A diagonal CONFIDENTIAL watermark on every page.	每頁上的對角線 CONFIDENTIAL 浮水印。
 	Sanitize Documents	清理文件
 	Remove hidden information, metadata, scripts and embedded content, and rewrite the files.	刪除隱藏資訊、中繼資料、指令碼和嵌入內容，並重寫檔案。
 	Type text	輸入文字
@@ -591,7 +599,7 @@
 	Add a sticky note here	在此處新增附註
 	{kind} Properties	{kind} 屬性
 	Appearance	外觀
-	General	常規
+	General	一般
 	Review History	審閱歷史
 	This comment's appearance can't be changed yet.	此註解的外觀尚無法更改。
 	Icon	圖示
@@ -603,7 +611,7 @@
 	Open the older version first	請先開啟舊版本
 	New file:	新檔案：
 	Text is compared word by word; the differences are shown on the new file.	逐詞比較文字；差異顯示在新檔案上。
-	Compare this file with an older version: Compare files… in All tools.	將此檔案與舊版本比較：在所有工具中使用“比較檔案…”。
+	Compare this file with an older version: Compare files… in All tools.	將此檔案與舊版本比較：在所有工具中使用「比較檔案…」。
 	No differences in the text.	文字沒有差異。
 	{n} {kind}	{n} {kind}
 	Inserted	插入
@@ -630,7 +638,7 @@
 	Page Range	頁面範圍
 	All pages in document	文件中的所有頁面
 	Checking Options ({on} of 32 in all categories)	檢驗選項（所有類別共 32 項，已選 {on} 項）
-	Show this dialog when the Checker starts	啟動檢驗器時顯示此對話框
+	Show this dialog when the Checker starts	啟動檢驗器時顯示此對話方塊
 	Select All	全選
 	Clear All	全部清除
 	Start Checking	開始檢驗
@@ -661,11 +669,11 @@
 	Forms	表單
 	Alternate Text	替代文字
 	Tables	表格
-	Lists	列表
+	Lists	清單
 	Headings	標題
 	Accessibility permission flag	無障礙許可標誌
 	Accessibility permission flag is set	已設定無障礙許可標誌
-	Security settings must allow assistive technology to read the content ("Enable text access for screen reader devices"). Change the document's security to allow it.	安全設定必須允許輔助技術讀取內容（“允許螢幕閱讀器裝置訪問文字”）。請更改文件安全設定以允許。
+	Security settings must allow assistive technology to read the content ("Enable text access for screen reader devices"). Change the document's security to allow it.	安全設定必須允許輔助技術讀取內容（「允許螢幕閱讀器裝置存取文字」）。請更改文件安全設定以允許。
 	Image-only PDF	純圖片 PDF
 	Document is not image-only PDF	文件不是純圖片 PDF
 	Pages that are only pictures of text can't be read aloud or searched. Recognize text (OCR) to add a text layer.	僅為文字圖片的頁面無法朗讀或搜尋。請辨識文字（OCR）以新增文字層。
@@ -676,9 +684,9 @@
 	Check that the tags read in the order a sighted reader would. Use the Reading Order tool or the Tags panel to correct it.	檢驗標記的閱讀順序是否與明眼讀者一致。使用閱讀順序工具或標記面板進行更正。
 	Primary language	主要語言
 	Text language is specified	已指定文字語言
-	Screen readers choose their voice from the document's language. Set it in Document Properties > Advanced > Language.	螢幕閱讀器根據文件語言選擇語音。請在“文件屬性”>“高階”>“語言”中設定。
-	Document title is showing in title bar	標題欄中顯示文件標題
-	The window should show a meaningful title rather than the file name. Set a title and Initial View > Show: Document Title.	視窗應顯示有意義的標題而非檔案名。請設定標題，並在“初始檢視”>“顯示”中選擇“文件標題”。
+	Screen readers choose their voice from the document's language. Set it in Document Properties > Advanced > Language.	螢幕閱讀器根據文件語言選擇語音。請在「文件屬性」>「進階」>「語言」中設定。
+	Document title is showing in title bar	標題列中顯示文件標題
+	The window should show a meaningful title rather than the file name. Set a title and Initial View > Show: Document Title.	視窗應顯示有意義的標題而非檔案名。請設定標題，並在「初始檢視」>「顯示」中選擇「文件標題」。
 	Bookmarks are present in large documents	大文件中有書籤
 	Documents of more than 20 pages need bookmarks for navigation. Add bookmarks for the main sections.	超過 20 頁的文件需要書籤以便導覽。請為主要章節新增書籤。
 	Color contrast	顏色對比度
@@ -692,7 +700,7 @@
 	Comments, links and fields must be in the tag tree to be announced. Tag the annotations.	註解、連結和欄位必須位於標記樹中才能被播報。請標記註解。
 	Tab order	Tab 順序
 	Tab order is consistent with structure order	Tab 順序與結構順序一致
-	Pages with links, comments or fields should tab in structure order. The fix sets each page's tab order to Use Document Structure.	包含連結、註解或欄位的頁面應按結構順序 Tab。修復操作將每頁的 Tab 順序設為“使用文件結構”。
+	Pages with links, comments or fields should tab in structure order. The fix sets each page's tab order to Use Document Structure.	包含連結、註解或欄位的頁面應按結構順序 Tab。修復操作將每頁的 Tab 順序設為「使用文件結構」。
 	Character encoding	字元編碼
 	Reliable character encoding is provided	提供了可靠的字元編碼
 	Fonts must map their characters to Unicode so text can be read and copied. Fix the fonts or recreate the PDF.	字型必須將其字元對映到 Unicode，以便讀取和複製文字。請修復字型或重新生成 PDF。
@@ -715,7 +723,7 @@
 	Form fields must be in the tag tree (Form tags) to be announced. Tag the form fields.	表單欄位必須位於標記樹（表單標記）中才能被播報。請標記表單欄位。
 	Field descriptions	欄位描述
 	All form fields have description	所有表單欄位都有描述
-	Each field needs a tooltip that says what to enter. Add one in Field Properties > General > Tooltip.	每個欄位都需要說明輸入內容的提示。在“欄位屬性”>“常規”>“提示”中新增。
+	Each field needs a tooltip that says what to enter. Add one in Field Properties > General > Tooltip.	每個欄位都需要說明輸入內容的提示。在「欄位屬性」>「一般」>「提示」中新增。
 	Figures alternate text	圖形替代文字
 	Figures require alternate text	圖形需要替代文字
 	Pictures need alternate text that describes them, or must be marked decorative. Add alternate text to each figure.	圖片需要描述性的替代文字，或標為裝飾性。請為每個圖形新增替代文字。
@@ -743,12 +751,12 @@
 	Summary	摘要
 	Tables must have a summary	表格必須有摘要
 	A summary describes the table's purpose and layout. Add a Summary attribute to each table.	摘要描述表格的用途和佈局。請為每個表格新增 Summary 屬性。
-	List items	列表項
+	List items	清單項
 	LI must be a child of L	LI 必須是 L 的子級
-	List items belong in a list. Fix the list's tags.	列表項應位於列表內。請修復列表標記。
+	List items belong in a list. Fix the list's tags.	清單項應位於清單內。請修復清單標記。
 	Lbl and LBody	Lbl 和 LBody
 	Lbl and LBody must be children of LI	Lbl 和 LBody 必須是 LI 的子級
-	List labels and bodies belong in a list item. Fix the list's tags.	列表標籤和正文應位於列表項內。請修復列表標記。
+	List labels and bodies belong in a list item. Fix the list's tags.	清單標籤和正文應位於清單項內。請修復清單標記。
 	Appropriate nesting	適當的巢狀
 	Heading levels shouldn't skip (an H1 followed by an H3). Retag the headings.	標題級別不應跳躍（H1 後面不應直接跟 H3）。請重新標記標題。
 	TH and TD	TH 和 TD
@@ -775,18 +783,19 @@
 	Redaction Tool Properties	遮蔽內容工具屬性
 	Redacted area fill colour:	遮蔽內容區域填充顏色：
 	Use overlay text	使用覆蓋文字
-	Custom text:	自定義文字：
+	Custom text:	自訂文字：
 	Redaction code:	遮蔽代碼：
 	Font:	字型：
-	Font size:	字號：
+	Font size:	字型大小：
+	Font size	字號
 	Auto-size text to fit redaction region	自動調整文字大小以適應遮蔽內容區域
 	Font colour:	字型顏色：
 	Repeat overlay text	重複覆蓋文字
 	Text alignment:	文字對齊：
-	Center	居中
-	Apply redactions	應用遮蔽內容
-	You are about to apply 1 redaction mark. Text, images and drawings under the marks, and comments and form fields that overlap them, are removed permanently.	即將應用 1 個遮蔽內容標記。標記下的文字、圖片和繪圖，以及與其重疊的註解和表單欄位，將被永久刪除。
-	You are about to apply {n} redaction marks. Text, images and drawings under the marks, and comments and form fields that overlap them, are removed permanently.	即將應用 {n} 個遮蔽內容標記。標記下的文字、圖片和繪圖，以及與其重疊的註解和表單欄位，將被永久刪除。
+	Center	置中
+	Apply redactions	套用遮蔽內容
+	You are about to apply 1 redaction mark. Text, images and drawings under the marks, and comments and form fields that overlap them, are removed permanently.	即將套用 1 個遮蔽內容標記。標記下的文字、圖片和繪圖，以及與其重疊的註解和表單欄位，將被永久刪除。
+	You are about to apply {n} redaction marks. Text, images and drawings under the marks, and comments and form fields that overlap them, are removed permanently.	即將套用 {n} 個遮蔽內容標記。標記下的文字、圖片和繪圖，以及與其重疊的註解和表單欄位，將被永久刪除。
 	Save the document afterwards: saving rewrites the whole file so no trace of the removed content stays in it.	之後請儲存文件：儲存將重寫整個檔案，使刪除的內容不留痕跡。
 	Select the items to remove from this document.	選擇要從本文件中刪除的專案。
 	Metadata	中繼資料
@@ -797,12 +806,12 @@
 	Links, actions and JavaScripts	連結、動作和 JavaScript
 	Private data of other applications	其他應用程式的私有資料
 	None found	未發現
-	Form fields are flattened: their values stay visible. Saving rewrites the whole file.	表單欄位將被拼合：其值保持可見。儲存將重寫整個檔案。
+	Form fields are flattened: their values stay visible. Saving rewrites the whole file.	表單欄位將被平面化：其值保持可見。儲存將重寫整個檔案。
 	Remove	刪除
-	Sanitizing removes hidden information from the document: metadata, file attachments, comments, form fields (flattened), hidden text and layers, bookmarks, links, actions and scripts, and private application data.	清理將刪除文件中的隱藏資訊：中繼資料、檔案附件、註解、表單欄位（拼合）、隱藏文字和圖層、書籤、連結、動作和指令碼，以及私有應用程式資料。
+	Sanitizing removes hidden information from the document: metadata, file attachments, comments, form fields (flattened), hidden text and layers, bookmarks, links, actions and scripts, and private application data.	清理將刪除文件中的隱藏資訊：中繼資料、檔案附件、註解、表單欄位（平面化）、隱藏文字和圖層、書籤、連結、動作和指令碼，以及私有應用程式資料。
 	Save the document afterwards; saving rewrites the whole file so nothing removed stays in it.	之後請儲存文件；儲存將重寫整個檔案，使刪除的內容不殘留。
 	Printer:	列印機：
-	Save as PDF	另存為 PDF
+	Save as PDF	另存新檔為 PDF
 	{name} (default)	{name}（預設）
 	Copies:	份數：
 	Collate	逐份列印
@@ -825,7 +834,7 @@
 	Booklet	小冊子
 	Fit	適合
 	Shrink oversized pages	縮小過大的頁面
-	Custom scale:	自定義比例：
+	Custom scale:	自訂比例：
 	Tile scale:	平鋪比例：
 	Overlap:	重疊：
 	Cut marks	裁切標記
@@ -860,8 +869,8 @@
 	Removed 1 hidden item. Save to remove them from the file.	已刪除 1 個隱藏項。儲存以從檔案中刪除它們。
 	Removed {n} hidden items. Save to remove them from the file.	已刪除 {n} 個隱藏項。儲存以從檔案中刪除它們。
 	Document sanitized. Save to finish: saving rewrites the whole file.	文件已清理。儲存以完成：儲存將重寫整個檔案。
-	Applied 1 redaction mark. Save to remove the content from the file.	已應用 1 個遮蔽內容標記。儲存以從檔案中刪除內容。
-	Applied {n} redaction marks. Save to remove the content from the file.	已應用 {n} 個遮蔽內容標記。儲存以從檔案中刪除內容。
+	Applied 1 redaction mark. Save to remove the content from the file.	已套用 1 個遮蔽內容標記。儲存以從檔案中刪除內容。
+	Applied {n} redaction marks. Save to remove the content from the file.	已套用 {n} 個遮蔽內容標記。儲存以從檔案中刪除內容。
 	JavaScript Console	JavaScript 主控台
 	JavaScript is turned off (Preferences ▸ JavaScript).	JavaScript 已關閉（偏好設定 → JavaScript）。
 	Output appears here.	輸出顯示在此處。
@@ -884,7 +893,7 @@
 	Use system setting	使用系統設定
 	Light gray	淺灰色
 	Dark gray	深灰色
-	Current page	當前頁
+	Current page	目前頁
 	Selected pages	選取的頁面
 	Document language	文件語言
 	Output	輸出
@@ -924,6 +933,7 @@
 	Replace	取代
 	Split	分割
 	Set page boxes	設定頁面方框
+	Set page transitions	設定換頁效果
 	Page labels	頁面標籤
 	Page transitions	頁面轉場
 	Sticky note	便利貼註解
@@ -1177,7 +1187,8 @@
 	Set status	設定狀態
 	Copy text	複製文字
 	Properties…	屬性…
-	Make Current Properties Default	將當前屬性設為預設
+	Make Current Properties Default	將目前屬性設為預設
+	Make Properties Default	將屬性設為預設
 	More options	更多選項
 	Sort by	排序方式
 	Author	作者
@@ -1232,8 +1243,8 @@
 	Align	對齊
 	Top	上
 	Bottom	下
-	Center horizontally	水平居中
-	Center vertically	垂直居中
+	Center horizontally	水平置中
+	Center vertically	垂直置中
 	Distribute	分佈
 	Horizontally	水平分佈
 	Vertically	垂直分佈
@@ -1260,7 +1271,7 @@
 	Strong	強
 	Medium	中等
 	Weak	弱
-	Advanced Options {chevron}	高階選項 {chevron}
+	Advanced Options {chevron}	進階選項 {chevron}
 	Compatibility	相容性
 	Acrobat X and later (256-bit AES)	Acrobat X 及更高版本（256 位 AES）
 	Acrobat 7.0 and later (128-bit AES)	Acrobat 7.0 及更高版本（128 位 AES）
@@ -1277,12 +1288,12 @@
 	Commenting, filling in form fields, and signing existing signature fields	註解、填寫表單欄位並簽署現有簽名欄位
 	Any except extracting pages	除提取頁面外的任何操作
 	Enable copying of text, images, and other content	允許複製文字、圖片和其他內容
-	Enable text access for screen reader devices for the visually impaired	允許螢幕閱讀器裝置訪問文字以幫助視障人士
+	Enable text access for screen reader devices for the visually impaired	允許螢幕閱讀器裝置存取文字以幫助視障人士
 	Type a password.	請輸入密碼。
 	The passwords don't match.	兩次輸入的密碼不一致。
 	This compatibility level supports only plain ASCII passwords.	此相容性級別僅支援純 ASCII 密碼。
-	Anyone opening the document will need this password. It's applied when you save.	開啟文件的任何人都需要此密碼。儲存時應用。
-	The document opens without a password; this password is needed to change the restrictions. It's applied when you save.	開啟文件無需密碼；更改限制需要此密碼。儲存時應用。
+	Anyone opening the document will need this password. It's applied when you save.	開啟文件的任何人都需要此密碼。儲存時套用。
+	The document opens without a password; this password is needed to change the restrictions. It's applied when you save.	開啟文件無需密碼；更改限制需要此密碼。儲存時套用。
 	Recover unsaved documents?	要恢復未儲存的文件嗎？
 	PdfCraft didn't shut down normally. These documents had changes that were autosaved:	PdfCraft 未正常關閉。以下文件的更改已自動儲存：
 	just now	剛剛
@@ -1309,7 +1320,10 @@
 	Comments only	僅註解
 	Sort comments by:	註解排序依據：
 	Create PDF Comment Summary	建立 PDF 註解摘要
-	Revert to the previously saved version of “{name}”? Changes since then can't be undone afterwards.	還原到“{name}”的上次儲存版本？此後的更改將無法復原。
+	Revert to the previously saved version of “{name}”? Changes since then can't be undone afterwards.	還原到「{name}」的上次儲存版本？此後的更改將無法復原。
+	Save over the changed file?	覆寫已變更的檔案？
+	“{name}” changed on disk after it was opened or last saved. Saving now replaces that newer version with this one.	「{name}」在開啟或上次儲存後已在磁碟上變更。現在儲存會以此版本取代那個較新的版本。
+	Save anyway	仍要儲存
 	Number pages	頁面編號
 	Style	樣式
 	None (prefix only)	無（僅字首）
@@ -1323,7 +1337,7 @@
 	Landscape Pages	橫向頁面
 	Portrait Pages	縱向頁面
 	Duplicate Field	複製欄位
-	Duplicate "{name}" onto:	將“{name}”複製到：
+	Duplicate "{name}" onto:	將「{name}」複製到：
 	1 page selected.	已選擇 1 頁。
 	{n} pages selected.	已選擇 {n} 頁。
 	Delete pages after extracting	提取後刪除頁面
@@ -1364,7 +1378,7 @@
 	Initial View	初始檢視
 	Security	安全
 	Fonts	字型
-	Advanced	高階
+	Advanced	進階
 	Title	標題
 	Subject	主題
 	Keywords	關鍵字
@@ -1395,14 +1409,14 @@
 	of {pages}	共 {pages} 頁
 	Window Options	視窗選項
 	Resize window to initial page	調整視窗大小以適合初始頁面
-	Center window on screen	在螢幕上居中視窗
-	Open in Full Screen mode	以全屏模式開啟
+	Center window on screen	在螢幕上置中視窗
+	Open in Full Screen mode	以全螢幕模式開啟
 	Show:	顯示：
 	File Name	檔案名
 	Document Title	文件標題
 	User Interface Options	使用者介面選項
 	Hide menu bar	隱藏選單欄
-	Hide toolbars	隱藏工具欄
+	Hide toolbars	隱藏工具列
 	Hide window controls	隱藏視窗控制元件
 	Security method	安全方法
 	No security	無安全性
@@ -1411,7 +1425,7 @@
 	Password security	密碼安全性
 	Encryption	加密
 	Opened with	開啟方式
-	— (protection is applied when you save)	—（儲存時應用保護）
+	— (protection is applied when you save)	—（儲存時套用保護）
 	Owner password (no restrictions apply)	所有者密碼（無限制）
 	User password	使用者密碼
 	Change settings…	更改設定…
@@ -1452,10 +1466,10 @@
 	On the web, open or drop an image to convert it	在 Web 端，開啟或拖入圖片進行轉換
 	Couldn't optimize the file: {e}	無法最佳化檔案：{e}
 	Couldn't write {path}: {e}	無法寫入{path}：{e}
-	The form asks to be submitted to {u}; PdfCraft doesn't send form data. Save the document to keep your entries.	該表單請求提交到{u}；PdfCraft 不傳送表單資料。請儲存文件以保留填寫內容。
+	The form asks to be submitted to {u}; PdfCraft doesn't send form data. Save the document to keep your entries.	該表單請求送出到{u}；PdfCraft 不傳送表單資料。請儲存文件以保留填寫內容。
 	This PDF uses the unsupported {s} action.	此 PDF 使用了不支援的 {s} 動作。
 	{name}: the {other} action isn't supported yet	{name}：{other} 動作暫不受支援
-	{name} submits the form to {url}; PdfCraft doesn't send form data. Save the document to keep your entries.	{name} 將表單提交到{url}；PdfCraft 不傳送表單資料。請儲存文件以保留填寫內容。
+	{name} submits the form to {url}; PdfCraft doesn't send form data. Save the document to keep your entries.	{name} 將表單送出到{url}；PdfCraft 不傳送表單資料。請儲存文件以保留填寫內容。
 	Export stopped: {e}	匯出中止：{e}
 	Exported 1 image	已匯出 1 張圖片
 	Exported {n} images	已匯出{n}張圖片
@@ -1510,11 +1524,13 @@
 	The document now conforms to {level}; save it to keep the changes	文件現已符合{level}；儲存以保留更改
 	Fixed what could be fixed; 1 problem remains	已修復能修復的問題；還剩 1 個問題
 	Fixed what could be fixed; {n} problems remain	已修復能修復的問題；還剩{n}個問題
-	Custom stamps arrive on the web with file pickers for images	Web 端自定義戳記將使用圖片檔案選擇器
+	Custom stamps arrive on the web with file pickers for images	Web 端自訂戳記將使用圖片檔案選擇器
 	{file} is too large for a stamp (at most {n} MB)	{file} 對於戳記來說太大了（最大 {n} MB）
 	Sent to {printer}	已傳送到{printer}
 	Sent to {printer}: {msg}	已傳送到{printer}：{msg}
 	Looking for printers…	正在尋找印表機…
+	Sending sheet {s} of {n} to {printer}…	正在將第 {s} 張（共 {n} 張）傳送到{printer}…
+	No printers were found. Check that the printer is installed and the print spooler is running, then open Print again.	找不到印表機。請確認印表機已安裝、列印多工緩衝處理器正在執行，然後重新開啟「列印」。
 	Sending to {printer}…	正在傳送到{printer}…
 	Choose a folder for the searchable files	選擇可搜尋檔案的資料夾
 	Files are combined from top to bottom. Leave Pages empty to take every page.	檔案將按從上到下的順序合併。頁碼留空表示取全部頁面。
@@ -1643,17 +1659,17 @@
 	Nothing to undo	沒有可復原的操作
 	Nothing to redo	沒有可重做的操作
 	This document has no form fields you can fill in	本文件沒有可填寫的表單欄位
-	This document has no comments to flatten	本文件沒有可拼合的註解
-	This document has no form fields to flatten	本文件沒有可拼合的表單欄位
+	This document has no comments to flatten	本文件沒有可平面化的註解
+	This document has no form fields to flatten	本文件沒有可平面化的表單欄位
 	There are no redaction marks (mark text, areas or pages first)	沒有遮蔽內容標記（請先標記文字、區域或頁面）
 	This document has no {kind} to change	本文件沒有可更改的{kind}
 	header or footer	頁首或頁尾
-	watermark	水印
+	watermark	浮水印
 	background	背景
 	This document isn't password-protected	本文件未受密碼保護
 	Enter permissions password…	輸入許可權密碼…
 	Permissions password	許可權密碼
-	“{name}” has security restrictions. Enter its permissions password to lift them.	“{name}”有安全限制。請輸入其許可權密碼以解除限制。
+	“{name}” has security restrictions. Enter its permissions password to lift them.	「{name}」有安全限制。請輸入其許可權密碼以解除限制。
 	Restrictions lifted	已解除限制
 	Couldn't unlock {name}: {e}	無法解鎖 {name}：{e}
 	This document has no restrictions to lift	此文件沒有可解除的限制
@@ -1663,14 +1679,14 @@
 	Security will be removed when you save	儲存時將刪除安全性設定
 	Click text or an image to edit it	按一下文字或圖片進行編輯
 	Drag a rectangle to create a link; double-click a link to edit it	拖動矩形建立連結；按兩下連結進行編輯
-	There are no redaction marks to apply	沒有可應用的遮蔽內容標記
+	There are no redaction marks to apply	沒有可套用的遮蔽內容標記
 	Drag to draw the area where the signature should appear.	拖動繪製簽名應顯示的區域。
 	Couldn't fit the visible content: {e}	無法適應可見內容：{e}
 	Drag a rectangle around the area to copy	拖動框選要複製的區域
 	Click on the page to add a {tool}, or drag to set its size	按一下頁面新增{tool}，或拖動設定其大小
 	Drag a rectangle on a page to crop it; double-click a page for Set Page Boxes	拖動頁面上的矩形進行裁切；按兩下頁面可設定頁面框
-	Keep tool selected: on	保持工具選中：開
-	Keep tool selected	保持工具選中
+	Keep tool selected: on	保持工具選取：開
+	Keep tool selected	保持工具選取
 	Opacity	不透明度
 	Line thickness	線條粗細
 	What word or phrase would you like to search for?	您想搜尋哪個詞或短語？
@@ -1696,8 +1712,8 @@
 	This document contains {n} interactive form fields.	本文件包含 {n} 個互動式表單欄位。
 	This file was damaged and has been repaired. Saving keeps the repaired version.	此檔案已損壞並已修復。儲存將保留修復後的版本。
 	Dismiss	關閉
-	Hide field highlights	隱藏欄位高亮
-	Highlight fields	高亮顯示欄位
+	Hide field highlights	隱藏欄位醒目提示
+	Highlight fields	醒目提示欄位
 	Security settings	安全設定
 	Details	詳情
 	Select (V)	選擇 (V)
@@ -1712,7 +1728,7 @@
 	Copy	複製
 	Paste after	在後面貼上
 	Rename	重新命名
-	Set to current page ({n})	設為當前頁（第 {n} 頁）
+	Set to current page ({n})	設為目前頁（第 {n} 頁）
 	Move up	上移
 	Move down	下移
 	Indent	縮排
@@ -1792,8 +1808,8 @@
 	Spreadsheet (.xlsx)	試算表（.xlsx）
 	Presentation (.pptx)	簡報（.pptx）
 	PostScript / EPS	PostScript / EPS
-	Save as PDF/X	另存為 PDF/X
-	Save as PDF/UA	另存為 PDF/UA
+	Save as PDF/X	另存新檔為 PDF/X
+	Save as PDF/UA	另存新檔為 PDF/UA
 	JavaScript	JavaScript
 	pages	頁
 	Planned	規劃中
@@ -1963,9 +1979,9 @@
 	Set status Completed	設定為已完成
 	Set status None	清除狀態
 	Set status Unmarked	設定為未標記
-	Save as PDF/A-1b	另存為 PDF/A-1b
-	Save as PDF/A-2b	另存為 PDF/A-2b
-	Save as PDF/A-3b	另存為 PDF/A-3b
+	Save as PDF/A-1b	另存新檔為 PDF/A-1b
+	Save as PDF/A-2b	另存新檔為 PDF/A-2b
+	Save as PDF/A-3b	另存新檔為 PDF/A-3b
 	Fill & Sign: change signature	填寫與簽署：變更簽名
 	Fill & Sign: change initials	填寫與簽署：變更姓名縮寫
 	Fill & Sign: remove saved signature	填寫與簽署：刪除已儲存的簽名
@@ -2121,6 +2137,8 @@ key	Space	空格
 	Switch to List view to change the pages it takes.	切換到清單檢視以變更要使用的頁面。
 	Expand all	全部展開
 	Collapse all	全部摺疊
+	Collapse all pages	摺疊所有頁面
+	Expand all pages	展開所有頁面
 	Remove page	刪除頁面
 	Remove {n} pages	刪除 {n} 頁
 
@@ -2134,14 +2152,14 @@ key	Space	空格
 	Tools	工具
 	Inspector	檢查器
 	Reload documents when their files change on disk	檔案在磁碟上變更時重新載入對應的文件
-	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	此檔案已在磁碟上變更。請重新載入以查看新版本；未儲存的變更將會遺失。
+	This file changed on disk. Reload shows the new version and drops your unsaved changes; Save replaces it with this version.	此檔案已在磁碟上變更。「重新載入」會顯示新版本並捨棄未儲存的變更；「儲存」則會以此版本取代它。
 	Reload	重新載入
 	Couldn't reload {name}: {e}	無法重新載入{name}：{e}
 	Select page {label}	選取頁面 {label}
 	Rotate page {label} counterclockwise	逆時針旋轉頁面 {label}
 	Rotate page {label} clockwise	順時針旋轉頁面 {label}
 	Delete page {label}	刪除頁面 {label}
-	Mouse wheel scroll speed	滑鼠滾輪捲動速度
+	Scroll speed (mouse wheel and arrow keys)	捲動速度（滑鼠滾輪與方向鍵）
 scroll speed	Slow	慢
 scroll speed	Normal	正常
 scroll speed	Fast	快
@@ -2157,11 +2175,11 @@ animation effects	Off	關
 	Greyscale	灰階
 	Black and white	黑白
 	This printer's driver doesn't take two-sided settings from other programs, so its own setting applies. Change it in Properties…	此印表機的驅動程式不接受其他程式的雙面列印設定，因此使用其自身設定。變更位置：屬性…
-	Browser's print dialog	瀏覽器的列印對話框
-	Copies, two-sided printing and colour are chosen in the browser's print dialog.	份數、雙面列印和色彩在瀏覽器的列印對話框中選擇。
+	Browser's print dialog	瀏覽器的列印對話方塊
+	Copies, two-sided printing and colour are chosen in the browser's print dialog.	份數、雙面列印和色彩在瀏覽器的列印對話方塊中選擇。
 	Preparing {n} sheets for printing…	正在準備 {n} 張紙以供列印…
 	Preparing sheet {done} of {total} for printing…	正在準備列印第 {done} 張，共 {total} 張…
-	Opening the browser's print dialog…	正在開啟瀏覽器的列印對話框…
+	Opening the browser's print dialog…	正在開啟瀏覽器的列印對話方塊…
 	Couldn't print from the browser ({e}); downloaded {name} to print instead	無法從瀏覽器列印（{e}）；已改為下載 {name} 以供列印
 	Tools panel side	工具面板位置
 	Add comment	新增註解
@@ -2215,6 +2233,10 @@ animation effects	Off	關
 	The linked PDF opened, but its page destination was out of range.	已開啟連結的 PDF，但其頁面目的地超出範圍。
 	Local cross-PDF links require the desktop app	PDF 之間的本機連結需要桌面應用程式
 	The existing action will be preserved.	將保留現有動作。
+	Cut Image	剪下圖片
+	Redact Image	遮蔽圖片
+	Create Link…	建立連結…
+	Recognize Text…	辨識文字…
 	Minimize	最小化
 	Maximize	最大化
 	Restore	還原
@@ -2224,7 +2246,139 @@ animation effects	Off	關
 # Absolute local GoToR confirmation (#1364).
 	Allow	允許
 	Only allow this if you trust the source document.	只有在您信任來源文件時，才允許此操作。
+	Open in Full Screen mode?	要以全螢幕模式開啟嗎？
+	This document asks to open in Full Screen mode: the page fills the screen and nothing else shows. Press Esc at any time to leave it.	這份文件要求以全螢幕模式開啟：頁面佔滿整個螢幕，不顯示其他東西。隨時按 Esc 即可離開。
+	Full Screen	全螢幕
+	Not now	暫時不要
 	Open this local PDF?	要開啟此本機 PDF 嗎？
 	This document is trying to open a local file:	此文件正嘗試開啟本機檔案：
 	Move tag earlier	將標記前移
 	Move tag later	將標記後移
+	Turn upside down (180°)	上下顛倒 (180°)
+	4 x 6 in label (101.6 x 152.4 mm)	4 × 6 英吋標籤 (101.6 × 152.4 公釐)
+	Cuts each page to its printed area, turns it upright and fits it to the sheet without stretching. One label per sheet.	將每頁裁切至其列印區域，轉正後不拉伸地符合紙張。每張紙一個標籤。
+	Find untagged content	尋找未標記的內容
+	No untagged content was found.	找不到未標記的內容。
+	Found {n} untagged content problems.	發現 {n} 個未標記內容問題。
+	Tag form fields	標記表單欄位
+	Mark as artifact	標記為成品
+	Remove this leaf tag from reading order and mark its direct content as an artifact	從閱讀順序中移除此葉標記，並將其直接內容標記為成品
+	Mark content as artifact	將內容標記為成品
+	About	關於
+	Contributors	貢獻者
+	Models	模型
+	Show	顯示
+	Username	使用者名稱
+	Display name	顯示名稱
+	Real name	真實姓名
+	Sort	排序
+	Name (A–Z)	名稱（A–Z）
+	Merged PRs	已合併的 PR
+	PRs	PR
+	Commits	提交次數
+	Lines added	新增行數
+	Lines deleted	刪除行數
+	Line delta	行數增減
+	Binary assets added	新增的二進位資產
+	Binary assets removed	移除的二進位資產
+	First commit	首次提交
+	Last commit	最近提交
+	+LOC	新增行
+	−LOC	刪除行
+	ΔLOC	行數增減
+	+Bin	新增二進位
+	−Bin	移除二進位
+	First	首次提交
+	Last	最近提交
+	Reverse the order	反轉順序
+	Grab bag	精簡
+	Table	表格
+	{n} contributors · {c} commits	{n} 位貢獻者 · {c} 次提交
+	No contributor data was built into this copy.	此版本未內建貢獻者資料。
+	@{login}: {prs} PRs, {commits} commits, +{added} / −{deleted} lines (Δ {delta}), +{bin_added} / −{bin_deleted} binary assets, {first} – {last}	@{login}：{prs} 個 PR、{commits} 次提交、+{added} / −{deleted} 行（Δ {delta}）、+{bin_added} / −{bin_deleted} 個二進位資產，{first} – {last}
+	No model credits were built into this copy.	此版本未內建模型致謝資料。
+	Company	公司
+	Model	模型
+	% of all commits	佔全部提交的百分比
+	Lines +/−	行數 +/−
+	Only continue if you trust this document. An address can carry information from the document, such as what you typed into its form.	請僅在信任此文件時繼續。網址可能夾帶文件中的資訊，例如您在表單中輸入的內容。
+	Print single-sided. Keep the sheets in order, cut at the marks, then stack the piles left to right, top to bottom.	請單面列印。保持紙張順序，沿裁切標記裁切，再依由左至右、由上至下的順序疊放各疊紙張。
+	Flatten Fill & Sign when saving	儲存時將填寫與簽署內容平面化
+	Text, marks and signatures become part of the page. Other comments stay editable.	文字、標記和簽名會成為頁面的一部分。其他註解仍可編輯。
+	Offset from centre	距中心的位移
+	Line ending	線條端點
+	Change {what}	變更{what}
+	Cut and stack	裁切後疊放
+	Default workspace mode	預設工作區模式
+	Default page display	預設頁面顯示
+	Default zoom	預設縮放
+	Documents and view	文件與檢視
+	Open email app	開啟電子郵件應用程式
+	Open link	開啟連結
+	Open this web page?	要開啟此網頁嗎？
+	Scripts run in a sandbox without file or network access. A script that asks to open a web page needs your permission first. With JavaScript off, Acrobat's standard format, validate and calculate functions still work.	指令碼在沙箱中執行，無法存取檔案或網路。指令碼要開啟網頁時，需要先經過您的允許。關閉 JavaScript 後，Acrobat 的標準格式、驗證和計算函式仍可運作。
+	Sign yourself	自行簽署
+	Used when opening PDFs. An explicit launch or control mode takes precedence for the session.	開啟 PDF 時使用。若啟動時或透過控制通道明確指定了模式，則本次工作階段以該模式為準。
+	Used when a PDF doesn't ask for a layout or zoom. Continuous scrolling never snaps between pages.	在 PDF 未指定版面配置或縮放時使用。連續捲動不會在頁面之間自動對齊。
+	Write this email?	要撰寫這封電子郵件嗎？
+	{who} in this document wants to open this address in your browser:	此文件中的{who}想在瀏覽器中開啟這個網址：
+	{who} in this document wants to open your email app with this address:	此文件中的{who}想用這個地址開啟您的電子郵件應用程式：
+	This web address mixes letters from different alphabets, a common way to imitate another site's name.	這個網址混用了不同字母系統的字母，這是仿冒其他網站名稱的常見手法。
+	This web address uses letters from another alphabet, which can look like familiar ones.	這個網址使用了其他字母系統的字母，看起來可能和常見字母很像。
+	Create PDF from images	從圖片建立 PDF
+	Selected image files: {count}	已選取的圖片檔案：{count}
+	Use image resolution	使用圖片解析度
+	Use each image's embedded DPI; use 72 DPI when it is absent.	使用每張圖片內嵌的 DPI；沒有時使用 72 DPI。
+	Use 72 DPI (one point per pixel)	使用 72 DPI（每個像素一點）
+	Use custom DPI	使用自訂 DPI
+	DPI sets the printed page size without resampling the image.	DPI 決定列印時的頁面大小，不會重新取樣圖片。
+	Create	建立
+	Dynamic XFA form laid out from its template: {pages}, {fields}.	依範本排版的動態 XFA 表單：{pages}、{fields}。
+	XFA form: its fields and its XFA data are kept in step, so other viewers show what you fill in.	XFA 表單：欄位與 XFA 資料會保持同步，因此其他檢視器也會顯示您填寫的內容。
+@plural	{n} page|{n} pages	{n} 頁
+@plural	{n} field|{n} fields	{n} 個欄位
+	PDF page: {size}	PDF 頁面：{size}
+	Match page at 100%	以 100% 符合頁面
+	PDF scale: {scale}%	PDF 比例：{scale}%
+	Printer paper and scaling may differ. Check driver settings.	印表機的紙張與縮放可能不同，請檢查驅動程式設定。
+	Drawing scale changes. Use Actual size for full-scale plans.	圖面比例會改變。如需原尺寸的圖面，請使用「實際大小」。
+	Done adding text	完成新增文字
+	Discard this text (Esc)	捨棄此文字（Esc）
+	Word count	字詞統計
+	Current page only	僅目前頁面
+	Exclude tagged tables	排除帶標籤的表格
+	Exclude tagged code blocks	排除帶標籤的程式碼區塊
+	Exclude image/OCR text	排除影像/OCR文字
+	Exclusions use PDF tags. Untagged tables and code remain included. Image exclusion also removes invisible text.	排除規則使用PDF標籤。沒有標籤的表格和程式碼仍計入統計。排除影像時也會排除不可見文字。
+	Words	詞數
+	Characters	字元數
+	Characters without spaces	不含空白的字元數
+	Pages counted	已統計頁數
+	Some pages contain no countable text. Scanned images need OCR first.	部分頁面沒有可統計的文字。掃描影像需要先進行OCR辨識。
+	Some content could not be classified safely and was kept in the count.	部分內容無法可靠分類，已保留在統計中。
+	Counting words… {n} pages read	正在統計字詞… 已讀取{n}頁
+	Word counting stopped unexpectedly.	字詞統計意外停止。
+	Word count…	字詞統計…
+@id	file.word_count	字詞統計…
+	Standard	標準
+	Mobile	行動裝置
+	Merge image fragments	合併影像片段
+	Optimizing… merging image fragments	正在最佳化… 正在合併影像片段
+	Side by side	並排
+	New file only	僅新檔案
+	Old file: {name}	舊檔案：{name}
+	New file: {name}	新檔案：{name}
+	Print as image	以影像列印
+	Resolution:	解析度：
+	Use it when a printer skips text, shading or transparency. The print is no longer searchable text; with Print in grayscale, the pictures are grey.	當印表機漏印文字、漸層或透明效果時使用。列印結果不再是可搜尋的文字；搭配灰階列印時影像為灰色。
+	Crop Image	裁切影像
+	Remove Crop	移除裁切
+	Trim the picture with its handles; Enter or Done applies	用控點裁切圖片;按 Enter 或「完成」套用
+	Redaction mark appearance	塗黑標記外觀
+	Outline colour:	輪廓色彩:
+	Fill colour:	填滿色彩:
+	Shown while the pointer is over a mark.	指標位於標記上方時顯示。
+	Opacity:	不透明度:
+	Make properties default	將內容設為預設
+	Pages selected	選取的頁面
+	Page properties	頁面屬性
diff --git a/crates/ui-egui/src/js_ui.rs b/crates/ui-egui/src/js_ui.rs
index fe474622c..df461fc6e 100644
--- a/crates/ui-egui/src/js_ui.rs
+++ b/crates/ui-egui/src/js_ui.rs
@@ -382,7 +382,7 @@ pub(crate) fn preferences_body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tok
     #[cfg(not(target_arch = "wasm32"))]
     ui.add(widgets::checkbox(&mut app.reload_changed_files, tl!("Reload documents when their files change on disk")));
     ui.horizontal(|ui| {
-        ui.label(tl!("Mouse wheel scroll speed"));
+        ui.label(tl!("Scroll speed (mouse wheel and arrow keys)"));
         for speed in crate::scroll_speed::ScrollSpeed::ALL {
             widgets::radio_value(ui, &mut app.scroll_speed, speed, tl_ctx!("scroll speed", speed.label()));
         }
@@ -467,6 +467,7 @@ pub(crate) fn preferences_body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tok
         let label = ui.label(tl!("Name on new comments"));
         ui.add(crate::widgets::line(&mut app.comment_prefs.author).desired_width(220.0).char_limit(crate::MAX_AUTHOR_CHARS)).labelled_by(label.id);
     });
+    ui.add(widgets::checkbox(&mut app.comment_prefs.hide_empty_highlight_hover, tl!("Hide hover previews for highlights without comment text")));
     ui.add_space(8.0);
     ui.label(egui::RichText::new(tl!("Fill & Sign")).font(theme::semibold(13.0)));
     ui.add(widgets::checkbox(&mut app.flatten_fill_sign_on_save, tl!("Flatten Fill & Sign when saving")));
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index f800ad6a0..d101d812e 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -7,6 +7,12 @@
 
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
+/// Whether `a` and `b` name the same file: equal, or equal once made absolute against the
+/// current directory (links are not resolved, as in `last_session`).
+pub(crate) fn same_file(a: &str, b: &str) -> bool {
+    a == b || matches!((std::path::absolute(a), std::path::absolute(b)), (Ok(x), Ok(y)) if x == y)
+}
+
 /// Translate an English UI string into the current language (see [`i18n`]).
 macro_rules! tl {
     ($s:expr) => {
@@ -73,11 +79,13 @@ mod bidi;
 pub mod bulk_fields;
 mod dialogs;
 mod edit_text_ui;
+pub use edit_text_ui::CropMode;
 mod editing;
 #[cfg(not(target_arch = "wasm32"))]
 pub mod file_watch;
 mod files;
 pub mod fill_sign;
+mod fling;
 pub mod folders_ui;
 pub mod forms_ui;
 mod home;
@@ -96,6 +104,7 @@ mod print_ui;
 mod signature_drag;
 pub mod units;
 mod web_print;
+mod word_count_ui;
 pub use print_ui::{Handling as PrintHandling, PrintDraft, PrinterSource, Which as PrintWhich, system_printers};
 mod redact_ui;
 pub use redact_ui::{HiddenDraft, PagesDraft as RedactPagesDraft, RedactPrefs, SearchDraft as RedactSearchDraft, SearchMode as RedactSearchMode};
@@ -119,6 +128,7 @@ pub(crate) const MAX_AUTHOR_CHARS: usize = 200;
 
 #[cfg(not(target_arch = "wasm32"))]
 mod open_worker;
+mod organize_panel;
 pub mod portable;
 mod protect;
 mod recovery;
@@ -250,9 +260,11 @@ fn read_grid_file((name, source): GridFile) -> Result<(String, Vec<u8>), (String
     Ok((name, bytes))
 }
 
-/// Files dropped on a document's page grid.
+/// Files dropped on a document's page grid or its Pages panel.
 struct GridDrop {
     doc: pdfcraft_engine::DocId,
+    /// Dropped on the Pages panel (its gap decides where they go), not the page grid.
+    panel: bool,
     files: Vec<GridFile>,
     /// When to stop waiting for the pointer (egui time, seconds).
     deadline: f64,
@@ -260,6 +272,7 @@ struct GridDrop {
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum Dialog {
+    WordCount,
     CreateImages,
     Properties(PropsTab),
     About,
@@ -294,6 +307,8 @@ pub enum Dialog {
     Print,
     /// File ▸ Revert confirmation.
     Revert,
+    /// Save over a file that changed on disk since the document came from it (#2166).
+    OverwriteChanged,
     /// Link Properties.
     LinkProps,
     /// Organize ▸ Extract (options), Rotate Pages.
@@ -604,6 +619,9 @@ pub struct PdfCraftApp {
     pub host_dirty: Option<HostDirtyFn>,
     /// A pending "save changes?" question (closing a dirty tab or quitting).
     pub close_request: Option<CloseRequest>,
+    /// A save waiting behind [`Dialog::OverwriteChanged`] (the web build has no files to check).
+    #[cfg(not(target_arch = "wasm32"))]
+    pub pending_overwrite: Option<editing::PendingOverwrite>,
     /// Save to this path instead of asking (tests and automation).
     pub save_override: Option<String>,
     /// Document Properties ▸ Description fields being edited: (document, Title/Author/Subject/Keywords).
@@ -738,6 +756,7 @@ pub struct PdfCraftApp {
     pub bookmark_rename: Option<(Vec<usize>, String)>,
     /// Number pages dialog settings (1-based pages).
     pub number_draft: NumberDraft,
+    pub(crate) word_count_draft: word_count_ui::Draft,
     /// Protect Using Password dialog state.
     pub protect_draft: protect::ProtectDraft,
     /// Set Page Boxes dialog state.
@@ -767,6 +786,10 @@ pub struct PdfCraftApp {
     pub field_props: Option<prepare::FieldDraft>,
     pub bulk_field_props: Option<bulk_fields::Draft>,
     pub redact_prefs: RedactPrefs,
+    /// The Redaction Tool Properties kept for the next run (what the last OK with "Make
+    /// properties default" ticked left), and the values before the dialog opened, for Cancel.
+    pub redact_defaults: RedactPrefs,
+    pub redact_before: Option<RedactPrefs>,
     pub redact_pages_draft: RedactPagesDraft,
     pub redact_search: RedactSearchDraft,
     pub hidden_draft: HiddenDraft,
@@ -780,6 +803,9 @@ pub struct PdfCraftApp {
     pub last_opened_url: Option<String>,
     /// A document asked to open this address; the user hasn't answered yet (#90, #91).
     pub pending_link: Option<PendingLink>,
+    /// A document just opened asks to be shown in Full Screen mode (`/PageMode /FullScreen`):
+    /// the person is asked first, as in Acrobat, and this is the document waiting for the answer.
+    pub pending_full_screen: Option<DocId>,
     /// An absolute GoToR target waiting for approval, before any target-file I/O (#1364).
     pub pending_remote_link: Option<PendingRemoteLink>,
 }
@@ -936,6 +962,8 @@ impl PdfCraftApp {
             host_save: None,
             host_dirty: None,
             close_request: None,
+            #[cfg(not(target_arch = "wasm32"))]
+            pending_overwrite: None,
             save_override: None,
             props_draft: None,
             view_draft: None,
@@ -1012,6 +1040,7 @@ impl PdfCraftApp {
             bookmark_rename: None,
             last_opened_url: None,
             pending_link: None,
+            pending_full_screen: None,
             pending_remote_link: None,
             protect_draft: Default::default(),
             boxes_draft: Default::default(),
@@ -1032,6 +1061,8 @@ impl PdfCraftApp {
             field_props: None,
             bulk_field_props: None,
             redact_prefs: RedactPrefs::default(),
+            redact_defaults: RedactPrefs::default(),
+            redact_before: None,
             redact_pages_draft: RedactPagesDraft::default(),
             redact_search: RedactSearchDraft::default(),
             hidden_draft: HiddenDraft::default(),
@@ -1040,6 +1071,7 @@ impl PdfCraftApp {
             text_style: content_ui::default_style(),
             replace_draft: None,
             number_draft: NumberDraft { from: 1, to: 1, style: pdfcraft_engine::LabelStyle::Decimal, prefix: String::new(), start: 1 },
+            word_count_draft: word_count_ui::Draft::default(),
         }
     }
 
@@ -1145,12 +1177,19 @@ impl PdfCraftApp {
 
     #[cfg(not(target_arch = "wasm32"))]
     fn poll_pending_opens(&mut self) {
-        let mut ready = Vec::new();
-        let mut waiting = Vec::new();
         let pending_opens = std::mem::take(&mut self.pending_opens);
-        for pending in pending_opens {
+        let mut remaining = pending_opens.into_iter();
+        let mut waiting = Vec::new();
+        while let Some(pending) = remaining.next() {
+            // A tool, password prompt or file picker belongs to the document just admitted.
+            // Keep later replies queued so another open cannot change its recipient.
+            if self.modal_open() || self.pickers.pending() {
+                waiting.push(pending);
+                waiting.extend(remaining);
+                break;
+            }
             match pending.receiver.try_recv() {
-                Ok(result) if result.token == pending.token => ready.push((pending, result.kind)),
+                Ok(result) if result.token == pending.token => self.finish_pending_open(pending, result.kind),
                 Ok(_) => waiting.push(pending),
                 Err(std::sync::mpsc::TryRecvError::Empty) => waiting.push(pending),
                 Err(std::sync::mpsc::TryRecvError::Disconnected) => {
@@ -1158,10 +1197,10 @@ impl PdfCraftApp {
                 }
             }
         }
+        // A completion may schedule another open; preserve those requests as well as the
+        // earlier waiting replies, without consuming a blocked receiver's result.
+        waiting.append(&mut self.pending_opens);
         self.pending_opens = waiting;
-        for (pending, kind) in ready {
-            self.finish_pending_open(pending, kind);
-        }
     }
 
     #[cfg(not(target_arch = "wasm32"))]
@@ -1296,12 +1335,17 @@ impl PdfCraftApp {
             self.active = Some(self.views.len() - 1);
         }
         self.apply_initial_view(self.views.len() - 1, &initial);
+        // Full screen is asked for, never taken: a document can't put the app in full screen on
+        // its own (the prompt is `dialogs::full_screen_prompt`).
+        if activate && initial.full_screen {
+            self.pending_full_screen = Some(id);
+        }
         if activate
             && self.left_open
             && self.left == LeftPanel::Tool("organize")
             && let Some(view) = self.views.last_mut()
         {
-            view.organize = true;
+            view.open_organize();
         }
         if activate && let Some(mode) = self.mode_override {
             // Explicit mode options do not reset independent --tool / --left choices.
@@ -1368,11 +1412,29 @@ impl PdfCraftApp {
         (self.dialog.is_none() && self.session.get(view.id)?.allows_assembly()).then_some(view.id)
     }
 
-    /// Files dropped while the page grid shows are inserted into it rather than opened: they
-    /// are kept until [`Self::finish_grid_drop`] knows the gap. Returns the files not taken.
+    /// The document whose Pages panel is under the pointer and may take pages, if any.
+    #[cfg(not(target_arch = "wasm32"))]
+    fn panel_target(&self, ctx: &egui::Context) -> Option<pdfcraft_engine::DocId> {
+        let view = self.active.and_then(|i| self.views.get(i))?;
+        let pointer = ctx.input(|i| i.pointer.hover_pos())?;
+        let over = view.pages_panel.is_some_and(|panel| panel.contains(pointer));
+        (over && self.dialog.is_none() && self.session.get(view.id)?.allows_assembly()).then_some(view.id)
+    }
+
+    /// Files dropped on the Pages panel, or while the page grid shows, are inserted into the
+    /// document rather than opened: they are kept until [`Self::finish_grid_drop`] knows the
+    /// gap. Returns the files not taken.
     #[cfg(not(target_arch = "wasm32"))]
     fn drop_on_grid(&mut self, dropped: Vec<egui::DroppedFileHandle>, ctx: &egui::Context) -> Vec<egui::DroppedFileHandle> {
-        let Some(id) = self.grid_target().filter(|_| !dropped.is_empty()) else { return dropped };
+        if dropped.is_empty() {
+            return dropped;
+        }
+        // The panel first: the grid takes files dropped anywhere in the window.
+        let (id, panel) = match (self.panel_target(ctx), self.grid_target()) {
+            (Some(id), _) => (id, true),
+            (None, Some(id)) => (id, false),
+            (None, None) => return dropped,
+        };
         let mut files = Vec::new();
         for f in &dropped {
             let name = f.path().file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_else(|| "dropped.pdf".into());
@@ -1389,22 +1451,29 @@ impl PdfCraftApp {
             // Where there is no telling where the pointer is during the drag, its place arrives
             // with the first move after the drop.
             ctx.request_repaint();
-            self.grid_drop = Some(GridDrop { doc: id, files, deadline: ctx.input(|i| i.time) + 1.0 });
+            self.grid_drop = Some(GridDrop { doc: id, panel, files, deadline: ctx.input(|i| i.time) + 1.0 });
         }
         Vec::new()
     }
 
-    /// Insert files dropped on the page grid at the gap under the pointer, or at the end when
-    /// the pointer hasn't shown up in time.
+    /// Insert files dropped on the page grid or the Pages panel at the gap under the pointer,
+    /// or at the end when the pointer hasn't shown up in time.
     fn finish_grid_drop(&mut self, ctx: &egui::Context) {
-        let Some(GridDrop { doc: id, deadline, .. }) = &self.grid_drop else { return };
-        let (id, deadline) = (*id, *deadline);
-        if self.grid_target() != Some(id) {
+        let Some(GridDrop { doc: id, panel, deadline, .. }) = &self.grid_drop else { return };
+        let (id, panel, deadline) = (*id, *panel, *deadline);
+        let still = if panel {
+            self.dialog.is_none()
+                && self.active_ids().map(|(_, active)| active) == Some(id)
+                && self.session.get(id).is_some_and(|d| d.allows_assembly())
+        } else {
+            self.grid_target() == Some(id)
+        };
+        if !still {
             self.grid_drop = None;
             return self.notify_tr("The document changed while you were choosing a file, so nothing was changed.");
         }
         let Some(view) = self.active.and_then(|i| self.views.get_mut(i)) else { return };
-        let gap = match view.grid_gap {
+        let gap = match if panel { view.panel_gap } else { view.grid_gap } {
             Some(gap) => gap,
             None if ctx.input(|i| i.time) >= deadline => usize::MAX,
             None => return ctx.request_repaint(),
@@ -1499,6 +1568,15 @@ impl PdfCraftApp {
         ctx.send_viewport_cmd(egui::ViewportCommand::Fullscreen(on));
     }
 
+    /// Answer the Full Screen mode prompt a document raised on opening: enter it, or leave the
+    /// window as it is.
+    pub fn resolve_full_screen_prompt(&mut self, ctx: &egui::Context, allow: bool) {
+        let Some(id) = self.pending_full_screen.take() else { return };
+        if allow && self.session.get(id).is_some() {
+            self.set_full_screen(ctx, true);
+        }
+    }
+
     /// Answer the password prompt (`None` cancels).
     pub fn submit_password(&mut self, password: Option<String>) {
         let Some(p) = self.password_prompt.take() else { return };
@@ -1596,10 +1674,16 @@ impl PdfCraftApp {
         }
     }
 
+    /// The tab already showing the file at `path` (the same path, or one that names the same
+    /// file once made absolute).
+    pub(crate) fn tab_showing(&self, path: &str) -> Option<usize> {
+        self.views.iter().position(|v| self.session.get(v.id).and_then(|d| d.path.as_deref()).is_some_and(|p| same_file(p, path)))
+    }
+
     /// Open a file from a recent list: focus the tab already showing it, else open it (File ▸
     /// Open Recent and the Home view's list share this).
     pub fn open_recent(&mut self, path: &str) {
-        if let Some(i) = self.views.iter().position(|v| self.session.get(v.id).and_then(|d| d.path.as_deref()) == Some(path)) {
+        if let Some(i) = self.tab_showing(path) {
             self.active = Some(i);
         } else {
             #[cfg(not(target_arch = "wasm32"))]
@@ -1696,6 +1780,18 @@ impl PdfCraftApp {
     /// Keep a chosen tool with its file until preparation and any password entry finish.
     #[cfg(not(target_arch = "wasm32"))]
     fn open_path_then(&mut self, path: &str, then: Option<&'static str>) {
+        // One file, one tab (#2166): a file that is open already comes to the front instead,
+        // and the tool it was opened for runs on it. One still being opened is left to that.
+        if let Some(i) = self.tab_showing(path) {
+            self.active = Some(i);
+            if let Some(command) = then {
+                self.execute(command);
+            }
+            return;
+        }
+        if self.pending_opens.iter().any(|p| p.path.as_deref().is_some_and(|p| same_file(p, path))) {
+            return;
+        }
         let name = std::path::Path::new(path).file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_else(|| path.to_string());
         // Taken before reading: a build that rewrites the file meanwhile still counts as a change.
         let stamp = file_watch::Stamp::at(path);
@@ -2028,11 +2124,17 @@ impl PdfCraftApp {
         self.left = LeftPanel::Tool(id);
         self.reveal_tools();
         if let Some(view) = self.active.and_then(|i| self.views.get_mut(i)) {
-            view.organize = id == "organize";
+            if id == "organize" {
+                view.open_organize();
+            } else {
+                view.organize = false;
+            }
         }
     }
 
-    /// Select the workspace and its matching tool panel, just like the mode bar.
+    /// Select the workspace and its matching tool panel, just like the mode bar. Edit turns on
+    /// Edit text & images at once, as Acrobat does: every paragraph and image on the page gets its
+    /// box and is editable with one click. Leaving Edit puts the editing tools down again.
     pub(crate) fn select_mode(&mut self, mode: Mode) {
         self.mode = mode;
         self.reveal_tools();
@@ -2045,6 +2147,23 @@ impl PdfCraftApp {
             Mode::Sign => LeftPanel::Tool("fill_sign"),
             _ => LeftPanel::AllTools,
         };
+        if mode == Mode::Edit {
+            self.quick_tool = QuickTool::EditText;
+        } else if matches!(self.quick_tool, QuickTool::EditText | QuickTool::AddText) {
+            self.put_down_edit_text();
+        }
+    }
+
+    /// Back to the Select tool from an editing tool. A paragraph still open in the editor is
+    /// applied, as clicking away from it does; left open, its page would keep showing the
+    /// paragraph's text removed with no editor over it.
+    pub(crate) fn put_down_edit_text(&mut self) {
+        self.quick_tool = QuickTool::Select;
+        if let Some(ed) = self.active.and_then(|i| self.views.get_mut(i)).and_then(|v| v.line_editor.take())
+            && let Some(edit) = edit_text_ui::finished_edit(ed)
+        {
+            self.apply_edit(edit);
+        }
     }
 
     /// Switches workspace because the user chose to (mode bar, Read mode command). Entering Read
@@ -2096,7 +2215,7 @@ impl PdfCraftApp {
     /// Serialize the user's persistent state (recent files, theme). Local only.
     pub fn persist(&self) -> String {
         let trusted: Vec<String> = self.session.trusted_certificates().iter().map(pdfcraft_engine::sign::x509::to_pem).collect();
-        serde_json::json!({
+        let mut v = serde_json::json!({
             "docking": self.docking,
             "docking_left_open": self.left_open,
             "docking_right": self.right,
@@ -2155,8 +2274,12 @@ impl PdfCraftApp {
             "combine_zoom": self.combine_zoom,
             "comments_panel_closed": self.comments_panel_closed,
             "right_panel_closed": self.right_panel_closed,
-        })
-        .to_string()
+        });
+        // Set apart: one more key inside the macro above passes serde_json's recursion limit.
+        v["redact_prefs"] = self.redact_defaults.to_json();
+        // Set outside json! above, which is at serde_json's macro recursion limit.
+        v["hide_empty_highlight_hover"] = serde_json::Value::Bool(self.comment_prefs.hide_empty_highlight_hover);
+        v.to_string()
     }
 
     /// Restore state written by `persist`. Unknown or malformed data is ignored.
@@ -2234,6 +2357,10 @@ impl PdfCraftApp {
         if let Some(size) = v["fill_text_size"].as_f64().and_then(fill_sign::valid_text_size) {
             self.fill_text_size = size;
         }
+        if let Some(prefs) = RedactPrefs::from_json(&v["redact_prefs"]) {
+            self.redact_prefs = prefs.clone();
+            self.redact_defaults = prefs;
+        }
         // Settings are untrusted: an unreadable value (a colour that isn't three bytes, say)
         // fails to deserialize and keeps Off.
         if let Ok(colors) = serde_json::from_value::<pdfcraft_render::ReadingColors>(v["reading_colors"].clone()) {
@@ -2253,6 +2380,9 @@ impl PdfCraftApp {
         if let Some(author) = v["author"].as_str().map(str::trim).filter(|a| !a.is_empty()) {
             self.comment_prefs.author = author.chars().take(MAX_AUTHOR_CHARS).collect();
         }
+        if let Some(hide) = v["hide_empty_highlight_hover"].as_bool() {
+            self.comment_prefs.hide_empty_highlight_hover = hide;
+        }
         // Per-tool comment styles (#340): each field goes through its clamping setter, so a
         // malformed or hostile entry is clamped or ignored rather than trusted.
         if let Some(styles) = v["comment_styles"].as_array() {
@@ -2391,6 +2521,7 @@ impl PdfCraftApp {
                     "watermark" => Some(Dialog::Marks(pdfcraft_engine::MarkKind::Watermark)),
                     "background" => Some(Dialog::Marks(pdfcraft_engine::MarkKind::Background)),
                     "export-image" => Some(Dialog::Export(export_ui::ExportKind::Image)),
+                    "word-count" => Some(Dialog::WordCount),
                     "export-text" => Some(Dialog::Export(export_ui::ExportKind::Text)),
                     "export-all-images" => Some(Dialog::Export(export_ui::ExportKind::AllImages)),
                     "accessibility-options" => Some(Dialog::AccessibilityOptions),
@@ -2466,7 +2597,13 @@ impl PdfCraftApp {
                 "right" => true,
                 _ => return Err("tools-side must be left or right".into()),
             })?,
-            ("organize", Some(v)) => v.organize = value != "off",
+            ("organize", Some(v)) => {
+                if value == "off" {
+                    v.organize = false;
+                } else {
+                    v.open_organize();
+                }
+            }
             // `--grid-zoom 150`: the size of the pages in the organize grid, in percent.
             ("grid-zoom", Some(v)) => {
                 let percent = value.trim_end_matches('%').parse::<f32>().map_err(|e| e.to_string())?;
@@ -2555,6 +2692,13 @@ impl PdfCraftApp {
                 };
             }
             ("author", _) => self.comment_prefs.author = value.to_string(),
+            ("hide-empty-highlight-hover", _) => {
+                self.comment_prefs.hide_empty_highlight_hover = match value {
+                    "true" => true,
+                    "false" => false,
+                    _ => return Err("hide-empty-highlight-hover must be true or false".into()),
+                };
+            }
             ("ui-scale", _) => self.ui_scale = ui_scale::parse(value)?,
             ("system-title-bar", _) => {
                 self.system_title_bar = match value {
@@ -2669,7 +2813,7 @@ impl PdfCraftApp {
             {
                 object_ui::nudge_keys(ctx, &mut self.views[i], doc);
             }
-            canvas::shortcuts(&mut self.views[i], ctx);
+            canvas::shortcuts(&mut self.views[i], ctx, self.scroll_speed);
             self.copy_key(i, ctx);
             self.image_pick_keys(i, ctx);
         }
@@ -2701,10 +2845,19 @@ impl PdfCraftApp {
         if !copy || ctx.egui_wants_keyboard_input() {
             return;
         }
-        let Some((id, text)) = self.views.get(i).and_then(|v| Some((v.id, v.selected_text()?))) else { return };
-        if self.may_copy(id) {
-            ctx.copy_text(text);
+        self.copy_selected_text(i, ctx);
+    }
+
+    /// Shared permission gate for copying selected page text from menus and keyboard events.
+    pub(crate) fn copy_selected_text(&mut self, i: usize, ctx: &egui::Context) -> bool {
+        let Some((id, text)) = self.views.get(i).and_then(|v| Some((v.id, v.selected_text()?))).filter(|(_, text)| !text.is_empty()) else {
+            return false;
+        };
+        if !self.may_copy(id) {
+            return false;
         }
+        ctx.copy_text(text);
+        true
     }
 
     /// The quick tools' keys, as in Acrobat: V selects, H pans, and holding Space pans until it
@@ -2872,6 +3025,8 @@ impl eframe::App for PdfCraftApp {
             self.control = Some(control);
         }
         self.guard_quit(ctx);
+        // macOS: quit through `terminate:` instead of dropping the window (Touch Bar crash, #1136).
+        craft_quit::on_close_request(ctx);
         let now = ctx.input(|i| i.time);
         self.autosave_tick(now);
         // Reload documents whose files a build rewrote (#431).
@@ -2945,7 +3100,10 @@ impl eframe::App for PdfCraftApp {
                 ui,
                 |ui| {
                     if let Some(i) = self.active {
-                        canvas::document_area(self, i, ui);
+                        match compare_ui::side_by_side(self, i) {
+                            Some((old, new)) => compare_ui::compare_area(self, old, new, ui),
+                            None => canvas::document_area(self, i, ui),
+                        }
                     }
                 },
             );
@@ -2982,7 +3140,10 @@ impl eframe::App for PdfCraftApp {
                 match self.active {
                     None if self.combine_showing() => combine_ui::page(self, ui),
                     None => home::show(self, ui),
-                    Some(index) => canvas::document_area(self, index, ui),
+                    Some(index) => match compare_ui::side_by_side(self, index) {
+                        Some((old, new)) => compare_ui::compare_area(self, old, new, ui),
+                        None => canvas::document_area(self, index, ui),
+                    },
                 }
             } else {
                 docking::show(self, ui);
@@ -3003,17 +3164,22 @@ impl PdfCraftApp {
         self.combine_thumbs_frame(ctx);
         // Retire hidden documents before admitting the visible document's textures, so the
         // three cache limits apply to the application, regardless of how many tabs are open.
+        // Side by side: the comparison's old file renders alongside the active one.
+        let partner = self.active.and_then(|i| compare_ui::side_by_side(self, i)).map(|(old, _)| old);
         for (i, view) in self.views.iter_mut().enumerate() {
             if Some(i) != self.active
+                && Some(i) != partner
                 && let Some(doc) = self.session.get(view.id)
             {
                 view.suspend_rendering(&doc.renderer);
             }
         }
-        if let Some(view) = self.active.and_then(|i| self.views.get_mut(i))
-            && let Some(doc) = self.session.get(view.id)
-        {
-            view.finish_render_frame(ctx, &doc.info, &doc.renderer);
+        for i in self.active.into_iter().chain(partner) {
+            if let Some(view) = self.views.get_mut(i)
+                && let Some(doc) = self.session.get(view.id)
+            {
+                view.finish_render_frame(ctx, &doc.info, &doc.renderer);
+            }
         }
     }
 }
diff --git a/crates/ui-egui/src/link_ui.rs b/crates/ui-egui/src/link_ui.rs
index a969a195d..c714870c5 100644
--- a/crates/ui-egui/src/link_ui.rs
+++ b/crates/ui-egui/src/link_ui.rs
@@ -149,7 +149,7 @@ impl PdfCraftApp {
     /// Open Link Properties for a new link area or an existing link.
     pub(crate) fn open_link_props(&mut self, page: usize, rect: Option<[f64; 4]>, index: Option<usize>) {
         let Some((_, id)) = self.active_ids() else { return };
-        let existing = index.and_then(|i| self.session.get(id).and_then(|d| d.links.iter().find(|l| l.page == page && l.index == i).cloned()));
+        let existing = index.and_then(|i| self.session.get(id).and_then(|d| d.links().iter().find(|l| l.page == page && l.index == i).cloned()));
         let draft = match existing {
             Some(l) => LinkDraft {
                 page,
@@ -203,7 +203,7 @@ impl PdfCraftApp {
     /// Remove every link in the active document.
     pub fn remove_all_links(&mut self) {
         let Some((_, id)) = self.active_ids() else { return };
-        let count = self.session.get(id).map_or(0, |d| d.links.len());
+        let count = self.session.get(id).map_or(0, |d| d.links().len());
         if count == 0 {
             self.notify_tr("No links to remove");
             return;
diff --git a/crates/ui-egui/src/marks_ui.rs b/crates/ui-egui/src/marks_ui.rs
index 84214fc2f..4a60c40a6 100644
--- a/crates/ui-egui/src/marks_ui.rs
+++ b/crates/ui-egui/src/marks_ui.rs
@@ -384,20 +384,29 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens, kind: M
             }
         });
     });
+    // Text the standard fonts can't draw is refused on apply (#125), so it's refused here, with the
+    // preview (drawn in the interface font, which can draw it) no longer the only answer (#2013).
+    let undrawable = undrawable(kind, d);
+    if let Some(c) = undrawable {
+        ui.add_space(6.0);
+        ui.label(egui::RichText::new(crate::content_ui::undrawable_message(c)).small().color(crate::content_ui::UNDRAWABLE));
+    }
     ui.add_space(10.0);
     let (mut apply, mut cancel) = (false, false);
     ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
-        let ready = match kind {
-            MarkKind::HeaderFooter => d.hf.text.iter().any(|x| !x.trim().is_empty()),
-            MarkKind::Watermark => {
-                if d.use_file {
-                    d.file.is_some()
-                } else {
-                    !d.wm.text.trim().is_empty()
+        let ready = undrawable.is_none()
+            && match kind {
+                MarkKind::HeaderFooter => d.hf.text.iter().any(|x| !x.trim().is_empty()),
+                MarkKind::Watermark => {
+                    if d.use_file {
+                        d.file.is_some()
+                    } else {
+                        !d.wm.text.trim().is_empty()
+                    }
                 }
+                MarkKind::Background => !d.use_file || d.file.is_some(),
             }
-            MarkKind::Background => !d.use_file || d.file.is_some(),
-        } && !d.range.pages(count).is_empty();
+            && !d.range.pages(count).is_empty();
         if ui.add_enabled_ui(ready, |ui| widgets::pill_button(ui, tl!("OK"), true)).inner.clicked() {
             apply = true;
         }
@@ -425,6 +434,16 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens, kind: M
     (apply, cancel)
 }
 
+/// The first character of the dialog's text that applying would refuse (the standard fonts can't
+/// draw it), as the engine decides it. Pictures draw no text.
+fn undrawable(kind: MarkKind, d: &MarksDraft) -> Option<char> {
+    match kind {
+        MarkKind::HeaderFooter => d.hf.first_undrawable(),
+        MarkKind::Watermark if !d.use_file => d.wm.first_undrawable(),
+        MarkKind::Watermark | MarkKind::Background => None,
+    }
+}
+
 fn mark_file(d: &MarksDraft) -> Option<pdfcraft_engine::MarkFile> {
     let (name, bytes) = d.file.clone().filter(|_| d.use_file)?;
     Some(pdfcraft_engine::MarkFile { name, bytes, page: d.file_page.max(1) - 1 })
@@ -478,6 +497,20 @@ pub fn edit(d: &MarksDraft, kind: MarkKind, count: usize) -> Edit {
 mod tests {
     use super::*;
 
+    #[test]
+    fn text_applying_would_refuse_is_caught_in_the_dialog() {
+        let mut d = MarksDraft::default();
+        d.hf.text[5] = "Страница <<1>> из <<n>> / Page <<1>> of <<n>>".into();
+        assert_eq!(undrawable(MarkKind::HeaderFooter, &d), Some('С'), "#2013: refused before OK, not after");
+        d.hf.text[5] = "Page <<1>> of <<n>> — café".into();
+        assert_eq!(undrawable(MarkKind::HeaderFooter, &d), None);
+        d.wm.text = "ΑΠΟΡΡΗΤΟ".into();
+        assert_eq!(undrawable(MarkKind::Watermark, &d), Some('Α'));
+        d.use_file = true;
+        assert_eq!(undrawable(MarkKind::Watermark, &d), None, "a picture watermark draws no text");
+        assert_eq!(undrawable(MarkKind::Background, &d), None);
+    }
+
     #[test]
     fn page_ranges_with_subsets() {
         let r = PageRange::default();
diff --git a/crates/ui-egui/src/object_ui.rs b/crates/ui-egui/src/object_ui.rs
index 118946bd0..025e72d5e 100644
--- a/crates/ui-egui/src/object_ui.rs
+++ b/crates/ui-egui/src/object_ui.rs
@@ -232,7 +232,7 @@ fn input(s: &mut ObjectSelection, ui: &egui::Ui, resp: &egui::Response, xf: &Pag
         } else {
             s.gesture = Some(gesture);
         }
-        ui.ctx().set_cursor_icon(if gesture.marquee { egui::CursorIcon::Crosshair } else { egui::CursorIcon::Grabbing });
+        ui.ctx().set_cursor_icon(if gesture.marquee { egui::CursorIcon::Crosshair } else { egui::CursorIcon::Move });
         return true;
     }
     let Some(p) = pointer.filter(|p| xf.rect.contains(*p) && ui.clip_rect().contains(*p) && resp.rect.contains(*p)) else {
@@ -242,7 +242,7 @@ fn input(s: &mut ObjectSelection, ui: &egui::Ui, resp: &egui::Response, xf: &Pag
         if s.page == Some(page) && !s.selected.is_empty() {
             let union = s.selected.iter().fold(Rect::NOTHING, |r, o| r.union(screen(xf, info, page, o)));
             if union.contains(p) {
-                ui.ctx().set_cursor_icon(egui::CursorIcon::Grab);
+                ui.ctx().set_cursor_icon(egui::CursorIcon::Move);
             }
             return true;
         }
diff --git a/crates/ui-egui/src/open_worker_tests.rs b/crates/ui-egui/src/open_worker_tests.rs
index 306d8e9ac..75ce82314 100644
--- a/crates/ui-egui/src/open_worker_tests.rs
+++ b/crates/ui-egui/src/open_worker_tests.rs
@@ -2,6 +2,7 @@ use std::sync::{Arc, Mutex};
 use std::time::Duration;
 
 use egui_kittest::Harness;
+use egui_kittest::kittest::Queryable;
 use serde_json::{Value, json};
 
 use crate::{PdfCraftApp, control::ControlClient, open_worker};
@@ -406,3 +407,204 @@ fn a_startup_document_waits_for_an_active_document_to_prepare() {
     assert_eq!(harness.state().active, Some(0), "the chosen document keeps focus");
     let _ = std::fs::remove_file(path);
 }
+
+#[test]
+#[allow(clippy::expect_used)]
+fn tool_modal_keeps_picked_recipient_when_other_open_is_ready() {
+    for same_batch in [true, false] {
+        let timing = if same_batch { "batch" } else { "later" };
+        let original_a = fixture(2);
+        let original_b = fixture(1);
+        let picked = tool_open_file(&format!("recipient-{timing}-a"), "pdf", &original_a);
+        let other = tool_open_file(&format!("recipient-{timing}-b"), "pdf", &original_b);
+        let mut harness = tool_open_harness();
+        harness.state_mut().pick_override = Some(vec![picked.0.to_string_lossy().into_owned()]);
+        let held = HeldToolOpen::install(&mut harness);
+        harness.state_mut().run_command("export.text");
+        harness.step();
+        held.started.recv_timeout(Duration::from_secs(5)).expect("picked A reached prepare barrier");
+        harness.state_mut().open_path(other.0.to_string_lossy().as_ref());
+        held.release.send(()).expect("release picked A");
+        held.finished.recv_timeout(Duration::from_secs(5)).expect("picked A is ready");
+        held.started.recv_timeout(Duration::from_secs(5)).expect("ordinary B reached prepare barrier");
+        if same_batch {
+            held.release.send(()).expect("release ordinary B before A admission");
+            held.finished.recv_timeout(Duration::from_secs(5)).expect("ordinary B is also ready");
+        }
+        harness.step();
+        assert!(matches!(harness.state().dialog, Some(crate::Dialog::Export(_))));
+        let active = harness.state().active.expect("active Export recipient");
+        let doc = harness.state().session.get(harness.state().views[active].id).expect("Export recipient document");
+        assert_eq!(doc.path.as_deref(), Some(picked.0.to_string_lossy().as_ref()), "Export must retain picked A in {timing} completion timing");
+        assert_eq!(doc.info.pages.len(), 2);
+        assert!(!doc.dirty && doc.can_undo().is_none() && doc.can_redo().is_none());
+        assert_eq!(doc.saved_bytes().as_slice(), original_a.as_slice());
+        assert_eq!(harness.state().views.len(), 1);
+        assert_eq!(harness.state().pending_opens.len(), 1);
+        if !same_batch {
+            held.release.send(()).expect("release ordinary B after A Export opens");
+            held.finished.recv_timeout(Duration::from_secs(5)).expect("ordinary B is now ready");
+        }
+        harness.run_steps(2);
+        assert!(matches!(harness.state().dialog, Some(crate::Dialog::Export(_))));
+        assert_eq!(harness.state().active, Some(active));
+        assert_eq!(harness.state().views.len(), 1, "ready B stays unadmitted while A's modal is open");
+        assert_eq!(harness.state().pending_opens.len(), 1);
+        assert_eq!(harness.state().pending_opens[0].path.as_deref(), Some(other.0.to_string_lossy().as_ref()));
+        // Use the actual modal's Cancel button, rather than clearing its state directly.
+        harness.get_by_label("Cancel").click();
+        harness.run_steps(2);
+        assert!(harness.state().dialog.is_none() && harness.state().pending_opens.is_empty());
+        assert_eq!(harness.state().views.len(), 2, "cancel releases B's retained result exactly once");
+        let active = harness.state().active.expect("ordinary B activates after cancel");
+        let doc = harness.state().session.get(harness.state().views[active].id).expect("ordinary B document");
+        assert_eq!(doc.path.as_deref(), Some(other.0.to_string_lossy().as_ref()));
+        assert_eq!(doc.info.pages.len(), 1);
+        assert!(!doc.dirty && doc.can_undo().is_none() && doc.can_redo().is_none());
+        assert_eq!(doc.saved_bytes().as_slice(), original_b.as_slice());
+        harness.run_steps(2);
+        assert_eq!(harness.state().views.len(), 2);
+        assert!(harness.state().dialog.is_none(), "A's tool does not run again after B admission");
+        for (file, original) in [(&picked, &original_a), (&other, &original_b)] {
+            assert_eq!(std::fs::read(&file.0).expect("read unchanged modal fixture"), *original);
+        }
+    }
+}
+
+#[test]
+#[allow(clippy::expect_used)]
+fn tool_password_prompt_retains_other_ready_open_through_retry() {
+    let protected = encrypted_tool_fixture();
+    let picked = tool_open_file("password-recipient-a", "pdf", &protected);
+    let other = tool_open_file("password-recipient-b", "pdf", &fixture(2));
+    let mut harness = tool_open_harness();
+    harness.state_mut().pick_override = Some(vec![picked.0.to_string_lossy().into_owned()]);
+    let held = HeldToolOpen::install(&mut harness);
+    harness.state_mut().run_command("export.text");
+    harness.step();
+    held.started.recv_timeout(Duration::from_secs(5)).expect("encrypted A reached prepare barrier");
+    harness.state_mut().open_path(other.0.to_string_lossy().as_ref());
+    held.release.send(()).expect("release encrypted A");
+    held.finished.recv_timeout(Duration::from_secs(5)).expect("encrypted A is ready");
+    held.started.recv_timeout(Duration::from_secs(5)).expect("ordinary B reached prepare barrier");
+    held.release.send(()).expect("release ordinary B");
+    held.finished.recv_timeout(Duration::from_secs(5)).expect("ordinary B is ready before prompt admission");
+    harness.step();
+    let prompt = harness.state().password_prompt.as_ref().expect("picked A password prompt");
+    assert_eq!(prompt.path.as_deref(), Some(picked.0.to_string_lossy().as_ref()));
+    assert_eq!(prompt.then, Some("export.text"));
+    harness.run_steps(2);
+    assert!(harness.state().views.is_empty());
+    assert_eq!(harness.state().pending_opens.len(), 1, "B cannot replace A's visible password prompt");
+    harness.state_mut().submit_password(Some("wrong-password".into()));
+    held.wait_started();
+    held.complete(&mut harness);
+    // During the retry gap no modal exists, so ordinary B may admit. A still owns its
+    // continuation and its wrong-password prompt, and success must reactivate A.
+    assert_eq!(harness.state().views.len(), 1);
+    let prompt = harness.state().password_prompt.as_ref().expect("picked A wrong-password prompt");
+    assert_eq!(prompt.path.as_deref(), Some(picked.0.to_string_lossy().as_ref()));
+    assert!(prompt.error.is_some());
+    assert_eq!(prompt.then, Some("export.text"));
+    assert!(harness.state().dialog.is_none());
+    harness.state_mut().submit_password(Some("tool-password".into()));
+    held.wait_started();
+    held.complete(&mut harness);
+    assert!(harness.state().password_prompt.is_none() && harness.state().pending_opens.is_empty());
+    assert_eq!(harness.state().views.len(), 2);
+    assert!(matches!(harness.state().dialog, Some(crate::Dialog::Export(_))));
+    let active = harness.state().active.expect("A reactivates for Export");
+    let doc = harness.state().session.get(harness.state().views[active].id).expect("A Export recipient");
+    assert_eq!(doc.path.as_deref(), Some(picked.0.to_string_lossy().as_ref()));
+    assert_eq!(doc.info.pages.len(), 2);
+    assert!(!doc.dirty && doc.can_undo().is_none());
+    harness.run_steps(2);
+    assert_eq!(harness.state().active, Some(active));
+    harness.get_by_label("Cancel").click();
+    harness.run_steps(2);
+    assert!(harness.state().dialog.is_none() && harness.state().pending_opens.is_empty());
+    assert_eq!(harness.state().views.len(), 2);
+    assert_eq!(std::fs::read(&picked.0).expect("read original encrypted A"), protected.as_slice());
+}
+
+#[test]
+#[allow(clippy::expect_used)]
+fn tool_picker_keeps_picked_recipient_when_other_open_is_ready() {
+    for cancel in [false, true] {
+        let case = if cancel { "picker-cancel" } else { "picker-insert" };
+        let original_a = fixture(2);
+        let original_b = fixture(1);
+        let original_c = fixture(1);
+        let picked = tool_open_file(&format!("{case}-a"), "pdf", &original_a);
+        let other = tool_open_file(&format!("{case}-b"), "pdf", &original_b);
+        let insert = tool_open_file(&format!("{case}-c"), "pdf", &original_c);
+        let mut harness = tool_open_harness();
+        harness.state_mut().pick_override = Some(vec![picked.0.to_string_lossy().into_owned()]);
+        let held = HeldToolOpen::install(&mut harness);
+        harness.state_mut().run_command("page.insert");
+        harness.step();
+        held.started.recv_timeout(Duration::from_secs(5)).expect("picked A reached prepare barrier");
+        assert!(harness.state().views.is_empty());
+        assert_eq!(harness.state().pending_opens.len(), 1);
+        harness.state_mut().open_path(other.0.to_string_lossy().as_ref());
+        // A's first picker was consumed above. Its real Insert pages continuation must
+        // now queue this second picker, bound to A, when the prepared document commits.
+        harness.state_mut().pick_override = Some(if cancel { Vec::new() } else { vec![insert.0.to_string_lossy().into_owned()] });
+        held.release.send(()).expect("release picked A");
+        held.finished.recv_timeout(Duration::from_secs(5)).expect("picked A reply is ready");
+        held.started.recv_timeout(Duration::from_secs(5)).expect("ordinary B reached prepare barrier");
+        held.release.send(()).expect("release ordinary B");
+        held.finished.recv_timeout(Duration::from_secs(5)).expect("ordinary B reply is also ready");
+        assert_eq!(harness.state().pending_opens.len(), 2);
+
+        // Poll admission separately from consuming the picker callback: this reproduces
+        // the same ordering as a UI frame, with both worker replies already available.
+        harness.state_mut().poll_pending_opens();
+        assert_eq!(harness.state().views.len(), 1, "ready B must wait for A's Insert pages picker");
+        assert_eq!(harness.state().active, Some(0));
+        assert!(harness.state().dialog.is_none() && harness.state().password_prompt.is_none());
+        let a_id = harness.state().views[0].id;
+        let doc = harness.state().session.get(a_id).expect("picked A before picker completion");
+        assert_eq!(doc.path.as_deref(), Some(picked.0.to_string_lossy().as_ref()));
+        assert_eq!(doc.info.pages.len(), 2);
+        assert!(!doc.dirty && doc.can_undo().is_none() && doc.can_redo().is_none());
+        assert_eq!(harness.state().pending_opens.len(), 1);
+        assert_eq!(harness.state().pending_opens[0].path.as_deref(), Some(other.0.to_string_lossy().as_ref()));
+        harness.state_mut().poll_pending_opens();
+        assert_eq!(harness.state().views.len(), 1, "B remains held until the queued picker result is consumed");
+        assert_eq!(harness.state().active, Some(0));
+
+        // Consume the actual native-picker callback (or its empty-path cancellation).
+        harness.state_mut().process_picked();
+        let doc = harness.state().session.get(a_id).expect("A after picker completion");
+        assert_eq!(doc.info.pages.len(), if cancel { 2 } else { 3 });
+        assert_eq!(doc.dirty, !cancel);
+        assert_eq!(doc.can_undo().is_some(), !cancel);
+        assert!(doc.can_redo().is_none());
+        assert_eq!(harness.state().views.len(), 1);
+        assert_eq!(harness.state().pending_opens.len(), 1);
+        assert_eq!(harness.state().active, Some(0));
+
+        harness.step();
+        assert!(harness.state().pending_opens.is_empty());
+        assert_eq!(harness.state().views.len(), 2, "picker completion releases B exactly once");
+        let active = harness.state().active.expect("B activates after picker completion");
+        let doc = harness.state().session.get(harness.state().views[active].id).expect("ordinary B document");
+        assert_eq!(doc.path.as_deref(), Some(other.0.to_string_lossy().as_ref()));
+        assert_eq!(doc.info.pages.len(), 1);
+        assert!(!doc.dirty && doc.can_undo().is_none() && doc.can_redo().is_none());
+        harness.run_steps(2);
+        assert!(harness.state().pending_opens.is_empty() && harness.state().dialog.is_none());
+        assert_eq!(harness.state().views.len(), 2);
+        assert_eq!(harness.state().active, Some(active));
+        let doc = harness.state().session.get(a_id).expect("A retains exactly one insertion or cancellation");
+        assert_eq!(doc.info.pages.len(), if cancel { 2 } else { 3 });
+        assert_eq!(doc.dirty, !cancel);
+        assert_eq!(doc.can_undo().is_some(), !cancel);
+        assert!(doc.can_redo().is_none());
+        assert_eq!(doc.saved_bytes().as_slice(), original_a.as_slice(), "insertion preserves A's saved source");
+        for (file, original) in [(&picked, &original_a), (&other, &original_b), (&insert, &original_c)] {
+            assert_eq!(std::fs::read(&file.0).expect("read unchanged original picker fixture"), *original);
+        }
+    }
+}
diff --git a/crates/ui-egui/src/optimize_ui.rs b/crates/ui-egui/src/optimize_ui.rs
index a35f02977..34188e184 100644
--- a/crates/ui-egui/src/optimize_ui.rs
+++ b/crates/ui-egui/src/optimize_ui.rs
@@ -8,7 +8,7 @@
 use std::sync::{Arc, Mutex};
 
 use egui::{Align, Layout};
-use pdfcraft_engine::optimize::{Compression, ImageSettings, QUALITIES, Settings};
+use pdfcraft_engine::optimize::{Compression, ImageSettings, Preset, QUALITIES, Settings};
 use pdfcraft_engine::optimizer::{OptimizeStage, Optimized};
 use pdfcraft_engine::{DocId, EditError, Hidden, OptimizeReport};
 
@@ -78,6 +78,7 @@ pub struct OptimizeRun {
 fn stage_label(stage: OptimizeStage) -> String {
     match stage {
         OptimizeStage::Discarding => tl!("Optimizing… removing user data").to_string(),
+        OptimizeStage::Fragments => tl!("Optimizing… merging image fragments").to_string(),
         OptimizeStage::Images { done, total } => crate::i18n::fmt(
             tl!("Optimizing… image {d} of {t}"),
             &[("d", &(done + 1).min(total.max(1)).to_string()), ("t", &total.max(1).to_string())],
@@ -157,6 +158,22 @@ fn discard_box(ui: &mut egui::Ui, list: &mut Vec<Hidden>, h: Hidden, label: &str
 pub(crate) fn body(ui: &mut egui::Ui, d: &mut OptimizeDraft, t: &Tokens) -> (bool, bool) {
     ui.label(egui::RichText::new(tl!("PDF Optimizer")).font(theme::semibold(18.0)));
     ui.add_space(6.0);
+    ui.horizontal(|ui| {
+        ui.label(tl!("Settings"));
+        let name = |p: Preset| match p {
+            Preset::Standard => tl!("Standard"),
+            Preset::Mobile => tl!("Mobile"),
+        };
+        let current = Preset::of(&d.settings);
+        egui::ComboBox::from_id_salt("optimize-preset").selected_text(current.map_or(tl!("Custom"), name)).show_ui(ui, |ui| {
+            for p in Preset::ALL {
+                if ui.selectable_label(current == Some(p), name(p)).clicked() {
+                    d.settings = p.settings();
+                }
+            }
+        });
+    });
+    ui.add_space(6.0);
     ui.horizontal_wrapped(|ui| {
         for (tab, label) in [
             (OptimizeTab::Images, tl!("Images")),
@@ -174,6 +191,7 @@ pub(crate) fn body(ui: &mut egui::Ui, d: &mut OptimizeDraft, t: &Tokens) -> (boo
     let s = &mut d.settings;
     match d.tab {
         OptimizeTab::Images => {
+            ui.add(widgets::checkbox(&mut s.merge_fragments, tl!("Merge image fragments")));
             image_row(ui, "color", "Color Images", &mut s.color);
             image_row(ui, "gray", "Grayscale Images", &mut s.gray);
             ui.label(
@@ -225,33 +243,52 @@ pub(crate) fn body(ui: &mut egui::Ui, d: &mut OptimizeDraft, t: &Tokens) -> (boo
     (ok, cancel)
 }
 
-/// Audit Space Usage: bytes and share of the file per kind of content.
+/// Audit Space Usage: how the file's bytes are spent now, by kind of content (not what
+/// optimizing would save).
 pub(crate) fn audit_body(ui: &mut egui::Ui, rows: &[pdfcraft_engine::optimize::SpaceUse], t: &Tokens) -> bool {
-    ui.label(egui::RichText::new(tl!("Space Audit")).font(crate::theme::semibold(18.0)));
+    use egui::{RichText, TextWrapMode, WidgetText};
+    ui.label(RichText::new(tl!("Space Audit")).font(crate::theme::semibold(18.0)));
+    ui.add_space(4.0);
+    ui.label(RichText::new(tl!("What takes up the space in this file, by kind of content.")).color(t.text_muted));
     ui.add_space(8.0);
-    egui::Grid::new("space-audit").num_columns(3).striped(true).spacing([24.0, 4.0]).show(ui, |ui| {
-        for h in [tl!("Description"), tl!("Bytes"), tl!("Percentage")] {
-            ui.label(egui::RichText::new(h).color(t.text_muted));
-        }
-        ui.end_row();
-        let total: u64 = rows.iter().map(|r| r.bytes).sum();
-        for r in rows.iter().filter(|r| r.bytes > 0) {
-            // "Patterns" also names the redaction search patterns ("模式"); the audit's PDF
-            // graphics objects need their own key.
-            let category = if r.category == pdfcraft_engine::optimize::SpaceCategory::Patterns {
-                tl!("Patterns (graphics objects)").to_string()
-            } else {
-                tl!(r.category.label()).to_string()
-            };
-            ui.label(category);
-            ui.with_layout(Layout::right_to_left(Align::Center), |ui| ui.label(r.bytes.to_string()));
-            ui.with_layout(Layout::right_to_left(Align::Center), |ui| ui.label(format!("{:.2}%", r.percent)));
+    // Every cell is laid out first so each column can be exactly as wide as its widest cell. A
+    // right-to-left layout in a grid's last column takes the rest of the window instead, which
+    // drew the percentages at the dialog's far edge, away from their rows.
+    let text = |s: RichText| WidgetText::from(s).into_galley(ui, Some(TextWrapMode::Extend), f32::INFINITY, egui::TextStyle::Body);
+    let header = |s: &str| text(RichText::new(s).color(t.text_muted));
+    let mut table = vec![[header(tl!("Description")), header(tl!("Bytes")), header(tl!("Percentage"))]];
+    for r in rows.iter().filter(|r| r.bytes > 0) {
+        // "Patterns" also names the redaction search patterns ("模式"); the audit's PDF
+        // graphics objects need their own key.
+        let category = if r.category == pdfcraft_engine::optimize::SpaceCategory::Patterns {
+            tl!("Patterns (graphics objects)")
+        } else {
+            tl!(r.category.label())
+        };
+        table.push([text(RichText::new(category)), text(RichText::new(r.bytes.to_string())), text(RichText::new(format!("{:.2}%", r.percent)))]);
+    }
+    let total: u64 = rows.iter().map(|r| r.bytes).sum();
+    table.push([
+        text(RichText::new(tl!("Total")).strong()),
+        text(RichText::new(total.to_string()).strong()),
+        text(RichText::new("100.00%").strong()),
+    ]);
+    let gap = 24.0;
+    let width = |column: usize| table.iter().filter_map(|row| row.get(column)).map(|g| g.size().x).fold(0.0, f32::max);
+    // The description takes what the numbers leave, so the striped rows span the dialog.
+    let numbers = width(1) + width(2) + 2.0 * gap;
+    let widths = [width(0).max(ui.available_width() - numbers), width(1), width(2)];
+    let height = table.iter().flatten().map(|g| g.size().y).fold(ui.spacing().interact_size.y, f32::max);
+    egui::Grid::new("space-audit").num_columns(3).striped(true).spacing([gap, 4.0]).show(ui, |ui| {
+        for row in table {
+            for (column, (cell, width)) in row.into_iter().zip(widths).enumerate() {
+                // Numbers line up on their last digit.
+                let layout = if column == 0 { Layout::left_to_right(Align::Center) } else { Layout::right_to_left(Align::Center) };
+                let (rect, _) = ui.allocate_exact_size(egui::vec2(width, height), egui::Sense::hover());
+                ui.new_child(egui::UiBuilder::new().max_rect(rect).layout(layout)).label(cell);
+            }
             ui.end_row();
         }
-        ui.label(egui::RichText::new(tl!("Total")).strong());
-        ui.with_layout(Layout::right_to_left(Align::Center), |ui| ui.label(egui::RichText::new(total.to_string()).strong()));
-        ui.with_layout(Layout::right_to_left(Align::Center), |ui| ui.label(egui::RichText::new("100.00%").strong()));
-        ui.end_row();
     });
     ui.add_space(12.0);
     let mut ok = false;
diff --git a/crates/ui-egui/src/organize_panel.rs b/crates/ui-egui/src/organize_panel.rs
new file mode 100644
index 000000000..a4c2e8cf7
--- /dev/null
+++ b/crates/ui-egui/src/organize_panel.rs
@@ -0,0 +1,221 @@
+//! Organize pages, laid out as Acrobat's panel: the pages selected (typed, or picked by kind from
+//! its menu); page options as a row of icon buttons (rotate both ways, delete, extract) and Insert,
+//! Replace, Split and Bates numbering; page setup (boxes, crop, transitions, templates, printing);
+//! and page labels and properties. It shows whenever the page grid does, so every way into
+//! Organize (the tool, the Edit panel, the command, `--organize`) gets the same controls, and the
+//! grid's own toolbar keeps only moving pages, their size, Save pages and Close.
+//!
+//! The page actions queue on the view (`pending_edit`, `pending_action`) exactly as the grid's
+//! toolbar did, so they run, refuse and undo the same way.
+
+use egui::{Align2, CornerRadius, Rect, Sense, Stroke, vec2};
+use pdfcraft_engine::Edit;
+
+use crate::canvas::ViewAction;
+use crate::theme::{self, Tokens};
+use crate::{LeftPanel, PdfCraftApp, icons, widgets};
+
+/// Whether the left panel is Organize pages: the tool is chosen, or the active view shows the grid.
+pub(crate) fn showing(app: &PdfCraftApp) -> bool {
+    app.left == LeftPanel::Tool("organize") || app.active.and_then(|i| app.views.get(i)).is_some_and(|v| v.organize)
+}
+
+/// The panel of the workspace Organize was opened from, shown again once Organize closes (by
+/// its Close, the grid's Close, or opening a page from the grid): Edit's panel under the Edit
+/// tab, as Acrobat goes back to the tool you came from, and All tools otherwise.
+pub(crate) fn workspace_panel(mode: crate::Mode) -> LeftPanel {
+    match mode {
+        crate::Mode::Edit => LeftPanel::Tool("edit"),
+        crate::Mode::Convert => LeftPanel::Tool("export"),
+        crate::Mode::Sign => LeftPanel::Tool("fill_sign"),
+        _ => LeftPanel::AllTools,
+    }
+}
+
+/// What a row does once clicked.
+enum Act {
+    Edit(Box<Edit>),
+    View(ViewAction),
+    Command(&'static str),
+}
+
+pub(crate) fn panel(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens) {
+    let Some((index, id)) = app.active_ids() else { return };
+    let Some(doc) = app.session.get(id) else { return };
+    let info = &doc.info;
+    let editable = doc.allows_assembly();
+    let n = info.pages.len();
+    let mut act: Option<Act> = None;
+    let mut back = false;
+    let mut close = false;
+    let Some(view) = app.views.get_mut(index) else { return };
+
+    ui.horizontal(|ui| {
+        if icons::button(ui, "chevron-left", 26.0, false, tl!("Back to all tools")).clicked() {
+            back = true;
+        }
+        let title = tl!("Organize pages");
+        let title_width = (ui.available_width() - 26.0 - ui.spacing().item_spacing.x).max(1.0);
+        ui.add_sized([title_width, 26.0], egui::Label::new(egui::RichText::new(title).font(theme::semibold(15.5)).color(t.text)).truncate())
+            .on_hover_text(title);
+        if icons::button(ui, "x", 26.0, false, tl!("Close panel")).clicked() {
+            close = true;
+        }
+    });
+    ui.add_space(2.0);
+    ui.separator();
+
+    egui::ScrollArea::vertical().auto_shrink([false, false]).show(ui, |ui| {
+        widgets::section_title(ui, tl!("Pages selected"));
+        let current = view.current;
+        let picked = view.organize_range.show(ui, &view.selected, n, current, |ui| {
+            use pdfcraft_engine::{PageOrientation as O, PageParity as P, filter_pages};
+            let all: Vec<usize> = (0..n).collect();
+            let mut chosen = None;
+            for (label, parity, orient) in [
+                ("All pages", P::Both, O::Both),
+                ("Even pages", P::Even, O::Both),
+                ("Odd pages", P::Odd, O::Both),
+                ("Landscape pages", P::Both, O::Landscape),
+                ("Portrait pages", P::Both, O::Portrait),
+            ] {
+                if ui.button(tl!(label)).clicked() {
+                    chosen = Some(filter_pages(info, &all, parity, orient));
+                }
+            }
+            if ui.button(tl!("None")).clicked() {
+                chosen = Some(Vec::new());
+            }
+            chosen
+        });
+        if let Some(pages) = picked {
+            view.select_pages(&pages);
+        }
+
+        let targets = view.target_pages();
+        let last = targets.last().copied().unwrap_or(0);
+        widgets::section_title(ui, tl!("Page options"));
+        ui.add_enabled_ui(editable, |ui| {
+            ui.horizontal(|ui| {
+                ui.spacing_mut().item_spacing.x = 6.0;
+                if icons::button(ui, "rotate-ccw", 34.0, false, tl!("Rotate counterclockwise")).clicked() {
+                    act = Some(Act::Edit(Box::new(Edit::RotatePages { pages: targets.clone(), degrees: -90 })));
+                }
+                if icons::button(ui, "rotate-cw", 34.0, false, tl!("Rotate clockwise")).clicked() {
+                    act = Some(Act::Edit(Box::new(Edit::RotatePages { pages: targets.clone(), degrees: 90 })));
+                }
+                // A document keeps at least one page.
+                let can_delete = targets.len() < n;
+                if ui.add_enabled_ui(can_delete, |ui| icons::button(ui, "trash-2", 34.0, false, tl!("Delete pages (Delete)"))).inner.clicked() {
+                    act = Some(Act::Edit(Box::new(Edit::DeletePages { pages: targets.clone() })));
+                }
+                if icons::button(ui, "file-output", 34.0, false, tl!("Extract pages to a new document")).clicked() {
+                    act = Some(Act::View(ViewAction::Extract));
+                }
+            });
+            ui.add_space(2.0);
+            // Insert ▸: a blank page, pages from a file, or copies of the selected pages.
+            let insert = row(ui, t, "file-plus-2", tl!("Insert"), Availability::Ready, true);
+            egui::Popup::menu(&insert).align(egui::RectAlign::RIGHT_START).gap(6.0).show(|ui| {
+                if ui.button(tl!("Insert a blank page after the selection")).clicked() {
+                    let crop = info.pages.get(last).map_or([0.0, 0.0, 612.0, 792.0], |p| p.crop);
+                    let (w, h) = ((crop[2] - crop[0]).abs().max(1.0) as f64, (crop[3] - crop[1]).abs().max(1.0) as f64);
+                    act = Some(Act::Edit(Box::new(Edit::InsertBlankPage { at: last.saturating_add(1), width: w, height: h })));
+                }
+                if ui.button(tl!("Insert pages from a file…")).clicked() {
+                    act = Some(Act::View(ViewAction::InsertFromFile));
+                }
+                if ui.button(tl!("Duplicate pages")).clicked() {
+                    act = Some(Act::Command("page.duplicate"));
+                }
+            });
+            if row(ui, t, "replace", tl!("Replace"), Availability::Ready, false).clicked() {
+                act = Some(Act::View(ViewAction::ReplacePages));
+            }
+            if row(ui, t, "scissors", tl!("Split"), Availability::Ready, false).clicked() {
+                act = Some(Act::View(ViewAction::Split));
+            }
+        });
+        if row(ui, t, "hash", tl!("Bates numbering"), Availability::Ready, false).clicked() {
+            act = Some(Act::Command("edit.bates"));
+        }
+        divider(ui, t);
+        for (icon, label, availability, command) in [
+            ("square-dashed-mouse-pointer", "Set page boxes", Availability::Ready, Some("page.boxes")),
+            ("crop", "Crop pages", Availability::Ready, Some("page.crop")),
+            ("presentation", "Page transitions", Availability::Later, Some("page.transitions")),
+            ("file-text", "Page templates", Availability::Later, None),
+            ("printer", "Print pages", Availability::Ready, Some("print.dialog")),
+        ] {
+            if row(ui, t, icon, tl!(label), availability, false).clicked()
+                && let Some(command) = command
+            {
+                act = Some(Act::Command(command));
+            }
+        }
+        divider(ui, t);
+        if row(ui, t, "tag", tl!("Page labels"), Availability::Ready, false).clicked() {
+            act = Some(Act::Command("page.number"));
+        }
+        row(ui, t, "info", tl!("Page properties"), Availability::Later, false);
+    });
+
+    if close {
+        view.organize = false;
+        app.left = workspace_panel(app.mode);
+    } else if back {
+        view.organize = false;
+        app.left = LeftPanel::AllTools;
+        app.mode = crate::Mode::AllTools;
+    }
+    match act {
+        Some(Act::Edit(edit)) => view.pending_edit = Some(*edit),
+        Some(Act::View(action)) => view.pending_action = Some(action),
+        Some(Act::Command(command)) => app.run_command(command),
+        None => {}
+    }
+}
+
+/// Whether a row works in this build.
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum Availability {
+    Ready,
+    /// Not in PdfCraft yet: shown muted, as Acrobat lists it, and says it is planned when hovered.
+    Later,
+}
+
+/// One row of the panel: a monochrome icon and the label, as Acrobat draws them, with a corner
+/// mark when it opens a menu.
+fn row(ui: &mut egui::Ui, t: &Tokens, icon: &str, label: &str, availability: Availability, menu: bool) -> egui::Response {
+    let ready = availability == Availability::Ready && ui.is_enabled();
+    let (rect, resp) = ui.allocate_exact_size(vec2(ui.available_width(), 34.0), if ready { Sense::click() } else { Sense::hover() });
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, ready, label));
+    let press = theme::Press::track(ui, &resp);
+    if ready {
+        press.wash(ui, rect, 6, false);
+    }
+    let body = rect.translate(press.offset());
+    let fg = if ready { t.text } else { t.text_faint };
+    let icon_rect = Rect::from_min_size(body.min + vec2(6.0, 8.0), vec2(18.0, 18.0));
+    icons::paint(ui, icon_rect, icon, 17.0, fg);
+    let font = theme::regular(13.5);
+    let width = crate::widgets::text_width(ui, label, &font);
+    ui.painter().text(body.left_center() + vec2(34.0, 0.0), Align2::LEFT_CENTER, label, font, fg);
+    if menu {
+        // The small corner triangle Acrobat puts after a label that opens a menu.
+        let tip = body.left_center() + vec2(34.0 + width + 6.0, 6.0);
+        let tri = vec![tip, tip + vec2(-5.0, 0.0), tip + vec2(0.0, -5.0)];
+        ui.painter().add(egui::Shape::convex_polygon(tri, fg, Stroke::NONE));
+    }
+    match availability {
+        Availability::Ready => theme::hand(resp),
+        Availability::Later => resp.on_hover_text(tl!("Planned")),
+    }
+}
+
+fn divider(ui: &mut egui::Ui, t: &Tokens) {
+    ui.add_space(6.0);
+    let (r, _) = ui.allocate_exact_size(vec2(ui.available_width(), 1.0), Sense::hover());
+    ui.painter().rect_filled(r, CornerRadius::ZERO, t.divider);
+    ui.add_space(6.0);
+}
diff --git a/crates/ui-egui/src/page_selection_ui.rs b/crates/ui-egui/src/page_selection_ui.rs
index 87340f6f7..0907232f7 100644
--- a/crates/ui-egui/src/page_selection_ui.rs
+++ b/crates/ui-egui/src/page_selection_ui.rs
@@ -58,7 +58,17 @@ fn formatted(pages: &BTreeSet<usize>) -> String {
 }
 
 impl PageSelectionInput {
-    pub(crate) fn show(&mut self, ui: &mut egui::Ui, selected: &BTreeSet<usize>, count: usize) -> Option<Vec<usize>> {
+    /// The field, as Acrobat's Pages selected: typed pages apply on Enter or when the field loses
+    /// focus, and the chevron opens `menu` (pages by kind), whose choice is returned the same way.
+    /// With nothing selected it shows the current page (0-based `current`), which actions apply to.
+    pub(crate) fn show(
+        &mut self,
+        ui: &mut egui::Ui,
+        selected: &BTreeSet<usize>,
+        count: usize,
+        current: usize,
+        menu: impl FnOnce(&mut egui::Ui) -> Option<Vec<usize>>,
+    ) -> Option<Vec<usize>> {
         if self.selection != *selected {
             self.selection.clone_from(selected);
             self.text = formatted(selected);
@@ -75,14 +85,28 @@ impl PageSelectionInput {
             self.error = None;
             ui.memory_mut(|m| m.surrender_focus(id));
         }
+        let mut chosen = None;
         ui.horizontal(|ui| {
             let label = tl!("Selected pages");
-            ui.label(label);
-            let field = ui.add(egui::TextEdit::singleline(&mut self.text).id(id).desired_width(300.0).char_limit(16_384).hint_text("1, 12, 16-18"));
+            let width = (ui.available_width() - 32.0).max(40.0);
+            let field = ui.add(
+                egui::TextEdit::singleline(&mut self.text)
+                    .id(id)
+                    .desired_width(width)
+                    .char_limit(16_384)
+                    .hint_text(current.saturating_add(1).to_string()),
+            );
             field.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::TextEdit, ui.is_enabled(), label));
-            let apply = ui.button(tl!("Apply")).clicked();
-            commit = ui.is_enabled() && !cancel && (field.lost_focus() || apply);
+            commit = ui.is_enabled() && !cancel && field.lost_focus();
+            let pick = crate::icons::button(ui, "chevron-down", 26.0, false, tl!("Select pages"));
+            chosen = egui::Popup::menu(&pick).show(menu).and_then(|r| r.inner);
         });
+        if let Some(pages) = chosen {
+            self.selection = pages.iter().copied().collect();
+            self.text = formatted(&self.selection);
+            self.error = None;
+            return Some(pages);
+        }
         if cancel {
             self.text = formatted(selected);
             self.error = None;
diff --git a/crates/ui-egui/src/panels.rs b/crates/ui-egui/src/panels.rs
index bdd625804..92071c249 100644
--- a/crates/ui-egui/src/panels.rs
+++ b/crates/ui-egui/src/panels.rs
@@ -16,9 +16,16 @@ fn hue(g: &ToolGroup) -> Color32 {
 
 pub fn left_panel(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
     let t = Tokens::get(ui.ctx());
+    // Organize closed another way (the grid's Close, or a page opened from it) closes the tool too,
+    // as its panel's Close does, back to the workspace's own panel.
+    if app.left == LeftPanel::Tool("organize") && app.active.and_then(|i| app.views.get(i)).is_some_and(|v| !v.organize) {
+        app.left = crate::organize_panel::workspace_panel(app.mode);
+    }
     egui::Frame::NONE.fill(t.panel).inner_margin(egui::Margin { left: 14, right: 10, top: 12, bottom: 10 }).stroke(Stroke::new(1.0, t.divider)).show(
         ui,
         |ui| match app.left {
+            // Organize pages has its own panel whenever the grid shows (with a document open).
+            _ if app.active.is_some() && crate::organize_panel::showing(app) => crate::organize_panel::panel(app, ui, &t),
             LeftPanel::AllTools => all_tools(app, ui, &t),
             LeftPanel::Tool(id) => match catalog::group(id) {
                 Some(g) => tool_detail(app, ui, &t, g),
@@ -230,8 +237,32 @@ fn tool_detail(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens, g: &'static
                 row_label(ui, tl!(item.label), theme::regular(13.0), fg, body.left_center() + vec2(34.0, 0.0), r.left() - body.left() - 42.0);
                 ui.painter().rect_filled(r, CornerRadius::same(4), fill);
                 ui.painter().text(r.center(), Align2::CENTER_CENTER, chip_label, font, cfg);
-                if theme::hand(resp).on_hover_text(format!("{} — {}", tl!(item.label), item.command)).clicked() {
-                    run = Some(item.command);
+                let resp = theme::hand(resp).on_hover_text(format!("{} — {}", tl!(item.label), item.command));
+                if item.actions.is_empty() {
+                    if resp.clicked() {
+                        run = Some(item.command);
+                    }
+                } else {
+                    // A caret before the chip says the entry opens a menu (Add / Update / Remove).
+                    let c = r.left_center() - vec2(10.0, 0.0);
+                    ui.painter().add(egui::Shape::convex_polygon(
+                        vec![c + vec2(-3.5, -2.0), c + vec2(3.5, -2.0), c + vec2(0.0, 2.5)],
+                        fg,
+                        egui::Stroke::NONE,
+                    ));
+                    egui::Popup::menu(&resp).show(|ui| {
+                        ui.set_min_width(180.0);
+                        for (n, id) in item.actions.iter().enumerate() {
+                            let Some(spec) = pdfcraft_engine::commands::command(id) else { continue };
+                            // Add stays usable with no document open: it asks for a file first.
+                            let enabled = (n == 0 && app.active.is_none()) || app.command_enabled(spec);
+                            let label = crate::i18n::menu_label(spec.id, spec.label);
+                            if ui.add_enabled(enabled, egui::Button::new(label)).clicked() {
+                                run = Some(spec.id);
+                                ui.close();
+                            }
+                        }
+                    });
                 }
             }
         }
@@ -406,7 +437,7 @@ fn format_section(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens) {
     let image = app.active_ids().and_then(|(i, id)| {
         let (page, index) = app.views[i].content.selected?;
         let doc = app.session.get(id)?;
-        match &doc.added.iter().filter(|a| a.page == page).nth(index)?.content {
+        match &doc.added().iter().filter(|a| a.page == page).nth(index)?.content {
             pdfcraft_engine::AddedContent::Image(img) => Some((page, index, img.clone())),
             _ => None,
         }
@@ -426,7 +457,7 @@ fn format_section(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens) {
     let selected = app.active_ids().and_then(|(i, id)| {
         let (page, index) = app.views[i].content.selected?;
         let doc = app.session.get(id)?;
-        let a = doc.added.iter().filter(|a| a.page == page).nth(index)?;
+        let a = doc.added().iter().filter(|a| a.page == page).nth(index)?;
         match &a.content {
             pdfcraft_engine::AddedContent::Text(text) => Some((page, index, text.clone())),
             _ => None,
@@ -671,7 +702,8 @@ pub fn right_panel(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                     }
                     RightPanel::Tags => {
                         let tags = tags_state.tags(doc);
-                        let (page, edit) = crate::tags_ui::panel(ui, &t, id, &tags, tags_state, doc.allows_modification());
+                        let content = tags_state.content(doc);
+                        let (page, edit) = crate::tags_ui::panel(ui, &t, id, &tags, &content, tags_state, doc.allows_modification());
                         if let Some(page) = page {
                             nav = Some(Nav::Page(page));
                         }
@@ -1114,6 +1146,28 @@ fn pages(ui: &mut egui::Ui, t: &Tokens, info: &DocInfo, view: &mut crate::DocVie
         ui.add_space(4.0);
     }
     page_drag(ui, t, view, &rows, dropped);
+    file_drop(ui, t, view, &rows, editable && !modal);
+}
+
+/// Files dragged in from outside go to the gap under the pointer: remember where the panel is
+/// and that gap, for the app to take the drop, and show where the pages would go.
+fn file_drop(ui: &mut egui::Ui, t: &Tokens, view: &mut crate::DocView, rows: &[Rect], editable: bool) {
+    if !editable {
+        return;
+    }
+    let clip = ui.clip_rect();
+    view.pages_panel = Some(clip);
+    let pointer = ui.input(|i| i.pointer.hover_pos()).filter(|p| clip.contains(*p));
+    view.panel_gap = pointer.filter(|_| view.panel_drag.is_none()).and_then(|p| panel_gap(rows, p.y));
+    if pointer.is_none() || ui.input(|i| i.raw.hovered_files.is_empty()) {
+        return;
+    }
+    let painter = ui.painter().with_clip_rect(clip);
+    painter.rect_stroke(clip.shrink(2.0), CornerRadius::same(6), Stroke::new(2.0, t.accent), egui::StrokeKind::Inside);
+    if let (Some(gap), Some(first), Some(last)) = (view.panel_gap, rows.first(), rows.last()) {
+        let y = rows.get(gap).map_or(last.bottom() + 2.0, |r| r.top() - 3.0);
+        painter.line_segment([pos2(first.left(), y), pos2(first.right(), y)], Stroke::new(3.0, t.accent));
+    }
 }
 
 /// Queue deleting the selection (or the current page) of a document of `n` pages, unless that
@@ -1217,9 +1271,7 @@ fn fields(
         empty(ui, t, "text-cursor-input", "This document has no form fields.");
         return None;
     }
-    let rank = |name: &str| form.iter().find(|f| f.name == name).and_then(|f| f.widgets.iter().map(|w| w.tab).min()).unwrap_or(usize::MAX);
-    let mut ordered: Vec<_> = info.fields.iter().collect();
-    ordered.sort_by_key(|f| (f.page, rank(&f.name)));
+    let rows = field_rows(&info.fields, form);
     if preparing {
         ui.label(egui::RichText::new(tl!("Tab order: move a field with its arrows.")).small().color(t.text_muted));
         ui.label(egui::RichText::new(tl!("Shift- or Ctrl/Command-click to select several fields.")).small().color(t.text_muted));
@@ -1233,10 +1285,7 @@ fn fields(
             }
         });
     }
-    let mut pages: Vec<Option<usize>> = info.fields.iter().map(|f| f.page).collect();
-    pages.sort();
-    pages.dedup();
-    for p in pages {
+    for (p, page_rows) in rows {
         // A field's /P can name a page the document doesn't have (#1307); it reads as unplaced.
         let label = p
             .and_then(|p| info.pages.get(p))
@@ -1244,11 +1293,7 @@ fn fields(
             .unwrap_or_else(|| tl!("Unplaced").to_string());
         ui.add_space(4.0);
         ui.label(egui::RichText::new(label).font(theme::semibold(12.5)).color(t.text_muted));
-        for f in ordered.iter().copied().filter(|f| f.page == p) {
-            let key = form
-                .iter()
-                .find(|field| field.name == f.name)
-                .and_then(|field| field.widgets.iter().position(|w| w.page == f.page).map(|wi| (field.name.clone(), wi)));
+        for (f, key) in page_rows {
             let selected = key.as_ref().is_some_and(|key| selection.selected.as_ref() == Some(key) || selection.also.contains(key));
             let icon = match f.kind {
                 FieldKind::Text => "text-cursor-input",
@@ -1262,28 +1307,25 @@ fn fields(
             };
             let (rect, resp) = ui.allocate_exact_size(vec2(ui.available_width(), 30.0), Sense::click());
             resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::Button, true, selected, &f.name));
-            let press = theme::Press::track(ui, &resp);
-            press.wash(ui, rect, 6, selected);
-            let body = rect.translate(press.offset());
-            icons::paint(ui, Rect::from_min_size(body.min + vec2(8.0, 7.0), vec2(16.0, 16.0)), icon, 15.0, Color32::from_rgb(0x8E, 0x4E, 0xE6));
-            let value =
-                f.value.as_ref().map(|v| if v.chars().count() > 18 { format!("{}…", v.chars().take(17).collect::<String>()) } else { v.clone() });
-            let value_font = theme::regular(11.5);
-            let value_w = value.as_ref().map(|v| crate::widgets::text_width(ui, v, &value_font)).unwrap_or(0.0);
-            let arrows = if preparing && f.page.is_some() { 56.0 } else { 0.0 };
-            let max_w = (rect.width() - 32.0 - value_w - arrows - 16.0).max(0.0);
-            crate::widgets::paint_left(ui, body.left_center() + vec2(32.0, 0.0), &f.name, theme::regular(13.0), t.text, max_w);
-            if let Some(v) = value {
-                let x = if arrows > 0.0 { 64.0 } else { 8.0 };
-                ui.painter().text(body.right_center() - vec2(x, 0.0), Align2::RIGHT_CENTER, v, value_font, t.text_faint);
-            }
-            let kind = format!("{:?}", f.kind);
-            let mut tip = crate::i18n::fmt(tl!("{kind} field"), &[("kind", tl!(&kind))]);
-            if let Some(tt) = &f.tooltip {
-                tip.push_str(&format!(" — {tt}"));
-            }
-            if f.has_actions {
-                tip.push_str(&format!("\n{}", tl!("Has JavaScript actions (run in M6)")));
+            // A row scrolled out of view still takes clicks and keyboard focus, but isn't drawn:
+            // laying out every row of a large form each frame took a tenth of a second a frame.
+            let visible = ui.is_rect_visible(rect);
+            if visible {
+                let press = theme::Press::track(ui, &resp);
+                press.wash(ui, rect, 6, selected);
+                let body = rect.translate(press.offset());
+                icons::paint(ui, Rect::from_min_size(body.min + vec2(8.0, 7.0), vec2(16.0, 16.0)), icon, 15.0, Color32::from_rgb(0x8E, 0x4E, 0xE6));
+                let value =
+                    f.value.as_ref().map(|v| if v.chars().count() > 18 { format!("{}…", v.chars().take(17).collect::<String>()) } else { v.clone() });
+                let value_font = theme::regular(11.5);
+                let value_w = value.as_ref().map(|v| crate::widgets::text_width(ui, v, &value_font)).unwrap_or(0.0);
+                let arrows = if preparing && f.page.is_some() { 56.0 } else { 0.0 };
+                let max_w = (rect.width() - 32.0 - value_w - arrows - 16.0).max(0.0);
+                crate::widgets::paint_left(ui, body.left_center() + vec2(32.0, 0.0), &f.name, theme::regular(13.0), t.text, max_w);
+                if let Some(v) = value {
+                    let x = if arrows > 0.0 { 64.0 } else { 8.0 };
+                    ui.painter().text(body.right_center() - vec2(x, 0.0), Align2::RIGHT_CENTER, v, value_font, t.text_faint);
+                }
             }
             if preparing && f.page.is_some() {
                 let up = Rect::from_center_size(rect.right_center() - vec2(44.0, 0.0), vec2(22.0, 22.0));
@@ -1293,9 +1335,11 @@ fn fields(
                 {
                     let b = ui.interact(r, ui.id().with((&f.name, earlier)), Sense::click());
                     b.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, format!("{tip}: {}", f.name)));
-                    let bpress = theme::Press::track(ui, &b);
-                    bpress.wash(ui, r, 4, false);
-                    icons::paint(ui, r.shrink(3.0).translate(bpress.offset()), icon, 15.0, t.icon);
+                    if visible {
+                        let bpress = theme::Press::track(ui, &b);
+                        bpress.wash(ui, r, 4, false);
+                        icons::paint(ui, r.shrink(3.0).translate(bpress.offset()), icon, 15.0, t.icon);
+                    }
                     if theme::hand(b).on_hover_text(tip).clicked() {
                         *edit = Some(pdfcraft_engine::Edit::MoveInTabOrder { name: f.name.clone(), earlier });
                     }
@@ -1314,7 +1358,10 @@ fn fields(
             {
                 selection.select(key, ui.input(|i| i.modifiers.shift || i.modifiers.command));
             }
-            if theme::hand(resp).on_hover_text(tip).clicked()
+            let resp = theme::hand(resp);
+            // Only a row in view can be hovered: its tip isn't built for the others.
+            let resp = if visible { resp.on_hover_text(field_tip(f)) } else { resp };
+            if resp.clicked()
                 && let (Some(p), Some(r)) = (f.page, f.rect)
             {
                 *nav = Some(Nav::Flash(p, r));
@@ -1324,6 +1371,46 @@ fn fields(
     properties
 }
 
+/// A Fields panel row's tooltip: the field's kind, its own tooltip and whether it has scripts.
+fn field_tip(f: &pdfcraft_render::Field) -> String {
+    let kind = format!("{:?}", f.kind);
+    let mut tip = crate::i18n::fmt(tl!("{kind} field"), &[("kind", tl!(&kind))]);
+    if let Some(tt) = &f.tooltip {
+        tip.push_str(&format!(" — {tt}"));
+    }
+    if f.has_actions {
+        tip.push_str(&format!("\n{}", tl!("Has JavaScript actions (run in M6)")));
+    }
+    tip
+}
+
+/// One page's rows of the Fields panel: each field, with the form field and widget a click on
+/// it selects (`None` when the form has no widget of it on that page).
+type FieldRows<'a> = Vec<(&'a pdfcraft_render::Field, Option<(String, usize)>)>;
+
+/// The Fields panel's rows: by page ("Unplaced" first), each page's in tab order. A row is paired
+/// with the first form field of its name, as the engine pairs them: one map, built once a frame.
+/// Searching the form for each row, and again inside the sort, was O(fields²) every frame.
+fn field_rows<'a>(fields: &'a [pdfcraft_render::Field], form: &[pdfcraft_engine::FormField]) -> Vec<(Option<usize>, FieldRows<'a>)> {
+    let mut by_name: std::collections::HashMap<&str, &pdfcraft_engine::FormField> = std::collections::HashMap::with_capacity(form.len());
+    for field in form {
+        by_name.entry(field.name.as_str()).or_insert(field);
+    }
+    let rank = |name: &str| by_name.get(name).and_then(|f| f.widgets.iter().map(|w| w.tab).min()).unwrap_or(usize::MAX);
+    let mut ordered: Vec<&pdfcraft_render::Field> = fields.iter().collect();
+    ordered.sort_by_cached_key(|f| (f.page, rank(&f.name)));
+    let mut rows: Vec<(Option<usize>, FieldRows<'a>)> = Vec::new();
+    for f in ordered {
+        let key =
+            by_name.get(f.name.as_str()).and_then(|field| field.widgets.iter().position(|w| w.page == f.page).map(|wi| (field.name.clone(), wi)));
+        match rows.last_mut() {
+            Some((page, page_rows)) if *page == f.page => page_rows.push((f, key)),
+            _ => rows.push((f.page, vec![(f, key)])),
+        }
+    }
+    rows
+}
+
 pub fn human_size(n: usize) -> String {
     match n {
         n if n >= 1 << 20 => format!("{:.1} MB", n as f64 / (1u64 << 20) as f64),
@@ -1366,6 +1453,115 @@ mod page_moves {
     }
 }
 
+#[cfg(test)]
+mod field_rows {
+    use super::field_rows;
+    use std::sync::Arc;
+
+    /// A PDF of `objects` (numbered from 1; object 1 the catalog) with a valid xref table.
+    fn pdf(objects: &[String]) -> Vec<u8> {
+        let mut out = b"%PDF-1.7\n".to_vec();
+        let mut offsets = Vec::new();
+        for (i, o) in objects.iter().enumerate() {
+            offsets.push(out.len());
+            out.extend(format!("{} 0 obj\n{o}\nendobj\n", i + 1).bytes());
+        }
+        let xref = out.len();
+        out.extend(format!("xref\n0 {}\n0000000000 65535 f \n", objects.len() + 1).bytes());
+        for o in offsets {
+            out.extend(format!("{o:010} 00000 n \n").bytes());
+        }
+        out.extend(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objects.len() + 1).bytes());
+        out
+    }
+
+    /// The fields the engine reads from `bytes`: the inspector's list and the form.
+    fn open(bytes: Vec<u8>) -> (Vec<pdfcraft_render::Field>, Arc<Vec<pdfcraft_engine::FormField>>) {
+        let mut session = pdfcraft_engine::Session::new();
+        let id = session.open("form.pdf", None, Arc::new(bytes), None).expect("opens");
+        let doc = session.get(id).expect("open");
+        (doc.info.fields.clone(), doc.form.clone())
+    }
+
+    /// Rows go by page, the unplaced first, each page's in tab order (here its annotation order,
+    /// not the `/Fields` order), and a row selects the first form field of its name.
+    #[test]
+    fn rows_follow_pages_and_tab_order() {
+        let widget = |name: &str, page: Option<usize>| match page {
+            Some(p) => format!("<< /Type /Annot /Subtype /Widget /FT /Tx /T ({name}) /Rect [10 10 90 30] /P {} 0 R >>", 3 + p),
+            None => format!("<< /Type /Annot /Subtype /Widget /FT /Tx /T ({name}) /Rect [10 10 90 30] >>"),
+        };
+        let bytes = pdf(&[
+            "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [5 0 R 7 0 R 8 0 R 9 0 R 10 0 R 6 0 R] >> >>".into(),
+            "<< /Type /Pages /Kids [3 0 R 4 0 R] /Count 2 >>".into(),
+            "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots [6 0 R 5 0 R] >>".into(),
+            "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots [7 0 R 8 0 R 9 0 R] >>".into(),
+            widget("a1", Some(0)),
+            widget("a2", Some(0)),
+            widget("b", Some(1)),
+            widget("twin", Some(1)),
+            widget("twin", Some(1)),
+            widget("loose", None),
+        ]);
+        let (fields, form) = open(bytes);
+        // A page's rows as (field name, the form field and widget a click selects).
+        type Named<'a> = Vec<(&'a str, Option<(String, usize)>)>;
+        let rows: Vec<(Option<usize>, Named)> = field_rows(&fields, &form)
+            .into_iter()
+            .map(|(page, rows)| (page, rows.into_iter().map(|(f, key)| (f.name.as_str(), key)).collect()))
+            .collect();
+        let key = |name: &str| Some((name.to_string(), 0));
+        assert_eq!(
+            rows,
+            [
+                (None, vec![("loose", key("loose"))]),
+                (Some(0), vec![("a2", key("a2")), ("a1", key("a1"))]),
+                (Some(1), vec![("b", key("b")), ("twin", key("twin")), ("twin", key("twin"))]),
+            ]
+        );
+    }
+
+    /// The panel's rows for a large form take milliseconds: looking each row's field up in the
+    /// form, there and inside the sort, was O(fields²) every frame.
+    #[test]
+    fn rows_for_a_large_form_are_quick() {
+        const PAGES: usize = 150;
+        const PER_PAGE: usize = 100;
+        let mut objects = vec![String::new(), String::new()];
+        let page = |p: usize| 3 + p;
+        let field = |p: usize, k: usize| 3 + PAGES + p * PER_PAGE + k;
+        let mut all = Vec::new();
+        for p in 0..PAGES {
+            let annots: Vec<String> = (0..PER_PAGE).map(|k| format!("{} 0 R", field(p, k))).collect();
+            all.extend(annots.iter().cloned());
+            objects.push(format!("<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots [{}] >>", annots.join(" ")));
+        }
+        for p in 0..PAGES {
+            for k in 0..PER_PAGE {
+                objects.push(format!("<< /Type /Annot /Subtype /Widget /FT /Tx /T (field{p}_{k}) /Rect [10 10 90 30] /P {} 0 R >>", page(p)));
+            }
+        }
+        // `/Fields` in no particular order, so the rows must be sorted.
+        let mut seed = 12345u64;
+        for i in (1..all.len()).rev() {
+            seed = seed.wrapping_mul(6364136223846793005).wrapping_add(1442695040888963407);
+            all.swap(i, (seed >> 33) as usize % (i + 1));
+        }
+        objects[0] = format!("<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [{}] >> >>", all.join(" "));
+        let kids: Vec<String> = (0..PAGES).map(|p| format!("{} 0 R", page(p))).collect();
+        objects[1] = format!("<< /Type /Pages /Kids [{}] /Count {PAGES} >>", kids.join(" "));
+        let (fields, form) = open(pdf(&objects));
+        assert_eq!(fields.len(), PAGES * PER_PAGE);
+        let (tx, rx) = std::sync::mpsc::channel();
+        std::thread::spawn(move || {
+            let rows = field_rows(&fields, &form);
+            let _ = tx.send((rows.len(), rows.iter().map(|(_, r)| r.len()).sum::<usize>()));
+        });
+        let counted = rx.recv_timeout(std::time::Duration::from_secs(3)).expect("the Fields panel's rows must not take seconds a frame");
+        assert_eq!(counted, (PAGES, PAGES * PER_PAGE));
+    }
+}
+
 #[cfg(test)]
 mod label_column {
     use super::ellipsized_prefix;
diff --git a/crates/ui-egui/src/pickers.rs b/crates/ui-egui/src/pickers.rs
index dcb012089..7661b7175 100644
--- a/crates/ui-egui/src/pickers.rs
+++ b/crates/ui-egui/src/pickers.rs
@@ -81,24 +81,36 @@ pub struct Pickers {
 }
 
 /// Clears `showing` if the worker ends without queueing a pick (it panicked).
-struct Showing(Option<Arc<AtomicBool>>);
+struct Showing {
+    flag: Option<Arc<AtomicBool>>,
+    ctx: Option<egui::Context>,
+}
 
 impl Showing {
     /// The pick is queued: the frame that uses it clears the flag.
     fn hand_over(mut self) {
-        self.0 = None;
+        self.flag = None;
     }
 }
 
 impl Drop for Showing {
     fn drop(&mut self) {
-        if let Some(flag) = &self.0 {
+        if let Some(flag) = &self.flag {
             flag.store(false, Ordering::SeqCst);
+            // No picked result will wake the frame to resume opens behind this picker.
+            if let Some(ctx) = &self.ctx {
+                ctx.request_repaint();
+            }
         }
     }
 }
 
 impl Pickers {
+    /// A picker is showing or its result is waiting for the frame.
+    pub(crate) fn pending(&self) -> bool {
+        self.showing.load(Ordering::SeqCst)
+    }
+
     /// Wait for `pick` on a worker thread and queue its result for the next frame. On macOS
     /// `pick` must already have shown the picker (rfd starts the panel when the future is
     /// created, on the main thread). Returns false when the worker couldn't start.
@@ -114,7 +126,7 @@ impl Pickers {
     where
         F: Future<Output = Vec<PathBuf>> + Send + 'static,
     {
-        let showing = Showing(Some(self.showing.clone()));
+        let showing = Showing { flag: Some(self.showing.clone()), ctx: ctx.clone() };
         let done = self.done.clone();
         std::thread::Builder::new()
             .name("file-picker".into())
@@ -225,6 +237,13 @@ impl PdfCraftApp {
         for Picked { target, paths, then } in self.pickers.take() {
             // The pick is in hand: the next picker may show, including one `then` asks for.
             self.pickers.showing.store(false, Ordering::SeqCst);
+            // Opens were polled before this pick was consumed. Wake their retained replies
+            // once, including after cancellation, without polling while a picker waits.
+            if !self.pending_opens.is_empty()
+                && let Some(ctx) = &self.ctx
+            {
+                ctx.request_repaint();
+            }
             if paths.is_empty() {
                 continue;
             }
@@ -264,18 +283,31 @@ mod tests {
     }
 
     #[test]
-    fn a_panicking_worker_clears_showing_and_queues_nothing() {
+    fn a_panicking_worker_releases_picker_and_requests_repaint() {
         let pickers = Pickers::default();
         pickers.showing.store(true, Ordering::SeqCst);
+        let ctx = egui::Context::default();
+        // Consume the context's initial repaint demand so only the failed worker can wake it.
+        for _ in 0..2 {
+            let _ = ctx.run_logic(&egui::RawInput::default(), |_| {});
+        }
+        assert!(!ctx.has_requested_repaint());
+        let wakes = Arc::new(std::sync::atomic::AtomicUsize::new(0));
+        let requested = wakes.clone();
+        ctx.set_request_repaint_callback(move |_| {
+            requested.fetch_add(1, Ordering::SeqCst);
+        });
         fn fail() -> Vec<PathBuf> {
             panic!("picker failed")
         }
         let got = Arc::new(Mutex::new(Vec::new()));
-        let worker = pickers.spawn_worker(None, None, async { fail() }, record(&got)).expect("worker starts");
+        let worker = pickers.spawn_worker(None, Some(ctx.clone()), async { fail() }, record(&got)).expect("worker starts");
         // join returns once the panic has unwound and the drop guard has run.
         assert!(worker.join().is_err());
         assert!(!pickers.showing.load(Ordering::SeqCst));
         assert!(pickers.take().is_empty());
+        assert!(ctx.has_requested_repaint(), "retained opens must get another frame after a picker worker fails");
+        assert_eq!(wakes.load(Ordering::SeqCst), 1, "an abandoned picker requests one wake");
     }
 
     #[test]
@@ -289,6 +321,43 @@ mod tests {
         assert_eq!(*got.lock().unwrap(), vec![PathBuf::from("b.pdf")], "a cancelled pick runs nothing");
     }
 
+    #[test]
+    fn cancellation_requests_a_frame_for_a_retained_open_reply() {
+        let mut app = PdfCraftApp::new();
+        let ctx = egui::Context::default();
+        app.ctx = Some(ctx.clone());
+        for _ in 0..2 {
+            let _ = ctx.run_logic(&egui::RawInput::default(), |_| {});
+        }
+        assert!(!ctx.has_requested_repaint());
+        let (reply, receiver) = std::sync::mpsc::channel();
+        reply
+            .send(crate::open_worker::ResultMessage { token: 1, kind: crate::open_worker::ResultKind::ReadFailed("controlled failure".into()) })
+            .unwrap();
+        app.pending_opens.push(crate::PendingOpen {
+            token: 1,
+            receiver,
+            name: "waiting.pdf".into(),
+            path: None,
+            stamp: None,
+            activate: true,
+            after_open: None,
+            recovered: None,
+            then: None,
+        });
+        let got = Arc::new(Mutex::new(Vec::new()));
+        app.pickers.showing.store(true, Ordering::SeqCst);
+        app.pickers.deliver(None, vec![], record(&got));
+        app.poll_pending_opens();
+        assert_eq!(app.pending_opens.len(), 1, "the picker keeps the ready reply queued");
+        app.process_picked();
+        assert!(!app.pickers.showing.load(Ordering::SeqCst));
+        assert!(got.lock().unwrap().is_empty(), "cancellation runs no callback");
+        assert!(ctx.has_requested_repaint(), "cancellation must wake the earlier blocked open poll");
+        app.poll_pending_opens();
+        assert!(app.pending_opens.is_empty(), "the retained ready reply is consumed on the next poll");
+    }
+
     #[test]
     fn a_second_picker_is_refused_while_one_is_showing() {
         let mut app = PdfCraftApp::new();
diff --git a/crates/ui-egui/src/prepare.rs b/crates/ui-egui/src/prepare.rs
index 37747f14c..386c42e87 100644
--- a/crates/ui-egui/src/prepare.rs
+++ b/crates/ui-egui/src/prepare.rs
@@ -11,6 +11,7 @@ use pdfcraft_engine::{BorderStyle, Edit, FieldFont, FieldLook, FieldProps, FormF
 use pdfcraft_render::DocInfo;
 
 use crate::canvas::{DocView, PageXform};
+use crate::comments;
 use crate::theme;
 use crate::widgets;
 
@@ -187,23 +188,14 @@ fn handles(r: Rect) -> [(Pos2, bool, bool); 4] {
     [(r.left_top(), true, true), (r.right_top(), false, true), (r.left_bottom(), true, false), (r.right_bottom(), false, false)]
 }
 
-/// The rect while a move or resize is in progress.
-fn dragged(r: Rect, grab: Grab, delta: egui::Vec2) -> Rect {
+/// The rect while a move or resize is in progress. With `shift` held a corner keeps the field's
+/// proportions, as it does for comments and stamps.
+fn dragged(r: Rect, grab: Grab, delta: egui::Vec2, shift: bool) -> Rect {
     match grab {
         Grab::Move => r.translate(delta),
         Grab::Corner(left, top) => {
-            let mut r = r;
-            if left {
-                r.min.x += delta.x;
-            } else {
-                r.max.x += delta.x;
-            }
-            if top {
-                r.min.y += delta.y;
-            } else {
-                r.max.y += delta.y;
-            }
-            Rect::from_two_pos(r.min, r.max)
+            let handle = (if left { -1 } else { 1 }, if top { -1 } else { 1 });
+            comments::resized(r, handle, delta, comments::corner_ratio(r, None, shift))
         }
         Grab::Draw(_) | Grab::Select(_) => r,
     }
@@ -295,7 +287,8 @@ pub(crate) fn page_input(
                     let Some(w) = form.iter().find(|f| f.name == name).and_then(|f| f.widgets.get(wi)) else { return out };
                     let delta = end - start;
                     if delta.length() >= 1.0 {
-                        let r = dragged(screen_rect(xf, info, page, w.rect), grab, delta);
+                        let shift = ui.input(|i| i.modifiers.shift);
+                        let r = dragged(screen_rect(xf, info, page, w.rect), grab, delta, shift);
                         let rect = user_rect(xf, info, page, r);
                         view.pending_edit =
                             Some(Edit::SetFieldProps { name, props: Box::new(FieldProps { rect: Some((wi, rect)), ..Default::default() }) });
@@ -521,7 +514,7 @@ pub(crate) fn paint_page(ui: &egui::Ui, painter: &egui::Painter, xf: &PageXform,
             let selected = prep.selected.as_ref().is_some_and(|(n, i)| n == &f.name && *i == wi);
             let also = prep.also.iter().any(|(n, i)| n == &f.name && *i == wi);
             if selected && let (Some((_, g, start)), Some(p)) = (grab, pointer) {
-                r = dragged(r, g, p - start);
+                r = dragged(r, g, p - start, ui.input(|i| i.modifiers.shift));
             }
             painter.rect_filled(r, CornerRadius::ZERO, FIELD_FILL);
             painter.rect_stroke(
@@ -928,6 +921,22 @@ fn flag_box(ui: &mut egui::Ui, flags: &mut u32, bit: u32, inverted: bool, label:
     }
 }
 
+/// Shared PDF `/Q` picker for text and choice-field Options.
+fn alignment(ui: &mut egui::Ui, quadding: &mut i64) {
+    ui.label(tl!("Alignment:"));
+    egui::ComboBox::from_id_salt("quadding")
+        .selected_text(tl!(match (*quadding).clamp(0, 2) {
+            1 => "Center",
+            2 => "Right",
+            _ => "Left",
+        }))
+        .show_ui(ui, |ui| {
+            for (q, label) in [(0, tl!("Left")), (1, tl!("Center")), (2, tl!("Right"))] {
+                ui.selectable_value(quadding, q, label);
+            }
+        });
+}
+
 /// Draw Field Properties; returns (apply, cancel).
 pub(crate) fn body(ui: &mut egui::Ui, d: &mut FieldDraft, t: &crate::theme::Tokens) -> (bool, bool) {
     use crate::widgets;
@@ -1081,14 +1090,7 @@ pub(crate) fn body(ui: &mut egui::Ui, d: &mut FieldDraft, t: &crate::theme::Toke
                 FormFieldKind::Text => {
                     use pdfcraft_engine::field_flags as ff;
                     egui::Grid::new("text-options").num_columns(2).spacing([12.0, 8.0]).show(ui, |ui| {
-                        ui.label(tl!("Alignment:"));
-                        egui::ComboBox::from_id_salt("quadding")
-                            .selected_text(tl!(["Left", "Center", "Right"][d.quadding.clamp(0, 2) as usize]))
-                            .show_ui(ui, |ui| {
-                                for (q, l) in [(0, tl!("Left")), (1, tl!("Center")), (2, tl!("Right"))] {
-                                    ui.selectable_value(&mut d.quadding, q, l);
-                                }
-                            });
+                        alignment(ui, &mut d.quadding);
                         ui.end_row();
                         let l = ui.label(tl!("Default Value:"));
                         ui.add(crate::widgets::line(&mut d.default).desired_width(260.0)).labelled_by(l.id);
@@ -1149,6 +1151,8 @@ pub(crate) fn body(ui: &mut egui::Ui, d: &mut FieldDraft, t: &crate::theme::Toke
                     }
                 }
                 _ => {
+                    ui.horizontal(|ui| alignment(ui, &mut d.quadding));
+                    ui.add_space(6.0);
                     ui.horizontal(|ui| {
                         let l = ui.label(tl!("Item:"));
                         let r = ui.add(crate::widgets::line(&mut d.new_option).desired_width(240.0)).labelled_by(l.id);
@@ -1568,3 +1572,26 @@ fn calculate_tab(ui: &mut egui::Ui, d: &mut FieldDraft, t: &crate::theme::Tokens
         ui.label(egui::RichText::new(tl!("Field names with + - * / and parentheses; put \\ before spaces in names.")).small().color(t.text_faint));
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use egui::pos2;
+
+    use super::*;
+
+    #[test]
+    fn corner_drags_stretch_freely_and_keep_proportions_with_shift() {
+        let r = Rect::from_min_max(pos2(100.0, 100.0), pos2(196.0, 132.0));
+        let free = dragged(r, Grab::Corner(false, false), vec2(24.0, 0.0), false);
+        assert_eq!(free, Rect::from_min_max(pos2(100.0, 100.0), pos2(220.0, 132.0)));
+        for (left, top) in [(true, true), (false, true), (true, false), (false, false)] {
+            let d = vec2(if left { -48.0 } else { 48.0 }, 0.0);
+            let out = dragged(r, Grab::Corner(left, top), d, true);
+            assert!((out.width() / out.height() - 3.0).abs() < 0.001, "{left} {top}: {out:?}");
+            // The opposite corner stays put.
+            assert_eq!(if left { out.max.x } else { out.min.x }, if left { r.max.x } else { r.min.x });
+            assert_eq!(if top { out.max.y } else { out.min.y }, if top { r.max.y } else { r.min.y });
+        }
+        assert_eq!(dragged(r, Grab::Move, vec2(5.0, 6.0), true), r.translate(vec2(5.0, 6.0)));
+    }
+}
diff --git a/crates/ui-egui/src/print_ui.rs b/crates/ui-egui/src/print_ui.rs
index 65d72d443..4e0f06588 100644
--- a/crates/ui-egui/src/print_ui.rs
+++ b/crates/ui-egui/src/print_ui.rs
@@ -14,6 +14,9 @@ const PREVIEW_W: f32 = 320.0;
 const PREVIEW_H: f32 = 380.0;
 const PREVIEW_INSET: f32 = 12.0;
 pub(crate) const PREVIEW_BOX: (f32, f32) = (PREVIEW_W - 2.0 * PREVIEW_INSET, PREVIEW_H - 2.0 * PREVIEW_INSET);
+/// Label printing reads the printed area of at most this many pages (each is a quick render on
+/// the UI thread); further pages print whole.
+pub(crate) const LABEL_CROP_PAGES: usize = 50;
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum Which {
@@ -30,6 +33,8 @@ pub enum Handling {
     Poster,
     Multiple,
     Booklet,
+    /// Shipping label: cut to the printed area, turned upright, one per sheet.
+    Label,
 }
 
 #[derive(Clone, Debug, PartialEq)]
@@ -67,6 +72,9 @@ pub struct PrintDraft {
     pub cut_marks: bool,
     pub orientation: Orientation,
     pub content: Content,
+    /// Print as image (Acrobat's Advanced Print Setup) at `dpi`.
+    pub as_image: bool,
+    pub dpi: f64,
     pub paper: usize,
     /// The sheet shown in the preview (0-based).
     pub sheet: usize,
@@ -78,6 +86,13 @@ pub struct PrintDraft {
     pub show_driver_options: bool,
     /// Why the printer's preferences window didn't open (Windows).
     pub driver_error: Option<String>,
+    /// Label: turn a further 180°.
+    pub label_flip: bool,
+    /// Label: each page's printed area and text direction, read when Label is chosen
+    /// ([`PdfCraftApp::read_label_crops`]); empty until then.
+    pub crops: Vec<Option<print::Crop>>,
+    /// The pages `crops` were read for, so a changed page selection reads them again.
+    pub crop_pages: Option<Vec<usize>>,
 }
 
 impl Default for PrintDraft {
@@ -111,6 +126,8 @@ impl Default for PrintDraft {
             cut_marks: true,
             orientation: Orientation::Auto,
             content: Content::DocumentAndMarkups,
+            as_image: false,
+            dpi: 300.0,
             paper: 0,
             sheet: 0,
             current_page: 0,
@@ -118,6 +135,9 @@ impl Default for PrintDraft {
             driver_choices: Default::default(),
             show_driver_options: false,
             driver_error: None,
+            label_flip: false,
+            crops: Vec::new(),
+            crop_pages: None,
         }
     }
 }
@@ -155,8 +175,17 @@ impl PrintDraft {
             },
             Handling::Booklet => Layout::Booklet { subset: self.booklet_subset, binding: self.binding },
             Handling::Poster => Layout::Poster { scale: self.poster_scale, overlap: self.overlap, cut_marks: self.cut_marks },
+            Handling::Label => Layout::Label { flip: self.label_flip },
         };
-        Ok(print::Settings { pages, paper: PAPERS[self.paper.min(PAPERS.len() - 1)].1, orientation: self.orientation, layout, content: self.content })
+        Ok(print::Settings {
+            pages,
+            paper: PAPERS[self.paper.min(PAPERS.len() - 1)].1,
+            orientation: self.orientation,
+            layout,
+            content: self.content,
+            raster: self.as_image.then_some(print::Raster { dpi: self.dpi, grayscale: self.grayscale }),
+            crops: self.crops.clone(),
+        })
     }
 
     pub fn job(&self, title: &str) -> spool::Job {
@@ -172,7 +201,11 @@ impl PrintDraft {
             options: match (&self.printer, &self.driver_options) {
                 (Some(p), Some((read_for, _))) if p == read_for => self.driver_choices.iter().map(|(k, v)| (k.clone(), v.clone())).collect(),
                 _ => Vec::new(),
-            },
+            }
+            .into_iter()
+            // The sheet the PDF was laid out on, not the queue's default paper.
+            .chain(print::cups_media(self.paper).map(|m| ("media".to_string(), m.to_string())))
+            .collect(),
         }
     }
 }
@@ -188,13 +221,16 @@ pub fn system_printers() -> PrinterSource {
 }
 
 /// The Print dialog's work in the background: the printer list being read, and the jobs being
-/// spooled (the printer each was sent to, and the spooler's answer).
+/// spooled, oldest first.
 #[derive(Default)]
 pub(crate) struct PrintTasks {
     #[cfg(not(target_arch = "wasm32"))]
     printers: Option<std::sync::mpsc::Receiver<Vec<spool::Printer>>>,
     #[cfg(not(target_arch = "wasm32"))]
-    jobs: Vec<(String, std::sync::mpsc::Receiver<Result<String, String>>)>,
+    jobs: Vec<PrintJob>,
+    /// The progress card is showing a print job (it is shared with other long jobs).
+    #[cfg(not(target_arch = "wasm32"))]
+    showing_progress: bool,
     /// The browser print being drawn, a sheet a frame (`web_print`).
     #[cfg(target_arch = "wasm32")]
     web_job: Option<crate::web_print::WebPrintJob>,
@@ -220,11 +256,34 @@ fn listed_printers() -> Vec<spool::Printer> {
     }
 }
 
+/// The first list is still being read and the user hasn't chosen yet (#160): no printer is
+/// selected only because none is known yet, so the dialog says it is looking rather than
+/// offering Save as PDF, and its button waits. Printing then would have saved a PDF.
+fn still_looking(d: &PrintDraft) -> bool {
+    d.printers_loading && d.printer.is_none() && !d.printer_picked
+}
+
 /// A printer's name as the dialog shows it.
 fn printer_label(name: &str) -> String {
     if name == crate::web_print::BROWSER_PRINTER { crate::web_print::browser_printer_label().to_string() } else { name.to_string() }
 }
 
+/// A job being spooled: its printer, the sheets sent so far of how many, and its worker's news.
+#[cfg(not(target_arch = "wasm32"))]
+struct PrintJob {
+    printer: String,
+    sheets: Option<(usize, usize)>,
+    news: std::sync::mpsc::Receiver<JobNews>,
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+enum JobNews {
+    /// `(sent, sheets)`: the spooler has this many of the job's sheets.
+    Sent(usize, usize),
+    /// The spooler's answer.
+    Done(Result<String, String>),
+}
+
 /// The printer the dialog preselects: the system default, else the first.
 fn default_printer(printers: &[spool::Printer]) -> Option<String> {
     printers.iter().find(|p| p.default).or(printers.first()).map(|p| p.name.clone())
@@ -254,6 +313,8 @@ impl PdfCraftApp {
             (true, other) => other,
         };
         self.print_draft = PrintDraft {
+            crops: Vec::new(),
+            crop_pages: None,
             printers,
             printers_loading,
             printer_picked: false,
@@ -268,6 +329,50 @@ impl PdfCraftApp {
         self.dialog = Some(crate::Dialog::Print);
     }
 
+    /// Label printing: find each printed page's printed area (a quick low-resolution render, as
+    /// Fit Visible does) and which way its text runs. Only the pages being printed are read, at
+    /// most [`LABEL_CROP_PAGES`] of them (the rest print whole); read again when they change.
+    pub(crate) fn read_label_crops(&mut self, id: pdfcraft_engine::DocId) {
+        let Some(doc) = self.session.get(id) else { return };
+        let labels: Vec<String> = doc.info.pages.iter().map(|p| p.label.clone()).collect();
+        let mut pages = self.print_draft.settings(doc.info.pages.len(), &labels).map(|s| s.pages).unwrap_or_default();
+        pages.sort_unstable();
+        pages.dedup();
+        pages.truncate(LABEL_CROP_PAGES);
+        if self.print_draft.crop_pages.as_ref() == Some(&pages) {
+            return;
+        }
+        let up = self.session.print_text_up(id, &pages);
+        let config = pdfcraft_render::RenderConfig { password: doc.password.as_deref().map(std::sync::Arc::from), ..Default::default() };
+        let mut r = pdfcraft_render::PageRenderer::new(doc.bytes.clone(), config);
+        self.print_draft.crops = doc
+            .info
+            .pages
+            .iter()
+            .enumerate()
+            .map(|(page, p)| {
+                let (w, h) = (f64::from(p.width), f64::from(p.height));
+                if pages.binary_search(&page).is_err() || w <= 0.0 || h <= 0.0 {
+                    return None;
+                }
+                let out = r.render(pdfcraft_render::RenderRequest {
+                    page,
+                    kind: pdfcraft_render::RequestKind::Pixels,
+                    tile: None,
+                    scale: (1000.0 / w.max(h) as f32).clamp(0.1, 4.0),
+                    tag: 0,
+                    preview: false,
+                });
+                let [u0, v0, u1, v1] = crate::zoom_snap::ink_bounds(out.width as usize, out.height as usize, &out.rgba)?;
+                // Image rows run down from the top; display space runs up. Half a millimetre of slack.
+                let pad = 1.5;
+                let rect = [f64::from(u0) * w - pad, (1.0 - f64::from(v1)) * h - pad, f64::from(u1) * w + pad, (1.0 - f64::from(v0)) * h + pad];
+                Some(print::Crop { rect, text_up: up.get(page).copied().unwrap_or(false) })
+            })
+            .collect();
+        self.print_draft.crop_pages = Some(pages);
+    }
+
     #[cfg(not(target_arch = "wasm32"))]
     fn list_printers_in_background(&mut self, source: PrinterSource) {
         // A list already being read is as fresh as a new one would be.
@@ -310,23 +415,63 @@ impl PdfCraftApp {
                 }
             }
             let mut finished = Vec::new();
-            self.print_tasks.jobs.retain(|(printer, rx)| match rx.try_recv() {
-                Ok(r) => {
-                    finished.push((printer.clone(), r));
-                    false
-                }
-                Err(std::sync::mpsc::TryRecvError::Empty) => true,
-                Err(std::sync::mpsc::TryRecvError::Disconnected) => {
-                    finished.push((printer.clone(), Err("the print job stopped unexpectedly".into())));
-                    false
+            self.print_tasks.jobs.retain_mut(|job| {
+                loop {
+                    match job.news.try_recv() {
+                        Ok(JobNews::Sent(sent, sheets)) => job.sheets = Some((sent, sheets)),
+                        Ok(JobNews::Done(r)) => {
+                            finished.push((job.printer.clone(), r));
+                            break false;
+                        }
+                        Err(std::sync::mpsc::TryRecvError::Empty) => break true,
+                        Err(std::sync::mpsc::TryRecvError::Disconnected) => {
+                            finished.push((job.printer.clone(), Err("the print job stopped unexpectedly".into())));
+                            break false;
+                        }
+                    }
                 }
             });
+            self.show_print_progress();
             for (printer, result) in finished {
                 self.report_print_job(&printer, result);
             }
         }
     }
 
+    /// The oldest job being spooled on the progress card, counting its sheets as they reach the
+    /// spooler, while no other long job holds the card.
+    #[cfg(not(target_arch = "wasm32"))]
+    fn show_print_progress(&mut self) {
+        let Some(job) = self.print_tasks.jobs.first() else {
+            if std::mem::take(&mut self.print_tasks.showing_progress) {
+                self.progress_notice = None;
+            }
+            return;
+        };
+        if self.progress_notice.is_some() && !self.print_tasks.showing_progress {
+            return;
+        }
+        let printer = job.printer.as_str();
+        let (label, fraction) = match job.sheets {
+            Some((sent, sheets)) if sheets > 0 => {
+                // The sheet on its way: one past those sent, until the last is.
+                let sheet = sent.saturating_add(1).min(sheets).to_string();
+                let label = crate::i18n::fmt(
+                    tl!("Sending sheet {s} of {n} to {printer}…"),
+                    &[("s", &sheet), ("n", &sheets.to_string()), ("printer", printer)],
+                );
+                (label, sent as f32 / sheets as f32)
+            }
+            _ => (crate::i18n::fmt(tl!("Sending to {printer}…"), &[("printer", printer)]), 0.0),
+        };
+        self.progress_notice = Some(crate::widgets::ProgressNotice { label, fraction, cancellable: false });
+        self.print_tasks.showing_progress = true;
+        // The bar's sweep keeps moving between sheets.
+        if let Some(ctx) = &self.ctx {
+            ctx.request_repaint_after(std::time::Duration::from_millis(100));
+        }
+    }
+
     fn report_print_job(&mut self, printer: &str, result: Result<String, String>) {
         match result {
             Ok(msg) if msg.is_empty() => self.notify(crate::i18n::fmt(tl!("Sent to {printer}"), &[("printer", printer)])),
@@ -379,20 +524,29 @@ impl PdfCraftApp {
     }
 
     /// Spool a job off the UI thread: on Windows every sheet is rendered at the printer's
-    /// resolution first, which can take minutes for a long document. The dialog closes at once
-    /// and the spooler's answer arrives as a notice.
+    /// resolution first, which can take minutes for a long document. The dialog closes at once,
+    /// the progress card counts the sheets as they reach the spooler, and the spooler's answer
+    /// arrives as a notice.
     #[cfg(not(target_arch = "wasm32"))]
     fn send_to_printer(&mut self, printer: String, bytes: Vec<u8>, job: spool::Job) -> bool {
         let (tx, rx) = std::sync::mpsc::channel();
         let ctx = self.ctx.clone();
         std::thread::spawn(move || {
-            let _ = tx.send(spool::submit(&bytes, &job).map_err(|e| e.to_string()));
-            if let Some(ctx) = ctx {
-                ctx.request_repaint();
-            }
+            let repaint = || {
+                if let Some(ctx) = &ctx {
+                    ctx.request_repaint();
+                }
+            };
+            // The receiver may be gone (the app quit): nothing to report to then.
+            let result = spool::submit_with_progress(&bytes, &job, &mut |sent, sheets| {
+                let _ = tx.send(JobNews::Sent(sent, sheets));
+                repaint();
+            });
+            let _ = tx.send(JobNews::Done(result.map_err(|e| e.to_string())));
+            repaint();
         });
-        self.notify(crate::i18n::fmt(tl!("Sending to {printer}…"), &[("printer", &printer)]));
-        self.print_tasks.jobs.push((printer, rx));
+        self.print_tasks.jobs.push(PrintJob { printer, sheets: None, news: rx });
+        self.show_print_progress();
         true
     }
 
@@ -664,7 +818,11 @@ pub(crate) fn body(
                 // The browser's print dialog sets copies, two-sided printing and colour itself.
                 let browser = d.printer.as_deref() == Some(crate::web_print::BROWSER_PRINTER);
                 ui.horizontal(|ui| {
-                    let shown = d.printer.as_deref().map_or_else(|| tl!("Save as PDF").to_string(), printer_label);
+                    let shown = match d.printer.as_deref() {
+                        Some(p) => printer_label(p),
+                        None if still_looking(d) => tl!("Looking for printers…").to_string(),
+                        None => tl!("Save as PDF").to_string(),
+                    };
                     egui::ComboBox::from_id_salt("printer").selected_text(shown).width(260.0).show_ui(ui, |ui| {
                         if d.printers_loading {
                             ui.add_enabled(false, egui::Label::new(tl!("Looking for printers…")));
@@ -678,7 +836,11 @@ pub(crate) fn body(
                             };
                             ui.selectable_value(&mut d.printer, Some(p.name.clone()), label);
                         }
-                        ui.selectable_value(&mut d.printer, None, tl!("Save as PDF"));
+                        // Chosen even when it was already the selection, so the list arriving
+                        // later doesn't replace it with the default printer.
+                        if ui.selectable_value(&mut d.printer, None, tl!("Save as PDF")).clicked() {
+                            d.printer_picked = true;
+                        }
                     });
                     let tip = if spool::HAS_PRINTER_PREFERENCES {
                         tl!("Opens the printer driver's preferences. They are saved for every print from this computer; the copies, two-sided, grayscale and paper chosen here still apply.")
@@ -706,6 +868,17 @@ pub(crate) fn body(
                     d.driver_error = None;
                 }
                 ui.end_row();
+                // The spooler answered with no printer at all (#160): say so, rather than
+                // leaving Save as PDF looking like the only thing PdfCraft can do.
+                if !d.printers_loading && d.printers.is_empty() {
+                    ui.label("");
+                    ui.label(
+                        egui::RichText::new(tl!("No printers were found. Check that the printer is installed and the print spooler is running, then open Print again."))
+                            .small()
+                            .color(t.text_muted),
+                    );
+                    ui.end_row();
+                }
                 ui.label(tl!("Copies:"));
                 ui.add_enabled_ui(!browser, |ui| {
                     ui.horizontal(|ui| {
@@ -732,11 +905,17 @@ pub(crate) fn body(
                 ui.end_row();
                 ui.label(tl!("Paper:"));
                 let paper_name = PAPERS.get(d.paper).map_or("US Letter", |p| p.0);
-                egui::ComboBox::from_id_salt("paper").selected_text(paper_name).width(260.0).show_ui(ui, |ui| {
+                let before = d.paper;
+                egui::ComboBox::from_id_salt("paper").selected_text(tl!(paper_name)).width(260.0).show_ui(ui, |ui| {
                     for (i, (name, _)) in PAPERS.iter().enumerate() {
-                        ui.selectable_value(&mut d.paper, i, *name);
+                        ui.selectable_value(&mut d.paper, i, tl!(name));
                     }
                 });
+                // Label stock gets the label layout (cut, turned upright, fitted).
+                if d.paper != before && d.paper == print::LABEL_PAPER {
+                    d.handling = Handling::Label;
+                    d.sheet = 0;
+                }
                 ui.end_row();
             });
             // Windows says which drivers can't print two-sided as they're asked; they keep their
@@ -808,10 +987,15 @@ pub(crate) fn body(
                     (Handling::Poster, tl!("Poster")),
                     (Handling::Multiple, tl!("Multiple")),
                     (Handling::Booklet, tl!("Booklet")),
+                    (Handling::Label, tl!("Label")),
                 ] {
                     if widgets::mode_tab(ui, label, d.handling == h).clicked() {
                         d.handling = h;
                         d.sheet = 0;
+                        // A label goes on label stock.
+                        if h == Handling::Label {
+                            d.paper = print::LABEL_PAPER;
+                        }
                     }
                 }
             });
@@ -831,6 +1015,14 @@ pub(crate) fn body(
                         ui.add_enabled(custom, egui::DragValue::new(&mut d.custom_scale).range(1.0..=1000.0).suffix(" %"));
                     });
                 }
+                Handling::Label => {
+                    ui.add(widgets::checkbox(&mut d.label_flip, tl!("Turn upside down (180°)")));
+                    ui.label(
+                        egui::RichText::new(tl!("Cuts each page to its printed area, turns it upright and fits it to the sheet without stretching. One label per sheet."))
+                            .small()
+                            .color(t.text_muted),
+                    );
+                }
                 Handling::Poster => {
                     ui.horizontal(|ui| {
                         ui.label(tl!("Tile scale:"));
@@ -909,6 +1101,29 @@ pub(crate) fn body(
                 ],
                 220.0,
             );
+            // Advanced (Acrobat's Advanced Print Setup): print as image. Folded unless it is on.
+            ui.add_space(6.0);
+            egui::CollapsingHeader::new(egui::RichText::new(tl!("Advanced").to_uppercase()).font(theme::semibold(10.5)).color(t.text_faint))
+                .id_salt("print-advanced")
+                .default_open(d.as_image)
+                .show(ui, |ui| {
+                    ui.horizontal(|ui| {
+                        ui.add(widgets::checkbox(&mut d.as_image, tl!("Print as image")));
+                        ui.add_enabled_ui(d.as_image, |ui| {
+                            ui.label(tl!("Resolution:"));
+                            let mut dpi = d.dpi.round() as u32;
+                            combo(ui, "print-dpi", &mut dpi, &[(150, "150 dpi"), (300, "300 dpi"), (600, "600 dpi")], 100.0);
+                            d.dpi = f64::from(dpi);
+                        });
+                    });
+                    ui.label(
+                        egui::RichText::new(tl!(
+                            "Use it when a printer skips text, shading or transparency. The print is no longer searchable text; with Print in grayscale, the pictures are grey."
+                        ))
+                        .small()
+                        .color(t.text_muted),
+                    );
+                });
         });
         ui.add_space(12.0);
         // Preview.
@@ -1013,8 +1228,9 @@ pub(crate) fn body(
     ui.add_space(12.0);
     let (mut go, mut cancel) = (false, false);
     ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
-        let label = if d.printer.is_some() { "Print" } else { "Save as PDF" };
-        if ui.add_enabled_ui(settings.is_ok() && !sheets.is_empty(), |ui| widgets::pill_button(ui, label, true)).inner.clicked() {
+        let looking = still_looking(d);
+        let label = if d.printer.is_some() || looking { tl!("Print") } else { tl!("Save as PDF") };
+        if ui.add_enabled_ui(settings.is_ok() && !sheets.is_empty() && !looking, |ui| widgets::pill_button(ui, label, true)).inner.clicked() {
             go = true;
         }
         if widgets::pill_button(ui, tl!("Cancel"), false).clicked() {
@@ -1065,6 +1281,46 @@ mod tests {
         assert_eq!(PrintDraft::default().job("report.pdf").duplex, Some(spool::Duplex::Off));
     }
 
+    /// A job being spooled holds the progress card, counting its sheets as the spooler reports
+    /// them; the card goes when the job ends and its answer arrives as a notice. A card another
+    /// long job is showing is left alone.
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn the_progress_card_counts_the_sheets_of_a_print_job() {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        let (tx, rx) = std::sync::mpsc::channel();
+        app.print_tasks.jobs.push(PrintJob { printer: "Office".into(), sheets: None, news: rx });
+        app.poll_print();
+        assert_eq!(app.progress_notice.as_ref().map(|p| p.label.as_str()), Some("Sending to Office…"));
+
+        tx.send(JobNews::Sent(0, 3)).unwrap();
+        tx.send(JobNews::Sent(1, 3)).unwrap();
+        app.poll_print();
+        let shown = app.progress_notice.clone().unwrap();
+        assert_eq!(shown.label, "Sending sheet 2 of 3 to Office…");
+        assert!((shown.fraction - 1.0 / 3.0).abs() < 1e-4 && !shown.cancellable, "{shown:?}");
+
+        tx.send(JobNews::Sent(3, 3)).unwrap();
+        tx.send(JobNews::Done(Ok(String::new()))).unwrap();
+        app.poll_print();
+        assert!(app.progress_notice.is_none() && app.print_tasks.jobs.is_empty());
+        assert_eq!(app.toast.as_ref().map(|t| t.0.as_str()), Some("Sent to Office"));
+
+        // Another job's card stays; a worker that vanished is reported, not left spinning.
+        let other = crate::widgets::ProgressNotice { label: "Optimizing…".into(), fraction: 0.5, cancellable: true };
+        app.progress_notice = Some(other.clone());
+        let (tx, rx) = std::sync::mpsc::channel();
+        app.print_tasks.jobs.push(PrintJob { printer: "Office".into(), sheets: None, news: rx });
+        tx.send(JobNews::Sent(1, 2)).unwrap();
+        app.poll_print();
+        assert_eq!(app.progress_notice, Some(other));
+        drop(tx);
+        app.poll_print();
+        assert!(app.print_tasks.jobs.is_empty() && app.progress_notice.is_some());
+        assert_eq!(app.toast.as_ref().map(|t| t.0.as_str()), Some("the print job stopped unexpectedly"));
+    }
+
     /// Issue #1308: Current page is the page on screen, even when a later page is labelled with
     /// its number. A typed range still reads labels first.
     #[test]
diff --git a/crates/ui-egui/src/recovery.rs b/crates/ui-egui/src/recovery.rs
index 134f54ecd..4f1f1d8e8 100644
--- a/crates/ui-egui/src/recovery.rs
+++ b/crates/ui-egui/src/recovery.rs
@@ -8,8 +8,16 @@
 //!
 //! Encrypted documents are stored encrypted (the working file is), so recovery never writes
 //! plaintext of a protected document to disk. The web build has no recovery store yet.
+//!
+//! A running instance holds an exclusively locked `instance-<pid>-<n>.lock` in the folder and
+//! names it in the snapshots it writes, so a second instance can tell live autosaves from a
+//! crash's leftovers and neither offers nor discards them (#2166). The OS releases the lock
+//! when the process dies.
 
+use std::fs::{File, TryLockError};
 use std::path::{Path, PathBuf};
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::sync::{Arc, OnceLock};
 
 use crate::PdfCraftApp;
 
@@ -27,17 +35,110 @@ pub struct RecoveryMeta {
     pub saved_at: u64,
     /// The bytes are encrypted; recovering asks for the password.
     pub encrypted: bool,
+    /// The lock file of the instance that wrote the snapshot (see the module doc); missing in
+    /// snapshots from before it.
+    #[serde(default)]
+    pub instance: Option<String>,
 }
 
 /// The recovery folder.
 #[derive(Clone, Debug)]
 pub struct RecoveryStore {
     dir: PathBuf,
+    /// This instance's lock, held while it runs and shared by the store's clones (one store,
+    /// one instance). Unset until [`claim`](Self::claim); `Some(None)` when claiming failed
+    /// (the folder can't be written, or the platform has no file locks).
+    lock: Arc<OnceLock<Option<InstanceLock>>>,
 }
 
+/// An open, exclusively locked `instance-<pid>-<n>.lock` in the folder, released and removed
+/// with the last clone of its store.
+#[derive(Debug)]
+struct InstanceLock {
+    name: String,
+    path: PathBuf,
+    file: File,
+}
+
+impl Drop for InstanceLock {
+    fn drop(&mut self) {
+        let _ = self.file.unlock();
+        let _ = std::fs::remove_file(&self.path);
+    }
+}
+
+/// Tells this process's stores apart: tests make several, and a dropped one's lock is free.
+static CLAIMS: AtomicU64 = AtomicU64::new(0);
+
 impl RecoveryStore {
     pub fn new(dir: impl Into<PathBuf>) -> Self {
-        Self { dir: dir.into() }
+        Self { dir: dir.into(), lock: Arc::default() }
+    }
+
+    /// Mark the folder as in use by a running instance (see the module doc). Without a lock
+    /// (the folder can't be written, or the platform has no file locks) snapshots are written
+    /// and offered as before.
+    pub fn claim(&self) {
+        self.lock.get_or_init(|| {
+            if let Err(e) = std::fs::create_dir_all(&self.dir) {
+                log::warn!("recovery folder {} can't be made: {e}", self.dir.display());
+                return None;
+            }
+            let name = format!("instance-{}-{}.lock", std::process::id(), CLAIMS.fetch_add(1, Ordering::Relaxed));
+            let path = self.dir.join(&name);
+            let locked = File::options().read(true).write(true).create(true).truncate(false).open(&path).and_then(|file| match file.try_lock() {
+                Ok(()) => Ok(file),
+                Err(TryLockError::WouldBlock) => Err(std::io::Error::new(std::io::ErrorKind::WouldBlock, "held by another instance")),
+                Err(TryLockError::Error(e)) => Err(e),
+            });
+            match locked {
+                Ok(file) => Some(InstanceLock { name, path, file }),
+                Err(e) => {
+                    let _ = std::fs::remove_file(&path);
+                    log::warn!("recovery folder {} can't be claimed: {e}", self.dir.display());
+                    None
+                }
+            }
+        });
+    }
+
+    fn own_lock(&self) -> Option<&InstanceLock> {
+        self.lock.get().and_then(Option::as_ref)
+    }
+
+    /// The name of this instance's lock file, for the snapshots it writes.
+    pub fn instance(&self) -> Option<String> {
+        self.own_lock().map(|l| l.name.clone())
+    }
+
+    /// Whether `meta` was written by another instance that is still running. A lock file that
+    /// is no longer held is a crash's leftover and is removed. The name comes from the sidecar,
+    /// which is untrusted, so only a plain `instance-….lock` name in the folder is looked at.
+    fn written_by_a_live_instance(&self, meta: &RecoveryMeta) -> bool {
+        let Some(name) = meta.instance.as_deref() else { return false };
+        if self.own_lock().is_some_and(|l| l.name == name) {
+            return false;
+        }
+        let plain = name.starts_with("instance-")
+            && name.ends_with(".lock")
+            && !name.contains("..")
+            && name.chars().all(|c| c.is_ascii_alphanumeric() || c == '-' || c == '.');
+        if !plain {
+            return false;
+        }
+        let path = self.dir.join(name);
+        let Ok(file) = File::options().read(true).write(true).open(&path) else { return false };
+        match file.try_lock() {
+            Err(TryLockError::WouldBlock) => true,
+            Ok(()) => {
+                let _ = file.unlock();
+                drop(file);
+                let _ = std::fs::remove_file(&path);
+                false
+            }
+            // Can't tell (no file locks here): offered, as before.
+            Err(TryLockError::Error(_)) => false,
+        }
     }
 
     /// `Recovery` in the portable data folder in portable mode ([`crate::portable`]), otherwise
@@ -76,7 +177,8 @@ impl RecoveryStore {
         let _ = std::fs::remove_file(self.dir.join(format!("{key}.pdf")));
     }
 
-    /// Snapshots, newest first. Listing never removes files; missing metadata uses the file name.
+    /// Snapshots, newest first, leaving out what another running instance is autosaving.
+    /// Listing never removes a snapshot; missing metadata uses the file name.
     pub fn list(&self) -> Vec<RecoveryMeta> {
         let Ok(dir) = std::fs::read_dir(&self.dir) else { return Vec::new() };
         let mut out = Vec::new();
@@ -104,9 +206,11 @@ impl RecoveryStore {
                     saved_at,
                     // This is only a display hint; opening the PDF still detects encryption.
                     encrypted: false,
+                    instance: None,
                 }
             }));
         }
+        out.retain(|m| !self.written_by_a_live_instance(m));
         out.sort_by_key(|m| std::cmp::Reverse(m.saved_at));
         out
     }
@@ -157,6 +261,7 @@ fn now_secs() -> u64 {
 impl PdfCraftApp {
     /// Turn on autosave into `store`, and look for documents a previous session left behind.
     pub fn enable_recovery(&mut self, store: RecoveryStore) {
+        store.claim();
         self.recoverable = store.list();
         if !self.recoverable.is_empty() {
             self.dialog = Some(crate::Dialog::Recovery);
@@ -169,7 +274,8 @@ impl PdfCraftApp {
         let Some(store) = self.recovery.clone() else { return };
         for snap in self.session.autosave_snapshots() {
             let key = self.recovery_keys.entry(snap.doc).or_insert_with(|| format!("{}-{}-{}", now_secs(), std::process::id(), snap.doc.0)).clone();
-            let meta = RecoveryMeta { key, name: snap.name, path: snap.path, saved_at: now_secs(), encrypted: snap.encrypted };
+            let meta =
+                RecoveryMeta { key, name: snap.name, path: snap.path, saved_at: now_secs(), encrypted: snap.encrypted, instance: store.instance() };
             if let Err(e) = store.write(&meta, &snap.bytes) {
                 log::warn!("autosave failed: {e}");
             }
diff --git a/crates/ui-egui/src/redact_ui.rs b/crates/ui-egui/src/redact_ui.rs
index 8a431a73d..412fc9599 100644
--- a/crates/ui-egui/src/redact_ui.rs
+++ b/crates/ui-egui/src/redact_ui.rs
@@ -26,6 +26,14 @@ pub struct RedactPrefs {
     pub codes: Vec<&'static str>,
     /// Overlay text font, size (0 = auto), colour, alignment and repetition.
     pub look: pdfcraft_engine::OverlayLook,
+    /// How an unapplied mark looks on the page: its outline colour (`/C`), the fill shown while
+    /// the pointer is over it (a preference, not written to the file) and its opacity (`/CA`).
+    pub outline: Rgb,
+    pub hover_fill: Rgb,
+    pub opacity: f64,
+    /// "Make properties default": OK also keeps these values for the next run. Off, they last
+    /// for this run only and the saved defaults stay what they were.
+    pub remember: bool,
 }
 
 impl Default for RedactPrefs {
@@ -39,6 +47,10 @@ impl Default for RedactPrefs {
             code_set: REDACTION_CODE_SETS[0],
             codes: Vec::new(),
             look: Default::default(),
+            outline: [0.89, 0.13, 0.13],
+            hover_fill: [0.89, 0.13, 0.13],
+            opacity: 1.0,
+            remember: true,
         }
     }
 }
@@ -57,8 +69,102 @@ impl RedactPrefs {
         let shape = Shape::Redact { quads, overlay: self.overlay_text(), look: self.look };
         let mut style = Style::default_for(&shape);
         style.fill = self.fill;
+        style.color = self.outline;
+        style.opacity = self.opacity.clamp(0.0, 1.0);
         Edit::AddAnnotation(NewAnnotation { page, shape, style, contents: String::new(), author: author.to_string() })
     }
+
+    /// The settings as saved between runs (`"redact_prefs"` in the settings file): the values
+    /// the dialog's last OK with "Make properties default" ticked left.
+    pub fn to_json(&self) -> serde_json::Value {
+        serde_json::json!({
+            "fill": self.fill,
+            "use_overlay": self.use_overlay,
+            "overlay": self.overlay,
+            "use_code": self.use_code,
+            "code_set": self.code_set.id,
+            "codes": self.codes,
+            "font": self.look.font.resource(),
+            "size": self.look.size,
+            "color": self.look.color,
+            "align": self.look.align,
+            "repeat": self.look.repeat,
+            "outline": self.outline,
+            "hover_fill": self.hover_fill,
+            "opacity": self.opacity,
+        })
+    }
+
+    /// Settings are untrusted: each value is taken only when it reads as what it should be;
+    /// anything else keeps the default. `None` when nothing was saved.
+    pub fn from_json(v: &serde_json::Value) -> Option<Self> {
+        if !v.is_object() {
+            return None;
+        }
+        let rgb = |x: &serde_json::Value| -> Option<Rgb> {
+            let a = x.as_array()?;
+            if a.len() != 3 {
+                return None;
+            }
+            let mut out = [0.0f64; 3];
+            for (slot, n) in out.iter_mut().zip(a) {
+                *slot = n.as_f64().filter(|n| (0.0..=1.0).contains(n))?;
+            }
+            Some(out)
+        };
+        let mut d = Self::default();
+        // `"fill": null` is a saved "no colour"; a missing or malformed fill keeps the default.
+        match v.get("fill") {
+            Some(serde_json::Value::Null) => d.fill = None,
+            Some(x) => {
+                if let Some(c) = rgb(x) {
+                    d.fill = Some(c);
+                }
+            }
+            None => {}
+        }
+        if let Some(b) = v["use_overlay"].as_bool() {
+            d.use_overlay = b;
+        }
+        if let Some(t) = v["overlay"].as_str() {
+            d.overlay = t.chars().take(1000).collect();
+        }
+        if let Some(b) = v["use_code"].as_bool() {
+            d.use_code = b;
+        }
+        if let Some(set) = v["code_set"].as_str().and_then(RedactionCodeSet::from_id) {
+            d.code_set = set;
+        }
+        if let Some(codes) = v["codes"].as_array() {
+            // Only codes of the saved set, each once, in the set's order.
+            d.codes = d.code_set.codes.iter().copied().filter(|c| codes.iter().any(|x| x.as_str() == Some(c))).collect();
+        }
+        if let Some(f) = v["font"].as_str() {
+            d.look.font = pdfcraft_engine::OverlayFont::from_resource(f);
+        }
+        if let Some(n) = v["size"].as_f64().filter(|n| (0.0..=400.0).contains(n)) {
+            d.look.size = n;
+        }
+        if let Some(c) = rgb(&v["color"]) {
+            d.look.color = c;
+        }
+        if let Some(a) = v["align"].as_u64().filter(|a| *a <= 2) {
+            d.look.align = a as u8;
+        }
+        if let Some(b) = v["repeat"].as_bool() {
+            d.look.repeat = b;
+        }
+        if let Some(c) = rgb(&v["outline"]) {
+            d.outline = c;
+        }
+        if let Some(c) = rgb(&v["hover_fill"]) {
+            d.hover_fill = c;
+        }
+        if let Some(o) = v["opacity"].as_f64().filter(|o| (0.0..=1.0).contains(o)) {
+            d.opacity = o;
+        }
+        Some(d)
+    }
 }
 
 /// Redact pages: which pages to mark.
@@ -327,107 +433,146 @@ pub(crate) fn search_body(ui: &mut egui::Ui, d: &mut SearchDraft, t: &Tokens) ->
 
 /// Redaction Tool Properties. Returns (apply, cancel).
 pub(crate) fn props_body(ui: &mut egui::Ui, d: &mut RedactPrefs, _t: &Tokens) -> (bool, bool) {
-    ui.set_width(380.0);
+    ui.set_width(780.0);
     ui.label(egui::RichText::new(tl!("Redaction Tool Properties")).font(crate::theme::semibold(18.0)));
     ui.add_space(8.0);
-    egui::Grid::new("redact-props").num_columns(2).spacing([12.0, 10.0]).show(ui, |ui| {
-        ui.label(tl!("Redacted area fill colour:"));
-        ui.horizontal(|ui| {
-            let mut none = d.fill.is_none();
-            if ui.add(widgets::checkbox(&mut none, tl!("No colour"))).changed() {
-                d.fill = if none { None } else { Some([0.0, 0.0, 0.0]) };
-            }
-        });
-        ui.end_row();
-        ui.label("");
-        if let Some(c) = crate::comments::swatch_grid(ui, d.fill) {
-            d.fill = Some(c);
-        }
-        ui.end_row();
-        ui.label("");
-        ui.add(widgets::checkbox(&mut d.use_overlay, tl!("Use overlay text")));
-        ui.end_row();
-        let on = d.use_overlay;
-        let l = ui.add_enabled(on, widgets::radio(!d.use_code, tl!("Custom text:")));
-        if l.clicked() {
-            d.use_code = false;
-        }
-        ui.add_enabled(on && !d.use_code, crate::widgets::line(&mut d.overlay).desired_width(220.0)).labelled_by(l.id);
-        ui.end_row();
-        if ui.add_enabled(on, widgets::radio(d.use_code, tl!("Redaction code:"))).clicked() {
-            d.use_code = true;
-        }
-        let codes_on = on && d.use_code;
-        ui.add_enabled_ui(codes_on, |ui| {
-            egui::ComboBox::from_id_salt("redaction-code-set").selected_text(d.code_set.name).show_ui(ui, |ui| {
-                for set in REDACTION_CODE_SETS {
-                    if ui.selectable_label(d.code_set == set, set.name).clicked() && d.code_set != set {
-                        d.code_set = set;
-                        d.codes.clear();
-                    }
-                }
-            });
-        });
-        ui.end_row();
-        for row in d.code_set.codes.chunks(4) {
-            ui.label("");
-            ui.add_enabled_ui(codes_on, |ui| {
+    // Two columns, so three colour grids fit a short window: the redacted result and its
+    // overlay text on the left, the mark's own look (Acrobat's third group) on
+    // the right.
+    ui.horizontal_top(|ui| {
+        ui.vertical(|ui| {
+            ui.set_width(380.0);
+            egui::Grid::new("redact-props").num_columns(2).spacing([12.0, 10.0]).show(ui, |ui| {
+                ui.label(tl!("Redacted area fill colour:"));
                 ui.horizontal(|ui| {
-                    for &code in row {
-                        let mut picked = d.codes.contains(&code);
-                        if ui.add_sized([62.0, 18.0], widgets::checkbox(&mut picked, code)).changed() {
-                            d.codes.retain(|c| *c != code);
-                            if picked {
-                                d.codes.push(code);
-                            }
-                        }
+                    let mut none = d.fill.is_none();
+                    if ui.add(widgets::checkbox(&mut none, tl!("No colour"))).changed() {
+                        d.fill = if none { None } else { Some([0.0, 0.0, 0.0]) };
                     }
                 });
-            });
-            ui.end_row();
-        }
-        let look = &mut d.look;
-        ui.label(tl!("Font:"));
-        ui.add_enabled_ui(on, |ui| {
-            egui::ComboBox::from_id_salt("overlay-font").selected_text(look.font.name()).show_ui(ui, |ui| {
-                for f in pdfcraft_engine::OverlayFont::ALL {
-                    ui.selectable_value(&mut look.font, f, f.name());
+                ui.end_row();
+                ui.label("");
+                if let Some(c) = crate::comments::swatch_grid(ui, d.fill) {
+                    d.fill = Some(c);
                 }
+                ui.end_row();
+                ui.label("");
+                ui.add(widgets::checkbox(&mut d.use_overlay, tl!("Use overlay text")));
+                ui.end_row();
+                let on = d.use_overlay;
+                let l = ui.add_enabled(on, widgets::radio(!d.use_code, tl!("Custom text:")));
+                if l.clicked() {
+                    d.use_code = false;
+                }
+                ui.add_enabled(on && !d.use_code, crate::widgets::line(&mut d.overlay).desired_width(220.0)).labelled_by(l.id);
+                ui.end_row();
+                if ui.add_enabled(on, widgets::radio(d.use_code, tl!("Redaction code:"))).clicked() {
+                    d.use_code = true;
+                }
+                let codes_on = on && d.use_code;
+                ui.add_enabled_ui(codes_on, |ui| {
+                    egui::ComboBox::from_id_salt("redaction-code-set").selected_text(d.code_set.name).show_ui(ui, |ui| {
+                        for set in REDACTION_CODE_SETS {
+                            if ui.selectable_label(d.code_set == set, set.name).clicked() && d.code_set != set {
+                                d.code_set = set;
+                                d.codes.clear();
+                            }
+                        }
+                    });
+                });
+                ui.end_row();
+                for row in d.code_set.codes.chunks(4) {
+                    ui.label("");
+                    ui.add_enabled_ui(codes_on, |ui| {
+                        ui.horizontal(|ui| {
+                            for &code in row {
+                                let mut picked = d.codes.contains(&code);
+                                if ui.add_sized([62.0, 18.0], widgets::checkbox(&mut picked, code)).changed() {
+                                    d.codes.retain(|c| *c != code);
+                                    if picked {
+                                        d.codes.push(code);
+                                    }
+                                }
+                            }
+                        });
+                    });
+                    ui.end_row();
+                }
+                let look = &mut d.look;
+                ui.label(tl!("Font:"));
+                ui.add_enabled_ui(on, |ui| {
+                    egui::ComboBox::from_id_salt("overlay-font").selected_text(look.font.name()).show_ui(ui, |ui| {
+                        for f in pdfcraft_engine::OverlayFont::ALL {
+                            ui.selectable_value(&mut look.font, f, f.name());
+                        }
+                    });
+                });
+                ui.end_row();
+                ui.label(tl!("Font size:"));
+                ui.add_enabled_ui(on, |ui| {
+                    ui.horizontal(|ui| {
+                        let mut auto = look.size <= 0.0;
+                        if ui.add(widgets::checkbox(&mut auto, tl!("Auto-size text to fit redaction region"))).changed() {
+                            look.size = if auto { 0.0 } else { 10.0 };
+                        }
+                        if !auto {
+                            ui.add(egui::DragValue::new(&mut look.size).range(2.0..=144.0).suffix(" pt"));
+                        }
+                    });
+                });
+                ui.end_row();
+                ui.label(tl!("Font colour:"));
+                ui.add_enabled_ui(on, |ui| {
+                    if let Some(c) = crate::comments::swatch_grid(ui, Some(look.color)) {
+                        look.color = c;
+                    }
+                });
+                ui.end_row();
+                ui.label("");
+                ui.add_enabled(on, widgets::checkbox(&mut look.repeat, tl!("Repeat overlay text")));
+                ui.end_row();
+                ui.label(tl!("Text alignment:"));
+                ui.add_enabled_ui(on, |ui| {
+                    ui.horizontal(|ui| {
+                        for (a, label) in [(0u8, tl!("Left")), (1, tl!("Center")), (2, tl!("Right"))] {
+                            widgets::radio_value(ui, &mut look.align, a, label);
+                        }
+                    });
+                });
+                ui.end_row();
             });
         });
-        ui.end_row();
-        ui.label(tl!("Font size:"));
-        ui.add_enabled_ui(on, |ui| {
-            ui.horizontal(|ui| {
-                let mut auto = look.size <= 0.0;
-                if ui.add(widgets::checkbox(&mut auto, tl!("Auto-size text to fit redaction region"))).changed() {
-                    look.size = if auto { 0.0 } else { 10.0 };
+        // No separator here: in a horizontal layout it would stretch to the window's bottom.
+        ui.add_space(28.0);
+        ui.vertical(|ui| {
+            ui.set_width(340.0);
+            ui.label(egui::RichText::new(tl!("Redaction mark appearance")).strong());
+            ui.add_space(6.0);
+            egui::Grid::new("redact-mark").num_columns(2).spacing([12.0, 10.0]).show(ui, |ui| {
+                ui.label(tl!("Outline colour:"));
+                if let Some(c) = crate::comments::swatch_grid(ui, Some(d.outline)) {
+                    d.outline = c;
                 }
-                if !auto {
-                    ui.add(egui::DragValue::new(&mut look.size).range(2.0..=144.0).suffix(" pt"));
+                ui.end_row();
+                ui.label(tl!("Fill colour:"));
+                ui.vertical(|ui| {
+                    if let Some(c) = crate::comments::swatch_grid(ui, Some(d.hover_fill)) {
+                        d.hover_fill = c;
+                    }
+                    ui.label(egui::RichText::new(tl!("Shown while the pointer is over a mark.")).weak().size(11.5));
+                });
+                ui.end_row();
+                ui.label(tl!("Opacity:"));
+                let mut pct = d.opacity * 100.0;
+                if ui.add(egui::Slider::new(&mut pct, 10.0..=100.0).suffix("%")).changed() {
+                    d.opacity = (pct / 100.0).clamp(0.1, 1.0);
                 }
+                ui.end_row();
+                ui.label("");
+                ui.add(widgets::checkbox(&mut d.remember, tl!("Make properties default")));
+                ui.end_row();
             });
         });
-        ui.end_row();
-        ui.label(tl!("Font colour:"));
-        ui.add_enabled_ui(on, |ui| {
-            if let Some(c) = crate::comments::swatch_grid(ui, Some(look.color)) {
-                look.color = c;
-            }
-        });
-        ui.end_row();
-        ui.label("");
-        ui.add_enabled(on, widgets::checkbox(&mut look.repeat, tl!("Repeat overlay text")));
-        ui.end_row();
-        ui.label(tl!("Text alignment:"));
-        ui.add_enabled_ui(on, |ui| {
-            ui.horizontal(|ui| {
-                for (a, label) in [(0u8, tl!("Left")), (1, tl!("Center")), (2, tl!("Right"))] {
-                    widgets::radio_value(ui, &mut look.align, a, label);
-                }
-            });
-        });
-        ui.end_row();
     });
     ui.add_space(12.0);
     buttons(ui, "OK", true)
diff --git a/crates/ui-egui/src/scroll_speed.rs b/crates/ui-egui/src/scroll_speed.rs
index af8d0fe33..a2d857c74 100644
--- a/crates/ui-egui/src/scroll_speed.rs
+++ b/crates/ui-egui/src/scroll_speed.rs
@@ -1,4 +1,4 @@
-//! How far a mouse-wheel notch scrolls (#444, #186).
+//! How far a mouse-wheel notch scrolls (#444, #186), and ↓ / ↑ with it (#985).
 //!
 //! egui scrolls `line_scroll_speed` points per wheel line: 40 on the desktop, 8 on the web.
 //! macOS already accelerates line deltas, and browsers there scroll about that far per line,
@@ -41,14 +41,18 @@ impl ScrollSpeed {
         }
     }
 
+    /// This speed relative to Normal.
+    pub fn factor(self) -> f32 {
+        match self {
+            Self::Slow => 0.5,
+            Self::Normal => 1.0,
+            Self::Fast => 2.0,
+        }
+    }
+
     /// Points one wheel line scrolls.
     pub fn line_points(self) -> f32 {
-        NORMAL_LINE_POINTS
-            * match self {
-                Self::Slow => 0.5,
-                Self::Normal => 1.0,
-                Self::Fast => 2.0,
-            }
+        NORMAL_LINE_POINTS * self.factor()
     }
 
     /// Makes egui scroll this far per wheel line, from this frame's input on (call it before egui
diff --git a/crates/ui-egui/src/sign_ui.rs b/crates/ui-egui/src/sign_ui.rs
index 14aa45160..29147a992 100644
--- a/crates/ui-egui/src/sign_ui.rs
+++ b/crates/ui-egui/src/sign_ui.rs
@@ -5,7 +5,7 @@
 use std::path::PathBuf;
 
 use egui::{Align, Color32, CornerRadius, Layout, Pos2, Rect, Stroke, vec2};
-use pdfcraft_engine::sign::{self, Appearance, Certificate, DigitalId, Modification, Name, PrivateKey};
+use pdfcraft_engine::sign::{self, Appearance, AppearanceLabels, Certificate, DigitalId, Modification, Name, PrivateKey};
 use pdfcraft_engine::{SignOptions, SignatureImage, SignatureInfo, SignatureStatus};
 
 use crate::canvas::{DocView, PageXform};
@@ -357,8 +357,10 @@ impl PdfCraftApp {
         if d.name.trim().is_empty() {
             return Err("Enter a name.".into());
         }
-        if d.password.chars().count() < 6 {
-            return Err("The password must have at least 6 characters.".into());
+        // The message is a catalogue key, so it spells the number out; keep the two in step.
+        const _: () = assert!(sign::pkcs12::MIN_PASSWORD_CHARS == 8);
+        if d.password.chars().count() < sign::pkcs12::MIN_PASSWORD_CHARS {
+            return Err("The password must have at least 8 characters.".into());
         }
         if d.password != d.confirm {
             return Err("The passwords do not match.".into());
@@ -434,6 +436,8 @@ impl PdfCraftApp {
             location: some(&d.location),
             certify: d.certify,
             appearance: d.appearance.clone(),
+            // The labels the preview shows: in the interface language, or all in English.
+            appearance_labels: appearance_labels(crate::i18n::current()).0,
             graphic,
             ..SignOptions::default()
         };
@@ -816,12 +820,67 @@ fn graphic_of(signature: Option<&SavedSig>, g: &SignGraphic) -> Option<SavedSig>
     }
 }
 
-/// The signature as it will look: the graphic (or the name) on the left, the details beside it.
+/// The words of a visible signature's labels in `lang`, and whether they fell back to English.
+///
+/// The labels are stamped into the document, so they are all in `lang` or all in English, never a
+/// mix. English when `lang` is English; when it is written right to left (its catalog is kept in
+/// display order, not the order a PDF stores text in); when one label has no translation; or when
+/// the signature's font can't draw one (Chinese, Japanese, Cyrillic, Greek in Helvetica), which
+/// signing would refuse. The English words are the sign crate's own, so they can't drift apart.
+pub(crate) fn appearance_labels(lang: crate::i18n::Lang) -> (AppearanceLabels, bool) {
+    let english = AppearanceLabels::default();
+    if lang == crate::i18n::Lang::EN {
+        return (english, false);
+    }
+    let said = |s: &str| (!lang.rtl() && crate::i18n::has(lang, s)).then(|| crate::i18n::tr(lang, s).to_string());
+    let translated = (|| {
+        Some(AppearanceLabels {
+            signed_by: said(&english.signed_by)?,
+            distinguished_name: said(&english.distinguished_name)?,
+            reason: said(&english.reason)?,
+            location: said(&english.location)?,
+            date: said(&english.date)?,
+        })
+    })();
+    match translated.filter(|l| l.first_undrawable().is_none()) {
+        Some(labels) => (labels, false),
+        None => (english, true),
+    }
+}
+
+/// The detail lines of a visible signature, as `sign::pdf` stamps them (the distinguished name
+/// aside, which the dialog doesn't know before the ID is opened): the label above the name, then
+/// the reason, location and date, each after its label. `reason` and `location` are as typed.
+fn detail_lines(a: &Appearance, labels: &AppearanceLabels, name: &str, reason: &str, location: &str, date: &str) -> Vec<String> {
+    let label = |l: &str, v: &str| if a.labels { format!("{l}{v}") } else { v.to_string() };
+    let mut lines = Vec::new();
+    if a.name {
+        if a.labels {
+            lines.push(labels.signed_by.clone());
+        }
+        lines.push(name.to_string());
+    }
+    if a.reason && !reason.trim().is_empty() {
+        lines.push(label(&labels.reason, reason.trim()));
+    }
+    if a.location && !location.trim().is_empty() {
+        lines.push(label(&labels.location, location.trim()));
+    }
+    if a.date {
+        lines.push(label(&labels.date, date));
+    }
+    lines.retain(|l| !l.is_empty());
+    lines
+}
+
+/// The signature as it will look: the graphic (or the name) on the left, the details beside it
+/// (`lines`, from [`detail_lines`] with the labels signing will stamp).
 fn preview(
     ui: &mut egui::Ui,
     t: &Tokens,
     name: &str,
-    d: &SignDraft,
+    a: &Appearance,
+    lines: &[String],
     graphic: Option<&SavedSig>,
     cache: &mut Option<(SavedSig, egui::TextureHandle)>,
 ) {
@@ -829,20 +888,6 @@ fn preview(
     let bg = if t.dark() { Color32::from_gray(0xF4) } else { Color32::WHITE };
     ui.painter().rect(rect, CornerRadius::same(4), bg, Stroke::new(1.0, t.border), egui::StrokeKind::Inside);
     let inner = rect.shrink(10.0);
-    let a = &d.appearance;
-    let mut lines = Vec::new();
-    if a.name {
-        lines.push(if a.labels { format!("Digitally signed by {name}") } else { name.to_string() });
-    }
-    if a.reason && !d.reason.trim().is_empty() {
-        lines.push(format!("{}{}", if a.labels { "Reason: " } else { "" }, d.reason.trim()));
-    }
-    if a.location && !d.location.trim().is_empty() {
-        lines.push(format!("{}{}", if a.labels { "Location: " } else { "" }, d.location.trim()));
-    }
-    if a.date {
-        lines.push(format!("{}{}", if a.labels { "Date: " } else { "" }, "(the signing time)"));
-    }
     // As in the signature itself: a graphic with no details beside it fills the box.
     let alone = graphic.is_some() && lines.is_empty();
     let half = Rect::from_min_size(inner.min, vec2(inner.width() * 0.5 - 6.0, inner.height()));
@@ -859,6 +904,8 @@ fn preview(
 
 fn sign_as(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> bool {
     let ids = app.digital_ids.clone();
+    // The time as the signature will show it (signing takes the session clock then).
+    let date = sign::pdf::display_date(&app.session.signing_date());
     let Some(d) = app.sign_draft.as_mut() else { return true };
     let Some(entry) = d.selected.and_then(|i| ids.get(i)).cloned() else {
         d.step = SignStep::Choose;
@@ -879,7 +926,16 @@ fn sign_as(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> bool {
     if d.rect.is_some() || d.field.is_some() {
         ui.label(egui::RichText::new(tl!("Appearance")).font(theme::semibold(12.5)));
         let graphic = graphic_of(app.signature.as_ref(), &d.graphic);
-        preview(ui, t, &entry.name, d, graphic.as_ref(), &mut app.sign_graphic_preview);
+        let (labels, in_english) = appearance_labels(crate::i18n::current());
+        let lines = detail_lines(&d.appearance, &labels, &entry.name, &d.reason, &d.location, &date);
+        preview(ui, t, &entry.name, &d.appearance, &lines, graphic.as_ref(), &mut app.sign_graphic_preview);
+        if in_english && d.appearance.labels {
+            ui.label(
+                egui::RichText::new(tl!("The labels are in English: the signature's font can't draw them in this language."))
+                    .small()
+                    .color(t.text_muted),
+            );
+        }
         ui.horizontal_wrapped(|ui| {
             let a = &mut d.appearance;
             ui.add(widgets::checkbox(&mut a.name, tl!("Name")));
@@ -1362,7 +1418,7 @@ mod tests {
         // P-256 keeps the test fast.
         let key = KEY_ALGORITHMS.iter().position(|k| k.1 == "p256").unwrap();
         draft.new_id =
-            NewIdDraft { name: "Grace Hopper".into(), key, password: "secret1".into(), confirm: "secret1".into(), ..NewIdDraft::default() };
+            NewIdDraft { name: "Grace Hopper".into(), key, password: "secret12".into(), confirm: "secret12".into(), ..NewIdDraft::default() };
         app.sign_draft = Some(draft);
         let i = app.create_digital_id()?;
         Ok(PathBuf::from(&app.digital_ids[i].path))
@@ -1379,7 +1435,7 @@ mod tests {
         let saved = create_in(&dir).unwrap();
         assert_eq!(saved, dir.join("Grace Hopper 3.p12"));
         assert_eq!(std::fs::read_to_string(dir.join("victim.txt")).unwrap(), "keep me");
-        assert!(sign::pkcs12::open(&std::fs::read(&saved).unwrap(), "secret1").is_ok());
+        assert!(sign::pkcs12::open(&std::fs::read(&saved).unwrap(), "secret12").is_ok());
         let _ = std::fs::remove_dir_all(&dir);
     }
 
@@ -1456,4 +1512,46 @@ mod tests {
         assert!(fresh.digital_ids.is_empty(), "the removal survives a restart: {:?}", fresh.digital_ids);
         let _ = std::fs::remove_dir_all(&dir);
     }
+
+    /// The labels a signature is stamped with are all in the interface language, or all in
+    /// English when the signature's font can't draw them there (or the language is right to
+    /// left): never a mix, and never a label signing would refuse.
+    #[test]
+    fn appearance_labels_are_translated_or_all_english() {
+        use crate::i18n::{Lang, tr};
+        let english = AppearanceLabels::default();
+        assert_eq!(appearance_labels(Lang::EN), (english.clone(), false));
+        for code in ["de", "es", "fr", "it", "pt-br", "pl", "tr", "sl", "hu"] {
+            let lang = Lang::from_code(code).unwrap();
+            let (labels, in_english) = appearance_labels(lang);
+            assert!(!in_english, "{code}: {labels:?}");
+            for ((field, ours), (_, source)) in labels.fields().into_iter().zip(english.fields()) {
+                assert_eq!(ours, tr(lang, source), "{code}: {field}");
+            }
+        }
+        let (de, _) = appearance_labels(Lang::from_code("de").unwrap());
+        assert_eq!((de.signed_by.as_str(), de.reason.as_str()), ("Digital signiert von", "Grund: "));
+        for code in ["zh-hans", "zh-hant", "ja", "ru", "uk", "bg", "kk", "el", "te", "cs", "lt", "ar"] {
+            assert_eq!(appearance_labels(Lang::from_code(code).unwrap()), (english.clone(), true), "{code}");
+        }
+        for lang in Lang::all() {
+            let (labels, in_english) = appearance_labels(lang);
+            assert_eq!(labels.first_undrawable(), None, "{}: signing would refuse {labels:?}", lang.code());
+            assert_eq!(in_english, lang != Lang::EN && labels == english, "{}", lang.code());
+        }
+    }
+
+    /// The preview's details are the stamp's: the label above the name, then each detail after
+    /// its label, in the words given, and only the values when the labels are off.
+    #[test]
+    fn preview_lines_use_the_labels_signing_stamps() {
+        let (de, _) = appearance_labels(crate::i18n::Lang::from_code("de").unwrap());
+        let all = Appearance { reason: true, location: true, ..Appearance::default() };
+        let lines = detail_lines(&all, &de, "Ada", " Genehmigt ", "Berlin", "2026.10.14 09:30:00 Z");
+        assert_eq!(lines, ["Digital signiert von", "Ada", "Grund: Genehmigt", "Ort: Berlin", "Datum: 2026.10.14 09:30:00 Z"]);
+        let bare = Appearance { labels: false, ..all.clone() };
+        assert_eq!(detail_lines(&bare, &de, "Ada", "Genehmigt", "", "D"), ["Ada", "Genehmigt", "D"]);
+        let nothing = Appearance { name: false, date: false, ..all };
+        assert!(detail_lines(&nothing, &de, "Ada", "  ", "", "D").is_empty());
+    }
 }
diff --git a/crates/ui-egui/src/signature_drag.rs b/crates/ui-egui/src/signature_drag.rs
index e61b3c9cd..094aa6cbf 100644
--- a/crates/ui-egui/src/signature_drag.rs
+++ b/crates/ui-egui/src/signature_drag.rs
@@ -133,7 +133,8 @@ impl SignatureDrag {
             return;
         }
         let (Some(background), Some(a), Some(p)) = (&layers.background, cx.get(index), cx.info.pages.get(page)) else { return };
-        let rect = cx.adjusted_rect(a, cv.gesture.as_ref(), painter.ctx().input(|i| i.pointer.hover_pos()), pending);
+        let (pointer, shift) = painter.ctx().input(|i| (i.pointer.hover_pos(), i.modifiers.shift));
+        let rect = cx.adjusted_rect(a, cv.gesture.as_ref(), pointer, shift, pending);
         let rect = cx.rect_to_user(rect);
         let painter = painter.with_clip_rect(painter.clip_rect().intersect(cx.xf.rect));
         cx.xf.paint_image(&painter, background.id(), 0.0, 0.0, 1.0, 1.0);
diff --git a/crates/ui-egui/src/system_fonts.rs b/crates/ui-egui/src/system_fonts.rs
index 3083fc5f0..606fa923d 100644
--- a/crates/ui-egui/src/system_fonts.rs
+++ b/crates/ui-egui/src/system_fonts.rs
@@ -3,8 +3,8 @@
 //! The embedded faces (Inter, egui's defaults, craft-fonts) come first in every family; this one
 //! only draws characters none of them has, such as an Arabic file name in a build without
 //! craft-fonts, or the Simplified Chinese interface in a build without a `Hans` face (#826). A
-//! second and a third installed face, [`devanagari_fallback`] and [`telugu_fallback`], draw Hindi
-//! and Telugu when one is installed. It is
+//! few more installed faces, [`devanagari_fallback`], [`telugu_fallback`], [`sinhala_fallback`]
+//! and [`tamil_fallback`], draw Hindi, Telugu, Sinhala and Tamil when one is installed. It is
 //! read at runtime and never embedded or shipped (AGENTS.md §1.4), and `PDFCRAFT_SYSTEM_FONTS=0`
 //! turns it off (published screenshots do).
 
@@ -13,6 +13,9 @@ use std::sync::{Arc, OnceLock};
 
 use egui::FontData;
 
+#[cfg(all(unix, not(target_os = "macos"), not(target_arch = "wasm32")))]
+mod fontconfig;
+
 /// Larger files are not read: a font path is still untrusted input.
 const MAX_BYTES: u64 = 32 << 20;
 /// Chinese system faces are big collections (PingFang, STHeiti), so they get a higher cap.
@@ -25,6 +28,10 @@ const PROBE: char = '\u{0627}';
 const DEVANAGARI_PROBE: char = '\u{0915}';
 /// Telugu letter ka: the face must have it to cover Telugu.
 const TELUGU_PROBE: char = '\u{0C15}';
+/// Sinhala letter ka (ක): the face must have it to cover Sinhala.
+const SINHALA_PROBE: char = '\u{0D9A}';
+/// Tamil letter ka (க): the face must have it to cover Tamil.
+const TAMIL_PROBE: char = '\u{0B95}';
 /// 欢 (U+6B22): Simplified only, absent from the Japanese craft-fonts faces.
 const HANS_PROBE: char = '\u{6B22}';
 /// 說 (U+8AAA): Traditional only, absent from the Japanese craft-fonts faces.
@@ -82,6 +89,20 @@ pub fn telugu_fallback() -> Option<Arc<FontData>> {
     CACHE.get_or_init(|| script_fallback(&telugu_candidates(), TELUGU_PROBE)).clone()
 }
 
+/// The installed fallback face for Sinhala, read once. `None` when it is turned off or no
+/// candidate is installed; the interface then draws what the embedded faces can.
+pub fn sinhala_fallback() -> Option<Arc<FontData>> {
+    static CACHE: OnceLock<Option<Arc<FontData>>> = OnceLock::new();
+    CACHE.get_or_init(|| script_fallback(&sinhala_candidates(), SINHALA_PROBE)).clone()
+}
+
+/// The installed fallback face for Tamil, read once. `None` when it is turned off or no
+/// candidate is installed; the interface then draws what the embedded faces can.
+pub fn tamil_fallback() -> Option<Arc<FontData>> {
+    static CACHE: OnceLock<Option<Arc<FontData>>> = OnceLock::new();
+    CACHE.get_or_init(|| script_fallback(&tamil_candidates(), TAMIL_PROBE)).clone()
+}
+
 fn script_fallback(candidates: &[PathBuf], probe: char) -> Option<Arc<FontData>> {
     if std::env::var_os("PDFCRAFT_SYSTEM_FONTS").is_some_and(|v| v == "0") {
         return None;
@@ -155,6 +176,57 @@ fn telugu_candidates() -> Vec<PathBuf> {
     }
 }
 
+/// Well-known locations of Sinhala faces, best first. Nirmala UI has Sinhala from Windows 10;
+/// Iskoola Pota is the older Windows Sinhala face.
+fn sinhala_candidates() -> Vec<PathBuf> {
+    if cfg!(windows) {
+        ["Nirmala.ttc", "Nirmala.ttf", "iskpota.ttf"].iter().map(|f| windows_fonts().join(f)).collect()
+    } else if cfg!(target_os = "macos") {
+        ["/System/Library/Fonts/Supplemental/Sinhala Sangam MN.ttc", "/System/Library/Fonts/Supplemental/Sinhala MN.ttc"]
+            .iter()
+            .map(PathBuf::from)
+            .collect()
+    } else {
+        unix_fonts(&[
+            "google-noto/NotoSansSinhalaUI-Regular.ttf",
+            "google-noto/NotoSansSinhala-Regular.ttf",
+            "google-noto-vf/NotoSansSinhala[wght].ttf",
+            "truetype/noto/NotoSansSinhala-Regular.ttf",
+            "truetype/noto/NotoSansSinhalaUI-Regular.ttf",
+            "noto/NotoSansSinhala-Regular.ttf",
+            "noto/NotoSansSinhalaUI-Regular.ttf",
+        ])
+    }
+}
+
+/// Well-known locations of Tamil faces, best first. Latha is the older Windows Tamil face.
+fn tamil_candidates() -> Vec<PathBuf> {
+    if cfg!(windows) {
+        ["Nirmala.ttc", "Nirmala.ttf", "latha.ttf"].iter().map(|f| windows_fonts().join(f)).collect()
+    } else if cfg!(target_os = "macos") {
+        [
+            "/System/Library/Fonts/Supplemental/Tamil Sangam MN.ttc",
+            "/System/Library/Fonts/Supplemental/Tamil MN.ttc",
+            "/Library/Fonts/Arial Unicode.ttf",
+        ]
+        .iter()
+        .map(PathBuf::from)
+        .collect()
+    } else {
+        unix_fonts(&[
+            "google-noto/NotoSansTamilUI-Regular.ttf",
+            "google-noto/NotoSansTamil-Regular.ttf",
+            "google-noto-vf/NotoSansTamil[wght].ttf",
+            "truetype/noto/NotoSansTamil-Regular.ttf",
+            "truetype/noto/NotoSansTamilUI-Regular.ttf",
+            "noto/NotoSansTamil-Regular.ttf",
+            "noto/NotoSansTamilUI-Regular.ttf",
+            "lohit-tamil-fonts/Lohit-Tamil.ttf",
+            "truetype/lohit-tamil/Lohit-Tamil.ttf",
+        ])
+    }
+}
+
 /// Well-known locations of faces with broad script coverage, best first.
 fn candidates(need: Need) -> Vec<PathBuf> {
     match need {
@@ -222,7 +294,37 @@ fn windows_fonts() -> PathBuf {
 }
 
 fn unix_fonts(files: &'static [&'static str]) -> Vec<PathBuf> {
-    ["/usr/share/fonts", "/usr/local/share/fonts"].iter().flat_map(|dir| files.iter().map(move |f| Path::new(dir).join(f))).collect()
+    #[cfg(all(unix, not(target_os = "macos"), not(target_arch = "wasm32")))]
+    static INSTALLED: OnceLock<Vec<PathBuf>> = OnceLock::new();
+    #[cfg(all(unix, not(target_os = "macos"), not(target_arch = "wasm32")))]
+    // Read once per process, and not at all when installed fonts are turned off.
+    let installed = INSTALLED
+        .get_or_init(|| {
+            if std::env::var_os("PDFCRAFT_SYSTEM_FONTS").is_some_and(|v| v == "0") {
+                return Vec::new();
+            }
+            fontconfig::font_files(&fontconfig::config_path())
+        })
+        .as_slice();
+    #[cfg(not(all(unix, not(target_os = "macos"), not(target_arch = "wasm32"))))]
+    let installed: &[PathBuf] = &[];
+    unix_candidates(files, installed)
+}
+
+fn unix_candidates(files: &[&str], installed: &[PathBuf]) -> Vec<PathBuf> {
+    let mut paths: Vec<_> =
+        ["/usr/share/fonts", "/usr/local/share/fonts"].iter().flat_map(|dir| files.iter().map(move |f| Path::new(dir).join(f))).collect();
+    // Fontconfig may point into /nix/store or a user's font directory. Keep the existing
+    // candidate names and their preference order; this does not select arbitrary fonts.
+    for file in files {
+        let name = Path::new(file).file_name();
+        for path in installed.iter().filter(|p| p.file_name() == name) {
+            if !paths.contains(path) {
+                paths.push(path.clone());
+            }
+        }
+    }
+    paths
 }
 
 fn read(path: &Path, probe: char, max: u64) -> Option<Arc<FontData>> {
@@ -235,7 +337,7 @@ fn read(path: &Path, probe: char, max: u64) -> Option<Arc<FontData>> {
     let mut data = FontData::from_owned(bytes);
     data.index = index;
     log::info!("interface font fallback: {} (face {index})", path.display());
-    Some(Arc::new(data))
+    Some(Arc::new(crate::theme::on_interface_baseline(data)))
 }
 
 /// The first face of the file that parses and maps `c`. egui parses fonts with the same skrifa,
@@ -249,6 +351,17 @@ fn face_with(bytes: &[u8], c: char) -> Option<u32> {
 mod tests {
     use super::*;
 
+    #[test]
+    fn configured_candidates_preserve_names_order_and_existing_paths() {
+        let names = ["noto/NotoSansArabic-Regular.ttf", "truetype/dejavu/DejaVuSans.ttf"];
+        let noto = PathBuf::from("/custom/fonts/NotoSansArabic-Regular.ttf");
+        let dejavu = PathBuf::from("/nix/store/font/share/fonts/truetype/DejaVuSans.ttf");
+        let installed = [dejavu.clone(), PathBuf::from("/custom/fonts/SourceHanSans.ttf"), noto.clone(), dejavu.clone()];
+        let mut expected = unix_candidates(&names, &[]);
+        expected.extend([noto, dejavu]);
+        assert_eq!(unix_candidates(&names, &installed), expected);
+    }
+
     #[test]
     fn broken_and_missing_files_are_skipped() {
         assert_eq!(face_with(b"", PROBE), None);
@@ -292,11 +405,13 @@ mod tests {
         assert!(script_fallback(&candidates, 'A').is_some());
         assert!(script_fallback(&candidates, TELUGU_PROBE).is_none());
         assert!(script_fallback(&candidates, DEVANAGARI_PROBE).is_none());
+        assert!(script_fallback(&candidates, SINHALA_PROBE).is_none());
+        assert!(script_fallback(&candidates, TAMIL_PROBE).is_none());
     }
 
     #[test]
     fn script_candidates_are_absolute_font_files() {
-        for list in [devanagari_candidates(), telugu_candidates()] {
+        for list in [devanagari_candidates(), telugu_candidates(), sinhala_candidates(), tamil_candidates()] {
             assert!(!list.is_empty());
             assert!(list.iter().all(|p| p.is_absolute() || cfg!(windows)), "{list:?}");
             assert!(list.iter().all(|p| p.extension().is_some_and(|e| e == "ttf" || e == "ttc")), "{list:?}");
diff --git a/crates/ui-egui/src/system_fonts/fontconfig.rs b/crates/ui-egui/src/system_fonts/fontconfig.rs
new file mode 100644
index 000000000..dbec74eae
--- /dev/null
+++ b/crates/ui-egui/src/system_fonts/fontconfig.rs
@@ -0,0 +1,329 @@
+//! Discover font files in configured directories, including Nix store paths.
+//!
+//! Only the existing fallback filenames are selected by the caller. Font bytes are still
+//! checked for size and glyph coverage there; no font is copied or embedded.
+
+use std::collections::HashSet;
+use std::io::Read as _;
+use std::path::{Path, PathBuf};
+
+// A configured directory may contain unrelated files or symlink cycles. Bound the walk.
+const MAX_ENTRIES: usize = 32_768;
+const MAX_DEPTH: usize = 16;
+const MAX_CONFIGS: usize = 256;
+const MAX_CONFIG_BYTES: u64 = 1024 * 1024;
+
+#[derive(Default)]
+struct Directories {
+    dirs: Vec<PathBuf>,
+    seen: HashSet<PathBuf>,
+    entries: usize,
+}
+
+impl Directories {
+    fn include(&mut self, path: &Path, depth: usize) {
+        if depth > MAX_DEPTH || self.seen.len() >= MAX_CONFIGS {
+            return;
+        }
+        let Ok(canonical) = path.canonicalize() else { return };
+        if self.seen.contains(&canonical) {
+            return;
+        }
+        if canonical.is_dir() {
+            self.seen.insert(canonical);
+            let Ok(entries) = std::fs::read_dir(path) else { return };
+            let mut configs = Vec::new();
+            for entry in entries {
+                if self.entries >= MAX_ENTRIES {
+                    break;
+                }
+                self.entries += 1;
+                let Ok(entry) = entry else { continue };
+                // Fontconfig directory includes accept digit-prefixed *.conf only.
+                let name = entry.file_name();
+                let Some(name) = name.to_str() else { continue };
+                if name.as_bytes().first().is_some_and(u8::is_ascii_digit) && name.ends_with(".conf") && entry.path().is_file() {
+                    configs.push(entry.path());
+                }
+            }
+            configs.sort();
+            for config in configs {
+                self.include(&config, depth + 1);
+            }
+            return;
+        }
+        if !canonical.is_file() {
+            return;
+        }
+        self.seen.insert(canonical);
+        let Ok(file) = std::fs::File::open(path) else { return };
+        let mut bytes = Vec::new();
+        if file.take(MAX_CONFIG_BYTES + 1).read_to_end(&mut bytes).is_err() || bytes.len() as u64 > MAX_CONFIG_BYTES {
+            return;
+        }
+        let Ok(xml) = String::from_utf8(bytes) else { return };
+        let parts = match fontconfig_parser::parse_config_parts(&xml) {
+            Ok(parts) => parts,
+            Err(error) => {
+                log::debug!("interface font directories: {}: {error}", path.display());
+                return;
+            }
+        };
+        for part in parts {
+            use fontconfig_parser::{ConfigPart, DirPrefix};
+            match part {
+                ConfigPart::Dir(dir) if self.dirs.len() < MAX_ENTRIES => self.dirs.push(dir.calculate_path(path)),
+                ConfigPart::ResetDirs => self.dirs.clear(),
+                ConfigPart::Include(mut include) => {
+                    // The dependency's default include prefix hardcodes /etc/fonts.
+                    // Resolve relative to this file, including nested and FONTCONFIG_PATH configs.
+                    if include.prefix == DirPrefix::Default {
+                        include.prefix = DirPrefix::Relative;
+                    }
+                    self.include(&include.calculate_path(path), depth + 1);
+                }
+                _ => {}
+            }
+        }
+    }
+}
+
+pub(super) fn config_path() -> PathBuf {
+    let file = std::env::var_os("FONTCONFIG_FILE").map_or_else(|| PathBuf::from("fonts.conf"), PathBuf::from);
+    if file.is_absolute() {
+        return file;
+    }
+    let dir =
+        std::env::var_os("FONTCONFIG_PATH").and_then(|paths| std::env::split_paths(&paths).next()).unwrap_or_else(|| PathBuf::from("/etc/fonts"));
+    dir.join(file)
+}
+
+pub(super) fn font_files(config_path: &Path) -> Vec<PathBuf> {
+    // Use the dependency's XML parser, but own include resolution and directory filtering.
+    // Missing or malformed configuration must not prevent the ordinary fallback paths.
+    let mut config = Directories::default();
+    config.include(config_path, 0);
+    let mut pending: Vec<_> = config.dirs.into_iter().map(|dir| (dir, 0)).collect();
+    let mut seen = HashSet::new();
+    let mut files = Vec::new();
+    let mut remaining = MAX_ENTRIES;
+    while let Some((dir, depth)) = pending.pop() {
+        let Ok(canonical) = dir.canonicalize() else { continue };
+        if !seen.insert(canonical) {
+            continue;
+        }
+        let Ok(entries) = std::fs::read_dir(&dir) else { continue };
+        for entry in entries {
+            if remaining == 0 {
+                files.sort();
+                return files;
+            }
+            remaining -= 1;
+            let Ok(entry) = entry else { continue };
+            let path = entry.path();
+            // Follow links to fonts and directories, but visit each directory only once.
+            if path.is_dir() {
+                if depth < MAX_DEPTH {
+                    pending.push((path, depth + 1));
+                }
+            } else if path.extension().is_some_and(|ext| ext == "ttf" || ext == "ttc") && path.is_file() {
+                files.push(path);
+            }
+        }
+    }
+    files.sort();
+    files
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    // Fixtures contain only configuration and dummy files, never copied system fonts.
+    struct Fixture(PathBuf);
+
+    impl Fixture {
+        fn new() -> Self {
+            static NEXT: std::sync::atomic::AtomicUsize = std::sync::atomic::AtomicUsize::new(0);
+            let n = NEXT.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+            let dir = std::env::temp_dir().join(format!("pdfcraft-fontconfig-{}-{n}", std::process::id()));
+            std::fs::create_dir(&dir).unwrap();
+            Self(dir)
+        }
+
+        fn config(&self, name: &str, body: &str) -> PathBuf {
+            let path = self.0.join(name);
+            std::fs::write(&path, format!("<fontconfig>{body}</fontconfig>")).unwrap();
+            path
+        }
+
+        fn isolated(&self, test: &str) {
+            // Environment selection is process-global: never mutate it in a parallel harness.
+            let output = std::process::Command::new(std::env::current_exe().unwrap())
+                .args(["--exact", &format!("system_fonts::fontconfig::tests::{test}"), "--nocapture"])
+                .env("FONTCONFIG_PATH", &self.0)
+                .env("FONTCONFIG_FILE", "fonts.conf")
+                .env("PDFCRAFT_FONTCONFIG_TEST_ROOT", &self.0)
+                .output()
+                .unwrap();
+            assert!(output.status.success(), "{}\n{}", String::from_utf8_lossy(&output.stdout), String::from_utf8_lossy(&output.stderr));
+            assert!(String::from_utf8_lossy(&output.stdout).contains("1 passed"));
+        }
+
+        fn font(&self) -> PathBuf {
+            let dir = self.0.join("fonts");
+            std::fs::create_dir(&dir).unwrap();
+            let font = dir.join("DejaVuSans.ttf");
+            std::fs::write(&font, b"dummy font for directory discovery").unwrap();
+            font
+        }
+    }
+
+    impl Drop for Fixture {
+        fn drop(&mut self) {
+            let _ = std::fs::remove_dir_all(&self.0);
+        }
+    }
+
+    #[test]
+    fn relative_includes_follow_each_including_config_under_fontconfig_path() {
+        if let Some(root) = std::env::var_os("PDFCRAFT_FONTCONFIG_TEST_ROOT") {
+            let root = PathBuf::from(root);
+            assert_eq!(config_path(), root.join("fonts.conf"));
+            assert_eq!(font_files(&config_path()), vec![root.join("fonts/DejaVuSans.ttf")]);
+            return;
+        }
+        let fixture = Fixture::new();
+        fixture.font();
+        std::fs::create_dir(fixture.0.join("conf.d")).unwrap();
+        std::fs::create_dir(fixture.0.join("nested")).unwrap();
+        fixture.config("fonts.conf", "<include>conf.d</include>");
+        fixture.config("conf.d/10-fonts.conf", "<include>../nested/next.conf</include>");
+        fixture.config("nested/next.conf", &format!("<dir>{}</dir>", fixture.0.join("fonts").display()));
+        fixture.isolated("relative_includes_follow_each_including_config_under_fontconfig_path");
+    }
+
+    #[test]
+    fn included_directories_ignore_disabled_backup_and_non_numbered_files() {
+        if let Some(root) = std::env::var_os("PDFCRAFT_FONTCONFIG_TEST_ROOT") {
+            let root = PathBuf::from(root);
+            assert_eq!(font_files(&config_path()), vec![root.join("fonts/DejaVuSans.ttf")]);
+            return;
+        }
+        for name in ["99-reset.conf.disabled", "99-reset.conf.bak", "reset.conf"] {
+            let fixture = Fixture::new();
+            fixture.font();
+            std::fs::create_dir(fixture.0.join("conf.d")).unwrap();
+            fixture.config("fonts.conf", &format!("<include>{}</include>", fixture.0.join("conf.d").display()));
+            fixture.config("conf.d/10-fonts.conf", &format!("<dir>{}</dir>", fixture.0.join("fonts").display()));
+            fixture.config(&format!("conf.d/{name}"), "<reset-dirs/>");
+            fixture.isolated("included_directories_ignore_disabled_backup_and_non_numbered_files");
+        }
+    }
+
+    #[test]
+    fn numbered_configs_keep_lexical_reset_order_and_include_cycles_terminate() {
+        let fixture = Fixture::new();
+        let font = fixture.font();
+        std::fs::create_dir(fixture.0.join("conf.d")).unwrap();
+        let config = fixture.config("fonts.conf", "<include>conf.d</include>");
+        fixture.config("conf.d/10-reset.conf", "<reset-dirs/>");
+        let external = fixture.config("external.conf", &format!("<dir>{}</dir><include>../fonts.conf</include>", fixture.0.join("fonts").display()));
+        std::os::unix::fs::symlink(external, fixture.0.join("conf.d/20-fonts.conf")).unwrap();
+        assert_eq!(font_files(&config), vec![font]);
+        fixture.config("conf.d/30-reset.conf", "<reset-dirs/>");
+        assert!(font_files(&config).is_empty());
+    }
+
+    #[test]
+    fn oversized_configs_are_skipped_without_losing_other_includes() {
+        let fixture = Fixture::new();
+        let font = fixture.font();
+        std::fs::create_dir(fixture.0.join("conf.d")).unwrap();
+        let config = fixture.config("fonts.conf", "<include>conf.d</include>");
+        std::fs::write(fixture.0.join("conf.d/10-large.conf"), vec![b' '; (MAX_CONFIG_BYTES + 1) as usize]).unwrap();
+        fixture.config("conf.d/20-fonts.conf", &format!("<dir>{}</dir>", fixture.0.join("fonts").display()));
+        assert_eq!(font_files(&config), vec![font]);
+    }
+
+    #[test]
+    fn deep_include_chains_are_bounded() {
+        let fixture = Fixture::new();
+        fixture.font();
+        for depth in 0..=MAX_DEPTH + 1 {
+            let body = if depth > MAX_DEPTH {
+                format!("<dir>{}</dir>", fixture.0.join("fonts").display())
+            } else {
+                format!("<include>depth-{}.conf</include>", depth + 1)
+            };
+            fixture.config(&format!("depth-{depth}.conf"), &body);
+        }
+        assert!(font_files(&fixture.0.join("depth-0.conf")).is_empty());
+    }
+
+    #[test]
+    fn wide_include_directories_are_bounded() {
+        let fixture = Fixture::new();
+        fixture.font();
+        std::fs::create_dir(fixture.0.join("conf.d")).unwrap();
+        let config = fixture.config("fonts.conf", "<include>conf.d</include>");
+        for n in 0..MAX_CONFIGS {
+            fixture.config(&format!("conf.d/{n:04}-empty.conf"), "");
+        }
+        fixture.config("conf.d/9999-fonts.conf", &format!("<dir>{}</dir>", fixture.0.join("fonts").display()));
+        assert!(font_files(&config).is_empty());
+    }
+
+    #[test]
+    fn included_configuration_finds_fonts_outside_standard_directories() {
+        let fixture = Fixture::new();
+        let fonts = fixture.0.join("nix-store-font/share/fonts/truetype");
+        std::fs::create_dir_all(&fonts).unwrap();
+        let font = fonts.join("DejaVuSans.ttf");
+        std::fs::write(&font, b"not parsed during discovery").unwrap();
+        std::fs::write(fonts.join("README.txt"), b"not a font").unwrap();
+        let included = fixture.config("nixos.conf", &format!("<dir>{}</dir>", fixture.0.join("nix-store-font").display()));
+        let config = fixture.config("fonts.conf", &format!("<include>{}</include>", included.display()));
+        assert_eq!(font_files(&config), vec![font]);
+    }
+
+    #[test]
+    fn missing_and_malformed_configuration_are_skipped() {
+        let fixture = Fixture::new();
+        assert!(font_files(&fixture.0.join("missing.conf")).is_empty());
+        let path = fixture.0.join("broken.conf");
+        std::fs::write(&path, "<fontconfig><dir>").unwrap();
+        assert!(font_files(&path).is_empty());
+    }
+
+    #[test]
+    fn symlinked_fonts_are_found_and_directory_cycles_terminate() {
+        let fixture = Fixture::new();
+        let fonts = fixture.0.join("fonts");
+        std::fs::create_dir(&fonts).unwrap();
+        let original = fixture.0.join("original.ttf");
+        std::fs::write(&original, b"dummy").unwrap();
+        let linked = fonts.join("DejaVuSans.ttf");
+        std::os::unix::fs::symlink(&original, &linked).unwrap();
+        std::os::unix::fs::symlink(&fonts, fonts.join("loop")).unwrap();
+        std::os::unix::fs::symlink(fixture.0.join("missing.ttf"), fonts.join("broken.ttf")).unwrap();
+        let config = fixture.config("fonts.conf", &format!("<dir>{}</dir><dir>{}</dir>", fonts.display(), fonts.display()));
+        assert_eq!(font_files(&config), vec![linked]);
+    }
+
+    #[test]
+    fn deeply_nested_directories_are_bounded() {
+        let fixture = Fixture::new();
+        let mut dir = fixture.0.join("fonts");
+        std::fs::create_dir(&dir).unwrap();
+        let shallow = dir.join("DejaVuSans.ttf");
+        std::fs::write(&shallow, b"dummy").unwrap();
+        for _ in 0..MAX_DEPTH + 1 {
+            dir.push("nested");
+            std::fs::create_dir(&dir).unwrap();
+        }
+        std::fs::write(dir.join("DejaVuSans.ttf"), b"dummy").unwrap();
+        let config = fixture.config("fonts.conf", &format!("<dir>{}</dir>", fixture.0.join("fonts").display()));
+        assert_eq!(font_files(&config), vec![shallow]);
+    }
+}
diff --git a/crates/ui-egui/src/tags_ui.rs b/crates/ui-egui/src/tags_ui.rs
index 2fe917f7c..ed019cacb 100644
--- a/crates/ui-egui/src/tags_ui.rs
+++ b/crates/ui-egui/src/tags_ui.rs
@@ -5,7 +5,7 @@ use std::sync::Arc;
 
 use egui::Ui;
 use pdfcraft_cos::ObjRef;
-use pdfcraft_engine::a11y::{TagInfo, TagPlacement, TagProperty};
+use pdfcraft_engine::a11y::{TagContentItem, TagInfo, TagPlacement, TagProperty};
 use pdfcraft_engine::{DocId, Edit};
 
 use crate::{icons, theme::Tokens, widgets};
@@ -20,6 +20,9 @@ pub(crate) struct State {
     /// The tag list per (document, edit generation): walking the structure tree is too slow
     /// to repeat every frame on a large tagged PDF.
     cache: Option<(DocId, u64, Arc<Vec<TagInfo>>)>,
+    /// The selected tag's marked content per (document, edit generation, tag): reading it parses
+    /// page content, so it isn't repeated every frame either.
+    content_cache: Option<(DocId, u64, ObjRef, Arc<Vec<TagContentItem>>)>,
 }
 
 #[derive(Clone, Debug, Default)]
@@ -64,6 +67,21 @@ impl Draft {
 }
 
 impl State {
+    /// The selected tag's marked content, read again only after an edit or a new selection.
+    pub(crate) fn content(&mut self, doc: &pdfcraft_engine::Document) -> Arc<Vec<TagContentItem>> {
+        let Some(object) = self.selected else { return Arc::default() };
+        let generation = doc.edit_generation();
+        if let Some((id, g, o, content)) = &self.content_cache
+            && *id == doc.id
+            && *g == generation
+            && *o == object
+        {
+            return content.clone();
+        }
+        let content = Arc::new(doc.tag_content(object).unwrap_or_default());
+        self.content_cache = Some((doc.id, generation, object, content.clone()));
+        content
+    }
     /// The document's tags, walked again only after an edit.
     pub(crate) fn tags(&mut self, doc: &pdfcraft_engine::Document) -> Arc<Vec<TagInfo>> {
         let generation = doc.edit_generation();
@@ -102,7 +120,15 @@ impl State {
 }
 
 /// The chosen page and an edit to apply after the panel releases its document borrow.
-pub(crate) fn panel(ui: &mut Ui, t: &Tokens, doc: DocId, tags: &[TagInfo], state: &mut State, can_edit: bool) -> (Option<usize>, Option<Edit>) {
+pub(crate) fn panel(
+    ui: &mut Ui,
+    t: &Tokens,
+    doc: DocId,
+    tags: &[TagInfo],
+    content: &[TagContentItem],
+    state: &mut State,
+    can_edit: bool,
+) -> (Option<usize>, Option<Edit>) {
     if state.doc != Some(doc) {
         state.doc = Some(doc);
         state.selected = None;
@@ -191,11 +217,28 @@ pub(crate) fn panel(ui: &mut Ui, t: &Tokens, doc: DocId, tags: &[TagInfo], state
             state.draft = Draft::from_tag(tag);
         }
     });
-    let (mut earlier, mut later) = (false, false);
+    let (mut earlier, mut later, mut artifact) = (false, false, false);
     ui.horizontal(|ui| {
         earlier = ui.add_enabled(can_edit && !dirty && before.is_some(), egui::Button::new(tl!("Move tag earlier"))).clicked();
         later = ui.add_enabled(can_edit && !dirty && after.is_some(), egui::Button::new(tl!("Move tag later"))).clicked();
+        artifact = ui
+            .add_enabled(can_edit && !dirty, egui::Button::new(tl!("Mark as artifact")))
+            .on_hover_text(tl!("Remove this leaf tag from reading order and mark its direct content as an artifact"))
+            .clicked();
     });
+    ui.separator();
+    for item in content {
+        let page_label = item.page.map(|p| crate::i18n::fmt(tl!("Go to page {p}"), &[("p", &(p + 1).to_string())]));
+        let label = match (&page_label, item.text.trim()) {
+            (Some(page), text) if !text.is_empty() => format!("MCID {} · {page} · {text}", item.mcid),
+            (Some(page), _) => format!("MCID {} · {page}", item.mcid),
+            (_, text) if !text.is_empty() => format!("MCID {} · {text}", item.mcid),
+            _ => format!("MCID {}", item.mcid),
+        };
+        if ui.button(label).clicked() {
+            page = item.page;
+        }
+    }
     (
         page,
         if save {
@@ -204,6 +247,8 @@ pub(crate) fn panel(ui: &mut Ui, t: &Tokens, doc: DocId, tags: &[TagInfo], state
             before.map(|anchor| Edit::MoveTag { object: tag.object, anchor: anchor.object, placement: TagPlacement::Before })
         } else if later {
             after.map(|anchor| Edit::MoveTag { object: tag.object, anchor: anchor.object, placement: TagPlacement::After })
+        } else if artifact {
+            Some(Edit::MarkTagArtifact { object: tag.object })
         } else {
             None
         },
diff --git a/crates/ui-egui/src/theme.rs b/crates/ui-egui/src/theme.rs
index 9f2bb9009..3f43a03dc 100644
--- a/crates/ui-egui/src/theme.rs
+++ b/crates/ui-egui/src/theme.rs
@@ -220,6 +220,10 @@ pub const SYSTEM_FALLBACK: &str = "system-fallback";
 pub const SYSTEM_DEVANAGARI_FALLBACK: &str = "system-devanagari-fallback";
 /// The name of the installed Telugu face [`installed_font_definitions`] may add.
 pub const SYSTEM_TELUGU_FALLBACK: &str = "system-telugu-fallback";
+/// The name of the installed Sinhala face [`installed_font_definitions`] may add.
+pub const SYSTEM_SINHALA_FALLBACK: &str = "system-sinhala-fallback";
+/// The name of the installed Tamil face [`installed_font_definitions`] may add.
+pub const SYSTEM_TAMIL_FALLBACK: &str = "system-tamil-fallback";
 
 /// What [`install_fonts_for`] installs: [`font_definitions_for`], then, on desktop, one face
 /// already installed on this machine. It only draws characters no embedded face has.
@@ -232,8 +236,9 @@ pub const SYSTEM_TELUGU_FALLBACK: &str = "system-telugu-fallback";
 /// - Otherwise it is the last fallback of every family (an Arabic file name in a build without
 ///   craft-fonts).
 ///
-/// An installed Devanagari face and an installed Telugu face, when there are, end every family
-/// just before that one, so Hindi and Telugu text draw in a build without such faces (#1531).
+/// Installed Devanagari, Telugu, Sinhala and Tamil faces, when there are, end every family just
+/// before that one, so Hindi, Telugu (#1531), Sinhala and Tamil (#1688) text, such as a file
+/// name, draws in a build without such faces.
 ///
 /// `PDFCRAFT_SYSTEM_FONTS=0` leaves them out.
 pub fn installed_font_definitions(cjk: CjkPreference) -> FontDefinitions {
@@ -246,6 +251,8 @@ pub fn installed_font_definitions(cjk: CjkPreference) -> FontDefinitions {
         for (name, data) in [
             (SYSTEM_DEVANAGARI_FALLBACK, crate::system_fonts::devanagari_fallback()),
             (SYSTEM_TELUGU_FALLBACK, crate::system_fonts::telugu_fallback()),
+            (SYSTEM_SINHALA_FALLBACK, crate::system_fonts::sinhala_fallback()),
+            (SYSTEM_TAMIL_FALLBACK, crate::system_fonts::tamil_fallback()),
         ] {
             let Some(data) = data else { continue };
             fonts.font_data.insert(name.to_owned(), data);
@@ -308,6 +315,40 @@ fn primary_font_tweak(platform: FontPolicyPlatform, name: &str) -> FontTweak {
     tweak
 }
 
+/// A face's vertical metrics in em, as egui reads them: skrifa's ascent, descent (negative) and
+/// line gap at the default location. `None` when the face doesn't parse.
+fn vertical_metrics(bytes: &[u8], index: u32) -> Option<[f32; 3]> {
+    use skrifa::MetadataProvider as _;
+    let font = skrifa::FontRef::from_index(bytes, index).ok()?;
+    let m = font.metrics(skrifa::instance::Size::unscaled(), skrifa::instance::LocationRef::default());
+    let em = f32::from(m.units_per_em);
+    let metrics = [m.ascent / em, m.descent / em, m.leading / em];
+    (em > 0.0 && metrics.iter().all(|v| v.is_finite())).then_some(metrics)
+}
+
+/// How far below the primary face's baseline egui draws a fallback face's, in em of the font size
+/// (negative: above). egui centres the fallback's line box (ascent − descent + gap) on the
+/// primary's rather than lining up their baselines, so the baseline moves by half the difference
+/// of ascent + descent, less half the difference of the line gaps (epaint `text_layout`).
+fn baseline_drop(primary: [f32; 3], fallback: [f32; 3]) -> f32 {
+    let [pa, pd, pg] = primary;
+    let [a, d, g] = fallback;
+    ((a + d) - (pa + pd) + pg - g) / 2.0
+}
+
+/// `data` with its glyphs moved onto Inter's baseline (#1676). Without this, Chinese next to Latin
+/// in one label sits higher or lower than the Latin by a few percent of the font size, depending on
+/// the installed Chinese face (PingFang, Microsoft JhengHei, SimSun…). Inter is the first face of
+/// every proportional family; the monospace family's JetBrains Mono differs from it by 0.004 em,
+/// well under a pixel. A face that doesn't parse is left as it is (egui will skip it anyway).
+pub(crate) fn on_interface_baseline(mut data: FontData) -> FontData {
+    let primary = vertical_metrics(pdfcraft_fonts::INTER_REGULAR, 0);
+    if let (Some(primary), Some(fallback)) = (primary, vertical_metrics(&data.font, data.index)) {
+        data.tweak.y_offset_factor = -baseline_drop(primary, fallback);
+    }
+    data
+}
+
 fn font_definitions_for_platform(prefer_hans: bool, platform: FontPolicyPlatform) -> FontDefinitions {
     let mut fonts = FontDefinitions::default();
     let add = |fonts: &mut FontDefinitions, name: &str, bytes: &'static [u8]| {
@@ -315,7 +356,7 @@ fn font_definitions_for_platform(prefer_hans: bool, platform: FontPolicyPlatform
         let data = if ["Inter", "Inter-Medium", "Inter-SemiBold", "JetBrainsMono"].contains(&name) {
             data.tweak(primary_font_tweak(platform, name))
         } else {
-            data
+            on_interface_baseline(data)
         };
         fonts.font_data.insert(name.to_owned(), Arc::new(data));
     };
@@ -326,6 +367,9 @@ fn font_definitions_for_platform(prefer_hans: bool, platform: FontPolicyPlatform
     add(&mut fonts, "JetBrainsMono", include_bytes!("../../../assets/fonts/JetBrainsMono-Regular.ttf"));
     fonts.families.entry(FontFamily::Proportional).or_default().insert(0, "Inter".to_owned());
     fonts.families.entry(FontFamily::Monospace).or_default().insert(0, "JetBrainsMono".to_owned());
+    // Keep missing Latin/Cyrillic letters in the app's own faces (for example Bulgarian ѝ,
+    // absent from JetBrains Mono), before egui's defaults or optional system/CJK fallbacks.
+    fonts.families.entry(FontFamily::Monospace).or_default().insert(1, "Inter".to_owned());
     // The same static bytes pdfcraft-fonts uses for Japanese/Chinese text in PDFs: one copy, not two.
     for face in pdfcraft_fonts::ui_cjk_fonts(prefer_hans) {
         let name = face.name();
@@ -549,6 +593,39 @@ mod tests {
         )
     }
 
+    /// The baseline of each glyph of `text` laid out by egui at `size` points, in points from the
+    /// top of the row: its position plus its face's `y_offset_factor`, as epaint draws it.
+    fn baselines(fallback: FontData, size: f32, text: &str) -> Vec<f32> {
+        let factor = fallback.tweak.y_offset_factor;
+        let mut defs = FontDefinitions::empty();
+        defs.font_data.insert("Inter".into(), Arc::new(FontData::from_static(pdfcraft_fonts::INTER_REGULAR)));
+        defs.font_data.insert("fallback".into(), Arc::new(fallback));
+        defs.families.insert(FontFamily::Proportional, vec!["Inter".into(), "fallback".into()]);
+        let mut fonts = Fonts::new(TextOptions::default(), defs);
+        let g = galley(&mut fonts, FontFamily::Proportional, size, 1.0, text);
+        let inter_has = |c: char| c.is_ascii();
+        g.rows[0].glyphs.iter().map(|gl| gl.pos.y + if inter_has(gl.chr) { 0.0 } else { size * factor }).collect()
+    }
+
+    #[test]
+    fn fallback_faces_share_the_interface_baseline() {
+        // Dancing Script's metrics differ from Inter's the way a Chinese face's do (by 0.044 em),
+        // and it has letters Inter doesn't (DŽ), which egui then takes from it.
+        let dancing: &'static [u8] = include_bytes!("../../../assets/fonts/DancingScript.ttf");
+        let size = 100.0;
+        // As egui lays it out by itself, DŽ sits ~4 pt off H's baseline: the bug (#1676).
+        let raw = baselines(FontData::from_static(dancing), size, "HDŽ");
+        assert!((raw[1] - raw[0]).abs() > 3.0, "the test fonts must differ: {raw:?}");
+        let drop = baseline_drop(vertical_metrics(pdfcraft_fonts::INTER_REGULAR, 0).unwrap(), vertical_metrics(dancing, 0).unwrap());
+        assert!((raw[1] - raw[0] - size * drop).abs() <= 1.0, "baseline_drop predicts egui: {raw:?} vs {drop}");
+        // On the interface baseline, to the pixel.
+        let aligned = baselines(on_interface_baseline(FontData::from_static(dancing)), size, "HDŽ");
+        assert!((aligned[1] - aligned[0]).abs() <= 1.0, "{aligned:?}");
+        // A face that doesn't parse is left alone rather than guessed at.
+        assert_eq!(on_interface_baseline(FontData::from_static(b"not a font")).tweak, FontTweak::default());
+        assert_eq!(vertical_metrics(b"", 0), None);
+    }
+
     #[test]
     fn windows_hinting_changes_only_the_jetbrains_symmetric_rendering_field() {
         let baseline = font_definitions_for_platform(false, FontPolicyPlatform::Other);
diff --git a/crates/ui-egui/src/wheel_pager.rs b/crates/ui-egui/src/wheel_pager.rs
index a05af23bf..d12c445a8 100644
--- a/crates/ui-egui/src/wheel_pager.rs
+++ b/crates/ui-egui/src/wheel_pager.rs
@@ -53,12 +53,16 @@ pub(crate) struct WheelPager {
     last_event: f64,
     /// egui time of the last smooth (non-notch) motion.
     last_smooth: f64,
+    /// The current smooth gesture already panned the page (edge paging only): it must end
+    /// before it can turn, so momentum that carries the view to the page's edge doesn't go on
+    /// to turn the page.
+    panned: bool,
 }
 
 impl Default for WheelPager {
     fn default() -> Self {
         // Infinitely long ago, so the first event never looks like part of a stream.
-        Self { accum: 0.0, turned: None, touch: None, finger_up: None, last_event: f64::NEG_INFINITY, last_smooth: f64::NEG_INFINITY }
+        Self { accum: 0.0, turned: None, touch: None, finger_up: None, last_event: f64::NEG_INFINITY, last_smooth: f64::NEG_INFINITY, panned: false }
     }
 }
 
@@ -69,10 +73,27 @@ impl WheelPager {
         self.accum = 0.0;
     }
 
+    /// Whether the current gesture already turned a page: the rest of it must not pan the page
+    /// just shown away from its top (or bottom).
+    pub(crate) fn gesture_turned(&self) -> bool {
+        self.turned.is_some()
+    }
+
     /// Feed one `Event::MouseWheel`: `dy` is its vertical delta (negative scrolls forward) and
     /// `now` is egui time. With `can_turn` false (the page doesn't fit, a dialog is open…) the
     /// gesture is followed but never turns. Returns the way to turn (`true` = forward).
     pub(crate) fn feed(&mut self, unit: MouseWheelUnit, dy: f32, phase: TouchPhase, now: f64, can_turn: bool) -> Option<bool> {
+        self.feed_inner(unit, dy, phase, now, can_turn, false)
+    }
+
+    /// Like [`Self::feed`], for a page taller than the window, where `can_turn` means the view
+    /// is at the edge the motion pushes against. A smooth gesture that panned the page first
+    /// doesn't turn it: the user lifts and swipes again (a wheel notch still turns at once).
+    pub(crate) fn feed_edge(&mut self, unit: MouseWheelUnit, dy: f32, phase: TouchPhase, now: f64, can_turn: bool) -> Option<bool> {
+        self.feed_inner(unit, dy, phase, now, can_turn, true)
+    }
+
+    fn feed_inner(&mut self, unit: MouseWheelUnit, dy: f32, phase: TouchPhase, now: f64, can_turn: bool, edge: bool) -> Option<bool> {
         if !now.is_finite() {
             return None;
         }
@@ -96,16 +117,17 @@ impl WheelPager {
                 self.touch = None;
                 None
             }
-            TouchPhase::Move => self.motion(unit, dy, now, idle, can_turn),
+            TouchPhase::Move => self.motion(unit, dy, now, idle, can_turn, edge),
         }
     }
 
     fn new_gesture(&mut self) {
         self.accum = 0.0;
         self.turned = None;
+        self.panned = false;
     }
 
-    fn motion(&mut self, unit: MouseWheelUnit, dy: f32, now: f64, idle: f64, can_turn: bool) -> Option<bool> {
+    fn motion(&mut self, unit: MouseWheelUnit, dy: f32, now: f64, idle: f64, can_turn: bool, edge: bool) -> Option<bool> {
         if !dy.is_finite() || dy == 0.0 {
             return None;
         }
@@ -136,6 +158,10 @@ impl WheelPager {
         if !can_turn {
             // Panning a page that doesn't fit: that motion must not count toward a turn later.
             self.accum = 0.0;
+            self.panned |= edge;
+            return None;
+        }
+        if self.panned {
             return None;
         }
         if self.turned == Some(forward) {
@@ -280,6 +306,23 @@ mod tests {
         assert_eq!(turns(&mut p, &[(Line, -1.0, Move, 3.0)]), [true]);
     }
 
+    #[test]
+    fn edge_paging_needs_a_gesture_that_did_not_pan() {
+        let mut p = WheelPager::default();
+        // A swipe that pans first (not at the edge yet), then reaches it: no turn, momentum included.
+        let mut n = 0;
+        for (unit, dy, phase, at) in swipe(1.0, -25.0) {
+            n += usize::from(p.feed_edge(unit, dy, phase, at, at > 1.2).is_some());
+        }
+        assert_eq!(n, 0);
+        // A fresh swipe that starts at the edge turns once.
+        let turned: Vec<_> = swipe(3.0, -25.0).into_iter().filter_map(|(u, dy, ph, at)| p.feed_edge(u, dy, ph, at, true)).collect();
+        assert_eq!(turned, [true]);
+        // A wheel notch at the edge turns at once, even right after panning.
+        assert_eq!(p.feed_edge(Line, -1.0, Move, 5.0, false), None);
+        assert_eq!(p.feed_edge(Line, -1.0, Move, 5.3, true), Some(true));
+    }
+
     #[test]
     fn hostile_input_never_turns_more_than_once() {
         let mut p = WheelPager::default();
diff --git a/crates/ui-egui/src/word_count_ui.rs b/crates/ui-egui/src/word_count_ui.rs
new file mode 100644
index 000000000..1aa999c49
--- /dev/null
+++ b/crates/ui-egui/src/word_count_ui.rs
@@ -0,0 +1,225 @@
+//! Read-only statistics for a document snapshot. At most one worker per dialog, with cancellation
+//! between pages and no stale results after edits, page changes or changed exclusions.
+
+use std::sync::{
+    Arc,
+    atomic::{AtomicBool, AtomicUsize, Ordering},
+    mpsc,
+};
+
+use pdfcraft_engine::{
+    DocId,
+    export::ExportSource,
+    word_count::{self, Options, Report},
+};
+
+use crate::{PdfCraftApp, widgets};
+
+#[derive(Clone, Copy, PartialEq, Eq)]
+struct Key {
+    doc: DocId,
+    generation: u64,
+    page: Option<usize>,
+    options: Options,
+}
+
+struct Job {
+    key: Key,
+    receiver: mpsc::Receiver<Result<Report, String>>,
+    cancel: Arc<AtomicBool>,
+    done: Arc<AtomicUsize>,
+}
+
+impl Drop for Job {
+    fn drop(&mut self) {
+        self.cancel.store(true, Ordering::Relaxed);
+    }
+}
+
+#[derive(Default)]
+pub(crate) struct Draft {
+    options: Options,
+    current_page: bool,
+    key: Option<Key>,
+    job: Option<Job>,
+    result: Option<Result<Report, String>>,
+}
+
+impl Draft {
+    pub(crate) fn cancel(&mut self) {
+        if let Some(job) = &self.job {
+            job.cancel.store(true, Ordering::Relaxed);
+        }
+        self.key = None;
+        self.result = None;
+    }
+
+    fn update(&mut self, key: Key, source: impl FnOnce() -> ExportSource, ctx: &egui::Context, inline: bool) {
+        if self.key != Some(key) {
+            self.cancel();
+            self.key = Some(key);
+        }
+        if let Some(job) = &self.job {
+            let received = match job.receiver.try_recv() {
+                Ok(result) => Some(result),
+                Err(mpsc::TryRecvError::Empty) => None,
+                Err(mpsc::TryRecvError::Disconnected) => Some(Err(tl!("Word counting stopped unexpectedly.").into())),
+            };
+            if let Some(result) = received {
+                if job.key == key && !job.cancel.load(Ordering::Relaxed) {
+                    self.result = Some(result);
+                }
+                self.job = None;
+            }
+        }
+        if self.job.is_some() || self.result.is_some() {
+            return;
+        }
+        let source = source();
+        let pages: Vec<_> = key.page.map_or_else(|| (0..source.pages).collect(), |page| vec![page]);
+        let (sender, receiver) = mpsc::channel();
+        let cancel = Arc::new(AtomicBool::new(false));
+        let done = Arc::new(AtomicUsize::new(0));
+        self.job = Some(Job { key, receiver, cancel: cancel.clone(), done: done.clone() });
+        let ctx = ctx.clone();
+        let work = move || {
+            let result = word_count::count(source, &pages, key.options, |n| {
+                done.store(n, Ordering::Relaxed);
+                ctx.request_repaint();
+                !cancel.load(Ordering::Relaxed)
+            });
+            let _ = sender.send(result);
+            ctx.request_repaint();
+        };
+        #[cfg(not(target_arch = "wasm32"))]
+        if !inline {
+            if let Err(error) = std::thread::Builder::new().name("word-count".into()).spawn(work) {
+                self.job = None;
+                self.result = Some(Err(error.to_string()));
+            }
+            return;
+        }
+        let _ = inline;
+        work();
+    }
+}
+
+pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp) -> bool {
+    ui.heading(tl!("Word count"));
+    let Some((view, id)) = app.active_ids() else { return true };
+    let Some(doc) = app.session.get(id) else { return true };
+    if let Err(error) = doc.check_copying() {
+        app.word_count_draft.cancel();
+        ui.label(error.to_string());
+        return false;
+    }
+    let draft = &mut app.word_count_draft;
+    ui.add(widgets::checkbox(&mut draft.current_page, tl!("Current page only")));
+    ui.separator();
+    ui.add(widgets::checkbox(&mut draft.options.exclude_tables, tl!("Exclude tagged tables")));
+    ui.add(widgets::checkbox(&mut draft.options.exclude_code, tl!("Exclude tagged code blocks")));
+    ui.add(widgets::checkbox(&mut draft.options.exclude_images, tl!("Exclude image/OCR text")));
+    ui.label(tl!("Exclusions use PDF tags. Untagged tables and code remain included. Image exclusion also removes invisible text."));
+    let key = Key { doc: id, generation: doc.edit_generation(), page: draft.current_page.then_some(app.views[view].current), options: draft.options };
+    draft.update(key, || doc.export_source(), ui.ctx(), app.run_inline);
+    ui.separator();
+    match &draft.result {
+        Some(Ok(report)) => {
+            egui::Grid::new("word-count-totals").show(ui, |ui| {
+                for (label, value) in [
+                    (tl!("Words"), report.total.words),
+                    (tl!("Characters"), report.total.characters),
+                    (tl!("Characters without spaces"), report.total.characters_without_spaces),
+                    (tl!("Pages counted"), report.pages.len()),
+                ] {
+                    ui.label(label);
+                    ui.strong(value.to_string());
+                    ui.end_row();
+                }
+            });
+            if report.pages_without_text > 0 {
+                ui.label(tl!("Some pages contain no countable text. Scanned images need OCR first."));
+            }
+            if report.unclassified_structure {
+                ui.label(tl!("Some content could not be classified safely and was kept in the count."));
+            }
+        }
+        Some(Err(error)) => {
+            ui.colored_label(ui.visuals().error_fg_color, error);
+        }
+        None => {
+            ui.spinner();
+            let done = draft.job.as_ref().map_or(0, |job| job.done.load(Ordering::Relaxed));
+            ui.label(crate::i18n::fmt(tl!("Counting words… {n} pages read"), &[("n", &done.to_string())]));
+        }
+    }
+    false
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::Dialog;
+    use egui_kittest::{Harness, kittest::Queryable};
+
+    #[test]
+    fn word_count_dialog_counts_changes_pages_and_closes() {
+        for inline in [true, false] {
+            let bytes = pdfcraft_engine::Session::new().create_from_text("Words", "Hello world\u{c}Another three words").unwrap();
+            let mut h = Harness::builder().with_size(egui::vec2(1200.0, 900.0)).build_eframe(|_| {
+                let mut app = PdfCraftApp::new();
+                app.run_inline = inline;
+                app.set_option("language", "en").unwrap();
+                app.open_bytes("words.pdf", None, bytes.as_ref().clone()).unwrap();
+                app.run_command("file.word_count");
+                app
+            });
+            let wait = |h: &mut Harness<'_, PdfCraftApp>| {
+                let deadline = std::time::Instant::now() + std::time::Duration::from_secs(10);
+                while h.state().word_count_draft.result.is_none() {
+                    assert!(std::time::Instant::now() < deadline, "word-count worker timed out");
+                    h.run_steps(1);
+                    std::thread::sleep(std::time::Duration::from_millis(1));
+                }
+                h.run_steps(2);
+            };
+            wait(&mut h);
+            assert_eq!(h.state().dialog, Some(Dialog::WordCount));
+            assert_eq!(h.state().word_count_draft.result.as_ref().unwrap().as_ref().unwrap().total.words, 5);
+            h.get_by_label("Current page only").click();
+            h.run_steps(1);
+            wait(&mut h);
+            assert_eq!(h.state().word_count_draft.result.as_ref().unwrap().as_ref().unwrap().total.words, 2);
+            h.state_mut().apply_edit(pdfcraft_engine::Edit::DeletePages { pages: vec![0] });
+            h.run_steps(1);
+            wait(&mut h);
+            assert_eq!(h.state().word_count_draft.result.as_ref().unwrap().as_ref().unwrap().total.words, 3);
+            h.get_by_label("Close").click();
+            h.run_steps(2);
+            assert!(h.state().dialog.is_none());
+            assert!(h.state().word_count_draft.result.is_none());
+        }
+    }
+
+    #[test]
+    fn word_count_cancelled_worker_cannot_publish_an_old_result() {
+        let key = Key { doc: DocId(1), generation: 0, page: None, options: Options::default() };
+        let (tx, rx) = mpsc::channel();
+        let cancel = Arc::new(AtomicBool::new(false));
+        let mut draft = Draft {
+            key: Some(key),
+            job: Some(Job { key, receiver: rx, cancel: cancel.clone(), done: Arc::new(AtomicUsize::new(0)) }),
+            ..Draft::default()
+        };
+        draft.cancel();
+        assert!(cancel.load(Ordering::Relaxed));
+        let bytes = pdfcraft_engine::Session::new().create_blank(200.0, 300.0, 1).unwrap();
+        let source = || ExportSource { bytes: bytes.clone(), pages: 1, sizes: vec![(200.0, 300.0)], config: Default::default() };
+        draft.update(key, source, &egui::Context::default(), true);
+        assert!(draft.result.is_none()); // still one worker, no competing replacement
+        tx.send(Ok(Report { total: word_count::Counts { words: 999, ..Default::default() }, ..Default::default() })).unwrap();
+        draft.update(key, source, &egui::Context::default(), true);
+        draft.update(key, source, &egui::Context::default(), true);
+        assert_eq!(draft.result.unwrap().unwrap().total.words, 0);
+    }
+}
diff --git a/crates/ui-egui/tests/accessibility.rs b/crates/ui-egui/tests/accessibility.rs
index 6872ab470..7d13df6ad 100644
--- a/crates/ui-egui/tests/accessibility.rs
+++ b/crates/ui-egui/tests/accessibility.rs
@@ -18,6 +18,14 @@ endstream endobj
 trailer << /Root 1 0 R >>
 %%EOF";
 
+const FORM_FIXTURE: &[u8] = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R] >> >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 100] /Annots [4 0 R] >> endobj
+4 0 obj << /Type /Annot /Subtype /Widget /FT /Tx /T (Name) /Rect [20 40 120 60] /P 3 0 R >> endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+
 fn status(h: &Harness<'static, PdfCraftApp>, rule: Rule) -> Status {
     h.state().a11y.report.as_ref().unwrap().1.result(rule).unwrap().status
 }
@@ -210,6 +218,28 @@ fn a_saved_page_range_past_the_document_still_checks_its_pages() {
     assert_eq!(h.state().a11y.options.as_ref().and_then(|o| o.pages.clone()), Some(vec![0]));
 }
 
+#[test]
+fn tagging_form_fields_opens_the_tags_panel() {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("form.pdf", None, FORM_FIXTURE.to_vec()).unwrap();
+        app
+    });
+    h.run_steps(3);
+    assert!(h.state_mut().execute("a11y.autotag_fields"));
+    h.run_steps(3);
+    assert_eq!(h.state().right, Some(RightPanel::Tags));
+    let id = h.state().views[0].id;
+    let report = h
+        .state()
+        .session
+        .get(id)
+        .unwrap()
+        .accessibility_check(&pdfcraft_engine::a11y::Options { rules: [Rule::TaggedFormFields].into(), pages: None });
+    assert_eq!(report.unwrap().result(Rule::TaggedFormFields).unwrap().status, Status::Passed);
+}
+
 /// Two tagged figures: an image without alternate text and a bar (role-mapped Photo) with.
 const FIGURES: &[u8] = b"%PDF-1.7
 1 0 obj << /Type /Catalog /Pages 2 0 R /MarkInfo << /Marked true >> /StructTreeRoot 5 0 R >> endobj
@@ -297,6 +327,7 @@ fn tags_panel_edits_a_tag_property_and_undoes_it() {
     h.run_steps(2);
     h.get_by_label("Figure · 7").click();
     h.run_steps(2);
+    h.get_by_label("MCID 0 · Go to page 1");
     let title = h.get_by_role_and_label(Role::TextInput, "Title");
     title.focus();
     title.type_text("First figure");
@@ -337,6 +368,27 @@ fn tags_panel_moves_a_tag_within_its_siblings() {
     assert_eq!(doc.can_undo(), Some("Move object"));
 }
 
+#[test]
+fn tags_panel_marks_a_leaf_tag_as_an_artifact() {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("figures.pdf", None, FIGURES.to_vec()).unwrap();
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("a11y.tags"));
+    h.run_steps(2);
+    h.get_by_label("Figure · 7").click();
+    h.run_steps(1);
+    h.get_by_label("Mark as artifact").click();
+    h.run_steps(3);
+    let s = h.state();
+    let doc = s.session.get(s.views[0].id).unwrap();
+    assert_eq!(doc.tags().into_iter().map(|tag| tag.object.num).collect::<Vec<_>>(), [6, 8]);
+    assert_eq!(doc.can_undo(), Some("Mark content as artifact"));
+}
+
 #[test]
 fn checker_finding_opens_its_structure_tag() {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
@@ -365,3 +417,20 @@ fn checker_finding_opens_its_structure_tag() {
     h.run_steps(2);
     assert_eq!(h.state().right, Some(RightPanel::Accessibility), "an unfinished tag edit is preserved");
 }
+
+#[test]
+fn finding_untagged_content_shows_the_focused_accessibility_results() {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("notes.pdf", None, FIXTURE.to_vec()).unwrap();
+        app
+    });
+    h.run_steps(3);
+    assert!(h.state_mut().execute("a11y.find_untagged"));
+    h.run_steps(2);
+    assert_eq!(h.state().right, Some(RightPanel::Accessibility));
+    let report = &h.state().a11y.report.as_ref().unwrap().1;
+    let active: Vec<Rule> = report.results.iter().filter(|result| result.status != Status::Skipped).map(|result| result.rule).collect();
+    assert_eq!(active, [Rule::TaggedContent, Rule::TaggedAnnotations, Rule::TaggedFormFields]);
+}
diff --git a/crates/ui-egui/tests/commands.rs b/crates/ui-egui/tests/commands.rs
index a8b9d88f0..5afb4db55 100644
--- a/crates/ui-egui/tests/commands.rs
+++ b/crates/ui-egui/tests/commands.rs
@@ -71,7 +71,8 @@ const PICKERS: &[&str] = &[
 #[test]
 fn every_registered_command_is_implemented() {
     for spec in COMMANDS {
-        if PICKERS.contains(&spec.id) {
+        // Page-text Copy needs a loaded view and egui context, covered by ui_group::text_select.
+        if PICKERS.contains(&spec.id) || spec.id == "edit.copy" {
             continue;
         }
         let mut app = PdfCraftApp::new();
@@ -148,9 +149,19 @@ fn every_registered_command_is_implemented() {
         if spec.id == "view.layout.cover" {
             app.set_option("layout", "two-up").unwrap();
         }
+        // History commands need a real jump (and Back first to make Forward available).
+        if matches!(spec.id, "view.previous_view" | "view.next_view") {
+            app.views[0].go_to_page(1);
+            if spec.id == "view.next_view" {
+                assert!(app.views[0].view_history(false));
+            }
+        }
         let dir = std::env::temp_dir().join(format!("pdfcraft-cmd-{}", std::process::id()));
         std::fs::create_dir_all(&dir).unwrap();
         app.save_override = Some(dir.join("out.pdf").to_string_lossy().into_owned());
+        // A picker the list above misses (file.pin_folder, create.multiple_separate did) must not
+        // open a real file dialog on the desktop running the tests: answer it as a cancel.
+        app.pick_override = Some(Vec::new());
         assert!(app.execute(spec.id), "{} is registered but not implemented (or wrongly disabled)", spec.id);
     }
 }
@@ -296,7 +307,6 @@ fn the_open_recent_menu_lists_files_and_opens_one() {
     h.get_by_label_contains("recent.pdf").click();
     support::wait_until(&mut h, "recent document", |app| app.views.len() == 2 && app.password_prompt.is_none());
     let app = h.state();
-    assert_eq!(app.views.len(), 2, "the recent file opened in a new tab");
     let active = app.active.unwrap();
     assert_eq!(app.session.get(app.views[active].id).and_then(|d| d.path.as_deref()), Some(path.as_str()), "the active tab is the recent file");
     assert_eq!(app.session.get(app.views[active].id).unwrap().bytes.as_slice(), fixture(2).as_slice());
@@ -493,6 +503,36 @@ fn the_about_dialog_shows_the_running_version() {
     h.get_by_label_contains(&format!("Version {}", env!("CARGO_PKG_VERSION")));
 }
 
+#[test]
+fn quit_shortcut_requires_exact_modifiers_and_preserves_unsaved_work() {
+    for (os, modifiers) in [
+        (OperatingSystem::Windows, Modifiers { ctrl: true, command: true, ..Default::default() }),
+        (OperatingSystem::Mac, Modifiers { mac_cmd: true, command: true, ..Default::default() }),
+    ] {
+        for (extra, dirty, should_close) in
+            [(Modifiers::ALT, false, false), (Modifiers::SHIFT, false, false), (Modifiers::NONE, false, true), (Modifiers::NONE, true, false)]
+        {
+            let mut h = harness();
+            h.ctx.set_os(os);
+            if dirty {
+                assert!(h.state_mut().execute("page.insert_blank"));
+                h.run_steps(2);
+            }
+            h.event(egui::Event::Key { key: Key::Q, physical_key: None, pressed: true, repeat: false, modifiers: modifiers | extra });
+            h.step();
+            let closes = h.output().viewport_output.values().any(|v| v.commands.contains(&egui::ViewportCommand::Close));
+            assert_eq!(closes, should_close, "{os:?}, extra={extra:?}, dirty={dirty}");
+            if dirty {
+                h.get_by_label("Cancel").click();
+                h.run_steps(2);
+                assert_eq!(h.state().views.len(), 1);
+                assert!(h.state().session.get(h.state().views[0].id).unwrap().dirty);
+                assert!(!h.output().viewport_output.values().any(|v| v.commands.contains(&egui::ViewportCommand::Close)));
+            }
+        }
+    }
+}
+
 #[test]
 fn command_w_closes_empty_macos_window_but_not_an_empty_windows_window() {
     for (os, should_close) in [(OperatingSystem::Mac, true), (OperatingSystem::Windows, false)] {
diff --git a/crates/ui-egui/tests/comments.rs b/crates/ui-egui/tests/comments.rs
index 98f2bf907..914bc281b 100644
--- a/crates/ui-egui/tests/comments.rs
+++ b/crates/ui-egui/tests/comments.rs
@@ -231,6 +231,111 @@ fn a_new_highlight_opens_its_note_for_typing() {
     assert_eq!(h.state().views[0].comments.editing, Some((0, 1, "typed".into())));
 }
 
+#[test]
+fn ctrl_enter_posts_a_highlight_comment_and_shift_enter_adds_a_line() {
+    let mut h = harness(|app| {
+        app.set_option("quick", "highlight").unwrap();
+        app.set_option("panel", "comments").unwrap();
+    });
+    let (a, b) = {
+        let v = &h.state().views[0];
+        (v.glyph_screen_pos(0, 4).expect("text layer"), v.glyph_screen_pos(0, 14).expect("glyph"))
+    };
+    drag(&mut h, a, b);
+    h.query_all_by(|n| n.role() == egui::accesskit::Role::MultilineTextInput && n.placeholder() != Some("Add a reply"))
+        .next()
+        .expect("highlight editor")
+        .click();
+    h.run_steps(2);
+    h.event(egui::Event::Text("First line".into()));
+    h.run_steps(2);
+    h.key_press_modifiers(egui::Modifiers::SHIFT, egui::Key::Enter);
+    h.run_steps(2);
+    assert_eq!(h.state().views[0].comments.editing.as_ref().unwrap().2, "First line\n");
+    assert_eq!(comments(&h)[0].contents.as_deref().unwrap_or(""), "", "a newline does not post");
+    h.event(egui::Event::Text("Second line".into()));
+    h.run_steps(2);
+    h.key_press_modifiers(egui::Modifiers::CTRL, egui::Key::Enter);
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].comments.editing, None);
+    assert_eq!(comments(&h)[0].contents.as_deref(), Some("First line\nSecond line"));
+    h.state_mut().undo();
+    h.run_steps(2);
+    assert_eq!(comments(&h)[0].contents.as_deref().unwrap_or(""), "", "posting is one undo step");
+}
+
+#[test]
+fn ctrl_enter_posts_a_reply_and_shift_enter_adds_a_line() {
+    let mut h = harness(|app| app.set_option("panel", "comments").unwrap());
+    field(&h, "Add a comment").click();
+    h.run_steps(2);
+    field(&h, "Add a comment").type_text("Parent");
+    h.run_steps(2);
+    h.key_press(egui::Key::Enter);
+    h.run_steps(3);
+    field(&h, "Add a reply").click();
+    h.run_steps(2);
+    field(&h, "Add a reply").type_text("First line");
+    h.run_steps(2);
+    h.key_press_modifiers(egui::Modifiers::SHIFT, egui::Key::Enter);
+    h.run_steps(2);
+    assert_eq!(comments(&h).len(), 1, "Shift+Enter does not post a reply");
+    assert_eq!(h.state().views[0].comments.reply, "First line\n");
+    h.event(egui::Event::Text("Second line".into()));
+    h.run_steps(2);
+    h.key_press_modifiers(egui::Modifiers::CTRL, egui::Key::Enter);
+    h.run_steps(3);
+    let c = comments(&h);
+    assert_eq!(c.len(), 2);
+    assert_eq!(c[1].contents.as_deref(), Some("First line\nSecond line"));
+    assert_eq!(c[1].in_reply_to, c[0].name);
+    assert_eq!(c[1].author.as_deref(), Some("Tester"));
+    assert!(h.state().views[0].comments.reply.is_empty());
+    h.key_press_modifiers(egui::Modifiers::CTRL, egui::Key::Enter);
+    h.run_steps(2);
+    assert_eq!(comments(&h).len(), 2, "an empty reply is not posted");
+    h.state_mut().undo();
+    h.run_steps(2);
+    assert_eq!(comments(&h).len(), 1, "posting is one undo step");
+    h.state_mut().set_option("comment", "1:1").unwrap();
+    h.run_steps(2);
+    field(&h, "Add a reply").click();
+    h.run_steps(2);
+    field(&h, "Add a reply").type_text("Enter still posts");
+    h.run_steps(2);
+    h.key_press(egui::Key::Enter);
+    h.run_steps(3);
+    assert_eq!(comments(&h)[1].contents.as_deref(), Some("Enter still posts"));
+}
+
+#[test]
+fn the_comment_composer_shortcut_only_posts_the_focused_editor() {
+    let mut h = harness(|app| app.set_option("quick", "note").unwrap());
+    click_pt(&mut h, (250.0, 180.0));
+    field(&h, "Add a comment").click();
+    h.run_steps(2);
+    h.event(egui::Event::Text("First line".into()));
+    h.run_steps(2);
+    h.key_press_modifiers(egui::Modifiers::SHIFT, egui::Key::Enter);
+    h.run_steps(2);
+    assert_eq!(h.state().views[0].comments.composer.as_ref().unwrap().text, "First line\n");
+    assert!(comments(&h).is_empty());
+    h.event(egui::Event::Text("Second line".into()));
+    h.run_steps(2);
+    h.query_all_by_value("1").next().expect("current page input").focus();
+    h.run_steps(2);
+    h.key_press_modifiers(egui::Modifiers::CTRL, egui::Key::Enter);
+    h.run_steps(2);
+    assert!(h.state().views[0].comments.composer.is_some(), "a shortcut outside the editor keeps the draft");
+    assert!(comments(&h).is_empty());
+    h.query_all_by(|n| n.role() == egui::accesskit::Role::MultilineTextInput).next().expect("composer editor").focus();
+    h.run_steps(2);
+    h.key_press_modifiers(egui::Modifiers::CTRL, egui::Key::Enter);
+    h.run_steps(3);
+    assert!(h.state().views[0].comments.composer.is_none());
+    assert_eq!(comments(&h)[0].contents.as_deref(), Some("First line\nSecond line"));
+}
+
 #[test]
 fn a_selection_made_first_is_marked_when_a_tool_is_picked() {
     let mut h = harness(|_| {});
@@ -301,6 +406,42 @@ fn shapes_and_ink_are_drawn_by_dragging() {
     assert!((r[0] - 40.0).abs() < 3.0 && (r[1] - 40.0).abs() < 3.0 && (r[2] - 140.0).abs() < 3.0 && (r[3] - 100.0).abs() < 3.0, "{r:?}");
 }
 
+/// Press, drag and release a stroke, running only one frame after the release.
+fn stroke_without_settling(h: &mut Harness<'static, PdfCraftApp>, a: (f32, f32), b: (f32, f32)) {
+    let (from, to) = (at(h, a.0, a.1), at(h, b.0, b.1));
+    h.hover_at(from);
+    h.run_steps(1);
+    h.drag_at(from);
+    h.run_steps(1);
+    for k in 1..=4 {
+        h.hover_at(from + (to - from) * (k as f32 / 4.0));
+        h.run_steps(1);
+    }
+    h.drop_at(to);
+    h.run_steps(1);
+}
+
+/// #1858: on release the live stroke is replaced by the committed annotation, but the page
+/// raster that draws it arrives later. The stroke stays painted from its points meanwhile.
+#[test]
+fn a_released_pen_stroke_stays_drawn_until_the_page_raster_has_it() {
+    let mut h = harness(|app| app.set_option("quick", "ink").unwrap());
+    stroke_without_settling(&mut h, (40.0, 100.0), (140.0, 60.0));
+    assert_eq!(comments(&h).len(), 1, "the stroke is committed");
+    assert_eq!(h.state().views[0].comments.settling_len(), 1, "still drawn from its points");
+    settle(&mut h);
+    assert_eq!(h.state().views[0].comments.settling_len(), 0, "the raster draws it now");
+}
+
+#[test]
+fn undoing_a_pen_stroke_before_its_raster_leaves_no_ghost() {
+    let mut h = harness(|app| app.set_option("quick", "ink").unwrap());
+    stroke_without_settling(&mut h, (40.0, 100.0), (140.0, 60.0));
+    assert_eq!(h.state().views[0].comments.settling_len(), 1);
+    h.state_mut().undo();
+    assert_eq!(h.state().views[0].comments.settling_len(), 0);
+}
+
 #[test]
 fn pen_strokes_stay_unselected_so_writing_continues() {
     let mut h = harness(|app| app.set_option("quick", "ink").unwrap());
@@ -369,6 +510,28 @@ fn comments_are_selected_moved_and_deleted_with_the_select_tool() {
     assert_eq!(comments(&h).len(), 1);
 }
 
+#[test]
+fn a_shape_just_drawn_resizes_from_its_handles_without_the_select_tool() {
+    // #2338: the new shape showed its handles, but only the Select tool answered them.
+    let square = QuickTool::Comment(pdfcraft_ui_egui::comments::CommentTool::Rectangle);
+    let mut h = harness(|app| app.set_option("quick", "square").unwrap());
+    drag_pt(&mut h, (40.0, 100.0), (140.0, 40.0));
+    assert_eq!(h.state().views[0].comments.selected, Some((0, 0)), "the new rectangle is selected");
+    let before = comments(&h)[0].rect;
+    // Drag its bottom-right handle 40 pt right and 20 pt down.
+    drag_pt(&mut h, (before[2], before[1]), (before[2] + 40.0, before[1] - 20.0));
+    let c = comments(&h);
+    assert_eq!(c.len(), 1, "the handle resized the rectangle instead of drawing another: {c:?}");
+    let r = c[0].rect;
+    assert!((r[2] - (before[2] + 40.0)).abs() < 3.0 && (r[1] - (before[1] - 20.0)).abs() < 3.0, "resized: {before:?} → {r:?}");
+    assert!((r[0] - before[0]).abs() < 1.0 && (r[3] - before[3]).abs() < 1.0, "the opposite corner stays: {before:?} → {r:?}");
+    assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().can_undo(), Some("Resize comment"));
+    assert_eq!(h.state().quick_tool, square, "the rectangle tool stays on");
+    // Away from the handles the tool still draws, over the shape too.
+    drag_pt(&mut h, (60.0, 90.0), (120.0, 60.0));
+    assert_eq!(comments(&h).len(), 2, "a drag inside the rectangle draws a second one");
+}
+
 #[test]
 fn the_panel_posts_comments_and_replies() {
     let mut h = harness(|app| app.set_option("panel", "comments").unwrap());
@@ -572,6 +735,61 @@ fn the_panel_filters_and_sorts() {
     assert_eq!(h.query_all_by_label("Oval").count(), ovals + 1, "a group header was added");
 }
 
+/// #1554: a page group's chevron folds that page's cards away and back, and the choice holds.
+#[test]
+fn page_groups_collapse_and_expand() {
+    let mut h = harness(|app| app.set_option("panel", "comments").unwrap());
+    for (page, text) in [(0, "First page note"), (1, "Second page note")] {
+        let shape = pdfcraft_engine::Shape::Note { at: [100.0, 100.0], icon: pdfcraft_engine::NoteIcon::Comment };
+        h.state_mut().apply_edit(pdfcraft_engine::Edit::AddAnnotation(pdfcraft_engine::NewAnnotation {
+            page,
+            style: pdfcraft_engine::Style::default_for(&shape),
+            shape,
+            contents: text.into(),
+            author: "Tester".into(),
+        }));
+    }
+    h.state_mut().views[0].comments.selected = None;
+    h.run_steps(3);
+    let shown = |h: &Harness<'static, PdfCraftApp>, text: &str| h.query_all_by_label_contains(text).count() > 0;
+    assert!(shown(&h, "First page note") && shown(&h, "Second page note"));
+    assert_eq!(h.query_all_by_label("Collapse").count(), 2, "one chevron per page group");
+
+    h.query_all_by_label("Collapse").next().unwrap().click();
+    h.run_steps(3);
+    assert!(!shown(&h, "First page note"), "page 1's card is folded away");
+    assert!(shown(&h, "Second page note"), "page 2 stays open");
+    h.run_steps(5);
+    assert!(!shown(&h, "First page note"), "the group stays folded on later frames");
+
+    h.get_by_label("Expand").click();
+    h.run_steps(3);
+    assert!(shown(&h, "First page note"), "page 1's card is back");
+
+    // Selecting a comment on a folded page opens its group so the card can be shown.
+    h.query_all_by_label("Collapse").next().unwrap().click();
+    h.run_steps(3);
+    assert!(!shown(&h, "First page note"));
+    h.state_mut().views[0].comments.selected = Some((0, 0));
+    h.state_mut().views[0].comments.reveal = true;
+    h.run_steps(3);
+    assert!(shown(&h, "First page note"), "the selected comment's group opened");
+
+    // "…" ▸ Collapse all pages, then Expand all pages.
+    h.state_mut().views[0].comments.selected = None;
+    h.get_by_label("More options").click();
+    h.run_steps(2);
+    h.get_by_label("Collapse all pages").click();
+    h.run_steps(3);
+    assert!(!shown(&h, "First page note") && !shown(&h, "Second page note"), "every page is folded");
+    assert_eq!(h.query_all_by_label("Expand").count(), 2);
+    h.get_by_label("More options").click();
+    h.run_steps(2);
+    h.get_by_label("Expand all pages").click();
+    h.run_steps(3);
+    assert!(shown(&h, "First page note") && shown(&h, "Second page note"), "every page is open again");
+}
+
 #[test]
 fn comments_take_checkmarks_lock_hide_and_summarize() {
     let mut h = harness(|app| {
@@ -695,6 +913,46 @@ fn polygons_clouds_connected_lines_callouts_and_inserted_text() {
     assert_eq!(h.state().quick_tool, QuickTool::Select);
 }
 
+fn drawn_points(h: &Harness<'static, PdfCraftApp>) -> usize {
+    match &h.state().views[0].comments.gesture {
+        Some(pdfcraft_ui_egui::comments::Gesture::Draw { points, .. }) => points.len(),
+        _ => 0,
+    }
+}
+
+#[test]
+fn a_wrong_polygon_point_is_taken_back_with_backspace_or_undo() {
+    let mut h = harness(|app| app.set_option("quick", "polygon").unwrap());
+    for p in [(40.0, 40.0), (120.0, 40.0), (200.0, 150.0)] {
+        click_pt(&mut h, p);
+    }
+    assert_eq!(drawn_points(&h), 3);
+    // Backspace takes back the wrong click, then Undo takes back the one before it.
+    h.key_press(egui::Key::Backspace);
+    h.run_steps(2);
+    assert_eq!(drawn_points(&h), 2);
+    h.state_mut().undo();
+    h.run_steps(2);
+    assert_eq!(drawn_points(&h), 1);
+    // The right corner goes where the wrong one was, and the polygon finishes with all three.
+    click_pt(&mut h, (80.0, 110.0));
+    click_pt(&mut h, (120.0, 40.0));
+    assert_eq!(drawn_points(&h), 3);
+    h.key_press(egui::Key::Enter);
+    h.run_steps(3);
+    let c = comments(&h);
+    assert_eq!(c.len(), 1);
+    assert_eq!(c[0].subtype, "Polygon");
+    // Taking back the only point cancels the drawing without making a comment.
+    h.state_mut().set_option("quick", "polygon").unwrap();
+    click_pt(&mut h, (200.0, 200.0));
+    h.key_press(egui::Key::Backspace);
+    h.run_steps(2);
+    assert_eq!(drawn_points(&h), 0);
+    assert!(h.state().views[0].comments.gesture.is_none());
+    assert_eq!(comments(&h).len(), 1);
+}
+
 #[test]
 fn inserted_text_snaps_to_the_gap_between_characters_on_the_baseline() {
     let mut h = harness(|app| app.set_option("quick", "caret").unwrap());
@@ -799,6 +1057,54 @@ fn make_current_properties_default() {
     assert_eq!(last.color, Some([0.0, 0.47, 0.84]));
 }
 
+/// Acrobat's Properties ▸ Make Properties Default: OK with the box ticked makes the edited look
+/// the tool's default (here a strikethrough's colour); without it, only the comment changes.
+#[test]
+fn properties_dialog_makes_the_strikethrough_colour_default() {
+    use pdfcraft_ui_egui::comments::CommentTool;
+    let mut h = harness(|app| app.set_option("quick", "strikeout").unwrap());
+    let green = [0.18, 0.62, 0.36];
+    let blue = [0.0, 0.47, 0.84];
+    assert_ne!(h.state().comment_prefs.style(CommentTool::StrikeOut).color, green);
+    drag_pt(&mut h, (18.0, 155.0), (150.0, 155.0));
+    assert_eq!(comments(&h).iter().filter(|a| a.subtype == "StrikeOut").count(), 1);
+
+    // Without the box: the comment turns blue, the tool keeps its colour.
+    let before = h.state().comment_prefs.style(CommentTool::StrikeOut);
+    h.state_mut().open_comment_props(0, 0);
+    h.run_steps(2);
+    h.state_mut().comment_props.as_mut().expect("open").edited.color = Some(blue);
+    h.get_by_label("OK").click();
+    h.run_steps(3);
+    assert_eq!(h.state().comment_prefs.style(CommentTool::StrikeOut).color, before.color);
+
+    // With it: green, and a 0% opacity is clamped so the next strikethrough stays visible.
+    h.state_mut().open_comment_props(0, 0);
+    h.run_steps(2);
+    {
+        let d = h.state_mut().comment_props.as_mut().expect("open");
+        d.edited.color = Some(green);
+        d.edited.opacity = 0.0;
+    }
+    h.get_by_label("Make Properties Default").click();
+    h.run_steps(1);
+    assert!(h.state().comment_props.as_ref().is_some_and(|d| d.make_default));
+    h.get_by_label("OK").click();
+    h.run_steps(3);
+    let st = h.state().comment_prefs.style(CommentTool::StrikeOut);
+    assert_eq!((st.color, st.opacity), (green, 0.1));
+    let fresh = {
+        let mut fresh = PdfCraftApp::new();
+        fresh.restore(&h.state().persist());
+        fresh.comment_prefs.style(CommentTool::StrikeOut).color
+    };
+    assert_eq!(fresh, green, "the default persisted");
+    drag_pt(&mut h, (18.0, 155.0), (150.0, 155.0));
+    let c = comments(&h);
+    let made = c.iter().rfind(|a| a.subtype == "StrikeOut").and_then(|a| a.color).expect("a colougreen strikethrough");
+    assert!(made.iter().zip(green).all(|(m, r)| (f64::from(*m) - r).abs() < 0.01), "the next strikethrough is green: {made:?}");
+}
+
 /// #1302: making an arrow's properties the default updates the Arrow tool, not later plain lines.
 #[test]
 fn an_arrows_default_does_not_restyle_lines() {
@@ -993,6 +1299,37 @@ fn hovering_a_comment_shows_its_author_and_text() {
     assert!(h.query_by_label_contains("Check this figure").is_none(), "a dialog covers the page hover");
 }
 
+#[test]
+fn preference_hides_author_only_highlight_hover_previews() {
+    // A highlight annotation with author Ada and empty contents over the first page.
+    let pdf = String::from_utf8_lossy(TEXT_FIXTURE).replace("/Contents 5 0 R /Resources", "/Contents 5 0 R /Annots [8 0 R] /Resources").replace(
+        "trailer",
+        "8 0 obj << /Type /Annot /Subtype /Highlight /Rect [50 50 150 120] /C [1 1 0] /T (Ada) /QuadPoints [50 120 150 120 50 50 150 50] >> endobj\ntrailer",
+    );
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("highlight_hover.pdf", None, pdf.into_bytes()).expect("opens");
+        app.set_option("left", "closed").unwrap();
+        app.set_option("panel", "none").unwrap();
+        app
+    });
+    h.run_steps(4);
+    settle(&mut h);
+
+    let p = at(&h, 100.0, 85.0);
+    // By default, author-only hover is shown.
+    h.hover_at(p);
+    h.run_steps(3);
+    h.get_by_label("Ada");
+
+    // Enabling preference hides author-only highlight hover.
+    h.state_mut().set_option("hide-empty-highlight-hover", "true").unwrap();
+    h.hover_at(p);
+    h.run_steps(3);
+    assert!(h.query_by_label("Ada").is_none(), "author-only hover must be suppressed");
+}
+
 #[test]
 fn the_squiggly_tool_marks_selected_text() {
     let mut h = harness(|_| {});
@@ -1076,3 +1413,34 @@ fn a_closed_comments_panel_stays_closed_when_picking_comment_tools() {
     h.run_steps(2);
     assert_eq!(h.state().right, Some(RightPanel::Comments));
 }
+
+/// #1908: Comment properties of a text box has a Font size control; changing it redraws the box
+/// with the new /DA size as one undo step, and shapes without text have no such control.
+#[test]
+fn text_box_properties_change_the_font_size() {
+    use pdfcraft_engine::{Edit, NewAnnotation, Shape};
+    let mut h = harness(|_| {});
+    let tb = NewAnnotation {
+        page: 0,
+        shape: Shape::TextBox { rect: [40.0, 600.0, 240.0, 640.0], font_size: 12.0 },
+        style: Default::default(),
+        contents: "Hello".into(),
+        author: "Ada".into(),
+    };
+    h.state_mut().apply_edit(Edit::AddAnnotation(tb));
+    h.run_steps(2);
+    h.state_mut().open_comment_props(0, 0);
+    h.run_steps(2);
+    h.get_by_label("Font size");
+    {
+        let d = h.state_mut().comment_props.as_mut().expect("open");
+        assert_eq!(d.original.font_size, Some(12.0));
+        d.edited.font_size = Some(30.0);
+    }
+    h.get_by_label("OK").click();
+    h.run_steps(3);
+    let s = h.state();
+    let doc = s.session.get(s.views[0].id).unwrap();
+    assert_eq!(doc.comment_props(0, 0).unwrap().font_size, Some(30.0));
+    assert_eq!(doc.can_undo(), Some("Change comment properties"));
+}
diff --git a/crates/ui-egui/tests/compare.rs b/crates/ui-egui/tests/compare.rs
index 089d3b882..e735668a1 100644
--- a/crates/ui-egui/tests/compare.rs
+++ b/crates/ui-egui/tests/compare.rs
@@ -33,6 +33,24 @@ fn compare_two_versions() {
     let id = h.state().active_ids().unwrap().1;
     let i = h.state().active_ids().unwrap().0;
     assert_eq!(h.state().views[i].compare_marks.len(), 2);
+    // Side by side: the old file's half shades its side of the changes and follows the new
+    // file's zoom; "New file only" ends it.
+    assert!(h.state().compare.as_ref().unwrap().side_by_side, "side by side on a wide window");
+    let old_i = h.state().views.iter().position(|v| v.id == h.state().compare.as_ref().unwrap().old).unwrap();
+    assert_eq!(h.state().views[old_i].compare_marks.len(), 2, "replaced words shaded on the old file too");
+    assert!(h.state().views[old_i].flash.is_some(), "the old half jumped to the change");
+    h.state_mut().views[i].zoom = 1.5;
+    h.state_mut().views[i].fit = pdfcraft_ui_egui::canvas::Fit::None;
+    h.run_steps(3);
+    assert_eq!((h.state().views[old_i].zoom, h.state().views[old_i].fit), (1.5, pdfcraft_ui_egui::canvas::Fit::None), "the old half follows");
+    h.get_by_label("New file only").click();
+    h.run_steps(2);
+    assert!(!h.state().compare.as_ref().unwrap().side_by_side);
+    h.get_by_label("Side by side").click();
+    h.run_steps(2);
+    assert!(h.state().compare.as_ref().unwrap().side_by_side);
+    h.get_by_label("New file only").click();
+    h.run_steps(2);
     h.get_by_label("Mark as comments").click();
     h.run_steps(3);
     assert_eq!(h.state().session.get(id).unwrap().info.annotations.len(), 2);
diff --git a/crates/ui-egui/tests/content.rs b/crates/ui-egui/tests/content.rs
index 722144896..dd2c032ef 100644
--- a/crates/ui-egui/tests/content.rs
+++ b/crates/ui-egui/tests/content.rs
@@ -7,11 +7,19 @@ use egui_kittest::kittest::Queryable;
 use pdfcraft_ui_egui::{PdfCraftApp, QuickTool};
 
 fn harness() -> Harness<'static, PdfCraftApp> {
-    harness_bytes(include_bytes!("data/form.pdf").to_vec())
+    harness_with_step_dt(0.25)
+}
+
+fn harness_with_step_dt(step_dt: f32) -> Harness<'static, PdfCraftApp> {
+    harness_bytes_with_step_dt(include_bytes!("data/form.pdf").to_vec(), step_dt)
 }
 
 fn harness_bytes(bytes: Vec<u8>) -> Harness<'static, PdfCraftApp> {
-    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+    harness_bytes_with_step_dt(bytes, 0.25)
+}
+
+fn harness_bytes_with_step_dt(bytes: Vec<u8>, step_dt: f32) -> Harness<'static, PdfCraftApp> {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).with_step_dt(step_dt).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
         app.set_option("language", "en").unwrap();
         app.open_bytes("form.pdf", None, bytes.clone()).unwrap();
@@ -45,7 +53,7 @@ fn click(h: &mut Harness<'static, PdfCraftApp>, p: Pos2) {
 
 fn added(h: &Harness<'static, PdfCraftApp>) -> Vec<pdfcraft_engine::Added> {
     let s = h.state();
-    s.session.get(s.views[0].id).unwrap().added.clone()
+    s.session.get(s.views[0].id).unwrap().added().to_vec()
 }
 
 /// A click whose press and release arrive in the same frame, as a quick real mouse click does.
@@ -68,6 +76,113 @@ fn texts(h: &Harness<'static, PdfCraftApp>) -> Vec<String> {
         .collect()
 }
 
+#[test]
+fn text_tool_drafts_grow_for_latin_and_arabic() {
+    for text in ["Wide words ".repeat(8), "سلام عليكم ".repeat(8)] {
+        let mut h = harness();
+        assert!(h.state_mut().execute("edit.text"));
+        h.run_steps(2);
+        let point = at(&h, 40.0, 300.0);
+        click(&mut h, point);
+        let before = h.state().views[0].content.draft.as_ref().unwrap().rect;
+        h.event(egui::Event::Text(text.clone()));
+        h.run_steps(4);
+        let draft = h.state().views[0].content.draft.as_ref().unwrap();
+        assert!(draft.rect[2] - draft.rect[0] > before[2] - before[0] + 10.0, "the editor grows before wrapping: {}", text);
+        assert!(draft.rect[2] <= 300.0 && draft.rect[1] < before[1], "the frame stays on the page and grows vertically");
+        if let Ok(dir) = std::env::var("PDFCRAFT_SHOTS") {
+            let language = if text.starts_with("Wide") { "latin" } else { "arabic" };
+            h.render().unwrap().save(format!("{dir}/growing-{language}-text.png")).unwrap();
+        }
+        h.get_by_label("Done adding text").click();
+        h.run_steps(3);
+        if text.starts_with("سلام") && pdfcraft_fonts::document_arabic_font().is_none() {
+            assert!(h.state().views[0].content.draft.is_some(), "without a document font the draft remains available");
+            assert!(added(&h).is_empty());
+            continue;
+        }
+        let pdfcraft_engine::AddedContent::Text(saved) = &added(&h)[0].content else { panic!() };
+        assert_eq!(saved.text, text.trim_end());
+        assert!(saved.rect[2] - saved.rect[0] > before[2] - before[0] + 10.0, "Save uses the grown width");
+    }
+}
+
+#[test]
+fn text_tool_single_click_retypes_added_text_without_another_item() {
+    for command in ["edit.text", "edit.edit_text"] {
+        for (original, replacement) in [("Original", "Replacement"), ("سلام", "سلام عليكم ورحمة الله")] {
+            if original == "سلام" && pdfcraft_fonts::document_arabic_font().is_none() {
+                continue;
+            }
+            let mut h = harness();
+            assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::AddText {
+                page: 0,
+                text: pdfcraft_engine::AddedText { rect: [40.0, 195.0, 140.0, 210.0], text: original.into(), ..Default::default() },
+            }));
+            assert!(h.state_mut().execute(command));
+            h.run_steps(3);
+            let point = at(&h, 45.0, 195.0);
+            click(&mut h, point);
+            let draft = h.state().views[0].content.draft.as_ref().expect("one click edits the existing item");
+            assert_eq!(draft.index, Some(0));
+            assert_eq!(draft.text, original);
+            h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::A);
+            h.event(egui::Event::Text(replacement.into()));
+            h.run_steps(3);
+            h.get_by_label("Done adding text").click();
+            h.run_steps(3);
+            assert_eq!(texts(&h), [replacement]);
+            let state = h.state();
+            let bytes = state.session.save_bytes(state.views[0].id).unwrap();
+            let mut reopened = pdfcraft_engine::Session::new();
+            let id = reopened.open("again.pdf", None, bytes, None).unwrap();
+            assert_eq!(reopened.get(id).unwrap().added().len(), 1);
+            let pdfcraft_engine::AddedContent::Text(text) = &reopened.get(id).unwrap().added()[0].content else { panic!() };
+            assert_eq!(text.text, replacement);
+        }
+    }
+}
+
+#[test]
+fn text_tool_deleting_a_draft_hides_the_old_added_glyphs_and_cancel_restores_them() {
+    let mut h = harness();
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::AddText {
+        page: 0,
+        text: pdfcraft_engine::AddedText { rect: [40.0, 195.0, 240.0, 220.0], text: "Original glyphs".into(), size: 18.0, ..Default::default() },
+    }));
+    let bytes = h.state().session.get(h.state().views[0].id).unwrap().bytes.clone();
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(3);
+    let point = at(&h, 45.0, 185.0);
+    click(&mut h, point);
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::A);
+    h.key_press(egui::Key::Backspace);
+    for _ in 0..100 {
+        h.run_steps(2);
+        if !h.state().render_pending() {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    assert!(h.state().views[0].content.draft.as_ref().unwrap().text.is_empty());
+    let shot = h.render().unwrap();
+    for x in 105..140 {
+        for y in 185..197 {
+            let pixel = at(&h, x as f32, y as f32);
+            let [r, g, b, a] = shot.get_pixel(pixel.x as u32, pixel.y as u32).0;
+            assert!(r > 200 && g > 200 && b > 200 && a == 255, "old glyph ink remains at {x},{y}: {r},{g},{b},{a}");
+        }
+    }
+    if let Ok(dir) = std::env::var("PDFCRAFT_SHOTS") {
+        shot.save(format!("{dir}/cleared-added-text.png")).unwrap();
+    }
+    assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().bytes, bytes, "previewing does not edit the document");
+    h.key_press(egui::Key::Escape);
+    h.run_steps(3);
+    assert_eq!(texts(&h), ["Original glyphs"]);
+    assert!(h.state().views[0].content.draft.is_none());
+}
+
 #[test]
 fn clicking_elsewhere_keeps_the_text_and_starts_a_new_box() {
     // #74: a click elsewhere on the page threw away the text being typed and opened a new box.
@@ -236,6 +351,116 @@ fn typing_thai_text_keeps_marks_and_commits_to_page() {
     assert_eq!(texts(&h), ["น้ำ กิ่ ผู้ใช้ Hello"]);
 }
 
+#[test]
+fn finished_text_over_form_field_keeps_selection_and_drag_ownership() {
+    let mut h = harness();
+    assert!(h.state_mut().execute("edit.text"));
+    h.run_steps(2);
+    let p = at(&h, 60.0, 202.0);
+    click(&mut h, p);
+    h.event(egui::Event::Text("Reviewed".into()));
+    h.run_steps(2);
+    h.get_by_label("Done adding text").click();
+    h.run_steps(3);
+    assert_eq!(texts(&h), ["Reviewed"]);
+    let rect = added(&h)[0].content.rect();
+    let mid_x = ((rect[0] + rect[2]) / 2.0) as f32;
+    let mid_y = ((rect[1] + rect[3]) / 2.0) as f32;
+    assert!((20.0..280.0).contains(&mid_x) && (180.0..200.0).contains(&mid_y), "fixture text must overlap city: {rect:?}");
+    let center = at(&h, mid_x, 400.0 - mid_y);
+    click(&mut h, center);
+    assert!(h.state().views[0].forms.focus.is_none(), "selecting finished text must not focus the field underneath");
+    assert_eq!(h.state().views[0].content.selected, Some((0, 0)));
+    h.run_steps(60);
+    let start = at(&h, mid_x, 400.0 - mid_y);
+    let end = at(&h, mid_x, 400.0 - mid_y - 80.0);
+    h.drag_at(start);
+    h.run_steps(1);
+    for step in 1..=40 {
+        h.hover_at(start + (end - start) * (step as f32 / 40.0));
+        h.run_steps(1);
+    }
+    h.drop_at(end);
+    h.run_steps(4);
+    let moved = added(&h)[0].content.rect();
+    for (actual, expected) in moved.into_iter().zip([rect[0], rect[1] + 80.0, rect[2], rect[3] + 80.0]) {
+        assert!((actual - expected).abs() < 1.0, "text should move upward: {rect:?} -> {moved:?}");
+    }
+    assert!(h.state().views[0].forms.focus.is_none());
+    let bare = at(&h, 270.0, 210.0);
+    click(&mut h, bare);
+    assert_eq!(h.state().views[0].forms.focus.as_ref().map(|f| f.name.as_str()), Some("city"));
+}
+
+fn text_over_city() -> Harness<'static, PdfCraftApp> {
+    let mut h = harness_with_step_dt(1.0 / 60.0);
+    assert!(h.state_mut().execute("edit.text"));
+    h.run_steps(2);
+    let p = at(&h, 60.0, 202.0);
+    click(&mut h, p);
+    h.event(egui::Event::Text("Reviewed".into()));
+    h.run_steps(2);
+    h.get_by_label("Done adding text").click();
+    h.run_steps(3);
+    h
+}
+
+#[test]
+fn finished_text_over_field_keeps_move_and_resize_cursors() {
+    let mut h = text_over_city();
+    let rect = added(&h)[0].content.rect();
+    let center = at(&h, ((rect[0] + rect[2]) / 2.0) as f32, (400.0 - (rect[1] + rect[3]) / 2.0) as f32);
+    h.hover_at(center);
+    h.run_steps(2);
+    assert_eq!(h.output().platform_output.cursor_icon, egui::CursorIcon::Move);
+    // The upper-right handle overlaps the city field; it retains its resize gesture.
+    let corner = at(&h, rect[2] as f32, (400.0 - rect[3]) as f32);
+    h.hover_at(corner);
+    h.run_steps(2);
+    assert_eq!(h.output().platform_output.cursor_icon, egui::CursorIcon::ResizeNeSw);
+    let end = corner + egui::vec2(30.0, -20.0);
+    h.drag_at(corner);
+    h.run_steps(1);
+    for step in 1..=20 {
+        h.hover_at(corner + (end - corner) * (step as f32 / 20.0));
+        h.run_steps(1);
+    }
+    h.drop_at(end);
+    h.run_steps(4);
+    let resized = added(&h)[0].content.rect();
+    assert!(resized[2] > rect[2] + 1.0 && resized[3] > rect[3] + 1.0, "resize must retain ownership: {rect:?} -> {resized:?}");
+    assert!(h.state().views[0].forms.focus.is_none());
+}
+
+#[test]
+fn finished_text_over_field_still_opens_its_editor() {
+    let mut h = text_over_city();
+    let rect = added(&h)[0].content.rect();
+    let center = at(&h, ((rect[0] + rect[2]) / 2.0) as f32, (400.0 - (rect[1] + rect[3]) / 2.0) as f32);
+    h.run_steps(60);
+    h.hover_at(center);
+    h.run_steps(1);
+    for _ in 0..2 {
+        for pressed in [true, false] {
+            h.event(egui::Event::PointerButton { pos: center, button: egui::PointerButton::Primary, pressed, modifiers: egui::Modifiers::NONE });
+        }
+        h.run_steps(1);
+    }
+    h.run_steps(2);
+    assert!(h.state().views[0].content.draft.as_ref().is_some_and(|d| d.index == Some(0)), "double click edits the added text");
+    assert!(h.state().views[0].forms.focus.is_none());
+}
+
+#[test]
+fn closing_edit_panel_leaves_form_filling_available() {
+    let mut h = text_over_city();
+    h.state_mut().set_option("left", "closed").unwrap();
+    h.run_steps(3);
+    let p = at(&h, 100.0, 210.0);
+    click(&mut h, p);
+    assert_eq!(h.state().views[0].forms.focus.as_ref().map(|f| f.name.as_str()), Some("city"));
+}
+
 /// The screen rectangle of an added item's display-space box (y up, from the page's bottom).
 fn item_on_screen(h: &Harness<'static, PdfCraftApp>, r: [f64; 4]) -> egui::Rect {
     let s = h.state();
diff --git a/crates/ui-egui/tests/control.rs b/crates/ui-egui/tests/control.rs
index a73b3073b..88ed1c0a9 100644
--- a/crates/ui-egui/tests/control.rs
+++ b/crates/ui-egui/tests/control.rs
@@ -1346,7 +1346,8 @@ fn explicit_panel_requests_reveal_inactive_group_members() {
     h.get_by_label("This document has no bookmarks.");
     ok(&mut h, &c, "ui.command", json!({"id":"edit.edit_text"}));
     h.run_steps(4);
-    h.get_by_label("Edit text & images");
+    // The Edit panel's own row: the tool's name is on the floating toolbar too while it is on.
+    h.get_by_label("Header and footer");
 }
 
 #[test]
@@ -1576,3 +1577,95 @@ fn click_and_drag_refuse_coordinates_that_overflow_like_move() {
     assert_eq!(ok(&mut h, &c, "ui.click", json!({ "x": x, "y": y }))["clicked"], json!([x, y]));
     ok(&mut h, &c, "ui.drag", json!({ "from": [x, y], "to": [x + 10.0, y], "steps": 2 }));
 }
+
+#[test]
+fn page_size_shows_while_the_pointer_is_in_the_bottom_left_quadrant() {
+    let (mut h, _c) = harness();
+    let area = h.state().views[0].viewport_rect();
+    let shown = |h: &Harness<'static, PdfCraftApp>| {
+        let layer = egui::LayerId::new(egui::Order::Foreground, egui::Id::new("page-size-hint"));
+        h.ctx.memory(|m| m.areas().visible_last_frame(&layer))
+    };
+    let away = area.center() + egui::vec2(300.0, -200.0);
+    h.event(egui::Event::PointerMoved(away));
+    h.run_steps(3);
+    assert!(!shown(&h), "top-right: hidden");
+    h.event(egui::Event::PointerMoved(area.left_bottom() + egui::vec2(80.0, -80.0)));
+    h.run_steps(3);
+    assert!(shown(&h), "bottom-left: shown");
+    if let Ok(dir) = std::env::var("PDFCRAFT_SHOT_DIR") {
+        h.render().unwrap().save(format!("{dir}/page-size-hint.png")).unwrap();
+    }
+    h.event(egui::Event::PointerMoved(away));
+    h.run_steps(3);
+    assert!(!shown(&h), "pointer left: hidden again");
+}
+
+#[test]
+fn navigation_history_commands_and_rail_are_per_tab_and_non_editing() {
+    for os in [egui::os::OperatingSystem::Nix, egui::os::OperatingSystem::Mac, egui::os::OperatingSystem::Windows] {
+        navigation_history_for_os(os);
+    }
+}
+
+fn navigation_history_for_os(os: egui::os::OperatingSystem) {
+    let (mut h, c) = harness();
+    h.ctx.set_os(os);
+    h.run_steps(2);
+    let enabled =
+        |list: Value, id: &str| list["commands"].as_array().unwrap().iter().find(|cmd| cmd["id"] == id).unwrap()["enabled"].as_bool().unwrap();
+    assert!(!enabled(ok(&mut h, &c, "ui.commands", json!({})), "view.previous_view"));
+    assert!(call(&mut h, &c, "ui.command", json!({"id": "view.previous_view"})).is_err());
+    // Empty-history shortcuts were silent before registry integration and must stay silent.
+    for key in ["[", "]"] {
+        ok(&mut h, &c, "ui.key", json!({"key": key, "modifiers": ["command"]}));
+        assert!(h.state().toast.is_none(), "an unavailable history action must not ask to open the already-open document");
+    }
+    let before = h.state().session.get(h.state().views[0].id).unwrap().bytes.clone();
+    ok(&mut h, &c, "ui.set", json!({"key": "page", "value": "4"}));
+    assert!(enabled(ok(&mut h, &c, "ui.commands", json!({})), "view.previous_view"));
+    // The real rail button is accessible and invokes the same history, not the adjacent page.
+    let shortcut = if h.ctx.os() == egui::os::OperatingSystem::Mac { "⌘[" } else { "Ctrl+[" };
+    ok(&mut h, &c, "ui.click", json!({"label": &format!("Previous view ({shortcut})")}));
+    assert_eq!(h.state().views[0].current, 0);
+    assert!(enabled(ok(&mut h, &c, "ui.commands", json!({})), "view.next_view"));
+    ok(&mut h, &c, "ui.command", json!({"id": "view.next_view"}));
+    assert_eq!(h.state().views[0].current, 3);
+    ok(&mut h, &c, "ui.set", json!({"key": "page", "value": "5"}));
+    ok(&mut h, &c, "ui.key", json!({"key": "[", "modifiers": ["command"]}));
+    assert_eq!(h.state().views[0].current, 3, "shortcut traverses exactly one history entry");
+    ok(&mut h, &c, "ui.key", json!({"key": "]", "modifiers": ["command"]}));
+    assert_eq!(h.state().views[0].current, 4);
+    ok(&mut h, &c, "ui.command", json!({"id": "view.previous_view"}));
+    h.state_mut().open_bytes("other.pdf", None, fixture(5)).unwrap();
+    assert!(!enabled(ok(&mut h, &c, "ui.commands", json!({})), "view.previous_view"));
+    ok(&mut h, &c, "ui.set", json!({"key": "page", "value": "2"}));
+    ok(&mut h, &c, "ui.command", json!({"id": "view.previous_view"}));
+    assert_eq!(h.state().views[1].current, 0);
+    assert_eq!(h.state().views[0].current, 3, "other tab's history does not move this document");
+    h.state_mut().active = Some(0);
+    ok(&mut h, &c, "ui.command", json!({"id": "view.previous_view"}));
+    assert_eq!(h.state().views[0].current, 0);
+    assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().bytes, before);
+    assert!(!h.state().session.get(h.state().views[0].id).unwrap().dirty);
+    h.state_mut().open_bytes("reopened.pdf", None, before.as_ref().clone()).unwrap();
+    assert!(h.state().views.last().unwrap().back.is_empty());
+    assert!(h.state().views.last().unwrap().forward.is_empty());
+}
+
+#[test]
+fn routine_continuous_scrolling_does_not_add_navigation_history() {
+    let (mut h, c) = harness_pages(20);
+    ok(&mut h, &c, "ui.set", json!({"key": "animation_effects", "value": "off"}));
+    h.hover_at(egui::pos2(700.0, 450.0));
+    h.event(egui::Event::MouseWheel {
+        unit: egui::MouseWheelUnit::Point,
+        delta: egui::vec2(0.0, -1200.0),
+        modifiers: egui::Modifiers::NONE,
+        phase: egui::TouchPhase::Move,
+    });
+    h.run_steps(8);
+    assert!(h.state().views[0].current > 0, "the wheel really moved to a later page");
+    assert!(h.state().views[0].back.is_empty());
+    assert!(h.state().views[0].forward.is_empty());
+}
diff --git a/crates/ui-egui/tests/create.rs b/crates/ui-egui/tests/create.rs
index bfbba2e13..ce2a5f37e 100644
--- a/crates/ui-egui/tests/create.rs
+++ b/crates/ui-egui/tests/create.rs
@@ -69,12 +69,36 @@ fn opening_images_and_text_converts_them_to_new_pdfs() {
     assert!(app.open_bytes("junk.png", None, b"\x89PNG\r\n\x1a\nnot really".to_vec()).is_err());
 }
 
+struct ReduceDir(std::path::PathBuf);
+impl ReduceDir {
+    fn new() -> Self {
+        use std::sync::atomic::{AtomicU64, Ordering};
+        static NEXT: AtomicU64 = AtomicU64::new(0);
+        for _ in 0..128 {
+            let path = std::env::temp_dir().join(format!("pdfcraft-reduce-test-{}-{}", std::process::id(), NEXT.fetch_add(1, Ordering::Relaxed)));
+            match std::fs::create_dir(&path) {
+                Ok(()) => return Self(path),
+                Err(error) if error.kind() == std::io::ErrorKind::AlreadyExists => continue,
+                Err(error) => panic!("creating Reduce test directory: {error}"),
+            }
+        }
+        panic!("no unused Reduce test directory after 128 attempts");
+    }
+}
+impl Drop for ReduceDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
 /// Open `name` and run Reduce File Size on it, saving to `out` without a dialog.
 fn reduce(name: &'static str, bytes: Vec<u8>, out: &std::path::Path) -> egui_kittest::Harness<'static, PdfCraftApp> {
     let out2 = out.to_path_buf();
     let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1200.0, 800.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
         app.set_option("language", "en").unwrap();
+        // Keep metadata identical: changing ModDate can make a compact PDF one byte smaller.
+        app.session = std::mem::take(&mut app.session).with_clock(|| 1_700_000_000);
         app.open_bytes(name, None, bytes).unwrap();
         app.save_override = Some(out2.to_string_lossy().into_owned());
         app
@@ -105,9 +129,8 @@ fn reduce_file_size_writes_a_compact_copy() {
         enc.set_depth(png::BitDepth::Eight);
         enc.write_header().unwrap().write_image_data(&px).unwrap();
     }
-    let dir = std::env::temp_dir().join(format!("pdfcraft-reduce-{}", std::process::id()));
-    std::fs::create_dir_all(&dir).unwrap();
-    let out = dir.join("reduced.pdf");
+    let dir = ReduceDir::new();
+    let out = dir.0.join("reduced.pdf");
     let h = reduce("photo.png", photo, &out);
     let bytes = std::fs::read(&out).unwrap();
     assert!(bytes.starts_with(b"%PDF-"));
@@ -119,9 +142,8 @@ fn reduce_file_size_writes_a_compact_copy() {
 #[test]
 fn reduce_file_size_saves_nothing_when_the_file_is_already_small() {
     use egui_kittest::kittest::Queryable;
-    let dir = std::env::temp_dir().join(format!("pdfcraft-reduce-small-{}", std::process::id()));
-    std::fs::create_dir_all(&dir).unwrap();
-    let out = dir.join("reduced.pdf");
+    let dir = ReduceDir::new();
+    let out = dir.0.join("reduced.pdf");
     // A new text PDF is already compact: a copy would be no smaller (#490).
     let h = reduce("notes.txt", "lorem ipsum ".repeat(500).into_bytes(), &out);
     assert!(!out.exists(), "no copy was written");
@@ -190,6 +212,34 @@ fn the_pdf_optimizer_dialog_saves_an_optimized_copy() {
     assert_eq!(h.state().dialog, None);
 }
 
+#[test]
+fn the_pdf_optimizer_dialog_picks_a_preset() {
+    use egui_kittest::Harness;
+    use egui_kittest::kittest::Queryable;
+    use pdfcraft_engine::optimize::Preset;
+    let mut h = Harness::builder().with_size(egui::vec2(1200.0, 800.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("notes.txt", None, b"lorem ipsum".to_vec()).unwrap();
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("optimize.advanced"));
+    h.run_steps(2);
+    assert_eq!(Preset::of(&h.state().optimize_draft.settings), Some(Preset::Standard));
+    h.get_by_label("Merge image fragments");
+    h.get_by_value("Standard").click();
+    h.run_steps(4);
+    h.get_by_label("Mobile").click();
+    h.run_steps(2);
+    assert_eq!(h.state().optimize_draft.settings, Preset::Mobile.settings(), "Mobile chosen");
+    // Changing an option makes the settings custom.
+    h.get_by_label("Merge image fragments").click();
+    h.run_steps(2);
+    assert!(!h.state().optimize_draft.settings.merge_fragments);
+    h.get_by_value("Custom");
+}
+
 fn mixed_files(app: &PdfCraftApp) -> Vec<(String, Vec<u8>)> {
     let pdf = app.session.create_from_text("a", "from a pdf").unwrap();
     vec![
diff --git a/crates/ui-egui/tests/dialog_chrome.rs b/crates/ui-egui/tests/dialog_chrome.rs
index 8a403535e..57f549305 100644
--- a/crates/ui-egui/tests/dialog_chrome.rs
+++ b/crates/ui-egui/tests/dialog_chrome.rs
@@ -81,3 +81,18 @@ fn password_prompt_field_is_tall_and_inset() {
     let heading = h.get_by_label("Password required").rect();
     assert!(heading.top() - card.top() >= 16.0, "heading inset {heading:?} in {card:?}");
 }
+
+#[test]
+fn document_properties_long_filename_does_not_overflow_card() {
+    let long_name = "Global_sociology_introducing_five_contemporary_societies_Schneider_Linda_Silverman_Arnold_2000_Boston_isbn13_9780072294309_hash_3d2960a9212a8573bba2536e91f36e59_archive_copy.pdf";
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes(long_name, None, fixture()).unwrap();
+        app.set_option("dialog", "properties").unwrap();
+        app
+    });
+    h.run_steps(4);
+    let card = card(&h, "dialog");
+    assert!(card.width() <= 700.0, "dialog card should not blow out horizontally on long filename, width was: {}", card.width());
+}
diff --git a/crates/ui-egui/tests/document_links.rs b/crates/ui-egui/tests/document_links.rs
index c9bb64a3d..ab7987b94 100644
--- a/crates/ui-egui/tests/document_links.rs
+++ b/crates/ui-egui/tests/document_links.rs
@@ -235,6 +235,7 @@ fn a_gotor_link_to_a_directory_or_device_is_refused_without_reading_it() {
     for target in targets {
         let mut h = remote_harness(Some(dir.join("source.pdf").to_string_lossy().into_owned()), target, "[0 /Fit]");
         click_remote_link(&mut h);
+        support::wait_until(&mut h, "relative invalid target refusal", |app| app.toast.is_some());
         assert_eq!(h.state().views.len(), 1, "{target} opens no tab");
         let toast = &h.state().toast.as_ref().unwrap().0;
         assert!(toast.contains("not a regular file"), "{target}: {toast}");
diff --git a/crates/ui-egui/tests/editing.rs b/crates/ui-egui/tests/editing.rs
index c47083777..f8db52575 100644
--- a/crates/ui-egui/tests/editing.rs
+++ b/crates/ui-egui/tests/editing.rs
@@ -56,6 +56,13 @@ fn organize(pages: usize) -> Harness<'static, PdfCraftApp> {
     harness(pages, |app| app.set_option("organize", "on").unwrap())
 }
 
+/// Organize pages ▸ Insert ▸ `item`.
+fn insert_menu(h: &mut Harness<'static, PdfCraftApp>, item: &str) {
+    h.get_by_label("Insert").click();
+    h.run_steps(2);
+    h.get_by_label(item).click();
+}
+
 fn type_selection(h: &mut Harness<'static, PdfCraftApp>, text: &str) {
     use egui::accesskit::Role;
     h.get_by_role_and_label(Role::TextInput, "Selected pages").click();
@@ -114,7 +121,7 @@ fn organize_page_range_rejects_invalid_input_and_escape_cancels_without_clearing
     assert_eq!(h.state().views[0].target_pages(), [1, 2]);
     assert_eq!(h.get_by_role_and_label(Role::TextInput, "Selected pages").value().as_deref(), Some("2-3"));
     type_selection(&mut h, "5, 4, 4");
-    h.get_by_label("Apply").click();
+    h.key_press(Key::Enter);
     h.run_steps(2);
     assert_eq!(h.state().views[0].target_pages(), [3, 4]);
     type_selection(&mut h, " ");
@@ -149,6 +156,53 @@ fn organize_tool_opens_the_overview_directly_and_can_be_reentered() {
     assert!(!h.state().views[0].organize, "another tool returns to the document");
 }
 
+/// Issue #1910: the page grid opens on the page the user was reading: it is selected and
+/// scrolled into view, whether the document was on a middle page, its last page or a page
+/// other than an earlier grid selection.
+#[test]
+fn organize_opens_on_the_current_page() {
+    let mut h = harness(60, |_| {});
+    let in_view = |h: &Harness<'static, PdfCraftApp>, page: usize| {
+        let viewport = h.state().views[0].viewport_rect();
+        let label = format!("Page {}", page + 1);
+        h.query_by_label(&label).is_some_and(|n| viewport.contains_rect(n.rect()))
+    };
+    // From a middle page.
+    h.state_mut().views[0].go_to_page(30);
+    h.run_steps(2);
+    assert!(h.state_mut().execute("page.organize"));
+    h.run_steps(4);
+    assert!(h.state().views[0].organize);
+    assert_eq!(h.state().views[0].target_pages(), [30]);
+    assert!(h.state().views[0].selected.is_empty(), "an empty selection is the current page, so checkboxes still toggle");
+    assert!(in_view(&h, 30), "the current page is scrolled into view");
+    assert!(!in_view(&h, 0), "the grid does not open on page 1");
+    // An earlier grid selection on another page does not win over the page the user went to.
+    h.get_by_label("Select page 32").click();
+    h.run_steps(2);
+    assert_eq!(h.state().views[0].target_pages(), [31]);
+    h.get_by_label("Close").click();
+    h.run_steps(2);
+    assert!(!h.state().views[0].organize);
+    h.state_mut().views[0].go_to_page(45);
+    h.run_steps(2);
+    h.state_mut().set_option("tool", "organize").unwrap();
+    h.run_steps(4);
+    assert_eq!(h.state().views[0].target_pages(), [45]);
+    assert!(in_view(&h, 45));
+    assert!(!in_view(&h, 1));
+    // From the last page.
+    h.get_by_label("Close").click();
+    h.run_steps(2);
+    h.state_mut().views[0].go_to_page(59);
+    h.run_steps(2);
+    h.state_mut().set_option("organize", "on").unwrap();
+    h.run_steps(4);
+    assert_eq!(h.state().views[0].target_pages(), [59]);
+    assert!(in_view(&h, 59));
+    assert!(!in_view(&h, 0));
+}
+
 #[test]
 fn organize_tool_chosen_before_opening_a_document_shows_its_pages() {
     let mut app = PdfCraftApp::new();
@@ -434,7 +488,7 @@ fn insert_blank_page_after_selection() {
     let mut h = organize(2);
     h.get_by_label("Page 1").click();
     h.run_steps(1);
-    h.get_by_label("Insert a blank page after the selection").click();
+    insert_menu(&mut h, "Insert a blank page after the selection");
     h.run_steps(3);
     assert_eq!(page_texts(h.state()), ["Page 1", "", "Page 2"]);
     let app = h.state();
@@ -1491,7 +1545,7 @@ fn replace_button_replaces_selected_pages_in_organize() {
     h.get_by_label("Page 3").click_modifiers(Modifiers::COMMAND);
     h.run_steps(2);
     h.state_mut().pick_override = Some(vec![other.to_string_lossy().into_owned()]);
-    h.get_by_label("Replace pages…").click();
+    h.get_by_label("Replace").click();
     h.run_steps(3);
     egui_kittest::kittest::Queryable::get_by_label(&h, "Replace Pages");
     assert_eq!(h.state().replace_draft.as_ref().unwrap().from, 2);
@@ -1601,7 +1655,7 @@ fn plus_between_pages_inserts_picked_files_there_in_order() {
     // The toolbar button still inserts after the selection, not at the last "+" used.
     h.get_by_label("Page 2").click();
     h.run_steps(2);
-    h.get_by_label("Insert pages from a file…").click();
+    insert_menu(&mut h, "Insert pages from a file…");
     h.run_steps(4);
     assert_eq!(texts_of(h.state(), 0), ["a note", "Page 1", "a note", "Page 2", "Page 3", "a note"]);
     // A file that can't be converted changes nothing.
@@ -1686,6 +1740,51 @@ fn files_dropped_outside_the_page_grid_still_open_as_documents() {
     assert_eq!(doc.bytes.as_slice(), fixture(1).as_slice());
 }
 
+/// The Pages panel's thumbnail of page `label` (the panel is right of the page view).
+fn panel_thumb_rect(h: &Harness<'static, PdfCraftApp>, label: &str) -> egui::Rect {
+    h.get_all_by_label(label).map(|n| n.rect()).max_by(|a, b| a.left().total_cmp(&b.left())).unwrap()
+}
+
+#[test]
+fn files_dropped_on_the_pages_panel_are_inserted_there() {
+    let mut h = harness(3, |app| app.right = Some(pdfcraft_ui_egui::RightPanel::Pages));
+    // The top half of page 2's thumbnail: between pages 1 and 2.
+    let thumb = panel_thumb_rect(&h, "Page 2");
+    h.hover_at(thumb.center() - egui::vec2(0.0, thumb.height() * 0.25));
+    h.run_steps(2);
+    assert_eq!(h.state().views[0].panel_gap, Some(1));
+    drop_files(&mut h, vec![Dropped("extra.pdf", fixture(2)), Dropped("note.txt", b"a note".to_vec())]);
+    h.run_steps(4);
+    assert_eq!(h.state().views.len(), 1, "dropped files are not opened as documents");
+    assert_eq!(texts_of(h.state(), 0), ["Page 1", "Page 1", "Page 2", "a note", "Page 2", "Page 3"]);
+    assert_eq!(picked(&h), [1, 2, 3], "the inserted pages are selected");
+    // The bottom half of the last thumbnail: the end.
+    let mut h = harness(2, |app| app.right = Some(pdfcraft_ui_egui::RightPanel::Pages));
+    let last = panel_thumb_rect(&h, "Page 2");
+    h.hover_at(last.center() + egui::vec2(0.0, last.height() * 0.25));
+    h.run_steps(2);
+    drop_files(&mut h, vec![Dropped("note.txt", b"a note".to_vec())]);
+    h.run_steps(4);
+    assert_eq!(h.state().views.len(), 1);
+    assert_eq!(texts_of(h.state(), 0), ["Page 1", "Page 2", "a note"]);
+}
+
+#[test]
+fn files_dropped_beside_the_pages_panel_still_open_as_documents() {
+    let mut h = harness(2, |app| app.right = Some(pdfcraft_ui_egui::RightPanel::Pages));
+    // Over the page view, not the panel.
+    let thumb = panel_thumb_rect(&h, "Page 1");
+    h.hover_at(egui::pos2(thumb.left() - 300.0, thumb.center().y));
+    h.run_steps(2);
+    drop_files(&mut h, vec![Dropped("other.pdf", fixture(1))]);
+    // Native opening prepares the document on a worker; three UI frames need not give it
+    // any CPU time. Wait for the result, as the other dropped-document regression does.
+    support::wait_until(&mut h, "document dropped beside the Pages panel", |app| app.views.len() == 2 && app.password_prompt.is_none());
+    assert_eq!(h.state().views.len(), 2);
+    assert_eq!(texts_of(h.state(), 0), ["Page 1", "Page 2"]);
+    assert_eq!(texts_of(h.state(), 1), ["Page 1"], "the dropped PDF opens as its own document");
+}
+
 fn grid_zoom(h: &Harness<'static, PdfCraftApp>) -> f32 {
     h.state().views[0].grid_zoom()
 }
@@ -1825,10 +1924,10 @@ fn split_dialog_writes_one_file_per_part() {
     let d = dir.to_string_lossy().into_owned();
     let mut h = organize(3);
     h.state_mut().export_dir_override = Some(d);
-    h.get_by_label("Split into files…").click();
+    h.get_all_by_label("Split").last().unwrap().click();
     h.run_steps(3);
     h.get_by_label_contains("Creates 3 files from 3 pages");
-    h.get_by_label("Split").click();
+    h.get_all_by_label("Split").last().unwrap().click();
     h.run_steps(3);
     let mut names: Vec<String> = std::fs::read_dir(&dir).unwrap().map(|e| e.unwrap().file_name().to_string_lossy().into_owned()).collect();
     names.sort();
@@ -1854,7 +1953,7 @@ fn split_at_bookmarks_with_equal_titles_keeps_every_part() {
     h.state_mut().run_command("page.split");
     h.run_steps(3);
     h.get_by_label_contains("Creates 3 files from 3 pages");
-    h.get_by_label("Split").click();
+    h.get_all_by_label("Split").last().unwrap().click();
     h.run_steps(3);
     let mut names: Vec<String> = std::fs::read_dir(&dir).unwrap().map(|e| e.unwrap().file_name().to_string_lossy().into_owned()).collect();
     names.sort();
@@ -1874,7 +1973,7 @@ fn split_before_selected_pages() {
     h.state_mut().run_command("page.split");
     h.run_steps(3);
     h.get_by_label_contains("Creates 2 files from 4 pages");
-    h.get_by_label("Split").click();
+    h.get_all_by_label("Split").last().unwrap().click();
     h.run_steps(3);
     let mut names: Vec<String> = std::fs::read_dir(&dir).unwrap().map(|e| e.unwrap().file_name().to_string_lossy().into_owned()).collect();
     names.sort();
@@ -2132,6 +2231,75 @@ fn replace_pages_dialog_swaps_page_content() {
     assert_eq!(doc.can_undo(), Some("Replace page"));
 }
 
+/// Pages 1 and 3 are selected. OK replaces those two and leaves the unchecked page between them.
+#[test]
+fn replace_split_selection_keeps_the_unchecked_page() {
+    fn sized(n: usize, width: u32, height: u32, label: &str) -> Vec<u8> {
+        let mut objs: Vec<String> = vec!["<< /Type /Catalog /Pages 2 0 R >>".into()];
+        let kids: Vec<String> = (0..n).map(|i| format!("{} 0 R", 4 + 2 * i)).collect();
+        objs.push(format!("<< /Type /Pages /Kids [{}] /Count {n} /MediaBox [0 0 {width} {height}] >>", kids.join(" ")));
+        objs.push("<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".into());
+        for i in 0..n {
+            objs.push(format!("<< /Type /Page /Parent 2 0 R /Contents {} 0 R /Resources << /Font << /F1 3 0 R >> >> >>", 5 + 2 * i));
+            let body = format!("BT /F1 24 Tf 20 150 Td ({label} {}) Tj ET", i + 1);
+            objs.push(format!("<< /Length {} >>\nstream\n{body}\nendstream", body.len()));
+        }
+        let mut out = b"%PDF-1.7\n".to_vec();
+        let mut offsets = Vec::new();
+        for (i, o) in objs.iter().enumerate() {
+            offsets.push(out.len());
+            out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+        }
+        let xref = out.len();
+        out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+        for o in offsets {
+            out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+        }
+        out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+        out
+    }
+    let open = |selected: &[usize], edited: bool| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("original.pdf", None, sized(3, 200, 300, "Original")).unwrap();
+        app.views[0].select_pages(selected);
+        app.start_replace("other.pdf".into(), sized(5, 400, 500, "Replacement"));
+        if edited {
+            app.replace_draft.as_mut().unwrap().range_edited = true;
+        }
+        let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| app);
+        h.run_steps(2);
+        h
+    };
+    let sizes = |app: &PdfCraftApp| {
+        let doc = app.session.get(app.views[0].id).unwrap();
+        doc.info.pages.iter().map(|p| (p.width.round() as i32, p.height.round() as i32)).collect::<Vec<_>>()
+    };
+    let mut split = open(&[0, 2], false);
+    let draft = split.state().replace_draft.as_ref().unwrap();
+    assert_eq!((draft.from, draft.to, draft.pages.as_slice(), draft.range_edited), (1, 3, &[0usize, 2][..], false));
+    egui_kittest::kittest::Queryable::get_by_label(&split, "OK").click();
+    split.run_steps(3);
+    assert_eq!(texts_of(split.state(), 0), ["Replacement 1", "Original 2", "Replacement 2"]);
+    assert_eq!(sizes(split.state()), [(400, 500), (200, 300), (400, 500)]);
+    assert_eq!(split.state().session.get(split.state().views[0].id).unwrap().can_undo(), Some("Replace pages"));
+    split.state_mut().undo();
+    split.run_steps(2);
+    assert_eq!(texts_of(split.state(), 0), ["Original 1", "Original 2", "Original 3"]);
+    assert_eq!(sizes(split.state()), [(200, 300), (200, 300), (200, 300)]);
+
+    let mut span = open(&[0, 2], true);
+    egui_kittest::kittest::Queryable::get_by_label(&span, "OK").click();
+    span.run_steps(3);
+    assert_eq!(texts_of(span.state(), 0), ["Replacement 1", "Replacement 2", "Replacement 3"]);
+
+    let mut adjacent = open(&[1, 2], false);
+    egui_kittest::kittest::Queryable::get_by_label(&adjacent, "OK").click();
+    adjacent.run_steps(3);
+    assert_eq!(texts_of(adjacent.state(), 0), ["Original 1", "Replacement 1", "Replacement 2"]);
+    assert_eq!(sizes(adjacent.state()), [(200, 300), (400, 500), (400, 500)]);
+}
+
 #[test]
 fn extract_options_and_rotate_pages_dialog() {
     let dir = temp_path("extract-sep");
@@ -2387,6 +2555,51 @@ fn switching_from_a_narrow_editor_keeps_one_frame_and_a_wide_heading_on_one_line
     assert!(!dirty(&h));
 }
 
+/// #2022: clicking straight into another text box while one is open for typing must apply the
+/// open paragraph first; the typed text used to be dropped with the editor that switched away.
+#[test]
+fn switching_straight_to_another_box_applies_the_open_paragraph() {
+    let bytes = source_font_fixture_with_text("BT /F1 24 Tf 20 220 Td (Top) Tj ET BT /F2 24 Tf 20 120 Td (Bottom) Tj ET");
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("boxes.pdf", None, bytes).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let k = r.width() / 300.0;
+    let mut blocks = {
+        let s = h.state();
+        s.session.get(s.views[0].id).unwrap().text_blocks(0)
+    };
+    blocks.sort_by(|a, b| b.rect[1].partial_cmp(&a.rect[1]).unwrap_or(std::cmp::Ordering::Equal));
+    assert_eq!(blocks.iter().map(|b| b.text.as_str()).collect::<Vec<_>>(), ["Top", "Bottom"], "two editable boxes");
+    let center = |b: &pdfcraft_engine::TextBlock| {
+        egui::pos2(r.left() + ((b.rect[0] + b.rect[2]) / 2.0) as f32 * k, r.top() + (300.0 - (b.rect[1] + b.rect[3]) / 2.0) as f32 * k)
+    };
+    // Open the top box and type into it.
+    click_at(&mut h, center(&blocks[0]));
+    let ed = h.state().views[0].line_editor.clone().expect("the top box opens for typing");
+    assert_eq!(ed.text, "Top");
+    h.state_mut().views[0].line_editor.as_mut().unwrap().text = "Top edited".into();
+    h.run_steps(1);
+    // Click straight into the bottom box: the open paragraph is applied, and the bottom box opens.
+    click_at(&mut h, center(&blocks[1]));
+    let s = h.state();
+    let doc = s.session.get(s.views[0].id).unwrap();
+    assert_eq!(
+        doc.text_blocks(0).iter().map(|b| b.text.clone()).collect::<Vec<_>>(),
+        ["Top edited", "Bottom"],
+        "the typed text is applied, not dropped"
+    );
+    assert_eq!(doc.can_undo(), Some("Edit text"));
+    let ed = s.views[0].line_editor.clone().expect("the bottom box is now open");
+    assert_eq!(ed.text, "Bottom");
+}
+
 #[test]
 fn editing_existing_text_in_place() {
     let mut h = harness(1, |_| {});
@@ -2416,6 +2629,89 @@ fn editing_existing_text_in_place() {
     assert_eq!(texts_of(s, 0), ["Chapter One"], "the page shows it");
 }
 
+#[test]
+fn text_tool_clicking_source_text_edits_instead_of_adding_a_copy() {
+    let mut h = harness(1, |_| {});
+    assert!(h.state_mut().execute("edit.text"));
+    h.run_steps(2);
+    let page = h.state().views[0].page_screen_rect(0).unwrap();
+    let blank = egui::pos2(page.left() + 0.2 * page.width(), page.top() + 0.1 * page.height());
+    h.hover_at(blank);
+    h.run_steps(1);
+    h.drag_at(blank);
+    h.run_steps(1);
+    h.drop_at(blank);
+    h.run_steps(3);
+    h.event(egui::Event::Text("Keep this note".into()));
+    h.run_steps(3);
+    let point = egui::pos2(page.left() + 40.0 / 200.0 * page.width(), page.top() + 142.0 / 300.0 * page.height());
+    h.hover_at(point);
+    h.run_steps(1);
+    h.drag_at(point);
+    h.run_steps(1);
+    h.drop_at(point);
+    h.run_steps(4);
+    assert!(h.state().views[0].content.draft.is_none(), "clicking source text must not start an added layer");
+    assert_eq!(h.state().views[0].line_editor.as_ref().unwrap().text, "Page 1");
+    assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().added().len(), 1, "the previous draft is kept");
+    h.key_press_modifiers(Modifiers::COMMAND, Key::A);
+    h.event(egui::Event::Text("Replacement".into()));
+    h.run_steps(3);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Enter);
+    h.run_steps(3);
+    assert_eq!(page_texts(h.state()), ["Keep this note\nReplacement"]);
+    assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().added().len(), 1, "editing the source adds no second layer");
+}
+
+#[test]
+fn text_tool_mixed_style_row_grows_in_the_editor_and_saved_pdf() {
+    let bytes = source_font_fixture_with_text("BT /F1 12 Tf 20 220 Td (Small ) Tj /F2 12 Tf (row) Tj ET");
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("mixed-row.pdf", None, bytes).unwrap();
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    let page = h.state().views[0].page_screen_rect(0).unwrap();
+    let point = egui::pos2(page.left() + 25.0 / 300.0 * page.width(), page.top() + 75.0 / 300.0 * page.height());
+    h.hover_at(point);
+    h.run_steps(1);
+    h.drag_at(point);
+    h.run_steps(1);
+    h.drop_at(point);
+    h.run_steps(4);
+    let replacement = "Small row with more words";
+    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
+    h.event(egui::Event::Text(" with more words".into()));
+    h.run_steps(4);
+    let galley = h
+        .output()
+        .shapes
+        .iter()
+        .find_map(|s| match &s.shape {
+            egui::Shape::Text(t) if t.galley.text() == replacement => Some(&t.galley),
+            _ => None,
+        })
+        .expect("the draft is painted");
+    assert_eq!(galley.rows.len(), 1, "mixed source runs grow as one visual row");
+    if let Ok(path) = std::env::var("PDFCRAFT_MIXED_ROW_SHOT") {
+        h.render().unwrap().save(path).unwrap();
+    }
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Enter);
+    h.run_steps(3);
+    let state = h.state();
+    let doc = state.session.get(state.views[0].id).unwrap();
+    assert_eq!(doc.text_blocks(0)[0].editor_text, replacement);
+    assert_eq!(doc.text_blocks(0)[0].rows.len(), 1);
+    let bytes = state.session.save_bytes(state.views[0].id).unwrap();
+    let mut reopened = pdfcraft_engine::Session::new();
+    let id = reopened.open("again.pdf", None, bytes, None).unwrap();
+    assert_eq!(reopened.get(id).unwrap().text_blocks(0)[0].rows.len(), 1);
+}
+
 /// One page whose only line is drawn twice at the same spot (fake bold, as many generated
 /// documents do).
 fn double_drawn() -> Vec<u8> {
@@ -3063,7 +3359,7 @@ fn check_added_text_drag(panel_open: bool) {
     h.run_steps(4);
     let added = |h: &Harness<'static, PdfCraftApp>| {
         let app = h.state();
-        app.session.get(app.views[0].id).unwrap().added.clone()
+        app.session.get(app.views[0].id).unwrap().added().to_vec()
     };
     let before_added = added(&h);
     assert_eq!(before_added.len(), 1);
@@ -3887,6 +4183,74 @@ fn cropped_image_corner_resize_keeps_opposite_corner_and_scales_crop() {
     assert_eq!(reopened.get(re).unwrap().page_images(0), h.state().session.get(id).unwrap().page_images(0));
 }
 
+/// While a corner is dragged, the image's pixels are drawn in the blue frame, not left at their
+/// old size until release (#1671).
+#[test]
+fn image_pixels_follow_the_frame_while_a_corner_is_dragged() {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 1100.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("clipped.pdf", None, clipped_artwork_with_labels_drawn(true)).unwrap();
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.state_mut().views[0].set_zoom(1.2);
+    h.run_steps(4);
+    let page = h.state().views[0].page_screen_rect(0).unwrap();
+    let at = |x: f32, y: f32| egui::pos2(page.left() + x / 200.0 * page.width(), page.top() + (300.0 - y) / 300.0 * page.height());
+    let p = at(95.0, 195.0);
+    h.hover_at(p);
+    h.run_steps(1);
+    h.drag_at(p);
+    h.run_steps(1);
+    h.drop_at(p);
+    h.run_steps(3);
+    assert!(h.state().views[0].image_selection.is_some());
+    let frame = |h: &Harness<'static, PdfCraftApp>| {
+        h.output().shapes.iter().find_map(|s| match &s.shape {
+            egui::Shape::Rect(r) if r.stroke.color == egui::Color32::from_rgb(0x14, 0x73, 0xE6) && r.rect.width() > 20.0 => Some(r.rect),
+            _ => None,
+        })
+    };
+    // Textured meshes smaller than the page: the page raster itself always covers the page.
+    let pictures = |h: &Harness<'static, PdfCraftApp>| -> Vec<egui::Rect> {
+        h.output()
+            .shapes
+            .iter()
+            .filter_map(|s| match &s.shape {
+                egui::Shape::Mesh(m) if m.texture_id != egui::TextureId::default() => Some(m.calc_bounds()),
+                _ => None,
+            })
+            .filter(|b| b.width() < page.width() - 1.0)
+            .collect()
+    };
+    let start = frame(&h).expect("the selected image has a frame");
+    let (grip, fixed) = (start.right_top(), start.left_bottom());
+    for factor in [0.6, 1.3] {
+        let to = fixed + (grip - fixed) * factor;
+        h.hover_at(grip);
+        h.run_steps(1);
+        h.drag_at(grip);
+        h.run_steps(1);
+        for k in 1..=4 {
+            h.hover_at(grip + (to - grip) * (k as f32 / 4.0));
+            h.run_steps(1);
+        }
+        let live = frame(&h).expect("the drag shows its frame");
+        assert!((live.width() - start.width() * factor).abs() < 1.0, "the frame follows the grip: {live:?} from {start:?}");
+        let drawn = pictures(&h);
+        assert!(
+            drawn.iter().any(|b| (b.min - live.min).length() < 0.5 && (b.max - live.max).length() < 0.5),
+            "the picture is drawn in the frame {live:?}, not only at {drawn:?}"
+        );
+        h.drop_at(to);
+        h.run_steps(4);
+        h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+        h.run_steps(4);
+    }
+}
+
 /// Exercise actual pointer gestures on each cropped placement, without capturing private pixels.
 #[test]
 #[ignore = "requires an explicitly supplied local PDF with cropped artwork"]
@@ -4160,3 +4524,152 @@ fn private_new_chinese_keyboard_input_preserves_font_layout_and_saved_pixels() {
     assert_eq!(std::fs::read(path).unwrap(), original);
     println!("verified Chinese keyboard insertion/deletion and save/reopen rendering on {pages} pages");
 }
+
+/// Moving text shows the four-way arrow wherever a drag would move it (#1520 follow-up): over a
+/// closed paragraph, on the frame of an open one, and while dragging. Inside the open one the
+/// pointer reads as text; on a closed one's edge, as the rewrap handle.
+#[test]
+fn moving_text_offers_the_four_way_arrow() {
+    let mut h = harness(2, |_| {});
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    let id = h.state().views[0].id;
+    let block = h.state().session.get(id).unwrap().text_blocks(0)[0].clone();
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let k = r.width() / 200.0;
+    let screen = |x: f64, y: f64| egui::pos2(r.left() + x as f32 * k, r.top() + (300.0 - y as f32) * k);
+    let centre = screen((block.rect[0] + block.rect[2]) / 2.0, (block.rect[1] + block.rect[3]) / 2.0);
+    let cursor_at = |h: &mut Harness<'static, PdfCraftApp>, at: egui::Pos2| {
+        h.hover_at(at);
+        h.run_steps(2);
+        h.output().platform_output.cursor_icon
+    };
+    // A closed paragraph: a drag moves it; its left edge rewraps it.
+    assert_eq!(cursor_at(&mut h, centre), egui::CursorIcon::Move);
+    assert_eq!(cursor_at(&mut h, screen(block.rect[0], (block.rect[1] + block.rect[3]) / 2.0)), egui::CursorIcon::ResizeHorizontal);
+    // While it is being dragged.
+    h.hover_at(centre);
+    h.run_steps(1);
+    h.drag_at(centre);
+    h.run_steps(1);
+    let mid = centre + egui::vec2(20.0 * k, 10.0 * k);
+    h.hover_at(mid);
+    h.run_steps(2);
+    assert_eq!(h.output().platform_output.cursor_icon, egui::CursorIcon::Move);
+    h.drop_at(mid);
+    h.run_steps(4);
+    let moved = h.state().session.get(id).unwrap().text_blocks(0)[0].clone();
+    assert!((moved.rect[0] - block.rect[0] - 20.0).abs() < 1.5, "{:?} → {:?}", block.rect, moved.rect);
+    // Open: text inside, the frame moves it.
+    let centre = screen((moved.rect[0] + moved.rect[2]) / 2.0, (moved.rect[1] + moved.rect[3]) / 2.0);
+    click_at(&mut h, centre);
+    assert!(h.state().views[0].line_editor.is_some());
+    assert_eq!(cursor_at(&mut h, centre), egui::CursorIcon::Text);
+    let frame = screen((moved.rect[0] + moved.rect[2]) / 2.0, moved.rect[3]) - egui::vec2(0.0, 4.0);
+    assert_eq!(cursor_at(&mut h, frame), egui::CursorIcon::Move);
+}
+
+/// Cropping a picture on the page (Acrobat's crop handles): in crop mode the
+/// handles trim, Enter applies what is kept, Esc leaves the picture as it was.
+#[test]
+fn cropping_a_picture_with_its_handles() {
+    let mut png = Vec::new();
+    image::RgbImage::from_pixel(80, 40, image::Rgb([200, 40, 40])).write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("picture.png", None, png.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    let id = h.state().views[0].id;
+    let before = h.state().session.get(id).unwrap().page_images(0)[0].visible_rect.unwrap();
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let c = r.center();
+    h.hover_at(c);
+    h.run_steps(1);
+    h.drag_at(c);
+    h.run_steps(1);
+    h.drop_at(c);
+    h.run_steps(2);
+    assert!(h.state().views[0].image_selection.is_some(), "selected");
+    // Crop mode (as the context menu's Crop Image starts it): drag the right-bottom handle a
+    // quarter of the picture inward, then Enter.
+    h.state_mut().views[0].image_selection.as_mut().unwrap().crop = Some(pdfcraft_ui_egui::CropMode::new(before));
+    h.run_steps(2);
+    let corner = r.right_bottom();
+    let to = corner - egui::vec2(r.width() / 4.0, r.height() / 4.0);
+    h.hover_at(corner);
+    h.run_steps(1);
+    h.drag_at(corner);
+    h.run_steps(1);
+    for k in 1..=4 {
+        h.hover_at(corner + (to - corner) * (k as f32 / 4.0));
+        h.run_steps(1);
+    }
+    h.drop_at(to);
+    h.run_steps(2);
+    let keep = h.state().views[0].image_selection.as_ref().unwrap().crop.as_ref().unwrap().keep;
+    assert!(keep[2] < before[2] - 1.0 && keep[1] > before[1] + 1.0, "trimmed on the right and the bottom: {keep:?} of {before:?}");
+    h.key_press(egui::Key::Enter);
+    h.run_steps(4);
+    let doc = h.state().session.get(id).unwrap();
+    assert_eq!(doc.can_undo(), Some("Crop image"));
+    let im = &doc.page_images(0)[0];
+    assert_eq!(im.rect, [0.0, 0.0, 80.0, 40.0], "the placement is not scaled");
+    let v = im.visible_rect.unwrap();
+    assert!((v[2] - 60.0).abs() < 1.5 && (v[1] - 10.0).abs() < 1.5, "kept {v:?}");
+    assert!(h.state().views[0].image_selection.as_ref().is_some_and(|s| s.crop.is_none()), "crop mode ends");
+    // Esc leaves it.
+    h.state_mut().views[0].image_selection.as_mut().unwrap().crop = Some(pdfcraft_ui_egui::CropMode::new([10.0, 10.0, 20.0, 20.0]));
+    h.run_steps(2);
+    h.key_press(egui::Key::Escape);
+    h.run_steps(3);
+    let doc = h.state().session.get(id).unwrap();
+    assert_eq!(doc.page_images(0)[0].visible_rect.unwrap(), v);
+    assert!(h.state().views[0].image_selection.as_ref().is_none_or(|s| s.crop.is_none()));
+}
+
+/// Organize pages has Acrobat's panel whenever the grid shows, however it was opened, and the
+/// panel's Close ends Organize: the grid closes and All tools comes back.
+#[test]
+fn organize_panel_comes_with_the_grid_and_closes_it() {
+    let mut h = organize(3);
+    h.get_by_label("Insert");
+    h.get_by_label("Bates numbering");
+    h.get_by_label("Page properties");
+    h.get_by_label("Close panel").click();
+    h.run_steps(3);
+    assert!(!h.state().views[0].organize, "Close ends Organize");
+    assert_eq!(h.state().left, pdfcraft_ui_egui::LeftPanel::AllTools);
+    assert!(h.query_by_label("Page properties").is_none(), "the panel is gone");
+}
+
+/// Leaving Organize (a page opened from the grid, or the grid's Close) goes back to the
+/// workspace's panel: under the Edit tab, the Edit panel, not All tools.
+#[test]
+fn leaving_organize_goes_back_to_the_workspace_panel() {
+    use pdfcraft_ui_egui::{LeftPanel, Mode};
+    let mut h = harness(3, |_| {});
+    h.state_mut().mode = Mode::Edit;
+    h.state_mut().left = LeftPanel::Tool("edit");
+    h.run_steps(2);
+    h.state_mut().left = LeftPanel::Tool("organize");
+    h.state_mut().views[0].organize = true;
+    h.run_steps(3);
+    h.get_by_label("Pages selected".to_uppercase().as_str());
+    // What opening a page from the grid does.
+    h.state_mut().views[0].organize = false;
+    h.run_steps(3);
+    assert_eq!(h.state().left, LeftPanel::Tool("edit"), "back to the Edit panel");
+    // The same from All tools goes back to All tools.
+    h.state_mut().mode = Mode::AllTools;
+    h.state_mut().left = LeftPanel::Tool("organize");
+    h.state_mut().views[0].organize = true;
+    h.run_steps(3);
+    h.state_mut().views[0].organize = false;
+    h.run_steps(3);
+    assert_eq!(h.state().left, LeftPanel::AllTools);
+}
diff --git a/crates/ui-egui/tests/fill_sign.rs b/crates/ui-egui/tests/fill_sign.rs
index 12f4ea813..27fd6dd8a 100644
--- a/crates/ui-egui/tests/fill_sign.rs
+++ b/crates/ui-egui/tests/fill_sign.rs
@@ -305,6 +305,30 @@ fn changing_saved_signatures_and_initials_preserves_placed_marks() {
     assert_eq!(again.initials, Some(SavedSig::Typed("GH".into())));
 }
 
+#[test]
+fn undo_button_and_ctrl_z_take_back_one_drawn_stroke_at_a_time() {
+    let mut h = harness();
+    let drawn = SavedSig::Drawn(vec![vec![[0.1, 0.1], [0.5, 0.2]], vec![[0.2, 0.3], [0.6, 0.1]], vec![[0.7, 0.2], [0.9, 0.3]]]);
+    h.state_mut().signature = Some(drawn);
+    assert!(h.state_mut().execute("sign.fill.signature.change"));
+    h.run_steps(2);
+    h.get_by_label("Undo").click();
+    h.run_steps(2);
+    assert_eq!(h.state().signature_draft.strokes.len(), 2);
+    h.key_press(egui::Key::Z);
+    h.run_steps(2);
+    assert_eq!(h.state().signature_draft.strokes.len(), 2, "plain Z is not undo");
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::Z);
+    h.run_steps(2);
+    assert_eq!(h.state().signature_draft.strokes.len(), 1);
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::Z);
+    h.run_steps(2);
+    assert!(h.state().signature_draft.strokes.is_empty());
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::Z);
+    h.run_steps(2);
+    assert!(h.state().signature_draft.strokes.is_empty());
+}
+
 #[test]
 fn changing_drawn_signatures_can_be_cancelled_or_switched_to_type() {
     let mut h = harness();
diff --git a/crates/ui-egui/tests/fonts.rs b/crates/ui-egui/tests/fonts.rs
index 63a31d4cf..9cfa36c8a 100644
--- a/crates/ui-egui/tests/fonts.rs
+++ b/crates/ui-egui/tests/fonts.rs
@@ -193,6 +193,32 @@ fn system_fallback_covers_telugu() {
     assert!(layout_widths(&mut fonts, TELUGU).iter().all(|w| w.is_finite() && *w > 0.0));
 }
 
+/// On a machine with installed Sinhala and Tamil fonts, the installed definitions include them
+/// and Sinhala and Tamil text, such as a file name, has glyphs instead of boxes (#1688). macOS
+/// always ships Sinhala Sangam MN and Tamil Sangam MN, so there the test never skips.
+#[test]
+fn system_fallback_covers_sinhala_and_tamil() {
+    for (name, text) in [(theme::SYSTEM_SINHALA_FALLBACK, "ශ්‍රී ලංකා ගොනුව"), (theme::SYSTEM_TAMIL_FALLBACK, "தமிழ் கோப்பு")]
+    {
+        assert!(!theme::font_definitions().font_data.contains_key(name));
+        let defs = theme::installed_font_definitions(theme::CjkPreference::Default);
+        let off = std::env::var_os("PDFCRAFT_SYSTEM_FONTS").is_some_and(|v| v == "0");
+        if !defs.font_data.contains_key(name) && (off || !cfg!(target_os = "macos")) {
+            eprintln!("skipping {name}: no installed fallback font (or PDFCRAFT_SYSTEM_FONTS=0)");
+            assert!(defs.families.values().all(|stack| !stack.iter().any(|n| n == name)));
+            continue;
+        }
+        for (family, stack) in &defs.families {
+            assert_eq!(stack.iter().filter(|n| *n == name).count(), 1, "{family:?}: {stack:?}");
+        }
+        let mut fonts = Fonts::new(TextOptions::default(), defs);
+        for id in families() {
+            assert!(fonts.has_glyphs(&id, text), "{id:?} lacks {text}");
+        }
+        assert!(layout_widths(&mut fonts, text).iter().all(|w| w.is_finite() && *w > 0.0));
+    }
+}
+
 /// The Han characters of a catalog's translations.
 fn catalog_han(catalog: &str) -> String {
     let mut han: Vec<char> = catalog
@@ -265,12 +291,16 @@ fn ui_fonts_work_without_craft_fonts() {
 }
 
 /// Latin- and Cyrillic-script catalogs (Czech, Brazilian Portuguese, German, Spanish, French, Russian, Bulgarian, Hungarian, Ukrainian, Italian, Slovene) are drawn entirely by the app's own faces
-/// (Inter, JetBrains Mono): no letter falls through to egui's defaults or a CJK fallback. (egui's
+/// (Inter, JetBrains Mono with Inter fallback): no letter falls through to egui's defaults or a CJK fallback. (egui's
 /// `has_glyphs` can't answer this: with only the primary face it is also the replacement face.)
 #[test]
 fn primary_ui_fonts_cover_latin_and_cyrillic_catalogs() {
     use skrifa::MetadataProvider as _;
     let defs = theme::font_definitions();
+    assert_eq!(&defs.families[&FontFamily::Monospace][..2], ["JetBrainsMono", "Inter"]);
+    let fallback = &defs.font_data["Inter"];
+    let fallback_font = skrifa::FontRef::from_index(&fallback.font, fallback.index).unwrap();
+    let fallback_charmap = fallback_font.charmap();
     for (code, catalog) in [
         ("cs", include_str!("../src/i18n/cs.tsv")),
         ("el", include_str!("../src/i18n/el.tsv")),
@@ -287,6 +317,7 @@ fn primary_ui_fonts_cover_latin_and_cyrillic_catalogs() {
         ("tr", include_str!("../src/i18n/tr.tsv")),
         ("sl", include_str!("../src/i18n/sl.tsv")),
         ("lt", include_str!("../src/i18n/lt.tsv")),
+        ("vi", include_str!("../src/i18n/vi.tsv")),
     ] {
         let mut text = String::from("áčďéěíňóřšťúůýžÁČĎÉĚÍŇÓŘŠŤÚŮÝŽãõçâêôàÃÕÇÂÊÔÀñÑüÜäÄöÖőűß„“¿¡«»…ґҐєЄіІїЇәғқңөұүһӘҒҚҢӨҰҮҺ");
         for line in catalog.lines().filter(|l| !l.starts_with('#')) {
@@ -298,7 +329,8 @@ fn primary_ui_fonts_cover_latin_and_cyrillic_catalogs() {
             let data = &defs.font_data[name];
             let font = skrifa::FontRef::from_index(&data.font, data.index).unwrap();
             let charmap = font.charmap();
-            let mut missing: Vec<char> = text.chars().filter(|c| charmap.map(*c).is_none()).collect();
+            let mut missing: Vec<char> =
+                text.chars().filter(|c| charmap.map(*c).is_none() && (name != "JetBrainsMono" || fallback_charmap.map(*c).is_none())).collect();
             missing.sort_unstable();
             missing.dedup();
             assert!(missing.is_empty(), "{code}: {name} lacks {missing:?}");
diff --git a/crates/ui-egui/tests/forms.rs b/crates/ui-egui/tests/forms.rs
index 34e3300c2..96a0a6a11 100644
--- a/crates/ui-egui/tests/forms.rs
+++ b/crates/ui-egui/tests/forms.rs
@@ -122,6 +122,45 @@ fn tabbing_into_a_filled_field_selects_it_so_typing_replaces() {
     assert_eq!(value(&h, "city"), ["Lyon"]);
 }
 
+#[test]
+fn dragging_over_another_fields_text_focuses_it_and_selects_from_the_press() {
+    // Issue #2213: with the caret in one field, a drag over another field's text selected
+    // nothing; the field opened only on a click.
+    let mut h = harness();
+    click_field(&mut h, "name", 0);
+    h.event(egui::Event::Text("Ada Lovelace".into()));
+    h.run_steps(1);
+    h.key_press(egui::Key::Enter);
+    h.run_steps(3);
+    click_field(&mut h, "city", 0);
+    assert_eq!(h.state().views[0].forms.focus.as_ref().map(|f| f.name.as_str()), Some("city"));
+    let (rect, id) = {
+        let s = h.state();
+        let doc = s.session.get(s.views[0].id).unwrap();
+        let f = doc.form.iter().find(|f| f.name == "name").unwrap();
+        let rect = pdfcraft_ui_egui::forms_ui::field_screen_rect(&s.views[0], &doc.info, f, 0).expect("on screen");
+        (rect, egui::Id::new(("form-field", s.views[0].id.0, "name", 0usize)))
+    };
+    // From inside the first word to past the end of the text.
+    let (from, to) = (egui::pos2(rect.left() + 30.0, rect.center().y), egui::pos2(rect.right() - 8.0, rect.center().y));
+    h.hover_at(from);
+    h.run_steps(1);
+    h.drag_at(from);
+    h.run_steps(1);
+    for k in 1..=4 {
+        h.hover_at(from.lerp(to, k as f32 / 4.0));
+        h.run_steps(1);
+    }
+    h.drop_at(to);
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].forms.focus.as_ref().map(|f| f.name.as_str()), Some("name"), "the press moved the focus");
+    let n = "Ada Lovelace".chars().count();
+    let range = egui::TextEdit::load_state(&h.ctx, id).and_then(|s| s.cursor.char_range()).expect("a selection in the field");
+    // "Ad|a": not the caret at the end that a newly focused editor gets on its own.
+    assert_eq!(range.secondary.index.0, 2, "anchored where the drag started: {range:?}");
+    assert_eq!(range.primary.index.0, n, "and extended to where it ended: {range:?}");
+}
+
 #[test]
 fn date_fields_offer_a_calendar() {
     use egui_kittest::kittest::Queryable;
@@ -182,6 +221,19 @@ fn saved_value(path: &std::path::Path, name: &str) -> Vec<String> {
     app.session.get(app.views[0].id).unwrap().form.iter().find(|f| f.name == name).unwrap().value.clone()
 }
 
+/// Step frames until the save has written `path`, instead of assuming it is there after a fixed
+/// number of frames. The write is atomic, so the file appears only when it is complete.
+fn wait_for_file(h: &mut Harness<'static, PdfCraftApp>, path: &std::path::Path) {
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(30);
+    while !path.exists() {
+        assert!(std::time::Instant::now() < deadline, "the save never wrote {}", path.display());
+        h.run_steps(1);
+        std::thread::sleep(std::time::Duration::from_millis(10));
+    }
+    // One more frame so the app has seen its own save before the test looks at its state.
+    h.run_steps(1);
+}
+
 fn scratch(name: &str) -> std::path::PathBuf {
     let dir = std::env::temp_dir().join(format!("pdfcraft-forms-{name}-{}", std::process::id()));
     let _ = std::fs::remove_dir_all(&dir);
@@ -257,7 +309,7 @@ fn tabbing_back_to_the_same_field_then_saving_keeps_the_committed_value() {
             h.run_steps(3);
             h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::S);
         }
-        h.run_steps(4);
+        wait_for_file(&mut h, &out);
         assert_eq!(saved_value(&out, "qty"), ["42"], "{case}: saving cannot restore the old value");
         assert_eq!(value(&h, "qty"), ["42"], "{case}");
         // One typing action is one history entry, even after saving. Escape closes the
@@ -383,6 +435,52 @@ fn validated_form() -> Vec<u8> {
     ])
 }
 
+#[test]
+fn pressing_another_text_field_validates_the_refused_value_once() {
+    // The press commits `qty`; its release must not commit (and alert) a second time.
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("order.pdf", None, validated_form_with_note()).unwrap();
+        app.set_option("left", "closed").unwrap();
+        app.set_option("zoom", "150").unwrap();
+        app
+    });
+    h.run_steps(6);
+    click_field(&mut h, "qty", 0);
+    h.event(egui::Event::Text("500".into()));
+    h.run_steps(2);
+    let p = {
+        let s = h.state();
+        let doc = s.session.get(s.views[0].id).unwrap();
+        let f = doc.form.iter().find(|f| f.name == "note").unwrap();
+        pdfcraft_ui_egui::forms_ui::field_screen_rect(&s.views[0], &doc.info, f, 0).expect("on screen").center()
+    };
+    h.hover_at(p);
+    h.run_steps(1);
+    h.drag_at(p);
+    h.run_steps(2);
+    assert!(h.state().toast.is_some(), "the press committed 4500 and the script refused it");
+    h.state_mut().toast = None;
+    h.drop_at(p);
+    h.run_steps(3);
+    assert_eq!(h.state().toast, None, "the release did not validate it again");
+    let focus = h.state().views[0].forms.focus.clone().expect("the refused field stays open");
+    assert_eq!((focus.name.as_str(), focus.text.as_str()), ("qty", "4500"));
+}
+
+/// `validated_form` plus a plain text field, `note`, under `qty`.
+fn validated_form_with_note() -> Vec<u8> {
+    pdf_from_objects(&[
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R 6 0 R] /DA (/Helv 0 Tf 0 g) /DR << /Font << /Helv 5 0 R >> >> >> >>",
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 400] >>",
+        "<< /Type /Page /Parent 2 0 R /Annots [4 0 R 6 0 R] >>",
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (qty) /V (4) /Rect [20 350 280 372] /P 3 0 R /F 4 /AA << /V << /S /JavaScript /JS (if (event.value > 100) { app.alert('At most 100'); event.rc = false; }) >> >> >>",
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >>",
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (note) /Rect [20 300 280 322] /P 3 0 R /F 4 >>",
+    ])
+}
+
 fn pdf_from_objects(objs: &[&str]) -> Vec<u8> {
     let mut out = b"%PDF-1.7\n".to_vec();
     let mut offsets = Vec::new();
@@ -399,6 +497,78 @@ fn pdf_from_objects(objs: &[&str]) -> Vec<u8> {
     out
 }
 
+/// Fields that sit on text, where the text layer would show its I-beam: a checked box drawn
+/// with an "X" (appearance text is page text), an empty check box and a text field over printed
+/// words (character-sheet dots are set on printed "OOOOO"), and a printed word with no field.
+fn fields_over_text() -> Vec<u8> {
+    let content = "BT /F1 12 Tf 20 250 Td (Strength) Tj ET BT /F1 12 Tf 20 200 Td (Background) Tj ET BT /F1 12 Tf 20 150 Td (Notes) Tj ET";
+    let check = "q BT /Helv 11 Tf 2 2 Td (X) Tj ET Q";
+    let objs = [
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R 5 0 R 6 0 R] /DA (/Helv 0 Tf 0 g) /DR << /Font << /Helv 8 0 R /ZaDb 9 0 R >> >> >> >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 400] >>".to_string(),
+        "<< /Type /Page /Parent 2 0 R /Contents 7 0 R /Resources << /Font << /F1 8 0 R >> >> /Annots [4 0 R 5 0 R 6 0 R] >>".to_string(),
+        "<< /Type /Annot /Subtype /Widget /FT /Btn /T (agree) /V /Yes /AS /Yes /Rect [20 300 32 312] /P 3 0 R /F 4 /DA (/Helv 11 Tf 0 g) /AP << /N << /Yes 10 0 R >> >> >>".to_string(),
+        "<< /Type /Annot /Subtype /Widget /FT /Btn /T (strength) /V /Off /AS /Off /Rect [20 246 70 262] /P 3 0 R /F 4 /MK << /CA (l) >> /DA (/ZaDb 11 Tf 0 g) >>".to_string(),
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (background) /Rect [20 196 200 214] /P 3 0 R /F 4 >>".to_string(),
+        format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len() + 1),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >>".to_string(),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /ZapfDingbats >>".to_string(),
+        format!(
+            "<< /Type /XObject /Subtype /Form /BBox [0 0 12 12] /Resources << /Font << /Helv 8 0 R >> >> /Length {} >>\nstream\n{check}\nendstream",
+            check.len() + 1
+        ),
+    ];
+    pdf_from_objects(&objs.iter().map(String::as_str).collect::<Vec<_>>())
+}
+
+#[test]
+fn buttons_over_text_show_the_pointing_hand_not_the_i_beam() {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("sheet.pdf", None, fields_over_text()).unwrap();
+        app.set_option("left", "closed").unwrap();
+        app.set_option("zoom", "150").unwrap();
+        app
+    });
+    h.run_steps(6);
+    let (agree, strength, background) = {
+        let s = h.state();
+        let doc = s.session.get(s.views[0].id).unwrap();
+        let at = |name: &str| {
+            let f = doc.form.iter().find(|f| f.name == name).unwrap();
+            pdfcraft_ui_egui::forms_ui::field_screen_rect(&s.views[0], &doc.info, f, 0).expect("on screen")
+        };
+        (at("agree"), at("strength"), at("background"))
+    };
+    let cursor_at = |h: &mut Harness<'static, PdfCraftApp>, p: egui::Pos2| {
+        h.hover_at(p);
+        h.run_steps(2);
+        h.output().platform_output.cursor_icon
+    };
+    // "Notes" (baseline y 150) lies 50 pt below "Background" (y 200), with no field on it.
+    // Wait for the page text: the I-beam over it shows the text layer is live.
+    let scale = background.width() / 180.0;
+    let notes = egui::pos2(background.left() + 12.0 * scale, background.bottom() + (196.0 - 154.0) * scale);
+    let mut over_notes = egui::CursorIcon::Default;
+    for _ in 0..100 {
+        over_notes = cursor_at(&mut h, notes);
+        if over_notes == egui::CursorIcon::Text {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(10));
+    }
+    assert_eq!(over_notes, egui::CursorIcon::Text, "printed text off any field shows the I-beam");
+    use egui::CursorIcon::{PointingHand, Text};
+    let over_fields = [agree, strength, background].map(|r| cursor_at(&mut h, r.center()));
+    assert_eq!(over_fields, [PointingHand, PointingHand, Text], "check boxes are buttons, not text to select; a text field keeps the I-beam");
+    // Clicking still toggles them.
+    click_field(&mut h, "agree", 0);
+    assert!(value(&h, "agree").is_empty());
+    click_field(&mut h, "strength", 0);
+    assert_eq!(value(&h, "strength"), ["Yes"]);
+}
+
 #[test]
 fn a_rejected_value_keeps_the_typing_and_stops_the_save() {
     let dir = scratch("rejected");
@@ -701,3 +871,140 @@ fn the_fields_panel_lists_a_field_on_a_missing_page_as_unplaced() {
     h.get_by_label("Unplaced");
     assert_eq!(h.query_all_by_label("orphan").count(), 1);
 }
+
+#[test]
+fn list_box_clicks_select_directly_and_ctrl_click_toggles_multi() {
+    let bytes = pdf_from_objects(&[
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R 5 0 R] /DA (/Helv 10 Tf 0 g) /DR << /Font << /Helv 6 0 R >> >> >> >>",
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 400 400] >>",
+        "<< /Type /Page /Parent 2 0 R /Annots [4 0 R 5 0 R] >>",
+        "<< /Type /Annot /Subtype /Widget /FT /Ch /T (ListOne) /Opt [(Red) (Green) (Blue)] /Rect [50 250 200 320] /P 3 0 R /F 4 >>",
+        "<< /Type /Annot /Subtype /Widget /FT /Ch /T (ListMulti) /Ff 2097152 /Opt [(Mon) (Tue) (Wed) (Thu) (Fri)] /Rect [50 100 200 170] /P 3 0 R /F 4 >>",
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >>",
+    ]);
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("lists.pdf", None, bytes).unwrap();
+        app.set_option("left", "closed").unwrap();
+        app.set_option("zoom", "100").unwrap();
+        app
+    });
+    h.run_steps(4);
+
+    // Click row 1 (Green) in ListOne
+    let r_one = {
+        let s = h.state();
+        let doc = s.session.get(s.views[0].id).unwrap();
+        let f = doc.form.iter().find(|f| f.name == "ListOne").unwrap();
+        pdfcraft_ui_egui::forms_ui::field_screen_rect(&s.views[0], &doc.info, f, 0).expect("on screen")
+    };
+    let zoom_one = r_one.height() / 70.0;
+    let p_green = egui::pos2(r_one.center().x, r_one.min.y + 19.0 * zoom_one);
+    h.hover_at(p_green);
+    h.run_steps(1);
+    h.drag_at(p_green);
+    h.run_steps(1);
+    h.drop_at(p_green);
+    h.run_steps(3);
+
+    assert_eq!(value(&h, "ListOne"), ["Green"], "clicking row 1 in ListOne selected Green");
+
+    // Click row 1 (Tue) in ListMulti
+    let r_multi = {
+        let s = h.state();
+        let doc = s.session.get(s.views[0].id).unwrap();
+        let f = doc.form.iter().find(|f| f.name == "ListMulti").unwrap();
+        pdfcraft_ui_egui::forms_ui::field_screen_rect(&s.views[0], &doc.info, f, 0).expect("on screen")
+    };
+    let zoom_multi = r_multi.height() / 70.0;
+    let p_tue = egui::pos2(r_multi.center().x, r_multi.min.y + 19.0 * zoom_multi);
+    h.hover_at(p_tue);
+    h.run_steps(1);
+    h.drag_at(p_tue);
+    h.run_steps(1);
+    h.drop_at(p_tue);
+    h.run_steps(3);
+
+    assert_eq!(value(&h, "ListMulti"), ["Tue"], "clicking row 1 in ListMulti selected Tue");
+
+    // Ctrl/Cmd-click row 3 (Thu) in ListMulti
+    let p_thu = egui::pos2(r_multi.center().x, r_multi.min.y + 42.0 * zoom_multi);
+    h.hover_at(p_thu);
+    h.run_steps(1);
+    h.event(egui::Event::PointerMoved(p_thu));
+    h.event(egui::Event::ModifiersChanged(egui::Modifiers::COMMAND));
+    h.event(egui::Event::PointerButton { pos: p_thu, button: egui::PointerButton::Primary, pressed: true, modifiers: egui::Modifiers::COMMAND });
+    h.run_steps(1);
+    h.event(egui::Event::PointerButton { pos: p_thu, button: egui::PointerButton::Primary, pressed: false, modifiers: egui::Modifiers::COMMAND });
+    h.event(egui::Event::ModifiersChanged(egui::Modifiers::NONE));
+    h.run_steps(3);
+
+    assert_eq!(value(&h, "ListMulti"), ["Tue", "Thu"], "Ctrl-clicking Thu toggled it on, keeping Tue");
+}
+
+/// Auto-size (`0 Tf`, inherited from the AcroForm) single-line and multiline fields, and a fixed 10 pt one.
+fn auto_size_form() -> Vec<u8> {
+    pdf_from_objects(&[
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R 6 0 R 7 0 R] /DA (/Helv 0 Tf 0 g) /DR << /Font << /Helv 5 0 R >> >> >> >>",
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 400] >>",
+        "<< /Type /Page /Parent 2 0 R /Annots [4 0 R 6 0 R 7 0 R] >>",
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (short) /Rect [20 350 220 364] /P 3 0 R /F 4 >>",
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >>",
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (notes) /Ff 4096 /Rect [20 270 140 320] /P 3 0 R /F 4 >>",
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (fixed) /DA (/Helv 10 Tf 0 g) /Rect [20 220 120 234] /P 3 0 R /F 4 >>",
+    ])
+}
+
+fn auto_size_harness() -> Harness<'static, PdfCraftApp> {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("auto.pdf", None, auto_size_form()).unwrap();
+        app.set_option("left", "closed").unwrap();
+        app.set_option("zoom", "150").unwrap();
+        app
+    });
+    h.run_steps(6);
+    h
+}
+
+/// The on-screen size for `text` in the field, and how wide (single-line) or tall (multiline,
+/// wrapped at the box) that text is in the screen font, against the room inside the box (pt).
+fn on_screen_fit(h: &Harness<'static, PdfCraftApp>, name: &str, text: &str) -> (f32, f32, f32) {
+    let s = h.state();
+    let f = s.session.get(s.views[0].id).unwrap().form.iter().find(|f| f.name == name).unwrap().clone();
+    let w = f.widgets[0].clone();
+    let painter = egui::Painter::new(h.ctx.clone(), egui::LayerId::background(), egui::Rect::EVERYTHING);
+    let size = pdfcraft_ui_egui::forms_ui::field_text_size(&painter, &f, &w, text);
+    let (bw, bh) = ((w.rect[2] - w.rect[0]) as f32 - 6.0, (w.rect[3] - w.rect[1]) as f32 - 6.0);
+    let font = egui::FontId::proportional(size);
+    if f.has(pdfcraft_engine::field_flags::MULTILINE) {
+        (size, painter.layout(text.to_string(), font, egui::Color32::BLACK, bw).size().y, bh)
+    } else {
+        (size, painter.layout_no_wrap(text.to_string(), font, egui::Color32::BLACK).size().x, bw)
+    }
+}
+
+#[test]
+fn auto_size_fields_shrink_and_wrap_typed_text_to_fit_their_box() {
+    let mut h = auto_size_harness();
+    let long = "Weekly progress and diligence: CoBank refi, IL and Redwood Falls";
+    click_field(&mut h, "short", 0);
+    h.event(egui::Event::Text(long.into()));
+    h.run_steps(2);
+    let typed = h.state().views[0].forms.focus.clone().expect("the editor is open").text;
+    assert_eq!(typed, long);
+    let (size, used, room) = on_screen_fit(&h, "short", &typed);
+    assert!(size > 4.0 && size < 8.0 / 1.15, "a long value shrinks in the short box: {size} pt");
+    assert!(used <= room + 0.5, "and fits its width: {used} > {room}");
+    let (short_size, ..) = on_screen_fit(&h, "short", "Hi");
+    assert!(short_size > size, "short text keeps a larger size: {short_size}");
+
+    let (size, used, room) = on_screen_fit(&h, "notes", long);
+    assert!(used <= room + 0.5, "multiline text wraps and shrinks to the box height: {used} > {room} at {size} pt");
+    assert!(size >= 6.0, "without shrinking further than it must: {size} pt");
+
+    // An explicit size is kept, as in Acrobat: the text may then run past the box.
+    assert_eq!(on_screen_fit(&h, "fixed", long).0, 10.0);
+}
diff --git a/crates/ui-egui/tests/prepare.rs b/crates/ui-egui/tests/prepare.rs
index b23f1a9f8..eb25e42a0 100644
--- a/crates/ui-egui/tests/prepare.rs
+++ b/crates/ui-egui/tests/prepare.rs
@@ -250,6 +250,69 @@ fn options_tab_sets_the_check_box_style() {
     assert_eq!(s.session.get(s.views[0].id).unwrap().field_check_style("agree"), Some(CheckStyle::Cross));
 }
 
+#[test]
+fn dropdown_alignment_is_editable_and_preserved() {
+    choice_alignment(pdfcraft_engine::NewField::Combo { options: vec!["One".into(), "Two".into()], editable: false }, "Center", 1);
+}
+
+#[test]
+fn list_box_alignment_is_editable_and_preserved() {
+    choice_alignment(pdfcraft_engine::NewField::List { options: vec!["One".into(), "Two".into()], multi: true }, "Left", 0);
+}
+
+fn choice_alignment(kind: pdfcraft_engine::NewField, label: &str, quadding: i64) {
+    use pdfcraft_engine::{Edit, FieldProps, FieldValue};
+    let mut h = harness();
+    h.state_mut().apply_edit(Edit::AddField { page: 0, rect: [40.0, 260.0, 240.0, 310.0], kind, name: Some("aligned_choice".into()) });
+    h.state_mut()
+        .apply_edit(Edit::SetFieldProps { name: "aligned_choice".into(), props: Box::new(FieldProps { quadding: Some(2), ..Default::default() }) });
+    h.state_mut().apply_edit(Edit::SetFieldValue { name: "aligned_choice".into(), value: FieldValue::Choice(vec!["Two".into()]) });
+    let field = |h: &Harness<'static, PdfCraftApp>| {
+        let app = h.state();
+        app.session.get(app.views[0].id).unwrap().form.iter().find(|f| f.name == "aligned_choice").unwrap().clone()
+    };
+    let original = field(&h);
+    h.state_mut().open_field_props("aligned_choice", 0);
+    h.run_steps(2);
+    h.get_by_label("Options").click();
+    h.run_steps(2);
+    h.get_by_label("Alignment:");
+    // The imported right alignment is displayed and unchanged until a choice is made.
+    h.get_by_value("Right").click();
+    h.run_steps(2);
+    h.get_by_label(label).click();
+    h.run_steps(2);
+    h.get_by_label("Cancel").click();
+    h.run_steps(2);
+    assert_eq!(field(&h).quadding, 2, "cancel keeps the existing /Q");
+    h.state_mut().open_field_props("aligned_choice", 0);
+    h.run_steps(2);
+    h.get_by_label("Options").click();
+    h.run_steps(2);
+    h.get_by_value("Right").click();
+    h.run_steps(2);
+    h.get_by_label(label).click();
+    h.run_steps(2);
+    h.get_by_label("OK").click();
+    h.run_steps(3);
+    let changed = field(&h);
+    assert_eq!(changed.quadding, quadding);
+    assert_eq!((changed.options, changed.value, changed.flags), (original.options, original.value, original.flags));
+    let app = h.state();
+    let id = app.views[0].id;
+    assert_eq!(app.session.get(id).unwrap().can_undo(), Some("Change field properties"));
+    let bytes = app.session.save_bytes(id).unwrap();
+    let mut reopened = pdfcraft_engine::Session::new();
+    let reopened_id = reopened.open("saved.pdf", None, bytes, None).unwrap();
+    assert_eq!(reopened.get(reopened_id).unwrap().form.iter().find(|f| f.name == "aligned_choice").unwrap().quadding, quadding);
+    h.state_mut().execute("edit.undo");
+    h.run_steps(3);
+    assert_eq!(field(&h).quadding, 2);
+    h.state_mut().execute("edit.redo");
+    h.run_steps(3);
+    assert_eq!(field(&h).quadding, quadding);
+}
+
 #[test]
 fn options_tab_sets_flags_alignment_and_defaults() {
     use pdfcraft_engine::field_flags as ff;
diff --git a/crates/ui-egui/tests/print.rs b/crates/ui-egui/tests/print.rs
index 739c04ee9..f3d10238c 100644
--- a/crates/ui-egui/tests/print.rs
+++ b/crates/ui-egui/tests/print.rs
@@ -1,5 +1,6 @@
 //! The Print dialog in the real shell (egui_kittest): settings, preview sheets, Save as PDF.
 
+use egui::accesskit::Role;
 use egui_kittest::Harness;
 use egui_kittest::kittest::{NodeT, Queryable};
 use pdfcraft_ui_egui::{Dialog, PdfCraftApp};
@@ -243,14 +244,16 @@ fn print_dialog_shows_the_printer_driver_options() {
     h.get_by_label("Printer properties");
     h.get_by_label("Media");
     h.get_by_label("Paper tray");
-    assert_eq!(h.state().print_draft.job("form.pdf").options, [("InputSlot".to_string(), "Tray2".to_string())]);
+    // The selected sheet's media is always sent, independently of changed driver properties.
+    let media = vec![("media".to_string(), "Letter".to_string())];
+    assert_eq!(h.state().print_draft.job("form.pdf").options, [("InputSlot".to_string(), "Tray2".to_string()), media[0].clone()]);
     h.get_by_label("Reset to printer defaults").click();
     h.run_steps(2);
-    assert!(h.state().print_draft.job("form.pdf").options.is_empty(), "defaults are not sent");
+    assert_eq!(h.state().print_draft.job("form.pdf").options, media, "driver defaults are not sent; selected paper is retained");
     // Options read for another printer never go with this one's job.
     h.state_mut().print_draft.driver_choices.insert("InputSlot".into(), "Tray2".into());
     h.state_mut().print_draft.printer = Some("Other_Queue".into());
-    assert!(h.state().print_draft.job("form.pdf").options.is_empty());
+    assert_eq!(h.state().print_draft.job("form.pdf").options, media, "another queue must not inherit driver options");
 }
 
 /// The desktop app lists printers in the background (PowerShell on Windows takes a second or
@@ -277,6 +280,11 @@ fn printers_listed_in_the_background_preselect_the_default_unless_one_was_picked
     assert_eq!(h.state().dialog, Some(Dialog::Print), "the dialog doesn't wait for the printers");
     assert!(h.state().print_draft.printers_loading);
     assert_eq!(h.state().print_draft.printer, None);
+    // Nothing is known yet (#160): the dialog says it is looking, and Print waits instead of
+    // saving a PDF.
+    h.get_by_value("Looking for printers…");
+    assert!(h.get_by_role_and_label(Role::Button, "Print").accesskit_node().is_disabled(), "Print waits for the list");
+    assert!(h.query_by_label("Save as PDF").is_none(), "not offered as the choice while looking");
     drop(hold);
     let deadline = std::time::Instant::now() + std::time::Duration::from_secs(10);
     while h.state().print_draft.printers_loading && std::time::Instant::now() < deadline {
@@ -373,3 +381,48 @@ fn a_printer_without_two_sided_printing_points_to_its_properties() {
     h.run_steps(2);
     h.get_by_label_contains(note);
 }
+
+/// Print as image (Acrobat's Advanced Print Setup) is a choice in the Print dialog's Advanced
+/// section: the saved print-ready PDF carries the page as a picture, no text.
+#[test]
+fn print_as_image_is_an_advanced_choice_that_saves_pictures() {
+    let mut h = harness();
+    assert!(h.state_mut().execute("print.dialog"));
+    h.run_steps(3);
+    h.get_by_label("Advanced".to_uppercase().as_str()).click();
+    h.run_steps(2);
+    h.get_by_label("Print as image").click();
+    h.run_steps(2);
+    assert!(h.state().print_draft.as_image);
+    let out = std::env::temp_dir().join(format!("pdfcraft-print-image-test-{}.pdf", std::process::id()));
+    h.state_mut().save_override = Some(out.to_string_lossy().into_owned());
+    h.state_mut().print_draft.printer = None;
+    h.run_steps(1);
+    h.get_by_label("Save as PDF").click();
+    h.run_steps(3);
+    assert_eq!(h.state().dialog, None);
+    let bytes = std::fs::read(&out).expect("saved");
+    let doc = pdfcraft_cos::Document::open(std::sync::Arc::new(bytes)).unwrap();
+    assert_eq!(pdfcraft_model::pages(&doc).len(), 1);
+    let pictures =
+        doc.scan_objects().filter(|(_, o)| matches!(&**o, pdfcraft_cos::Object::Stream(st) if st.dict.name(b"Subtype") == Some(b"Image"))).count();
+    assert_eq!(pictures, 1, "the page is one picture");
+    let _ = std::fs::remove_file(out);
+}
+
+/// The spooler answering with no printers at all says so (#160), and Save as PDF still works.
+#[test]
+fn an_empty_printer_list_says_none_were_found() {
+    use std::sync::Arc;
+    let mut h = harness();
+    h.state_mut().printer_source = Some(Arc::new(Vec::new));
+    assert!(h.state_mut().execute("print.dialog"));
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(10);
+    while h.state().print_draft.printers_loading && std::time::Instant::now() < deadline {
+        h.run_steps(1);
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    h.run_steps(2);
+    h.get_by_label_contains("No printers were found");
+    assert!(!h.get_by_role_and_label(Role::Button, "Save as PDF").accesskit_node().is_disabled());
+}
diff --git a/crates/ui-egui/tests/recovery.rs b/crates/ui-egui/tests/recovery.rs
index 7d356744a..807261c8c 100644
--- a/crates/ui-egui/tests/recovery.rs
+++ b/crates/ui-egui/tests/recovery.rs
@@ -41,8 +41,9 @@ fn store(tag: &str) -> RecoveryStore {
     RecoveryStore::new(dir)
 }
 
+/// Snapshot files (the PDF and its sidecar), not the running instances' lock files.
 fn files_in(s: &RecoveryStore) -> usize {
-    std::fs::read_dir(s.dir()).map(|d| d.count()).unwrap_or(0)
+    std::fs::read_dir(s.dir()).map(|d| d.flatten().filter(|e| e.path().extension().and_then(|x| x.to_str()) != Some("lock")).count()).unwrap_or(0)
 }
 
 /// A session that edits a document, autosaves, and then "crashes" (is dropped).
@@ -269,6 +270,7 @@ fn a_failed_metadata_write_keeps_the_completed_snapshot_recoverable() {
         path: Some("original.pdf".into()),
         saved_at: 1,
         encrypted: false,
+        instance: None,
     };
     // A directory at the sidecar path makes its atomic rename fail after the PDF was written.
     std::fs::create_dir_all(s.dir().join("snapshot.json")).unwrap();
@@ -377,3 +379,35 @@ fn control_click_effects_are_visible_when_the_reply_arrives() {
     assert_eq!(files_in(&s), 0, "discarded by the time the click is answered");
     assert_eq!(call(&mut h, "ui.state", serde_json::json!({}))["dialog"], serde_json::Value::Null);
 }
+
+/// A running instance's autosaves are its own (#2166): a second instance started meanwhile
+/// does not offer them, so it cannot discard them either; once the first is gone, they are
+/// offered. A sidecar naming a lock file outside the folder is a plain leftover. Each instance
+/// is a store of its own here: a clone shares its instance.
+#[test]
+fn a_running_instances_autosaves_are_not_offered_to_a_second_instance() {
+    let s = store("live");
+    let instance = || RecoveryStore::new(s.dir());
+    let mut first = PdfCraftApp::new();
+    first.set_option("language", "en").unwrap();
+    first.enable_recovery(instance());
+    first.open_bytes("work.pdf", None, fixture(2)).unwrap();
+    assert!(first.apply_edit(Edit::DeletePages { pages: vec![0] }));
+    first.autosave_now();
+    assert_eq!(files_in(&s), 2);
+    let second = harness(instance());
+    assert!(second.state().recoverable.is_empty() && second.state().dialog.is_none(), "the first instance is still running");
+    drop(second);
+    drop(first);
+    let third = harness(instance());
+    assert_eq!(third.state().recoverable.len(), 1, "offered once the first instance is gone");
+    assert_eq!(files_in(&s), 2, "listing removes no snapshot");
+    drop(third);
+    let meta =
+        std::fs::read_dir(s.dir()).unwrap().flatten().map(|e| e.path()).find(|p| p.extension().and_then(|x| x.to_str()) == Some("json")).unwrap();
+    let mut json: serde_json::Value = serde_json::from_slice(&std::fs::read(&meta).unwrap()).unwrap();
+    json["instance"] = "../../outside.lock".into();
+    std::fs::write(&meta, json.to_string()).unwrap();
+    let fourth = harness(instance());
+    assert_eq!(fourth.state().recoverable.len(), 1, "a name outside the folder is not looked at, and the snapshot is offered");
+}
diff --git a/crates/ui-egui/tests/reload.rs b/crates/ui-egui/tests/reload.rs
index dc0ed869b..d9e6b142b 100644
--- a/crates/ui-egui/tests/reload.rs
+++ b/crates/ui-egui/tests/reload.rs
@@ -6,7 +6,7 @@ use std::path::PathBuf;
 use std::time::{Duration, SystemTime};
 
 use egui_kittest::Harness;
-use egui_kittest::kittest::Queryable;
+use egui_kittest::kittest::{By, Queryable};
 use pdfcraft_ui_egui::{PdfCraftApp, SaveTarget};
 
 /// An `n`-page document with a proper xref table; page `i` shows "Page i+1", and with `notes`
@@ -77,6 +77,11 @@ fn harness(path: &str) -> Harness<'static, PdfCraftApp> {
     let path = path.to_owned();
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        // The labels looked for are English, whatever the machine's language.
+        app.set_option("language", "en").unwrap();
+        // The labels below are English whatever the developer's system language is.
+        app.set_option("language", "en").unwrap();
         app.run_inline = true;
         app.open_path(&path);
         app
@@ -118,6 +123,92 @@ fn a_rebuilt_file_reloads_in_place_keeping_the_page_and_zoom() {
     assert_eq!((app.views[0].current, app.views[0].zoom), (2, 1.5), "at the same page and zoom");
 }
 
+#[test]
+fn a_watched_label_replacement_keeps_the_display_mode_and_focused_page() {
+    use pdfcraft_engine::{Edit, LabelStyle, Session};
+    use pdfcraft_ui_egui::canvas::display_token;
+    use std::sync::Arc;
+
+    let labelled = |ranges: &[(usize, usize, LabelStyle)]| {
+        let mut source = Session::new().with_clock(|| 1_700_000_000);
+        let id = source.open("labels.pdf", None, Arc::new(fixture(5)), None).unwrap();
+        for &(from, to, style) in ranges {
+            source.apply(id, Edit::NumberPages { from, to, style, prefix: String::new(), first: 1 }).unwrap();
+        }
+        source.save_bytes(id).unwrap()
+    };
+    let original = labelled(&[(0, 1, LabelStyle::LowerRoman), (2, 4, LabelStyle::Decimal)]);
+    let replacement = labelled(&[(0, 4, LabelStyle::LowerRoman)]);
+    for display in ["single", "continuous"] {
+        let file = TempPdf::new(&format!("focused-label-{display}"), &original);
+        let mut h = harness(&file.path);
+        let id = h.state().views[0].id;
+        h.state_mut().set_option("layout", display).unwrap();
+        h.state_mut().set_option("zoom", "100").unwrap();
+        h.state_mut().set_option("page", "4").unwrap();
+        h.run_steps(3);
+        let view = &h.state().views[0];
+        assert_eq!((view.current, display_token(view.layout, view.continuous())), (3, display));
+        let doc = h.state().session.get(id).unwrap();
+        assert_eq!(doc.bytes, original);
+        assert!(!doc.dirty);
+        assert_eq!((doc.can_undo(), doc.can_redo()), (None, None));
+        assert!(h.state_mut().execute("view.focus_page_input"));
+        h.run_steps(3);
+        h.get(By::new().role(egui::accesskit::Role::TextInput).value("2"));
+        let editor = h.ctx.memory(|m| m.focused()).expect("the page editor is focused");
+
+        // A build atomically publishes a whole, clean PDF. The real watcher detects it.
+        let next = file.dir.join("next.pdf");
+        std::fs::write(&next, replacement.as_slice()).unwrap();
+        let published = std::fs::File::options().write(true).open(&next).unwrap();
+        published.set_modified(SystemTime::now() + Duration::from_secs(60)).unwrap();
+        drop(published);
+        std::fs::rename(next, &file.path).unwrap();
+        for _ in 0..8 {
+            h.run_steps(1);
+            if h.state().session.get(id).unwrap().bytes == replacement {
+                break;
+            }
+        }
+        h.run_steps(2);
+        let app = h.state();
+        let view = &app.views[0];
+        let doc = app.session.get(id).unwrap();
+        assert_eq!((app.views.len(), app.active, view.id), (1, Some(0), id));
+        assert_eq!(doc.bytes, replacement, "the watcher loaded the replacement before checking navigation");
+        assert_eq!((doc.info.pages.len(), doc.info.pages[3].label.as_str()), (5, "iv"));
+        // First causal negative: a single-page reader must not become a continuous reader.
+        assert_eq!((view.current, display_token(view.layout, view.continuous())), (3, display), "reload retains the physical page and display mode");
+        assert_eq!(view.zoom, 1.0);
+        assert_eq!(view.page_input, "iv");
+        assert_eq!(h.ctx.memory(|m| m.focused()), Some(editor));
+        h.get(By::new().role(egui::accesskit::Role::TextInput).value("iv"));
+
+        // Keep the replacement editor's selection and then its caret, without re-focusing it.
+        h.event(egui::Event::Text("2".into()));
+        h.run_steps(2);
+        assert_eq!((h.state().views[0].current, h.state().views[0].page_input.as_str()), (3, "2"));
+        h.event(egui::Event::Text("x".into()));
+        h.run_steps(1);
+        assert_eq!(h.state().views[0].page_input, "2x");
+        h.key_press(egui::Key::Backspace);
+        h.run_steps(1);
+        assert_eq!(h.state().views[0].page_input, "2");
+        h.key_press(egui::Key::Enter);
+        h.run_steps(3);
+        let app = h.state();
+        assert_eq!((app.views[0].id, app.views[0].current, app.views[0].page_input.as_str()), (id, 1, "ii"));
+        let doc = app.session.get(id).unwrap();
+        assert_eq!(doc.path.as_deref(), Some(file.path.as_str()));
+        assert!(!doc.dirty);
+        assert_eq!((doc.can_undo(), doc.can_redo()), (None, None));
+        assert_eq!(doc.bytes, replacement);
+        assert_eq!(app.session.save_bytes(id).unwrap(), replacement);
+        assert_eq!(std::fs::read(&file.path).unwrap(), replacement.as_ref().clone());
+    }
+}
+
 #[test]
 fn a_half_written_file_waits_until_the_pdf_is_whole() {
     let file = TempPdf::new("partial", &fixture(2));
@@ -204,3 +295,74 @@ fn a_shorter_new_version_drops_what_pointed_into_the_old_one() {
     assert_eq!(view.current, 0, "the page is clamped");
     assert!(view.selected.is_empty() && view.comments.selected.is_none(), "no selection points past the new version");
 }
+
+/// Save asks before writing over a version of the file the document did not come from (#2166):
+/// something else wrote it since the open or the last save. Cancel keeps the file on disk;
+/// Save anyway replaces it, and the next Save does not ask.
+#[test]
+fn saving_over_a_file_changed_by_something_else_asks_first() {
+    let file = TempPdf::new("overwrite", &fixture(2));
+    let mut h = harness(&file.path);
+    rotate_first_page(&mut h);
+    file.rebuild(&fixture(4));
+    h.run_steps(3);
+    h.get_by_label_contains("This file changed on disk");
+    assert!(!h.state_mut().save_active(SaveTarget::InPlace), "not written yet");
+    h.run_steps(2);
+    h.get_by_label("Save over the changed file?");
+    h.get_by_label("Cancel").click();
+    h.run_steps(2);
+    assert_eq!(std::fs::read(&file.path).unwrap(), fixture(4), "Cancel keeps the newer file");
+    assert!(dirty(&h) && h.state().pending_overwrite.is_none());
+    assert!(!h.state_mut().save_active(SaveTarget::InPlace));
+    h.run_steps(2);
+    h.get_by_label("Save anyway").click();
+    h.run_steps(3);
+    assert!(!dirty(&h), "written");
+    assert_ne!(std::fs::read(&file.path).unwrap(), fixture(4));
+    assert_eq!(pages(&h), 2, "the document, not the file, is what is shown");
+    // Our own write is the version the document came from now.
+    rotate_first_page(&mut h);
+    assert!(h.state_mut().save_active(SaveTarget::InPlace), "written at once");
+}
+
+/// With the watcher off nothing notices the change until Save looks at the file.
+#[test]
+fn saving_checks_the_file_with_the_watcher_off_too() {
+    let file = TempPdf::new("overwrite-unwatched", &fixture(2));
+    let path = file.path.clone();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.run_inline = true;
+        app.reload_changed_files = false;
+        app.open_path(&path);
+        app
+    });
+    h.run_steps(4);
+    rotate_first_page(&mut h);
+    file.rebuild(&fixture(4));
+    h.run_steps(3);
+    assert!(h.query_by_label_contains("This file changed on disk").is_none(), "nothing watched");
+    assert!(!h.state_mut().save_active(SaveTarget::InPlace));
+    h.run_steps(2);
+    h.get_by_label("Save over the changed file?");
+}
+
+/// One file, one tab (#2166): opening a file that is open already brings its tab forward,
+/// however its path is spelled.
+#[test]
+fn opening_a_file_that_is_open_focuses_its_tab() {
+    let file = TempPdf::new("twice", &fixture(2));
+    let mut h = harness(&file.path);
+    let id = h.state().views[0].id;
+    h.state_mut().open_bytes("other.pdf", None, fixture(1)).unwrap();
+    h.run_steps(2);
+    assert_eq!((h.state().views.len(), h.state().active), (2, Some(1)));
+    let spelled = file.dir.join(".").join("thesis.pdf").to_string_lossy().into_owned();
+    assert_ne!(spelled, file.path);
+    h.state_mut().open_path(&spelled);
+    h.run_steps(2);
+    let app = h.state();
+    assert_eq!((app.views.len(), app.active, app.views[0].id), (2, Some(0), id), "focused, not opened again");
+}
diff --git a/crates/ui-egui/tests/signing.rs b/crates/ui-egui/tests/signing.rs
index a5b5cf513..7b321d4da 100644
--- a/crates/ui-egui/tests/signing.rs
+++ b/crates/ui-egui/tests/signing.rs
@@ -63,6 +63,35 @@ fn field<'a>(h: &'a Harness<'static, PdfCraftApp>, label: &'a str) -> egui_kitte
     h.get_all_by_label(label).last().unwrap_or_else(|| panic!("no {label:?}"))
 }
 
+#[test]
+fn ctrl_alt_q_types_an_email_without_quitting() {
+    let mut h = harness(dir());
+    h.state_mut().execute("sign.digital");
+    let (a, b) = (at(&h, 40.0, 90.0), at(&h, 220.0, 40.0));
+    drag(&mut h, a, b);
+    assert_eq!(h.state().sign_draft.as_ref().unwrap().step, SignStep::Configure);
+    field(&h, "Email Address").click();
+    h.run_steps(1);
+    field(&h, "Email Address").type_text("test");
+    h.run_steps(1);
+    // The key and text events produced by Ctrl+Alt+Q on German QWERTZ.
+    h.input_mut().events.push(egui::Event::Key {
+        key: egui::Key::Q,
+        physical_key: Some(egui::Key::Q),
+        pressed: true,
+        repeat: false,
+        modifiers: egui::Modifiers { ctrl: true, command: true, alt: true, ..Default::default() },
+    });
+    h.input_mut().events.push(egui::Event::Text("@".into()));
+    h.step();
+    assert!(!h.output().viewport_output.values().any(|v| v.commands.contains(&egui::ViewportCommand::Close)));
+    assert_eq!(h.state().sign_draft.as_ref().unwrap().new_id.email, "test@");
+    field(&h, "Email Address").type_text("example.org");
+    h.run_steps(1);
+    assert_eq!(h.state().sign_draft.as_ref().unwrap().new_id.email, "test@example.org");
+    assert_eq!(h.state().dialog, Some(Dialog::Sign));
+}
+
 #[test]
 fn drawing_a_signature_creating_an_id_signing_and_trusting() {
     let dir = dir();
@@ -80,7 +109,7 @@ fn drawing_a_signature_creating_an_id_signing_and_trusting() {
     h.run_steps(1);
     field(&h, "Name").type_text("Grace Hopper");
     h.state_mut().sign_draft.as_mut().unwrap().new_id.key = 3;
-    for (label, text) in [("Password", "secret1"), ("Confirm Password", "secret1")] {
+    for (label, text) in [("Password", "secret12"), ("Confirm Password", "secret12")] {
         field(&h, label).click();
         h.run_steps(1);
         field(&h, label).type_text(text);
@@ -102,7 +131,7 @@ fn drawing_a_signature_creating_an_id_signing_and_trusting() {
     h.get_by_label("Sign").click();
     h.run_steps(3);
     h.get_by_label("The password is incorrect.");
-    h.state_mut().sign_draft.as_mut().unwrap().password = "secret1".into();
+    h.state_mut().sign_draft.as_mut().unwrap().password = "secret12".into();
     field(&h, "Reason").click();
     h.run_steps(1);
     field(&h, "Reason").type_text("I approve");
@@ -315,6 +344,60 @@ fn the_fill_and_sign_signature_or_an_image_shows_in_a_digital_signature() {
     assert_eq!(fresh.sign_graphic, SignGraphic::Name);
 }
 
+/// The decoded text of every visible signature appearance (Helvetica forms) in a signed file.
+fn stamped(path: &std::path::Path) -> String {
+    use pdfcraft_cos::{Document, ObjRef, Object};
+    let doc = Document::open(std::sync::Arc::new(std::fs::read(path).unwrap())).unwrap();
+    let mut text = String::new();
+    for num in doc.object_numbers() {
+        if let Object::Stream(s) = &*doc.get(ObjRef { num, generation: 0 })
+            && s.dict.name(b"Subtype") == Some(b"Form")
+        {
+            let content = String::from_utf8_lossy(&s.decoded().unwrap()).into_owned();
+            if content.contains("/Helv") {
+                text.push_str(&content);
+            }
+        }
+    }
+    text
+}
+
+/// A signature signed in German is stamped with German labels. In Simplified Chinese, whose
+/// labels the signature's font can't draw, it is stamped with English ones and the dialog says
+/// so under the preview: signing neither fails nor writes `?` for them.
+#[test]
+fn the_signature_labels_follow_the_interface_language() {
+    use pdfcraft_ui_egui::i18n::{Lang, tr};
+    let p12 = concat!(env!("CARGO_MANIFEST_DIR"), "/../sign/tests/data/ec-p256.p12");
+    let cert = pdfcraft_engine::sign::pkcs12::open(&std::fs::read(p12).unwrap(), "test").unwrap().certificate;
+    let note = "The labels are in English: the signature's font can't draw them in this language.";
+    for (code, labels, in_english) in [("de", ["(Digital", "(Grund:", "(Datum:"], false), ("zh-hans", ["(Digitally", "(Reason:", "(Date:"], true)] {
+        let dir = dir().join(code);
+        std::fs::create_dir_all(&dir).unwrap();
+        let mut h = harness(dir.clone());
+        let lang = Lang::from_code(code).unwrap();
+        h.state_mut().set_option("language", code).unwrap();
+        h.state_mut().start_signing(0, Some([20.0, 110.0, 280.0, 180.0]), None, None);
+        let entry = h.state_mut().add_digital_id(p12, &cert);
+        {
+            let d = h.state_mut().sign_draft.as_mut().unwrap();
+            (d.selected, d.step, d.password, d.reason) = (Some(entry), SignStep::SignAs, "test".into(), "OK".into());
+            d.appearance.reason = true;
+        }
+        h.run_steps(3);
+        assert_eq!(h.query_all_by_label(tr(lang, note)).count(), usize::from(in_english), "{code}: the note under the preview");
+        field(&h, tr(lang, "Sign")).click();
+        h.run_steps(6);
+        assert_eq!(h.state().sign_draft.as_ref().and_then(|d| d.error.clone()), None, "{code}");
+        let content = stamped(&dir.join("contract_signed.pdf"));
+        for label in labels {
+            assert!(content.contains(label), "{code}: {label}: {content}");
+        }
+        assert!(!content.contains('?'), "{code}: {content}");
+        assert_eq!(content.contains("Digitally") || content.contains("Reason"), in_english, "{code}: {content}");
+    }
+}
+
 #[test]
 fn os_store_identities_are_not_persisted() {
     let mut app = PdfCraftApp::new();
diff --git a/crates/ui-egui/tests/ui.rs b/crates/ui-egui/tests/ui.rs
index 4c1bdffbe..1b6276d7c 100644
--- a/crates/ui-egui/tests/ui.rs
+++ b/crates/ui-egui/tests/ui.rs
@@ -192,6 +192,35 @@ fn read_mode_rail_buttons_open_their_panels() {
     h.get_by_label("Alpha section");
 }
 
+/// A document that asks to open in Full Screen mode (`/PageMode /FullScreen`) is asked about
+/// first, as in Acrobat: "Not now" leaves the window as it is, "Full Screen" enters it.
+#[test]
+fn a_document_asking_for_full_screen_is_asked_about_first() {
+    let deck = || String::from_utf8(FIXTURE.to_vec()).unwrap().replace("/Outlines 6 0 R", "/Outlines 6 0 R /PageMode /FullScreen").into_bytes();
+    let mut h = harness(move |app| app.open_bytes("deck.pdf", None, deck()).expect("opens"));
+    h.run_steps(3);
+    assert!(!h.state().full_screen, "nothing happens before the answer");
+    h.get_by_label("Open in Full Screen mode?");
+    h.get_by_label("Not now").click();
+    h.run_steps(3);
+    assert!(!h.state().full_screen);
+    assert!(h.query_by_label("Open in Full Screen mode?").is_none() && h.state().pending_full_screen.is_none());
+    // Asked again for the next such document; Full Screen enters it.
+    let again = String::from_utf8(FIXTURE.to_vec()).unwrap().replace("/Outlines 6 0 R", "/Outlines 6 0 R /PageMode /FullScreen").into_bytes();
+    h.state_mut().open_bytes("deck2.pdf", None, again).expect("opens");
+    h.run_steps(3);
+    h.get_by_label("Full Screen").click();
+    h.run_steps(3);
+    assert!(h.state().full_screen, "Full Screen enters it");
+    assert!(h.state().pending_full_screen.is_none());
+    // A plain document asks nothing.
+    h.key_press(egui::Key::Escape);
+    h.run_steps(2);
+    h.state_mut().open_bytes("plain.pdf", None, FIXTURE.to_vec()).expect("opens");
+    h.run_steps(3);
+    assert!(h.query_by_label("Open in Full Screen mode?").is_none() && !h.state().full_screen);
+}
+
 /// Switching to Read mode closes the open pane, and switching back reopens it.
 #[test]
 fn read_mode_closes_the_panes_and_leaving_it_brings_them_back() {
@@ -270,6 +299,28 @@ fn a_tab_with_an_arabic_file_name_keeps_its_logical_accessible_name() {
     h.get_by_label(long);
 }
 
+/// A middle click on a tab closes it, as in Acrobat and browsers (#1853); a tab with unsaved
+/// changes asks first, as its close button does.
+#[test]
+fn a_middle_click_closes_the_tab() {
+    let mut h = harness(|app| {
+        app.open_bytes("first.pdf", None, FIXTURE.to_vec()).unwrap();
+        app.open_bytes("second.pdf", None, FIXTURE.to_vec()).unwrap();
+    });
+    h.get_by_label("first.pdf").click_button(egui::PointerButton::Middle);
+    h.run_steps(3);
+    let app = h.state();
+    assert_eq!(app.views.len(), 1);
+    assert_eq!(app.session.get(app.views[0].id).unwrap().name, "second.pdf");
+    assert!(app.close_request.is_none(), "a clean document closes without asking");
+    h.state_mut().apply_edit(pdfcraft_engine::Edit::RotatePages { pages: vec![0], degrees: 90 });
+    h.run_steps(2);
+    h.get_by_label("second.pdf (edited)").click_button(egui::PointerButton::Middle);
+    h.run_steps(3);
+    assert_eq!(h.state().views.len(), 1, "unsaved changes ask first");
+    assert!(h.state().close_request.is_some());
+}
+
 #[test]
 fn overflowing_tabs_can_be_reached_by_scrolling() {
     let mut h = harness(|app| {
@@ -1234,6 +1285,42 @@ fn dragging_a_tab_moves_it_and_keeps_the_same_document_active() {
     }
 }
 
+/// Regression (#2225): the drop line in front of the first tab sat half a gap outside the
+/// scroll area's clip rect and was never visible.
+#[test]
+fn the_drop_line_shows_in_front_of_the_first_tab() {
+    use egui::accesskit::Role;
+    let mut h = three_tab_harness();
+    let first = h.get_by_role_and_label(Role::Tab, "first.pdf").rect();
+    // Pixels in the strip just left of the first tab that are strongly blue (the accent line).
+    let blue_left_of = |h: &mut Harness<'static, PdfCraftApp>, rect: egui::Rect| {
+        let image = h.render().unwrap();
+        let scale = image.width() as f32 / h.ctx.content_rect().width();
+        let x0 = ((rect.left() - 3.0) * scale).max(0.0) as u32;
+        let x1 = ((rect.left() + 1.0) * scale).max(0.0) as u32;
+        let (y0, y1) = ((rect.top() * scale) as u32, (rect.bottom() * scale) as u32);
+        let mut n = 0;
+        for y in y0..y1.min(image.height()) {
+            for x in x0..x1.min(image.width()) {
+                let p = image.get_pixel(x, y).0;
+                if p[2] > 150 && p[0] < 90 && p[1] < 140 {
+                    n += 1;
+                }
+            }
+        }
+        n
+    };
+    let before = blue_left_of(&mut h, first);
+    // last.pdf to the left of the first tab, released not yet.
+    let to = first.left_center() - egui::vec2(10.0, 0.0);
+    drag_named_tab(&mut h, "last.pdf", to, false);
+    let during = blue_left_of(&mut h, first);
+    assert!(during > before + 10, "no drop line left of the first tab ({before} -> {during})");
+    if let Ok(dir) = std::env::var("PDFCRAFT_TAB_SHOTS") {
+        h.render().unwrap().save(format!("{dir}/dragging-to-front.png")).unwrap();
+    }
+}
+
 #[test]
 fn a_tab_dropped_where_it_was_stays_and_a_click_still_selects_it() {
     let mut h = three_tab_harness();
@@ -1257,3 +1344,27 @@ fn the_combine_tab_does_not_move_and_documents_stay_in_order() {
     drag_named_tab(&mut h, "Combine files", first.left_center() - egui::vec2(10.0, 0.0), true);
     assert_eq!(h.state().views.iter().map(|view| view.id).collect::<Vec<_>>(), ids);
 }
+
+/// The Edit tab turns on Edit text & images at once, as Acrobat does, so every paragraph and image
+/// is boxed and editable with one click; another tab puts the tool down again.
+#[test]
+fn the_edit_tab_turns_on_edit_text_and_images() {
+    use pdfcraft_ui_egui::{Mode, QuickTool};
+    let mut h = harness(|app| app.open_bytes("fixture.pdf", None, FIXTURE.to_vec()).expect("fixture opens"));
+    assert_eq!(h.state().quick_tool, QuickTool::Select);
+    h.get_by_label("Edit").click();
+    h.run_steps(3);
+    assert_eq!(h.state().mode, Mode::Edit);
+    assert_eq!(h.state().quick_tool, QuickTool::EditText);
+    h.get_by_label("All tools").click();
+    h.run_steps(3);
+    assert_eq!(h.state().mode, Mode::AllTools);
+    assert_eq!(h.state().quick_tool, QuickTool::Select);
+    // Another tool picked inside Edit is not taken away by leaving it.
+    h.get_by_label("Edit").click();
+    h.run_steps(3);
+    h.state_mut().quick_tool = QuickTool::Hand;
+    h.get_by_label("Convert").click();
+    h.run_steps(3);
+    assert_eq!(h.state().quick_tool, QuickTool::Hand);
+}
diff --git a/crates/ui-egui/tests/ui_group/column_select.rs b/crates/ui-egui/tests/ui_group/column_select.rs
index 30ef0a13c..017851a89 100644
--- a/crates/ui-egui/tests/ui_group/column_select.rs
+++ b/crates/ui-egui/tests/ui_group/column_select.rs
@@ -37,14 +37,9 @@ fn harness(setup: impl FnOnce(&mut PdfCraftApp) + 'static) -> Harness<'static, P
         setup(&mut app);
         app
     });
-    for _ in 0..200 {
-        h.run_steps(2);
-        if !h.state().render_pending() {
-            break;
-        }
-        std::thread::sleep(std::time::Duration::from_millis(5));
-    }
-    assert!(h.state().views[0].glyph_screen_pos(0, 0).is_some(), "text layer loaded");
+    // Wait for the text layer itself (#1277): under load the first render takes longer than a
+    // fixed second, and nothing may be pending yet before the text layer is asked for.
+    crate::support::wait_until(&mut h, "the page's text layer", |app| app.views[0].glyph_screen_pos(0, 0).is_some() && !app.render_pending());
     h
 }
 
diff --git a/crates/ui-egui/tests/ui_group/identity.rs b/crates/ui-egui/tests/ui_group/identity.rs
index 52581fe6a..ccfba78d7 100644
--- a/crates/ui-egui/tests/ui_group/identity.rs
+++ b/crates/ui-egui/tests/ui_group/identity.rs
@@ -41,13 +41,7 @@ fn the_identity_name_signs_new_comments_and_is_remembered() {
     // New comments carry it. Wait for the page (and its text) to finish loading first: selecting
     // text that hasn't loaded selects nothing, and no highlight is made (seen on slow CI runners).
     h.state_mut().set_option("dialog", "none").unwrap();
-    for _ in 0..200 {
-        h.run_steps(2);
-        if !h.state().render_pending() {
-            break;
-        }
-        std::thread::sleep(std::time::Duration::from_millis(5));
-    }
+    crate::support::wait_until(&mut h, "the page's text layer", |app| app.views[0].glyph_screen_pos(0, 8).is_some() && !app.render_pending());
     h.state_mut().views[0].select_text(0, 4, 8);
     assert!(h.state_mut().execute("comment.highlight"));
     // Wait for the edit to land in the document (it applies on a later frame).
@@ -55,13 +49,7 @@ fn the_identity_name_signs_new_comments_and_is_remembered() {
         let doc = h.state().session.get(h.state().views[0].id).unwrap();
         doc.info.annotations.first().and_then(|a| a.author.clone())
     };
-    for _ in 0..100 {
-        if author(&h).is_some() {
-            break;
-        }
-        h.run_steps(1);
-        std::thread::sleep(std::time::Duration::from_millis(5));
-    }
+    crate::support::wait_until(&mut h, "the highlight", |app| app.session.get(app.views[0].id).is_some_and(|d| !d.info.annotations.is_empty()));
     assert_eq!(author(&h).as_deref(), Some("Grace Hopper"));
     // It survives a restart; an empty or missing name keeps the default, and a huge one is cut.
     let mut restored = PdfCraftApp::new();
diff --git a/crates/ui-egui/tests/ui_group/main.rs b/crates/ui-egui/tests/ui_group/main.rs
index 4c59ca93a..5f0215dd4 100644
--- a/crates/ui-egui/tests/ui_group/main.rs
+++ b/crates/ui-egui/tests/ui_group/main.rs
@@ -3,6 +3,9 @@
 //! write screenshots, use process-ID temporary paths or probe installed fonts stay standalone
 //! in `tests/`. A file in this folder is only built if it is listed here.
 
+#[path = "../support/mod.rs"]
+mod support;
+
 mod animate;
 mod bulk_fields;
 mod column_select;
diff --git a/crates/ui-egui/tests/ui_group/marks.rs b/crates/ui-egui/tests/ui_group/marks.rs
index 285442f97..0a0e45b15 100644
--- a/crates/ui-egui/tests/ui_group/marks.rs
+++ b/crates/ui-egui/tests/ui_group/marks.rs
@@ -27,7 +27,7 @@ fn harness() -> Harness<'static, PdfCraftApp> {
 
 fn marks(h: &Harness<'static, PdfCraftApp>) -> Vec<MarkKind> {
     let s = h.state();
-    s.session.get(s.views[0].id).unwrap().marks.clone()
+    s.session.get(s.views[0].id).unwrap().marks().to_vec()
 }
 
 #[test]
diff --git a/crates/ui-egui/tests/ui_group/pdf_links.rs b/crates/ui-egui/tests/ui_group/pdf_links.rs
index 0916de8e3..7ed2903bc 100644
--- a/crates/ui-egui/tests/ui_group/pdf_links.rs
+++ b/crates/ui-egui/tests/ui_group/pdf_links.rs
@@ -40,7 +40,7 @@ fn drag(h: &mut Harness<'static, PdfCraftApp>, a: Pos2, b: Pos2) {
 
 fn links(h: &Harness<'static, PdfCraftApp>) -> Vec<pdfcraft_engine::LinkItem> {
     let s = h.state();
-    s.session.get(s.views[0].id).unwrap().links.clone()
+    s.session.get(s.views[0].id).unwrap().links().to_vec()
 }
 
 #[test]
diff --git a/crates/ui-egui/tests/ui_group/redact.rs b/crates/ui-egui/tests/ui_group/redact.rs
index 76e075d08..c2d150e11 100644
--- a/crates/ui-egui/tests/ui_group/redact.rs
+++ b/crates/ui-egui/tests/ui_group/redact.rs
@@ -107,6 +107,95 @@ fn redaction_codes_become_the_overlay_text() {
     assert_eq!(h.state().redact_prefs.overlay_text(), "CONFIDENTIAL", "custom text is kept while codes are used");
 }
 
+/// The Redaction Tool Properties are the next run's too, like every other tool's defaults
+/// (Acrobat's "Make Properties Default" without the box): fill, overlay text or codes, the
+/// text's look, and the mark's outline colour and opacity all come back from the settings.
+#[test]
+fn redaction_properties_survive_a_restart() {
+    let mut h = harness();
+    {
+        let p = &mut h.state_mut().redact_prefs;
+        p.fill = None;
+        p.use_overlay = true;
+        p.use_code = true;
+        p.code_set = pdfcraft_engine::REDACTION_CODE_SETS[0];
+        p.codes = vec!["(b)(6)", "(b)(7)(C)"];
+        p.overlay = "CONFIDENTIAL".into();
+        p.look.font = pdfcraft_engine::OverlayFont::Courier;
+        p.look.size = 12.0;
+        p.look.color = [0.0, 0.0, 1.0];
+        p.look.align = 2;
+        p.look.repeat = true;
+        p.outline = [0.0, 0.5, 0.0];
+        p.hover_fill = [1.0, 1.0, 0.0];
+        p.opacity = 0.4;
+    }
+    // The defaults are what OK with "Make properties default" ticked leaves: go through the
+    // dialog.
+    assert!(h.state_mut().execute("redact.properties"));
+    h.run_steps(6);
+    h.get_by_label("Make properties default");
+    h.get_by_label("OK").click();
+    h.run_steps(2);
+    let json = h.state().persist();
+    let mut fresh = PdfCraftApp::new();
+    fresh.restore(&json);
+    let p = &fresh.redact_prefs;
+    assert_eq!(p.fill, None, "no colour is a saved choice, not a missing one");
+    assert_eq!(p.overlay_text(), "(b)(6), (b)(7)(C)");
+    assert_eq!(p.overlay, "CONFIDENTIAL");
+    assert_eq!(p.look.font, pdfcraft_engine::OverlayFont::Courier);
+    assert_eq!((p.look.size, p.look.color, p.look.align, p.look.repeat), (12.0, [0.0, 0.0, 1.0], 2, true));
+    assert_eq!((p.outline, p.hover_fill, p.opacity), ([0.0, 0.5, 0.0], [1.0, 1.0, 0.0], 0.4));
+    // The next mark takes the outline and opacity.
+    let pdfcraft_engine::Edit::AddAnnotation(a) = p.mark(0, vec![pdfcraft_engine::rect_quad([10.0, 10.0, 50.0, 30.0])], "T") else {
+        panic!("a mark adds an annotation")
+    };
+    assert_eq!((a.style.color, a.style.opacity, a.style.fill), ([0.0, 0.5, 0.0], 0.4, None));
+    // Settings are untrusted: a bad colour, an unknown code set and a code outside the set are
+    // dropped, the rest kept.
+    let mut odd = PdfCraftApp::new();
+    odd.restore(
+        r#"{"redact_prefs":{"outline":[2,0,0],"opacity":0.7,"code_set":"nope","codes":["(b)(6)","bogus"],"use_overlay":true,"use_code":true}}"#,
+    );
+    let p = &odd.redact_prefs;
+    assert_eq!((p.outline, p.opacity), ([0.89, 0.13, 0.13], 0.7));
+    assert_eq!(p.code_set.id, pdfcraft_engine::REDACTION_CODE_SETS[0].id);
+    assert_eq!(p.overlay_text(), "(b)(6)");
+}
+
+/// "Make properties default" off: OK keeps the values for this run only, the saved defaults
+/// stay what they were; Cancel puts back what the dialog opened with.
+#[test]
+fn redaction_properties_for_this_run_only_and_cancel() {
+    let mut h = harness();
+    assert!(h.state_mut().execute("redact.properties"));
+    h.run_steps(6);
+    h.get_by_label("Redaction mark appearance");
+    h.get_by_label("Outline colour:");
+    h.get_by_label("Fill colour:");
+    h.get_by_label("Opacity:");
+    h.get_by_label("Make properties default").click();
+    h.run_steps(3);
+    assert!(!h.state().redact_prefs.remember);
+    h.state_mut().redact_prefs.outline = [0.0, 0.0, 1.0];
+    h.get_by_label("OK").click();
+    h.run_steps(2);
+    assert_eq!(h.state().redact_prefs.outline, [0.0, 0.0, 1.0], "used for this run");
+    assert_eq!(h.state().redact_defaults.outline, [0.89, 0.13, 0.13], "not made the default");
+    let mut fresh = PdfCraftApp::new();
+    fresh.restore(&h.state().persist());
+    assert_eq!(fresh.redact_prefs.outline, [0.89, 0.13, 0.13], "the next run starts from the saved defaults");
+    // Cancel discards the edits made while the dialog was open.
+    assert!(h.state_mut().execute("redact.properties"));
+    h.run_steps(2);
+    h.state_mut().redact_prefs.opacity = 0.2;
+    h.get_by_label("Cancel").click();
+    h.run_steps(2);
+    assert_eq!(h.state().redact_prefs.opacity, 1.0, "cancelled");
+    assert_eq!(h.state().redact_prefs.outline, [0.0, 0.0, 1.0], "the run's values stay");
+}
+
 #[test]
 fn redacting_an_imported_word_list() {
     let memo = pdfcraft_engine::Session::new().create_from_text("memo", "Call Ada today\nAda is private\nPublic line").unwrap().to_vec();
diff --git a/crates/ui-egui/tests/ui_group/text_select.rs b/crates/ui-egui/tests/ui_group/text_select.rs
index a98b2f8ed..9ed4e9d5d 100644
--- a/crates/ui-egui/tests/ui_group/text_select.rs
+++ b/crates/ui-egui/tests/ui_group/text_select.rs
@@ -7,7 +7,10 @@ use pdfcraft_ui_egui::PdfCraftApp;
 
 /// One 300×200 page with two lines of Helvetica text.
 fn two_lines() -> Vec<u8> {
-    let content = "BT /F1 14 Tf 20 150 Td (The quick brown fox) Tj 0 -24 Td (jumps over the dog) Tj ET";
+    text_pdf("BT /F1 14 Tf 20 150 Td (The quick brown fox) Tj 0 -24 Td (jumps over the dog) Tj ET")
+}
+
+fn text_pdf(content: &str) -> Vec<u8> {
     format!(
         "%PDF-1.7
 1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
@@ -16,7 +19,7 @@ fn two_lines() -> Vec<u8> {
 4 0 obj << /Length {} >> stream
 {content}
 endstream endobj
-5 0 obj << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> endobj
+5 0 obj << /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >> endobj
 trailer << /Root 1 0 R >>
 %%EOF",
         content.len()
@@ -41,13 +44,8 @@ fn harness_with(pdf: Vec<u8>, setup: impl FnOnce(&mut PdfCraftApp) + 'static) ->
         setup(&mut app);
         app
     });
-    for _ in 0..200 {
-        h.run_steps(2);
-        if !h.state().render_pending() {
-            break;
-        }
-        std::thread::sleep(std::time::Duration::from_millis(5));
-    }
+    // Wait for the text layer itself (#1277), not for a fixed second.
+    crate::support::wait_until(&mut h, "the page's text layer", |app| app.views[0].glyph_screen_pos(0, 5).is_some() && !app.render_pending());
     let at = h.state().views[0].glyph_screen_pos(0, 5).expect("text layer loaded");
     h.hover_at(at);
     h.run_steps(1);
@@ -94,16 +92,12 @@ fn quick_clicks_with_the_highlighter_mark_only_the_word() {
         }
     }
     h.run_steps(3);
-    // Under load the mark can land a few frames later; wait for it (egui's clock is fixed per
-    // frame, so waiting can't turn the clicks into a different run).
-    for _ in 0..200 {
-        let app = h.state();
-        if app.session.get(app.views[0].id).is_some_and(|d| !d.info.annotations.is_empty()) && !app.render_pending() {
-            break;
-        }
-        std::thread::sleep(std::time::Duration::from_millis(5));
-        h.run_steps(1);
-    }
+    // Under load the mark can land later; wait for it (egui's clock is fixed per frame, so
+    // waiting can't turn the clicks into a different run). By state, not for a fixed second
+    // (#1277).
+    crate::support::wait_until(&mut h, "the highlight and the page after it", |app| {
+        app.session.get(app.views[0].id).is_some_and(|d| !d.info.annotations.is_empty()) && !app.render_pending()
+    });
     let app = h.state();
     let doc = app.session.get(app.views[0].id).unwrap();
     let marks: Vec<(&str, usize)> = doc.info.annotations.iter().map(|a| (a.subtype.as_str(), a.quads.len())).collect();
@@ -190,6 +184,161 @@ fn multiclick_selects_on_pointer_press_before_release() {
     assert_eq!(h.state().views[0].selected_text().as_deref(), Some("The quick brown fox"), "line stays selected on release");
 }
 
+// Issue #1225: page-text Copy belongs in both menus and observes PDF permissions.
+fn copied(h: &Harness<'static, PdfCraftApp>, want: &str) -> bool {
+    h.output().platform_output.commands.iter().any(|c| matches!(c, egui::OutputCommand::CopyText(t) if t == want))
+}
+
+#[test]
+fn selected_text_copy_edit_and_context_menus() {
+    use egui_kittest::kittest::Queryable;
+    let (mut h, at) = harness(|_| {});
+    click(&mut h, at);
+    click(&mut h, at);
+    h.state_mut().quick_tool = pdfcraft_ui_egui::QuickTool::Hand;
+    h.run_steps(2); // Hide floating Copy so this test can only reach menu entries.
+    h.get_by_label("Menu").click();
+    h.run_steps(2);
+    h.get_by_label("Edit ⏵").hover();
+    h.run_steps(3);
+    h.get_by_label_contains("Copy").click();
+    let mut did_copy = false;
+    for _ in 0..4 {
+        h.step();
+        did_copy |= copied(&h, "quick");
+    }
+    assert!(did_copy, "Edit Copy emits the selected text");
+    h.state_mut().quick_tool = pdfcraft_ui_egui::QuickTool::Hand;
+    h.run_steps(2); // Hide the floating bar: the remaining Copy must be in the context menu.
+    h.event(Event::PointerMoved(at));
+    for pressed in [true, false] {
+        h.event(Event::PointerButton { pos: at, button: PointerButton::Secondary, pressed, modifiers: Modifiers::NONE });
+        h.run_steps(1);
+    }
+    h.run_steps(2);
+    h.get_by_label_contains("Copy").click();
+    let mut did_copy = false;
+    for _ in 0..4 {
+        h.step();
+        did_copy |= copied(&h, "quick");
+    }
+    assert!(did_copy, "context Copy emits the selected text");
+    assert_eq!(h.state().views[0].selected_text().as_deref(), Some("quick"));
+}
+
+#[test]
+fn selected_text_copy_command_requires_selection() {
+    let (mut h, at) = harness(|_| {});
+    assert!(!h.state_mut().execute("edit.copy"));
+    click(&mut h, at);
+    click(&mut h, at);
+    assert!(h.state_mut().execute("edit.copy"));
+    h.step();
+    assert!(copied(&h, "quick"));
+    let mut app = PdfCraftApp::new();
+    assert!(!app.execute("edit.copy"));
+}
+
+#[test]
+fn selected_text_copy_floating_button_honours_permissions() {
+    use egui_kittest::kittest::Queryable;
+    for password in ["pw", "owner"] {
+        let mut doc = pdfcraft_cos::Document::open(std::sync::Arc::new(two_lines())).unwrap();
+        doc.set_encryption(&pdfcraft_cos::NewEncryption {
+            algorithm: pdfcraft_cos::Algorithm::Aes256,
+            user_password: "pw",
+            owner_password: "owner",
+            permissions: -1 ^ 0b1_0000,
+            encrypt_metadata: true,
+            seed: [4; 32],
+        })
+        .unwrap();
+        let bytes = pdfcraft_cos::write_full(&doc, &Default::default()).unwrap();
+        let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+            let mut app = PdfCraftApp::new();
+            app.set_option("language", "en").unwrap();
+            app.open_bytes("no-copy.pdf", None, bytes).unwrap();
+            app.submit_password(Some(password.into()));
+            app.set_option("left", "closed").unwrap();
+            app
+        });
+        let mut loaded = false;
+        for _ in 0..200 {
+            h.run_steps(2);
+            if h.state_mut().views[0].select_all() {
+                loaded = true;
+                break;
+            }
+            std::thread::sleep(std::time::Duration::from_millis(20));
+        }
+        assert!(loaded);
+        h.run_steps(2);
+        h.get_by_label("Copy").click();
+        let mut did_copy = false;
+        for _ in 0..4 {
+            h.step();
+            did_copy |= copied(&h, "The quick brown fox\njumps over the dog");
+        }
+        assert_eq!(did_copy, password == "owner", "floating Copy with {password} password");
+        assert_eq!(h.state_mut().execute("edit.copy"), password == "owner");
+    }
+}
+
+#[test]
+fn selected_text_copy_preserves_unicode_and_page_clipboard() {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.system_clipboard = false;
+        app.open_bytes("unicode.pdf", None, text_pdf(r"BT /F1 14 Tf 20 150 Td (caf\351) Tj ET")).unwrap();
+        app
+    });
+    let mut loaded = false;
+    for _ in 0..200 {
+        h.run_steps(2);
+        if h.state_mut().views[0].select_all() {
+            loaded = true;
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(20));
+    }
+    assert!(loaded);
+    assert_eq!(h.state().views[0].selected_text().as_deref(), Some("café"));
+    assert!(h.state_mut().execute("edit.copy"));
+    h.step();
+    assert!(copied(&h, "café"));
+    assert!(h.state().page_clipboard.is_none());
+    assert!(h.state_mut().execute("page.organize"));
+    h.run_steps(2);
+    assert!(!h.state_mut().execute("edit.copy"), "Organize retains page clipboard ownership");
+    assert!(h.state_mut().execute("page.copy"));
+    assert_eq!(h.state().page_clipboard.as_ref().map(|c| c.pages.clone()), Some(vec![0]));
+}
+
+#[test]
+fn selected_text_copy_keeps_focused_input_clipboard_ownership() {
+    let (mut h, at) = harness(|_| {});
+    click(&mut h, at);
+    click(&mut h, at);
+    h.state_mut().views[0].open_find();
+    h.state_mut().views[0].find.as_mut().unwrap().query = "widget café".into();
+    h.run_steps(3);
+    h.ctx.memory_mut(|m| m.request_focus(egui::Id::new("find-input")));
+    h.run_steps(2);
+    h.key_press_modifiers(Modifiers::COMMAND, egui::Key::A);
+    h.run_steps(2);
+    h.event(Event::Copy);
+    let mut widget_copy = false;
+    let mut page_copy = false;
+    for _ in 0..4 {
+        h.step();
+        widget_copy |= copied(&h, "widget café");
+        page_copy |= copied(&h, "quick");
+    }
+    assert!(widget_copy, "the focused text input copies its selected text");
+    assert!(!page_copy, "page text must not also consume the Copy event");
+}
+
 /// `n` pages of 300×200, each ending with one line of Helvetica text near its bottom edge.
 fn bottom_lines(n: usize) -> Vec<u8> {
     let mut objects = String::new();
@@ -267,3 +416,131 @@ fn a_selection_drag_keeps_scrolling_over_the_gap_and_the_next_page() {
     h.run_steps(2);
     assert_eq!(h.state().views[0].selected_text(), Some(held), "releasing keeps the selection");
 }
+
+/// One 300×600 page with a line of Helvetica text at its top and another at its bottom.
+fn tall_page() -> Vec<u8> {
+    let content = "BT /F1 14 Tf 20 570 Td (Top line) Tj 0 -550 Td (Bottom line) Tj ET";
+    format!(
+        "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 600] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+5 0 obj << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+        content.len()
+    )
+    .into_bytes()
+}
+
+/// Issue #1670: holding a selection drag at the bottom edge of the view scrolls it, and the
+/// selection follows the pointer down to text that was off screen.
+#[test]
+fn a_selection_drag_held_at_the_bottom_edge_scrolls_the_view() {
+    let (mut h, _) = harness_with(tall_page(), |app| {
+        app.set_option("layout", "continuous").unwrap();
+        app.set_option("zoom", "200").unwrap();
+    });
+    let view = &h.state().views[0];
+    let viewport = view.viewport_rect();
+    assert!(view.page_screen_rect(0).expect("page on screen").bottom() > viewport.bottom() + 100.0, "the page must not fit");
+    // "Top" (glyphs 0..=2).
+    let (from, to) = (view.glyph_screen_pos(0, 0).expect("glyph on screen"), view.glyph_screen_pos(0, 2).expect("glyph on screen"));
+    press_and_move(&mut h, from, to);
+    assert_eq!(h.state().views[0].selected_text().as_deref(), Some("Top"));
+    let edge = egui::pos2(to.x, viewport.bottom() - 2.0);
+    let before = page_top(&h, 0);
+    h.hover_at(edge);
+    h.run_steps(120);
+    assert!(page_top(&h, 0) < before - 100.0, "the view scrolls while the pointer rests at its edge ({before} -> {})", page_top(&h, 0));
+    let held = h.state().views[0].selected_text().expect("still selected");
+    // The pointer stays above the "t" of "Top", so the selection ends at the "t" of "Bottom".
+    assert_eq!(held, "Top line\nBot", "the selection reaches the bottom line");
+    h.event(Event::PointerButton { pos: edge, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+    h.run_steps(2);
+    assert_eq!(h.state().views[0].selected_text(), Some(held), "releasing keeps the selection");
+}
+
+/// Click at `at`, then press there again and drag to `to` before releasing: a double-click drag.
+fn double_click_drag(h: &mut Harness<'static, PdfCraftApp>, at: Pos2, to: Pos2) {
+    click(h, at);
+    press_and_move(h, at, to);
+    h.event(Event::PointerButton { pos: to, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+    h.run_steps(1);
+}
+
+/// Issue #1685: dragging after a double-click extends the selection a word at a time, and the
+/// double-clicked word stays selected whichever way the drag goes.
+#[test]
+fn a_double_click_drag_extends_by_whole_words_both_ways() {
+    let (mut h, _) = harness(|_| {});
+    let glyph = |h: &Harness<'static, PdfCraftApp>, g: usize| h.state().views[0].glyph_screen_pos(0, g).expect("glyph on screen");
+    // "The quick brown fox": the "u" of "quick" is glyph 5, the "o" of "brown" glyph 12.
+    let (u, o) = (glyph(&h, 5), glyph(&h, 12));
+    double_click_drag(&mut h, u, o);
+    let right = h.state().views[0].selected_text();
+    h.run_steps(60);
+    double_click_drag(&mut h, o, u);
+    let left = h.state().views[0].selected_text();
+    assert_eq!([right.as_deref(), left.as_deref()], [Some("quick brown"); 2], "dragging right, then left");
+}
+
+/// Issue #1685: after a triple-click the drag extends a whole line at a time.
+#[test]
+fn a_triple_click_drag_extends_by_whole_lines() {
+    let (mut h, at) = harness(|_| {});
+    // A glyph inside "jumps over the dog", on the second line.
+    let below = h.state().views[0].glyph_screen_pos(0, 23).expect("glyph on screen");
+    click(&mut h, at);
+    double_click_drag(&mut h, at, below);
+    assert_eq!(h.state().views[0].selected_text().as_deref(), Some("The quick brown fox\njumps over the dog"));
+}
+
+/// Coalesced down/up keeps the same word/line selection as separate press and release passes.
+#[test]
+fn coalesced_primary_clicks_select_line_then_spaced_click_clears() {
+    for coalesced in [true, false] {
+        let (mut h, at) = harness(|_| {});
+        h.ctx.options_mut(|o| o.max_passes = 1.try_into().unwrap());
+        let id = h.state().views[0].id;
+        let saved = h.state().session.get(id).unwrap().saved_bytes();
+        assert!(h.state().views[0].selected_text().is_none());
+        assert!(!h.state().session.get(id).unwrap().dirty);
+        for want in [None, Some("quick"), Some("The quick brown fox")] {
+            if coalesced {
+                // Harness::event steps each queued event separately; RawInput keeps this pair together.
+                h.input_mut().events.extend([true, false].map(|pressed| Event::PointerButton {
+                    pos: at,
+                    button: PointerButton::Primary,
+                    pressed,
+                    modifiers: Modifiers::NONE,
+                }));
+                h.step();
+            } else {
+                click(&mut h, at);
+            }
+            assert_eq!(h.state().views[0].selected_text().as_deref(), want, "coalesced={coalesced}");
+        }
+        h.run_steps(60);
+        if coalesced {
+            h.input_mut().events.extend([true, false].map(|pressed| Event::PointerButton {
+                pos: at,
+                button: PointerButton::Primary,
+                pressed,
+                modifiers: Modifiers::NONE,
+            }));
+            h.step();
+        } else {
+            click(&mut h, at);
+        }
+        assert_eq!(h.state().views[0].selected_text(), None, "a spaced click clears either gesture path");
+        assert_eq!(h.state().views[0].id, id);
+        let doc = h.state().session.get(id).unwrap();
+        assert!(!doc.dirty);
+        assert_eq!((doc.can_undo(), doc.can_redo()), (None, None));
+        assert_eq!(doc.saved_bytes(), saved);
+    }
+}
diff --git a/crates/ui-egui/tests/ui_group/theme.rs b/crates/ui-egui/tests/ui_group/theme.rs
index 2a7e0e265..6e86c5099 100644
--- a/crates/ui-egui/tests/ui_group/theme.rs
+++ b/crates/ui-egui/tests/ui_group/theme.rs
@@ -204,3 +204,64 @@ fn native_appearance_remains_inherited_for_every_saved_choice() {
         assert_eq!(h.ctx.options(|o| o.theme_preference), egui::ThemePreference::System);
     }
 }
+
+/// Preferences ▸ Appearance: a theme card is a manual choice that the mode combo box shows and
+/// OS changes leave alone; Use system setting afterwards follows the OS again.
+#[test]
+fn preferences_theme_cards_and_use_system_setting_stay_in_sync() {
+    use egui::accesskit::Role;
+    fn mode_shown(h: &Harness<'static, PdfCraftApp>) -> String {
+        let combo =
+            h.get_by(|n| n.role() == Role::ComboBox && n.value().is_some_and(|v| ["Use system setting", "Light", "Dark"].contains(&v.as_str())));
+        combo.value().unwrap_or_default()
+    }
+    let mut h = harness();
+    h.get_by_label("Display theme: Light gray").click_secondary();
+    h.run_steps(4);
+    h.get_by_label("Appearance settings…").click();
+    h.run_steps(10);
+    assert_theme(&h, ThemePreference::Light, ThemeKind::Light);
+    assert_eq!(mode_shown(&h), "Light");
+
+    // The OS is dark: the Dark card's radio row picks Dark, and the combo box says so.
+    // The cards sit below the fold of the Preferences scroll area at this window size.
+    h.get_by_label("Dark gray").scroll_to_me();
+    h.run_steps(3);
+    h.get_by_label("Dark gray").click();
+    h.run_steps(3);
+    assert_theme(&h, ThemePreference::Dark, ThemeKind::Dark);
+    assert_eq!(mode_shown(&h), "Dark");
+    // The Light card itself, not its radio row, picks Light, and a dark OS doesn't undo it.
+    h.get_by_label("Light theme").click();
+    h.run_steps(3);
+    h.input_mut().system_theme = Some(egui::Theme::Light);
+    h.run_steps(2);
+    h.input_mut().system_theme = Some(egui::Theme::Dark);
+    h.run_steps(2);
+    assert_theme(&h, ThemePreference::Light, ThemeKind::Light);
+    assert_eq!(mode_shown(&h), "Light");
+
+    // Use system setting follows the OS both ways after a card choice.
+    h.get_by(|n| n.role() == Role::ComboBox && n.value().as_deref() == Some("Light")).scroll_to_me();
+    h.run_steps(3);
+    h.get_by(|n| n.role() == Role::ComboBox && n.value().as_deref() == Some("Light")).click();
+    h.run_steps(3);
+    // Motion has a "Use system setting" radio of its own; this is the combo box's item.
+    h.get_by_role_and_label(Role::Button, "Use system setting").click();
+    h.run_steps(3);
+    assert_theme(&h, ThemePreference::System, ThemeKind::Dark);
+    assert_eq!(mode_shown(&h), "Use system setting");
+    h.input_mut().system_theme = Some(egui::Theme::Light);
+    h.run_steps(3);
+    assert_theme(&h, ThemePreference::System, ThemeKind::Light);
+    // Only the Light card is marked Active while the OS is light.
+    assert_eq!(h.query_all_by_label("Active").count(), 1);
+
+    // A card click leaves system mode again.
+    h.get_by_label("Dark theme").scroll_to_me();
+    h.run_steps(3);
+    h.get_by_label("Dark theme").click();
+    h.run_steps(3);
+    assert_theme(&h, ThemePreference::Dark, ThemeKind::Dark);
+    assert_eq!(mode_shown(&h), "Dark");
+}
diff --git a/crates/ui-egui/tests/ui_group/updates.rs b/crates/ui-egui/tests/ui_group/updates.rs
index c06bd8b2c..a8ecb31c5 100644
--- a/crates/ui-egui/tests/ui_group/updates.rs
+++ b/crates/ui-egui/tests/ui_group/updates.rs
@@ -21,13 +21,17 @@ fn harness(answer: Result<&str, &str>) -> Harness<'static, PdfCraftApp> {
     })
 }
 
-/// Run frames until the background check has reported (or give up).
+/// Run frames until the background check has reported. By what the dialog shows, with the
+/// same 30-second deadline as `support::wait_until`, not for a fixed second: under load the
+/// check's thread can take longer (#1277).
 fn settle(h: &mut Harness<'static, PdfCraftApp>) {
-    for _ in 0..200 {
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(30);
+    loop {
         h.run_steps(2);
         if h.query_by_label_contains("Checking for a newer version").is_none() {
             break;
         }
+        assert!(std::time::Instant::now() < deadline, "timed out waiting for the update check");
         std::thread::sleep(std::time::Duration::from_millis(5));
     }
     h.run_steps(2);
diff --git a/crates/ui-egui/tests/view.rs b/crates/ui-egui/tests/view.rs
index d3744dd2e..3fdeff637 100644
--- a/crates/ui-egui/tests/view.rs
+++ b/crates/ui-egui/tests/view.rs
@@ -198,6 +198,95 @@ fn single_page_wheel_pans_instead_when_zoomed_in() {
     assert_eq!(h.state().views[0].current, 0, "zoomed-in wheel pans, it does not turn the page");
 }
 
+#[test]
+fn single_page_wheel_at_the_bottom_edge_turns_to_the_next_page_top_and_back() {
+    // #1924: zoomed in so the page is taller than the window, the wheel pans; at the bottom
+    // edge one more notch shows the next page at its top, and at the top edge one notch up
+    // shows the previous page at its bottom.
+    let mut h = harness_stepping(1.0 / 60.0, &[("layout", "single"), ("zoom", "200")]);
+    let at = h.state().views[0].viewport_rect().center();
+    h.hover_at(at);
+    h.run_steps(4);
+    // Notches pan page 1 down; the page turns only after the view stopped at the bottom.
+    let (mut notches, mut stalled) = (0, 0);
+    let mut last = rect(&h, 0).expect("page 1 on screen").min.y;
+    while h.state().views[0].current == 0 && notches < 80 {
+        h.event(wheel(MouseWheelUnit::Line, -1.0, TouchPhase::Move));
+        h.run_steps(12);
+        notches += 1;
+        if let Some(r) = rect(&h, 0) {
+            stalled = if (r.min.y - last).abs() < 0.01 { stalled + 1 } else { 0 };
+            last = r.min.y;
+        }
+    }
+    assert!(notches > 2, "the page panned before it turned: {notches} notches");
+    assert_eq!(h.state().views[0].current, 1, "a notch at the bottom edge shows the next page");
+    assert!(stalled <= 1, "no notch was wasted at the edge");
+    let top = rect(&h, 1).expect("page 2 on screen").min.y;
+    assert!(top > h.state().views[0].viewport_rect().min.y, "page 2 shows its top edge: {top}");
+    h.event(wheel(MouseWheelUnit::Line, 1.0, TouchPhase::Move));
+    h.run_steps(30);
+    assert_eq!(h.state().views[0].current, 0, "a notch at the top edge shows the previous page");
+    let r = rect(&h, 0).expect("page 1 on screen");
+    assert!(r.max.y < h.state().views[0].viewport_rect().max.y + 40.0, "page 1 shows its bottom edge: {r:?}");
+}
+
+#[test]
+fn single_page_swipe_that_reaches_the_edge_does_not_turn_but_a_fresh_one_does() {
+    // Momentum that carries a swipe to the bottom edge must not go on to turn the page.
+    let mut h = harness_stepping(1.0 / 60.0, &[("layout", "single"), ("zoom", "200")]);
+    let at = h.state().views[0].viewport_rect().center();
+    h.hover_at(at);
+    h.run_steps(4);
+    let send = |h: &mut Harness<'static, PdfCraftApp>, phase, dy| {
+        h.event(wheel(MouseWheelUnit::Point, dy, phase));
+        h.step();
+    };
+    // One long swipe: far more motion than the page has, in one gesture.
+    send(&mut h, TouchPhase::Start, 0.0);
+    for _ in 0..120 {
+        send(&mut h, TouchPhase::Move, -40.0);
+    }
+    send(&mut h, TouchPhase::End, 0.0);
+    h.run_steps(30);
+    assert_eq!(h.state().views[0].current, 0, "the swipe that panned to the edge does not turn");
+    // A new swipe at the edge turns exactly one page.
+    send(&mut h, TouchPhase::Start, 0.0);
+    for _ in 0..6 {
+        send(&mut h, TouchPhase::Move, -25.0);
+    }
+    send(&mut h, TouchPhase::End, 0.0);
+    h.run_steps(30);
+    assert_eq!(h.state().views[0].current, 1, "a fresh swipe at the edge turns one page");
+    let top = rect(&h, 1).expect("page 2 on screen").min.y;
+    assert!(
+        top >= h.state().views[0].viewport_rect().min.y,
+        "page 2 starts at its top after the swipe: {top} in {:?}",
+        h.state().views[0].viewport_rect()
+    );
+}
+
+#[test]
+fn stepping_past_either_end_leaves_the_view_alone() {
+    // Paging on past the first or last page must not jump the page back to its top.
+    for (page, forward) in [(2, true), (0, false)] {
+        let mut h = harness_stepping(1.0 / 60.0, &[("layout", "single"), ("zoom", "200")]);
+        h.state_mut().views[0].go_to_page(page);
+        h.run_steps(20);
+        let at = h.state().views[0].viewport_rect().center();
+        h.hover_at(at);
+        h.run_steps(4);
+        // Pan the page off its edge so a jump would show.
+        h.event(wheel(MouseWheelUnit::Line, -1.0, TouchPhase::Move));
+        h.run_steps(30);
+        let before = rect(&h, page).expect("page on screen");
+        h.state_mut().views[0].step_page(forward);
+        h.run_steps(30);
+        assert_eq!(h.state().views[0].current, page);
+        assert_eq!(rect(&h, page), Some(before), "stepping past the end (forward={forward}) moved the page");
+    }
+}
+
 #[test]
 fn wheel_turns_one_page_per_notch_and_per_trackpad_swipe() {
     // At a real frame rate: brisk notches each turn a page, and one trackpad swipe turns one
@@ -256,6 +345,88 @@ fn precise_touchpad_wheel_scrolls_one_to_one() {
     assert!(drift.abs() < 2.0, "no easing tail after the swipe: drifted {drift}");
 }
 
+/// Steps `frames` frames and returns how far the document scrolled down over them, from the
+/// pages on screen in each pair of consecutive frames (a page can leave the screen on the way).
+#[cfg(not(target_os = "macos"))]
+fn scroll_over(h: &mut Harness<'static, PdfCraftApp>, frames: usize) -> f32 {
+    let tops = |h: &Harness<'static, PdfCraftApp>| (0..3).map(|p| rect(h, p).map(|r| r.min.y)).collect::<Vec<_>>();
+    let mut moved = 0.0;
+    for _ in 0..frames {
+        let before = tops(h);
+        h.step();
+        let after = tops(h);
+        let step = before.iter().zip(&after).find_map(|(b, a)| Some(b.as_ref()? - a.as_ref()?));
+        moved += step.expect("a page stays on screen from one frame to the next");
+    }
+    moved
+}
+
+/// A two-finger swipe down the page, 25 points a frame for six frames, lifted the frame after
+/// (the axis stop Wayland sends), at 300 % so the document is long enough to glide in: how far
+/// it scrolled by the frame after the lift (the page is drawn a frame behind its scroll).
+#[cfg(not(target_os = "macos"))]
+fn swipe_and_lift(h: &mut Harness<'static, PdfCraftApp>) -> f32 {
+    let at = h.state().views[0].viewport_rect().center();
+    h.hover_at(at);
+    h.run_steps(2);
+    h.event(wheel(MouseWheelUnit::Point, -25.0, TouchPhase::Start));
+    let mut moved = scroll_over(h, 1);
+    for _ in 0..6 {
+        h.event(wheel(MouseWheelUnit::Point, -25.0, TouchPhase::Move));
+        moved += scroll_over(h, 1);
+    }
+    h.event(wheel(MouseWheelUnit::Point, 0.0, TouchPhase::End));
+    moved + scroll_over(h, 2)
+}
+
+/// The touchpad glide is Wayland's: macOS sends its own momentum and the web none (#531).
+#[cfg(not(target_os = "macos"))]
+#[test]
+fn touchpad_swipe_glides_on_after_the_fingers_lift_and_stops() {
+    let mut h = harness_stepping(1.0 / 60.0, &[("layout", "continuous"), ("zoom", "300")]);
+    let swiped = swipe_and_lift(&mut h);
+    // The seven 25-point motions, 1:1 (#759).
+    assert!(swiped >= 174.0, "the swipe scrolls 1:1: moved {swiped}");
+    // 1500 points a second at the lift: about 190 points over the next 10 frames.
+    let glided = scroll_over(&mut h, 10);
+    assert!(glided > 100.0, "the page glides on after the lift: moved {glided} more");
+    let rest = scroll_over(&mut h, 180);
+    let drift = scroll_over(&mut h, 20);
+    assert!(drift.abs() < 0.5, "the glide slows to a stop: still drifting {drift}");
+    let total = swiped - 175.0 + glided + rest;
+    assert!(total > 400.0 && total < 600.0, "about the lift speed × 0.35 s: glided {total}");
+}
+
+#[cfg(not(target_os = "macos"))]
+#[test]
+fn touching_the_touchpad_again_or_turning_animations_off_stops_the_glide() {
+    let mut h = harness_stepping(1.0 / 60.0, &[("layout", "continuous"), ("zoom", "300")]);
+    swipe_and_lift(&mut h);
+    assert!(scroll_over(&mut h, 3) > 30.0, "gliding");
+    h.event(wheel(MouseWheelUnit::Point, 0.0, TouchPhase::Start));
+    scroll_over(&mut h, 2);
+    let drift = scroll_over(&mut h, 20);
+    assert!(drift.abs() < 0.5, "fingers back down catch the page: drifted {drift}");
+
+    // A click (a pressed touchpad, or a tap with tap-to-click) catches it too.
+    let mut h = harness_stepping(1.0 / 60.0, &[("layout", "continuous"), ("zoom", "300")]);
+    swipe_and_lift(&mut h);
+    assert!(scroll_over(&mut h, 3) > 30.0, "gliding");
+    let at = h.state().views[0].viewport_rect().center();
+    h.event(egui::Event::PointerButton { pos: at, button: egui::PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
+    scroll_over(&mut h, 2);
+    let drift = scroll_over(&mut h, 20);
+    assert!(drift.abs() < 0.5, "a click catches the page: drifted {drift}");
+
+    // Animation effects off: the page stops with the fingers, as before #531.
+    let mut h = harness_stepping(1.0 / 60.0, &[("layout", "continuous"), ("zoom", "300")]);
+    h.state_mut().set_option("animation_effects", "off").unwrap();
+    let swiped = swipe_and_lift(&mut h);
+    assert!((swiped - 175.0).abs() < 1.0, "the swipe still scrolls 1:1: moved {swiped}");
+    let drift = scroll_over(&mut h, 20);
+    assert!(drift.abs() < 0.5, "no glide with animations off: drifted {drift}");
+}
+
 /// The 40 frames from one wheel notch on, with the system asking for no animations (Windows'
 /// Animation effects turned off) or not, and Preferences ▸ Animation effects as given: how far
 /// page 1 has moved up in each frame, or with ⌘/Ctrl held, the view's zoom.
@@ -980,17 +1151,15 @@ fn compare_page_with_raster(h: &mut Harness<'static, PdfCraftApp>, pdf: &[u8], z
     (sum as f64 / n as f64, worst)
 }
 
-#[test]
-fn zooming_a_tiled_page_shows_its_earlier_tiles_until_new_ones_arrive() {
-    let _gpu = gpu();
-    // A 1200 pt square page of fine lines (0.5 pt every 1.7 pt): tiled at 300 %.
+/// A 1200 pt square page of fine lines (0.5 pt every 1.7 pt): tiled at 300 %, whole-page at 150 %.
+fn fine_grid_pdf() -> Vec<u8> {
     let mut content = String::from("0 g\n");
     for i in 0..670 {
         let v = 30.0 + 1.7 * i as f32;
         content.push_str(&format!("{v} 30 0.5 1140 re 30 {v} 1140 0.5 re\n"));
     }
     content.push_str("f\n");
-    let pdf = format!(
+    format!(
         "%PDF-1.7
 1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
@@ -1002,15 +1171,21 @@ trailer << /Root 1 0 R >>
 %%EOF",
         content.len()
     )
-    .into_bytes();
-    let mut h = Harness::builder().with_size(egui::vec2(1000.0, 800.0)).build_eframe(move |_cc| {
+    .into_bytes()
+}
+
+fn grid_harness(pdf: Vec<u8>, zoom: &str) -> Harness<'static, PdfCraftApp> {
+    Harness::builder().with_size(egui::vec2(1000.0, 800.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
         app.open_bytes("grid.pdf", None, pdf.clone()).expect("opens");
         app.set_option("left", "closed").unwrap();
         app.set_option("panel", "none").unwrap();
-        app.set_option("zoom", "300").unwrap();
+        app.set_option("zoom", zoom).unwrap();
         app
-    });
+    })
+}
+
+fn settle(h: &mut Harness<'static, PdfCraftApp>) {
     for _ in 0..400 {
         h.run_steps(2);
         if !h.state().render_pending() {
@@ -1018,26 +1193,58 @@ trailer << /Root 1 0 R >>
         }
         std::thread::sleep(std::time::Duration::from_millis(5));
     }
-    // Detail in the middle of the window: the summed difference between neighbouring pixels.
-    let detail = |h: &mut Harness<'static, PdfCraftApp>| {
-        let img = h.render().expect("renders");
-        let (cx, cy) = (img.width() / 2, img.height() / 2);
-        let mut sum = 0u64;
-        for y in cy - 100..cy + 100 {
-            for x in cx - 150..cx + 150 {
-                sum += u64::from(img.get_pixel(x, y)[0].abs_diff(img.get_pixel(x + 1, y)[0]));
-            }
+}
+
+/// Detail in the middle of the window: the summed difference between neighbouring pixels.
+fn centre_detail(h: &mut Harness<'static, PdfCraftApp>) -> u64 {
+    let img = h.render().expect("renders");
+    let (cx, cy) = (img.width() / 2, img.height() / 2);
+    let mut sum = 0u64;
+    for y in cy - 100..cy + 100 {
+        for x in cx - 150..cx + 150 {
+            sum += u64::from(img.get_pixel(x, y)[0].abs_diff(img.get_pixel(x + 1, y)[0]));
         }
-        sum
-    };
-    let sharp = detail(&mut h);
+    }
+    sum
+}
+
+#[test]
+fn zooming_a_tiled_page_shows_its_earlier_tiles_until_new_ones_arrive() {
+    let _gpu = gpu();
+    let mut h = grid_harness(fine_grid_pdf(), "300");
+    settle(&mut h);
+    let sharp = centre_detail(&mut h);
     // The first frame at a new zoom has no tiles for it yet (they are requested at its end).
     h.state_mut().set_option("zoom", "310").unwrap();
     h.step();
-    let first = detail(&mut h);
+    let first = centre_detail(&mut h);
     assert!(first * 10 > sharp * 7, "the first frame after zooming lost its detail: {first} against {sharp}");
 }
 
+/// #2196: zooming away from a tiled page and back must not re-blur an area already rendered
+/// sharp. The tiles of the zoom just left used to be dropped while the page was shown whole,
+/// so returning to it was a cold miss and every tile cost a full page interpret again.
+#[test]
+fn returning_to_a_visited_zoom_reuses_its_cached_tiles() {
+    let _gpu = gpu();
+    let mut h = grid_harness(fine_grid_pdf(), "300");
+    settle(&mut h);
+    let before = h.state().views[0].tiles_debug(0);
+    assert!(!before.is_empty(), "the 300 % page should be tiled, but it cached no tiles");
+    // Zoom right out, where the 1200 pt page fits in one raster and is not tiled at all, so
+    // none of its tiles is demanded...
+    h.state_mut().set_option("zoom", "50").unwrap();
+    settle(&mut h);
+    // ...then back to the first zoom, which was already rendered sharp.
+    h.state_mut().set_option("zoom", "300").unwrap();
+    h.step();
+    let after = h.state().views[0].tiles_debug(0);
+    // Every tile rendered sharp before the round trip is still cached: zooming away must not
+    // drop them, so returning shows them at once instead of re-interpreting the page per tile.
+    let lost: Vec<_> = before.iter().copied().filter(|k| !after.contains(k)).collect();
+    assert!(lost.is_empty(), "returning to a visited zoom dropped its cached tiles {lost:?} (had {before:?}, now {after:?})");
+}
+
 #[test]
 fn sidebar_collapse_and_resize_preserves_scroll_position() {
     use pdfcraft_ui_egui::canvas::Fit;
@@ -1100,3 +1307,75 @@ fn sidebar_collapse_and_resize_preserves_scroll_position() {
     let rel_y_reopened = rect_reopened.min.y - vp_reopened.min.y;
     assert!((rel_y_reopened - rel_y_before).abs() < 1.0, "page 2 scroll position preserved on reopen: before {rel_y_before}, after {rel_y_reopened}");
 }
+
+/// Synthetic unequal-height spreads, generated without font or image assets.
+fn final_spread_at_scroll_end(heights: &[u32], cover: bool) -> (Vec<(usize, egui::Rect)>, egui::Rect) {
+    let kids = (0..heights.len()).map(|i| format!("{} 0 R", i + 3)).collect::<Vec<_>>().join(" ");
+    let mut pdf = format!(
+        "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [{kids}] /Count {} >> endobj\n",
+        heights.len()
+    );
+    for (i, height) in heights.iter().enumerate() {
+        pdf += &format!("{} 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 {height}] >> endobj\n", i + 3);
+    }
+    pdf += "trailer << /Root 1 0 R >>\n%%EOF";
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).with_step_dt(1.0 / 60.0).build_eframe(move |_| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("unequal-spreads.pdf", None, pdf.as_bytes().to_vec()).unwrap();
+        for (key, value) in [("left", "closed"), ("panel", "none"), ("layout", "two-up"), ("zoom", "200")] {
+            app.set_option(key, value).unwrap();
+        }
+        app.set_option("cover", if cover { "on" } else { "off" }).unwrap();
+        app
+    });
+    h.run_steps(12);
+    let at = h.state().views[0].viewport_rect().center();
+    h.hover_at(at);
+    h.run_steps(2);
+    for _ in 0..4 {
+        h.event(wheel(MouseWheelUnit::Line, -1000.0, TouchPhase::Move));
+        h.run_steps(45);
+    }
+    let view = &h.state().views[0];
+    let last = heights.len() - 1;
+    let first = if cover { last - (last + 1) % 2 } else { last - last % 2 };
+    let pages = (first..=last).map(|page| (page, view.page_screen_rect(page).expect("final spread is visible"))).collect();
+    (pages, view.viewport_rect())
+}
+
+fn assert_final_spread_bottom_reachable(heights: &[u32], cover: bool) {
+    let (pages, viewport) = final_spread_at_scroll_end(heights, cover);
+    let bottom = pages.iter().map(|(_, rect)| rect.bottom()).fold(0.0_f32, f32::max);
+    assert!(
+        bottom <= viewport.bottom() + 1.0,
+        "final spread remains below the viewport: heights={heights:?}, cover={cover}, pages={pages:?}, viewport={viewport:?}"
+    );
+    // The maximum-height page reaches the bottom margin after the scroll offset settles.
+    assert!((viewport.bottom() - bottom - 28.0).abs() < 1.0, "scroll end leaves the bottom margin: pages={pages:?}, viewport={viewport:?}");
+}
+
+#[test]
+fn two_up_scroll_end_reaches_a_taller_left_page() {
+    assert_final_spread_bottom_reachable(&[400, 400, 400, 100], false);
+}
+
+#[test]
+fn two_up_scroll_end_reaches_a_taller_right_page() {
+    assert_final_spread_bottom_reachable(&[400, 400, 100, 400], false);
+}
+
+#[test]
+fn two_up_scroll_end_reaches_equal_height_pages() {
+    assert_final_spread_bottom_reachable(&[400, 400, 400, 400], false);
+}
+
+#[test]
+fn two_up_scroll_end_reaches_an_unpaired_final_page() {
+    assert_final_spread_bottom_reachable(&[400, 400, 400], false);
+}
+
+#[test]
+fn two_up_scroll_end_with_cover_reaches_a_taller_left_page() {
+    assert_final_spread_bottom_reachable(&[400, 400, 400, 400, 100], true);
+}
diff --git a/crates/ui-egui/tests/viewer.rs b/crates/ui-egui/tests/viewer.rs
index a21f6b14e..077553c71 100644
--- a/crates/ui-egui/tests/viewer.rs
+++ b/crates/ui-egui/tests/viewer.rs
@@ -2,7 +2,7 @@
 //! cover page, a scroll position per tab.
 
 use egui_kittest::Harness;
-use egui_kittest::kittest::Queryable;
+use egui_kittest::kittest::{By, Queryable};
 use pdfcraft_ui_egui::{Dialog, PdfCraftApp};
 
 /// `n` pages of 200×300; page i says "Page i+1" plus "page" and "Pages" for find tests.
@@ -128,7 +128,11 @@ fn view_history_select_all_and_find_options() {
     assert_eq!(h.state().views[0].find.as_ref().unwrap().matches.len(), 0, "\"page\" alone, lower case, appears nowhere");
     h.state_mut().views[0].find.as_mut().unwrap().query = "PAGE".into();
     h.state_mut().views[0].rerun_find();
-    h.run_steps(2);
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(20);
+    while std::time::Instant::now() < deadline && h.state().views[0].find.as_ref().unwrap().matches.len() < 5 {
+        h.run_steps(2);
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
     assert_eq!(h.state().views[0].find.as_ref().unwrap().matches.len(), 5);
 }
 
@@ -302,6 +306,359 @@ fn layouts_fit_height_labels_and_system_theme() {
     assert_eq!(h.state().theme_preference, pdfcraft_ui_egui::theme::ThemePreference::System);
 }
 
+fn page_input_focused(h: &Harness<'static, PdfCraftApp>) -> bool {
+    let focused = h.ctx.memory(|m| m.focused());
+    let view = &h.state().views[h.state().active.unwrap()];
+    // Also identifies the original editor when running this test-only patch on the baseline.
+    focused == Some(egui::Id::new(("page-input", view.id.0))) || focused == Some(egui::Id::new("page-input"))
+}
+
+/// Exercise the real navigation editor, including its focus and Enter handling.
+fn focus_page_input(h: &mut Harness<'static, PdfCraftApp>) {
+    let text = h.state().views[h.state().active.unwrap()].page_input.clone();
+    h.get(By::new().role(egui::accesskit::Role::TextInput).value(&text)).focus();
+    h.run_steps(1);
+    assert!(page_input_focused(h), "the actual page editor has focus");
+}
+
+fn type_page_input(h: &mut Harness<'static, PdfCraftApp>, text: &str) {
+    focus_page_input(h);
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::A);
+    h.run_steps(1);
+    let old = h.state().views[h.state().active.unwrap()].page_input.clone();
+    h.get(By::new().role(egui::accesskit::Role::TextInput).value(&old)).type_text(text);
+    h.run_steps(2);
+}
+
+fn restart_page_labels(h: &mut Harness<'static, PdfCraftApp>) {
+    use pdfcraft_engine::{Edit, LabelStyle};
+    let session = std::mem::take(&mut h.state_mut().session);
+    h.state_mut().session = session.with_clock(|| 1_700_000_000);
+    h.state_mut().active = Some(0);
+    for (from, to, style, first) in [(0, 1, LabelStyle::LowerRoman, 1), (2, 4, LabelStyle::Decimal, 1)] {
+        h.state_mut().apply_edit(Edit::NumberPages { from, to, style, prefix: String::new(), first });
+    }
+    h.run_steps(3);
+}
+
+#[test]
+fn page_label_input_keeps_current_page_when_submitted_unchanged() {
+    let mut h = harness();
+    restart_page_labels(&mut h);
+    // Physical page 3 has logical label 1. The old editor showed 3, then interpreted it as
+    // logical label 3 (physical page 5) when Enter was pressed without changing anything.
+    h.state_mut().views[0].go_to_page(2);
+    h.run_steps(3);
+    focus_page_input(&mut h);
+    h.key_press(egui::Key::Enter);
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].current, 2, "unchanged Enter must stay on the current physical page");
+
+    let id = h.state().views[0].id;
+    let before = h.state().session.get(id).unwrap();
+    let undo = before.can_undo().map(str::to_owned);
+    let dirty = before.dirty;
+    let before_bytes = h.state().session.save_bytes(id).unwrap();
+    for (page, label) in ["i", "ii", "1", "2", "3"].into_iter().enumerate() {
+        h.state_mut().views[0].go_to_page(page);
+        h.run_steps(3);
+        assert_eq!(h.state().views[0].page_input, label);
+        focus_page_input(&mut h);
+        h.key_press(egui::Key::Enter);
+        h.run_steps(3);
+        assert_eq!(h.state().views[0].current, page, "{label}");
+        assert_eq!(h.state().views[0].page_input, label);
+    }
+    let after = h.state().session.get(id).unwrap();
+    assert_eq!(after.can_undo().map(str::to_owned), undo);
+    assert_eq!(after.dirty, dirty, "navigation does not edit the PDF");
+    assert_eq!(h.state().session.save_bytes(id).unwrap(), before_bytes, "navigation preserves saved PDF bytes");
+    let mut empty = pdfcraft_ui_egui::canvas::DocView::new(pdfcraft_engine::DocId(0), &Default::default(), Default::default());
+    assert!(!empty.go_to_typed("1", &[]), "an empty view has no current page to retain");
+}
+
+#[test]
+fn page_label_input_resolves_labels_numbers_and_restores_invalid_input() {
+    use pdfcraft_engine::{Edit, LabelStyle};
+    let mut h = harness();
+    restart_page_labels(&mut h);
+    h.state_mut().apply_edit(Edit::NumberPages { from: 4, to: 4, style: LabelStyle::Decimal, prefix: "A-".into(), first: 8 });
+    h.run_steps(3);
+    for (typed, page, displayed) in [("ii", 1, "ii"), ("2", 3, "2"), ("A-8", 4, "A-8"), ("3", 2, "1"), ("missing", 2, "1")] {
+        type_page_input(&mut h, typed);
+        h.key_press(egui::Key::Enter);
+        h.run_steps(3);
+        assert_eq!(h.state().views[0].current, page, "{typed}");
+        assert_eq!(h.state().views[0].page_input, displayed, "{typed}");
+    }
+    // Scripted page selection remains physical and one-based even when a numeric label differs.
+    h.state_mut().set_option("page", "2").unwrap();
+    h.run_steps(3);
+    assert_eq!((h.state().views[0].current, h.state().views[0].page_input.as_str()), (1, "ii"));
+
+    h.state_mut().apply_edit(Edit::NumberPages { from: 0, to: 1, style: LabelStyle::None, prefix: "Appendix".into(), first: 1 });
+    h.state_mut().views[0].go_to_page(1);
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].page_input, "Appendix");
+    focus_page_input(&mut h);
+    h.key_press(egui::Key::Enter);
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].current, 1, "a duplicate current label must not resolve to its first occurrence");
+    h.state_mut().views[0].go_to_page(2);
+    h.run_steps(3);
+    type_page_input(&mut h, "Appendix");
+    h.key_press(egui::Key::Enter);
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].current, 0, "a changed label keeps the existing first-match lookup");
+
+    h.state_mut().views[0].go_to_page(0);
+    h.state_mut().apply_edit(Edit::NumberPages { from: 0, to: 0, style: LabelStyle::None, prefix: String::new(), first: 1 });
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].page_input, "1", "an empty label falls back to the physical number");
+    focus_page_input(&mut h);
+    h.key_press(egui::Key::Enter);
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].current, 0, "the current fallback number must not jump to another page labelled 1");
+}
+
+#[test]
+fn page_label_input_preserves_literal_whitespace_before_trimmed_lookup() {
+    use pdfcraft_render::{DocInfo, PageInfo};
+    use pdfcraft_ui_egui::canvas::DocView;
+    // The importer trims label prefixes, so supply literal labels directly to the view.
+    for label in [" 1", "1 "] {
+        let info = DocInfo {
+            pages: [label, "ii", "1"]
+                .into_iter()
+                .map(|label| PageInfo { width: 200.0, height: 300.0, label: label.into(), crop: [0.0, 0.0, 200.0, 300.0], rotation: 0 })
+                .collect(),
+            ..Default::default()
+        };
+        let labels: Vec<String> = info.pages.iter().map(|page| page.label.clone()).collect();
+        let mut view = DocView::new(pdfcraft_engine::DocId(0), &info, Default::default());
+        view.document_replaced(&info);
+        assert_eq!(view.page_input, label, "the displayed label retains its literal whitespace");
+        let unchanged = view.page_input.clone();
+        assert!(view.go_to_typed(&unchanged, &labels));
+        assert_eq!(view.current, 0, "unchanged spaces in {label:?} belong to the label");
+        assert!(view.go_to_typed("1", &labels));
+        assert_eq!(view.current, 2, "changed input keeps the existing trimmed label lookup");
+    }
+}
+
+#[test]
+fn page_label_input_focus_command_refreshes_same_frame_navigation_and_preserves_a_draft() {
+    let mut h = harness();
+    restart_page_labels(&mut h);
+    assert_eq!(h.state().views[0].page_input, "i");
+    // No frame between navigation and the real command: it must not focus the old label.
+    h.state_mut().set_option("page", "3").unwrap();
+    assert!(h.state_mut().execute("view.focus_page_input"));
+    h.run_steps(3);
+    assert!(page_input_focused(&h));
+    assert_eq!(h.state().views[0].page_input, "1");
+    h.key_press(egui::Key::Enter);
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].current, 2, "the focus command selects the new current label");
+
+    type_page_input(&mut h, "draft");
+    h.state_mut().set_option("page", "4").unwrap();
+    assert!(h.state_mut().execute("view.focus_page_input"));
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].current, 3);
+    assert_eq!(h.state().views[0].page_input, "draft", "re-focusing keeps text already being edited");
+}
+
+#[test]
+fn page_label_input_new_document_does_not_inherit_or_commit_the_previous_draft() {
+    use pdfcraft_engine::{Edit, LabelStyle, Session};
+    let mut h = harness();
+    restart_page_labels(&mut h);
+    h.state_mut().views[0].go_to_page(3);
+    h.run_steps(3);
+    type_page_input(&mut h, "ii");
+    let original_id = h.state().views[0].id;
+    let original_bytes = h.state().session.save_bytes(original_id).unwrap();
+
+    let mut source = Session::new().with_clock(|| 1_700_000_000);
+    let source_id = source.open("new-labels.pdf", None, std::sync::Arc::new(fixture(5)), None).unwrap();
+    for (from, to, style) in [(0, 1, LabelStyle::LowerRoman), (2, 4, LabelStyle::Decimal)] {
+        source.apply(source_id, Edit::NumberPages { from, to, style, prefix: String::new(), first: 1 }).unwrap();
+    }
+    h.state_mut().open_bytes("new-labels.pdf", None, source.save_bytes(source_id).unwrap().as_ref().clone()).unwrap();
+    // Enter arriving with the switch must not submit the previous editor into this document.
+    h.key_press(egui::Key::Enter);
+    h.run_steps(3);
+    let next = h.state().active.unwrap();
+    assert_ne!(h.state().views[next].id, original_id);
+    assert_eq!((h.state().views[next].current, h.state().views[next].page_input.as_str()), (0, "i"));
+    assert!(!page_input_focused(&h), "the new document's editor starts idle");
+    assert_eq!((h.state().views[0].current, h.state().views[0].page_input.as_str()), (3, "ii"), "the hidden valid draft is not committed");
+    focus_page_input(&mut h);
+    h.key_press(egui::Key::Enter);
+    h.run_steps(3);
+    assert_eq!(h.state().views[next].current, 0, "unchanged Enter stays on the new document's first page");
+
+    h.get_by_label("a.pdf (edited)").click();
+    h.run_steps(3);
+    assert_eq!(h.state().active, Some(0));
+    assert_eq!((h.state().views[0].current, h.state().views[0].page_input.as_str()), (3, "2"));
+    assert_eq!(h.state().session.save_bytes(original_id).unwrap(), original_bytes, "tab switching never edits the original PDF");
+}
+
+#[test]
+fn page_label_input_preserves_typing_and_refreshes_after_navigation_and_tab_changes() {
+    let mut h = harness();
+    restart_page_labels(&mut h);
+    h.state_mut().views[0].go_to_page(0);
+    h.run_steps(3);
+    type_page_input(&mut h, "draft");
+    h.state_mut().views[0].go_to_page(3);
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].page_input, "draft", "paging must not overwrite the focused editor");
+    let editor_id = h.ctx.memory(|m| m.focused()).expect("focused page editor");
+    h.ctx.memory_mut(|m| m.surrender_focus(editor_id));
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].page_input, "2", "an idle editor follows the current page");
+
+    type_page_input(&mut h, "unsent");
+    h.get_by_label("b.pdf").click();
+    h.run_steps(3);
+    assert_eq!(h.state().active, Some(1));
+    assert_eq!(h.state().views[0].page_input, "unsent", "switching tabs keeps the hidden document's draft");
+    assert_eq!(h.state().views[1].page_input, "1", "the new document displays its own label");
+    h.state_mut().set_option("page", "2").unwrap();
+    h.run_steps(3);
+    focus_page_input(&mut h);
+    h.key_press(egui::Key::Enter);
+    h.run_steps(3);
+    assert_eq!((h.state().views[1].current, h.state().views[1].page_input.as_str()), (1, "2"), "default labels still work");
+    h.get_by_label("a.pdf (edited)").click();
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].page_input, "2", "returning to a document refreshes its idle label");
+
+    assert!(h.state_mut().views[0].view_history(false));
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].page_input, "i", "history navigation refreshes the label");
+}
+
+#[test]
+fn page_label_input_same_document_replacement_refreshes_the_focused_label() {
+    use pdfcraft_engine::{Edit, LabelStyle, Session};
+    use std::sync::Arc;
+    for (pages, roman, page, label) in [(5, false, 3, "4"), (5, true, 3, "iv"), (3, false, 2, "3")] {
+        let mut h = harness();
+        h.state_mut().active = Some(0);
+        h.state_mut().views[0].go_to_page(3);
+        h.run_steps(3);
+        assert_eq!((h.state().views[0].current, h.state().views[0].page_input.as_str()), (3, "4"));
+        focus_page_input(&mut h);
+        let editor_id = h.ctx.memory(|m| m.focused()).expect("focused page editor");
+        let id = h.state().views[0].id;
+        let before = h.state().session.get(id).unwrap();
+        assert!(!before.dirty);
+        assert_eq!((before.can_undo(), before.can_redo()), (None, None));
+
+        let replacement = if roman {
+            let mut source = Session::new().with_clock(|| 1_700_000_000);
+            let source_id = source.open("replacement.pdf", None, Arc::new(fixture(pages)), None).unwrap();
+            source
+                .apply(source_id, Edit::NumberPages { from: 0, to: pages - 1, style: LabelStyle::LowerRoman, prefix: String::new(), first: 1 })
+                .unwrap();
+            source.save_bytes(source_id).unwrap()
+        } else {
+            Arc::new(fixture(pages))
+        };
+        // The file watcher uses this same reload/replacement path without changing DocId.
+        let app = h.state_mut();
+        app.session.reload(id, replacement.clone()).unwrap();
+        let doc = app.session.get(id).unwrap();
+        app.views[0].document_replaced(&doc.info);
+        h.run_steps(3);
+        assert_eq!(h.state().views[0].id, id);
+        assert_eq!(h.ctx.memory(|m| m.focused()), Some(editor_id), "reload retains the actual editor's focus");
+        assert!(page_input_focused(&h));
+        assert_eq!((h.state().views[0].current, h.state().views[0].page_input.as_str()), (page, label), "replacement labels and page-count clamping");
+        h.key_press(egui::Key::Enter);
+        h.run_steps(3);
+        assert_eq!(
+            (h.state().views[0].current, h.state().views[0].page_input.as_str()),
+            (page, label),
+            "unchanged Enter retains the replacement's physical page"
+        );
+        assert_eq!(h.state().views[0].id, id);
+        let after = h.state().session.get(id).unwrap();
+        assert!(!after.dirty, "navigation does not edit the replacement");
+        assert_eq!((after.can_undo(), after.can_redo()), (None, None));
+        assert_eq!(h.state().session.save_bytes(id).unwrap(), replacement, "navigation preserves replacement PDF bytes");
+    }
+}
+
+#[test]
+fn page_label_input_same_document_replacement_keeps_full_label_selected_for_typing() {
+    use pdfcraft_engine::{Edit, LabelStyle, Session};
+    use std::sync::Arc;
+    for settling_frames in [3, 0] {
+        let mut h = harness();
+        h.state_mut().active = Some(0);
+        h.state_mut().views[0].go_to_page(3);
+        h.run_steps(3);
+        assert_eq!((h.state().views[0].current, h.state().views[0].page_input.as_str()), (3, "4"));
+        assert!(h.state_mut().execute("view.focus_page_input"));
+        h.run_steps(3);
+        assert!(page_input_focused(&h), "the real focus command focuses the page editor");
+        let editor_id = h.ctx.memory(|m| m.focused()).expect("focused page editor");
+        let range = egui::TextEdit::load_state(&h.ctx, editor_id).unwrap().cursor.char_range().unwrap();
+        let ends = [range.primary.index, range.secondary.index];
+        assert!(ends.contains(&egui::text::CCursor::new(0).index), "the old label selection starts at zero");
+        assert!(ends.contains(&egui::text::CCursor::new(1).index), "the entire old one-character label is selected");
+        let id = h.state().views[0].id;
+        let original = h.state().session.get(id).unwrap();
+        assert!(!original.dirty);
+        assert_eq!((original.can_undo(), original.can_redo()), (None, None));
+
+        let mut source = Session::new().with_clock(|| 1_700_000_000);
+        let source_id = source.open("replacement.pdf", None, Arc::new(fixture(5)), None).unwrap();
+        source.apply(source_id, Edit::NumberPages { from: 0, to: 4, style: LabelStyle::LowerRoman, prefix: String::new(), first: 1 }).unwrap();
+        let replacement = source.save_bytes(source_id).unwrap();
+        let app = h.state_mut();
+        app.session.reload(id, replacement.clone()).unwrap();
+        let doc = app.session.get(id).unwrap();
+        app.views[0].document_replaced(&doc.info);
+        // Cover the reproduced settled case and typing before the replacement's first frame.
+        if settling_frames > 0 {
+            h.run_steps(settling_frames);
+        }
+        assert_eq!(h.state().views[0].id, id);
+        assert_eq!(h.ctx.memory(|m| m.focused()), Some(editor_id), "same-DocId reload retains the actual focused editor");
+        assert!(page_input_focused(&h));
+        assert_eq!((h.state().views[0].current, h.state().views[0].page_input.as_str()), (3, "iv"));
+
+        // Ordinary typing must replace the whole refreshed label without another focus or select-all.
+        h.event(egui::Event::Text("2".into()));
+        h.run_steps(if settling_frames == 0 { 1 } else { 2 });
+        assert!(page_input_focused(&h));
+        assert_eq!(h.state().views[0].current, 3, "typing has not submitted navigation yet");
+        assert_eq!(h.state().views[0].page_input, "2", "typing replaces the entire replacement label");
+        // Selection synchronization is consumed once: later input appends at the caret.
+        h.event(egui::Event::Text("x".into()));
+        h.run_steps(1);
+        assert!(page_input_focused(&h));
+        assert_eq!(h.state().views[0].page_input, "2x", "a second character appends without selecting the label again");
+        h.key_press(egui::Key::Backspace);
+        h.run_steps(1);
+        assert_eq!(h.state().views[0].page_input, "2", "Backspace removes only the second character");
+        h.key_press(egui::Key::Enter);
+        h.run_steps(3);
+        assert_eq!((h.state().views[0].current, h.state().views[0].page_input.as_str()), (1, "ii"), "Enter goes to physical page two");
+        assert_eq!(h.state().views[0].id, id);
+        let after = h.state().session.get(id).unwrap();
+        assert!(!after.dirty, "navigation does not edit the replacement PDF");
+        assert_eq!((after.can_undo(), after.can_redo()), (None, None));
+        assert_eq!(h.state().session.save_bytes(id).unwrap(), replacement, "typing and navigation preserve replacement PDF bytes");
+    }
+}
+
 #[test]
 fn two_page_view_steps_a_spread_at_a_time() {
     // #70: ⌘→ went to the right-hand page of the same spread, so the view never moved.
@@ -547,6 +904,22 @@ fn optimizer_audits_space_usage() {
     assert_eq!(h.state().dialog, Some(Dialog::Optimize), "back to the optimizer");
 }
 
+#[test]
+fn space_audit_numbers_line_up_under_their_headers() {
+    // The percentages were drawn at the dialog's far edge, away from their header and the
+    // striped rows: a right-to-left layout in a grid's last column takes the rest of the window.
+    let mut h = harness();
+    assert!(h.state_mut().execute("optimize.advanced"));
+    h.run_steps(2);
+    h.get_by_label("Audit space usage…").click();
+    h.run_steps(3);
+    let total = h.state().space_audit.iter().map(|r| r.bytes).sum::<u64>().to_string();
+    let right = |label: &str| h.get_by_label(label).rect().right();
+    assert!((right("Percentage") - right("100.00%")).abs() < 1.0, "{} vs {}", right("Percentage"), right("100.00%"));
+    assert!((right("Bytes") - right(&total)).abs() < 1.0, "{} vs {}", right("Bytes"), right(&total));
+    assert!(right("100.00%") < right("OK") + 1.0, "the table stays inside the dialog");
+}
+
 #[test]
 fn each_document_keeps_its_own_scroll_position() {
     // #189: every document's page view shared one scroll position, so switching tabs showed a
@@ -924,12 +1297,17 @@ fn the_scroll_speed_preference_scales_mouse_wheel_notches() {
 
 /// A 40 × 30 picture (one red corner) and a harness showing a PDF of it.
 fn picture_harness() -> (image::RgbaImage, Harness<'static, PdfCraftApp>) {
+    picture_harness_sized(egui::vec2(1400.0, 900.0))
+}
+
+/// [`picture_harness`] in a window of this size.
+fn picture_harness_sized(size: egui::Vec2) -> (image::RgbaImage, Harness<'static, PdfCraftApp>) {
     let mut px = image::RgbaImage::from_pixel(40, 30, image::Rgba([10, 200, 30, 255]));
     px.put_pixel(0, 0, image::Rgba([255, 0, 0, 255]));
     let mut png = std::io::Cursor::new(Vec::new());
     image::DynamicImage::ImageRgba8(px.clone()).write_to(&mut png, image::ImageFormat::Png).unwrap();
     let pdf = pdfcraft_engine::Session::new().create_from_images(&[("p.png".into(), png.into_inner())]).unwrap();
-    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+    let mut h = Harness::builder().with_size(size).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
         app.set_option("language", "en").unwrap();
         app.open_bytes("pic.pdf", None, pdf.to_vec()).unwrap();
@@ -1044,6 +1422,91 @@ fn a_picture_inside_form_artwork_under_text_is_selected_and_copied() {
     let png = image::load_from_memory_with_format(&bytes, image::ImageFormat::Png).unwrap().into_rgba8();
     assert_eq!(png.into_raw(), vec![255, 0, 0, 255, 0, 0, 255, 255]);
 }
+
+/// A picture in Edit text & images, right-clicked so its menu is open (in a tall window, so the
+/// whole menu is on screen).
+fn picture_menu() -> (image::RgbaImage, Harness<'static, PdfCraftApp>) {
+    let (px, mut h) = picture_harness_sized(egui::vec2(1400.0, 1500.0));
+    h.state_mut().set_option("quick", "edit-text").unwrap();
+    h.run_steps(3);
+    let i = h.state().active.unwrap();
+    let at = h.state().views[i].page_screen_rect(0).expect("on screen").center();
+    h.hover_at(at);
+    h.run_steps(1);
+    h.event(egui::Event::PointerButton { pos: at, button: egui::PointerButton::Secondary, pressed: true, modifiers: Default::default() });
+    h.event(egui::Event::PointerButton { pos: at, button: egui::PointerButton::Secondary, pressed: false, modifiers: Default::default() });
+    h.run_steps(3);
+    (px, h)
+}
+
+fn picture_count(h: &Harness<'static, PdfCraftApp>) -> usize {
+    let s = h.state();
+    s.session.get(s.active_ids().unwrap().1).unwrap().page_images(0).len()
+}
+
+#[test]
+fn the_picture_menu_cuts_a_picture_to_the_clipboard_and_removes_it() {
+    let (px, mut h) = picture_menu();
+    assert_eq!(picture_count(&h), 1);
+    h.get_by_label("Cut Image").click();
+    h.run_steps(3);
+    let (w, hgt, rgba) = h.state().last_copied_image.clone().expect("the image was copied first");
+    assert_eq!((w, hgt), (40, 30));
+    assert_eq!(rgba, px.into_raw());
+    assert_eq!(picture_count(&h), 0, "then taken off the page");
+    h.state_mut().undo();
+    h.run_steps(2);
+    assert_eq!(picture_count(&h), 1, "one undo step puts it back");
+}
+
+#[test]
+fn the_picture_menu_marks_a_picture_for_redaction() {
+    let (_, mut h) = picture_menu();
+    let marks = |h: &Harness<'static, PdfCraftApp>| {
+        let s = h.state();
+        s.session.get(s.active_ids().unwrap().1).unwrap().redaction_marks()
+    };
+    assert_eq!(marks(&h), 0);
+    h.get_by_label("Redact Image").click();
+    h.run_steps(3);
+    assert_eq!(marks(&h), 1);
+    assert_eq!(picture_count(&h), 1, "marked, not yet removed: Redact a PDF applies it");
+}
+
+#[test]
+fn the_picture_menu_opens_link_properties_and_recognize_text_for_the_picture() {
+    let (_, mut h) = picture_menu();
+    h.get_by_label("Create Link…").click();
+    h.run_steps(3);
+    assert!(matches!(h.state().dialog, Some(pdfcraft_ui_egui::Dialog::LinkProps)));
+    let draft = h.state().link_draft.clone().expect("the link draft");
+    assert_eq!(draft.page, 0);
+    assert!(draft.rect[2] > draft.rect[0] && draft.rect[3] > draft.rect[1], "over the picture: {:?}", draft.rect);
+
+    let (_, mut h) = picture_menu();
+    h.get_by_label("Recognize Text…").click();
+    h.run_steps(3);
+    assert!(matches!(h.state().dialog, Some(pdfcraft_ui_egui::Dialog::RecognizeText)));
+    let d = &h.state().ocr_draft;
+    assert_eq!((format!("{:?}", d.pages), d.from, d.to), ("Range".to_string(), 1, 1));
+}
+
+/// The menu is longer than the picture is tall, so most items lie outside it: the pointer moving
+/// onto them must not close the menu (it used to be drawn only while the pointer was over the
+/// picture, so Delete and the items below the page could not be clicked).
+#[test]
+fn every_item_of_the_picture_menu_can_be_clicked_outside_the_picture() {
+    let (_, mut h) = picture_menu();
+    let s = h.state();
+    let page = s.views[s.active.unwrap()].page_screen_rect(0).expect("on screen");
+    let delete = h.get_by_label("Delete").rect();
+    assert!(delete.center().y > page.bottom(), "Delete lies below the page: {delete:?} vs {page:?}");
+    assert_eq!(picture_count(&h), 1);
+    h.get_by_label("Delete").click();
+    h.run_steps(3);
+    assert_eq!(picture_count(&h), 0);
+}
+
 #[test]
 fn mouse_wheel_scrolls_while_selecting_text() {
     let mut h = harness();
@@ -1225,3 +1688,53 @@ fn selection_mouse_wheel_resumes_after_point_scrolling() {
         }
     }
 }
+
+#[test]
+fn page_command_without_selection_acts_on_the_page_pressed() {
+    let mut h = harness(); // b.pdf (2 pages) is active
+    h.state_mut().set_option("zoom", "50").unwrap();
+    h.run_steps(3);
+    // Page 2 was gone to earlier; both pages show whole, so it stays current.
+    h.state_mut().set_option("page", "2").unwrap();
+    h.run_steps(5);
+    let at = |h: &Harness<'static, PdfCraftApp>, page: usize| {
+        let v = &h.state().views[h.state().active.unwrap()];
+        v.page_screen_rect(page).expect("page on screen").center()
+    };
+    let first = at(&h, 0);
+    h.event(egui::Event::PointerMoved(first));
+    h.run_steps(2);
+    h.event(egui::Event::PointerButton { pos: first, button: egui::PointerButton::Primary, pressed: true, modifiers: egui::Modifiers::NONE });
+    h.run_steps(2);
+    h.event(egui::Event::PointerButton { pos: first, button: egui::PointerButton::Primary, pressed: false, modifiers: egui::Modifiers::NONE });
+    h.run_steps(3);
+    assert_eq!(h.state().views[h.state().active.unwrap()].current, 0, "the pressed page is the current one");
+    h.state_mut().execute("page.rotate");
+    h.run_steps(3);
+    let s = h.state();
+    let d = s.session.get(s.views[s.active.unwrap()].id).unwrap();
+    assert_eq!(d.info.pages.iter().map(|p| p.rotation).collect::<Vec<_>>(), [90, 0]);
+}
+
+/// ↓ / ↑ follow the Scroll speed preference as the wheel does (#985): Fast reaches the next page
+/// in about half the presses of Normal, and Slow takes about twice as many.
+#[test]
+fn arrow_keys_follow_the_scroll_speed_preference() {
+    use egui::Key;
+    let lines_to_page_2 = |speed: &str| {
+        let mut h = harness();
+        h.state_mut().active = Some(0);
+        h.state_mut().set_option("scroll_speed", speed).unwrap();
+        h.run_steps(4);
+        let mut n = 0;
+        while h.state().views[0].current == 0 {
+            h.key_press(Key::ArrowDown);
+            h.run_steps(2);
+            n += 1;
+            assert!(n < 1000, "↓ never reached page 2 at {speed}");
+        }
+        n
+    };
+    let (slow, normal, fast) = (lines_to_page_2("slow"), lines_to_page_2("normal"), lines_to_page_2("fast"));
+    assert!(fast * 3 < normal * 2 && normal * 3 < slow * 2, "presses to page 2: slow {slow}, normal {normal}, fast {fast}");
+}
diff --git a/crates/xfa/README.md b/crates/xfa/README.md
index 4ded8f808..5d494d7b4 100644
--- a/crates/xfa/README.md
+++ b/crates/xfa/README.md
@@ -118,6 +118,12 @@ let form = pdfcraft_xfa::layout_xml(template_xml)?;       // pages of items, for
   allocates is not capped (the same holds for AcroForm JavaScript).
 - **Static XFA forms** (`/NeedsRendering` absent, AcroForm fields present) keep their AcroForm;
   only their data is read and written.
+- **Flattening and converting.** `strip` takes the XFA out of a document: the packets,
+  `/NeedsRendering`, the layout mark, the overrides and the private keys on the fields. The
+  engine calls it after flattening an XFA form's fields (so Adobe's viewers show the baked
+  pages instead of laying the form out again from the template) and for "convert to a static
+  form" (`xfa_to_static`), which keeps the laid-out pages and the fields with their values as
+  an ordinary AcroForm that no viewer lays out again and whose scripts no longer run.
 - **Field kinds.** Choice lists become combo boxes (editable with `textEntry`) or list boxes
   (`open="always"`, multi-select with `open="multiSelect"`), with the shown items and the saved
   values of `<items save="1">` as the options; the data holds saved values, several on
diff --git a/crates/xfa/src/data.rs b/crates/xfa/src/data.rs
index 504e4b367..d3e1f2c1a 100644
--- a/crates/xfa/src/data.rs
+++ b/crates/xfa/src/data.rs
@@ -188,6 +188,30 @@ fn som_of(doc: &Document, f: &FieldDatum) -> String {
     doc.get(f.obj).as_dict().and_then(|d| text_of(doc, d, crate::pdf::SOM_KEY)).unwrap_or_else(|| f.name.clone())
 }
 
+/// The datasets text for a radio group. The AcroForm value is an appearance-state name
+/// (`New York` is stored as `New_York`); `/PCOn` on the selected widget is the original item.
+fn radio_dataset_value(doc: &Document, f: &FieldDatum, sel: &Option<String>) -> String {
+    let Some(selected) = sel.as_deref().filter(|s| !s.is_empty() && *s != "Off") else {
+        return String::new();
+    };
+    let Some(group) = doc.get(f.obj).as_dict().cloned() else { return selected.to_string() };
+    let kids = group.get(b"Kids").map(|k| doc.resolve(k)).and_then(|k| k.as_array().cloned()).unwrap_or_else(|| vec![Object::Ref(f.obj)]);
+    for kid in kids {
+        let Some(widget) = doc.resolve(&kid).as_dict().cloned() else { continue };
+        let original = text_of(doc, &widget, b"PCOn");
+        let state = widget
+            .get(b"AP")
+            .map(|ap| doc.resolve(ap))
+            .and_then(|ap| ap.as_dict().and_then(|a| a.get(b"N").cloned()))
+            .and_then(|n| doc.resolve(&n).as_dict().cloned())
+            .and_then(|n| n.iter().map(|(k, _)| String::from_utf8_lossy(k).into_owned()).find(|k| k != "Off"));
+        if state.as_deref() == Some(selected) || original.as_deref() == Some(selected) {
+            return original.unwrap_or_else(|| selected.to_string());
+        }
+    }
+    selected.to_string()
+}
+
 /// The on and off item values of a check box (`/PCItems`), or the widget's on state.
 fn items_of(doc: &Document, f: &FieldDatum) -> (String, String) {
     let d = doc.get(f.obj);
@@ -439,7 +463,7 @@ fn wanted(doc: &Document, fields: &[FieldDatum], tpl: Option<&Template>) -> Vec<
                 let (on_item, off_item) = items_of(doc, f);
                 if *on { on_item } else { off_item }
             }
-            FieldData::Radio(sel) => sel.clone().unwrap_or_default(),
+            FieldData::Radio(sel) => radio_dataset_value(doc, f, sel),
             FieldData::None => continue,
         };
         out.push(Want { som, path, text, ensure: false });
diff --git a/crates/xfa/src/layout.rs b/crates/xfa/src/layout.rs
index fb9ac5518..a491d3f49 100644
--- a/crates/xfa/src/layout.rs
+++ b/crates/xfa/src/layout.rs
@@ -221,12 +221,6 @@ pub fn instance_count(occur: &Occur, from_data: usize) -> usize {
     n.min(occur.max.unwrap_or(usize::MAX)).clamp(1, MAX_INSTANCES)
 }
 
-/// Index of child `i` among the earlier siblings with the same name (the SOM index).
-fn sib_index(children: &[Node], i: usize) -> usize {
-    let name = children.get(i).and_then(|c| c.common().name.as_deref());
-    children.iter().take(i).filter(|c| c.common().name.as_deref() == name && name.is_some()).count()
-}
-
 /// Lay a template out, with the values and repeat counts of `data` (the `xfa:data` element).
 pub fn layout(tpl: &Template, data: Option<&DataNode>) -> Result<Form, XfaError> {
     let areas = match &tpl.root.page_set {
@@ -521,8 +515,9 @@ impl Layouter<'_> {
         // Master page content: positioned draws and fields.
         let ctx = Ctx { font: Font::default(), para: Para::default(), som: area.name.clone().map(|n| format!("{n}[0]")).unwrap_or_default() };
         let page_rect = Rect::new(0.0, 0.0, area.width, area.height);
+        let sibs = SomIndices::of(&area.items);
         for (i, item) in area.items.iter().enumerate() {
-            self.draw_positioned_child(item, page_rect, &ctx, 1, sib_index(&area.items, i))?;
+            self.draw_positioned_child(item, page_rect, &ctx, 1, sibs.at(i))?;
         }
         Ok(())
     }
@@ -748,11 +743,12 @@ impl Layouter<'_> {
             match sf.layout {
                 Layout::Table => self.flow_table(sf, inner_x, inner_w, &ctx, depth)?,
                 _ => {
+                    let sibs = SomIndices::of(&sf.children);
                     for (ci, child) in sf.children.iter().enumerate() {
                         if !child.common().presence.occupies() {
                             continue;
                         }
-                        let csib = sib_index(&sf.children, ci);
+                        let csib = sibs.at(ci);
                         if let Node::Subform(_) = child
                             && splittable(child)
                         {
@@ -784,11 +780,12 @@ impl Layouter<'_> {
         let cols = self.columns(sf, inner_w);
         let leader =
             sf.overflow_leader.as_ref().and_then(|name| sf.children.iter().position(|c| c.common().name.as_deref() == Some(name) && is_row(c)));
+        let sibs = SomIndices::of(&sf.children);
         for (ci, child) in sf.children.iter().enumerate() {
             if !child.common().presence.occupies() {
                 continue;
             }
-            let csib = sib_index(&sf.children, ci);
+            let csib = sibs.at(ci);
             if let Node::Subform(row) = child
                 && row.layout == Layout::Row
             {
@@ -804,7 +801,7 @@ impl Layouter<'_> {
                     {
                         let lh = self.row_height(l, &cols, inner_w, ctx, depth + 1);
                         let (_, y, _) = self.cursor();
-                        self.draw_row(l, &cols, Rect::new(x, y, inner_w, lh), ctx, depth + 1, sib_index(&sf.children, li))?;
+                        self.draw_row(l, &cols, Rect::new(x, y, inner_w, lh), ctx, depth + 1, sibs.at(li))?;
                         self.place(lh);
                     }
                     let (_, y, _) = self.cursor();
@@ -1163,10 +1160,11 @@ impl Layouter<'_> {
         let ctx = ctx.with_som(&row.common, sib);
         let inner = rect.inset(&row.common.margin);
         let (cells, _) = self.cells(row, cols, inner.w, &ctx, depth);
+        let sibs = SomIndices::of(&row.children);
         for (i, r) in cells {
             if let Some(k) = row.children.get(i) {
                 // Cells stretch to the row height.
-                self.draw_node(k, Rect::new(inner.x + r.x, inner.y, r.w, inner.h), &ctx, depth + 1, sib_index(&row.children, i))?;
+                self.draw_node(k, Rect::new(inner.x + r.x, inner.y, r.w, inner.h), &ctx, depth + 1, sibs.at(i))?;
             }
         }
         Ok(())
@@ -1209,8 +1207,9 @@ impl Layouter<'_> {
             Node::ExclGroup(g) => self.draw_group(g, rect, ctx, depth, sib),
             Node::Area(a) => {
                 let ctx = ctx.with_som(&a.common, sib);
+                let sibs = SomIndices::of(&a.children);
                 for (i, k) in a.children.iter().enumerate() {
-                    self.draw_positioned_child(k, rect, &ctx, depth + 1, sib_index(&a.children, i))?;
+                    self.draw_positioned_child(k, rect, &ctx, depth + 1, sibs.at(i))?;
                 }
                 Ok(())
             }
@@ -1221,10 +1220,11 @@ impl Layouter<'_> {
                 let parent_ctx = ctx;
                 let ctx = ctx.with_som(&s.common, sib);
                 let inner = rect.inset(&s.common.margin);
+                let sibs = SomIndices::of(&s.children);
                 match s.layout {
                     Layout::Positioned => {
                         for (i, k) in s.children.iter().enumerate() {
-                            self.draw_positioned_child(k, inner, &ctx, depth + 1, sib_index(&s.children, i))?;
+                            self.draw_positioned_child(k, inner, &ctx, depth + 1, sibs.at(i))?;
                         }
                     }
                     Layout::Tb => {
@@ -1237,7 +1237,7 @@ impl Layouter<'_> {
                             // A repeating subform here (a table in an area of a positioned page,
                             // say) gets its instances, as in a flowed one, one under another.
                             for instance in 0..self.instances(k, &ctx.som) {
-                                self.draw_node(k, Rect::new(inner.x, y, w, h), &ctx, depth + 1, sib_index(&s.children, i) + instance)?;
+                                self.draw_node(k, Rect::new(inner.x, y, w, h), &ctx, depth + 1, sibs.at(i) + instance)?;
                                 y += h;
                             }
                         }
@@ -1249,7 +1249,7 @@ impl Layouter<'_> {
                         for (i, instance, r) in placed {
                             if let Some(k) = s.children.get(i) {
                                 let x = if s.layout == Layout::RlTb { inner.right() - r.x - r.w } else { inner.x + r.x };
-                                self.draw_node(k, Rect::new(x, inner.y + r.y, r.w, r.h), &ctx, depth + 1, sib_index(&s.children, i) + instance)?;
+                                self.draw_node(k, Rect::new(x, inner.y + r.y, r.w, r.h), &ctx, depth + 1, sibs.at(i) + instance)?;
                             }
                         }
                     }
@@ -1260,7 +1260,7 @@ impl Layouter<'_> {
                             if !k.common().presence.occupies() {
                                 continue;
                             }
-                            let csib = sib_index(&s.children, i);
+                            let csib = sibs.at(i);
                             if let Node::Subform(r) = k
                                 && r.layout == Layout::Row
                             {
@@ -1402,12 +1402,13 @@ impl Layouter<'_> {
                 .collect(),
             _ => self.pack(&nodes, inner.w, &ctx, depth).0,
         };
+        let sibs = SomIndices::of(&nodes);
         for (i, r) in placed {
             if let Some(f) = g.fields.get(i) {
                 let on = f.items.first().cloned().filter(|s| !s.trim().is_empty()).unwrap_or_else(|| (i + 1).to_string());
                 let tip = f.tooltip.clone().or_else(|| g.tooltip.clone());
                 let chosen = selected.as_deref() == Some(on.as_str());
-                self.draw_field(f, Rect::new(inner.x + r.x, inner.y + r.y, r.w, r.h), &ctx, Some((&group, &on, tip, chosen)), sib_index(&nodes, i))?;
+                self.draw_field(f, Rect::new(inner.x + r.x, inner.y + r.y, r.w, r.h), &ctx, Some((&group, &on, tip, chosen)), sibs.at(i))?;
             }
         }
         Ok(())
diff --git a/crates/xfa/src/lib.rs b/crates/xfa/src/lib.rs
index ec4130cd9..bf4414970 100644
--- a/crates/xfa/src/lib.rs
+++ b/crates/xfa/src/lib.rs
@@ -98,7 +98,7 @@ pub use data::{
 pub use layout::{Action, BorderShape, Form, Item, MAX_PAGES, Page, Widget, WidgetKind, layout};
 pub use packets::{Encoding, Packets, decode as decode_packet, encode as encode_packet, read_packets};
 pub use parse::{measure, parse};
-pub use pdf::{CLICK_KEY, LAYOUT_KEY, SOM_KEY, existing_layout};
+pub use pdf::{CLICK_KEY, LAYOUT_KEY, SOM_KEY, Stripped, XfaShape, existing_layout, strip, xfa_shape};
 pub use script::{
     FormNode, LiveForm, MAX_FORM_NODES, NodeKind, OVERRIDES_KEY, Overrides, ScriptEvent, apply_overrides, data_of, fields_by_som, form_tree,
     has_scripts, overrides, refresh_value, rerender, set_overrides, template_of,
diff --git a/crates/xfa/src/model.rs b/crates/xfa/src/model.rs
index 01a4b9bcf..f4ef3fabc 100644
--- a/crates/xfa/src/model.rs
+++ b/crates/xfa/src/model.rs
@@ -350,6 +350,30 @@ impl Node {
     }
 }
 
+pub(crate) struct SomIndices(Vec<usize>);
+
+impl SomIndices {
+    pub(crate) fn of(children: &[Node]) -> Self {
+        let mut seen = std::collections::HashMap::new();
+        SomIndices(
+            children
+                .iter()
+                .map(|c| {
+                    c.common().name.as_deref().map_or(0, |name| {
+                        let n = seen.entry(name).or_insert(0);
+                        *n += 1;
+                        *n - 1
+                    })
+                })
+                .collect(),
+        )
+    }
+
+    pub(crate) fn at(&self, i: usize) -> usize {
+        self.0.get(i).copied().unwrap_or(0)
+    }
+}
+
 /// How often a subform occurs when no data drives it.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub struct Occur {
diff --git a/crates/xfa/src/pdf.rs b/crates/xfa/src/pdf.rs
index 54e70a35b..cca62e64e 100644
--- a/crates/xfa/src/pdf.rs
+++ b/crates/xfa/src/pdf.rs
@@ -421,6 +421,9 @@ impl Emitter<'_> {
                     }
                 };
                 d.set(b"Parent".to_vec(), Object::Ref(parent));
+                // Appearance states are PDF names, so a space becomes an underscore. The datasets
+                // still hold the template's text (`/PCOn`); writing the name back would drop the selection.
+                d.set(b"PCOn".to_vec(), Object::String(PdfString::text(on)));
                 let state = state_name(on);
                 let chosen = w.value.is_some();
                 d.set(b"AS".to_vec(), Object::name(if chosen { &state } else { "Off" }));
@@ -777,6 +780,250 @@ pub fn write_form(doc: &mut Document, form: &Form) -> Result<Written, XfaError>
     Ok(Written { pages: count, fields: field_count, warnings })
 }
 
+/// What [`strip`] took out, for the user to be told (the packets held more than the fields).
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct Stripped {
+    /// The packets removed, by name (`template`, `datasets`, `config`, `signature`, …).
+    pub packets: Vec<String>,
+    /// Data values in the datasets no field held (what the form's data had that its fields
+    /// didn't show); `None` when the template could not be read to tell.
+    pub unbound_data: Option<usize>,
+    /// Buttons whose click ran an XFA script, and image fields: they do nothing from now on.
+    pub script_buttons: usize,
+    pub image_fields: usize,
+    /// What the layout left out (pictures, rows past the cap), now for good.
+    pub layout_warnings: Vec<String>,
+    /// Reader usage rights (`/Perms /UR3`) were removed: changing the form voids them anyway.
+    pub usage_rights: bool,
+    /// Private keys removed from field dictionaries (`/PCSom`, `/PCXfaClick`, …).
+    pub field_keys: usize,
+}
+
+impl Stripped {
+    /// What was dropped, as lines for the user (empty when nothing worth saying).
+    pub fn notes(&self) -> Vec<String> {
+        let mut out = Vec::new();
+        if !self.packets.is_empty() {
+            out.push(format!("The XFA was taken out of the form: its {} packet(s) are gone from the saved file", self.packets.join(", ")));
+        }
+        match self.unbound_data {
+            Some(n) if n > 0 => out.push(format!("{n} value(s) the form's XFA data held that no field showed are gone with it")),
+            None => out.push("The template could not be read, so data the fields didn't show may be gone with the XFA".into()),
+            _ => {}
+        }
+        if self.script_buttons + self.image_fields > 0 {
+            out.push(format!("{} button(s) that ran XFA scripts and {} image field(s) do nothing now", self.script_buttons, self.image_fields));
+        }
+        for w in &self.layout_warnings {
+            out.push(format!("Kept as laid out: {w}"));
+        }
+        if self.usage_rights {
+            out.push("Adobe Reader extended features were removed (changing the form voids them)".into());
+        }
+        out
+    }
+}
+
+/// What a document's XFA entry says, from its dictionaries alone (no packet decoded).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct XfaShape {
+    /// `/NeedsRendering true`: the form expects to be laid out from the template.
+    pub needs_rendering: bool,
+    /// The AcroForm has fields of its own.
+    pub has_fields: bool,
+    /// PdfCraft laid the form out (the layout mark is there).
+    pub laid_out: bool,
+}
+
+impl XfaShape {
+    /// Whether taking the XFA out leaves a form every viewer shows: the pages PdfCraft laid out
+    /// (with their fields), or a static form's own pages and fields. A dynamic form that was
+    /// never laid out has only placeholder pages: stripping it would leave nothing.
+    pub fn strippable(self) -> bool {
+        self.laid_out || (!self.needs_rendering && self.has_fields)
+    }
+}
+
+/// The document's XFA entry, if any, without decoding a packet.
+pub fn xfa_shape(doc: &Document) -> Option<XfaShape> {
+    let root = doc.root()?;
+    let catalog = doc.get(root);
+    let catalog = catalog.as_dict()?;
+    let acro = doc.resolve(catalog.get(b"AcroForm")?);
+    let acro = acro.as_dict()?;
+    acro.get(b"XFA")?;
+    let bool_of = |v: Option<&Object>| matches!(v.map(|v| doc.resolve(v)).as_deref(), Some(Object::Bool(true)));
+    let needs_rendering = bool_of(catalog.get(b"NeedsRendering")) || bool_of(acro.get(b"NeedsRendering"));
+    let has_fields = acro.get(b"Fields").map(|f| doc.resolve(f)).and_then(|f| f.as_array().map(|a| !a.is_empty())).unwrap_or(false);
+    Some(XfaShape { needs_rendering, has_fields, laid_out: acro.contains(LAYOUT_KEY) })
+}
+
+/// Most field dictionaries walked for their private keys.
+const MAX_STRIP_FIELDS: usize = 1_000_000;
+
+/// Take the XFA out of a document, leaving what every viewer shows: the pages as laid out
+/// and, when the fields were kept, an ordinary AcroForm. The packets (template, data and
+/// all), `/NeedsRendering`, the layout mark, the overrides and Reader usage rights go, and
+/// the fields lose the private keys PdfCraft gave them. A flattened form (no fields left)
+/// becomes a plain PDF; one with its fields becomes a static form that Adobe's viewers no
+/// longer lay out again. What the packets held beyond the fields is counted in the report,
+/// so the user can be told; the caller decides whether the form is one to strip
+/// ([`XfaShape::strippable`]). A document without XFA is left as it is.
+pub fn strip(doc: &mut Document) -> Result<Stripped, XfaError> {
+    let mut out = Stripped::default();
+    let Some(root) = doc.root() else { return Ok(out) };
+    let Some(mut catalog) = doc.get(root).as_dict().cloned() else { return Ok(out) };
+    let acro_obj = catalog.get(b"AcroForm").cloned();
+    let Some(acro_obj) = acro_obj else { return Ok(out) };
+    let Some(mut acro) = doc.resolve(&acro_obj).as_dict().cloned() else { return Ok(out) };
+    let Some(xfa) = acro.get(b"XFA").cloned() else { return Ok(out) };
+    // What is about to go, while it can still be read.
+    out.unbound_data = unbound_data(doc);
+    out.layout_warnings = existing_layout(doc).map(|r| r.warnings).unwrap_or_default();
+    let mut streams: Vec<ObjRef> = Vec::new();
+    match &*doc.resolve(&xfa) {
+        Object::Array(items) => {
+            let mut i = 0;
+            while i < items.len() {
+                let name = items.get(i).and_then(|n| n.as_string()).map(|s| s.to_text());
+                let stream = if name.is_some() { items.get(i + 1) } else { items.get(i) };
+                if let Some(n) = &name {
+                    out.packets.push(n.clone());
+                }
+                if let Some(r) = stream.and_then(Object::as_ref) {
+                    streams.push(r);
+                }
+                i += if name.is_some() { 2 } else { 1 };
+            }
+        }
+        Object::Stream(s) => {
+            if let Some(r) = xfa.as_ref() {
+                streams.push(r);
+            }
+            // One XDP: the packets it holds are the envelope's children.
+            let text = s.decoded_within(64 << 20).ok().and_then(|b| crate::packets::decode(&b)).map(|(t, _)| t).unwrap_or_default();
+            let opts = roxmltree::ParsingOptions { allow_dtd: false, nodes_limit: 1_000_000 };
+            if crate::xml_nesting_depth(&text) <= crate::MAX_XML_DEPTH
+                && let Ok(parsed) = roxmltree::Document::parse_with_options(&text, opts)
+            {
+                let root = parsed.root_element();
+                if root.tag_name().name() == "xdp" {
+                    out.packets.extend(root.children().filter(|c| c.is_element()).map(|c| c.tag_name().name().to_string()).take(32));
+                } else {
+                    out.packets.push(root.tag_name().name().to_string());
+                }
+            }
+            if out.packets.is_empty() {
+                out.packets.push("xdp".into());
+            }
+        }
+        _ => {}
+    }
+    acro.remove(b"XFA");
+    for key in [b"NeedsRendering".as_slice(), LAYOUT_KEY, crate::script::OVERRIDES_KEY] {
+        acro.remove(key);
+    }
+    // The private keys on every field and widget, down the tree (each dictionary once).
+    let fields = acro.get(b"Fields").map(|f| doc.resolve(f)).and_then(|f| f.as_array().cloned()).unwrap_or_default();
+    let mut seen = std::collections::HashSet::new();
+    let mut todo: Vec<ObjRef> = Vec::new();
+    for r in fields.iter().filter_map(Object::as_ref) {
+        if seen.insert(r) && seen.len() <= MAX_STRIP_FIELDS {
+            todo.push(r);
+        }
+    }
+    while let Some(r) = todo.pop() {
+        let Some(d) = doc.get(r).as_dict().cloned() else { continue };
+        if d.contains(CLICK_KEY) {
+            out.script_buttons += 1;
+        }
+        if d.contains(IMAGE_FIELD_KEY) {
+            out.image_fields += 1;
+        }
+        let private: Vec<Vec<u8>> =
+            [SOM_KEY, CLICK_KEY, IMAGE_FIELD_KEY, b"PCItems".as_slice()].iter().filter(|k| d.contains(k)).map(|k| k.to_vec()).collect();
+        if !private.is_empty() {
+            out.field_keys += private.len();
+            doc.update_dict(r, |d| {
+                for k in &private {
+                    d.remove(k);
+                }
+            })?;
+        }
+        if let Some(kids) = d.get(b"Kids").map(|k| doc.resolve(k)).and_then(|k| k.as_array().cloned()) {
+            for k in kids.iter().filter_map(Object::as_ref) {
+                if seen.insert(k) && seen.len() <= MAX_STRIP_FIELDS {
+                    todo.push(k);
+                }
+            }
+        }
+    }
+    match acro_obj.as_ref() {
+        Some(r) => doc.set(r, Object::Dict(acro)),
+        None => catalog.set(b"AcroForm".to_vec(), Object::Dict(acro)),
+    }
+    catalog.remove(b"NeedsRendering");
+    // Reader usage rights are void once the form changed: Reader says so on opening the file
+    // and drops them, so they go now, with a note.
+    if let Some(perms) = catalog.get(b"Perms").map(|p| doc.resolve(p))
+        && let Some(mut perms) = perms.as_dict().cloned()
+        && (perms.contains(b"UR3") || perms.contains(b"UR"))
+    {
+        perms.remove(b"UR3");
+        perms.remove(b"UR");
+        out.usage_rights = true;
+        if perms.is_empty() {
+            catalog.remove(b"Perms");
+        } else {
+            catalog.set(b"Perms".to_vec(), Object::Dict(perms));
+        }
+    }
+    doc.set(root, Object::Dict(catalog));
+    // The packet streams are referenced from nowhere else: freed, so an incremental save
+    // doesn't carry an unreachable copy of the data.
+    for r in streams {
+        doc.free(r);
+    }
+    Ok(out)
+}
+
+/// Values in the datasets that no field of the laid-out form holds (leaf text nodes whose
+/// data path no field binds to). `None` when the template can't be read.
+fn unbound_data(doc: &Document) -> Option<usize> {
+    let data = crate::script::data_of(doc)?;
+    let tpl = crate::script::template_of(doc).ok()?;
+    let bound: std::collections::HashSet<crate::data::DataPath> =
+        crate::script::fields_by_som(doc).keys().map(|som| crate::data::data_path(&tpl, som)).collect();
+    fn walk(
+        n: &crate::data::DataNode,
+        path: &mut crate::data::DataPath,
+        bound: &std::collections::HashSet<crate::data::DataPath>,
+        count: &mut usize,
+        depth: usize,
+    ) {
+        if depth > 64 {
+            return;
+        }
+        let mut seen: std::collections::HashMap<&str, usize> = std::collections::HashMap::new();
+        for c in &n.children {
+            let idx = seen.entry(c.name.as_str()).or_insert(0);
+            path.push((c.name.clone(), *idx));
+            *idx += 1;
+            if c.children.is_empty() {
+                if !c.text.trim().is_empty() && !bound.contains(path) {
+                    *count += 1;
+                }
+            } else {
+                walk(c, path, bound, count, depth + 1);
+            }
+            path.pop();
+        }
+    }
+    let mut count = 0;
+    walk(&data, &mut Vec::new(), &bound, &mut count, 0);
+    Some(count)
+}
+
 /// The layout a document already carries from an earlier pass, if any.
 pub fn existing_layout(doc: &Document) -> Option<crate::Report> {
     let root = doc.root()?;
diff --git a/crates/xfa/src/script.rs b/crates/xfa/src/script.rs
index ddc52af81..17a037664 100644
--- a/crates/xfa/src/script.rs
+++ b/crates/xfa/src/script.rs
@@ -156,12 +156,6 @@ pub fn set_overrides(doc: &mut Document, ov: &Overrides) -> Result<(), XfaError>
     Ok(())
 }
 
-/// Index of child `i` among the earlier siblings with the same name.
-fn sib_index(children: &[Node], i: usize) -> usize {
-    let name = children.get(i).and_then(|c| c.common().name.as_deref());
-    children.iter().take(i).filter(|c| c.common().name.as_deref() == name && name.is_some()).count()
-}
-
 fn child_som(parent: &str, name: Option<&str>, index: usize) -> String {
     match name {
         Some(n) if !parent.is_empty() => format!("{parent}.{n}[{index}]"),
@@ -285,11 +279,12 @@ impl Walker<'_> {
         if depth > MAX_DEPTH {
             return out;
         }
+        let sibs = SomIndices::of(nodes);
         for (i, n) in nodes.iter().enumerate() {
             if !self.take() {
                 break;
             }
-            let sib = sib_index(nodes, i);
+            let sib = sibs.at(i);
             match n {
                 Node::Subform(sf) => {
                     let from_data = match (&sf.common.name, self.data) {
@@ -360,12 +355,13 @@ impl Walker<'_> {
                         self.data.and_then(|d| d.text_at(&data_path(self.tpl, &som))).map(|t| t.trim().to_string()).filter(|t| !t.is_empty());
                     self.push_events(&som, &g.scripts, None, None, None);
                     let fields: Vec<Node> = g.fields.iter().map(|f| Node::Field(Box::new(f.clone()))).collect();
+                    let fsibs = SomIndices::of(&fields);
                     let mut children = Vec::new();
                     for (fi, f) in g.fields.iter().enumerate() {
                         if !self.take() {
                             break;
                         }
-                        children.push(self.field(f, &som, sib_index(&fields, fi), Some(selected.as_deref().unwrap_or(""))));
+                        children.push(self.field(f, &som, fsibs.at(fi), Some(selected.as_deref().unwrap_or(""))));
                     }
                     out.push(FormNode {
                         name: g.common.name.clone().unwrap_or_else(|| "group".into()),
@@ -451,9 +447,9 @@ pub fn apply_overrides(tpl: &Template, ov: &Overrides) -> Template {
         if depth > MAX_DEPTH {
             return;
         }
-        let sibs: Vec<usize> = (0..nodes.len()).map(|i| sib_index(nodes, i)).collect();
+        let sibs = SomIndices::of(nodes);
         for (i, n) in nodes.iter_mut().enumerate() {
-            let sib = sibs.get(i).copied().unwrap_or(0);
+            let sib = sibs.at(i);
             let name_default = match n {
                 Node::Field(_) => Some("field"),
                 Node::ExclGroup(_) => Some("group"),
@@ -498,8 +494,9 @@ pub fn apply_overrides(tpl: &Template, ov: &Overrides) -> Template {
                         g.common.presence = p;
                     }
                     let fields: Vec<Node> = g.fields.iter().map(|f| Node::Field(Box::new(f.clone()))).collect();
+                    let fsibs = SomIndices::of(&fields);
                     for (fi, f) in g.fields.iter_mut().enumerate() {
-                        let fsom = child_som(&som, f.common.name.as_deref().or(Some("field")), sib_index(&fields, fi));
+                        let fsom = child_som(&som, f.common.name.as_deref().or(Some("field")), fsibs.at(fi));
                         if let Some(p) = ov.presence.get(&fsom) {
                             f.common.presence = Presence::parse(Some(p));
                         }
diff --git a/crates/xfa/src/tests.rs b/crates/xfa/src/tests.rs
index e38be22f8..1e8730586 100644
--- a/crates/xfa/src/tests.rs
+++ b/crates/xfa/src/tests.rs
@@ -426,6 +426,61 @@ fn the_datasets_packet_is_written_from_the_fields_and_read_back() {
     assert!(!write_datasets(&mut plain, &[]).unwrap().written);
 }
 
+/// A radio item whose text contains a space keeps that text in the datasets. The appearance
+/// state is a PDF name (`New_York`); writing it back used to clear the selection on the next layout.
+#[test]
+fn spaced_radio_values_stay_in_the_datasets() {
+    for (value, state) in [("New York", "New_York"), ("Y", "Y")] {
+        let xdp = format!(
+            r#"<xdp:xdp xmlns:xdp="http://ns.adobe.com/xdp/">
+<template xmlns="http://www.xfa.org/schema/xfa-template/3.3/">
+<subform name="form" layout="tb">
+<pageSet><pageArea name="page"><contentArea x="36pt" y="36pt" w="540pt" h="720pt"/><medium short="612pt" long="792pt"/></pageArea></pageSet>
+<exclGroup name="city" layout="lr-tb">
+<field name="first" w="108pt" h="18pt"><ui><checkButton/></ui><items><text>{value}</text></items></field>
+<field name="second" w="108pt" h="18pt"><ui><checkButton/></ui><items><text>Boston</text></items></field>
+</exclGroup>
+<field name="note" w="108pt" h="18pt"><ui><textEdit/></ui></field>
+<field name="agree" w="108pt" h="18pt"><ui><checkButton/></ui><items><text>{value}</text><text>No</text></items></field>
+</subform>
+</template>
+<xfa:datasets xmlns:xfa="http://www.xfa.org/schema/xfa-data/1.0/"><xfa:data><form><city>{value}</city><note>before</note><agree>{value}</agree></form></xfa:data></xfa:datasets>
+</xdp:xdp>"#
+        );
+        let mut doc = Document::open(Arc::new(shell(&xdp))).unwrap();
+        let report = render_into(&mut doc).unwrap();
+        assert!(report.warnings.is_empty(), "{value:?} {:?}", report.warnings);
+        let fields = field_data(&doc);
+        assert!(fields.iter().any(|f| f.name == "city" && f.data == FieldData::Radio(Some(state.into()))), "{value:?} {fields:?}");
+        let unchanged = write_datasets(&mut doc, &fields).unwrap();
+        assert!(!unchanged.written && unchanged.warnings.is_empty(), "{value:?} {unchanged:?}");
+        let mut fields = fields;
+        for f in &mut fields {
+            if f.name == "note" {
+                f.data = FieldData::Text("after".into());
+            }
+        }
+        let write = write_datasets(&mut doc, &fields).unwrap();
+        assert!(write.written && write.warnings.is_empty(), "{value:?} {write:?}");
+        let packets = read_packets(&doc).unwrap().unwrap();
+        let data = parse_datasets(&packets.xdp).unwrap();
+        assert_eq!(data.text_at(&som_to_path("form[0].city[0]")), Some(value));
+        assert_eq!(data.text_at(&som_to_path("form[0].agree[0]")), Some(value));
+        assert_eq!(data.text_at(&som_to_path("form[0].note[0]")), Some("after"));
+        let selected: Vec<(String, Option<String>)> = layout_xml(&packets.xdp)
+            .unwrap()
+            .pages
+            .iter()
+            .flat_map(|p| &p.items)
+            .filter_map(|item| match item {
+                Item::Widget(w) if w.name == "first" || w.name == "second" => Some((w.name.clone(), w.value.clone())),
+                _ => None,
+            })
+            .collect();
+        assert_eq!(selected, vec![("first".into(), Some(value.into())), ("second".into(), None)], "{value:?}");
+    }
+}
+
 #[test]
 fn static_forms_read_their_values_from_the_datasets() {
     let doc = Document::open(Arc::new(static_shell("<form1><page1><name>Ada</name><agree>1</agree></page1></form1>"))).unwrap();
@@ -1836,3 +1891,110 @@ fn an_anchor_type_places_the_named_point_of_the_box_at_its_x_and_y() {
     let field = widgets(page).into_iter().find(|w| w.name == "ref").unwrap();
     assert!((field.rect.x - 6.0 * 72.0).abs() < 0.01 && (field.rect.y - 72.0).abs() < 0.01, "{:?}", field.rect);
 }
+
+#[test]
+fn stripping_takes_the_xfa_out_and_leaves_an_ordinary_document() {
+    use crate::pdf::strip;
+    let mut doc = Document::open(Arc::new(shell(&fields_template("<form><page1><country>JP</country></page1></form>")))).unwrap();
+    render_into(&mut doc).unwrap();
+    assert!(crate::read_packets(&doc).unwrap().is_some());
+    // Reader usage rights on the catalog go too (changing the form voids them).
+    let root = doc.root().unwrap();
+    let mut ur = pdfcraft_cos::Dict::new();
+    ur.set(b"UR3".to_vec(), Object::Dict(pdfcraft_cos::Dict::new()));
+    doc.update_dict(root, |d| d.set(b"Perms".to_vec(), Object::Dict(ur))).unwrap();
+    let r = strip(&mut doc).unwrap();
+    assert_eq!(r.packets, vec!["template".to_string(), "datasets".to_string()]);
+    assert_eq!(r.unbound_data, Some(0));
+    assert_eq!((r.script_buttons, r.image_fields), (0, 1), "{r:?}");
+    assert!(r.usage_rights);
+    assert!(r.field_keys >= 7, "{r:?}");
+    assert!(
+        r.notes().iter().any(|n| n.contains("template, datasets")) && r.notes().iter().any(|n| n.contains("extended features")),
+        "{:?}",
+        r.notes()
+    );
+    let bytes = write_incremental(&doc, &SaveOptions::default()).unwrap();
+    let doc = Document::open(Arc::new(bytes)).unwrap();
+    assert!(crate::read_packets(&doc).unwrap().is_none(), "no XFA entry");
+    assert!(!is_dynamic(&doc));
+    assert!(crate::existing_layout(&doc).is_none(), "the layout mark is gone");
+    let root = doc.get(doc.root().unwrap());
+    let catalog = root.as_dict().unwrap();
+    assert!(!catalog.contains(b"NeedsRendering") && !catalog.contains(b"Perms"));
+    let acro = doc.resolve(catalog.get(b"AcroForm").unwrap());
+    let acro = acro.as_dict().unwrap();
+    assert!(!acro.contains(b"XFA") && !acro.contains(b"PCXfaLayout") && !acro.contains(b"PCXfaOverrides"));
+    // The fields stay, with their values, and without the private keys.
+    let fields = pdfcraft_forms_free_fields(&doc);
+    assert_eq!(fields.len(), 7);
+    let country = &fields.iter().find(|(n, _)| n == "country").unwrap().1;
+    assert_eq!(country.get(b"V").and_then(|v| v.as_string()).map(|s| s.to_text()).as_deref(), Some("JP"));
+    for (name, d) in &fields {
+        for k in [b"PCSom".as_slice(), b"PCXfaClick", b"PCXfaImage", b"PCItems"] {
+            assert!(!d.contains(k), "{name} still has {}", String::from_utf8_lossy(k));
+        }
+    }
+    // The pages are untouched.
+    let pages = doc.resolve(catalog.get(b"Pages").unwrap());
+    assert_eq!(pages.as_dict().unwrap().int(b"Count"), Some(1));
+    // Twice is nothing: a document without XFA is left as it is.
+    let mut doc = doc;
+    let r = strip(&mut doc).unwrap();
+    assert_eq!(r, crate::Stripped::default());
+    assert!(!doc.is_modified());
+    // Data no field holds is counted; a form whose click buttons ran scripts too; the shape
+    // check needs no packet decoded and tells a never-laid-out dynamic form from one to strip.
+    let mut doc = Document::open(Arc::new(shell(&scripted_template().replace("</template>", "</template><xfa:datasets xmlns:xfa=\"http://www.xfa.org/schema/xfa-data/1.0/\"><xfa:data><form><page1><qty>3</qty><extra>kept nowhere</extra><more2>x</more2></page1></form></xfa:data></xfa:datasets>")))).unwrap();
+    let before = crate::xfa_shape(&doc).unwrap();
+    assert_eq!(before, crate::XfaShape { needs_rendering: true, has_fields: false, laid_out: false });
+    assert!(!before.strippable(), "nothing laid out yet: stripping would leave the placeholder page");
+    render_into(&mut doc).unwrap();
+    assert!(crate::xfa_shape(&doc).unwrap().strippable());
+    let r = strip(&mut doc).unwrap();
+    assert_eq!(r.unbound_data, Some(2), "{r:?}");
+    assert_eq!(r.script_buttons, 4, "addRow, removeRow, hello, legacy: {r:?}");
+    assert!(crate::xfa_shape(&doc).is_none());
+    // A field tree whose dictionaries share one Kids array (every kid listing every other) is
+    // walked once per dictionary, not once per listing.
+    let mut doc = Document::open(Arc::new(shell(&fields_template("")))).unwrap();
+    render_into(&mut doc).unwrap();
+    let root = doc.root().unwrap();
+    let acro_ref = doc.get(root).as_dict().unwrap().get(b"AcroForm").and_then(Object::as_ref);
+    let fields: Vec<Object> = (0..2000).map(|_| Object::Ref(doc.add(Object::Dict(pdfcraft_cos::Dict::new())))).collect();
+    let kids = doc.add(Object::Array(fields.clone()));
+    for f in &fields {
+        if let Some(r) = f.as_ref() {
+            doc.update_dict(r, |d| {
+                d.set(b"Kids".to_vec(), Object::Ref(kids));
+                d.set(b"PCSom".to_vec(), Object::String(pdfcraft_cos::PdfString::text("x")));
+            })
+            .unwrap();
+        }
+    }
+    let update = |d: &mut pdfcraft_cos::Dict| d.set(b"Fields".to_vec(), Object::Array(fields.clone()));
+    match acro_ref {
+        Some(r) => doc.update_dict(r, update).unwrap(),
+        None => doc
+            .update_dict(root, |c| {
+                let mut a = c.get(b"AcroForm").and_then(|a| a.as_dict().cloned()).unwrap_or_default();
+                update(&mut a);
+                c.set(b"AcroForm".to_vec(), Object::Dict(a));
+            })
+            .unwrap(),
+    }
+    let started = std::time::Instant::now();
+    let r = strip(&mut doc).unwrap();
+    assert_eq!(r.field_keys, 2000);
+    assert!(started.elapsed() < std::time::Duration::from_secs(5), "{:?}", started.elapsed());
+}
+
+#[test]
+fn som_indices_count_earlier_same_named_siblings() {
+    let draw = |name: Option<&str>| {
+        Node::Draw(Box::new(Draw { common: Common { name: name.map(str::to_string), ..Default::default() }, ..Default::default() }))
+    };
+    let children = [draw(Some("a")), draw(Some("b")), draw(Some("a")), draw(None), draw(Some("a")), draw(Some("b"))];
+    let sibs = SomIndices::of(&children);
+    assert_eq!((0..=children.len()).map(|i| sibs.at(i)).collect::<Vec<_>>(), [0, 0, 1, 0, 2, 1, 0]);
+}
diff --git a/crates/xfdf/README.md b/crates/xfdf/README.md
index fd2852584..2b179e200 100644
--- a/crates/xfdf/README.md
+++ b/crates/xfdf/README.md
@@ -13,7 +13,7 @@ let report = import(&mut doc, &bytes)?;                 // XFDF, FDF, XML, CSV o
   circle, polygon, polyline, markup, stamp, caret, ink, attachments, sound, redact) with rect,
   name, author, subject, dates, flags, colours, opacity, width, icon, quads, line ends, ink,
   default appearance, callouts (`callout`, `fringe`, `intent`, `head`), pop-ups and reply threads
-  (`inreplyto`); field values nested by name.
+  (`inreplyto`); field values nested by name, with text preserved across XML comments and processing instructions.
 - **FDF**: fields (with `/Kids` hierarchies) and comments as direct objects.
 - **Form data**: Acrobat's XML (`xfdf:original` keeps names that aren't XML names), CSV and
   tab-delimited text (a row of names, a row of values).
diff --git a/crates/xfdf/src/lib.rs b/crates/xfdf/src/lib.rs
index d9287101b..50326c4e7 100644
--- a/crates/xfdf/src/lib.rs
+++ b/crates/xfdf/src/lib.rs
@@ -558,10 +558,30 @@ pub fn export_fdf(doc: &Document, comments: bool, fields: bool, file: &str) -> V
     let _ = write!(out, "trailer\n<< /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n");
     out
 }
-/// The XML element name for a field name (letters, digits, `_`, `-`, `.`).
+/// XML 1.0 fifth-edition NameStartChar, excluding `:` for an unprefixed NCName.
+/// https://www.w3.org/TR/2008/REC-xml-20081126/#NT-NameStartChar
+fn xml_name_start(c: char) -> bool {
+    matches!(
+        c,
+        '_' | 'A'..='Z' | 'a'..='z'
+            | '\u{C0}'..='\u{D6}' | '\u{D8}'..='\u{F6}' | '\u{F8}'..='\u{2FF}'
+            | '\u{370}'..='\u{37D}' | '\u{37F}'..='\u{1FFF}'
+            | '\u{200C}'..='\u{200D}' | '\u{2070}'..='\u{218F}'
+            | '\u{2C00}'..='\u{2FEF}' | '\u{3001}'..='\u{D7FF}'
+            | '\u{F900}'..='\u{FDCF}' | '\u{FDF0}'..='\u{FFFD}'
+            | '\u{10000}'..='\u{EFFFF}'
+    )
+}
+
+fn xml_name_char(c: char) -> bool {
+    xml_name_start(c) || matches!(c, '-' | '.' | '0'..='9' | '\u{B7}' | '\u{300}'..='\u{36F}' | '\u{203F}'..='\u{2040}')
+}
+
+/// Keep the existing letters/digits/`_`/`-`/`.` normalization, constrained to valid NCNames.
 fn xml_name(name: &str) -> String {
-    let mut s: String = name.chars().map(|c| if c.is_alphanumeric() || matches!(c, '_' | '-' | '.') { c } else { '_' }).collect();
-    if !s.chars().next().is_some_and(|c| c.is_alphabetic() || c == '_') {
+    let mut s: String =
+        name.chars().map(|c| if (c.is_alphanumeric() && xml_name_char(c)) || matches!(c, '_' | '-' | '.') { c } else { '_' }).collect();
+    if !s.chars().next().is_some_and(|c| (c.is_alphabetic() && xml_name_start(c)) || c == '_') {
         s.insert(0, '_');
     }
     s
@@ -592,7 +612,7 @@ pub fn export_data(doc: &Document, format: Format) -> String {
             out
         }
         Format::Csv => {
-            let q = |s: &str| if s.contains([',', '"', '\n']) { format!("\"{}\"", s.replace('"', "\"\"")) } else { s.to_string() };
+            let q = |s: &str| if s.contains([',', '"', '\n', '\r']) { format!("\"{}\"", s.replace('"', "\"\"")) } else { s.to_string() };
             format!(
                 "{}\n{}\n",
                 fields.iter().map(|f| q(&f.0)).collect::<Vec<_>>().join(","),
@@ -925,7 +945,12 @@ fn walk_xfdf(node: roxmltree::Node, prefix: &str, out: &mut Vec<(String, Vec<Str
     for f in node.children().filter(|c| c.has_tag_name("field")) {
         let Some(name) = f.attribute("name") else { continue };
         let full = if prefix.is_empty() { name.to_string() } else { format!("{prefix}.{name}") };
-        let vals: Vec<String> = f.children().filter(|c| c.has_tag_name("value")).map(|v| v.text().unwrap_or("").to_string()).collect();
+        let vals: Vec<String> = f
+            .children()
+            .filter(|c| c.has_tag_name("value"))
+            // Comments and processing instructions can split a value into several text nodes.
+            .map(|v| v.children().filter(|n| n.is_text()).filter_map(|n| n.text()).collect())
+            .collect();
         if !vals.is_empty() {
             out.push((full.clone(), vals));
         }
diff --git a/crates/xfdf/src/tests.rs b/crates/xfdf/src/tests.rs
index be747d77e..d244df1ad 100644
--- a/crates/xfdf/src/tests.rs
+++ b/crates/xfdf/src/tests.rs
@@ -292,6 +292,60 @@ trailer\n<< /Root 1 0 R >>\n%%EOF\n";
     assert_eq!((parent("cycle-a").as_deref(), parent("cycle-b").as_deref()), (Some("cycle-b"), Some("cycle-a")));
 }
 
+#[test]
+fn xml_field_names_remain_valid_and_round_trip_without_collisions() {
+    assert_eq!(xml_name(".Value"), "_.Value");
+    let names = [
+        ("Area²", "Area_"),
+        ("Area_", "Area_"),
+        ("Aµ", "A_"),
+        ("µRate", "_Rate"),
+        ("²Rate", "_Rate"),
+        ("½Amount", "_Amount"),
+        ("1Rate", "_1Rate"),
+        ("Café", "Café"),
+        ("Δείγμα", "Δείγμα"),
+        ("姓名", "姓名"),
+        ("٣Value", "_٣Value"),
+        ("\u{345}Rate", "_\u{345}Rate"),
+        ("A\u{345}", "A\u{345}"),
+        ("Alpha_1-2", "Alpha_1-2"),
+        ("ns:value", "ns_value"),
+        ("-Value", "_-Value"),
+    ];
+    let mut src = one_field();
+    pdfcraft_forms::delete_field(&mut src, "Name").unwrap();
+    for (index, (name, _)) in names.iter().enumerate() {
+        add_field(&mut src, 0, [50.0, 700.0, 250.0, 720.0], &NewField::Text { multiline: false }, Some(name)).unwrap();
+        set_value(&mut src, name, &FieldValue::Text(format!("value-{index}"))).unwrap();
+    }
+    let source = Arc::new(write_full(&src, &SaveOptions::default()).unwrap());
+    let src = Document::open(source.clone()).unwrap();
+    let want = values(&src);
+    for format in [Format::Xml, Format::Xdp] {
+        let text = export_data(&src, format);
+        let xml = roxmltree::Document::parse(&text).unwrap();
+        let children: Vec<_> = xml.root_element().children().filter(|n| n.is_element()).collect();
+        assert_eq!(children.len(), names.len());
+        for (child, (original, tag)) in children.iter().zip(names) {
+            assert_eq!(child.tag_name().name(), tag);
+            assert_eq!(child.attribute(("http://ns.adobe.com/xfdf-transition/", "original")), (original != tag).then_some(original));
+        }
+        assert!(!src.is_modified(), "export must not change the source PDF");
+        assert_eq!(src.bytes().as_slice(), source.as_slice());
+
+        let mut dst = Document::open(source.clone()).unwrap();
+        for (name, _) in names {
+            set_value(&mut dst, name, &FieldValue::Text("replaced".into())).unwrap();
+        }
+        let report = import(&mut dst, text.as_bytes()).unwrap();
+        assert_eq!(report.fields, names.len());
+        assert!(report.rejected.is_empty(), "{report:?}");
+        let reopened = Document::open(Arc::new(write_full(&dst, &SaveOptions::default()).unwrap())).unwrap();
+        assert_eq!(values(&reopened), want, "{format:?}: sanitized names must preserve distinct original fields");
+    }
+}
+
 #[test]
 fn form_data_as_xml_csv_and_text() {
     let src = filled();
@@ -346,6 +400,41 @@ fn one_field() -> Document {
     Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap()
 }
 
+#[test]
+fn csv_exports_preserve_carriage_returns_in_names_and_values() {
+    for (name, value, expected) in [
+        ("Name", "plain", "Name\nplain\n"),
+        ("Name", "Tail\r", "Name\n\"Tail\r\"\n"),
+        ("Name", "Alpha\rBeta", "Name\n\"Alpha\rBeta\"\n"),
+        ("Name", "\rLead", "Name\n\"\rLead\"\n"),
+        ("Name", "\r", "Name\n\"\r\"\n"),
+        ("Name", "Alpha\r\nBeta", "Name\n\"Alpha\r\nBeta\"\n"),
+        ("Name", "Alpha\nBeta", "Name\n\"Alpha\nBeta\"\n"),
+        ("Name", "comma,\r", "Name\n\"comma,\r\"\n"),
+        ("Name", "\"quoted\"\r", "Name\n\"\"\"quoted\"\"\r\"\n"),
+        ("Name", "before\r,\"after\"", "Name\n\"before\r,\"\"after\"\"\"\n"),
+        ("Na\rme", "both\r", "\"Na\rme\"\n\"both\r\"\n"),
+    ] {
+        let mut src = one_field();
+        let field = fields(&src)[0].obj;
+        src.update_dict(field, |d| d.set(b"T".to_vec(), PdfString::text(name))).unwrap();
+        set_value(&mut src, name, &FieldValue::Text(value.into())).unwrap();
+        let source = Arc::new(write_full(&src, &SaveOptions::default()).unwrap());
+        let src = Document::open(source.clone()).unwrap();
+        assert_eq!(values(&src), [(name.to_string(), vec![value.to_string()])]);
+        let csv = export_data(&src, Format::Csv);
+
+        let mut dst = Document::open(source).unwrap();
+        set_value(&mut dst, name, &FieldValue::Text("replaced".into())).unwrap();
+        let report = import(&mut dst, csv.as_bytes()).unwrap();
+        assert_eq!(report.fields, 1);
+        assert!(report.rejected.is_empty(), "{report:?}");
+        let reopened = Document::open(Arc::new(write_full(&dst, &SaveOptions::default()).unwrap())).unwrap();
+        assert_eq!(values(&reopened), [(name.to_string(), vec![value.to_string()])]);
+        assert_eq!(csv, expected, "CSV must quote CR as well as LF, commas and quotes");
+    }
+}
+
 /// #1321: the text export of a one-field form has no tab to tell it from CSV, so a comma in the
 /// value used to split it and only the text before the comma was imported.
 #[test]
@@ -887,3 +976,38 @@ fn duplicate_xfdf_annotation_flags_do_not_turn_on_unrelated_bits() {
         assert_eq!(square.get(b"F").and_then(Object::as_int), Some(expected), "flags={flags}");
     }
 }
+
+// XML comments and processing instructions are not field text (XML 1.0 §§2.5–2.6).
+fn split_text_values() -> [(&'static str, &'static str); 5] {
+    [
+        ("Ada<!--editor note--> Lovelace", "Ada Lovelace"),
+        ("<!--editor note-->Ada", "Ada"),
+        ("Ada<?editor keep?> Lovelace", "Ada Lovelace"),
+        (" Å<!--note--><![CDATA[<&>]]><?editor keep?>&#x03A9; ", " Å<&>Ω "),
+        ("<!--empty--><?editor keep?>", ""),
+    ]
+}
+
+#[test]
+fn xfdf_data_values_join_text_around_xml_comments_and_instructions() {
+    for (xml_text, expected) in split_text_values() {
+        let xml = format!(r#"<xfdf xmlns="http://ns.adobe.com/xfdf/"><fields><field name="Name"><value>{xml_text}</value></field></fields></xfdf>"#);
+        assert_eq!(data_values(xml.as_bytes()).unwrap(), vec![("Name".into(), vec![expected.to_string()])], "{xml_text}");
+    }
+}
+
+#[test]
+fn xfdf_import_keeps_text_around_xml_comments_and_instructions() {
+    for (xml_text, expected) in split_text_values() {
+        let xml = format!(r#"<xfdf xmlns="http://ns.adobe.com/xfdf/"><fields><field name="Name"><value>{xml_text}</value></field></fields></xfdf>"#);
+        let mut doc = one_field();
+        set_value(&mut doc, "Name", &FieldValue::Text("old value".into())).unwrap();
+        let report = import(&mut doc, xml.as_bytes()).unwrap();
+        assert_eq!(report.fields, 1);
+        assert!(report.rejected.is_empty(), "{report:?}");
+        let saved = write_full(&doc, &SaveOptions::default()).unwrap();
+        let reopened = Document::open(Arc::new(saved)).unwrap();
+        let want: Vec<&str> = if expected.is_empty() { vec![] } else { vec![expected] };
+        assert_eq!(values(&reopened)[0].1, want, "{xml_text}");
+    }
+}
diff --git a/docs/development.md b/docs/development.md
index 59483b533..e599effc7 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -50,7 +50,7 @@ do not contact a desktop session bus. Page and document colours retain their exi
 ## Logs
 
 The desktop app writes its `log` records to standard error and to `logs/pdfcraft.log` in its
-settings folder, next to `app.ron`: Linux and FreeBSD `~/.local/share/pdfcraft/logs/` (or
+data folder: Linux and FreeBSD `~/.local/share/pdfcraft/logs/` (or
 `$XDG_DATA_HOME/pdfcraft/logs/`), macOS `~/Library/Application Support/PdfCraft/logs/`, Windows
 `%APPDATA%\PdfCraft\data\logs\`. In portable mode (a `portable.txt` file next to the executable, as
 the Windows portable zip ships) the settings folder is `PdfCraftData\` beside the executable, and
@@ -105,13 +105,26 @@ reach this retry instead of the uncaptured-error panic handler. This does not fi
 driver's shader compilation, and explicit `PDFCRAFT_RENDERER=wgpu` still disables the retry.
 `PDFCRAFT_RENDERER` skips it or chooses OpenGL from the start.
 
+## Preferences
+
+Linux and FreeBSD store `app.ron` in `$XDG_CONFIG_HOME/pdfcraft/`, or
+`~/.config/pdfcraft/` when that variable is unset, empty or relative. This follows the
+[XDG Base Directory Specification](https://specifications.freedesktop.org/basedir/latest/).
+On first launch after upgrading, existing `app.ron` preferences are copied from the old
+data folder without replacing an existing configuration file. The old copy is retained;
+logs, crash recovery and digital IDs stay in their data locations. If migration fails,
+the app logs the failure and continues using the original preferences folder.
+The existing PrintCraft-to-PdfCraft migration runs first. macOS, Windows and portable
+copies retain their current preferences locations.
+
 ## Environment variables
 
 | Variable | Effect |
 |---|---|
 | `RUST_LOG` | Log levels for standard error and the log file (see [Logs](#logs)) |
 | `RUST_BACKTRACE` | `1` adds a backtrace to the report of an internal error |
-| `XDG_DATA_HOME` | Linux/FreeBSD: base of the settings folder (`pdfcraft/`), the log folder and crash recovery |
+| `XDG_CONFIG_HOME` | Linux/FreeBSD: absolute configuration base for `pdfcraft/app.ron`; defaults to `~/.config` |
+| `XDG_DATA_HOME` | Linux/FreeBSD: base of the log folder and crash recovery; previous preferences are migrated from here |
 | `WGPU_POWER_PREF` | GPU choice; by default PdfCraft draws on the GPU the Wayland compositor draws with (it says so through linux-dmabuf feedback), else the GPU that drives the primary display (Windows) or the built-in panel (Linux), else the low-power (integrated) GPU. The log says which one was chosen |
 | `WGPU_BACKEND` | Graphics backend; by default Windows uses Direct3D 12, falling back to OpenGL |
 | `WGPU_VALIDATION_INDIRECT_CALL` | `1` turns wgpu's check of indirect draw arguments back on. PdfCraft draws nothing indirectly and turns it off, since the compute shader the check needs fails to compile on some drivers (Metal on an Intel Iris Pro), which lost the device at start-up |
@@ -120,3 +133,17 @@ driver's shader compilation, and explicit `PDFCRAFT_RENDERER=wgpu` still disable
 | `PDFCRAFT_BUILD_LABEL` | Build time: a label for a local or patched build (letters, digits, inner dots), shown after the version in `--version`, About and the log (`0.7.1 (titlebar)`). `packaging/linux/package.sh` also puts it in the file names and the .rpm/.deb release (`1.titlebar`), which upgrades over the release of the same version |
 | `CRAFT_FONTS_DIR` | Build time: a [craft-fonts](https://github.com/storytold/craft-fonts) checkout to embed (Japanese fonts) |
 | `PDFCRAFT_SYSTEM_FONTS` | `0` stops the desktop app from using an installed font for characters its embedded fonts lack (`cargo xtask screenshots` sets it) |
+| `FONTCONFIG_FILE` | On Linux/Unix, the Fontconfig configuration file used to discover installed UI fallback fonts (default: `/etc/fonts/fonts.conf`); relative filenames are resolved under `FONTCONFIG_PATH` |
+| `FONTCONFIG_PATH` | Directory for a relative `FONTCONFIG_FILE` (default: `/etc/fonts`; the first entry of a search path is used) |
+
+On Linux/Unix, the UI's existing fallback filenames are also searched in Fontconfig's configured
+directories and their subdirectories. This finds fonts in Nix store paths and user font directories
+without invoking `fc-match` or linking libfontconfig. The scan is cached and bounded; missing or
+malformed configuration leaves the ordinary `/usr/share/fonts` and `/usr/local/share/fonts`
+candidates available. Font size and glyph-coverage checks still apply. This only reads installed
+fonts for the interface; it does not embed them into PDFs or packages.
+
+Relative includes resolve beside the config that contains them. Included directories load only
+digit-prefixed `*.conf` files, in lexical order; backups and disabled files are ignored. The scan
+limits each config to 1 MiB, visits at most 256 config files/directories, and bounds include depth
+to 16 and directory entries to 32,768. Cyclic includes are skipped.
diff --git a/docs/editing-existing-text.md b/docs/editing-existing-text.md
index 3e71c8c72..e8bb03b9a 100644
--- a/docs/editing-existing-text.md
+++ b/docs/editing-existing-text.md
@@ -4,23 +4,46 @@ Click a text region in **Edit a PDF → Edit text and images**. One editor conta
 source rows and mixed styles. Embedded TrueType and OpenType/CFF faces are used in memory;
 source font programs, colour, size and baseline anchors stay intact. A textless preview
 prevents a second copy underneath. The frame shows the live extent as text grows or shrinks.
+Rows a text edit doesn't reach keep their original operators, so their kerning, `TJ` word
+gaps and glyph widths stay exactly as they were. Only rows whose characters changed, or that
+moved because an earlier row wrapped, are rewritten, and formatting a selection rewrites
+only the rows it covers. Changing the whole paragraph's formatting, width or position rewrites
+every row.
+
+Add Text also opens existing text when it is clicked; a blank-space click starts a new item.
+Both text tools retype an added text item with one click. Draft boxes grow to the page edge
+before wrapping, and the saved item uses that width. A single visual source row grows across font/style boundaries;
+multi-row paragraphs retain their existing wrap width. Retyping uses a preview with only
+that added item's old drawing removed, so deleted draft characters do not show underneath.
 
 A subset font contains only some of the original face's glyphs. A new character cannot be
 reconstructed from a glyph the PDF does not contain. **Load font…** imports an openly licensed,
 embeddable standalone `.ttf` or `.otf` face. **Installed fonts…** discovers eligible user-installed
 faces on request, off the UI thread; the document-font menu selects resources already on the
 page. Select **Keep source fonts** to preserve each run's original face. A matching full face
-completes its subsets automatically, including new Chinese characters. Choosing another face
+completes its subsets automatically, including new Chinese characters. When the PDF itself embeds
+the complete program of a paragraph's font (not a subset) and its licence allows editable
+embedding, a character the font's encoding can't show is drawn with that same program. A
+character no available face has is refused with an error that names it. Choosing another face
 is explicit. Fonts with restricted embedding, unsupported collections, excluded families or
 no open-licence declaration are refused. Interface fallback fonts are never exported.
 
 The full selected program, glyph mappings, widths and Unicode text are embedded in the PDF.
-Saving and reopening therefore needs no locally installed font. Original subset bytes are
+Saving and reopening therefore needs no locally installed font. Editing the same text again
+reuses the font resource the page already has, and every resource made from one program
+shares a single copy of it. Original subset bytes are
 preserved. Optional matching faces from `CRAFT_FONTS_DIR` can also complete source subsets;
 this works only when that build input actually contains the full face. This change does not
 add a font binary or change the release font pin. Fonts shared by releases belong in
 `storytold/craft-fonts` under the repository's asset rules.
 
+Rewrapped Chinese and Japanese text, which has no spaces between words, may break between any
+two characters. A row never begins with closing punctuation, a closing bracket or quote, a small
+kana or the prolonged sound mark, and never ends with an opening bracket or quote or a currency
+sign before an amount: the line-start and line-end rules of JIS X 4051, as in Unicode line
+breaking (UAX #14). Latin words inside such text are not split. Korean and Thai still break only
+at spaces.
+
 Select text within the editor before changing size, colour, font, underline or spacing to
 format that selection. Automation supports up to 1024 disjoint UTF-8 byte ranges with the
 same properties; invalid or overlapping ranges fail atomically. Untouched source formatting
@@ -33,6 +56,12 @@ a second bidi reversal; adjacent visual glyph runs still recover their own readi
 Only right-to-left ActualText is kept apart this way: left-to-right spans, such as the Latin
 ligatures (`fi`, `fl`) Word and Chrome wrap in ActualText mid-word, join their line as before.
 
+A justified paragraph stretches each row but its last to the paragraph's width by widening its
+spaces. Word spacing (`Tw`) widens only single-byte code 32, so where the font shows a space with
+another code (a composite font, the generated Type 3 fallback) each space is followed by a `TJ`
+adjustment instead. Justifying a paragraph with several formats in it is not supported yet: it is
+left-aligned.
+
 For headless editing, use `text_font_files` → `text_font_import` → `text_fonts` and pass a
 resource to `text_edit.font_resource`. `text_edit.ranges` holds selected range formatting.
 `text_edit_layout` accepts resource/ranges too and measures a draft without applying it.
diff --git a/docs/editing-images.md b/docs/editing-images.md
index 3417b4c6d..eba918ef3 100644
--- a/docs/editing-images.md
+++ b/docs/editing-images.md
@@ -6,6 +6,9 @@ that placement. The context menu also rotates or flips it. Changes support undo
 survive saving/reopening. For single-figure transforms, a clipping path exclusive to one image moves and resizes
 together with its pixels, including nested graphics states, intervening state operators
 and paths split across content streams. A clip shared with other content stays where it is.
+When the figure already sits alone in a `q … cm … Q` (its own placement, or the one an
+earlier edit added), moving or resizing it again changes that `cm`, so repeated edits don't
+nest one more graphics state each time.
 
 PDF figures are not always bitmap images. Imported diagrams often use a **Form XObject**,
 which packages text, vector paths, and nested images into one object. PdfCraft selects
diff --git a/docs/gaps.md b/docs/gaps.md
index 457a868fc..003d93deb 100644
--- a/docs/gaps.md
+++ b/docs/gaps.md
@@ -1,6 +1,8 @@
 # Where PdfCraft falls short of Acrobat Pro
 
 > **Last reviewed:** 2026-10-14 · **Last updated:** 2026-10-14 · **Change:** minor (M1: raw-deflate fallback preserves decoding-limit errors; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-13 · **Change:** minor (gap 14: Vietnamese catalog shipped; Hindi/Indonesian/Korean and Arabic RTL remain) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-13 · **Last updated:** 2026-10-13 · **Change:** minor (gap 6: #1910 Organize Pages opens on the current page; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (gap 6: #1398 stamps read upright on rotated pages; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (gap 6: #1317, #1327, #1302, #1315 and #1340; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-12 · **Change:** minor (#1316: replacing a line keeps a neighbouring line whose glyph box overlaps; gap 3 remains) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
@@ -39,7 +41,7 @@ update the numbers.
 | 11 | Accessibility: checker only, no tagging tools | feature | 40–70 | [target-app-parity.md](target-app-parity.md) |
 | 12 | No measured fidelity harness against Acrobat | quality | (in 2) | [target-app-parity.md](target-app-parity.md) |
 | 13 | Performance budgets and lazy loading of very large files | performance | 25–45 | this file |
-| 14 | Arabic not mirrored; no Hindi, Indonesian, Korean, Vietnamese | localization | 30–50 | [localization-parity.md](localization-parity.md) |
+| 14 | Arabic not mirrored; no Hindi, Indonesian, Korean | localization | 25–45 | [localization-parity.md](localization-parity.md) |
 | 15 | Forms: JavaScript object model, actions, submit, XFA depth | feature | 40–75 | [pdf-spec-parity.md](pdf-spec-parity.md) |
 | 16 | UI precision gaps (multi-select move, rulers, accelerators, windows) | UI/UX | 30–60 | [ui-parity.md](ui-parity.md) |
 | 17 | Certificate security and other protect gaps | feature, spec | 15–30 | [pdf-spec-parity.md](pdf-spec-parity.md) |
@@ -129,14 +131,15 @@ update the numbers.
 - **Missing:** fixes for the ≈ 13 of ≈ 25 filed reports of features marked `shipped` that give wrong results still open,
   plus triage of ≈ 220 other open issues.
 - **Evidence:** 245 open issues on 2026-10-10. The first batch of `fix(...)` reports was fixed by
-  2026-10-10 (#799, #800, #807, #809, #810, #811, #815, #816, #817, #818, #819, #821). Stamps placed
-  on a rotated page read upright: rubber stamps, natural-size and explicit-rectangle images, and
-  PDF-page stamps (#1398). The rest of the backlog is untriaged.
   2026-10-10 (#799, #800, #807, #809, #810, #811, #815, #816, #817, #818, #819, #821). A later
   batch keeps a cloudy comment flatten cannot draw (#1317), leaves a refused text-box restyle or
   resize unchanged (#1327), keeps arrow defaults off plain lines (#1302), stops a custom text
   match on the separator instead of the next glyph (#1315), and states the vertical-text
-  redaction refusal without claiming an overlap (#1340). The rest of the backlog is untriaged.
+  redaction refusal without claiming an overlap (#1340). Organize Pages opens on the page being
+  read, selected and scrolled into view (#1910). Stamps placed on a rotated page read upright
+  (#1398). Another batch keeps a spaced XFA radio value in the datasets (#1319), replaces only the
+  selected pages when they are not adjacent (#1305), and leaves unrelated page streams in place
+  when a figure is marked decorative (#1324). The rest of the backlog is untriaged.
 - **Fix verified (2026-10-14):** raw-deflate fallback returns a decoding-limit error instead of
   accepting an empty partial stream when a misleading zlib header triggers a retry. Synthetic
   filter and COS stream regressions cover refusal at the limit and decoding within it.
@@ -199,8 +202,10 @@ update the numbers.
 
 ### 11. Accessibility: only text-only automatic structure creation
 
-- **Missing:** auto-tag mixed text, images, tables, lists, links and fields; connect preview heading
-  proposals to Apply; visual Order and Content panels, Reading Order tool, table editor, Make Accessible action,
+- **Missing:** apply auto-tag proposals to marked content and a valid parent tree, tag fields
+  into structure trees with unusual layouts (only a direct Document root with a direct
+  ParentTree Nums array is extended),
+  visual Tags, Order and Content panels, Reading Order tool, table editor, Make Accessible action,
   Read Out Loud; full keyboard operation of PdfCraft itself and a screen-reader audit.
 - **Evidence:** all 32 checker rules, figure alt text, tag property and sibling order edits, and
   a bounded auto-tag preview exist. Apply writes valid structure and parent-tree links for
@@ -216,10 +221,46 @@ update the numbers.
   signature validation against Acrobat on synthetic fixtures; an interop suite that opens every
   kind of output we write (encrypted ones above all, after #774) in pdf.js, MuPDF and Poppler as
   oracle processes.
-- **Evidence:** none exists; only text extraction has an oracle (word-F1 0.98 against `pdftotext`).
-  Acrobat captures must stay local in `plan/acrobat/` (clean-room, `AGENTS.md` §1.1).
-- **Impact:** until it exists, every quality number here is a judgement.
-- **Estimate:** counted in gap 2 (≈ 20–30 h of it). **Doc:** [target-app-parity.md](target-app-parity.md).
+- **Progress (2026-10-14):** rendering now has an oracle too. `cargo xtask render-oracle` compares
+  page 1 of every corpus file against Poppler's `pdftoppm` and reports a disagreement rate: the
+  share of pixels with no near match in the other renderer's 3×3 neighbourhood, which forgives
+  antialiasing and subpixel placement but not missing or wrong content (`crates/oracle`, module
+  `pixels`). **First reading, 250 files at 72 dpi, tolerance 8: 229 compared, median 0.89%, mean
+  2.16%, p90 5.35%, 25 within 0.1%.** It reports rather than gates — the corpus is not fetched on
+  CI, and a first reading of a borrowed renderer is a baseline to improve on, not a bar to clear.
+  The worst results cluster on JBIG2 `bitmap-*` files (`hayro-jbig2` carries 3 local patches) and
+  on ZapfDingbats, which points the renderer work at something specific for the first time.
+- **Read the score as a disagreement, not a verdict (2026-10-14).** The worst file of the 250,
+  `bug1552113.pdf` at 84%, turned out to be Poppler's defect: it paints the link's `/Border [0 0
+  112]` as a 112-unit band over the two lines of text, and the fixture is named "this text should
+  be visible". Ours is the readable rendering. Anything at the top of the list needs a person to
+  look at both images before it is treated as a bug of ours.
+- **The JBIG2 cluster was Poppler too, and the suite checks itself (2026-10-14).** The next four
+  worst files were JBIG2, which looked like a defect in `hayro-jbig2` and its local patches. It is
+  the reverse. The 96 `bitmap-*.pdf` fixtures are a conformance suite: one picture encoded through
+  every corner of JBIG2, so a correct decoder renders all 96 identically — a real test needing no
+  reference image and no oracle. **We render 1 distinct image across all 96; Poppler renders 8**,
+  drawing a blank page for the seven halftone-skip and symbol fixtures and mis-decoding TPGRON
+  refinement (its output changes when TPGRON is switched on, which a correct decoder's cannot).
+  Pinned as `crates/render/tests/jbig2_invariants.rs`. **Poppler is not a usable oracle for JBIG2**,
+  and roughly a fifth of its fixtures should be read as its bugs rather than ours.
+- **Annotations are shown, and that was measured rather than argued.** Poppler synthesises an
+  appearance for an annotation that has none, where we draw only what the document carries (link
+  borders without `/AP` are recorded as not covered under `view.render-annotation-appearances`), so
+  showing them scores us for a known gap. Hiding them is worse, because it then scores Poppler for
+  every appearance we *do* draw: over the same 250 files, shown gives mean 2.16% / p90 5.35% / 25
+  files within 0.1%, hidden gives 2.18% / 5.55% / 22, with `annotation-tx3.pdf` jumping to 45.64%.
+  The biases nearly cancel; `--hide-annotations` tells the two apart for one file at a time.
+- **Evidence:** text extraction (word-F1 0.98 against `pdftotext`) and now rendering (above); qpdf
+  checks written output on every CI run since `PDFCRAFT_ORACLES_REQUIRED`. Acrobat captures must
+  stay local in `plan/acrobat/` (clean-room, `AGENTS.md` §1.1).
+- **Still missing:** Acrobat itself as the reference rather than other open renderers; form
+  calculation and signature validation; the interop suite that opens every kind of output we write
+  (encrypted ones above all, after #774) in pdf.js and MuPDF; and 15 of those 250 files could not
+  be compared at all because the two renderers round the page box to different pixel sizes.
+- **Impact:** until it is complete, quality numbers outside rendering and text are judgements.
+- **Estimate:** counted in gap 2 (≈ 20–30 h of it; roughly a third done).
+  **Doc:** [target-app-parity.md](target-app-parity.md).
 
 ### 13. Performance budgets and lazy loading of very large files
 
@@ -240,14 +281,15 @@ update the numbers.
   to edit.
 - **Estimate:** 25–45 h. **Doc:** this file.
 
-### 14. Arabic not mirrored; no Hindi, Indonesian, Korean, Vietnamese
+### 14. Arabic not mirrored; no Hindi, Indonesian, Korean
 
 - **Missing:** a right-to-left layout (panels, menus, alignment), bidirectional text in the text
-  layout itself (wrapping, typed text); catalogs for Hindi, Indonesian, Korean and Vietnamese
-  (Acrobat ships Korean; it ships Arabic in its Middle East edition; it ships none of the other
-  three).
+  layout itself (wrapping, typed text); catalogs for Hindi, Indonesian and Korean (Acrobat ships
+  Korean; it ships Arabic in its Middle East edition; it ships none of Hindi or Indonesian).
+  Vietnamese ships as a catalog (`vi`, 100% of the current localizable union) but stays `partial`
+  like other non-English languages (no translated help; engine/OS details stay English).
 - **Evidence:** [localization.md](localization.md) §Arabic; `misc.rtl-ui` planned.
-- **Estimate:** 30–50 h (Arabic RTL 20–35, four catalogs 10–15 plus review). **Doc:**
+- **Estimate:** 25–45 h (Arabic RTL 20–35, three catalogs 8–12 plus review). **Doc:**
   [localization-parity.md](localization-parity.md).
 
 ### 15. Forms: JavaScript object model, actions, submit, XFA depth
@@ -320,8 +362,8 @@ update the numbers.
 
 - **Missing:** a menu and tool listing captured from Acrobat (names only, `plan/acrobat/`, never
   committed) diffed against the checklist, so that features the checklist never listed show up.
-  Also correct `misc.localization` and `misc.installers`, which are still `planned` though both
-  ship.
+  `misc.localization` and `misc.installers` are now `partial` (Chinese, Telugu and Arabic are not
+  fully usable yet; Linux packages are unsigned).
 - **Estimate:** 4–8 h. **Doc:** [target-app-parity.md](target-app-parity.md).
 
 ## Revision history
@@ -329,6 +371,8 @@ update the numbers.
 | Date | Change | Summary |
 |---|---|---|
 | 2026-10-14 | minor | M1: raw-deflate fallback preserves decoding-limit errors in strict and tolerant decoding; synthetic filter and COS stream regressions. Estimates unchanged. |
+| 2026-10-15 | patch | Gap 24: record localization and installers as partial (unusable Chinese, Telugu and Arabic; unsigned Linux packages) |
+| 2026-10-13 | minor | Gap 6: Organize Pages selects and reveals the current page on open, including after an earlier grid selection elsewhere (#1910). Estimates unchanged. |
 | 2026-10-12 | minor | Gap 6: rubber stamps, explicit image rectangles and PDF-page stamps read upright on rotated pages (#1398). Estimates unchanged. |
 | 2026-10-12 | minor | #1316: replacing a line or paragraph keeps a neighbouring line whose glyph box overlaps. Gap 3 remains. Estimates unchanged. |
 | 2026-10-12 | minor | Exclusive image crops resize with their pixels across nested states, intervening operators and content streams; shared clips remain fixed. Synthetic engine/tool regressions and private image save/reopen checks; estimates unchanged. |
diff --git a/docs/localization-parity.md b/docs/localization-parity.md
index ccd5f88b9..995293af3 100644
--- a/docs/localization-parity.md
+++ b/docs/localization-parity.md
@@ -1,6 +1,7 @@
 # Localization parity
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-12 · **Change:** minor (list all registered interface languages; preserve the original coverage snapshot) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-13 · **Change:** minor (Vietnamese 100% of current key union; native-speaker community review; twelve-language mean ≈68%) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-14 · **Change:** minor (Italian count after completing its catalog) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 
 Per-language status of PdfCraft's interface against Acrobat Pro's. How translations work and how to
 add a language: [localization.md](localization.md). Summary in [ROADMAP.md](../ROADMAP.md).
@@ -8,10 +9,11 @@ add a language: [localization.md](localization.md). Summary in [ROADMAP.md](../R
 ## How this was measured
 
 - **Strings translated** is measured: the catalogs in `crates/ui-egui/src/i18n/<code>.tsv`, counted
-  as distinct `(context, English)` keys with a non-empty translation. The denominator is the union
-  of keys across all catalogs, **2,143**. Cross-check: of the 1,151 distinct `tl!("…")` literals in
-  `crates/ui-egui/src`, every full catalog covers 96.5–99.4% (7 literals are in no catalog yet).
-  English is built in.
+  as distinct `(context, English)` keys with a non-empty translation. The **current** denominator is
+  the union of keys across all catalogs (**2,590** plain keys as of 2026-10-13, plus language-specific
+  context rows such as Vietnamese `theme`/`Appearance`). The twelve-language percentage table below
+  still quotes the **historical 2,143-key snapshot** from 2026-10-10 for every language except
+  Vietnamese (re-measured against the current union). English is built in.
 - **Not counted:** error details from the engine and the operating system, which are shown in
   English inside a translated frame; there is no translated user documentation or help yet (Acrobat
   ships localized help).
@@ -38,15 +40,17 @@ add a language: [localization.md](localization.md). Summary in [ROADMAP.md](../R
 | Japanese | `ja` | 2,123 (99.1%) | dialogs and tooltips; no help | BIZ UDPGothic from craft-fonts; IME patched on macOS, Windows, X11, Wayland; vertical text renders but can't be edited | no | partial | yes | 4–8 |
 | German | `de` | 2,128 (99.3%) | dialogs and tooltips; no help | Latin | community, in progress (#828: terminology, clipping) | partial | yes | 2–4 |
 | Korean | `ko` | 0 | none | Hangul IME patched (Microsoft and Apple Korean, `vendor/README.md` winit 3, 6, 9, 10); no Hangul UI face in craft-fonts | no | none | yes | 6–10 |
-| Vietnamese | `vi` | 0 | none | Latin with stacked diacritics; bundled Inter covers them (not tested) | no | none | no | 3–5 |
+| Vietnamese | `vi` | 2,591 (100% of current union + theme Appearance) | dialogs and tooltips; no help | Latin with stacked diacritics; bundled Inter covers them (fonts test) | community | partial | no | 2–4 |
 
-**Localization dimension ≈ 59%**: the mean over the twelve, counting a catalog's percentage but only
-60% for Chinese and Arabic until their script problems are fixed, and 0 for the four missing
-languages. **≈ 60–115 h** to bring all twelve to `full`, of which ≈ 35–60 h is engineering (Hans
-face, RTL layout, bidi text) and the rest catalogs and fixes; native-speaker review needs humans.
+**Localization dimension ≈ 68%**: the mean over the twelve, counting a catalog's percentage but only
+60% for Chinese and Arabic until their script problems are fixed, and 0 for Hindi, Indonesian and
+Korean (still missing). Vietnamese moved from 0% to 100% in that mean (59% → 68%). **≈ 55–110 h**
+to bring all twelve to `full`, of which ≈ 35–60 h is engineering (Hans face, RTL layout, bidi text)
+and the rest catalogs and fixes; native-speaker review needs humans.
 
 No language is `full` except English: every catalog leaves engine error details in English, and
-none has translated help.
+none has translated help. Vietnamese's **To `full`** hours are therefore residual help/docs polish
+(catalog and script work are already done), not missing UI strings.
 
 ## Other shipped languages
 
@@ -59,21 +63,26 @@ none has translated help.
 | Telugu | `te` | 2,058 (96.0%) | partial (the release-pinned craft-fonts has no Telugu face yet) | no |
 | Hungarian | `hu` | 2,126 (99.2%) | partial | yes |
 | Ukrainian | `uk` | 2,142 (100%) | partial | yes |
-| Italian | `it` | 2,130 (99.4%) | partial | yes |
+| Italian | `it` | 2,528 entries (every key of the other catalogs that the code looks up) | partial | yes |
 | Kazakh | `kk` | 2,327 entries | partial | no |
 | Polish | `pl` | 2,287 entries | partial | yes |
 | Slovenian | `sl` | 2,324 entries | partial | no |
 | Greek | `el` | 2,341 entries | partial | no |
 | Turkish | `tr` | 2,313 entries | partial | yes |
-| Lithuanian | `lt` | 2,578 entries | partial; community native-speaker review ([#1401](https://github.com/storytold/pdfcraft/pull/1401)) | no |
+| Lithuanian | `lt` | 2,585 entries | partial; community native-speaker review ([#1401](https://github.com/storytold/pdfcraft/pull/1401)) | no |
 
+**14 other languages** ship (22 catalogs plus English = **23** interface languages in Preferences).
+The entry counts without percentages were measured on 2026-10-12–13; they are not percentages of the older 2,143-key snapshot above. Their presence does not imply a detailed linguistic or runtime review.
+Acrobat languages PdfCraft lacks: Danish, Dutch, Finnish, Norwegian, Swedish, Hebrew. Vietnamese is shipped here but not by Acrobat.
 **14 other languages** ship (21 catalogs plus English, 22 interface languages in Preferences).
-The entry counts without percentages were measured on 2026-10-12; they are not percentages of the older 2,143-key snapshot above. Their presence does not imply a detailed linguistic or runtime review.
+The entry counts without percentages were measured on 2026-10-12 (Italian on 2026-10-14); they are not percentages of the older 2,143-key snapshot above. Their presence does not imply a detailed linguistic or runtime review.
 Acrobat languages PdfCraft lacks: Danish, Dutch, Finnish, Norwegian, Swedish, Hebrew.
 
 ## Revision history
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-13 | minor | Vietnamese (`vi`) catalog: 2,591 entries (100% of current key union + `theme`/`Appearance`); twelve-language mean ≈ 68%; native-speaker community review; registered with `plural_none` |
+| 2026-10-14 | minor | Italian: 2,528 entries after adding the 201 keys the other catalogs had and the code looks up |
 | 2026-10-12 | minor | Added current counts for Kazakh, Polish, Slovenian, Greek, Turkish and Lithuanian; retained existing language assessments and the original percentage snapshot |
 | 2026-10-10 | major | Created. Catalog counts measured from `crates/ui-egui/src/i18n/*.tsv` against the 2,143-key union; Acrobat's localizations from its bundle's `.lproj` and Sequences folder names |
diff --git a/docs/localization.md b/docs/localization.md
index 05240cafb..657e2eb24 100644
--- a/docs/localization.md
+++ b/docs/localization.md
@@ -1,10 +1,10 @@
 # Interface language
 
-Choose **Menu > Edit > Preferences…** (Command-comma on macOS, Ctrl-comma elsewhere) **> Interface language** and select **Auto**, **English**, **日本語**, **简体中文**, **繁體中文**, **Čeština**, **Português (Brasil)**, **Deutsch**, **Español**, **Français**, **Русский**, **Қазақша**, **Български**, **తెలుగు**, **Magyar**, **Українська**, **Italiano**, **العربية**, **Polski**, **Slovenščina**, **Ελληνικά**, **Türkçe** or **Lietuvių**. The change applies immediately and persists between launches. Command ids, document contents and file names are unchanged.
+Choose **Menu > Edit > Preferences…** (Command-comma on macOS, Ctrl-comma elsewhere) **> Interface language** and select **Auto**, **English**, **日本語**, **简体中文**, **繁體中文**, **Čeština**, **Português (Brasil)**, **Deutsch**, **Español**, **Français**, **Русский**, **Қазақша**, **Български**, **తెలుగు**, **Magyar**, **Українська**, **Italiano**, **العربية**, **Polski**, **Slovenščina**, **Ελληνικά**, **Türkçe**, **Lietuvių** or **Tiếng Việt**. The change applies immediately and persists between launches. Command ids, document contents and file names are unchanged.
 
 Displayed keyboard shortcuts use the same active interface language. For example, German shows `Strg+K` and `Strg+Umschalt+S` in the toolbar, menus, command palette, tooltips and Keyboard shortcuts dialog; macOS keeps its modifier symbols (`⌘`, `⇧`, `⌃`). Key names have their own `key` catalog context, so the Delete key can read `Entf` while the command remains `Löschen`. A missing key-name entry falls back to the English key name. Actual bindings and machine-facing command ids remain stable.
 
-**Auto** (the default) follows the system language: `LC_ALL`, `LC_MESSAGES` or `LANG`, then the preferred-languages list on macOS. Any Portuguese locale (`pt_BR`, `pt_PT`) uses the Brazilian catalog, any French locale (`fr`, `fr_FR`, `fr_CA`, `fr_BE`) the French one, any German locale (`de`, `de_DE`, `de_AT`, `de_CH`) the German one, and Chinese locales for Taiwan, Hong Kong and Macau (`zh_TW`, `zh_HK`, `zh_MO`, `zh-Hant`) the Traditional Chinese one; other Chinese locales (`zh`, `zh_CN`, `zh_SG`, `zh-Hans`) the Simplified Chinese one. Telugu locales (`te`, `te_IN`) use the Telugu catalog, Bulgarian locales (`bg`, `bg_BG`) the Bulgarian one, and Hungarian locales (`hu`, `hu_HU`) the Hungarian one, and Ukrainian locales (`uk`, `uk_UA`) the Ukrainian one, and Italian locales (`it`, `it_IT`, `it_CH`) the Italian one, and Arabic locales (`ar`, `ar_MA`, `ar_EG`, `ar_SA`, …) the Arabic one, and Turkish locales (`tr`, `tr_TR`) the Turkish one, and Slovenian locales (`sl`, `sl_SI`) the Slovenian one. A system language without a catalog shows English. On Windows, **Auto** uses the Windows display languages, in preference order, when no supported locale is selected by those environment variables. Neutral `C`/`POSIX` locale values (including `C.UTF-8`) inherited from a launcher do not override the Windows display language; explicitly named supported locales such as `fr_FR.UTF-8` still do. The query asks Windows directly (`GetUserPreferredUILanguages`, through the `sys-locale` crate) without starting a process, and is cached for the process. If detection fails or the display language has no catalog, PdfCraft shows English.
+**Auto** (the default) follows the system language: `LC_ALL`, `LC_MESSAGES` or `LANG`, then the preferred-languages list on macOS. Any Portuguese locale (`pt_BR`, `pt_PT`) uses the Brazilian catalog, any French locale (`fr`, `fr_FR`, `fr_CA`, `fr_BE`) the French one, any German locale (`de`, `de_DE`, `de_AT`, `de_CH`) the German one, and Chinese locales for Taiwan, Hong Kong and Macau (`zh_TW`, `zh_HK`, `zh_MO`, `zh-Hant`) the Traditional Chinese one; other Chinese locales (`zh`, `zh_CN`, `zh_SG`, `zh-Hans`) the Simplified Chinese one. Telugu locales (`te`, `te_IN`) use the Telugu catalog, Bulgarian locales (`bg`, `bg_BG`) the Bulgarian one, and Hungarian locales (`hu`, `hu_HU`) the Hungarian one, and Ukrainian locales (`uk`, `uk_UA`) the Ukrainian one, and Italian locales (`it`, `it_IT`, `it_CH`) the Italian one, and Arabic locales (`ar`, `ar_MA`, `ar_EG`, `ar_SA`, …) the Arabic one, and Turkish locales (`tr`, `tr_TR`) the Turkish one, and Slovenian locales (`sl`, `sl_SI`) the Slovenian one, and Vietnamese locales (`vi`, `vi_VN`) the Vietnamese one. A system language without a catalog shows English. On Windows, **Auto** uses the Windows display languages, in preference order, when no supported locale is selected by those environment variables. Neutral `C`/`POSIX` locale values (including `C.UTF-8`) inherited from a launcher do not override the Windows display language; explicitly named supported locales such as `fr_FR.UTF-8` still do. The query asks Windows directly (`GetUserPreferredUILanguages`, through the `sys-locale` crate) without starting a process, and is cached for the process. If detection fails or the display language has no catalog, PdfCraft shows English.
 
 The control channel exposes the setting through `ui.set`:
 
@@ -12,18 +12,21 @@ The control channel exposes the setting through `ui.set`:
 {"method":"ui.set","params":{"key":"language","value":"ja"}}
 ```
 
-The value is `auto` or a language code (`en`, `ja`, `zh-hans`, `zh-hant`, `cs`, `pt-br`, `de`, `es`, `fr`, `ru`, `kk`, `bg`, `te`, `hu`, `uk`, `it`, `ar`, `pl`, `sl`, `el`, `tr`, `lt`), in any case. `ui.state` reports `language` as written in the preferences (`auto`, `en`, `ja`, `zh-hans`, `zh-hant`, `cs`, `pt-br`, `de`, `es`, `fr`, `ru`, `kk`, `bg`, `te`, `hu`, `uk`, `it`, `ar`, `pl`, `sl`, `el`, `tr` or `lt`). Unknown values return an error without changing the current setting. Preferences saved before this setting existed follow the system language.
+The value is `auto` or a language code (`en`, `ja`, `zh-hans`, `zh-hant`, `cs`, `pt-br`, `de`, `es`, `fr`, `ru`, `kk`, `bg`, `te`, `hu`, `uk`, `it`, `ar`, `pl`, `sl`, `el`, `tr`, `lt` or `vi`), in any case. `ui.state` reports `language` as written in the preferences (`auto`, `en`, `ja`, `zh-hans`, `zh-hant`, `cs`, `pt-br`, `de`, `es`, `fr`, `ru`, `kk`, `bg`, `te`, `hu`, `uk`, `it`, `ar`, `pl`, `sl`, `el`, `tr`, `lt` or `vi`). Unknown values return an error without changing the current setting. Preferences saved before this setting existed follow the system language.
 
-Dialogs, panels, menus, notices and history labels go through the catalog (`tl!`). Japanese, Traditional Chinese, Simplified Chinese, Russian, Bulgarian, German, Spanish, French, Telugu, Hungarian, Ukrainian, Italian, Brazilian Portuguese and Arabic translate them (about 2,000–2,140 entries each); Czech and Turkish cover the menus so far. Untranslated labels use English. Error details that come from the engine or the operating system are shown as they are, inside a translated frame ("操作「…」に失敗しました: …"). The command palette matches the translated label, the English label and the command id. Vertical Japanese PDF rendering is an existing viewer feature; this change does not add vertical text editing. Per-language coverage, script support and what each language still needs are in [localization-parity.md](localization-parity.md).
-Dialogs, panels, menus, notices and history labels go through the catalog (`tl!`). Japanese, Traditional Chinese, Simplified Chinese, Russian, Bulgarian, German, Spanish, French, Telugu, Hungarian, Ukrainian, Italian, Brazilian Portuguese, Arabic and Slovenian translate them (about 2,000–2,190 entries each); Czech covers the menus so far. Untranslated labels use English. Error details that come from the engine or the operating system are shown as they are, inside a translated frame ("操作「…」に失敗しました: …"). The command palette matches the translated label, the English label and the command id. Vertical Japanese PDF rendering is an existing viewer feature; this change does not add vertical text editing. Per-language coverage, script support and what each language still needs are in [localization-parity.md](localization-parity.md).
+Dialogs, panels, menus, notices and history labels go through the catalog (`tl!`). Most shipped catalogs (Japanese, Chinese, Russian, Bulgarian, German, Spanish, French, Telugu, Hungarian, Ukrainian, Italian, Brazilian Portuguese, Arabic, Slovenian, Kazakh, Polish, Greek, Turkish, Lithuanian, Vietnamese and others) cover the current localizable surface (about 2,000–2,600 entries each); Czech still covers mainly the menus. Untranslated labels use English. Error details that come from the engine or the operating system are shown as they are, inside a translated frame ("操作「…」に失敗しました: …"). The command palette matches the translated label, the English label and the command id. Vertical Japanese PDF rendering is an existing viewer feature; this change does not add vertical text editing. Document contents, filenames, CLI/MCP/control protocol strings and external help stay outside the catalog. Per-language coverage, script support and what each language still needs are in [localization-parity.md](localization-parity.md).
+Dialogs, panels, menus, notices and history labels go through the catalog (`tl!`). Japanese, Traditional Chinese, Simplified Chinese, Russian, Bulgarian, German, Spanish, French, Telugu, Hungarian, Ukrainian, Brazilian Portuguese and Arabic translate them (about 2,000–2,140 entries each), and Italian has 2,528 entries; Czech and Turkish cover the menus so far. Untranslated labels use English. Error details that come from the engine or the operating system are shown as they are, inside a translated frame ("操作「…」に失敗しました: …"). The command palette matches the translated label, the English label and the command id. Vertical Japanese PDF rendering is an existing viewer feature; this change does not add vertical text editing. Per-language coverage, script support and what each language still needs are in [localization-parity.md](localization-parity.md).
+Dialogs, panels, menus, notices and history labels go through the catalog (`tl!`). Japanese, Traditional Chinese, Simplified Chinese, Russian, Bulgarian, German, Spanish, French, Telugu, Hungarian, Ukrainian, Brazilian Portuguese, Arabic and Slovenian translate them (about 2,000–2,190 entries each), and Italian has 2,528 entries; Czech covers the menus so far. Untranslated labels use English. Error details that come from the engine or the operating system are shown as they are, inside a translated frame ("操作「…」に失敗しました: …"). The command palette matches the translated label, the English label and the command id. Vertical Japanese PDF rendering is an existing viewer feature; this change does not add vertical text editing. Per-language coverage, script support and what each language still needs are in [localization-parity.md](localization-parity.md).
 
 Whole sentences that the layers below word — what the accessibility checker found, what the PDF/A verifier reports, what a signature's details say, what is wrong with the pages to print, what an edit is called in the history — are translated too, because those layers hand the sentence over apart from the document's own words. See [Sentences the engine words](#sentences-the-engine-words).
 
 The Ukrainian catalog has 2,047 entries, written from the meaning of the English labels using Ukrainian computing vocabulary. Commands use infinitives; fixed-count messages use count-neutral wording. Plural-aware messages use the three [CLDR Ukrainian integer forms](https://www.unicode.org/cldr/charts/48/supplemental/language_plural_rules.html#uk): `1 сторінка`, `2 сторінки`, `5 сторінок`; 11–14 take the third form, while 21 and 22 return to the first and second. Calendar dates use genitive month names (`9 жовтня 2026`), while headings use standalone names (`Жовтень 2026`). Home recommendation cards grow to fit translated text; the toolbar search hint truncates before the shortcut, with the full label available on hover.
 
-The Lithuanian catalog has 2,578 entries and three integer plural forms. Calendar headings use standalone month names; dates use genitive forms. Coverage tests check commands/tools, scanned literal and direct lookups, and source/context keys in the other bundled catalogs. Calendar, inspector and password-dialog UI regressions check dynamic labels and preserve document values. A native Lithuanian-speaking contributor has reviewed the translation.
+The Lithuanian catalog has 2,585 entries and three integer plural forms. Calendar headings use standalone month names; dates use genitive forms. Coverage tests check commands/tools, scanned literal and direct lookups, and source/context keys in the other bundled catalogs. Calendar, inspector and password-dialog UI regressions check dynamic labels and preserve document values. A native Lithuanian-speaking contributor has reviewed the translation.
 
-Edit text reads Hebrew lines in typing order and writes them back in drawing order (`crates/edit/src/bidi.rs`); letters the page's own font lacks are drawn with the craft-fonts `Hebr` face (Noto Sans Hebrew) as Type 3 glyphs, and a build without one says so. Hebrew points (niqqud) can't be written yet. The craft-fonts revision pinned for CI and releases has no `Hebr` face yet, so until one is added releases report that error instead of drawing the missing letters.
+The Vietnamese catalog has 2,591 entries and one plural form (`plural_none`). Preferences theme `Appearance` uses context `theme` → `Giao diện`; object/comment/signature appearance stays plain `Diện mạo`. Form fields use `Trường`; redaction apply wording states permanent removal. Calendar months are numeric (`Tháng 1`…`12` / `tháng 1`…`12`). Coverage tests require every current command, UI literal, bundled key and credit label. A native Vietnamese-speaking contributor has reviewed the translation. Status stays `partial`: no translated help, and engine/OS details stay English inside a translated frame.
+
+Edit text reads Hebrew lines in typing order and writes them back in drawing order (`crates/edit/src/bidi.rs`); letters the page's own font lacks are drawn with the craft-fonts `Hebr` face (Noto Sans Hebrew) as Type 3 glyphs, and a build without one says so. Hebrew points (niqqud) can't be written yet in Edit text. Add text (#128) draws Hebrew with the same face through the shaped path Arabic and Thai use: right to left with numbers and Latin in place, points kept on their letter, and typing order for copy and search. The craft-fonts revision pinned for CI and releases has no `Hebr` face yet, so until one is added releases report that error instead of drawing the missing letters, and refuse Hebrew in Add text.
 
 Japanese interface text uses BIZ UDPGothic from [craft-fonts](https://github.com/storytold/craft-fonts), an optional build input that every release includes (`CRAFT_FONTS_DIR`; see the README). A build made without it has no Japanese face, so Japanese labels show replacement boxes. Chinese is drawn with the same craft-fonts CJK faces (in Simplified Chinese the `Hans` faces come first, so a line never mixes faces with different baselines), so a character none of them has shows a replacement box (and every Chinese character does in a build without craft-fonts). Russian, Bulgarian, Czech, Brazilian Portuguese, German, Spanish, French, Hungarian, Italian, Turkish and Lithuanian need only the bundled Latin faces (tested in `tests/fonts.rs`). Hungarian uses the same one/other plural rule as English: 1 is singular, and every other count — including 0 — is the other form. After a numeral the noun stays singular (`1 oldal`, `2 oldal`). Telugu is drawn with a craft-fonts `Telu` face (Noto Sans Telugu, kept in the web build too), whose conjuncts egui shapes; a build without one shows Telugu labels as replacement boxes, and the release-pinned craft-fonts input has no Telugu face yet.
 Japanese interface text uses BIZ UDPGothic from [craft-fonts](https://github.com/storytold/craft-fonts), an optional build input that every release includes (`CRAFT_FONTS_DIR`; see the README). A build made without it has no Japanese face, so Japanese labels show replacement boxes. Chinese is drawn with the same craft-fonts CJK faces (in Simplified Chinese the `Hans` faces come first, so a line never mixes faces with different baselines), so a character none of them has shows a replacement box (and every Chinese character does in a build without craft-fonts). Russian, Bulgarian, Czech, Brazilian Portuguese, German, Spanish, French, Hungarian, Italian and Slovenian need only the bundled Latin faces (tested in `tests/fonts.rs`). Slovenian has four plural forms: one (1, 101, 201…), two (2, 102…), few (3, 4, 103…) and other (everything else, including 0, 5–20 and 21+), so `@plural` entries list four forms (`1 stran`, `2 strani`, `3 strani`, `5 strani`). Hungarian uses the same one/other plural rule as English: 1 is singular, and every other count — including 0 — is the other form. After a numeral the noun stays singular (`1 oldal`, `2 oldal`). Telugu is drawn with a craft-fonts `Telu` face (Noto Sans Telugu, kept in the web build too), whose conjuncts egui shapes; a build without one shows Telugu labels as replacement boxes, and the release-pinned craft-fonts input has no Telugu face yet.
@@ -62,7 +65,7 @@ PdfCraft uses the same system as PhotoCraft (`crates/ui-egui/src/i18n/`):
 - Each language has a catalog, `crates/ui-egui/src/i18n/<code>.tsv`, with one entry per line: `context<TAB>English<TAB>translation`. An empty context marks a plain string. `@id` keys an entry by command id (for example `file.saveAs`), so one menu item can read differently from another with the same English label. `@plural` holds plural forms. Any other context disambiguates an English word with several meanings (`tl_ctx!` in UI code, for example the signature pad's "Type" button against the "Type" column). The header of `ja.tsv` documents the format and escapes.
 - Placeholders (`{name}`) must appear in both columns. A trailing `…` must be kept. `i18n::fmt` fills placeholders in one pass, so a value such as a file name containing `{n}` is inserted as written.
 - Catalogs are validated strictly: unknown escapes, unknown `@` contexts, placeholder or ellipsis mismatches, wrong plural form counts and duplicates are errors. The tests require the bundled catalogs to have none; at run time a bad line is skipped (and logged) and that string shows in English.
-- Catalogs are assets: each `.tsv` has an `ATTRIBUTION.toml` entry with `kind = "translation"` and its SHA-256, checked by `cargo xtask assets`.
+- Catalogs are assets: each `.tsv` has an `ATTRIBUTION.toml` entry with `kind = "translation"` and its SHA-256, checked by `cargo xtask assets`. After editing a catalog, put the new hash into its entry by hand (`sha256sum crates/ui-egui/src/i18n/<code>.tsv`), because `cargo xtask assets --write` does not touch `ATTRIBUTION.toml`; the hash check is deliberate, so a changed asset gets its provenance re-checked. Without it `cargo xtask assets` and the test `assets::tests::the_real_manifest_passes` fail.
 - Translations are clean-room: write them from the meaning of the English text, never from another product's string tables.
 
 ## Sentences the engine words
@@ -81,6 +84,6 @@ Error details that come from the operating system, and faults rather than mistak
 
 1. Copy the header of `ja.tsv` into `xx.tsv` and translate entries.
 2. Add one row to `LANGUAGES` in `crates/ui-egui/src/i18n/mod.rs`: code, native name, catalog and plural rule.
-3. Add an `ATTRIBUTION.toml` entry for the catalog (`kind = "translation"`), then run `cargo xtask assets --write` and `cargo xtask assets`.
+3. Add an `ATTRIBUTION.toml` entry for the catalog (`kind = "translation"`), with the catalog's `sha256sum` as `sha256`, then run `cargo xtask assets --write` (it regenerates `ATTRIBUTION.md` only) and `cargo xtask assets`.
 
 The Preferences dropdown, the system-language match and the catalog tests (format, duplicates, placeholders, plural forms, command ids) then pick it up.
diff --git a/docs/mcp.md b/docs/mcp.md
index 830a6c312..96493487c 100644
--- a/docs/mcp.md
+++ b/docs/mcp.md
@@ -1,6 +1,6 @@
 # MCP conventions
 
-Start explicitly with `pdfcraft-cli mcp [--root DIR] [--compact]`. The server uses JSON lines on
+Start explicitly with `pdfcraft-cli mcp [--root DIR] [--compact] [--automation-read-root DIR] [--automation-write-root DIR]`. The server uses JSON lines on
 stdin/stdout, opens no port, and stops on EOF. `--root` confines all reads and writes, including
 commands invoked through the common tools. Logs stay on stderr.
 
@@ -8,6 +8,68 @@ Supply `--root` at most once, followed by a nonempty directory path. Missing ope
 repeated roots and another long option in place of the directory are refused before any
 script is read or server is started. Prefix a directory name beginning with `--` with `./`.
 
+## Confining file access
+
+```sh
+pdfcraft-cli mcp --automation-read-root /work/project --automation-write-root /work/project/out
+```
+
+```json
+{"mcpServers": {"pdfcraft": {"command": "/abs/path/target/release/pdfcraft-cli",
+  "args": ["mcp", "--automation-read-root", "/work/project", "--automation-write-root", "/work/project/out"]}}}
+```
+
+The two flags (VectorCraft, PhotoCraft and the other Craft apps take the same ones, so one client
+config works across the suite) keep the agent to the folders you give it:
+
+- Every file a tool reads must lie inside the **read root**: `doc_open`, `page_insert_file`,
+  `page_replace`, `doc_combine` and `doc_create_multiple` inputs, `doc_create` images, stamp,
+  picture, attachment, signature and form-image files, `doc_watermark` and `doc_background` files,
+  `doc_import_data`, `form_merge_data`, the files `action_run` and `ocr_recognize_files` process,
+  digital ID, graphic and certificate files for signing and `sign_trust`, `text_font_import`, and
+  the folders `text_font_files` searches. Without `directories`, `text_font_files` searches the read
+  root instead of the installed fonts.
+- Every file a tool writes must lie inside the **write root**: `doc_save` (also saving in place),
+  `page_extract`, `doc_combine`, `doc_create_multiple`, `doc_split`, `doc_reduce`, `doc_optimize`,
+  `doc_print` to a file, the `doc_export_*` tools, `image_save`, `measure_export`,
+  `comments_summarize`, the accessibility report and review record, `doc_compare_report`,
+  `form_merge_data`, the output folders of `action_run` and `ocr_recognize_files`, `sign_id_create`
+  and `sign_document`.
+- Read and write access are separate. Give the same folder twice for both. A root left out grants
+  none of its access: with only `--automation-read-root`, nothing can be written to disk, though
+  tools that give their result back instead of a path still do. Without either flag nothing changes.
+- A path is made absolute against the server's working directory, then its links are followed: a file
+  (or folder) link that leads out of a root is outside it. For a file that doesn't exist yet, its
+  nearest existing folder's links are followed and the rest must be plain names, so `..` below a
+  folder that doesn't exist is refused, as is a link that leads nowhere (writing through it would
+  create its target). The result is compared with the root by whole folder names: `/work2/x` is not
+  inside `/work`. On Windows case is ignored, UNC paths are resolved like drive-letter ones, and
+  device names (`CON`, `NUL`, `COM1`...) are refused.
+- A refused path is an ordinary tool error the agent can read and correct, for example
+  `automation path rejected: outside the write root /work/project/out: /etc/x.pdf` or
+  `automation filesystem access is not granted: write authority is absent: /work/project/out/x.pdf`.
+  Tools that handle several files report a refused one in its own entry.
+- The roots must be existing folders; a missing one stops the server with an error. Each flag is
+  given once (`--flag <dir>` or `--flag=<dir>`).
+- `--root DIR` still works and can be combined with these flags. Both then apply: a path must be
+  inside `--root` and inside the matching automation root.
+
+`pdfcraft-cli mcp` always runs the session in its own process (there is no flag to connect it to a
+running app), so the roots cover every server it starts. The desktop app is not confined by them.
+
+What the roots do not cover: tools that take no path still read and change the open documents, and
+`text_extract` and the other inspection tools return their content. Keychain and Windows
+certificate-store identities for `sign_document` are not files and are not checked. Sending a job
+to a printer is not a file write. Every path a tool reads or writes goes through
+`Automation::resolve`, and a unit test keeps the tool modules from touching the file system
+without it.
+
+A path is checked, then opened: another program that swaps a link in between can still win that
+race, so the roots keep an agent to the files it was given rather than guarding against other
+software on the computer.
+
+## Tools
+
 | Tool | Arguments |
 |---|---|
 | `command_list` | `doc?`, `filter?`, `enabled_only?`; returns `{commands: [...]}` with mapped tool schemas |
diff --git a/docs/pdf-spec-parity.md b/docs/pdf-spec-parity.md
index 23f2b66a3..4e21ef2ec 100644
--- a/docs/pdf-spec-parity.md
+++ b/docs/pdf-spec-parity.md
@@ -1,6 +1,6 @@
 # PDF specification and standards parity
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-11 · **Change:** minor (§7.6.4: written encrypted files open in Acrobat, #774) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-14 · **Change:** minor (§12.4.4: page transitions and display times read) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 
 How much of ISO 32000-2 (PDF 2.0) and the PDF subset standards PdfCraft implements, set against
 what Acrobat Pro implements. This is PdfCraft's equivalent of a "geometry" or "codec" checklist:
@@ -35,7 +35,7 @@ are borrowed; PDF 2.0 additions and most subset standards are missing. **150–2
 | §10 | Rendering: transfer functions, halftones, overprint, smoothness | full | borrowed; no overprint preview | `print.overprint-preview` planned |
 | §11 | Transparency: blend modes, soft masks, groups, knockout | full | borrowed (knockout shipped) | `view.render-transparency` partial |
 | §12.1–12.3 | Viewer preferences, page layout, page labels, outlines, destinations | full | **own**: initial view, page labels, bookmarks edit and from structure, named destinations rewired on copy | named-destination editing panel planned |
-| §12.4 | Page transitions, thumbnails, articles, presentations | full | none (thumbnails discarded or kept) | `organize.page-transitions`, `view.articles-panel` planned |
+| §12.4 | Page transitions, thumbnails, articles, presentations | full | `/Trans` and `/Dur` read and listed by `doc_info`, not played; thumbnails discarded or kept | `organize.page-transitions` partial, `view.articles-panel` planned |
 | §12.5 | Annotations | 28 types | see table below | |
 | §12.6 | Actions | 19 types | see table below | |
 | §12.7 | Interactive forms (AcroForm): fields, appearances, calculation order, JavaScript actions | full | **own**: all field types, regenerated appearances, Acrobat's AF functions and event order, sandboxed JavaScript (boa) | `form.js-host` partial (object-model subset); submit planned |
@@ -130,5 +130,6 @@ are borrowed; PDF 2.0 additions and most subset standards are missing. **150–2
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-14 | minor | §12.4.4: `/Trans` and `/Dur` read into `DocInfo::transitions` and reported by `doc_info` |
 | 2026-10-11 | minor | §7.6.4: encrypted files we write open in Acrobat (#774, fixed by #836) |
 | 2026-10-10 | major | Created from the code, `vendor/README.md` and `parity/acrobat-features.toml`, against ISO 32000-2 and Acrobat Pro 26.002.21931's documented capabilities |
diff --git a/docs/releasing.md b/docs/releasing.md
index 5d6a850ab..ec2e5853b 100644
--- a/docs/releasing.md
+++ b/docs/releasing.md
@@ -121,10 +121,14 @@ neither the MSI nor the portable zip needs the Visual C++ redistributable.
   dialogs. Full UI confirms success with Finish; failures and cancellations have distinct messages.
   The welcome dialog has a "Create a desktop shortcut" checkbox and an "Edit with PdfCraft"
   right-click menu checkbox, both ticked by default. `/qn` and `/qb` stay unattended and create
-  both unless `INSTALLDESKTOPSHORTCUT=0` or `INSTALLPDFCONTEXTMENU=0` is passed. An update (the
-  launcher runs `msiexec /passive` with no properties) keeps the desktop shortcut only if
-  `PdfCraft.lnk` is still on the all-users desktop, so deleting it once keeps it away (#1058); a
-  value given on the command line wins.
+  both unless `INSTALLDESKTOPSHORTCUT=0` or `INSTALLPDFCONTEXTMENU=0` is passed;
+  `INSTALLIMAGECONTEXTMENU=0` (no checkbox) leaves out the image menu. An update (the launcher runs
+  `msiexec /passive` with no properties) keeps the desktop shortcut only if `PdfCraft.lnk` is still
+  on the all-users desktop, so deleting it once keeps it away (#1058), and keeps each menu only if
+  its key path is still in HKLM (#305). Both are AppSearch results read before the old version is
+  removed. An update from a release that didn't have a menu yet (before 0.7.1 for the PDF menu,
+  before 0.4.0 for the image menu, found by `OnlyDetect` Upgrade rows) adds it like a first install.
+  A value given on the command line wins.
 - The PDF right-click entry (#682) is a classic verb under
   `HKLM\Software\Classes\SystemFileAssociations\.pdf\shell\PdfCraft.Edit`, so it shows whichever app
   is the default for `.pdf` and never changes that default. Several selected PDFs (up to 15, the
@@ -132,8 +136,12 @@ neither the MSI nor the portable zip needs the Visual C++ redistributable.
   hand-off opens them as tabs. On Windows 11 it is under "Show more options"; a first-level entry
   needs an `IExplorerCommand` handler and package identity (a sparse MSIX package), which the MSI
   doesn't have.
+- The image right-click entry (#190) is the same kind of verb, `PdfCraft.CreatePdf`, for ten image
+  types, in its own component (`PdfcraftImageContextMenu`) since it became optional. Its rows moved
+  out of `PdfcraftApp`; that's safe because `MajorUpgrade` removes the old version before installing
+  the new one (`afterInstallValidate`), which `test-msi.ps1` checks.
 - `test-msi.ps1 <file.msi>` checks the compiled shortcut, context-menu and dialog tables, and
-  evaluates the desktop shortcut's first-install and update conditions. Packaging
+  evaluates the first-install and update conditions of the desktop shortcut and both menus. Packaging
   runs it in a child process before signing, so the MSI isn't held open when signtool runs. The ARM64 install
   smoke test checks that both all-users shortcuts point at the installed `pdfcraft.exe` and are
   removed on uninstall, and that `INSTALLDESKTOPSHORTCUT=0` skips the desktop one.
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 8da76e0d2..d9470232b 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -1,7 +1,13 @@
 # PdfCraft roadmap: milestones and what's next
 
 > **Last reviewed:** 2026-10-14 · **Last updated:** 2026-10-14 · **Change:** minor (M1: raw-deflate fallback preserves decoding-limit errors; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-13 · **Last updated:** 2026-10-14 · **Change:** minor (M14: the Italian catalog has every entry the other catalogs had and the code looks up, 2,528 entries; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-13 · **Change:** minor (M2/M6: spot-colour images convert once per pixel value; widget placement and the Fields panel scale with the field count; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-14 · **Last updated:** 2026-10-14 · **Change:** minor (M3 candidate: coordinate control clicks on slow frames and coalesced text selection; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-14 · **Last updated:** 2026-10-14 · **Change:** minor (M3 #2080 candidate: explicit search jumps join per-tab history; rail and control-channel Back/Forward; estimates unchanged)
 > **Last reviewed:** 2026-10-13 · **Last updated:** 2026-10-13 · **Change:** minor (M3 candidate: native opens retain chosen tools through password retries and defer startup intake while preparation is pending; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (M4 #1310 #1311 #1312: undo, revert and the next save keep the last saved revision; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-13 · **Last updated:** 2026-10-13 · **Change:** minor (M3 #1980: exact quit modifiers preserve Ctrl+Alt+Q email input; M3 candidate: native opens retain chosen tools through password retries and defer startup intake while preparation is pending; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (M13: CLI check visits each directory once through aliases and cycles; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (M4: Extract and Split preserve shared Type 3 glyph resources; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (M2: packed TIFF-predictor RGB rows retain their byte boundaries; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
@@ -9,6 +15,7 @@
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (M5 #1398: stamps read upright on rotated pages; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (gap 6: #1317, #1327, #1302, #1315, #1340; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (M7 #1316: replacing a line keeps a neighbouring line whose glyph box overlaps; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (M5: comment submission shortcuts; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (M1 #1339: unchanged incremental saves of a classic cross-reference table write a zero-length subsection; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (M3: Windows' Animation effects setting is followed, and Preferences has Animation effects; earlier: exclusive image-crop resize follow-up; M2: short same-line redraws split before placement; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (M7: inline Arabic ActualText ligatures join their word; earlier: preserve Arabic ActualText typing order; M3: Windows' Animation effects setting is followed, and Preferences has Animation effects; exclusive image-crop resize follow-up; M2: short same-line redraws split before placement; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
@@ -25,6 +32,7 @@
 > **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-11 · **Change:** minor (M6: keep accepted form values when Tab reopens the same field before Save; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-11 · **Change:** minor (M13: reject malformed CLI --root options before dispatch; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-11 · **Change:** minor (Traditional Chinese accessibility semantics and Taiwan form/table terminology; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** patch (M1 #1337: exhausted xref hints are repaired; allocation avoids overflow; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 
 Forward-looking: the milestones, the current focus and what comes next. The parity numbers behind
 it are in [target-app-parity.md](target-app-parity.md), the ranked work list in [gaps.md](gaps.md),
@@ -89,37 +97,46 @@ total matches the parity estimate.
 | M | Milestone | Plan size (h) | Done | Remaining (h, 2026-10-10) | Notes |
 |---|---|---|---|---|---|
 | M0 | Skeleton: workspace, xtask gates, CI | 15–30 | 98% | 1–2 | GitHub workflow, `deny.toml` (licence audit of every dependency), parity checklist (826 features, `xtask parity`) done. Missing: remaining crate stubs, testkit/oracle crates |
-| M1 | COS: filters, crypt, parser, xref, writer | 120–200 | 80% | 20–40 | Done:<br>- filters and crypt: every standard-security revision R2–R6 (RC4, AES-128/256), SASLprep, permissions, creating encryption;<br>- cos: parse and repair (including invalid xref object-number ranges), decoded-stream limits including unfiltered data, decrypt on load, re-encrypt on save, incremental and full writing.<br>Corpus: open/edit/save passes on 958 files, and all 7 password-protected files open.<br>Full saves now pack objects into compressed object streams. An unchanged incremental save of a classic table writes a zero-length cross-reference subsection instead of a section with no subsections (#1339). Fuzzing runs nightly (`xtask fuzz`). Raw-deflate fallback preserves decoding-limit errors, including through tolerant COS stream decoding. Missing: ≥ 250 tests, own image codecs |
-| M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings. Packed TIFF-predictor RGB rows retain later rows in decoding and rendering. |
+| M1 | COS: filters, crypt, parser, xref, writer | 120–200 | 80% | 20–40 | Done:<br>- filters and crypt: every standard-security revision R2–R6 (RC4, AES-128/256), SASLprep, permissions, creating encryption;<br>- cos: parse and repair (including invalid xref object-number ranges), decoded-stream limits including unfiltered data, decrypt on load, re-encrypt on save, incremental and full writing.<br>Corpus: open/edit/save passes on 958 files, and all 7 password-protected files open.<br>Full saves now pack objects into compressed object streams. An unchanged incremental save of a classic table writes a zero-length cross-reference subsection instead of a section with no subsections (#1339). A full rewrite keeps unknown trailer entries, including objects reachable only from them (#1338). Fuzzing runs nightly (`xtask fuzz`). Raw-deflate fallback preserves decoding-limit errors, including through tolerant COS stream decoding. Missing: ≥ 250 tests, own image codecs |
+| M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings. Packed TIFF-predictor RGB rows retain later rows in decoding and rendering. Page marks, added content and print output retain small page-unit transform coefficients when serialized. |
+| M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings. Packed TIFF-predictor RGB rows retain later rows in decoding and rendering. The renderer keeps its one-point crop-size floor in physical points after UserUnit scaling, with regression coverage for crop origins, rotations and f32 reciprocal rounding. Existing unit policy and nearly-zero fallback are retained. |
 | M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings |
-| M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). #1364 candidate: absolute local GoToR links ask before target access; headless callers explicitly opt in. Native-opening candidate: chosen tools survive preparation and password retries; startup intake waits for pending preparation. |
+| M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). Selected-text Copy in Edit and the canvas context menu is covered by focused regressions and native clipboard checks (#1225); document copy restrictions apply to the floating action too. #1364 candidate: absolute local GoToR links ask before target access; headless callers explicitly opt in. Native-opening candidate: chosen tools survive preparation and password retries; startup intake waits for pending preparation. Page-label navigation displays logical labels, retains the current page on unchanged submission and refreshes focused same-document replacements; clean file-watcher reload preserves the chosen scrolling mode, preventing a Single Page reader from jumping to page 1 during replacement. Synthetic control regressions cover these behaviors. |
+| M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). #1364 candidate: absolute local GoToR links ask before target access; headless callers explicitly opt in. Native-opening candidate: chosen tools survive preparation and password retries; startup intake waits for pending preparation. Later native-open replies stay queued while a modal or picker owns the foreground; regressions cover recipient ownership, completion/cancellation and one-shot wakes. |
+| M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). #1364 candidate: absolute local GoToR links ask before target access; headless callers explicitly opt in. Native-opening candidate: chosen tools survive preparation and password retries; startup intake waits for pending preparation. #1980: exact quit modifiers preserve Ctrl+Alt+Q email input; Ctrl+Q/Cmd+Q asks before discarding unsaved documents. |
+| M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). #1364 candidate: absolute local GoToR links ask before target access; headless callers explicitly opt in. Native-opening candidate: chosen tools survive preparation and password retries; startup intake waits for pending preparation.<br>Candidate: coordinate control clicks pair press/release across slow frames; coalesced primary presses retain text multi-click selection. Regression cases cover slow-frame button activation, disabled controls and text multi-click selection; estimates unchanged. |
+| M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). #1364 candidate: absolute local GoToR links ask before target access; headless callers explicitly opt in. Native-opening candidate: chosen tools survive preparation and password retries; startup intake waits for pending preparation. #2080 candidate: search-result jumps enter per-tab history; rail and control-channel Back/Forward; no exact-view or restart persistence. |
 | M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. A custom text match that ends on a reconstructed separator stops before the next glyph (#1315). Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings |
-| M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); Lab Bradford adaptation uses LMS white-point ratios, covered by independent neutral/chromatic and direct/Indexed render oracles; inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings |
+| M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); Lab Bradford adaptation uses LMS white-point ratios, covered by independent neutral/chromatic and direct/Indexed render oracles; inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings. Literal page-label prefix whitespace is preserved; nine public-inspection cases cover prefix spaces, encodings and empty-prefix controls |
 | M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). |
-| M4 | Engine, history, save, organize | 100–180 | 95% | 8–15 | Done:<br>- command registry (menus, shortcuts and palette all use it);<br>- undo/redo; incremental, atomic and encrypted saves;<br>- autosave and crash recovery;<br>- organize, combine, extract, split and insert-from-file, with identical fonts and images stored once;<br>- CLI `edit/combine/extract/split`.<br>Done since: Organize opens directly into the page overview, with checkbox selection, an editable page-range selection (#1092), and per-page rotate/delete controls; Combine files in its own tab (sortable, resizable columns; folders; early warnings; unlocking protected files), bookmark editing, page labels (Number pages), CLI `run`, Set Page Boxes, Crop tool, Duplicate pages, Ctrl+A / Cmd+A to select all pages in Organize, Replace pages, bookmarks from tagged headings. Extract and Split preserve shared Type 3 glyph resource graphs, retaining conservative pruning limits. Missing: page transitions, recovery on the web |
+| M4 | Engine, history, save, organize | 100–180 | 95% | 8–15 | Done:<br>- command registry (menus, shortcuts and palette all use it);<br>- undo/redo; incremental, atomic and encrypted saves;<br>- autosave and crash recovery;<br>- organize, combine, extract, split and insert-from-file, with identical fonts and images stored once;<br>- CLI `edit/combine/extract/split`.<br>Done since: Organize opens directly into the page overview, with checkbox selection, an editable page-range selection (#1092), and per-page rotate/delete controls; Combine files in its own tab (sortable, resizable columns; folders; early warnings; unlocking protected files), bookmark editing, page labels (Number pages), CLI `run`, Set Page Boxes, Crop tool, Duplicate pages, Ctrl+A / Cmd+A to select all pages in Organize, Replace pages, bookmarks from tagged headings. Extract and Split preserve shared Type 3 glyph resource graphs, retaining conservative pruning limits. Undo back to the opened or last saved file is clean; Revert opens that saved file after an undo; a later save appends to it so the saved revision stays in the file (#1310, #1311, #1312). Missing: page transitions, recovery on the web |
+| M4 | Engine, history, save, organize | 100–180 | 95% | 8–15 | Done:<br>- command registry (menus, shortcuts and palette all use it);<br>- undo/redo; incremental, atomic and encrypted saves;<br>- autosave and crash recovery;<br>- organize, combine, extract, split and insert-from-file, with identical fonts and images stored once;<br>- CLI `edit/combine/extract/split`.<br>Done since: Organize opens directly into the page overview, with checkbox selection, an editable page-range selection (#1092), and per-page rotate/delete controls; Combine files in its own tab (sortable, resizable columns; folders; early warnings; unlocking protected files), bookmark editing, page labels (Number pages), CLI `run`, Set Page Boxes, Crop tool, Duplicate pages, Ctrl+A / Cmd+A to select all pages in Organize, Replace pages, bookmarks from tagged headings. Extract and Split preserve shared Type 3 glyph resource graphs, retaining conservative pruning limits. Missing: page transitions, recovery on the web M4: Insert-from-file preserves source bookmarks; integration tests retained with current main. |
 | M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). Renderer-creation errors return to the existing OpenGL startup fallback; a real-GPU regression covers errors and device reuse. The underlying x86 DX12 shader compiler failure remains unresolved; see `windows-renderer-startup.md`. With Windows' Animation effects turned off, the wheel scrolls and zooms without easing and egui's animations take no time (`motion.rs`; macOS, Linux and the browser aren't asked yet); Preferences ▸ Animation effects (Use system setting, On, Off) decides it on every platform. |
 | M4 | Engine, history, save, organize | 100–180 | 95% | 8–15 | Done:<br>- command registry (menus, shortcuts and palette all use it);<br>- undo/redo; incremental, atomic and encrypted saves;<br>- autosave and crash recovery;<br>- organize, combine, extract, split and insert-from-file, with identical fonts and images stored once;<br>- CLI `edit/combine/extract/split`.<br>Done since: Combine files in its own tab (sortable, resizable columns; folders; early warnings; unlocking protected files), bookmark editing, page labels (Number pages), CLI `run`, Set Page Boxes, Crop tool, Duplicate pages, Ctrl+A / Cmd+A to select all pages in Organize, Replace pages, bookmarks from tagged headings. Missing: page transitions, recovery on the web |
+| M5 | Comments (all annotation types, XFDF) | 120–200 | 88% | 12–25 | Done: notes, highlight/underline/strikeout/squiggly, text boxes, ink, lines, arrows, rectangles, ovals, stamps (dynamic, Sign Here, Standard Business), with appearance streams; replies, status, checkmarks, locking, move/resize/restyle/delete; properties dialog; panel filter and sort; hide all; summaries (comments only); XFDF/FDF import and export (partial imports preserve existing reply and review-status links); flatten; Fill & Sign with adjustable text/date size; agent tools.<br>Done since: stamps placed on a rotated page read upright (#1398); polygons, connected lines, clouds, callouts, inserted text, colour and checkmark filters; image signature pointer previews, selection handles and live image movement/resizing with proportional corners and independent edge handles; Ctrl+Enter submission for highlight comment text and replies, with Shift+Enter newlines (reconciled with upstream main for PR #1457 on 2026-10-14). Missing: custom stamps, replace-text proposals, summary layouts with the page |
+| M4 | Engine, history, save, organize | 100–180 | 95% | 8–15 | Done:<br>- command registry (menus, shortcuts and palette all use it);<br>- undo/redo; incremental, atomic and encrypted saves;<br>- autosave and crash recovery;<br>- organize, combine, extract, split and insert-from-file, with identical fonts and images stored once;<br>- CLI `edit/combine/extract/split`.<br>Done since: Combine files in its own tab (sortable, resizable columns; folders; early warnings; unlocking protected files), bookmark editing, page labels (Number pages), CLI `run`, Set Page Boxes, Crop tool, Duplicate pages, Ctrl+A / Cmd+A to select all pages in Organize, Replace pages, bookmarks from tagged headings. Missing: page transitions, recovery on the web M4: Insert-from-file preserves source bookmarks; integration tests retained with current main. |
 | M5 | Comments (all annotation types, XFDF) | 120–200 | 88% | 12–25 | Done: notes, highlight/underline/strikeout/squiggly, text boxes, ink, lines, arrows, rectangles, ovals, stamps (dynamic, Sign Here, Standard Business), with appearance streams; replies, status, checkmarks, locking, move/resize/restyle/delete; properties dialog; panel filter and sort; hide all; summaries (comments only); XFDF/FDF import and export (partial imports preserve existing reply and review-status links); flatten; Fill & Sign with adjustable text/date size; agent tools.<br>Done since: stamps placed on a rotated page read upright (#1398); polygons, connected lines, clouds, callouts, inserted text, colour and checkmark filters; image signature pointer previews, selection handles and live image movement/resizing with proportional corners and independent edge handles. Missing: custom stamps, replace-text proposals, summary layouts with the page |
 | M5 | Comments (all annotation types, XFDF) | 120–200 | 88% | 12–25 | Done: notes, highlight/underline/strikeout/squiggly, text boxes, ink, lines, arrows, rectangles, ovals, stamps (dynamic, Sign Here, Standard Business), with appearance streams; replies, status, checkmarks, locking, move/resize/restyle/delete; properties dialog; panel filter and sort; hide all; summaries (comments only); XFDF/FDF import and export (partial imports preserve existing reply and review-status links); flatten; Fill & Sign with adjustable text/date size; agent tools.<br>Done since: polygons, connected lines, clouds, callouts, inserted text, colour and checkmark filters; image signature pointer previews, selection handles and live image movement/resizing with proportional corners and independent edge handles. A refused restyle or resize of a text box another program drew leaves that comment unchanged (#1327). Make Current Properties Default on an arrow updates arrows, not plain lines (#1302). Flattening keeps a visible comment it cannot draw (#1317). Missing: custom stamps, replace-text proposals, summary layouts with the page |
-| M6 | Forms + JavaScript | 160–320 | 50% | 40–75 | Done: filling all field types with regenerated appearances; Prepare a form (every field type, multi-select/shared properties, move/resize/delete, Field Properties General/Appearance/Position/Options/Format/Validate/Calculate); Acrobat's AF format/keystroke/validate/calculate functions and simplified field notation run natively in Acrobat's event order; tab order; push-button actions; flatten; agent tools. Form data exchange (FDF, XFDF, XML, CSV, text) done.<br>Done since: JavaScript engine (boa, sandboxed) running custom keystroke/validate/calculate/format and button scripts, document JavaScripts, console. Missing: Actions tab, wider object model (annotations, layers, dialogs), XFA |
+| M6 | Forms + JavaScript | 160–320 | 50% | 40–75 | Done: filling all field types with regenerated appearances; Prepare a form (every field type, multi-select/shared properties, move/resize/delete, Field Properties General/Appearance/Position/Options/Format/Validate/Calculate); Acrobat's AF format/keystroke/validate/calculate functions and simplified field notation run natively in Acrobat's event order; tab order; push-button actions; flatten; agent tools. Form data exchange (FDF, XFDF, XML, CSV, text) done; XFDF values retain text across XML comments and processing instructions.<br>Done since: JavaScript engine (boa, sandboxed) running custom keystroke/validate/calculate/format and button scripts, document JavaScripts, console. Missing: Actions tab, wider object model (annotations, layers, dialogs), XFA<br>Done since: Multi-select choice fields write ascending `/I` option indices while preserving `/V` selection order; synthetic forms/engine regressions cover reverse selection and save/reopen. CSV export preserves carriage returns in names and values. |
 | M7 | Content editing (text, images, header/footer, watermark) | 250–500 | 20% | 100–180 | Done: header & footer, watermarks, backgrounds, Bates; added text and images that stay editable (move, resize, format, rotate, flip, crop, replace); links (Link tool, Link Properties, create from URLs, remove all). Done since: Edit text preserves Arabic/Hebrew `/ActualText` typing order, with font-independent regressions; single-glyph RTL ligature spans (including lam-alef) join their surrounding word. Done since (#1116): editable text regions grouped across compatible words and subset fonts, one rich-text editor over a background with the source text removed, embedded sfnt faces reused as editor faces, and visible (clipped) bounds for cropped-image selection and resize. Exclusive crops now resize across nested states and content streams, with shared clips fixed.<br>Done since: #594 ordinary paragraph drags preserve overlapping source text; UI/engine regressions, native save/reopen, independent-reader checks and full CI passed in the Linux test environment. #1200 candidate: local GoToR links open in desktop tabs and through root-confined automation; appearance-only edits preserve existing actions. Named destinations remain unapplied and `/NewWindow` is a tab hint. Missing: editing existing text and images in place (the longest pole), image/PDF watermarks |
 | M7 | Content editing (text, images, header/footer, watermark) | 250–500 | 20% | 100–180 | Done: header & footer, watermarks, backgrounds, Bates; added text and images that stay editable (move, resize, format, rotate, flip, crop, replace); links (Link tool, Link Properties, create from URLs, remove all). Done since: Edit text preserves Arabic/Hebrew `/ActualText` typing order, with font-independent regressions. Done since (#1116): editable text regions grouped across compatible words and subset fonts, one rich-text editor over a background with the source text removed, embedded sfnt faces reused as editor faces, and visible (clipped) bounds for cropped-image selection and resize. Exclusive crops now resize across nested states and content streams, with shared clips fixed.<br>Done since: #594 ordinary paragraph drags preserve overlapping source text; UI/engine regressions, native save/reopen, independent-reader checks and full CI passed in the Linux test environment. #1200 candidate: local GoToR links open in desktop tabs and through root-confined automation; appearance-only edits preserve existing actions. Named destinations remain unapplied and `/NewWindow` is a tab hint. #1316: replacing a line or paragraph keeps a neighbouring line whose glyph box overlaps when the baselines differ; a second copy on the same baseline is still replaced. Missing: editing existing text and images in place (the longest pole), image/PDF watermarks |
 | M7 | Content editing (text, images, header/footer, watermark) | 250–500 | 20% | 100–180 | Done: header & footer, watermarks, backgrounds, Bates; added text and images that stay editable (move, resize, format, rotate, flip, crop, replace); links (Link tool, Link Properties, create from URLs, remove all). Missing: editing existing text and images in place (the longest pole), watermark print/screen visibility and repeat |
-| M6 | Forms + JavaScript | 160–320 | 50% | 40–75 | Done: filling all field types with regenerated appearances; Prepare a form (every field type, multi-select/shared properties, move/resize/delete, Field Properties General/Appearance/Position/Options/Format/Validate/Calculate); Acrobat's AF format/keystroke/validate/calculate functions and simplified field notation run natively in Acrobat's event order; tab order; push-button actions; flatten; agent tools. Form data exchange (FDF, XFDF, XML, CSV, text) done.<br>Done since: JavaScript engine (boa, sandboxed) running custom keystroke/validate/calculate/format and button scripts, document JavaScripts, console. Missing: Actions tab, wider object model (annotations, layers, dialogs), XFA<br>Done since: Existing simple field-font encodings and Differences are respected when generating appearances; an unencodable value uses a separate Helvetica appearance font without changing the source font. Synthetic reopen regressions cover punctuation, subset fallback and multiline text. Exact font metrics/layout and broader Unicode fallback remain incomplete. |
-| M6 | Forms + JavaScript | 160–320 | 50% | 40–75 | Done: filling all field types with regenerated appearances; Prepare a form (every field type, multi-select/shared properties, move/resize/delete, Field Properties General/Appearance/Position/Options/Format/Validate/Calculate); Acrobat's AF format/keystroke/validate/calculate functions and simplified field notation run natively in Acrobat's event order; tab order; push-button actions; flatten; agent tools. Form data exchange (FDF, XFDF, XML, CSV, text) done.<br>Done since: JavaScript engine (boa, sandboxed) running custom keystroke/validate/calculate/format and button scripts, document JavaScripts, console. Missing: Actions tab, wider object model (annotations, layers, dialogs), XFA<br>Done since: Tab and Shift-Tab wrapping to the same field or another widget of that field refresh the newly opened editor from the accepted value before Save. Synthetic UI regressions cover both directions, same-frame Save, validation refusal and undo/redo. |
+| M6 | Forms + JavaScript | 160–320 | 50% | 40–75 | Done: filling all field types with regenerated appearances; Prepare a form (every field type, multi-select/shared properties, move/resize/delete, Field Properties General/Appearance/Position/Options/Format/Validate/Calculate); Acrobat's AF format/keystroke/validate/calculate functions and simplified field notation run natively in Acrobat's event order; tab order; push-button actions; flatten; agent tools. Form data exchange (FDF, XFDF, XML, CSV, text) done; XFDF values retain text across XML comments and processing instructions.<br>Done since: JavaScript engine (boa, sandboxed) running custom keystroke/validate/calculate/format and button scripts, document JavaScripts, console. Missing: Actions tab, wider object model (annotations, layers, dialogs), XFA<br>Done since: Existing simple field-font encodings and Differences are respected when generating appearances; an unencodable value uses a separate Helvetica appearance font without changing the source font. Synthetic reopen regressions cover punctuation, subset fallback and multiline text. Exact font metrics/layout and broader Unicode fallback remain incomplete. |
+| M6 | Forms + JavaScript | 160–320 | 50% | 40–75 | Done: filling all field types with regenerated appearances; Prepare a form (every field type, multi-select/shared properties, move/resize/delete, Field Properties General/Appearance/Position/Options/Format/Validate/Calculate); Acrobat's AF format/keystroke/validate/calculate functions and simplified field notation run natively in Acrobat's event order; tab order; push-button actions; flatten; agent tools. Form data exchange (FDF, XFDF, XML, CSV, text) done; XFDF values retain text across XML comments and processing instructions.<br>Done since: JavaScript engine (boa, sandboxed) running custom keystroke/validate/calculate/format and button scripts, document JavaScripts, console. Missing: Actions tab, wider object model (annotations, layers, dialogs), XFA<br>Done since: Tab and Shift-Tab wrapping to the same field or another widget of that field refresh the newly opened editor from the accepted value before Save. Synthetic UI regressions cover both directions, same-frame Save, validation refusal and undo/redo. |
 | M7 | Content editing (text, images, header/footer, watermark) | 250–500 | 20% | 100–180 | Done: header & footer, watermarks, backgrounds, Bates; added text and images that stay editable (move, resize, format, rotate, flip, crop, replace); links (Link tool, Link Properties, create from URLs, remove all). Missing: editing existing text and images in place (the longest pole), image/PDF watermarks |
 | M8 | Security + redaction | 100–180 | 68% | 15–30 | Done: opening protected documents, permissions, Protect Using Password, Remove security; redaction (mark text/areas/pages, Search & Redact with patterns, apply removing glyphs, image pixels, vectors, XObject content, annotations and fields, verification, full rewrite on save); Remove hidden information and Sanitize.<br>Done since: redaction codes (U.S. FOIA and Privacy Act sets as overlay text, in Redaction properties and `redact_mark`). Redaction cleans indirect and form structure references, preserving surviving form tags. Vertical-writing text is still refused, and the error no longer claims the text was under the mark (#1340). Missing: certificate security, custom redaction code sets and pattern locales, DCT re-encoding |
-| M8 | Security + redaction | 100–180 | 68% | 15–30 | Done: opening protected documents, permissions, Protect Using Password, Remove security; redaction (mark text/areas/pages, Search & Redact with patterns, apply removing glyphs, image pixels, vectors, XObject content, annotations and fields, verification, full rewrite on save); Remove hidden information and Sanitize.<br>Done since: redaction codes (U.S. FOIA and Privacy Act sets as overlay text, in Redaction properties and `redact_mark`). Redaction cleans indirect and form structure references, preserving surviving form tags. Redaction retires inherited resource dictionaries, so a parent `/Pages` can't keep a removed XObject reachable; unredacted pages are left untouched. Missing: certificate security, custom redaction code sets and pattern locales, DCT re-encoding |
+| M8 | Security + redaction | 100–180 | 68% | 15–30 | Done: opening protected documents, permissions, Protect Using Password, Remove security; redaction (mark text/areas/pages, Search & Redact with patterns, apply removing glyphs, image pixels, vectors, XObject content, annotations and fields, verification, full rewrite on save); Remove hidden information and Sanitize.<br>Done since: redaction codes (U.S. FOIA and Privacy Act sets as overlay text, in Redaction properties and `redact_mark`). Redaction cleans indirect and form structure references, preserving surviving form tags. Redaction retires inherited resource dictionaries, so a parent `/Pages` can't keep a removed XObject reachable; unredacted pages are left untouched. Image redaction removes alternate images and unsupported masks only on affected images. Missing: certificate security, custom redaction code sets and pattern locales, DCT re-encoding |
 | M9 | Signatures (PAdES, validation) | 160–280 | 60% | 40–70 | Done: new `sign` crate (DER, X.509, CMS, PKCS #12 on RustCrypto; aws-lc-rs for RSA private keys); PAdES B-B signing (visible, invisible, existing fields, certification with DocMDP); validation with trust store and changes-after-signing classification; self-signed digital IDs; Signatures panel, message bar, sign dialogs; agent tools. Checked with pdfsig and OpenSSL.<br>Done since: macOS Keychain and Windows Current User Personal store signing (software-backed CNG keys), certificate viewer, signed documents protected from rewrites. Missing: timestamps (B-T), LTV (DSS, OCSP, CRL), FieldMDP, smart cards, PKCS #11 |
 | M10 | OCR, create, export, print | 200–350 | 33% | 120–215 | Done: create from blank/text/PNG/JPEG/TIFF (multi-page)/GIF/BMP; export PNG/JPEG/TIFF and text; Print (Acrobat's sizing, n-up, booklet, poster, comments & forms, preview, the CUPS and Windows spoolers, print-ready PDF).<br>Done since: embedded/72/custom DPI choices for image imports; export all images; OCR (searchable image for pages, ranges and multiple files); single-sided cut-and-stack imposition with cut marks, through Print and doc_print; architectural/ANSI/large ISO sheet presets, Match page at 100% and PDF-scale preview (#599 follow-up); Create PDF from multiple files (PDFs, images and text, edited as pages in the grid); OCR can also read pictures on pages that have text, without adding that text twice (#1028). Done since: Word invoice export uses borderless inferred tables, floating positioned text/artwork only where text overlaps an image or is rotated, and per-page sizes, covered by synthetic invoice automation regressions (#773); printing on the web through the browser's print dialog, sheets drawn by PdfCraft (gap 4). Missing: OCR languages beyond Latin, editable-text OCR output, full Office layout fidelity/import |
 | M11 | Optimize, preflight, PDF/A/X/UA, print production | 200–350 | 18% | 80–140 | Done: new `optimize` crate: Reduce File Size and the PDF Optimizer (images measured where drawn, bicubic downsampling, JPEG/ZIP recompression only when smaller, discard objects and user data, Flate clean-up, resource merging, object streams). Missing: fonts and transparency panels, space audit, preflight, PDF/A/X/UA |
-| M12 | Accessibility, compare, measure, search, XFA | 200–380 | 30% | 90–160 | Done: new `a11y` crate with the Accessibility Checker (all 32 rules, report, Fix/Skip/Explain, options dialog and results panel, agent tools). Locatable figure, annotation and form findings highlight their page bounds.<br>Done since: 2D distance, perimeter and area measurements with persistent viewport calibration, snapping, live information and CSV export; a bounded, text-only auto-tag proposal tool for one page. Missing: writing proposed tags and parent tree, field autotag, visual Tags/Order/Content panels, Reading Order tool, compare, geospatial/3D measurement, search index, XFA |
+| M12 | Accessibility, compare, measure, search, XFA | 200–380 | 30% | 90–160 | Done: new `a11y` crate with the Accessibility Checker (all 32 rules, report, Fix/Skip/Explain, options dialog and results panel, agent tools). Locatable figure, annotation and form findings highlight their page bounds.<br>Done since: 2D distance, perimeter and area measurements with persistent viewport calibration, snapping, live information and CSV export; a bounded, text-only auto-tag proposal tool for one page. Marking a figure decorative rewrites only that stream (#1324). An XFA radio item whose value contains a space is written back unchanged (#1319). Missing: writing proposed tags and parent tree, field autotag, visual Tags/Order/Content panels, Reading Order tool, compare, geospatial/3D measurement, search index, XFA |
 | M13 | Automation (MCP, Action Wizard, CLI) + AI providers | 60–120 | 45% | 25–45 | Done: MCP resources (document info, text, page images); headless tool table (123 tools incl. signing, optimizing, initial view, links, stamps, data exchange, comment review, forms authoring and scripts, redaction, sanitize, print, add content), opt-in MCP server over stdio, CLI `run`/`tools` (closed stdout pipes exit cleanly), UI control channel with drag. Missing: Action Wizard, AI providers<br>Done since: CLI run and MCP reject missing, empty, repeated and option-valued --root arguments before any tool/script execution or MCP initialization. A single-hyphen directory name remains valid; synthetic CLI regressions preserve a would-be overwritten file. `text_find` also caps the per-page match ranges it materializes at the remaining result limit plus one continuation match. CLI robustness scans visit each directory once through overlapping roots and symlink aliases. |
 | M12 | Accessibility, compare, measure, search, XFA | 200–380 | 30% | 90–160 | Done: new `a11y` crate with the Accessibility Checker (all 32 rules, report, Fix/Skip/Explain, options dialog and results panel, agent tools). Locatable figure, annotation and form findings highlight their page bounds.<br>Done since: 2D distance, perimeter and area measurements with persistent viewport calibration, snapping, live information and CSV export; a bounded text-only auto-tag proposal tool; text-only Apply writes marked content, paragraph tags and a parent tree, then opens the Tags panel for review. Missing: mixed-content and field autotag, heading/list/table/figure classification, Order/Content panels, Reading Order tool, compare, geospatial/3D measurement, search index, XFA |
 | M13 | Automation (MCP, Action Wizard, CLI) + AI providers | 60–120 | 45% | 25–45 | Done: MCP resources (document info, text, page images); headless tool table (123 tools incl. signing, optimizing, initial view, links, stamps, data exchange, comment review, forms authoring and scripts, redaction, sanitize, print, add content), opt-in MCP server over stdio, CLI `run`/`tools` (closed stdout pipes exit cleanly), UI control channel with drag. Missing: Action Wizard, AI providers<br>Done since: CLI run and MCP reject missing, empty, repeated and option-valued --root arguments before any tool/script execution or MCP initialization. A single-hyphen directory name remains valid; synthetic CLI regressions preserve a would-be overwritten file. `text_find` also caps the per-page match ranges it materializes at the remaining result limit plus one continuation match. |
-| M14 | 1.0 polish: performance, localization, installers | 120–250 | 15% | 80–150 | Done: PhotoCraft's translation system (`i18n/`: TSV catalogs, `tl!`, command-id and plural entries, system-language detection, strict catalog tests); every dialog, panel and notice goes through `tl!`. Catalogs of ≈ 2,000–2,140 entries for Japanese, Simplified and Traditional Chinese, Russian, Bulgarian, German, Spanish, French, Telugu, Hungarian, Ukrainian, Italian, Brazilian Portuguese and Arabic (logical-order catalog put into display order; layout not yet mirrored); Czech covers the menus. Signed and notarized macOS builds, signed Windows installers (x64, x86, ARM64), AppImage, deb, rpm, Flatpak and FreeBSD packages. #307 (bounded large-PDF memory): shared resource indexes and parser metadata, lazy inspection, bounded caches; a 9,156-page file inspects in ≈ 1.8 s at ≈ 500 MiB instead of exceeding 10 GiB. Edits let go of the previous working file before writing the next (a 1 GiB file peaks at two copies while editing, not three; gap 13). Shortcut display uses localized modifier/key names across menus, toolbar, palette, Help and tooltips (#496). Lithuanian adds a 2,578-entry catalog and date names, reviewed by a native-speaking contributor. Validated candidate (macOS raster probe; Windows runtime unverified): the Windows policy changes only embedded JetBrains Mono; horizontal alpha-edge energy per ink improves 2.78%, 3.87% and 1.59% at 100%, 125% and 150%, and is down 0.79% at 200%. Inter is pixel-identical; layout hashes, glyph coverage and the 8 MiB atlas are unchanged. Timing and RSS ranges overlap, with no improvement claimed. Estimates unchanged. Missing: a right-to-left layout, a Chinese UI face in releases, Hindi/Indonesian/Korean/Vietnamese, file-backed input and global memory budgets, performance budgets, keyboard-only operation |
+| M14 | 1.0 polish: performance, localization, installers | 120–250 | 15% | 80–150 | Done: PhotoCraft's translation system (`i18n/`: TSV catalogs, `tl!`, command-id and plural entries, system-language detection, strict catalog tests); every dialog, panel and notice goes through `tl!`. Catalogs of ≈ 2,000–2,140 entries for Japanese, Simplified and Traditional Chinese, Russian, Bulgarian, German, Spanish, French, Telugu, Hungarian, Ukrainian, Brazilian Portuguese and Arabic (logical-order catalog put into display order; layout not yet mirrored); Czech covers the menus. Italian has 2,528 entries: every key of the other catalogs that the code looks up. Signed and notarized macOS builds, signed Windows installers (x64, x86, ARM64), AppImage, deb, rpm, Flatpak and FreeBSD packages. #307 (bounded large-PDF memory): shared resource indexes and parser metadata, lazy inspection, bounded caches; a 9,156-page file inspects in ≈ 1.8 s at ≈ 500 MiB instead of exceeding 10 GiB. Edits let go of the previous working file before writing the next (a 1 GiB file peaks at two copies while editing, not three; gap 13). Shortcut display uses localized modifier/key names across menus, toolbar, palette, Help and tooltips (#496). Lithuanian adds a 2,578-entry catalog and date names, reviewed by a native-speaking contributor. Validated candidate (macOS raster probe; Windows runtime unverified): the Windows policy changes only embedded JetBrains Mono; horizontal alpha-edge energy per ink improves 2.78%, 3.87% and 1.59% at 100%, 125% and 150%, and is down 0.79% at 200%. Inter is pixel-identical; layout hashes, glyph coverage and the 8 MiB atlas are unchanged. Timing and RSS ranges overlap, with no improvement claimed. Estimates unchanged. Missing: a right-to-left layout, a Chinese UI face in releases, Hindi/Indonesian/Korean/Vietnamese, file-backed input and global memory budgets, performance budgets, keyboard-only operation Linux/Unix UI fallback fonts also use Fontconfig directories, including Nix store paths, with bounded discovery and the existing candidate allowlist; relative includes and digit-prefixed config filtering have isolated regressions. |
+| M14 | 1.0 polish: performance, localization, installers | 120–250 | 15% | 80–150 | Done: PhotoCraft's translation system (`i18n/`: TSV catalogs, `tl!`, command-id and plural entries, system-language detection, strict catalog tests); every dialog, panel and notice goes through `tl!`. Catalogs of ≈ 2,000–2,140 entries for Japanese, Simplified and Traditional Chinese, Russian, Bulgarian, German, Spanish, French, Telugu, Hungarian, Ukrainian, Brazilian Portuguese and Arabic (logical-order catalog put into display order; layout not yet mirrored); Czech covers the menus. Italian has 2,528 entries: every key of the other catalogs that the code looks up. Signed and notarized macOS builds, signed Windows installers (x64, x86, ARM64), AppImage, deb, rpm, Flatpak and FreeBSD packages. #307 (bounded large-PDF memory): shared resource indexes and parser metadata, lazy inspection, bounded caches; a 9,156-page file inspects in ≈ 1.8 s at ≈ 500 MiB instead of exceeding 10 GiB. Edits let go of the previous working file before writing the next (a 1 GiB file peaks at two copies while editing, not three; gap 13). Shortcut display uses localized modifier/key names across menus, toolbar, palette, Help and tooltips (#496). Lithuanian adds a 2,578-entry catalog and date names, reviewed by a native-speaking contributor. Validated candidate (macOS raster probe; Windows runtime unverified): the Windows policy changes only embedded JetBrains Mono; horizontal alpha-edge energy per ink improves 2.78%, 3.87% and 1.59% at 100%, 125% and 150%, and is down 0.79% at 200%. Inter is pixel-identical; layout hashes, glyph coverage and the 8 MiB atlas are unchanged. Timing and RSS ranges overlap, with no improvement claimed. Estimates unchanged. Missing: a right-to-left layout, a Chinese UI face in releases, Hindi/Indonesian/Korean/Vietnamese, file-backed input and global memory budgets, performance budgets, keyboard-only operation XDG desktops use the configuration base for preferences with non-overwriting migration and original-data preservation (#1395). |
 | M13 | Automation (MCP, Action Wizard, CLI) + AI providers | 60–120 | 45% | 25–45 | Done: MCP resources (document info, text, page images); headless tool table (123 tools incl. signing, optimizing, initial view, links, stamps, data exchange, comment review, forms authoring and scripts, redaction, sanitize, print, add content), opt-in MCP server over stdio, CLI `run`/`tools` (closed stdout pipes exit cleanly), UI control channel with drag. Missing: Action Wizard, AI providers |
-| M14 | 1.0 polish: performance, localization, installers | 120–250 | 15% | 80–150 | Done: PhotoCraft's translation system (`i18n/`: TSV catalogs, `tl!`, command-id and plural entries, system-language detection, strict catalog tests); every dialog, panel and notice goes through `tl!`. Catalogs of ≈ 2,000–2,140 entries for Japanese, Simplified and Traditional Chinese, Russian, Bulgarian, German, Spanish, French, Telugu, Hungarian, Ukrainian, Italian, Brazilian Portuguese and Arabic (logical-order catalog put into display order; layout not yet mirrored); Czech covers the menus. Signed and notarized macOS builds, signed Windows installers (x64, x86, ARM64), AppImage, deb, rpm, Flatpak and FreeBSD packages. #307 (bounded large-PDF memory): shared resource indexes and parser metadata, lazy inspection, bounded caches; a 9,156-page file inspects in ≈ 1.8 s at ≈ 500 MiB instead of exceeding 10 GiB. Edits let go of the previous working file before writing the next (a 1 GiB file peaks at two copies while editing, not three; gap 13). Shortcut display uses localized modifier/key names across menus, toolbar, palette, Help and tooltips (#496). Traditional Chinese accessibility statuses, rule semantics and Taiwan form/table terms have catalog regressions. Missing: a right-to-left layout, a Chinese UI face in releases, Hindi/Indonesian/Korean/Vietnamese, file-backed input and global memory budgets, performance budgets, keyboard-only operation |
+| M14 | 1.0 polish: performance, localization, installers | 120–250 | 15% | 80–150 | Done: PhotoCraft's translation system (`i18n/`: TSV catalogs, `tl!`, command-id and plural entries, system-language detection, strict catalog tests); every dialog, panel and notice goes through `tl!`. Catalogs of ≈ 2,000–2,140 entries for Japanese, Simplified and Traditional Chinese, Russian, Bulgarian, German, Spanish, French, Telugu, Hungarian, Ukrainian, Brazilian Portuguese and Arabic (logical-order catalog put into display order; layout not yet mirrored); Czech covers the menus. Italian has 2,528 entries: every key of the other catalogs that the code looks up. Signed and notarized macOS builds, signed Windows installers (x64, x86, ARM64), AppImage, deb, rpm, Flatpak and FreeBSD packages. #307 (bounded large-PDF memory): shared resource indexes and parser metadata, lazy inspection, bounded caches; a 9,156-page file inspects in ≈ 1.8 s at ≈ 500 MiB instead of exceeding 10 GiB. Edits let go of the previous working file before writing the next (a 1 GiB file peaks at two copies while editing, not three; gap 13). Shortcut display uses localized modifier/key names across menus, toolbar, palette, Help and tooltips (#496). Traditional Chinese accessibility statuses, rule semantics and Taiwan form/table terms have catalog regressions. Missing: a right-to-left layout, a Chinese UI face in releases, Hindi/Indonesian/Korean/Vietnamese, file-backed input and global memory budgets, performance budgets, keyboard-only operation |
 | | **Total** | **2,085–3,840** | **≈ 49% ready** | **≈ 770–1,400** | Area view of the same work: [target-app-parity.md](target-app-parity.md#by-feature-area) |
 
 ## Upcoming milestones, ranked
@@ -164,6 +181,19 @@ M2 (renderer), M7 (content editing), M10 (OCR and Office), M11 (Preflight and st
 | Date | Change | Summary |
 |---|---|---|
 | 2026-10-14 | minor | M1: raw-deflate fallback preserves decoding-limit errors in strict and tolerant decoding; synthetic filter and COS stream regressions. Estimates unchanged. |
+| 2026-10-12 | minor | M6: valid AcroForm XML element names with original PDF field names preserved; saved-PDF collision and Unicode regressions. Estimates unchanged. |
+| 2026-10-12 | minor | M6: preserve carriage returns in exported CSV field names and values; saved-PDF round-trip coverage. Estimates unchanged. |
+| 2026-10-12 | minor | M7 local candidate: text drafts grow and save their width; single visual rows grow across style boundaries; both text tools retype added items and Add Text edits source text. Added-item textless previews are read-only and covered by UI/tool regressions. Estimates unchanged. |
+| 2026-10-12 | minor | M14/#1395: XDG configuration preferences, safe migration and fallback; logs/recovery retain data locations, portable/non-XDG unchanged. Estimates unchanged. |
+| 2026-10-12 | minor | M6: XFDF field import and data extraction preserve all text around XML comments and processing instructions; synthetic save/reopen regressions. Estimates unchanged. |
+| 2026-10-12 | minor | M2: preserve whitespace-bounded EI bytes in known unfiltered inline images; row padding, masks and aliases tested, with independent saved-PDF pixel checks. Estimates unchanged. |
+| 2026-10-12 | minor | M1 #1338: a full rewrite keeps unknown trailer entries and objects reachable only from them. Estimates unchanged. |
+| 2026-10-12 | minor | M7 #1443: adding a word to a multi-line paragraph keeps its line breaks. Composite subset fonts whose `/W` leaves out default-width glyphs (Chrome, Skia) no longer measure those letters as missing, and paragraphs drawn turned on the page group into rows along their own baselines. Estimates unchanged. |
+| 2026-10-14 | minor | M14: Italian catalog completed (2,528 entries) and dropped from the ≈ 2,000–2,140-entry group; estimates unchanged |
+| 2026-10-12 | minor | M4 #1310 #1311 #1312: undo back to the opened file is clean, Revert returns to the last saved file, and the next save keeps that revision. Estimates unchanged. |
+| 2026-10-14 | minor | M5: reconciled PR #1457 with upstream main, preserving comment submission shortcuts and upstream roadmap progress. Estimates unchanged. |
+| 2026-10-13 | minor | M2/M6: images with at most 16 bits of samples a pixel (8-bit Separation/DeviceN, 1-4-bit gray or indexed) convert once per pixel value (hayro-interpret patch 28), so spot-colour form backgrounds draw in milliseconds instead of seconds; widgets without `/P` are placed in one pass; the Fields panel no longer searches the form per row and draws only the rows in view. Estimates unchanged. |
+| 2026-10-13 | minor | M3: native-open admission preserves modal/picker ownership; regressions cover queued replies and one-shot picker wakes. Estimates unchanged |
 | 2026-10-12 | minor | M13: CLI check directory identity, with overlap and symlink regressions; estimates unchanged |
 | 2026-10-12 | minor | M4: shared Type 3 glyph resources survive extraction, with save/reopen and independent raster regressions; estimates unchanged |
 | 2026-10-12 | minor | M2: packed TIFF-predictor RGB row boundaries, with decoding and page-render regressions; estimates unchanged |
@@ -174,14 +204,18 @@ M2 (renderer), M7 (content editing), M10 (OCR and Office), M11 (Preflight and st
 | 2026-10-12 | minor | M7 #1316: replacing a line or paragraph keeps a neighbouring line whose glyph box overlaps; same-baseline copies are still replaced. Estimates unchanged. |
 | 2026-10-12 | minor | M1 #1339: unchanged incremental saves of a classic cross-reference table write a zero-length subsection. Estimates unchanged. |
 | 2026-10-12 | minor | M12: bounded text-only auto-tag preview through the engine and automation; actual PDF structure writing and visual review remain open. Estimates unchanged. |
+| 2026-10-12 | minor | Gap 6: XFA radio values with spaces stay in the datasets (#1319); Replace Pages keeps a gap in a split selection (#1305); decorative figures rewrite only their own content stream (#1324). Estimates unchanged. |
 | 2026-10-12 | minor | M7: keep added Arabic copy/search in typing order with per-line ActualText; preserve that order in the editor and keep visual runs separate. Font-independent regressions and tool save/reopen coverage; font fallback and bidi typing remain partial. Estimates unchanged. |
 | 2026-10-12 | minor | M3: case-insensitive Find matches normal, final and capital Greek sigma; exact search, word boundaries, glyph ranges and match limits have regression coverage. The tab-menu test uses Finder on macOS. Estimates unchanged. |
 | 2026-10-12 | minor | M14: Windows low-DPI JetBrains Mono hinting candidate; raster and layout evidence recorded without a Windows runtime claim. Estimates unchanged. |
 | 2026-10-12 | minor | M7/#1200 candidate: bounded local GoToR opening, root-confined automation, and action-preserving appearance edits; named destinations and window behavior remain partial; estimates unchanged. |
+| 2026-10-12 | patch | M1 #1337: exhausted xref entries are repaired; allocation safely handles exhausted /Size and high edits; classic-table/stream regressions and opening/allocation controls. Estimates unchanged. |
 | 2026-10-12 | minor | Exclusive image crops resize with their pixels across nested states, intervening operators and content streams; shared clips remain fixed. Synthetic engine/tool regressions and private image save/reopen checks; estimates unchanged. |
 | 2026-10-11 | minor | M4: editable Organize page-range selection (#1092), synchronized with thumbnails and available through UI control. Estimates unchanged. |
+| 2026-10-11 | minor | M6 #1208: expose dropdown and list-box alignment; preserve existing values and cover cancel, undo/redo, save/reopen. Estimates unchanged. |
 | 2026-10-11 | minor | M10: Word invoice export regressions (#773); estimates unchanged. |
 | 2026-10-12 | minor | M2: short same-line redraws split before placement; estimates unchanged. |
+| 2026-10-12 | minor | M5: Ctrl+Enter posts highlight comment text and replies; Shift+Enter adds newlines. Estimates unchanged. |
 | 2026-10-11 | minor | M3: Windows' Animation effects setting is followed: wheel scrolling and zooming without easing, no other animations. Preferences ▸ Animation effects (Use system setting, On, Off) overrides it. macOS, Linux and the browser aren't asked yet. Estimates unchanged. |
 | 2026-10-11 | minor | M10: printing on the web through the browser's print dialog (gap 4 closed); rank 1 drops web printing, 65–120 → 50–90 h |
 | 2026-10-11 | minor | M13/#971: cap materialized text-search matches to the requested limit plus one continuation match. |
@@ -199,4 +233,5 @@ M2 (renderer), M7 (content editing), M10 (OCR and Office), M11 (Preflight and st
 | 2026-10-10 | minor | M3 records the System appearance completion after #881; estimates unchanged |
 | 2026-10-10 | minor | Re-judged convert and share with the cross-app gate rule (only a workflow that can't be completed at all blocks): partial, not blocking → stage alpha |
 | 2026-10-10 | minor | Added the alpha gate (six core workflows; convert and share fails → pre-alpha, 40–70 h to alpha) and rank 0 in the upcoming milestones |
+| 2026-10-12 | minor | M8: image redaction removes alternate images and unsupported masks only on affected images. Estimates unchanged. |
 | 2026-10-10 | major | Created from ROADMAP.md §Milestones, §Critical path, §Risks and §Where we're lacking. Merged the duplicated M1, M2, M3 and M14 rows, re-measured Done and Remaining, added Current focus and the ranked upcoming milestones |
diff --git a/docs/target-app-parity.md b/docs/target-app-parity.md
index 85d6f5a8b..e7698baee 100644
--- a/docs/target-app-parity.md
+++ b/docs/target-app-parity.md
@@ -1,6 +1,6 @@
 # PdfCraft parity with Adobe Acrobat Pro
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-12 · **Change:** web printing shipped, gap 4 closed, scores not re-judged; exclusive image-crop resize follow-up; minor (document-font subset completion, source styles and curved/shared image clips in the contributor fork; closed issues synced, scores not re-judged: #774, #756, #740, #759, #799–#821, #825, #844; earlier: readiness table with hours per audience; full number restated as the standard's additive weighted sum, 47% → 49%; earlier: second look: cross-cutting double count removed, mainstream-practitioner number added, core-workflow gate applied → alpha) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-13 · **Change:** minor (localization ≈59% → ≈68%; weighted readiness 49.25 → 49.7 ≈ 50%) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 
 The authoritative assessment of how close PdfCraft is to Acrobat Pro. [ROADMAP.md](../ROADMAP.md)
 summarizes it; [gaps.md](gaps.md) lists every shortfall one by one; the deep-dive checklists are
@@ -21,7 +21,7 @@ Approved Trust List) are out of scope: 23 such features are tracked as `na` in
 | Feature breadth, unweighted | 56.9% (423 shipped + 74 partial of 808) | measured (`cargo xtask parity` arithmetic) |
 | Must-have (P0) features | 94.2% (226 + 23 partial of 252) | measured |
 | Feature breadth, mainstream practitioner | ≈ 70% tier-weighted (63.2% unweighted: 292 + 44 partial of 497; P0 95.3%) | measured ([split below](#mainstream-practitioner-vs-full-acrobat-pro)) |
-| **Ready for real work**, full Acrobat Pro | **≈ 49%** (range 45–53%) | estimated (weighted sum over dimensions, [below](#by-dimension)) |
+| **Ready for real work**, full Acrobat Pro | **≈ 50%** (range 45–53%) | estimated (weighted sum over dimensions, [below](#by-dimension)) |
 | **Ready for real work**, mainstream practitioner | **≈ 55%** (range 50–60%) | estimated ([split below](#mainstream-practitioner-vs-full-acrobat-pro)) |
 | **Ready for real work**, essentials user | **≈ 66%** (range 60–70%) | estimated ([below](#essentials-user)) |
 | **Stage** | **alpha** (passes the core-workflow gate) | see [Stage](#stage) |
@@ -32,7 +32,7 @@ Approved Trust List) are out of scope: 23 such features are tracked as `na` in
 
 | Audience | Ready | Opus 5.5 agent-hours to ≈ 95% | Work that dominates |
 |---|---|---|---|
-| Full Acrobat Pro (ready for real work) | ≈ 49% | ≈ 780–1,400 h (≈ 300–550 h wall clock with 3–5 agents; 60–70% parallelizes) | Own renderer and fidelity harness, editing existing content, OCR and Office conversion, Preflight and PDF/A/X/UA, accessibility tagging, signatures for institutions |
+| Full Acrobat Pro (ready for real work) | ≈ 50% | ≈ 780–1,400 h (≈ 300–550 h wall clock with 3–5 agents; 60–70% parallelizes) | Own renderer and fidelity harness, editing existing content, OCR and Office conversion, Preflight and PDF/A/X/UA, accessibility tagging, signatures for institutions |
 | Mainstream practitioner | ≈ 55% | ≈ 500–900 h (≈ 200–400 h wall clock; ≈ 60% parallelizes) | Rendering fidelity, editing existing text (CJK, RTL, subsets), conversion (Word layout, Excel, PowerPoint, Office→PDF), OCR languages, the bug backlog |
 | Essentials user | ≈ 66% | ≈ 180–330 h (≈ 90–180 h wall clock; ≈ 50% parallelizes) | Rendering fidelity on everyday files, launch and GPU stability, simple text fixes, Word export layout, Chinese UI glyphs |
 
@@ -86,8 +86,8 @@ The **full ready-for-real-work number is an additive weighted sum over the dimen
 method; weights by what decides whether a professional can switch): features 40%, file formats and
 conversion 12%, UI/UX 10%, PDF specification 8%, stability 8%, performance 6%, localization 5%,
 platforms 5%, hardware 4%, ecosystem 1%, AI 1%:
-0.40 × 49 + 0.12 × 40 + 0.10 × 55 + 0.08 × 60 + 0.08 × 50 + 0.06 × 40 + 0.05 × 59 + 0.05 × 70 +
-0.04 × 35 + 0.01 × 30 + 0.01 × 0 = 49.25 → **≈ 49%**.
+0.40 × 49 + 0.12 × 40 + 0.10 × 55 + 0.08 × 60 + 0.08 × 50 + 0.06 × 40 + 0.05 × 68 + 0.05 × 70 +
+0.04 × 35 + 0.01 × 30 + 0.01 × 0 = 49.7 → **≈ 50%**.
 
 History: the first version of this file subtracted 9 points from the area figure for cross-cutting
 shortfalls (40%); the second look found that a double count (Windows printing, encrypted-output
@@ -181,13 +181,13 @@ features total and are shown for orientation; the others add to it.
 | File formats and conversion | ≈ 40% | 12% | 120–220 | within features | PDF read/write strong, encrypted output included (#774 fixed); export Word is layout-poor (#773); no Excel/PowerPoint export, no Office/HTML/PostScript import | [file-format-parity.md](file-format-parity.md) |
 | PDF specification and standards | ≈ 60% | 8% | 150–260 | within features | ISO 32000 syntax, encryption, annotations and AcroForm strong; rendering and fonts borrowed from `hayro`; PDF 2.0 extras, linearization, public-key security absent; PDF/A partial, PDF/X/UA none | [pdf-spec-parity.md](pdf-spec-parity.md) |
 | Hardware | ≈ 35% | 4% | 25–50 | additional | Page raster is CPU only (Acrobat has GPU rendering); Windows CNG and macOS Keychain keys sign, no PKCS #11; no scanners; web printing goes through the browser's print dialog as pictures, not vectors | [hardware-parity.md](hardware-parity.md) |
-| Localization | ≈ 59% over the 12 key languages | 5% | 35–60 | additional | 15 catalogs, 13 at 94–100%; Chinese UI shows tofu in releases (#826, #688); Arabic not mirrored; no Hindi, Indonesian, Korean, Vietnamese | [localization-parity.md](localization-parity.md) |
+| Localization | ≈ 68% over the 12 key languages | 5% | 35–60 | additional | 22 catalogs + English (23 interface languages); Chinese UI shows tofu in releases (#826, #688); Arabic not mirrored; no Hindi, Indonesian, Korean | [localization-parity.md](localization-parity.md) |
 | Performance | ≈ 40% | 6% | 25–45 | additional | 500-page smooth scrolling and large-file memory work (#307) done; no performance budgets (`misc.performance-budgets`), no lazy loading of GB files; blurry text at 1080p/1440p (#730) | [gaps.md](gaps.md) |
 | Stability | ≈ 50% | 8% | 45–80 | additional | Never-crash rules and nightly fuzzing; 245 open issues on 2026-10-10, many of them `fix(...)` reports of wrong results in shipped features (the #799–#821 batch is fixed) | [gaps.md](gaps.md) |
 | Platforms | ≈ 70% | 5% | 15–30 | additional | macOS (signed, notarized), Windows x64/x86/ARM64 (signed), Linux (AppImage, deb, rpm, Flatpak), FreeBSD, web (WASM). Acrobat has no Linux, FreeBSD or full web editor; we lack web OCR and web recovery | [hardware-parity.md](hardware-parity.md) |
 | Ecosystem and plug-ins | ≈ 30% | 1% | 10–20 | within features | No plug-in SDK or folder-level JavaScript; Action Wizard partial. Agent automation (CLI, MCP, UI control channel) has no Acrobat equivalent | [gaps.md](gaps.md) |
 | AI features | ≈ 0% (in scope) | 1% | 20–40 | within features | Acrobat's AI Assistant is cloud-only (out of scope). Local, opt-in provider interface (`misc.ai-provider`) not started | [gaps.md](gaps.md) |
-| **Total (weighted sum)** | **≈ 49%** | 100% | **≈ 780–1,400** | | | |
+| **Total (weighted sum)** | **≈ 50%** | 100% | **≈ 780–1,400** | | | |
 
 ## By feature area
 
@@ -222,7 +222,7 @@ with evidence when next touched.
 
 ## Stage
 
-**alpha.** Ready for real work, ≈ 49%, is inside the 40–75% band, and every one of Acrobat Pro's
+**alpha.** Ready for real work, ≈ 50%, is inside the 40–75% band, and every one of Acrobat Pro's
 six everyday workflows can be completed end to end on macOS. Under the gate rule shared by all the
 Crafting Apps, a workflow blocks only when a typical user can't complete it at all; lossy exchange
 or a missing sub-case is a beta item. **Converting and sharing** is therefore partial, not
@@ -241,7 +241,7 @@ stage set to pre-alpha; see the revision history.)
 | Edit text and images | partial, not blocking (Latin text with embedded or standard fonts) |
 | Convert and share (Office ↔ PDF, password protection) | partial, not blocking (Office→PDF and Word layout #773 are beta items; encryption interop #774 fixed) |
 
-**To reach beta** (≈ 75% ready, no blocking gap in PDF interchange), ≈ 26 points and
+**To reach beta** (≈ 75% ready, no blocking gap in PDF interchange), ≈ 25 points and
 **≈ 400–700 agent-hours**:
 
 | Beta requirement | Hours |
diff --git a/docs/ui-parity.md b/docs/ui-parity.md
index b5b93452e..a78409fad 100644
--- a/docs/ui-parity.md
+++ b/docs/ui-parity.md
@@ -47,7 +47,7 @@ No dump of Acrobat's menu tree has been diffed against the registry yet (gap 24)
 | Hand tool, middle-button pan, autoscroll | yes | hand tool; Linux autoscroll | partial |
 | Text selection, column select | yes, Alt-drag columns | reading-order selection; Alt/Option-drag or Edit ▸ Column select (#740) | shipped |
 | Select and move several objects at once | yes | on one page: Shift/Ctrl/⌘-click and marquee, one undo step (#844); not across pages, no group resize | partial |
-| Object handles: corners keep proportion, edges free | yes | yes for added images and signatures | shipped |
+| Object handles: corners keep proportion, edges free | yes | yes for added images and signatures; Shift on a corner keeps the proportions of comments, stamps and form fields (#2199); no Alt resize from the centre | shipped |
 | Arrange, align and distribute page objects | yes | fields only | partial |
 | Rulers, grids, snap to grid, guides | yes | no | planned |
 | Cursor coordinates, line weights | yes | no | planned |
diff --git a/docs/word-count.md b/docs/word-count.md
new file mode 100644
index 000000000..4b3d02cba
--- /dev/null
+++ b/docs/word-count.md
@@ -0,0 +1,52 @@
+# Word count
+
+File ▸ Word count counts the current document, including unsaved edits. Select **Current page
+only** to count just the displayed page. On desktop, counting runs in the background, one page
+at a time. Closing the dialog or changing its options cancels the old count between pages.
+
+Words use Unicode word boundaries (UAX #29); punctuation alone is not a word. Characters are
+Unicode scalar values, not bytes or displayed glyphs. “Characters without spaces” removes all
+Unicode whitespace. Characters include the line breaks and spaces reconstructed by text
+extraction. The total is the sum of page counts, with no extra separator between pages.
+
+The three independent exclusions are off by default:
+
+- **Tagged tables:** Table, TR, TH, TD, THead, TBody and TFoot content.
+- **Tagged code blocks:** Code content.
+- **Image/OCR text:** Figure content and invisible text, including typical OCR layers. Invisible
+  text can have other uses too. Visible OCR text without Figure tags is not identifiable as OCR.
+
+Tags can be explicit marked-content tags or page-local MCIDs classified through the PDF's
+structure tree, including parent roles and RoleMap aliases. These are semantic exclusions, not
+visual table/code recognition. Untagged or unsupported structure stays in the count; the dialog
+reports when structure classification is incomplete. On pages with Form XObjects, structure-tree
+MCID exclusions are conservatively disabled because forms have separate MCID namespaces.
+Explicit Table/Code/Figure marked content still works there. Cyclic and oversized structure
+graphs are bounded and reported as incomplete.
+
+PDF `/ActualText` replacements are respected. If one replacement spans both included and
+excluded glyphs, there is no reliable mapping of its words to the selected content: counting
+fails with an explanation instead of silently returning the wrong total. Disable exclusions to
+count that page. Unreadable pages likewise fail the operation, without a misleading partial total.
+
+Images alone contain no extractable words. Run Scan & OCR first when counting scanned pages.
+Copy restrictions are respected. Counting never edits, rasterizes or saves the document, and
+keeps only one page's extracted text at a time, plus the resulting page statistics.
+
+## CLI and MCP
+
+`text_word_count` is the shared read-only automation tool:
+
+```json
+{"tool":"text_word_count","args":{"doc":1,"pages":[1,3],"exclude_tables":true,"exclude_code":true,"exclude_images":false}}
+```
+
+Omit `pages` to count all pages. Page numbers are 1-based; duplicates count once. The result
+contains `total`, per-page `pages` entries with `page` and `counts`, `pages_without_text`, and
+`unclassified_structure`. Each count has `words`, `characters`, and `characters_without_spaces`.
+`pages_without_text` is measured after exclusions, so it can also include pages whose entire
+text was deliberately excluded.
+
+The engine entry point is `pdfcraft_engine::word_count::count`. Its page indexes are 0-based;
+its progress callback can cancel between pages. Frontends must enforce document copy
+permissions before supplying an `ExportSource`.
diff --git a/packaging/linux/nfpm.yaml b/packaging/linux/nfpm.yaml
index b1b8a1404..646eb61a3 100644
--- a/packaging/linux/nfpm.yaml
+++ b/packaging/linux/nfpm.yaml
@@ -46,9 +46,16 @@ overrides:
       - mesa-vulkan-drivers
       - xdg-desktop-portal
   rpm:
+    # Library sonames rather than package names, so the same requirements resolve on Fedora/RHEL
+    # and openSUSE (which has no libxkbcommon, vulkan-loader or libglvnd-egl package). The glibc
+    # floor names libm because the binaries' GLIBC_2.35 symbols (hypot, hypotf) are libm's: RHEL 9's
+    # glibc 2.34 provides libc.so.6(GLIBC_2.35) through backports, but not this, so it refuses.
     depends:
-      - libxkbcommon
-      - (vulkan-loader or libglvnd-egl)
+      - libc.so.6()(64bit)
+      - libm.so.6(GLIBC_2.35)(64bit)
+      - libgcc_s.so.1()(64bit)
+      - libxkbcommon.so.0()(64bit)
+      - (libvulkan.so.1()(64bit) or libEGL.so.1()(64bit))
     recommends:
       - cups-client
       - libwayland-client
diff --git a/packaging/macos/Credits.rtf b/packaging/macos/Credits.rtf
new file mode 100644
index 000000000..18c053f5d
--- /dev/null
+++ b/packaging/macos/Credits.rtf
@@ -0,0 +1,10 @@
+{\rtf1\ansi\ansicpg1252\cocoartf2822
+{\fonttbl\f0\fswiss\fcharset0 Helvetica;}
+{\colortbl;\red255\green255\blue255;}
+\pard\qc\f0\fs24\cf0
+A clean-room, open-source PDF application written in Rust.\
+MIT OR Apache-2.0.\
+\
+{\field{\*\fldinst{HYPERLINK "https://getartcraft.com"}}{\fldrslt getartcraft.com}}\
+Help and feedback: {\field{\*\fldinst{HYPERLINK "https://discord.gg/artcraft"}}{\fldrslt discord.gg/artcraft}}\
+}
diff --git a/packaging/macos/package.sh b/packaging/macos/package.sh
index e04be13c8..267a87280 100755
--- a/packaging/macos/package.sh
+++ b/packaging/macos/package.sh
@@ -103,6 +103,9 @@ mkdir -p "$APP/Contents/MacOS" "$APP/Contents/Resources"
 # Executable and icon carry the display name (CFBundleExecutable / CFBundleIconFile).
 cp "$WORK/bin/pdfcraft" "$APP/Contents/MacOS/PdfCraft"
 cp "$ROOT/assets/app-icon/pdfcraft.icns" "$APP/Contents/Resources/PdfCraft.icns"
+# The standard About panel (PdfCraft menu > About PdfCraft) shows Credits.rtf under the version:
+# the website and Discord links the in-app About dialog has (#1287).
+cp "$HERE/Credits.rtf" "$APP/Contents/Resources/Credits.rtf"
 copy_font_licences "$APP/Contents/Resources"
 # OCR models: the app finds them at Contents/MacOS/../Resources/models. Before signing, so the
 # bundle's seal covers them.
diff --git a/packaging/windows/pdfcraft.wxs b/packaging/windows/pdfcraft.wxs
index 3f291721a..7fae1329f 100644
--- a/packaging/windows/pdfcraft.wxs
+++ b/packaging/windows/pdfcraft.wxs
@@ -6,9 +6,10 @@
 
   Per-machine install into Program Files, a Start Menu shortcut, a desktop shortcut (on by default,
   optional, and an update keeps it only if it is still there), an App Paths entry, PdfCraft registered as a PDF handler (offered under "Open with"
-  and in Default apps, never forced as the default), and "Edit with PdfCraft" on PDF files'
-  right-click menu (on by default, optional). Files opened with PdfCraft arrive on its command
-  line.
+  and in Default apps, never forced as the default), "Edit with PdfCraft" on PDF files'
+  right-click menu and "Create PDF with PdfCraft…" on image files' right-click menu (both on by
+  default, optional, and an update keeps the installed version's choice). Files opened with
+  PdfCraft arrive on its command line.
 -->
 <Wix xmlns="http://wixtoolset.org/schemas/v4/wxs">
   <Package
@@ -51,9 +52,31 @@
     </Property>
     <SetProperty Id="INSTALLDESKTOPSHORTCUT" Value="1" After="AppSearch" Sequence="first"
         Condition="NOT INSTALLDESKTOPSHORTCUT AND (NOT WIX_UPGRADE_DETECTED OR EXISTINGDESKTOPSHORTCUT)" />
-    <!-- "Edit with PdfCraft" on the right-click menu of PDF files in File Explorer (#682): on by
-         default, the same way, and INSTALLPDFCONTEXTMENU=0 for unattended installs without it. -->
-    <Property Id="INSTALLPDFCONTEXTMENU" Value="1" Secure="yes" />
+    <!-- The File Explorer menus: "Edit with PdfCraft" for PDF files (#682) and "Create PDF with
+         PdfCraft…" for images (#190). Each is on by default for a first install and has a property
+         to leave it out of unattended installs: INSTALLPDFCONTEXTMENU=0 (also a welcome-dialog
+         checkbox) and INSTALLIMAGECONTEXTMENU=0. Secure, like the desktop shortcut's.
+         An update keeps the installed version's choice (#305) by looking for the menu's registry
+         key, the way the desktop shortcut looks for its file: AppSearch runs before the old version
+         is removed. Releases from before a menu existed (the PDF one came in 0.7.1, the image one in
+         0.4.0) never had the key, so updating from one of them counts as a first install; the
+         OnlyDetect rows below tell them apart. A value given on the command line wins. -->
+    <Upgrade Id="EA00C367-7270-4C50-9D8B-A7A5C88AD27F">
+      <UpgradeVersion Minimum="0.7.1" IncludeMinimum="yes" OnlyDetect="yes" Property="PDFCONTEXTMENURELEASE" />
+      <UpgradeVersion Minimum="0.4.0" IncludeMinimum="yes" OnlyDetect="yes" Property="IMAGECONTEXTMENURELEASE" />
+    </Upgrade>
+    <Property Id="INSTALLPDFCONTEXTMENU" Secure="yes" />
+    <Property Id="EXISTINGPDFCONTEXTMENU">
+      <RegistrySearch Id="PdfContextMenuSearch" Root="HKLM" Key="Software\Classes\SystemFileAssociations\.pdf\shell\PdfCraft.Edit" Type="raw" />
+    </Property>
+    <SetProperty Id="INSTALLPDFCONTEXTMENU" Value="1" After="AppSearch" Sequence="first"
+        Condition="NOT INSTALLPDFCONTEXTMENU AND (NOT PDFCONTEXTMENURELEASE OR EXISTINGPDFCONTEXTMENU)" />
+    <Property Id="INSTALLIMAGECONTEXTMENU" Secure="yes" />
+    <Property Id="EXISTINGIMAGECONTEXTMENU">
+      <RegistrySearch Id="ImageContextMenuSearch" Root="HKLM" Key="Software\Classes\SystemFileAssociations\.png\shell\PdfCraft.CreatePdf" Type="raw" />
+    </Property>
+    <SetProperty Id="INSTALLIMAGECONTEXTMENU" Value="1" After="AppSearch" Sequence="first"
+        Condition="NOT INSTALLIMAGECONTEXTMENU AND (NOT IMAGECONTEXTMENURELEASE OR EXISTINGIMAGECONTEXTMENU)" />
     <UIRef Id="PdfcraftInstallerUI" />
 
     <StandardDirectory Id="ProgramFiles6432Folder">
@@ -98,38 +121,6 @@
         <RegistryValue Root="HKLM" Key="Software\PdfCraft\Capabilities" Name="ApplicationIcon" Value="[#PdfcraftExe],0" Type="string" />
         <RegistryValue Root="HKLM" Key="Software\PdfCraft\Capabilities\FileAssociations" Name=".pdf" Value="PdfCraft.Document" Type="string" />
         <RegistryValue Root="HKLM" Key="Software\RegisteredApplications" Name="PdfCraft" Value="Software\PdfCraft\Capabilities" Type="string" />
-
-        <!-- Image context menu (#190): convert without changing image file defaults. -->
-        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.png\shell\PdfCraft.CreatePdf" Value="Create PDF with PdfCraft…" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.png\shell\PdfCraft.CreatePdf" Name="MultiSelectModel" Value="Single" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.png\shell\PdfCraft.CreatePdf\command" Value="&quot;[#PdfcraftExe]&quot; --create-images &quot;%1&quot;" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.jpg\shell\PdfCraft.CreatePdf" Value="Create PDF with PdfCraft…" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.jpg\shell\PdfCraft.CreatePdf" Name="MultiSelectModel" Value="Single" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.jpg\shell\PdfCraft.CreatePdf\command" Value="&quot;[#PdfcraftExe]&quot; --create-images &quot;%1&quot;" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.jpeg\shell\PdfCraft.CreatePdf" Value="Create PDF with PdfCraft…" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.jpeg\shell\PdfCraft.CreatePdf" Name="MultiSelectModel" Value="Single" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.jpeg\shell\PdfCraft.CreatePdf\command" Value="&quot;[#PdfcraftExe]&quot; --create-images &quot;%1&quot;" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.tif\shell\PdfCraft.CreatePdf" Value="Create PDF with PdfCraft…" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.tif\shell\PdfCraft.CreatePdf" Name="MultiSelectModel" Value="Single" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.tif\shell\PdfCraft.CreatePdf\command" Value="&quot;[#PdfcraftExe]&quot; --create-images &quot;%1&quot;" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.tiff\shell\PdfCraft.CreatePdf" Value="Create PDF with PdfCraft…" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.tiff\shell\PdfCraft.CreatePdf" Name="MultiSelectModel" Value="Single" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.tiff\shell\PdfCraft.CreatePdf\command" Value="&quot;[#PdfcraftExe]&quot; --create-images &quot;%1&quot;" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.gif\shell\PdfCraft.CreatePdf" Value="Create PDF with PdfCraft…" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.gif\shell\PdfCraft.CreatePdf" Name="MultiSelectModel" Value="Single" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.gif\shell\PdfCraft.CreatePdf\command" Value="&quot;[#PdfcraftExe]&quot; --create-images &quot;%1&quot;" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.bmp\shell\PdfCraft.CreatePdf" Value="Create PDF with PdfCraft…" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.bmp\shell\PdfCraft.CreatePdf" Name="MultiSelectModel" Value="Single" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.bmp\shell\PdfCraft.CreatePdf\command" Value="&quot;[#PdfcraftExe]&quot; --create-images &quot;%1&quot;" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.jp2\shell\PdfCraft.CreatePdf" Value="Create PDF with PdfCraft…" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.jp2\shell\PdfCraft.CreatePdf" Name="MultiSelectModel" Value="Single" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.jp2\shell\PdfCraft.CreatePdf\command" Value="&quot;[#PdfcraftExe]&quot; --create-images &quot;%1&quot;" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.j2k\shell\PdfCraft.CreatePdf" Value="Create PDF with PdfCraft…" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.j2k\shell\PdfCraft.CreatePdf" Name="MultiSelectModel" Value="Single" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.j2k\shell\PdfCraft.CreatePdf\command" Value="&quot;[#PdfcraftExe]&quot; --create-images &quot;%1&quot;" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.jpx\shell\PdfCraft.CreatePdf" Value="Create PDF with PdfCraft…" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.jpx\shell\PdfCraft.CreatePdf" Name="MultiSelectModel" Value="Single" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.jpx\shell\PdfCraft.CreatePdf\command" Value="&quot;[#PdfcraftExe]&quot; --create-images &quot;%1&quot;" Type="string" />
       </Component>
 
       <!-- Shortcuts (#143) are plain links to pdfcraft.exe, not advertised MSI shortcuts: advertised
@@ -165,6 +156,45 @@
         <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.pdf\shell\PdfCraft.Edit\command" Value="&quot;[#PdfcraftExe]&quot; &quot;%1&quot;" Type="string" />
       </Component>
 
+      <!-- Image context menu (#190): "Create PDF with PdfCraft…" opens the DPI chooser, without
+           changing image file defaults. Its own component with an HKLM key path, so
+           INSTALLIMAGECONTEXTMENU=0 leaves it out and uninstall removes it. These rows were in
+           PdfcraftApp up to 0.7.1; moving them is safe because MajorUpgrade removes the old version
+           before installing (afterInstallValidate), so no old row is left behind. -->
+      <Component Id="PdfcraftImageContextMenu" Guid="1B783BF3-12DF-4588-AF80-E2CEA8BC1E5A"
+          Condition="INSTALLIMAGECONTEXTMENU = 1">
+        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.png\shell\PdfCraft.CreatePdf" Value="Create PDF with PdfCraft…" Type="string" KeyPath="yes" />
+        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.png\shell\PdfCraft.CreatePdf" Name="MultiSelectModel" Value="Single" Type="string" />
+        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.png\shell\PdfCraft.CreatePdf\command" Value="&quot;[#PdfcraftExe]&quot; --create-images &quot;%1&quot;" Type="string" />
+        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.jpg\shell\PdfCraft.CreatePdf" Value="Create PDF with PdfCraft…" Type="string" />
+        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.jpg\shell\PdfCraft.CreatePdf" Name="MultiSelectModel" Value="Single" Type="string" />
+        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.jpg\shell\PdfCraft.CreatePdf\command" Value="&quot;[#PdfcraftExe]&quot; --create-images &quot;%1&quot;" Type="string" />
+        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.jpeg\shell\PdfCraft.CreatePdf" Value="Create PDF with PdfCraft…" Type="string" />
+        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.jpeg\shell\PdfCraft.CreatePdf" Name="MultiSelectModel" Value="Single" Type="string" />
+        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.jpeg\shell\PdfCraft.CreatePdf\command" Value="&quot;[#PdfcraftExe]&quot; --create-images &quot;%1&quot;" Type="string" />
+        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.tif\shell\PdfCraft.CreatePdf" Value="Create PDF with PdfCraft…" Type="string" />
+        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.tif\shell\PdfCraft.CreatePdf" Name="MultiSelectModel" Value="Single" Type="string" />
+        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.tif\shell\PdfCraft.CreatePdf\command" Value="&quot;[#PdfcraftExe]&quot; --create-images &quot;%1&quot;" Type="string" />
+        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.tiff\shell\PdfCraft.CreatePdf" Value="Create PDF with PdfCraft…" Type="string" />
+        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.tiff\shell\PdfCraft.CreatePdf" Name="MultiSelectModel" Value="Single" Type="string" />
+        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.tiff\shell\PdfCraft.CreatePdf\command" Value="&quot;[#PdfcraftExe]&quot; --create-images &quot;%1&quot;" Type="string" />
+        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.gif\shell\PdfCraft.CreatePdf" Value="Create PDF with PdfCraft…" Type="string" />
+        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.gif\shell\PdfCraft.CreatePdf" Name="MultiSelectModel" Value="Single" Type="string" />
+        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.gif\shell\PdfCraft.CreatePdf\command" Value="&quot;[#PdfcraftExe]&quot; --create-images &quot;%1&quot;" Type="string" />
+        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.bmp\shell\PdfCraft.CreatePdf" Value="Create PDF with PdfCraft…" Type="string" />
+        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.bmp\shell\PdfCraft.CreatePdf" Name="MultiSelectModel" Value="Single" Type="string" />
+        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.bmp\shell\PdfCraft.CreatePdf\command" Value="&quot;[#PdfcraftExe]&quot; --create-images &quot;%1&quot;" Type="string" />
+        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.jp2\shell\PdfCraft.CreatePdf" Value="Create PDF with PdfCraft…" Type="string" />
+        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.jp2\shell\PdfCraft.CreatePdf" Name="MultiSelectModel" Value="Single" Type="string" />
+        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.jp2\shell\PdfCraft.CreatePdf\command" Value="&quot;[#PdfcraftExe]&quot; --create-images &quot;%1&quot;" Type="string" />
+        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.j2k\shell\PdfCraft.CreatePdf" Value="Create PDF with PdfCraft…" Type="string" />
+        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.j2k\shell\PdfCraft.CreatePdf" Name="MultiSelectModel" Value="Single" Type="string" />
+        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.j2k\shell\PdfCraft.CreatePdf\command" Value="&quot;[#PdfcraftExe]&quot; --create-images &quot;%1&quot;" Type="string" />
+        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.jpx\shell\PdfCraft.CreatePdf" Value="Create PDF with PdfCraft…" Type="string" />
+        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.jpx\shell\PdfCraft.CreatePdf" Name="MultiSelectModel" Value="Single" Type="string" />
+        <RegistryValue Root="HKLM" Key="Software\Classes\SystemFileAssociations\.jpx\shell\PdfCraft.CreatePdf\command" Value="&quot;[#PdfcraftExe]&quot; --create-images &quot;%1&quot;" Type="string" />
+      </Component>
+
       <Component Id="PdfcraftCli">
         <File Id="PdfcraftCliExe" Source="$(var.BinDir)\pdfcraft-cli.exe" KeyPath="yes" />
       </Component>
diff --git a/packaging/windows/test-msi.ps1 b/packaging/windows/test-msi.ps1
index 3af5bd037..45e1147fa 100644
--- a/packaging/windows/test-msi.ps1
+++ b/packaging/windows/test-msi.ps1
@@ -1,4 +1,4 @@
-<#
+<#
 .SYNOPSIS
   Check the compiled MSI's install scope, publisher, shortcuts, native UI and OCR models, without installing it.
 .EXAMPLE
@@ -88,33 +88,50 @@ foreach ($entry in @(@('StartMenuShortcut', 'ProgramMenuFolder', 'PdfcraftStartM
   Assert-Equal $component[0] $entry[1] "$($entry[2]) directory"
   Assert-Equal $component[1] $entry[3] "$($entry[2]) condition"
 }
-# No static default (#1058): a SetProperty after AppSearch turns it on for a first install, and for an
-# update only while the old shortcut is still on the desktop; a command-line value is left alone.
-Assert-NoRow 'SELECT `Value` FROM `Property` WHERE `Property` = ''INSTALLDESKTOPSHORTCUT''' 'desktop shortcut static default'
-$setDesktop = Read-Row 'SELECT `Action`, `Target` FROM `CustomAction` WHERE `Source` = ''INSTALLDESKTOPSHORTCUT''' 2
-Assert-Equal $setDesktop[1] '1' 'Desktop shortcut default value'
-foreach ($sequence in @('InstallUISequence', 'InstallExecuteSequence')) {
-  $search = Read-Row ('SELECT `Sequence` FROM `' + $sequence + '` WHERE `Action` = ''AppSearch''') 1
-  $set = Read-Row ('SELECT `Sequence`, `Condition` FROM `' + $sequence + '` WHERE `Action` = ''' + $setDesktop[0] + '''') 2
-  if ([int] $set[0] -le [int] $search[0]) { throw "$sequence must set the desktop shortcut default after AppSearch" }
-}
-$session = $null
-try {
-  $session = $Installer.OpenPackage((Resolve-Path -LiteralPath $Path).Path, 1)
-  foreach ($case in @(
-      @('first install', '', '', '', 1),
-      @('first install, INSTALLDESKTOPSHORTCUT=0', '0', '', '', 0),
-      @('update, shortcut still there', '', '{00000000-0000-0000-0000-000000000000}', 'C:\Users\Public\Desktop\PdfCraft.lnk', 1),
-      @('update, shortcut deleted', '', '{00000000-0000-0000-0000-000000000000}', '', 0),
-      @('update, INSTALLDESKTOPSHORTCUT=0', '0', '{00000000-0000-0000-0000-000000000000}', 'C:\Users\Public\Desktop\PdfCraft.lnk', 0))) {
-    $session.Property('INSTALLDESKTOPSHORTCUT') = $case[1]
-    $session.Property('WIX_UPGRADE_DETECTED') = $case[2]
-    $session.Property('EXISTINGDESKTOPSHORTCUT') = $case[3]
-    Assert-Equal ($session.EvaluateCondition($set[1])) $case[4] "Desktop shortcut default: $($case[0])"
+# Defaults an update keeps (#1058, #305). No static default: a SetProperty after AppSearch turns it on
+# for a first install and, for an update from a release that offered it ($Release set), only while what
+# it installed is still there ($Found, from AppSearch). A command-line value is left alone. Windows
+# Installer's evaluator runs the SetProperty condition and then $Component's own condition.
+function Assert-KeptOnUpdate([string] $Property, [string] $Release, [string] $Found, [string] $FoundValue, [string] $Component, [string] $What) {
+  Assert-NoRow ('SELECT `Value` FROM `Property` WHERE `Property` = ''' + $Property + '''') "$What static default"
+  $action = Read-Row ('SELECT `Action`, `Target` FROM `CustomAction` WHERE `Source` = ''' + $Property + '''') 2
+  Assert-Equal $action[1] '1' "$What default value"
+  $condition = $null
+  foreach ($sequence in @('InstallUISequence', 'InstallExecuteSequence')) {
+    $search = Read-Row ('SELECT `Sequence` FROM `' + $sequence + '` WHERE `Action` = ''AppSearch''') 1
+    $set = Read-Row ('SELECT `Sequence`, `Condition` FROM `' + $sequence + '` WHERE `Action` = ''' + $action[0] + '''') 2
+    if ([int] $set[0] -le [int] $search[0]) { throw "$sequence must set the $What default after AppSearch" }
+    $condition = $set[1]
+  }
+  $installed = Read-Row ('SELECT `Condition` FROM `Component` WHERE `Component` = ''' + $Component + '''') 1
+  Assert-Equal $installed[0] "$Property = 1" "$Component condition"
+  $old = '{00000000-0000-0000-0000-000000000000}'
+  # Name, command-line value, WIX_UPGRADE_DETECTED, $Release, $Found, installed (1) or not (0).
+  $cases = @(
+    @('first install', '', '', '', '', 1),
+    @("first install, $Property=0", '0', '', '', '', 0),
+    @('update, still there', '', $old, $old, $FoundValue, 1),
+    @('update, removed', '', $old, $old, '', 0),
+    @("update, $Property=0", '0', $old, $old, $FoundValue, 0),
+    @("update, removed, $Property=1", '1', $old, $old, '', 1))
+  # An update from a release from before it existed (WIX_UPGRADE_DETECTED alone) is a first install.
+  if ($Release -ne 'WIX_UPGRADE_DETECTED') { $cases += , @('update from a release without it', '', $old, '', '', 1) }
+  $session = $null
+  try {
+    $session = $Installer.OpenPackage((Resolve-Path -LiteralPath $Path).Path, 1)
+    foreach ($case in $cases) {
+      $session.Property($Property) = $case[1]
+      $session.Property('WIX_UPGRADE_DETECTED') = $case[2]
+      $session.Property($Release) = $case[3]
+      $session.Property($Found) = $case[4]
+      if ($session.EvaluateCondition($condition) -eq 1) { $session.Property($Property) = $action[1] }
+      Assert-Equal ($session.EvaluateCondition($installed[0])) $case[5] "$What`: $($case[0])"
+    }
+  } finally {
+    if ($session) { [void] [Runtime.InteropServices.Marshal]::FinalReleaseComObject($session) }
   }
-} finally {
-  if ($session) { [void] [Runtime.InteropServices.Marshal]::FinalReleaseComObject($session) }
 }
+Assert-KeptOnUpdate 'INSTALLDESKTOPSHORTCUT' 'WIX_UPGRADE_DETECTED' 'EXISTINGDESKTOPSHORTCUT' 'C:\Users\Public\Desktop\PdfCraft.lnk' 'PdfcraftDesktopShortcut' 'Desktop shortcut'
 $secure = Read-Row 'SELECT `Value` FROM `Property` WHERE `Property` = ''SecureCustomProperties''' 1
 if (($secure[0] -split ';') -notcontains 'INSTALLDESKTOPSHORTCUT') { throw "INSTALLDESKTOPSHORTCUT is not secure: '$($secure[0])'" }
 $checkbox = Read-Row 'SELECT `Type`, `Property`, `Text` FROM `Control` WHERE `Dialog_` = ''InstallWelcome'' AND `Control` = ''DesktopShortcut''' 3
@@ -128,23 +145,71 @@ Assert-Equal $app[0] 'PdfcraftExe' 'Shortcut executable key path'
 $scope = Read-Row 'SELECT `Value` FROM `Property` WHERE `Property` = ''ALLUSERS''' 1
 Assert-Equal $scope[0] '1' 'Per-machine shortcut scope'
 
-# Image context menu opens the DPI chooser; the app component owns every registry row so
-# uninstall removes it. No image default association is changed.
+# Each File Explorer menu remembers whether it was installed by finding its key path in HKLM, in the
+# package's own registry view (64-bit for x64 and arm64). Only a release that offered the menu can
+# leave it out, so the OnlyDetect Upgrade rows start at the first release with that menu.
+$upgradeCode = Read-Row 'SELECT `Value` FROM `Property` WHERE `Property` = ''UpgradeCode''' 1
+$view64 = $Database.SummaryInformation(0).Property(7) -notmatch '^Intel;'
+function Assert-MenuSearch([string] $Found, [string] $Key, [string] $Release, [string] $Since, [string] $What) {
+  $search = Read-Row ('SELECT `Root`, `Key`, `Name`, `Type` FROM `RegLocator`, `AppSearch` WHERE `AppSearch`.`Signature_` = `RegLocator`.`Signature_` AND `AppSearch`.`Property` = ''' + $Found + '''') 4
+  Assert-Equal $search[0] '2' "$What search HKLM root"
+  Assert-Equal $search[1] $Key "$What search key"
+  Assert-Equal $search[2] '' "$What search reads the default value"
+  # msidbLocatorTypeRawValue (2), plus msidbLocatorType64bit (16) in a 64-bit package.
+  Assert-Equal ([int] $search[3]) $(if ($view64) { 18 } else { 2 }) "$What search type"
+  $upgrade = Read-Row ('SELECT `UpgradeCode`, `VersionMin`, `VersionMax`, `Attributes` FROM `Upgrade` WHERE `ActionProperty` = ''' + $Release + '''') 4
+  Assert-Equal $upgrade[0] $upgradeCode[0] "$What release detection upgrade code"
+  Assert-Equal $upgrade[1] $Since "$What release detection minimum"
+  Assert-Equal $upgrade[2] '' "$What release detection maximum"
+  # msidbUpgradeAttributesOnlyDetect (2) + VersionMinInclusive (256): never removes anything itself.
+  Assert-Equal ([int] $upgrade[3]) 258 "$What release detection attributes"
+  if (($secure[0] -split ';') -notcontains $Release) { throw "$Release is not secure: '$($secure[0])'" }
+}
+# The old version is removed before the new one is installed, so rows that moved between components
+# (the image menu left PdfcraftApp after 0.7.1) are removed with it rather than orphaned.
+$validate = Read-Row 'SELECT `Sequence` FROM `InstallExecuteSequence` WHERE `Action` = ''InstallValidate''' 1
+$remove = Read-Row 'SELECT `Sequence` FROM `InstallExecuteSequence` WHERE `Action` = ''RemoveExistingProducts''' 1
+$initialize = Read-Row 'SELECT `Sequence` FROM `InstallExecuteSequence` WHERE `Action` = ''InstallInitialize''' 1
+if ([int] $remove[0] -le [int] $validate[0] -or [int] $remove[0] -ge [int] $initialize[0]) {
+  throw "RemoveExistingProducts ($($remove[0])) must run between InstallValidate and InstallInitialize"
+}
+
+# Image context menu (#190) opens the DPI chooser. Its own component, gated by INSTALLIMAGECONTEXTMENU
+# (on for a first install, kept on update only while present, secure), with the .png label as key
+# path so uninstall removes every row. No image default association is changed.
+$imageKey = 'Software\Classes\SystemFileAssociations\.png\shell\PdfCraft.CreatePdf'
 foreach ($ext in @('png', 'jpg', 'jpeg', 'tif', 'tiff', 'gif', 'bmp', 'jp2', 'j2k', 'jpx')) {
   $key = 'Software\Classes\SystemFileAssociations\.' + $ext + '\shell\PdfCraft.CreatePdf'
   $menu = Read-Row ('SELECT `Value`, `Component_`, `Root` FROM `Registry` WHERE `Key` = ''' + $key + ''' AND `Name` IS NULL') 3
   Assert-Equal $menu[0] 'Create PDF with PdfCraft…' "$ext context menu label"
-  Assert-Equal $menu[1] 'PdfcraftApp' "$ext context menu component"
+  Assert-Equal $menu[1] 'PdfcraftImageContextMenu' "$ext context menu component"
   Assert-Equal $menu[2] '2' "$ext context menu HKLM root"
-  $command = Read-Row ('SELECT `Value` FROM `Registry` WHERE `Key` = ''' + $key + '\command''') 1
+  $command = Read-Row ('SELECT `Value`, `Component_` FROM `Registry` WHERE `Key` = ''' + $key + '\command''') 2
   Assert-Equal $command[0] '"[#PdfcraftExe]" --create-images "%1"' "$ext context menu command"
-  $selection = Read-Row ('SELECT `Value` FROM `Registry` WHERE `Key` = ''' + $key + ''' AND `Name` = ''MultiSelectModel''') 1
+  Assert-Equal $command[1] 'PdfcraftImageContextMenu' "$ext context menu command component"
+  $selection = Read-Row ('SELECT `Value`, `Component_` FROM `Registry` WHERE `Key` = ''' + $key + ''' AND `Name` = ''MultiSelectModel''') 2
   Assert-Equal $selection[0] 'Single' "$ext context menu selection"
+  Assert-Equal $selection[1] 'PdfcraftImageContextMenu' "$ext context menu selection component"
 }
+$view = $Database.OpenView('SELECT `Key` FROM `Registry` WHERE `Component_` = ''PdfcraftApp''')
+try {
+  [void] $view.Execute()
+  while ($record = $view.Fetch()) {
+    if ($record.StringData(1) -match 'PdfCraft\.CreatePdf') { throw "image menu row left in PdfcraftApp: $($record.StringData(1))" }
+  }
+} finally { [void] $view.Close() }
+$imageKeyPath = Read-Row ('SELECT `Registry` FROM `Registry` WHERE `Key` = ''' + $imageKey + ''' AND `Name` IS NULL') 1
+$imageComponent = Read-Row 'SELECT `KeyPath`, `Attributes` FROM `Component` WHERE `Component` = ''PdfcraftImageContextMenu''' 2
+Assert-Equal $imageComponent[0] $imageKeyPath[0] 'Image context menu key path'
+# msidbComponentAttributesRegistryKeyPath (4).
+if (([int] $imageComponent[1] -band 4) -eq 0) { throw "Image context menu key path is not a registry value: attributes $($imageComponent[1])" }
+Assert-KeptOnUpdate 'INSTALLIMAGECONTEXTMENU' 'IMAGECONTEXTMENURELEASE' 'EXISTINGIMAGECONTEXTMENU' 'Create PDF with PdfCraft…' 'PdfcraftImageContextMenu' 'Image context menu'
+Assert-MenuSearch 'EXISTINGIMAGECONTEXTMENU' $imageKey 'IMAGECONTEXTMENURELEASE' '0.4.0' 'Image context menu'
+if (($secure[0] -split ';') -notcontains 'INSTALLIMAGECONTEXTMENU') { throw "INSTALLIMAGECONTEXTMENU is not secure: '$($secure[0])'" }
 
 # PDF context menu (#682): "Edit with PdfCraft" opens the file in PdfCraft. Its own component, gated
-# by INSTALLPDFCONTEXTMENU (default 1, secure, welcome checkbox), with its menu value as key path so
-# uninstall removes it. Several selected PDFs each start pdfcraft.exe "%1" (Document), which the
+# by INSTALLPDFCONTEXTMENU (on for a first install, kept on update only while present, secure, welcome
+# checkbox), with its menu value as key path so uninstall removes it. Several selected PDFs each start pdfcraft.exe "%1" (Document), which the
 # single-instance hand-off opens as tabs. The .pdf default is never set, so the user's default app
 # stays.
 $pdfKey = 'Software\Classes\SystemFileAssociations\.pdf\shell\PdfCraft.Edit'
@@ -163,8 +228,8 @@ Assert-Equal $pdfCommand[1] 'PdfcraftPdfContextMenu' 'PDF context menu command c
 $pdfComponent = Read-Row 'SELECT `Condition`, `KeyPath` FROM `Component` WHERE `Component` = ''PdfcraftPdfContextMenu''' 2
 Assert-Equal $pdfComponent[0] 'INSTALLPDFCONTEXTMENU = 1' 'PDF context menu condition'
 Assert-Equal $pdfComponent[1] $pdfMenu[0] 'PDF context menu key path'
-$pdfDefault = Read-Row 'SELECT `Value` FROM `Property` WHERE `Property` = ''INSTALLPDFCONTEXTMENU''' 1
-Assert-Equal $pdfDefault[0] '1' 'PDF context menu default'
+Assert-KeptOnUpdate 'INSTALLPDFCONTEXTMENU' 'PDFCONTEXTMENURELEASE' 'EXISTINGPDFCONTEXTMENU' 'Edit with PdfCraft' 'PdfcraftPdfContextMenu' 'PDF context menu'
+Assert-MenuSearch 'EXISTINGPDFCONTEXTMENU' $pdfKey 'PDFCONTEXTMENURELEASE' '0.7.1' 'PDF context menu'
 if (($secure[0] -split ';') -notcontains 'INSTALLPDFCONTEXTMENU') { throw "INSTALLPDFCONTEXTMENU is not secure: '$($secure[0])'" }
 $pdfCheckbox = Read-Row 'SELECT `Type`, `Property`, `Text` FROM `Control` WHERE `Dialog_` = ''InstallWelcome'' AND `Control` = ''PdfContextMenu''' 3
 Assert-Equal $pdfCheckbox[0] 'CheckBox' 'Welcome PDF context-menu control'
@@ -204,4 +269,4 @@ $rm = Read-Row 'SELECT `Dialog` FROM `Dialog` WHERE `Dialog` = ''MsiRMFilesInUse
 Assert-Equal $rm[0] 'MsiRMFilesInUse' 'Files-in-use dialog'
 [void] [Runtime.InteropServices.Marshal]::FinalReleaseComObject($Database)
 [void] [Runtime.InteropServices.Marshal]::FinalReleaseComObject($Installer)
-Write-Output 'ok MSI: per-machine scope guard, publisher, persistent progress text, Start Menu shortcut, optional desktop shortcut (on for a first install, kept on update only while present, checkbox), optional PDF context menu (default on, checkbox), icon/key path, full-UI success/cancel/error and Finish controls, files-in-use dialog, OCR models'
+Write-Output 'ok MSI: per-machine scope guard, publisher, persistent progress text, Start Menu shortcut, optional desktop shortcut and PDF and image context menus (on for a first install, kept on update only while present; checkboxes for the first two), icon/key path, full-UI success/cancel/error and Finish controls, files-in-use dialog, OCR models'
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 37b98326d..7aa5e629d 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -13,6 +13,18 @@ areas = { A = "core", B = "view", C = "edit", D = "organize", E = "comment", F =
 # A. Core document model and fidelity
 # ==================================================================================================
 
+[[feature]]
+id = "core.word-count"
+title = "Word and character count"
+area = "A"
+tier = "P2"
+milestone = "M2"
+status = "shipped"
+commands = ["file.word_count"]
+tools = ["text_word_count"]
+evidence = ["crates/engine/src/word_count.rs::word_count_filters_are_independent_and_do_not_change_normal_extraction", "crates/automation/tests/automation.rs::word_count_reads_selected_pages_and_unsaved_edits_without_mutating", "crates/ui-egui/src/word_count_ui.rs::word_count_dialog_counts_changes_pages_and_closes"]
+notes = "Unicode words and characters for the current snapshot; all or current page in GUI, selected pages headlessly. Desktop background work with cancellation. Optional semantic table/code/Figure and invisible-text exclusions; no OCR or visual layout classification. Unsupported structure remains counted and is reported. Mixed ActualText exclusions fail explicitly. See docs/word-count.md."
+
 [[feature]]
 id = "core.open-pdf"
 title = "Open PDF files"
@@ -334,8 +346,8 @@ milestone = "M1"
 status = "shipped"
 commands = []
 tools = []
-evidence = ["crates/cos/tests/encryption.rs::qpdf_agrees", "crates/cos/tests/writer.rs::qpdf_accepts_object_stream_output"]
-notes = "skipped when qpdf is absent"
+evidence = ["crates/cos/tests/encryption.rs::qpdf_agrees", "crates/cos/tests/writer.rs::qpdf_accepts_object_stream_output", "crates/platform/src/staging.rs::an_atomic_write_replaces_the_target_only_when_complete", "apps/pdfcraft-cli/tests/edit.rs::editing_in_place_leaves_a_valid_file_and_no_staging_file", "crates/automation/tests/automation.rs::a_root_less_write_output_is_atomic_too"]
+notes = "qpdf is installed on the Linux CI runner and PDFCRAFT_ORACLES_REQUIRED makes its absence a failure, so these run on every CI run rather than skipping; on a machine without qpdf they skip with a notice (crates/oracle). Every PDF leaves the engine checked (it reopens with its pages): saves, new files from Combine/Extract/Split/Create, signed, timestamped and LTV-embedded files, OCR batch output; and every writer goes through one staging-file writer (the desktop app, the tools with or without --root, the CLI), so a failed write never leaves a truncated file (#1698, #2166)"
 
 [[feature]]
 id = "core.deterministic-save"
@@ -538,8 +550,8 @@ milestone = "M4"
 status = "shipped"
 commands = []
 tools = []
-evidence = ["crates/ui-egui/tests/recovery.rs::a_crashed_session_is_offered_and_recovered_unsaved", "crates/ui-egui/tests/recovery.rs::discarding_removes_the_autosaves", "crates/engine/src/tests.rs::recovered_documents_reopen_unsaved_at_their_original_path"]
-notes = ""
+evidence = ["crates/ui-egui/tests/recovery.rs::a_crashed_session_is_offered_and_recovered_unsaved", "crates/ui-egui/tests/recovery.rs::discarding_removes_the_autosaves", "crates/ui-egui/tests/recovery.rs::a_running_instances_autosaves_are_not_offered_to_a_second_instance", "crates/engine/src/tests.rs::recovered_documents_reopen_unsaved_at_their_original_path"]
+notes = "A running instance holds an exclusively locked instance file in the recovery folder and names it in its snapshots, so a second instance neither offers nor discards what the first is autosaving (#2166); the OS releases the lock when the process dies. Where the folder can't be written or the platform has no file locks, snapshots are offered as before."
 
 [[feature]]
 id = "core.encrypted-autosave"
@@ -634,8 +646,8 @@ milestone = "M4"
 status = "shipped"
 commands = []
 tools = []
-evidence = ["crates/engine/src/tests.rs::reload_reads_the_new_file_into_the_same_document", "crates/ui-egui/tests/reload.rs::a_rebuilt_file_reloads_in_place_keeping_the_page_and_zoom", "crates/ui-egui/tests/reload.rs::a_half_written_file_waits_until_the_pdf_is_whole", "crates/ui-egui/tests/reload.rs::saving_does_not_reload_or_lose_undo", "crates/ui-egui/tests/reload.rs::unsaved_changes_are_kept_until_reload_is_chosen", "crates/ui-egui/tests/reload.rs::a_deleted_file_leaves_the_document_open", "crates/ui-egui/tests/reload.rs::nothing_reloads_with_the_preference_off", "crates/ui-egui/tests/reload.rs::a_shorter_new_version_drops_what_pointed_into_the_old_one"]
-notes = "Desktop, on by default (Preferences ▸ Documents and view, #431), for LaTeX/Typst builds: a worker thread checks each open file's metadata every 250 ms and reads a change once it has settled and ends in %%EOF; a clean document reloads in place (same tab, page, zoom, scroll; old page images stay until new ones are drawn), one with unsaved changes gets a Reload notice; PdfCraft's own saves never reload. Measured on Windows: one check 11 µs per file, reload of a 417-page 0.9 MB pdflatex file 16 ms. Not yet: OS change notifications (polling adds up to 250 ms), the web build; a reload clears undo history, like Revert."
+evidence = ["crates/engine/src/tests.rs::reload_reads_the_new_file_into_the_same_document", "crates/ui-egui/tests/reload.rs::a_rebuilt_file_reloads_in_place_keeping_the_page_and_zoom", "crates/ui-egui/tests/reload.rs::a_half_written_file_waits_until_the_pdf_is_whole", "crates/ui-egui/tests/reload.rs::saving_does_not_reload_or_lose_undo", "crates/ui-egui/tests/reload.rs::unsaved_changes_are_kept_until_reload_is_chosen", "crates/ui-egui/tests/reload.rs::a_deleted_file_leaves_the_document_open", "crates/ui-egui/tests/reload.rs::nothing_reloads_with_the_preference_off", "crates/ui-egui/tests/reload.rs::a_shorter_new_version_drops_what_pointed_into_the_old_one", "crates/ui-egui/tests/reload.rs::saving_over_a_file_changed_by_something_else_asks_first", "crates/ui-egui/tests/reload.rs::saving_checks_the_file_with_the_watcher_off_too", "crates/ui-egui/tests/reload.rs::opening_a_file_that_is_open_focuses_its_tab"]
+notes = "Desktop, on by default (Preferences ▸ Documents and view, #431), for LaTeX/Typst builds: a worker thread checks each open file's metadata every 250 ms and reads a change once it has settled and ends in %%EOF; a clean document reloads in place (same tab, page, zoom, scroll; old page images stay until new ones are drawn), one with unsaved changes gets a Reload notice; PdfCraft's own saves never reload. Save asks before writing over a version of the file the document did not come from, watcher on or off, with Save as… to keep it (#2166); a file that is open already comes to the front instead of opening twice. Measured on Windows: one check 11 µs per file, reload of a 417-page 0.9 MB pdflatex file 16 ms. Not yet: OS change notifications (polling adds up to 250 ms), the web build; a reload clears undo history, like Revert."
 
 [[feature]]
 id = "core.signed-save-policy"
@@ -734,8 +746,8 @@ milestone = "M2"
 status = "partial"
 commands = []
 tools = []
-evidence = ["crates/render/src/raster.rs::soft_mask_without_group_colour_space_is_applied"]
-notes = "via hayro bootstrap"
+evidence = ["crates/render/src/raster.rs::soft_mask_without_group_colour_space_is_applied", "crates/render/src/raster.rs::a_multiply_highlight_inside_a_transparency_group_keeps_the_text"]
+notes = "via hayro bootstrap. A transparency group that is neither isolated nor knockout and is entered at full opacity, with no soft mask and Normal blending, is drawn straight onto the page, so a blend mode inside it (the Multiply of a highlight appearance written by other editors) sees the page content (#1968). Missing: a non-isolated group that needs a layer (partial opacity, a soft mask or a blend mode on the group itself) still composites its elements against a blank backdrop, and knockout groups are drawn as ordinary ones"
 
 [[feature]]
 id = "view.render-knockout"
@@ -794,8 +806,8 @@ milestone = "M2"
 status = "shipped"
 commands = []
 tools = []
-evidence = ["crates/render/src/raster.rs::widget_appearance_states", "crates/render/src/raster.rs::highlights_without_an_appearance_are_drawn", "crates/engine/src/tests.rs::comments_without_appearances_are_drawn_but_not_saved"]
-notes = "comments without /AP (FreeText, Ink, notes, stamps, shapes, markup) are drawn from their dictionaries in the page view, page_render and page images, never saved (a read-only document still gets the renderer's Highlight fallback only); Link borders without /AP and printing are not covered yet"
+evidence = ["crates/render/src/raster.rs::widget_appearance_states", "crates/render/src/raster.rs::highlights_without_an_appearance_are_drawn", "crates/engine/src/tests.rs::comments_without_appearances_are_drawn_but_not_saved", "crates/engine/src/tests.rs::cli_display_adds_missing_appearances_without_changing_the_source"]
+notes = "comments without /AP (FreeText, Ink, notes, stamps, shapes, markup) are drawn from their dictionaries in the page view, page_render and page images, including the CLI render command, never saved (a read-only document still gets the renderer's Highlight fallback only); Link borders without /AP and printing are not covered yet"
 
 [[feature]]
 id = "view.render-error-isolation"
@@ -830,8 +842,8 @@ milestone = "M3"
 status = "partial"
 commands = []
 tools = []
-evidence = ["crates/render/src/raster.rs::tiles_match_full_render", "crates/render/src/raster.rs::effective_scale_never_exceeds_the_caps"]
-notes = "capped at 8192 px per side (M3.3)"
+evidence = ["crates/render/src/raster.rs::tiles_match_full_render", "crates/render/src/raster.rs::effective_scale_never_exceeds_the_caps", "crates/ui-egui/tests/view.rs::returning_to_a_visited_zoom_reuses_its_cached_tiles", "crates/ui-egui/tests/view.rs::zooming_a_tiled_page_shows_its_earlier_tiles_until_new_ones_arrive"]
+notes = "capped at 8192 px per side (M3.3); tiles of a zoom already rendered stay cached while their page is on screen, so zooming away and back shows the area sharp instead of re-rendering it tile by tile (#2196)"
 
 [[feature]]
 id = "view.layout-continuous"
@@ -842,8 +854,8 @@ milestone = "M3"
 status = "shipped"
 commands = ["view.continuous"]
 tools = []
-evidence = ["crates/ui-egui/tests/view.rs::continuous_layout_stacks_pages_vertically", "crates/ui-egui/tests/view.rs::page_display_commands_switch_layouts", "crates/ui-egui/tests/view.rs::default_page_display_is_used_for_new_documents", "crates/ui-egui/src/canvas.rs::fit_page_and_height_hold_still_while_mixed_page_sizes_scroll_past"]
-notes = "the default for PDFs that don't ask for a layout (Preferences ▸ Default page display); pages stack with no snapping. Fit page and Fit height fit the largest page, so the zoom holds still across mixed page sizes"
+evidence = ["crates/ui-egui/tests/view.rs::continuous_layout_stacks_pages_vertically", "crates/ui-egui/tests/view.rs::page_display_commands_switch_layouts", "crates/ui-egui/tests/view.rs::default_page_display_is_used_for_new_documents", "crates/ui-egui/src/canvas.rs::fit_page_and_height_hold_still_while_mixed_page_sizes_scroll_past", "crates/ui-egui/tests/view.rs::touchpad_swipe_glides_on_after_the_fingers_lift_and_stops", "crates/ui-egui/tests/view.rs::touching_the_touchpad_again_or_turning_animations_off_stops_the_glide"]
+notes = "the default for PDFs that don't ask for a layout (Preferences ▸ Default page display); pages stack with no snapping. Fit page and Fit height fit the largest page, so the zoom holds still across mixed page sizes. A touchpad swipe glides on after the fingers lift on Wayland (#531; macOS glides by itself; Windows and X11 report no lift through winit), unless Animation effects is off; a click, key, zoom or new scroll catches it. Not yet: fingers resting on the touchpad don't catch it (needs Wayland hold gestures, which the vendored winit doesn't bind)"
 
 [[feature]]
 id = "view.layout-single-page"
@@ -854,8 +866,8 @@ milestone = "M3"
 status = "shipped"
 commands = ["view.layout.single"]
 tools = []
-evidence = ["crates/ui-egui/tests/view.rs::single_page_layout_shows_one_page_at_a_time", "crates/ui-egui/tests/view.rs::single_page_wheel_pans_instead_when_zoomed_in", "crates/ui-egui/tests/view.rs::wheel_turns_one_page_per_notch_and_per_trackpad_swipe", "crates/ui-egui/tests/view.rs::rail_page_display_button_switches_layouts", "crates/ui-egui/tests/view.rs::view_menu_page_display_uses_the_same_commands"]
-notes = "when the whole page fits, each wheel notch turns a page and each trackpad swipe turns one, momentum included; zoomed in, the wheel pans and never turns the page. Switched from the View menu, the rail's Page display button or the palette"
+evidence = ["crates/ui-egui/tests/view.rs::single_page_layout_shows_one_page_at_a_time", "crates/ui-egui/tests/view.rs::single_page_wheel_pans_instead_when_zoomed_in", "crates/ui-egui/tests/view.rs::wheel_turns_one_page_per_notch_and_per_trackpad_swipe", "crates/ui-egui/tests/view.rs::single_page_wheel_at_the_bottom_edge_turns_to_the_next_page_top_and_back", "crates/ui-egui/tests/view.rs::single_page_swipe_that_reaches_the_edge_does_not_turn_but_a_fresh_one_does", "crates/ui-egui/tests/view.rs::rail_page_display_button_switches_layouts", "crates/ui-egui/tests/view.rs::view_menu_page_display_uses_the_same_commands"]
+notes = "when the whole page fits, each wheel notch turns a page and each trackpad swipe turns one, momentum included; zoomed in so the page is taller than the window, the wheel pans, and at the bottom (top) edge a wheel notch, or a fresh trackpad swipe, shows the next page at its top (the previous page at its bottom); a swipe that panned to the edge, momentum included, does not turn until the fingers lift and swipe again (#1924). Not verified against Acrobat's own thresholds. Switched from the View menu, the rail's Page display button or the palette"
 
 [[feature]]
 id = "view.layout-two-up"
@@ -1152,10 +1164,10 @@ area = "B"
 tier = "P1"
 milestone = "M3"
 status = "shipped"
-commands = []
+commands = ["view.previous_view", "view.next_view"]
 tools = []
-evidence = ["crates/ui-egui/tests/viewer.rs::view_history_select_all_and_find_options"]
-notes = "⌘[ / ⌘] and View ▸ Page navigation"
+evidence = ["crates/ui-egui/tests/viewer.rs::view_history_select_all_and_find_options", "crates/ui-egui/tests/control.rs::navigation_history_commands_and_rail_are_per_tab_and_non_editing", "crates/ui-egui/tests/control.rs::routine_continuous_scrolling_does_not_add_navigation_history"]
+notes = "Per-tab page history: explicit search-result jumps, page navigation, bookmarks and links; no continuous-scroll history or restart persistence; existing page-step history is retained. Rail buttons, View ▸ Page navigation and Ctrl/⌘[ / Ctrl/⌘]. UI control ui.command exposes view.previous_view / view.next_view; standalone engine sessions have no viewport history. Restores page tops, not exact scroll/zoom positions."
 
 [[feature]]
 id = "view.follow-links"
@@ -1181,6 +1193,18 @@ tools = []
 evidence = ["crates/ui-egui/tests/comments.rs::hovering_a_comment_shows_its_author_and_text"]
 notes = "a popup with the author and the comment text, as Acrobat shows"
 
+[[feature]]
+id = "view.page-size-hover"
+title = "Page size on hover (bottom-left of the page view)"
+area = "B"
+tier = "P2"
+milestone = "M3"
+status = "shipped"
+commands = []
+tools = []
+evidence = ["crates/ui-egui/tests/control.rs::page_size_shows_while_the_pointer_is_in_the_bottom_left_quadrant", "crates/ui-egui/src/canvas.rs::page_size_hint_zone_is_the_bottom_left_quadrant"]
+notes = "While the pointer is in the bottom-left quadrant of the page view, a small label shows the current page's size (after /Rotate and /UserUnit) in the Preferences unit, formatted as in Document Properties (#1855). It never takes clicks and hides when the pointer leaves. Acrobat's trigger is the corner itself and may differ in exact area and wording (not compared with real Acrobat); the size of the current page only, not of the page under the pointer; no headless tool (page sizes are in document info)."
+
 [[feature]]
 id = "view.document-tabs"
 title = "Tabbed documents"
@@ -1512,10 +1536,10 @@ area = "B"
 tier = "P0"
 milestone = "M3"
 status = "shipped"
-commands = []
-tools = []
-evidence = ["crates/ui-egui/tests/ui.rs::drag_selects_text_and_copy_returns_it"]
-notes = ""
+commands = ["edit.copy"]
+tools = ["text_extract"]
+evidence = ["crates/ui-egui/tests/ui.rs::drag_selects_text_and_copy_returns_it", "crates/ui-egui/tests/ui_group/text_select.rs::selected_text_copy_edit_and_context_menus", "crates/ui-egui/tests/ui_group/text_select.rs::selected_text_copy_floating_button_honours_permissions", "crates/ui-egui/tests/ui_group/text_select.rs::selected_text_copy_keeps_focused_input_clipboard_ownership"]
+notes = "Keyboard, Edit-menu, page-context-menu and floating-selection Copy honour document copy permissions. Menus require selected page text; focused text inputs and Organize page copying retain their own clipboard handling. Headless text extraction uses text_extract."
 
 [[feature]]
 id = "view.select-all"
@@ -1694,8 +1718,8 @@ milestone = "M4"
 status = "shipped"
 commands = []
 tools = []
-evidence = ["crates/ui-egui/tests/commands.rs::shortcuts_run_registered_commands", "crates/engine/src/commands.rs::shortcut_labels_follow_platform_conventions"]
-notes = ""
+evidence = ["crates/ui-egui/tests/commands.rs::shortcuts_run_registered_commands", "crates/engine/src/commands.rs::shortcut_labels_follow_platform_conventions", "crates/ui-egui/tests/commands.rs::quit_shortcut_requires_exact_modifiers_and_preserves_unsaved_work", "crates/ui-egui/tests/signing.rs::ctrl_alt_q_types_an_email_without_quitting"]
+notes = "Quit requires exact Ctrl+Q/Cmd+Q modifiers and preserves unsaved-document confirmation. Ctrl+Alt+Q email input is covered with synthetic key/text events; native German keyboard-layout translation is not covered by that test (#1980)."
 
 [[feature]]
 id = "view.shortcuts-dialog"
@@ -1842,8 +1866,8 @@ milestone = "M7"
 status = "partial"
 commands = ["edit.edit_text"]
 tools = ["text_lines", "text_paragraphs", "text_edit", "text_edit_layout", "text_font_files", "text_font_import", "text_fonts"]
-evidence = ["crates/edit/src/tests.rs::paragraphs_are_found_and_rewrapped", "crates/edit/src/tests.rs::text_lines_are_found_and_replaced_in_place", "crates/ui-egui/tests/editing.rs::editing_existing_text_in_place", "crates/automation/tests/automation.rs::editing_existing_text_through_tools", "crates/edit/src/tests.rs::a_line_whose_operator_starts_the_next_stream_can_be_edited", "crates/automation/tests/automation.rs::a_line_split_across_content_streams_is_listed_and_edited", "crates/ui-egui/tests/editing.rs::selected_text_formatting_keeps_the_rest_of_the_paragraph_and_reopens", "crates/edit/src/tests.rs::marked_paragraph_boundaries_and_cross_stream_transforms_survive_rewrite", "crates/automation/tests/automation.rs::explicit_font_and_disjoint_ranges_save_reopen_through_tools", "crates/edit/src/tests.rs::disjoint_style_ranges_preserve_unselected_runs_and_validate_utf8_atomically", "crates/engine/tests/document_fonts.rs::opentype_cff_document_font_preserves_program_codes_and_rendering_after_reopen", "crates/ui-egui/tests/editing.rs::cropped_images_do_not_intercept_text_and_stay_inside_each_page", "crates/automation/tests/automation.rs::clipped_image_bounds_and_text_edit_save_reopen_through_tools", "crates/edit/src/tests.rs::mixed_styles_and_matrix_sizes_form_visual_regions_without_merging_columns", "crates/edit/src/tests.rs::rich_region_edits_preserve_styles_positions_and_delete_all_runs_after_reopen", "crates/ui-egui/tests/editing.rs::one_editor_contains_mixed_styles_and_visual_rows", "crates/ui-egui/tests/editing.rs::inline_editor_preserves_source_font_and_previews_live_bounds", "crates/fonts/src/pdf.rs::mac_subset_cmap_uses_pdf_unicode_without_changing_source_program", "crates/automation/tests/automation.rs::mixed_visual_region_edit_preview_save_reopen_and_undo_through_tools"]
-notes = "click a paragraph box and retype it in place (font reused or Helvetica substituted, colour and spacing kept, rewrapped); a page's /Contents pieces are parsed joined, so a line whose operands and operator sit in different pieces is listed and edited (lines and paragraphs still don't join across pieces; Edit image still parses each piece alone); drag a box to move it or its right-edge handle to rewrap it (edit.text-move-resize); per-character formatting changes are next Since #1116: mixed-style visual regions retain source rows, subset encodings, colour and baseline anchors in one textless-background editor. Explicit paragraph/heading scopes constrain grouping; compatible graphics planes permit cross-stream regions. Full matching document fonts complete absent subset glyphs; installed/file selection, TrueType/OpenType-CFF embedding and disjoint UTF-8 range styles have save/reopen coverage. Single-face OpenType shaping/bidi retains logical text through ToUnicode/ActualText. Legacy non-SFNT preview, mixed-font/style contextual runs, full structure-tree preservation and author intent in untagged PDFs remain limited; see docs/editing-existing-text.md"
+evidence = ["crates/edit/src/tests.rs::paragraphs_are_found_and_rewrapped", "crates/edit/src/tests.rs::text_lines_are_found_and_replaced_in_place", "crates/ui-egui/tests/editing.rs::editing_existing_text_in_place", "crates/automation/tests/automation.rs::editing_existing_text_through_tools", "crates/edit/src/tests.rs::a_line_whose_operator_starts_the_next_stream_can_be_edited", "crates/automation/tests/automation.rs::a_line_split_across_content_streams_is_listed_and_edited", "crates/ui-egui/tests/editing.rs::selected_text_formatting_keeps_the_rest_of_the_paragraph_and_reopens", "crates/edit/src/tests.rs::marked_paragraph_boundaries_and_cross_stream_transforms_survive_rewrite", "crates/automation/tests/automation.rs::explicit_font_and_disjoint_ranges_save_reopen_through_tools", "crates/edit/src/tests.rs::disjoint_style_ranges_preserve_unselected_runs_and_validate_utf8_atomically", "crates/engine/tests/document_fonts.rs::opentype_cff_document_font_preserves_program_codes_and_rendering_after_reopen", "crates/ui-egui/tests/editing.rs::cropped_images_do_not_intercept_text_and_stay_inside_each_page", "crates/automation/tests/automation.rs::clipped_image_bounds_and_text_edit_save_reopen_through_tools", "crates/edit/src/tests.rs::mixed_styles_and_matrix_sizes_form_visual_regions_without_merging_columns", "crates/edit/src/tests.rs::rich_region_edits_preserve_styles_positions_and_delete_all_runs_after_reopen", "crates/ui-egui/tests/editing.rs::one_editor_contains_mixed_styles_and_visual_rows", "crates/ui-egui/tests/editing.rs::inline_editor_preserves_source_font_and_previews_live_bounds", "crates/fonts/src/pdf.rs::mac_subset_cmap_uses_pdf_unicode_without_changing_source_program", "crates/automation/tests/automation.rs::mixed_visual_region_edit_preview_save_reopen_and_undo_through_tools", "crates/ui-egui/tests/ui.rs::the_edit_tab_turns_on_edit_text_and_images"]
+notes = "The Edit tab turns Edit text & images on at once, as in Acrobat (leaving the tab puts the tool down and applies an edit in progress); click a paragraph box and retype it in place (font reused or Helvetica substituted, colour and spacing kept, rewrapped); a page's /Contents pieces are parsed joined, so a line whose operands and operator sit in different pieces is listed and edited (lines and paragraphs still don't join across pieces; Edit image still parses each piece alone); drag a box to move it or its right-edge handle to rewrap it (edit.text-move-resize); per-character formatting changes are next Since #1116: mixed-style visual regions retain source rows, subset encodings, colour and baseline anchors in one textless-background editor. Explicit paragraph/heading scopes constrain grouping; compatible graphics planes permit cross-stream regions. Full matching document fonts complete absent subset glyphs; installed/file selection, TrueType/OpenType-CFF embedding and disjoint UTF-8 range styles have save/reopen coverage. Single-face OpenType shaping/bidi retains logical text through ToUnicode/ActualText. Legacy non-SFNT preview, mixed-font/style contextual runs, full structure-tree preservation and author intent in untagged PDFs remain limited; see docs/editing-existing-text.md"
 
 [[feature]]
 id = "edit.text-reflow"
@@ -1986,8 +2010,8 @@ milestone = "M7"
 status = "shipped"
 commands = ["edit.text"]
 tools = ["page_add_text", "content_update"]
-evidence = ["crates/ui-egui/tests/content.rs::typing_moving_styling_and_deleting_added_content", "crates/ui-egui/tests/content.rs::clicking_elsewhere_keeps_the_text_and_starts_a_new_box", "crates/automation/tests/automation.rs::adding_content_through_tools", "crates/edit/src/tests.rs::added_text_and_images_are_page_content_that_stays_editable", "crates/engine/src/tests.rs::added_text_and_images_render_and_stay_editable", "crates/edit/src/tests.rs::added_arabic_text_is_shaped_in_display_order_and_stays_searchable", "crates/automation/tests/automation.rs::thai_text_through_tools_saves_reopens_extracts_and_renders", "crates/ui-egui/tests/content.rs::typing_thai_text_keeps_marks_and_commits_to_page", "crates/automation/tests/automation.rs::added_arabic_text_keeps_copy_search_and_editor_order_after_retyping_and_reopen"]
-notes = "page content, editable later (retype, move, restyle); standard fonts, Windows-1252 text. Arabic text is shaped with the craft-fonts Arab face (Type 3 outlines with ToUnicode) and laid out in bidirectional display order; per-line ActualText keeps copy, search and editor text in typing order through retyping and save/reopen; it is drawn regular whatever the bold/italic setting, Hebrew and other right-to-left scripts are not covered, and typing in the box is still left to right (misc.rtl-ui). Thai Add Text uses the craft-fonts Thai face, with shaped clusters and ToUnicode; Thai is regular style, wrapping preserves clusters but is not dictionary-based, and forms/Fill and Sign are not covered by this change. Each click on the page keeps the box being typed and starts a new one; Done and Discard beside the box"
+evidence = ["crates/ui-egui/tests/content.rs::typing_moving_styling_and_deleting_added_content", "crates/ui-egui/tests/content.rs::clicking_elsewhere_keeps_the_text_and_starts_a_new_box", "crates/automation/tests/automation.rs::adding_content_through_tools", "crates/edit/src/tests.rs::added_text_and_images_are_page_content_that_stays_editable", "crates/engine/src/tests.rs::added_text_and_images_render_and_stay_editable", "crates/edit/src/tests.rs::added_arabic_text_is_shaped_in_display_order_and_stays_searchable", "crates/automation/tests/automation.rs::thai_text_through_tools_saves_reopens_extracts_and_renders", "crates/ui-egui/tests/content.rs::typing_thai_text_keeps_marks_and_commits_to_page", "crates/automation/tests/automation.rs::added_arabic_text_keeps_copy_search_and_editor_order_after_retyping_and_reopen", "crates/edit/src/tests.rs::added_hebrew_text_is_drawn_right_to_left_and_stays_searchable", "crates/automation/tests/automation.rs::hebrew_text_through_tools_saves_reopens_extracts_and_renders"]
+notes = "page content, editable later (retype, move, restyle); standard fonts, Windows-1252 text. Arabic text is shaped with the craft-fonts Arab face (Type 3 outlines with ToUnicode) and laid out in bidirectional display order; per-line ActualText keeps copy, search and editor text in typing order through retyping and save/reopen; it is drawn regular whatever the bold/italic setting, and typing in the box is still left to right (misc.rtl-ui). Hebrew (#128) takes the same path with the craft-fonts Hebr face (Noto Sans Hebrew): right-to-left display order, points and cantillation kept on their letter as one glyph, ToUnicode and per-line ActualText; regular style only, and right-to-left scripts other than Arabic and Hebrew are not covered. Thai Add Text uses the craft-fonts Thai face, with shaped clusters and ToUnicode; Thai is regular style, wrapping preserves clusters but is not dictionary-based, and forms/Fill and Sign are not covered by this change. Each click on the page keeps the box being typed and starts a new one; Done and Discard beside the box"
 
 [[feature]]
 id = "edit.find-replace"
@@ -2067,11 +2091,11 @@ title = "Crop an image"
 area = "C"
 tier = "P0"
 milestone = "M7"
-status = "partial"
+status = "shipped"
 commands = ["edit.image"]
-tools = ["content_update"]
-evidence = ["crates/engine/src/tests.rs::added_images_rotate_flip_and_crop_as_drawn", "crates/automation/tests/automation.rs::adding_content_through_tools"]
-notes = "for added images: trim each side, clipped"
+tools = ["content_update", "image_edit"]
+evidence = ["crates/ui-egui/tests/editing.rs::cropping_a_picture_with_its_handles", "crates/engine/src/tests.rs::cropping_an_existing_image_clips_it_and_moves_with_it", "crates/automation/tests/automation.rs::editing_page_images_through_tools", "crates/engine/src/tests.rs::added_images_rotate_flip_and_crop_as_drawn", "crates/automation/tests/automation.rs::adding_content_through_tools"]
+notes = "Existing page images: right-click ▸ Crop Image puts the picture in crop mode: its eight handles trim (the inside pans), the part that will go is dimmed, Enter or Done applies, Esc or Cancel leaves it; Remove Crop shows the whole picture again. The pixels stay where they are (a clipping path inside the picture's own scope, so a later move or resize carries it along; cropping again replaces the earlier crop, so it can grow back); image_edit crop. Added images: trim each side by percent in Edit image, clipped. Not yet: cropping grouped Form artwork by handles is allowed the same way (it is a clip), but a shared clip of the original file is not changed."
 
 [[feature]]
 id = "edit.image-rotate-flip"
@@ -2596,8 +2620,8 @@ milestone = "M4"
 status = "shipped"
 commands = ["page.organize"]
 tools = []
-evidence = ["crates/ui-egui/tests/editing.rs::shift_click_selects_a_range_and_moves_it", "crates/ui-egui/tests/editing.rs::organize_tool_opens_the_overview_directly_and_can_be_reentered", "crates/ui-egui/tests/control.rs::organize_overview_is_reachable_through_the_control_channel"]
-notes = "Opening the Organize pages tool enters the overview directly. Hovered, focused and selected pages expose individual rotate/delete actions; the toolbar acts on the selection."
+evidence = ["crates/ui-egui/tests/editing.rs::shift_click_selects_a_range_and_moves_it", "crates/ui-egui/tests/editing.rs::organize_tool_opens_the_overview_directly_and_can_be_reentered", "crates/ui-egui/tests/editing.rs::organize_opens_on_the_current_page", "crates/ui-egui/tests/control.rs::organize_overview_is_reachable_through_the_control_channel", "crates/ui-egui/tests/editing.rs::organize_panel_comes_with_the_grid_and_closes_it", "crates/ui-egui/tests/editing.rs::leaving_organize_goes_back_to_the_workspace_panel"]
+notes = "Opening the Organize pages tool enters the overview directly, on the current page: selected and scrolled into view (#1910). Hovered, focused and selected pages expose individual rotate/delete actions; the toolbar acts on the selection. The left panel is laid out as Acrobat's Organize pages panel: Pages selected (typed ranges, or All, Even, Odd, Landscape or Portrait pages; empty, it shows the current page), rotate, delete, extract, Insert (a blank page, pages from a file, duplicates), Replace, Split, Bates numbering, Set page boxes, Crop pages, Print pages and Page labels. Closing it, by its Close, the grid's Close or opening a page, returns to the workspace's own panel (Edit, Convert, E-Sign or All tools). Page transitions, Page templates and Page properties are listed but planned."
 
 [[feature]]
 id = "organize.multi-select-pages"
@@ -2692,8 +2716,8 @@ milestone = "M4"
 status = "shipped"
 commands = ["page.insert"]
 tools = ["page_insert_file"]
-evidence = ["crates/organize/src/tests.rs::inserting_pages_from_another_file_is_an_incremental_edit", "crates/ui-egui/tests/editing.rs::inserting_a_file_goes_after_the_selection_and_undoes", "crates/ui-egui/tests/editing.rs::plus_between_pages_inserts_picked_files_there_in_order"]
-notes = "After the selection (toolbar, File menu) or at any gap of the page grid (a + between pages and at both ends); several files at once, in order; images and .txt files are converted first; the inserted pages end up selected. The page_insert_file tool takes PDFs only. Missing: choosing which pages of the file to insert in the app."
+evidence = ["crates/organize/src/tests.rs::inserting_pages_from_another_file_is_an_incremental_edit", "crates/organize/src/tests.rs::inserting_a_file_brings_its_bookmarks_under_one_named_after_it", "crates/automation/tests/automation.rs::inserting_a_file_brings_its_bookmarks", "crates/ui-egui/tests/editing.rs::inserting_a_file_goes_after_the_selection_and_undoes", "crates/ui-egui/tests/editing.rs::plus_between_pages_inserts_picked_files_there_in_order"]
+notes = "After the selection (toolbar, File menu) or at any gap of the page grid (a + between pages and at both ends); several files at once, in order; images and .txt files are converted first; the inserted pages end up selected. The file's bookmarks come along, collapsed under one named after the file, placed among the document's bookmarks where the pages went (as Combine does per file). The page_insert_file tool takes PDFs only. Missing: choosing which pages of the file to insert in the app; the file's tags (structure tree) are not merged."
 
 [[feature]]
 id = "organize.insert-from-clipboard"
@@ -3169,11 +3193,11 @@ title = "Page transitions"
 area = "D"
 tier = "P2"
 milestone = "M4"
-status = "planned"
+status = "partial"
 commands = []
-tools = []
-evidence = []
-notes = ""
+tools = ["doc_info", "page_transition_set"]
+evidence = ["crates/render/src/inspect.rs::page_transitions_and_display_times_are_read", "crates/automation/tests/automation.rs::doc_info_lists_page_transitions_and_display_times", "crates/organize/src/tests.rs::page_transitions_are_set_removed_and_checked", "crates/automation/tests/automation.rs::page_transitions_are_set_and_removed_through_the_tools"]
+notes = "Read and set, not played: each page's /Trans (style, duration, dimension, motion, direction, Fly scale and backdrop) and /Dur display time are read with the spec's defaults and listed by doc_info (DocInfo::transitions); page_transition_set (Edit::SetTransition, one undo step) writes or removes them on chosen pages with the values checked first. Not yet: playing them in full screen, auto-advancing on /Dur, and the Page Transitions dialog"
 
 [[feature]]
 id = "organize.page-tab-order"
@@ -3316,8 +3340,8 @@ milestone = "M4"
 status = "shipped"
 commands = ["bookmark.from_structure"]
 tools = ["bookmark_from_structure"]
-evidence = ["crates/a11y/src/tests.rs::headings_are_found_with_their_levels_titles_and_pages", "crates/organize/src/tests.rs::a_bookmark_tree_nests_entries_by_level_under_a_new_first_bookmark", "crates/engine/src/tests.rs::bookmarks_from_structure_nest_the_headings_and_undo", "crates/automation/tests/automation.rs::bookmarks_from_structure_through_tools", "crates/ui-egui/tests/bookmarks.rs::new_bookmarks_from_structure_nest_the_tagged_headings"]
-notes = "Bookmark options ▸ New bookmarks from structure: tagged headings (H1–H6 through the role map; a plain H takes its Sect/Part/Art nesting) become bookmarks nested by level under a new first \"Untitled\" bookmark, each linked to its element (/SE). Titles come from /ActualText, the marked text drawn directly on the page (not inside Form XObjects), /Alt or /T. Not yet: Acrobat's choice of element types (only headings), and destinations go to the heading's page rather than its position on it"
+evidence = ["crates/a11y/src/tests.rs::headings_are_found_with_their_levels_titles_and_pages", "crates/a11y/src/tests.rs::headings_drawn_glyph_by_glyph_keep_their_words", "crates/a11y/src/tests.rs::horizontally_scaled_wrapped_heading_keeps_a_space_between_lines", "crates/organize/src/tests.rs::a_bookmark_tree_nests_entries_by_level_under_a_new_first_bookmark", "crates/engine/src/tests.rs::bookmarks_from_structure_nest_the_headings_and_undo", "crates/automation/tests/automation.rs::bookmarks_from_structure_through_tools", "crates/ui-egui/tests/bookmarks.rs::new_bookmarks_from_structure_nest_the_tagged_headings"]
+notes = "Bookmark options ▸ New bookmarks from structure: tagged headings (H1–H6 through the role map; a plain H takes its Sect/Part/Art nesting) become bookmarks nested by level under a new first \"Untitled\" bookmark, each linked to its element (/SE). Titles come from /ActualText, the marked text drawn directly on the page (not inside Form XObjects; words split where the glyphs are apart, so text placed glyph by glyph, as Chromium writes it, keeps its words; vertical line breaks use the absolute font size independently of Tz), /Alt or /T. Not yet: Acrobat's choice of element types (only headings), and destinations go to the heading's page rather than its position on it"
 
 [[feature]]
 id = "organize.attachments-add"
@@ -3448,8 +3472,8 @@ milestone = "M4"
 status = "shipped"
 commands = ["file.properties"]
 tools = ["doc_initial_view"]
-evidence = ["crates/organize/src/tests.rs::initial_view_round_trips_and_keeps_scripts", "crates/ui-egui/tests/viewer.rs::initial_view_is_edited_and_honoured_on_open", "crates/automation/tests/automation.rs::initial_view_through_tools"]
-notes = "navigation panel, layout, magnification, page, window and interface options; honoured on open; script open actions kept"
+evidence = ["crates/ui-egui/tests/ui.rs::a_document_asking_for_full_screen_is_asked_about_first", "crates/organize/src/tests.rs::initial_view_round_trips_and_keeps_scripts", "crates/ui-egui/tests/viewer.rs::initial_view_is_edited_and_honoured_on_open", "crates/automation/tests/automation.rs::initial_view_through_tools"]
+notes = "navigation panel, layout, magnification, page, window and interface options; honoured on open; script open actions kept. Open in Full Screen mode (/PageMode /FullScreen) asks first (Full Screen / Not now), as Acrobat does, instead of taking the screen. Missing: Acrobat's Full Screen preference to turn that alert off and its \"remember my choice for this document\" (misc.prefs-full-screen)"
 
 [[feature]]
 id = "organize.custom-properties"
@@ -3524,8 +3548,8 @@ milestone = "M3"
 status = "shipped"
 commands = ["comment.list"]
 tools = ["comment_list"]
-evidence = ["crates/ui-egui/tests/ui.rs::opening_a_pdf_shows_comments_and_bookmarks", "crates/ui-egui/tests/comments.rs::the_panel_posts_comments_and_replies"]
-notes = "cards grouped by page with replies, status badges, selection, reply box and an Add a comment box"
+evidence = ["crates/ui-egui/tests/ui.rs::opening_a_pdf_shows_comments_and_bookmarks", "crates/ui-egui/tests/comments.rs::the_panel_posts_comments_and_replies", "crates/ui-egui/tests/comments.rs::page_groups_collapse_and_expand"]
+notes = "cards grouped by page with replies, status badges, selection, reply box and an Add a comment box; page groups fold and unfold from their chevron or with Collapse/Expand all pages in the panel's \"…\" menu (a comment selected on a folded page opens its group). Groups by author, type or colour don't fold yet"
 
 [[feature]]
 id = "comment.appearance-generation"
@@ -3548,8 +3572,8 @@ milestone = "M5"
 status = "shipped"
 commands = ["comment.note"]
 tools = ["comment_add"]
-evidence = ["crates/ui-egui/tests/comments.rs::sticky_note_composer_posts_and_returns_to_select", "crates/annot/src/tests.rs::every_tool_creates_a_drawable_comment"]
-notes = "our own Comment/Note icon drawings, with a pop-up"
+evidence = ["crates/ui-egui/tests/comments.rs::sticky_note_composer_posts_and_returns_to_select", "crates/ui-egui/tests/comments.rs::the_comment_composer_shortcut_only_posts_the_focused_editor", "crates/annot/src/tests.rs::every_tool_creates_a_drawable_comment"]
+notes = "our own Comment/Note icon drawings, with a pop-up; Ctrl+Enter (also Command+Enter) posts from the focused editor, Shift+Enter adds a newline"
 
 [[feature]]
 id = "comment.highlight"
@@ -3716,8 +3740,8 @@ milestone = "M5"
 status = "shipped"
 commands = ["comment.square"]
 tools = ["comment_add", "comment_edit"]
-evidence = ["crates/ui-egui/tests/comments.rs::shapes_and_ink_are_drawn_by_dragging", "crates/annot/src/tests.rs::restyle_and_resize_redraw_the_appearance", "crates/annot/src/tests.rs::shapes_can_be_filled_and_unfilled", "crates/ui-egui/tests/comments.rs::shapes_take_a_fill_colour_from_the_quick_bar_and_properties"]
-notes = "resize with the 8 handles; fill colour or no fill (#686) from the quick bar, Properties and comment_edit `fill`; fill swatches are the comment palette only (no custom colour picker yet)"
+evidence = ["crates/ui-egui/tests/comments.rs::shapes_and_ink_are_drawn_by_dragging", "crates/annot/src/tests.rs::restyle_and_resize_redraw_the_appearance", "crates/annot/src/tests.rs::shapes_can_be_filled_and_unfilled", "crates/ui-egui/tests/comments.rs::shapes_take_a_fill_colour_from_the_quick_bar_and_properties", "crates/ui-egui/tests/comments.rs::a_shape_just_drawn_resizes_from_its_handles_without_the_select_tool"]
+notes = "resize with the 8 handles, straight after drawing with the tool still on (#2338); fill colour or no fill (#686) from the quick bar, Properties and comment_edit `fill`; fill swatches are the comment palette only (no custom colour picker yet)"
 
 [[feature]]
 id = "comment.oval"
@@ -3836,8 +3860,8 @@ milestone = "M5"
 status = "shipped"
 commands = ["comment.list"]
 tools = ["comment_edit"]
-evidence = ["crates/ui-egui/tests/comments.rs::comment_properties_change_appearance_and_author", "crates/annot/src/tests.rs::author_subject_and_note_icon_change", "crates/ui-egui/tests/comments.rs::shapes_take_a_fill_colour_from_the_quick_bar_and_properties"]
-notes = "Appearance (colour, fill colour for rectangles/ovals/polygons, opacity, thickness, note icon), General (author, subject), Review History"
+evidence = ["crates/ui-egui/tests/comments.rs::comment_properties_change_appearance_and_author", "crates/annot/src/tests.rs::author_subject_and_note_icon_change", "crates/ui-egui/tests/comments.rs::shapes_take_a_fill_colour_from_the_quick_bar_and_properties", "crates/ui-egui/tests/comments.rs::text_box_properties_change_the_font_size", "crates/annot/src/tests.rs::text_box_font_size_changes_the_da_and_grows_the_box", "crates/automation/tests/automation.rs::text_box_font_size_through_the_tool"]
+notes = "Appearance (colour, fill colour for rectangles/ovals/polygons, opacity, thickness, note icon, font size of text boxes, typewriter text and callouts: 1-400 pt, written to /DA and the rich-text strings, the box grows to fit and never shrinks; comment_edit font_size), General (author, subject), Review History. Still missing: font family, bold/italic, alignment and per-run formatting of text boxes; the quick bar has no font size for new text boxes (they start at 12 pt, callouts 10 pt)"
 
 [[feature]]
 id = "comment.properties-bar"
@@ -3872,8 +3896,8 @@ milestone = "M5"
 status = "shipped"
 commands = ["comment.list"]
 tools = []
-evidence = ["crates/ui-egui/tests/comments.rs::make_current_properties_default"]
-notes = "colour, opacity and line width become the tool's defaults (canvas and Comments panel menus) and survive a restart: the per-tool styles are persisted with the settings and restored through their clamping setters (#340)"
+evidence = ["crates/ui-egui/tests/comments.rs::make_current_properties_default", "crates/ui-egui/tests/comments.rs::properties_dialog_makes_the_strikethrough_colour_default"]
+notes = "colour, opacity and line width become the tool's defaults (canvas and Comments panel menus, and Acrobat's Make Properties Default box in Comment Properties, applied on OK with the edited look) and survive a restart: the per-tool styles are persisted with the settings and restored through their clamping setters (#340)"
 
 [[feature]]
 id = "comment.author-identity"
@@ -3896,8 +3920,8 @@ milestone = "M5"
 status = "shipped"
 commands = ["comment.list"]
 tools = ["comment_reply"]
-evidence = ["crates/ui-egui/tests/comments.rs::the_panel_posts_comments_and_replies", "crates/annot/src/tests.rs::replies_and_status_thread_onto_the_parent"]
-notes = ""
+evidence = ["crates/ui-egui/tests/comments.rs::the_panel_posts_comments_and_replies", "crates/ui-egui/tests/comments.rs::ctrl_enter_posts_a_reply_and_shift_enter_adds_a_line", "crates/annot/src/tests.rs::replies_and_status_thread_onto_the_parent"]
+notes = "multiline reply field: Enter or Ctrl+Enter (also Command+Enter) posts, Shift+Enter adds a newline; empty replies are not posted"
 
 [[feature]]
 id = "comment.set-status"
@@ -3944,8 +3968,8 @@ milestone = "M5"
 status = "shipped"
 commands = ["comment.list"]
 tools = ["comment_edit"]
-evidence = ["crates/annot/src/tests.rs::text_box_text_and_colour_changes_are_drawn", "crates/annot/src/tests.rs::editing_a_text_box_refits_its_rectangle", "crates/automation/tests/automation.rs::comments_through_tools"]
-notes = "double-click a comment or card, or Edit in the menus; a text box's rectangle follows the new text (wrap width and top edge stay, the height fits the wrapped lines)"
+evidence = ["crates/annot/src/tests.rs::text_box_text_and_colour_changes_are_drawn", "crates/annot/src/tests.rs::editing_a_text_box_refits_its_rectangle", "crates/automation/tests/automation.rs::comments_through_tools", "crates/ui-egui/tests/comments.rs::ctrl_enter_posts_a_highlight_comment_and_shift_enter_adds_a_line"]
+notes = "double-click a comment or card, or Edit in the menus; Ctrl+Enter (also Command+Enter) saves text in the focused comment editor, Shift+Enter adds a newline; a text box's rectangle follows the new text (wrap width and top edge stay, the height fits the wrapped lines)"
 
 [[feature]]
 id = "comment.copy-comment-text"
@@ -4184,8 +4208,8 @@ milestone = "M5"
 status = "shipped"
 commands = ["comment.flatten"]
 tools = ["doc_flatten"]
-evidence = ["crates/edit/src/tests.rs::flattening_draws_appearances_into_the_page_and_removes_the_comments", "crates/engine/src/tests.rs::flattening_keeps_the_look_and_drops_the_objects", "crates/automation/tests/automation.rs::flattening_through_tools"]
-notes = "appearances become page content; pop-ups and replies removed"
+evidence = ["crates/edit/src/tests.rs::flattening_draws_appearances_into_the_page_and_removes_the_comments", "crates/edit/src/tests.rs::flattening_keeps_an_undrawn_reply_to_a_flattened_comment", "crates/engine/src/tests.rs::flattening_keeps_the_look_and_drops_the_objects", "crates/automation/tests/automation.rs::flattening_through_tools"]
+notes = "appearances become page content; pop-ups and replies removed; a comment or reply whose appearance cannot be drawn (a cloudy border, an unsupported subtype) stays as it is instead of being deleted"
 
 [[feature]]
 id = "comment.migrate"
@@ -4392,8 +4416,8 @@ milestone = "M6"
 status = "shipped"
 commands = ["form.fields"]
 tools = ["form_fill", "form_fields"]
-evidence = ["crates/ui-egui/tests/forms.rs::typing_into_a_text_field_and_tabbing_on", "crates/forms/src/tests.rs::text_fields_get_new_appearances", "crates/engine/src/tests.rs::filling_a_form_shows_saves_and_undoes", "crates/automation/tests/automation.rs::orphan_form_fields_through_tools"]
-notes = "in-place editor; Enter or clicking away commits, Escape cancels; no format/keystroke JavaScript yet (M6.4)"
+evidence = ["crates/ui-egui/tests/forms.rs::typing_into_a_text_field_and_tabbing_on", "crates/ui-egui/tests/forms.rs::auto_size_fields_shrink_and_wrap_typed_text_to_fit_their_box", "crates/forms/src/tests.rs::text_fields_get_new_appearances", "crates/engine/src/tests.rs::filling_a_form_shows_saves_and_undoes", "crates/automation/tests/automation.rs::orphan_form_fields_through_tools", "crates/forms/src/tests.rs::fields_sharing_a_name_take_the_same_value"]
+notes = "in-place editor; Enter or clicking away commits, Escape cancels; auto-size (0 Tf) fields shrink, and multiline ones wrap, the text being typed to fit the box, on screen as on the page (the screen measures in the interface font, so its size can be a little smaller than the page's Helvetica fit); fixed sizes are kept and clip, as in Acrobat; no format/keystroke JavaScript yet (M6.4)"
 
 [[feature]]
 id = "form.fill-checkbox-radio"
@@ -4452,8 +4476,8 @@ milestone = "M6"
 status = "partial"
 commands = ["form.fields"]
 tools = ["form_fill", "form_set_props"]
-evidence = ["crates/forms/src/tests.rs::text_fields_get_new_appearances", "crates/forms/src/tests.rs::choices_accept_exports_or_display_text", "crates/forms/src/tests.rs::rotated_fields_draw_in_their_quadrant", "crates/engine/tests/form_rotation.rs::a_rotated_field_draws_along_the_vertical_edge", "crates/automation/tests/automation.rs::rotating_a_field_through_tools", "crates/ui-egui/tests/prepare.rs::position_tab_rotates_a_field"]
-notes = "auto-size, comb, multiline, password, quadding, /MK colours and /MK /R rotation (0, 90, 180, 270); approximate Helvetica metrics"
+evidence = ["crates/forms/src/tests.rs::text_fields_get_new_appearances", "crates/forms/src/tests.rs::auto_text_size_fits_single_and_multiline_text", "crates/forms/src/tests.rs::choices_accept_exports_or_display_text", "crates/forms/src/tests.rs::rotated_fields_draw_in_their_quadrant", "crates/engine/tests/form_rotation.rs::a_rotated_field_draws_along_the_vertical_edge", "crates/automation/tests/automation.rs::rotating_a_field_through_tools", "crates/ui-egui/tests/prepare.rs::position_tab_rotates_a_field", "crates/ui-egui/tests/prepare.rs::dropdown_alignment_is_editable_and_preserved", "crates/ui-egui/tests/prepare.rs::list_box_alignment_is_editable_and_preserved"]
+notes = "auto-size, comb, multiline, password, quadding (text, dropdown and list-box Options controls), /MK colours and /MK /R rotation (0, 90, 180, 270); approximate Helvetica metrics"
 
 [[feature]]
 id = "form.rich-text-fields"
@@ -4656,8 +4680,8 @@ milestone = "M6"
 status = "shipped"
 commands = ["form.import_data"]
 tools = ["doc_import_data"]
-evidence = ["crates/xfdf/src/tests.rs::xfdf_round_trips_comments_and_values", "crates/xfdf/src/tests.rs::fdf_round_trips_values_and_comments", "crates/automation/tests/automation.rs::comments_and_form_data_travel_as_xfdf_fdf_and_text"]
-notes = "XFDF, FDF; values go through formats and validation; read-only fields take data; XFA forms also take XDP/XML data files (form.xfa-data)"
+evidence = ["crates/xfdf/src/tests.rs::xfdf_import_keeps_text_around_xml_comments_and_instructions", "crates/xfdf/src/tests.rs::xfdf_round_trips_comments_and_values", "crates/xfdf/src/tests.rs::fdf_round_trips_values_and_comments", "crates/automation/tests/automation.rs::comments_and_form_data_travel_as_xfdf_fdf_and_text"]
+notes = "XFDF, FDF; XFDF text survives XML comments and processing instructions; values go through formats and validation; read-only fields take data; XFA forms also take XDP/XML data files (form.xfa-data)"
 
 [[feature]]
 id = "form.export-data"
@@ -4704,8 +4728,8 @@ milestone = "M6"
 status = "shipped"
 commands = ["form.flatten"]
 tools = ["doc_flatten"]
-evidence = ["crates/edit/src/tests.rs::flattening_draws_appearances_into_the_page_and_removes_the_comments", "crates/engine/src/tests.rs::flattening_keeps_the_look_and_drops_the_objects", "crates/automation/tests/automation.rs::flattening_through_tools"]
-notes = "widgets drawn into content and pruned from the field tree"
+evidence = ["crates/edit/src/tests.rs::flattening_draws_appearances_into_the_page_and_removes_the_comments", "crates/edit/src/tests.rs::flattening_keeps_a_valued_widget_it_cannot_draw", "crates/engine/src/tests.rs::flattening_keeps_the_look_and_drops_the_objects", "crates/automation/tests/automation.rs::flattening_through_tools"]
+notes = "widgets drawn into content and pruned from the field tree; a widget with no appearance to draw (none stored, or none for its selected state) stays a live field rather than losing its value, so a form with such fields is not fully flattened — Acrobat regenerates appearances first, which PdfCraft does not yet do here"
 
 [[feature]]
 id = "form.prepare-form-mode"
@@ -4716,8 +4740,8 @@ milestone = "M6"
 status = "shipped"
 commands = ["form.prepare"]
 tools = ["form_add_field", "form_set_props", "form_delete_field"]
-evidence = ["crates/ui-egui/tests/prepare.rs::placing_moving_editing_and_deleting_a_field", "crates/ui-egui/tests/prepare.rs::deleting_several_selected_fields_and_detecting_fields_from_the_panel", "crates/engine/src/tests.rs::preparing_a_form_adds_renames_and_deletes_fields", "crates/ui-egui/tests/ui_group/bulk_fields.rs::shared_properties_preserve_mixed_values_and_undo_the_whole_change", "crates/ui-egui/tests/ui_group/bulk_fields.rs::select_all_in_prepare_a_form_selects_only_the_current_pages_fields", "crates/ui-egui/tests/ui_group/bulk_fields.rs::dragging_an_empty_page_area_selects_fields_without_moving_them"]
-notes = "fields shown with blue fill and name tags; select, move, resize by corners, Delete (every selected field, one undo step); field tools return to Select after one field. Shared General, Appearance and applicable Options edits are atomic and opt-in; Ctrl/Command+A selects the current page, rectangle and panel selection are supported. Names, positions, choices/defaults and script tabs remain individual GUI edits"
+evidence = ["crates/ui-egui/tests/prepare.rs::placing_moving_editing_and_deleting_a_field", "crates/ui-egui/src/prepare.rs::corner_drags_stretch_freely_and_keep_proportions_with_shift", "crates/ui-egui/tests/prepare.rs::deleting_several_selected_fields_and_detecting_fields_from_the_panel", "crates/engine/src/tests.rs::preparing_a_form_adds_renames_and_deletes_fields", "crates/ui-egui/tests/ui_group/bulk_fields.rs::shared_properties_preserve_mixed_values_and_undo_the_whole_change", "crates/ui-egui/tests/ui_group/bulk_fields.rs::select_all_in_prepare_a_form_selects_only_the_current_pages_fields", "crates/ui-egui/tests/ui_group/bulk_fields.rs::dragging_an_empty_page_area_selects_fields_without_moving_them"]
+notes = "fields shown with blue fill and name tags; select, move, resize by corners (Shift keeps the field's proportions, #2199), Delete (every selected field, one undo step); field tools return to Select after one field. Shared General, Appearance and applicable Options edits are atomic and opt-in; Ctrl/Command+A selects the current page, rectangle and panel selection are supported. Names, positions, choices/defaults and script tabs remain individual GUI edits"
 
 [[feature]]
 id = "form.add-text-field"
@@ -5064,8 +5088,8 @@ milestone = "M6"
 status = "partial"
 commands = ["form.detect", "form.prepare"]
 tools = ["form_detect_fields"]
-evidence = ["crates/forms/src/tests.rs::detection_finds_blanks_rules_boxes_and_names_them", "crates/engine/src/tests.rs::detecting_fields_on_a_printed_form", "crates/automation/tests/automation.rs::detecting_form_fields_through_tools", "crates/ui-egui/tests/javascript.rs::prepare_a_form_detects_fields_on_a_paper_form", "crates/ui-egui/tests/prepare.rs::deleting_several_selected_fields_and_detecting_fields_from_the_panel"]
-notes = "Underscore runs, rules, empty boxes and small squares (check boxes); runs when Prepare a form starts on a document without fields, and from Prepare a form ▸ Detect form fields at any time (existing fields are skipped). Not yet: comb boxes, tables of cells, scanned forms (needs OCR first), radio groups."
+evidence = ["crates/forms/src/tests.rs::detection_finds_blanks_rules_boxes_and_names_them", "crates/engine/src/tests.rs::detecting_fields_on_a_printed_form", "crates/engine/src/tests.rs::detecting_fields_on_a_scanned_form", "crates/forms/src/detect/raster.rs::a_scanned_form_gives_its_rules_boxes_and_check_boxes", "crates/forms/src/detect/raster.rs::noise_and_uneven_paper_do_not_hide_the_lines", "crates/automation/tests/automation.rs::detecting_form_fields_through_tools", "crates/ui-egui/tests/javascript.rs::prepare_a_form_detects_fields_on_a_paper_form", "crates/ui-egui/tests/prepare.rs::deleting_several_selected_fields_and_detecting_fields_from_the_panel"]
+notes = "Underscore runs, rules, empty boxes and small squares (check boxes); runs when Prepare a form starts on a document without fields, and from Prepare a form ▸ Detect form fields at any time (existing fields are skipped). Scanned pages (an image covers at least half the page and the content draws no lines) are rendered and their rules, boxes and check boxes read from the pixels; a box with a small printed label gets a field in its empty part. Tested on synthetic scans only: straight, stored sideways with /Rotate 90 (fields get /MK /R so typing reads upright), noisy, and 1 degree askew (fields stay inside their boxes but lose up to the skew in height). Labels come from the text layer or, when the OCR models are installed, from text recognition (Latin without accents, so German labels with umlauts make poorer names); without either, fields get default names (Text1, Check Box1). Recognition runs synchronously, about a second per scanned page. Not yet: comb boxes, dotted leader lines, tables of cells as such, deskewing, radio groups."
 
 [[feature]]
 id = "form.auto-name-fields"
@@ -5229,11 +5253,11 @@ title = "Flatten XFA forms"
 area = "F"
 tier = "P2"
 milestone = "M12"
-status = "planned"
-commands = []
-tools = []
-evidence = []
-notes = ""
+status = "shipped"
+commands = ["form.flatten"]
+tools = ["doc_flatten", "xfa_to_static"]
+evidence = ["crates/xfa/src/tests.rs::stripping_takes_the_xfa_out_and_leaves_an_ordinary_document", "crates/engine/src/tests.rs::flattening_an_xfa_form_bakes_its_pages_and_takes_the_xfa_out", "crates/engine/src/tests.rs::an_xfa_form_converts_to_a_static_form_that_keeps_its_fields", "crates/automation/tests/automation.rs::xfa_forms_flatten_and_convert_to_static_through_tools"]
+notes = "Flatten form fields on a laid-out XFA form bakes the fields into the pages and takes the XFA out (packets, /NeedsRendering, PdfCraft's private keys), so every viewer, Adobe's included, shows the baked pages rather than laying the form out again from the template. xfa_to_static (tool and engine edit) keeps the laid-out pages and the fields with their values as an ordinary AcroForm whose scripts no longer run. Both undoable until saved. Missing: a menu entry for the conversion (the tool and the MCP server have it); flattening keeps the layout as PdfCraft laid it out, not as Acrobat would (form.xfa-dynamic)"
 
 [[feature]]
 id = "form.fill-sign-text"
@@ -5244,8 +5268,8 @@ milestone = "M5"
 status = "shipped"
 commands = ["sign.fill.text"]
 tools = ["fill_sign_add"]
-evidence = ["crates/ui-egui/tests/fill_sign.rs::text_marks_and_date", "crates/annot/src/tests.rs::fill_and_sign_items_are_drawn", "crates/automation/tests/automation.rs::fill_and_sign_through_tools"]
-notes = "typewriter FreeText, 10 pt Helvetica"
+evidence = ["crates/ui-egui/tests/fill_sign.rs::text_marks_and_date", "crates/annot/src/tests.rs::fill_and_sign_items_are_drawn", "crates/automation/tests/automation.rs::fill_and_sign_through_tools", "crates/engine/src/tests.rs::typed_text_reads_across_as_displayed_on_rotated_pages"]
+notes = "typewriter FreeText, 10 pt Helvetica. Reads across as displayed on pages with /Rotate (sideways-stored scans): the box follows the displayed axes and the appearance is turned back (PdfCraft key /PCTextRotate); other apps that regenerate the appearance from /DA draw it unturned. A later page rotation does not re-turn it. Field detection does not work on scanned (image-only) forms yet"
 
 [[feature]]
 id = "form.fill-sign-marks"
@@ -5280,8 +5304,8 @@ milestone = "M5"
 status = "shipped"
 commands = ["sign.fill.signature", "sign.fill.initials", "sign.fill.signature.change", "sign.fill.initials.change", "sign.fill.signature.remove", "sign.fill.initials.remove"]
 tools = ["fill_sign_add", "comment_edit", "comment_image_preview"]
-evidence = ["crates/ui-egui/tests/fill_sign.rs::drawn_signatures_resize_from_their_corners", "crates/ui-egui/tests/fill_sign.rs::drawn_and_typed_signatures_stay_upright_on_rotated_pages", "crates/automation/tests/automation.rs::typed_signatures_stay_upright_on_rotated_pages", "crates/ui-egui/tests/fill_sign.rs::image_signature_corners_restore_original_aspect_after_edge_resize_and_reopen", "crates/ui-egui/src/comments.rs::proportional_corners_keep_the_opposite_anchor_and_edges_stretch_one_axis", "crates/ui-egui/tests/fill_sign.rs::image_signature_live_resize_and_move_preserve_background_and_hide_moving_handles", "crates/ui-egui/tests/fill_sign.rs::embedded_image_signature_live_gestures_follow_document_and_view_rotation", "crates/automation/tests/automation.rs::image_signature_preview_layers_are_read_only_and_survive_encrypted_save", "crates/engine/src/signature_image.rs::embedded_signature_preview_preserves_alpha_without_editing_the_document", "crates/engine/src/signature_image.rs::oversized_embedded_signature_preview_is_rejected_before_decoding", "crates/ui-egui/tests/fill_sign.rs::image_signature_preview_follows_pointer_at_page_size_with_zoom_and_rotation", "crates/ui-egui/tests/fill_sign.rs::image_signature_placement_selects_resize_handles_and_requires_reselecting_to_repeat", "crates/ui-egui/tests/fill_sign.rs::typed_signatures_and_initials", "crates/ui-egui/tests/fill_sign.rs::signing_draws_a_signature_once_and_places_it", "crates/ui-egui/tests/fill_sign.rs::changing_saved_signatures_and_initials_preserves_placed_marks", "crates/ui-egui/tests/fill_sign.rs::changing_drawn_signatures_can_be_cancelled_or_switched_to_type", "crates/ui-egui/tests/fill_sign.rs::saved_signature_cards_remove_and_add_without_changing_the_document", "crates/ui-egui/tests/fill_sign.rs::long_typed_names_fit_the_placed_signature_and_keep_every_outline", "crates/ui-egui/src/fill_sign.rs::long_signature_previews_have_clear_margins", "crates/ui-egui/tests/control.rs::saved_signature_can_be_changed_through_the_control_channel", "crates/fonts/src/script.rs::a_name_becomes_outlines", "crates/fonts/src/script.rs::long_names_keep_every_glyph_with_bounded_outline_work", "crates/automation/tests/automation.rs::fill_and_sign_through_tools", "crates/ui-egui/tests/fill_sign.rs::image_signatures_and_initials_can_be_imported_placed_and_remembered", "crates/ui-egui/tests/fill_sign.rs::image_import_cancel_clear_and_errors_preserve_saved_signatures", "crates/engine/src/signature_image.rs::image_signatures_preserve_alpha_and_fit_the_signature_box", "crates/engine/src/signature_image.rs::invalid_and_oversized_signature_images_are_rejected", "crates/engine/src/signature_image.rs::large_signature_images_are_scaled_down", "crates/engine/src/signature_image.rs::jpeg_signatures_are_normalized_to_png", "crates/engine/src/signature_image.rs::jpeg_signature_orientation_is_applied_before_preview_and_embedding", "crates/engine/src/signature_image.rs::very_wide_image_signatures_keep_the_requested_rectangle", "crates/automation/tests/automation.rs::image_signatures_through_tools_preserve_transparency_and_survive_save", "crates/ui-egui/tests/fill_sign.rs::fill_and_sign_tools_pick_up_placed_marks_to_move_and_resize_them", "crates/ui-egui/tests/fill_sign.rs::select_tool_picks_up_a_signature_over_a_form_field", "crates/ui-egui/tests/fill_sign.rs::scanned_signatures_are_framed_cleaned_adjusted_placed_and_remembered", "crates/ui-egui/tests/fill_sign.rs::scan_cancel_errors_and_stale_answers_preserve_saved_signatures", "crates/automation/tests/automation.rs::scanned_signatures_through_tools_drop_the_paper_and_report_bad_arguments", "crates/engine/src/signature_scan.rs::a_photo_is_scanned_into_a_trimmed_transparent_signature_in_its_ink_colour"]
-notes = "signature and initials, typed (Dancing Script outlines as filled paths, no font embedded), drawn or imported from local PNG/JPEG images; all three are placed upright and anchored as displayed on pages with /Rotate (#299); saved in settings with preview cards and add/change/remove controls; changes leave placed annotations untouched; images preserve alpha, aspect ratio and EXIF orientation, fit within 150 pt by 32 pt (24 pt for initials), and are normalized without source paths or metadata; image previews follow the pointer at placement size with zoom and rotation; signatures/initials place once then select the new annotation; while a Fill & Sign tool is active, marks already placed are picked up as with Select (hover shows the move cursor, a click selects, a drag moves, the selected mark's handles resize) and the tool places only away from them; embedded image signatures resize and move live, hiding the frame during movement and restoring it on release; corner handles preserve the original aspect ratio of the embedded image with the opposite corner anchored, while edge midpoint handles stretch width or height independently; cached background layers preserve page content and alpha, including reopened/encrypted documents; Escape cancels a gesture without committing; stamps resize through selection handles or comment_edit with their original appearance; native and web asynchronous pickers; fill_sign_add accepts path instead of text; image imports capped at 4 MiB, 32 megapixels and 8192 pixels per side, larger than 4 megapixels or 4096 pixels per side scaled down to fit (#1075); Scan tab (fill_sign_add scan/sensitivity headless): a phone photo of a signature on paper (PNG/JPEG within the same image limits, EXIF-oriented, kept at most 4 megapixels) is framed automatically (all words; table, sheet edge and dust ignored; a sideways signature turned upright), the frame can be moved, resized or redrawn and the photo turned in quarter turns, and an ink-sensitivity slider (0-100) controls how faint ink is kept; the paper is estimated by a morphological closing, so shadows and uneven light are removed, and the result is trimmed ink in its own colour on transparency, saved like an imported image. Still missing: perspective correction of a skewed sheet, live camera capture, keyboard control of the frame, and processing off the UI thread (bounded by the 4-megapixel working copy; quick 900 px previews while dragging)"
+evidence = ["crates/ui-egui/tests/fill_sign.rs::drawn_signatures_resize_from_their_corners", "crates/ui-egui/tests/fill_sign.rs::drawn_and_typed_signatures_stay_upright_on_rotated_pages", "crates/automation/tests/automation.rs::typed_signatures_stay_upright_on_rotated_pages", "crates/ui-egui/tests/fill_sign.rs::image_signature_corners_restore_original_aspect_after_edge_resize_and_reopen", "crates/ui-egui/src/comments.rs::proportional_corners_keep_the_opposite_anchor_and_edges_stretch_one_axis", "crates/ui-egui/tests/fill_sign.rs::image_signature_live_resize_and_move_preserve_background_and_hide_moving_handles", "crates/ui-egui/tests/fill_sign.rs::embedded_image_signature_live_gestures_follow_document_and_view_rotation", "crates/automation/tests/automation.rs::image_signature_preview_layers_are_read_only_and_survive_encrypted_save", "crates/engine/src/signature_image.rs::embedded_signature_preview_preserves_alpha_without_editing_the_document", "crates/engine/src/signature_image.rs::oversized_embedded_signature_preview_is_rejected_before_decoding", "crates/ui-egui/tests/fill_sign.rs::image_signature_preview_follows_pointer_at_page_size_with_zoom_and_rotation", "crates/ui-egui/tests/fill_sign.rs::image_signature_placement_selects_resize_handles_and_requires_reselecting_to_repeat", "crates/ui-egui/tests/fill_sign.rs::typed_signatures_and_initials", "crates/ui-egui/tests/fill_sign.rs::signing_draws_a_signature_once_and_places_it", "crates/ui-egui/tests/fill_sign.rs::changing_saved_signatures_and_initials_preserves_placed_marks", "crates/ui-egui/tests/fill_sign.rs::changing_drawn_signatures_can_be_cancelled_or_switched_to_type", "crates/ui-egui/tests/fill_sign.rs::saved_signature_cards_remove_and_add_without_changing_the_document", "crates/ui-egui/tests/fill_sign.rs::long_typed_names_fit_the_placed_signature_and_keep_every_outline", "crates/ui-egui/src/fill_sign.rs::long_signature_previews_have_clear_margins", "crates/ui-egui/tests/control.rs::saved_signature_can_be_changed_through_the_control_channel", "crates/fonts/src/script.rs::a_name_becomes_outlines", "crates/fonts/src/script.rs::long_names_keep_every_glyph_with_bounded_outline_work", "crates/automation/tests/automation.rs::fill_and_sign_through_tools", "crates/ui-egui/tests/fill_sign.rs::image_signatures_and_initials_can_be_imported_placed_and_remembered", "crates/ui-egui/tests/fill_sign.rs::image_import_cancel_clear_and_errors_preserve_saved_signatures", "crates/engine/src/signature_image.rs::image_signatures_preserve_alpha_and_fit_the_signature_box", "crates/engine/src/signature_image.rs::invalid_and_oversized_signature_images_are_rejected", "crates/engine/src/signature_image.rs::large_signature_images_are_scaled_down", "crates/engine/src/signature_image.rs::jpeg_signatures_are_normalized_to_png", "crates/engine/src/signature_image.rs::jpeg_signature_orientation_is_applied_before_preview_and_embedding", "crates/engine/src/signature_image.rs::very_wide_image_signatures_keep_the_requested_rectangle", "crates/automation/tests/automation.rs::image_signatures_through_tools_preserve_transparency_and_survive_save", "crates/ui-egui/tests/fill_sign.rs::fill_and_sign_tools_pick_up_placed_marks_to_move_and_resize_them", "crates/ui-egui/tests/fill_sign.rs::select_tool_picks_up_a_signature_over_a_form_field", "crates/ui-egui/tests/fill_sign.rs::scanned_signatures_are_framed_cleaned_adjusted_placed_and_remembered", "crates/ui-egui/tests/fill_sign.rs::scan_cancel_errors_and_stale_answers_preserve_saved_signatures", "crates/automation/tests/automation.rs::scanned_signatures_through_tools_drop_the_paper_and_report_bad_arguments", "crates/engine/src/signature_scan.rs::a_photo_is_scanned_into_a_trimmed_transparent_signature_in_its_ink_colour", "crates/ui-egui/tests/fill_sign.rs::undo_button_and_ctrl_z_take_back_one_drawn_stroke_at_a_time", "crates/ui-egui/src/fill_sign.rs::undo_removes_the_last_stroke_and_skips_empty_ones", "crates/ui-egui/src/comments.rs::shift_keeps_the_current_proportions_unless_the_box_has_its_own"]
+notes = "signature and initials, typed (Dancing Script outlines as filled paths, no font embedded), drawn (an Undo button and Ctrl/Cmd+Z in the pad take back the last stroke; Clear empties it) or imported from local PNG/JPEG images; all three are placed upright and anchored as displayed on pages with /Rotate (#299); saved in settings with preview cards and add/change/remove controls; changes leave placed annotations untouched; images preserve alpha, aspect ratio and EXIF orientation, fit within 150 pt by 32 pt (24 pt for initials), and are normalized without source paths or metadata; image previews follow the pointer at placement size with zoom and rotation; signatures/initials place once then select the new annotation; while a Fill & Sign tool is active, marks already placed are picked up as with Select (hover shows the move cursor, a click selects, a drag moves, the selected mark's handles resize) and the tool places only away from them; embedded image signatures resize and move live, hiding the frame during movement and restoring it on release; corner handles preserve the original aspect ratio of the embedded image with the opposite corner anchored, while edge midpoint handles stretch width or height independently; cached background layers preserve page content and alpha, including reopened/encrypted documents; Escape cancels a gesture without committing; stamps resize through selection handles or comment_edit with their original appearance; holding Shift on a corner handle keeps any resizable comment's current proportions (#2199); native and web asynchronous pickers; fill_sign_add accepts path instead of text; image imports capped at 4 MiB, 32 megapixels and 8192 pixels per side, larger than 4 megapixels or 4096 pixels per side scaled down to fit (#1075); Scan tab (fill_sign_add scan/sensitivity headless): a phone photo of a signature on paper (PNG/JPEG within the same image limits, EXIF-oriented, kept at most 4 megapixels) is framed automatically (all words; table, sheet edge and dust ignored; a sideways signature turned upright), the frame can be moved, resized or redrawn and the photo turned in quarter turns, and an ink-sensitivity slider (0-100) controls how faint ink is kept; the paper is estimated by a morphological closing, so shadows and uneven light are removed, and the result is trimmed ink in its own colour on transparency, saved like an imported image. Still missing: perspective correction of a skewed sheet, live camera capture, keyboard control of the frame, and processing off the UI thread (bounded by the 4-megapixel working copy; quick 900 px previews while dragging)"
 
 [[feature]]
 id = "form.fill-sign-flatten"
@@ -5629,11 +5653,11 @@ title = "Redaction fill colour and overlay text"
 area = "G"
 tier = "P0"
 milestone = "M8"
-status = "partial"
+status = "shipped"
 commands = ["redact.properties"]
 tools = ["redact_mark"]
-evidence = ["crates/ui-egui/tests/ui_group/redact.rs::marking_applying_and_clearing", "crates/redact/src/tests.rs::overlay_text_takes_its_font_size_colour_alignment_and_repeats"]
-notes = "fill colour or none; overlay text with font, size or auto-size, colour, alignment and repeat, or redaction codes (protect.redaction-codes)"
+evidence = ["crates/ui-egui/tests/ui_group/redact.rs::marking_applying_and_clearing", "crates/ui-egui/tests/ui_group/redact.rs::redaction_properties_survive_a_restart", "crates/ui-egui/tests/ui_group/redact.rs::redaction_properties_for_this_run_only_and_cancel", "crates/redact/src/tests.rs::overlay_text_takes_its_font_size_colour_alignment_and_repeats"]
+notes = "Acrobat's three groups: redacted area fill colour or none; overlay text with font, size or auto-size, colour, alignment and repeat, or redaction codes (protect.redaction-codes); Redaction mark appearance: outline colour (/C), fill colour shown while the pointer is over a mark (a preference, not written), opacity (/CA). Make properties default: ticked, OK keeps the values for the next run (settings \"redact_prefs\"); unticked, this run only and the saved defaults stay; Cancel puts back what the dialog opened with."
 
 [[feature]]
 id = "protect.redaction-codes"
@@ -5788,8 +5812,8 @@ milestone = "M8"
 status = "partial"
 commands = []
 tools = ["doc_audit_redactions"]
-evidence = ["crates/audit/src/tests.rs::faux_redaction_is_found", "crates/audit/src/tests.rs::background_before_text_is_not_flagged", "crates/audit/src/tests.rs::light_shading_after_text_is_not_flagged", "crates/audit/src/tests.rs::graphics_state_carries_across_streams", "crates/audit/src/tests.rs::audit_fails_closed_on_undecodable_stream", "crates/audit/src/tests.rs::unapplied_redact_mark_is_found", "crates/audit/src/tests.rs::rectangle_drawn_as_a_path_covers_text_like_re", "crates/audit/src/tests.rs::non_rectangular_path_is_not_a_cover", "crates/automation/tests/automation.rs::auditing_faux_redactions_through_tools"]
-notes = "New pdfcraft-audit crate. A filled rectangle (re + fill, or a single m/l subpath whose corners form an axis-aligned rectangle, #1510; opaque) counts as a cover only when painted after the text it overlaps and dark enough to hide it (WCAG contrast < 3.0); page backgrounds, table shading and highlights are not flagged. Graphics state carries across a page's content streams. Fails closed: undecodable content is an error, never a clean bill. Also flags /Redact annotations never applied. CLI: pdfcraft-cli audit (fails when findings exist)."
+evidence = ["crates/audit/src/tests.rs::faux_redaction_is_found", "crates/audit/src/tests.rs::background_before_text_is_not_flagged", "crates/audit/src/tests.rs::light_shading_after_text_is_not_flagged", "crates/audit/src/tests.rs::graphics_state_carries_across_streams", "crates/audit/src/tests.rs::audit_fails_closed_on_undecodable_stream", "crates/audit/src/tests.rs::unapplied_redact_mark_is_found", "crates/audit/src/tests.rs::applied_redaction_at_the_end_of_a_line_is_not_flagged", "crates/audit/src/tests.rs::faux_redaction_at_the_end_of_a_line_is_found", "crates/audit/src/tests.rs::faux_redaction_over_a_short_value_after_a_long_label_is_found", "crates/audit/src/tests.rs::faux_redaction_over_mirrored_text_is_found", "crates/audit/src/tests.rs::faux_redaction_over_a_partial_value_after_a_long_label_is_found", "crates/audit/src/tests.rs::faux_redaction_over_a_partial_value_after_a_long_label_on_a_rotated_page_is_found", "crates/audit/src/tests.rs::faux_redactions_with_multiple_covers_lines_and_spacing_are_found", "crates/automation/tests/automation.rs::auditing_faux_redactions_through_tools", "crates/automation/tests/automation.rs::an_applied_redaction_at_the_end_of_a_line_audits_clean", "crates/audit/src/tests.rs::rectangle_drawn_as_a_path_covers_text_like_re", "crates/audit/src/tests.rs::non_rectangular_path_is_not_a_cover", "apps/pdfcraft-cli/tests/audit.rs::audit_rectangles_match_the_tool_in_top_left_points"]
+notes = "New pdfcraft-audit crate. A filled rectangle (re + fill, or a single m/l subpath whose corners form an axis-aligned rectangle, #1510; opaque) counts as a cover only when painted after the text it overlaps and dark enough to hide it (WCAG contrast < 3.0); page backgrounds, table shading and highlights are not flagged. Coverage is measured on the words a line draws, not its box, so the gap an applied redaction leaves is not counted as hidden text; a cover over 40% of the line's box still counts when it has a positive-area intersection with one word, so a short value after a long label is found. A cover over less than 40% of both a line's box and its words (a short value in the middle of a long line) is still not flagged. Graphics state carries across a page's content streams. Fails closed: undecodable content is an error, never a clean bill. Also flags /Redact annotations never applied. CLI: pdfcraft-cli audit (fails when findings exist). Tool and CLI report rectangles in points from the top-left of the displayed page, after /Rotate and rounded to 0.01 pt, like the other tools."
 
 [[feature]]
 id = "protect.remove-hidden-on-close"
@@ -5984,8 +6008,8 @@ milestone = "M9"
 status = "partial"
 commands = ["sign.digital"]
 tools = ["sign_document"]
-evidence = ["crates/ui-egui/tests/signing.rs::drawing_a_signature_creating_an_id_signing_and_trusting", "crates/ui-egui/tests/signing.rs::the_fill_and_sign_signature_or_an_image_shows_in_a_digital_signature", "crates/sign/tests/pdf.rs::visible_signatures_show_a_drawn_typed_or_image_graphic", "crates/sign/tests/pdf.rs::malformed_signature_graphics_are_refused_not_drawn", "crates/sign/tests/pdf.rs::an_encrypted_documents_signature_graphic_is_encrypted_with_it", "crates/automation/tests/automation.rs::signing_with_an_image_typed_or_drawn_graphic_through_tools"]
-notes = "text items (name, date, reason, location, DN, labels), and a graphic where the large name would be: the saved Fill & Sign signature (drawn, typed or image) or an imported PNG/JPEG (white paper made transparent, as in Fill & Sign), remembered for the next signing; alone it fills the box. Missing: named saved appearances (one remembered choice only), a PDF page as the graphic, the logo/watermark background, drawing a new signature inside the dialog"
+evidence = ["crates/ui-egui/tests/signing.rs::drawing_a_signature_creating_an_id_signing_and_trusting", "crates/ui-egui/tests/signing.rs::the_fill_and_sign_signature_or_an_image_shows_in_a_digital_signature", "crates/sign/tests/pdf.rs::visible_signatures_show_a_drawn_typed_or_image_graphic", "crates/sign/tests/pdf.rs::malformed_signature_graphics_are_refused_not_drawn", "crates/sign/tests/pdf.rs::an_encrypted_documents_signature_graphic_is_encrypted_with_it", "crates/automation/tests/automation.rs::signing_with_an_image_typed_or_drawn_graphic_through_tools", "crates/sign/tests/pdf.rs::appearance_labels_helvetica_cannot_draw_are_refused", "crates/ui-egui/tests/signing.rs::the_signature_labels_follow_the_interface_language", "crates/automation/tests/automation.rs::signing_with_translated_labels_through_tools"]
+notes = "text items (name, date, reason, location, DN, labels), and a graphic where the large name would be: the saved Fill & Sign signature (drawn, typed or image) or an imported PNG/JPEG (white paper made transparent, as in Fill & Sign), remembered for the next signing; alone it fills the box. The labels are stamped in the interface language when Helvetica (WinAnsi) can draw all of them (German, Spanish, French, Italian, Portuguese, Polish, Turkish, Slovene, Hungarian), otherwise all in English with a note under the preview, which shows the same labels and the signing time; sign_document takes labels and the shown items (appearance), and a drawn label the font can't draw is refused, never written as ?. Missing: labels in non-Latin scripts (needs an embedded font), the DN line in the preview, named saved appearances (one remembered choice only), a PDF page as the graphic, the logo/watermark background, drawing a new signature inside the dialog"
 
 [[feature]]
 id = "sign.reason-location"
@@ -6296,8 +6320,8 @@ milestone = "M9"
 status = "shipped"
 commands = ["sign.panel"]
 tools = ["sign_list"]
-evidence = ["crates/sign/tests/pdf.rs::later_changes_are_classified_under_the_signature_permissions", "crates/sign/tests/pdf.rs::signing_an_existing_field_and_counter_signing", "crates/engine/src/tests.rs::signing_saving_trusting_and_commenting_afterwards", "crates/sign/tests/pdf.rs::validation_data_and_xmp_added_after_signing_are_not_tampering", "crates/sign/tests/pdf.rs::a_dss_entry_does_not_make_the_object_it_names_part_of_the_store", "crates/sign/tests/pdf.rs::an_existing_dictionary_is_not_a_store_part_because_the_store_names_it", "crates/sign/tests/pdf.rs::an_existing_array_stays_what_it_is_when_the_store_points_at_it", "crates/sign/tests/pdf.rs::a_signed_store_may_grow_but_not_lose_or_swap_entries", "crates/sign/tests/pdf.rs::a_dictionary_labelled_metadata_is_not_a_metadata_change", "crates/sign/tests/pdf.rs::a_stream_already_labelled_metadata_when_signed_is_not_metadata_unless_the_catalog_names_it", "crates/sign/tests/pdf.rs::the_catalogs_own_xmp_stream_may_still_be_rewritten_after_signing"]
-notes = "revision diff classified as signing, form fill, comments, metadata, page content or structure. Later revisions that add DSS data (new /Certs, /CRLs, /OCSPs, /VRI objects, or ones of the signed store that only grew) or rewrite the catalog's XMP are permitted changes; a /DSS entry that names other objects, or a /Type /DSS or /Type /Metadata label on an existing dictionary or stream, does not excuse changing them (negative tests at every DocMDP level)"
+evidence = ["crates/sign/tests/pdf.rs::later_changes_are_classified_under_the_signature_permissions", "crates/sign/tests/pdf.rs::signing_an_existing_field_and_counter_signing", "crates/engine/src/tests.rs::signing_saving_trusting_and_commenting_afterwards", "crates/sign/tests/pdf.rs::validation_data_and_xmp_added_after_signing_are_not_tampering", "crates/sign/tests/pdf.rs::a_dss_entry_does_not_make_the_object_it_names_part_of_the_store", "crates/sign/tests/pdf.rs::an_existing_dictionary_is_not_a_store_part_because_the_store_names_it", "crates/sign/tests/pdf.rs::an_existing_array_stays_what_it_is_when_the_store_points_at_it", "crates/sign/tests/pdf.rs::a_signed_store_may_grow_but_not_lose_or_swap_entries", "crates/sign/tests/pdf.rs::a_dictionary_labelled_metadata_is_not_a_metadata_change", "crates/sign/tests/pdf.rs::a_stream_already_labelled_metadata_when_signed_is_not_metadata_unless_the_catalog_names_it", "crates/sign/tests/pdf.rs::the_catalogs_own_xmp_stream_may_still_be_rewritten_after_signing", "crates/sign/tests/pdf.rs::rewritten_page_resources_are_page_content_whatever_keys_they_carry"]
+notes = "revision diff classified as signing, form fill, comments, metadata, page content or structure. Later revisions that add DSS data (new /Certs, /CRLs, /OCSPs, /VRI objects, or ones of the signed store that only grew) or rewrite the catalog's XMP are permitted changes; a /DSS entry that names other objects, or a /Type /DSS or /Type /Metadata label on an existing dictionary or stream, does not excuse changing them (negative tests at every DocMDP level). A signed page's resources (fonts, XObjects, graphics states and what they reach) are page content by the role they held when signed, whatever keys a later revision writes into them (#1787)"
 
 [[feature]]
 id = "sign.view-signed-version"
@@ -6953,7 +6977,7 @@ status = "partial"
 commands = ["export.docx"]
 tools = ["doc_export_office"]
 evidence = ["crates/export/src/lib.rs::word_does_not_invent_borders_for_aligned_invoice_fields", "crates/export/src/lib.rs::word_overlap_does_not_consume_invoice_body_space", "crates/export/src/lib.rs::word_keeps_a_page_with_a_clear_image_and_big_title_in_flow", "crates/export/src/lib.rs::word_rotated_pages_keep_separate_page_sizes_and_unique_shapes", "crates/engine/src/tests.rs::office_export_positions_follow_the_displayed_crop_rotation_and_units", "crates/automation/tests/automation.rs::exporting_an_invoice_to_word_keeps_the_watermark_out_of_flow", "crates/export/src/lib.rs::docx_is_a_word_package", "crates/export/src/lib.rs::text_colour_survives_every_format", "crates/engine/src/tests.rs::exporting_office_files_keeps_text_colour", "crates/export/src/lib.rs::grid_text_becomes_a_real_table_in_every_format", "crates/export/src/lib.rs::word_opens_text_with_control_characters_and_long_pages", "crates/engine/src/tests.rs::exporting_office_files_keeps_images", "crates/automation/tests/automation.rs::exporting_to_word_html_and_rtf", "crates/ui-egui/tests/compare.rs::export_to_word_html_and_rtf"]
-notes = "Flowing Word document: paragraphs, Heading 1/2 from larger text, bold/italic, text colour (fill as sRGB; gray/CMYK converted naively, colour spaces via cs/sc read as black), borderless detected tables with spans/empty cells, per-page sections/sizes, and positioned editable text/artwork only for pages with rotated text or text overlapped by an image or watermark-sized text, other pages flowing with inline images (#773); synthetic invoice regression; the emitted package validates with Open XML SDK 2.20 (Office 2010 schema). Word/LibreOffice rendering of the positioned output remains unverified. The earlier flowing output was checked with macOS textutil and opened in Microsoft Word (Windows). Characters XML forbids are dropped; the page size stays within Word's 22 in. Not yet: exact font matching, vector rules, arbitrary paint-order/transparency, colour per run within a paragraph, general exact layout fidelity."
+notes = "Flowing Word document: paragraphs, Heading 1/2 from larger text, bold/italic, text colour (fill as sRGB; gray/CMYK converted naively, colour spaces via cs/sc read as black), borderless detected tables with spans/empty cells, per-page sections/sizes, and positioned editable text/artwork only for pages with rotated text or text overlapped by an image or watermark-sized text, other pages flowing with inline images (#773); synthetic invoice regression; the emitted package validates with Open XML SDK 2.20 (Office 2010 schema). Word/LibreOffice rendering of the positioned output remains unverified. Pictures on positioned pages are DrawingML anchors behind the text (a VML rectangle with an image showed no picture, #1936; not yet opened in Word); a Word file embeds at most 1000 pictures and 512 MiB of them. The earlier flowing output was checked with macOS textutil and opened in Microsoft Word (Windows). Characters XML forbids are dropped; the page size stays within Word's 22 in. Not yet: exact font matching, vector rules, arbitrary paint-order/transparency, colour per run within a paragraph, general exact layout fidelity."
 
 [[feature]]
 id = "create.export-rtf"
@@ -7213,7 +7237,7 @@ status = "shipped"
 commands = ["optimize.reduce"]
 tools = ["doc_reduce"]
 evidence = ["crates/ui-egui/tests/create.rs::reduce_file_size_writes_a_compact_copy", "crates/ui-egui/tests/create.rs::reduce_file_size_saves_nothing_when_the_file_is_already_small", "crates/engine/src/tests.rs::create_and_reduce", "crates/automation/tests/automation.rs::creating_and_reducing_through_tools", "crates/automation/tests/automation.rs::optimizing_through_tools", "crates/optimize/tests/optimize.rs::an_identity_decode_array_does_not_stop_reduce"]
-notes = "images above 225 ppi to 150 ppi JPEG medium, thumbnails dropped, resources merged, object streams; scanner images with the default decode array are included; a copy that isn't smaller is not saved (\"already as small as it can be made\"); runs in the background with a progress bar and Cancel"
+notes = "images above 225 ppi to 150 ppi JPEG medium (after merging page pictures printed as one-pixel strips into one image), thumbnails dropped, resources merged, object streams; scanner images with the default decode array are included; a copy that isn't smaller is not saved (\"already as small as it can be made\"); runs in the background with a progress bar and Cancel"
 
 [[feature]]
 id = "optimize.compatibility-level"
@@ -7236,8 +7260,8 @@ milestone = "M11"
 status = "partial"
 commands = ["optimize.advanced"]
 tools = ["doc_optimize"]
-evidence = ["crates/ui-egui/tests/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy", "crates/automation/tests/automation.rs::optimizing_through_tools", "crates/ui-egui/src/optimize_ui.rs::the_progress_card_shows_the_stage_and_cancels", "crates/engine/src/tests.rs::an_optimize_job_reports_its_stages_and_can_be_cancelled", "crates/optimize/tests/optimize.rs::images_and_forms_nothing_draws_are_dropped", "crates/automation/tests/automation.rs::a_deleted_image_is_not_kept_by_reduce_or_optimize"]
-notes = "Images, Discard Objects, Discard User Data, Clean Up (also drops images and forms the pages list but never draw, such as deleted images); runs in the background with a progress bar (per image) and Cancel; no Fonts or Transparency panels, no space audit"
+evidence = ["crates/ui-egui/tests/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy", "crates/automation/tests/automation.rs::optimizing_through_tools", "crates/ui-egui/src/optimize_ui.rs::the_progress_card_shows_the_stage_and_cancels", "crates/engine/src/tests.rs::an_optimize_job_reports_its_stages_and_can_be_cancelled", "crates/optimize/tests/optimize.rs::images_and_forms_nothing_draws_are_dropped", "crates/automation/tests/automation.rs::a_deleted_image_is_not_kept_by_reduce_or_optimize", "crates/ui-egui/tests/create.rs::the_pdf_optimizer_dialog_picks_a_preset", "crates/automation/tests/automation.rs::a_page_printed_in_strips_gets_small_through_tools", "crates/optimize/tests/optimize.rs::the_mobile_preset_makes_a_printed_page_small"]
+notes = "Settings menu with the Standard and Mobile presets (Custom once an option changes; doc_optimize preset), Images (with Merge image fragments: a page picture drawn as one-pixel strips, as some PDF printers write it, is put back together so it can be resampled), Discard Objects, Discard User Data, Clean Up (also drops images and forms the pages list but never draw, such as deleted images); runs in the background with a progress bar (per image) and Cancel; no Fonts or Transparency panels, no saved custom presets, no space audit"
 
 [[feature]]
 id = "optimize.downsample-images"
@@ -7248,8 +7272,8 @@ milestone = "M11"
 status = "partial"
 commands = ["optimize.advanced"]
 tools = ["doc_optimize"]
-evidence = ["crates/optimize/tests/optimize.rs::images_are_measured_where_drawn_and_downsampled", "crates/optimize/tests/optimize.rs::settings_choose_what_happens", "crates/automation/tests/automation.rs::optimizing_through_tools"]
-notes = "colour and grayscale, bicubic, effective resolution measured where drawn; monochrome not yet"
+evidence = ["crates/optimize/tests/optimize.rs::images_are_measured_where_drawn_and_downsampled", "crates/optimize/tests/optimize.rs::settings_choose_what_happens", "crates/automation/tests/automation.rs::optimizing_through_tools", "crates/optimize/tests/optimize.rs::a_page_picture_printed_as_one_pixel_strips_is_merged_into_one_image", "crates/optimize/tests/optimize.rs::images_that_do_not_tile_a_picture_are_left_alone", "crates/optimize/tests/optimize.rs::a_deeply_nested_form_is_measured_at_its_largest_use", "crates/optimize/tests/optimize.rs::images_are_not_resampled_when_some_uses_could_not_be_measured"]
+notes = "colour and grayscale, bicubic, effective resolution measured where drawn (every use, through nested forms up to 12 deep; when a use can't be measured, nothing is resampled); image fragments stacked edge to edge are merged first (side-by-side tiles not yet); monochrome not yet"
 
 [[feature]]
 id = "optimize.recompress-images"
@@ -7572,8 +7596,8 @@ milestone = "M11"
 status = "shipped"
 commands = ["optimize.advanced"]
 tools = ["doc_audit_space"]
-evidence = ["crates/optimize/tests/optimize.rs::space_audit_shares_the_file_out_by_kind", "crates/automation/tests/automation.rs::auditing_space_through_tools", "crates/ui-egui/tests/viewer.rs::optimizer_audits_space_usage"]
-notes = "PDF Optimizer ▸ Audit space usage: 16 categories (images, content streams, fonts, X Object forms, structure, bookmarks, thumbnails, comments, forms, named destinations, colour spaces, shadings, patterns, graphics states, embedded files, overhead) with bytes and percentages"
+evidence = ["crates/optimize/tests/optimize.rs::space_audit_shares_the_file_out_by_kind", "crates/optimize/tests/optimize.rs::space_audit_counts_what_fields_and_comments_draw_with_by_kind", "crates/optimize/tests/optimize.rs::space_audit_survives_deeply_nested_forms", "crates/automation/tests/automation.rs::auditing_space_through_tools", "crates/ui-egui/tests/viewer.rs::optimizer_audits_space_usage", "crates/ui-egui/tests/viewer.rs::space_audit_numbers_line_up_under_their_headers"]
+notes = "PDF Optimizer ▸ Audit space usage: what the file's bytes are spent on now (not what optimizing would save), in 16 categories (images, content streams, fonts, X Object forms, structure, bookmarks, thumbnails, comments, forms, named destinations, colour spaces, shadings, patterns, graphics states, embedded files, overhead) with bytes and percentages. Resources are counted by kind wherever they are used, so the fonts and images form fields and comments draw with count as fonts and images. Still missing: sizes are each object as it would be written uncompressed, so objects packed in compressed object streams count larger than they take on disk (overhead, the rest of the file, shrinks to match)"
 
 [[feature]]
 id = "optimize.optimizer-presets"
@@ -7973,7 +7997,7 @@ status = "shipped"
 commands = ["print.dialog"]
 tools = ["doc_print"]
 evidence = ["crates/print/src/tests.rs::size_modes", "crates/print/src/tests.rs::architectural_sheets_preserve_full_scale", "crates/automation/tests/automation.rs::architectural_and_iso_papers_through_tools", "crates/ui-egui/tests/print.rs::architectural_page_can_be_matched_at_100_percent"]
-notes = "fit, actual size, shrink oversized, custom %; ARCH A/B/C/D/E1/E, ANSI C/D/E, ISO A0/A1/A2 presets; Match page at 100% matches the current page to a standard sheet. PDF scale shows the previewed source-to-sheet transform, not calibrated physical output; driver substitution/scaling remains possible"
+notes = "fit, actual size, shrink oversized, custom %; ARCH A/B/C/D/E1/E, ANSI C/D/E, ISO A0/A1/A2 and A6 presets; Match page at 100% matches the current page to a standard sheet. PDF scale shows the previewed source-to-sheet transform, not calibrated physical output; driver substitution/scaling remains possible"
 
 [[feature]]
 id = "print.paper-source-by-size"
@@ -8089,11 +8113,11 @@ title = "Print in grayscale"
 area = "L"
 tier = "P1"
 milestone = "M10"
-status = "partial"
+status = "shipped"
 commands = ["print.dialog"]
 tools = ["doc_print"]
-evidence = ["crates/print/src/tests.rs::spooler_arguments_and_printer_list"]
-notes = "asks the printer for monochrome (lp -o, and the Windows page settings as the job's); the PDF itself stays in colour"
+evidence = ["crates/engine/src/tests.rs::printing_as_image_sends_pictures_instead_of_pages", "crates/ui-egui/tests/print.rs::print_as_image_is_an_advanced_choice_that_saves_pictures", "crates/automation/tests/automation.rs::doc_print_as_image"]
+notes = "asks the printer for monochrome (lp -o, and the Windows page settings as the job's); with Print as image the pictures themselves are rendered grey (Rec. 601 luma), so the print-ready PDF is grayscale too. Still missing against Acrobat: a grey conversion of the vector pages without rendering them."
 
 [[feature]]
 id = "print.print-as-image"
@@ -8101,11 +8125,11 @@ title = "Print as image"
 area = "L"
 tier = "P1"
 milestone = "M10"
-status = "planned"
-commands = []
-tools = []
-evidence = []
-notes = ""
+status = "shipped"
+commands = ["print.dialog"]
+tools = ["doc_print"]
+evidence = ["crates/engine/src/tests.rs::printing_as_image_sends_pictures_instead_of_pages", "crates/ui-egui/tests/print.rs::print_as_image_is_an_advanced_choice_that_saves_pictures", "crates/automation/tests/automation.rs::doc_print_as_image"]
+notes = "The Print dialog's Advanced section (folded unless on): Print as image at 150, 300 or 600 dpi; doc_print as_image and dpi (72–600). The pages used are rendered once each the way the viewer shows them (comments left out when the print leaves them out), composed over white, made into an image-only document and imposed on the paper like the pages themselves. The print is no longer searchable text. Still missing against Acrobat: per-printer defaults for it."
 
 [[feature]]
 id = "print.page-setup"
@@ -8837,11 +8861,11 @@ title = "Autotag form fields"
 area = "M"
 tier = "P1"
 milestone = "M12"
-status = "planned"
-commands = []
-tools = []
-evidence = []
-notes = ""
+status = "partial"
+commands = ["a11y.autotag_fields"]
+tools = ["accessibility_autotag_form_fields"]
+evidence = ["crates/a11y/src/tests.rs::autotag_form_fields_writes_widget_structure_and_parent_tree", "crates/automation/tests/automation.rs::autotag_form_fields_writes_reviewable_widget_tags"]
+notes = "For an untagged AcroForm, writes Form structure elements, OBJR references, widget StructParent keys and ParentTree entries. An existing tree is extended when its root points directly to a Document element and its ParentTree uses a direct Nums array; other layouts are refused before any edit. A widget listed on several pages is tagged once. Text, figures, links and other content remain untagged."
 
 [[feature]]
 id = "a11y.reading-order-tool"
@@ -8864,8 +8888,8 @@ milestone = "M12"
 status = "partial"
 commands = ["a11y.tags"]
 tools = ["accessibility_tags"]
-evidence = ["crates/ui-egui/tests/accessibility.rs::tags_panel_edits_a_tag_property_and_undoes_it", "crates/ui-egui/tests/accessibility.rs::checker_finding_opens_its_structure_tag"]
-notes = "The right-side Tags panel lists reachable indirect tags as a collapsible hierarchy, filters by type or title with ancestors, navigates to their page and edits properties. Checker findings linked to indirect tags open the matching tag without losing unsaved edits. Inline tags, adding/deleting tags, artifact marking and finding content remain planned in #982."
+evidence = ["crates/ui-egui/tests/accessibility.rs::tags_panel_edits_a_tag_property_and_undoes_it", "crates/ui-egui/tests/accessibility.rs::checker_finding_opens_its_structure_tag", "crates/automation/tests/automation.rs::structure_tags_are_listed_a_page_at_a_time"]
+notes = "The right-side Tags panel lists reachable indirect tags as a collapsible hierarchy, filters by type or title with ancestors, navigates to their page and edits properties. accessibility_tags lists them a page at a time (offset, limit, next) and can keep only some types, pages or depths. Checker findings linked to indirect tags open the matching tag without losing unsaved edits. Inline tags, adding/deleting tags, artifact marking and finding content remain planned in #982."
 
 [[feature]]
 id = "a11y.tag-properties"
@@ -8921,11 +8945,11 @@ title = "Content panel"
 area = "M"
 tier = "P2"
 milestone = "M12"
-status = "planned"
-commands = []
-tools = []
-evidence = []
-notes = ""
+status = "partial"
+commands = ["a11y.tags"]
+tools = ["accessibility_tag_content"]
+evidence = ["crates/a11y/src/tests.rs::tag_content_lists_direct_marked_content", "crates/ui-egui/tests/accessibility.rs::tags_panel_edits_a_tag_property_and_undoes_it"]
+notes = "Selecting a tag in the Tags panel lists its direct marked-content references with MCID, page and extracted text, and selecting an item navigates to the page. The content tree is presented within the Tags panel; editing content objects and arbitrary inline structure nodes remain planned."
 
 [[feature]]
 id = "a11y.create-tag-from-selection"
@@ -8945,11 +8969,11 @@ title = "Mark content as artifact"
 area = "M"
 tier = "P1"
 milestone = "M12"
-status = "planned"
-commands = []
-tools = []
-evidence = []
-notes = ""
+status = "partial"
+commands = ["a11y.tags"]
+tools = ["accessibility_mark_tag_artifact"]
+evidence = ["crates/a11y/src/tests.rs::marking_a_leaf_tag_as_an_artifact_preserves_appearance_and_structure_integrity", "crates/automation/tests/automation.rs::marking_a_leaf_tag_as_an_artifact_through_automation_is_undoable_and_saved", "crates/ui-egui/tests/accessibility.rs::tags_panel_marks_a_leaf_tag_as_an_artifact"]
+notes = "Tags panel and automation can retire a reachable indirect leaf tag that owns direct MCIDs: its visible page content remains but becomes /Artifact and the parent-tree references are cleared. Tags with structural children, non-MCID content, missing pages or ambiguous parents are refused. Arbitrary painted-content selection, direct structure dictionaries and removing whole tagged subtrees remain unsupported."
 
 [[feature]]
 id = "a11y.find-untagged"
@@ -8957,11 +8981,11 @@ title = "Find unmarked content, comments and links"
 area = "M"
 tier = "P2"
 milestone = "M12"
-status = "planned"
-commands = []
-tools = []
-evidence = []
-notes = ""
+status = "partial"
+commands = ["a11y.find_untagged"]
+tools = ["accessibility_find_untagged"]
+evidence = ["crates/automation/tests/automation.rs::finding_untagged_content_limits_results_to_content_annotations_and_widgets", "crates/ui-egui/tests/accessibility.rs::finding_untagged_content_shows_the_focused_accessibility_results"]
+notes = "Lists findings for untagged painted page content, non-widget annotations and form widgets, optionally on selected pages. It reuses the checker and does not identify untagged table structure, links already represented by an annotation, or structure-tree elements that lack content."
 
 [[feature]]
 id = "a11y.table-editor"
@@ -9080,8 +9104,8 @@ milestone = "M12"
 status = "shipped"
 commands = []
 tools = ["view_reading_colors"]
-evidence = ["crates/automation/tests/automation.rs::reading_colors_through_tools", "crates/render/src/raster.rs::reading_colors_map_solid_paints_and_leave_images", "crates/render/src/raster.rs::reading_colors_tiles_match_full_render", "crates/render/src/raster.rs::print_preview_requests_render_with_reading_colors_off", "crates/ui-egui/tests/reading_colors.rs::reading_colours_preference_round_trips", "crates/ui-egui/tests/reading_colors.rs::reading_colours_seed_on_open"]
-notes = "View only, off by default: Preferences ▸ Reading colours holds the app-wide preference, seeded into every document as it opens (including created ones), and view_reading_colors reads and sets it per document (Acrobat's Replace Document Colors). Solid text paints and, by default, line-art paints (including stencil-mask image paints) are remapped by luminance — each lerps between the preset's text and background colour by how dark or light the original paint is — while images, shadings and tiling patterns pass through untouched. Presets: black on white, white on black, yellow on black, green on black, or a custom #RRGGBB pair; only_black limits the mapping to near-black paints (a 10% luminance threshold — our choice; Acrobat's was not observed). Display only: the document is not changed and print and export are unaffected; print previews and view snapshots render with the document's true colours (a preview matches the uncoloured printout, and a snapshot is an export surface), so reading colours apply to the reading view only. Closes #897 (duplicate #488)."
+evidence = ["crates/automation/tests/automation.rs::reading_colors_through_tools", "crates/render/src/raster.rs::reading_colors_map_solid_paints_and_leave_images", "crates/render/src/raster.rs::reading_colors_tiles_match_full_render", "crates/render/src/raster.rs::print_preview_requests_render_with_reading_colors_off", "crates/render/src/raster.rs::reading_colors_keep_highlight_annotations_readable", "crates/ui-egui/tests/reading_colors.rs::reading_colours_preference_round_trips", "crates/ui-egui/tests/reading_colors.rs::reading_colours_seed_on_open"]
+notes = "View only, off by default: Preferences ▸ Reading colours holds the app-wide preference, seeded into every document as it opens (including created ones), and view_reading_colors reads and sets it per document (Acrobat's Replace Document Colors). Solid text paints and, by default, line-art paints (including stencil-mask image paints) are remapped by luminance — each lerps between the preset's text and background colour by how dark or light the original paint is — while images, shadings and tiling patterns pass through untouched. Annotations keep the colours they were given (both /AP appearances and the no-/AP Highlight fallback), so a Multiply highlight over a dark background shows the marked-up words in the highlight's colour instead of a flat bar that hides them (#1548). Presets: black on white, white on black, yellow on black, green on black, or a custom #RRGGBB pair; only_black limits the mapping to near-black paints (a 10% luminance threshold — our choice; Acrobat's was not observed). Display only: the document is not changed and print and export are unaffected; print previews and view snapshots render with the document's true colours (a preview matches the uncoloured printout, and a snapshot is an export surface), so reading colours apply to the reading view only. Closes #897 (duplicate #488)."
 
 [[feature]]
 id = "a11y.reflow-tagged"
@@ -9141,11 +9165,11 @@ title = "Side-by-side compare view with synchronised scrolling"
 area = "N"
 tier = "P1"
 milestone = "M12"
-status = "planned"
-commands = []
+status = "shipped"
+commands = ["doc.compare"]
 tools = []
-evidence = []
-notes = ""
+evidence = ["crates/ui-egui/tests/compare.rs::compare_two_versions"]
+notes = "After Compare files the document area splits (when the old version is open in a tab and the window is at least 1000 px wide; the Compare panel's Side by side / New file only toggles it): the old file on the left, the new on the right, each a page view of its own with its shading (deleted and replaced on the old, inserted and replaced on the new, visual differences on both). The half the pointer is over leads: the other takes its zoom, fit, layout, rotation and scroll offset; a change clicked in the panel jumps both halves to their side of it. Clear ends it. Still missing against Acrobat: scrolling by matching content rather than by offset (pages of different sizes drift), and the comparison kept when the old file's tab closes."
 
 [[feature]]
 id = "misc.compare-report"
@@ -9396,8 +9420,8 @@ milestone = "M13"
 status = "shipped"
 commands = []
 tools = []
-evidence = ["crates/automation/tests/automation.rs::tool_table_is_well_formed", "crates/automation/tests/automation.rs::edit_undo_redo_and_save_round_trip", "apps/pdfcraft-cli/tests/stdout.rs::output_commands_exit_cleanly_when_the_reader_has_closed"]
-notes = "CLI stdout exits cleanly if a pipe reader closes early; other output errors and command failures remain errors."
+evidence = ["crates/automation/tests/automation.rs::tool_table_is_well_formed", "crates/automation/tests/automation.rs::edit_undo_redo_and_save_round_trip", "apps/pdfcraft-cli/tests/stdout.rs::output_commands_exit_cleanly_when_the_reader_has_closed", "apps/pdfcraft-cli/tests/run_report.rs::a_failing_step_is_named_and_the_rest_are_skipped"]
+notes = "CLI stdout exits cleanly if a pipe reader closes early; other output errors and command failures remain errors. `run --script --report` prints one JSON document with a status per step (#1891); without it the output is unchanged."
 
 [[feature]]
 id = "misc.cli-completeness"
@@ -9768,8 +9792,8 @@ milestone = "M14"
 status = "partial"
 commands = ["app.preferences"]
 tools = ["js_enabled"]
-evidence = ["crates/ui-egui/tests/javascript.rs::document_scripts_and_preferences", "crates/ui-egui/tests/ui.rs::preferences_selects_default_workspace_for_next_open", "crates/ui-egui/tests/control.rs::control_default_workspace_and_session_override"]
-notes = "Preferences dialog with Interface language, Documents and view (persistent default workspace with session override), Identity, Fill & Sign (flatten on save, off by default) and JavaScript; other categories still live in their tools, and it isn't generated from a schema yet."
+evidence = ["crates/ui-egui/tests/javascript.rs::document_scripts_and_preferences", "crates/ui-egui/tests/ui.rs::preferences_selects_default_workspace_for_next_open", "crates/ui-egui/tests/control.rs::control_default_workspace_and_session_override", "apps/pdfcraft/src/settings.rs::xdg_preferences_use_config_instead_of_data", "apps/pdfcraft/src/settings.rs::migration_preserves_preferences_and_other_data"]
+notes = "Preferences dialog with Interface language, Documents and view (persistent default workspace with session override), Identity, Fill & Sign (flatten on save, off by default) and JavaScript; other categories still live in their tools, and it isn't generated from a schema yet. XDG desktops store app.ron under XDG_CONFIG_HOME/pdfcraft or ~/.config/pdfcraft; existing data-folder preferences are copied without replacing configured preferences, with fallback on migration errors. Logs and recovery retain data locations. Portable/non-XDG locations are unchanged."
 
 [[feature]]
 id = "misc.prefs-general"
@@ -9912,8 +9936,8 @@ milestone = "M14"
 status = "partial"
 commands = ["app.preferences"]
 tools = []
-evidence = ["crates/ui-egui/src/commands.rs::localized_shortcut_labels_follow_language_and_platform", "crates/ui-egui/src/i18n/mod.rs::keyboard_key_names_have_a_separate_context_and_english_fallback", "crates/ui-egui/tests/commands.rs::localized_shortcuts_update_immediately_and_keep_command_ids_and_key_bindings", "crates/ui-egui/src/i18n/mod.rs::windows_display_language_resolves_chinese_scripts", "crates/ui-egui/src/i18n/mod.rs::neutral_locale_does_not_override_display_language", "crates/ui-egui/src/i18n/mod.rs::windows_display_language_query_returns_a_locale_tag", "crates/ui-egui/src/i18n/mod.rs::language_persists_and_invalid_input_keeps_current_language", "crates/ui-egui/src/i18n/mod.rs::bundled_catalogs_are_consistent", "crates/ui-egui/src/i18n/mod.rs::arabic_is_registered_and_persists", "crates/ui-egui/src/i18n/mod.rs::arabic_lookups_are_in_display_order", "crates/ui-egui/src/i18n/mod.rs::arabic_plurals_follow_the_six_cldr_forms", "crates/ui-egui/src/i18n/mod.rs::arabic_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::arabic_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::arabic_labels_have_glyphs", "crates/ui-egui/src/bidi.rs::rtl_labels_keep_placeholders_whole", "crates/ui-egui/src/i18n/mod.rs::japanese_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_history_and_diagnostics_preserve_user_values", "crates/ui-egui/tests/control.rs::simplified_chinese_signature_prompts_and_errors_keep_document_state", "crates/ui-egui/tests/control.rs::language_switch_preserves_document_and_command_ids", "crates/ui-egui/tests/control.rs::japanese_controls_and_search_keep_command_ids", "crates/ui-egui/tests/control.rs::japanese_dialogs_errors_and_custom_action_names", "crates/ui-egui/src/i18n/mod.rs::french_is_registered", "crates/ui-egui/src/i18n/mod.rs::french_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::french_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::french_history_and_diagnostics_preserve_user_values", "crates/ui-egui/src/i18n/mod.rs::german_certificate_subject_has_a_distinct_context", "crates/ui-egui/src/widgets.rs::search_placeholder_never_overlaps_the_shortcut", "crates/ui-egui/src/home.rs::translated_card_description_leaves_room_for_the_action", "crates/ui-egui/tests/control.rs::german_preferences_and_search_keep_command_ids", "crates/ui-egui/src/i18n/mod.rs::telugu_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::telugu_labels_have_glyphs", "crates/ui-egui/src/i18n/mod.rs::hungarian_is_registered", "crates/ui-egui/src/i18n/mod.rs::hungarian_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::hungarian_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::hungarian_history_and_diagnostics_preserve_user_values", "crates/ui-egui/src/i18n/mod.rs::ukrainian_is_registered_and_persists", "crates/ui-egui/src/i18n/mod.rs::ukrainian_integer_plurals_cover_teens_and_large_counts", "crates/ui-egui/src/i18n/mod.rs::ukrainian_calendar_uses_month_case_for_dates", "crates/ui-egui/src/i18n/mod.rs::ukrainian_catalog_does_not_leave_english_ui_text", "crates/ui-egui/src/i18n/mod.rs::ukrainian_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::ukrainian_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::ukrainian_history_and_diagnostics_preserve_user_values", "crates/ui-egui/src/i18n/mod.rs::spanish_covers_what_the_engine_says", "crates/ui-egui/src/i18n/mod.rs::spanish_keeps_the_holes_in_what_the_engine_says", "crates/print/src/tests.rs::wordings_are_said"]
-notes = "Shortcut modifiers and key names use a dedicated catalog context across toolbar, menus, palette, Help and tooltips, with English fallback and macOS symbols preserved. Preferences switches Auto (system language)/English/Japanese/Simplified Chinese/Traditional Chinese/Czech/Brazilian Portuguese/German/Spanish/French/Telugu/Hungarian/Ukrainian/Italian/Arabic and persists; ui.set language auto|en|ja|zh-hans|zh-hant|cs|pt-br|de|es|fr|te|hu|uk|it|ar and ui.state expose it. TSV catalogs per language (same system as PhotoCraft); every dialog, panel and notice goes through tl!. Japanese, Traditional Chinese, Simplified Chinese, German, Spanish, French and Hungarian cover commands, dialogs, panels, shortcuts and history labels; Czech and Brazilian Portuguese the menus. French locales (fr, fr_FR, fr_CA, fr_BE) select the French catalog, German locales (de, de_DE, de_AT, de_CH) the German one, Hungarian locales (hu, hu_HU) the Hungarian one. German search hints reserve shortcut space, Home cards bound translated text, certificate Subject has its own context, and inserted tool names keep their capitalization. The sentences the layers below word for themselves (accessibility findings and the saved report, PDF/A problems, signature details, page-range mistakes, edit labels) are handed over apart from the document's own values and go through the catalog too, through said(&i18n::words); Spanish translates them and the other catalogs fall back to English. OS error details, and faults rather than mistakes, stay as they are. Auto detects the Windows display language after explicitly named supported locale overrides; neutral C/POSIX launcher locales are skipped on Windows, with Chinese script/region mapping and English fallback. Arabic (ar and every ar-* locale) covers commands, dialogs and panels with the six CLDR plural forms; its labels are put into display order when the catalog loads, because egui joins Arabic letters but lays words out left to right. Missing: a right-to-left layout (Arabic labels sit in the left-to-right layout, a wrapped Arabic paragraph breaks at the wrong end, and text typed into a field is not reordered), Czech and Brazilian Portuguese dialogs, Chinese and Telugu font delivery in releases (the pinned craft-fonts revision has an Arabic face; its Noto Sans CJK SC is never embedded, AGENTS.md §1.1), the engine's sentences in the other catalogs, a full localization audit."
+evidence = ["crates/ui-egui/src/commands.rs::localized_shortcut_labels_follow_language_and_platform", "crates/ui-egui/src/i18n/mod.rs::keyboard_key_names_have_a_separate_context_and_english_fallback", "crates/ui-egui/tests/commands.rs::localized_shortcuts_update_immediately_and_keep_command_ids_and_key_bindings", "crates/ui-egui/src/i18n/mod.rs::windows_display_language_resolves_chinese_scripts", "crates/ui-egui/src/i18n/mod.rs::neutral_locale_does_not_override_display_language", "crates/ui-egui/src/i18n/mod.rs::windows_display_language_query_returns_a_locale_tag", "crates/ui-egui/src/i18n/mod.rs::language_persists_and_invalid_input_keeps_current_language", "crates/ui-egui/src/i18n/mod.rs::bundled_catalogs_are_consistent", "crates/ui-egui/src/i18n/mod.rs::arabic_is_registered_and_persists", "crates/ui-egui/src/i18n/mod.rs::arabic_lookups_are_in_display_order", "crates/ui-egui/src/i18n/mod.rs::arabic_plurals_follow_the_six_cldr_forms", "crates/ui-egui/src/i18n/mod.rs::arabic_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::arabic_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::arabic_labels_have_glyphs", "crates/ui-egui/src/bidi.rs::rtl_labels_keep_placeholders_whole", "crates/ui-egui/src/i18n/mod.rs::japanese_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_history_and_diagnostics_preserve_user_values", "crates/ui-egui/tests/control.rs::simplified_chinese_signature_prompts_and_errors_keep_document_state", "crates/ui-egui/tests/control.rs::language_switch_preserves_document_and_command_ids", "crates/ui-egui/tests/control.rs::japanese_controls_and_search_keep_command_ids", "crates/ui-egui/tests/control.rs::japanese_dialogs_errors_and_custom_action_names", "crates/ui-egui/src/i18n/mod.rs::french_is_registered", "crates/ui-egui/src/i18n/mod.rs::french_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::french_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::french_history_and_diagnostics_preserve_user_values", "crates/ui-egui/src/i18n/mod.rs::german_certificate_subject_has_a_distinct_context", "crates/ui-egui/src/widgets.rs::search_placeholder_never_overlaps_the_shortcut", "crates/ui-egui/src/home.rs::translated_card_description_leaves_room_for_the_action", "crates/ui-egui/tests/control.rs::german_preferences_and_search_keep_command_ids", "crates/ui-egui/src/i18n/mod.rs::telugu_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::telugu_labels_have_glyphs", "crates/ui-egui/src/i18n/mod.rs::hungarian_is_registered", "crates/ui-egui/src/i18n/mod.rs::hungarian_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::hungarian_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::hungarian_history_and_diagnostics_preserve_user_values", "crates/ui-egui/src/i18n/mod.rs::ukrainian_is_registered_and_persists", "crates/ui-egui/src/i18n/mod.rs::ukrainian_integer_plurals_cover_teens_and_large_counts", "crates/ui-egui/src/i18n/mod.rs::ukrainian_calendar_uses_month_case_for_dates", "crates/ui-egui/src/i18n/mod.rs::ukrainian_catalog_does_not_leave_english_ui_text", "crates/ui-egui/src/i18n/mod.rs::ukrainian_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::ukrainian_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::ukrainian_history_and_diagnostics_preserve_user_values", "crates/ui-egui/src/i18n/mod.rs::spanish_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::spanish_covers_what_the_engine_says", "crates/ui-egui/src/i18n/mod.rs::spanish_keeps_the_holes_in_what_the_engine_says", "crates/print/src/tests.rs::wordings_are_said"]
+notes = "Shortcut modifiers and key names use a dedicated catalog context across toolbar, menus, palette, Help and tooltips, with English fallback and macOS symbols preserved. Preferences switches Auto (system language)/English/Japanese/Simplified Chinese/Traditional Chinese/Czech/Brazilian Portuguese/German/Spanish/French/Telugu/Hungarian/Ukrainian/Italian/Arabic and persists; ui.set language auto|en|ja|zh-hans|zh-hant|cs|pt-br|de|es|fr|te|hu|uk|it|ar and ui.state expose it. TSV catalogs per language (same system as PhotoCraft); every dialog, panel and notice goes through tl!. Japanese, Traditional Chinese, Simplified Chinese, German, Spanish, French and Hungarian cover commands, dialogs, panels, shortcuts and history labels; Czech and Brazilian Portuguese the menus. French locales (fr, fr_FR, fr_CA, fr_BE) select the French catalog, German locales (de, de_DE, de_AT, de_CH) the German one, Hungarian locales (hu, hu_HU) the Hungarian one. German search hints reserve shortcut space, Home cards bound translated text, certificate Subject has its own context, and inserted tool names keep their capitalization. The sentences the layers below word for themselves (accessibility findings and the saved report, PDF/A problems, signature details, page-range mistakes, edit labels) are handed over apart from the document's own values and go through the catalog too, through said(&i18n::words); Spanish and Italian translate them and the other catalogs fall back to English. OS error details, and faults rather than mistakes, stay as they are. Auto detects the Windows display language after explicitly named supported locale overrides; neutral C/POSIX launcher locales are skipped on Windows, with Chinese script/region mapping and English fallback. Arabic (ar and every ar-* locale) covers commands, dialogs and panels with the six CLDR plural forms; its labels are put into display order when the catalog loads, because egui joins Arabic letters but lays words out left to right. Missing: a right-to-left layout (Arabic labels sit in the left-to-right layout, a wrapped Arabic paragraph breaks at the wrong end, and text typed into a field is not reordered), Czech and Brazilian Portuguese dialogs, Chinese and Telugu font delivery in releases (the pinned craft-fonts revision has an Arabic face; its Noto Sans CJK SC is never embedded, AGENTS.md §1.1), the engine's sentences in the other catalogs, a full localization audit."
 
 [[feature]]
 id = "misc.prefs-reading"
@@ -10041,11 +10065,11 @@ title = "Localization (Fluent catalogs)"
 area = "N"
 tier = "P1"
 milestone = "M14"
-status = "planned"
+status = "partial"
 commands = []
 tools = []
-evidence = []
-notes = ""
+evidence = ["crates/ui-egui/src/i18n/mod.rs::bundled_catalogs_are_consistent", "crates/ui-egui/src/i18n/mod.rs::date_languages_are_the_interface_languages", "crates/ui-egui/src/i18n/mod.rs::language_persists_and_invalid_input_keeps_current_language"]
+notes = "The UI offers 22 non-English catalogs plus English fallback (entry counts vary by language), and the selected language persists. Partial because the languages are not all usable yet: Chinese shows tofu in releases (#826, #688), the release-pinned craft-fonts has no Telugu face, Arabic is not mirrored (misc.rtl-ui), and strings missing from a catalog fall back to English (localization-parity.md). The language can be set through the UI control channel (`set language`) but not through an automation tool, so pdfcraft-cli run and MCP cannot change it."
 
 [[feature]]
 id = "misc.rtl-ui"
@@ -10065,11 +10089,11 @@ title = "Signed installers for macOS, Windows and Linux"
 area = "N"
 tier = "P1"
 milestone = "M14"
-status = "planned"
+status = "partial"
 commands = []
 tools = []
 evidence = []
-notes = "Windows MSI creates a Start menu shortcut, an optional (default on) desktop shortcut and an optional (default on, INSTALLPDFCONTEXTMENU) \"Edit with PdfCraft\" File Explorer menu entry for PDF files (#682), and confirms full-UI completion with Finish (#143); packaging/windows/test-msi.ps1 checks the compiled MSI and windows-arm64.yml checks installation/removal. PDF files use a dedicated embedded document icon when PdfCraft is chosen as the default reader (confirmed in Windows Explorer); first-page thumbnails remain unsupported. Signed installers across platforms remain planned."
+notes = "Release builds provide signed and notarized macOS artifacts and code-signed Windows installers when signing credentials are configured (packaging/macos/package.sh; packaging/windows/sign.ps1; README.md). Linux AppImage, Flatpak, deb and rpm packages ship, but are not code-signed. Windows MSI creates a Start menu shortcut, an optional (default on) desktop shortcut, an optional (default on, INSTALLPDFCONTEXTMENU) \"Edit with PdfCraft\" File Explorer menu entry for PDF files (#682) and an optional (default on, INSTALLIMAGECONTEXTMENU) \"Create PDF with PdfCraft…\" entry for images; an update keeps whichever of the three the installed version has (#1058, #305). It confirms full-UI completion with Finish (#143); packaging/windows/test-msi.ps1 checks the compiled MSI and windows-arm64.yml checks installation/removal. PDF files use a dedicated embedded document icon when PdfCraft is chosen as the default reader (confirmed in Windows Explorer); first-page thumbnails remain unsupported."
 
 [[feature]]
 id = "misc.web-deploy"
diff --git a/vendor/README.md b/vendor/README.md
index c433193f3..fb6588c14 100644
--- a/vendor/README.md
+++ b/vendor/README.md
@@ -5,23 +5,28 @@ licence files unchanged. Every patch is marked `PdfCraft patch:` in the source,
 PdfCraft test, and should be proposed upstream. Remove the vendored copy once upstream releases
 the fix. Vendoring copyleft code is never allowed (plan/adr/0001).
 
+A PdfCraft patch in `hayro-syntax::Page::base_dimensions` expresses the existing one-point floor as a raw reciprocal of `/UserUnit`, rounded upward only when f32 multiplication would fall below one point. Five `pdfcraft-render` regressions with prefix `raster::tests::raw_crop_` cover the observed dimensions, origins and rotations, units 41/47, bounded vector rasters and unchanged nearly-zero A4 fallback. Accepted page-unit policy and licences are unchanged.
+
 | Crate | Version | Licence | Patches | Test |
 |---|---|---|---|---|
-| hayro-interpret | 0.7.0 | Apache-2.0 OR MIT | (1) select `/AP /N` appearance states via `/AS` (checkboxes, radios, stateful icons) and honour the NoView flag; (2) Type3 Unicode fallback to `/Encoding` glyph names, then printable ASCII; (3) `Type3Glyph::advance_width`; (4) `InterpreterSettings::ocg_overrides` for viewer layer toggles; (5) soft masks whose group lacks `/CS` were dropped (Chrome gradient text); (6) paint nesting cap `MAX_PAINT_NESTING` for tiling patterns and Type 3 glyphs (self-referencing content overflowed the stack); (7) CID width ranges in `/W` and `/W2` clamped to `MAX_CID` (a `0 4294967295 w` range hung); (8) `InterpreterSettings::hide_comments` skips markup annotations but keeps widgets and links (View ▸ Hide all comments); (9) `image_size_ok`: images and masks over 2^28 pixels are not decoded (a fuzzed `/W 4294967295` stencil mask allocated 4 GiB); (10) `MAX_NESTED_PAINTS`: nested paints (forms, Type 3 glyphs and tiling patterns inside one another) share a per-page budget of 50,000 (a glyph showing eight glyphs of its own font, sixteen deep, hung); (11) depends on skrifa 0.47 instead of 0.42 (upstream read-fonts fixed a Type 1 tokenizer that recursed through runs of numbers: a fuzzed font hung or overflowed the stack), with the one API change (`Charset::glyph_id` returns `Option`); (12) annotation appearances whose `/BBox` or `/Matrix` collapses to a line or a point are skipped (mapping them onto `/Rect` divided by zero and handed the device infinite or NaN matrices); (13) a Highlight annotation without a usable normal appearance is drawn from its `/QuadPoints`, `/C` and `/CA` with Multiply blending, as pdfcraft-annot draws highlights (it was not drawn at all); (14) simple-font `/Widths` (`read_widths`): entries only for codes 0–255 (one entry per code below `/FirstChar` was allocated: `4294967295` asked for 34 GB), an entry that isn't a number leaves its code missing instead of ending the array, and a `/LastChar` below `/FirstChar` gives no widths instead of discarding the font for a standard one; (15) the appearance box is mapped onto `/Rect` corner to corner: the translation now accounts for the scale (an appearance whose box didn't start at the origin and differed in size from `/Rect` was drawn shifted); (16) a clip set by `W`/`W*` takes effect after whichever path-painting operator ends the path (`S`, `f`, `B`, … as well as `n`; ISO 32000-2 §8.5.4): it was applied only on `n`, so `re W* S` clipped nothing and the clip stayed pending for a later, unrelated `n`; (17) `InterpreterSettings::cancelled`: once set, interpretation stops before the next content operator (a render pool sets it for every worker when dropped, after an edit or on closing, and for one worker when the watchdog gives up on its render, so renders whose answers nobody can receive stop instead of running to the end); (18) `MAX_PAGE_CONTENT`: the content a page holds at once (its contents, and the forms, tiling patterns and Type 3 glyph procedures being painted) stays within 512 MiB (`decode_content`; once it runs out, `InterpreterWarning::ContentTruncated` is reported (once per page by pdfcraft-render) so a truncated page is not a clean render; each level gives its bytes back when it finishes): forms nest fifty deep and each level kept its content while the next ran, so a form painting itself around a stream inflating to 256 MiB would have held over 12 GB; and Type 0 sampled functions take at most `MAX_SAMPLE_ENTRIES` (2^21) table points and `MAX_SAMPLE_VALUES` (2^23) samples, read no further than `/Size` asks (256 MiB of 1-bit samples asked for over 8 GB); (19) mesh shadings (types 4–7) are sampled only inside the area being drawn (`ShadingPattern::encode_within`, which the vendored hayro renderer calls with that area plus a pixel), within 8 visits per pixel of it plus 4 per triangle (`TriangleSampler`), and patches are triangulated one at a time: points far off the page were sampled over their whole bounding box, up to 65536 × 65536 entries (a fuzzed 147-byte patch stream; a synthetic page passed 6 GB in six seconds), ten thousand overlapping triangles ran for minutes, and every patch became 722 triangles before any limit; meshes hold at most `MAX_MESH_PATCHES` (2^16) patches and `MAX_MESH_TRIANGLES` (2^20) triangles, a lattice needs two to 2^19 vertices per row (`/VerticesPerRow 0` pushed empty rows for ever; one huge row read the whole stream), and a page samples at most `MAX_PAGE_MESH_TRIANGLES` (2^25) mesh triangles in all (a mesh painted a thousand times was triangulated a thousand times); each cut logs a warning; (20) PDF function construction is limited to 64 levels and 10,000 total nodes with cycle detection; calculator parsing and evaluation share procedure depth/work budgets, integer division/bitshift/rotation/index are panic-free, and fixed-size stack errors propagate; (21) a Type 0 font drawn with a substitute that isn't CID-keyed (it isn't embedded, or its program doesn't load) draws `.notdef` for a CID of an Adobe character collection (Japan1, GB1, CNS1, Korea1) that it can't find by Unicode: hayro took the CID for a glyph index of the substitute, which numbers its glyphs its own way, so the character was drawn as an unrelated one (𠮷 as "Ｑ" in BIZ UDPGothic); (22) a Type 0 font drawn with a substitute finds a character given with a variation selector (`/ToUnicode`, or Adobe-Japan1-UCS2, which maps the JIS X 0208 forms of the kanji JIS X 0213:2004 redrew that way: CID 1247 is 噂 U+E0100) through the substitute's variation sequences, else as the character alone: such a CID found no glyph and was drawn as an unrelated one; (23) backport of hayro 0.8's `gradient` module: `EncodedShadingPattern::as_svg_gradient` turns an axial or radial shading into stops of an sRGB gradient (within 0.01 per channel, a stop at every stitching-function bound via `Function::stitching_bounds`) when a native gradient draws it exactly (extended past the box drawn in; a radial one with no background colour); (24) `DecodedImageCache`: decoded image pixels shared across renders through the interpreter cache within a 64 MiB budget (an image-heavy page decoded its thousands of images again per tile and per scale), keyed by every decode input (`DecodedImageKey`: the stream's place and dictionary bytes, its object, mask/stencil/raster output, interpolation, decode target size, preview or final); images under a transfer function and inline images are not cached, an image over the budget is never kept, and a poisoned lock decodes uncached; (25) `Device::actual_text` hands the device a marked content sequence's `/ActualText` (inline or named in `/Properties`), so text extraction keeps the Thai, Indic and Arabic clusters Chrome marks this way (their shaped tone marks and vowels have no Unicode of their own); (26) non-embedded simple fonts drawn with a standard-font stand-in build the Latin Extended-A letters the stand-in lacks (`/Gbreve`, `/Idotaccent`, `/Scedilla`, `/aogonek`, `/ccaron`…) from the base letter and accent it has (`StandardKind::composite_glyph`, `ACCENTED_LETTERS`): PDFium's Foxit stand-ins hold only the Standard/WinAnsi/Mac Roman glyphs, so iText letters with Times New Roman unembedded showed blanks for Ğ, İ, Ş, ğ and ş; (27) an embedded TrueType font without a base encoding reads its codes as WinAnsi for text extraction (`EmbeddedKind::code_to_unicode_name`), matching pdftotext's output, instead of Standard: OCR text layers of scans write WinAnsi codes with no `/Encoding`, and Standard has no ü, ö or ß and reads é as Ø (glyph selection unchanged) | (1) `raster::tests::widget_appearance_states`; (2, 3) `xtask text-oracle` on corpus/pdfjs issue918; (4) `raster::tests::layer_override_hides_content`; (5) `raster::tests::soft_mask_without_group_colour_space_is_applied`; (6) `raster::tests::self_referencing_tiling_pattern_terminates`, `raster::tests::self_referencing_type3_glyph_terminates`; (7) `raster::tests::huge_cid_width_ranges_terminate`; (8) `raster::tests::hiding_comments_keeps_fields`; (9) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (10) `raster::tests::type3_glyphs_that_fan_out_into_themselves_finish`; (11) `raster::tests::type1_font_programs_with_long_runs_of_numbers_load_quickly`; (12) `raster::tests::degenerate_annotation_appearances_are_skipped`; (13) `raster::tests::highlights_without_an_appearance_are_drawn`; (14) `raster::tests::malformed_simple_font_widths_keep_later_widths_and_the_font`, `raster::tests::huge_simple_font_first_char_terminates`; (15) `raster::tests::annotation_appearance_box_maps_onto_rect`; (16) `raster::tests::clipping_path_applies_after_any_painting_operator`; (17) `raster::tests::dropping_the_pool_cancels_its_renders`, `raster::tests::the_watchdog_stops_the_render_it_gives_up_on`; (18) `raster::tests::page_contents_and_nested_forms_share_one_budget`, `raster::tests::content_painted_again_and_again_keeps_drawing`, `raster::tests::sampled_functions_with_billions_of_samples_are_refused`; (19) `raster::tests::mesh_shadings_far_off_the_page_render`, `raster::tests::many_overlapping_mesh_triangles_finish`, `raster::tests::mesh_shadings_with_many_patches_or_no_rows_finish`; (20) `raster::tests::function_limits_calculator_arithmetic_and_depth`, `raster::tests::function_limits_public_construction_work_and_depth`, `raster::tests::function_limits_stitching_cycles_are_refused_and_shared_children_work`, `raster::tests::function_limits_invalid_calculator_keeps_the_page_renderable`; (21) `raster::tests::cids_a_substitute_lacks_are_not_drawn_as_other_glyphs`; (26) `raster::tests::accented_letters_the_standard_stand_ins_lack_are_built_from_their_parts` |; (22) `raster::tests::variation_sequences_draw_their_kanji_in_a_substitute`; (23) `raster::tests::axial_and_radial_shadings_draw_as_native_gradients`; (24) `raster::tests::tiles_match_full_render`, `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel` (both decode through the cache), `raster::tests::decoded_images_with_identical_dictionaries_keep_their_own_pixels`, `raster::tests::decoded_images_under_a_transfer_function_are_not_shared`; (25) `text::tests::actual_text_replaces_the_glyphs_it_marks_in_every_writing_direction`, `text::tests::actual_text_follows_the_pdf_rules_for_marked_content`; (27) `text::tests::truetype_without_an_encoding_reads_its_codes_as_win_ansi`
-| hayro-interpret | 0.7.0 | Apache-2.0 OR MIT | (1) select `/AP /N` appearance states via `/AS` (checkboxes, radios, stateful icons) and honour the NoView flag; (2) Type3 Unicode fallback to `/Encoding` glyph names, then printable ASCII; (3) `Type3Glyph::advance_width`; (4) `InterpreterSettings::ocg_overrides` for viewer layer toggles; (5) soft masks whose group lacks `/CS` were dropped (Chrome gradient text); (6) paint nesting cap `MAX_PAINT_NESTING` for tiling patterns and Type 3 glyphs (self-referencing content overflowed the stack); (7) CID width ranges in `/W` and `/W2` clamped to `MAX_CID` (a `0 4294967295 w` range hung); (8) `InterpreterSettings::hide_comments` skips markup annotations but keeps widgets and links (View ▸ Hide all comments); (9) `image_size_ok`: images and masks over 2^28 pixels are not decoded (a fuzzed `/W 4294967295` stencil mask allocated 4 GiB); (10) `MAX_NESTED_PAINTS`: nested paints (forms, Type 3 glyphs and tiling patterns inside one another) share a per-page budget of 50,000 (a glyph showing eight glyphs of its own font, sixteen deep, hung); (11) depends on skrifa 0.47 instead of 0.42 (upstream read-fonts fixed a Type 1 tokenizer that recursed through runs of numbers: a fuzzed font hung or overflowed the stack), with the one API change (`Charset::glyph_id` returns `Option`); (12) annotation appearances whose `/BBox` or `/Matrix` collapses to a line or a point are skipped (mapping them onto `/Rect` divided by zero and handed the device infinite or NaN matrices); (13) a Highlight annotation without a usable normal appearance is drawn from its `/QuadPoints`, `/C` and `/CA` with Multiply blending, as pdfcraft-annot draws highlights (it was not drawn at all); (14) simple-font `/Widths` (`read_widths`): entries only for codes 0–255 (one entry per code below `/FirstChar` was allocated: `4294967295` asked for 34 GB), an entry that isn't a number leaves its code missing instead of ending the array, and a `/LastChar` below `/FirstChar` gives no widths instead of discarding the font for a standard one; (15) the appearance box is mapped onto `/Rect` corner to corner: the translation now accounts for the scale (an appearance whose box didn't start at the origin and differed in size from `/Rect` was drawn shifted); (16) a clip set by `W`/`W*` takes effect after whichever path-painting operator ends the path (`S`, `f`, `B`, … as well as `n`; ISO 32000-2 §8.5.4): it was applied only on `n`, so `re W* S` clipped nothing and the clip stayed pending for a later, unrelated `n`; (17) `InterpreterSettings::cancelled`: once set, interpretation stops before the next content operator (a render pool sets it for every worker when dropped, after an edit or on closing, and for one worker when the watchdog gives up on its render, so renders whose answers nobody can receive stop instead of running to the end); (18) `MAX_PAGE_CONTENT`: the content a page holds at once (its contents, and the forms, tiling patterns and Type 3 glyph procedures being painted) stays within 512 MiB (`decode_content`; once it runs out, `InterpreterWarning::ContentTruncated` is reported (once per page by pdfcraft-render) so a truncated page is not a clean render; each level gives its bytes back when it finishes): forms nest fifty deep and each level kept its content while the next ran, so a form painting itself around a stream inflating to 256 MiB would have held over 12 GB; and Type 0 sampled functions take at most `MAX_SAMPLE_ENTRIES` (2^21) table points and `MAX_SAMPLE_VALUES` (2^23) samples, read no further than `/Size` asks (256 MiB of 1-bit samples asked for over 8 GB); (19) mesh shadings (types 4–7) are sampled only inside the area being drawn (`ShadingPattern::encode_within`, which the vendored hayro renderer calls with that area plus a pixel), within 8 visits per pixel of it plus 4 per triangle (`TriangleSampler`), and patches are triangulated one at a time: points far off the page were sampled over their whole bounding box, up to 65536 × 65536 entries (a fuzzed 147-byte patch stream; a synthetic page passed 6 GB in six seconds), ten thousand overlapping triangles ran for minutes, and every patch became 722 triangles before any limit; meshes hold at most `MAX_MESH_PATCHES` (2^16) patches and `MAX_MESH_TRIANGLES` (2^20) triangles, a lattice needs two to 2^19 vertices per row (`/VerticesPerRow 0` pushed empty rows for ever; one huge row read the whole stream), and a page samples at most `MAX_PAGE_MESH_TRIANGLES` (2^25) mesh triangles in all (a mesh painted a thousand times was triangulated a thousand times); each cut logs a warning; (20) PDF function construction is limited to 64 levels and 10,000 total nodes with cycle detection; calculator parsing and evaluation share procedure depth/work budgets, integer division/bitshift/rotation/index are panic-free, and fixed-size stack errors propagate; (21) a Type 0 font drawn with a substitute that isn't CID-keyed (it isn't embedded, or its program doesn't load) draws `.notdef` for a CID of an Adobe character collection (Japan1, GB1, CNS1, Korea1) that it can't find by Unicode: hayro took the CID for a glyph index of the substitute, which numbers its glyphs its own way, so the character was drawn as an unrelated one (𠮷 as "Ｑ" in BIZ UDPGothic); (22) a Type 0 font drawn with a substitute finds a character given with a variation selector (`/ToUnicode`, or Adobe-Japan1-UCS2, which maps the JIS X 0208 forms of the kanji JIS X 0213:2004 redrew that way: CID 1247 is 噂 U+E0100) through the substitute's variation sequences, else as the character alone: such a CID found no glyph and was drawn as an unrelated one; (23) backport of hayro 0.8's `gradient` module: `EncodedShadingPattern::as_svg_gradient` turns an axial or radial shading into stops of an sRGB gradient (within 0.01 per channel, a stop at every stitching-function bound via `Function::stitching_bounds`) when a native gradient draws it exactly (extended past the box drawn in; a radial one with no background colour); (24) `DecodedImageCache`: decoded image pixels shared across renders through the interpreter cache within a 64 MiB budget (an image-heavy page decoded its thousands of images again per tile and per scale), keyed by every decode input (`DecodedImageKey`: the stream's place and dictionary bytes, its object, mask/stencil/raster output, interpolation, decode target size, preview or final); images under a transfer function and inline images are not cached, an image over the budget is never kept, and a poisoned lock decodes uncached; (25) `Device::actual_text` hands the device a marked content sequence's `/ActualText` (inline or named in `/Properties`), so text extraction keeps the Thai, Indic and Arabic clusters Chrome marks this way (their shaped tone marks and vowels have no Unicode of their own); (26) non-embedded simple fonts drawn with a standard-font stand-in build the Latin Extended-A letters the stand-in lacks (`/Gbreve`, `/Idotaccent`, `/Scedilla`, `/aogonek`, `/ccaron`…) from the base letter and accent it has (`StandardKind::composite_glyph`, `ACCENTED_LETTERS`): PDFium's Foxit stand-ins hold only the Standard/WinAnsi/Mac Roman glyphs, so iText letters with Times New Roman unembedded showed blanks for Ğ, İ, Ş, ğ and ş; (27) text in a Type 3 font is drawn filled whatever the text rendering mode, except mode 3 (invisible): only that mode has any effect on Type 3 fonts (ISO 32000-1 §9.3.6). Stroking ran the glyph procedure a second time, so `2 Tr` made bitmap fonts look bold, `1 Tr` painted an uncoloured glyph in the stroking colour, and `7 Tr` hid it | (1) `raster::tests::widget_appearance_states`; (2, 3) `xtask text-oracle` on corpus/pdfjs issue918; (4) `raster::tests::layer_override_hides_content`; (5) `raster::tests::soft_mask_without_group_colour_space_is_applied`; (6) `raster::tests::self_referencing_tiling_pattern_terminates`, `raster::tests::self_referencing_type3_glyph_terminates`; (7) `raster::tests::huge_cid_width_ranges_terminate`; (8) `raster::tests::hiding_comments_keeps_fields`; (9) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (10) `raster::tests::type3_glyphs_that_fan_out_into_themselves_finish`; (11) `raster::tests::type1_font_programs_with_long_runs_of_numbers_load_quickly`; (12) `raster::tests::degenerate_annotation_appearances_are_skipped`; (13) `raster::tests::highlights_without_an_appearance_are_drawn`; (14) `raster::tests::malformed_simple_font_widths_keep_later_widths_and_the_font`, `raster::tests::huge_simple_font_first_char_terminates`; (15) `raster::tests::annotation_appearance_box_maps_onto_rect`; (16) `raster::tests::clipping_path_applies_after_any_painting_operator`; (17) `raster::tests::dropping_the_pool_cancels_its_renders`, `raster::tests::the_watchdog_stops_the_render_it_gives_up_on`; (18) `raster::tests::page_contents_and_nested_forms_share_one_budget`, `raster::tests::content_painted_again_and_again_keeps_drawing`, `raster::tests::sampled_functions_with_billions_of_samples_are_refused`; (19) `raster::tests::mesh_shadings_far_off_the_page_render`, `raster::tests::many_overlapping_mesh_triangles_finish`, `raster::tests::mesh_shadings_with_many_patches_or_no_rows_finish`; (20) `raster::tests::function_limits_calculator_arithmetic_and_depth`, `raster::tests::function_limits_public_construction_work_and_depth`, `raster::tests::function_limits_stitching_cycles_are_refused_and_shared_children_work`, `raster::tests::function_limits_invalid_calculator_keeps_the_page_renderable`; (21) `raster::tests::cids_a_substitute_lacks_are_not_drawn_as_other_glyphs`; (26) `raster::tests::accented_letters_the_standard_stand_ins_lack_are_built_from_their_parts` |; (22) `raster::tests::variation_sequences_draw_their_kanji_in_a_substitute`; (23) `raster::tests::axial_and_radial_shadings_draw_as_native_gradients`; (24) `raster::tests::tiles_match_full_render`, `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel` (both decode through the cache), `raster::tests::decoded_images_with_identical_dictionaries_keep_their_own_pixels`, `raster::tests::decoded_images_under_a_transfer_function_are_not_shared`; (25) `text::tests::actual_text_replaces_the_glyphs_it_marks_in_every_writing_direction`, `text::tests::actual_text_follows_the_pdf_rules_for_marked_content`; (27) `raster::tests::text_rendering_modes_other_than_invisible_draw_type3_glyphs_as_filled`
-| hayro-interpret | 0.7.0 | Apache-2.0 OR MIT | (1) select `/AP /N` appearance states via `/AS` (checkboxes, radios, stateful icons) and honour the NoView flag; (2) Type3 Unicode fallback to `/Encoding` glyph names, then printable ASCII; (3) `Type3Glyph::advance_width`; (4) `InterpreterSettings::ocg_overrides` for viewer layer toggles; (5) soft masks whose group lacks `/CS` were dropped (Chrome gradient text); (6) paint nesting cap `MAX_PAINT_NESTING` for tiling patterns and Type 3 glyphs (self-referencing content overflowed the stack); (7) CID width ranges in `/W` and `/W2` clamped to `MAX_CID` (a `0 4294967295 w` range hung); (8) `InterpreterSettings::hide_comments` skips markup annotations but keeps widgets and links (View ▸ Hide all comments); (9) `image_size_ok`: images and masks over 2^28 pixels are not decoded (a fuzzed `/W 4294967295` stencil mask allocated 4 GiB); (10) `MAX_NESTED_PAINTS`: nested paints (forms, Type 3 glyphs and tiling patterns inside one another) share a per-page budget of 50,000 (a glyph showing eight glyphs of its own font, sixteen deep, hung); (11) depends on skrifa 0.47 instead of 0.42 (upstream read-fonts fixed a Type 1 tokenizer that recursed through runs of numbers: a fuzzed font hung or overflowed the stack), with the one API change (`Charset::glyph_id` returns `Option`); (12) annotation appearances whose `/BBox` or `/Matrix` collapses to a line or a point are skipped (mapping them onto `/Rect` divided by zero and handed the device infinite or NaN matrices); (13) a Highlight annotation without a usable normal appearance is drawn from its `/QuadPoints`, `/C` and `/CA` with Multiply blending, as pdfcraft-annot draws highlights (it was not drawn at all); (14) simple-font `/Widths` (`read_widths`): entries only for codes 0–255 (one entry per code below `/FirstChar` was allocated: `4294967295` asked for 34 GB), an entry that isn't a number leaves its code missing instead of ending the array, and a `/LastChar` below `/FirstChar` gives no widths instead of discarding the font for a standard one; (15) the appearance box is mapped onto `/Rect` corner to corner: the translation now accounts for the scale (an appearance whose box didn't start at the origin and differed in size from `/Rect` was drawn shifted); (16) a clip set by `W`/`W*` takes effect after whichever path-painting operator ends the path (`S`, `f`, `B`, … as well as `n`; ISO 32000-2 §8.5.4): it was applied only on `n`, so `re W* S` clipped nothing and the clip stayed pending for a later, unrelated `n`; (17) `InterpreterSettings::cancelled`: once set, interpretation stops before the next content operator (a render pool sets it for every worker when dropped, after an edit or on closing, and for one worker when the watchdog gives up on its render, so renders whose answers nobody can receive stop instead of running to the end); (18) `MAX_PAGE_CONTENT`: the content a page holds at once (its contents, and the forms, tiling patterns and Type 3 glyph procedures being painted) stays within 512 MiB (`decode_content`; once it runs out, `InterpreterWarning::ContentTruncated` is reported (once per page by pdfcraft-render) so a truncated page is not a clean render; each level gives its bytes back when it finishes): forms nest fifty deep and each level kept its content while the next ran, so a form painting itself around a stream inflating to 256 MiB would have held over 12 GB; and Type 0 sampled functions take at most `MAX_SAMPLE_ENTRIES` (2^21) table points and `MAX_SAMPLE_VALUES` (2^23) samples, read no further than `/Size` asks (256 MiB of 1-bit samples asked for over 8 GB); (19) mesh shadings (types 4–7) are sampled only inside the area being drawn (`ShadingPattern::encode_within`, which the vendored hayro renderer calls with that area plus a pixel), within 8 visits per pixel of it plus 4 per triangle (`TriangleSampler`), and patches are triangulated one at a time: points far off the page were sampled over their whole bounding box, up to 65536 × 65536 entries (a fuzzed 147-byte patch stream; a synthetic page passed 6 GB in six seconds), ten thousand overlapping triangles ran for minutes, and every patch became 722 triangles before any limit; meshes hold at most `MAX_MESH_PATCHES` (2^16) patches and `MAX_MESH_TRIANGLES` (2^20) triangles, a lattice needs two to 2^19 vertices per row (`/VerticesPerRow 0` pushed empty rows for ever; one huge row read the whole stream), and a page samples at most `MAX_PAGE_MESH_TRIANGLES` (2^25) mesh triangles in all (a mesh painted a thousand times was triangulated a thousand times); each cut logs a warning; (20) PDF function construction is limited to 64 levels and 10,000 total nodes with cycle detection; calculator parsing and evaluation share procedure depth/work budgets, integer division/bitshift/rotation/index are panic-free, and fixed-size stack errors propagate; (21) a Type 0 font drawn with a substitute that isn't CID-keyed (it isn't embedded, or its program doesn't load) draws `.notdef` for a CID of an Adobe character collection (Japan1, GB1, CNS1, Korea1) that it can't find by Unicode: hayro took the CID for a glyph index of the substitute, which numbers its glyphs its own way, so the character was drawn as an unrelated one (𠮷 as "Ｑ" in BIZ UDPGothic); (22) a Type 0 font drawn with a substitute finds a character given with a variation selector (`/ToUnicode`, or Adobe-Japan1-UCS2, which maps the JIS X 0208 forms of the kanji JIS X 0213:2004 redrew that way: CID 1247 is 噂 U+E0100) through the substitute's variation sequences, else as the character alone: such a CID found no glyph and was drawn as an unrelated one; (23) backport of hayro 0.8's `gradient` module: `EncodedShadingPattern::as_svg_gradient` turns an axial or radial shading into stops of an sRGB gradient (within 0.01 per channel, a stop at every stitching-function bound via `Function::stitching_bounds`) when a native gradient draws it exactly (extended past the box drawn in; a radial one with no background colour); (24) `DecodedImageCache`: decoded image pixels shared across renders through the interpreter cache within a 64 MiB budget (an image-heavy page decoded its thousands of images again per tile and per scale), keyed by every decode input (`DecodedImageKey`: the stream's place and dictionary bytes, its object, mask/stencil/raster output, interpolation, decode target size, preview or final); images under a transfer function and inline images are not cached, an image over the budget is never kept, and a poisoned lock decodes uncached; (25) Lab colour spaces honour their own `/WhitePoint`: L\*a\*b\* goes to XYZ relative to that white, is Bradford-adapted to D65 and converted to sRGB (ISO 32000-2 §8.6.5.4) instead of through `LAB.icc` as if every white were D50 (a D65 blue came out 45 levels too red; the profile is removed); components normalised to [0, 1] (`manual_scale`, an `/Indexed` palette over Lab) map onto L\* 0..100 and the a\*/b\* `/Range` | (1) `raster::tests::widget_appearance_states`; (2, 3) `xtask text-oracle` on corpus/pdfjs issue918; (4) `raster::tests::layer_override_hides_content`; (5) `raster::tests::soft_mask_without_group_colour_space_is_applied`; (6) `raster::tests::self_referencing_tiling_pattern_terminates`, `raster::tests::self_referencing_type3_glyph_terminates`; (7) `raster::tests::huge_cid_width_ranges_terminate`; (8) `raster::tests::hiding_comments_keeps_fields`; (9) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (10) `raster::tests::type3_glyphs_that_fan_out_into_themselves_finish`; (11) `raster::tests::type1_font_programs_with_long_runs_of_numbers_load_quickly`; (12) `raster::tests::degenerate_annotation_appearances_are_skipped`; (13) `raster::tests::highlights_without_an_appearance_are_drawn`; (14) `raster::tests::malformed_simple_font_widths_keep_later_widths_and_the_font`, `raster::tests::huge_simple_font_first_char_terminates`; (15) `raster::tests::annotation_appearance_box_maps_onto_rect`; (16) `raster::tests::clipping_path_applies_after_any_painting_operator`; (17) `raster::tests::dropping_the_pool_cancels_its_renders`, `raster::tests::the_watchdog_stops_the_render_it_gives_up_on`; (18) `raster::tests::page_contents_and_nested_forms_share_one_budget`, `raster::tests::content_painted_again_and_again_keeps_drawing`, `raster::tests::sampled_functions_with_billions_of_samples_are_refused`; (19) `raster::tests::mesh_shadings_far_off_the_page_render`, `raster::tests::many_overlapping_mesh_triangles_finish`, `raster::tests::mesh_shadings_with_many_patches_or_no_rows_finish`; (20) `raster::tests::function_limits_calculator_arithmetic_and_depth`, `raster::tests::function_limits_public_construction_work_and_depth`, `raster::tests::function_limits_stitching_cycles_are_refused_and_shared_children_work`, `raster::tests::function_limits_invalid_calculator_keeps_the_page_renderable`; (21) `raster::tests::cids_a_substitute_lacks_are_not_drawn_as_other_glyphs` |; (22) `raster::tests::variation_sequences_draw_their_kanji_in_a_substitute`; (23) `raster::tests::axial_and_radial_shadings_draw_as_native_gradients`; (24) `raster::tests::tiles_match_full_render`, `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel` (both decode through the cache), `raster::tests::decoded_images_with_identical_dictionaries_keep_their_own_pixels`, `raster::tests::decoded_images_under_a_transfer_function_are_not_shared`; (25) `raster::tests::lab_honours_the_space_white_point`, `raster::tests::indexed_palettes_over_lab_keep_their_colours`
+| hayro-interpret | 0.7.0 | Apache-2.0 OR MIT | (1) select `/AP /N` appearance states via `/AS` (checkboxes, radios, stateful icons) and honour the NoView flag; (2) Type3 Unicode fallback to `/Encoding` glyph names, then printable ASCII; (3) `Type3Glyph::advance_width`; (4) `InterpreterSettings::ocg_overrides` for viewer layer toggles; (5) soft masks whose group lacks `/CS` were dropped (Chrome gradient text); (6) paint nesting cap `MAX_PAINT_NESTING` for tiling patterns and Type 3 glyphs (self-referencing content overflowed the stack); (7) CID width ranges in `/W` and `/W2` clamped to `MAX_CID` (a `0 4294967295 w` range hung); (8) `InterpreterSettings::hide_comments` skips markup annotations but keeps widgets and links (View ▸ Hide all comments); (9) `image_size_ok`: images and masks over 2^28 pixels are not decoded (a fuzzed `/W 4294967295` stencil mask allocated 4 GiB); (10) `MAX_NESTED_PAINTS`: nested paints (forms, Type 3 glyphs and tiling patterns inside one another) share a per-page budget of 50,000 (a glyph showing eight glyphs of its own font, sixteen deep, hung); (11) depends on skrifa 0.47 instead of 0.42 (upstream read-fonts fixed a Type 1 tokenizer that recursed through runs of numbers: a fuzzed font hung or overflowed the stack), with the one API change (`Charset::glyph_id` returns `Option`); (12) annotation appearances whose `/BBox` or `/Matrix` collapses to a line or a point are skipped (mapping them onto `/Rect` divided by zero and handed the device infinite or NaN matrices); (13) a Highlight annotation without a usable normal appearance is drawn from its `/QuadPoints`, `/C` and `/CA` with Multiply blending, as pdfcraft-annot draws highlights (it was not drawn at all); (14) simple-font `/Widths` (`read_widths`): entries only for codes 0–255 (one entry per code below `/FirstChar` was allocated: `4294967295` asked for 34 GB), an entry that isn't a number leaves its code missing instead of ending the array, and a `/LastChar` below `/FirstChar` gives no widths instead of discarding the font for a standard one; (15) the appearance box is mapped onto `/Rect` corner to corner: the translation now accounts for the scale (an appearance whose box didn't start at the origin and differed in size from `/Rect` was drawn shifted); (16) a clip set by `W`/`W*` takes effect after whichever path-painting operator ends the path (`S`, `f`, `B`, … as well as `n`; ISO 32000-2 §8.5.4): it was applied only on `n`, so `re W* S` clipped nothing and the clip stayed pending for a later, unrelated `n`; (17) `InterpreterSettings::cancelled`: once set, interpretation stops before the next content operator (a render pool sets it for every worker when dropped, after an edit or on closing, and for one worker when the watchdog gives up on its render, so renders whose answers nobody can receive stop instead of running to the end); (18) `MAX_PAGE_CONTENT`: the content a page holds at once (its contents, and the forms, tiling patterns and Type 3 glyph procedures being painted) stays within 512 MiB (`decode_content`; once it runs out, `InterpreterWarning::ContentTruncated` is reported (once per page by pdfcraft-render) so a truncated page is not a clean render; each level gives its bytes back when it finishes): forms nest fifty deep and each level kept its content while the next ran, so a form painting itself around a stream inflating to 256 MiB would have held over 12 GB; and Type 0 sampled functions take at most `MAX_SAMPLE_ENTRIES` (2^21) table points and `MAX_SAMPLE_VALUES` (2^23) samples, read no further than `/Size` asks (256 MiB of 1-bit samples asked for over 8 GB); (19) mesh shadings (types 4–7) are sampled only inside the area being drawn (`ShadingPattern::encode_within`, which the vendored hayro renderer calls with that area plus a pixel), within 8 visits per pixel of it plus 4 per triangle (`TriangleSampler`), and patches are triangulated one at a time: points far off the page were sampled over their whole bounding box, up to 65536 × 65536 entries (a fuzzed 147-byte patch stream; a synthetic page passed 6 GB in six seconds), ten thousand overlapping triangles ran for minutes, and every patch became 722 triangles before any limit; meshes hold at most `MAX_MESH_PATCHES` (2^16) patches and `MAX_MESH_TRIANGLES` (2^20) triangles, a lattice needs two to 2^19 vertices per row (`/VerticesPerRow 0` pushed empty rows for ever; one huge row read the whole stream), and a page samples at most `MAX_PAGE_MESH_TRIANGLES` (2^25) mesh triangles in all (a mesh painted a thousand times was triangulated a thousand times); each cut logs a warning; (20) PDF function construction is limited to 64 levels and 10,000 total nodes with cycle detection; calculator parsing and evaluation share procedure depth/work budgets, integer division/bitshift/rotation/index are panic-free, and fixed-size stack errors propagate; (21) a Type 0 font drawn with a substitute that isn't CID-keyed (it isn't embedded, or its program doesn't load) draws `.notdef` for a CID of an Adobe character collection (Japan1, GB1, CNS1, Korea1) that it can't find by Unicode: hayro took the CID for a glyph index of the substitute, which numbers its glyphs its own way, so the character was drawn as an unrelated one (𠮷 as "Ｑ" in BIZ UDPGothic); (22) a Type 0 font drawn with a substitute finds a character given with a variation selector (`/ToUnicode`, or Adobe-Japan1-UCS2, which maps the JIS X 0208 forms of the kanji JIS X 0213:2004 redrew that way: CID 1247 is 噂 U+E0100) through the substitute's variation sequences, else as the character alone: such a CID found no glyph and was drawn as an unrelated one; (23) backport of hayro 0.8's `gradient` module: `EncodedShadingPattern::as_svg_gradient` turns an axial or radial shading into stops of an sRGB gradient (within 0.01 per channel, a stop at every stitching-function bound via `Function::stitching_bounds`) when a native gradient draws it exactly (extended past the box drawn in; a radial one with no background colour); (24) `DecodedImageCache`: decoded image pixels shared across renders through the interpreter cache within a 64 MiB budget (an image-heavy page decoded its thousands of images again per tile and per scale), keyed by every decode input (`DecodedImageKey`: the stream's place and dictionary bytes, its object, mask/stencil/raster output, interpolation, decode target size, preview or final); images under a transfer function and inline images are not cached, an image over the budget is never kept, and a poisoned lock decodes uncached; (25) `Device::actual_text` hands the device a marked content sequence's `/ActualText` (inline or named in `/Properties`), so text extraction keeps the Thai, Indic and Arabic clusters Chrome marks this way (their shaped tone marks and vowels have no Unicode of their own); (26) non-embedded simple fonts drawn with a standard-font stand-in build the Latin Extended-A letters the stand-in lacks (`/Gbreve`, `/Idotaccent`, `/Scedilla`, `/aogonek`, `/ccaron`…) from the base letter and accent it has (`StandardKind::composite_glyph`, `ACCENTED_LETTERS`): PDFium's Foxit stand-ins hold only the Standard/WinAnsi/Mac Roman glyphs, so iText letters with Times New Roman unembedded showed blanks for Ğ, İ, Ş, ğ and ş; (27) an embedded TrueType font without a base encoding reads its codes as WinAnsi for text extraction (`EmbeddedKind::code_to_unicode_name`), matching pdftotext's output, instead of Standard: OCR text layers of scans write WinAnsi codes with no `/Encoding`, and Standard has no ü, ö or ß and reads é as Ø (glyph selection unchanged); (28) an image whose pixels hold at most 16 bits of samples (an 8-bit Separation or DeviceN image, a 1-, 2- or 4-bit gray or indexed one) is converted once per possible pixel value through a lookup table instead of once per pixel (`rgb_via_lookup`): a spot-colour tint transform is often a PostScript calculator program, run for every pixel, so a fillable character sheet's 3304 × 4105 DeviceN background took four seconds and 430 MB to draw a page; each entry is converted on its own (`convert_each`), so a tint transform giving the wrong number of components for a value the image never uses cannot shift the colours of the values it does; (29) `Device::begin_annotations`/`end_annotations` bracket the page's annotations, so a device can tell comment paints from document paints (reading colours recolour the document, never a comment, #1548) | (1) `raster::tests::widget_appearance_states`; (2, 3) `xtask text-oracle` on corpus/pdfjs issue918; (4) `raster::tests::layer_override_hides_content`; (5) `raster::tests::soft_mask_without_group_colour_space_is_applied`; (6) `raster::tests::self_referencing_tiling_pattern_terminates`, `raster::tests::self_referencing_type3_glyph_terminates`; (7) `raster::tests::huge_cid_width_ranges_terminate`; (8) `raster::tests::hiding_comments_keeps_fields`; (9) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (10) `raster::tests::type3_glyphs_that_fan_out_into_themselves_finish`; (11) `raster::tests::type1_font_programs_with_long_runs_of_numbers_load_quickly`; (12) `raster::tests::degenerate_annotation_appearances_are_skipped`; (13) `raster::tests::highlights_without_an_appearance_are_drawn`; (14) `raster::tests::malformed_simple_font_widths_keep_later_widths_and_the_font`, `raster::tests::huge_simple_font_first_char_terminates`; (15) `raster::tests::annotation_appearance_box_maps_onto_rect`; (16) `raster::tests::clipping_path_applies_after_any_painting_operator`; (17) `raster::tests::dropping_the_pool_cancels_its_renders`, `raster::tests::the_watchdog_stops_the_render_it_gives_up_on`; (18) `raster::tests::page_contents_and_nested_forms_share_one_budget`, `raster::tests::content_painted_again_and_again_keeps_drawing`, `raster::tests::sampled_functions_with_billions_of_samples_are_refused`; (19) `raster::tests::mesh_shadings_far_off_the_page_render`, `raster::tests::many_overlapping_mesh_triangles_finish`, `raster::tests::mesh_shadings_with_many_patches_or_no_rows_finish`; (20) `raster::tests::function_limits_calculator_arithmetic_and_depth`, `raster::tests::function_limits_public_construction_work_and_depth`, `raster::tests::function_limits_stitching_cycles_are_refused_and_shared_children_work`, `raster::tests::function_limits_invalid_calculator_keeps_the_page_renderable`; (21) `raster::tests::cids_a_substitute_lacks_are_not_drawn_as_other_glyphs`; (26) `raster::tests::accented_letters_the_standard_stand_ins_lack_are_built_from_their_parts` |; (22) `raster::tests::variation_sequences_draw_their_kanji_in_a_substitute`; (23) `raster::tests::axial_and_radial_shadings_draw_as_native_gradients`; (24) `raster::tests::tiles_match_full_render`, `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel` (both decode through the cache), `raster::tests::decoded_images_with_identical_dictionaries_keep_their_own_pixels`, `raster::tests::decoded_images_under_a_transfer_function_are_not_shared`; (25) `text::tests::actual_text_replaces_the_glyphs_it_marks_in_every_writing_direction`, `text::tests::actual_text_follows_the_pdf_rules_for_marked_content`; (27) `text::tests::truetype_without_an_encoding_reads_its_codes_as_win_ansi`; (28) `raster::tests::spot_colour_images_run_their_tint_transform_once_per_sample_value`, `raster::tests::images_converted_through_a_table_keep_every_samples_colour`, `raster::tests::a_malformed_tint_for_an_unused_sample_keeps_the_used_colours`; (29) `raster::tests::reading_colors_keep_highlight_annotations_readable` |
+| hayro-interpret | 0.7.0 | Apache-2.0 OR MIT | (1) select `/AP /N` appearance states via `/AS` (checkboxes, radios, stateful icons) and honour the NoView flag; (2) Type3 Unicode fallback to `/Encoding` glyph names, then printable ASCII; (3) `Type3Glyph::advance_width`; (4) `InterpreterSettings::ocg_overrides` for viewer layer toggles; (5) soft masks whose group lacks `/CS` were dropped (Chrome gradient text); (6) paint nesting cap `MAX_PAINT_NESTING` for tiling patterns and Type 3 glyphs (self-referencing content overflowed the stack); (7) CID width ranges in `/W` and `/W2` clamped to `MAX_CID` (a `0 4294967295 w` range hung); (8) `InterpreterSettings::hide_comments` skips markup annotations but keeps widgets and links (View ▸ Hide all comments); (9) `image_size_ok`: images and masks over 2^28 pixels are not decoded (a fuzzed `/W 4294967295` stencil mask allocated 4 GiB); (10) `MAX_NESTED_PAINTS`: nested paints (forms, Type 3 glyphs and tiling patterns inside one another) share a per-page budget of 50,000 (a glyph showing eight glyphs of its own font, sixteen deep, hung); (11) depends on skrifa 0.47 instead of 0.42 (upstream read-fonts fixed a Type 1 tokenizer that recursed through runs of numbers: a fuzzed font hung or overflowed the stack), with the one API change (`Charset::glyph_id` returns `Option`); (12) annotation appearances whose `/BBox` or `/Matrix` collapses to a line or a point are skipped (mapping them onto `/Rect` divided by zero and handed the device infinite or NaN matrices); (13) a Highlight annotation without a usable normal appearance is drawn from its `/QuadPoints`, `/C` and `/CA` with Multiply blending, as pdfcraft-annot draws highlights (it was not drawn at all); (14) simple-font `/Widths` (`read_widths`): entries only for codes 0–255 (one entry per code below `/FirstChar` was allocated: `4294967295` asked for 34 GB), an entry that isn't a number leaves its code missing instead of ending the array, and a `/LastChar` below `/FirstChar` gives no widths instead of discarding the font for a standard one; (15) the appearance box is mapped onto `/Rect` corner to corner: the translation now accounts for the scale (an appearance whose box didn't start at the origin and differed in size from `/Rect` was drawn shifted); (16) a clip set by `W`/`W*` takes effect after whichever path-painting operator ends the path (`S`, `f`, `B`, … as well as `n`; ISO 32000-2 §8.5.4): it was applied only on `n`, so `re W* S` clipped nothing and the clip stayed pending for a later, unrelated `n`; (17) `InterpreterSettings::cancelled`: once set, interpretation stops before the next content operator (a render pool sets it for every worker when dropped, after an edit or on closing, and for one worker when the watchdog gives up on its render, so renders whose answers nobody can receive stop instead of running to the end); (18) `MAX_PAGE_CONTENT`: the content a page holds at once (its contents, and the forms, tiling patterns and Type 3 glyph procedures being painted) stays within 512 MiB (`decode_content`; once it runs out, `InterpreterWarning::ContentTruncated` is reported (once per page by pdfcraft-render) so a truncated page is not a clean render; each level gives its bytes back when it finishes): forms nest fifty deep and each level kept its content while the next ran, so a form painting itself around a stream inflating to 256 MiB would have held over 12 GB; and Type 0 sampled functions take at most `MAX_SAMPLE_ENTRIES` (2^21) table points and `MAX_SAMPLE_VALUES` (2^23) samples, read no further than `/Size` asks (256 MiB of 1-bit samples asked for over 8 GB); (19) mesh shadings (types 4–7) are sampled only inside the area being drawn (`ShadingPattern::encode_within`, which the vendored hayro renderer calls with that area plus a pixel), within 8 visits per pixel of it plus 4 per triangle (`TriangleSampler`), and patches are triangulated one at a time: points far off the page were sampled over their whole bounding box, up to 65536 × 65536 entries (a fuzzed 147-byte patch stream; a synthetic page passed 6 GB in six seconds), ten thousand overlapping triangles ran for minutes, and every patch became 722 triangles before any limit; meshes hold at most `MAX_MESH_PATCHES` (2^16) patches and `MAX_MESH_TRIANGLES` (2^20) triangles, a lattice needs two to 2^19 vertices per row (`/VerticesPerRow 0` pushed empty rows for ever; one huge row read the whole stream), and a page samples at most `MAX_PAGE_MESH_TRIANGLES` (2^25) mesh triangles in all (a mesh painted a thousand times was triangulated a thousand times); each cut logs a warning; (20) PDF function construction is limited to 64 levels and 10,000 total nodes with cycle detection; calculator parsing and evaluation share procedure depth/work budgets, integer division/bitshift/rotation/index are panic-free, and fixed-size stack errors propagate; (21) a Type 0 font drawn with a substitute that isn't CID-keyed (it isn't embedded, or its program doesn't load) draws `.notdef` for a CID of an Adobe character collection (Japan1, GB1, CNS1, Korea1) that it can't find by Unicode: hayro took the CID for a glyph index of the substitute, which numbers its glyphs its own way, so the character was drawn as an unrelated one (𠮷 as "Ｑ" in BIZ UDPGothic); (22) a Type 0 font drawn with a substitute finds a character given with a variation selector (`/ToUnicode`, or Adobe-Japan1-UCS2, which maps the JIS X 0208 forms of the kanji JIS X 0213:2004 redrew that way: CID 1247 is 噂 U+E0100) through the substitute's variation sequences, else as the character alone: such a CID found no glyph and was drawn as an unrelated one; (23) backport of hayro 0.8's `gradient` module: `EncodedShadingPattern::as_svg_gradient` turns an axial or radial shading into stops of an sRGB gradient (within 0.01 per channel, a stop at every stitching-function bound via `Function::stitching_bounds`) when a native gradient draws it exactly (extended past the box drawn in; a radial one with no background colour); (24) `DecodedImageCache`: decoded image pixels shared across renders through the interpreter cache within a 64 MiB budget (an image-heavy page decoded its thousands of images again per tile and per scale), keyed by every decode input (`DecodedImageKey`: the stream's place and dictionary bytes, its object, mask/stencil/raster output, interpolation, decode target size, preview or final); images under a transfer function and inline images are not cached, an image over the budget is never kept, and a poisoned lock decodes uncached; (25) `Device::actual_text` hands the device a marked content sequence's `/ActualText` (inline or named in `/Properties`), so text extraction keeps the Thai, Indic and Arabic clusters Chrome marks this way (their shaped tone marks and vowels have no Unicode of their own); (26) non-embedded simple fonts drawn with a standard-font stand-in build the Latin Extended-A letters the stand-in lacks (`/Gbreve`, `/Idotaccent`, `/Scedilla`, `/aogonek`, `/ccaron`…) from the base letter and accent it has (`StandardKind::composite_glyph`, `ACCENTED_LETTERS`): PDFium's Foxit stand-ins hold only the Standard/WinAnsi/Mac Roman glyphs, so iText letters with Times New Roman unembedded showed blanks for Ğ, İ, Ş, ğ and ş; (27) an embedded TrueType font without a base encoding reads its codes as WinAnsi for text extraction (`EmbeddedKind::code_to_unicode_name`), matching pdftotext's output, instead of Standard: OCR text layers of scans write WinAnsi codes with no `/Encoding`, and Standard has no ü, ö or ß and reads é as Ø (glyph selection unchanged); (28) a transparency group that is neither isolated nor knockout, entered at full opacity with no soft mask and Normal blending, is drawn straight onto the page instead of into a layer of its own (§11.4.7: its elements composite with the backdrop; the layer made a `/BM /Multiply` highlight appearance an opaque block, #1968); (29) `Device::begin_annotations`/`end_annotations` bracket the page's annotations, so a device can tell comment paints from document paints (reading colours recolour the document, never a comment, #1548) | (1) `raster::tests::widget_appearance_states`; (2, 3) `xtask text-oracle` on corpus/pdfjs issue918; (4) `raster::tests::layer_override_hides_content`; (5) `raster::tests::soft_mask_without_group_colour_space_is_applied`; (6) `raster::tests::self_referencing_tiling_pattern_terminates`, `raster::tests::self_referencing_type3_glyph_terminates`; (7) `raster::tests::huge_cid_width_ranges_terminate`; (8) `raster::tests::hiding_comments_keeps_fields`; (9) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (10) `raster::tests::type3_glyphs_that_fan_out_into_themselves_finish`; (11) `raster::tests::type1_font_programs_with_long_runs_of_numbers_load_quickly`; (12) `raster::tests::degenerate_annotation_appearances_are_skipped`; (13) `raster::tests::highlights_without_an_appearance_are_drawn`; (14) `raster::tests::malformed_simple_font_widths_keep_later_widths_and_the_font`, `raster::tests::huge_simple_font_first_char_terminates`; (15) `raster::tests::annotation_appearance_box_maps_onto_rect`; (16) `raster::tests::clipping_path_applies_after_any_painting_operator`; (17) `raster::tests::dropping_the_pool_cancels_its_renders`, `raster::tests::the_watchdog_stops_the_render_it_gives_up_on`; (18) `raster::tests::page_contents_and_nested_forms_share_one_budget`, `raster::tests::content_painted_again_and_again_keeps_drawing`, `raster::tests::sampled_functions_with_billions_of_samples_are_refused`; (19) `raster::tests::mesh_shadings_far_off_the_page_render`, `raster::tests::many_overlapping_mesh_triangles_finish`, `raster::tests::mesh_shadings_with_many_patches_or_no_rows_finish`; (20) `raster::tests::function_limits_calculator_arithmetic_and_depth`, `raster::tests::function_limits_public_construction_work_and_depth`, `raster::tests::function_limits_stitching_cycles_are_refused_and_shared_children_work`, `raster::tests::function_limits_invalid_calculator_keeps_the_page_renderable`; (21) `raster::tests::cids_a_substitute_lacks_are_not_drawn_as_other_glyphs`; (26) `raster::tests::accented_letters_the_standard_stand_ins_lack_are_built_from_their_parts` |; (22) `raster::tests::variation_sequences_draw_their_kanji_in_a_substitute`; (23) `raster::tests::axial_and_radial_shadings_draw_as_native_gradients`; (24) `raster::tests::tiles_match_full_render`, `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel` (both decode through the cache), `raster::tests::decoded_images_with_identical_dictionaries_keep_their_own_pixels`, `raster::tests::decoded_images_under_a_transfer_function_are_not_shared`; (25) `text::tests::actual_text_replaces_the_glyphs_it_marks_in_every_writing_direction`, `text::tests::actual_text_follows_the_pdf_rules_for_marked_content`; (27) `text::tests::truetype_without_an_encoding_reads_its_codes_as_win_ansi`; (28) `raster::tests::a_multiply_highlight_inside_a_transparency_group_keeps_the_text`; (29) `raster::tests::reading_colors_keep_highlight_annotations_readable` |
+| hayro-interpret | 0.7.0 | Apache-2.0 OR MIT | (1) select `/AP /N` appearance states via `/AS` (checkboxes, radios, stateful icons) and honour the NoView flag; (2) Type3 Unicode fallback to `/Encoding` glyph names, then printable ASCII; (3) `Type3Glyph::advance_width`; (4) `InterpreterSettings::ocg_overrides` for viewer layer toggles; (5) soft masks whose group lacks `/CS` were dropped (Chrome gradient text); (6) paint nesting cap `MAX_PAINT_NESTING` for tiling patterns and Type 3 glyphs (self-referencing content overflowed the stack); (7) CID width ranges in `/W` and `/W2` clamped to `MAX_CID` (a `0 4294967295 w` range hung); (8) `InterpreterSettings::hide_comments` skips markup annotations but keeps widgets and links (View ▸ Hide all comments); (9) `image_size_ok`: images and masks over 2^28 pixels are not decoded (a fuzzed `/W 4294967295` stencil mask allocated 4 GiB); (10) `MAX_NESTED_PAINTS`: nested paints (forms, Type 3 glyphs and tiling patterns inside one another) share a per-page budget of 50,000 (a glyph showing eight glyphs of its own font, sixteen deep, hung); (11) depends on skrifa 0.47 instead of 0.42 (upstream read-fonts fixed a Type 1 tokenizer that recursed through runs of numbers: a fuzzed font hung or overflowed the stack), with the one API change (`Charset::glyph_id` returns `Option`); (12) annotation appearances whose `/BBox` or `/Matrix` collapses to a line or a point are skipped (mapping them onto `/Rect` divided by zero and handed the device infinite or NaN matrices); (13) a Highlight annotation without a usable normal appearance is drawn from its `/QuadPoints`, `/C` and `/CA` with Multiply blending, as pdfcraft-annot draws highlights (it was not drawn at all); (14) simple-font `/Widths` (`read_widths`): entries only for codes 0–255 (one entry per code below `/FirstChar` was allocated: `4294967295` asked for 34 GB), an entry that isn't a number leaves its code missing instead of ending the array, and a `/LastChar` below `/FirstChar` gives no widths instead of discarding the font for a standard one; (15) the appearance box is mapped onto `/Rect` corner to corner: the translation now accounts for the scale (an appearance whose box didn't start at the origin and differed in size from `/Rect` was drawn shifted); (16) a clip set by `W`/`W*` takes effect after whichever path-painting operator ends the path (`S`, `f`, `B`, … as well as `n`; ISO 32000-2 §8.5.4): it was applied only on `n`, so `re W* S` clipped nothing and the clip stayed pending for a later, unrelated `n`; (17) `InterpreterSettings::cancelled`: once set, interpretation stops before the next content operator (a render pool sets it for every worker when dropped, after an edit or on closing, and for one worker when the watchdog gives up on its render, so renders whose answers nobody can receive stop instead of running to the end); (18) `MAX_PAGE_CONTENT`: the content a page holds at once (its contents, and the forms, tiling patterns and Type 3 glyph procedures being painted) stays within 512 MiB (`decode_content`; once it runs out, `InterpreterWarning::ContentTruncated` is reported (once per page by pdfcraft-render) so a truncated page is not a clean render; each level gives its bytes back when it finishes): forms nest fifty deep and each level kept its content while the next ran, so a form painting itself around a stream inflating to 256 MiB would have held over 12 GB; and Type 0 sampled functions take at most `MAX_SAMPLE_ENTRIES` (2^21) table points and `MAX_SAMPLE_VALUES` (2^23) samples, read no further than `/Size` asks (256 MiB of 1-bit samples asked for over 8 GB); (19) mesh shadings (types 4–7) are sampled only inside the area being drawn (`ShadingPattern::encode_within`, which the vendored hayro renderer calls with that area plus a pixel), within 8 visits per pixel of it plus 4 per triangle (`TriangleSampler`), and patches are triangulated one at a time: points far off the page were sampled over their whole bounding box, up to 65536 × 65536 entries (a fuzzed 147-byte patch stream; a synthetic page passed 6 GB in six seconds), ten thousand overlapping triangles ran for minutes, and every patch became 722 triangles before any limit; meshes hold at most `MAX_MESH_PATCHES` (2^16) patches and `MAX_MESH_TRIANGLES` (2^20) triangles, a lattice needs two to 2^19 vertices per row (`/VerticesPerRow 0` pushed empty rows for ever; one huge row read the whole stream), and a page samples at most `MAX_PAGE_MESH_TRIANGLES` (2^25) mesh triangles in all (a mesh painted a thousand times was triangulated a thousand times); each cut logs a warning; (20) PDF function construction is limited to 64 levels and 10,000 total nodes with cycle detection; calculator parsing and evaluation share procedure depth/work budgets, integer division/bitshift/rotation/index are panic-free, and fixed-size stack errors propagate; (21) a Type 0 font drawn with a substitute that isn't CID-keyed (it isn't embedded, or its program doesn't load) draws `.notdef` for a CID of an Adobe character collection (Japan1, GB1, CNS1, Korea1) that it can't find by Unicode: hayro took the CID for a glyph index of the substitute, which numbers its glyphs its own way, so the character was drawn as an unrelated one (𠮷 as "Ｑ" in BIZ UDPGothic); (22) a Type 0 font drawn with a substitute finds a character given with a variation selector (`/ToUnicode`, or Adobe-Japan1-UCS2, which maps the JIS X 0208 forms of the kanji JIS X 0213:2004 redrew that way: CID 1247 is 噂 U+E0100) through the substitute's variation sequences, else as the character alone: such a CID found no glyph and was drawn as an unrelated one; (23) backport of hayro 0.8's `gradient` module: `EncodedShadingPattern::as_svg_gradient` turns an axial or radial shading into stops of an sRGB gradient (within 0.01 per channel, a stop at every stitching-function bound via `Function::stitching_bounds`) when a native gradient draws it exactly (extended past the box drawn in; a radial one with no background colour); (24) `DecodedImageCache`: decoded image pixels shared across renders through the interpreter cache within a 64 MiB budget (an image-heavy page decoded its thousands of images again per tile and per scale), keyed by every decode input (`DecodedImageKey`: the stream's place and dictionary bytes, its object, mask/stencil/raster output, interpolation, decode target size, preview or final); images under a transfer function and inline images are not cached, an image over the budget is never kept, and a poisoned lock decodes uncached; (25) `Device::actual_text` hands the device a marked content sequence's `/ActualText` (inline or named in `/Properties`), so text extraction keeps the Thai, Indic and Arabic clusters Chrome marks this way (their shaped tone marks and vowels have no Unicode of their own); (26) non-embedded simple fonts drawn with a standard-font stand-in build the Latin Extended-A letters the stand-in lacks (`/Gbreve`, `/Idotaccent`, `/Scedilla`, `/aogonek`, `/ccaron`…) from the base letter and accent it has (`StandardKind::composite_glyph`, `ACCENTED_LETTERS`): PDFium's Foxit stand-ins hold only the Standard/WinAnsi/Mac Roman glyphs, so iText letters with Times New Roman unembedded showed blanks for Ğ, İ, Ş, ğ and ş; (27) text in a Type 3 font is drawn filled whatever the text rendering mode, except mode 3 (invisible): only that mode has any effect on Type 3 fonts (ISO 32000-1 §9.3.6). Stroking ran the glyph procedure a second time, so `2 Tr` made bitmap fonts look bold, `1 Tr` painted an uncoloured glyph in the stroking colour, and `7 Tr` hid it; (29) `Device::begin_annotations`/`end_annotations` bracket the page's annotations, so a device can tell comment paints from document paints (reading colours recolour the document, never a comment, #1548) | (1) `raster::tests::widget_appearance_states`; (2, 3) `xtask text-oracle` on corpus/pdfjs issue918; (4) `raster::tests::layer_override_hides_content`; (5) `raster::tests::soft_mask_without_group_colour_space_is_applied`; (6) `raster::tests::self_referencing_tiling_pattern_terminates`, `raster::tests::self_referencing_type3_glyph_terminates`; (7) `raster::tests::huge_cid_width_ranges_terminate`; (8) `raster::tests::hiding_comments_keeps_fields`; (9) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (10) `raster::tests::type3_glyphs_that_fan_out_into_themselves_finish`; (11) `raster::tests::type1_font_programs_with_long_runs_of_numbers_load_quickly`; (12) `raster::tests::degenerate_annotation_appearances_are_skipped`; (13) `raster::tests::highlights_without_an_appearance_are_drawn`; (14) `raster::tests::malformed_simple_font_widths_keep_later_widths_and_the_font`, `raster::tests::huge_simple_font_first_char_terminates`; (15) `raster::tests::annotation_appearance_box_maps_onto_rect`; (16) `raster::tests::clipping_path_applies_after_any_painting_operator`; (17) `raster::tests::dropping_the_pool_cancels_its_renders`, `raster::tests::the_watchdog_stops_the_render_it_gives_up_on`; (18) `raster::tests::page_contents_and_nested_forms_share_one_budget`, `raster::tests::content_painted_again_and_again_keeps_drawing`, `raster::tests::sampled_functions_with_billions_of_samples_are_refused`; (19) `raster::tests::mesh_shadings_far_off_the_page_render`, `raster::tests::many_overlapping_mesh_triangles_finish`, `raster::tests::mesh_shadings_with_many_patches_or_no_rows_finish`; (20) `raster::tests::function_limits_calculator_arithmetic_and_depth`, `raster::tests::function_limits_public_construction_work_and_depth`, `raster::tests::function_limits_stitching_cycles_are_refused_and_shared_children_work`, `raster::tests::function_limits_invalid_calculator_keeps_the_page_renderable`; (21) `raster::tests::cids_a_substitute_lacks_are_not_drawn_as_other_glyphs`; (26) `raster::tests::accented_letters_the_standard_stand_ins_lack_are_built_from_their_parts` |; (22) `raster::tests::variation_sequences_draw_their_kanji_in_a_substitute`; (23) `raster::tests::axial_and_radial_shadings_draw_as_native_gradients`; (24) `raster::tests::tiles_match_full_render`, `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel` (both decode through the cache), `raster::tests::decoded_images_with_identical_dictionaries_keep_their_own_pixels`, `raster::tests::decoded_images_under_a_transfer_function_are_not_shared`; (25) `text::tests::actual_text_replaces_the_glyphs_it_marks_in_every_writing_direction`, `text::tests::actual_text_follows_the_pdf_rules_for_marked_content`; (27) `raster::tests::text_rendering_modes_other_than_invisible_draw_type3_glyphs_as_filled`; (29) `raster::tests::reading_colors_keep_highlight_annotations_readable` |
+| hayro-interpret | 0.7.0 | Apache-2.0 OR MIT | (1) select `/AP /N` appearance states via `/AS` (checkboxes, radios, stateful icons) and honour the NoView flag; (2) Type3 Unicode fallback to `/Encoding` glyph names, then printable ASCII; (3) `Type3Glyph::advance_width`; (4) `InterpreterSettings::ocg_overrides` for viewer layer toggles; (5) soft masks whose group lacks `/CS` were dropped (Chrome gradient text); (6) paint nesting cap `MAX_PAINT_NESTING` for tiling patterns and Type 3 glyphs (self-referencing content overflowed the stack); (7) CID width ranges in `/W` and `/W2` clamped to `MAX_CID` (a `0 4294967295 w` range hung); (8) `InterpreterSettings::hide_comments` skips markup annotations but keeps widgets and links (View ▸ Hide all comments); (9) `image_size_ok`: images and masks over 2^28 pixels are not decoded (a fuzzed `/W 4294967295` stencil mask allocated 4 GiB); (10) `MAX_NESTED_PAINTS`: nested paints (forms, Type 3 glyphs and tiling patterns inside one another) share a per-page budget of 50,000 (a glyph showing eight glyphs of its own font, sixteen deep, hung); (11) depends on skrifa 0.47 instead of 0.42 (upstream read-fonts fixed a Type 1 tokenizer that recursed through runs of numbers: a fuzzed font hung or overflowed the stack), with the one API change (`Charset::glyph_id` returns `Option`); (12) annotation appearances whose `/BBox` or `/Matrix` collapses to a line or a point are skipped (mapping them onto `/Rect` divided by zero and handed the device infinite or NaN matrices); (13) a Highlight annotation without a usable normal appearance is drawn from its `/QuadPoints`, `/C` and `/CA` with Multiply blending, as pdfcraft-annot draws highlights (it was not drawn at all); (14) simple-font `/Widths` (`read_widths`): entries only for codes 0–255 (one entry per code below `/FirstChar` was allocated: `4294967295` asked for 34 GB), an entry that isn't a number leaves its code missing instead of ending the array, and a `/LastChar` below `/FirstChar` gives no widths instead of discarding the font for a standard one; (15) the appearance box is mapped onto `/Rect` corner to corner: the translation now accounts for the scale (an appearance whose box didn't start at the origin and differed in size from `/Rect` was drawn shifted); (16) a clip set by `W`/`W*` takes effect after whichever path-painting operator ends the path (`S`, `f`, `B`, … as well as `n`; ISO 32000-2 §8.5.4): it was applied only on `n`, so `re W* S` clipped nothing and the clip stayed pending for a later, unrelated `n`; (17) `InterpreterSettings::cancelled`: once set, interpretation stops before the next content operator (a render pool sets it for every worker when dropped, after an edit or on closing, and for one worker when the watchdog gives up on its render, so renders whose answers nobody can receive stop instead of running to the end); (18) `MAX_PAGE_CONTENT`: the content a page holds at once (its contents, and the forms, tiling patterns and Type 3 glyph procedures being painted) stays within 512 MiB (`decode_content`; once it runs out, `InterpreterWarning::ContentTruncated` is reported (once per page by pdfcraft-render) so a truncated page is not a clean render; each level gives its bytes back when it finishes): forms nest fifty deep and each level kept its content while the next ran, so a form painting itself around a stream inflating to 256 MiB would have held over 12 GB; and Type 0 sampled functions take at most `MAX_SAMPLE_ENTRIES` (2^21) table points and `MAX_SAMPLE_VALUES` (2^23) samples, read no further than `/Size` asks (256 MiB of 1-bit samples asked for over 8 GB); (19) mesh shadings (types 4–7) are sampled only inside the area being drawn (`ShadingPattern::encode_within`, which the vendored hayro renderer calls with that area plus a pixel), within 8 visits per pixel of it plus 4 per triangle (`TriangleSampler`), and patches are triangulated one at a time: points far off the page were sampled over their whole bounding box, up to 65536 × 65536 entries (a fuzzed 147-byte patch stream; a synthetic page passed 6 GB in six seconds), ten thousand overlapping triangles ran for minutes, and every patch became 722 triangles before any limit; meshes hold at most `MAX_MESH_PATCHES` (2^16) patches and `MAX_MESH_TRIANGLES` (2^20) triangles, a lattice needs two to 2^19 vertices per row (`/VerticesPerRow 0` pushed empty rows for ever; one huge row read the whole stream), and a page samples at most `MAX_PAGE_MESH_TRIANGLES` (2^25) mesh triangles in all (a mesh painted a thousand times was triangulated a thousand times); each cut logs a warning; (20) PDF function construction is limited to 64 levels and 10,000 total nodes with cycle detection; calculator parsing and evaluation share procedure depth/work budgets, integer division/bitshift/rotation/index are panic-free, and fixed-size stack errors propagate; (21) a Type 0 font drawn with a substitute that isn't CID-keyed (it isn't embedded, or its program doesn't load) draws `.notdef` for a CID of an Adobe character collection (Japan1, GB1, CNS1, Korea1) that it can't find by Unicode: hayro took the CID for a glyph index of the substitute, which numbers its glyphs its own way, so the character was drawn as an unrelated one (𠮷 as "Ｑ" in BIZ UDPGothic); (22) a Type 0 font drawn with a substitute finds a character given with a variation selector (`/ToUnicode`, or Adobe-Japan1-UCS2, which maps the JIS X 0208 forms of the kanji JIS X 0213:2004 redrew that way: CID 1247 is 噂 U+E0100) through the substitute's variation sequences, else as the character alone: such a CID found no glyph and was drawn as an unrelated one; (23) backport of hayro 0.8's `gradient` module: `EncodedShadingPattern::as_svg_gradient` turns an axial or radial shading into stops of an sRGB gradient (within 0.01 per channel, a stop at every stitching-function bound via `Function::stitching_bounds`) when a native gradient draws it exactly (extended past the box drawn in; a radial one with no background colour); (24) `DecodedImageCache`: decoded image pixels shared across renders through the interpreter cache within a 64 MiB budget (an image-heavy page decoded its thousands of images again per tile and per scale), keyed by every decode input (`DecodedImageKey`: the stream's place and dictionary bytes, its object, mask/stencil/raster output, interpolation, decode target size, preview or final); images under a transfer function and inline images are not cached, an image over the budget is never kept, and a poisoned lock decodes uncached; (25) Lab colour spaces honour their own `/WhitePoint`: L\*a\*b\* goes to XYZ relative to that white, is Bradford-adapted to D65 and converted to sRGB (ISO 32000-2 §8.6.5.4) instead of through `LAB.icc` as if every white were D50 (a D65 blue came out 45 levels too red; the profile is removed); components normalised to [0, 1] (`manual_scale`, an `/Indexed` palette over Lab) map onto L\* 0..100 and the a\*/b\* `/Range`; (29) `Device::begin_annotations`/`end_annotations` bracket the page's annotations, so a device can tell comment paints from document paints (reading colours recolour the document, never a comment, #1548) | (1) `raster::tests::widget_appearance_states`; (2, 3) `xtask text-oracle` on corpus/pdfjs issue918; (4) `raster::tests::layer_override_hides_content`; (5) `raster::tests::soft_mask_without_group_colour_space_is_applied`; (6) `raster::tests::self_referencing_tiling_pattern_terminates`, `raster::tests::self_referencing_type3_glyph_terminates`; (7) `raster::tests::huge_cid_width_ranges_terminate`; (8) `raster::tests::hiding_comments_keeps_fields`; (9) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (10) `raster::tests::type3_glyphs_that_fan_out_into_themselves_finish`; (11) `raster::tests::type1_font_programs_with_long_runs_of_numbers_load_quickly`; (12) `raster::tests::degenerate_annotation_appearances_are_skipped`; (13) `raster::tests::highlights_without_an_appearance_are_drawn`; (14) `raster::tests::malformed_simple_font_widths_keep_later_widths_and_the_font`, `raster::tests::huge_simple_font_first_char_terminates`; (15) `raster::tests::annotation_appearance_box_maps_onto_rect`; (16) `raster::tests::clipping_path_applies_after_any_painting_operator`; (17) `raster::tests::dropping_the_pool_cancels_its_renders`, `raster::tests::the_watchdog_stops_the_render_it_gives_up_on`; (18) `raster::tests::page_contents_and_nested_forms_share_one_budget`, `raster::tests::content_painted_again_and_again_keeps_drawing`, `raster::tests::sampled_functions_with_billions_of_samples_are_refused`; (19) `raster::tests::mesh_shadings_far_off_the_page_render`, `raster::tests::many_overlapping_mesh_triangles_finish`, `raster::tests::mesh_shadings_with_many_patches_or_no_rows_finish`; (20) `raster::tests::function_limits_calculator_arithmetic_and_depth`, `raster::tests::function_limits_public_construction_work_and_depth`, `raster::tests::function_limits_stitching_cycles_are_refused_and_shared_children_work`, `raster::tests::function_limits_invalid_calculator_keeps_the_page_renderable`; (21) `raster::tests::cids_a_substitute_lacks_are_not_drawn_as_other_glyphs` |; (22) `raster::tests::variation_sequences_draw_their_kanji_in_a_substitute`; (23) `raster::tests::axial_and_radial_shadings_draw_as_native_gradients`; (24) `raster::tests::tiles_match_full_render`, `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel` (both decode through the cache), `raster::tests::decoded_images_with_identical_dictionaries_keep_their_own_pixels`, `raster::tests::decoded_images_under_a_transfer_function_are_not_shared`; (25) `raster::tests::lab_honours_the_space_white_point`, `raster::tests::indexed_palettes_over_lab_keep_their_colours`; (29) `raster::tests::reading_colors_keep_highlight_annotations_readable` |
 
-| hayro | 0.7.1 | Apache-2.0 OR MIT | (1) `RenderSettings::{x_offset, y_offset}` to render one tile of a large page; (2) images over `MAX_IMAGE_PIXELS` (2^28) are skipped (a fuzzed `/W 4294967295` hung in resampling); (3) `tiling_cell_scale` keeps a tiling pattern's cell pixmap within 3000 px a side whatever its `/XStep`/`/YStep` (a fuzzed step far beyond `/BBox` allocated 2 GB); (4) stroke widths clamped to 4 × (canvas width + height) device pixels (a fuzzed `/LW 9223372036854775807` allocated 10 GB in stroke expansion); (5) `usable_dash_pattern`: a stroke whose dash pattern could cut it into more than `MAX_DASHES_PER_STROKE` (250,000) pieces, counting kurbo's restart of the pattern at every subpath and `ClosePath`, is drawn solid (a fuzzed `/D [[11] 0]` on a line from x = 92234775807 allocated over 5 GB, `[0.000001] 0 d` on a 20 pt line over 10 GB); (6) a dash pattern with a negative or non-finite entry, or a period that isn't positive, is drawn solid (`[-1 -1] 0 d` looped for ever in kurbo); (7) `render_size` and `render_into`: render into a buffer the caller allocates (PdfCraft renders into pixel-aligned memory that the GUI takes over as texture data); `render` is `render_into` on a new pixmap; (8) checked image source/target/RGBA, alpha-premultiplication scratch and intermediate sizes before resampling, finite transforms and exact source/mask buffers; sources wider than u16 may shrink before backend limits, with a 2^20 source-axis cap and conservative 128 MiB filter-planning estimate; an over-limit or failed resize keeps the original image resolution and geometry when the source fits the backend, otherwise skips it, with a logged warning; staging, resampling output/scratch, RGBA conversion and padding buffers use fallible reserves; (9) `may_paint_canvas`: a fill or stroke whose control-point box, grown by how far its paint reaches past the path (half the stroke width times the larger of the miter limit and √2) plus 0.5 user units and 2 pixels, misses the canvas is not drawn, so a tile no longer strokes and fills every path of its page (item 5 of #623); `set_skip_offscreen_paths` turns this off for the regression test; (10) backport of hayro 0.8: shadings that `as_svg_gradient` can represent are painted as a `vello_cpu` linear or two-point radial gradient instead of a texture sampled pixel by pixel through the shading function (InDesign fades are luminosity soft masks of one full-page axial `sh`: 40 on a report page took 15 s at 144 dpi, now under 1 s); without upstream's half-pixel shift, which suits vello_cpu 0.3 but moves 0.0.8's gradients off pixel centres; (11) `may_paint_rect`: an image whose stream-size box, mapped to the device, misses the canvas is skipped before decoding (decoded data can only shrink against that box), so a tile of an image-heavy page no longer decodes, resamples and rasterizes every image on it; (12) preview renders (`InterpreterSettings::preview`: backdrops, thumbnails, grid cells, signature-drag backgrounds) skip images under `PREVIEW_MIN_IMAGE_AREA` device pixels, while final renders always draw them; (13) reading colours (#897): `RenderSettings::color_replacement` takes a `ColorReplacement` (text colour, background, `only_black`, `line_art`) that remaps solid text and line-art paint while rendering, glyph outlines counting as text and stencil-mask ink as line art; images, image alpha masks, soft masks and pattern cells keep their colours; `render_pdf` gains a `color_replacement: Option<ColorReplacement>` argument (pass `None` for true colours); the upstream-only `[dev-dependencies.log]` entry is removed from `Cargo.toml` (log is a normal dependency since the logging patch), so `cargo test -p hayro` runs this crate's unit tests; (14) a shrunk, interpolated, axis-aligned image is snapped to whole device pixels: shrunk once to its rounded device rectangle and drawn 1:1 at the rounded corner, instead of a ceil-sized raster resampled again at a fractional scale and offset (`snap_minified_image`; scans looked soft next to Acrobat); (15) a soft mask of another size than its image is filtered when shrunk, whatever its `/Interpolate` (#1649): such a mask carries the shape on its own (Word saves text as a tiny black image with a glyph-bitmap mask), and nearest-neighbour dropped every stroke thinner than the shrink factor | (1) `raster::tests::tiles_match_full_render`; (2) `raster::tests::absurd_image_dimensions_are_skipped`; (3) `raster::tests::tiling_cells_stay_small_whatever_the_step`; (4) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (5) `raster::tests::dash_patterns_that_cut_a_stroke_into_billions_of_pieces_render`; (6) `raster::tests::invalid_dash_patterns_terminate_and_are_drawn_solid`; (7) `raster::tests::pixels_are_a_plain_renders_bytes_in_a_buffer_a_gui_can_take_over`; (8) `raster::tests::image_resampling_rejects_anisotropic_target_growth`, `raster::tests::image_resampling_bounds_intermediate_before_planning`, `raster::tests::image_resampling_rejects_invalid_sources_and_scales`, `raster::tests::image_resampling_keeps_valid_sizes_and_exact_limits`, `raster::tests::resampling_fallback_preserves_original_geometry_and_pixels`, `raster::tests::image_resampling_wide_sources_shrink_before_backend_side_limits`, `raster::tests::image_resampling_wide_transparent_sources_still_shrink`, `raster::tests::image_resampling_padded_backend_dimensions_stay_checked`, `raster::tests::image_resampling_mismatched_alpha_mask_keeps_pixels_and_placement`; (9) `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel`; (10) `raster::tests::axial_and_radial_shadings_draw_as_native_gradients`; (11) `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel`; (12) `raster::tests::preview_renders_skip_tiny_images_but_finals_draw_everything`; (13) `color_replacement_tests::{black_maps_to_text_colour, white_maps_to_background, midgrey_interpolates, alpha_copied_verbatim, only_black_threshold, line_art_false_skips_paths_but_not_text}`, `color_replacement_render_tests::{color_replacement_maps_text_and_line_art, color_replacement_maps_stencil_mask_ink}`; (14) `raster::tests::interpolated_minified_image_edges_snap_to_whole_pixels` (`cargo test -p hayro`); (15) `raster::tests::shrunk_soft_mask_larger_than_its_image_keeps_thin_strokes` |
-| hayro | 0.7.1 | Apache-2.0 OR MIT | (1) `RenderSettings::{x_offset, y_offset}` to render one tile of a large page; (2) images over `MAX_IMAGE_PIXELS` (2^28) are skipped (a fuzzed `/W 4294967295` hung in resampling); (3) `tiling_cell_scale` keeps a tiling pattern's cell pixmap within 3000 px a side whatever its `/XStep`/`/YStep` (a fuzzed step far beyond `/BBox` allocated 2 GB); (4) stroke widths clamped to 4 × (canvas width + height) device pixels (a fuzzed `/LW 9223372036854775807` allocated 10 GB in stroke expansion); (5) `usable_dash_pattern`: a stroke whose dash pattern could cut it into more than `MAX_DASHES_PER_STROKE` (250,000) pieces, counting kurbo's restart of the pattern at every subpath and `ClosePath`, is drawn solid (a fuzzed `/D [[11] 0]` on a line from x = 92234775807 allocated over 5 GB, `[0.000001] 0 d` on a 20 pt line over 10 GB); (6) a dash pattern with a negative or non-finite entry, or a period that isn't positive, is drawn solid (`[-1 -1] 0 d` looped for ever in kurbo); (7) `render_size` and `render_into`: render into a buffer the caller allocates (PdfCraft renders into pixel-aligned memory that the GUI takes over as texture data); `render` is `render_into` on a new pixmap; (8) checked image source/target/RGBA, alpha-premultiplication scratch and intermediate sizes before resampling, finite transforms and exact source/mask buffers; sources wider than u16 may shrink before backend limits, with a 2^20 source-axis cap and conservative 128 MiB filter-planning estimate; an over-limit or failed resize keeps the original image resolution and geometry when the source fits the backend, otherwise skips it, with a logged warning; staging, resampling output/scratch, RGBA conversion and padding buffers use fallible reserves; (9) `may_paint_canvas`: a fill or stroke whose control-point box, grown by how far its paint reaches past the path (half the stroke width times the larger of the miter limit and √2) plus 0.5 user units and 2 pixels, misses the canvas is not drawn, so a tile no longer strokes and fills every path of its page (item 5 of #623); `set_skip_offscreen_paths` turns this off for the regression test; (10) `/Interpolate` governs the pre-resize too (#624): a minified image that does not request interpolation is pre-resized with nearest-neighbour, planned without the Catmull-Rom filter limits (`image_resampling_size` takes the flag); a Type 3 glyph image is sampled bicubically only when interpolated; a minified image with a matching soft mask is nearest-sampled straight into premultiplied RGBA; (11) `may_paint_rect`: an image whose stream-size box, mapped to the device, misses the canvas is skipped before decoding (decoded data can only shrink against that box), so a tile of an image-heavy page no longer decodes, resamples and rasterizes every image on it; (12) preview renders (`InterpreterSettings::preview`: backdrops, thumbnails, grid cells, signature-drag backgrounds) skip images under `PREVIEW_MIN_IMAGE_AREA` device pixels, while final renders always draw them; (13) reading colours (#897): `RenderSettings::color_replacement` takes a `ColorReplacement` (text colour, background, `only_black`, `line_art`) that remaps solid text and line-art paint while rendering, glyph outlines counting as text and stencil-mask ink as line art; images, image alpha masks, soft masks and pattern cells keep their colours; `render_pdf` gains a `color_replacement: Option<ColorReplacement>` argument (pass `None` for true colours); the upstream-only `[dev-dependencies.log]` entry is removed from `Cargo.toml` (log is a normal dependency since the logging patch), so `cargo test -p hayro` runs this crate's unit tests; (14) a shrunk, interpolated, axis-aligned image is snapped to whole device pixels: shrunk once to its rounded device rectangle and drawn 1:1 at the rounded corner, instead of a ceil-sized raster resampled again at a fractional scale and offset (`snap_minified_image`; scans looked soft next to Acrobat); (15) a soft mask of another size than its image is filtered when shrunk, whatever its `/Interpolate` (#1649): such a mask carries the shape on its own (Word saves text as a tiny black image with a glyph-bitmap mask), and nearest-neighbour dropped every stroke thinner than the shrink factor | (1) `raster::tests::tiles_match_full_render`; (2) `raster::tests::absurd_image_dimensions_are_skipped`; (3) `raster::tests::tiling_cells_stay_small_whatever_the_step`; (4) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (5) `raster::tests::dash_patterns_that_cut_a_stroke_into_billions_of_pieces_render`; (6) `raster::tests::invalid_dash_patterns_terminate_and_are_drawn_solid`; (7) `raster::tests::pixels_are_a_plain_renders_bytes_in_a_buffer_a_gui_can_take_over`; (8) `raster::tests::image_resampling_rejects_anisotropic_target_growth`, `raster::tests::image_resampling_bounds_intermediate_before_planning`, `raster::tests::image_resampling_rejects_invalid_sources_and_scales`, `raster::tests::image_resampling_keeps_valid_sizes_and_exact_limits`, `raster::tests::resampling_fallback_preserves_original_geometry_and_pixels`, `raster::tests::image_resampling_wide_sources_shrink_before_backend_side_limits`, `raster::tests::image_resampling_wide_transparent_sources_still_shrink`, `raster::tests::image_resampling_padded_backend_dimensions_stay_checked`, `raster::tests::image_resampling_mismatched_alpha_mask_keeps_pixels_and_placement`; (9) `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel`; (10) `raster::tests::non_interpolated_images_are_not_smoothed_when_minified`, `raster::tests::non_interpolated_gray_images_are_not_smoothed_when_minified`, `raster::tests::non_integer_minification_samples_the_same_columns`, `raster::tests::non_integer_minification_samples_colour_and_mask_from_the_same_columns`, `raster::tests::non_interpolated_alpha_images_keep_their_colours_and_mask_when_minified`, `raster::tests::non_interpolated_type3_glyph_images_are_not_smoothed_when_minified`, `raster::tests::image_resampling_nearest_accepts_wide_sources_the_filter_refuses`, `raster::tests::wide_non_interpolated_sources_draw_after_shrinking`; (11) `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel`; (12) `raster::tests::preview_renders_skip_tiny_images_but_finals_draw_everything`; (13) `color_replacement_tests::{black_maps_to_text_colour, white_maps_to_background, midgrey_interpolates, alpha_copied_verbatim, only_black_threshold, line_art_false_skips_paths_but_not_text}`, `color_replacement_render_tests::{color_replacement_maps_text_and_line_art, color_replacement_maps_stencil_mask_ink}`; (14) `raster::tests::interpolated_minified_image_edges_snap_to_whole_pixels` (`cargo test -p hayro`); (15) `raster::tests::shrunk_soft_mask_larger_than_its_image_keeps_thin_strokes` |
+| hayro | 0.7.1 | Apache-2.0 OR MIT | (1) `RenderSettings::{x_offset, y_offset}` to render one tile of a large page; (2) images over `MAX_IMAGE_PIXELS` (2^28) are skipped (a fuzzed `/W 4294967295` hung in resampling); (3) `tiling_cell_scale` keeps a tiling pattern's cell pixmap within 3000 px a side whatever its `/XStep`/`/YStep` (a fuzzed step far beyond `/BBox` allocated 2 GB); (4) stroke widths clamped to 4 × (canvas width + height) device pixels (a fuzzed `/LW 9223372036854775807` allocated 10 GB in stroke expansion); (5) `usable_dash_pattern`: a stroke whose dash pattern could cut it into more than `MAX_DASHES_PER_STROKE` (250,000) pieces, counting kurbo's restart of the pattern at every subpath and `ClosePath`, is drawn solid (a fuzzed `/D [[11] 0]` on a line from x = 92234775807 allocated over 5 GB, `[0.000001] 0 d` on a 20 pt line over 10 GB); (6) a dash pattern with a negative or non-finite entry, or a period that isn't positive, is drawn solid (`[-1 -1] 0 d` looped for ever in kurbo); (7) `render_size` and `render_into`: render into a buffer the caller allocates (PdfCraft renders into pixel-aligned memory that the GUI takes over as texture data); `render` is `render_into` on a new pixmap; (8) checked image source/target/RGBA, alpha-premultiplication scratch and intermediate sizes before resampling, finite transforms and exact source/mask buffers; sources wider than u16 may shrink before backend limits, with a 2^20 source-axis cap and conservative 128 MiB filter-planning estimate; an over-limit or failed resize keeps the original image resolution and geometry when the source fits the backend, otherwise skips it, with a logged warning; staging, resampling output/scratch, RGBA conversion and padding buffers use fallible reserves; (9) `may_paint_canvas`: a fill or stroke whose control-point box, grown by how far its paint reaches past the path (half the stroke width times the larger of the miter limit and √2) plus 0.5 user units and 2 pixels, misses the canvas is not drawn, so a tile no longer strokes and fills every path of its page (item 5 of #623); `set_skip_offscreen_paths` turns this off for the regression test; (10) backport of hayro 0.8: shadings that `as_svg_gradient` can represent are painted as a `vello_cpu` linear or two-point radial gradient instead of a texture sampled pixel by pixel through the shading function (InDesign fades are luminosity soft masks of one full-page axial `sh`: 40 on a report page took 15 s at 144 dpi, now under 1 s); without upstream's half-pixel shift, which suits vello_cpu 0.3 but moves 0.0.8's gradients off pixel centres; (11) `may_paint_rect`: an image whose stream-size box, mapped to the device, misses the canvas is skipped before decoding (decoded data can only shrink against that box), so a tile of an image-heavy page no longer decodes, resamples and rasterizes every image on it; (12) preview renders (`InterpreterSettings::preview`: backdrops, thumbnails, grid cells, signature-drag backgrounds) skip images under `PREVIEW_MIN_IMAGE_AREA` device pixels, while final renders always draw them; (13) reading colours (#897): `RenderSettings::color_replacement` takes a `ColorReplacement` (text colour, background, `only_black`, `line_art`) that remaps solid text and line-art paint while rendering, glyph outlines counting as text and stencil-mask ink as line art; images, image alpha masks, soft masks and pattern cells keep their colours; `render_pdf` gains a `color_replacement: Option<ColorReplacement>` argument (pass `None` for true colours); the upstream-only `[dev-dependencies.log]` entry is removed from `Cargo.toml` (log is a normal dependency since the logging patch), so `cargo test -p hayro` runs this crate's unit tests; (14) a shrunk, interpolated, axis-aligned image is snapped to whole device pixels: shrunk once to its rounded device rectangle and drawn 1:1 at the rounded corner, instead of a ceil-sized raster resampled again at a fractional scale and offset (`snap_minified_image`; scans looked soft next to Acrobat); (15) a soft mask of another size than its image is filtered when shrunk, whatever its `/Interpolate` (#1649): such a mask carries the shape on its own (Word saves text as a tiny black image with a glyph-bitmap mask), and nearest-neighbour dropped every stroke thinner than the shrink factor; (16) under a soft mask or a blend mode, axial and radial shadings are sampled instead of drawn as native gradients (#2128): vello_cpu 0.0.8 copies an opaque gradient over fully covered tiles without the mask or blend mode, so PowerPoint's faded gradient fills came out solid; (17) the renderer keeps annotation paints out of the reading-colours mapping between `begin_annotations` and `end_annotations` (#1548); (18) the page renders as one transparency group with its background painted inside it as the initial backdrop, so a Multiply highlight blends with a dark reading-colours background instead of staying an opaque block (identity on white pages) | (1) `raster::tests::tiles_match_full_render`; (2) `raster::tests::absurd_image_dimensions_are_skipped`; (3) `raster::tests::tiling_cells_stay_small_whatever_the_step`; (4) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (5) `raster::tests::dash_patterns_that_cut_a_stroke_into_billions_of_pieces_render`; (6) `raster::tests::invalid_dash_patterns_terminate_and_are_drawn_solid`; (7) `raster::tests::pixels_are_a_plain_renders_bytes_in_a_buffer_a_gui_can_take_over`; (8) `raster::tests::image_resampling_rejects_anisotropic_target_growth`, `raster::tests::image_resampling_bounds_intermediate_before_planning`, `raster::tests::image_resampling_rejects_invalid_sources_and_scales`, `raster::tests::image_resampling_keeps_valid_sizes_and_exact_limits`, `raster::tests::resampling_fallback_preserves_original_geometry_and_pixels`, `raster::tests::image_resampling_wide_sources_shrink_before_backend_side_limits`, `raster::tests::image_resampling_wide_transparent_sources_still_shrink`, `raster::tests::image_resampling_padded_backend_dimensions_stay_checked`, `raster::tests::image_resampling_mismatched_alpha_mask_keeps_pixels_and_placement`; (9) `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel`; (10) `raster::tests::axial_and_radial_shadings_draw_as_native_gradients`; (11) `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel`; (12) `raster::tests::preview_renders_skip_tiny_images_but_finals_draw_everything`; (13) `color_replacement_tests::{black_maps_to_text_colour, white_maps_to_background, midgrey_interpolates, alpha_copied_verbatim, only_black_threshold, line_art_false_skips_paths_but_not_text}`, `color_replacement_render_tests::{color_replacement_maps_text_and_line_art, color_replacement_maps_stencil_mask_ink}`; (14) `raster::tests::interpolated_minified_image_edges_snap_to_whole_pixels` (`cargo test -p hayro`); (15) `raster::tests::shrunk_soft_mask_larger_than_its_image_keeps_thin_strokes`; (16) `raster::tests::soft_mask_applies_to_a_shading_pattern_fill`; (17), (18) `raster::tests::reading_colors_keep_highlight_annotations_readable` |
+| hayro | 0.7.1 | Apache-2.0 OR MIT | (1) `RenderSettings::{x_offset, y_offset}` to render one tile of a large page; (2) images over `MAX_IMAGE_PIXELS` (2^28) are skipped (a fuzzed `/W 4294967295` hung in resampling); (3) `tiling_cell_scale` keeps a tiling pattern's cell pixmap within 3000 px a side whatever its `/XStep`/`/YStep` (a fuzzed step far beyond `/BBox` allocated 2 GB); (4) stroke widths clamped to 4 × (canvas width + height) device pixels (a fuzzed `/LW 9223372036854775807` allocated 10 GB in stroke expansion); (5) `usable_dash_pattern`: a stroke whose dash pattern could cut it into more than `MAX_DASHES_PER_STROKE` (250,000) pieces, counting kurbo's restart of the pattern at every subpath and `ClosePath`, is drawn solid (a fuzzed `/D [[11] 0]` on a line from x = 92234775807 allocated over 5 GB, `[0.000001] 0 d` on a 20 pt line over 10 GB); (6) a dash pattern with a negative or non-finite entry, or a period that isn't positive, is drawn solid (`[-1 -1] 0 d` looped for ever in kurbo); (7) `render_size` and `render_into`: render into a buffer the caller allocates (PdfCraft renders into pixel-aligned memory that the GUI takes over as texture data); `render` is `render_into` on a new pixmap; (8) checked image source/target/RGBA, alpha-premultiplication scratch and intermediate sizes before resampling, finite transforms and exact source/mask buffers; sources wider than u16 may shrink before backend limits, with a 2^20 source-axis cap and conservative 128 MiB filter-planning estimate; an over-limit or failed resize keeps the original image resolution and geometry when the source fits the backend, otherwise skips it, with a logged warning; staging, resampling output/scratch, RGBA conversion and padding buffers use fallible reserves; (9) `may_paint_canvas`: a fill or stroke whose control-point box, grown by how far its paint reaches past the path (half the stroke width times the larger of the miter limit and √2) plus 0.5 user units and 2 pixels, misses the canvas is not drawn, so a tile no longer strokes and fills every path of its page (item 5 of #623); `set_skip_offscreen_paths` turns this off for the regression test; (10) `/Interpolate` governs the pre-resize too (#624): a minified image that does not request interpolation is pre-resized with nearest-neighbour, planned without the Catmull-Rom filter limits (`image_resampling_size` takes the flag); a Type 3 glyph image is sampled bicubically only when interpolated; a minified image with a matching soft mask is nearest-sampled straight into premultiplied RGBA; (11) `may_paint_rect`: an image whose stream-size box, mapped to the device, misses the canvas is skipped before decoding (decoded data can only shrink against that box), so a tile of an image-heavy page no longer decodes, resamples and rasterizes every image on it; (12) preview renders (`InterpreterSettings::preview`: backdrops, thumbnails, grid cells, signature-drag backgrounds) skip images under `PREVIEW_MIN_IMAGE_AREA` device pixels, while final renders always draw them; (13) reading colours (#897): `RenderSettings::color_replacement` takes a `ColorReplacement` (text colour, background, `only_black`, `line_art`) that remaps solid text and line-art paint while rendering, glyph outlines counting as text and stencil-mask ink as line art; images, image alpha masks, soft masks and pattern cells keep their colours; `render_pdf` gains a `color_replacement: Option<ColorReplacement>` argument (pass `None` for true colours); the upstream-only `[dev-dependencies.log]` entry is removed from `Cargo.toml` (log is a normal dependency since the logging patch), so `cargo test -p hayro` runs this crate's unit tests; (14) a shrunk, interpolated, axis-aligned image is snapped to whole device pixels: shrunk once to its rounded device rectangle and drawn 1:1 at the rounded corner, instead of a ceil-sized raster resampled again at a fractional scale and offset (`snap_minified_image`; scans looked soft next to Acrobat); (15) a soft mask of another size than its image is filtered when shrunk, whatever its `/Interpolate` (#1649): such a mask carries the shape on its own (Word saves text as a tiny black image with a glyph-bitmap mask), and nearest-neighbour dropped every stroke thinner than the shrink factor; (16) under a soft mask or a blend mode, axial and radial shadings are sampled instead of drawn as native gradients (#2128): vello_cpu 0.0.8 copies an opaque gradient over fully covered tiles without the mask or blend mode, so PowerPoint's faded gradient fills came out solid; (17) the renderer keeps annotation paints out of the reading-colours mapping between `begin_annotations` and `end_annotations` (#1548); (18) the page renders as one transparency group with its background painted inside it as the initial backdrop, so a Multiply highlight blends with a dark reading-colours background instead of staying an opaque block (identity on white pages) | (1) `raster::tests::tiles_match_full_render`; (2) `raster::tests::absurd_image_dimensions_are_skipped`; (3) `raster::tests::tiling_cells_stay_small_whatever_the_step`; (4) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (5) `raster::tests::dash_patterns_that_cut_a_stroke_into_billions_of_pieces_render`; (6) `raster::tests::invalid_dash_patterns_terminate_and_are_drawn_solid`; (7) `raster::tests::pixels_are_a_plain_renders_bytes_in_a_buffer_a_gui_can_take_over`; (8) `raster::tests::image_resampling_rejects_anisotropic_target_growth`, `raster::tests::image_resampling_bounds_intermediate_before_planning`, `raster::tests::image_resampling_rejects_invalid_sources_and_scales`, `raster::tests::image_resampling_keeps_valid_sizes_and_exact_limits`, `raster::tests::resampling_fallback_preserves_original_geometry_and_pixels`, `raster::tests::image_resampling_wide_sources_shrink_before_backend_side_limits`, `raster::tests::image_resampling_wide_transparent_sources_still_shrink`, `raster::tests::image_resampling_padded_backend_dimensions_stay_checked`, `raster::tests::image_resampling_mismatched_alpha_mask_keeps_pixels_and_placement`; (9) `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel`; (10) `raster::tests::non_interpolated_images_are_not_smoothed_when_minified`, `raster::tests::non_interpolated_gray_images_are_not_smoothed_when_minified`, `raster::tests::non_integer_minification_samples_the_same_columns`, `raster::tests::non_integer_minification_samples_colour_and_mask_from_the_same_columns`, `raster::tests::non_interpolated_alpha_images_keep_their_colours_and_mask_when_minified`, `raster::tests::non_interpolated_type3_glyph_images_are_not_smoothed_when_minified`, `raster::tests::image_resampling_nearest_accepts_wide_sources_the_filter_refuses`, `raster::tests::wide_non_interpolated_sources_draw_after_shrinking`; (11) `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel`; (12) `raster::tests::preview_renders_skip_tiny_images_but_finals_draw_everything`; (13) `color_replacement_tests::{black_maps_to_text_colour, white_maps_to_background, midgrey_interpolates, alpha_copied_verbatim, only_black_threshold, line_art_false_skips_paths_but_not_text}`, `color_replacement_render_tests::{color_replacement_maps_text_and_line_art, color_replacement_maps_stencil_mask_ink}`; (14) `raster::tests::interpolated_minified_image_edges_snap_to_whole_pixels` (`cargo test -p hayro`); (15) `raster::tests::shrunk_soft_mask_larger_than_its_image_keeps_thin_strokes`; (16) `raster::tests::soft_mask_applies_to_a_shading_pattern_fill`; (17), (18) `raster::tests::reading_colors_keep_highlight_annotations_readable` |
 | hayro-jbig2 | 0.3.0 | Apache-2.0 OR MIT | (1) at most 2^28 pixels per bitmap, page bitmap, halftone grid and grayscale image (each side could be 65535: 4.3 billion pixels decoded one by one); (2) at most 2^26 symbol pixels per symbol dictionary (a fuzzed dictionary decoded for minutes); (3) a symbol dictionary's height classes are capped at one per new symbol and its export runs at `2 × symbols + 1`, each plus `EXTRA_EMPTY_STEPS` (1024): an empty height class or a zero-length export run doesn't advance, and past the end of its data the arithmetic decoder can decode them for ever (one changed byte hung the renderer) | (1) `raster::tests::jbig2_regions_of_billions_of_pixels_are_refused`; (2) the nightly `cargo xtask fuzz` finding, which now finishes in about a second; (3) `raster::tests::jbig2_symbol_dictionaries_that_never_advance_terminate` |
 | lopdf | 0.45.0 | MIT | (1) PNG predictor rows longer than the data are refused before their buffers are allocated (a fuzzed `/Columns 4294967295` allocated two 4 GiB rows), and empty frames return without row buffers; (2) predictor row widths use saturating arithmetic or reject overflow; (3) sub-byte TIFF Predictor 2 scratch is bounded by the samples present in the input instead of the declared `/Colors`, aligned with [lopdf#589](https://github.com/J-F-Liu/lopdf/pull/589) | (1) `inspect::tests::png_predictor_rows_longer_than_the_data_are_refused_before_allocating`, `inspect::tests::empty_png_predictor_frames_do_not_allocate_rows`; (2) `inspect::tests::tiff_subbyte_predictor_row_width_overflow_is_refused`; (3) `inspect::tests::tiff_subbyte_predictor_scratch_is_bounded_by_available_samples`, `inspect::tests::tiff_subbyte_predictors_keep_components_rows_and_padding` |
-| hayro-syntax | 0.7.2 | Apache-2.0 OR MIT | (1) Page-tree cycle guard in `resolve_pages` (visited set + depth cap): a `/Kids` loop among compressed objects overflowed the stack and aborted the process; (2) `ccitt_size_ok`: CCITT images wider than 2^20 columns or over 2^28 pixels are not decoded (a fuzzed `/Columns 4294967295` allocated 4 GiB); (3) Flate/LZW predictor row widths are saturating `usize`, a zero width is refused and a row longer than the data is not allocated (a fuzzed `/Columns 9223372036854775807` wrapped to a 2^61-byte allocation and aborted); (4) the inline-image end-of-data check (`EI`) doesn't nest inside its own look-ahead and examines at most 256 candidates and steps (50 images with "EI" in their data ran for over ten minutes); (5) a stream whose `/Length` is wrong is recovered only when `stream` is the next token — scanning ahead to a later object's `stream` made an indirect appearance-state dictionary (Quartz checkboxes: `/AP /N` → `<< /Yes … /Off … >>`) render as a non-form, so the widget was skipped; (6) JPX rescaling uses an exact integer sample range for 1–32-bit components (32 shifted past u32, and floating-point maxima at 25–31 bits wrapped to zero), and refuses zero-sized rows; (7) `decode_limit`: Flate (through flate2 and the fallback inflater), LZW and RunLength never write past `MAX_DECODED_STREAM` (256 MiB), or, for the last filter of an image of known size, past twice its pixel bytes (a predictor tag byte per byte), at most 1 GiB; `Stream::decoded_within` for budgeted callers; a page's `/Contents` array shares one `MAX_DECODED_STREAM` (a 2 MB page whose content stream or 8 × 8 image inflated to 2 GB took the renderer past 3 GB in under a second; naming the stream twenty times in `/Contents`, 5 GB); (8) high-precision numbers (jsPDF MediaBox coordinates with over 19 digits) parse without overflowing the u64 mantissa: fractional digits past it are dropped, integer digits past it scale the value (a real, kept finite); (9) large dictionary indexes are built on first use and shared across repeated reads within each PDF (#307); the validated-byte cache is bounded, reader contexts remain separate, repairs and inline/content dictionaries bypass sharing, and small dictionaries stay eager; (10) decoded object-stream slots publish once under contention, cold loading rejects recursive dependencies, and xref repair serializes without holding recursive read guards; this permits one parser per native render pool with private worker caches; (11) `sync.rs`: a poisoned lock is recovered instead of unwrapped (a worker panic no longer cascades into every reader of the same PDF), and xref repair takes a blocking write lock instead of asserting a non-blocking one; (12) `SegmentList` (`util.rs`) returns `None` for an out-of-range index instead of panicking; (13) a page's `/UserUnit` scales `render_dimensions` and `initial_transform`, so the page and everything on it are sized in points, as Acrobat shows them; it is read as Acrobat reads it (the page's own entry, not inherited; a number from 1 up, at most 75,000; anything else counts as 1), and a page without it keeps exactly the transform it had; (14) revision 2–4 passwords are tried as given and then in PDFDocEncoding (`legacy_passwords` in `crypto/mod.rs`, which resolves the upstream `TODO: Convert to PDFDocEncoding`): passwords arrive as UTF-8 text, so a password with characters outside ASCII (`Çok güzel`, `ılık€`) written in PDFDocEncoding, as ISO 32000-2 §7.6.4.3.2 asks and qpdf and Acrobat write it, was always wrong; (15) page content is read a piece at a time (`page::ContentReader`, `Page::content_reader`): plain streams and Flate streams without a predictor are decoded as they are read, with a budget of 64 times their compressed size and never less than `MAX_DECODED_STREAM` (a stream that expands past it is cut and reported); other streams are decoded whole, as before, and share `MAX_DECODED_STREAM`. The content tokenizer reads a window at a time (`UntypedIter::new_window`, `TypedIter::needs_more`, `TypedIter::committed`): an instruction that runs past the window is not decided until more data follows, which `Reader` records by flagging reads and `at_end` past the end of the data, including through the clones the parser makes. The Flate decoder keeps its own 32 KiB history, so it pauses at any output size. `ContentReader::new` reuses raw/decrypted stream bytes for budget accounting and piece creation, and `decoded_raw_within` applies the existing Whole-stream filters and limits to those bytes without decrypting twice; (16) revision 5–6 (AES-256) passwords are tried in their SASLprep form (RFC 4013, then UTF-8, at most 127 bytes, as ISO 32000-2 §7.6.4.3.3 Algorithm 2.A asks and pdfcraft-crypt writes them) and then, if that differs, as given (`aes256_passwords` in `crypto/mod.rs`, which resolves the upstream `TODO: Do the above.`; `stringprep`, already in the tree through pdfcraft-crypt, is an optional dependency enabled by `std`, and without `std` passwords are used as given): the renderer used the password as typed, so one that SASLprep changes (a decomposed `café`, a no-break space, the fullwidth `ａｂ` a Japanese IME types in full-width mode) was wrong, although pdfcraft-cos accepted it: protecting a document with such an open password was rolled back ("the password is incorrect"), and a file with such a password did not open with it. | (1) `cos/tests/writer.rs::page_tree_loops_in_object_streams_do_not_crash_readers`; (2) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (3) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (4) `raster::tests::inline_images_with_ei_in_their_data_parse_in_linear_time`; (5) `raster::tests::indirect_appearance_state_dict_is_not_another_stream`; (6) `raster::tests::jpx_stream_bit_depth_boundaries_do_not_panic`, `raster::tests::jpx_32_bit_image_does_not_prevent_other_page_content_from_rendering`, `raster::tests::jpx_gray_rgb_and_alpha_keep_eight_bit_samples`, `raster::tests::jpx_streams_reject_out_of_range_bit_depths`; (7) `raster::tests::decompression_bombs_stop_at_the_stream_limit`, `raster::tests::page_contents_and_nested_forms_share_one_budget`; (8) `inspect::tests::jspdf_high_precision_mediabox_does_not_overflow_dimensions`, `object::number::tests::high_precision_float_does_not_overflow_mantissa` (hayro-syntax); (9) `object::dict::lazy_index_tests`, `raster::tests::large_resource_indexes_preserve_pixels_and_text`; (10) `data::tests`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`, `raster::tests::shared_parser_is_lazy_and_initializes_once_under_contention`; (11) `data::tests::panicking_initializer_wakes_waiters_and_prevents_retries`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`; (12) `util::tests::segment_list_rejects_out_of_range_indices`; (13) `raster::tests::user_unit_scales_the_page_and_everything_on_it`; (14) `crypto::pdfcraft_password_tests`, `pdfcraft-engine` `tests::legacy_passwords_with_turkish_characters_open`; (15) `content::tests::windows_keep_every_instruction_at_every_split`, `content::tests::windows_keep_every_instruction_in_pieces_of_any_size`, `content::tests::windows_match_the_slice_on_random_content`, `content::tests::windows_drop_blanks_and_keep_a_comment_that_may_go_on`, `page::content_reader_tests::content_past_the_cap_is_read_to_the_end`, `page::content_reader_tests::a_stream_that_expands_past_the_budget_is_cut_there`, `page::content_reader_tests::a_small_expansion_under_the_cap_is_not_cut`, `raster::tests::page_content_past_the_old_cap_renders`, `raster::tests::content_reader_returns_the_same_bytes_in_any_pieces`, `raster::tests::content_bombs_stop_at_the_budget_and_say_so`, `page::content_reader_tests::plain_and_whole_pieces_keep_their_bytes`, `page::content_reader_tests::repeated_content_reference_counts_compressed_bytes_once`, `page::content_reader_tests::whole_cap_still_counts_later_unique_streams`; (16) `crypto::pdfcraft_password_tests::aes256_passwords_are_tried_in_their_saslprep_form_then_as_given`, `crypto::pdfcraft_password_tests::aes256_passwords_open_as_typed_and_in_their_saslprep_form`, `pdfcraft-engine` `tests::aes256_open_passwords_that_saslprep_changes_protect_and_reopen_as_typed`, `tests::aes256_files_whose_passwords_saslprep_changes_open_as_typed`
+| hayro-syntax | 0.7.2 | Apache-2.0 OR MIT | (1) Page-tree cycle guard in `resolve_pages` (visited set + depth cap): a `/Kids` loop among compressed objects overflowed the stack and aborted the process; (2) `ccitt_size_ok`: CCITT images wider than 2^20 columns or over 2^28 pixels are not decoded (a fuzzed `/Columns 4294967295` allocated 4 GiB); (3) Flate/LZW predictor row widths are saturating `usize`, a zero width is refused and a row longer than the data is not allocated (a fuzzed `/Columns 9223372036854775807` wrapped to a 2^61-byte allocation and aborted); (4) the inline-image end-of-data check (`EI`) doesn't nest inside its own look-ahead and examines at most 256 candidates and steps (50 images with "EI" in their data ran for over ten minutes); (5) a stream whose `/Length` is wrong is recovered only when `stream` is the next token — scanning ahead to a later object's `stream` made an indirect appearance-state dictionary (Quartz checkboxes: `/AP /N` → `<< /Yes … /Off … >>`) render as a non-form, so the widget was skipped; (6) JPX rescaling uses an exact integer sample range for 1–32-bit components (32 shifted past u32, and floating-point maxima at 25–31 bits wrapped to zero), and refuses zero-sized rows; (7) `decode_limit`: Flate (through flate2 and the fallback inflater), LZW and RunLength never write past `MAX_DECODED_STREAM` (256 MiB), or, for the last filter of an image of known size, past twice its pixel bytes (a predictor tag byte per byte), at most 1 GiB; `Stream::decoded_within` for budgeted callers; a page's `/Contents` array shares one `MAX_DECODED_STREAM` (a 2 MB page whose content stream or 8 × 8 image inflated to 2 GB took the renderer past 3 GB in under a second; naming the stream twenty times in `/Contents`, 5 GB); (8) high-precision numbers (jsPDF MediaBox coordinates with over 19 digits) parse without overflowing the u64 mantissa: fractional digits past it are dropped, integer digits past it scale the value (a real, kept finite); (9) large dictionary indexes are built on first use and shared across repeated reads within each PDF (#307); the validated-byte cache is bounded, reader contexts remain separate, repairs and inline/content dictionaries bypass sharing, and small dictionaries stay eager; (10) decoded object-stream slots publish once under contention, cold loading rejects recursive dependencies, and xref repair serializes without holding recursive read guards; this permits one parser per native render pool with private worker caches; (11) `sync.rs`: a poisoned lock is recovered instead of unwrapped (a worker panic no longer cascades into every reader of the same PDF), and xref repair takes a blocking write lock instead of asserting a non-blocking one; (12) `SegmentList` (`util.rs`) returns `None` for an out-of-range index instead of panicking; (13) a page's `/UserUnit` scales `render_dimensions` and `initial_transform`, so the page and everything on it are sized in points, as Acrobat shows them; it is read as Acrobat reads it (the page's own entry, not inherited; a number from 1 up, at most 75,000; anything else counts as 1), and a page without it keeps exactly the transform it had; (14) revision 2–4 passwords are tried as given and then in PDFDocEncoding (`legacy_passwords` in `crypto/mod.rs`, which resolves the upstream `TODO: Convert to PDFDocEncoding`): passwords arrive as UTF-8 text, so a password with characters outside ASCII (`Çok güzel`, `ılık€`) written in PDFDocEncoding, as ISO 32000-2 §7.6.4.3.2 asks and qpdf and Acrobat write it, was always wrong; (15) page content is read a piece at a time (`page::ContentReader`, `Page::content_reader`): plain streams and Flate streams without a predictor are decoded as they are read, with a budget of 64 times their compressed size and never less than `MAX_DECODED_STREAM` (a stream that expands past it is cut and reported); other streams are decoded whole, as before, and share `MAX_DECODED_STREAM`. The content tokenizer reads a window at a time (`UntypedIter::new_window`, `TypedIter::needs_more`, `TypedIter::committed`): an instruction that runs past the window is not decided until more data follows, which `Reader` records by flagging reads and `at_end` past the end of the data, including through the clones the parser makes. The Flate decoder keeps its own 32 KiB history, so it pauses at any output size. `ContentReader::new` reuses raw/decrypted stream bytes for budget accounting and piece creation, and `decoded_raw_within` applies the existing Whole-stream filters and limits to those bytes without decrypting twice; (16) revision 5–6 (AES-256) passwords are tried in their SASLprep form (RFC 4013, then UTF-8, at most 127 bytes, as ISO 32000-2 §7.6.4.3.3 Algorithm 2.A asks and pdfcraft-crypt writes them) and then, if that differs, as given (`aes256_passwords` in `crypto/mod.rs`, which resolves the upstream `TODO: Do the above.`; `stringprep`, already in the tree through pdfcraft-crypt, is an optional dependency enabled by `std`, and without `std` passwords are used as given): the renderer used the password as typed, so one that SASLprep changes (a decomposed `café`, a no-break space, the fullwidth `ａｂ` a Japanese IME types in full-width mode) was wrong, although pdfcraft-cos accepted it: protecting a document with such an open password was rolled back ("the password is incorrect"), and a file with such a password did not open with it.; (17) CCITT `/Rows 0` means the height is not predetermined (ISO 32000-2 Table 11), not zero rows: scanned Group 4 pages written that way rendered blank | (1) `cos/tests/writer.rs::page_tree_loops_in_object_streams_do_not_crash_readers`; (2) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (3) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (4) `raster::tests::inline_images_with_ei_in_their_data_parse_in_linear_time`; (5) `raster::tests::indirect_appearance_state_dict_is_not_another_stream`; (6) `raster::tests::jpx_stream_bit_depth_boundaries_do_not_panic`, `raster::tests::jpx_32_bit_image_does_not_prevent_other_page_content_from_rendering`, `raster::tests::jpx_gray_rgb_and_alpha_keep_eight_bit_samples`, `raster::tests::jpx_streams_reject_out_of_range_bit_depths`; (7) `raster::tests::decompression_bombs_stop_at_the_stream_limit`, `raster::tests::page_contents_and_nested_forms_share_one_budget`; (8) `inspect::tests::jspdf_high_precision_mediabox_does_not_overflow_dimensions`, `object::number::tests::high_precision_float_does_not_overflow_mantissa` (hayro-syntax); (9) `object::dict::lazy_index_tests`, `raster::tests::large_resource_indexes_preserve_pixels_and_text`; (10) `data::tests`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`, `raster::tests::shared_parser_is_lazy_and_initializes_once_under_contention`; (11) `data::tests::panicking_initializer_wakes_waiters_and_prevents_retries`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`; (12) `util::tests::segment_list_rejects_out_of_range_indices`; (13) `raster::tests::user_unit_scales_the_page_and_everything_on_it`; (14) `crypto::pdfcraft_password_tests`, `pdfcraft-engine` `tests::legacy_passwords_with_turkish_characters_open`; (15) `content::tests::windows_keep_every_instruction_at_every_split`, `content::tests::windows_keep_every_instruction_in_pieces_of_any_size`, `content::tests::windows_match_the_slice_on_random_content`, `content::tests::windows_drop_blanks_and_keep_a_comment_that_may_go_on`, `page::content_reader_tests::content_past_the_cap_is_read_to_the_end`, `page::content_reader_tests::a_stream_that_expands_past_the_budget_is_cut_there`, `page::content_reader_tests::a_small_expansion_under_the_cap_is_not_cut`, `raster::tests::page_content_past_the_old_cap_renders`, `raster::tests::content_reader_returns_the_same_bytes_in_any_pieces`, `raster::tests::content_bombs_stop_at_the_budget_and_say_so`, `page::content_reader_tests::plain_and_whole_pieces_keep_their_bytes`, `page::content_reader_tests::repeated_content_reference_counts_compressed_bytes_once`, `page::content_reader_tests::whole_cap_still_counts_later_unique_streams`; (16) `crypto::pdfcraft_password_tests::aes256_passwords_are_tried_in_their_saslprep_form_then_as_given`, `crypto::pdfcraft_password_tests::aes256_passwords_open_as_typed_and_in_their_saslprep_form`, `pdfcraft-engine` `tests::aes256_open_passwords_that_saslprep_changes_protect_and_reopen_as_typed`, `tests::aes256_files_whose_passwords_saslprep_changes_open_as_typed`; (17) `raster::tests::group4_fax_with_rows_zero_decodes_to_the_image_height` 
+| hayro-syntax | 0.7.2 | Apache-2.0 OR MIT | (1) Page-tree cycle guard in `resolve_pages` (visited set + depth cap): a `/Kids` loop among compressed objects overflowed the stack and aborted the process; (2) `ccitt_size_ok`: CCITT images wider than 2^20 columns or over 2^28 pixels are not decoded (a fuzzed `/Columns 4294967295` allocated 4 GiB); (3) Flate/LZW predictor row widths are saturating `usize`, a zero width is refused and a row longer than the data is not allocated (a fuzzed `/Columns 9223372036854775807` wrapped to a 2^61-byte allocation and aborted); (4) the inline-image end-of-data check (`EI`) doesn't nest inside its own look-ahead and examines at most 256 candidates and steps (50 images with "EI" in their data ran for over ten minutes); (5) a stream whose `/Length` is wrong is recovered only when `stream` is the next token — scanning ahead to a later object's `stream` made an indirect appearance-state dictionary (Quartz checkboxes: `/AP /N` → `<< /Yes … /Off … >>`) render as a non-form, so the widget was skipped; (6) JPX rescaling uses an exact integer sample range for 1–32-bit components (32 shifted past u32, and floating-point maxima at 25–31 bits wrapped to zero), and refuses zero-sized rows; (7) `decode_limit`: Flate (through flate2 and the fallback inflater), LZW, RunLength and ASCII85 never write past `MAX_DECODED_STREAM` (256 MiB), or, for the last filter of an image of known size, past twice its pixel bytes (a predictor tag byte per byte), at most 1 GiB; `Stream::decoded_within` for budgeted callers; a page's `/Contents` array shares one `MAX_DECODED_STREAM` (a 2 MB page whose content stream or 8 × 8 image inflated to 2 GB took the renderer past 3 GB in under a second; naming the stream twenty times in `/Contents`, 5 GB); (8) high-precision numbers (jsPDF MediaBox coordinates with over 19 digits) parse without overflowing the u64 mantissa: fractional digits past it are dropped, integer digits past it scale the value (a real, kept finite); (9) large dictionary indexes are built on first use and shared across repeated reads within each PDF (#307); the validated-byte cache is bounded, reader contexts remain separate, repairs and inline/content dictionaries bypass sharing, and small dictionaries stay eager; (10) decoded object-stream slots publish once under contention, cold loading rejects recursive dependencies, and xref repair serializes without holding recursive read guards; this permits one parser per native render pool with private worker caches; (11) `sync.rs`: a poisoned lock is recovered instead of unwrapped (a worker panic no longer cascades into every reader of the same PDF), and xref repair takes a blocking write lock instead of asserting a non-blocking one; (12) `SegmentList` (`util.rs`) returns `None` for an out-of-range index instead of panicking; (13) a page's `/UserUnit` scales `render_dimensions` and `initial_transform`, so the page and everything on it are sized in points, as Acrobat shows them; it is read as Acrobat reads it (the page's own entry, not inherited; a number from 1 up, at most 75,000; anything else counts as 1), and a page without it keeps exactly the transform it had; (14) revision 2–4 passwords are tried as given and then in PDFDocEncoding (`legacy_passwords` in `crypto/mod.rs`, which resolves the upstream `TODO: Convert to PDFDocEncoding`): passwords arrive as UTF-8 text, so a password with characters outside ASCII (`Çok güzel`, `ılık€`) written in PDFDocEncoding, as ISO 32000-2 §7.6.4.3.2 asks and qpdf and Acrobat write it, was always wrong; (15) page content is read a piece at a time (`page::ContentReader`, `Page::content_reader`): plain streams and Flate streams without a predictor are decoded as they are read, with a budget of 64 times their compressed size and never less than `MAX_DECODED_STREAM` (a stream that expands past it is cut and reported); other streams are decoded whole, as before, and share `MAX_DECODED_STREAM`. The content tokenizer reads a window at a time (`UntypedIter::new_window`, `TypedIter::needs_more`, `TypedIter::committed`): an instruction that runs past the window is not decided until more data follows, which `Reader` records by flagging reads and `at_end` past the end of the data, including through the clones the parser makes. The Flate decoder keeps its own 32 KiB history, so it pauses at any output size. `ContentReader::new` reuses raw/decrypted stream bytes for budget accounting and piece creation, and `decoded_raw_within` applies the existing Whole-stream filters and limits to those bytes without decrypting twice; (16) revision 5–6 (AES-256) passwords are tried in their SASLprep form (RFC 4013, then UTF-8, at most 127 bytes, as ISO 32000-2 §7.6.4.3.3 Algorithm 2.A asks and pdfcraft-crypt writes them) and then, if that differs, as given (`aes256_passwords` in `crypto/mod.rs`, which resolves the upstream `TODO: Do the above.`; `stringprep`, already in the tree through pdfcraft-crypt, is an optional dependency enabled by `std`, and without `std` passwords are used as given): the renderer used the password as typed, so one that SASLprep changes (a decomposed `café`, a no-break space, the fullwidth `ａｂ` a Japanese IME types in full-width mode) was wrong, although pdfcraft-cos accepted it: protecting a document with such an open password was rolled back ("the password is incorrect"), and a file with such a password did not open with it. | (1) `cos/tests/writer.rs::page_tree_loops_in_object_streams_do_not_crash_readers`; (2) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (3) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (4) `raster::tests::inline_images_with_ei_in_their_data_parse_in_linear_time`; (5) `raster::tests::indirect_appearance_state_dict_is_not_another_stream`; (6) `raster::tests::jpx_stream_bit_depth_boundaries_do_not_panic`, `raster::tests::jpx_32_bit_image_does_not_prevent_other_page_content_from_rendering`, `raster::tests::jpx_gray_rgb_and_alpha_keep_eight_bit_samples`, `raster::tests::jpx_streams_reject_out_of_range_bit_depths`; (7) `raster::tests::decompression_bombs_stop_at_the_stream_limit`, `raster::tests::page_contents_and_nested_forms_share_one_budget`; (8) `inspect::tests::jspdf_high_precision_mediabox_does_not_overflow_dimensions`, `object::number::tests::high_precision_float_does_not_overflow_mantissa` (hayro-syntax); (9) `object::dict::lazy_index_tests`, `raster::tests::large_resource_indexes_preserve_pixels_and_text`; (10) `data::tests`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`, `raster::tests::shared_parser_is_lazy_and_initializes_once_under_contention`; (11) `data::tests::panicking_initializer_wakes_waiters_and_prevents_retries`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`; (12) `util::tests::segment_list_rejects_out_of_range_indices`; (13) `raster::tests::user_unit_scales_the_page_and_everything_on_it`; (14) `crypto::pdfcraft_password_tests`, `pdfcraft-engine` `tests::legacy_passwords_with_turkish_characters_open`; (15) `content::tests::windows_keep_every_instruction_at_every_split`, `content::tests::windows_keep_every_instruction_in_pieces_of_any_size`, `content::tests::windows_match_the_slice_on_random_content`, `content::tests::windows_drop_blanks_and_keep_a_comment_that_may_go_on`, `page::content_reader_tests::content_past_the_cap_is_read_to_the_end`, `page::content_reader_tests::a_stream_that_expands_past_the_budget_is_cut_there`, `page::content_reader_tests::a_small_expansion_under_the_cap_is_not_cut`, `raster::tests::page_content_past_the_old_cap_renders`, `raster::tests::content_reader_returns_the_same_bytes_in_any_pieces`, `raster::tests::content_bombs_stop_at_the_budget_and_say_so`, `page::content_reader_tests::plain_and_whole_pieces_keep_their_bytes`, `page::content_reader_tests::repeated_content_reference_counts_compressed_bytes_once`, `page::content_reader_tests::whole_cap_still_counts_later_unique_streams`; (16) `crypto::pdfcraft_password_tests::aes256_passwords_are_tried_in_their_saslprep_form_then_as_given`, `crypto::pdfcraft_password_tests::aes256_passwords_open_as_typed_and_in_their_saslprep_form`, `pdfcraft-engine` `tests::aes256_open_passwords_that_saslprep_changes_protect_and_reopen_as_typed`, `tests::aes256_files_whose_passwords_saslprep_changes_open_as_typed`
 | lopdf | 0.45.0 | MIT | (1) PNG predictor rows longer than the data are refused before their buffers are allocated (a fuzzed `/Columns 4294967295` allocated two 4 GiB rows), and empty frames return without row buffers; (2) predictor row widths use saturating arithmetic or reject overflow; (3) sub-byte TIFF Predictor 2 scratch is bounded by the samples present in the input instead of the declared `/Colors`, aligned with [lopdf#589](https://github.com/J-F-Liu/lopdf/pull/589); (4) the object lookup keeps its cycle history through compressed objects, requires an ordinary in-file container, and caps the chain of indirect lookups at 16 (a chain of new objects, each a `/Length` compressed in a container whose own `/Length` names the next, or a stream whose `/Length` names the next stream, overflowed the stack: a dev build's 2 MiB thread within 800 hops); (5) object-stream members are parsed within their own extent (up to the next distinct offset), an entry whose offset repeats an earlier entry's is skipped (so a repeated object number can resolve to its earlier entry), and offsets are processed in index order | (1) `inspect::tests::png_predictor_rows_longer_than_the_data_are_refused_before_allocating`, `inspect::tests::empty_png_predictor_frames_do_not_allocate_rows`; (2) `inspect::tests::tiff_subbyte_predictor_row_width_overflow_is_refused`; (3) `inspect::tests::tiff_subbyte_predictor_scratch_is_bounded_by_available_samples`, `inspect::tests::tiff_subbyte_predictors_keep_components_rows_and_padding`; (4) `inspect::tests::compressed_object_self_container_does_not_recurse`, `inspect::tests::compressed_object_mutual_containers_do_not_recurse`, `inspect::tests::object_stream_length_cycle_does_not_recurse`, `inspect::tests::compressed_object_container_chain_does_not_recurse`, `inspect::tests::compressed_length_chain_does_not_recurse`, `inspect::tests::plain_stream_length_chain_does_not_recurse`, `inspect::tests::compressed_objects_and_indirect_stream_length_still_load`, `inspect::tests::compressed_length_in_a_container_with_an_indirect_length_still_loads`; (5) `inspect::tests::object_stream_member_extents_bound_owned_strings`, `inspect::tests::object_stream_member_extents_preserve_index_order_and_whitespace` |
 | hayro-syntax | 0.7.2 | Apache-2.0 OR MIT | (1) Page-tree cycle guard in `resolve_pages` (visited set + depth cap): a `/Kids` loop among compressed objects overflowed the stack and aborted the process; (2) `ccitt_size_ok`: CCITT images wider than 2^20 columns or over 2^28 pixels are not decoded (a fuzzed `/Columns 4294967295` allocated 4 GiB); (3) Flate/LZW predictor row widths are saturating `usize`, a zero width is refused and a row longer than the data is not allocated (a fuzzed `/Columns 9223372036854775807` wrapped to a 2^61-byte allocation and aborted); (4) the inline-image end-of-data check (`EI`) doesn't nest inside its own look-ahead and examines at most 256 candidates and steps (50 images with "EI" in their data ran for over ten minutes); (5) a stream whose `/Length` is wrong is recovered only when `stream` is the next token — scanning ahead to a later object's `stream` made an indirect appearance-state dictionary (Quartz checkboxes: `/AP /N` → `<< /Yes … /Off … >>`) render as a non-form, so the widget was skipped; (6) JPX rescaling uses an exact integer sample range for 1–32-bit components (32 shifted past u32, and floating-point maxima at 25–31 bits wrapped to zero), and refuses zero-sized rows; (7) `decode_limit`: Flate (through flate2 and the fallback inflater), LZW and RunLength never write past `MAX_DECODED_STREAM` (256 MiB), or, for the last filter of an image of known size, past twice its pixel bytes (a predictor tag byte per byte), at most 1 GiB; `Stream::decoded_within` for budgeted callers; a page's `/Contents` array shares one `MAX_DECODED_STREAM` (a 2 MB page whose content stream or 8 × 8 image inflated to 2 GB took the renderer past 3 GB in under a second; naming the stream twenty times in `/Contents`, 5 GB); (8) high-precision numbers (jsPDF MediaBox coordinates with over 19 digits) parse without overflowing the u64 mantissa: fractional digits past it are dropped, integer digits past it scale the value (a real, kept finite); (9) large dictionary indexes are built on first use and shared across repeated reads within each PDF (#307); the validated-byte cache is bounded, reader contexts remain separate, repairs and inline/content dictionaries bypass sharing, and small dictionaries stay eager; (10) decoded object-stream slots publish once under contention, cold loading rejects recursive dependencies, and xref repair serializes without holding recursive read guards; this permits one parser per native render pool with private worker caches; (11) `sync.rs`: a poisoned lock is recovered instead of unwrapped (a worker panic no longer cascades into every reader of the same PDF), and xref repair takes a blocking write lock instead of asserting a non-blocking one; (12) `SegmentList` (`util.rs`) returns `None` for an out-of-range index instead of panicking; (13) a page's `/UserUnit` scales `render_dimensions` and `initial_transform`, so the page and everything on it are sized in points, as Acrobat shows them; it is read as Acrobat reads it (the page's own entry, not inherited; a number from 1 up, at most 75,000; anything else counts as 1), and a page without it keeps exactly the transform it had | (1) `cos/tests/writer.rs::page_tree_loops_in_object_streams_do_not_crash_readers`; (2) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (3) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (4) `raster::tests::inline_images_with_ei_in_their_data_parse_in_linear_time`; (5) `raster::tests::indirect_appearance_state_dict_is_not_another_stream`; (6) `raster::tests::jpx_stream_bit_depth_boundaries_do_not_panic`, `raster::tests::jpx_32_bit_image_does_not_prevent_other_page_content_from_rendering`, `raster::tests::jpx_gray_rgb_and_alpha_keep_eight_bit_samples`, `raster::tests::jpx_streams_reject_out_of_range_bit_depths`; (7) `raster::tests::decompression_bombs_stop_at_the_stream_limit`, `raster::tests::page_contents_and_nested_forms_share_one_budget`; (8) `inspect::tests::jspdf_high_precision_mediabox_does_not_overflow_dimensions`, `object::number::tests::high_precision_float_does_not_overflow_mantissa` (hayro-syntax); (9) `object::dict::lazy_index_tests`, `raster::tests::large_resource_indexes_preserve_pixels_and_text`; (10) `data::tests`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`, `raster::tests::shared_parser_is_lazy_and_initializes_once_under_contention`; (11) `data::tests::panicking_initializer_wakes_waiters_and_prevents_retries`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`; (12) `util::tests::segment_list_rejects_out_of_range_indices`; (13) `raster::tests::user_unit_scales_the_page_and_everything_on_it` |
 | lopdf | 0.45.0 | MIT | (1) PNG predictor rows longer than the data are refused before their buffers are allocated (a fuzzed `/Columns 4294967295` allocated two 4 GiB rows), and empty frames return without row buffers; (2) predictor row widths use saturating arithmetic or reject overflow; (3) sub-byte TIFF Predictor 2 scratch is bounded by the samples present in the input instead of the declared `/Colors`, aligned with [lopdf#589](https://github.com/J-F-Liu/lopdf/pull/589) | (1) `inspect::tests::png_predictor_rows_longer_than_the_data_are_refused_before_allocating`, `inspect::tests::empty_png_predictor_frames_do_not_allocate_rows`; (2) `inspect::tests::tiff_subbyte_predictor_row_width_overflow_is_refused`; (3) `inspect::tests::tiff_subbyte_predictor_scratch_is_bounded_by_available_samples`, `inspect::tests::tiff_subbyte_predictors_keep_components_rows_and_padding` |
 | hayro-syntax | 0.7.2 | Apache-2.0 OR MIT | (1) Page-tree cycle guard in `resolve_pages` (visited set + depth cap): a `/Kids` loop among compressed objects overflowed the stack and aborted the process; (2) `ccitt_size_ok`: CCITT images wider than 2^20 columns or over 2^28 pixels are not decoded (a fuzzed `/Columns 4294967295` allocated 4 GiB); (3) Flate/LZW predictor row widths are saturating `usize`, a zero width is refused and a row longer than the data is not allocated (a fuzzed `/Columns 9223372036854775807` wrapped to a 2^61-byte allocation and aborted); (4) the inline-image end-of-data check (`EI`) doesn't nest inside its own look-ahead and examines at most 256 candidates and steps (50 images with "EI" in their data ran for over ten minutes); (5) a stream whose `/Length` is wrong is recovered only when `stream` is the next token — scanning ahead to a later object's `stream` made an indirect appearance-state dictionary (Quartz checkboxes: `/AP /N` → `<< /Yes … /Off … >>`) render as a non-form, so the widget was skipped; (6) JPX rescaling uses an exact integer sample range for 1–32-bit components (32 shifted past u32, and floating-point maxima at 25–31 bits wrapped to zero), and refuses zero-sized rows; (7) `decode_limit`: Flate (through flate2 and the fallback inflater), LZW and RunLength never write past `MAX_DECODED_STREAM` (256 MiB), or, for the last filter of an image of known size, past twice its pixel bytes (a predictor tag byte per byte), at most 1 GiB; `Stream::decoded_within` for budgeted callers; a page's `/Contents` array shares one `MAX_DECODED_STREAM` (a 2 MB page whose content stream or 8 × 8 image inflated to 2 GB took the renderer past 3 GB in under a second; naming the stream twenty times in `/Contents`, 5 GB); (8) high-precision numbers (jsPDF MediaBox coordinates with over 19 digits) parse without overflowing the u64 mantissa: fractional digits past it are dropped, integer digits past it scale the value (a real, kept finite); (9) large dictionary indexes are built on first use and shared across repeated reads within each PDF (#307); the validated-byte cache is bounded, reader contexts remain separate, repairs and inline/content dictionaries bypass sharing, and small dictionaries stay eager; (10) decoded object-stream slots publish once under contention, cold loading rejects recursive dependencies, and xref repair serializes without holding recursive read guards; this permits one parser per native render pool with private worker caches; (11) `sync.rs`: a poisoned lock is recovered instead of unwrapped (a worker panic no longer cascades into every reader of the same PDF), and xref repair takes a blocking write lock instead of asserting a non-blocking one; (12) `SegmentList` (`util.rs`) returns `None` for an out-of-range index instead of panicking; (13) a page's `/UserUnit` scales `render_dimensions` and `initial_transform`, so the page and everything on it are sized in points, as Acrobat shows them; it is read as Acrobat reads it (the page's own entry, not inherited; a number from 1 up, at most 75,000; anything else counts as 1), and a page without it keeps exactly the transform it had; (14) direct arrays and dictionaries share a reader-local nesting cap of 128, counted while skipping and while parsing a dictionary (its lenient repair reads, rather than skips, an object found where a key belongs, so `<< << …` recursed through that read); deeper objects return `None` instead of overflowing the stack (including unused trailer values, trailer entries, content operands and marked-content properties); a chain of 65 direct stitching functions now stops at this cap, before the 64-function guard | (1) `cos/tests/writer.rs::page_tree_loops_in_object_streams_do_not_crash_readers`; (2) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (3) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (4) `raster::tests::inline_images_with_ei_in_their_data_parse_in_linear_time`; (5) `raster::tests::indirect_appearance_state_dict_is_not_another_stream`; (6) `raster::tests::jpx_stream_bit_depth_boundaries_do_not_panic`, `raster::tests::jpx_32_bit_image_does_not_prevent_other_page_content_from_rendering`, `raster::tests::jpx_gray_rgb_and_alpha_keep_eight_bit_samples`, `raster::tests::jpx_streams_reject_out_of_range_bit_depths`; (7) `raster::tests::decompression_bombs_stop_at_the_stream_limit`, `raster::tests::page_contents_and_nested_forms_share_one_budget`; (8) `inspect::tests::jspdf_high_precision_mediabox_does_not_overflow_dimensions`, `object::number::tests::high_precision_float_does_not_overflow_mantissa` (hayro-syntax); (9) `object::dict::lazy_index_tests`, `raster::tests::large_resource_indexes_preserve_pixels_and_text`; (10) `data::tests`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`, `raster::tests::shared_parser_is_lazy_and_initializes_once_under_contention`; (11) `data::tests::panicking_initializer_wakes_waiters_and_prevents_retries`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`; (12) `util::tests::segment_list_rejects_out_of_range_indices`; (13) `raster::tests::user_unit_scales_the_page_and_everything_on_it`; (14) `raster::tests::deeply_nested_direct_objects_do_not_overflow_the_stack`, `raster::tests::dictionaries_nested_without_keys_in_content_do_not_overflow_the_stack`, `raster::tests::dictionaries_nested_without_keys_in_the_trailer_do_not_overflow_the_stack`, `raster::tests::dictionaries_nested_without_keys_as_marked_content_properties_do_not_overflow_the_stack`, `raster::tests::dictionaries_nested_without_keys_are_read_up_to_the_nesting_cap`, `raster::tests::nesting_at_the_cap_fits_a_512_kib_stack` (native only), `raster::tests::function_limits_depth_guard_refuses_a_chain_of_references` |
-| winit | 0.30.13 | Apache-2.0 | (1) on Windows 11 (build 22000 and later), `WM_DPICHANGED` applies the rect Windows suggests. It used to nudge the window onto the monitor `MonitorFromWindow` names, which during a drag is still the monitor being left; the nudge sent another `WM_DPICHANGED`, so a window dragged to a monitor with another scale factor grew and stayed on the wrong monitor at the wrong scale (#324). Backport of winit master 488c036a ([winit#4341](https://github.com/rust-windowing/winit/pull/4341)), which no 0.30 release has; Windows 10 keeps the old adjustment, as on winit master. (2) on Wayland, a seat's text input is destroyed when the seat goes away, not whenever it loses a capability: losing any capability (a touch screen or tablet unplugged, a remote-desktop session ending) destroyed it, and only an added capability recreated it, so IME stopped working until restart. Port of [winit#4747](https://github.com/rust-windowing/winit/pull/4747); (3) on Windows, an IME composition reports its cursor from `GCS_CURSORPOS` only when `WM_IME_COMPOSITION` says it is set, and at the end of the composition otherwise: the Microsoft Korean IME never sets it, so the cursor read as 0 (egui then drew no caret while composing; it now draws it after the syllable). Port of [winit#4746](https://github.com/rust-windowing/winit/pull/4746); (4) on Windows, a hidden window is not maximized until it is shown, and a hidden window shown while maximized gets one `ShowWindow(SW_MAXIMIZE)`: `SW_MAXIMIZE` shows a hidden window, so PdfCraft, which eframe keeps hidden until its first frame is drawn, appeared unpainted (white) when it restored a maximized window, and could lose its focus. Port of [winit#4587](https://github.com/rust-windowing/winit/pull/4587) (the later, focus-safe form of [winit#4575](https://github.com/rust-windowing/winit/pull/4575)); (5) on X11, when allowing or disallowing IME replaces the focused window's input context (egui does it each time a text field gains or loses focus), the new context is focused: no focus event follows, so it stayed unfocused until the window lost and regained focus. Port of [winit#4727](https://github.com/rust-windowing/winit/pull/4727); (6) on macOS, `insertText` commits through IME when a composition was started (`pending_commit`, set by `setMarkedText`) rather than when marked text is left: input methods that end a composition with `unmarkText` before `insertText` lost the text, and Apple Korean dropped the key typed after a syllable (`한` then `5` or `;`); other `insertText` calls stay `KeyboardInput`; a commit outside a key press (a candidate clicked with the mouse, dictation) clears the marked text and leaves no key to swallow, as in [winit#4748](https://github.com/rust-windowing/winit/pull/4748) (without it the next key, such as Backspace, was lost). `validAttributesForMarkedText` lists the underline and marked-clause attributes, without which some input methods don't compose. Port of [winit#4650](https://github.com/rust-windowing/winit/pull/4650), the 0.30 backport of [winit#4651](https://github.com/rust-windowing/winit/pull/4651) (merged on winit master), with the underline attribute spelled as AppKit's `NSUnderlineStyleAttributeName` (`NSUnderline`); (7) on macOS, disallowing IME with a composition in progress (focus leaving a text field) tells the input method to discard its marked text (`discardMarkedText`): it kept composing it once IME was allowed again, so the abandoned syllable came back (`하`, then `가` typed in the next field, became `학`, then `하` + `가`; Japanese `か` then `さ` became `傘`). Port of [winit#4745](https://github.com/rust-windowing/winit/pull/4745); (8) on macOS, text inserted outside a key press without a composition (the emoji picker) is reported as `Ime::Commit`; it was dropped. Port of the emoji-picker part of [winit#4749](https://github.com/rust-windowing/winit/pull/4749) (0.30 backport of [winit#4748](https://github.com/rust-windowing/winit/pull/4748)); its `selectedRange` change for dictation is left out because it switches on press-and-hold for every held key (an accent menu instead of key repeat, and the chosen accent added after the repeated letters); (9) on macOS, a key whose text was committed through IME isn't also sent as `KeyboardInput` unless AppKit forwards it as a command (Enter): Apple Korean answers Space with no syllable in progress with `setMarkedText(" ")`, `insertText(" ")`, `setMarkedText("")`, and the last call reset winit's state, so the space arrived twice. Same goal as [winit#4478](https://github.com/rust-windowing/winit/pull/4478), whose changes don't reach this call order (macOS 14); to be proposed upstream there; (10) on macOS, when the first key in a fresh app reaches Apple Korean's `insertText` as a raw compatibility jamo instead of starting a composition, that key is interpreted once more, synchronously, before it is sent as `KeyboardInput` (g k s typed ㅎㅏㄴ instead of 한); only an unmodified, non-repeated first key whose one callback inserts that same jamo, with IME enabled and nothing composed, focus and input source unchanged, is retried (`ime_startup.rs`). Port of [winit#4744](https://github.com/rust-windowing/winit/pull/4744), with its policy tests.; (11) on X11 without `Xft.dpi`, the scale factor comes from the X screen's configured DPI (its size in pixels and millimetres) before the output's physical density from RandR: Xorg can deliberately run a dense panel at 96 DPI, and only winit applications then looked zoomed; `Xft.dpi` still wins, `WINIT_X11_SCALE_FACTOR` still overrides, and a screen reporting no size keeps the RandR fallback. PdfCraft patch (#1150, replacing the launcher pin proposed in #908). The published crate's asset files (`docs/res/*.svg`, `examples/data/*.png`) are left out, so its `window` example doesn't build | (1) `pdfcraft` `tests::winit_carries_the_windows_11_monitor_scale_fix` keeps the patch in the build; the drag itself needs two monitors with different scale factors on Windows 11; (2) `pdfcraft` `tests/winit_wayland_text_input.rs`; the capability change itself needs a Wayland session and an input method; (3) `pdfcraft` `tests/winit_windows_ime_cursor.rs`; composing itself needs the Microsoft Korean IME; (4) `pdfcraft` `tests/winit_windows_hidden_maximized.rs`; the start-up itself needs Windows and a window that was closed maximized; (5) `pdfcraft` `tests/winit_x11_ime_focus.rs`; switching fields itself needs an X11 session and an input method (IBus, fcitx5); (6) `pdfcraft` `tests/winit_macos_ime_commit.rs`; composing itself needs macOS and an input method; (7) `pdfcraft` `tests/winit_macos_ime_discard.rs`; composing itself needs macOS and an input method; (8) `pdfcraft` `tests/winit_macos_emoji_picker.rs`; the picker itself needs macOS; (9) `pdfcraft` `tests/winit_macos_korean_space.rs`; composing itself needs macOS and Apple Korean; (10) `pdfcraft` `tests/winit_macos_korean_first_key.rs` and `ime_startup.rs`'s own tests (run them with `rustc --test`); typing itself needs macOS and Apple Korean; (11) `pdfcraft` `tests/winit_x11_dpi.rs` keeps the patch in the build, and `util::randr` tests the policy (run them in the vendored crate); the scale itself needs an X11 session |
+| winit | 0.30.13 | Apache-2.0 | (1) on Windows 11 (build 22000 and later), `WM_DPICHANGED` applies the rect Windows suggests. It used to nudge the window onto the monitor `MonitorFromWindow` names, which during a drag is still the monitor being left; the nudge sent another `WM_DPICHANGED`, so a window dragged to a monitor with another scale factor grew and stayed on the wrong monitor at the wrong scale (#324). Backport of winit master 488c036a ([winit#4341](https://github.com/rust-windowing/winit/pull/4341)), which no 0.30 release has; Windows 10 keeps the old adjustment, as on winit master. (2) on Wayland, a seat's text input is destroyed when the seat goes away, not whenever it loses a capability: losing any capability (a touch screen or tablet unplugged, a remote-desktop session ending) destroyed it, and only an added capability recreated it, so IME stopped working until restart. Port of [winit#4747](https://github.com/rust-windowing/winit/pull/4747); (3) on Windows, an IME composition reports its cursor from `GCS_CURSORPOS` only when `WM_IME_COMPOSITION` says it is set, and at the end of the composition otherwise: the Microsoft Korean IME never sets it, so the cursor read as 0 (egui then drew no caret while composing; it now draws it after the syllable). Port of [winit#4746](https://github.com/rust-windowing/winit/pull/4746); (4) on Windows, a hidden window is not maximized until it is shown, and a hidden window shown while maximized gets one `ShowWindow(SW_MAXIMIZE)`: `SW_MAXIMIZE` shows a hidden window, so PdfCraft, which eframe keeps hidden until its first frame is drawn, appeared unpainted (white) when it restored a maximized window, and could lose its focus. Port of [winit#4587](https://github.com/rust-windowing/winit/pull/4587) (the later, focus-safe form of [winit#4575](https://github.com/rust-windowing/winit/pull/4575)); (5) on X11, when allowing or disallowing IME replaces the focused window's input context (egui does it each time a text field gains or loses focus), the new context is focused: no focus event follows, so it stayed unfocused until the window lost and regained focus. Port of [winit#4727](https://github.com/rust-windowing/winit/pull/4727); (6) on macOS, `insertText` commits through IME when a composition was started (`pending_commit`, set by `setMarkedText`) rather than when marked text is left: input methods that end a composition with `unmarkText` before `insertText` lost the text, and Apple Korean dropped the key typed after a syllable (`한` then `5` or `;`); other `insertText` calls stay `KeyboardInput`; a commit outside a key press (a candidate clicked with the mouse, dictation) clears the marked text and leaves no key to swallow, as in [winit#4748](https://github.com/rust-windowing/winit/pull/4748) (without it the next key, such as Backspace, was lost). `validAttributesForMarkedText` lists the underline and marked-clause attributes, without which some input methods don't compose. Port of [winit#4650](https://github.com/rust-windowing/winit/pull/4650), the 0.30 backport of [winit#4651](https://github.com/rust-windowing/winit/pull/4651) (merged on winit master), with the underline attribute spelled as AppKit's `NSUnderlineStyleAttributeName` (`NSUnderline`); (7) on macOS, disallowing IME with a composition in progress (focus leaving a text field) tells the input method to discard its marked text (`discardMarkedText`): it kept composing it once IME was allowed again, so the abandoned syllable came back (`하`, then `가` typed in the next field, became `학`, then `하` + `가`; Japanese `か` then `さ` became `傘`). Port of [winit#4745](https://github.com/rust-windowing/winit/pull/4745); (8) on macOS, text inserted outside a key press without a composition (the emoji picker) is reported as `Ime::Commit`; it was dropped. Port of the emoji-picker part of [winit#4749](https://github.com/rust-windowing/winit/pull/4749) (0.30 backport of [winit#4748](https://github.com/rust-windowing/winit/pull/4748)); its `selectedRange` change for dictation is left out because it switches on press-and-hold for every held key (an accent menu instead of key repeat, and the chosen accent added after the repeated letters); (9) on macOS, a key whose text was committed through IME isn't also sent as `KeyboardInput` unless AppKit forwards it as a command (Enter): Apple Korean answers Space with no syllable in progress with `setMarkedText(" ")`, `insertText(" ")`, `setMarkedText("")`, and the last call reset winit's state, so the space arrived twice. Same goal as [winit#4478](https://github.com/rust-windowing/winit/pull/4478), whose changes don't reach this call order (macOS 14); to be proposed upstream there; (10) on macOS, when the first key in a fresh app reaches Apple Korean's `insertText` as a raw compatibility jamo instead of starting a composition, that key is interpreted once more, synchronously, before it is sent as `KeyboardInput` (g k s typed ㅎㅏㄴ instead of 한); only an unmodified, non-repeated first key whose one callback inserts that same jamo, with IME enabled and nothing composed, focus and input source unchanged, is retried (`ime_startup.rs`). Port of [winit#4744](https://github.com/rust-windowing/winit/pull/4744), with its policy tests.; (11) on X11 without `Xft.dpi`, the scale factor comes from the X screen's configured DPI (its size in pixels and millimetres) before the output's physical density from RandR: Xorg can deliberately run a dense panel at 96 DPI, and only winit applications then looked zoomed; `Xft.dpi` still wins, `WINIT_X11_SCALE_FACTOR` still overrides, and a screen reporting no size keeps the RandR fallback. PdfCraft patch (#1150, replacing the launcher pin proposed in #908). (12) on macOS, `WinitView` answers `mouseDownCanMoveWindow` with the window's `movable_by_window_background` attribute (NO unless asked): NSView answers YES for a view that isn't opaque, so with the transparent title bar and full-size content view PdfCraft uses, AppKit moved the window for any drag that began in the 28 pt title-bar band before the app saw it, and document tabs (which live in that band) could not be dragged to reorder them. The empty strip still moves the window through `ViewportCommand::StartDrag`. PdfCraft patch. The published crate's asset files (`docs/res/*.svg`, `examples/data/*.png`) are left out, so its `window` example doesn't build; (13) on Wayland, pixel-only wheel, wheel-tilt and continuous-source scroll events report `Moved` rather than starting an unterminated finger gesture, so egui follows modifier release instead of keeping Ctrl zoom latched (#991). Finger gestures and unknown sources retain their existing phase policy | (1) `pdfcraft` `tests::winit_carries_the_windows_11_monitor_scale_fix` keeps the patch in the build; the drag itself needs two monitors with different scale factors on Windows 11; (2) `pdfcraft` `tests/winit_wayland_text_input.rs`; the capability change itself needs a Wayland session and an input method; (3) `pdfcraft` `tests/winit_windows_ime_cursor.rs`; composing itself needs the Microsoft Korean IME; (4) `pdfcraft` `tests/winit_windows_hidden_maximized.rs`; the start-up itself needs Windows and a window that was closed maximized; (5) `pdfcraft` `tests/winit_x11_ime_focus.rs`; switching fields itself needs an X11 session and an input method (IBus, fcitx5); (6) `pdfcraft` `tests/winit_macos_ime_commit.rs`; composing itself needs macOS and an input method; (7) `pdfcraft` `tests/winit_macos_ime_discard.rs`; composing itself needs macOS and an input method; (8) `pdfcraft` `tests/winit_macos_emoji_picker.rs`; the picker itself needs macOS; (9) `pdfcraft` `tests/winit_macos_korean_space.rs`; composing itself needs macOS and Apple Korean; (10) `pdfcraft` `tests/winit_macos_korean_first_key.rs` and `ime_startup.rs`'s own tests (run them with `rustc --test`); typing itself needs macOS and Apple Korean; (11) `pdfcraft` `tests/winit_x11_dpi.rs` keeps the patch in the build, and `util::randr` tests the policy (run them in the vendored crate); the scale itself needs an X11 session; (12) `pdfcraft` `tests/winit_macos_title_bar_drag.rs` keeps the patch in the build; the drag itself needs macOS and a pointer; (13) `pdfcraft` `tests/winit_wayland_scroll.rs` compiles the production phase policy and exercises modifier release through egui; live COSMIC confirmation remains open |
 | egui-wgpu | 0.36.2 | MIT OR Apache-2.0 | (1) `winit::surface_fit`: a window's surface is configured within the device's `max_texture_dimension_2d`, both sides shrunk by one factor that egui then draws at (`pixels_per_point × render_scale`), so the whole window is drawn into the surface (on DX12 it is stretched over the window and lines up with the pointer; wgpu's GL backend copies it unscaled into a corner); the longer side becomes exactly the limit; the depth and MSAA textures follow, and a recreated surface starts again from the window's own size. egui-wgpu configured the window's size as is, and `Surface::configure` panics beyond the limit: a window restored at another monitor's scale (opening an Outlook attachment on a mixed-DPI laptop asked an 8192-pixel device for 8600 × 3423, #577) or stretched across monitors closed PdfCraft, before its window appeared when it happened at start-up ([emilk/egui#8361](https://github.com/emilk/egui/issues/8361)). The published crate leaves out egui's licence files; `LICENSE-APACHE` and `LICENSE-MIT` are from the 0.36.2 tag; (2) `winit::catch_errors`: a new window's surface is configured inside wgpu error scopes (validation, out of memory, internal), and a failure is returned as `WgpuError::ConfigureSurface` (for the root window at start-up eframe returns it as `Error::Wgpu`, which PdfCraft retries with OpenGL); nothing is kept for the window. wgpu's default handler panicked instead, and eframe configures the root surface before the app is created, so a driver that can't configure one closed PdfCraft at launch (a 2015 Intel GPU through wgpu's GL backend timed out waiting for the GPU to go idle, `GpuWaitTimeout`, #519). Unchanged, so still a panic: an error in a later reconfigure (resize, a lost surface), a device lost during the first configure (wgpu reports it only to a callback), and a window shown at zero size (first configured on resize) | (1) `pdfcraft` `tests::a_window_larger_than_the_gpu_limit_gets_a_surface_within_it`, `tests::surface_fit_never_empties_or_overflows_a_surface`, and `tests::egui_wgpu_carries_the_surface_size_fit`, which keeps the patch in the build and in the paths that size a surface; (2) `pdfcraft` `tests::a_gpu_error_while_a_window_is_set_up_is_returned_not_a_panic` (a real device: an error inside `catch_errors` is returned, not a panic) and `tests::egui_wgpu_returns_a_surface_it_cannot_configure_as_an_error`, which keeps it around `add_surface`'s configure |
+| vello_common | 0.0.8 | Apache-2.0 OR MIT | (1) `clip::intersect` (the clip step every clipped path passes through) starts its row walk at the first row both paths have strips in, not the earlier of the two first rows. The walk visited every row from the top of the clip for each path (on the A1 sample's full-page canvas, about half its strip rows per stroke), and rows where one path has no strips produce no output, so the strips are unchanged (vello_common 0.1 starts at the later row too). Its cost grew with the page, and a full-page render of the A1 sample was about 30% faster; the output is byte-identical | (1) `clip::tests::intersect_walks_only_rows_both_paths_have_strips` counts the rows the walk visits (`cargo test --manifest-path vendor/vello_common/Cargo.toml`) and fails without the patch; the render crate's pixel tests run through the patched crate |
 
 Renderer startup errors: `egui-wgpu::RenderState::create` also wraps `Renderer::new` in
 `winit::catch_errors` when the winit feature is enabled. A rejected shader or render pipeline
diff --git a/vendor/hayro-interpret/src/device.rs b/vendor/hayro-interpret/src/device.rs
index 72d5a9809..36c64a23f 100644
--- a/vendor/hayro-interpret/src/device.rs
+++ b/vendor/hayro-interpret/src/device.rs
@@ -66,6 +66,13 @@ pub trait Device<'a> {
     fn actual_text(&mut self, _text: &[u8]) {}
     /// Called at the end of a marked content sequence (EMC).
     fn end_marked_content(&mut self) {}
+    /// PdfCraft patch (29): the page's annotations are about to be drawn (until
+    /// `end_annotations`), as page content finishes. Devices can use this to treat their
+    /// paints as annotation colours rather than document colours — the reading-colours
+    /// setting replaces document colours only, never the colours a comment was given.
+    fn begin_annotations(&mut self) {}
+    /// PdfCraft patch (29): the page's annotations are done; what follows is page content.
+    fn end_annotations(&mut self) {}
 }
 
 /// A device that discards all drawing operations.
diff --git a/vendor/hayro-interpret/src/interpret/mod.rs b/vendor/hayro-interpret/src/interpret/mod.rs
index 931b3388c..fe08fc284 100644
--- a/vendor/hayro-interpret/src/interpret/mod.rs
+++ b/vendor/hayro-interpret/src/interpret/mod.rs
@@ -175,6 +175,9 @@ pub fn interpret_page<'a>(
     if context.settings.render_annotations
         && let Some(annot_arr) = page.raw().get::<Array<'_>>(ANNOTS)
     {
+        // PdfCraft patch (29): bracket the annotations so devices can tell their paints from
+        // the document's own (the reading-colours setting recolours the document, not comments).
+        device.begin_annotations();
         for annot in annot_arr.iter::<Dict<'_>>() {
             let flags = annot.get::<u32>(F).unwrap_or(0);
 
@@ -275,6 +278,7 @@ pub fn interpret_page<'a>(
                 draw_highlight_without_appearance(&annot, context, device);
             }
         }
+        device.end_annotations();
     }
 }
 
diff --git a/vendor/hayro-interpret/src/x_object.rs b/vendor/hayro-interpret/src/x_object.rs
index 68d97d555..1138b658f 100644
--- a/vendor/hayro-interpret/src/x_object.rs
+++ b/vendor/hayro-interpret/src/x_object.rs
@@ -60,6 +60,9 @@ pub(crate) struct FormXObject<'a> {
     pub(crate) matrix: Affine,
     pub(crate) bbox: [f32; 4],
     is_transparency_group: bool,
+    // PdfCraft patch: the group's /I and /K (ISO 32000-2 §11.6.6, both false by default).
+    is_isolated: bool,
+    is_knockout: bool,
     pub(crate) dict: Dict<'a>,
     resources: Dict<'a>,
 }
@@ -77,12 +80,17 @@ impl<'a> FormXObject<'a> {
                 .unwrap_or([1.0, 0.0, 0.0, 1.0, 0.0, 0.0]),
         );
         let bbox = dict.get::<[f32; 4]>(BBOX)?;
-        let is_transparency_group = dict.get::<Dict<'_>>(GROUP).is_some();
+        let group = dict.get::<Dict<'_>>(GROUP);
+        let is_transparency_group = group.is_some();
+        let is_isolated = group.as_ref().and_then(|g| g.get::<bool>(I)).unwrap_or(false);
+        let is_knockout = group.as_ref().and_then(|g| g.get::<bool>(K)).unwrap_or(false);
 
         Some(Self {
             decoded,
             matrix,
             is_transparency_group,
+            is_isolated,
+            is_knockout,
             bbox,
             dict: dict.clone(),
             resources,
@@ -134,7 +142,26 @@ pub(crate) fn draw_form_xobject<'a, 'b>(
     context.pre_concat_affine(x_object.matrix);
     context.push_root_transform();
 
-    if x_object.is_transparency_group {
+    // PdfCraft patch: a transparency group that is neither isolated nor knockout composites
+    // its elements with the backdrop already on the page (§11.4.7), so when it is entered at
+    // full opacity with no soft mask and Normal blending there is nothing for a layer of its
+    // own to add, and drawing straight onto the page is the exact result. A layer here was
+    // wrong, not just slower: a blend mode inside the group (the `/BM /Multiply` of a highlight
+    // appearance written by other editors) saw the layer's transparent backdrop instead of the
+    // text, and the layer then covered the page as an opaque block (#1968). An isolated group
+    // starts from a blank backdrop by definition, and a knockout group or one entered at partial
+    // opacity, under a soft mask or with a blend mode keeps its layer, where the group's
+    // elements still composite with a blank backdrop (an approximation of §11.4.7 for them).
+    let neutral = !x_object.is_isolated && !x_object.is_knockout && {
+        let state = &context.get().graphics_state;
+        state.non_stroke_alpha >= 1.0
+            && state.stroke_alpha >= 1.0
+            && state.soft_mask.is_none()
+            && state.blend_mode == BlendMode::Normal
+    };
+    let own_layer = x_object.is_transparency_group && !neutral;
+
+    if own_layer {
         device.push_transparency_group(
             context.get().graphics_state.non_stroke_alpha,
             std::mem::take(&mut context.get_mut().graphics_state.soft_mask),
@@ -169,7 +196,7 @@ pub(crate) fn draw_form_xobject<'a, 'b>(
 
     device.pop_clip_path();
 
-    if x_object.is_transparency_group {
+    if own_layer {
         device.pop_transparency_group();
     }
 
@@ -667,23 +694,38 @@ fn decode_raster(
             ctx.bits_per_component,
         )?;
 
-        let mut f32_data = apply_decode_array(
+        // PdfCraft patch (28): an image with few possible pixel values converts each of them once.
+        let mut rgb_data = if let Some(rgb) = rgb_via_lookup(
             &components,
-            &ctx.color_space,
-            ctx.bits_per_component,
-            &ctx.decode_arr,
-        )?;
-
-        fix_image_length(&mut f32_data, ctx.width, &mut height, 0.0, &ctx.color_space)?;
-
-        let mut rgb_data = get_rgb_data(
-            &f32_data,
             ctx.width,
             height,
             ctx.scale_factors,
             &ctx.color_space,
+            ctx.bits_per_component,
+            &ctx.decode_arr,
             obj.interpolate,
-        );
+        ) {
+            height = rgb.height;
+            Some(rgb)
+        } else {
+            let mut f32_data = apply_decode_array(
+                &components,
+                &ctx.color_space,
+                ctx.bits_per_component,
+                &ctx.decode_arr,
+            )?;
+
+            fix_image_length(&mut f32_data, ctx.width, &mut height, 0.0, &ctx.color_space)?;
+
+            get_rgb_data(
+                &f32_data,
+                ctx.width,
+                height,
+                ctx.scale_factors,
+                &ctx.color_space,
+                obj.interpolate,
+            )
+        };
 
         if let Some(transfer_function) = &obj.transfer_function
             && let Some(rgb_data) = &mut rgb_data
@@ -1034,27 +1076,136 @@ fn apply_decode_array(
     bits_per_component: u8,
     decode: &[(f32, f32)],
 ) -> Option<Vec<f32>> {
-    let interpolate = |n: f32, d_min: f32, d_max: f32| {
-        interpolate(
-            n,
-            0.0,
-            2.0_f32.powi(bits_per_component as i32) - 1.0,
-            d_min,
-            d_max,
-        )
-    };
-
     let mut decoded_arr = vec![];
 
     for pixel in components.chunks(color_space.num_components() as usize) {
-        for (component, (d_min, d_max)) in pixel.iter().zip(decode) {
-            decoded_arr.push(interpolate(*component as f32, *d_min, *d_max));
+        for (component, range) in pixel.iter().zip(decode) {
+            decoded_arr.push(decode_sample(*component, bits_per_component, *range));
         }
     }
 
     Some(decoded_arr)
 }
 
+/// One sample mapped through its `/Decode` range (ISO 32000-2 §8.9.5.2). PdfCraft patch (28):
+/// shared by [`apply_decode_array`] and [`rgb_via_lookup`], so both decode alike.
+fn decode_sample(sample: u16, bits_per_component: u8, (d_min, d_max): (f32, f32)) -> f32 {
+    interpolate(
+        sample as f32,
+        0.0,
+        2.0_f32.powi(bits_per_component as i32) - 1.0,
+        d_min,
+        d_max,
+    )
+}
+
+/// PdfCraft patch (28): the most bits a pixel's samples may hold together for
+/// [`rgb_via_lookup`] (a table of 65,536 colours).
+const MAX_LOOKUP_BITS: usize = 16;
+
+/// PdfCraft patch (28): the RGB of an image whose pixels hold at most [`MAX_LOOKUP_BITS`] bits
+/// of samples, converted once per possible pixel value rather than once per pixel, at the
+/// height `fix_image_length` gives. `None` when the table would not pay off (the image has no
+/// more pixels than it has entries) or does not apply; the caller then converts every pixel.
+///
+/// The colour of a pixel depends only on its own samples, so the result is the per-pixel one,
+/// except where a tint transform gives the wrong number of components. The per-pixel batch then
+/// shifts the colours after that pixel. The table converts each entry on its own
+/// ([`convert_each`]), so a wrong-sized entry changes only itself, and a value the image never
+/// uses cannot change the colour of one it does.
+/// A Separation or DeviceN tint transform is a PDF function, often a PostScript calculator
+/// program: run once per pixel, an 8-bit spot-colour background of 3304 × 4105 took four
+/// seconds and 430 MB to draw; looked up from 256 entries it takes milliseconds.
+#[allow(clippy::too_many_arguments)]
+fn rgb_via_lookup(
+    components: &[u16],
+    width: u32,
+    height: u32,
+    scale_factors: (f32, f32),
+    cs: &ColorSpace,
+    bits_per_component: u8,
+    decode: &[(f32, f32)],
+    interpolate: bool,
+) -> Option<RgbData> {
+    let n = cs.num_components() as usize;
+    let bpc = usize::from(bits_per_component);
+    let bits = bpc.checked_mul(n)?;
+    // `apply_decode_array` decodes only the samples `/Decode` has a range for: leave a short
+    // array to it, and every sample size it doesn't read.
+    if n == 0 || bits == 0 || bits > MAX_LOOKUP_BITS || bpc > 16 || decode.len() < n {
+        return None;
+    }
+    // The length rules of `fix_image_length`: extra samples are dropped; missing ones shorten
+    // the image to the rows begun, the last row padded with decoded zeros.
+    let row_len = usize::try_from(width).ok()?.checked_mul(n)?;
+    let wanted = row_len.checked_mul(usize::try_from(height).ok()?)?;
+    let (height, used) = if wanted <= components.len() {
+        (height, wanted)
+    } else {
+        (u32::try_from(components.len().div_ceil(row_len)).ok()?, components.len())
+    };
+    let pixels = usize::try_from(width).ok()?.checked_mul(usize::try_from(height).ok()?)?;
+    let total = pixels.checked_mul(n)?;
+    let entries = 1usize << bits;
+    if pixels <= entries {
+        return None;
+    }
+
+    // Every possible pixel value, its samples in order, decoded as `apply_decode_array` would.
+    let mask = (1usize << bpc) - 1;
+    let mut table_input = Vec::with_capacity(entries * n);
+    for code in 0..entries {
+        for (k, range) in decode.iter().take(n).enumerate() {
+            let sample = ((code >> (bpc * (n - 1 - k))) & mask) as u16;
+            table_input.push(decode_sample(sample, bits_per_component, *range));
+        }
+    }
+    let mut table = vec![0; entries * 3];
+    convert_each(cs, &table_input, n, &mut table);
+
+    let mut data = vec![0; pixels.checked_mul(3)?];
+    let whole = used / n;
+    let samples = components.get(..whole * n)?;
+    for (pixel, rgb) in samples.chunks_exact(n).zip(data.chunks_exact_mut(3)) {
+        let code = pixel.iter().fold(0usize, |code, s| (code << bpc) | (usize::from(*s) & mask));
+        if let Some(colour) = table.get(code * 3..code * 3 + 3) {
+            rgb.copy_from_slice(colour);
+        }
+    }
+    // The pixels past the samples present (at most a row): converted as before, padding and all.
+    if whole < pixels {
+        let tail: Vec<f32> = (whole * n..total)
+            .map(|i| match (components.get(i), decode.get(i % n)) {
+                (Some(s), Some(range)) if i < used => decode_sample(*s, bits_per_component, *range),
+                _ => 0.0,
+            })
+            .collect();
+        let _ = cs.convert_f32(&tail, data.get_mut(whole * 3..)?, false);
+    }
+
+    Some(RgbData {
+        data,
+        width,
+        height,
+        interpolate,
+        scale_factors,
+    })
+}
+
+/// PdfCraft patch (28): `input`, `n` decoded samples a pixel, converted into `output` (RGB) one
+/// pixel at a time. A Separation or DeviceN tint transform may give more or fewer components
+/// than its alternate space takes (a Type 4 program's count is only warned about): converted as
+/// one batch, such a result shifts every pixel after it; converted alone, it affects only its
+/// own. A failed conversion leaves black, as in `get_rgb_data`.
+fn convert_each(cs: &ColorSpace, input: &[f32], n: usize, output: &mut [u8]) {
+    if n == 0 {
+        return;
+    }
+    for (pixel, rgb) in input.chunks_exact(n).zip(output.chunks_exact_mut(3)) {
+        let _ = cs.convert_f32(pixel, rgb, false);
+    }
+}
+
 /// PdfCraft patch: whether an image or mask of `width` × `height` may be decoded (at most
 /// 2^28 pixels, the renderer's `MAX_IMAGE_PIXELS`).
 pub fn image_size_ok(width: u32, height: u32) -> bool {
diff --git a/vendor/hayro-syntax/src/filter/ascii_85.rs b/vendor/hayro-syntax/src/filter/ascii_85.rs
index 5a18cf835..943bfeb74 100644
--- a/vendor/hayro-syntax/src/filter/ascii_85.rs
+++ b/vendor/hayro-syntax/src/filter/ascii_85.rs
@@ -4,7 +4,9 @@ use crate::reader::Reader;
 use crate::trivia::is_white_space_character;
 use alloc::vec::Vec;
 
-pub(crate) fn decode(data: &[u8]) -> Option<Vec<u8>> {
+/// PdfCraft patch: `limit` is the most bytes produced (see `filter::decode_limit`); each `z`
+/// expands one input byte to four.
+pub(crate) fn decode(data: &[u8], limit: usize) -> Option<Vec<u8>> {
     const POW_85: [u32; 5] = [52200625, 614125, 7225, 85, 1];
 
     let mut reader = Reader::new(data);
@@ -50,15 +52,21 @@ pub(crate) fn decode(data: &[u8]) -> Option<Vec<u8>> {
             .checked_add(digits[3].checked_mul(POW_85[3])?)?
             .checked_add(digits[4])?;
 
-        decoded.extend_from_slice(&value.to_be_bytes()[..output_len]);
+        let left = limit.saturating_sub(decoded.len());
+        decoded.extend_from_slice(&value.to_be_bytes()[..output_len.min(left)]);
         group.clear();
         Some(())
     };
 
-    let mut decoded = Vec::with_capacity(data.len() * 4 / 5);
+    let mut decoded = Vec::with_capacity((data.len() / 5 * 4).min(limit));
     let mut group = Vec::with_capacity(5);
 
     loop {
+        // PdfCraft patch: output cut at the limit is reported, never dropped silently.
+        if decoded.len() >= limit {
+            warn!("ASCII85 stream stopped at its decode limit of {limit} bytes");
+            return Some(decoded);
+        }
         let Some(b) = read_byte() else {
             // Be lenient and accept what we have (see PDFBOX-5910).
             flush_group(&mut group, &mut decoded)?;
@@ -76,7 +84,8 @@ pub(crate) fn decode(data: &[u8]) -> Option<Vec<u8>> {
             }
             b'z' => {
                 flush_group(&mut group, &mut decoded)?;
-                decoded.extend_from_slice(&[0, 0, 0, 0]);
+                let left = limit.saturating_sub(decoded.len());
+                decoded.extend(core::iter::repeat_n(0, left.min(4)));
             }
             b'~' => {
                 // Technically requires a '>', but there is a PDF where it isn't
diff --git a/vendor/hayro-syntax/src/filter/ccitt.rs b/vendor/hayro-syntax/src/filter/ccitt.rs
index 98924f2db..687d08714 100644
--- a/vendor/hayro-syntax/src/filter/ccitt.rs
+++ b/vendor/hayro-syntax/src/filter/ccitt.rs
@@ -15,7 +15,12 @@ pub(crate) fn decode(
 ) -> Option<FilterResult<'static>> {
     let k = params.get::<i32>(K).unwrap_or(0);
 
-    let rows = params.get::<u32>(ROWS).unwrap_or(image_params.height);
+    // PdfCraft patch: `/Rows 0` means the height is not predetermined (ISO 32000-2 Table 11, and
+    // the default), not zero rows. Scanners write it on Group 4 pages, which rendered blank.
+    let rows = params
+        .get::<u32>(ROWS)
+        .filter(|&rows| rows != 0)
+        .unwrap_or(image_params.height);
     let end_of_block = params.get::<bool>(END_OF_BLOCK).unwrap_or(true);
 
     let settings = DecodeSettings {
diff --git a/vendor/hayro-syntax/src/filter/mod.rs b/vendor/hayro-syntax/src/filter/mod.rs
index 22bebf6d3..06bda2948 100644
--- a/vendor/hayro-syntax/src/filter/mod.rs
+++ b/vendor/hayro-syntax/src/filter/mod.rs
@@ -95,7 +95,7 @@ impl Filter {
             Self::AsciiHexDecode => ascii_hex::decode(data)
                 .map(FilterResult::from_data)
                 .ok_or(DecodeFailure::StreamDecode),
-            Self::Ascii85Decode => ascii_85::decode(data)
+            Self::Ascii85Decode => ascii_85::decode(data, limit)
                 .map(FilterResult::from_data)
                 .ok_or(DecodeFailure::StreamDecode),
             Self::RunLengthDecode => run_length::decode(data, limit)
diff --git a/vendor/hayro-syntax/src/page.rs b/vendor/hayro-syntax/src/page.rs
index 7d63931a3..d7f0ec953 100644
--- a/vendor/hayro-syntax/src/page.rs
+++ b/vendor/hayro-syntax/src/page.rs
@@ -558,9 +558,17 @@ impl<'a> Page<'a> {
         {
             (A4.width() as f32, A4.height() as f32)
         } else {
+            // PdfCraft patch: retain a one-point floor after UserUnit, not one raw unit.
+            // The stored unit is finite and within 1..=75000. Round upward only if the
+            // reciprocal's f32 product would fall below one and trigger a placeholder.
+            let mut raw_floor = 1.0 / self.user_unit;
+            if raw_floor * self.user_unit < 1.0 {
+                raw_floor = raw_floor.next_up();
+            }
+            let raw_floor = f64::from(raw_floor);
             (
-                crop_box.width().max(1.0) as f32,
-                crop_box.height().max(1.0) as f32,
+                crop_box.width().max(raw_floor) as f32,
+                crop_box.height().max(raw_floor) as f32,
             )
         }
     }
diff --git a/vendor/hayro/src/lib.rs b/vendor/hayro/src/lib.rs
index def102b42..43381ab67 100644
--- a/vendor/hayro/src/lib.rs
+++ b/vendor/hayro/src/lib.rs
@@ -254,6 +254,16 @@ pub fn render_into<'a>(
         interpreter_settings.preview,
     );
 
+    // PdfCraft patch (18): the page renders as one transparency group with the background
+    // painted *inside* it, as the initial backdrop. A group isolates what it wraps from what
+    // was painted before it, so with the background outside, a Multiply highlight blended
+    // only with the group's transparent backdrop and stayed its own colour — over a dark
+    // reading-colours background the whole quad became one flat bar and the words under it
+    // vanished. Inside the group the highlight multiplies with the background too: the words
+    // keep the highlight's colour and the band between them takes the background (white
+    // backgrounds are unaffected — multiplying with white is the identity).
+    device.push_transparency_group(1.0, None, BlendMode::Normal);
+
     device.ctx.set_paint(render_settings.bg_color);
     device
         .ctx
@@ -265,12 +275,10 @@ pub fn render_into<'a>(
         fill: FillRule::NonZero,
     });
 
-    device.push_transparency_group(1.0, None, BlendMode::Normal);
     interpret_page(page, &mut state, &mut device);
 
-    device.pop_transparency_group();
-
     device.pop_clip_path();
+    device.pop_transparency_group();
 
     let mut resources = vello_cpu::Resources::default();
     device.ctx.render_to_buffer(
diff --git a/vendor/hayro/src/renderer.rs b/vendor/hayro/src/renderer.rs
index 23fc2e36c..0619b4c6d 100644
--- a/vendor/hayro/src/renderer.rs
+++ b/vendor/hayro/src/renderer.rs
@@ -432,6 +432,9 @@ pub(crate) struct Renderer {
     /// PdfCraft patch: when set, solid text and line-art paint colours are remapped
     /// while rendering (the "reading colours" view setting).
     color_replacement: Option<ColorReplacement>,
+    /// PdfCraft patch (17): while the page's annotations are being drawn, paints keep their
+    /// colours — reading colours replace document colours, never annotation colours.
+    in_annotations: bool,
     pub(crate) inside_pattern: bool,
     /// Soft masks drawn during this render. PdfCraft note: it belongs to one `Renderer` (one
     /// render, every nested renderer starting empty) and so to one `preview` setting: a mask
@@ -466,6 +469,7 @@ impl Renderer {
         Self {
             ctx: RenderContext::new_with(width, height, settings),
             color_replacement,
+            in_annotations: false,
             inside_pattern: false,
             soft_mask_cache: HashMap::default(),
             outline_cache: cache.outline_cache.clone(),
@@ -573,6 +577,7 @@ impl Renderer {
                 // PdfCraft patch: this renders an image's alpha mask, which must keep its
                 // original values, so it is never remapped by the reading-colours setting.
                 color_replacement: None,
+                in_annotations: false,
                 inside_pattern: false,
                 soft_mask_cache: HashMap::default(),
                 outline_cache: self.outline_cache.clone(),
@@ -1023,6 +1028,11 @@ impl Renderer {
         let Some(replacement) = self.color_replacement else {
             return paint.clone();
         };
+        // PdfCraft patch (17): annotations keep the colours they were given; reading colours
+        // replace document colours only (issue #1548).
+        if self.in_annotations {
+            return paint.clone();
+        }
         match paint {
             Paint::Color(c) => {
                 let mapped = replacement.map(c.to_rgba().to_rgba8(), is_text);
@@ -1075,8 +1085,13 @@ impl Renderer {
                         // become native gradients instead of a texture sampled pixel by pixel.
                         // Upstream also shifts by half a pixel for vello_cpu 0.3; 0.0.8 already
                         // evaluates gradients at pixel centres, like the texture below.
-                        if let Some(native) =
-                            encoded.as_svg_gradient(bbox, NATIVE_GRADIENT_TOLERANCE)
+                        // PdfCraft patch (#2128): vello_cpu 0.0.8 copies an opaque gradient
+                        // over fully covered tiles without applying the mask or blend mode, and
+                        // a gradient can't be flagged transparent like the texture below, so
+                        // under a soft mask or blend mode the shading is sampled instead.
+                        if !self.force_images_may_have_transparency()
+                            && let Some(native) =
+                                encoded.as_svg_gradient(bbox, NATIVE_GRADIENT_TOLERANCE)
                         {
                             self.ctx
                                 .set_paint_transform(path_transform.inverse() * native.transform);
@@ -1149,6 +1164,7 @@ impl Renderer {
                             // PdfCraft patch: a pattern cell is painted as one artwork, so its
                             // content is never remapped by the reading-colours setting.
                             color_replacement: None,
+                            in_annotations: false,
                             cur_mask: None,
                             inside_pattern: true,
                             soft_mask_cache: HashMap::default(),
@@ -1464,6 +1480,7 @@ impl<'a> Device<'a> for Renderer {
                                         // coverage values, so its content is never remapped by
                                         // the reading-colours setting.
                                         color_replacement: None,
+                                        in_annotations: false,
                                         inside_pattern: false,
                                         soft_mask_cache: HashMap::default(),
                                         outline_cache: self.outline_cache.clone(),
@@ -1608,6 +1625,16 @@ impl<'a> Device<'a> for Renderer {
         }
     }
 
+    /// PdfCraft patch (17): the reading-colours mapping is suspended for annotations.
+    fn begin_annotations(&mut self) {
+        self.in_annotations = true;
+    }
+
+    /// PdfCraft patch (17): back to document content; reading colours apply again.
+    fn end_annotations(&mut self) {
+        self.in_annotations = false;
+    }
+
     fn draw_rect(
         &mut self,
         rect: &Rect,
@@ -1749,6 +1776,7 @@ fn draw_soft_mask(mask: &SoftMask<'_>, settings: RenderSettings, width: u16, hei
         // PdfCraft patch: a soft mask must keep its original luminance values, so its
         // content is never remapped by the reading-colours setting.
         color_replacement: None,
+        in_annotations: false,
         inside_pattern: false,
         cur_mask: None,
         soft_mask_cache: HashMap::default(),
diff --git a/vendor/vello_common/CHANGELOG.md b/vendor/vello_common/CHANGELOG.md
new file mode 100644
index 000000000..912b7648a
--- /dev/null
+++ b/vendor/vello_common/CHANGELOG.md
@@ -0,0 +1,246 @@
+<!-- Instructions
+
+This changelog follows the patterns described here: <https://keepachangelog.com/en/>.
+
+Subheadings to categorize changes are `added, changed, deprecated, removed, fixed, security`.
+
+-->
+
+# Changelog
+
+## [Unreleased]
+
+This release has an [MSRV][] of 1.88.
+
+## [0.0.8][] - 2026-05-15
+
+This release has an [MSRV][] of 1.88.
+
+### Added
+
+- `TextureId`, a handle for user-provided textures resolved at render-time, and `EncodedExternalTexture` for encoding draws that sample from them. ([#1552][] by [@tomcur][])
+- `RectU16`, a shared axis-aligned rectangle type for `u16` coordinate bounding boxes. ([#1559][] by [@tomcur][])
+
+### Changed
+
+- `WideTilesBbox` now uses `RectU16` internally, its `bbox` field is private, and `WideTilesBbox::new` now takes four `u16` coordinates instead of a `[u16; 4]`. ([#1559][] by [@tomcur][])
+- Renamed image transparency hint APIs from `may_have_opacities` and `*_opacity_hint` to `may_have_transparency` and `*_transparency_hint`. ([#1613][] by [@upsuper][])
+- Gradient LUTs no longer reserve an extra transparent entry for undefined radial-gradient regions; `EncodedGradient` now tracks whether those regions are possible. ([#1529][] by [@LaurenzV][])
+
+### Removed
+
+- Public `glyph` and `colr` modules and the `text` feature; sparse-strips text rendering now lives in `glifo` and the renderer crates. ([#1562][] by [@LaurenzV][])
+- Support for recordings, including the shared recording API.
+  This decision was made due to a number of downsides that came with the implementation.
+  See the corresponding PR and Zulip thread for more information. ([#1611][] by [@LaurenzV][])
+
+### Fixed
+
+- Handling of zero-area rectangles in the rectangle fast path, avoiding out-of-viewport strips and downstream assertions. ([#1537][] by [@LaurenzV][])
+- Invalid gradients with NaN or out-of-range final stop offsets now fall back to the first color instead of passing validation. ([#1531][] by [@LaurenzV][])
+- Implicit subpaths that continue after `ClosePath` without an explicit `MoveTo`. ([#1544][] by [@tomcur][])
+- Negative-sized rectangles during strip generation. ([#1589][] by [@LaurenzV][])
+
+### Optimized
+
+- Rendering performance for paths with line segments fully or partly left of the viewport by culling invisible left-of-viewport line work while preserving winding contributions. ([#1368][] by [@b0nes164][])
+- Performance of clipped drawing by culling geometry outside the clip bounding box during flattening. ([#1519][] by [@tomcur][])
+- Flattening and tiling performance through codegen improvements in the sparse strip pipeline. ([#1600][], [#1616][], [#1634][] by [@LaurenzV][])
+
+## [0.0.7][] - 2026-03-24
+
+This release has an [MSRV][] of 1.92.
+
+### Added
+
+- Support for image tinting. ([#1460][] by [@grebmeg][])
+- `RenderState` abstraction. ([#1486][] by [@LaurenzV][])
+- Helpers for rendering filters. ([#1446][] by [@LaurenzV][])
+- `ImageCache` and `MultiAtlasManager`. ([#1457][] by [@grebmeg][])
+
+### Changed
+
+- Replaced custom blend mode representation with peniko `Mix` for filter effects. ([#1410][] by [@LaurenzV][])
+
+### Removed
+
+- Process Row Incremental Macro and Perfect Bit. ([#1384][] by [@b0nes164][])
+- `tolerance` parameter from the flattening method. ([#1399][] by [@LaurenzV][])
+- Command annotation logic. ([#1438][] by [@LaurenzV][])
+
+### Fixed
+
+- Double-scaling of non-hinted COLR glyphs. ([#1370][] by [@conor-93][])
+- Handling of `pop_clip` commands and properly resetting wide tiles. ([#1443][] by [@LaurenzV][], [#1447][] by [@tomcur][])
+- Layer ranges not being updated when a wide tile is reset with a background color. ([#1478][] by [@LaurenzV][])
+
+### Optimized
+
+- Bézier flattening performance by catching more Béziers whose chords are immediately within rendering tolerance. ([#1216][] by [@tomcur][])
+- Flattening and tiling performance by culling out-of-viewport Béziers before flattening. ([#1341][] by [@tomcur][])
+- Rendering performance of scenes including blend layers by ensuring no commands are generated for wide tiles without layer content. ([#1403][] by [@tomcur][])
+- Scenes including blend layers by only allocating layer scratch buffers for a wide tile upon draw commands being performed in that wide tile. ([#1414][] by [@tomcur][])
+- Analytic anti-aliasing. ([#1426][], [#1442][] by [@tomcur][])
+- Filter application to layers. ([#1444][] by [@LaurenzV][])
+- Rendering pixel-aligned rectangles. ([#1453][] by [@grebmeg][])
+- Coarse rasterization and scheduling of scenes without layers. ([#1454][] by [@LaurenzV][])
+- Resetting wide tiles. ([#1484][] by [@LaurenzV][])
+
+## [0.0.6][] - 2026-01-15
+
+This release has an [MSRV][] of 1.88.
+
+### Changed
+
+- Breaking change: Updated Peniko to [v0.6.0](https://github.com/linebender/peniko/releases/tag/v0.6.0). ([#1349][] by [@DJMcNab][])
+  - This also updates Kurbo to [v0.13.0](https://github.com/linebender/kurbo/releases/tag/v0.13.0).
+- Upgraded Skrifa to v0.40.0. ([#1353][] by [@waywardmonkeys][])
+- Upgraded Hashbrown to v0.16.1. ([#1354][] by [@waywardmonkeys][])
+
+### Optimized
+
+- Alpha blending for fully opaque image fills. ([#1329][] by [@grebmeg][])
+
+See also the [vello_hybrid 0.0.6](../vello_hybrid/CHANGELOG.md#006---2026-01-15) and [vello_cpu 0.0.6](../vello_cpu/CHANGELOG.md#006---2026-01-15) releases.
+
+## [0.0.5][] - 2026-01-08
+
+This release has an [MSRV][] of 1.88.
+
+### Added
+
+- A new module `clip` allowing for the possibility to intersect two strips to create a new strip representing their intersection. ([#1203][] by [@LaurenzV])
+- An `extend` method to `StripStorage` to extend its alphas/strips from another `StripStorage`. ([#1203][] by [@LaurenzV])
+- A new trait for approximate integer division by 255. ([#1203][] by [@LaurenzV])
+- A `from_parts` method for masks. ([#1237][] by [@LaurenzV])
+- Initial support for image filters. ([#1286][] by [@grebmeg])
+
+### Changed
+
+- `WideTile::generate` now takes an additional `BlendMode` as a parameter. ([#1159][] by [@LaurenzV])
+- `CmdFill` and `CmdAlphaFill` now store a `BlendMode` instead of `Option<BlendMode>`. ([#1159][] by [@LaurenzV])
+- `Strip` now implements `PartialEq` and `Eq`. ([#1203][] by [@LaurenzV])
+- `Strip` now has a `is_sentinel` method. ([#1203][] by [@LaurenzV])
+- `StripStorage` now implements `PartialEq` and `Eq`. ([#1203][] by [@LaurenzV])
+- The `generate_filled_path` method of `StripGenerator` now takes an optional clip path as input. ([#1203][] by [@LaurenzV])
+- The `generate` method of `Wide` now takes an optional mask as an additional argument. ([#1237][] by [@LaurenzV])
+- `CmdFill` and `CmdAlphaFill` now store an optional mask. ([#1237][] by [@LaurenzV])
+- Various changes to the logic for computing tile intersections and representation of tiles. ([#1293][], [#1317][], [#1318][] by [@b0nes164])
+- Support for computing data necessary to implement multi-sampled anti-aliasing. ([#1319][], by [@b0nes164])
+
+### Optimized
+
+- Gradient rendering. ([#1301][] by [@valadaptive])
+- Numerous performance and memory-efficiency improvements. ([#1325][] by [@LaurenzV], [#1327][] by [@grebmeg], [#1336][] by [@tomcur], [#1338][] by [@taj-p])
+
+See also the [vello_hybrid 0.0.5](../vello_hybrid/CHANGELOG.md#005---2026-01-08) and [vello_cpu 0.0.5](../vello_cpu/CHANGELOG.md#005---2026-01-08) releases.
+
+## [0.0.4][] - 2025-10-17
+
+This release has an [MSRV][] of 1.86.
+
+No changelog was kept for this release.
+
+See also the [vello_hybrid 0.0.4](../vello_hybrid/CHANGELOG.md#004---2025-10-17) and [vello_cpu 0.0.4](../vello_cpu/CHANGELOG.md#004---2025-10-17) releases.
+
+## [0.0.3][] - 2025-10-04
+
+This release has an [MSRV][] of 1.86.
+
+No changelog was kept for this release.
+
+See also the [vello_cpu 0.0.3](../vello_cpu/CHANGELOG.md#003---2025-10-04) release.
+
+## [0.0.2][] - 2025-09-22
+
+This release has an [MSRV][] of 1.85.
+
+No changelog was kept for this release.
+
+See also the [vello_cpu 0.0.2](../vello_cpu/CHANGELOG.md#002---2025-09-22) release.
+
+## [0.0.1][] - 2025-05-10
+
+This release has an [MSRV][] of 1.85.
+
+This is the initial release. No changelog was kept for this release.
+
+See also the [vello_cpu 0.0.1](../vello_cpu/CHANGELOG.md#001---2025-05-10) release.
+
+[@b0nes164]: https://github.com/b0nes164
+[@conor-93]: https://github.com/conor-93
+[@DJMcNab]: https://github.com/waywardmonkeys
+[@grebmeg]: https://github.com/grebmeg
+[@LaurenzV]: https://github.com/LaurenzV
+[@taj-p]: https://github.com/taj-p
+[@tomcur]: https://github.com/tomcur
+[@upsuper]: https://github.com/upsuper
+[@valadaptive]: https://github.com/valadaptive
+[@waywardmonkeys]: https://github.com/waywardmonkeys
+
+[#1159]: https://github.com/linebender/vello/pull/1159
+[#1203]: https://github.com/linebender/vello/pull/1203
+[#1216]: https://github.com/linebender/vello/pull/1216
+[#1237]: https://github.com/linebender/vello/pull/1237
+[#1286]: https://github.com/linebender/vello/pull/1286
+[#1293]: https://github.com/linebender/vello/pull/1293
+[#1301]: https://github.com/linebender/vello/pull/1301
+[#1317]: https://github.com/linebender/vello/pull/1317
+[#1318]: https://github.com/linebender/vello/pull/1318
+[#1319]: https://github.com/linebender/vello/pull/1319
+[#1325]: https://github.com/linebender/vello/pull/1325
+[#1327]: https://github.com/linebender/vello/pull/1327
+[#1329]: https://github.com/linebender/vello/pull/1329
+[#1336]: https://github.com/linebender/vello/pull/1327
+[#1338]: https://github.com/linebender/vello/pull/1327
+[#1341]: https://github.com/linebender/vello/pull/1341
+[#1349]: https://github.com/linebender/vello/pull/1349
+[#1353]: https://github.com/linebender/vello/pull/1353
+[#1354]: https://github.com/linebender/vello/pull/1354
+[#1368]: https://github.com/linebender/vello/pull/1368
+[#1399]: https://github.com/linebender/vello/pull/1399
+[#1403]: https://github.com/linebender/vello/pull/1403
+[#1414]: https://github.com/linebender/vello/pull/1414
+[#1370]: https://github.com/linebender/vello/pull/1370
+[#1384]: https://github.com/linebender/vello/pull/1384
+[#1410]: https://github.com/linebender/vello/pull/1410
+[#1426]: https://github.com/linebender/vello/pull/1426
+[#1438]: https://github.com/linebender/vello/pull/1438
+[#1442]: https://github.com/linebender/vello/pull/1442
+[#1443]: https://github.com/linebender/vello/pull/1443
+[#1444]: https://github.com/linebender/vello/pull/1444
+[#1446]: https://github.com/linebender/vello/pull/1446
+[#1447]: https://github.com/linebender/vello/pull/1447
+[#1453]: https://github.com/linebender/vello/pull/1453
+[#1454]: https://github.com/linebender/vello/pull/1454
+[#1457]: https://github.com/linebender/vello/pull/1457
+[#1460]: https://github.com/linebender/vello/pull/1460
+[#1478]: https://github.com/linebender/vello/pull/1478
+[#1484]: https://github.com/linebender/vello/pull/1484
+[#1486]: https://github.com/linebender/vello/pull/1486
+[#1519]: https://github.com/linebender/vello/pull/1519
+[#1529]: https://github.com/linebender/vello/pull/1529
+[#1531]: https://github.com/linebender/vello/pull/1531
+[#1537]: https://github.com/linebender/vello/pull/1537
+[#1544]: https://github.com/linebender/vello/pull/1544
+[#1552]: https://github.com/linebender/vello/pull/1552
+[#1559]: https://github.com/linebender/vello/pull/1559
+[#1562]: https://github.com/linebender/vello/pull/1562
+[#1589]: https://github.com/linebender/vello/pull/1589
+[#1600]: https://github.com/linebender/vello/pull/1600
+[#1611]: https://github.com/linebender/vello/pull/1611
+[#1613]: https://github.com/linebender/vello/pull/1613
+[#1616]: https://github.com/linebender/vello/pull/1616
+[#1634]: https://github.com/linebender/vello/pull/1634
+
+[Unreleased]: https://github.com/linebender/vello/compare/sparse-strips-v0.0.8...HEAD
+[0.0.8]: https://github.com/linebender/vello/compare/sparse-strips-v0.0.7...sparse-strips-v0.0.8
+[0.0.7]: https://github.com/linebender/vello/compare/sparse-strips-v0.0.6...sparse-strips-v0.0.7
+[0.0.6]: https://github.com/linebender/vello/compare/sparse-strips-v0.0.5...sparse-strips-v0.0.6
+[0.0.5]: https://github.com/linebender/vello/compare/sparse-stips-v0.0.4...sparse-strips-v0.0.5
+[0.0.4]: https://github.com/linebender/vello/compare/sparse-stips-v0.0.3...sparse-strips-v0.0.4
+[0.0.3]: https://github.com/linebender/vello/compare/sparse-stips-v0.0.2...sparse-strips-v0.0.3
+[0.0.2]: https://github.com/linebender/vello/compare/sparse-strips-v0.0.1...sparse-stips-v0.0.2
+[0.0.1]: https://github.com/linebender/vello/compare/ca6b1e4c7f5b0d95953c3b524f5d3952d5669c5a...sparse-strips-v0.0.1
+
+[MSRV]: README.md#minimum-supported-rust-version-msrv
diff --git a/vendor/vello_common/Cargo.lock b/vendor/vello_common/Cargo.lock
new file mode 100644
index 000000000..72d0743ff
--- /dev/null
+++ b/vendor/vello_common/Cargo.lock
@@ -0,0 +1,310 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "adler2"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
+
+[[package]]
+name = "arrayvec"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c02d123df017efcdfbd739ef81735b36c5ba83ec3c59c80a9d7ecc718f92e50"
+
+[[package]]
+name = "autocfg"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
+
+[[package]]
+name = "bitflags"
+version = "2.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3"
+
+[[package]]
+name = "bytemuck"
+version = "1.25.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8efb64bd706a16a1bdde310ae86b351e4d21550d98d056f22f8a7f7a2183fec"
+dependencies = [
+ "bytemuck_derive",
+]
+
+[[package]]
+name = "bytemuck_derive"
+version = "1.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9abbd1bc6865053c427f7198e6af43bfdedc55ab791faed4fbd361d789575ff"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "color"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ec7c5eb7a16992b1904d76c517d170ab353b0e0b3d5a0c81a8a0cd1037893cf"
+dependencies = [
+ "bytemuck",
+ "libm",
+]
+
+[[package]]
+name = "crc32fast"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "euclid"
+version = "0.22.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1a05365e3b1c6d1650318537c7460c6923f1abdd272ad6842baa2b509957a06"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "fdeflate"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e6853b52649d4ac5c0bd02320cddc5ba956bdb407c4b75a2c6b75bf51500f8c"
+dependencies = [
+ "simd-adler32",
+]
+
+[[package]]
+name = "fearless_simd"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76258897e51fd156ee03b6246ea53f3e0eb395d0b327e9961c4fc4c8b2fa151a"
+dependencies = [
+ "libm",
+]
+
+[[package]]
+name = "flate2"
+version = "1.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide",
+]
+
+[[package]]
+name = "foldhash"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
+
+[[package]]
+name = "guillotiere"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b17e70c989c36bad147b27a58d148c0741c51448aa5653436547323e524d0ab"
+dependencies = [
+ "euclid",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+dependencies = [
+ "foldhash",
+]
+
+[[package]]
+name = "kurbo"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b60dfc32f652b926df6192e55525b16d186c69d47876c3ead4da5cc9f8450e2"
+dependencies = [
+ "arrayvec",
+ "euclid",
+ "libm",
+ "polycool",
+ "smallvec",
+]
+
+[[package]]
+name = "libm"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
+
+[[package]]
+name = "linebender_resource_handle"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4a5ff6bcca6c4867b1c4fd4ef63e4db7436ef363e0ad7531d1558856bae64f4"
+
+[[package]]
+name = "log"
+version = "0.4.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
+
+[[package]]
+name = "miniz_oxide"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
+dependencies = [
+ "adler2",
+ "simd-adler32",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+ "libm",
+]
+
+[[package]]
+name = "peniko"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "839c8299360d2e998bdb106dc0a6cd71dcc5f4df51df1b620361bf50e283cca6"
+dependencies = [
+ "bytemuck",
+ "color",
+ "kurbo",
+ "linebender_resource_handle",
+ "smallvec",
+]
+
+[[package]]
+name = "png"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "60769b8b31b2a9f263dae2776c37b1b28ae246943cf719eb6946a1db05128a61"
+dependencies = [
+ "bitflags",
+ "crc32fast",
+ "fdeflate",
+ "flate2",
+ "miniz_oxide",
+]
+
+[[package]]
+name = "polycool"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50596ddc09eb5ad5f75cacd40209568e66df71baf86e1499a0e99c4cff12a5a6"
+dependencies = [
+ "arrayvec",
+ "libm",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "roxmltree"
+version = "0.20.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c20b6793b5c2fa6553b250154b78d6d0db37e72700ae35fad9387a46f487c97"
+
+[[package]]
+name = "simd-adler32"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "703d5c7ef118737c72f1af64ad2f6f8c5e1921f818cdcb97b8fe6fc69bf66214"
+
+[[package]]
+name = "smallvec"
+version = "1.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
+
+[[package]]
+name = "syn"
+version = "2.0.117"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "vello_common"
+version = "0.0.8"
+dependencies = [
+ "bytemuck",
+ "fearless_simd",
+ "guillotiere",
+ "hashbrown",
+ "libm",
+ "log",
+ "peniko",
+ "png",
+ "roxmltree",
+ "smallvec",
+ "thiserror",
+]
diff --git a/vendor/vello_common/Cargo.toml b/vendor/vello_common/Cargo.toml
new file mode 100644
index 000000000..988ffb939
--- /dev/null
+++ b/vendor/vello_common/Cargo.toml
@@ -0,0 +1,158 @@
+# THIS FILE IS AUTOMATICALLY GENERATED BY CARGO
+#
+# When uploading crates to the registry Cargo will automatically
+# "normalize" Cargo.toml files for maximal compatibility
+# with all versions of Cargo and also rewrite `path` dependencies
+# to registry (e.g., crates.io) dependencies.
+#
+# If you are reading this file be aware that the original Cargo.toml
+# will likely look very different (and much more reasonable).
+# See Cargo.toml.orig for the original contents.
+
+[package]
+edition = "2024"
+rust-version = "1.88"
+name = "vello_common"
+version = "0.0.8"
+build = false
+autolib = false
+autobins = false
+autoexamples = false
+autotests = false
+autobenches = false
+description = "Core data structures and utilities shared across the Vello rendering, including geometry processing and tiling logic."
+readme = "README.md"
+keywords = [
+    "2d",
+    "vector-graphics",
+]
+categories = [
+    "rendering",
+    "graphics",
+]
+license = "Apache-2.0 OR MIT"
+repository = "https://github.com/linebender/vello"
+resolver = "2"
+
+[package.metadata.docs.rs]
+all-features = true
+default-target = "x86_64-unknown-linux-gnu"
+targets = []
+
+[features]
+default = [
+    "std",
+    "png",
+]
+libm = [
+    "peniko/libm",
+    "dep:libm",
+    "fearless_simd/libm",
+]
+multithreading = ["std"]
+pico_svg = ["dep:roxmltree"]
+png = [
+    "std",
+    "dep:png",
+]
+probe = []
+std = [
+    "peniko/std",
+    "fearless_simd/std",
+]
+
+[lib]
+name = "vello_common"
+path = "src/lib.rs"
+
+[dependencies.bytemuck]
+version = "1.25.0"
+features = [
+    "derive",
+    "derive",
+]
+
+[dependencies.fearless_simd]
+version = "0.4.0"
+default-features = false
+
+[dependencies.guillotiere]
+version = "0.7.0"
+default-features = false
+
+[dependencies.hashbrown]
+version = "0.17.1"
+features = [
+    "default-hasher",
+    "raw-entry",
+]
+default-features = false
+
+[dependencies.libm]
+version = "0.2.16"
+optional = true
+
+[dependencies.log]
+version = "0.4.29"
+
+[dependencies.peniko]
+version = "0.6.1"
+features = ["bytemuck"]
+default-features = false
+
+[dependencies.png]
+version = "0.18.1"
+optional = true
+
+[dependencies.roxmltree]
+version = "0.20.0"
+optional = true
+
+[dependencies.smallvec]
+version = "1.15.1"
+
+[dependencies.thiserror]
+version = "2.0.18"
+default-features = false
+
+[lints.clippy]
+allow_attributes_without_reason = "warn"
+cargo_common_metadata = "warn"
+cast_possible_truncation = "warn"
+collection_is_never_read = "warn"
+dbg_macro = "warn"
+debug_assert_with_mut_call = "warn"
+default_trait_access = "warn"
+doc_markdown = "warn"
+fn_to_numeric_cast_any = "warn"
+infinite_loop = "warn"
+large_stack_arrays = "warn"
+mismatching_type_param_order = "warn"
+missing_assert_message = "warn"
+missing_fields_in_debug = "warn"
+negative_feature_names = "warn"
+redundant_feature_names = "warn"
+same_functions_in_if_condition = "warn"
+semicolon_if_nothing_returned = "warn"
+should_panic_without_expect = "warn"
+todo = "warn"
+too_many_arguments = "allow"
+unseparated_literal_suffix = "warn"
+use_self = "warn"
+wildcard_dependencies = "warn"
+
+[lints.rust]
+elided_lifetimes_in_paths = "warn"
+keyword_idents_2024 = "forbid"
+missing_debug_implementations = "warn"
+missing_docs = "warn"
+non_ascii_idents = "forbid"
+non_local_definitions = "forbid"
+trivial_numeric_casts = "warn"
+unnameable_types = "warn"
+unreachable_pub = "warn"
+unsafe_op_in_unsafe_fn = "forbid"
+unused_import_braces = "warn"
+unused_lifetimes = "warn"
+unused_macro_rules = "warn"
+unused_qualifications = "warn"
diff --git a/vendor/vello_common/Cargo.toml.orig b/vendor/vello_common/Cargo.toml.orig
new file mode 100644
index 000000000..fa356c16d
--- /dev/null
+++ b/vendor/vello_common/Cargo.toml.orig
@@ -0,0 +1,53 @@
+[package]
+name = "vello_common"
+# When updating, also update the version in the workspace dependency in the root Cargo.toml
+version = "0.0.8"
+description = "Core data structures and utilities shared across the Vello rendering, including geometry processing and tiling logic."
+categories = ["rendering", "graphics"]
+keywords = ["2d", "vector-graphics"]
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+repository.workspace = true
+
+[package.metadata.docs.rs]
+all-features = true
+# There are no platform specific docs.
+default-target = "x86_64-unknown-linux-gnu"
+targets = []
+
+[dependencies]
+bytemuck = { workspace = true, features = ["derive"] }
+peniko = { workspace = true, features = ["bytemuck"] }
+fearless_simd = { workspace = true }
+hashbrown = { workspace = true, features = ["raw-entry"] }
+png = { workspace = true, optional = true }
+roxmltree = { version = "0.20.0", optional = true }
+smallvec = { workspace = true }
+thiserror = { workspace = true, default-features = false }
+guillotiere = { workspace = true }
+libm = { version = "0.2.16", optional = true }
+log = { workspace = true }
+
+[features]
+# If adding new features, also document in `src/lib.rs`
+default = ["std", "png"]
+# Get floating point functions from the standard library (likely using your target's libc).
+std = ["peniko/std", "fearless_simd/std"]
+# Use floating point implementations from libm.
+libm = ["peniko/libm", "dep:libm", "fearless_simd/libm"]
+# Allow loading Pixmap from PNG, and drawing png glyphs.
+png = ["std", "dep:png"]
+# Add helpers for drawing a probe scene.
+probe = []
+# Enable multi-threaded rendering.
+multithreading = ["std"]
+# Development only features
+
+# Enable a simple version of SVG drawing.
+# This is only intended for development of Vello CPU itself,
+# and is likely to be removed/moved.
+pico_svg = ["dep:roxmltree"]
+
+[lints]
+workspace = true
diff --git a/vendor/vello_common/LICENSE-APACHE b/vendor/vello_common/LICENSE-APACHE
new file mode 100644
index 000000000..d9a10c0d8
--- /dev/null
+++ b/vendor/vello_common/LICENSE-APACHE
@@ -0,0 +1,176 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
diff --git a/vendor/vello_common/LICENSE-MIT b/vendor/vello_common/LICENSE-MIT
new file mode 100644
index 000000000..48ff8e414
--- /dev/null
+++ b/vendor/vello_common/LICENSE-MIT
@@ -0,0 +1,25 @@
+Copyright 2020 the Vello Authors
+
+Permission is hereby granted, free of charge, to any
+person obtaining a copy of this software and associated
+documentation files (the "Software"), to deal in the
+Software without restriction, including without
+limitation the rights to use, copy, modify, merge,
+publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software
+is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice
+shall be included in all copies or substantial portions
+of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
+SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
+IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.
diff --git a/vendor/vello_common/README.md b/vendor/vello_common/README.md
new file mode 100644
index 000000000..27fa3f770
--- /dev/null
+++ b/vendor/vello_common/README.md
@@ -0,0 +1,100 @@
+<div align="center">
+
+# Vello Common
+
+**Shared data structures**
+
+[![Latest published version.](https://img.shields.io/crates/v/vello_common.svg)](https://crates.io/crates/vello_common)
+[![Documentation build status.](https://img.shields.io/docsrs/vello_common.svg)](https://docs.rs/vello_common)
+[![Apache 2.0 or MIT license.](https://img.shields.io/badge/license-Apache--2.0_OR_MIT-blue.svg)](#license)
+\
+[![Linebender Zulip chat.](https://img.shields.io/badge/Linebender-%23vello-blue?logo=Zulip)](https://xi.zulipchat.com/#narrow/channel/197075-vello)
+[![GitHub Actions CI status.](https://img.shields.io/github/actions/workflow/status/linebender/vello/ci.yml?logo=github&label=CI)](https://github.com/linebender/vello/actions)
+[![Dependency staleness status.](https://deps.rs/crate/vello_common/latest/status.svg)](https://deps.rs/crate/vello_common)
+
+</div>
+
+<!-- We use cargo-rdme to update the README with the contents of lib.rs.
+To edit the following section, update it in lib.rs, then run:
+cargo rdme --workspace-project=vello_common
+Full documentation at https://github.com/orium/cargo-rdme -->
+
+<!-- Intra-doc links used in lib.rs should be evaluated here.
+See https://linebender.org/blog/doc-include/ for related discussion. -->
+
+[libm]: https://crates.io/crates/libm
+[crate::pixmap::Pixmap]: https://docs.rs/vello_common/latest/vello_common/pixmap/struct.Pixmap.html
+<!-- cargo-rdme start -->
+
+This crate includes common geometry representations, tiling logic, and other fundamental components used by both [Vello CPU][vello_cpu] and Vello Hybrid.
+
+## Usage
+
+This crate should not be used on its own, and you should instead use one of the renderers which use it.
+At the moment, only [Vello CPU][vello_cpu] is published, and you probably want to use that.
+
+We also develop [Vello](https://crates.io/crates/vello), which makes use of the GPU for 2D rendering and has higher performance than Vello CPU.
+Vello CPU is being developed as part of work to address shortcomings in Vello.
+Vello does not use this crate.
+
+## Features
+
+- `std` (enabled by default): Get floating point functions from the standard library
+  (likely using your target's libc).
+- `libm`: Use floating point implementations from [libm][].
+- `png` (enabled by default): Allow loading [`Pixmap`][crate::pixmap::Pixmap]s from PNG images.
+  Also required for rendering glyphs with an embedded PNG.
+  Implies `std`.
+
+At least one of `std` and `libm` is required; `std` overrides `libm`.
+
+## Contents
+
+- Shared data structures for paths, tiles, and strips
+- Geometry processing utilities
+- Common logic for rendering stages
+
+This crate acts as a foundation for `vello_cpu` and `vello_hybrid`, providing essential components to minimize duplication.
+
+[vello_cpu]: https://crates.io/crates/vello_cpu
+
+<!-- cargo-rdme end -->
+
+## Minimum supported Rust Version (MSRV)
+
+This version of Vello Common has been verified to compile with **Rust 1.92** and later.
+
+Future versions of Vello Common might increase the Rust version requirement.
+It will not be treated as a breaking change and as such can even happen with small patch releases.
+
+<details>
+<summary>Click here if compiling fails.</summary>
+
+As time has passed, some of Vello Common's dependencies could have released versions with a higher Rust requirement.
+If you encounter a compilation issue due to a dependency and don't want to upgrade your Rust toolchain, then you could downgrade the dependency.
+
+```sh
+# Use the problematic dependency's name and version
+cargo update -p package_name --precise 0.1.1
+```
+
+</details>
+
+## Community
+
+Discussion of Vello Common development happens in the [Linebender Zulip](https://xi.zulipchat.com/), specifically the [#vello channel](https://xi.zulipchat.com/#narrow/channel/197075-vello).
+All public content can be read without logging in.
+
+Contributions are welcome by pull request.
+The [Rust code of conduct] applies.
+
+## License
+
+Licensed under either of
+
+- Apache License, Version 2.0 ([LICENSE-APACHE](LICENSE-APACHE) or <http://www.apache.org/licenses/LICENSE-2.0>)
+- MIT license ([LICENSE-MIT](LICENSE-MIT) or <http://opensource.org/licenses/MIT>)
+
+at your option.
+
+[Rust code of conduct]: https://www.rust-lang.org/policies/code-of-conduct
diff --git a/vendor/vello_common/assets/README.md b/vendor/vello_common/assets/README.md
new file mode 100644
index 000000000..f7fc3bace
--- /dev/null
+++ b/vendor/vello_common/assets/README.md
@@ -0,0 +1,2 @@
+In order to regenerate `probe.png` and `probe.rgba`, please run
+`cargo run --bin regenerate_probe_reference` inside of `vello_sparse_tests`.
diff --git a/vendor/vello_common/assets/probe.png b/vendor/vello_common/assets/probe.png
new file mode 100644
index 000000000..8464880a0
Binary files /dev/null and b/vendor/vello_common/assets/probe.png differ
diff --git a/vendor/vello_common/assets/probe.rgba b/vendor/vello_common/assets/probe.rgba
new file mode 100644
index 000000000..35238209a
Binary files /dev/null and b/vendor/vello_common/assets/probe.rgba differ
diff --git a/vendor/vello_common/src/blurred_rounded_rect.rs b/vendor/vello_common/src/blurred_rounded_rect.rs
new file mode 100644
index 000000000..13f62e33f
--- /dev/null
+++ b/vendor/vello_common/src/blurred_rounded_rect.rs
@@ -0,0 +1,19 @@
+// Copyright 2025 the Vello Authors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+//! Blurred, rounded rectangles.
+use crate::color::{AlphaColor, Srgb};
+use crate::kurbo::Rect;
+
+/// A blurred, rounded rectangle.
+#[derive(Debug)]
+pub struct BlurredRoundedRectangle {
+    /// The base rectangle to use for the blur effect.
+    pub rect: Rect,
+    /// The color of the blurred rectangle.
+    pub color: AlphaColor<Srgb>,
+    /// The radius of the rounded rectangle's corners.
+    pub radius: f32,
+    /// The standard deviation of the blur effect.
+    pub std_dev: f32,
+}
diff --git a/vendor/vello_common/src/clip.rs b/vendor/vello_common/src/clip.rs
new file mode 100644
index 000000000..c50a0ff9d
--- /dev/null
+++ b/vendor/vello_common/src/clip.rs
@@ -0,0 +1,996 @@
+// Copyright 2025 the Vello Authors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+//! Managing clipping state.
+
+use crate::geometry::RectU16;
+use crate::kurbo::{Affine, BezPath, PathEl, Rect};
+use crate::strip::Strip;
+use crate::strip_generator::{GenerationMode, StripGenerator, StripStorage};
+use crate::tile::Tile;
+use crate::util::normalized_mul_u8x16;
+use alloc::vec;
+use alloc::vec::Vec;
+use fearless_simd::{Level, Simd, SimdBase, dispatch, u8x16};
+use peniko::Fill;
+
+#[cfg(not(feature = "std"))]
+use peniko::kurbo::common::FloatFuncs as _;
+
+#[derive(Debug)]
+struct ClipData {
+    alpha_start: u32,
+    strip_start: u32,
+
+    /// A coarse bounding box of the clip path in pixel coordinates.
+    ///
+    /// These bounds have already been intersected with the viewport.
+    bbox: RectU16,
+}
+
+impl ClipData {
+    fn to_path_data_ref<'a>(&self, storage: &'a StripStorage) -> PathDataRef<'a> {
+        PathDataRef {
+            strips: storage
+                .strips
+                .get(self.strip_start as usize..)
+                .unwrap_or(&[]),
+            alphas: storage
+                .alphas
+                .get(self.alpha_start as usize..)
+                .unwrap_or(&[]),
+            bbox: self.bbox,
+        }
+    }
+}
+
+/// A context for managing clip stacks.
+#[derive(Debug)]
+pub struct ClipContext {
+    storage: StripStorage,
+    temp_storage: StripStorage,
+    clip_stack: Vec<ClipData>,
+}
+
+impl Default for ClipContext {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl ClipContext {
+    /// Create a new clip context.
+    #[inline]
+    pub fn new() -> Self {
+        let mut main_storage = StripStorage::default();
+        main_storage.set_generation_mode(GenerationMode::Append);
+        Self {
+            storage: main_storage,
+            temp_storage: StripStorage::default(),
+            clip_stack: vec![],
+        }
+    }
+
+    /// Reset the clip context.
+    #[inline]
+    pub fn reset(&mut self) {
+        self.clip_stack.clear();
+        self.storage.clear();
+        self.temp_storage.clear();
+    }
+
+    /// Get the data of the current clip path.
+    #[inline]
+    pub fn get(&self) -> Option<PathDataRef<'_>> {
+        self.clip_stack
+            .last()
+            .map(|c| c.to_path_data_ref(&self.storage))
+    }
+
+    /// Push a new clip path to the stack.
+    #[inline]
+    pub fn push_clip(
+        &mut self,
+        clip_path: &BezPath,
+        strip_generator: &mut StripGenerator,
+        fill_rule: Fill,
+        transform: Affine,
+        aliasing_threshold: Option<u8>,
+    ) {
+        self.temp_storage.clear();
+
+        let alpha_start = self.storage.alphas.len() as u32;
+        let strip_start = self.storage.strips.len() as u32;
+
+        // Calculate a coarse bounding box of the path. If the path is empty, the bounding box is
+        // an infinite and inversed `kurbo::Rect`. This is harmless in practice: an empty path does
+        // not produce any strips.
+        //
+        // Note this iterates `clip_path`, which means we iterate it twice: once here, and once in
+        // flattening. If we ever take an iterator instead, or want to prevent iterating twice, we
+        // could move this calculation into flattening (perhaps with a const-generic as to not
+        // pessimize calls that don't require the bbox).
+        let path_bbox = control_point_bbox(clip_path, transform);
+        let mut bbox = RectU16::new(
+            path_bbox.x0 as u16,
+            path_bbox.y0 as u16,
+            path_bbox.x1.ceil() as u16,
+            path_bbox.y1.ceil() as u16,
+        );
+
+        // Intersect with the existing clip bounding box, or the viewport if this is the outermost
+        // clip.
+        if let Some(existing) = self.clip_stack.last() {
+            bbox = bbox.intersect(existing.bbox);
+        } else {
+            bbox.x1 = bbox.x1.min(strip_generator.width());
+            bbox.y1 = bbox.y1.min(strip_generator.height());
+        }
+
+        let clip_data = ClipData {
+            alpha_start,
+            strip_start,
+            bbox,
+        };
+
+        let existing_clip = self
+            .clip_stack
+            .last()
+            .map(|c| c.to_path_data_ref(&self.storage));
+
+        strip_generator.generate_filled_path(
+            clip_path,
+            fill_rule,
+            transform,
+            aliasing_threshold,
+            &mut self.temp_storage,
+            existing_clip,
+        );
+
+        self.storage.extend(&self.temp_storage);
+        self.clip_stack.push(clip_data);
+    }
+
+    /// Pop the least recent clip path.
+    #[inline]
+    pub fn pop_clip(&mut self) {
+        let data = self.clip_stack.pop().expect("clip stack underflowed");
+        self.storage.strips.truncate(data.strip_start as usize);
+        self.storage.alphas.truncate(data.alpha_start as usize);
+    }
+}
+
+/// Compute a conservative bounding box for the transformed path by computing the bounding box of
+/// the transformed control points.
+///
+/// If `path` is empty, this returns an infinite, inversed [`Rect`] (`left` > `right` and `top` > `bottom`).
+fn control_point_bbox(path: &BezPath, transform: Affine) -> Rect {
+    // Start with an infinite, inversed rectangle. Adding the first point immediately collapses it
+    // without branching.
+    let mut bbox = Rect::new(
+        f64::INFINITY,
+        f64::INFINITY,
+        f64::NEG_INFINITY,
+        f64::NEG_INFINITY,
+    );
+    for el in path.iter() {
+        match el {
+            PathEl::MoveTo(p) | PathEl::LineTo(p) => {
+                bbox = bbox.union_pt(transform * p);
+            }
+            PathEl::QuadTo(p1, p2) => {
+                bbox = bbox.union_pt(transform * p1);
+                bbox = bbox.union_pt(transform * p2);
+            }
+            PathEl::CurveTo(p1, p2, p3) => {
+                bbox = bbox.union_pt(transform * p1);
+                bbox = bbox.union_pt(transform * p2);
+                bbox = bbox.union_pt(transform * p3);
+            }
+            PathEl::ClosePath => {}
+        }
+    }
+    bbox
+}
+
+/// Borrowed data of a stripped path.
+#[derive(Clone, Copy, Debug)]
+pub struct PathDataRef<'a> {
+    /// The strips.
+    pub strips: &'a [Strip],
+    /// The alpha buffer.
+    pub alphas: &'a [u8],
+
+    /// A coarse bounding box of the clip path in pixel coordinates.
+    ///
+    /// These bounds have already been intersected with the viewport.
+    pub bbox: RectU16,
+}
+
+/// Compute the sparse strips representation of a path that results
+/// from intersecting the two input paths. This can be used to implement
+/// clip paths.
+pub fn intersect(
+    level: Level,
+    path_1: PathDataRef<'_>,
+    path_2: PathDataRef<'_>,
+    target: &mut StripStorage,
+) {
+    dispatch!(level, simd => intersect_impl(simd, path_1, path_2, target));
+}
+
+// PdfCraft patch: rows walked by `intersect_impl` on this thread (tests only).
+#[cfg(test)]
+std::thread_local! {
+    static ROWS_WALKED: core::cell::Cell<usize> = const { core::cell::Cell::new(0) };
+}
+
+/// The implementation of the clipping algorithm using sparse strips. Conceptually, it is relatively
+/// simple: We iterate over each strip and fill region of the two paths in lock step and determine
+/// all overlaps between the two. For each overlap, we proceed depending on what kind of region
+/// we have in the first path and the second one.
+/// - In case we have two fill regions, the overlap region will also be filled.
+/// - In case we have one strip and one fill region, the overlap region will copy the alpha mask of the strip region.
+/// - Finally, if we have two strip regions, we combine the alpha masks of both.
+/// - All regions that are not filled in either path are simply ignored.
+///
+/// This is all that this method does. It just looks more complicated as the logic for iterating
+/// in lock step is a bit tricky.
+fn intersect_impl<S: Simd>(
+    simd: S,
+    path_1: PathDataRef<'_>,
+    path_2: PathDataRef<'_>,
+    target: &mut StripStorage,
+) {
+    // In case either path is empty, the clip path should be empty.
+    if path_1.strips.is_empty() || path_2.strips.is_empty() {
+        return;
+    }
+
+    // Ignore any y values that are outside the bounding box of either of the two paths, as
+    // those are guaranteed to have neither fill nor strip regions.
+    // PdfCraft patch: start at the later first row. Above it one path has no strips, so no row
+    // there yields output, but the walk visited each of them, from the top of the clip, for every
+    // path drawn (on the A1 sample's full-page canvas, about half its strip rows per stroke).
+    let mut cur_y = path_1.strips[0].strip_y().max(path_2.strips[0].strip_y());
+    let end_y = path_1.strips[path_1.strips.len() - 1]
+        .strip_y()
+        .min(path_2.strips[path_2.strips.len() - 1].strip_y());
+
+    let mut path_1_idx = 0;
+    let mut path_2_idx = 0;
+    let mut strip_state = None;
+
+    // Iterate over each strip row and handle them.
+    while cur_y <= end_y {
+        // PdfCraft patch: counts the rows walked, for the test that pins where the walk starts.
+        #[cfg(test)]
+        ROWS_WALKED.with(|rows| rows.set(rows.get() + 1));
+        // For each row, we create two iterators that alternatingly yield the strips and fill
+        // regions in that row, until the last strip has been reached.
+        let mut p1_iter = RowIterator::new(path_1, &mut path_1_idx, cur_y);
+        let mut p2_iter = RowIterator::new(path_2, &mut path_2_idx, cur_y);
+
+        let mut p1_region = p1_iter.next();
+        let mut p2_region = p2_iter.next();
+
+        // If at least one region is none, it means that we reached the end of the row
+        // for that path, meaning that we exceeded the bounding box of that path and no
+        // additional strips should be generated for that row, even if the other path might
+        // still have more strips left. They will all be clipped away. So only consider it
+        // if both paths have a region left.
+        while let (Some(region_1), Some(region_2)) = (p1_region, p2_region) {
+            match region_1.overlap_relationship(&region_2) {
+                // This means there is no overlap between the regions, so we need to advance
+                // the iterator of the region that is further behind.
+                OverlapRelationship::Advance(advance) => {
+                    match advance {
+                        Advance::Left => p1_region = p1_iter.next(),
+                        Advance::Right => p2_region = p2_iter.next(),
+                    };
+
+                    continue;
+                }
+                // We have an overlap!
+                OverlapRelationship::Overlap(overlap) => {
+                    match (region_1, region_2) {
+                        // Both regions are a fill. Flush the current strip and start a new
+                        // one at the end of the overlap region setting `fill_gap` to true,
+                        // so that the whole area before that will be filled with a sparse
+                        // fill.
+                        (Region::Fill(_), Region::Fill(_)) => {
+                            flush_strip(&mut strip_state, &mut target.strips, cur_y);
+                            start_strip(&mut strip_state, &target.alphas, overlap.end, true);
+                        }
+                        // One fill one strip, so we simply use the alpha mask from the strip region.
+                        (Region::Strip(s), Region::Fill(_))
+                        | (Region::Fill(_), Region::Strip(s)) => {
+                            // If possible, don't create a new strip but just extend the current one.
+                            if should_create_new_strip(&strip_state, &target.alphas, overlap.start)
+                            {
+                                flush_strip(&mut strip_state, &mut target.strips, cur_y);
+                                start_strip(&mut strip_state, &target.alphas, overlap.start, false);
+                            }
+
+                            let s_alphas = &s.alphas[(overlap.start - s.start) as usize * 4..]
+                                [..overlap.width() as usize * 4];
+                            target.alphas.extend_from_slice(s_alphas);
+                        }
+                        // Two strips, we need to multiply the opacity masks from both paths.
+                        (Region::Strip(s_region_1), Region::Strip(s_region_2)) => {
+                            // Once again, only create a new strip if we can't extend the current one.
+                            if should_create_new_strip(&strip_state, &target.alphas, overlap.start)
+                            {
+                                flush_strip(&mut strip_state, &mut target.strips, cur_y);
+                                start_strip(&mut strip_state, &target.alphas, overlap.start, false);
+                            }
+
+                            let num_blocks = overlap.width() / Tile::HEIGHT;
+
+                            // Get the right alpha values for the specific position.
+                            let s1_alphas = s_region_1.alphas
+                                [(overlap.start - s_region_1.start) as usize * 4..]
+                                .chunks_exact(16)
+                                .take(num_blocks as usize);
+                            let s2_alphas = s_region_2.alphas
+                                [(overlap.start - s_region_2.start) as usize * 4..]
+                                .chunks_exact(16)
+                                .take(num_blocks as usize);
+
+                            for (s1_alpha, s2_alpha) in s1_alphas.zip(s2_alphas) {
+                                let s1 = u8x16::from_slice(simd, s1_alpha);
+                                let s2 = u8x16::from_slice(simd, s2_alpha);
+
+                                // Combine them.
+                                let res = simd.narrow_u16x16(normalized_mul_u8x16(s1, s2));
+                                target.alphas.extend(res.as_slice());
+                            }
+                        }
+                    }
+
+                    // Advance the iterator of the path whose region's end is further behind.
+                    match overlap.advance {
+                        Advance::Left => p1_region = p1_iter.next(),
+                        Advance::Right => p2_region = p2_iter.next(),
+                    };
+                }
+            }
+        }
+
+        // Flush the strip before advancing to the next strip row.
+        flush_strip(&mut strip_state, &mut target.strips, cur_y);
+        cur_y += 1;
+    }
+
+    // Push the sentinel strip, if one wasn't already pushed.
+    if !target.strips.last().is_some_and(Strip::is_sentinel) {
+        target.strips.push(Strip::new(
+            u16::MAX,
+            end_y * Tile::HEIGHT,
+            target.alphas.len() as u32,
+            false,
+        ));
+    }
+}
+
+/// An overlap between two regions.
+struct Overlap {
+    /// The start x coordinate.
+    start: u16,
+    /// The end x coordinate.
+    end: u16,
+    /// Whether the left or right region iterator should be advanced next.
+    advance: Advance,
+}
+
+impl Overlap {
+    fn width(&self) -> u16 {
+        self.end - self.start
+    }
+}
+
+enum Advance {
+    Left,
+    Right,
+}
+
+/// The relationship between two regions.
+enum OverlapRelationship {
+    /// There is no overlap between the regions, advance the region iterator on the given side.
+    Advance(Advance),
+    /// There is an overlap between the regions.
+    Overlap(Overlap),
+}
+
+#[derive(Debug, Clone, Copy)]
+struct FillRegion {
+    start: u16,
+    width: u16,
+}
+
+#[derive(Debug, Clone, Copy)]
+struct StripRegion<'a> {
+    start: u16,
+    width: u16,
+    alphas: &'a [u8],
+}
+
+#[derive(Debug, Clone, Copy)]
+enum Region<'a> {
+    Fill(FillRegion),
+    Strip(StripRegion<'a>),
+}
+
+impl Region<'_> {
+    #[inline(always)]
+    fn start(&self) -> u16 {
+        match self {
+            Region::Fill(fill) => fill.start,
+            Region::Strip(strip) => strip.start,
+        }
+    }
+
+    #[inline(always)]
+    fn width(&self) -> u16 {
+        match self {
+            Region::Fill(fill) => fill.width,
+            Region::Strip(strip) => strip.width,
+        }
+    }
+
+    #[inline(always)]
+    fn end(&self) -> u16 {
+        self.start() + self.width()
+    }
+
+    fn overlap_relationship(&self, other: &Region<'_>) -> OverlapRelationship {
+        if self.end() <= other.start() {
+            OverlapRelationship::Advance(Advance::Left)
+        } else if self.start() >= other.end() {
+            OverlapRelationship::Advance(Advance::Right)
+        } else {
+            let start = self.start().max(other.start());
+            let end = self.end().min(other.end());
+
+            let shift = if self.end() <= other.end() {
+                Advance::Left
+            } else {
+                Advance::Right
+            };
+
+            OverlapRelationship::Overlap(Overlap {
+                advance: shift,
+                start,
+                end,
+            })
+        }
+    }
+}
+
+/// An iterator of strip and fill regions of a single strip row.
+struct RowIterator<'a> {
+    /// The path in question.
+    input: PathDataRef<'a>,
+    /// The strip row we want to iterate over.
+    strip_y: u16,
+    /// The index of the current strip.
+    cur_idx: &'a mut usize,
+    /// Whether the iterator should yield a strip next or not.
+    /// When iterating over a row, we alternate between emitting strips and filled regions (unless
+    /// the region between two strips is not filled), so this flag acts as a toggle to store what
+    /// should be yielded next.
+    on_strip: bool,
+}
+
+impl<'a> RowIterator<'a> {
+    fn new(input: PathDataRef<'a>, cur_idx: &'a mut usize, strip_y: u16) -> Self {
+        // Forward the index until we have found the right strip.
+        while input.strips[*cur_idx].strip_y() < strip_y {
+            *cur_idx += 1;
+        }
+
+        Self {
+            input,
+            cur_idx,
+            strip_y,
+            on_strip: true,
+        }
+    }
+
+    #[inline(always)]
+    fn cur_strip(&self) -> &Strip {
+        &self.input.strips[*self.cur_idx]
+    }
+
+    #[inline(always)]
+    fn next_strip(&self) -> &Strip {
+        &self.input.strips[*self.cur_idx + 1]
+    }
+
+    #[inline(always)]
+    fn cur_strip_width(&self) -> u16 {
+        let cur = self.cur_strip();
+        let next = self.next_strip();
+        ((next.alpha_idx() - cur.alpha_idx()) / Tile::HEIGHT as u32) as u16
+    }
+
+    #[inline(always)]
+    fn cur_strip_alphas(&self) -> &'a [u8] {
+        let cur = self.cur_strip();
+        let next = self.next_strip();
+        &self.input.alphas[cur.alpha_idx() as usize..next.alpha_idx() as usize]
+    }
+
+    fn cur_strip_fill_area(&self) -> Option<FillRegion> {
+        let next = self.next_strip();
+
+        // Note that if the next strip happens to be on the next line, it will always have
+        // zero winding so we don't need to special case this.
+        if next.fill_gap() {
+            let cur = self.cur_strip();
+            let x = cur.x + self.cur_strip_width();
+            let width = next.x - x;
+
+            (width > 0).then_some(FillRegion { start: x, width })
+        } else {
+            None
+        }
+    }
+}
+
+impl<'a> Iterator for RowIterator<'a> {
+    type Item = Region<'a>;
+
+    #[inline(always)]
+    fn next(&mut self) -> Option<Self::Item> {
+        // If we are currently not on a strip, we want to yield a filled region in case there is one.
+        if !self.on_strip {
+            // Flip boolean flag so we will yield a strip in the next iteration.
+            self.on_strip = true;
+
+            // if we have a filled area, yield it and return. Otherwise, do nothing and we will
+            // instead yield the next strip below. In any case, we need to advance the current index
+            // so that we point to the next strip now.
+            if let Some(fill_area) = self.cur_strip_fill_area() {
+                *self.cur_idx += 1;
+
+                return Some(Region::Fill(fill_area));
+            } else {
+                *self.cur_idx += 1;
+            }
+        }
+
+        // If we reached this point, we will yield a strip this iteration, so toggle the flag
+        // so that in the next iteration, we yield a filled region instead.
+        self.on_strip = false;
+
+        // If the current strip is sentinel or not within our target row, terminate.
+        if self.cur_strip().is_sentinel() || self.cur_strip().strip_y() != self.strip_y {
+            return None;
+        }
+
+        // Calculate the dimensions of the strip and yield it.
+        let x = self.cur_strip().x;
+        let width = self.cur_strip_width();
+        let alphas = self.cur_strip_alphas();
+
+        Some(Region::Strip(StripRegion {
+            start: x,
+            width,
+            alphas,
+        }))
+    }
+}
+
+/// The data of the current strip we are building.
+struct StripState {
+    x: u16,
+    alpha_idx: u32,
+    fill_gap: bool,
+}
+
+fn flush_strip(strip_state: &mut Option<StripState>, strips: &mut Vec<Strip>, cur_y: u16) {
+    if let Some(state) = core::mem::take(strip_state) {
+        strips.push(Strip::new(
+            state.x,
+            cur_y * Tile::HEIGHT,
+            state.alpha_idx,
+            state.fill_gap,
+        ));
+    }
+}
+
+#[inline(always)]
+fn start_strip(strip_data: &mut Option<StripState>, alphas: &[u8], x: u16, fill_gap: bool) {
+    *strip_data = Some(StripState {
+        x,
+        alpha_idx: alphas.len() as u32,
+        fill_gap,
+    });
+}
+
+fn should_create_new_strip(
+    strip_state: &Option<StripState>,
+    alphas: &[u8],
+    overlap_start: u16,
+) -> bool {
+    // Returns false in case we can append to the currently built strip.
+    strip_state.as_ref().is_none_or(|state| {
+        let width = ((alphas.len() as u32 - state.alpha_idx) / Tile::HEIGHT as u32) as u16;
+        let strip_end = state.x + width;
+
+        strip_end < overlap_start - 1
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::clip::{PathDataRef, Region, RowIterator, intersect};
+    use crate::geometry::RectU16;
+    use crate::strip::Strip;
+    use crate::strip_generator::StripStorage;
+    use crate::tile::Tile;
+    use fearless_simd::Level;
+    use std::vec;
+
+    #[test]
+    fn intersect_partly_overlapping_strips() {
+        let path_1 = StripBuilder::new().add_strip(0, 0, 32, false).finish();
+
+        let path_2 = StripBuilder::new().add_strip(8, 0, 44, false).finish();
+
+        let expected = StripBuilder::new().add_strip(8, 0, 32, false).finish();
+
+        run_test(expected, path_1, path_2);
+    }
+
+    // PdfCraft patch: the walk starts at the first row both paths have strips in. Starting at the
+    // earlier first row walked every row between the top of the clip and this one for each path.
+    #[test]
+    fn intersect_walks_only_rows_both_paths_have_strips() {
+        let path_1 = StripBuilder::new().add_strip(0, 200, 8, false).finish();
+        let path_2 = StripBuilder::new()
+            .add_strip(0, 0, 8, false)
+            .add_strip(0, 200, 8, false)
+            .finish();
+        let expected = StripBuilder::new().add_strip(0, 200, 8, false).finish();
+
+        super::ROWS_WALKED.with(|rows| rows.set(0));
+        run_test(expected, path_1, path_2);
+        let walked = super::ROWS_WALKED.with(core::cell::Cell::get);
+        assert_eq!(walked, 1, "the walk visited {walked} rows; it should visit only row 200");
+    }
+
+    #[test]
+    fn intersect_multiple_overlapping_strips() {
+        let path_1 = StripBuilder::new()
+            .add_strip(0, 1, 4, false)
+            .add_strip(12, 1, 20, true)
+            .add_strip(28, 1, 32, false)
+            .add_strip(44, 1, 52, true)
+            .finish();
+
+        let path_2 = StripBuilder::new()
+            .add_strip(4, 1, 8, false)
+            .add_strip(16, 1, 20, true)
+            .add_strip(24, 1, 28, false)
+            .add_strip(32, 1, 36, false)
+            .add_strip(44, 1, 48, true)
+            .finish();
+
+        let expected = StripBuilder::new()
+            .add_strip(4, 1, 8, false)
+            .add_strip(12, 1, 20, true)
+            .add_strip(32, 1, 36, false)
+            .add_strip(44, 1, 48, true)
+            .finish();
+
+        run_test(expected, path_1, path_2);
+    }
+
+    #[test]
+    fn multiple_rows() {
+        let path_1 = StripBuilder::new()
+            .add_strip(0, 0, 4, false)
+            .add_strip(16, 0, 20, true)
+            .add_strip(4, 1, 8, false)
+            .add_strip(12, 1, 24, true)
+            .add_strip(4, 2, 8, false)
+            .add_strip(16, 2, 32, true)
+            .finish();
+
+        let path_2 = StripBuilder::new()
+            .add_strip(0, 2, 4, false)
+            .add_strip(16, 2, 24, true)
+            .add_strip(8, 3, 12, false)
+            .add_strip(16, 3, 28, true)
+            .finish();
+
+        let expected = StripBuilder::new()
+            .add_strip(4, 2, 8, false)
+            .add_strip(16, 2, 24, true)
+            .finish();
+
+        run_test(expected, path_1, path_2);
+    }
+
+    #[test]
+    fn alpha_buffer_correct_width() {
+        let path_1 = StripBuilder::new()
+            .add_strip(0, 0, 4, false)
+            .add_strip(0, 1, 12, false)
+            .finish();
+
+        let path_2 = StripBuilder::new()
+            .add_strip(4, 0, 8, false)
+            .add_strip(0, 1, 4, false)
+            .add_strip(12, 1, 16, true)
+            .finish();
+
+        let expected = StripBuilder::new().add_strip(0, 1, 12, false).finish();
+
+        run_test(expected, path_1, path_2);
+    }
+
+    #[test]
+    fn row_iterator_abort_next_line() {
+        let path_1 = StripBuilder::new()
+            .add_strip(0, 0, 4, false)
+            .add_strip(0, 1, 4, false)
+            .finish();
+
+        let path_ref = PathDataRef {
+            strips: &path_1.strips,
+            alphas: &path_1.alphas,
+            bbox: RectU16::new(0, 0, u16::MAX, u16::MAX),
+        };
+
+        let mut idx = 0;
+        let mut iter = RowIterator::new(path_ref, &mut idx, 0);
+
+        assert!(iter.next().is_some());
+        assert!(iter.next().is_none());
+    }
+
+    #[test]
+    fn row_iterator_sentinel_fill_gap() {
+        let path = StripBuilder::new()
+            .add_strip(0, 0, Tile::WIDTH, false)
+            .finish_with_fill_gap_sentinel();
+        let path_ref = path_ref(&path);
+
+        let mut idx = 0;
+        let mut iter = RowIterator::new(path_ref, &mut idx, 0);
+
+        assert_strip_region(iter.next(), 0, Tile::WIDTH);
+        assert_fill_region(iter.next(), Tile::WIDTH, u16::MAX - Tile::WIDTH);
+        assert!(iter.next().is_none());
+    }
+
+    #[test]
+    fn intersect_strip_with_sentinel_fill_gap() {
+        let path_1 = StripBuilder::new()
+            .add_strip(0, 0, Tile::WIDTH, false)
+            .finish_with_fill_gap_sentinel();
+        let path_2 = StripBuilder::new().add_strip(8, 0, 12, false).finish();
+        let expected = StripBuilder::new().add_strip(8, 0, 12, false).finish();
+
+        run_test(expected, path_1, path_2);
+    }
+
+    #[test]
+    fn intersect_two_sentinel_fill_gaps() {
+        let path_1 = StripBuilder::new()
+            .add_strip(0, 0, 8, false)
+            .finish_with_fill_gap_sentinel();
+        let path_2 = StripBuilder::new()
+            .add_strip(4, 0, 12, false)
+            .finish_with_fill_gap_sentinel();
+        let expected = StripBuilder::new()
+            .add_strip(4, 0, 12, false)
+            .finish_with_fill_gap_sentinel();
+
+        run_test(expected, path_1, path_2);
+    }
+
+    #[test]
+    fn row_iterator_fill_gap_stops_at_row_boundary() {
+        let mut path = StripBuilder::new()
+            .add_strip(0, 0, 4, false)
+            .finish_with_fill_gap_sentinel();
+        let idx = path.alphas.len();
+        path.strips
+            .push(Strip::new(0, Tile::HEIGHT, idx as u32, false));
+        path.alphas
+            .extend([0; Tile::HEIGHT as usize * Tile::WIDTH as usize]);
+        path.strips.push(Strip::new(
+            u16::MAX,
+            Tile::HEIGHT,
+            path.alphas.len() as u32,
+            false,
+        ));
+
+        let path_ref = path_ref(&path);
+        let mut idx = 0;
+        let mut iter = RowIterator::new(path_ref, &mut idx, 0);
+
+        assert_strip_region(iter.next(), 0, 4);
+        assert_fill_region(iter.next(), 4, u16::MAX - 4);
+        assert!(iter.next().is_none());
+
+        let mut iter = RowIterator::new(path_ref, &mut idx, 1);
+
+        assert_strip_region(iter.next(), 0, Tile::WIDTH);
+        assert!(iter.next().is_none());
+    }
+
+    #[test]
+    fn row_iterator_adjacent_unmerged_strips_no_fill() {
+        let path = StripBuilder::new()
+            .add_strip(0, 0, 4, false)
+            .add_strip(4, 0, 8, false)
+            .finish();
+        let path_ref = path_ref(&path);
+
+        let mut idx = 0;
+        let mut iter = RowIterator::new(path_ref, &mut idx, 0);
+
+        assert_strip_region(iter.next(), 0, 4);
+        assert_strip_region(iter.next(), 4, 4);
+        assert!(iter.next().is_none());
+    }
+
+    #[test]
+    fn row_iterator_adjacent_unmerged_strips_with_fill_gap() {
+        let path = StripBuilder::new()
+            .add_strip(0, 0, 4, false)
+            .add_strip(4, 0, 8, true)
+            .finish();
+        let path_ref = path_ref(&path);
+
+        let mut idx = 0;
+        let mut iter = RowIterator::new(path_ref, &mut idx, 0);
+
+        assert_strip_region(iter.next(), 0, 4);
+        assert_strip_region(iter.next(), 4, 4);
+        assert!(iter.next().is_none());
+    }
+
+    #[test]
+    fn intersect_adjacent_unmerged_strips() {
+        let path = StripBuilder::new()
+            .add_strip(0, 0, 4, false)
+            .add_strip(4, 0, 8, true)
+            .finish();
+        let cover = StripBuilder::new().add_strip(0, 0, 8, false).finish();
+        let expected = StripBuilder::new().add_strip(0, 0, 8, false).finish();
+
+        run_test(expected, path, cover);
+    }
+
+    #[test]
+    fn row_iterator_zero_width_alpha_region() {
+        let mut path = StripStorage::default();
+        path.strips.push(Strip::new(8, 0, 0, false));
+        path.strips.push(Strip::new(16, 0, 0, true));
+        path.strips.push(Strip::new(u16::MAX, 0, 0, false));
+        let path_ref = path_ref(&path);
+
+        let mut idx = 0;
+        let iter = RowIterator::new(path_ref, &mut idx, 0);
+
+        assert_eq!(iter.cur_strip_width(), 0);
+        let fill = iter.cur_strip_fill_area().unwrap();
+        assert_eq!(fill.start, 8);
+        assert_eq!(fill.width, 8);
+
+        let cover = StripBuilder::new().add_strip(0, 0, 20, false).finish();
+        let expected = StripBuilder::new().add_strip(8, 0, 16, false).finish();
+
+        run_test(expected, path, cover);
+    }
+
+    fn run_test(expected: StripStorage, path_1: StripStorage, path_2: StripStorage) {
+        let mut write_target = StripStorage::default();
+
+        let path_1 = path_ref(&path_1);
+        let path_2 = path_ref(&path_2);
+
+        intersect(Level::new(), path_1, path_2, &mut write_target);
+
+        assert_eq!(write_target, expected);
+    }
+
+    fn path_ref(path: &StripStorage) -> PathDataRef<'_> {
+        PathDataRef {
+            strips: &path.strips,
+            alphas: &path.alphas,
+            bbox: RectU16::new(0, 0, u16::MAX, u16::MAX),
+        }
+    }
+
+    fn assert_strip_region(region: Option<Region<'_>>, start: u16, width: u16) {
+        match region {
+            Some(Region::Strip(strip)) => {
+                assert_eq!(strip.start, start);
+                assert_eq!(strip.width, width);
+                assert_eq!(strip.alphas.len(), (width * Tile::HEIGHT) as usize);
+            }
+            other => panic!("expected strip region, got {other:?}"),
+        }
+    }
+
+    fn assert_fill_region(region: Option<Region<'_>>, start: u16, width: u16) {
+        match region {
+            Some(Region::Fill(fill)) => {
+                assert_eq!(fill.start, start);
+                assert_eq!(fill.width, width);
+            }
+            other => panic!("expected fill region, got {other:?}"),
+        }
+    }
+
+    struct StripBuilder {
+        storage: StripStorage,
+    }
+
+    impl StripBuilder {
+        fn new() -> Self {
+            Self {
+                storage: StripStorage::default(),
+            }
+        }
+
+        fn add_strip(self, x: u16, strip_y: u16, end: u16, fill_gap: bool) -> Self {
+            let width = end - x;
+            self.add_strip_with(
+                x,
+                strip_y,
+                end,
+                fill_gap,
+                &vec![0; (width * Tile::HEIGHT) as usize],
+            )
+        }
+
+        fn add_strip_with(
+            mut self,
+            x: u16,
+            strip_y: u16,
+            end: u16,
+            fill_gap: bool,
+            alphas: &[u8],
+        ) -> Self {
+            let width = end - x;
+            assert_eq!(alphas.len(), (width * Tile::HEIGHT) as usize);
+            let idx = self.storage.alphas.len();
+            self.storage
+                .strips
+                .push(Strip::new(x, strip_y * Tile::HEIGHT, idx as u32, fill_gap));
+            self.storage.alphas.extend_from_slice(alphas);
+
+            self
+        }
+
+        fn finish(mut self) -> StripStorage {
+            let last_y = self.storage.strips.last().unwrap().y;
+            let idx = self.storage.alphas.len();
+
+            self.storage
+                .strips
+                .push(Strip::new(u16::MAX, last_y, idx as u32, false));
+
+            self.storage
+        }
+
+        fn finish_with_fill_gap_sentinel(mut self) -> StripStorage {
+            let last_y = self.storage.strips.last().unwrap().y;
+            let idx = self.storage.alphas.len();
+
+            self.storage
+                .strips
+                .push(Strip::new(u16::MAX, last_y, idx as u32, true));
+
+            self.storage
+        }
+    }
+}
diff --git a/vendor/vello_common/src/coarse.rs b/vendor/vello_common/src/coarse.rs
new file mode 100644
index 000000000..14f9b3a9a
--- /dev/null
+++ b/vendor/vello_common/src/coarse.rs
@@ -0,0 +1,2385 @@
+// Copyright 2025 the Vello Authors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+//! Generating and processing wide tiles.
+
+use crate::color::palette::css::TRANSPARENT;
+use crate::encode::EncodedPaint;
+use crate::filter_effects::Filter;
+use crate::geometry::RectU16;
+use crate::kurbo::{Affine, Rect};
+use crate::mask::Mask;
+use crate::paint::{Paint, PremulColor};
+use crate::peniko::{BlendMode, Compose, Mix};
+use crate::render_graph::{DependencyKind, LayerId, RenderGraph, RenderNodeKind};
+use crate::{strip::Strip, tile::Tile};
+use alloc::vec;
+use alloc::{boxed::Box, vec::Vec};
+#[cfg(debug_assertions)]
+use alloc::{format, string::String};
+use core::ops::Range;
+use hashbrown::HashMap;
+#[cfg(not(feature = "std"))]
+use peniko::kurbo::common::FloatFuncs as _;
+
+#[derive(Debug)]
+struct Layer {
+    /// The layer's ID.
+    layer_id: LayerId,
+    /// Whether the layer has a clip associated with it.
+    clip: bool,
+    /// The blend mode with which this layer should be blended into
+    /// the previous layer.
+    blend_mode: BlendMode,
+    /// An opacity to apply to the whole layer before blending it
+    /// into the backdrop.
+    opacity: f32,
+    /// A mask to apply to the layer before blending it back into
+    /// the backdrop.
+    mask: Option<Mask>,
+    /// A filter effect to apply to the layer before other operations.
+    filter: Option<Filter>,
+    /// Bounding box of wide tiles containing geometry.
+    /// Starts with inverted bounds, shrinks to actual content during drawing.
+    wtile_bbox: WideTilesBbox,
+}
+
+impl Layer {
+    /// Whether the layer actually requires allocating a new scratch buffer
+    /// for drawing its contents.
+    fn needs_buf(&self) -> bool {
+        self.blend_mode.mix != Mix::Normal
+            || self.blend_mode.compose != Compose::SrcOver
+            || self.opacity != 1.0
+            || self.mask.is_some()
+            || self.filter.is_some()
+            || !self.clip
+    }
+}
+
+/// `MODE_CPU` allows compile time optimizations to be applied to wide tile draw command generation
+/// specific to `vello_cpu`.
+pub const MODE_CPU: u8 = 0;
+/// `MODE_HYBRID` allows compile time optimizations to be applied to wide tile draw command
+/// generation specific for `vello_hybrid`.
+pub const MODE_HYBRID: u8 = 1;
+
+/// The index that in `push_buf_indices` is reserved for indicating the target is the final
+/// destination surface.
+const TARGET_SURFACE_PUSH_BUF_IDX: usize = usize::MAX;
+
+#[derive(Debug)]
+struct LayerKindAndOccupiedTiles {
+    /// The kind of layer needing a scratch buffer. This is tracked to allow lazy buffer pushing to
+    /// know for which layer kind to push.
+    kind: LayerKind,
+    /// The indices into [`Wide::tiles`] of wide tiles that occupy this layer. These are the wide
+    /// tiles that have pushed a buffer and need to be popped when the layer is popped.
+    occupied_tiles: Vec<usize>,
+}
+
+/// For layers that require allocating a new scratch buffer for drawing its contents, this stores
+/// the layer kind and the occupied wide tiles.
+///
+/// The wide tile push buffer command [`WideTile::push_buf`] is performed lazily upon actually
+/// being drawn into.
+///
+/// See [`LayerKindAndOccupiedTiles`].
+///
+/// This is a small wrapper around [`Vec`] so we can keep the
+/// [`LayerKindAndOccupiedTiles::occupied_tiles`] allocations around.
+#[derive(Debug, Default)]
+struct NeedsBufLayerStack {
+    stack: Vec<LayerKindAndOccupiedTiles>,
+    /// The actual length of [`Self::stack`], as we never actually shrink it (see the note above
+    /// about keeping allocations around).
+    len: usize,
+}
+
+impl NeedsBufLayerStack {
+    #[inline]
+    fn clear(&mut self) {
+        self.len = 0;
+    }
+
+    #[inline]
+    fn push(&mut self, kind: LayerKind) {
+        if self.len == self.stack.len() {
+            self.stack.push(LayerKindAndOccupiedTiles {
+                kind,
+                occupied_tiles: vec![],
+            });
+        } else {
+            self.stack[self.len].occupied_tiles.clear();
+            self.stack[self.len].kind = kind;
+        }
+        self.len += 1;
+    }
+
+    #[inline]
+    fn pop(&mut self) {
+        debug_assert!(self.len > 0, "Called `pop` at the root");
+        self.len -= 1;
+    }
+
+    #[inline]
+    fn last(&self) -> Option<&LayerKindAndOccupiedTiles> {
+        self.len.checked_sub(1).map(|idx| &self.stack[idx])
+    }
+}
+
+/// A container for wide tiles.
+#[derive(Debug)]
+pub struct Wide<const MODE: u8 = MODE_CPU> {
+    /// The width of the container.
+    width: u16,
+    /// The height of the container.
+    height: u16,
+    /// The wide tiles in the container.
+    tiles: Vec<WideTile<MODE>>,
+    /// Shared command properties, referenced by index from fill and clip commands.
+    pub attrs: CommandAttrs,
+    /// The stack of layers.
+    layer_stack: Vec<Layer>,
+    /// The stack of layer kinds and occupied tiles for layers that require buffers.
+    ///
+    /// This contains exactly one entry for each layer with [`Layer::needs_buf`] in
+    /// [`Self::layer_stack`].
+    layers_needing_buf_stack: NeedsBufLayerStack,
+    /// The stack of active clip regions.
+    clip_stack: Vec<Clip>,
+    /// Stack of filter layer node IDs for render graph dependency tracking.
+    /// Initialized with node 0 (the root node representing the final output).
+    /// As layers with filters are pushed, their node IDs are added to this stack.
+    filter_node_stack: Vec<usize>,
+    /// Count of nested filtered layers with clip paths.
+    /// When > 0, command generation uses full viewport bounds instead of clip bounds
+    /// to ensure filter effects can process the full layer before applying the clip.
+    clipped_filter_layer_depth: u32,
+    /// Global batch counter, incremented each time we transition from fast strip rendering
+    /// to a set of strips passing through coarse rasterization.
+    batch_count: u32,
+    /// Whether to enable the optimization that allows fills with an opaque color to clear
+    /// all previous commands if it spans the whole wide tile.
+    ///
+    /// This needs to be disabled for the interleaved rendering path in `vello_hybrid`, because
+    /// the background is applied as the very first operation, and we have no way of clearing
+    /// strips in the fast path that would affect the area of the wide tile.
+    enable_bg_optimization: bool,
+    /// Whether at least one of the wide tiles has been mutated and thus they
+    /// need to be reset.
+    tiles_dirty: bool,
+}
+
+/// A clip region.
+#[derive(Debug)]
+struct Clip {
+    /// The intersected bounding box after clip
+    pub clip_bbox: WideTilesBbox,
+    /// The rendered path in sparse strip representation
+    pub strips: Box<[Strip]>,
+    /// The index of the thread that owns the alpha buffer.
+    /// Always 0 in single-threaded mode.
+    pub thread_idx: u8,
+}
+
+/// An axis-aligned bounding box in wide tile coordinates.
+///
+/// This is a wrapper around [`RectU16`], adding some utilities useful for converting between
+/// wide-tile space and pixel-space. `(x0, y0)` is the top-left corner and `(x1, y1)` is the
+/// bottom-right corner, both in wide tile units.
+#[derive(Debug, Clone, Copy)]
+pub struct WideTilesBbox {
+    /// The bounding box.
+    bbox: RectU16,
+}
+
+impl WideTilesBbox {
+    /// A empty rectangle with all coordinates set to zero.
+    pub const ZERO: Self = Self {
+        bbox: RectU16::ZERO,
+    };
+
+    /// An empty, maximally inverted rectangle, useful as a starting value for incremental union
+    /// operations.
+    ///
+    /// Has `(x0, y0) = (u16::MAX, u16::MAX)` and `(x1, y1) = (0, 0)`.
+    const INVERTED: Self = Self {
+        bbox: RectU16::INVERTED,
+    };
+
+    /// Create a new bounding box from wide tile coordinates.
+    pub fn new(x0: u16, y0: u16, x1: u16, y1: u16) -> Self {
+        Self {
+            bbox: RectU16::new(x0, y0, x1, y1),
+        }
+    }
+
+    /// Get the x0 coordinate of the bounding box.
+    #[inline(always)]
+    pub fn x0(&self) -> u16 {
+        self.bbox.x0
+    }
+
+    /// Get the y0 coordinate of the bounding box.
+    #[inline(always)]
+    pub fn y0(&self) -> u16 {
+        self.bbox.y0
+    }
+
+    /// Get the x1 coordinate of the bounding box.
+    #[inline(always)]
+    pub fn x1(&self) -> u16 {
+        self.bbox.x1
+    }
+
+    /// Get the y1 coordinate of the bounding box.
+    #[inline(always)]
+    pub fn y1(&self) -> u16 {
+        self.bbox.y1
+    }
+
+    /// Returns `true` if the bounding box has zero area.
+    #[inline(always)]
+    pub fn is_empty(&self) -> bool {
+        self.bbox.is_empty()
+    }
+
+    /// Get the width of the bounding box in tiles (x1 - x0).
+    #[inline(always)]
+    pub fn width_tiles(&self) -> u16 {
+        self.bbox.width()
+    }
+
+    /// Get the width of the bounding box in pixels.
+    #[inline(always)]
+    pub fn width_px(&self) -> u16 {
+        self.width_tiles() * WideTile::WIDTH
+    }
+
+    /// Get the height of the bounding box in tiles (y1 - y0).
+    #[inline(always)]
+    pub fn height_tiles(&self) -> u16 {
+        self.bbox.height()
+    }
+
+    /// Get the height of the bounding box in pixels.
+    #[inline(always)]
+    pub fn height_px(&self) -> u16 {
+        self.height_tiles() * Tile::HEIGHT
+    }
+
+    /// Check if a point (x, y) is contained within this bounding box.
+    ///
+    /// Returns `true` if x0 <= x < x1 and y0 <= y < y1.
+    #[inline(always)]
+    pub fn contains(&self, x: u16, y: u16) -> bool {
+        self.bbox.contains(x, y)
+    }
+
+    /// Calculate the intersection of this bounding box with another.
+    #[inline(always)]
+    pub(crate) fn intersect(self, other: Self) -> Self {
+        Self {
+            bbox: self.bbox.intersect(other.bbox),
+        }
+    }
+
+    /// Update this bounding box to include another bounding box (union in place).
+    #[inline(always)]
+    pub(crate) fn union(&mut self, other: Self) {
+        self.bbox.union(other.bbox);
+    }
+
+    /// Update the bbox to include the given tile coordinates.
+    #[inline(always)]
+    pub(crate) fn include_tile(&mut self, wtile_x: u16, wtile_y: u16) {
+        self.bbox.x0 = self.bbox.x0.min(wtile_x);
+        self.bbox.y0 = self.bbox.y0.min(wtile_y);
+        self.bbox.x1 = self.bbox.x1.max(wtile_x + 1);
+        self.bbox.y1 = self.bbox.y1.max(wtile_y + 1);
+    }
+
+    /// Scale this bounding box by the given scale factors.
+    ///
+    /// Multiplies each coordinate by the corresponding scale factor to convert
+    /// from one coordinate system to another.
+    #[inline(always)]
+    pub fn scale(&self, scale_x: u16, scale_y: u16) -> [u32; 4] {
+        [
+            u32::from(self.x0()) * u32::from(scale_x),
+            u32::from(self.y0()) * u32::from(scale_y),
+            u32::from(self.x1()) * u32::from(scale_x),
+            u32::from(self.y1()) * u32::from(scale_y),
+        ]
+    }
+
+    /// Expands the bounding box outward by the given pixel amounts in each direction.
+    ///
+    /// Pixel values are converted to tile coordinates (rounding up) and clamped to the
+    /// valid range `[0, max_x)` × `[0, max_y)`. The result is a new bounding box in
+    /// wide tile coordinates.
+    pub fn expand_by_pixels(&self, expansion: Rect, max_x: u16, max_y: u16) -> Self {
+        // The expansion rect is centered at origin:
+        // - Negative coordinates (x0, y0) represent left/top expansion
+        // - Positive coordinates (x1, y1) represent right/bottom expansion
+        let left_px = (-expansion.x0).max(0.0).ceil() as u16;
+        let top_px = (-expansion.y0).max(0.0).ceil() as u16;
+        let right_px = expansion.x1.max(0.0).ceil() as u16;
+        let bottom_px = expansion.y1.max(0.0).ceil() as u16;
+
+        // Convert pixel expansion to tile expansion (round up)
+        let left_tiles = left_px.div_ceil(WideTile::WIDTH);
+        let top_tiles = top_px.div_ceil(Tile::HEIGHT);
+        let right_tiles = right_px.div_ceil(WideTile::WIDTH);
+        let bottom_tiles = bottom_px.div_ceil(Tile::HEIGHT);
+
+        Self::new(
+            self.x0().saturating_sub(left_tiles),
+            self.y0().saturating_sub(top_tiles),
+            (self.x1() + right_tiles).min(max_x),
+            (self.y1() + bottom_tiles).min(max_y),
+        )
+    }
+}
+
+impl Wide<MODE_CPU> {
+    /// Create a new container for wide tiles.
+    pub fn new(width: u16, height: u16) -> Self {
+        Self::new_internal(width, height, true)
+    }
+}
+
+impl Wide<MODE_HYBRID> {
+    /// Create a new container for wide tiles.
+    pub fn new(width: u16, height: u16, enable_bg_optimization: bool) -> Self {
+        Self::new_internal(width, height, enable_bg_optimization)
+    }
+
+    /// Record a coarse batch boundary.
+    ///
+    /// Each tile lazily emits the pending `BatchEnd` markers the next
+    /// time it receives a command.
+    #[inline(always)]
+    pub fn end_batch(&mut self) {
+        self.batch_count += 1;
+    }
+}
+
+impl<const MODE: u8> Wide<MODE> {
+    /// Create a new container for wide tiles.
+    fn new_internal(width: u16, height: u16, enable_bg_optimization: bool) -> Self {
+        let width_tiles = width.div_ceil(WideTile::WIDTH);
+        let height_tiles = height.div_ceil(Tile::HEIGHT);
+        let mut tiles = Vec::with_capacity(usize::from(width_tiles) * usize::from(height_tiles));
+
+        for h in 0..height_tiles {
+            for w in 0..width_tiles {
+                tiles.push(WideTile::<MODE>::new_internal(
+                    w * WideTile::WIDTH,
+                    h * Tile::HEIGHT,
+                ));
+            }
+        }
+
+        Self {
+            tiles,
+            width,
+            height,
+            attrs: CommandAttrs::default(),
+            enable_bg_optimization,
+            layer_stack: vec![],
+            clip_stack: vec![],
+            // Start with root node 0.
+            filter_node_stack: vec![0],
+            clipped_filter_layer_depth: 0,
+            layers_needing_buf_stack: NeedsBufLayerStack::default(),
+            batch_count: 0,
+            tiles_dirty: false,
+        }
+    }
+
+    /// Whether there are any existing layers that haven't been popped yet.
+    pub fn has_layers(&self) -> bool {
+        !self.layer_stack.is_empty()
+    }
+
+    /// Reset all tiles in the container.
+    pub fn reset(&mut self) {
+        if self.tiles_dirty {
+            for tile in &mut self.tiles {
+                tile.reset();
+            }
+
+            self.tiles_dirty = false;
+        }
+
+        self.attrs.clear();
+        self.layer_stack.clear();
+        self.layers_needing_buf_stack.clear();
+        self.clip_stack.clear();
+        self.filter_node_stack.truncate(1);
+        self.clipped_filter_layer_depth = 0;
+        self.batch_count = 0;
+    }
+
+    /// Return the number of horizontal tiles.
+    pub fn width_tiles(&self) -> u16 {
+        self.width.div_ceil(WideTile::WIDTH)
+    }
+
+    /// Return the number of vertical tiles.
+    pub fn height_tiles(&self) -> u16 {
+        self.height.div_ceil(Tile::HEIGHT)
+    }
+
+    /// Get the index of the wide tile at the given coordinates.
+    ///
+    /// Panics if the coordinates are out-of-range.
+    #[inline]
+    pub fn get_idx(&self, x: u16, y: u16) -> usize {
+        assert!(
+            x < self.width_tiles() && y < self.height_tiles(),
+            "attempted to access out-of-bounds wide tile"
+        );
+
+        usize::from(y) * usize::from(self.width_tiles()) + usize::from(x)
+    }
+
+    /// Get the index of the wide tile at the given coordinates.
+    ///
+    /// Panics if the coordinates are out-of-range.
+    pub fn get(&self, x: u16, y: u16) -> &WideTile<MODE> {
+        let idx = self.get_idx(x, y);
+        &self.tiles[idx]
+    }
+
+    /// Get mutable access to the wide tile at the given coordinates.
+    ///
+    /// Panics if the coordinates are out-of-range.
+    fn get_mut(&mut self, x: u16, y: u16) -> &mut WideTile<MODE> {
+        let idx = self.get_idx(x, y);
+        &mut self.tiles[idx]
+    }
+
+    /// Return a reference to all wide tiles.
+    pub fn tiles(&self) -> &[WideTile<MODE>] {
+        self.tiles.as_slice()
+    }
+
+    /// Get the current layer Id.
+    #[inline(always)]
+    pub fn get_current_layer_id(&self) -> LayerId {
+        self.layer_stack.last().map_or(0, |l| l.layer_id)
+    }
+
+    /// Update the bounding box of the current layer to include the given tile.
+    /// Should be called whenever a command is generated for a tile.
+    #[inline]
+    fn update_current_layer_bbox(&mut self, wtile_x: u16, wtile_y: u16) {
+        if let Some(layer) = self.layer_stack.last_mut() {
+            layer.wtile_bbox.include_tile(wtile_x, wtile_y);
+        }
+    }
+
+    /// Generate wide tile commands from the strip buffer.
+    ///
+    /// This method processes a buffer of strips that represent a path, applies the fill rule,
+    /// and generates appropriate drawing commands for each affected wide tile.
+    ///
+    /// # Algorithm overview:
+    /// 1. For each strip in the buffer:
+    ///    - Calculate its position and width in pixels
+    ///    - Determine which wide tiles the strip intersects
+    ///    - Generate alpha fill commands for the intersected wide tiles
+    /// 2. For active fill regions (determined by fill rule):
+    ///    - Generate solid fill commands for the regions between strips
+    pub fn generate(
+        &mut self,
+        strip_buf: &[Strip],
+        paint: Paint,
+        blend_mode: BlendMode,
+        thread_idx: u8,
+        mask: Option<Mask>,
+        encoded_paints: &[EncodedPaint],
+    ) {
+        if strip_buf.is_empty() {
+            return;
+        }
+
+        self.tiles_dirty = true;
+        let alpha_base_idx = strip_buf[0].alpha_idx();
+
+        // Create shared attributes for all commands from this path
+        let attrs_idx = self.attrs.fill.len() as u32;
+        self.attrs.fill.push(FillAttrs {
+            thread_idx,
+            paint,
+            blend_mode,
+            mask,
+            alpha_base_idx,
+        });
+
+        // Get current clip bounding box or full viewport if no clip is active
+        let bbox = self.active_bbox();
+
+        // Save current_layer_id and batch_count to avoid borrowing issues
+        let current_layer_id = self.get_current_layer_id();
+        let batch_count = self.batch_count;
+
+        for i in 0..strip_buf.len() - 1 {
+            let strip = &strip_buf[i];
+
+            debug_assert!(
+                strip.y < self.height,
+                "Strips below the viewport should have been culled prior to this stage."
+            );
+
+            // Don't render strips that are outside the viewport width
+            if strip.x >= self.width {
+                continue;
+            }
+
+            let next_strip = &strip_buf[i + 1];
+            let x0 = strip.x;
+            let strip_y = strip.strip_y();
+
+            // Skip strips outside the current clip bounding box
+            if strip_y < bbox.y0() {
+                continue;
+            }
+            if strip_y >= bbox.y1() {
+                // The rest of our strips must be outside the clip, so we can break early.
+                break;
+            }
+
+            // Calculate the width of the strip in columns
+            let mut col = strip.alpha_idx() / u32::from(Tile::HEIGHT);
+            let next_col = next_strip.alpha_idx() / u32::from(Tile::HEIGHT);
+            // Can potentially be 0 if strip only changes winding without covering pixels
+            let strip_width = next_col.saturating_sub(col) as u16;
+            let x1 = x0.saturating_add(strip_width);
+
+            // Calculate which wide tiles this strip intersects
+            let wtile_x0 = (x0 / WideTile::WIDTH).max(bbox.x0());
+            // It's possible that a strip extends into a new wide tile, but we don't actually
+            // have as many wide tiles (e.g. because the pixmap width is only 512, but
+            // strip ends at 513), so take the minimum between the rounded values and `width_tiles`.
+            let wtile_x1 = x1
+                .div_ceil(WideTile::WIDTH)
+                .min(bbox.x1())
+                .min(WideTile::MAX_WIDE_TILE_COORD);
+
+            // Adjust column starting position if needed to respect clip boundaries
+            let mut x = x0;
+            let clip_x = bbox.x0() * WideTile::WIDTH;
+            if clip_x > x {
+                col += u32::from(clip_x - x);
+                x = clip_x;
+            }
+
+            // Generate alpha fill commands for each wide tile intersected by this strip
+            for wtile_x in wtile_x0..wtile_x1 {
+                let x_wtile_rel = x % WideTile::WIDTH;
+                // Restrict the width of the fill to the width of the wide tile
+                let width = x1.min((wtile_x + 1) * WideTile::WIDTH) - x;
+                let cmd = CmdAlphaFill {
+                    x: x_wtile_rel,
+                    width,
+                    alpha_offset: col * u32::from(Tile::HEIGHT) - alpha_base_idx,
+                    attrs_idx,
+                };
+                x += width;
+                col += u32::from(width);
+                let idx = self.get_idx(wtile_x, strip_y);
+                self.tiles[idx].strip(
+                    batch_count,
+                    idx,
+                    &mut self.layers_needing_buf_stack,
+                    cmd,
+                    current_layer_id,
+                );
+                self.update_current_layer_bbox(wtile_x, strip_y);
+            }
+
+            // Determine if the region between this strip and the next should be filled.
+            let active_fill = next_strip.fill_gap();
+
+            // If region should be filled and both strips are on the same row,
+            // generate fill commands for the region between them
+            if active_fill && strip_y == next_strip.strip_y() {
+                // Clamp the fill to the clip bounding box
+                x = x1.max(bbox.x0() * WideTile::WIDTH);
+                let x2 = next_strip.x.min(
+                    self.width
+                        .checked_next_multiple_of(WideTile::WIDTH)
+                        .unwrap_or(u16::MAX),
+                );
+                let wfxt0 = (x1 / WideTile::WIDTH).max(bbox.x0());
+                let wfxt1 = x2
+                    .div_ceil(WideTile::WIDTH)
+                    .min(bbox.x1())
+                    .min(WideTile::MAX_WIDE_TILE_COORD);
+
+                // Compute fill hint based on paint type
+                let fill_attrs = &self.attrs.fill[attrs_idx as usize];
+                let fill_hint = if fill_attrs.mask.is_none() && self.enable_bg_optimization {
+                    match &fill_attrs.paint {
+                        Paint::Solid(s) if s.is_opaque() => FillHint::OpaqueSolid(*s),
+                        Paint::Indexed(idx) => match encoded_paints.get(idx.index()) {
+                            Some(EncodedPaint::Image(img))
+                                if !img.may_have_transparency
+                                    && img.sampler.alpha == 1.0
+                                    && img.tint.is_none_or(|t| t.color.components[3] >= 1.0) =>
+                            {
+                                FillHint::OpaqueImage
+                            }
+                            Some(EncodedPaint::ExternalTexture(img))
+                                if !img.may_have_transparency
+                                    && img.sampler.alpha == 1.0
+                                    && img.tint.is_none_or(|t| t.color.components[3] >= 1.0) =>
+                            {
+                                FillHint::OpaqueImage
+                            }
+                            _ => FillHint::None,
+                        },
+                        _ => FillHint::None,
+                    }
+                } else {
+                    FillHint::None
+                };
+
+                // Generate fill commands for each wide tile in the fill region
+                for wtile_x in wfxt0..wfxt1 {
+                    let x_wtile_rel = x % WideTile::WIDTH;
+                    let width = x2.min(
+                        (wtile_x
+                            .checked_add(1)
+                            .unwrap_or(WideTile::MAX_WIDE_TILE_COORD))
+                            * WideTile::WIDTH,
+                    ) - x;
+                    x += width;
+                    let idx = self.get_idx(wtile_x, strip_y);
+                    self.tiles[idx].fill(
+                        batch_count,
+                        idx,
+                        &mut self.layers_needing_buf_stack,
+                        x_wtile_rel,
+                        width,
+                        attrs_idx,
+                        current_layer_id,
+                        fill_hint,
+                    );
+                    // TODO: This bbox update might be redundant since filled regions are always
+                    // bounded by strip regions (which already update the bbox). Consider removing
+                    // this in a follow-up with proper benchmarks to verify correctness.
+                    self.update_current_layer_bbox(wtile_x, strip_y);
+                }
+            }
+        }
+    }
+
+    /// Push a new layer with the given properties.
+    ///
+    /// Rendering will be directed to the layer storage identified by `layer_id`.
+    /// This is used for filter effects that require access to a fully-rendered layer.
+    ///
+    /// If `filter` is Some, builds render graph nodes for filter effects.
+    pub fn push_layer(
+        &mut self,
+        layer_id: LayerId,
+        clip_path: Option<impl Into<Box<[Strip]>>>,
+        blend_mode: BlendMode,
+        mask: Option<Mask>,
+        opacity: f32,
+        filter: Option<Filter>,
+        transform: Affine,
+        render_graph: &mut RenderGraph,
+        thread_idx: u8,
+    ) {
+        self.tiles_dirty = true;
+
+        // Some explanations about what is going on here: We support the concept of
+        // layers, where a user can push a new layer (with certain properties), draw some
+        // stuff, and finally pop the layer, as part of which the layer as a whole will be
+        // blended into the previous layer.
+        // There are 3 "straightforward" properties that can be set for each layer:
+        // 1) The blend mode that should be used to blend the layer into the backdrop.
+        // 2) A mask that will be applied to the whole layer in the very end before blending.
+        // 3) An optional opacity that will be applied to the whole layer before blending (this
+        //    could in theory be simulated with an alpha mask, but since it's a common operation and
+        //    we only have a single opacity, this can easily be optimized.
+        //
+        // Finally, you can also add a clip path to the layer. However, clipping has its own
+        // more complicated logic for pushing/popping buffers where drawing is also suppressed
+        // in clipped-out wide tiles. Because of this, in case we have one of the above properties
+        // AND a clipping path, we will actually end up pushing two buffers, the first one handles
+        // the three properties and the second one is just for clip paths. That is a bit wasteful
+        // and I believe it should be possible to process them all in just one go, but for now
+        // this is good enough, and it allows us to implement blending without too deep changes to
+        // the original clipping implementation.
+
+        // Build render graph node ONLY if we have a filter.
+        // The render graph tracks dependencies and execution order for filter effects.
+        if let Some(filter) = &filter {
+            // Create a FilterLayer node that combines render + filter + other operations
+            let child_node = render_graph.add_node(RenderNodeKind::FilterLayer {
+                layer_id,
+                filter: filter.clone(),
+                // Bounding box starts inverted and will be updated in pop_layer with actual bounds
+                wtile_bbox: WideTilesBbox::INVERTED,
+                transform,
+            });
+
+            // Connect to parent node if there is one
+            if let Some(&parent_node) = self.filter_node_stack.last() {
+                render_graph.add_edge(
+                    child_node,
+                    parent_node,
+                    DependencyKind::Sequential { layer_id },
+                );
+            }
+
+            // Push this filter node onto the stack so subsequent filters depend on it
+            self.filter_node_stack.push(child_node);
+        }
+
+        let has_filter = filter.is_some();
+        let has_clip = clip_path.is_some();
+        let layer_kind = if has_filter {
+            LayerKind::Filtered(layer_id)
+        } else {
+            LayerKind::Regular(layer_id)
+        };
+
+        // Filtered layers with clipping require special handling: normally, tiles with
+        // zero-winding clips suppress all drawing. However, filters need the full layer
+        // content rendered (including zero-clipped areas) before applying the clip as a mask.
+        // When this flag is true, we generate explicit drawing commands instead of just counters.
+        let in_clipped_filter_layer = has_filter && has_clip;
+
+        // Increment the depth counter so that active_bbox() returns the full viewport
+        // instead of the clipped bbox. This ensures command generation covers all tiles,
+        // allowing the filter to process the entire layer before the clip is applied.
+        if in_clipped_filter_layer {
+            self.clipped_filter_layer_depth += 1;
+        }
+
+        let layer = Layer {
+            layer_id,
+            clip: has_clip,
+            blend_mode,
+            opacity,
+            mask,
+            filter,
+            wtile_bbox: WideTilesBbox::INVERTED,
+        };
+
+        // In case we do blending, masking, opacity, or filtering, push one buffer per wide tile.
+        //
+        // Layers require buffers for different reasons:
+        // - Blending, opacity, and masking: Need to composite results with the backdrop
+        // - Filtering: Content must be rendered to a buffer before applying filter effects
+        //
+        // The layer_kind parameter distinguishes how buffers are managed:
+        // - Regular layers use the local blend_buf stack
+        // - Filtered layers are materialized in persistent layer storage for filter processing
+        // - Clip layers have special handling for clipping operations
+        if layer.needs_buf() {
+            let batch_count = self.batch_count;
+
+            self.layers_needing_buf_stack.push(layer_kind);
+
+            // We eagerly push buffers for the current active bbox if this is a destructive blend
+            // or the entire viewport if we are (nested in) a clipped filter layer.
+            //
+            // TODO: We may be able to do away with some or all of this eager pushing in the
+            // future, but for now these types of layers need buffers for all wide tiles regardless
+            // of whether they're drawn on.
+            if layer.blend_mode.is_destructive() || self.clipped_filter_layer_depth > 0 {
+                let active_bbox = if self.clipped_filter_layer_depth > 0 {
+                    self.full_viewport_bbox()
+                } else {
+                    self.active_bbox()
+                };
+
+                for y in active_bbox.y0()..active_bbox.y1() {
+                    for x in active_bbox.x0()..active_bbox.x1() {
+                        let idx = self.get_idx(x, y);
+                        self.tiles[idx].ensure_layer_stack_bufs(
+                            idx,
+                            &mut self.layers_needing_buf_stack,
+                            batch_count,
+                        );
+                        // Mark tiles that are in a clipped filter layer so they generate
+                        // explicit clip commands for proper filter processing.
+                        self.tiles[idx].in_clipped_filter_layer = in_clipped_filter_layer;
+                    }
+                }
+            }
+        }
+
+        // If we have a clip path, push another buffer in the affected wide tiles.
+        // Note that it is important that we FIRST push the buffer for blending etc. and
+        // only then for clipping, otherwise we will use the empty clip buffer as the backdrop
+        // for blending!
+        if let Some(clip) = clip_path {
+            self.push_clip(clip, layer_id, thread_idx);
+        }
+
+        self.layer_stack.push(layer);
+    }
+
+    /// Pop a previously pushed layer.
+    ///
+    /// This method finalizes the layer by:
+    /// - Expanding the bounding box if filter effects are present
+    /// - Updating the parent layer's bounding box to include this layer's bounds
+    /// - Completing render graph nodes for filter effects
+    /// - Generating filter commands for each tile
+    /// - Popping any associated clip
+    /// - Applying mask, opacity, and blend mode operations if needed
+    pub fn pop_layer(&mut self, render_graph: &mut RenderGraph) {
+        self.tiles_dirty = true;
+
+        // This method basically unwinds everything we did in `push_layer`.
+        let mut layer = self.layer_stack.pop().unwrap();
+        let batch_count = self.batch_count;
+
+        if let Some(filter) = &layer.filter {
+            let mut final_bbox = WideTilesBbox::INVERTED;
+
+            // Update render graph node with final bounding box
+            if let Some(node_id) = self.filter_node_stack.pop() {
+                // Get the transform from the FilterLayer node and scale the expansion by it
+                if let Some(node) = render_graph.nodes.get_mut(node_id)
+                    && let RenderNodeKind::FilterLayer {
+                        wtile_bbox,
+                        transform,
+                        ..
+                    } = &mut node.kind
+                {
+                    // Calculate expansion in device/pixel space, accounting for the full transform.
+                    // This ensures that rotated filters (e.g., drop shadows) have correct bounds.
+                    let expansion = filter.bounds_expansion(transform);
+                    let expanded_bbox = layer.wtile_bbox.expand_by_pixels(
+                        expansion,
+                        self.width_tiles(),
+                        self.height_tiles(),
+                    );
+                    let clip_bbox = self.active_bbox();
+                    final_bbox = expanded_bbox.intersect(clip_bbox);
+
+                    // Update both the local layer and the render graph node
+                    layer.wtile_bbox = final_bbox;
+                    *wtile_bbox = final_bbox;
+                }
+                // Record this node in execution order (children before parents)
+                render_graph.record_node_for_execution(node_id);
+            }
+
+            // Generate filter commands for each tile (used for non-graph path rendering)
+            // Apply filter BEFORE clipping (per SVG spec: filter → clip → mask → opacity → blend)
+            // Also ensure that each wide tile in the filter bbox (out of which some might not
+            // have been drawn on) has a `PushBuf` command.
+            for x in final_bbox.x0()..final_bbox.x1() {
+                for y in final_bbox.y0()..final_bbox.y1() {
+                    let idx = self.get_idx(x, y);
+                    self.tiles[idx].ensure_layer_stack_bufs(
+                        idx,
+                        &mut self.layers_needing_buf_stack,
+                        batch_count,
+                    );
+
+                    // Note that unlike commands like "mask" or "opacity" which only need to be applied
+                    // to wide tiles with drawing commands, filter commands always need to be applied
+                    // to all wide tiles in the filter bounding-box, because it's possible that after
+                    // applying a filter (like gaussian blur), wide tiles will take on a new color
+                    // even though nothing had been drawn there originally.
+                    self.tiles[idx].filter(layer.layer_id, filter.clone());
+                }
+            }
+        }
+
+        // Union this layer's bbox into the parent layer's bbox.
+        // This ensures the parent knows about all tiles used by this child layer,
+        // which is important for filter effects that may expand beyond the original content bounds.
+        if let Some(parent_layer) = self.layer_stack.last_mut() {
+            parent_layer.wtile_bbox.union(layer.wtile_bbox);
+        }
+
+        if layer.clip {
+            self.pop_clip();
+        }
+
+        if layer.needs_buf() {
+            for &tile_idx in self
+                .layers_needing_buf_stack
+                .last()
+                .unwrap()
+                .occupied_tiles
+                .iter()
+            {
+                let tile = &mut self.tiles[tile_idx];
+
+                // Optimization: If no drawing happened since the last `PushBuf`, then we don't
+                // need to do any masking or buffer-wide opacity work. Even though we push buffers
+                // lazily, this can still happen: e.g., filter layers with clips and destructive blends
+                // currently push layers eagerly.
+                let has_draw_commands = !matches!(tile.cmds.last().unwrap(), &Cmd::PushBuf(..));
+                if has_draw_commands {
+                    if let Some(mask) = layer.mask.clone() {
+                        tile.mask(mask);
+                    }
+                    tile.opacity(layer.opacity);
+                }
+                // We only need to blend if there are draw commands, unless this is destructive
+                // blending, in which case we always blend.
+                if has_draw_commands || layer.blend_mode.is_destructive() {
+                    tile.blend(layer.blend_mode);
+                }
+                tile.pop_buf();
+            }
+            self.layers_needing_buf_stack.pop();
+        }
+
+        let in_clipped_filter_layer = layer.filter.is_some() && layer.clip;
+        // Decrement the depth counter after popping a filtered layer with clip
+        if in_clipped_filter_layer {
+            self.clipped_filter_layer_depth -= 1;
+        }
+    }
+
+    /// Adds a clipping region defined by the provided strips.
+    ///
+    /// This method takes a vector of strips representing a clip path, calculates the
+    /// intersection with the current clip region, and updates the clip stack.
+    ///
+    /// # Algorithm overview:
+    /// 1. Calculate bounding box of the clip path
+    /// 2. Intersect with current clip bounding box
+    /// 3. For each tile in the intersected bounding box:
+    ///    - If covered by zero winding: `push_zero_clip`
+    ///    - If fully covered by non-zero winding: do nothing (clip is a no-op)
+    ///    - If partially covered: `push_clip`
+    fn push_clip(&mut self, strips: impl Into<Box<[Strip]>>, layer_id: LayerId, thread_idx: u8) {
+        let strips = strips.into();
+        let n_strips = strips.len();
+
+        // Calculate the bounding box of the clip path in strip coordinates
+        let path_bbox = if n_strips <= 1 {
+            WideTilesBbox::ZERO
+        } else {
+            // Calculate the y range from first to last strip in wide tile coordinates
+            let wtile_y0 = strips[0].strip_y();
+            let wtile_y1 = strips[n_strips.saturating_sub(1)].strip_y() + 1;
+
+            // Calculate the x range by examining all strips in wide tile coordinates
+            let mut wtile_x0 = strips[0].x / WideTile::WIDTH;
+            let mut wtile_x1 = wtile_x0;
+            for i in 0..n_strips.saturating_sub(1) {
+                let strip = &strips[i];
+                let next_strip = &strips[i + 1];
+                let width =
+                    ((next_strip.alpha_idx() - strip.alpha_idx()) / u32::from(Tile::HEIGHT)) as u16;
+                let x = strip.x;
+                wtile_x0 = wtile_x0.min(x / WideTile::WIDTH);
+                wtile_x1 = wtile_x1.max((x + width).div_ceil(WideTile::WIDTH));
+            }
+            WideTilesBbox::new(wtile_x0, wtile_y0, wtile_x1, wtile_y1)
+        };
+
+        let parent_bbox = self.active_bbox();
+        // Determine which tiles need clip processing:
+        // - For clipped filter layers: active_bbox() returns the full viewport, so parent_bbox
+        //   already covers all tiles. We need to process all of them because the filter needs
+        //   the entire layer rendered, and tiles outside the clip path must get `PushZeroClip`
+        //   commands to properly suppress their content after filtering.
+        // - For normal clips: Intersect with the path bounds to only process tiles that are
+        //   actually affected by the clip path, avoiding unnecessary work.
+        let clip_bbox = if self.clipped_filter_layer_depth > 0 {
+            // Use parent_bbox as-is (full viewport) to process all tiles
+            parent_bbox
+        } else {
+            // Optimize by processing only the intersection of parent and path bounds
+            parent_bbox.intersect(path_bbox)
+        };
+
+        let mut cur_wtile_x = clip_bbox.x0();
+        let mut cur_wtile_y = clip_bbox.y0();
+        let batch_count = self.batch_count;
+
+        // Process strips to determine the clipping state for each wide tile
+        for i in 0..n_strips.saturating_sub(1) {
+            let strip = &strips[i];
+            let strip_y = strip.strip_y();
+
+            // Skip strips before current wide tile row
+            if strip_y < cur_wtile_y {
+                continue;
+            }
+
+            // Process wide tiles in rows before this strip's row
+            // These wide tiles are all zero-winding (outside the path)
+            while cur_wtile_y < strip_y.min(clip_bbox.y1()) {
+                for wtile_x in cur_wtile_x..clip_bbox.x1() {
+                    self.get_mut(wtile_x, cur_wtile_y).push_zero_clip(layer_id);
+                }
+                // Reset x to the left edge of the clip bounding box
+                cur_wtile_x = clip_bbox.x0();
+                // Move to the next row
+                cur_wtile_y += 1;
+            }
+
+            // If we've reached the bottom of the clip bounding box, stop processing.
+            // Note that we are explicitly checking >= instead of ==, so that we abort if the clipping box
+            // is zero-area (see issue 1072).
+            if cur_wtile_y >= clip_bbox.y1() {
+                break;
+            }
+
+            // Process wide tiles to the left of this strip in the same row
+            let x = strip.x;
+            let wtile_x_clamped = (x / WideTile::WIDTH).min(clip_bbox.x1());
+            if cur_wtile_x < wtile_x_clamped {
+                // If winding is zero or doesn't match fill rule, these wide tiles are outside the path
+                let is_inside = strip.fill_gap();
+                if !is_inside {
+                    for wtile_x in cur_wtile_x..wtile_x_clamped {
+                        self.get_mut(wtile_x, cur_wtile_y).push_zero_clip(layer_id);
+                    }
+                }
+                // If winding is nonzero, then wide tiles covered entirely
+                // by sparse fill are no-op (no clipping is applied).
+                cur_wtile_x = wtile_x_clamped;
+            }
+
+            // Process wide tiles covered by the strip - these need actual clipping
+            let next_strip = &strips[i + 1];
+            let width =
+                ((next_strip.alpha_idx() - strip.alpha_idx()) / u32::from(Tile::HEIGHT)) as u16;
+            let wtile_x1 = (x + width).div_ceil(WideTile::WIDTH).min(clip_bbox.x1());
+            if cur_wtile_x < wtile_x1 {
+                for wtile_x in cur_wtile_x..wtile_x1 {
+                    let idx = self.get_idx(wtile_x, cur_wtile_y);
+                    self.tiles[idx].push_clip(
+                        idx,
+                        &mut self.layers_needing_buf_stack,
+                        layer_id,
+                        batch_count,
+                    );
+                }
+                cur_wtile_x = wtile_x1;
+            }
+        }
+
+        // Process any remaining wide tiles in the bounding box (all zero-winding)
+        while cur_wtile_y < clip_bbox.y1() {
+            for wtile_x in cur_wtile_x..clip_bbox.x1() {
+                self.get_mut(wtile_x, cur_wtile_y).push_zero_clip(layer_id);
+            }
+            cur_wtile_x = clip_bbox.x0();
+            cur_wtile_y += 1;
+        }
+
+        self.clip_stack.push(Clip {
+            clip_bbox,
+            strips,
+            thread_idx,
+        });
+    }
+
+    /// Get the bounding box of the current clip region or the entire viewport if no clip regions are active.
+    fn active_bbox(&self) -> WideTilesBbox {
+        // When in a clipped filter layer, use full viewport to allow
+        // filter to process the complete layer before applying clip as mask
+        if self.clipped_filter_layer_depth > 0 {
+            return self.full_viewport_bbox();
+        }
+
+        self.clip_stack
+            .last()
+            .map(|top| top.clip_bbox)
+            .unwrap_or_else(|| self.full_viewport_bbox())
+    }
+
+    /// Returns the bounding box covering the entire viewport in wide tile coordinates.
+    fn full_viewport_bbox(&self) -> WideTilesBbox {
+        WideTilesBbox::new(0, 0, self.width_tiles(), self.height_tiles())
+    }
+
+    /// Removes the most recently added clip region.
+    ///
+    /// This is the inverse operation of `push_clip`, carefully undoing all the clipping
+    /// operations while also handling any rendering needed for the clip region itself.
+    ///
+    /// # Algorithm overview:
+    /// 1. Retrieve the top clip from the stack
+    /// 2. For each wide tile in the clip's bounding box:
+    ///    - If covered by zero winding: `pop_zero_clip`
+    ///    - If fully covered by non-zero winding: do nothing (was no-op)
+    ///    - If partially covered: render the clip and `pop_clip`
+    ///
+    /// This operation must be symmetric with `push_clip` to maintain a balanced clip stack.
+    fn pop_clip(&mut self) {
+        let Clip {
+            clip_bbox,
+            strips,
+            thread_idx,
+        } = self.clip_stack.pop().unwrap();
+        let n_strips = strips.len();
+
+        // Compute base alpha index and create shared clip attributes
+        // Note: It's possible that the clip-path has zero strips. However, we cannot exit early
+        // in this case because we need to potentially pop zero clips further below. Therefore,
+        // we simply use a dummy alpha index of 0 in this case.
+        let clip_attrs_idx = self.attrs.clip.len() as u32;
+        let alpha_base_idx;
+        if n_strips == 0 {
+            alpha_base_idx = 0;
+        } else {
+            alpha_base_idx = strips[0].alpha_idx();
+            self.attrs.clip.push(ClipAttrs {
+                thread_idx,
+                alpha_base_idx,
+            });
+        };
+
+        let mut cur_wtile_x = clip_bbox.x0();
+        let mut cur_wtile_y = clip_bbox.y0();
+        let mut pop_pending = false;
+
+        // Process each strip to determine the clipping state for each tile
+        for i in 0..n_strips.saturating_sub(1) {
+            let strip = &strips[i];
+            let strip_y = strip.strip_y();
+
+            // Skip strips before current tile row
+            if strip_y < cur_wtile_y {
+                continue;
+            }
+
+            // Process tiles in rows before this strip's row
+            // These tiles all had zero-winding clips
+            while cur_wtile_y < strip_y.min(clip_bbox.y1()) {
+                // Handle any pending clip pop from previous iteration
+                if core::mem::take(&mut pop_pending) {
+                    self.get_mut(cur_wtile_x, cur_wtile_y).pop_clip();
+                    cur_wtile_x += 1;
+                }
+
+                // Pop zero clips for all remaining tiles in this row
+                for wtile_x in cur_wtile_x..clip_bbox.x1() {
+                    self.get_mut(wtile_x, cur_wtile_y).pop_zero_clip();
+                }
+                cur_wtile_x = clip_bbox.x0();
+                cur_wtile_y += 1;
+            }
+
+            // If we've reached the bottom of the clip bounding box, stop processing
+            // Note that we are explicitly checking >= instead of ==, so that we abort if the clipping box
+            // is zero-area (see issue 1072).
+            if cur_wtile_y >= clip_bbox.y1() {
+                break;
+            }
+
+            // Process tiles to the left of this strip in the same row
+            let x0 = strip.x;
+            let wtile_x_clamped = (x0 / WideTile::WIDTH).min(clip_bbox.x1());
+            if cur_wtile_x < wtile_x_clamped {
+                // Handle any pending clip pop from previous iteration
+                if core::mem::take(&mut pop_pending) {
+                    self.get_mut(cur_wtile_x, cur_wtile_y).pop_clip();
+                    cur_wtile_x += 1;
+                }
+
+                // Pop zero clips for tiles that had zero winding or didn't match fill rule
+                // TODO: The winding check is probably not needed; if there was a fill,
+                // the logic below should have advanced wtile_x.
+                let is_inside = strip.fill_gap();
+                if !is_inside {
+                    for wtile_x in cur_wtile_x..wtile_x_clamped {
+                        self.get_mut(wtile_x, cur_wtile_y).pop_zero_clip();
+                    }
+                }
+                cur_wtile_x = wtile_x_clamped;
+            }
+
+            // Process tiles covered by the strip - render clip content and pop
+            let next_strip = &strips[i + 1];
+            let strip_width =
+                ((next_strip.alpha_idx() - strip.alpha_idx()) / u32::from(Tile::HEIGHT)) as u16;
+            let mut clipped_x1 = x0 + strip_width;
+            let wtile_x0 = (x0 / WideTile::WIDTH).max(clip_bbox.x0());
+            let wtile_x1 = clipped_x1.div_ceil(WideTile::WIDTH).min(clip_bbox.x1());
+
+            // Calculate starting position and column for alpha mask
+            let mut x = x0;
+            let mut col = strip.alpha_idx() / u32::from(Tile::HEIGHT);
+            let clip_x = clip_bbox.x0() * WideTile::WIDTH;
+            if clip_x > x {
+                col += u32::from(clip_x - x);
+                x = clip_x;
+                clipped_x1 = clip_x.max(clipped_x1);
+            }
+
+            // Render clip strips for each affected tile and mark for popping
+            for wtile_x in wtile_x0..wtile_x1 {
+                // If we've moved past tile_x and have a pending pop, do it now
+                if cur_wtile_x < wtile_x && core::mem::take(&mut pop_pending) {
+                    self.get_mut(cur_wtile_x, cur_wtile_y).pop_clip();
+                }
+
+                // Calculate the portion of the strip that affects this tile
+                let x_rel = x % WideTile::WIDTH;
+                let width = clipped_x1.min((wtile_x + 1) * WideTile::WIDTH) - x;
+
+                // Create clip strip command for rendering the partial coverage
+                let cmd = CmdClipAlphaFill {
+                    x: x_rel,
+                    width,
+                    alpha_offset: col * u32::from(Tile::HEIGHT) - alpha_base_idx,
+                    attrs_idx: clip_attrs_idx,
+                };
+                x += width;
+                col += u32::from(width);
+
+                // Apply the clip strip command and update state
+                self.get_mut(wtile_x, cur_wtile_y).clip_strip(cmd);
+                cur_wtile_x = wtile_x;
+
+                // Only request a pop if the x coordinate is actually inside the bounds.
+                if cur_wtile_x < clip_bbox.x1() {
+                    pop_pending = true;
+                }
+            }
+
+            // Handle fill regions between strips based on fill rule
+            let is_inside = next_strip.fill_gap();
+            if is_inside && strip_y == next_strip.strip_y() {
+                if cur_wtile_x >= clip_bbox.x1() {
+                    continue;
+                }
+
+                let x2 = next_strip.x;
+                let clipped_x2 = x2.min((cur_wtile_x + 1) * WideTile::WIDTH);
+                let width = clipped_x2.saturating_sub(clipped_x1);
+
+                // If there's a gap, fill it. Only do this if the fill wouldn't cover the
+                // whole tile, as such clips are skipped by the `push_clip` function. See
+                // <https://github.com/linebender/vello/blob/de0659e4df9842c8857153841a2b4ba6f1020bb0/sparse_strips/vello_common/src/coarse.rs#L504-L516>
+                if width > 0 && width < WideTile::WIDTH {
+                    let x_rel = clipped_x1 % WideTile::WIDTH;
+                    self.get_mut(cur_wtile_x, cur_wtile_y)
+                        .clip_fill(x_rel, width);
+                }
+
+                // If the next strip is a sentinel, skip the fill
+                // It's a sentinel in the row if there is non-zero winding for the sparse fill
+                // Look more into this in the strip.rs render function
+                if x2 == u16::MAX {
+                    continue;
+                }
+
+                // If fill extends to next tile, pop current and handle next
+                if x2 > (cur_wtile_x + 1) * WideTile::WIDTH {
+                    if core::mem::take(&mut pop_pending) {
+                        self.get_mut(cur_wtile_x, cur_wtile_y).pop_clip();
+                    }
+
+                    let width2 = x2 % WideTile::WIDTH;
+                    cur_wtile_x = x2 / WideTile::WIDTH;
+
+                    // If the strip is outside the clipping box, we don't need to do any
+                    // filling, so we continue (also to prevent out-of-bounds access).
+                    if cur_wtile_x >= clip_bbox.x1() {
+                        continue;
+                    }
+
+                    if width2 > 0 {
+                        // An important thing to note: Note that we are only applying
+                        // `clip_fill` to the wide tile that is actually covered by the next
+                        // strip, and not the ones in-between! For example, if the first strip
+                        // is in wide tile 1 and the second in wide tile 4, we will do a clip
+                        // fill in wide tile 1 and 4, but not in 2 and 3. The reason for this is
+                        // that any tile in-between is fully covered and thus no clipping is
+                        // necessary at all. See also the `push_clip` function, where we don't
+                        // push a new buffer for such tiles.
+                        self.get_mut(cur_wtile_x, cur_wtile_y).clip_fill(0, width2);
+                    }
+                }
+            }
+        }
+
+        // Handle any pending clip pop from the last iteration
+        if core::mem::take(&mut pop_pending) {
+            self.get_mut(cur_wtile_x, cur_wtile_y).pop_clip();
+            cur_wtile_x += 1;
+        }
+
+        // Process any remaining tiles in the bounding box (all zero-winding)
+        while cur_wtile_y < clip_bbox.y1() {
+            for wtile_x in cur_wtile_x..clip_bbox.x1() {
+                self.get_mut(wtile_x, cur_wtile_y).pop_zero_clip();
+            }
+            cur_wtile_x = clip_bbox.x0();
+            cur_wtile_y += 1;
+        }
+    }
+}
+
+/// A wide tile.
+#[derive(Debug)]
+pub struct WideTile<const MODE: u8 = MODE_CPU> {
+    /// The x coordinate of the wide tile.
+    pub x: u16,
+    /// The y coordinate of the wide tile.
+    pub y: u16,
+    /// The background of the tile.
+    pub bg: PremulColor,
+    /// The draw commands of the tile.
+    pub cmds: Vec<Cmd>,
+    /// The number of zero-winding clips.
+    n_zero_clip: usize,
+    /// The number of non-zero-winding clips.
+    n_clip: usize,
+    /// The number of pushed buffers, including buffers for clips.
+    ///
+    /// Note not all layers require their own buffers; see [`Layer::needs_buf`].
+    n_bufs: usize,
+    /// True when this tile is in a filtered layer with clipping applied.
+    /// When set, clip operations generate explicit commands instead of just
+    /// tracking counters, allowing filters to process clipped content correctly.
+    in_clipped_filter_layer: bool,
+    /// Maps layer Id to command ranges for this tile.
+    pub layer_cmd_ranges: HashMap<LayerId, LayerCommandRanges>,
+    /// Vector of layer IDs this tile participates in.
+    layer_ids: Vec<LayerKind>,
+    /// Tracks the index into `cmds` of each `Start`/`PushBuf` command on the current stack.
+    ///
+    /// Only used in `HYBRID` mode.
+    push_buf_indices: Vec<usize>,
+    /// Whether at least one filter layer has been pushed on this tile.
+    had_filter_layer: bool,
+    /// Indicates whether the main target surface is used as a blend target for a non
+    /// src-over blending operation.
+    ///
+    /// This will only be set in `HYBRID` mode.
+    surface_is_blend_target: bool,
+    /// Watermark: the batch count at which this tile last emitted `BatchEnd` markers.
+    /// Only meaningful in `MODE_HYBRID`.
+    last_batch_end: u32,
+}
+
+impl WideTile {
+    /// The width of a wide tile in pixels.
+    pub const WIDTH: u16 = 256;
+    /// The maximum coordinate of a wide tile.
+    pub const MAX_WIDE_TILE_COORD: u16 = u16::MAX / Self::WIDTH;
+}
+
+impl WideTile<MODE_CPU> {
+    /// Create a new wide tile.
+    pub fn new(width: u16, height: u16) -> Self {
+        Self::new_internal(width, height)
+    }
+}
+
+impl WideTile<MODE_HYBRID> {
+    /// Create a new wide tile.
+    pub fn new(width: u16, height: u16) -> Self {
+        Self::new_internal(width, height)
+    }
+}
+
+impl<const MODE: u8> WideTile<MODE> {
+    /// Create a new wide tile.
+    fn new_internal(x: u16, y: u16) -> Self {
+        let mut layer_cmd_ranges = HashMap::new();
+        layer_cmd_ranges.insert(0, LayerCommandRanges::default());
+        Self {
+            x,
+            y,
+            bg: PremulColor::from_alpha_color(TRANSPARENT),
+            cmds: vec![],
+            n_zero_clip: 0,
+            n_clip: 0,
+            n_bufs: 0,
+            in_clipped_filter_layer: false,
+            had_filter_layer: false,
+            layer_cmd_ranges,
+            layer_ids: vec![LayerKind::Regular(0)],
+            push_buf_indices: vec![TARGET_SURFACE_PUSH_BUF_IDX],
+            surface_is_blend_target: false,
+            last_batch_end: 0,
+        }
+    }
+
+    #[inline]
+    fn reset(&mut self) {
+        self.bg = PremulColor::from_alpha_color(TRANSPARENT);
+        self.cmds.clear();
+        self.n_zero_clip = 0;
+        self.n_clip = 0;
+        self.n_bufs = 0;
+        self.in_clipped_filter_layer = false;
+        self.had_filter_layer = false;
+        self.layer_ids.truncate(1);
+        self.layer_cmd_ranges.clear();
+        self.layer_cmd_ranges
+            .insert(0, LayerCommandRanges::default());
+        self.push_buf_indices.clear();
+        // We can't use 0 here, because then we have no way of distinguishing it from a
+        // user-supplied `PushBuf` at position 0.
+        self.push_buf_indices.push(TARGET_SURFACE_PUSH_BUF_IDX);
+        self.surface_is_blend_target = false;
+        self.last_batch_end = 0;
+    }
+
+    /// Push all layer buffers that have not yet been pushed for this tile.
+    /// Also emit `BatchEnd` commands in case we are in HYBRID mode.
+    ///
+    /// We push wide tile layer buffers lazily. This is called by wide tile draw methods to ensure
+    /// all layer stack buffers are pushed for the wide tile. Calling this multiple times won't
+    /// push additional buffers beyond the first call (until the layer stack changes).
+    ///
+    /// The `tile_idx` parameter is this tile's index in [`Wide::tiles`].
+    #[inline(always)]
+    fn ensure_layer_stack_bufs(
+        &mut self,
+        tile_idx: usize,
+        layers: &mut NeedsBufLayerStack,
+        batch_count: u32,
+    ) {
+        // First emit `BatchEnd` commands if necessary.
+        if MODE == MODE_HYBRID && self.last_batch_end < batch_count {
+            let count = (batch_count - self.last_batch_end) as usize;
+            self.cmds.extend(core::iter::repeat_n(Cmd::BatchEnd, count));
+            self.last_batch_end = batch_count;
+        }
+
+        // Then, take care of emitting `PushBuf` commands that haven't been emitted yet.
+
+        // `layers` tracks the number of layers that require scratch buffers, excluding those
+        // required for clips: clip buffers are handled separately. The scratch buffer stack for
+        // this tile is `self.n_bufs`, of which `self.n_clip` are for clips.
+        let layer_bufs = self.n_bufs - self.n_clip;
+        debug_assert!(
+            layer_bufs <= layers.len,
+            "tile `layer_buf_depth` exceeds active layer stack"
+        );
+        // It may be quite likely that no buffers need to be pushed: e.g. a tile that has content
+        // may well have more than one call to `ensure_layer_stack_bufs`, and layers needing
+        // buffers are not necessarily the most common case. As such, we keep this check inlined
+        // (because the function itself is inlined), and if buffers are needed do an explicit
+        // function call that is not inlined. That keeps the generated code size small at our call
+        // sites.
+        (layer_bufs < layers.len).then(
+            #[inline(never)]
+            || {
+                for layer in &mut layers.stack[layer_bufs..layers.len] {
+                    layer.occupied_tiles.push(tile_idx);
+                    self.push_buf(layer.kind);
+                }
+            },
+        );
+    }
+
+    /// Fill a rectangular region with a paint.
+    ///
+    /// Generates fill commands unless the tile is in a zero-clip region (fully clipped out).
+    /// For clipped filter layers, commands are always generated since filters need the full
+    /// layer content rendered before applying the clip as a mask.
+    ///
+    /// The `fill_hint` parameter is pre-computed by the caller based on paint type:
+    /// - `OpaqueSolid(color)`: Paint is an opaque solid color, can replace background
+    /// - `OpaqueImage`: Paint is an opaque image, can clear previous commands
+    /// - `None`: No optimization available
+    fn fill(
+        &mut self,
+        batch_count: u32,
+        tile_idx: usize,
+        layers: &mut NeedsBufLayerStack,
+        x: u16,
+        width: u16,
+        attrs_idx: u32,
+        current_layer_id: LayerId,
+        fill_hint: FillHint,
+    ) {
+        if !self.is_zero_clip() || self.in_clipped_filter_layer {
+            self.ensure_layer_stack_bufs(tile_idx, layers, batch_count);
+
+            // Check if we can apply overdraw elimination optimization.
+            // This requires filling the entire tile width with no clip/buffer stack.
+            //
+            // Note that we could be more aggressive in optimizing a whole-tile opaque fill
+            // even with a clip stack. It would be valid to elide all drawing commands from
+            // the enclosing clip push up to the fill. Further, we could extend the clip
+            // push command to include a background color, rather than always starting with
+            // a transparent buffer. Lastly, a sequence of push(bg); strip/fill; pop could
+            // be replaced with strip/fill with the color (the latter is true even with a
+            // non-opaque color).
+            //
+            // However, the extra cost of tracking such optimizations may outweigh the
+            // benefit, especially in hybrid mode with GPU painting.
+
+            let can_override = x == 0
+                && width == WideTile::WIDTH
+                && self.n_clip == 0
+                && self.n_bufs == 0
+                // TODO: Relax this condition to only trigger for filter graphs that contain at
+                // least 1 primitive filter that has non-local effects (see
+                // https://github.com/linebender/vello/pull/1526#discussion_r3007377869)
+                && !self.had_filter_layer;
+
+            if can_override {
+                match fill_hint {
+                    FillHint::OpaqueSolid(color) => {
+                        self.cmds.clear();
+                        self.bg = color;
+
+                        // We need to invalidate the ranges of all layers that have been drawn so far
+                        // in that wide tile.
+                        self.layer_cmd_ranges.clear();
+                        self.layer_cmd_ranges
+                            .insert(current_layer_id, LayerCommandRanges::default());
+                        return;
+                    }
+                    FillHint::OpaqueImage => {
+                        // Opaque image: clear previous commands but still emit the fill.
+                        self.cmds.clear();
+                        self.bg = PremulColor::from_alpha_color(TRANSPARENT);
+
+                        // We need to invalidate the ranges of all layers that have been drawn so far
+                        // in that wide tile.
+                        self.layer_cmd_ranges.clear();
+                        self.layer_cmd_ranges
+                            .insert(current_layer_id, LayerCommandRanges::default());
+                        // Fall through to emit the fill command below, as opposed to
+                        // solid paints where we have a return statement.
+                    }
+                    FillHint::None => {}
+                }
+            }
+
+            self.record_fill_cmd(current_layer_id, self.cmds.len());
+            self.cmds.push(Cmd::Fill(CmdFill {
+                x,
+                width,
+                attrs_idx,
+            }));
+        }
+    }
+
+    /// Fill a region using an alpha mask from a strip.
+    ///
+    /// Generates alpha fill commands unless the tile is in a zero-clip region (fully clipped out).
+    /// For clipped filter layers, commands are always generated since filters need the full
+    /// layer content rendered before applying the clip as a mask.
+    fn strip(
+        &mut self,
+        batch_count: u32,
+        tile_idx: usize,
+        layers: &mut NeedsBufLayerStack,
+        cmd_strip: CmdAlphaFill,
+        current_layer_id: LayerId,
+    ) {
+        if !self.is_zero_clip() || self.in_clipped_filter_layer {
+            self.ensure_layer_stack_bufs(tile_idx, layers, batch_count);
+
+            self.record_fill_cmd(current_layer_id, self.cmds.len());
+            self.cmds.push(Cmd::AlphaFill(cmd_strip));
+        }
+    }
+
+    /// Adds a new clip region to the current wide tile.
+    ///
+    /// Pushes a clip buffer unless the tile is in a zero-clip region (fully clipped out).
+    /// For clipped filter layers, clip buffers are always pushed since filters need explicit
+    /// clip state to process the full layer before applying the clip as a mask.
+    fn push_clip(
+        &mut self,
+        tile_idx: usize,
+        layers: &mut NeedsBufLayerStack,
+        layer_id: LayerId,
+        batch_count: u32,
+    ) {
+        if !self.is_zero_clip() || self.in_clipped_filter_layer {
+            self.ensure_layer_stack_bufs(tile_idx, layers, batch_count);
+            self.push_buf(LayerKind::Clip(layer_id));
+            self.n_clip += 1;
+        }
+    }
+
+    /// Removes the most recently added clip region from the current wide tile.
+    ///
+    /// Pops a clip buffer unless the tile is in a zero-clip region (fully clipped out).
+    /// For clipped filter layers, clip buffers are always popped since filters need explicit
+    /// clip state to process the full layer before applying the clip as a mask.
+    fn pop_clip(&mut self) {
+        if !self.is_zero_clip() || self.in_clipped_filter_layer {
+            self.pop_buf();
+            self.n_clip -= 1;
+        }
+    }
+
+    /// Adds a zero-winding clip region to the stack.
+    ///
+    /// Zero-winding clips represent tiles completely outside the clip path.
+    /// Normally these just increment a counter to suppress drawing, but for
+    /// clipped filter layers we generate explicit commands so filters can
+    /// process the entire layer before applying the clip as a mask.
+    fn push_zero_clip(&mut self, layer_id: LayerId) {
+        if self.in_clipped_filter_layer {
+            // Generate explicit command for filter processing
+            self.cmds.push(Cmd::PushZeroClip(layer_id));
+        }
+        self.n_zero_clip += 1;
+    }
+
+    /// Removes the most recently added zero-winding clip region.
+    fn pop_zero_clip(&mut self) {
+        if self.in_clipped_filter_layer {
+            // Generate explicit command for filter processing
+            self.cmds.push(Cmd::PopZeroClip);
+        }
+        self.n_zero_clip -= 1;
+    }
+
+    /// Checks if the current clip region is a zero-winding clip.
+    fn is_zero_clip(&mut self) -> bool {
+        self.n_zero_clip > 0
+    }
+
+    /// Applies a clip strip operation with the given parameters.
+    ///
+    /// Note: Unlike content operations (`strip`, `push_clip`, etc.), clip operations don't need
+    /// the `|| self.in_clipped_filter_layer` check. Filter effects need full layer *content*
+    /// rendered (even in zero-clip areas).
+    fn clip_strip(&mut self, cmd_clip_strip: CmdClipAlphaFill) {
+        if (!self.is_zero_clip()) && !matches!(self.cmds.last(), Some(Cmd::PushBuf(..))) {
+            self.cmds.push(Cmd::ClipStrip(cmd_clip_strip));
+        }
+    }
+
+    /// Applies a clip fill operation at the specified position and width.
+    fn clip_fill(&mut self, x: u16, width: u16) {
+        if (!self.is_zero_clip()) && !matches!(self.cmds.last(), Some(Cmd::PushBuf(..))) {
+            self.cmds.push(Cmd::ClipFill(CmdClipFill { x, width }));
+        }
+    }
+
+    /// Records the fill command for a specific layer.
+    fn record_fill_cmd(&mut self, layer_id: LayerId, cmd_idx: usize) {
+        self.layer_cmd_ranges.entry(layer_id).and_modify(|ranges| {
+            ranges.full_range.end = cmd_idx + 1;
+            if ranges.render_range.is_empty() {
+                ranges.render_range = cmd_idx..cmd_idx + 1;
+            } else {
+                ranges.render_range.end = cmd_idx + 1;
+            }
+        });
+    }
+
+    /// Whether the set of pushed commands so far indicates that the surface is used as
+    /// a blend target.
+    pub fn surface_is_blend_target(&self) -> bool {
+        self.surface_is_blend_target
+    }
+
+    /// Push a buffer for a new layer.
+    ///
+    /// Different layer kinds are handled differently:
+    /// - Regular layers: Use local `blend_buf` stack for temporary storage
+    /// - Filtered layers: Materialized in persistent layer storage for filter processing
+    /// - Clip layers: Special handling for clipping operations
+    #[inline(always)]
+    fn push_buf(&mut self, layer_kind: LayerKind) {
+        let top_layer = layer_kind.id();
+        if matches!(layer_kind, LayerKind::Filtered(_)) {
+            self.layer_cmd_ranges.insert(
+                top_layer,
+                LayerCommandRanges {
+                    full_range: self.cmds.len()..self.cmds.len() + 1,
+                    // Start with empty render_range; will be updated by `record_fill_cmd` and `pop_buf`.
+                    render_range: self.cmds.len() + 1..self.cmds.len() + 1,
+                },
+            );
+        } else if matches!(layer_kind, LayerKind::Clip(_)) {
+            self.layer_cmd_ranges.entry(top_layer).and_modify(|ranges| {
+                ranges.full_range.end = self.cmds.len() + 1;
+                // Start with empty render_range; will be updated by `record_fill_cmd` and `pop_buf`.
+                ranges.render_range = self.cmds.len() + 1..self.cmds.len() + 1;
+            });
+        }
+
+        if MODE == MODE_HYBRID {
+            self.push_buf_indices.push(self.cmds.len());
+        }
+
+        self.cmds.push(Cmd::PushBuf(layer_kind, false));
+        self.layer_ids.push(layer_kind);
+        self.n_bufs += 1;
+    }
+
+    /// Pop the most recent buffer.
+    #[inline(always)]
+    fn pop_buf(&mut self) {
+        if MODE == MODE_HYBRID {
+            self.push_buf_indices.pop();
+        }
+
+        let top_layer = self.layer_ids.pop().unwrap();
+        let mut next_layer = *self.layer_ids.last().unwrap();
+
+        if matches!(self.cmds.last(), Some(&Cmd::PushBuf(..))) {
+            // Optimization: If no drawing happened between the last `PushBuf`,
+            // we can just pop it instead.
+            self.cmds.pop();
+        } else {
+            self.layer_cmd_ranges
+                .entry(top_layer.id())
+                .and_modify(|ranges| {
+                    ranges.full_range.end = self.cmds.len() + 1;
+                });
+            if top_layer.id() == next_layer.id() {
+                next_layer = *self
+                    .layer_ids
+                    .get(self.layer_ids.len().saturating_sub(2))
+                    .unwrap();
+            }
+
+            self.layer_cmd_ranges
+                .entry(next_layer.id())
+                .and_modify(|ranges| {
+                    ranges.full_range.end = self.cmds.len() + 1;
+                    ranges.render_range.end = self.cmds.len() + 1;
+                });
+            self.cmds.push(Cmd::PopBuf);
+        }
+        self.n_bufs -= 1;
+    }
+
+    /// Apply an opacity to the whole buffer.
+    fn opacity(&mut self, opacity: f32) {
+        if opacity != 1.0 {
+            self.cmds.push(Cmd::Opacity(opacity));
+        }
+    }
+
+    /// Apply a filter effect to the whole buffer.
+    pub fn filter(&mut self, layer_id: LayerId, filter: Filter) {
+        self.had_filter_layer = true;
+        self.cmds.push(Cmd::Filter(layer_id, filter));
+    }
+
+    /// Apply a mask to the whole buffer.
+    fn mask(&mut self, mask: Mask) {
+        self.cmds.push(Cmd::Mask(mask));
+    }
+
+    /// Blend the current buffer into the previous buffer in the stack.
+    fn blend(&mut self, blend_mode: BlendMode) {
+        #[allow(clippy::collapsible_if, reason = "better expresses intent")]
+        if MODE == MODE_HYBRID {
+            // Whether we use a non-default blend mode to blend into the destination.
+            let blends_into_dest =
+                blend_mode.mix != Mix::Normal || blend_mode.compose != Compose::SrcOver;
+
+            if blends_into_dest && self.push_buf_indices.len() >= 2 {
+                let nos_idx = self.push_buf_indices[self.push_buf_indices.len() - 2];
+
+                if nos_idx == TARGET_SURFACE_PUSH_BUF_IDX {
+                    self.surface_is_blend_target = true;
+                } else {
+                    match &mut self.cmds[nos_idx] {
+                        Cmd::PushBuf(_, is_blend_target) => *is_blend_target = true,
+                        // Anything else shouldn't be possible.
+                        _ => unreachable!(),
+                    }
+                }
+            }
+        }
+
+        self.cmds.push(Cmd::Blend(blend_mode));
+    }
+}
+
+/// Debug utilities for wide tiles.
+///
+/// These methods are only available in debug builds (`debug_assertions`).
+/// They provide introspection into the command buffer for debugging and logging purposes.
+#[cfg(debug_assertions)]
+impl<const MODE: u8> WideTile<MODE> {
+    /// Lists all commands in this wide tile with their indices and names.
+    ///
+    /// Returns a formatted string with each command on a new line, showing its index
+    /// and human-readable name. This is useful for debugging and understanding the
+    /// command sequence.
+    ///
+    /// # Example
+    ///
+    /// ```ignore
+    /// let commands = wide_tile.list_commands();
+    /// println!("{}", commands);
+    /// // Output:
+    /// // 0: PushBuf(Regular)
+    /// // 1: FillPath
+    /// // 2: PushZeroClip
+    /// // 3: FillPath
+    /// // 4: PopBuf
+    /// ```
+    #[allow(dead_code, reason = "useful for debugging")]
+    pub fn list_commands(&self) -> String {
+        self.cmds
+            .iter()
+            .enumerate()
+            .map(|(i, cmd)| format!("{}: {}", i, cmd.name()))
+            .collect::<Vec<_>>()
+            .join("\n")
+    }
+}
+
+/// Optimization hint for fill operations, computed in `Wide::generate` and passed to `WideTile::fill`.
+///
+/// This enum communicates whether a fill operation can benefit from overdraw elimination:
+/// - For opaque solid colors: we can set the background color directly and skip the fill
+/// - For opaque images: we can clear previous commands but still need to emit the fill
+#[derive(Debug, Clone, Copy)]
+pub enum FillHint {
+    /// No optimization possible, emit fill command normally.
+    None,
+    /// Paint is an opaque solid color - can replace background if conditions are met.
+    OpaqueSolid(PremulColor),
+    /// Paint is an opaque image - can clear previous commands if conditions are met.
+    OpaqueImage,
+}
+
+/// Distinguishes between different types of layers and their storage strategies.
+///
+/// Each layer kind determines how the layer's content is stored and processed:
+/// - Regular layers are blended on-the-fly using a temporary buffer stack
+/// - Filtered layers are materialized in persistent storage for filter processing
+/// - Clip layers are special buffers used for clipping operations
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum LayerKind {
+    /// Regular layer using local `blend_buf` stack for temporary storage.
+    Regular(LayerId),
+    /// Filtered layer materialized in persistent `layer_manager` storage.
+    Filtered(LayerId),
+    /// Clip layer for clipping operations.
+    Clip(LayerId),
+}
+
+impl LayerKind {
+    /// Get the underlying layer ID.
+    ///
+    /// All layer kinds contain a layer ID that uniquely identifies the layer.
+    pub fn id(&self) -> LayerId {
+        match self {
+            Self::Regular(id) | Self::Filtered(id) | Self::Clip(id) => *id,
+        }
+    }
+}
+
+/// A drawing command for wide tiles.
+///
+/// Commands are executed in order to render the final image. They include
+/// drawing operations (`Fill`, `AlphaFill`), layer management (`PushBuf`, `PopBuf`),
+/// clipping operations (`ClipFill`, `ClipStrip`), and post-processing effects
+/// (`Filter`, `Blend`, `Opacity`, `Mask`).
+#[derive(Clone, Debug, PartialEq)]
+pub enum Cmd {
+    /// Fill a rectangular region with a solid color or paint.
+    Fill(CmdFill),
+    /// Fill a region with a paint, modulated by an alpha mask.
+    AlphaFill(CmdAlphaFill),
+    /// Pushes a new buffer for drawing.
+    /// Regular layers use the local `blend_buf` stack.
+    /// Filtered layers are materialized in persistent layer storage.
+    ///
+    /// The second argument indicates whether the layer that is about to be pushed
+    /// will be used as a destination for a blending operation with a non-default blend mode.
+    /// This information is only needed by `vello_hybrid` for scheduling purposes.
+    PushBuf(LayerKind, bool),
+    /// Pops the most recent buffer and blends it into the previous buffer.
+    PopBuf,
+    /// A fill command within a clipping region.
+    ///
+    /// This command will blend the contents of the current buffer within the clip fill region
+    /// into the previous buffer in the stack.
+    ClipFill(CmdClipFill),
+    /// A fill command with alpha mask within a clipping region.
+    ///
+    /// This command will blend the contents of the current buffer within the clip fill region
+    /// into the previous buffer in the stack, with an additional alpha mask.
+    ClipStrip(CmdClipAlphaFill),
+    /// Marks entry into a zero-winding clip region for a clipped filter layer.
+    ///
+    /// Zero-winding clips represent tiles completely outside the clip path. For clipped
+    /// filter layers, this command allows the filter to process the full layer content
+    /// before applying the clip as a mask (per SVG spec: filter → clip → mask → blend).
+    PushZeroClip(LayerId),
+    /// Marks exit from a zero-winding clip region for a clipped filter layer.
+    PopZeroClip,
+    /// Apply a filter effect to a layer's contents.
+    ///
+    /// This command applies a filter (e.g., blur, drop shadow) to the specified layer's
+    /// rendered content. Per the SVG specification, filters are applied before clipping,
+    /// masking, blending, and opacity operations.
+    Filter(LayerId, Filter),
+    /// Blend the current buffer into the previous buffer.
+    ///
+    /// This command blends the contents of the current buffer into the previous buffer
+    /// using the specified blend mode (e.g., multiply, screen, overlay).
+    Blend(BlendMode),
+    /// Apply uniform opacity to the current buffer.
+    ///
+    /// Multiplies the alpha channel of all pixels in the buffer by the given opacity value.
+    Opacity(f32),
+    /// Apply a mask to the current buffer.
+    ///
+    /// Modulates the alpha channel of the buffer using the provided mask.
+    Mask(Mask),
+    /// Marks a boundary between rendering fast path strips and coarse rasterized strips.
+    ///
+    /// Only meaningful in `MODE_HYBRID`.
+    // TODO: Consider removing this, see https://github.com/linebender/vello/pull/1479#discussion_r2869917343.
+    BatchEnd,
+}
+
+#[cfg(debug_assertions)]
+impl Cmd {
+    /// Returns a human-readable name for this command.
+    ///
+    /// This is useful for debugging, logging, and displaying command information
+    /// in a user-friendly format. To get detailed paint information, use `name_with_attrs`
+    /// which can look up the paint from the command attributes.
+    ///
+    /// **Note:** This method is only available in debug builds (`debug_assertions`).
+    pub fn name(&self) -> &'static str {
+        match self {
+            Self::Fill(_) => "FillPath",
+            Self::AlphaFill(_) => "AlphaFillPath",
+            Self::PushBuf(layer_kind, needs_temp) => match (layer_kind, needs_temp) {
+                (LayerKind::Regular(_), false) => "PushBuf(Regular, false)",
+                (LayerKind::Regular(_), true) => "PushBuf(Regular, true)",
+                (LayerKind::Filtered(_), false) => "PushBuf(Filtered, false)",
+                (LayerKind::Filtered(_), true) => "PushBuf(Filtered, true)",
+                (LayerKind::Clip(_), false) => "PushBuf(Clip, false)",
+                (LayerKind::Clip(_), true) => "PushBuf(Clip, true)",
+            },
+            Self::PopBuf => "PopBuf",
+            Self::ClipFill(_) => "ClipPathFill",
+            Self::ClipStrip(_) => "ClipPathStrip",
+            Self::PushZeroClip(_) => "PushZeroClip",
+            Self::PopZeroClip => "PopZeroClip",
+            Self::Filter(_, _) => "Filter",
+            Self::Blend(_) => "Blend",
+            Self::Opacity(_) => "Opacity",
+            Self::Mask(_) => "Mask",
+            Self::BatchEnd => "BatchEnd",
+        }
+    }
+
+    /// Returns a human-readable name for this command with detailed paint information.
+    ///
+    /// This variant looks up paint details from the command attributes for fill commands.
+    ///
+    /// **Note:** This method is only available in debug builds (`debug_assertions`).
+    pub fn name_with_attrs(
+        &self,
+        fill_attrs: &[FillAttrs],
+        encoded_paints: &[EncodedPaint],
+    ) -> String {
+        match self {
+            Self::Fill(cmd) => {
+                if let Some(attrs) = fill_attrs.get(cmd.attrs_idx as usize) {
+                    format!("FillPath({})", paint_name(&attrs.paint, encoded_paints))
+                } else {
+                    format!("FillPath(attrs_idx={})", cmd.attrs_idx)
+                }
+            }
+            Self::AlphaFill(cmd) => {
+                if let Some(attrs) = fill_attrs.get(cmd.attrs_idx as usize) {
+                    format!(
+                        "AlphaFillPath({})",
+                        paint_name(&attrs.paint, encoded_paints)
+                    )
+                } else {
+                    format!("AlphaFillPath(attrs_idx={})", cmd.attrs_idx)
+                }
+            }
+            _ => self.name().into(),
+        }
+    }
+}
+
+/// Returns a human-readable description of a paint.
+#[cfg(debug_assertions)]
+fn paint_name(paint: &Paint, encoded_paints: &[EncodedPaint]) -> String {
+    match paint {
+        Paint::Solid(color) => {
+            let rgba = color.as_premul_rgba8();
+            format!(
+                "Solid(#{:02x}{:02x}{:02x}{:02x})",
+                rgba.r, rgba.g, rgba.b, rgba.a
+            )
+        }
+        Paint::Indexed(idx) => {
+            let index = idx.index();
+            if let Some(encoded) = encoded_paints.get(index) {
+                let kind = match encoded {
+                    EncodedPaint::Gradient(g) => match &g.kind {
+                        crate::encode::EncodedKind::Linear(_) => "LinearGradient",
+                        crate::encode::EncodedKind::Radial(_) => "RadialGradient",
+                        crate::encode::EncodedKind::Sweep(_) => "SweepGradient",
+                    },
+                    EncodedPaint::Image(_) => "Image",
+                    EncodedPaint::ExternalTexture(_) => "ExternalTexture",
+                    EncodedPaint::BlurredRoundedRect(_) => "BlurredRoundedRect",
+                };
+                format!("{}[{}]", kind, index)
+            } else {
+                format!("Indexed({})", index)
+            }
+        }
+    }
+}
+
+/// Shared attributes for alpha fill commands.
+#[derive(Debug, Clone, PartialEq)]
+pub struct FillAttrs {
+    /// The index of the thread that owns the alpha buffer
+    /// containing the mask values at `alpha_idx`.
+    /// Always 0 in single-threaded mode.
+    pub thread_idx: u8,
+    /// The paint (color, gradient, etc.) to fill the region with.
+    // TODO: Store premultiplied colors as indexed paints as well, to reduce
+    // memory overhead? Or get rid of indexed paints and inline all paints?
+    pub paint: Paint,
+    /// The blend mode to apply before drawing the contents.
+    pub blend_mode: BlendMode,
+    /// A mask to apply to the command.
+    pub mask: Option<Mask>,
+    /// Base index into the alpha buffer for this path's commands.
+    /// Commands store a relative offset that is added to this base.
+    alpha_base_idx: u32,
+}
+
+impl FillAttrs {
+    /// Compute the absolute alpha buffer index from a relative offset.
+    pub fn alpha_idx(&self, offset: u32) -> u32 {
+        self.alpha_base_idx + offset
+    }
+}
+
+/// Shared attributes for clip alpha fill commands.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ClipAttrs {
+    /// The index of the thread that owns the alpha buffer
+    /// containing the mask values at `alpha_idx`.
+    /// Always 0 in single-threaded mode.
+    pub thread_idx: u8,
+    /// Base index into the alpha buffer for this clip path's commands.
+    /// Commands store a relative offset that is added to this base.
+    alpha_base_idx: u32,
+}
+
+impl ClipAttrs {
+    /// Compute the absolute alpha buffer index from a relative offset.
+    pub fn alpha_idx(&self, offset: u32) -> u32 {
+        self.alpha_base_idx + offset
+    }
+}
+
+/// Container for shared command attributes.
+///
+/// This struct holds the shared attributes for fill and clip commands,
+/// allowing them to be passed together to functions that need both.
+#[derive(Debug, Default, Clone)]
+pub struct CommandAttrs {
+    /// Shared attributes for fill commands, indexed by `attrs_idx` in `CmdFill`/`CmdAlphaFill`.
+    pub fill: Vec<FillAttrs>,
+    /// Shared attributes for clip commands, indexed by `attrs_idx` in `CmdClipAlphaFill`.
+    pub clip: Vec<ClipAttrs>,
+}
+
+impl CommandAttrs {
+    /// Clear all attributes.
+    pub fn clear(&mut self) {
+        self.fill.clear();
+        self.clip.clear();
+    }
+}
+
+/// Fill a consecutive horizontal region of a wide tile.
+///
+/// This command fills a rectangular region with the specified paint.
+/// The region starts at x-coordinate `x` and extends for `width` pixels
+/// horizontally, spanning the full height of the wide tile.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct CmdFill {
+    /// The horizontal start position relative to the wide tile's left edge, in pixels.
+    pub x: u16,
+    /// The width of the filled region in pixels.
+    pub width: u16,
+    /// Index into the command attributes array.
+    pub attrs_idx: u32,
+}
+
+/// Fill a consecutive horizontal region with an alpha mask.
+///
+/// Similar to `CmdFill`, but modulates the paint by an alpha mask stored
+/// in a separate buffer. This is used for anti-aliased edges and partial
+/// coverage from path rasterization.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct CmdAlphaFill {
+    /// The horizontal start position relative to the wide tile's left edge, in pixels.
+    pub x: u16,
+    /// The width of the filled region in pixels.
+    pub width: u16,
+    /// Relative offset to the alpha buffer location.
+    /// Use `FillAttrs::alpha_idx(alpha_offset)` to compute the absolute index.
+    pub alpha_offset: u32,
+    /// Index into the command attributes array.
+    pub attrs_idx: u32,
+}
+
+/// Fill operation within a clipping region.
+///
+/// This command copies a horizontal region from the top of the clip buffer stack
+/// to the next buffer on the stack, effectively rendering the clipped content.
+/// Unlike `CmdFill`, this doesn't fill with a paint but transfers existing content.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct CmdClipFill {
+    /// The horizontal start position relative to the wide tile's left edge, in pixels.
+    pub x: u16,
+    /// The width of the region to copy in pixels.
+    pub width: u16,
+}
+
+/// Alpha-masked fill operation within a clipping region.
+///
+/// This command composites a horizontal region from the top of the clip buffer stack
+/// to the next buffer, modulated by an alpha mask. This is used for anti-aliased
+/// clip edges.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct CmdClipAlphaFill {
+    /// The horizontal start position relative to the wide tile's left edge, in pixels.
+    pub x: u16,
+    /// The width of the region to composite in pixels.
+    pub width: u16,
+    /// Relative offset to the alpha buffer location.
+    /// Use `ClipAttrs::alpha_idx(alpha_offset)` to compute the absolute index.
+    pub alpha_offset: u32,
+    /// Index into the clip attributes array.
+    pub attrs_idx: u32,
+}
+
+/// Ranges of commands for a specific layer in a specific tile.
+///
+/// This structure tracks two different ranges of commands:
+/// - The full range includes all layer operations (push, draw, pop)
+/// - The render range includes only the actual drawing commands
+#[derive(Debug, Clone, Default)]
+pub struct LayerCommandRanges {
+    /// Full range including `PushBuf`, all commands, and `PopBuf`.
+    pub full_range: Range<usize>,
+    /// Range containing only fill commands (`Fill`, `AlphaFill`).
+    /// This is the range to replace when sampling from a filtered layer.
+    pub render_range: Range<usize>,
+}
+
+impl LayerCommandRanges {
+    /// Clear the full range and render range.
+    #[inline]
+    pub fn clear(&mut self) {
+        self.full_range = 0..0;
+        self.render_range = 0..0;
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::coarse::{FillHint, LayerKind, MODE_CPU, NeedsBufLayerStack, Wide, WideTile};
+    use crate::kurbo::Affine;
+    use crate::paint::{Paint, PremulColor};
+    use crate::peniko;
+    use crate::peniko::{BlendMode, Compose, Mix};
+    use crate::render_graph::RenderGraph;
+    use crate::strip::Strip;
+    use alloc::{boxed::Box, vec};
+
+    #[test]
+    fn optimize_empty_layers() {
+        let mut wide = WideTile::<MODE_CPU>::new(0, 0);
+        wide.push_buf(LayerKind::Regular(0));
+        wide.pop_buf();
+
+        assert!(wide.cmds.is_empty());
+    }
+
+    #[test]
+    fn basic_layer() {
+        let mut wide = WideTile::<MODE_CPU>::new(0, 0);
+        let mut layers = NeedsBufLayerStack::default();
+        layers.push(LayerKind::Regular(0));
+        wide.push_buf(LayerKind::Regular(0));
+        wide.fill(0, 0, &mut layers, 0, 10, 0, 0, FillHint::None);
+        wide.fill(0, 0, &mut layers, 10, 10, 0, 0, FillHint::None);
+        wide.pop_buf();
+
+        assert_eq!(wide.cmds.len(), 4);
+    }
+
+    #[test]
+    fn dont_inline_blend_with_two_fills() {
+        let blend_mode = BlendMode::new(Mix::Lighten, Compose::SrcOver);
+
+        let mut wide = WideTile::<MODE_CPU>::new(0, 0);
+        let mut layers = NeedsBufLayerStack::default();
+        layers.push(LayerKind::Regular(0));
+        wide.push_buf(LayerKind::Regular(0));
+        wide.fill(0, 0, &mut layers, 0, 10, 0, 0, FillHint::None);
+        wide.fill(0, 0, &mut layers, 10, 10, 0, 0, FillHint::None);
+        wide.blend(blend_mode);
+        wide.pop_buf();
+
+        assert_eq!(wide.cmds.len(), 5);
+    }
+
+    #[test]
+    fn dont_inline_destructive_blend() {
+        let blend_mode = BlendMode::new(Mix::Lighten, Compose::Clear);
+
+        let mut wide = WideTile::<MODE_CPU>::new(0, 0);
+        let mut layers = NeedsBufLayerStack::default();
+        layers.push(LayerKind::Regular(0));
+        wide.push_buf(LayerKind::Regular(0));
+        wide.fill(0, 0, &mut layers, 0, 10, 0, 0, FillHint::None);
+        wide.blend(blend_mode);
+        wide.pop_buf();
+
+        assert_eq!(wide.cmds.len(), 4);
+    }
+
+    #[test]
+    fn tile_coordinates() {
+        let wide = Wide::<MODE_CPU>::new(1000, 258);
+
+        let tile_1 = wide.get(1, 3);
+        assert_eq!(tile_1.x, 256);
+        assert_eq!(tile_1.y, 12);
+
+        let tile_2 = wide.get(2, 15);
+        assert_eq!(tile_2.x, 512);
+        assert_eq!(tile_2.y, 60);
+    }
+
+    #[test]
+    fn reset_clears_layer_and_clip_stacks() {
+        type ClipPath = Option<Box<[Strip]>>;
+
+        let mut wide = Wide::<MODE_CPU>::new(1000, 258);
+        let mut render_graph = RenderGraph::new();
+        let no_clip_path: ClipPath = None;
+        wide.push_layer(
+            1,
+            no_clip_path,
+            BlendMode::default(),
+            None,
+            0.5,
+            None,
+            Affine::IDENTITY,
+            &mut render_graph,
+            0,
+        );
+
+        assert_eq!(wide.layer_stack.len(), 1);
+        assert_eq!(wide.clip_stack.len(), 0);
+
+        let strip = Strip::new(2, 2, 0, true);
+        let clip_path = Some(vec![strip].into_boxed_slice());
+        wide.push_layer(
+            2,
+            clip_path,
+            BlendMode::default(),
+            None,
+            0.09,
+            None,
+            Affine::IDENTITY,
+            &mut render_graph,
+            0,
+        );
+
+        assert_eq!(wide.layer_stack.len(), 2);
+        assert_eq!(wide.clip_stack.len(), 1);
+        assert_eq!(wide.tiles[0].n_bufs, 0);
+
+        wide.reset();
+
+        assert_eq!(wide.layer_stack.len(), 0);
+        assert_eq!(wide.clip_stack.len(), 0);
+        assert_eq!(wide.tiles[0].n_bufs, 0);
+    }
+
+    #[test]
+    fn tiles_dirty_flag() {
+        type ClipPath = Option<Box<[Strip]>>;
+
+        let mut wide = Wide::<MODE_CPU>::new(256, 4);
+        let mut render_graph = RenderGraph::new();
+
+        assert!(!wide.tiles_dirty);
+
+        let strips = [Strip::new(0, 0, 0, false), Strip::new(10, 0, 4, true)];
+        wide.generate(
+            &strips,
+            Paint::Solid(PremulColor::from_alpha_color(
+                peniko::color::palette::css::RED,
+            )),
+            BlendMode::default(),
+            0,
+            None,
+            &[],
+        );
+        assert!(wide.tiles_dirty);
+
+        wide.reset();
+        assert!(!wide.tiles_dirty);
+
+        let no_clip: ClipPath = None;
+        wide.push_layer(
+            1,
+            no_clip,
+            BlendMode::default(),
+            None,
+            1.0,
+            None,
+            Affine::IDENTITY,
+            &mut render_graph,
+            0,
+        );
+        assert!(wide.tiles_dirty);
+
+        wide.pop_layer(&mut render_graph);
+        assert!(wide.tiles_dirty);
+
+        wide.reset();
+        assert!(!wide.tiles_dirty);
+
+        // Generating with empty strips does not need to mark it as dirty.
+        wide.generate(
+            &[],
+            Paint::Solid(PremulColor::from_alpha_color(
+                peniko::color::palette::css::RED,
+            )),
+            BlendMode::default(),
+            0,
+            None,
+            &[],
+        );
+        assert!(!wide.tiles_dirty);
+    }
+}
diff --git a/vendor/vello_common/src/encode.rs b/vendor/vello_common/src/encode.rs
new file mode 100644
index 000000000..5161fe021
--- /dev/null
+++ b/vendor/vello_common/src/encode.rs
@@ -0,0 +1,1354 @@
+// Copyright 2025 the Vello Authors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+//! Paints for drawing shapes.
+
+use crate::TextureId;
+use crate::blurred_rounded_rect::BlurredRoundedRectangle;
+use crate::color::palette::css::BLACK;
+use crate::color::{ColorSpaceTag, HueDirection, Srgb, gradient};
+use crate::geometry::RectU16;
+use crate::kurbo::{Affine, Point, Vec2};
+use crate::math::{FloatExt, compute_erf7};
+use crate::paint::{Image, ImageSource, IndexedPaint, Paint, PremulColor, Tint};
+use crate::peniko::{ColorStop, ColorStops, Extend, Gradient, GradientKind, ImageQuality};
+use alloc::borrow::Cow;
+use alloc::fmt::Debug;
+use alloc::vec;
+use alloc::vec::Vec;
+#[cfg(not(feature = "multithreading"))]
+use core::cell::OnceCell;
+use core::hash::{Hash, Hasher};
+use fearless_simd::{Simd, SimdBase, SimdFloat, f32x4, f32x16, mask32x4, mask32x16};
+use peniko::color::cache_key::{BitEq, BitHash, CacheKey};
+use peniko::color::gradient_unpremultiplied;
+use peniko::{
+    ImageSampler, InterpolationAlphaSpace, LinearGradientPosition, RadialGradientPosition,
+    SweepGradientPosition,
+};
+use smallvec::ToSmallVec;
+// So we can just use `OnceCell` regardless of which feature is activated.
+#[cfg(feature = "multithreading")]
+use std::sync::OnceLock as OnceCell;
+
+use crate::simd::{Splat4thExt, element_wise_splat};
+#[cfg(not(feature = "std"))]
+use peniko::kurbo::common::FloatFuncs as _;
+
+const DEGENERATE_THRESHOLD: f32 = 1.0e-6;
+const NUDGE_VAL: f32 = 1.0e-7;
+#[cfg(feature = "std")]
+fn exp(val: f32) -> f32 {
+    val.exp()
+}
+
+#[cfg(not(feature = "std"))]
+fn exp(val: f32) -> f32 {
+    #[cfg(feature = "libm")]
+    return libm::expf(val);
+    #[cfg(not(feature = "libm"))]
+    compile_error!("vello_common requires either the `std` or `libm` feature");
+}
+
+/// A trait for encoding paints.
+pub trait EncodeExt: private::Sealed {
+    /// Encode the paint and push it into a vector of encoded paints, returning
+    /// the corresponding paint in the process. This will also validate the paint.
+    fn encode_into(
+        &self,
+        paints: &mut Vec<EncodedPaint>,
+        transform: Affine,
+        tint: Option<Tint>,
+    ) -> Paint;
+}
+
+impl EncodeExt for Gradient {
+    /// Encode the gradient into a paint.
+    fn encode_into(
+        &self,
+        paints: &mut Vec<EncodedPaint>,
+        transform: Affine,
+        _tint: Option<Tint>,
+    ) -> Paint {
+        // First make sure that the gradient is valid and not degenerate.
+        if let Err(paint) = validate(self) {
+            return paint;
+        }
+
+        let mut may_have_transparency = self.stops.iter().any(|s| s.color.components[3] != 1.0);
+
+        let mut base_transform;
+
+        let mut stops = Cow::Borrowed(&self.stops.0);
+
+        let first_stop = &stops[0];
+        let last_stop = &stops[stops.len() - 1];
+
+        if first_stop.offset != 0.0 || last_stop.offset != 1.0 {
+            let mut vec = stops.to_smallvec();
+
+            if first_stop.offset != 0.0 {
+                let mut first_stop = *first_stop;
+                first_stop.offset = 0.0;
+                vec.insert(0, first_stop);
+            }
+
+            if last_stop.offset != 1.0 {
+                let mut last_stop = *last_stop;
+                last_stop.offset = 1.0;
+                vec.push(last_stop);
+            }
+
+            stops = Cow::Owned(vec);
+        }
+
+        let kind = match self.kind {
+            GradientKind::Linear(LinearGradientPosition { start: p0, end: p1 }) => {
+                // We update the transform currently in-place, such that the gradient line always
+                // starts at the point (0, 0) and ends at the point (1, 0). This simplifies the
+                // calculation for the current position along the gradient line a lot.
+                base_transform = ts_from_line_to_line(p0, p1, Point::ZERO, Point::new(1.0, 0.0));
+
+                EncodedKind::Linear(LinearKind)
+            }
+            GradientKind::Radial(RadialGradientPosition {
+                start_center: c0,
+                start_radius: r0,
+                end_center: c1,
+                end_radius: r1,
+            }) => {
+                // The implementation of radial gradients is translated from Skia.
+                // See:
+                // - <https://skia.org/docs/dev/design/conical/>
+                // - <https://github.com/google/skia/blob/main/src/shaders/gradients/SkConicalGradient.h>
+                // - <https://github.com/google/skia/blob/main/src/shaders/gradients/SkConicalGradient.cpp>
+                let d_radius = r1 - r0;
+
+                // <https://github.com/google/skia/blob/1e07a4b16973cf716cb40b72dd969e961f4dd950/src/shaders/gradients/SkConicalGradient.cpp#L83-L112>
+                let radial_kind = if ((c1 - c0).length() as f32).is_nearly_zero() {
+                    base_transform = Affine::translate((-c1.x, -c1.y));
+                    base_transform = base_transform.then_scale(1.0 / r0.max(r1) as f64);
+
+                    let scale = r1.max(r0) / d_radius;
+                    let bias = -r0 / d_radius;
+
+                    RadialKind::Radial { bias, scale }
+                } else {
+                    base_transform =
+                        ts_from_line_to_line(c0, c1, Point::ZERO, Point::new(1.0, 0.0));
+
+                    if (r1 - r0).is_nearly_zero() {
+                        let scaled_r0 = r1 / (c1 - c0).length() as f32;
+                        RadialKind::Strip {
+                            scaled_r0_squared: scaled_r0 * scaled_r0,
+                        }
+                    } else {
+                        let d_center = (c0 - c1).length() as f32;
+
+                        let focal_data =
+                            FocalData::create(r0 / d_center, r1 / d_center, &mut base_transform);
+
+                        let fp0 = 1.0 / focal_data.fr1;
+                        let fp1 = focal_data.f_focal_x;
+
+                        RadialKind::Focal {
+                            focal_data,
+                            fp0,
+                            fp1,
+                        }
+                    }
+                };
+
+                // Even if the gradient has no stops with transparency, we might have to force
+                // alpha-compositing in case the radial gradient is undefined in certain positions,
+                // in which case the resulting color will be transparent and thus the gradient overall
+                // must be treated as non-opaque.
+                may_have_transparency |= radial_kind.has_undefined();
+
+                EncodedKind::Radial(radial_kind)
+            }
+            GradientKind::Sweep(SweepGradientPosition {
+                center,
+                start_angle,
+                end_angle,
+            }) => {
+                // Make sure the center of the gradient falls on the origin (0, 0), to make
+                // angle calculation easier.
+                let x_offset = -center.x as f32;
+                let y_offset = -center.y as f32;
+                base_transform = Affine::translate((x_offset as f64, y_offset as f64));
+
+                EncodedKind::Sweep(SweepKind {
+                    start_angle,
+                    // Save the inverse so that we can use a multiplication in the shader instead.
+                    inv_angle_delta: 1.0 / (end_angle - start_angle),
+                })
+            }
+        };
+
+        let ranges = encode_stops(
+            &stops,
+            self.interpolation_cs,
+            self.hue_direction,
+            self.interpolation_alpha_space,
+        );
+
+        // This represents the transform that needs to be applied to the starting point of a
+        // command before starting with the rendering.
+        // First we need to account for the base transform of the shader, then
+        // we need to apply the _inverse_ paint transform to the point so that we can account
+        // for the paint transform of the render context.
+        let transform = base_transform * transform.inverse();
+
+        // One possible approach of calculating the positions would be to apply the above
+        // transform to _each_ pixel that we render in the wide tile. However, a much better
+        // approach is to apply the transform once for the first pixel in each wide tile,
+        // and from then on only apply incremental updates to the current x/y position
+        // that we calculate based on the transform.
+        //
+        // Remember that we render wide tiles in column major order (i.e. we first calculate the
+        // values for a specific x for all Tile::HEIGHT y by incrementing y by 1, and then finally
+        // we increment the x position by 1 and start from the beginning). If we want to implement
+        // the above approach of incrementally updating the position, we need to calculate
+        // how the x/y unit vectors are affected by the transform, and then use this as the
+        // step delta for a step in the x/y direction.
+        let (x_advance, y_advance) = x_y_advances(&transform);
+
+        let cache_key = CacheKey(GradientCacheKey {
+            stops: self.stops.clone(),
+            interpolation_cs: self.interpolation_cs,
+            hue_direction: self.hue_direction,
+        });
+
+        let has_undefined = kind.has_undefined();
+
+        let encoded = EncodedGradient {
+            cache_key,
+            kind,
+            has_undefined,
+            transform,
+            x_advance,
+            y_advance,
+            ranges,
+            extend: self.extend,
+            may_have_transparency,
+            u8_lut: OnceCell::new(),
+            f32_lut: OnceCell::new(),
+        };
+
+        let idx = paints.len();
+        paints.push(encoded.into());
+
+        Paint::Indexed(IndexedPaint::new(idx))
+    }
+}
+
+/// Returns a fallback paint in case the gradient is invalid.
+///
+/// The paint will be either black or contain the color of the first stop of the gradient.
+fn validate(gradient: &Gradient) -> Result<(), Paint> {
+    let black = Err(BLACK.into());
+
+    // Gradients need at least two stops.
+    if gradient.stops.is_empty() {
+        return black;
+    }
+
+    let first = Err(gradient.stops[0].color.to_alpha_color::<Srgb>().into());
+
+    if gradient.stops.len() == 1 {
+        return first;
+    }
+
+    for stops in gradient.stops.windows(2) {
+        let f = stops[0];
+        let n = stops[1];
+
+        // Offsets must be between 0 and 1, and not NaN.
+        if !(0.0..=1.0).contains(&f.offset) {
+            return first;
+        }
+
+        // Stops must be sorted by ascending offset.
+        if f.offset > n.offset {
+            return first;
+        }
+    }
+
+    // Check the last stop as well.
+    let last = gradient.stops.last().unwrap();
+    if !(0.0..=1.0).contains(&last.offset) {
+        return first;
+    }
+
+    let degenerate_point = |p1: &Point, p2: &Point| {
+        (p1.x - p2.x).abs() as f32 <= DEGENERATE_THRESHOLD
+            && (p1.y - p2.y).abs() as f32 <= DEGENERATE_THRESHOLD
+    };
+
+    let degenerate_val = |v1: f32, v2: f32| (v2 - v1).abs() <= DEGENERATE_THRESHOLD;
+
+    match &gradient.kind {
+        GradientKind::Linear(LinearGradientPosition { start, end }) => {
+            // Start and end points must not be too close together.
+            if degenerate_point(start, end) {
+                return first;
+            }
+        }
+        GradientKind::Radial(RadialGradientPosition {
+            start_center,
+            start_radius,
+            end_center,
+            end_radius,
+        }) => {
+            // Radii must not be negative.
+            if *start_radius < 0.0 || *end_radius < 0.0 {
+                return first;
+            }
+
+            // Radii and center points must not be close to the same.
+            if degenerate_point(start_center, end_center)
+                && degenerate_val(*start_radius, *end_radius)
+            {
+                return first;
+            }
+        }
+        GradientKind::Sweep(SweepGradientPosition {
+            start_angle,
+            end_angle,
+            ..
+        }) => {
+            // The end angle must be larger than the start angle.
+            if degenerate_val(*start_angle, *end_angle) {
+                return first;
+            }
+
+            if end_angle <= start_angle {
+                return first;
+            }
+        }
+    }
+
+    Ok(())
+}
+
+/// Encode all stops into a sequence of ranges.
+fn encode_stops(
+    stops: &[ColorStop],
+    cs: ColorSpaceTag,
+    hue_dir: HueDirection,
+    interpolation_alpha_space: InterpolationAlphaSpace,
+) -> Vec<GradientRange> {
+    #[derive(Debug)]
+    struct EncodedColorStop {
+        offset: f32,
+        color: crate::color::AlphaColor<Srgb>,
+    }
+
+    let create_range = |left_stop: &EncodedColorStop, right_stop: &EncodedColorStop| {
+        let clamp = |mut color: [f32; 4]| {
+            // The linear approximation of the gradient can produce values slightly outside of
+            // [0.0, 1.0], so clamp them.
+            for c in &mut color {
+                *c = c.clamp(0.0, 1.0);
+            }
+
+            color
+        };
+
+        let x0 = left_stop.offset;
+        let x1 = right_stop.offset;
+        let c0 = if interpolation_alpha_space == InterpolationAlphaSpace::Unpremultiplied {
+            clamp(left_stop.color.components)
+        } else {
+            clamp(left_stop.color.premultiply().components)
+        };
+        let c1 = if interpolation_alpha_space == InterpolationAlphaSpace::Unpremultiplied {
+            clamp(right_stop.color.components)
+        } else {
+            clamp(right_stop.color.premultiply().components)
+        };
+
+        // We calculate a bias and scale factor, such that we can simply calculate
+        // bias + x * scale to get the interpolated color, where x is between x0 and x1,
+        // to calculate the resulting color.
+        // Apply a nudge value because we sometimes call `create_range` with the same offset
+        // to create the padded stops.
+        let x1_minus_x0 = (x1 - x0).max(NUDGE_VAL);
+        let mut scale = [0.0; 4];
+        let mut bias = c0;
+
+        for i in 0..4 {
+            scale[i] = (c1[i] - c0[i]) / x1_minus_x0;
+            bias[i] = c0[i] - x0 * scale[i];
+        }
+
+        GradientRange {
+            x1,
+            bias,
+            scale,
+            interpolation_alpha_space,
+        }
+    };
+
+    // Create additional (SRGB-encoded) stops in-between to approximate the color space we want to
+    // interpolate in.
+    if cs != ColorSpaceTag::Srgb {
+        let interpolated_stops = if interpolation_alpha_space
+            == InterpolationAlphaSpace::Premultiplied
+        {
+            stops
+                .windows(2)
+                .flat_map(|s| {
+                    let left_stop = &s[0];
+                    let right_stop = &s[1];
+
+                    let interpolated =
+                        gradient::<Srgb>(left_stop.color, right_stop.color, cs, hue_dir, 0.01);
+
+                    interpolated.map(|st| EncodedColorStop {
+                        offset: left_stop.offset + (right_stop.offset - left_stop.offset) * st.0,
+                        color: st.1.un_premultiply(),
+                    })
+                })
+                .collect::<Vec<_>>()
+        } else {
+            stops
+                .windows(2)
+                .flat_map(|s| {
+                    let left_stop = &s[0];
+                    let right_stop = &s[1];
+
+                    let interpolated = gradient_unpremultiplied::<Srgb>(
+                        left_stop.color,
+                        right_stop.color,
+                        cs,
+                        hue_dir,
+                        0.01,
+                    );
+
+                    interpolated.map(|st| EncodedColorStop {
+                        offset: left_stop.offset + (right_stop.offset - left_stop.offset) * st.0,
+                        color: st.1,
+                    })
+                })
+                .collect::<Vec<_>>()
+        };
+
+        interpolated_stops
+            .windows(2)
+            .map(|s| {
+                let left_stop = &s[0];
+                let right_stop = &s[1];
+
+                create_range(left_stop, right_stop)
+            })
+            .collect()
+    } else {
+        stops
+            .windows(2)
+            .map(|c| {
+                let c0 = EncodedColorStop {
+                    offset: c[0].offset,
+                    color: c[0].color.to_alpha_color::<Srgb>(),
+                };
+
+                let c1 = EncodedColorStop {
+                    offset: c[1].offset,
+                    color: c[1].color.to_alpha_color::<Srgb>(),
+                };
+
+                create_range(&c0, &c1)
+            })
+            .collect()
+    }
+}
+
+pub(crate) fn x_y_advances(transform: &Affine) -> (Vec2, Vec2) {
+    let scale_skew_transform = {
+        let c = transform.as_coeffs();
+        Affine::new([c[0], c[1], c[2], c[3], 0.0, 0.0])
+    };
+
+    let x_advance = scale_skew_transform * Point::new(1.0, 0.0);
+    let y_advance = scale_skew_transform * Point::new(0.0, 1.0);
+
+    (
+        Vec2::new(x_advance.x, x_advance.y),
+        Vec2::new(y_advance.x, y_advance.y),
+    )
+}
+
+impl private::Sealed for Image {}
+
+impl EncodeExt for Image {
+    fn encode_into(
+        &self,
+        paints: &mut Vec<EncodedPaint>,
+        transform: Affine,
+        tint: Option<Tint>,
+    ) -> Paint {
+        let idx = paints.len();
+
+        let mut sampler = self.sampler;
+
+        if sampler.alpha != 1.0 {
+            // If the sampler alpha is not 1.0, we need to force alpha compositing.
+            unimplemented!("Applying opacity to image commands");
+        }
+
+        let c = transform.as_coeffs();
+
+        // Optimize image quality for integer-only translations.
+        if (c[0] as f32 - 1.0).is_nearly_zero()
+            && (c[1] as f32).is_nearly_zero()
+            && (c[2] as f32).is_nearly_zero()
+            && (c[3] as f32 - 1.0).is_nearly_zero()
+            && ((c[4] - c[4].floor()) as f32).is_nearly_zero()
+            && ((c[5] - c[5].floor()) as f32).is_nearly_zero()
+            && sampler.quality == ImageQuality::Medium
+        {
+            sampler.quality = ImageQuality::Low;
+        }
+
+        let transform = transform.inverse();
+
+        let (x_advance, y_advance) = x_y_advances(&transform);
+
+        // If the tint color has alpha < 1.0, the image will have opacities
+        // even if the source pixels are all opaque.
+        let tint_has_opacity = tint.as_ref().is_some_and(|t| t.color.components[3] < 1.0);
+
+        let encoded = EncodedImage {
+            may_have_transparency: self.image.may_have_transparency() || tint_has_opacity,
+            source: self.image.clone(),
+            sampler,
+            transform,
+            x_advance,
+            y_advance,
+            tint,
+        };
+
+        paints.push(EncodedPaint::Image(encoded));
+
+        Paint::Indexed(IndexedPaint::new(idx))
+    }
+}
+
+/// An encoded paint.
+#[derive(Debug)]
+pub enum EncodedPaint {
+    /// An encoded gradient.
+    Gradient(EncodedGradient),
+    /// An encoded image.
+    Image(EncodedImage),
+    /// An encoded external texture.
+    ExternalTexture(EncodedExternalTexture),
+    /// A blurred, rounded rectangle.
+    BlurredRoundedRect(EncodedBlurredRoundedRectangle),
+}
+
+impl From<EncodedGradient> for EncodedPaint {
+    fn from(value: EncodedGradient) -> Self {
+        Self::Gradient(value)
+    }
+}
+
+impl From<EncodedBlurredRoundedRectangle> for EncodedPaint {
+    fn from(value: EncodedBlurredRoundedRectangle) -> Self {
+        Self::BlurredRoundedRect(value)
+    }
+}
+
+/// An encoded image.
+#[derive(Debug)]
+pub struct EncodedImage {
+    /// The underlying pixmap of the image.
+    pub source: ImageSource,
+    /// Sampler
+    pub sampler: ImageSampler,
+    /// Whether the image has opacities.
+    pub may_have_transparency: bool,
+    /// A transform to apply to the image.
+    pub transform: Affine,
+    /// The advance in image coordinates for one step in the x direction.
+    pub x_advance: Vec2,
+    /// The advance in image coordinates for one step in the y direction.
+    pub y_advance: Vec2,
+    /// Optional tint applied to the image.
+    pub tint: Option<Tint>,
+}
+
+/// An encoded external texture.
+///
+/// The texture must be bound by the user at render-time in order for us to be able to sample from
+/// it; it is not interned into the renderer.
+#[derive(Debug)]
+pub struct EncodedExternalTexture {
+    /// External texture handle.
+    pub texture_id: TextureId,
+    /// Source region of the texture in texel coordinates.
+    pub source_region: RectU16,
+    /// Sampler parameters.
+    pub sampler: ImageSampler,
+    /// Whether the sampled content may contain non-opaque pixels.
+    pub may_have_transparency: bool,
+    /// Inverse destination transform, mapping scene coordinates to local source-rect space.
+    pub transform: Affine,
+    /// Optional tint applied to the sampled color.
+    pub tint: Option<Tint>,
+}
+
+/// Computed properties of a linear gradient.
+#[derive(Debug, Copy, Clone)]
+pub struct LinearKind;
+
+/// Focal data for a radial gradient.
+#[derive(Debug, PartialEq, Copy, Clone)]
+pub struct FocalData {
+    /// The normalized radius of the outer circle in focal space.
+    pub fr1: f32,
+    /// The x-coordinate of the focal point in normalized space \[0,1\].
+    pub f_focal_x: f32,
+    /// Whether the focal points have been swapped.
+    pub f_is_swapped: bool,
+}
+
+impl FocalData {
+    /// Create a new `FocalData` with the given radii and update the matrix.
+    pub fn create(mut r0: f32, mut r1: f32, matrix: &mut Affine) -> Self {
+        let mut swapped = false;
+        let mut f_focal_x = r0 / (r0 - r1);
+
+        if (f_focal_x - 1.0).is_nearly_zero() {
+            *matrix = matrix.then_translate(Vec2::new(-1.0, 0.0));
+            *matrix = matrix.then_scale_non_uniform(-1.0, 1.0);
+            core::mem::swap(&mut r0, &mut r1);
+            f_focal_x = 0.0;
+            swapped = true;
+        }
+
+        let focal_matrix = ts_from_line_to_line(
+            Point::new(f_focal_x as f64, 0.0),
+            Point::new(1.0, 0.0),
+            Point::new(0.0, 0.0),
+            Point::new(1.0, 0.0),
+        );
+        *matrix = focal_matrix * *matrix;
+
+        let fr1 = r1 / (1.0 - f_focal_x).abs();
+
+        let data = Self {
+            fr1,
+            f_focal_x,
+            f_is_swapped: swapped,
+        };
+
+        if data.is_focal_on_circle() {
+            *matrix = matrix.then_scale(0.5);
+        } else {
+            *matrix = matrix.then_scale_non_uniform(
+                (fr1 / (fr1 * fr1 - 1.0)) as f64,
+                1.0 / (fr1 * fr1 - 1.0).abs().sqrt() as f64,
+            );
+        }
+
+        *matrix = matrix.then_scale((1.0 - f_focal_x).abs() as f64);
+
+        data
+    }
+
+    /// Whether the focal is on the circle.
+    pub fn is_focal_on_circle(&self) -> bool {
+        (1.0 - self.fr1).is_nearly_zero()
+    }
+
+    /// Whether the focal points have been swapped.
+    pub fn is_swapped(&self) -> bool {
+        self.f_is_swapped
+    }
+
+    /// Whether the gradient is well-behaved.
+    pub fn is_well_behaved(&self) -> bool {
+        !self.is_focal_on_circle() && self.fr1 > 1.0
+    }
+
+    /// Whether the gradient is natively focal.
+    pub fn is_natively_focal(&self) -> bool {
+        self.f_focal_x.is_nearly_zero()
+    }
+}
+
+/// A radial gradient.
+#[derive(Debug, PartialEq, Copy, Clone)]
+pub enum RadialKind {
+    /// A radial gradient, i.e. the start and end center points are the same.
+    Radial {
+        /// The `bias` value (from the Skia implementation).
+        ///
+        /// It is a correction factor that accounts for the fact that the focal center might not
+        /// lie on the inner circle (if r0 > 0).
+        bias: f32,
+        /// The `scale` value (from the Skia implementation).
+        ///
+        /// It is a scaling factor that maps from r0 to r1.
+        scale: f32,
+    },
+    /// A strip gradient, i.e. the start and end radius are the same.
+    Strip {
+        /// The squared value of `scaled_r0` (from the Skia implementation).
+        scaled_r0_squared: f32,
+    },
+    /// A general, two-point conical gradient.
+    Focal {
+        /// The focal data  (from the Skia implementation).
+        focal_data: FocalData,
+        /// The `fp0` value (from the Skia implementation).
+        fp0: f32,
+        /// The `fp1` value (from the Skia implementation).
+        fp1: f32,
+    },
+}
+
+impl RadialKind {
+    /// Whether the gradient is undefined at any location.
+    pub fn has_undefined(&self) -> bool {
+        match self {
+            Self::Radial { .. } => false,
+            Self::Strip { .. } => true,
+            Self::Focal { focal_data, .. } => !focal_data.is_well_behaved(),
+        }
+    }
+}
+
+/// Computed properties of a sweep gradient.
+#[derive(Debug)]
+pub struct SweepKind {
+    /// The start angle of the sweep gradient.
+    pub start_angle: f32,
+    /// The inverse delta between start and end angle.
+    pub inv_angle_delta: f32,
+}
+
+/// A kind of encoded gradient.
+#[derive(Debug)]
+pub enum EncodedKind {
+    /// An encoded linear gradient.
+    Linear(LinearKind),
+    /// An encoded radial gradient.
+    Radial(RadialKind),
+    /// An encoded sweep gradient.
+    Sweep(SweepKind),
+}
+
+impl EncodedKind {
+    /// Whether the gradient is undefined at any location.
+    fn has_undefined(&self) -> bool {
+        match self {
+            Self::Radial(radial_kind) => radial_kind.has_undefined(),
+            _ => false,
+        }
+    }
+}
+
+/// An encoded gradient.
+#[derive(Debug)]
+pub struct EncodedGradient {
+    /// The cache key for the gradient.
+    pub cache_key: CacheKey<GradientCacheKey>,
+    /// The underlying kind of gradient.
+    pub kind: EncodedKind,
+    /// Whether the gradient can yield undefined `t` values at some locations.
+    pub has_undefined: bool,
+    /// A transform that needs to be applied to the position of the first processed pixel.
+    pub transform: Affine,
+    /// How much to advance into the x/y direction for one step in the x direction.
+    pub x_advance: Vec2,
+    /// How much to advance into the x/y direction for one step in the y direction.
+    pub y_advance: Vec2,
+    /// The color ranges of the gradient.
+    pub ranges: Vec<GradientRange>,
+    /// The extend of the gradient.
+    pub extend: Extend,
+    /// Whether the gradient requires `source_over` compositing.
+    pub may_have_transparency: bool,
+    u8_lut: OnceCell<GradientLut<u8>>,
+    f32_lut: OnceCell<GradientLut<f32>>,
+}
+
+impl EncodedGradient {
+    /// Get the lookup table for sampling u8-based gradient values.
+    pub fn u8_lut<S: Simd>(&self, simd: S) -> &GradientLut<u8> {
+        self.u8_lut
+            .get_or_init(|| GradientLut::new(simd, &self.ranges))
+    }
+
+    /// Get the lookup table for sampling f32-based gradient values.
+    pub fn f32_lut<S: Simd>(&self, simd: S) -> &GradientLut<f32> {
+        self.f32_lut
+            .get_or_init(|| GradientLut::new(simd, &self.ranges))
+    }
+}
+
+/// Cache key for gradient color ramps based on color-affecting properties.
+#[derive(Debug, Clone)]
+pub struct GradientCacheKey {
+    /// The color stops (offsets + colors).
+    pub stops: ColorStops,
+    /// Color space used for interpolation.
+    pub interpolation_cs: ColorSpaceTag,
+    /// Hue direction used for interpolation.
+    pub hue_direction: HueDirection,
+}
+
+impl BitHash for GradientCacheKey {
+    fn bit_hash<H: Hasher>(&self, state: &mut H) {
+        self.stops.bit_hash(state);
+        core::mem::discriminant(&self.interpolation_cs).hash(state);
+        core::mem::discriminant(&self.hue_direction).hash(state);
+    }
+}
+
+impl BitEq for GradientCacheKey {
+    fn bit_eq(&self, other: &Self) -> bool {
+        self.stops.bit_eq(&other.stops)
+            && self.interpolation_cs == other.interpolation_cs
+            && self.hue_direction == other.hue_direction
+    }
+}
+
+/// An encoded range between two color stops.
+#[derive(Debug, Clone)]
+pub struct GradientRange {
+    /// The end value of the range.
+    pub x1: f32,
+    /// A bias to apply when interpolating the color (in this case just the values of the start
+    /// color of the gradient).
+    pub bias: [f32; 4],
+    /// The scale factors of the range. By calculating bias + x * factors (where x is
+    /// between 0.0 and 1.0), we can interpolate between start and end color of the gradient range.
+    pub scale: [f32; 4],
+    /// The alpha space in which the interpolation was performed.
+    pub interpolation_alpha_space: InterpolationAlphaSpace,
+}
+
+/// An encoded blurred, rounded rectangle.
+#[derive(Debug)]
+pub struct EncodedBlurredRoundedRectangle {
+    /// An component for computing the blur effect.
+    pub exponent: f32,
+    /// An component for computing the blur effect.
+    pub recip_exponent: f32,
+    /// An component for computing the blur effect.
+    pub scale: f32,
+    /// An component for computing the blur effect.
+    pub std_dev_inv: f32,
+    /// An component for computing the blur effect.
+    pub min_edge: f32,
+    /// An component for computing the blur effect.
+    pub w: f32,
+    /// An component for computing the blur effect.
+    pub h: f32,
+    /// An component for computing the blur effect.
+    pub width: f32,
+    /// An component for computing the blur effect.
+    pub height: f32,
+    /// An component for computing the blur effect.
+    pub r1: f32,
+    /// The base color for the blurred rectangle.
+    pub color: PremulColor,
+    /// A transform that needs to be applied to the position of the first processed pixel.
+    pub transform: Affine,
+    /// How much to advance into the x/y direction for one step in the x direction.
+    pub x_advance: Vec2,
+    /// How much to advance into the x/y direction for one step in the y direction.
+    pub y_advance: Vec2,
+}
+
+impl private::Sealed for BlurredRoundedRectangle {}
+
+impl EncodeExt for BlurredRoundedRectangle {
+    fn encode_into(
+        &self,
+        paints: &mut Vec<EncodedPaint>,
+        transform: Affine,
+        _tint: Option<Tint>,
+    ) -> Paint {
+        let rect = {
+            // Ensure rectangle has positive width/height.
+            let mut rect = self.rect;
+
+            if self.rect.x0 > self.rect.x1 {
+                core::mem::swap(&mut rect.x0, &mut rect.x1);
+            }
+
+            if self.rect.y0 > self.rect.y1 {
+                core::mem::swap(&mut rect.y0, &mut rect.y1);
+            }
+
+            rect
+        };
+
+        let transform = Affine::translate((-rect.x0, -rect.y0)) * transform.inverse();
+
+        let (x_advance, y_advance) = x_y_advances(&transform);
+
+        let width = rect.width() as f32;
+        let height = rect.height() as f32;
+        let radius = self.radius.min(0.5 * width.min(height));
+
+        // To avoid divide by 0; potentially should be a bigger number for antialiasing.
+        let std_dev = self.std_dev.max(1e-6);
+
+        let min_edge = width.min(height);
+        let rmax = 0.5 * min_edge;
+        let r0 = radius.hypot(std_dev * 1.15).min(rmax);
+        let r1 = radius.hypot(std_dev * 2.0).min(rmax);
+
+        let exponent = 2.0 * r1 / r0;
+
+        let std_dev_inv = std_dev.recip();
+
+        // Pull in long end (make less eccentric).
+        let delta = 1.25
+            * std_dev
+            * (exp(-(0.5 * std_dev_inv * width).powi(2))
+                - exp(-(0.5 * std_dev_inv * height).powi(2)));
+        let w = width + delta.min(0.0);
+        let h = height - delta.max(0.0);
+
+        let recip_exponent = exponent.recip();
+        let scale = 0.5 * compute_erf7(std_dev_inv * 0.5 * (w.max(h) - 0.5 * radius));
+
+        let encoded = EncodedBlurredRoundedRectangle {
+            exponent,
+            recip_exponent,
+            width,
+            height,
+            scale,
+            r1,
+            std_dev_inv,
+            min_edge,
+            color: PremulColor::from_alpha_color(self.color),
+            w,
+            h,
+            transform,
+            x_advance,
+            y_advance,
+        };
+
+        let idx = paints.len();
+        paints.push(encoded.into());
+
+        Paint::Indexed(IndexedPaint::new(idx))
+    }
+}
+
+/// Calculates the transform necessary to map the line spanned by points src1, src2 to
+/// the line spanned by dst1, dst2.
+///
+/// This creates a transformation that maps any line segment to any other line segment.
+/// For gradients, we use this to transform the gradient line to a standard form (0,0) → (1,0).
+///
+/// Copied from <https://github.com/linebender/tiny-skia/blob/68b198a7210a6bbf752b43d6bc4db62445730313/src/shaders/radial_gradient.rs#L182>
+fn ts_from_line_to_line(src1: Point, src2: Point, dst1: Point, dst2: Point) -> Affine {
+    let unit_to_line1 = unit_to_line(src1, src2);
+    // Calculate the transform necessary to map line1 to the unit vector.
+    let line1_to_unit = unit_to_line1.inverse();
+    // Then map the unit vector to line2.
+    let unit_to_line2 = unit_to_line(dst1, dst2);
+
+    unit_to_line2 * line1_to_unit
+}
+
+/// Calculate the transform necessary to map the unit vector to the line spanned by the points
+/// `p1` and `p2`.
+fn unit_to_line(p0: Point, p1: Point) -> Affine {
+    Affine::new([
+        p1.y - p0.y,
+        p0.x - p1.x,
+        p1.x - p0.x,
+        p1.y - p0.y,
+        p0.x,
+        p0.y,
+    ])
+}
+
+/// A helper trait for converting a premultiplied f32 color to `Self`.
+pub trait FromF32Color: Sized + Debug + Copy + Clone {
+    /// The zero value.
+    const ZERO: Self;
+    /// Convert from a premultiplied f32 color to `Self`.
+    fn from_f32<S: Simd>(color: f32x4<S>) -> [Self; 4];
+}
+
+impl FromF32Color for f32 {
+    const ZERO: Self = 0.0;
+
+    fn from_f32<S: Simd>(color: f32x4<S>) -> [Self; 4] {
+        color.into()
+    }
+}
+
+impl FromF32Color for u8 {
+    const ZERO: Self = 0;
+
+    fn from_f32<S: Simd>(mut color: f32x4<S>) -> [Self; 4] {
+        let simd = color.simd;
+        color = color.mul_add(f32x4::splat(simd, 255.0), f32x4::splat(simd, 0.5));
+
+        [
+            color[0] as Self,
+            color[1] as Self,
+            color[2] as Self,
+            color[3] as Self,
+        ]
+    }
+}
+
+/// A lookup table for sampled gradient values.
+#[derive(Debug)]
+pub struct GradientLut<T: FromF32Color> {
+    lut: Vec<[T; 4]>,
+    scale: f32,
+}
+
+impl<T: FromF32Color> GradientLut<T> {
+    /// Create a new lookup table.
+    fn new<S: Simd>(simd: S, ranges: &[GradientRange]) -> Self {
+        let lut_size = determine_lut_size(ranges);
+        let mut lut = vec![[T::ZERO; 4]; lut_size];
+
+        // Calculate how many indices are covered by each range.
+        let ramps = {
+            let mut ramps = Vec::with_capacity(ranges.len());
+            let mut prev_idx = 0;
+
+            for range in ranges {
+                let max_idx = (range.x1 * lut_size as f32) as usize;
+
+                ramps.push((prev_idx..max_idx, range));
+                prev_idx = max_idx;
+            }
+
+            ramps
+        };
+
+        let scale = lut_size as f32 - 1.0;
+
+        let inv_lut_scale = f32x4::splat(simd, 1.0 / scale);
+        let add_factor = f32x4::from_slice(simd, &[0.0, 1.0, 2.0, 3.0]) * inv_lut_scale;
+
+        for (ramp_range, range) in ramps {
+            let biases = f32x16::block_splat(f32x4::from_slice(simd, &range.bias));
+            let scales = f32x16::block_splat(f32x4::from_slice(simd, &range.scale));
+
+            ramp_range.clone().step_by(4).for_each(|idx| {
+                let t_vals = f32x4::splat(simd, idx as f32).mul_add(inv_lut_scale, add_factor);
+
+                let t_vals = element_wise_splat(simd, t_vals);
+
+                let mut result = scales.mul_add(t_vals, biases);
+                let alphas = result.splat_4th();
+                // Premultiply colors, since we did interpolation in unpremultiplied space.
+                if range.interpolation_alpha_space == InterpolationAlphaSpace::Unpremultiplied {
+                    result = {
+                        let mask =
+                            mask32x16::block_splat(mask32x4::from_slice(simd, &[-1, -1, -1, 0]));
+                        simd.select_f32x16(mask, result * alphas, alphas)
+                    };
+                }
+
+                // Due to floating-point impreciseness, it can happen that
+                // values either become greater than 1 or the RGB channels
+                // become greater than the alpha channel. To prevent overflows
+                // in later parts of the pipeline, we need to take the minimum here.
+                result = result.min(1.0).min(alphas);
+                let (im1, im2) = simd.split_f32x16(result);
+                let (r1, r2) = simd.split_f32x8(im1);
+                let (r3, r4) = simd.split_f32x8(im2);
+                let rs = [r1, r2, r3, r4].map(T::from_f32);
+
+                // We always compute 4 samples at a time, but a gradient ramp does not necessarily
+                // start at a multiple of 4, therefore we might have to truncate.
+                let lut = &mut lut[idx..(idx + 4).min(lut_size)];
+                lut.copy_from_slice(&rs[..lut.len()]);
+            });
+        }
+
+        Self { lut, scale }
+    }
+
+    /// Get the sample value at a specific index.
+    #[inline(always)]
+    pub fn get(&self, idx: usize) -> [T; 4] {
+        self.lut[idx]
+    }
+
+    /// Return the raw array of gradient sample values.
+    #[inline(always)]
+    pub fn lut(&self) -> &[[T; 4]] {
+        &self.lut
+    }
+
+    /// Return the number of entries in the lookup table.
+    #[inline(always)]
+    pub fn width(&self) -> usize {
+        self.lut.len()
+    }
+
+    /// Get the scale factor by which to scale the parametric value to
+    /// compute the correct lookup index.
+    #[inline(always)]
+    pub fn scale_factor(&self) -> f32 {
+        self.scale
+    }
+}
+
+/// The maximum size of the gradient LUT.
+// Of course in theory we could still have a stop at 0.0001 in which case this resolution
+// wouldn't be enough, but for all intents and purposes this should be more than sufficient
+// for most real cases.
+pub const MAX_GRADIENT_LUT_SIZE: usize = 4096;
+
+fn determine_lut_size(ranges: &[GradientRange]) -> usize {
+    // Inspired by Blend2D.
+    // By default:
+    // 256 for 2 stops.
+    // 512 for 3 stops.
+    // 1024 for 4 or more stops.
+    let stop_len = match ranges.len() {
+        1 => 256,
+        2 => 512,
+        _ => 1024,
+    };
+
+    // In case we have some tricky stops (for example 3 stops with 0.0, 0.001, 1.0), we might
+    // increase the resolution.
+    let mut last_x1 = 0.0;
+    let mut min_size = 0;
+
+    for x1 in ranges.iter().map(|e| e.x1) {
+        // For example, if the first stop is at 0.001, then we need a resolution of at least 1000
+        // so that we can still safely capture the first stop.
+        let res = ((1.0 / (x1 - last_x1)).ceil() as usize)
+            .min(MAX_GRADIENT_LUT_SIZE)
+            .next_power_of_two();
+        min_size = min_size.max(res);
+        last_x1 = x1;
+    }
+
+    // Take the maximum of both, but don't exceed `MAX_LEN`.
+    stop_len.max(min_size)
+}
+
+mod private {
+    #[expect(unnameable_types, reason = "Sealed trait pattern.")]
+    pub trait Sealed {}
+
+    impl Sealed for super::Gradient {}
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{EncodeExt, Gradient};
+    use crate::color::DynamicColor;
+    use crate::color::palette::css::{BLACK, BLUE, GREEN};
+    use crate::kurbo::{Affine, Point};
+    use crate::peniko::{ColorStop, ColorStops};
+    use alloc::vec;
+    use peniko::{LinearGradientPosition, RadialGradientPosition};
+    use smallvec::smallvec;
+
+    #[test]
+    fn gradient_missing_stops() {
+        let mut buf = vec![];
+
+        let gradient = Gradient {
+            kind: LinearGradientPosition {
+                start: Point::new(0.0, 0.0),
+                end: Point::new(20.0, 0.0),
+            }
+            .into(),
+            ..Default::default()
+        };
+
+        assert_eq!(
+            gradient.encode_into(&mut buf, Affine::IDENTITY, None),
+            BLACK.into()
+        );
+    }
+
+    #[test]
+    fn gradient_one_stop() {
+        let mut buf = vec![];
+
+        let gradient = Gradient {
+            kind: LinearGradientPosition {
+                start: Point::new(0.0, 0.0),
+                end: Point::new(20.0, 0.0),
+            }
+            .into(),
+            stops: ColorStops(smallvec![ColorStop {
+                offset: 0.0,
+                color: DynamicColor::from_alpha_color(GREEN),
+            }]),
+            ..Default::default()
+        };
+
+        // Should return the color of the first stop.
+        assert_eq!(
+            gradient.encode_into(&mut buf, Affine::IDENTITY, None),
+            GREEN.into()
+        );
+    }
+
+    #[test]
+    fn gradient_not_sorted_stops() {
+        let mut buf = vec![];
+
+        let gradient = Gradient {
+            kind: LinearGradientPosition {
+                start: Point::new(0.0, 0.0),
+                end: Point::new(20.0, 0.0),
+            }
+            .into(),
+            stops: ColorStops(smallvec![
+                ColorStop {
+                    offset: 1.0,
+                    color: DynamicColor::from_alpha_color(GREEN),
+                },
+                ColorStop {
+                    offset: 0.0,
+                    color: DynamicColor::from_alpha_color(BLUE),
+                },
+            ]),
+            ..Default::default()
+        };
+
+        assert_eq!(
+            gradient.encode_into(&mut buf, Affine::IDENTITY, None),
+            GREEN.into()
+        );
+    }
+
+    #[test]
+    fn gradient_linear_degenerate() {
+        let mut buf = vec![];
+
+        let gradient = Gradient {
+            kind: LinearGradientPosition {
+                start: Point::new(0.0, 0.0),
+                end: Point::new(0.0, 0.0),
+            }
+            .into(),
+            stops: ColorStops(smallvec![
+                ColorStop {
+                    offset: 0.0,
+                    color: DynamicColor::from_alpha_color(GREEN),
+                },
+                ColorStop {
+                    offset: 1.0,
+                    color: DynamicColor::from_alpha_color(BLUE),
+                },
+            ]),
+            ..Default::default()
+        };
+
+        assert_eq!(
+            gradient.encode_into(&mut buf, Affine::IDENTITY, None),
+            GREEN.into()
+        );
+    }
+
+    #[test]
+    fn gradient_last_stop_with_infinity_offset() {
+        let mut buf = vec![];
+
+        let gradient = Gradient {
+            kind: LinearGradientPosition {
+                start: Point::new(0.0, 0.0),
+                end: Point::new(20.0, 0.0),
+            }
+            .into(),
+            stops: ColorStops(smallvec![
+                ColorStop {
+                    offset: 0.0,
+                    color: DynamicColor::from_alpha_color(GREEN),
+                },
+                ColorStop {
+                    offset: f32::INFINITY,
+                    color: DynamicColor::from_alpha_color(BLUE),
+                },
+            ]),
+            ..Default::default()
+        };
+
+        // Invalid gradient, so fall back to first color.
+        assert_eq!(
+            gradient.encode_into(&mut buf, Affine::IDENTITY, None),
+            GREEN.into()
+        );
+    }
+
+    #[test]
+    fn gradient_stop_with_nan_offset() {
+        let mut buf = vec![];
+
+        let gradient = Gradient {
+            kind: LinearGradientPosition {
+                start: Point::new(0.0, 0.0),
+                end: Point::new(20.0, 0.0),
+            }
+            .into(),
+            stops: ColorStops(smallvec![
+                ColorStop {
+                    offset: 0.0,
+                    color: DynamicColor::from_alpha_color(GREEN),
+                },
+                ColorStop {
+                    offset: f32::NAN,
+                    color: DynamicColor::from_alpha_color(BLUE),
+                },
+            ]),
+            ..Default::default()
+        };
+
+        // Invalid gradient, so fall back to first color.
+        assert_eq!(
+            gradient.encode_into(&mut buf, Affine::IDENTITY, None),
+            GREEN.into()
+        );
+    }
+
+    #[test]
+    fn gradient_radial_degenerate() {
+        let mut buf = vec![];
+
+        let gradient = Gradient {
+            kind: RadialGradientPosition {
+                start_center: Point::new(0.0, 0.0),
+                start_radius: 20.0,
+                end_center: Point::new(0.0, 0.0),
+                end_radius: 20.0,
+            }
+            .into(),
+            stops: ColorStops(smallvec![
+                ColorStop {
+                    offset: 0.0,
+                    color: DynamicColor::from_alpha_color(GREEN),
+                },
+                ColorStop {
+                    offset: 1.0,
+                    color: DynamicColor::from_alpha_color(BLUE),
+                },
+            ]),
+            ..Default::default()
+        };
+
+        assert_eq!(
+            gradient.encode_into(&mut buf, Affine::IDENTITY, None),
+            GREEN.into()
+        );
+    }
+}
diff --git a/vendor/vello_common/src/filter/drop_shadow.rs b/vendor/vello_common/src/filter/drop_shadow.rs
new file mode 100644
index 000000000..5260225c9
--- /dev/null
+++ b/vendor/vello_common/src/filter/drop_shadow.rs
@@ -0,0 +1,86 @@
+// Copyright 2026 the Vello Authors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+//! The drop shadow filter.
+
+use crate::color::{AlphaColor, Srgb};
+use crate::filter::gaussian_blur::{MAX_KERNEL_SIZE, plan_decimated_blur, transform_blur_params};
+use crate::filter::transform_offset_params;
+use crate::filter_effects::EdgeMode;
+use crate::kurbo::Affine;
+
+/// A drop shadow filter.
+#[derive(Debug)]
+pub struct DropShadow {
+    /// The x-offset of the shadow.
+    pub dx: f32,
+    /// The y-offset of the shadow.
+    pub dy: f32,
+    /// The color of the shadow.
+    pub color: AlphaColor<Srgb>,
+    /// Standard deviation for the blur (for reference/debugging).
+    pub std_deviation: f32,
+    /// Edge mode for blur sampling.
+    pub edge_mode: EdgeMode,
+    /// Number of 2x2 decimation levels to use (0 means direct convolution).
+    pub n_decimations: usize,
+    /// Pre-computed Gaussian kernel weights for the reduced blur.
+    /// Only the first `kernel_size` elements are valid.
+    pub kernel: [f32; MAX_KERNEL_SIZE],
+    /// Actual length of the kernel (kernel is padded to `MAX_KERNEL_SIZE`).
+    pub kernel_size: u8,
+}
+
+impl DropShadow {
+    /// Create a new drop shadow filter with the specified parameters.
+    ///
+    /// This precomputes the blur decimation plan and kernel for optimal performance.
+    pub fn new(
+        dx: f32,
+        dy: f32,
+        std_deviation: f32,
+        edge_mode: EdgeMode,
+        color: AlphaColor<Srgb>,
+    ) -> Self {
+        // Precompute blur plan (same logic as GaussianBlur::new)
+        let (n_decimations, kernel, kernel_size) = plan_decimated_blur(std_deviation);
+
+        Self {
+            dx,
+            dy,
+            color,
+            std_deviation,
+            edge_mode,
+            n_decimations,
+            kernel,
+            kernel_size,
+        }
+    }
+}
+
+/// Transform a drop shadow's offset and standard deviation using the affine transformation.
+///
+/// Applies the full linear transformation (rotation, scale, and shear) to the offset vector,
+/// and scales the blur standard deviation uniformly.
+///
+/// # Arguments
+/// * `dx` - Horizontal offset in user space
+/// * `dy` - Vertical offset in user space
+/// * `std_deviation` - Blur standard deviation in user space
+/// * `transform` - The transformation matrix to apply
+///
+/// # Returns
+/// A tuple of (`scaled_dx`, `scaled_dy`, `scaled_std_dev`) in device space
+pub(crate) fn transform_shadow_params(
+    dx: f32,
+    dy: f32,
+    std_deviation: f32,
+    transform: &Affine,
+) -> (f32, f32, f32) {
+    let (scaled_dx, scaled_dy) = transform_offset_params(dx, dy, transform);
+
+    // Scale the blur radius uniformly
+    let scaled_std_dev = transform_blur_params(std_deviation, transform);
+
+    (scaled_dx, scaled_dy, scaled_std_dev)
+}
diff --git a/vendor/vello_common/src/filter/flood.rs b/vendor/vello_common/src/filter/flood.rs
new file mode 100644
index 000000000..638525a66
--- /dev/null
+++ b/vendor/vello_common/src/filter/flood.rs
@@ -0,0 +1,20 @@
+// Copyright 2026 the Vello Authors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+//! The flood filter.
+
+use crate::color::{AlphaColor, Srgb};
+
+/// A flood filter.
+#[derive(Debug)]
+pub struct Flood {
+    /// The flood color.
+    pub color: AlphaColor<Srgb>,
+}
+
+impl Flood {
+    /// Create a new flood filter with the specified color.
+    pub fn new(color: AlphaColor<Srgb>) -> Self {
+        Self { color }
+    }
+}
diff --git a/vendor/vello_common/src/filter/gaussian_blur.rs b/vendor/vello_common/src/filter/gaussian_blur.rs
new file mode 100644
index 000000000..e31bfd509
--- /dev/null
+++ b/vendor/vello_common/src/filter/gaussian_blur.rs
@@ -0,0 +1,334 @@
+// Copyright 2026 the Vello Authors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+//! The gaussian blur filter.
+
+use alloc::vec::Vec;
+
+use crate::filter_effects::EdgeMode;
+use crate::kurbo::Affine;
+use crate::util::extract_scales;
+use core::f32::consts::E;
+#[cfg(not(feature = "std"))]
+use peniko::kurbo::common::FloatFuncs as _;
+
+/// Scale a blur's standard deviation uniformly based on the transformation.
+///
+/// Extracts the scale factors from the transformation matrix using SVD and
+/// averages them to get a uniform scale factor for the blur radius.
+///
+/// # Arguments
+/// * `std_deviation` - The blur standard deviation in user space
+/// * `transform` - The transformation matrix to extract scale from
+///
+/// # Returns
+/// The scaled standard deviation in device space
+pub(crate) fn transform_blur_params(std_deviation: f32, transform: &Affine) -> f32 {
+    let (scale_x, scale_y) = extract_scales(transform);
+    let uniform_scale = (scale_x + scale_y) / 2.0;
+    // TODO: Support separate std_deviation for x and y axes (std_deviation_x, std_deviation_y)
+    // to properly handle non-uniform scaling. This would eliminate the need for uniform_scale
+    // and allow blur to scale independently along each axis.
+    std_deviation * uniform_scale
+}
+
+/// Maximum size of the Gaussian kernel (must be odd and equal to or smaller than [`u8::MAX`]).
+///
+/// The multi-scale decimation algorithm guarantees that kernel size never exceeds this value.
+/// Decimation stops when remaining variance ≤ 4.0 (σ ≤ 2.0), which produces kernels of size
+/// at most 13 (radius = ceil(3σ) = 6, size = 1 + 2×6 = 13).
+// Keep in sync with MAX_KERNEL_SIZE in vello_sparse_shaders/shaders/filters.wgsl
+pub const MAX_KERNEL_SIZE: usize = 13;
+
+#[cfg(test)]
+const _: () = const {
+    if MAX_KERNEL_SIZE.is_multiple_of(2) {
+        panic!("`MAX_KERNEL_SIZE` must be odd");
+    }
+    if MAX_KERNEL_SIZE > u8::MAX as usize {
+        panic!("`MAX_KERNEL_SIZE` must be less than or equal to `u8::MAX`");
+    }
+};
+
+/// A gaussian blur.
+#[derive(Debug)]
+pub struct GaussianBlur {
+    /// The standard deviation.
+    pub std_deviation: f32,
+    /// Number of 2× decimation levels to use (0 means no decimation, direct convolution).
+    pub n_decimations: usize,
+    /// Pre-computed Gaussian kernel weights for the reduced blur.
+    /// Only the first `kernel_size` elements are valid.
+    pub kernel: [f32; MAX_KERNEL_SIZE],
+    /// Actual length of the kernel (rest is padding up to `MAX_KERNEL_SIZE`).
+    pub kernel_size: u8,
+    /// Edge mode for handling out-of-bounds sampling.
+    pub edge_mode: EdgeMode,
+}
+
+impl GaussianBlur {
+    /// Create a new Gaussian blur filter with the specified standard deviation.
+    ///
+    /// This precomputes the decimation plan, kernel, and radius for optimal performance.
+    pub fn new(std_deviation: f32, edge_mode: EdgeMode) -> Self {
+        let (n_decimations, kernel, kernel_size) = plan_decimated_blur(std_deviation);
+
+        Self {
+            std_deviation,
+            edge_mode,
+            n_decimations,
+            kernel,
+            kernel_size,
+        }
+    }
+}
+
+/// Compute the blur execution plan based on standard deviation.
+///
+/// Returns (`n_decimations`, `kernel`, `kernel_size`):
+/// - `n_decimations`: Number of 2× downsampling steps to perform (per axis)
+/// - `kernel`: Pre-computed Gaussian kernel weights (fixed-size array)
+/// - `kernel_size`: Actual length of the kernel (rest is zero-padded)
+pub fn plan_decimated_blur(std_deviation: f32) -> (usize, [f32; MAX_KERNEL_SIZE], u8) {
+    if std_deviation <= 0.0 {
+        // Invalid standard deviation, return identity kernel (no blur)
+        let mut kernel = [0.0; MAX_KERNEL_SIZE];
+        kernel[0] = 1.0;
+        return (0, kernel, 1);
+    }
+
+    // Compute decimation plan using variance analysis.
+    // Variance (σ²) has the additive property: applying two blurs sequentially
+    // adds their variances together. We use this to decompose the blur.
+    //
+    // Mathematical Foundation: From probability theory, convolving two Gaussians
+    // G(σ₁) ⊗ G(σ₂) = G(√(σ₁² + σ₂²)). This means variance is additive: σ²_total = σ²_1 + σ²_2.
+    // Rearranging: σ²_2 = σ²_total - σ²_1, allowing us to decompose the target blur.
+    let variance = std_deviation * std_deviation;
+    let mut n_decimations = 0;
+    let mut remaining_variance = variance;
+
+    // Each decimation step:
+    // 1. Applies [1,3,3,1] blur which adds variance = 0.75 per axis
+    // 2. Downsamples by 2× per axis, adding variance = 0.75 × 4 = 3.0 total
+    // 3. The 2× downsampling scales the remaining variance by 0.25 (= 1/2²)
+    // Stop when remaining variance ≤ 4.0 (σ ≈ 2), as further decimation isn't beneficial.
+    while remaining_variance > 4.0 {
+        remaining_variance = (remaining_variance - 3.0) * 0.25;
+        n_decimations += 1;
+    }
+    // Compute the reduced standard deviation to apply at the decimated resolution
+    let remaining_sigma = remaining_variance.sqrt();
+    // Compute Gaussian kernel for the reduced blur
+    let (kernel, kernel_size) = compute_gaussian_kernel(remaining_sigma);
+
+    (n_decimations, kernel, kernel_size)
+}
+
+/// Compute 1D Gaussian kernel weights for separable convolution.
+///
+/// Returns (`kernel_weights`, `kernel_size`) where `kernel_size = 2×radius + 1`.
+/// The kernel is stored in a fixed-size array to avoid heap allocation.
+/// Uses the standard Gaussian formula: G(x) = exp(-x² / (2σ²)), normalized to sum to 1.
+pub fn compute_gaussian_kernel(std_deviation: f32) -> ([f32; MAX_KERNEL_SIZE], u8) {
+    // Use radius = 3σ to capture 99.7% of the Gaussian distribution.
+    // Beyond ±3σ, the Gaussian values are negligible (<0.3%).
+    let radius = (3.0 * std_deviation).ceil() as usize;
+    let kernel_size = (1 + radius * 2).min(MAX_KERNEL_SIZE) as u8;
+
+    let mut kernel = [0.0; MAX_KERNEL_SIZE];
+    // Compute Gaussian weights using the formula: G(x) = exp(-x² / (2σ²))
+    // This creates a symmetric bell curve centered at the middle of the kernel.
+    let gaussian_denominator = 2.0 * std_deviation * std_deviation;
+    let mut sum = 0.0;
+    let kernel_center = (kernel_size / 2) as f32;
+    for (i, weight) in kernel.iter_mut().enumerate().take(usize::from(kernel_size)) {
+        // Compute distance from center (0 at center, increases outward)
+        let x = (i as f32) - kernel_center;
+        // Apply Gaussian formula: weight decreases exponentially with squared distance
+        *weight = E.powf(-x * x / gaussian_denominator);
+        sum += *weight;
+    }
+
+    // Normalize weights to sum to 1.0, ensuring the blur doesn't change overall brightness.
+    // Without normalization, blurring a uniform gray area could make it brighter/darker.
+    let scale = 1.0 / sum;
+    for weight in kernel.iter_mut().take(usize::from(kernel_size)) {
+        *weight *= scale;
+    }
+
+    (kernel, kernel_size)
+}
+
+/// Tracks dimensions through a chain of downscale/upscale operations.
+#[derive(Debug, Default)]
+pub struct DecimationSizer {
+    width: u16,
+    height: u16,
+    dim_stack: Vec<(u16, u16)>,
+}
+
+impl DecimationSizer {
+    /// Create a new sizer with the given initial dimensions.
+    #[inline]
+    pub fn new(width: u16, height: u16) -> Self {
+        Self {
+            width,
+            height,
+            dim_stack: Vec::new(),
+        }
+    }
+
+    /// Reset the sizer so it can be reused.
+    #[inline]
+    pub fn reset(&mut self, width: u16, height: u16) {
+        self.width = width;
+        self.height = height;
+        self.dim_stack.clear();
+    }
+
+    /// Returns the current logical dimensions.
+    #[inline]
+    pub fn current(&self) -> (u16, u16) {
+        (self.width, self.height)
+    }
+
+    /// Apply a new downscale operation.
+    #[inline]
+    pub fn downscale(&mut self) -> (u16, u16) {
+        self.dim_stack.push((self.width, self.height));
+        self.width = self.width.div_ceil(2);
+        self.height = self.height.div_ceil(2);
+        (self.width, self.height)
+    }
+
+    /// Apply a new upscale operation.
+    #[inline]
+    pub fn upscale(&mut self) -> (u16, u16) {
+        let (target_w, target_h) = self.dim_stack.pop().unwrap();
+        // Clamp because upscale can exceed target on odd dimensions (e.g., 5→3→6 > 5)
+        self.width = (self.width * 2).min(target_w);
+        self.height = (self.height * 2).min(target_h);
+        (self.width, self.height)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::filter::gaussian_blur::{
+        DecimationSizer, compute_gaussian_kernel, plan_decimated_blur,
+    };
+
+    /// Test Gaussian kernel computation for small σ.
+    #[test]
+    fn test_gaussian_kernel_small_sigma() {
+        let (kernel, size) = compute_gaussian_kernel(1.0);
+        // For σ=1.0, radius = ceil(3.0) = 3, size = 2*3+1 = 7
+        assert_eq!(size, 7);
+
+        // Kernel should be symmetric
+        for i in 0..size / 2 {
+            assert!((kernel[usize::from(i)] - kernel[usize::from(size - 1 - i)]).abs() < 1e-6);
+        }
+
+        // Kernel should sum to 1.0 (normalized)
+        let sum: f32 = kernel.iter().take(usize::from(size)).sum();
+        assert!((sum - 1.0).abs() < 1e-6);
+
+        // Center should be the largest weight
+        let center_idx = size / 2;
+        for i in 0..size {
+            if i != center_idx {
+                assert!(kernel[usize::from(center_idx)] >= kernel[usize::from(i)]);
+            }
+        }
+    }
+
+    /// Test Gaussian kernel computation for very small σ (near-zero).
+    #[test]
+    fn test_gaussian_kernel_very_small_sigma() {
+        let (kernel, size) = compute_gaussian_kernel(0.1);
+        // For σ=0.1, radius = ceil(0.3) = 1, size = 3
+        assert_eq!(size, 3);
+        // Should sum to 1.0
+        let sum: f32 = kernel.iter().take(usize::from(size)).sum();
+        assert!((sum - 1.0).abs() < 1e-6);
+        // Center weight should be dominant for very small σ
+        assert!(kernel[1] > 0.9); // Center is highly weighted
+    }
+
+    /// Test Gaussian kernel for fractional σ.
+    #[test]
+    fn test_gaussian_kernel_fractional_sigma() {
+        let (kernel, size) = compute_gaussian_kernel(0.5);
+        // For σ=0.5, radius = ceil(1.5) = 2, size = 5
+        assert_eq!(size, 5);
+
+        // Should still sum to 1.0
+        let sum: f32 = kernel.iter().take(usize::from(size)).sum();
+        assert!((sum - 1.0).abs() < 1e-6);
+    }
+
+    /// Test decimation plan for small blur (no decimation).
+    #[test]
+    fn test_plan_no_decimation() {
+        let (n_decimations, _kernel, _size) = plan_decimated_blur(1.0);
+        // σ=1.0 → variance=1.0, should not decimate
+        assert_eq!(n_decimations, 0);
+    }
+
+    /// Test decimation plan for medium blur (some decimation).
+    #[test]
+    fn test_plan_with_decimation() {
+        let (n_decimations, _kernel, _size) = plan_decimated_blur(5.0);
+        // σ=5.0 → variance=25.0, should decimate
+        assert_eq!(n_decimations, 2);
+    }
+
+    /// Test decimation plan at boundary (σ=2.0).
+    #[test]
+    fn test_plan_decimation_boundary() {
+        let (n_decimations, _kernel, _size) = plan_decimated_blur(2.0);
+        // σ=2.0 → variance=4.0, right at the boundary
+        assert_eq!(n_decimations, 0);
+    }
+
+    /// Test decimation plan for negative σ (invalid, should return identity).
+    #[test]
+    fn test_plan_negative_sigma() {
+        let (n_decimations, kernel, size) = plan_decimated_blur(-1.0);
+        assert_eq!(n_decimations, 0);
+        assert_eq!(size, 1);
+        assert!((kernel[0] - 1.0).abs() < 1e-6);
+    }
+
+    #[test]
+    fn test_decimation_sizer_even() {
+        let mut sizer = DecimationSizer::new(8, 8);
+        assert_eq!(sizer.current(), (8, 8));
+
+        assert_eq!(sizer.downscale(), (4, 4));
+        assert_eq!(sizer.downscale(), (2, 2));
+
+        assert_eq!(sizer.upscale(), (4, 4));
+        assert_eq!(sizer.upscale(), (8, 8));
+    }
+
+    #[test]
+    fn test_decimation_sizer_odd() {
+        let mut sizer = DecimationSizer::new(5, 7);
+        assert_eq!(sizer.downscale(), (3, 4));
+        assert_eq!(sizer.downscale(), (2, 2));
+
+        // Upscale clamps to the pre-downscale target
+        assert_eq!(sizer.upscale(), (3, 4));
+        assert_eq!(sizer.upscale(), (5, 7));
+    }
+
+    #[test]
+    fn test_decimation_sizer_single_level() {
+        let mut sizer = DecimationSizer::new(100, 50);
+        assert_eq!(sizer.downscale(), (50, 25));
+        assert_eq!(sizer.upscale(), (100, 50));
+    }
+}
diff --git a/vendor/vello_common/src/filter/mod.rs b/vendor/vello_common/src/filter/mod.rs
new file mode 100644
index 000000000..4da635d61
--- /dev/null
+++ b/vendor/vello_common/src/filter/mod.rs
@@ -0,0 +1,94 @@
+// Copyright 2026 the Vello Authors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+//! Common filter helper functions.
+//!
+//! Unlike the filters defines in [`crate::filter_effects`], the filters in this module
+//! represent a special representation of each filter to be used as the basis for rendering in
+//! `vello_hybrid` and `vello_cpu`.
+
+use crate::filter::drop_shadow::{DropShadow, transform_shadow_params};
+use crate::filter::flood::Flood;
+use crate::filter::gaussian_blur::{GaussianBlur, transform_blur_params};
+use crate::filter::offset::Offset;
+use crate::filter_effects::{Filter, FilterPrimitive};
+use crate::kurbo::{Affine, Vec2};
+
+pub mod drop_shadow;
+pub mod flood;
+pub mod gaussian_blur;
+pub mod offset;
+
+/// A filter that has been prepared for rendering.
+#[derive(Debug)]
+pub enum PreparedFilter {
+    /// A flood filter.
+    Flood(Flood),
+    /// A gaussian blur filter.
+    GaussianBlur(GaussianBlur),
+    /// An offset filter.
+    Offset(Offset),
+    /// A drop shadow filter.
+    DropShadow(DropShadow),
+}
+
+impl PreparedFilter {
+    /// Build a new prepared filter for the given transform.
+    pub fn new(filter: &Filter, transform: &Affine) -> Self {
+        // Multi-primitive filter graphs are not yet implemented.
+        if filter.graph.primitives.len() != 1 {
+            unimplemented!("Multi-primitive filter graphs are not yet supported");
+        }
+
+        match &filter.graph.primitives[0] {
+            FilterPrimitive::Flood { color } => {
+                let flood = Flood::new(*color);
+                Self::Flood(flood)
+            }
+            FilterPrimitive::GaussianBlur {
+                std_deviation,
+                edge_mode,
+            } => {
+                let scaled_std_dev = transform_blur_params(*std_deviation, transform);
+                let blur = GaussianBlur::new(scaled_std_dev, *edge_mode);
+                Self::GaussianBlur(blur)
+            }
+            FilterPrimitive::DropShadow {
+                dx,
+                dy,
+                std_deviation,
+                color,
+                edge_mode,
+            } => {
+                let (scaled_dx, scaled_dy, scaled_std_dev) =
+                    transform_shadow_params(*dx, *dy, *std_deviation, transform);
+                let drop_shadow =
+                    DropShadow::new(scaled_dx, scaled_dy, scaled_std_dev, *edge_mode, *color);
+
+                Self::DropShadow(drop_shadow)
+            }
+            FilterPrimitive::Offset { dx, dy } => {
+                let (scaled_dx, scaled_dy) = transform_offset_params(*dx, *dy, transform);
+                let offset = Offset::new(scaled_dx, scaled_dy);
+
+                Self::Offset(offset)
+            }
+            _ => {
+                // Other primitives like Blend, ColorMatrix, ComponentTransfer, etc.
+                // are not yet implemented
+                unimplemented!("Other filter primitives not yet implemented");
+            }
+        }
+    }
+}
+
+/// Transform an offset's dx/dy using the affine transformation's linear part.
+///
+/// # Returns
+/// A tuple of (`scaled_dx`, `scaled_dy`) in device space.
+fn transform_offset_params(dx: f32, dy: f32, transform: &Affine) -> (f32, f32) {
+    let offset = Vec2::new(dx as f64, dy as f64);
+    let [a, b, c, d, _, _] = transform.as_coeffs();
+    let transformed_offset = Vec2::new(a * offset.x + c * offset.y, b * offset.x + d * offset.y);
+    (transformed_offset.x as f32, transformed_offset.y as f32)
+}
diff --git a/vendor/vello_common/src/filter/offset.rs b/vendor/vello_common/src/filter/offset.rs
new file mode 100644
index 000000000..3ac7d5a27
--- /dev/null
+++ b/vendor/vello_common/src/filter/offset.rs
@@ -0,0 +1,22 @@
+// Copyright 2026 the Vello Authors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+//! The offset filter.
+
+/// Translation/shift filter.
+///
+/// This shifts the input image by `(dx, dy)` in device pixel space.
+#[derive(Clone, Copy, Debug)]
+pub struct Offset {
+    /// The x-offset that should be applied.
+    pub dx: f32,
+    /// The y-offset that should be applied.
+    pub dy: f32,
+}
+
+impl Offset {
+    /// Create a new offset filter.
+    pub fn new(dx: f32, dy: f32) -> Self {
+        Self { dx, dy }
+    }
+}
diff --git a/vendor/vello_common/src/filter_effects.rs b/vendor/vello_common/src/filter_effects.rs
new file mode 100644
index 000000000..40d7f82b9
--- /dev/null
+++ b/vendor/vello_common/src/filter_effects.rs
@@ -0,0 +1,1089 @@
+// Copyright 2025 the Vello Authors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+//! Filter effects API based on the W3C Filter Effects specification.
+//!
+//! This module provides a comprehensive filter system supporting both high-level
+//! CSS filter functions and low-level SVG filter primitives. The API is designed
+//! to follow the W3C Filter Effects Module Level 1 specification.
+//!
+//! See: <https://drafts.fxtf.org/filter-effects/>
+//!
+//! ## Implementation Status
+//!
+//! ### ✅ Implemented
+//!
+//! **Filter Functions:**
+//! - `Blur` - Gaussian blur effect
+//!
+//! **Filter Primitives (Single Use Only):**
+//! - `Flood` - Solid color fill
+//! - `GaussianBlur` - Gaussian blur filter
+//! - `DropShadow` - Drop shadow effect (compound primitive)
+//! - `Offset` - Translation/shift (single primitive)
+//!
+//! **Note:** Currently only single primitive filters are supported. Filter graphs with
+//! multiple connected primitives are not yet implemented.
+//!
+//! ### 🚧 Not Yet Implemented
+//!
+//! **Core Features:**
+//! - `FilterGraph` execution - Chaining multiple filter primitives together
+//! - `FilterInputs` - Connecting primitives to create complex effects
+//!
+//! **Filter Functions:**
+//! - `Brightness`, `Contrast`, `Grayscale`, `HueRotate`, `Invert`,
+//!   `Opacity`, `Saturate`, `Sepia`
+//!
+//! **Filter Primitives:**
+//! - `ColorMatrix` - Matrix-based color transformation
+//! - `Composite` - Porter-Duff compositing operations
+//! - `Blend` - Blend mode operations
+//! - `Morphology` - Dilate/erode operations
+//! - `ConvolveMatrix` - Custom convolution kernels
+//! - `Turbulence` - Perlin noise generation
+//! - `DisplacementMap` - Pixel displacement
+//! - `ComponentTransfer` - Per-channel transfer functions
+//! - `Image` - External image reference
+//! - `Tile` - Tiling operation
+//! - `DiffuseLighting`, `SpecularLighting` - Lighting effects
+
+use crate::color::{AlphaColor, Srgb};
+use crate::kurbo::{Affine, Rect};
+use alloc::sync::Arc;
+use alloc::vec::Vec;
+use smallvec::SmallVec;
+
+/// The main filter system.
+///
+/// A filter combines a graph of filter primitives with optional spatial bounds.
+/// If bounds are specified, the filter only applies within that region.
+#[derive(Debug, Clone, PartialEq)]
+pub struct Filter {
+    /// Filter graph defining the effect pipeline.
+    pub graph: Arc<FilterGraph>,
+    // TODO: Add bounds restricting where the filter applies.
+    // Optional bounds restricting where the filter applies.
+    // If `None`, the filter applies to the entire filtered element.
+    // pub bounds: Option<Rect>,
+}
+
+impl Filter {
+    /// Create a simple filter system from a filter function.
+    ///
+    /// Converts a high-level CSS-style filter function into a filter graph.
+    /// Use this for simple effects like blur, brightness, etc.
+    pub fn from_function(function: FilterFunction) -> Self {
+        // Convert function to primitive
+        let primitive = match function {
+            FilterFunction::Blur { radius } => FilterPrimitive::GaussianBlur {
+                std_deviation: radius,
+                edge_mode: EdgeMode::default(),
+            },
+            _ => unimplemented!("Filter function {:?} not supported", function),
+        };
+
+        Self::from_primitive(primitive)
+    }
+
+    /// Create a filter system from a filter primitive.
+    ///
+    /// Creates a simple filter graph with a single primitive.
+    /// Use this for direct access to low-level SVG filter operations.
+    pub fn from_primitive(primitive: FilterPrimitive) -> Self {
+        let mut graph = FilterGraph::new();
+        let filter_id = graph.add(primitive, None);
+        graph.set_output(filter_id);
+
+        Self {
+            graph: Arc::new(graph),
+        }
+    }
+
+    /// Calculate the bounds expansion for this filter in pixel/device space.
+    ///
+    /// Returns a `Rect` representing how many extra pixels are needed around the
+    /// filtered region to correctly compute the filter effect. For example, a blur
+    /// filter needs to sample beyond the original bounds to avoid edge artifacts.
+    ///
+    /// The expansion accounts for the transform (rotation, scale, and shear) to compute
+    /// the correct axis-aligned bounding box expansion in device space.
+    ///
+    /// The returned rect is centered at origin:
+    /// - x0: negative left expansion (in pixels)
+    /// - y0: negative top expansion (in pixels)
+    /// - x1: positive right expansion (in pixels)
+    /// - y1: positive bottom expansion (in pixels)
+    ///
+    /// # Arguments
+    /// * `transform` - The transform applied to this filter layer
+    pub fn bounds_expansion(&self, transform: &Affine) -> Rect {
+        let [a, b, c, d, _e, _f] = transform.as_coeffs();
+        let linear_only = Affine::new([a, b, c, d, 0.0, 0.0]);
+
+        self.graph.bounds_expansion(&linear_only)
+    }
+}
+
+/// A directed acyclic graph (DAG) of filter operations.
+///
+/// The graph represents a pipeline of filter primitives where outputs of some
+/// primitives can be used as inputs to others. Each primitive has a unique `FilterId`.
+#[derive(Debug, Clone, PartialEq)]
+pub struct FilterGraph {
+    /// All filter primitives in the graph, stored in insertion order.
+    pub primitives: SmallVec<[FilterPrimitive; 1]>,
+    /// The final output filter ID whose result is the output of this graph.
+    pub output: FilterId,
+    /// Next available filter ID (monotonically increasing counter).
+    next_id: u16,
+    /// Accumulated bounds expansion from all primitives in the graph, cached in user space.
+    /// This is the axis-aligned bounding box of the expansion region (centered at origin),
+    /// which can be transformed to device space when needed.
+    expansion_rect: Rect,
+}
+
+impl Default for FilterGraph {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl FilterGraph {
+    /// Create a new empty filter graph.
+    pub fn new() -> Self {
+        Self {
+            primitives: SmallVec::new(),
+            output: FilterId(0),
+            next_id: 0,
+            expansion_rect: Rect::ZERO,
+        }
+    }
+
+    /// Add a filter primitive with optional inputs.
+    ///
+    /// Returns a `FilterId` that can be referenced by other primitives.
+    /// Automatically updates the accumulated bounds expansion based on the primitive's requirements.
+    pub fn add(&mut self, primitive: FilterPrimitive, _inputs: Option<FilterInputs>) -> FilterId {
+        let id = FilterId(self.next_id);
+        self.next_id += 1;
+
+        // Update accumulated expansion by taking the union of rects
+        let primitive_rect = primitive.expansion_rect();
+        self.expansion_rect = self.expansion_rect.union(primitive_rect);
+
+        self.primitives.push(primitive);
+
+        id
+    }
+
+    /// Set the output filter for the graph.
+    pub fn set_output(&mut self, output: FilterId) {
+        self.output = output;
+    }
+
+    /// Get the accumulated bounds expansion for all primitives in this graph.
+    ///
+    /// This returns the expansion required by all primitives in the graph,
+    /// representing the padding needed to render all filter effects correctly.
+    ///
+    /// The expansion accounts for the transform (rotation, scale, and shear) to compute
+    /// the correct axis-aligned bounding box expansion in device space.
+    ///
+    /// # Arguments
+    /// * `transform` - The transform applied to this filter layer
+    pub fn bounds_expansion(&self, transform: &Affine) -> Rect {
+        // Transform the cached expansion rect to device space
+        // transform_rect_bbox computes the axis-aligned bounding box of the transformed rect
+        transform.transform_rect_bbox(self.expansion_rect)
+    }
+}
+
+/// All possible filter effects.
+///
+/// This enum allows choosing between high-level filter functions (simple CSS-style effects)
+/// and low-level filter primitives (complex SVG-style effects with full control).
+/// Use `FilterFunction` for common effects like blur, and `FilterPrimitive` for
+/// advanced composition and custom filter graphs.
+#[derive(Debug, Clone)]
+pub enum FilterEffect {
+    /// Simple, high-level filter functions.
+    Function(FilterFunction),
+    /// Low-level filter primitives (granular control).
+    Primitive(FilterPrimitive),
+}
+
+/// High-level filter functions for common effects (CSS filter functions).
+///
+/// These match the CSS Filter Effects specification and provide simple,
+/// commonly-used visual effects without needing to construct a filter graph.
+///
+/// See: <https://drafts.fxtf.org/filter-effects/#filter-functions>
+#[derive(Debug, Clone)]
+pub enum FilterFunction {
+    /// Gaussian blur effect.
+    ///
+    /// Applies a Gaussian blur to the input image. Larger radius values
+    /// produce more blur. The blur is applied equally in all directions.
+    ///
+    /// Note: Per the W3C Filter Effects specification, this `radius` parameter
+    /// represents the standard deviation (σ) of the Gaussian function, not the
+    /// effective blur range. The effective blur range is approximately 3× this value.
+    Blur {
+        /// Standard deviation of the Gaussian blur in pixels. Must be non-negative.
+        /// A value of 0 means no blur.
+        ///
+        /// Despite being called "radius" (to match CSS filter syntax), this is
+        /// actually the standard deviation. The visible blur effect extends
+        /// approximately 3 times this value in each direction.
+        radius: f32,
+    },
+    //
+    // ============================================================
+    // TODO: The following filter functions are not yet implemented
+    // ============================================================
+    //
+    /// Brightness adjustment.
+    ///
+    /// Adjusts the brightness of the input image using a linear multiplier.
+    Brightness {
+        /// Brightness amount: 0.0 = completely black, 1.0 = no change, >1.0 = brighter.
+        /// Must be non-negative.
+        amount: f32,
+    },
+    /// Contrast adjustment.
+    ///
+    /// Adjusts the contrast of the input image.
+    Contrast {
+        /// Contrast amount: 0.0 = uniform gray, 1.0 = no change, >1.0 = higher contrast.
+        /// Must be non-negative.
+        amount: f32,
+    },
+    /// Grayscale conversion.
+    ///
+    /// Converts the input to grayscale. Amount controls the strength of the conversion.
+    Grayscale {
+        /// Grayscale amount: 0.0 = original colors, 1.0 = full grayscale.
+        /// Values should be in range [0.0, 1.0].
+        amount: f32,
+    },
+    /// Hue rotation.
+    ///
+    /// Rotates the hue of all colors in the input image by the specified angle.
+    HueRotate {
+        /// Rotation angle in degrees. Can be negative.
+        /// 0° = no change, 180° = opposite hue, 360° = back to original.
+        angle: f32,
+    },
+    /// Color inversion.
+    ///
+    /// Inverts the colors of the input image.
+    Invert {
+        /// Inversion amount: 0.0 = original colors, 1.0 = fully inverted.
+        /// Values should be in range [0.0, 1.0].
+        amount: f32,
+    },
+    /// Opacity adjustment.
+    ///
+    /// Multiplies the alpha channel by the specified amount.
+    Opacity {
+        /// Opacity amount: 0.0 = fully transparent, 1.0 = no change.
+        /// Values should be in range [0.0, 1.0].
+        amount: f32,
+    },
+    /// Saturation adjustment.
+    ///
+    /// Adjusts the color saturation of the input image.
+    Saturate {
+        /// Saturation amount: 0.0 = completely desaturated (grayscale),
+        /// 1.0 = no change, >1.0 = oversaturated.
+        /// Must be non-negative.
+        amount: f32,
+    },
+    /// Sepia tone effect.
+    ///
+    /// Applies a sepia tone effect (vintage/old photo appearance).
+    Sepia {
+        /// Sepia amount: 0.0 = original colors, 1.0 = full sepia tone.
+        /// Values should be in range [0.0, 1.0].
+        amount: f32,
+    },
+}
+
+/// Edge mode for filter operations.
+///
+/// Determines how to extend the input image when filter operations require sampling
+/// beyond the original image boundaries. This is particularly important for blur and
+/// convolution operations near edges.
+///
+/// See: <https://drafts.fxtf.org/filter-effects/#element-attrdef-filter-primitive-edgemode>
+#[derive(Debug, Default, Clone, Copy, PartialEq, Eq)]
+pub enum EdgeMode {
+    /// Extend by duplicating edge pixels (clamp to edge).
+    ///
+    /// The input image is extended along each border by replicating the color values
+    /// at the given edge of the input image. This prevents dark halos around edges.
+    Duplicate,
+    /// Extend by wrapping to the opposite edge (repeat/tile).
+    ///
+    /// The input image is extended by taking color values from the opposite edge,
+    /// creating a tiling effect.
+    Wrap,
+    /// Extend by mirroring across the edge.
+    ///
+    /// The input image is extended by taking color values mirrored across the edge.
+    /// This creates seamless continuation at boundaries.
+    Mirror,
+    /// Extend with transparent black (zeros).
+    ///
+    /// The input image is extended with pixel values of zero for R, G, B and A.
+    /// This is the default and most common mode, creating natural fade-to-transparent edges.
+    #[default]
+    None,
+}
+
+/// Low-level filter primitives for granular control (SVG filter primitives).
+///
+/// These are the building blocks for complex filter effects, corresponding to SVG
+/// filter primitives. They can be combined in a `FilterGraph` to create sophisticated
+/// visual effects.
+///
+/// See: <https://drafts.fxtf.org/filter-effects/#FilterPrimitivesOverview>
+#[derive(Debug, Clone, PartialEq)]
+pub enum FilterPrimitive {
+    /// Generate a solid color fill.
+    ///
+    /// Creates a rectangle filled with the specified color, typically used as
+    /// input to other filter operations (e.g., for colored shadows).
+    Flood {
+        /// Fill color with alpha channel.
+        color: AlphaColor<Srgb>,
+    },
+    /// Gaussian blur filter.
+    ///
+    /// Applies a Gaussian blur using the specified standard deviation (σ).
+    /// The effective blur range (distance over which pixels are sampled) is
+    /// approximately 3 × `std_deviation`, as this captures ~99.7% of the
+    /// Gaussian distribution.
+    GaussianBlur {
+        /// Standard deviation for the blur kernel. Larger values create more blur.
+        /// Must be non-negative. A value of 0 means no blur.
+        ///
+        /// This directly corresponds to the σ (sigma) parameter in the Gaussian
+        /// function. The visible blur effect extends approximately 3σ in each direction.
+        ///
+        /// TODO: Per the W3C specification, this should support separate x and y values.
+        /// The spec allows `stdDeviation` to be either one number (applied to both axes)
+        /// or two numbers (first for x-axis, second for y-axis). Currently only uniform
+        /// blur is supported. Consider changing to `(f32, f32)` or a dedicated type.
+        std_deviation: f32,
+        /// Edge mode determining how pixels beyond the input bounds are handled.
+        edge_mode: EdgeMode,
+    },
+    /// Drop shadow effect (compound primitive).
+    ///
+    /// Creates a drop shadow by blurring the input's alpha channel, offsetting it,
+    /// and compositing it with the original. This is a compound operation that
+    /// combines multiple primitive operations into one.
+    ///
+    /// See: <https://drafts.fxtf.org/filter-effects-2/#feDropShadowElement>
+    DropShadow {
+        /// Horizontal offset of the shadow in pixels. Positive values shift right.
+        dx: f32,
+        /// Vertical offset of the shadow in pixels. Positive values shift down.
+        dy: f32,
+        /// Blur standard deviation for the shadow. Larger values create softer shadows.
+        std_deviation: f32,
+        /// Shadow color with alpha channel. Alpha controls shadow opacity.
+        color: AlphaColor<Srgb>,
+        /// Edge mode for handling boundaries during blur operation.
+        /// Default is `EdgeMode::None` per SVG spec.
+        edge_mode: EdgeMode,
+    },
+    //
+    // ============================================================
+    // TODO: The following filter primitives are not yet implemented
+    // ============================================================
+    //
+    /// Matrix-based color transformation.
+    ///
+    /// Applies a 4x5 matrix transformation to colors, allowing arbitrary
+    /// color space transformations, hue shifts, and color adjustments.
+    ColorMatrix {
+        /// 4x5 color transformation matrix: 4 rows (R,G,B,A) × 5 columns (R,G,B,A,offset).
+        /// Each output channel is computed as a linear combination of input channels plus offset.
+        matrix: [f32; 20],
+    },
+    /// Geometric offset/translation.
+    ///
+    /// Shifts the input image by the specified offset. Useful for creating
+    /// shadow effects or positioning elements in a filter graph.
+    Offset {
+        /// Horizontal offset in pixels. Positive values shift right.
+        dx: f32,
+        /// Vertical offset in pixels. Positive values shift down.
+        dy: f32,
+    },
+
+    /// Composite two inputs using Porter-Duff compositing operations.
+    ///
+    /// Combines two input images using standard compositing operators
+    /// (over, in, out, atop, xor) or custom arithmetic combination.
+    Composite {
+        /// Porter-Duff compositing operator to apply.
+        operator: CompositeOperator,
+    },
+    /// Blend two inputs using blend modes.
+    ///
+    /// Combines two input images using Photoshop-style blend modes
+    /// (multiply, screen, overlay, etc.).
+    Blend {
+        /// Blend mode determining how colors are combined.
+        mode: BlendMode,
+    },
+    /// Morphological operations (dilate/erode).
+    ///
+    /// Expands (dilate) or contracts (erode) the shapes in the input image.
+    /// Useful for creating outline effects or cleaning up edges.
+    Morphology {
+        /// Morphological operator determining whether to erode or dilate.
+        operator: MorphologyOperator,
+        /// Operation radius in pixels. Larger values create stronger effects.
+        radius: f32,
+    },
+    /// Custom convolution kernel for image processing.
+    ///
+    /// Applies a custom convolution matrix to the input image, enabling
+    /// effects like sharpening, edge detection, embossing, and custom filters.
+    ConvolveMatrix {
+        /// Convolution kernel specification including size, values, and normalization.
+        kernel: ConvolutionKernel,
+    },
+    /// Generate Perlin noise/turbulence patterns.
+    ///
+    /// Creates procedural noise patterns useful for textures, clouds,
+    /// marble effects, and other organic-looking randomness.
+    Turbulence {
+        /// Base frequency for noise generation. Higher values create finer detail.
+        base_frequency: f32,
+        /// Number of octaves for fractal noise. More octaves add finer detail.
+        num_octaves: u32,
+        /// Random seed for reproducible noise generation.
+        seed: u32,
+        /// Type of noise: smooth fractal or more chaotic turbulence.
+        turbulence_type: TurbulenceType,
+    },
+    /// Displace pixels using a displacement map.
+    ///
+    /// Uses the color values from a second input to spatially displace pixels
+    /// in the primary input, creating warping and distortion effects.
+    DisplacementMap {
+        /// Scale factor controlling the displacement intensity.
+        scale: f32,
+        /// Color channel from the displacement map used for X-axis displacement.
+        x_channel: ColorChannel,
+        /// Color channel from the displacement map used for Y-axis displacement.
+        y_channel: ColorChannel,
+    },
+    /// Per-channel component transfer using lookup tables or functions.
+    ///
+    /// Applies independent transfer functions to each color channel,
+    /// enabling color corrections, gamma adjustments, and custom mappings.
+    ComponentTransfer {
+        /// Transfer function applied to the red channel (None = identity).
+        red_function: Option<TransferFunction>,
+        /// Transfer function applied to the green channel (None = identity).
+        green_function: Option<TransferFunction>,
+        /// Transfer function applied to the blue channel (None = identity).
+        blue_function: Option<TransferFunction>,
+        /// Transfer function applied to the alpha channel (None = identity).
+        alpha_function: Option<TransferFunction>,
+    },
+    /// Reference an external image as filter input.
+    ///
+    /// Allows using pre-existing images (from an atlas or resource) as
+    /// input to filter operations, useful for texturing and overlays.
+    Image {
+        /// Identifier referencing an image in the resource atlas.
+        image_id: u32,
+        /// Optional 2D affine transformation matrix [a, b, c, d, e, f].
+        /// Transforms the image before using it as filter input.
+        transform: Option<[f32; 6]>,
+    },
+    /// Tile the input to fill the filter region.
+    ///
+    /// Repeats the input image to fill the entire filter primitive subregion,
+    /// creating a tiling/repeating pattern.
+    Tile,
+    /// Diffuse lighting simulation.
+    ///
+    /// Creates a lighting effect by treating the input's alpha channel as a height map
+    /// and calculating diffuse (matte) reflection from a light source.
+    DiffuseLighting {
+        /// Surface scale factor for converting alpha values to heights.
+        surface_scale: f32,
+        /// Diffuse reflection constant (kd). Controls lighting intensity.
+        diffuse_constant: f32,
+        /// Kernel unit length for gradient calculations in user space.
+        kernel_unit_length: f32,
+        /// Configuration of the light source (point, distant, or spot).
+        light_source: LightSource,
+    },
+    /// Specular lighting simulation.
+    ///
+    /// Creates a lighting effect by treating the input's alpha channel as a height map
+    /// and calculating specular (shiny) reflection highlights from a light source.
+    SpecularLighting {
+        /// Surface scale factor for converting alpha values to heights.
+        surface_scale: f32,
+        /// Specular reflection constant (ks). Controls highlight intensity.
+        specular_constant: f32,
+        /// Specular reflection exponent. Controls highlight sharpness (higher = sharper).
+        specular_exponent: f32,
+        /// Kernel unit length for gradient calculations in user space.
+        kernel_unit_length: f32,
+        /// Configuration of the light source (point, distant, or spot).
+        light_source: LightSource,
+    },
+}
+
+impl FilterPrimitive {
+    /// Calculate the bounds expansion as a `Rect` in user space.
+    ///
+    /// Returns a rectangle centered at the origin representing how much the filter
+    /// expands the processing region in each direction. The rect coordinates are:
+    /// - x0: negative left expansion
+    /// - y0: negative top expansion
+    /// - x1: positive right expansion
+    /// - y1: positive bottom expansion
+    ///
+    /// A `Rect::ZERO` means no expansion. This representation allows the expansion
+    /// to be correctly transformed (including rotation) using standard rect transforms.
+    ///
+    /// For example, a blur filter needs additional pixels around the edges (3*sigma).
+    /// Most filters that don't sample neighboring pixels return `Rect::ZERO`.
+    pub fn expansion_rect(&self) -> Rect {
+        match self {
+            Self::GaussianBlur { std_deviation, .. } => {
+                // Gaussian blur expands uniformly by 3*sigma (covers 99.7% of distribution)
+                let radius = (*std_deviation * 3.0) as f64;
+                Rect::new(-radius, -radius, radius, radius)
+            }
+            Self::Offset { dx, dy } => {
+                // Offset shifts pixels; expand bounds asymmetrically so shifted content isn't cut.
+                let dx = *dx as f64;
+                let dy = *dy as f64;
+                Rect::new(dx.min(0.0), dy.min(0.0), dx.max(0.0), dy.max(0.0))
+            }
+            Self::DropShadow {
+                std_deviation,
+                dx,
+                dy,
+                ..
+            } => {
+                // Drop shadow = blur + offset + composite with original
+                // The expansion rect encompasses both the blur and the offset
+                let blur_radius = (*std_deviation * 3.0) as f64;
+                let dx = *dx as f64;
+                let dy = *dy as f64;
+
+                Rect::new(
+                    -(blur_radius + (-dx).max(0.0)),
+                    -(blur_radius + (-dy).max(0.0)),
+                    blur_radius + dx.max(0.0),
+                    blur_radius + dy.max(0.0),
+                )
+            }
+            // Most other filters don't expand bounds
+            _ => Rect::ZERO,
+        }
+    }
+}
+
+#[cfg(test)]
+mod offset_expansion_tests {
+    use super::FilterPrimitive;
+    use crate::kurbo::Rect;
+
+    #[test]
+    fn offset_expands_in_direction_of_shift() {
+        let p = FilterPrimitive::Offset { dx: 2.5, dy: -3.0 };
+        assert_eq!(
+            p.expansion_rect(),
+            Rect::new(0.0, -3.0, 2.5, 0.0),
+            "Offset expansion should be asymmetric and include the shift vector"
+        );
+    }
+}
+
+/// Unique identifier for a filter primitive in the graph.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord)]
+pub struct FilterId(pub u16);
+
+/// Input connections for a filter primitive.
+#[derive(Debug, Clone, PartialEq)]
+pub struct FilterInputs {
+    /// Primary input ("in" attribute in SVG).
+    pub primary: FilterInput,
+    /// Secondary input ("in2" attribute in SVG, for composite/blend operations).
+    pub secondary: Option<FilterInput>,
+}
+
+impl FilterInputs {
+    /// Create filter inputs with a single input.
+    ///
+    /// Use this for primitives that operate on a single source (blur, color matrix, etc.).
+    pub fn single(input: FilterInput) -> Self {
+        Self {
+            primary: input,
+            secondary: None,
+        }
+    }
+
+    /// Create filter inputs with two inputs (for composite, blend, etc.).
+    ///
+    /// Use this for primitives that combine two sources (composite, blend, displacement map, etc.).
+    pub fn dual(input1: FilterInput, input2: FilterInput) -> Self {
+        Self {
+            primary: input1,
+            secondary: Some(input2),
+        }
+    }
+}
+
+/// A single filter input.
+#[derive(Debug, Clone, PartialEq)]
+pub enum FilterInput {
+    /// Input from a source (`SourceGraphic`, `SourceAlpha`, etc.).
+    Source(FilterSource),
+    /// Input from another filter's result.
+    Result(FilterId),
+}
+
+/// Filter input sources.
+///
+/// Defines the various built-in sources that can be used as filter inputs,
+/// matching the SVG filter primitive input types. These represent implicit
+/// inputs available to any filter primitive without requiring previous operations.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum FilterSource {
+    /// The original graphic content being filtered.
+    ///
+    /// This is the default input - the rendered result of the element
+    /// the filter is applied to, including all its fill, stroke, and content.
+    SourceGraphic,
+    /// Alpha channel only of the original graphic.
+    ///
+    /// Useful for creating effects based on shape/transparency, such as
+    /// shadows that follow the element's outline.
+    SourceAlpha,
+    /// Background image content behind the filtered element.
+    ///
+    /// Allows filters to incorporate or blend with content behind the element.
+    /// Not always available depending on the rendering context.
+    BackgroundImage,
+    /// Alpha channel only of the background image.
+    ///
+    /// The transparency mask of the background content.
+    BackgroundAlpha,
+    /// The fill paint of the element as an image input.
+    ///
+    /// For elements with gradient or pattern fills, this provides access
+    /// to the fill as a filter input.
+    FillPaint,
+    /// The stroke paint of the element as an image input.
+    ///
+    /// For elements with gradient or pattern strokes, this provides access
+    /// to the stroke as a filter input.
+    StrokePaint,
+}
+
+/// Pre-built compound effects for common use cases.
+///
+/// These effects combine multiple filter primitives into commonly-used visual effects.
+/// They provide a convenient high-level API for complex multi-step filter operations.
+///
+/// **Note:** These are planned but not yet implemented. Use `FilterGraph` to manually
+/// construct these effects from primitives.
+#[derive(Debug, Clone)]
+pub enum CompoundFilter {
+    /// Inner shadow effect (shadow inside the shape).
+    ///
+    /// Creates a shadow that appears inside the boundaries of the shape,
+    /// giving a recessed or inset appearance. This is the opposite of a drop shadow.
+    InnerShadow {
+        /// Horizontal offset of the shadow in pixels. Positive values shift right.
+        dx: f32,
+        /// Vertical offset of the shadow in pixels. Positive values shift down.
+        dy: f32,
+        /// Blur radius for the shadow in pixels. Larger values create softer shadows.
+        blur: f32,
+        /// Shadow color with alpha channel.
+        color: AlphaColor<Srgb>,
+    },
+    /// Glow effect around the shape.
+    ///
+    /// Creates a soft glowing halo around the shape by blurring and
+    /// compositing a colored version with the original.
+    Glow {
+        /// Blur radius for the glow in pixels. Larger values create softer glows.
+        blur: f32,
+        /// Glow color with alpha channel.
+        color: AlphaColor<Srgb>,
+    },
+    /// Bevel effect (3D raised/recessed appearance).
+    ///
+    /// Creates a 3D beveled edge effect using lighting simulation,
+    /// making the shape appear raised or recessed from the surface.
+    Bevel {
+        /// Light source angle in degrees (0° = right, 90° = up).
+        angle: f32,
+        /// Width of the bevel edge in pixels.
+        distance: f32,
+        /// Color for the highlight (lit) side of the bevel.
+        highlight: AlphaColor<Srgb>,
+        /// Color for the shadow (dark) side of the bevel.
+        shadow: AlphaColor<Srgb>,
+    },
+    /// Emboss effect for a raised relief appearance.
+    ///
+    /// Creates an embossed/stamped appearance by simulating lighting
+    /// on a raised surface based on the shape's alpha channel.
+    Emboss {
+        /// Light angle in degrees determining emboss direction.
+        angle: f32,
+        /// Depth of the emboss effect.
+        depth: f32,
+        /// Overall strength/intensity of the effect (0.0 = none, 1.0 = full).
+        amount: f32,
+    },
+}
+
+/// Composite operators for combining filter inputs.
+///
+/// These are the Porter-Duff compositing operators used to combine two images.
+/// Each operator defines how the source (input 1) and destination (input 2)
+/// are combined based on their color and alpha values.
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub enum CompositeOperator {
+    /// Source over destination (standard alpha blending).
+    ///
+    /// The source is composited over the destination. This is the most common
+    /// blending mode where source alpha determines visibility.
+    Over,
+    /// Source in destination (intersection).
+    ///
+    /// The source is only visible where the destination is opaque.
+    /// Result alpha = `source_alpha` × `dest_alpha`.
+    In,
+    /// Source out destination (subtract).
+    ///
+    /// The source is only visible where the destination is transparent.
+    /// Useful for masking/cutting out regions.
+    Out,
+    /// Source atop destination.
+    ///
+    /// Source is composited over destination, but only where destination is opaque.
+    Atop,
+    /// Source XOR destination (exclusive or).
+    ///
+    /// Shows source where destination is transparent and vice versa,
+    /// but not where both are opaque.
+    Xor,
+    /// Arithmetic combination with custom coefficients.
+    ///
+    /// Custom linear combination: result = k1*src*dst + k2*src + k3*dst + k4.
+    /// Allows creating custom compositing operations beyond the standard Porter-Duff set.
+    Arithmetic {
+        /// Coefficient k1 for the (source * destination) term.
+        k1: f32,
+        /// Coefficient k2 for the source term.
+        k2: f32,
+        /// Coefficient k3 for the destination term.
+        k3: f32,
+        /// Constant offset k4 added to the result.
+        k4: f32,
+    },
+}
+
+/// Blend modes for combining colors.
+///
+/// These are blend modes that define how to combine the colors
+/// of two layers. Unlike compositing operators which deal with alpha, blend modes
+/// focus on color mixing while preserving the compositing behavior.
+///
+/// See: <https://drafts.fxtf.org/compositing/#blending>
+pub type BlendMode = peniko::Mix;
+
+/// Morphological operators for dilate/erode operations.
+///
+/// These operators modify the shape of objects by expanding or contracting them.
+/// They work by examining neighborhoods of pixels and applying min/max operations.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum MorphologyOperator {
+    /// Erode operation (shrink/thin shapes).
+    ///
+    /// Makes objects smaller by removing pixels at the edges. Takes the minimum
+    /// value in the neighborhood. Useful for removing noise or separating touching objects.
+    Erode,
+    /// Dilate operation (expand/thicken shapes).
+    ///
+    /// Makes objects larger by adding pixels at the edges. Takes the maximum
+    /// value in the neighborhood. Useful for filling holes or connecting nearby objects.
+    Dilate,
+}
+
+/// Convolution kernel for custom filtering operations.
+///
+/// Defines a square matrix of weights used for convolution-based image processing.
+/// The kernel is applied to each pixel by multiplying surrounding pixels by the weights,
+/// summing the results, dividing by the divisor, and adding the bias.
+#[derive(Debug, Clone, PartialEq)]
+pub struct ConvolutionKernel {
+    /// Kernel size (e.g., 3 for a 3×3 kernel, 5 for 5×5).
+    /// The kernel must be square, so this defines both width and height.
+    pub size: u32,
+    /// Kernel weight values in row-major order.
+    /// Length must equal size × size. Center of kernel is typically at (size/2, size/2).
+    pub values: Vec<f32>,
+    /// Normalization divisor applied to the convolution result.
+    /// Common practice is to use the sum of all weights for averaging, or 1.0 otherwise.
+    pub divisor: f32,
+    /// Bias value added to the result after normalization.
+    /// Useful for edge detection or emboss effects to shift the result range.
+    pub bias: f32,
+    /// Whether to preserve the alpha channel unchanged.
+    /// If true, convolution only applies to RGB; if false, it applies to RGBA.
+    pub preserve_alpha: bool,
+}
+
+/// Types of turbulence noise generation.
+///
+/// Determines the algorithm used for generating procedural noise patterns.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum TurbulenceType {
+    /// Fractal noise (smooth, natural-looking Perlin noise).
+    ///
+    /// Creates smooth, continuous patterns suitable for natural textures
+    /// like clouds, marble, wood grain, or terrain.
+    FractalNoise,
+    /// Turbulence noise (more chaotic and energetic).
+    ///
+    /// Creates more chaotic patterns with sharper transitions,
+    /// suitable for fire, smoke, or turbulent effects.
+    Turbulence,
+}
+
+/// Color channels for displacement mapping and channel selection.
+///
+/// Specifies which color channel to use for operations that need to
+/// extract or reference individual channels from an image.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ColorChannel {
+    /// Red color channel (R component).
+    Red,
+    /// Green color channel (G component).
+    Green,
+    /// Blue color channel (B component).
+    Blue,
+    /// Alpha channel (transparency/opacity).
+    Alpha,
+}
+
+/// Transfer functions for component transfer operations.
+///
+/// These functions map input color channel values to output values,
+/// enabling gamma correction, color grading, and custom color curves.
+/// Input and output values are typically in the range [0, 1].
+#[derive(Debug, Clone, PartialEq)]
+pub enum TransferFunction {
+    /// Identity function (output = input, no change).
+    Identity,
+    /// Table lookup with linear interpolation.
+    ///
+    /// Maps input values using a lookup table with linear interpolation between entries.
+    /// Input 0.0 maps to values\[0\], 1.0 maps to values\[n-1\], intermediate values interpolate.
+    Table {
+        /// Lookup table values defining the transfer curve.
+        /// More values provide smoother curves. Minimum 2 values required.
+        values: Vec<f32>,
+    },
+    /// Discrete step function (posterization).
+    ///
+    /// Maps input to discrete output values without interpolation, creating step/banding effects.
+    /// Each segment gets a constant output value from the table.
+    Discrete {
+        /// Step values for each discrete output level.
+        /// Input range is divided into len(values) segments, each mapping to one value.
+        values: Vec<f32>,
+    },
+    /// Linear function: output = slope × input + intercept.
+    ///
+    /// Simple linear transformation of the input value.
+    Linear {
+        /// Slope coefficient (rate of change).
+        slope: f32,
+        /// Intercept offset (constant added to result).
+        intercept: f32,
+    },
+    /// Gamma correction: output = amplitude × input^exponent + offset.
+    ///
+    /// Applies power-law transformation, commonly used for gamma correction and
+    /// adjusting midtone brightness without affecting blacks or whites.
+    Gamma {
+        /// Amplitude multiplier applied to the result.
+        amplitude: f32,
+        /// Gamma exponent (< 1 brightens, > 1 darkens midtones).
+        exponent: f32,
+        /// Offset added to the final result.
+        offset: f32,
+    },
+}
+
+/// Light source configurations for lighting effects.
+///
+/// Defines different types of light sources used in diffuse and specular lighting
+/// filter primitives. Each type has different characteristics and use cases.
+#[derive(Debug, Clone, PartialEq)]
+pub enum LightSource {
+    /// Distant light source (infinitely far away, like the sun).
+    ///
+    /// All rays are parallel, creating uniform lighting across the surface.
+    /// Direction is specified using spherical coordinates (azimuth and elevation).
+    Distant {
+        /// Azimuth angle in degrees (0° = pointing right, 90° = pointing up).
+        /// Defines the horizontal direction of the light.
+        azimuth: f32,
+        /// Elevation angle in degrees (0° = horizon, 90° = directly overhead).
+        /// Defines the vertical angle of the light source.
+        elevation: f32,
+    },
+    /// Point light source at a specific 3D position.
+    ///
+    /// Light radiates uniformly in all directions from a single point.
+    /// Intensity decreases with distance. Like a light bulb.
+    Point {
+        /// Light source X coordinate in user space.
+        x: f32,
+        /// Light source Y coordinate in user space.
+        y: f32,
+        /// Light source Z coordinate (height above the surface).
+        /// Larger values create softer lighting across larger areas.
+        z: f32,
+    },
+    /// Spot light with position, direction, and cone angle.
+    ///
+    /// Light emanates from a point in a specific direction with limited spread.
+    /// Like a flashlight or stage spotlight with adjustable focus.
+    Spot {
+        /// Light source X coordinate in user space.
+        x: f32,
+        /// Light source Y coordinate in user space.
+        y: f32,
+        /// Light source Z coordinate (height above the surface).
+        z: f32,
+        /// X coordinate the spotlight is aimed at.
+        points_at_x: f32,
+        /// Y coordinate the spotlight is aimed at.
+        points_at_y: f32,
+        /// Z coordinate the spotlight is aimed at.
+        points_at_z: f32,
+        /// Specular exponent controlling the focus/sharpness of the spotlight beam.
+        /// Higher values create tighter, more focused beams.
+        specular_exponent: f32,
+        /// Optional cone angle in degrees limiting the spotlight spread.
+        /// If None, the light spreads based only on the specular exponent.
+        limiting_cone_angle: Option<f32>,
+    },
+}
+
+/// Common color transformation matrices.
+///
+/// These 4x5 matrices are used with the `ColorMatrix` filter primitive.
+/// Each row transforms a color channel: [R, G, B, A, offset].
+pub mod matrices {
+    /// Identity matrix (no change).
+    pub const IDENTITY: [f32; 20] = [
+        1.0, 0.0, 0.0, 0.0, 0.0, // Red
+        0.0, 1.0, 0.0, 0.0, 0.0, // Green
+        0.0, 0.0, 1.0, 0.0, 0.0, // Blue
+        0.0, 0.0, 0.0, 1.0, 0.0, // Alpha
+    ];
+
+    /// Extract alpha channel to RGB (for shadow effects).
+    pub const ALPHA_TO_BLACK: [f32; 20] = [
+        0.0, 0.0, 0.0, 1.0, 0.0, // Red = Alpha
+        0.0, 0.0, 0.0, 1.0, 0.0, // Green = Alpha
+        0.0, 0.0, 0.0, 1.0, 0.0, // Blue = Alpha
+        0.0, 0.0, 0.0, 1.0, 0.0, // Alpha = Alpha
+    ];
+
+    /// Grayscale conversion matrix using luminosity weights.
+    pub const GRAYSCALE: [f32; 20] = [
+        0.2126, 0.7152, 0.0722, 0.0, 0.0, // Red
+        0.2126, 0.7152, 0.0722, 0.0, 0.0, // Green
+        0.2126, 0.7152, 0.0722, 0.0, 0.0, // Blue
+        0.0, 0.0, 0.0, 1.0, 0.0, // Alpha
+    ];
+
+    /// Sepia tone matrix for vintage photo effect.
+    pub const SEPIA: [f32; 20] = [
+        0.393, 0.769, 0.189, 0.0, 0.0, // Red
+        0.349, 0.686, 0.168, 0.0, 0.0, // Green
+        0.272, 0.534, 0.131, 0.0, 0.0, // Blue
+        0.0, 0.0, 0.0, 1.0, 0.0, // Alpha
+    ];
+}
+
+/// Common convolution kernels.
+///
+/// These kernels are used with the `ConvolveMatrix` filter primitive
+/// for various image processing effects. All provided kernels are 3x3.
+pub mod kernels {
+    use super::ConvolutionKernel;
+    use alloc::vec;
+
+    /// 3x3 Gaussian blur kernel for basic smoothing.
+    pub fn gaussian_3x3() -> ConvolutionKernel {
+        ConvolutionKernel {
+            size: 3,
+            values: vec![1.0, 2.0, 1.0, 2.0, 4.0, 2.0, 1.0, 2.0, 1.0],
+            divisor: 16.0,
+            bias: 0.0,
+            preserve_alpha: false,
+        }
+    }
+
+    /// 3x3 Sharpen kernel to enhance edges and details.
+    pub fn sharpen_3x3() -> ConvolutionKernel {
+        ConvolutionKernel {
+            size: 3,
+            values: vec![0.0, -1.0, 0.0, -1.0, 5.0, -1.0, 0.0, -1.0, 0.0],
+            divisor: 1.0,
+            bias: 0.0,
+            preserve_alpha: true,
+        }
+    }
+
+    /// 3x3 Edge detection kernel (Laplacian operator).
+    pub fn edge_detect_3x3() -> ConvolutionKernel {
+        ConvolutionKernel {
+            size: 3,
+            values: vec![-1.0, -1.0, -1.0, -1.0, 8.0, -1.0, -1.0, -1.0, -1.0],
+            divisor: 1.0,
+            bias: 0.0,
+            preserve_alpha: true,
+        }
+    }
+
+    /// 3x3 Emboss kernel for creating a raised/beveled appearance.
+    pub fn emboss_3x3() -> ConvolutionKernel {
+        ConvolutionKernel {
+            size: 3,
+            values: vec![-2.0, -1.0, 0.0, -1.0, 1.0, 1.0, 0.0, 1.0, 2.0],
+            divisor: 1.0,
+            bias: 0.5,
+            preserve_alpha: true,
+        }
+    }
+}
diff --git a/vendor/vello_common/src/flatten.rs b/vendor/vello_common/src/flatten.rs
new file mode 100644
index 000000000..be219c6c3
--- /dev/null
+++ b/vendor/vello_common/src/flatten.rs
@@ -0,0 +1,286 @@
+// Copyright 2025 the Vello Authors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+//! Flattening filled and stroked paths.
+
+use crate::flatten_simd::{Callback, LinePathEl};
+use crate::geometry::RectU16;
+use crate::kurbo::{self, Affine, PathEl, Stroke, StrokeCtx, StrokeOpts};
+use alloc::vec::Vec;
+use fearless_simd::{Level, Simd, dispatch};
+use log::warn;
+
+pub use crate::flatten_simd::FlattenCtx;
+
+// The current tolerance is set to 0.25. Since `sqrt` doesn't work in const contexts, we instead
+// hardcode the squared tolerance and derive the others from that.
+pub(crate) const SQRT_TOL: f64 = 0.5;
+pub(crate) const TOL: f64 = SQRT_TOL * SQRT_TOL;
+pub(crate) const TOL_2: f64 = TOL * TOL;
+
+/// A point.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct Point {
+    /// The x coordinate of the point.
+    pub x: f32,
+    /// The y coordinate of the point.
+    pub y: f32,
+}
+
+impl Point {
+    /// The point `(0, 0)`.
+    pub const ZERO: Self = Self::new(0., 0.);
+
+    /// Create a new point.
+    pub const fn new(x: f32, y: f32) -> Self {
+        Self { x, y }
+    }
+}
+
+impl From<kurbo::Point> for Point {
+    #[inline(always)]
+    fn from(value: kurbo::Point) -> Self {
+        Self {
+            x: value.x as f32,
+            y: value.y as f32,
+        }
+    }
+}
+
+impl core::ops::Add for Point {
+    type Output = Self;
+
+    fn add(self, rhs: Self) -> Self {
+        Self::new(self.x + rhs.x, self.y + rhs.y)
+    }
+}
+
+impl core::ops::Sub for Point {
+    type Output = Self;
+
+    fn sub(self, rhs: Self) -> Self {
+        Self::new(self.x - rhs.x, self.y - rhs.y)
+    }
+}
+
+impl core::ops::Mul<f32> for Point {
+    type Output = Self;
+
+    fn mul(self, rhs: f32) -> Self {
+        Self::new(self.x * rhs, self.y * rhs)
+    }
+}
+
+/// A line.
+#[derive(Clone, Copy, Debug)]
+pub struct Line {
+    /// The start point of the line.
+    pub p0: Point,
+    /// The end point of the line.
+    pub p1: Point,
+}
+
+impl Line {
+    /// Create a new line.
+    pub fn new(p0: Point, p1: Point) -> Self {
+        Self { p0, p1 }
+    }
+}
+
+/// Flatten a filled Bézier path into line segments.
+///
+/// # Open subpaths and culling
+///
+/// Open subpaths in the input path get closed by connecting the last endpoint in the subpath to
+/// the starting point. The output lines in `line_buf` describe the flattened path, but these lines
+/// may describe open subpaths, as some path elements may have been culled.
+///
+/// For example, consider the following, where the box describes the viewport, a path is marked by
+/// `*`, and the region to be filled in the viewport is shaded. For ease of drawing the ASCII art,
+/// the path elements are all lines ([`PathEl::LineTo`]), but the same also holds for Bézier path
+/// elements.
+///
+/// ```text
+///    ---> winding scan direction
+///
+///                   * * * * *
+///                 *         *
+///    ---------- * -----     *
+///    |        *░░░░░░░|     *
+///    |      *░░░░░░░░░|     *
+///    |    *░░░░░░░░░░░|     *
+///    |  *░░░░░░░░░░░░░|     *
+///    |*░░░░░░░░░░░░░░░|     *
+///   *|░░░░░░░░░░░░░░░░|     *
+/// *  |░░░░░░░░░░░░░░░░|     *
+/// *  |░░░░░░░░░░░░░░░░|     *
+/// *  ------------------     *
+/// *                         *
+/// *                         *
+/// *                         *
+/// *                         *
+/// *                         *
+/// *                         *
+/// *                         *
+/// * * * * * * * * * * * * * *
+/// ```
+///
+/// Because the winding scan direction is from left to right, only the left-of-viewport and
+/// diagonal lines matter in later stages of rendering for the winding number and pixel coverage.
+/// The other three lines can be culled.
+///
+/// ```text
+///                   *
+///                 *
+///    ---------- * -----
+///    |        *░░░░░░░|
+///    |      *░░░░░░░░░|
+///    |    *░░░░░░░░░░░|
+///    |  *░░░░░░░░░░░░░|
+///    |*░░░░░░░░░░░░░░░|
+///   *|░░░░░░░░░░░░░░░░|
+/// *  |░░░░░░░░░░░░░░░░|
+/// *  |░░░░░░░░░░░░░░░░|
+/// *  ------------------
+/// *
+/// *
+/// *
+/// *
+/// *
+/// *
+/// *
+/// ```
+///
+/// It is important to keep these flattened subpaths open after culling, as closing the subpaths
+/// might yield different geometry like the following.
+///
+/// ```text
+///                   *
+///                 **
+///    ---------- * *----
+///    |        *░░*    |
+///    |      *░░░*     |
+///    |    *░░░░*      |
+///    |  *░░░░░*       |
+///    |*░░░░░░*        |
+///   *|░░░░░░*         |
+/// *  |░░░░░*          |
+/// *  |░░░░*           |
+/// *  --- * ------------
+/// *     *
+/// *    *
+/// *   *
+/// *  *
+/// * *
+/// **
+/// *
+/// ```
+pub fn fill(
+    level: Level,
+    path: impl IntoIterator<Item = PathEl>,
+    affine: Affine,
+    line_buf: &mut Vec<Line>,
+    ctx: &mut FlattenCtx,
+    cull_bbox: RectU16,
+) {
+    dispatch!(level, simd => fill_impl(simd, path, affine, line_buf, ctx, cull_bbox));
+}
+
+/// Flatten a filled bezier path into line segments.
+///
+/// See the note about open subpaths and culling on [`fill`].
+#[inline(always)]
+pub fn fill_impl<S: Simd>(
+    simd: S,
+    path: impl IntoIterator<Item = PathEl>,
+    affine: Affine,
+    line_buf: &mut Vec<Line>,
+    flatten_ctx: &mut FlattenCtx,
+    cull_bbox: RectU16,
+) {
+    line_buf.clear();
+    let mut lb = FlattenerCallback {
+        line_buf,
+        start: Point::ZERO,
+        p0: Point::ZERO,
+        is_nan: false,
+    };
+
+    crate::flatten_simd::flatten(simd, path, affine, &mut lb, flatten_ctx, cull_bbox);
+
+    // A path that contains NaN is ill-defined, so ignore it.
+    if lb.is_nan {
+        warn!("A path contains NaN, ignoring it.");
+
+        line_buf.clear();
+    }
+}
+/// Flatten a stroked Bézier path into line segments.
+///
+/// See the note about open subpaths and culling on [`fill`].
+pub fn stroke(
+    level: Level,
+    path: impl IntoIterator<Item = PathEl>,
+    style: &Stroke,
+    affine: Affine,
+    line_buf: &mut Vec<Line>,
+    flatten_ctx: &mut FlattenCtx,
+    stroke_ctx: &mut StrokeCtx,
+    cull_bbox: RectU16,
+) {
+    // TODO: Temporary hack to ensure that strokes are scaled properly by the transform.
+    let tolerance = TOL
+        / affine.as_coeffs()[0]
+            .abs()
+            .max(affine.as_coeffs()[3].abs())
+            .max(1.);
+
+    expand_stroke(path, style, tolerance, stroke_ctx);
+    fill(
+        level,
+        stroke_ctx.output(),
+        affine,
+        line_buf,
+        flatten_ctx,
+        cull_bbox,
+    );
+}
+
+/// Expand a stroked path to a filled path.
+pub fn expand_stroke(
+    path: impl IntoIterator<Item = PathEl>,
+    style: &Stroke,
+    tolerance: f64,
+    stroke_ctx: &mut StrokeCtx,
+) {
+    kurbo::stroke_with(path, style, &StrokeOpts::default(), tolerance, stroke_ctx);
+}
+
+struct FlattenerCallback<'a> {
+    line_buf: &'a mut Vec<Line>,
+    start: Point,
+    p0: Point,
+    is_nan: bool,
+}
+
+impl Callback for FlattenerCallback<'_> {
+    #[inline(always)]
+    fn callback(&mut self, el: LinePathEl) {
+        match el {
+            LinePathEl::MoveTo(p) => {
+                self.is_nan |= p.is_nan();
+
+                let p = p.into();
+                self.start = p;
+                self.p0 = p;
+            }
+            LinePathEl::LineTo(p) => {
+                self.is_nan |= p.is_nan();
+
+                let p = p.into();
+                self.line_buf.push(Line::new(self.p0, p));
+                self.p0 = p;
+            }
+        }
+    }
+}
diff --git a/vendor/vello_common/src/flatten_simd.rs b/vendor/vello_common/src/flatten_simd.rs
new file mode 100644
index 000000000..e71df65ca
--- /dev/null
+++ b/vendor/vello_common/src/flatten_simd.rs
@@ -0,0 +1,687 @@
+// Copyright 2025 the Vello Authors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+//! This is a temporary module that contains a SIMD version of flattening of cubic curves, as
+//! well as some code that was copied from kurbo, which is needed to reimplement the
+//! full `flatten` method.
+
+#[cfg(not(feature = "std"))]
+use crate::kurbo::common::FloatFuncs as _;
+use crate::kurbo::{CubicBez, Line, ParamCurve, ParamCurveNearest, PathEl, Point, QuadBez};
+use crate::{
+    flatten::{SQRT_TOL, TOL, TOL_2},
+    geometry::RectU16,
+    kurbo::Affine,
+    tile::Tile,
+};
+use alloc::vec::Vec;
+use bytemuck::{Pod, Zeroable};
+use fearless_simd::*;
+
+/// The element of a path made of lines.
+///
+/// Each subpath must start with a `MoveTo`. Closing of subpaths is not supported, and subpaths are
+/// not closed implicitly when a new subpath (with `MoveTo`) is started. It is expected that closed
+/// subpaths are watertight in the sense that the last `LineTo` matches exactly with the first
+/// `MoveTo`.
+///
+/// This intentionally allows for non-watertight subpaths, as, e.g., lines that are fully outside
+/// of the viewport do not need to be drawn.
+///
+/// See [`PathEl`] for a more general-purpose path element type.
+pub(crate) enum LinePathEl {
+    MoveTo(Point),
+    LineTo(Point),
+}
+
+// Unlike kurbo, which takes a closure with a callback for outputting the lines, we use a trait
+// instead. The reason is that this way the callback can be inlined, which is not possible with
+// a closure and turned out to have a noticeable overhead.
+pub(crate) trait Callback {
+    fn callback(&mut self, el: LinePathEl);
+}
+
+/// See the docs for the kurbo implementation of flattening:
+/// <https://docs.rs/kurbo/latest/kurbo/fn.flatten.html>
+///
+/// This version works using a similar approach but using f32x4/f32x8 SIMD instead.
+#[inline(always)]
+pub(crate) fn flatten<S: Simd>(
+    simd: S,
+    path: impl IntoIterator<Item = PathEl>,
+    // Note: we explicitly pass the `Affine` here instead of using `map` on
+    // the iterator because it seems like the `map` function isn't always inlined
+    // properly, even when annotating the closure with `#[inline(always)]`.
+    // See https://github.com/linebender/vello/pull/1600.
+    affine: Affine,
+    callback: &mut impl Callback,
+    flatten_ctx: &mut FlattenCtx,
+    cull_bbox: RectU16,
+) {
+    flatten_ctx.flattened_cubics.clear();
+
+    // For the culling performed here to be correct, the top y coordinate of the cull bbox must be
+    // aligned to strip row boundaries. Consider the alternative: for example, a strip row starting
+    // at y=8, a cull bbox starting at y=10, and (nearly) horizontal geometry at y=9 that does not
+    // cross into the cull bbox and does not extend above y=8 (and note this is all in a y-down
+    // coordinate space).
+    //
+    // The culling performed here would remove that geometry. However, as it does not extend above
+    // the strip row, it does not add coarse winding to the strip, and does not produce a sparse
+    // fill. Yet, if this is the top part of, say, a rectangle that is partially visible, the
+    // geometry is necessary for tiling to emit intermediate tiles that are necessary for the
+    // bottom part of the strip to get filled.
+    //
+    // Therefore, we align `top` to strip row boundaries, such that all intermediate tiles are
+    // produced.
+    //
+    // This is not necessary for the bottom. Consider a path where a segment extends just below the
+    // cull bbox, but remains in the same strip row. The path is closed, so if anything is to be
+    // rendered at all, there will be other geometry above that edge of the cull bbox. If that
+    // geometry extends above the row, there will be coarse winding for a sparse fill. If not, it
+    // there will be geometry to generate the intermediate tiles.
+    let left = cull_bbox.x0 as f64;
+    let top = ((cull_bbox.y0 / Tile::HEIGHT) * Tile::HEIGHT) as f64;
+    let right = cull_bbox.x1 as f64;
+    let bottom = cull_bbox.y1 as f64;
+
+    let mut path = path.into_iter();
+    let Some(first_el) = path.next() else {
+        return;
+    };
+    let first_el = affine * first_el;
+    let PathEl::MoveTo(start_pt) = first_el else {
+        debug_assert!(
+            matches!(first_el, PathEl::MoveTo(_)),
+            "Non-empty paths must begin with `PathEl::MoveTo`, got {first_el:?}"
+        );
+        return;
+    };
+
+    let mut start_pt = start_pt;
+    let mut last_pt = start_pt;
+    callback.callback(LinePathEl::MoveTo(start_pt));
+
+    for el in path {
+        match affine * el {
+            PathEl::MoveTo(p) => {
+                if last_pt != start_pt {
+                    callback.callback(LinePathEl::LineTo(start_pt));
+                }
+                last_pt = p;
+                start_pt = p;
+                callback.callback(LinePathEl::MoveTo(p));
+            }
+            PathEl::LineTo(p) => {
+                last_pt = p;
+                callback.callback(LinePathEl::LineTo(p));
+            }
+            PathEl::QuadTo(p1, p2) => {
+                let p0 = last_pt;
+                let line = Line::new(p0, p2);
+                // If the quadratic Bézier is fully to the right, top, or bottom of the culling
+                // bbox, it does not impact pixel coverage or winding. We can ignore it. The
+                // following checks that conservatively by checking whether the bounding box of the
+                // Bézier's control points is fully outside the culling bbox.
+                if [p0, p1, p2].into_iter().all(|p| p.x > right)
+                    || [p0, p1, p2].into_iter().all(|p| p.y < top)
+                    || [p0, p1, p2].into_iter().all(|p| p.y > bottom)
+                {
+                    callback.callback(LinePathEl::MoveTo(p2));
+                }
+                // The following checks two things. First, if the quadratic Bézier is fully to the
+                // left of the culling bbox, it may affect pixel coverage and winding, but its
+                // exact shape does not matter. It can be emitted as a line segment [p0, p2].
+                //
+                // Second, an upper bound on the shortest distance of any point on the quadratic
+                // Bézier curve to the line segment [p0, p2] is 1/2 of the control-point-to-line-segment
+                // distance.
+                //
+                // The derivation is similar to that for the cubic Bézier (see below). In
+                // short:
+                //
+                // q(t) = B0(t) p0 + B1(t) p1 + B2(t) p2
+                // dist(q(t), [p0, p1]) <= B1(t) dist(p1, [p0, p1])
+                //                       = 2 (1-t)t dist(p1, [p0, p1]).
+                //
+                // The maximum occurs at t=1/2, hence
+                // max(dist(q(t), [p0, p1] <= 1/2 dist(p1, [p0, p1])).
+                //
+                // The following takes the square to elide the square root of the Euclidean
+                // distance.
+                else if [p0, p1, p2].into_iter().all(|p| p.x < left)
+                    || line.nearest(p1, 0.).distance_sq <= 4. * TOL_2
+                {
+                    callback.callback(LinePathEl::LineTo(p2));
+                } else {
+                    let q = QuadBez::new(p0, p1, p2);
+                    let params = q.estimate_subdiv(SQRT_TOL);
+                    let n = ((0.5 / SQRT_TOL * params.val).ceil() as usize).max(1);
+                    let step = 1.0 / (n as f64);
+                    for i in 1..n {
+                        let u = (i as f64) * step;
+                        let t = q.determine_subdiv_t(&params, u);
+                        let p = q.eval(t);
+                        callback.callback(LinePathEl::LineTo(p));
+                    }
+                    callback.callback(LinePathEl::LineTo(p2));
+                }
+                last_pt = p2;
+            }
+            PathEl::CurveTo(p1, p2, p3) => {
+                let p0 = last_pt;
+                let line = Line::new(p0, p3);
+                // If the cubic Bézier is fully to the right, top, or bottom of the culling bbox,
+                // it does not impact pixel coverage or winding. We can ignore it. The following
+                // checks that conservatively by checking whether the bounding box of the Bézier's
+                // control points is fully outside the culling bbox.
+                if [p0, p1, p2, p3].into_iter().all(|p| p.x > right)
+                    || [p0, p1, p2, p3].into_iter().all(|p| p.y < top)
+                    || [p0, p1, p2, p3].into_iter().all(|p| p.y > bottom)
+                {
+                    callback.callback(LinePathEl::MoveTo(p3));
+                }
+                // The following checks two things. First, if the cubic Bézier is fully to the left
+                // of the culling bbox, it may affect pixel coverage and winding, but its exact
+                // shape does not matter. It can be emitted as a line segment [p0, p3].
+                //
+                // Second, an upper bound on the shortest distance of any point on the cubic Bézier
+                // curve to the line segment [p0, p3] is 3/4 of the maximum of the
+                // control-point-to-line-segment distances.
+                //
+                // With Bernstein weights Bi(t), we have
+                // c(t) = B0(t) p0 + B1(t) p1 + B2(t) p2 + B3(t) p3
+                // with t from 0 to 1 (inclusive).
+                //
+                // Through convexivity of the Euclidean distance function and the line segment,
+                // we have
+                // dist(c(t), [p0, p3]) <= B1(t) dist(p1, [p0, p3]) + B2(t) dist(p2, [p0, p3])
+                //                      <= (B1(t) + B2(t)) max(dist(p1, [p0, p3]), dist(p2, [p0, p3]))
+                //                       = 3 ((1-t)t^2 + (1-t)^2t) max(dist(p1, [p0, p3]), dist(p2, [p0, p3])).
+                //
+                // The inner polynomial has its maximum of 1/4 at t=1/2, hence
+                // max(dist(c(t), [p0, p3])) <= 3/4 max(dist(p1, [p0, p3]), dist(p2, [p0, p3])).
+                //
+                // The following takes the square to elide the square root of the Euclidean
+                // distance.
+                else if [p0, p1, p2, p3].into_iter().all(|p| p.x < left)
+                    || f64::max(
+                        line.nearest(p1, 0.).distance_sq,
+                        line.nearest(p2, 0.).distance_sq,
+                    ) <= 16. / 9. * TOL_2
+                {
+                    callback.callback(LinePathEl::LineTo(p3));
+                } else {
+                    let c = CubicBez::new(p0, p1, p2, p3);
+                    let max = flatten_cubic_simd(simd, c, flatten_ctx);
+
+                    for p in &flatten_ctx.flattened_cubics[1..max] {
+                        callback.callback(LinePathEl::LineTo(Point::new(p.x as f64, p.y as f64)));
+                    }
+                }
+                last_pt = p3;
+            }
+            PathEl::ClosePath => {
+                if last_pt != start_pt {
+                    callback.callback(LinePathEl::LineTo(start_pt));
+
+                    // Kurbo says: "If `quad_to` [or another drawing op] is called immediately
+                    // after `close_path` then the current subpath starts at the initial point of
+                    // the previous subpath."
+                    //
+                    // Hence, we set `last_pt` back to the just-closed subpath's `start_pt`.
+                    last_pt = start_pt;
+                }
+            }
+        }
+    }
+
+    if last_pt != start_pt {
+        callback.callback(LinePathEl::LineTo(start_pt));
+    }
+}
+
+// The below methods are copied from kurbo and needed to implement flattening of normal quad curves.
+
+/// An approximation to $\int (1 + 4x^2) ^ -0.25 dx$
+///
+/// This is used for flattening curves.
+fn approx_parabola_integral(x: f64) -> f64 {
+    const D: f64 = 0.67;
+    x / (1.0 - D + (D.powi(4) + 0.25 * x * x).sqrt().sqrt())
+}
+
+/// An approximation to the inverse parabola integral.
+fn approx_parabola_inv_integral(x: f64) -> f64 {
+    const B: f64 = 0.39;
+    x * (1.0 - B + (B * B + 0.25 * x * x).sqrt())
+}
+
+impl FlattenParamsExt for QuadBez {
+    #[inline(always)]
+    fn estimate_subdiv(&self, sqrt_tol: f64) -> FlattenParams {
+        // Determine transformation to $y = x^2$ parabola.
+        let d01 = self.p1 - self.p0;
+        let d12 = self.p2 - self.p1;
+        let dd = d01 - d12;
+        let cross = (self.p2 - self.p0).cross(dd);
+        let x0 = d01.dot(dd) * cross.recip();
+        let x2 = d12.dot(dd) * cross.recip();
+        let scale = (cross / (dd.hypot() * (x2 - x0))).abs();
+
+        // Compute number of subdivisions needed.
+        let a0 = approx_parabola_integral(x0);
+        let a2 = approx_parabola_integral(x2);
+        let val = if scale.is_finite() {
+            let da = (a2 - a0).abs();
+            let sqrt_scale = scale.sqrt();
+            if x0.signum() == x2.signum() {
+                da * sqrt_scale
+            } else {
+                // Handle cusp case (segment contains curvature maximum)
+                let xmin = sqrt_tol / sqrt_scale;
+                sqrt_tol * da / approx_parabola_integral(xmin)
+            }
+        } else {
+            0.0
+        };
+        let u0 = approx_parabola_inv_integral(a0);
+        let u2 = approx_parabola_inv_integral(a2);
+        let uscale = (u2 - u0).recip();
+        FlattenParams {
+            a0,
+            a2,
+            u0,
+            uscale,
+            val,
+        }
+    }
+
+    #[inline(always)]
+    fn determine_subdiv_t(&self, params: &FlattenParams, x: f64) -> f64 {
+        let a = params.a0 + (params.a2 - params.a0) * x;
+        let u = approx_parabola_inv_integral(a);
+        (u - params.u0) * params.uscale
+    }
+}
+
+trait FlattenParamsExt {
+    fn estimate_subdiv(&self, sqrt_tol: f64) -> FlattenParams;
+    fn determine_subdiv_t(&self, params: &FlattenParams, x: f64) -> f64;
+}
+
+// Everything below is a SIMD implementation of flattening of cubic curves.
+// It's a combination of https://gist.github.com/raphlinus/5f4e9feb85fd79bafc72da744571ec0e
+// and https://gist.github.com/raphlinus/44e114fef2fd33b889383a60ced0129b.
+
+// TODO(laurenz): Perhaps we should get rid of this in the future and work directly with f32,
+// as it's the only reason we have to pull in proc_macros via the `derive` feature of bytemuck.
+#[derive(Clone, Copy, Debug, Default, Zeroable, Pod)]
+#[repr(C)]
+struct Point32 {
+    x: f32,
+    y: f32,
+}
+
+struct FlattenParams {
+    a0: f64,
+    a2: f64,
+    u0: f64,
+    uscale: f64,
+    /// The number of `subdivisions * 2 * sqrt_tol`.
+    val: f64,
+}
+
+/// This limit was chosen based on the pre-existing GitHub gist.
+/// This limit should not be hit in normal operation, but _might_ be hit for very large
+/// transforms.
+const MAX_QUADS: usize = 16;
+
+/// The context needed for flattening curves.
+#[derive(Default, Debug)]
+pub struct FlattenCtx {
+    // The +4 is to encourage alignment; might be better to be explicit
+    even_pts: [Point32; MAX_QUADS + 4],
+    odd_pts: [Point32; MAX_QUADS],
+    a0: [f32; MAX_QUADS],
+    da: [f32; MAX_QUADS],
+    u0: [f32; MAX_QUADS],
+    uscale: [f32; MAX_QUADS],
+    val: [f32; MAX_QUADS],
+    n_quads: usize,
+    /// Reusable buffer for flattened cubic points.
+    flattened_cubics: Vec<Point32>,
+}
+
+#[inline(always)]
+fn is_finite_simd<S: Simd>(x: f32x4<S>) -> mask32x4<S> {
+    let simd = x.simd;
+
+    let x_abs = x.abs();
+    let reinterpreted = u32x4::from_bytes(x_abs.to_bytes());
+    simd.simd_lt_u32x4(reinterpreted, u32x4::splat(simd, 0x7f80_0000))
+}
+
+/// An approximation to $\int (1 + 4x^2) ^ -0.25 dx$
+///
+/// This is used for flattening curves.
+///
+/// SIMD version of [`approx_parabola_integral`].
+#[inline(always)]
+fn approx_parabola_integral_simd<S: Simd, F: SimdFloat<S, Element = f32>>(x: F) -> F {
+    let simd = x.witness();
+
+    const D: f32 = 0.67;
+    const D_POWI_4: f32 = 0.201_511_2;
+
+    let temp = F::splat(x.witness(), 0.25)
+        .mul_add(x * x, F::splat(simd, D_POWI_4))
+        .sqrt()
+        .sqrt();
+    let denom = temp + (1. - D);
+    x / denom
+}
+
+/// An approximation to the inverse parabola integral.
+///
+/// SIMD version of [`approx_parabola_inv_integral`].
+#[inline(always)]
+fn approx_parabola_inv_integral_simd<S: Simd>(x: f32x8<S>) -> f32x8<S> {
+    let simd = x.simd;
+
+    const B: f32 = 0.39;
+    const ONE_MINUS_B: f32 = 1.0 - B;
+
+    let temp = f32x8::splat(simd, 0.25).mul_add(x * x, B * B).sqrt();
+    let factor = f32x8::splat(simd, ONE_MINUS_B) + temp;
+    x * factor
+}
+
+#[inline(always)]
+fn pt_splat_simd<S: Simd>(simd: S, pt: Point32) -> f32x8<S> {
+    let p_f64: f64 = bytemuck::cast(pt);
+    simd.reinterpret_f32_f64x4(f64x4::splat(simd, p_f64))
+}
+
+#[inline(always)]
+fn eval_cubics_simd<S: Simd>(simd: S, c: &CubicBez, n: usize, result: &mut FlattenCtx) {
+    result.n_quads = n;
+    let dt = 0.5 / n as f32;
+
+    // TODO(laurenz): Perhaps we can SIMDify this better
+    let p0p1 = f32x4::from_slice(
+        simd,
+        &[c.p0.x as f32, c.p0.y as f32, c.p1.x as f32, c.p1.y as f32],
+    );
+    let p2p3 = f32x4::from_slice(
+        simd,
+        &[c.p2.x as f32, c.p2.y as f32, c.p3.x as f32, c.p3.y as f32],
+    );
+
+    let split_single = |input: f32x4<S>| {
+        let t1 = simd.reinterpret_f64_f32x4(input);
+        let p0 = simd.zip_low_f64x2(t1, t1);
+        let p1 = simd.zip_high_f64x2(t1, t1);
+
+        let p0 = simd.reinterpret_f32_f64x2(p0);
+        let p1 = simd.reinterpret_f32_f64x2(p1);
+
+        (f32x8::block_splat(p0), f32x8::block_splat(p1))
+    };
+
+    let (p0_128, p1_128) = split_single(p0p1);
+    let (p2_128, p3_128) = split_single(p2p3);
+
+    // Use Horner's method to evaluate p(t) as ((a*t + b)*t + c)*t + d. This allows hoisting
+    // coefficients out of the loop, and then evaluating as three sequential FMAs. Estrin's method
+    // would expose more ILP, but the increase in work on such small polynomials (cubic here and
+    // quad below) makes it a net slowdown.
+    let coeff_a = (p1_128 - p2_128).mul_add(3.0, p3_128 - p0_128);
+    let coeff_b = p1_128.mul_add(-2.0, p0_128 + p2_128) * 3.0;
+    let coeff_c = (p1_128 - p0_128) * 3.0;
+    let coeff_d = p0_128;
+
+    let iota = f32x8::from_slice(simd, &[0.0, 0.0, 2.0, 2.0, 1.0, 1.0, 3.0, 3.0]);
+    let step = iota * dt;
+    let mut t = step;
+    let t_inc = f32x8::splat(simd, 4.0 * dt);
+
+    let even_pts: &mut [f32] = bytemuck::cast_slice_mut(&mut result.even_pts);
+    let odd_pts: &mut [f32] = bytemuck::cast_slice_mut(&mut result.odd_pts);
+
+    for i in 0..n.div_ceil(2) {
+        let evaluated = (coeff_a.mul_add(t, coeff_b))
+            .mul_add(t, coeff_c)
+            .mul_add(t, coeff_d);
+
+        let (low, high) = simd.split_f32x8(evaluated);
+
+        low.store_slice(&mut even_pts[i * 4..][..4]);
+        high.store_slice(&mut odd_pts[i * 4..][..4]);
+
+        t += t_inc;
+    }
+
+    p3_128.store_slice(&mut even_pts[n * 2..][..8]);
+}
+
+#[inline(always)]
+fn estimate_subdiv_simd<S: Simd>(simd: S, sqrt_tol: f32, ctx: &mut FlattenCtx) {
+    let n = ctx.n_quads;
+
+    let even_pts: &mut [f32] = bytemuck::cast_slice_mut(&mut ctx.even_pts);
+    let odd_pts: &mut [f32] = bytemuck::cast_slice_mut(&mut ctx.odd_pts);
+
+    for i in 0..n.div_ceil(4) {
+        let p0 = f32x8::from_slice(simd, &even_pts[i * 8..][..8]);
+        let p_onehalf = f32x8::from_slice(simd, &odd_pts[i * 8..][..8]);
+        let p2 = f32x8::from_slice(simd, &even_pts[(i * 8 + 2)..][..8]);
+        let x = p0 * -0.5;
+        let x1 = p_onehalf.mul_add(2.0, x);
+        let p1 = p2.mul_add(-0.5, x1);
+
+        p1.store_slice(&mut odd_pts[(i * 8)..][..8]);
+
+        let d01 = p1 - p0;
+        let d12 = p2 - p1;
+        let d01x = simd.unzip_low_f32x8(d01, d01);
+        let d01y = simd.unzip_high_f32x8(d01, d01);
+        let d12x = simd.unzip_low_f32x8(d12, d12);
+        let d12y = simd.unzip_high_f32x8(d12, d12);
+        let ddx = d01x - d12x;
+        let ddy = d01y - d12y;
+        let d02x = d01x + d12x;
+        let d02y = d01y + d12y;
+        // (d02x * ddy) - (d02y * ddx)
+        let cross = ddx.mul_add(-d02y, d02x * ddy);
+
+        let x0_x2_a = {
+            let (d01x_low, _) = simd.split_f32x8(d01x);
+            let (d12x_low, _) = simd.split_f32x8(d12x);
+
+            simd.combine_f32x4(d12x_low, d01x_low) * ddx
+        };
+        let temp1 = {
+            let (d12y_low, _) = simd.split_f32x8(d12y);
+            let (d01y_low, _) = simd.split_f32x8(d01y);
+
+            simd.combine_f32x4(d12y_low, d01y_low)
+        };
+        let x0_x2_num = temp1.mul_add(ddy, x0_x2_a);
+        let x0_x2 = x0_x2_num / cross;
+        let (ddx_low, _) = simd.split_f32x8(ddx);
+        let (ddy_low, _) = simd.split_f32x8(ddy);
+        let dd_hypot = ddy_low.mul_add(ddy_low, ddx_low * ddx_low).sqrt();
+        let (x0, x2) = simd.split_f32x8(x0_x2);
+        let scale_denom = dd_hypot * (x2 - x0);
+        let (temp2, _) = simd.split_f32x8(cross);
+        let scale = (temp2 / scale_denom).abs();
+        let a0_a2 = approx_parabola_integral_simd(x0_x2);
+        let (a0, a2) = simd.split_f32x8(a0_a2);
+        let da = a2 - a0;
+        let da_abs = da.abs();
+        let sqrt_scale = scale.sqrt();
+        let temp3 = simd.or_i32x4(x0.bitcast(), x2.bitcast());
+        let mask = simd.simd_ge_i32x4(temp3, i32x4::splat(simd, 0));
+        let noncusp = da_abs * sqrt_scale;
+        // TODO: should we skip this if neither is a cusp? Maybe not worth branch prediction cost
+        let xmin = sqrt_tol / sqrt_scale;
+        let approxint = approx_parabola_integral_simd(xmin);
+        let cusp = (sqrt_tol * da_abs) / approxint;
+        let val_raw = simd.select_f32x4(mask, noncusp, cusp);
+        let finite_mask = is_finite_simd(val_raw);
+        let val = simd.select_f32x4(finite_mask, val_raw, f32x4::splat(simd, 0.0));
+        let u0_u2 = approx_parabola_inv_integral_simd(a0_a2);
+        let (u0, u2) = simd.split_f32x8(u0_u2);
+        let uscale_a = u2 - u0;
+        let uscale = 1.0 / uscale_a;
+
+        a0.store_slice(&mut ctx.a0[i * 4..][..4]);
+        da.store_slice(&mut ctx.da[i * 4..][..4]);
+        u0.store_slice(&mut ctx.u0[i * 4..][..4]);
+        uscale.store_slice(&mut ctx.uscale[i * 4..][..4]);
+        val.store_slice(&mut ctx.val[i * 4..][..4]);
+    }
+}
+
+#[inline(always)]
+fn output_lines_simd<S: Simd>(
+    simd: S,
+    ctx: &mut FlattenCtx,
+    i: usize,
+    x0: f32,
+    dx: f32,
+    n: usize,
+    start_idx: usize,
+) {
+    let p0 = pt_splat_simd(simd, ctx.even_pts[i]);
+    let p1 = pt_splat_simd(simd, ctx.odd_pts[i]);
+    let p2 = pt_splat_simd(simd, ctx.even_pts[i + 1]);
+
+    const IOTA2: [f32; 8] = [0., 0., 1., 1., 2., 2., 3., 3.];
+    let iota2 = f32x8::from_slice(simd, IOTA2.as_ref());
+    let x = iota2.mul_add(dx, f32x8::splat(simd, x0));
+    let da = f32x8::splat(simd, ctx.da[i]);
+    let mut a = da.mul_add(x, f32x8::splat(simd, ctx.a0[i]));
+    let a_inc = 4.0 * dx * da;
+    let uscale = f32x8::splat(simd, ctx.uscale[i]);
+    let u0 = f32x8::splat(simd, ctx.u0[i]);
+
+    // See Horner comment above
+    let coeff_a = p1.mul_add(-2.0, p0) + p2;
+    let coeff_b = (p1 - p0) * 2.0;
+    let coeff_c = p0;
+
+    let out: &mut [f32] = bytemuck::cast_slice_mut(&mut ctx.flattened_cubics[start_idx..]);
+
+    for j in 0..n.div_ceil(4) {
+        let u = approx_parabola_inv_integral_simd(a);
+        let t = (u - u0) * uscale;
+        let p = coeff_a.mul_add(t, coeff_b).mul_add(t, coeff_c);
+        p.store_slice(&mut out[j * 8..][..8]);
+        a += a_inc;
+    }
+}
+
+#[inline(always)]
+fn flatten_cubic_simd<S: Simd>(simd: S, c: CubicBez, ctx: &mut FlattenCtx) -> usize {
+    let n_quads = estimate_num_quads(c, TOL as f32);
+    eval_cubics_simd(simd, &c, n_quads, ctx);
+    let tol = (TOL as f32) * (1.0 - TO_QUAD_TOL);
+    let sqrt_tol = tol.sqrt();
+    estimate_subdiv_simd(simd, sqrt_tol, ctx);
+    let sum: f32 = ctx.val[..n_quads].iter().sum();
+    let n = ((0.5 * sum / sqrt_tol).ceil() as usize).max(1);
+    let target_len = n + 4;
+    if target_len > ctx.flattened_cubics.len() {
+        ctx.flattened_cubics.resize(target_len, Point32::default());
+    }
+
+    let step = sum / (n as f32);
+    let step_recip = 1.0 / step;
+    let mut val_sum = 0.0;
+    let mut last_n = 0;
+    let mut x0base = 0.0;
+
+    for i in 0..n_quads {
+        let val = ctx.val[i];
+        val_sum += val;
+        let this_n = val_sum * step_recip;
+        let this_n_next = 1.0 + this_n.floor();
+        let dn = this_n_next as usize - last_n;
+        if dn > 0 {
+            let dx = step / val;
+            let x0 = x0base * dx;
+            output_lines_simd(simd, ctx, i, x0, dx, dn, last_n);
+        }
+        x0base = this_n_next - this_n;
+        last_n = this_n_next as usize;
+    }
+
+    ctx.flattened_cubics[n] = ctx.even_pts[n_quads];
+
+    n + 1
+}
+
+#[inline(always)]
+fn estimate_num_quads(c: CubicBez, accuracy: f32) -> usize {
+    let q_accuracy = (accuracy * TO_QUAD_TOL) as f64;
+    let max_hypot2 = 432.0 * q_accuracy * q_accuracy;
+    let p1x2 = c.p1.to_vec2() * 3.0 - c.p0.to_vec2();
+    let p2x2 = c.p2.to_vec2() * 3.0 - c.p3.to_vec2();
+    let err = (p2x2 - p1x2).hypot2();
+    let err_div = err / max_hypot2;
+
+    estimate(err_div)
+}
+
+const TO_QUAD_TOL: f32 = 0.1;
+
+#[inline(always)]
+fn estimate(err_div: f64) -> usize {
+    // The original version of this method was:
+    // let n_quads = (err_div.powf(1. / 6.0).ceil() as usize).max(1);
+    // n_quads.min(MAX_QUADS)
+    //
+    // Note how we always round up and clamp to the range [1, max_quads]. Since we don't
+    // care about the actual fractional value resulting from the powf call we can simply
+    // compute this using a precomputed lookup table evaluating 1^6, 2^6, 3^6, etc. and simply
+    // comparing if the value is less than or equal to each threshold.
+
+    const LUT: [f64; MAX_QUADS] = [
+        1.0, 64.0, 729.0, 4096.0, 15625.0, 46656.0, 117649.0, 262144.0, 531441.0, 1000000.0,
+        1771561.0, 2985984.0, 4826809.0, 7529536.0, 11390625.0, 16777216.0,
+    ];
+
+    #[expect(clippy::needless_range_loop, reason = "better clarity")]
+    for i in 0..MAX_QUADS {
+        if err_div <= LUT[i] {
+            return i + 1;
+        }
+    }
+
+    MAX_QUADS
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::flatten_simd::{MAX_QUADS, estimate};
+
+    fn old_estimate(err_div: f64) -> usize {
+        let n_quads = (err_div.powf(1. / 6.0).ceil() as usize).max(1);
+        n_quads.min(MAX_QUADS)
+    }
+
+    // Test is disabled by default since it takes 10-20 seconds to run, even in release mode.
+    #[test]
+    #[ignore]
+    fn accuracy() {
+        for i in 0..u32::MAX {
+            let num = f32::from_bits(i);
+
+            if num.is_finite() {
+                assert_eq!(old_estimate(num as f64), estimate(num as f64), "{num}");
+            }
+        }
+    }
+}
diff --git a/vendor/vello_common/src/geometry.rs b/vendor/vello_common/src/geometry.rs
new file mode 100644
index 000000000..4337550eb
--- /dev/null
+++ b/vendor/vello_common/src/geometry.rs
@@ -0,0 +1,108 @@
+// Copyright 2025 the Vello Authors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+//! Geometry utilities.
+
+/// An axis-aligned rectangle with `u16` coordinates, stored as two corners `(x0, y0)` and
+/// `(x1, y1)`.
+///
+/// `(x0, y0)` is the top-left (minimum) corner and `(x1, y1)` is the bottom-right (maximum) corner.
+/// The rectangle is considered to be empty when `x0 >= x1` or `y0 >= y1`.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub struct RectU16 {
+    /// The minimum x coordinate (left edge).
+    pub x0: u16,
+    /// The minimum y coordinate (top edge).
+    pub y0: u16,
+    /// The maximum x coordinate (right edge, exclusive).
+    pub x1: u16,
+    /// The maximum y coordinate (bottom edge, exclusive).
+    pub y1: u16,
+}
+
+impl RectU16 {
+    /// A rectangle with all coordinates set to zero.
+    pub const ZERO: Self = Self {
+        x0: 0,
+        y0: 0,
+        x1: 0,
+        y1: 0,
+    };
+
+    /// An empty, maximally inverted rectangle, useful as a starting value for incremental union
+    /// operations.
+    ///
+    /// Has `(x0, y0) = (u16::MAX, u16::MAX)` and `(x1, y1) = (0, 0)`.
+    pub const INVERTED: Self = Self {
+        x0: u16::MAX,
+        y0: u16::MAX,
+        x1: 0,
+        y1: 0,
+    };
+
+    /// Create a new rectangle from its corner coordinates.
+    #[inline(always)]
+    pub const fn new(x0: u16, y0: u16, x1: u16, y1: u16) -> Self {
+        Self { x0, y0, x1, y1 }
+    }
+
+    /// The width of the rectangle (`x1 - x0`), saturating at zero.
+    #[inline(always)]
+    pub const fn width(self) -> u16 {
+        self.x1.saturating_sub(self.x0)
+    }
+
+    /// The height of the rectangle (`y1 - y0`), saturating at zero.
+    #[inline(always)]
+    pub const fn height(self) -> u16 {
+        self.y1.saturating_sub(self.y0)
+    }
+
+    /// Returns `true` if the rectangle has zero area (`x0 >= x1` or `y0 >= y1`).
+    #[inline(always)]
+    pub const fn is_empty(self) -> bool {
+        self.x0 >= self.x1 || self.y0 >= self.y1
+    }
+
+    /// Check if a point `(x, y)` is contained within this rectangle.
+    ///
+    /// Returns `true` if `x0 <= x < x1` and `y0 <= y < y1`.
+    #[inline(always)]
+    pub const fn contains(self, x: u16, y: u16) -> bool {
+        (x >= self.x0) & (x < self.x1) & (y >= self.y0) & (y < self.y1)
+    }
+
+    /// Compute the intersection of two rectangles.
+    ///
+    /// The result may be empty if the rectangles do not overlap.
+    #[inline(always)]
+    pub const fn intersect(self, other: Self) -> Self {
+        Self {
+            x0: const_max(self.x0, other.x0),
+            y0: const_max(self.y0, other.y0),
+            x1: const_min(self.x1, other.x1),
+            y1: const_min(self.y1, other.y1),
+        }
+    }
+
+    /// Expand this rectangle to also cover `other` (union in place).
+    ///
+    /// The union of `self` with a [`Self::INVERTED`] returns `self`.
+    #[inline(always)]
+    pub const fn union(&mut self, other: Self) {
+        self.x0 = const_min(self.x0, other.x0);
+        self.y0 = const_min(self.y0, other.y0);
+        self.x1 = const_max(self.x1, other.x1);
+        self.y1 = const_max(self.y1, other.y1);
+    }
+}
+
+#[inline(always)]
+const fn const_max(a: u16, b: u16) -> u16 {
+    if a > b { a } else { b }
+}
+
+#[inline(always)]
+const fn const_min(a: u16, b: u16) -> u16 {
+    if a < b { a } else { b }
+}
diff --git a/vendor/vello_common/src/image_cache.rs b/vendor/vello_common/src/image_cache.rs
new file mode 100644
index 000000000..f19c42f7a
--- /dev/null
+++ b/vendor/vello_common/src/image_cache.rs
@@ -0,0 +1,342 @@
+// Copyright 2025 the Vello Authors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+//! Image resource caching with multi-atlas allocation.
+//!
+//! This module provides an [`ImageCache`] that manages image resources across multiple texture
+//! atlases, supporting allocation, deallocation, and slot reuse.
+
+use crate::multi_atlas::{
+    AllocId, AllocationStrategy, AtlasConfig, AtlasError, AtlasId, MultiAtlasManager,
+};
+use crate::paint::ImageId;
+use alloc::vec::Vec;
+
+/// Represents an image resource for rendering.
+#[derive(Debug)]
+pub struct ImageResource {
+    /// The width of the image.
+    pub width: u16,
+    /// The height of the image.
+    pub height: u16,
+    /// The Id of the atlas containing this image.
+    pub atlas_id: AtlasId,
+    /// The offset of the image within its atlas (does not include padding, i.e. it points to the
+    /// position of the first actual top-left pixel).
+    pub offset: [u16; 2],
+    /// The number of transparent padding pixels around the image in the atlas.
+    pub padding: u16,
+    /// The atlas allocation ID for deallocation.
+    atlas_alloc_id: AllocId,
+}
+
+impl ImageResource {
+    /// Returns the offset as `[u32; 2]`.
+    pub fn offsets(&self) -> [u32; 2] {
+        [self.offset[0] as u32, self.offset[1] as u32]
+    }
+
+    /// Returns the size as `[u32; 2]`.
+    pub fn size(&self) -> [u32; 2] {
+        [self.width as u32, self.height as u32]
+    }
+}
+
+/// Manages image resources for the renderer.
+pub struct ImageCache {
+    /// Multi-atlas manager for handling multiple texture atlases.
+    atlas_manager: MultiAtlasManager,
+    /// Vector of optional image resources (None = free slot).
+    slots: Vec<Option<ImageResource>>,
+    /// Stack of free indices.
+    free_idxs: Vec<usize>,
+}
+
+impl core::fmt::Debug for ImageCache {
+    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        let atlas_stats = self.atlas_manager.atlas_stats();
+
+        f.debug_struct("ImageCache")
+            .field("slots", &self.slots)
+            .field("free_idxs", &self.free_idxs)
+            .field("atlas_count", &self.atlas_manager.atlas_count())
+            .field("atlas_stats", &atlas_stats)
+            .finish()
+    }
+}
+
+impl ImageCache {
+    /// Create a new image cache with custom atlas configuration.
+    pub fn new_with_config(config: AtlasConfig) -> Self {
+        Self {
+            atlas_manager: MultiAtlasManager::new(config),
+            slots: Vec::new(),
+            free_idxs: Vec::new(),
+        }
+    }
+
+    /// Create a new dummy image atlas that is supposed to act as a stub.
+    pub fn new_dummy() -> Self {
+        Self::new_with_config(AtlasConfig {
+            initial_atlas_count: 1,
+            max_atlases: 1,
+            atlas_size: (1, 1),
+            auto_grow: false,
+            allocation_strategy: AllocationStrategy::FirstFit,
+        })
+    }
+
+    /// Get an image resource by its Id.
+    pub fn get(&self, id: ImageId) -> Option<&ImageResource> {
+        self.slots.get(id.as_u32() as usize)?.as_ref()
+    }
+
+    /// Allocate an image in the cache, with optional transparent padding.
+    pub fn allocate(
+        &mut self,
+        width: u32,
+        height: u32,
+        padding: u16,
+    ) -> Result<ImageId, AtlasError> {
+        self.allocate_excluding(width, height, padding, None)
+    }
+
+    /// Allocate an image in the cache, with optional transparency padding
+    /// and optionally excluding a specific atlas.
+    #[expect(
+        clippy::cast_possible_truncation,
+        reason = "u16 is enough for the offset and width/height"
+    )]
+    pub fn allocate_excluding(
+        &mut self,
+        width: u32,
+        height: u32,
+        padding: u16,
+        exclude_atlas_id: Option<AtlasId>,
+    ) -> Result<ImageId, AtlasError> {
+        let padded_width = width + u32::from(padding) * 2;
+        let padded_height = height + u32::from(padding) * 2;
+        let atlas_alloc = self.atlas_manager.try_allocate_excluding(
+            padded_width,
+            padded_height,
+            exclude_atlas_id,
+        )?;
+
+        let slot_idx = self.free_idxs.pop().unwrap_or_else(|| {
+            // No free slots, append to vector
+            let index = self.slots.len();
+            // Placeholder, will be replaced
+            self.slots.push(None);
+            index
+        });
+
+        let image_id = ImageId::new(slot_idx as u32);
+        let image_resource = ImageResource {
+            width: width as u16,
+            height: height as u16,
+            atlas_id: atlas_alloc.atlas_id,
+            offset: [
+                atlas_alloc.allocation.x as u16 + padding,
+                atlas_alloc.allocation.y as u16 + padding,
+            ],
+            padding,
+            atlas_alloc_id: atlas_alloc.allocation.id,
+        };
+        self.slots[slot_idx] = Some(image_resource);
+
+        Ok(image_id)
+    }
+
+    /// Deallocate an image from the cache, returning the image resource if it existed.
+    pub fn deallocate(&mut self, id: ImageId) -> Option<ImageResource> {
+        let index = id.as_u32() as usize;
+        if let Some(image_resource) = self.slots.get_mut(index).and_then(Option::take) {
+            // Deallocate from the appropriate atlas
+            let padded_width = image_resource.width as u32 + u32::from(image_resource.padding) * 2;
+            let padded_height =
+                image_resource.height as u32 + u32::from(image_resource.padding) * 2;
+            self.atlas_manager
+                .deallocate(
+                    image_resource.atlas_id,
+                    image_resource.atlas_alloc_id,
+                    padded_width,
+                    padded_height,
+                )
+                .unwrap();
+            self.free_idxs.push(index);
+            Some(image_resource)
+        } else {
+            None
+        }
+    }
+
+    /// Get access to the atlas manager.
+    pub fn atlas_manager(&self) -> &MultiAtlasManager {
+        &self.atlas_manager
+    }
+
+    /// Get the number of atlases.
+    pub fn atlas_count(&self) -> usize {
+        self.atlas_manager.atlas_count()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const ATLAS_SIZE: u32 = 1024;
+
+    #[test]
+    fn test_insert_single_image() {
+        let mut cache = ImageCache::new_with_config(AtlasConfig {
+            atlas_size: (ATLAS_SIZE, ATLAS_SIZE),
+            ..Default::default()
+        });
+
+        let id = cache.allocate(100, 100, 0).unwrap();
+
+        assert_eq!(id.as_u32(), 0);
+        let resource = cache.get(id).unwrap();
+        assert_eq!(resource.width, 100);
+        assert_eq!(resource.height, 100);
+        // First image should be at origin
+        assert_eq!(resource.offset, [0, 0]);
+    }
+
+    #[test]
+    fn test_insert_single_image_with_padding() {
+        let mut cache = ImageCache::new_with_config(AtlasConfig {
+            atlas_size: (ATLAS_SIZE, ATLAS_SIZE),
+            ..Default::default()
+        });
+
+        let id = cache.allocate(100, 100, 4).unwrap();
+
+        assert_eq!(id.as_u32(), 0);
+        let resource = cache.get(id).unwrap();
+        assert_eq!(resource.width, 100);
+        assert_eq!(resource.height, 100);
+        assert_eq!(resource.padding, 4);
+        // Offset should be shifted inward by padding.
+        assert_eq!(resource.offset, [4, 4]);
+    }
+
+    #[test]
+    fn test_insert_multiple_images() {
+        let mut cache = ImageCache::new_with_config(AtlasConfig {
+            atlas_size: (ATLAS_SIZE, ATLAS_SIZE),
+            ..Default::default()
+        });
+
+        let id1 = cache.allocate(50, 50, 0).unwrap();
+        let id2 = cache.allocate(75, 75, 0).unwrap();
+
+        assert_eq!(id1.as_u32(), 0);
+        assert_eq!(id2.as_u32(), 1);
+
+        let resource1 = cache.get(id1).unwrap();
+        let resource2 = cache.get(id2).unwrap();
+
+        assert_eq!(resource1.width, 50);
+        assert_eq!(resource2.width, 75);
+
+        // Second image should be placed adjacent to first
+        assert_ne!(resource1.offset, resource2.offset);
+    }
+
+    #[test]
+    fn test_get_nonexistent_image() {
+        let cache: ImageCache = ImageCache::new_with_config(AtlasConfig {
+            atlas_size: (ATLAS_SIZE, ATLAS_SIZE),
+            ..Default::default()
+        });
+
+        assert!(cache.get(ImageId::new(0)).is_none());
+        assert!(cache.get(ImageId::new(999)).is_none());
+    }
+
+    #[test]
+    fn test_remove_image() {
+        let mut cache = ImageCache::new_with_config(AtlasConfig {
+            atlas_size: (ATLAS_SIZE, ATLAS_SIZE),
+            ..Default::default()
+        });
+
+        let id = cache.allocate(100, 100, 0).unwrap();
+        assert!(cache.get(id).is_some());
+
+        cache.deallocate(id);
+        assert!(cache.get(id).is_none());
+    }
+
+    #[test]
+    fn test_remove_nonexistent_image() {
+        let mut cache: ImageCache = ImageCache::new_with_config(AtlasConfig {
+            atlas_size: (ATLAS_SIZE, ATLAS_SIZE),
+            ..Default::default()
+        });
+
+        // Should not panic when unregistering non-existent image
+        cache.deallocate(ImageId::new(0));
+        cache.deallocate(ImageId::new(999));
+    }
+
+    #[test]
+    fn test_slot_reuse_after_remove() {
+        let mut cache = ImageCache::new_with_config(AtlasConfig {
+            atlas_size: (ATLAS_SIZE, ATLAS_SIZE),
+            ..Default::default()
+        });
+
+        // Register three images
+        let id1 = cache.allocate(50, 50, 0).unwrap();
+        let id2 = cache.allocate(60, 60, 0).unwrap();
+        let id3 = cache.allocate(70, 70, 0).unwrap();
+
+        assert_eq!(id1.as_u32(), 0);
+        assert_eq!(id2.as_u32(), 1);
+        assert_eq!(id3.as_u32(), 2);
+
+        // Unregister the middle one
+        cache.deallocate(id2);
+        assert!(cache.get(id2).is_none());
+
+        // Register a new image - should reuse slot 1
+        let id4 = cache.allocate(80, 80, 0).unwrap();
+        // Reused slot 1
+        assert_eq!(id4.as_u32(), 1);
+
+        // Verify other images are still there
+        assert!(cache.get(id1).is_some());
+        assert!(cache.get(id3).is_some());
+        assert!(cache.get(id4).is_some());
+        assert_eq!(cache.get(id4).unwrap().width, 80);
+    }
+
+    #[test]
+    fn test_multiple_remove_and_reuse() {
+        let mut cache = ImageCache::new_with_config(AtlasConfig {
+            atlas_size: (ATLAS_SIZE, ATLAS_SIZE),
+            ..Default::default()
+        });
+
+        // Register several images
+        let ids: Vec<_> = (0..5)
+            .map(|i| cache.allocate(100 + i * 10, 100 + i * 10, 0).unwrap())
+            .collect();
+
+        // Unregister some in the middle
+        cache.deallocate(ids[1]);
+        cache.deallocate(ids[3]);
+
+        // Register new images - should reuse the freed slots
+        let new_id1 = cache.allocate(200, 200, 0).unwrap();
+        let new_id2 = cache.allocate(300, 300, 0).unwrap();
+
+        // Should have reused slots 3 and 1 (in reverse order due to stack behavior)
+        assert_eq!(new_id1.as_u32(), 3);
+        assert_eq!(new_id2.as_u32(), 1);
+        assert_ne!(new_id1.as_u32(), new_id2.as_u32());
+    }
+}
diff --git a/vendor/vello_common/src/lib.rs b/vendor/vello_common/src/lib.rs
new file mode 100644
index 000000000..6862ea431
--- /dev/null
+++ b/vendor/vello_common/src/lib.rs
@@ -0,0 +1,106 @@
+// Copyright 2025 the Vello Authors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+// After you edit the crate's doc comment, run this command, then check README.md for any missing links
+// cargo rdme --workspace-project=vello_common
+
+//! This crate includes common geometry representations, tiling logic, and other fundamental components used by both [Vello CPU][vello_cpu] and Vello Hybrid.
+//!
+//! # Usage
+//!
+//! This crate should not be used on its own, and you should instead use one of the renderers which use it.
+//! At the moment, only [Vello CPU][vello_cpu] is published, and you probably want to use that.
+//!
+//! We also develop [Vello](https://crates.io/crates/vello), which makes use of the GPU for 2D rendering and has higher performance than Vello CPU.
+//! Vello CPU is being developed as part of work to address shortcomings in Vello.
+//! Vello does not use this crate.
+//!
+//! # Features
+//!
+//! - `std` (enabled by default): Get floating point functions from the standard library
+//!   (likely using your target's libc).
+//! - `libm`: Use floating point implementations from [libm][].
+//! - `png` (enabled by default): Allow loading [`Pixmap`][crate::pixmap::Pixmap]s from PNG images.
+//!   Also required for rendering glyphs with an embedded PNG.
+//!   Implies `std`.
+//!
+//! At least one of `std` and `libm` is required; `std` overrides `libm`.
+//!
+//! # Contents
+//!
+//! - Shared data structures for paths, tiles, and strips
+//! - Geometry processing utilities
+//! - Common logic for rendering stages
+//!
+//! This crate acts as a foundation for `vello_cpu` and `vello_hybrid`, providing essential components to minimize duplication.
+//!
+//! [vello_cpu]: https://crates.io/crates/vello_cpu
+#![cfg_attr(feature = "libm", doc = "[libm]: libm")]
+#![cfg_attr(not(feature = "libm"), doc = "[libm]: https://crates.io/crates/libm")]
+// LINEBENDER LINT SET - lib.rs - v3
+// See https://linebender.org/wiki/canonical-lints/
+// These lints shouldn't apply to examples or tests.
+#![cfg_attr(not(test), warn(unused_crate_dependencies))]
+// These lints shouldn't apply to examples.
+#![warn(clippy::print_stdout, clippy::print_stderr)]
+// Targeting e.g. 32-bit means structs containing usize can give false positives for 64-bit.
+#![cfg_attr(target_pointer_width = "64", warn(clippy::trivially_copy_pass_by_ref))]
+// END LINEBENDER LINT SET
+#![cfg_attr(docsrs, feature(doc_cfg))]
+#![forbid(unsafe_code)]
+#![expect(
+    clippy::cast_possible_truncation,
+    reason = "We temporarily ignore those because the casts\
+only break in edge cases, and some of them are also only related to conversions from f64 to f32."
+)]
+#![no_std]
+
+// Suppress the unused_crate_dependencies lint when both std and libm are specified.
+#[cfg(all(feature = "std", feature = "libm"))]
+use libm as _;
+
+extern crate alloc;
+#[cfg(feature = "std")]
+extern crate std;
+
+pub mod blurred_rounded_rect;
+pub mod clip;
+pub mod coarse;
+pub mod encode;
+pub mod filter;
+pub mod filter_effects;
+pub mod flatten;
+pub(crate) mod flatten_simd;
+pub mod geometry;
+pub mod image_cache;
+pub mod mask;
+pub mod math;
+pub mod multi_atlas;
+pub mod paint;
+#[doc(hidden)]
+#[cfg(feature = "pico_svg")]
+pub mod pico_svg;
+pub mod pixmap;
+#[doc(hidden)]
+#[cfg(feature = "probe")]
+pub mod probe;
+pub mod rect;
+pub mod render_graph;
+pub mod render_state;
+pub mod simd;
+pub mod strip;
+pub mod strip_generator;
+pub mod tile;
+pub mod util;
+
+pub use fearless_simd;
+pub use peniko;
+pub use peniko::color;
+pub use peniko::kurbo;
+
+/// A handle to an external, user-provided texture.
+///
+/// This is resolved at render time by passing in a mapping of handles to textures, but is
+/// otherwise opaque to the renderer.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub struct TextureId(pub u64);
diff --git a/vendor/vello_common/src/mask.rs b/vendor/vello_common/src/mask.rs
new file mode 100644
index 000000000..8047be828
--- /dev/null
+++ b/vendor/vello_common/src/mask.rs
@@ -0,0 +1,116 @@
+// Copyright 2025 the Vello Authors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+//! Alpha and luminance masks.
+
+use crate::pixmap::Pixmap;
+use alloc::sync::Arc;
+use alloc::vec::Vec;
+
+#[derive(Debug, PartialEq, Eq)]
+struct MaskRepr {
+    data: Vec<u8>,
+    width: u16,
+    height: u16,
+}
+
+// Note that we are on purpose storing width and height inside the `Arc`
+// to reduce the memory footprint of the struct.
+/// A mask.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Mask(Arc<MaskRepr>);
+
+impl Mask {
+    /// Create a new alpha mask from the pixmap.
+    pub fn new_alpha(pixmap: &Pixmap) -> Self {
+        Self::new_with(pixmap, true)
+    }
+
+    /// Create a new luminance mask from the pixmap.
+    pub fn new_luminance(pixmap: &Pixmap) -> Self {
+        Self::new_with(pixmap, false)
+    }
+
+    /// Create a new mask from the given alpha data.
+    ///
+    /// The `data` vector must be of length `width * height` exactly.
+    ///
+    /// The pixels are in row-major order.
+    ///
+    /// # Panics
+    ///
+    /// Panics if the `data` vector is not of length `width * height`.
+    pub fn from_parts(data: Vec<u8>, width: u16, height: u16) -> Self {
+        assert_eq!(
+            data.len(),
+            usize::from(width) * usize::from(height),
+            "`data` should have `width * height` length"
+        );
+
+        Self(Arc::new(MaskRepr {
+            data,
+            width,
+            height,
+        }))
+    }
+
+    fn new_with(pixmap: &Pixmap, alpha_mask: bool) -> Self {
+        let data = pixmap
+            .data()
+            .iter()
+            .map(|pixel| {
+                if alpha_mask {
+                    pixel.a
+                } else {
+                    let r = f32::from(pixel.r) / 255.;
+                    let g = f32::from(pixel.g) / 255.;
+                    let b = f32::from(pixel.b) / 255.;
+
+                    // See CSS Masking Module Level 1 § 7.10.1
+                    // <https://www.w3.org/TR/css-masking-1/#MaskValues>
+                    // and Filter Effects Module Level 1 § 9.6
+                    // <https://www.w3.org/TR/filter-effects-1/#elementdef-fecolormatrix>.
+                    // Note r, g and b are premultiplied by alpha.
+                    let luma = r * 0.2126 + g * 0.7152 + b * 0.0722;
+                    #[expect(clippy::cast_possible_truncation, reason = "This cannot overflow")]
+                    {
+                        (luma * 255.0 + 0.5) as u8
+                    }
+                }
+            })
+            .collect::<Vec<u8>>();
+
+        Self(Arc::new(MaskRepr {
+            data,
+            width: pixmap.width(),
+            height: pixmap.height(),
+        }))
+    }
+
+    /// Return the width of the mask.
+    #[inline(always)]
+    pub fn width(&self) -> u16 {
+        self.0.width
+    }
+
+    /// Return the height of the mask.
+    #[inline(always)]
+    pub fn height(&self) -> u16 {
+        self.0.height
+    }
+
+    /// Sample the value at a specific location.
+    ///
+    /// This function might panic or yield a wrong result if the location
+    /// is out-of-bounds.
+    #[inline(always)]
+    pub fn sample(&self, x: u16, y: u16) -> u8 {
+        let repr = &*self.0;
+        debug_assert!(
+            x < repr.width && y < repr.height,
+            "cannot sample mask outside of its range"
+        );
+
+        repr.data[y as usize * repr.width as usize + x as usize]
+    }
+}
diff --git a/vendor/vello_common/src/math.rs b/vendor/vello_common/src/math.rs
new file mode 100644
index 000000000..36efbacae
--- /dev/null
+++ b/vendor/vello_common/src/math.rs
@@ -0,0 +1,60 @@
+// Copyright 2025 the Vello Authors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+//! Mathematical helper functions.
+
+use core::ops::Sub;
+#[cfg(not(feature = "std"))]
+use peniko::kurbo::common::FloatFuncs as _;
+
+// See https://raphlinus.github.io/audio/2018/09/05/sigmoid.html for a little
+// explanation of this approximation to the erf function.
+/// Approximate the erf function.
+pub fn compute_erf7(x: f32) -> f32 {
+    // Clamp `x`, because for large `x` the terms here become `inf`, causing the result to be 0 or
+    // `NaN`. This clamping doesn't lose any information, because `erf(±10) ≈ 1` well within `f64`
+    // machine precision, let alone `f32`.
+    let x = x.clamp(-10., 10.);
+    let x = x * core::f32::consts::FRAC_2_SQRT_PI;
+    let xx = x * x;
+    let x = x + (0.24295 + (0.03395 + 0.0104 * xx) * xx) * (x * xx);
+    x / (1.0 + x * x).sqrt()
+}
+
+// From <https://github.com/linebender/tiny-skia/blob/68b198a7210a6bbf752b43d6bc4db62445730313/path/src/scalar.rs#L12>
+// Note: If this value changes, also update NEARLY_ZERO_TOLERANCE in render_strips.wgsl
+// @see {@link https://github.com/linebender/vello/blob/58b80d660e2fc5aef3bd32b24af3f95e973aab95/sparse_strips/vello_sparse_shaders/shaders/render_strips.wgsl#L63}
+const SCALAR_NEARLY_ZERO: f32 = 1.0 / (1 << 12) as f32;
+
+/// A number of useful methods for floating-point numbers.
+pub trait FloatExt: Sized + Sub<Self, Output = Self> {
+    /// Whether the number is approximately 0.
+    fn is_nearly_zero(&self) -> bool;
+
+    /// Whether the number is approximately 0, with a given tolerance.
+    fn is_nearly_zero_within_tolerance(&self, tolerance: f32) -> bool;
+}
+
+impl FloatExt for f32 {
+    fn is_nearly_zero(&self) -> bool {
+        self.is_nearly_zero_within_tolerance(SCALAR_NEARLY_ZERO)
+    }
+
+    fn is_nearly_zero_within_tolerance(&self, tolerance: f32) -> bool {
+        debug_assert!(tolerance >= 0.0, "tolerance must be positive");
+
+        self.abs() <= tolerance
+    }
+}
+
+impl FloatExt for f64 {
+    fn is_nearly_zero(&self) -> bool {
+        self.is_nearly_zero_within_tolerance(SCALAR_NEARLY_ZERO)
+    }
+
+    fn is_nearly_zero_within_tolerance(&self, tolerance: f32) -> bool {
+        debug_assert!(tolerance >= 0.0, "tolerance must be positive");
+
+        self.abs() <= tolerance as Self
+    }
+}
diff --git a/vendor/vello_common/src/multi_atlas.rs b/vendor/vello_common/src/multi_atlas.rs
new file mode 100644
index 000000000..4e42918e2
--- /dev/null
+++ b/vendor/vello_common/src/multi_atlas.rs
@@ -0,0 +1,760 @@
+// Copyright 2025 the Vello Authors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+//! Multi-atlas management for texture atlases.
+//!
+//! This module provides support for managing multiple texture atlases, allowing for handling of
+//! large numbers of images.
+//!
+//! The allocator backend is [guillotiere](https://github.com/nical/guillotiere)'s tree-based
+//! guillotine algorithm, providing O(1) neighbor lookup during deallocation and automatic
+//! free-rect coalescing.
+
+use alloc::vec::Vec;
+pub use guillotiere::AllocId;
+use guillotiere::AtlasAllocator;
+use thiserror::Error;
+
+/// The result of a successful rectangle allocation within a single atlas.
+#[derive(Debug)]
+pub struct Allocation {
+    /// Opaque handle used for deallocation.
+    pub id: AllocId,
+    /// X coordinate of the top-left corner of the allocated rectangle.
+    pub x: u32,
+    /// Y coordinate of the top-left corner of the allocated rectangle.
+    pub y: u32,
+}
+
+// ---------------------------------------------------------------------------
+// Unified Atlas type
+// ---------------------------------------------------------------------------
+
+/// Represents a single atlas in the multi-atlas system.
+pub struct Atlas {
+    /// Unique identifier for this atlas.
+    pub id: AtlasId,
+    /// Rectangle allocator backend.
+    allocator: AtlasAllocator,
+    /// Current usage statistics.
+    stats: AtlasUsageStats,
+    /// Allocation counter.
+    allocation_counter: u32,
+}
+
+impl Atlas {
+    /// Create a new atlas with the given ID and size.
+    pub fn new(id: AtlasId, width: u32, height: u32) -> Self {
+        Self {
+            id,
+            allocator: AtlasAllocator::new(guillotiere::size2(width as i32, height as i32)),
+            stats: AtlasUsageStats {
+                allocated_area: 0,
+                total_area: width * height,
+                allocated_count: 0,
+            },
+            allocation_counter: 0,
+        }
+    }
+
+    /// Try to allocate an image in this atlas.
+    #[expect(
+        clippy::cast_sign_loss,
+        reason = "coordinates are always non-negative for valid allocations"
+    )]
+    pub fn allocate(&mut self, width: u32, height: u32) -> Option<Allocation> {
+        let alloc = self
+            .allocator
+            .allocate(guillotiere::size2(width as i32, height as i32))?;
+        self.stats.allocated_area += width * height;
+        self.stats.allocated_count += 1;
+        self.allocation_counter += 1;
+        Some(Allocation {
+            id: alloc.id,
+            x: alloc.rectangle.min.x as u32,
+            y: alloc.rectangle.min.y as u32,
+        })
+    }
+
+    /// Deallocate an image from this atlas.
+    pub fn deallocate(&mut self, alloc_id: AllocId, width: u32, height: u32) {
+        self.allocator.deallocate(alloc_id);
+        self.stats.allocated_area = self.stats.allocated_area.saturating_sub(width * height);
+        self.stats.allocated_count = self.stats.allocated_count.saturating_sub(1);
+    }
+
+    /// Get current usage statistics.
+    pub fn stats(&self) -> &AtlasUsageStats {
+        &self.stats
+    }
+}
+
+impl core::fmt::Debug for Atlas {
+    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        f.debug_struct("Atlas")
+            .field("id", &self.id)
+            .field("stats", &self.stats)
+            .field("allocation_counter", &self.allocation_counter)
+            .finish_non_exhaustive()
+    }
+}
+
+// ---------------------------------------------------------------------------
+// MultiAtlasManager
+// ---------------------------------------------------------------------------
+
+/// Manages multiple texture atlases.
+pub struct MultiAtlasManager {
+    /// All atlases managed by this instance.
+    atlases: Vec<Atlas>,
+    /// Configuration for atlas management.
+    config: AtlasConfig,
+    /// Round-robin counter for allocation strategy.
+    round_robin_counter: usize,
+}
+
+impl MultiAtlasManager {
+    /// Create a new multi-atlas manager with the given configuration.
+    pub fn new(config: AtlasConfig) -> Self {
+        let mut manager = Self {
+            atlases: Vec::new(),
+            config,
+            round_robin_counter: 0,
+        };
+
+        for _ in 0..config.initial_atlas_count {
+            manager
+                .create_atlas()
+                .expect("Failed to create initial atlas");
+        }
+
+        manager
+    }
+
+    /// Get the current configuration.
+    pub fn config(&self) -> &AtlasConfig {
+        &self.config
+    }
+
+    /// Create a new atlas and return its ID.
+    pub fn create_atlas(&mut self) -> Result<AtlasId, AtlasError> {
+        if self.atlases.len() >= self.config.max_atlases {
+            return Err(AtlasError::AtlasLimitReached);
+        }
+
+        let atlas_id = AtlasId::new(self.next_atlas_id());
+
+        let atlas = Atlas::new(atlas_id, self.config.atlas_size.0, self.config.atlas_size.1);
+        self.atlases.push(atlas);
+
+        Ok(atlas_id)
+    }
+
+    /// Get the next available atlas ID.
+    pub fn next_atlas_id(&self) -> u32 {
+        u32::try_from(self.atlases.len()).unwrap()
+    }
+
+    /// Try to allocate space for an image with the given dimensions.
+    pub fn try_allocate(&mut self, width: u32, height: u32) -> Result<AtlasAllocation, AtlasError> {
+        self.try_allocate_excluding(width, height, None)
+    }
+
+    /// Try to allocate space for an image with the given dimensions,
+    /// optionally excluding a specific atlas.
+    pub fn try_allocate_excluding(
+        &mut self,
+        width: u32,
+        height: u32,
+        exclude_atlas_id: Option<AtlasId>,
+    ) -> Result<AtlasAllocation, AtlasError> {
+        // Check if the image is too large for any atlas
+        if width > self.config.atlas_size.0 || height > self.config.atlas_size.1 {
+            return Err(AtlasError::TextureTooLarge { width, height });
+        }
+
+        // Try allocation based on strategy
+        match self.config.allocation_strategy {
+            AllocationStrategy::FirstFit => {
+                self.allocate_first_fit(width, height, exclude_atlas_id)
+            }
+            AllocationStrategy::BestFit => self.allocate_best_fit(width, height, exclude_atlas_id),
+            AllocationStrategy::LeastUsed => {
+                self.allocate_least_used(width, height, exclude_atlas_id)
+            }
+            AllocationStrategy::RoundRobin => {
+                self.allocate_round_robin(width, height, exclude_atlas_id)
+            }
+        }
+    }
+
+    /// Allocate using first-fit strategy: try atlases in order until one has space.
+    fn allocate_first_fit(
+        &mut self,
+        width: u32,
+        height: u32,
+        exclude_atlas_id: Option<AtlasId>,
+    ) -> Result<AtlasAllocation, AtlasError> {
+        for atlas in &mut self.atlases {
+            if Some(atlas.id) == exclude_atlas_id {
+                continue;
+            }
+
+            if let Some(allocation) = atlas.allocate(width, height) {
+                return Ok(AtlasAllocation {
+                    atlas_id: atlas.id,
+                    allocation,
+                });
+            }
+        }
+
+        // Try creating a new atlas if auto-grow is enabled
+        if self.config.auto_grow {
+            let atlas_id = self.create_atlas()?;
+            let atlas = self.atlases.last_mut().unwrap();
+            if let Some(allocation) = atlas.allocate(width, height) {
+                return Ok(AtlasAllocation {
+                    atlas_id,
+                    allocation,
+                });
+            }
+        }
+
+        Err(AtlasError::NoSpaceAvailable)
+    }
+
+    /// Allocate using best-fit strategy: choose the atlas with the smallest remaining space that
+    /// can fit the image.
+    fn allocate_best_fit(
+        &mut self,
+        width: u32,
+        height: u32,
+        exclude_atlas_id: Option<AtlasId>,
+    ) -> Result<AtlasAllocation, AtlasError> {
+        let mut best_atlas_idx = None;
+        let mut best_remaining_space = u32::MAX;
+
+        // Find the atlas with the least remaining space that can fit the image
+        for (idx, atlas) in self.atlases.iter().enumerate() {
+            if Some(atlas.id) == exclude_atlas_id {
+                continue;
+            }
+
+            let stats = atlas.stats();
+            let remaining_space = stats.total_area - stats.allocated_area;
+
+            if remaining_space >= width * height && remaining_space < best_remaining_space {
+                best_remaining_space = remaining_space;
+                best_atlas_idx = Some(idx);
+            }
+        }
+
+        if let Some(idx) = best_atlas_idx {
+            let atlas = &mut self.atlases[idx];
+            if let Some(allocation) = atlas.allocate(width, height) {
+                return Ok(AtlasAllocation {
+                    atlas_id: atlas.id,
+                    allocation,
+                });
+            }
+        }
+
+        // Fallback to first-fit if best-fit didn't work
+        self.allocate_first_fit(width, height, exclude_atlas_id)
+    }
+
+    /// Allocate using least-used strategy: prefer the atlas with the lowest usage percentage.
+    fn allocate_least_used(
+        &mut self,
+        width: u32,
+        height: u32,
+        exclude_atlas_id: Option<AtlasId>,
+    ) -> Result<AtlasAllocation, AtlasError> {
+        let mut best_atlas_idx = None;
+        let mut lowest_usage = f32::MAX;
+
+        // Find the atlas with the lowest usage percentage
+        for (idx, atlas) in self.atlases.iter().enumerate() {
+            if Some(atlas.id) == exclude_atlas_id {
+                continue;
+            }
+
+            let usage = atlas.stats().usage_percentage();
+            if usage < lowest_usage {
+                lowest_usage = usage;
+                best_atlas_idx = Some(idx);
+            }
+        }
+
+        if let Some(idx) = best_atlas_idx
+            && let Some(allocation) = self.atlases[idx].allocate(width, height)
+        {
+            let atlas_id = self.atlases[idx].id;
+            return Ok(AtlasAllocation {
+                atlas_id,
+                allocation,
+            });
+        }
+
+        // Fallback to first-fit if least-used didn't work
+        self.allocate_first_fit(width, height, exclude_atlas_id)
+    }
+
+    /// Allocate using round-robin strategy: cycle through atlases using a round-robin counter.
+    fn allocate_round_robin(
+        &mut self,
+        width: u32,
+        height: u32,
+        exclude_atlas_id: Option<AtlasId>,
+    ) -> Result<AtlasAllocation, AtlasError> {
+        if self.atlases.is_empty() {
+            return self.allocate_first_fit(width, height, exclude_atlas_id);
+        }
+
+        let start_idx = self.round_robin_counter % self.atlases.len();
+
+        // Try starting from the round-robin position
+        for i in 0..self.atlases.len() {
+            let idx = (start_idx + i) % self.atlases.len();
+
+            if Some(self.atlases[idx].id) == exclude_atlas_id {
+                continue;
+            }
+
+            if let Some(allocation) = self.atlases[idx].allocate(width, height) {
+                let atlas_id = self.atlases[idx].id;
+                self.round_robin_counter = (idx + 1) % self.atlases.len();
+                return Ok(AtlasAllocation {
+                    atlas_id,
+                    allocation,
+                });
+            }
+        }
+
+        // Try creating a new atlas if auto-grow is enabled
+        if self.config.auto_grow {
+            let atlas_id = self.create_atlas()?;
+            let atlas = self.atlases.last_mut().unwrap();
+            if let Some(allocation) = atlas.allocate(width, height) {
+                self.round_robin_counter = self.atlases.len() - 1;
+                return Ok(AtlasAllocation {
+                    atlas_id,
+                    allocation,
+                });
+            }
+        }
+
+        Err(AtlasError::NoSpaceAvailable)
+    }
+
+    /// Deallocate space in the specified atlas.
+    pub fn deallocate(
+        &mut self,
+        atlas_id: AtlasId,
+        alloc_id: AllocId,
+        width: u32,
+        height: u32,
+    ) -> Result<(), AtlasError> {
+        // Since atlases only grow (never deallocate) and id is the index into the atlases vec,
+        // we can do a lookup instead of a linear search
+        let atlas = self
+            .atlases
+            .get_mut(atlas_id.0 as usize)
+            .ok_or(AtlasError::AtlasNotFound(atlas_id))?;
+        atlas.deallocate(alloc_id, width, height);
+        Ok(())
+    }
+
+    /// Get statistics for all atlases.
+    pub fn atlas_stats(&self) -> Vec<(AtlasId, &AtlasUsageStats)> {
+        self.atlases
+            .iter()
+            .map(|atlas| (atlas.id, atlas.stats()))
+            .collect()
+    }
+
+    /// Get the number of atlases.
+    pub fn atlas_count(&self) -> usize {
+        self.atlases.len()
+    }
+}
+
+impl core::fmt::Debug for MultiAtlasManager {
+    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        f.debug_struct("MultiAtlasManager")
+            .field("atlas_count", &self.atlases.len())
+            .field("config", &self.config)
+            .field("next_atlas_id", &self.next_atlas_id())
+            .field("round_robin_counter", &self.round_robin_counter)
+            .field("atlases", &self.atlases)
+            .finish()
+    }
+}
+
+/// Errors that can occur during atlas operations.
+#[derive(Debug, Clone, Error)]
+pub enum AtlasError {
+    /// No space available in any atlas.
+    #[error("No space available in any atlas")]
+    NoSpaceAvailable,
+    /// Maximum number of atlases reached.
+    #[error("Maximum number of atlases reached")]
+    AtlasLimitReached,
+    /// The requested texture size is too large for any atlas.
+    #[error("Texture too large ({width}x{height}) for atlas")]
+    TextureTooLarge {
+        /// The width of the requested texture.
+        width: u32,
+        /// The height of the requested texture.
+        height: u32,
+    },
+    /// The specified atlas was not found.
+    #[error("Atlas with Id {0:?} not found")]
+    AtlasNotFound(AtlasId),
+}
+
+/// Unique identifier for an atlas.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub struct AtlasId(pub u32);
+
+impl AtlasId {
+    /// Create a new atlas ID.
+    pub fn new(id: u32) -> Self {
+        Self(id)
+    }
+
+    /// Get the raw ID value.
+    pub fn as_u32(self) -> u32 {
+        self.0
+    }
+}
+
+/// Usage statistics for an atlas.
+#[derive(Debug, Clone)]
+pub struct AtlasUsageStats {
+    /// Total allocated area in pixels.
+    pub allocated_area: u32,
+    /// Total available area in pixels.
+    pub total_area: u32,
+    /// Number of allocated images.
+    pub allocated_count: u32,
+}
+
+impl AtlasUsageStats {
+    /// Calculate usage percentage (0.0 to 1.0).
+    pub fn usage_percentage(&self) -> f32 {
+        if self.total_area == 0 {
+            0.0
+        } else {
+            self.allocated_area as f32 / self.total_area as f32
+        }
+    }
+}
+
+/// Result of an atlas allocation attempt.
+#[derive(Debug)]
+pub struct AtlasAllocation {
+    /// The atlas where the allocation was made.
+    pub atlas_id: AtlasId,
+    /// The allocation details.
+    pub allocation: Allocation,
+}
+
+/// Configuration for multiple atlas support.
+///
+/// Note that any values provided here are recommendations and might not be fully
+/// honored depending on the capabilities of the backend. For example, if you define
+/// the atlas size to be 8192x8192 but the device only supports texture sizes up to 4096x4096,
+/// the backend will likely decide to instead use the value that is compatible with the device.
+#[derive(Debug, Clone, Copy)]
+pub struct AtlasConfig {
+    /// Initial number of atlases to create.
+    pub initial_atlas_count: usize,
+    /// Maximum number of atlases to create.
+    pub max_atlases: usize,
+    // TODO: Make those u16 instead?
+    /// Size of each atlas texture.
+    pub atlas_size: (u32, u32),
+    /// Whether to automatically create new atlases when needed.
+    pub auto_grow: bool,
+    /// Strategy for allocating images across atlases.
+    pub allocation_strategy: AllocationStrategy,
+}
+
+impl Default for AtlasConfig {
+    fn default() -> Self {
+        Self {
+            initial_atlas_count: 1,
+            max_atlases: 8,
+            atlas_size: (4096, 4096),
+            auto_grow: true,
+            allocation_strategy: AllocationStrategy::FirstFit,
+        }
+    }
+}
+
+/// Strategy for allocating images across multiple atlases.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
+pub enum AllocationStrategy {
+    /// Try atlases in order until one has space.
+    #[default]
+    FirstFit,
+    /// Choose the atlas with the smallest remaining space that can fit the image.
+    BestFit,
+    /// Prefer the atlas with the lowest usage percentage.
+    LeastUsed,
+    /// Cycle through atlases in round-robin fashion.
+    RoundRobin,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_atlas_creation() {
+        let mut manager = MultiAtlasManager::new(AtlasConfig {
+            initial_atlas_count: 0,
+            ..Default::default()
+        });
+
+        let atlas_id = manager.create_atlas().unwrap();
+        assert_eq!(atlas_id.as_u32(), 0);
+        assert_eq!(manager.atlas_count(), 1);
+    }
+
+    #[test]
+    fn test_allocation_strategies() {
+        let mut manager = MultiAtlasManager::new(AtlasConfig {
+            initial_atlas_count: 1,
+            max_atlases: 3,
+            atlas_size: (256, 256),
+            allocation_strategy: AllocationStrategy::FirstFit,
+            auto_grow: true,
+        });
+
+        // Should create atlas automatically
+        let allocation = manager.try_allocate(100, 100).unwrap();
+        assert_eq!(allocation.atlas_id.as_u32(), 0);
+    }
+
+    #[test]
+    fn test_atlas_limit() {
+        let mut manager = MultiAtlasManager::new(AtlasConfig {
+            initial_atlas_count: 1,
+            max_atlases: 1,
+            atlas_size: (256, 256),
+            allocation_strategy: AllocationStrategy::FirstFit,
+            auto_grow: false,
+        });
+
+        assert!(manager.create_atlas().is_err());
+    }
+
+    #[test]
+    fn test_texture_too_large() {
+        let mut manager = MultiAtlasManager::new(AtlasConfig {
+            atlas_size: (256, 256),
+            ..Default::default()
+        });
+
+        let result = manager.try_allocate(300, 300);
+        assert!(matches!(result, Err(AtlasError::TextureTooLarge { .. })));
+    }
+
+    #[test]
+    fn test_first_fit_allocation_strategy() {
+        let mut manager = MultiAtlasManager::new(AtlasConfig {
+            initial_atlas_count: 3,
+            max_atlases: 3,
+            atlas_size: (256, 256),
+            allocation_strategy: AllocationStrategy::FirstFit,
+            auto_grow: false,
+        });
+
+        // First allocation should go to atlas 0
+        let allocation0 = manager.try_allocate(100, 100).unwrap();
+        assert_eq!(allocation0.atlas_id.as_u32(), 0);
+
+        // Second allocation should also go to atlas 0 (first fit)
+        let allocation1 = manager.try_allocate(50, 50).unwrap();
+        assert_eq!(allocation1.atlas_id.as_u32(), 0);
+
+        // Third allocation should still go to atlas 0 (first fit continues to use same atlas)
+        let allocation2 = manager.try_allocate(80, 80).unwrap();
+        assert_eq!(allocation2.atlas_id.as_u32(), 0);
+
+        // Try to allocate something very large that definitely won't fit in atlas 0's remaining space
+        // This should force it to go to atlas 1
+        let allocation3 = manager.try_allocate(200, 200).unwrap();
+        assert_eq!(allocation3.atlas_id.as_u32(), 1);
+
+        // Next small allocation should go back to atlas 0 (first fit tries atlas 0 first)
+        let allocation4 = manager.try_allocate(20, 20).unwrap();
+        assert_eq!(allocation4.atlas_id.as_u32(), 0);
+    }
+
+    #[test]
+    fn test_best_fit_allocation_strategy() {
+        let mut manager = MultiAtlasManager::new(AtlasConfig {
+            initial_atlas_count: 3,
+            max_atlases: 3,
+            atlas_size: (256, 256),
+            allocation_strategy: AllocationStrategy::BestFit,
+            auto_grow: false,
+        });
+
+        // All atlases start empty, so first allocation goes to atlas 0 (first available)
+        let allocation0 = manager.try_allocate(150, 150).unwrap();
+        assert_eq!(allocation0.atlas_id.as_u32(), 0);
+
+        // Second allocation should also go to atlas 0 since it still has the least remaining space
+        // that can fit the image (all atlases have same remaining space, so it picks the first)
+        let allocation1 = manager.try_allocate(100, 100).unwrap();
+        assert_eq!(allocation1.atlas_id.as_u32(), 0);
+
+        // Now atlas 0 has less remaining space than atlases 1 and 2
+        // For a small allocation, it should still go to atlas 0 (best fit - least remaining space)
+        let allocation2 = manager.try_allocate(100, 100).unwrap();
+        assert_eq!(allocation2.atlas_id.as_u32(), 0);
+
+        // Now try to allocate something very large that won't fit in atlas 0's remaining space
+        // This should force it to go to atlas 1 (which has the most remaining space)
+        let allocation3 = manager.try_allocate(200, 200).unwrap();
+        assert_eq!(allocation3.atlas_id.as_u32(), 1);
+
+        // Now atlas 1 has less remaining space
+        // A small allocation should go to atlas 0 as it can
+        let allocation4 = manager.try_allocate(80, 80).unwrap();
+        assert_eq!(allocation4.atlas_id.as_u32(), 0);
+
+        // Now atlas 1 has less remaining space but it can't fit the allocation
+        // It should go to atlas 2 (best fit - least remaining space)
+        let allocation5 = manager.try_allocate(80, 80).unwrap();
+        assert_eq!(allocation5.atlas_id.as_u32(), 2);
+    }
+
+    #[test]
+    fn test_least_used_allocation_strategy() {
+        let mut manager = MultiAtlasManager::new(AtlasConfig {
+            initial_atlas_count: 3,
+            max_atlases: 3,
+            atlas_size: (256, 256),
+            allocation_strategy: AllocationStrategy::LeastUsed,
+            auto_grow: false,
+        });
+
+        // First allocation goes to atlas 0 (all atlases have 0% usage, picks first)
+        let allocation0 = manager.try_allocate(100, 100).unwrap();
+        assert_eq!(allocation0.atlas_id.as_u32(), 0);
+
+        // Second allocation should go to atlas 1 (least used among remaining)
+        let allocation1 = manager.try_allocate(50, 50).unwrap();
+        assert_eq!(allocation1.atlas_id.as_u32(), 1);
+
+        // Third allocation should go to atlas 2 (least used)
+        let allocation2 = manager.try_allocate(30, 30).unwrap();
+        assert_eq!(allocation2.atlas_id.as_u32(), 2);
+
+        // Fourth allocation should go to atlas 2 again (still least used)
+        let allocation3 = manager.try_allocate(30, 30).unwrap();
+        assert_eq!(allocation3.atlas_id.as_u32(), 2);
+    }
+
+    #[test]
+    fn test_round_robin_allocation_strategy() {
+        let mut manager = MultiAtlasManager::new(AtlasConfig {
+            initial_atlas_count: 3,
+            max_atlases: 3,
+            atlas_size: (256, 256),
+            allocation_strategy: AllocationStrategy::RoundRobin,
+            auto_grow: false,
+        });
+
+        // Allocations should cycle through atlases in order
+        let allocation0 = manager.try_allocate(50, 50).unwrap();
+        assert_eq!(allocation0.atlas_id.as_u32(), 0);
+
+        let allocation1 = manager.try_allocate(50, 50).unwrap();
+        assert_eq!(allocation1.atlas_id.as_u32(), 1);
+
+        let allocation2 = manager.try_allocate(50, 50).unwrap();
+        assert_eq!(allocation2.atlas_id.as_u32(), 2);
+
+        // Should wrap back to atlas 0
+        let allocation3 = manager.try_allocate(50, 50).unwrap();
+        assert_eq!(allocation3.atlas_id.as_u32(), 0);
+
+        // Continue the cycle
+        let allocation4 = manager.try_allocate(50, 50).unwrap();
+        assert_eq!(allocation4.atlas_id.as_u32(), 1);
+    }
+
+    #[test]
+    fn test_auto_grow() {
+        let mut manager = MultiAtlasManager::new(AtlasConfig {
+            initial_atlas_count: 1,
+            max_atlases: 3,
+            atlas_size: (256, 256),
+            allocation_strategy: AllocationStrategy::FirstFit,
+            auto_grow: true,
+        });
+
+        let allocation0 = manager.try_allocate(256, 256).unwrap();
+        assert_eq!(allocation0.atlas_id.as_u32(), 0);
+
+        let allocation1 = manager.try_allocate(256, 256).unwrap();
+        assert_eq!(allocation1.atlas_id.as_u32(), 1);
+
+        let allocation2 = manager.try_allocate(256, 256).unwrap();
+        assert_eq!(allocation2.atlas_id.as_u32(), 2);
+    }
+
+    fn test_allocate_excluding_with_strategy(strategy: AllocationStrategy) {
+        let mut manager = MultiAtlasManager::new(AtlasConfig {
+            initial_atlas_count: 3,
+            max_atlases: 3,
+            atlas_size: (256, 256),
+            allocation_strategy: strategy,
+            auto_grow: false,
+        });
+
+        let allocation0 = manager.try_allocate(100, 100).unwrap();
+        let first_atlas = allocation0.atlas_id;
+        let allocation1 = manager
+            .try_allocate_excluding(256, 256, Some(first_atlas))
+            .unwrap();
+        assert_ne!(allocation1.atlas_id, first_atlas);
+
+        let second_atlas = allocation1.atlas_id;
+        let allocation2 = manager
+            .try_allocate_excluding(100, 100, Some(second_atlas))
+            .unwrap();
+        assert_ne!(allocation2.atlas_id, second_atlas);
+
+        let allocation3 = manager
+            .try_allocate_excluding(100, 100, Some(first_atlas))
+            .unwrap();
+        assert_ne!(allocation3.atlas_id, first_atlas);
+    }
+
+    #[test]
+    fn test_allocate_excluding_first_fit() {
+        test_allocate_excluding_with_strategy(AllocationStrategy::FirstFit);
+    }
+
+    #[test]
+    fn test_allocate_excluding_best_fit() {
+        test_allocate_excluding_with_strategy(AllocationStrategy::BestFit);
+    }
+
+    #[test]
+    fn test_allocate_excluding_least_used() {
+        test_allocate_excluding_with_strategy(AllocationStrategy::LeastUsed);
+    }
+
+    #[test]
+    fn test_allocate_excluding_round_robin() {
+        test_allocate_excluding_with_strategy(AllocationStrategy::RoundRobin);
+    }
+}
diff --git a/vendor/vello_common/src/paint.rs b/vendor/vello_common/src/paint.rs
new file mode 100644
index 000000000..b032bc31b
--- /dev/null
+++ b/vendor/vello_common/src/paint.rs
@@ -0,0 +1,276 @@
+// Copyright 2025 the Vello Authors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+//! Types for paints.
+
+use crate::pixmap::Pixmap;
+use alloc::sync::Arc;
+pub use peniko::Color;
+use peniko::{
+    Gradient,
+    color::{AlphaColor, PremulRgba8, Srgb},
+};
+
+/// A paint that needs to be resolved via its index.
+// In the future, we might add additional flags, that's why we have
+// this thin wrapper around u32, so we can change the underlying
+// representation without breaking the API.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct IndexedPaint(u32);
+
+impl IndexedPaint {
+    /// Create a new indexed paint from an index.
+    pub fn new(index: usize) -> Self {
+        Self(u32::try_from(index).expect("exceeded the maximum number of paints"))
+    }
+
+    /// Return the index of the paint.
+    pub fn index(&self) -> usize {
+        usize::try_from(self.0).unwrap()
+    }
+}
+
+/// A paint that is used internally by a rendering frontend to store how a wide tile command
+/// should be painted. There are only two types of paint:
+///
+/// 1) Simple solid colors, which are stored in premultiplied representation so that
+///    each wide tile doesn't have to recompute it.
+/// 2) Indexed paints, which can represent any arbitrary, more complex paint that is
+///    determined by the frontend. The intended way of using this is to store a vector
+///    of paints and store its index inside `IndexedPaint`.
+#[derive(Debug, Clone, PartialEq)]
+pub enum Paint {
+    /// A premultiplied RGBA8 color.
+    Solid(PremulColor),
+    /// A paint that needs to be resolved via an index.
+    Indexed(IndexedPaint),
+}
+
+impl From<AlphaColor<Srgb>> for Paint {
+    fn from(value: AlphaColor<Srgb>) -> Self {
+        Self::Solid(PremulColor::from_alpha_color(value))
+    }
+}
+
+/// Opaque image handle
+#[derive(Clone, Copy, Hash, PartialEq, Eq, Debug)]
+pub struct ImageId(u32);
+
+impl ImageId {
+    // TODO: make this private in future
+    /// Create a new image id from a u32.
+    pub fn new(value: u32) -> Self {
+        Self(value)
+    }
+
+    /// Return the image id as a u32.
+    pub fn as_u32(&self) -> u32 {
+        self.0
+    }
+}
+
+/// Bitmap source used by `Image`.
+#[derive(Debug, Clone)]
+pub enum ImageSource {
+    /// Pixmap pixels travel with the scene packet.
+    Pixmap(Arc<Pixmap>),
+    /// Pixmap pixels were registered earlier; this is just a handle.
+    OpaqueId {
+        /// The image handle.
+        id: ImageId,
+        /// Whether the image may contain non-opaque pixels.
+        may_have_transparency: bool,
+    },
+}
+
+impl ImageSource {
+    /// Create an [`ImageSource`] from a pre-registered image handle.
+    ///
+    /// Conservatively assumes the image may have non-opaque pixels.
+    /// Use [`Self::opaque_id_with_transparency_hint`] when you know the image is fully opaque.
+    pub fn opaque_id(id: ImageId) -> Self {
+        Self::OpaqueId {
+            id,
+            may_have_transparency: true,
+        }
+    }
+
+    /// Create an [`ImageSource`] from a pre-registered image handle,
+    /// with an explicit hint about whether the image may have non-opaque pixels.
+    pub fn opaque_id_with_transparency_hint(id: ImageId, may_have_transparency: bool) -> Self {
+        Self::OpaqueId {
+            id,
+            may_have_transparency,
+        }
+    }
+
+    /// Returns whether this image source may contain non-opaque pixels.
+    pub fn may_have_transparency(&self) -> bool {
+        match self {
+            Self::Pixmap(p) => p.may_have_transparency(),
+            Self::OpaqueId {
+                may_have_transparency,
+                ..
+            } => *may_have_transparency,
+        }
+    }
+
+    /// Convert a [`peniko::ImageData`] to an [`ImageSource`].
+    ///
+    /// This is a somewhat lossy conversion, as the image data data is transformed to
+    /// [premultiplied RGBA8](`PremulRgba8`).
+    ///
+    /// # Panics
+    ///
+    /// This panics if `image` has a `width` or `height` greater than `u16::MAX`.
+    pub fn from_peniko_image_data(image: &peniko::ImageData) -> Self {
+        // TODO: how do we deal with `peniko::ImageFormat` growing? See also
+        // <https://github.com/linebender/vello/pull/996#discussion_r2080510863>.
+        let do_alpha_multiply = image.alpha_type != peniko::ImageAlphaType::AlphaPremultiplied;
+
+        assert!(
+            image.width <= u16::MAX as u32 && image.height <= u16::MAX as u32,
+            "The image is too big. Its width and height can be no larger than {} pixels.",
+            u16::MAX,
+        );
+        let width = image.width.try_into().unwrap();
+        let height = image.height.try_into().unwrap();
+
+        // TODO: SIMD
+        #[expect(clippy::cast_possible_truncation, reason = "This cannot overflow.")]
+        let pixels = image
+            .data
+            .data()
+            .chunks_exact(4)
+            .map(|pixel| {
+                let rgba: [u8; 4] = match image.format {
+                    peniko::ImageFormat::Rgba8 => pixel.try_into().unwrap(),
+                    peniko::ImageFormat::Bgra8 => [pixel[2], pixel[1], pixel[0], pixel[3]],
+                    format => unimplemented!("Unsupported image format: {format:?}"),
+                };
+                let alpha = u16::from(rgba[3]);
+                let multiply = |component| ((alpha * u16::from(component)) / 255) as u8;
+                if do_alpha_multiply {
+                    PremulRgba8 {
+                        r: multiply(rgba[0]),
+                        g: multiply(rgba[1]),
+                        b: multiply(rgba[2]),
+                        a: rgba[3],
+                    }
+                } else {
+                    PremulRgba8 {
+                        r: rgba[0],
+                        g: rgba[1],
+                        b: rgba[2],
+                        a: rgba[3],
+                    }
+                }
+            })
+            .collect();
+        let pixmap = Pixmap::from_parts(pixels, width, height);
+
+        Self::Pixmap(Arc::new(pixmap))
+    }
+}
+
+/// An image.
+pub type Image = peniko::ImageBrush<ImageSource>;
+
+/// Trait for resolving opaque image IDs to pixmaps at rasterization time.
+///
+/// This allows delaying the resolution of `ImageSource::OpaqueId` until the
+/// image is actually needed during rasterization, enabling patterns like
+/// dynamic sprite atlases where the image data may be updated between
+/// encoding and rendering.
+pub trait ImageResolver: Send + Sync {
+    /// Resolve an `ImageId` to its pixmap data.
+    ///
+    /// This method may be called repeatedly (dozens or even hundreds of times
+    /// per frame) and should therefore be very fast.
+    ///
+    /// Returns `None` if the image ID is not found in the registry.
+    fn resolve(&self, id: ImageId) -> Option<Arc<Pixmap>>;
+}
+
+/// A no-op image resolver that always returns `None`.
+#[derive(Debug, Clone, Copy, Default)]
+pub struct NoOpImageResolver;
+
+impl ImageResolver for NoOpImageResolver {
+    fn resolve(&self, _id: ImageId) -> Option<Arc<Pixmap>> {
+        None
+    }
+}
+
+/// A premultiplied color.
+#[derive(Debug, Clone, PartialEq, Copy)]
+pub struct PremulColor {
+    premul_u8: PremulRgba8,
+    premul_f32: peniko::color::PremulColor<Srgb>,
+}
+
+impl PremulColor {
+    /// Create a new premultiplied color.
+    pub fn from_alpha_color(color: AlphaColor<Srgb>) -> Self {
+        Self::from_premul_color(color.premultiply())
+    }
+
+    /// Create a new premultiplied color from `peniko::PremulColor`.
+    pub fn from_premul_color(color: peniko::color::PremulColor<Srgb>) -> Self {
+        Self {
+            premul_u8: color.to_rgba8(),
+            premul_f32: color,
+        }
+    }
+
+    /// Return the color as a premultiplied RGBA8 color.
+    pub fn as_premul_rgba8(&self) -> PremulRgba8 {
+        self.premul_u8
+    }
+
+    /// Return the color as a premultiplied RGBAF32 color.
+    pub fn as_premul_f32(&self) -> peniko::color::PremulColor<Srgb> {
+        self.premul_f32
+    }
+
+    /// Return whether the color is opaque (i.e. doesn't have transparency).
+    pub fn is_opaque(&self) -> bool {
+        self.premul_f32.components[3] == 1.0
+    }
+}
+
+/// How tint color is applied to an image.
+#[derive(Copy, Clone, Debug, PartialEq, Eq)]
+#[repr(u8)]
+pub enum TintMode {
+    /// Alpha-mask tinting: `tint_premul * source.alpha`.
+    ///
+    /// The source image's alpha channel is used as a coverage mask,
+    /// and the result is filled with the premultiplied tint color.
+    /// This is the standard approach for glyph / monochrome image tinting.
+    AlphaMask = 0,
+    /// Component-wise multiply: `source * tint`.
+    ///
+    /// Each channel of the source pixel is multiplied by the corresponding
+    /// channel of the tint color. This works well for full-color images.
+    Multiply = 1,
+}
+
+impl TintMode {
+    /// Return the discriminant as a `u32`.
+    pub fn as_u32(self) -> u32 {
+        self as u32
+    }
+}
+
+/// A tint applied to image paints.
+#[derive(Copy, Clone, Debug, PartialEq)]
+pub struct Tint {
+    /// The tint color.
+    pub color: Color,
+    /// How the tint is applied.
+    pub mode: TintMode,
+}
+
+/// A kind of paint that can be used for filling and stroking shapes.
+pub type PaintType = peniko::Brush<Image, Gradient>;
diff --git a/vendor/vello_common/src/pico_svg.rs b/vendor/vello_common/src/pico_svg.rs
new file mode 100644
index 000000000..c9f3fdc31
--- /dev/null
+++ b/vendor/vello_common/src/pico_svg.rs
@@ -0,0 +1,356 @@
+// Copyright 2024 the Vello Authors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+// Below is copied, lightly adapted, from Vello.
+
+//! A minimal SVG parser for rendering examples
+//!
+//! This module provides a simple SVG parser to load and render SVG files
+//! for demonstration purposes. It supports basic SVG features like paths,
+//! fill, stroke, and grouping.
+
+#![expect(
+    clippy::print_stderr,
+    reason = "We don't have a better way to handle these errors, plus this code is not public API"
+)]
+
+extern crate std;
+
+use crate::color::{AlphaColor, DynamicColor, Srgb, palette};
+use crate::kurbo::{Affine, BezPath, Point, Size, Vec2};
+use alloc::boxed::Box;
+use alloc::vec;
+use alloc::vec::Vec;
+use core::str::FromStr;
+use roxmltree::{Document, Node};
+use std::eprintln;
+
+/// A simplified representation of an SVG document
+#[derive(Debug)]
+pub struct PicoSvg {
+    /// The items (shapes, groups) contained in the SVG
+    pub items: Vec<Item>,
+    /// The size of the SVG document
+    pub size: Size,
+}
+
+/// Represents a single item in an SVG document
+#[derive(Debug)]
+pub enum Item {
+    /// A filled shape
+    Fill(FillItem),
+    /// A stroked shape
+    Stroke(StrokeItem),
+    /// A group of items
+    Group(GroupItem),
+}
+
+/// A stroke item with styling information
+#[derive(Debug)]
+pub struct StrokeItem {
+    /// The width of the stroke
+    pub width: f64,
+    /// The color of the stroke
+    pub color: AlphaColor<Srgb>,
+    /// The path to be stroked
+    pub path: BezPath,
+}
+
+/// A fill item with styling information
+#[derive(Debug)]
+pub struct FillItem {
+    /// The color to fill with
+    pub color: AlphaColor<Srgb>,
+    /// The path to be filled
+    pub path: BezPath,
+}
+
+/// A group of items that can be transformed together
+#[derive(Debug)]
+pub struct GroupItem {
+    /// The affine transformation to apply to all children
+    pub affine: Affine,
+    /// The child items in this group
+    pub children: Vec<Item>,
+}
+
+struct Parser {
+    scale: f64,
+}
+
+impl PicoSvg {
+    /// Load an SVG document from a string
+    pub fn load(xml_string: &str, scale: f64) -> Result<Self, Box<dyn core::error::Error>> {
+        let doc = Document::parse(xml_string)?;
+        let root = doc.root_element();
+        let mut parser = Parser::new(scale);
+        let root_width = root.attribute("width").and_then(|s| f64::from_str(s).ok());
+        let root_height = root.attribute("height").and_then(|s| f64::from_str(s).ok());
+        let (origin, viewbox_size) = root
+            .attribute("viewBox")
+            .and_then(|vb_attr| {
+                let vs: Vec<f64> = vb_attr
+                    .split(' ')
+                    .map(|s| f64::from_str(s).unwrap())
+                    .collect();
+                if let &[x, y, width, height] = vs.as_slice() {
+                    Some((Point { x, y }, Size { width, height }))
+                } else {
+                    None
+                }
+            })
+            .unzip();
+
+        let mut transform = if let Some(origin) = origin {
+            Affine::translate(origin.to_vec2() * -1.0)
+        } else {
+            Affine::IDENTITY
+        };
+
+        transform *= match (root_width, root_height, viewbox_size) {
+            (None, None, Some(_)) => Affine::IDENTITY,
+            (Some(w), Some(h), Some(s)) => {
+                Affine::scale_non_uniform(1.0 / s.width * w, 1.0 / s.height * h)
+            }
+            (Some(w), None, Some(s)) => Affine::scale(1.0 / s.width * w),
+            (None, Some(h), Some(s)) => Affine::scale(1.0 / s.height * h),
+            _ => Affine::IDENTITY,
+        };
+
+        let size = match (root_width, root_height, viewbox_size) {
+            (None, None, Some(s)) => s,
+            (mw, mh, None) => Size {
+                width: mw.unwrap_or(300_f64),
+                height: mh.unwrap_or(150_f64),
+            },
+            (Some(w), None, Some(s)) => Size {
+                width: w,
+                height: 1.0 / w * s.width * s.height,
+            },
+            (None, Some(h), Some(s)) => Size {
+                width: 1.0 / h * s.height * s.width,
+                height: h,
+            },
+            (Some(width), Some(height), Some(_)) => Size { width, height },
+        };
+
+        transform *= if scale >= 0.0 {
+            Affine::scale(scale)
+        } else {
+            Affine::new([-scale, 0.0, 0.0, scale, 0.0, 0.0])
+        };
+        let props = RecursiveProperties {
+            fill: Some(palette::css::BLACK),
+        };
+        // The root element is the svg document element, which we don't care about
+        let mut items = Vec::new();
+        for node in root.children() {
+            parser.rec_parse(node, &props, &mut items)?;
+        }
+        let root_group = Item::Group(GroupItem {
+            affine: transform,
+            children: items,
+        });
+        Ok(Self {
+            items: vec![root_group],
+            size,
+        })
+    }
+}
+
+#[derive(Clone)]
+struct RecursiveProperties {
+    fill: Option<AlphaColor<Srgb>>,
+}
+
+impl Parser {
+    fn new(scale: f64) -> Self {
+        Self { scale }
+    }
+
+    fn rec_parse(
+        &mut self,
+        node: Node<'_, '_>,
+        properties: &RecursiveProperties,
+        items: &mut Vec<Item>,
+    ) -> Result<(), Box<dyn core::error::Error>> {
+        if node.is_element() {
+            let mut properties = properties.clone();
+            if let Some(fill_color) = node.attribute("fill") {
+                if fill_color == "none" {
+                    properties.fill = None;
+                } else {
+                    let color = parse_color(fill_color);
+                    let color = modify_opacity(color, "fill-opacity", node);
+                    // TODO: Handle recursive opacity properly
+                    let color = modify_opacity(color, "opacity", node);
+                    properties.fill = Some(color);
+                }
+            }
+            match node.tag_name().name() {
+                "g" => {
+                    let mut children = Vec::new();
+                    let mut affine = Affine::default();
+                    if let Some(transform) = node.attribute("transform") {
+                        affine = parse_transform(transform);
+                    }
+                    for child in node.children() {
+                        self.rec_parse(child, &properties, &mut children)?;
+                    }
+                    items.push(Item::Group(GroupItem { affine, children }));
+                }
+                "path" => {
+                    let d = node.attribute("d").ok_or("missing 'd' attribute")?;
+                    let bp = BezPath::from_svg(d)?;
+                    let path = bp;
+                    if let Some(color) = properties.fill {
+                        items.push(Item::Fill(FillItem {
+                            color,
+                            path: path.clone(),
+                        }));
+                    }
+                    if let Some(stroke_color) = node.attribute("stroke")
+                        && stroke_color != "none"
+                    {
+                        let width = node
+                            .attribute("stroke-width")
+                            .map(|a| f64::from_str(a).unwrap_or(1.0))
+                            .unwrap_or(1.0)
+                            * self.scale.abs();
+                        let color = parse_color(stroke_color);
+                        let color = modify_opacity(color, "stroke-opacity", node);
+                        // TODO: Handle recursive opacity properly
+                        let color = modify_opacity(color, "opacity", node);
+                        items.push(Item::Stroke(StrokeItem { width, color, path }));
+                    }
+                }
+                other => eprintln!("Unhandled node type {other}"),
+            }
+        }
+        Ok(())
+    }
+}
+
+fn parse_transform(transform: &str) -> Affine {
+    let mut nt = Affine::IDENTITY;
+    for ts in transform.split(')').map(str::trim) {
+        nt *= if let Some(s) = ts.strip_prefix("matrix(") {
+            let vals = s
+                .split([',', ' '])
+                .map(str::parse)
+                .collect::<Result<Vec<f64>, _>>()
+                .expect("Could parse all values of 'matrix' as floats");
+            Affine::new(
+                vals.try_into()
+                    .expect("Should be six arguments to `matrix`"),
+            )
+        } else if let Some(s) = ts.strip_prefix("translate(") {
+            if let Ok(vals) = s
+                .split([',', ' '])
+                .map(str::trim)
+                .map(str::parse)
+                .collect::<Result<Vec<f64>, _>>()
+            {
+                match vals.as_slice() {
+                    &[x, y] => Affine::translate(Vec2 { x, y }),
+                    _ => Affine::IDENTITY,
+                }
+            } else {
+                Affine::IDENTITY
+            }
+        } else if let Some(s) = ts.strip_prefix("scale(") {
+            if let Ok(vals) = s
+                .split([',', ' '])
+                .map(str::trim)
+                .map(str::parse)
+                .collect::<Result<Vec<f64>, _>>()
+            {
+                match *vals.as_slice() {
+                    [x, y] => Affine::scale_non_uniform(x, y),
+                    [x] => Affine::scale(x),
+                    _ => Affine::IDENTITY,
+                }
+            } else {
+                Affine::IDENTITY
+            }
+        } else if let Some(s) = ts.strip_prefix("scaleX(") {
+            s.trim()
+                .parse()
+                .ok()
+                .map(|x| Affine::scale_non_uniform(x, 1.0))
+                .unwrap_or(Affine::IDENTITY)
+        } else if let Some(s) = ts.strip_prefix("scaleY(") {
+            s.trim()
+                .parse()
+                .ok()
+                .map(|y| Affine::scale_non_uniform(1.0, y))
+                .unwrap_or(Affine::IDENTITY)
+        } else {
+            if !ts.is_empty() {
+                eprintln!("Did not understand transform attribute {ts:?})");
+            }
+            Affine::IDENTITY
+        };
+    }
+    nt
+}
+
+fn parse_color(color: &str) -> AlphaColor<Srgb> {
+    let color = color.trim();
+    crate::color::parse_color(color.trim())
+        .map(DynamicColor::to_alpha_color)
+        .unwrap_or(palette::css::FUCHSIA.with_alpha(0.5))
+}
+
+fn modify_opacity(
+    color: AlphaColor<Srgb>,
+    attr_name: &str,
+    node: Node<'_, '_>,
+) -> AlphaColor<Srgb> {
+    if let Some(opacity) = node.attribute(attr_name) {
+        let alpha: f32 = if let Some(o) = opacity.strip_suffix('%') {
+            let pctg = o.parse().unwrap_or(100.0);
+            pctg * 0.01
+        } else {
+            opacity.parse().unwrap_or(1.0)
+        };
+        color.with_alpha(alpha.clamp(0., 1.))
+    } else {
+        color
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::parse_color;
+    use crate::color::{AlphaColor, Srgb, palette};
+
+    fn assert_close_color(c1: AlphaColor<Srgb>, c2: AlphaColor<Srgb>) {
+        const EPSILON: f32 = 1e-4;
+        assert_eq!(c1.cs, c2.cs);
+        for i in 0..4 {
+            assert!((c1.components[i] - c2.components[i]).abs() < EPSILON);
+        }
+    }
+
+    #[test]
+    fn parse_colors() {
+        let lime = palette::css::LIME;
+        let lime_a = lime.with_alpha(0.4);
+
+        let named = parse_color("lime");
+        assert_close_color(lime, named);
+
+        let hex = parse_color("#00ff00");
+        assert_close_color(lime, hex);
+
+        let rgb = parse_color("rgb(0, 255, 0)");
+        assert_close_color(lime, rgb);
+
+        let modern = parse_color("color(srgb 0 1 0)");
+        assert_close_color(lime, modern);
+
+        let modern_a = parse_color("color(srgb 0 1 0 / 0.4)");
+        assert_close_color(lime_a, modern_a);
+    }
+}
diff --git a/vendor/vello_common/src/pixmap.rs b/vendor/vello_common/src/pixmap.rs
new file mode 100644
index 000000000..83055dd51
--- /dev/null
+++ b/vendor/vello_common/src/pixmap.rs
@@ -0,0 +1,378 @@
+// Copyright 2025 the Vello Authors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+//! A simple pixmap type.
+
+use alloc::vec;
+use alloc::vec::Vec;
+#[cfg(feature = "png")]
+use std::io::{BufRead, Seek};
+
+use crate::peniko::color::{PremulRgba8, Rgba8};
+
+#[cfg(feature = "png")]
+extern crate std;
+
+/// A pixmap of premultiplied RGBA8 values backed by [`u8`][core::u8].
+#[derive(Debug, Clone)]
+pub struct Pixmap {
+    /// Width of the pixmap in pixels.  
+    width: u16,
+    /// Height of the pixmap in pixels.
+    height: u16,
+    /// Buffer of the pixmap in RGBA8 format.
+    buf: Vec<PremulRgba8>,
+    /// Whether the pixmap may have non-opaque pixels.
+    ///
+    /// Note: This may become stale if pixels are modified via [`data_mut()`](Self::data_mut),
+    /// [`data_as_u8_slice_mut()`](Self::data_as_u8_slice_mut), or [`set_pixel()`](Self::set_pixel).
+    may_have_transparency: bool,
+}
+
+impl Pixmap {
+    /// Create a new pixmap with the given width and height in pixels.
+    ///
+    /// All pixels are initialized to transparent black.
+    pub fn new(width: u16, height: u16) -> Self {
+        let buf = vec![PremulRgba8::from_u32(0); width as usize * height as usize];
+        Self {
+            width,
+            height,
+            buf,
+            may_have_transparency: true,
+        }
+    }
+
+    /// Create a new pixmap with the given premultiplied RGBA8 data.
+    ///
+    /// The `data` vector must be of length `width * height` exactly.
+    ///
+    /// The pixels are in row-major order.
+    ///
+    /// This assumes the image may have transparent pixels. Use
+    /// [`from_parts_with_opacity`](Self::from_parts_with_opacity) if you already
+    /// know the opacity status to enable optimizations.
+    ///
+    /// # Panics
+    ///
+    /// Panics if the `data` vector is not of length `width * height`.
+    pub fn from_parts(data: Vec<PremulRgba8>, width: u16, height: u16) -> Self {
+        Self::from_parts_with_opacity(data, width, height, true)
+    }
+
+    /// Create a new pixmap with the given premultiplied RGBA8 data and precomputed opacity flag.
+    ///
+    /// The `data` vector must be of length `width * height` exactly.
+    ///
+    /// The pixels are in row-major order.
+    ///
+    /// Use this when you've already determined whether the data contains
+    /// non-opaque pixels to avoid redundant scanning.
+    ///
+    /// # Panics
+    ///
+    /// Panics if the `data` vector is not of length `width * height`.
+    pub fn from_parts_with_opacity(
+        data: Vec<PremulRgba8>,
+        width: u16,
+        height: u16,
+        may_have_transparency: bool,
+    ) -> Self {
+        assert_eq!(
+            data.len(),
+            usize::from(width) * usize::from(height),
+            "Expected `data` to have length of exactly `width * height`"
+        );
+        Self {
+            width,
+            height,
+            buf: data,
+            may_have_transparency,
+        }
+    }
+
+    /// Resizes the pixmap container to the given width and height; this does not resize the
+    /// contained image.
+    ///
+    /// If the pixmap buffer has to grow to fit the new size, those pixels are set to transparent
+    /// black. If the pixmap buffer is larger than required, the buffer is truncated and its
+    /// reserved capacity is unchanged.
+    pub fn resize(&mut self, width: u16, height: u16) {
+        let new_len = usize::from(width) * usize::from(height);
+        // If we're growing, new pixels are transparent black
+        if new_len > self.buf.len() {
+            self.may_have_transparency = true;
+        }
+        self.width = width;
+        self.height = height;
+        self.buf.resize(new_len, PremulRgba8::from_u32(0));
+    }
+
+    /// Shrink the capacity of the pixmap buffer to fit the pixmap's current size.
+    pub fn shrink_to_fit(&mut self) {
+        self.buf.shrink_to_fit();
+    }
+
+    /// The reserved capacity (in pixels) of this pixmap.
+    ///
+    /// When calling [`Pixmap::resize`] with a `width * height` smaller than this value, the pixmap
+    /// does not need to reallocate.
+    pub fn capacity(&self) -> usize {
+        self.buf.capacity()
+    }
+
+    /// Return the width of the pixmap.
+    pub fn width(&self) -> u16 {
+        self.width
+    }
+
+    /// Return the height of the pixmap.
+    pub fn height(&self) -> u16 {
+        self.height
+    }
+
+    /// Returns whether the pixmap may have non-opaque pixels.
+    ///
+    /// This value is computed at construction time. It may become stale if pixels are
+    /// modified directly via [`data_mut()`](Self::data_mut),
+    /// [`data_as_u8_slice_mut()`](Self::data_as_u8_slice_mut), or [`set_pixel()`](Self::set_pixel).
+    ///
+    /// Use [`set_may_have_transparency()`](Self::set_may_have_transparency) to manually update the flag,
+    /// or [`recompute_may_have_transparency()`](Self::recompute_may_have_transparency) to recalculate it
+    /// by scanning all pixels.
+    pub fn may_have_transparency(&self) -> bool {
+        self.may_have_transparency
+    }
+
+    /// Manually set the `may_have_transparency` flag.
+    ///
+    /// Use this after modifying pixels via [`data_mut()`](Self::data_mut) or
+    /// [`set_pixel()`](Self::set_pixel) when you know whether the image has
+    /// non-opaque pixels.
+    pub fn set_may_have_transparency(&mut self, may_have_transparency: bool) {
+        self.may_have_transparency = may_have_transparency;
+    }
+
+    /// Recalculate `may_have_transparency` by scanning all pixels.
+    ///
+    /// Use this after modifying pixels via [`data_mut()`](Self::data_mut) or
+    /// [`set_pixel()`](Self::set_pixel) when you need accurate opacity information.
+    pub fn recompute_may_have_transparency(&mut self) {
+        self.may_have_transparency = self.buf.iter().any(|pixel| pixel.a != 255);
+    }
+
+    /// Apply an alpha value to the whole pixmap.
+    pub fn multiply_alpha(&mut self, alpha: u8) {
+        #[expect(
+            clippy::cast_possible_truncation,
+            reason = "cannot overflow in this case"
+        )]
+        let multiply = |component| ((u16::from(alpha) * u16::from(component)) / 255) as u8;
+
+        for pixel in self.data_mut() {
+            *pixel = PremulRgba8 {
+                r: multiply(pixel.r),
+                g: multiply(pixel.g),
+                b: multiply(pixel.b),
+                a: multiply(pixel.a),
+            };
+        }
+
+        // If we applied a non-opaque alpha, the image now has transparency
+        if alpha != 255 {
+            self.may_have_transparency = true;
+        }
+    }
+
+    /// Create a pixmap from a PNG file.
+    #[cfg(feature = "png")]
+    pub fn from_png(data: impl BufRead + Seek) -> Result<Self, png::DecodingError> {
+        let mut decoder = png::Decoder::new(data);
+        decoder.set_transformations(
+            png::Transformations::normalize_to_color8() | png::Transformations::ALPHA,
+        );
+
+        let mut reader = decoder.read_info()?;
+        let mut pixmap = {
+            let info = reader.info();
+            let width: u16 = info
+                .width
+                .try_into()
+                .map_err(|_| png::DecodingError::LimitsExceeded)?;
+            let height: u16 = info
+                .height
+                .try_into()
+                .map_err(|_| png::DecodingError::LimitsExceeded)?;
+            Self::new(width, height)
+        };
+
+        // Note `reader.info()` returns the pre-transformation color type output, whereas
+        // `reader.output_color_type()` takes the transformation into account.
+        let (color_type, bit_depth) = reader.output_color_type();
+        debug_assert_eq!(
+            bit_depth,
+            png::BitDepth::Eight,
+            "normalize_to_color8 means the bit depth is always 8."
+        );
+
+        match color_type {
+            png::ColorType::Rgb | png::ColorType::Grayscale => {
+                unreachable!("We set a transformation to always convert to alpha")
+            }
+            png::ColorType::Indexed => {
+                unreachable!("Transformation should have expanded indexed images")
+            }
+            png::ColorType::Rgba => {
+                debug_assert_eq!(
+                    Some(pixmap.data_as_u8_slice().len()),
+                    reader.output_buffer_size(),
+                    "The pixmap buffer should have the same number of bytes as the image."
+                );
+                reader.next_frame(pixmap.data_as_u8_slice_mut())?;
+            }
+            png::ColorType::GrayscaleAlpha => {
+                debug_assert_eq!(
+                    Some(pixmap.data().len() * 2),
+                    reader.output_buffer_size(),
+                    "The pixmap buffer should have twice the number of bytes of the grayscale image."
+                );
+                let mut grayscale_data = vec![0; reader.output_buffer_size().unwrap_or_default()];
+                reader.next_frame(&mut grayscale_data)?;
+
+                for (grayscale_pixel, pixmap_pixel) in
+                    grayscale_data.chunks_exact(2).zip(pixmap.data_mut())
+                {
+                    let [gray, alpha] = grayscale_pixel.try_into().unwrap();
+                    *pixmap_pixel = PremulRgba8 {
+                        r: gray,
+                        g: gray,
+                        b: gray,
+                        a: alpha,
+                    };
+                }
+            }
+        };
+
+        let mut may_have_transparency = false;
+        for pixel in pixmap.data_mut() {
+            let alpha = pixel.a;
+            if alpha != 255 {
+                may_have_transparency = true;
+            }
+            let alpha_u16 = u16::from(alpha);
+            #[expect(
+                clippy::cast_possible_truncation,
+                reason = "Overflow should be impossible."
+            )]
+            let premultiply = |e: u8| ((u16::from(e) * alpha_u16) / 255) as u8;
+            pixel.r = premultiply(pixel.r);
+            pixel.g = premultiply(pixel.g);
+            pixel.b = premultiply(pixel.b);
+        }
+        pixmap.may_have_transparency = may_have_transparency;
+
+        Ok(pixmap)
+    }
+
+    /// Return the current content of the pixmap as a PNG.
+    #[cfg(feature = "png")]
+    pub fn into_png(self) -> Result<Vec<u8>, png::EncodingError> {
+        let mut data = Vec::new();
+        let mut encoder = png::Encoder::new(&mut data, self.width as u32, self.height as u32);
+        encoder.set_color(png::ColorType::Rgba);
+        encoder.set_depth(png::BitDepth::Eight);
+        let mut writer = encoder.write_header()?;
+        writer.write_image_data(bytemuck::cast_slice(&self.take_unpremultiplied()))?;
+        writer.finish().map(|_| data)
+    }
+
+    /// Returns a reference to the underlying data as premultiplied RGBA8.
+    ///
+    /// The pixels are in row-major order.
+    pub fn data(&self) -> &[PremulRgba8] {
+        &self.buf
+    }
+
+    /// Returns a mutable reference to the underlying data as premultiplied RGBA8.
+    ///
+    /// The pixels are in row-major order.
+    pub fn data_mut(&mut self) -> &mut [PremulRgba8] {
+        &mut self.buf
+    }
+
+    /// Returns a reference to the underlying data as premultiplied RGBA8.
+    ///
+    /// The pixels are in row-major order. Each pixel consists of four bytes in the order
+    /// `[r, g, b, a]`.
+    pub fn data_as_u8_slice(&self) -> &[u8] {
+        bytemuck::cast_slice(&self.buf)
+    }
+
+    /// Returns a mutable reference to the underlying data as premultiplied RGBA8.
+    ///
+    /// The pixels are in row-major order. Each pixel consists of four bytes in the order
+    /// `[r, g, b, a]`.
+    pub fn data_as_u8_slice_mut(&mut self) -> &mut [u8] {
+        bytemuck::cast_slice_mut(&mut self.buf)
+    }
+
+    /// Sample a pixel from the pixmap.
+    ///
+    /// The pixel data is [premultiplied RGBA8][PremulRgba8].
+    #[inline(always)]
+    pub fn sample(&self, x: u16, y: u16) -> PremulRgba8 {
+        let idx = self.width as usize * y as usize + x as usize;
+        self.buf[idx]
+    }
+
+    /// Sample a pixel from a custom-calculated index. This index should be calculated assuming that
+    /// the data is stored in row-major order.
+    #[inline(always)]
+    pub fn sample_idx(&self, idx: u32) -> PremulRgba8 {
+        self.buf[idx as usize]
+    }
+
+    /// Set a pixel in the pixmap at the given coordinates.
+    ///
+    /// The pixel data should be [premultiplied RGBA8][PremulRgba8]. The coordinate system has
+    /// its origin at the top-left corner, with `x` increasing to the right and `y` increasing
+    /// downward.
+    #[inline(always)]
+    pub fn set_pixel(&mut self, x: u16, y: u16, pixel: PremulRgba8) {
+        let idx = self.width as usize * y as usize + x as usize;
+        self.buf[idx] = pixel;
+    }
+
+    /// Consume the pixmap, returning the data as the underlying [`Vec`] of premultiplied RGBA8.
+    ///
+    /// The pixels are in row-major order.
+    pub fn take(self) -> Vec<PremulRgba8> {
+        self.buf
+    }
+
+    /// Consume the pixmap, returning the data as (unpremultiplied) RGBA8.
+    ///
+    /// Not fast, but useful for saving to PNG etc.
+    ///
+    /// The pixels are in row-major order.
+    pub fn take_unpremultiplied(self) -> Vec<Rgba8> {
+        self.buf
+            .into_iter()
+            .map(|PremulRgba8 { r, g, b, a }| {
+                let alpha = 255.0 / f32::from(a);
+                if a != 0 {
+                    #[expect(clippy::cast_possible_truncation, reason = "deliberate quantization")]
+                    let unpremultiply = |component| (f32::from(component) * alpha + 0.5) as u8;
+                    Rgba8 {
+                        r: unpremultiply(r),
+                        g: unpremultiply(g),
+                        b: unpremultiply(b),
+                        a,
+                    }
+                } else {
+                    Rgba8 { r, g, b, a }
+                }
+            })
+            .collect()
+    }
+}
diff --git a/vendor/vello_common/src/probe.rs b/vendor/vello_common/src/probe.rs
new file mode 100644
index 000000000..5e48f1243
--- /dev/null
+++ b/vendor/vello_common/src/probe.rs
@@ -0,0 +1,419 @@
+// Copyright 2026 the Vello Authors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+//! Helpers for performing probing to verify the basic capabilities of the device we are
+//! running on.
+
+use crate::color::{AlphaColor, palette::css};
+use crate::filter_effects::{EdgeMode, Filter, FilterPrimitive};
+use crate::kurbo::{Affine, BezPath, Circle, Point, Rect, Shape};
+use crate::paint::{Image, ImageSource, PaintType};
+use crate::peniko::{
+    BlendMode, ColorStop, ColorStops, Compose, Extend, Gradient, ImageQuality, ImageSampler,
+    LinearGradientPosition, Mix,
+};
+use crate::pixmap::Pixmap;
+use alloc::vec::Vec;
+
+const REFERENCE_RGBA: &[u8] = include_bytes!("../assets/probe.rgba");
+
+const ELEMENTS_PER_ROW: usize = 3;
+const ELEMENT_MARGIN: f64 = 1.0;
+
+const RECT_SIZE: f64 = 10.0;
+const CIRCLE_RADIUS: f64 = 5.0;
+const CIRCLE_CENTER_OFFSET_X: f64 = 1.5;
+const IMAGE_SOURCE_SIZE: f64 = 5.0;
+const PATH_TOLERANCE: f64 = 0.1;
+
+const ELEMENTS: [ProbeElement; 9] = [
+    ProbeElement::SolidRect,
+    ProbeElement::AlphaBlending,
+    ProbeElement::Gradient,
+    ProbeElement::ImageNearest,
+    ProbeElement::Filter,
+    ProbeElement::ImageBilinear,
+    ProbeElement::OpacityLayer,
+    ProbeElement::Blending,
+    ProbeElement::Transformed,
+];
+/// Per-channel absolute tolerance used when comparing probe pixels.
+const CHANNEL_TOLERANCE: u8 = 3;
+
+/// Result of running the renderer probe.
+#[derive(Debug, Clone)]
+pub enum Probe<E> {
+    /// The probe matched the bundled reference image.
+    Success,
+    /// The probe did not match the bundled reference image.
+    Error(ProbeResult),
+    /// Rendering the probe scene produces an error.
+    RenderError(E),
+}
+
+/// Probe failure output.
+#[derive(Debug, Clone)]
+pub struct ProbeResult {
+    /// The expected probe image.
+    pub expected: ProbeImage,
+    /// The actual probe image.
+    pub actual: ProbeImage,
+}
+
+/// A probe image stored as RGBA8 bytes.
+#[derive(Debug, Clone)]
+pub struct ProbeImage {
+    /// Width of the image in pixels.
+    pub width: u16,
+    /// Height of the image in pixels.
+    pub height: u16,
+    /// The image data as RGBA8 bytes.
+    pub data: Vec<u8>,
+}
+
+impl<E> Probe<E> {
+    /// Returns `true` when the probe matched the bundled reference image.
+    pub fn is_success(&self) -> bool {
+        matches!(self, Self::Success)
+    }
+
+    /// Construct a new probe result by inspecting the provided pixmap and comparing it
+    /// against the reference output.
+    pub fn from_actual(actual: Pixmap) -> Self {
+        let (width, height) = canvas_size();
+        let expected = ProbeImage {
+            width,
+            height,
+            data: REFERENCE_RGBA.to_vec(),
+        };
+        let actual = ProbeImage::from_pixmap(actual);
+        let matches_reference = expected.width == actual.width
+            && expected.height == actual.height
+            && expected.data.len() == actual.data.len()
+            && expected
+                .data
+                .chunks_exact(4)
+                .zip(actual.data.chunks_exact(4))
+                .all(|(expected, actual)| {
+                    pixels_within_tolerance(expected, actual, CHANNEL_TOLERANCE)
+                });
+
+        if matches_reference {
+            Self::Success
+        } else {
+            Self::Error(ProbeResult { expected, actual })
+        }
+    }
+}
+
+impl ProbeImage {
+    fn from_pixmap(pixmap: Pixmap) -> Self {
+        Self {
+            width: pixmap.width(),
+            height: pixmap.height(),
+            data: bytemuck::cast_slice(&pixmap.take_unpremultiplied()).to_vec(),
+        }
+    }
+}
+
+/// API necessary to draw the probe scene.
+pub trait ProbeRenderer {
+    fn set_transform(&mut self, transform: Affine);
+    fn set_paint(&mut self, paint: PaintType);
+    fn fill_path(&mut self, path: &BezPath);
+    fn fill_rect(&mut self, rect: &Rect);
+    fn push_layer(&mut self, blend_mode: Option<BlendMode>, opacity: Option<f32>);
+    fn push_filter_layer(&mut self, filter: Filter);
+    fn pop_layer(&mut self);
+    fn set_paint_transform(&mut self, paint_transform: Affine);
+    fn reset_paint_transform(&mut self);
+}
+
+#[derive(Clone, Copy, Debug)]
+enum ProbeElement {
+    SolidRect,
+    Transformed,
+    AlphaBlending,
+    Gradient,
+    ImageNearest,
+    Filter,
+    ImageBilinear,
+    OpacityLayer,
+    Blending,
+}
+
+#[derive(Clone, Copy, Debug)]
+struct GridLayout {
+    columns: usize,
+    rows: usize,
+    cell_width: f64,
+    cell_height: f64,
+}
+
+impl GridLayout {
+    fn from_elements(elements: &[ProbeElement]) -> Self {
+        let columns = ELEMENTS_PER_ROW.min(elements.len());
+        let rows = elements.len().div_ceil(columns);
+        let (cell_width, cell_height) = elements
+            .iter()
+            .copied()
+            .map(ProbeElement::bounds)
+            .fold((0.0_f64, 0.0_f64), |(max_w, max_h), (w, h)| {
+                (max_w.max(w), max_h.max(h))
+            });
+
+        Self {
+            columns,
+            rows,
+            cell_width,
+            cell_height,
+        }
+    }
+
+    fn canvas_size(self) -> (u16, u16) {
+        let width = self.columns as f64 * self.cell_width
+            + self.columns.saturating_sub(1) as f64 * ELEMENT_MARGIN;
+        let height = self.rows as f64 * self.cell_height
+            + self.rows.saturating_sub(1) as f64 * ELEMENT_MARGIN;
+        (width.ceil() as u16, height.ceil() as u16)
+    }
+
+    fn canvas_rect(self) -> Rect {
+        let (width, height) = self.canvas_size();
+        Rect::new(0.0, 0.0, f64::from(width), f64::from(height))
+    }
+
+    fn cell_rect(self, index: usize) -> Rect {
+        let column = index % self.columns;
+        let row = index / self.columns;
+        let x0 = column as f64 * (self.cell_width + ELEMENT_MARGIN);
+        let y0 = row as f64 * (self.cell_height + ELEMENT_MARGIN);
+        Rect::new(x0, y0, x0 + self.cell_width, y0 + self.cell_height)
+    }
+}
+
+impl ProbeElement {
+    fn bounds(self) -> (f64, f64) {
+        let (width, height) = match self {
+            Self::SolidRect
+            | Self::Gradient
+            | Self::ImageNearest
+            | Self::ImageBilinear
+            | Self::Filter
+            | Self::OpacityLayer => (RECT_SIZE, RECT_SIZE),
+            Self::Transformed => (
+                RECT_SIZE * core::f64::consts::SQRT_2,
+                RECT_SIZE * core::f64::consts::SQRT_2,
+            ),
+            Self::AlphaBlending | Self::Blending => (
+                CIRCLE_RADIUS * 2.0 + CIRCLE_CENTER_OFFSET_X * 2.0,
+                CIRCLE_RADIUS * 2.0,
+            ),
+        };
+        (width + ELEMENT_MARGIN * 2.0, height + ELEMENT_MARGIN * 2.0)
+    }
+}
+
+/// Return the canvas size of the shared probe scene.
+pub fn canvas_size() -> (u16, u16) {
+    GridLayout::from_elements(&ELEMENTS).canvas_size()
+}
+
+/// Return the pixmap that is referenced when drawing images in the scene.
+pub fn probe_image_pixmap() -> Pixmap {
+    let mut pixmap = Pixmap::new(IMAGE_SOURCE_SIZE as u16, IMAGE_SOURCE_SIZE as u16);
+    for y in 0..pixmap.height() {
+        for x in 0..pixmap.width() {
+            pixmap.set_pixel(
+                x,
+                y,
+                AlphaColor::from_rgba8(255, 0, 0, 255)
+                    .premultiply()
+                    .to_rgba8(),
+            );
+        }
+    }
+    pixmap.set_may_have_transparency(false);
+    pixmap
+}
+
+fn image_paint(image: ImageSource, quality: ImageQuality) -> PaintType {
+    Image {
+        image,
+        sampler: ImageSampler {
+            x_extend: Extend::Pad,
+            y_extend: Extend::Pad,
+            quality,
+            alpha: 1.0,
+        },
+    }
+    .into()
+}
+
+/// Draw the full shared probe scene into a rendering context.
+pub fn draw_scene<T: ProbeRenderer>(ctx: &mut T, image: ImageSource) {
+    let layout = GridLayout::from_elements(&ELEMENTS);
+    let image_nearest = image_paint(image.clone(), ImageQuality::Low);
+    let image_bilinear = image_paint(image, ImageQuality::Medium);
+    ctx.set_transform(Affine::IDENTITY);
+    ctx.set_paint(css::WHITE.into());
+    ctx.fill_rect(&layout.canvas_rect());
+
+    for (index, element) in ELEMENTS.iter().copied().enumerate() {
+        draw_probe_element(
+            ctx,
+            layout.cell_rect(index),
+            element,
+            &image_nearest,
+            &image_bilinear,
+        );
+    }
+}
+
+fn pixels_within_tolerance(expected: &[u8], actual: &[u8], channel_tolerance: u8) -> bool {
+    if expected[3] == 0 && actual[3] == 0 {
+        return true;
+    }
+
+    expected
+        .iter()
+        .zip(actual)
+        .all(|(expected, actual)| expected.abs_diff(*actual) <= channel_tolerance)
+}
+
+fn draw_probe_element(
+    ctx: &mut impl ProbeRenderer,
+    cell: Rect,
+    element: ProbeElement,
+    image_nearest: &PaintType,
+    image_bilinear: &PaintType,
+) {
+    match element {
+        ProbeElement::SolidRect => {
+            ctx.set_paint(css::BLUE.into());
+            ctx.fill_rect(&centered_rect(cell, RECT_SIZE, RECT_SIZE));
+        }
+        ProbeElement::Transformed => {
+            draw_transformed_rect(ctx, centered_rect(cell, RECT_SIZE, RECT_SIZE));
+        }
+        ProbeElement::AlphaBlending => {
+            let center = cell.center();
+            ctx.set_paint(css::YELLOW.with_alpha(0.5).into());
+            ctx.fill_path(
+                &Circle::new((center.x - CIRCLE_CENTER_OFFSET_X, center.y), CIRCLE_RADIUS)
+                    .to_path(PATH_TOLERANCE),
+            );
+            ctx.set_paint(css::GREEN.with_alpha(0.5).into());
+            ctx.fill_path(
+                &Circle::new((center.x + CIRCLE_CENTER_OFFSET_X, center.y), CIRCLE_RADIUS)
+                    .to_path(PATH_TOLERANCE),
+            );
+        }
+        ProbeElement::Gradient => {
+            let rect = centered_rect(cell, RECT_SIZE, RECT_SIZE);
+            ctx.set_paint(linear_gradient(&rect).into());
+            ctx.fill_rect(&rect);
+        }
+        ProbeElement::ImageNearest => draw_centered_padded_image(ctx, cell, image_nearest),
+        ProbeElement::Filter => draw_blurred_rect(ctx, centered_rect(cell, RECT_SIZE, RECT_SIZE)),
+        ProbeElement::ImageBilinear => draw_centered_padded_image(ctx, cell, image_bilinear),
+        ProbeElement::OpacityLayer => {
+            draw_opacity_layer_rect(ctx, centered_rect(cell, RECT_SIZE, RECT_SIZE));
+        }
+        ProbeElement::Blending => draw_layered_difference_circles(ctx, cell),
+    }
+}
+
+fn centered_rect(cell: Rect, width: f64, height: f64) -> Rect {
+    let center = cell.center();
+    Rect::new(
+        center.x - width * 0.5,
+        center.y - height * 0.5,
+        center.x + width * 0.5,
+        center.y + height * 0.5,
+    )
+}
+
+fn draw_centered_padded_image(ctx: &mut impl ProbeRenderer, cell: Rect, image_paint: &PaintType) {
+    let dst_rect = centered_rect(cell, RECT_SIZE, RECT_SIZE);
+    let image_origin = (
+        dst_rect.x0 + (RECT_SIZE - IMAGE_SOURCE_SIZE) * 0.5,
+        dst_rect.y0 + (RECT_SIZE - IMAGE_SOURCE_SIZE) * 0.5,
+    );
+    ctx.set_paint(image_paint.clone());
+    ctx.set_paint_transform(Affine::translate(image_origin));
+    ctx.fill_rect(&dst_rect);
+    ctx.reset_paint_transform();
+}
+
+fn draw_transformed_rect(ctx: &mut impl ProbeRenderer, rect: Rect) {
+    let center = rect.center();
+    ctx.set_transform(
+        Affine::translate((center.x, center.y))
+            * Affine::rotate(core::f64::consts::FRAC_PI_4)
+            * Affine::translate((-center.x, -center.y)),
+    );
+    ctx.set_paint(css::BLUE.into());
+    ctx.fill_rect(&rect);
+    ctx.set_transform(Affine::IDENTITY);
+}
+
+fn draw_blurred_rect(ctx: &mut impl ProbeRenderer, rect: Rect) {
+    let blur = Filter::from_primitive(FilterPrimitive::GaussianBlur {
+        std_deviation: 0.5,
+        edge_mode: EdgeMode::None,
+    });
+    ctx.push_filter_layer(blur);
+    ctx.set_paint(css::REBECCA_PURPLE.into());
+    ctx.fill_rect(&rect);
+    ctx.pop_layer();
+}
+
+fn draw_opacity_layer_rect(ctx: &mut impl ProbeRenderer, rect: Rect) {
+    ctx.push_layer(None, Some(0.5));
+    ctx.set_paint(css::ORANGE_RED.into());
+    ctx.fill_rect(&rect);
+    ctx.pop_layer();
+}
+
+fn draw_layered_difference_circles(ctx: &mut impl ProbeRenderer, cell: Rect) {
+    let center = cell.center();
+
+    ctx.push_layer(None, None);
+    ctx.set_paint(css::YELLOW.with_alpha(0.5).into());
+    ctx.fill_path(
+        &Circle::new((center.x - CIRCLE_CENTER_OFFSET_X, center.y), CIRCLE_RADIUS)
+            .to_path(PATH_TOLERANCE),
+    );
+
+    ctx.push_layer(
+        Some(BlendMode::new(Mix::Difference, Compose::SrcOver)),
+        None,
+    );
+    ctx.set_paint(css::GREEN.with_alpha(0.5).into());
+    ctx.fill_path(
+        &Circle::new((center.x + CIRCLE_CENTER_OFFSET_X, center.y), CIRCLE_RADIUS)
+            .to_path(PATH_TOLERANCE),
+    );
+    ctx.pop_layer();
+    ctx.pop_layer();
+}
+
+fn linear_gradient(rect: &Rect) -> Gradient {
+    Gradient {
+        kind: LinearGradientPosition {
+            start: Point::new(rect.x0, rect.y0),
+            end: Point::new(rect.x1, rect.y0),
+        }
+        .into(),
+        stops: ColorStops::from(
+            [
+                ColorStop::from((0.0, css::BLUE)),
+                ColorStop::from((1.0, css::RED)),
+            ]
+            .as_slice(),
+        ),
+        extend: Extend::Pad,
+        ..Default::default()
+    }
+}
diff --git a/vendor/vello_common/src/rect.rs b/vendor/vello_common/src/rect.rs
new file mode 100644
index 000000000..55f98b716
--- /dev/null
+++ b/vendor/vello_common/src/rect.rs
@@ -0,0 +1,180 @@
+// Copyright 2025 the Vello Authors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+//! Fast pixel-aligned rectangle rendering directly into strips.
+
+use crate::kurbo::Rect;
+#[cfg(not(feature = "std"))]
+use crate::kurbo::common::FloatFuncs as _;
+use crate::strip::Strip;
+use crate::tile::Tile;
+use alloc::vec::Vec;
+use fearless_simd::*;
+
+/// Render a pixel-aligned rectangle directly into strips.
+///
+/// This bypasses the full path processing pipeline (flatten → tiles → strips)
+/// by directly creating strip coverage data for the rectangle.
+///
+/// The rect bounds should already be clamped to the viewport.
+pub fn render(level: Level, rect: Rect, strip_buf: &mut Vec<Strip>, alpha_buf: &mut Vec<u8>) {
+    dispatch!(level, simd => render_impl(simd, rect, strip_buf, alpha_buf));
+}
+
+/// Generates strip data for an axis-aligned rectangle.
+///
+/// # Strip layout strategy
+///
+/// Tile rows are classified into two kinds:
+///
+/// - **Edge rows** (top/bottom of rect): the rect boundary crosses partway
+///   through the tile vertically, so individual pixels need per-cell alpha.
+///   We emit a *single wide strip* spanning all tile columns, with alpha =
+///   `x_alpha` * `y_alpha` (so the intersection of the alpha mask in each direction).
+///
+/// - **Interior rows**: every pixel in the tile has full vertical coverage,
+///   so we only need to handle the left and right partial-column edges.
+///   We emit a **left edge strip** (with its x-alpha mask) and, when the rect
+///   spans more than one tile column, a **right edge strip** with `fill_gap =
+///   true` so the renderer fills solid 0xFF between them.
+///
+/// The x-alpha masks for the left/right edge tiles are y-independent, so they
+/// are precomputed once and reused across all interior rows.
+fn render_impl<S: Simd>(s: S, rect: Rect, strip_buf: &mut Vec<Strip>, alpha_buf: &mut Vec<u8>) {
+    if rect.is_zero_area() {
+        return;
+    }
+
+    let rect_x0 = rect.x0 as f32;
+    let rect_y0 = rect.y0 as f32;
+    let rect_x1 = rect.x1 as f32;
+    let rect_y1 = rect.y1 as f32;
+
+    // Integer pixel bounds.
+    let px_x0 = rect_x0.floor() as u16;
+    let px_y0 = rect_y0.floor() as u16;
+    let px_y1 = rect_y1.ceil() as u16;
+
+    let left_tile_x = (px_x0 / Tile::WIDTH) * Tile::WIDTH;
+    // Inclusive, so don't use `ceil` here but just `rect_x1` directly.
+    let right_tile_x = (rect_x1 as u16 / Tile::WIDTH) * Tile::WIDTH;
+
+    let y0 = (px_y0 / Tile::HEIGHT) * Tile::HEIGHT;
+    // Note: y1 is exclusive, but it's gonna break for the very last tile if we have a height of u16::MAX.
+    let y1 = (px_y1.saturating_add(Tile::HEIGHT - 1) / Tile::HEIGHT) * Tile::HEIGHT;
+    // Include one tile past the right edge so the right-edge tile column is
+    // covered by the edge-row wide-strip loop.
+    let x_end = right_tile_x.saturating_add(Tile::WIDTH);
+
+    if x_end <= left_tile_x || y1 <= y0 {
+        return;
+    }
+
+    let tile_start_y = y0 / Tile::HEIGHT;
+    let tile_end_y = y1 / Tile::HEIGHT;
+
+    // A right strip is only needed when the rect spans more than one tile column.
+    let needs_right_strip = right_tile_x > left_tile_x;
+
+    let left_x_cov = coverage(left_tile_x, rect_x0, rect_x1);
+    let right_x_cov = coverage(right_tile_x, rect_x0, rect_x1);
+    let left_x_mask = alpha_mask_from_x_coverage(s, &left_x_cov);
+    let right_x_mask = alpha_mask_from_x_coverage(s, &right_x_cov);
+
+    for tile_y in tile_start_y..tile_end_y {
+        let strip_y = tile_y * Tile::HEIGHT;
+        let strip_y_f = strip_y as f32;
+        let strip_y_end_f = strip_y as f32 + Tile::HEIGHT as f32;
+
+        // A row is an "edge" if the rect's top or bottom boundary falls
+        // *inside* it (i.e. partial vertical coverage).
+        let is_top_edge = strip_y_f < rect_y0 && rect_y0 < strip_y_end_f;
+        let is_bottom_edge = strip_y_f < rect_y1 && rect_y1 < strip_y_end_f;
+
+        if is_top_edge || is_bottom_edge {
+            let alpha_start = alpha_buf.len() as u32;
+
+            let y_cov = coverage(strip_y, rect_y0, rect_y1);
+            let mut col = left_tile_x;
+            // TODO: Can this result in an infinite loop in case x_end == u16::MAX?
+            while col + Tile::WIDTH <= x_end {
+                // TODO: We could optimize this so this is only computed for the left-most and right-most
+                // tile of the edge, all intermediate tiles have full horizontal coverage.
+                let x_cov = coverage(col, rect_x0, rect_x1);
+                let combined = combined_tile_alpha(s, &x_cov, &y_cov);
+                alpha_buf.extend_from_slice(combined.as_slice());
+                col += Tile::WIDTH;
+            }
+
+            strip_buf.push(Strip::new(left_tile_x, strip_y, alpha_start, false));
+        } else {
+            let alpha_start = alpha_buf.len() as u32;
+            alpha_buf.extend_from_slice(left_x_mask.as_slice());
+            strip_buf.push(Strip::new(left_tile_x, strip_y, alpha_start, false));
+
+            if needs_right_strip {
+                // `fill_gap = true` tells the renderer to fill solid 0xFF
+                // between the previous strip's end and this strip's start.
+                let alpha_start = alpha_buf.len() as u32;
+                alpha_buf.extend_from_slice(right_x_mask.as_slice());
+                strip_buf.push(Strip::new(right_tile_x, strip_y, alpha_start, true));
+            }
+        }
+    }
+
+    // Sentinel strip: marks the end of the strip list for this shape.
+    let last_strip_y = (tile_end_y - 1) * Tile::HEIGHT;
+    strip_buf.push(Strip::new(
+        u16::MAX,
+        last_strip_y,
+        alpha_buf.len() as u32,
+        false,
+    ));
+}
+
+/// Compute fractional pixel coverage for `N` consecutive pixels starting at `start`.
+#[inline(always)]
+fn coverage<const N: usize>(start: u16, rect_lo: f32, rect_hi: f32) -> [f32; N] {
+    let mut cov = [0.0_f32; N];
+
+    #[allow(clippy::needless_range_loop, reason = "better clarity")]
+    for i in 0..N {
+        let px = (start as usize + i) as f32;
+        cov[i] = (rect_hi.min(px + 1.0) - rect_lo.max(px)).clamp(0.0, 1.0);
+    }
+    cov
+}
+
+/// Build an alpha mask for the 4x4 tile from the given horizontal coverages,
+/// splatting them across the other dimension.
+#[inline(always)]
+fn alpha_mask_from_x_coverage<S: Simd>(s: S, cov: &[f32; Tile::WIDTH as usize]) -> u8x16<S> {
+    let mut buf = [0_u8; 16];
+
+    #[allow(clippy::needless_range_loop, reason = "better clarity")]
+    for col in 0..Tile::WIDTH as usize {
+        let alpha = (cov[col] * 255.0 + 0.5) as u8;
+        let base = col * Tile::HEIGHT as usize;
+        buf[base..base + Tile::HEIGHT as usize].fill(alpha);
+    }
+
+    u8x16::from_slice(s, &buf)
+}
+
+/// Compute the alphas for a single 4x4 tile, taking horizontal as well as vertical coverage
+/// of the rectangle into account.
+#[inline(always)]
+fn combined_tile_alpha<S: Simd>(
+    s: S,
+    x_cov: &[f32; Tile::WIDTH as usize],
+    y_cov: &[f32; Tile::HEIGHT as usize],
+) -> u8x16<S> {
+    let mut buf = [0_u8; 16];
+    for (col, xc) in x_cov.iter().copied().enumerate() {
+        for (row, yc) in y_cov.iter().copied().enumerate() {
+            buf[col * Tile::HEIGHT as usize + row] = (xc * yc * 255.0 + 0.5) as u8;
+        }
+    }
+
+    u8x16::from_slice(s, &buf)
+}
diff --git a/vendor/vello_common/src/render_graph.rs b/vendor/vello_common/src/render_graph.rs
new file mode 100644
index 000000000..4ddb871ec
--- /dev/null
+++ b/vendor/vello_common/src/render_graph.rs
@@ -0,0 +1,616 @@
+// Copyright 2025 the Vello Authors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+//! Render graph for multi-pass rendering with filter effects.
+//!
+//! This module provides a directed acyclic graph (DAG) representation of the rendering pipeline,
+//! enabling efficient multi-pass rendering when layers have filter effects applied.
+//!
+//! # Overview
+//!
+//! The render graph tracks dependencies between rendering operations (nodes) and ensures they
+//! execute in the correct order. Each node represents either:
+//! - The root (backdrop) layer that forms the base for compositing
+//! - A filtered layer that renders geometry, applies effects, and blends the result
+//!
+//! # Key Features
+//!
+//! - **Incremental execution order**: The graph builds its execution order as layers are popped
+//!   during scene encoding, avoiding the need for a full topological sort at render time.
+//! - **Data dependencies**: Edges represent dependencies where one layer's output is consumed
+//!   as input to another operation (e.g., a filter reading from a previous layer's buffer).
+//! - **Efficient traversal**: The pre-computed execution order allows O(1) iteration over nodes
+//!   in dependency order, with children always processed before their parents.
+//!
+//! # Usage Pattern
+//!
+//! 1. During scene encoding, nodes are added via [`RenderGraph::add_node`] as layers are created
+//! 2. When layers with dependencies are popped, edges are added via [`RenderGraph::add_edge`]
+//! 3. As each layer completes, it's recorded in execution order via [`RenderGraph::record_node_for_execution`]
+//! 4. At render time, iterate nodes in order using [`RenderGraph::execution_order`]
+//!
+//! # Example Structure
+//!
+//! ```text
+//! RootLayer (id=0) ← backdrop
+//!     │
+//!     └─→ FilterLayer (id=1, blur filter)
+//!             │
+//!             └─→ FilterLayer (id=2, drop shadow filter)
+//!
+//! Execution order: [2, 1, 0] (deepest children first, then parents)
+//! ```
+//!
+//! In this example, `FilterLayer 2` (drop shadow) is the most deeply nested child, so it
+//! executes first. Then `FilterLayer 1` (blur) executes and can reference `FilterLayer 2`'s output
+//! if needed. Finally, the `RootLayer` composites all filtered results into the final image.
+//!
+//! # Future Improvements
+//!
+//! TODO: Consider using `render_graph` for `FilterGraph` execution for filters. The render graph
+//! infrastructure could potentially be extended to handle the internal DAG structure within
+//! individual filter effects, not just layer-to-layer dependencies.
+
+use crate::coarse::WideTilesBbox;
+use crate::filter_effects::Filter;
+use crate::kurbo::Affine;
+use alloc::vec;
+use alloc::vec::Vec;
+use hashbrown::HashMap;
+
+/// A render graph containing nodes and edges representing the rendering pipeline.
+///
+/// This graph tracks layers with filter effects and their dependencies, enabling
+/// multi-pass rendering where filter outputs can be used as inputs to subsequent operations.
+#[derive(Debug, Clone)]
+pub struct RenderGraph {
+    /// All render operations (layers) in the graph.
+    pub nodes: Vec<RenderNode>,
+    /// Dependencies between nodes, defining execution order.
+    pub edges: Vec<RenderEdge>,
+    /// Counter for generating unique node IDs.
+    next_node_id: NodeId,
+    /// Pre-computed execution order collected during `pop_layer` calls.
+    /// This is built incrementally as layers are popped (children before parents),
+    /// avoiding the need for topological sort at render time.
+    node_execution_order: Vec<NodeId>,
+    /// The root layer node ID, tracked separately since it's never popped.
+    /// This is appended to the execution order when iterating.
+    root_node: Option<NodeId>,
+    /// Flag indicating whether the graph contains any filter layers.
+    /// Set to true when a `FilterLayer` node is added.
+    has_filters: bool,
+}
+
+/// The type of dependency between nodes.
+#[derive(Debug, Clone)]
+pub enum DependencyKind {
+    /// Sequential execution: the `from` node must execute before the `to` node.
+    ///
+    /// The `to` node consumes output from the `from` node via the specified layer.
+    /// For example, a parent filter reads from a child layer buffer produced by a previous operation.
+    Sequential {
+        /// The layer that connects the two nodes, whose output flows from `from` to `to`.
+        layer_id: LayerId,
+    },
+}
+
+impl Default for RenderGraph {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl RenderGraph {
+    /// Creates a new empty render graph.
+    ///
+    /// The graph starts with no nodes or edges. Nodes are added via [`add_node`](Self::add_node)
+    /// as layers are created during scene encoding.
+    pub fn new() -> Self {
+        Self {
+            nodes: Vec::new(),
+            edges: Vec::new(),
+            next_node_id: 0,
+            node_execution_order: Vec::new(),
+            root_node: None,
+            has_filters: false,
+        }
+    }
+
+    /// Clears the render graph state while preserving allocated capacity.
+    ///
+    /// This resets the graph to an empty state (equivalent to [`new`](Self::new))
+    /// but reuses the existing memory allocations, avoiding the need to reallocate
+    /// when building a new scene.
+    ///
+    /// After calling `clear()`, the graph will have no nodes or edges, and counters
+    /// will be reset to their initial state.
+    pub fn clear(&mut self) {
+        self.nodes.clear();
+        self.edges.clear();
+        self.next_node_id = 0;
+        self.node_execution_order.clear();
+        self.root_node = None;
+        self.has_filters = false;
+    }
+
+    /// Add a node to the graph and return its ID.
+    ///
+    /// This is called during scene encoding when a new layer is created. The returned ID
+    /// should be stored with the layer to establish edges later when dependencies are known.
+    pub fn add_node(&mut self, kind: RenderNodeKind) -> NodeId {
+        let id = self.next_node_id;
+        self.next_node_id += 1;
+
+        // Track root node separately since it's never popped and executes last
+        if matches!(kind, RenderNodeKind::RootLayer { .. }) {
+            self.root_node = Some(id);
+        }
+
+        // Track if we have any filters to avoid scanning nodes later
+        if matches!(kind, RenderNodeKind::FilterLayer { .. }) {
+            self.has_filters = true;
+        }
+
+        self.nodes.push(RenderNode { id, kind });
+        id
+    }
+
+    /// Add an edge between two nodes, establishing a dependency relationship.
+    ///
+    /// This is called when a layer with dependencies is popped during scene encoding.
+    /// The edge ensures that `from` node executes before `to` node, typically because
+    /// `to` needs to read data produced by `from` (e.g., a filter reading from a layer buffer).
+    pub fn add_edge(&mut self, from: NodeId, to: NodeId, kind: DependencyKind) {
+        self.edges.push(RenderEdge { from, to, kind });
+    }
+
+    /// Record a node as ready for execution in topological order.
+    ///
+    /// This is called from `pop_layer` to incrementally build the execution order
+    /// as layers are popped. Since layers are popped in a depth-first manner (children
+    /// before parents), this naturally builds the correct dependency order without
+    /// requiring a separate topological sort at render time.
+    ///
+    /// # Example
+    ///
+    /// For nested layers A → B → C (where C is the deepest child):
+    /// - C is popped first → recorded first
+    /// - B is popped second → recorded second  
+    /// - A is popped last → recorded last
+    ///
+    /// This gives execution order [C, B, A], which respects dependencies.
+    pub fn record_node_for_execution(&mut self, node_id: NodeId) {
+        self.node_execution_order.push(node_id);
+    }
+
+    /// Check if the graph contains any filter passes.
+    ///
+    /// Returns `true` if any layers have filter effects that need processing.
+    /// This is useful for determining whether to use the multi-pass rendering
+    /// pipeline (with filter support) or a simpler single-pass approach.
+    ///
+    /// This is set when filter nodes are added.
+    pub fn has_filters(&self) -> bool {
+        self.has_filters
+    }
+
+    /// Get an iterator over nodes in execution order.
+    ///
+    /// Returns filter layers followed by the root layer, in the order they should be executed.
+    /// This order is built incrementally during `pop_layer` calls (children before parents),
+    /// avoiding the need for topological sort at render time. Returns an iterator to avoid allocation.
+    pub fn execution_order(&self) -> impl Iterator<Item = NodeId> + '_ {
+        self.node_execution_order
+            .iter()
+            .copied()
+            .chain(self.root_node)
+    }
+
+    /// Topologically sort nodes based on their dependencies using Kahn's algorithm.
+    ///
+    /// Returns nodes in execution order, ensuring all dependencies are satisfied before
+    /// each node is processed. This implements a standard topological sort with cycle detection.
+    ///
+    /// # Performance
+    ///
+    /// This is primarily used for validation and debugging. For normal rendering,
+    /// prefer [`execution_order`](Self::execution_order) which is pre-computed during
+    /// scene encoding and avoids the O(V+E) sorting overhead.
+    ///
+    /// # Panics
+    ///
+    /// Panics if the graph contains a cycle, which should never happen in a valid render graph.
+    #[allow(
+        dead_code,
+        reason = "we don't use currently topological sort but will in the future"
+    )]
+    pub fn topological_sort(&self) -> Vec<NodeId> {
+        // Track how many incoming edges each node has (dependencies it's waiting for)
+        let mut in_degree = vec![0; self.nodes.len()];
+
+        // Map each node to its dependents (nodes that depend on it)
+        let mut adj_list: HashMap<NodeId, Vec<NodeId>> = HashMap::new();
+
+        // Build adjacency list and count incoming edges for each node
+        for edge in &self.edges {
+            adj_list.entry(edge.from).or_default().push(edge.to);
+            in_degree[edge.to] += 1;
+        }
+
+        // Start with nodes that have no dependencies (in-degree = 0)
+        // These are safe to execute immediately
+        let mut queue: Vec<NodeId> = (0..self.nodes.len())
+            .filter(|&i| in_degree[i] == 0)
+            .collect();
+
+        let mut result = Vec::new();
+
+        // Process nodes in dependency order (Kahn's algorithm)
+        while let Some(node_id) = queue.pop() {
+            result.push(node_id);
+
+            // For each node that depends on this one, mark this dependency as satisfied
+            if let Some(neighbors) = adj_list.get(&node_id) {
+                for &neighbor in neighbors {
+                    in_degree[neighbor] -= 1;
+                    // If all dependencies are now satisfied, this node is ready to execute
+                    if in_degree[neighbor] == 0 {
+                        queue.push(neighbor);
+                    }
+                }
+            }
+        }
+
+        // If we didn't process all nodes, there's a cycle (which should never happen)
+        assert_eq!(
+            result.len(),
+            self.nodes.len(),
+            "Cycle detected in render graph"
+        );
+        result
+    }
+}
+
+/// A node in the render graph representing a single render operation.
+#[derive(Debug, Clone)]
+pub struct RenderNode {
+    /// Unique identifier for this node.
+    pub id: NodeId,
+    /// The type of render operation this node performs.
+    pub kind: RenderNodeKind,
+}
+
+impl RenderNode {
+    /// Returns `true` if this node has an empty (zero-area) bounding box.
+    pub fn is_empty(&self) -> bool {
+        match &self.kind {
+            RenderNodeKind::RootLayer { wtile_bbox, .. } => wtile_bbox.is_empty(),
+            RenderNodeKind::FilterLayer { wtile_bbox, .. } => wtile_bbox.is_empty(),
+        }
+    }
+}
+
+/// An edge representing a dependency between two nodes.
+#[derive(Debug, Clone)]
+pub struct RenderEdge {
+    /// The source node that must complete first.
+    pub from: NodeId,
+    /// The destination node that depends on the source.
+    pub to: NodeId,
+    /// The type of dependency relationship.
+    pub kind: DependencyKind,
+}
+
+/// The type of operation a render node performs.
+///
+/// Each variant represents a different kind of rendering pass in the pipeline.
+/// Nodes are executed in dependency order to ensure correct compositing and filtering.
+#[derive(Debug, Clone)]
+pub enum RenderNodeKind {
+    /// The root (backdrop) layer that serves as the base for compositing.
+    ///
+    /// This layer is always present and is rendered last, after all filter layers have
+    /// been processed. It contains all non-filtered geometry and serves as the final
+    /// compositing target.
+    RootLayer {
+        /// ID of the root layer.
+        layer_id: LayerId,
+        /// Bounding box in wide tile coordinates covered by this layer.
+        wtile_bbox: WideTilesBbox,
+    },
+    /// A layer with filter effects applied.
+    ///
+    /// This combines multiple passes: render geometry → apply filter → blend result.
+    /// Layers are added to the render graph only if they have filters. The filter
+    /// output may be consumed by other filter layers or composited into the root layer.
+    FilterLayer {
+        /// ID of this filtered layer.
+        layer_id: LayerId,
+        /// The filter effect to apply.
+        filter: Filter,
+        /// Bounding box in wide tile coordinates containing geometry for this layer.
+        wtile_bbox: WideTilesBbox,
+        /// Transform that was active when the layer was created.
+        /// Used to scale filter parameters based on the current scale/zoom level.
+        transform: Affine,
+    },
+}
+
+/// Unique identifier for a layer in the rendering system.
+///
+/// Layer IDs are assigned by the encoding system and used to track layer buffers
+/// across multiple render passes. A layer may or may not have a corresponding node
+/// in the render graph (only layers with filters create graph nodes).
+pub type LayerId = u32;
+
+/// Unique identifier for a node in the render graph.
+///
+/// Node IDs are assigned sequentially as nodes are added during scene encoding.
+/// They are used to reference nodes when adding edges and during execution order traversal.
+pub type NodeId = usize;
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::color::AlphaColor;
+
+    #[test]
+    fn new_creates_empty_graph() {
+        let graph = RenderGraph::new();
+        assert_eq!(graph.nodes.len(), 0);
+        assert_eq!(graph.edges.len(), 0);
+        assert!(!graph.has_filters());
+        assert!(graph.root_node.is_none());
+    }
+
+    #[test]
+    fn clear_resets_to_empty_state() {
+        let mut graph = RenderGraph::new();
+        graph.add_node(RenderNodeKind::RootLayer {
+            layer_id: 0,
+            wtile_bbox: dummy_bbox(),
+        });
+        graph.add_node(RenderNodeKind::FilterLayer {
+            layer_id: 1,
+            filter: dummy_filter(),
+            wtile_bbox: dummy_bbox(),
+            transform: Affine::IDENTITY,
+        });
+        graph.record_node_for_execution(1);
+
+        graph.clear();
+
+        assert_eq!(graph.nodes.len(), 0);
+        assert_eq!(graph.edges.len(), 0);
+        assert_eq!(graph.next_node_id, 0);
+        assert!(graph.root_node.is_none());
+        assert!(!graph.has_filters());
+        assert_eq!(graph.execution_order().count(), 0);
+    }
+
+    #[test]
+    fn clear_preserves_capacity() {
+        let mut graph = RenderGraph::new();
+        let from = graph.add_node(RenderNodeKind::RootLayer {
+            layer_id: 0,
+            wtile_bbox: dummy_bbox(),
+        });
+        let to = graph.add_node(RenderNodeKind::RootLayer {
+            layer_id: 1,
+            wtile_bbox: dummy_bbox(),
+        });
+        graph.add_edge(from, to, DependencyKind::Sequential { layer_id: 1 });
+
+        let nodes_capacity = graph.nodes.capacity();
+        let edges_capacity = graph.edges.capacity();
+
+        graph.clear();
+
+        assert!(graph.nodes.capacity() >= nodes_capacity);
+        assert!(graph.edges.capacity() >= edges_capacity);
+    }
+
+    #[test]
+    fn add_node_returns_sequential_ids() {
+        let mut graph = RenderGraph::new();
+        let id0 = graph.add_node(RenderNodeKind::RootLayer {
+            layer_id: 0,
+            wtile_bbox: dummy_bbox(),
+        });
+        let id1 = graph.add_node(RenderNodeKind::FilterLayer {
+            layer_id: 1,
+            filter: dummy_filter(),
+            wtile_bbox: dummy_bbox(),
+            transform: Affine::IDENTITY,
+        });
+
+        assert_eq!(id0, 0);
+        assert_eq!(id1, 1);
+    }
+
+    #[test]
+    fn add_node_tracks_root() {
+        let mut graph = RenderGraph::new();
+        let root_id = graph.add_node(RenderNodeKind::RootLayer {
+            layer_id: 0,
+            wtile_bbox: dummy_bbox(),
+        });
+
+        assert_eq!(graph.root_node, Some(root_id));
+    }
+
+    #[test]
+    fn add_node_filter_sets_has_filters() {
+        let mut graph = RenderGraph::new();
+
+        graph.add_node(RenderNodeKind::FilterLayer {
+            layer_id: 1,
+            filter: dummy_filter(),
+            wtile_bbox: dummy_bbox(),
+            transform: Affine::IDENTITY,
+        });
+
+        assert!(graph.has_filters());
+    }
+
+    #[test]
+    fn add_node_root_does_not_set_has_filters() {
+        let mut graph = RenderGraph::new();
+
+        graph.add_node(RenderNodeKind::RootLayer {
+            layer_id: 0,
+            wtile_bbox: dummy_bbox(),
+        });
+
+        assert!(!graph.has_filters());
+    }
+
+    #[test]
+    fn add_edge_creates_dependency() {
+        let mut graph = RenderGraph::new();
+        let from = graph.add_node(RenderNodeKind::FilterLayer {
+            layer_id: 1,
+            filter: dummy_filter(),
+            wtile_bbox: dummy_bbox(),
+            transform: Affine::IDENTITY,
+        });
+        let to = graph.add_node(RenderNodeKind::RootLayer {
+            layer_id: 0,
+            wtile_bbox: dummy_bbox(),
+        });
+
+        graph.add_edge(from, to, DependencyKind::Sequential { layer_id: 1 });
+
+        assert_eq!(graph.edges.len(), 1);
+        assert_eq!(graph.edges[0].from, from);
+        assert_eq!(graph.edges[0].to, to);
+    }
+
+    #[test]
+    fn add_edge_multiple_from_same_node() {
+        let mut graph = RenderGraph::new();
+        let from = graph.add_node(RenderNodeKind::FilterLayer {
+            layer_id: 1,
+            filter: dummy_filter(),
+            wtile_bbox: dummy_bbox(),
+            transform: Affine::IDENTITY,
+        });
+        let to1 = graph.add_node(RenderNodeKind::FilterLayer {
+            layer_id: 2,
+            filter: dummy_filter(),
+            wtile_bbox: dummy_bbox(),
+            transform: Affine::IDENTITY,
+        });
+        let to2 = graph.add_node(RenderNodeKind::RootLayer {
+            layer_id: 0,
+            wtile_bbox: dummy_bbox(),
+        });
+
+        graph.add_edge(from, to1, DependencyKind::Sequential { layer_id: 1 });
+        graph.add_edge(from, to2, DependencyKind::Sequential { layer_id: 1 });
+
+        assert_eq!(graph.edges.len(), 2);
+    }
+
+    #[test]
+    fn execution_order_includes_recorded_nodes() {
+        let mut graph = RenderGraph::new();
+        let filter = graph.add_node(RenderNodeKind::FilterLayer {
+            layer_id: 1,
+            filter: dummy_filter(),
+            wtile_bbox: dummy_bbox(),
+            transform: Affine::IDENTITY,
+        });
+
+        graph.record_node_for_execution(filter);
+
+        let order: Vec<_> = graph.execution_order().collect();
+        assert_eq!(order, vec![filter]);
+    }
+
+    #[test]
+    fn execution_order_includes_only_root_when_present() {
+        let mut graph = RenderGraph::new();
+        let root = graph.add_node(RenderNodeKind::RootLayer {
+            layer_id: 0,
+            wtile_bbox: dummy_bbox(),
+        });
+
+        let order: Vec<_> = graph.execution_order().collect();
+        assert_eq!(order, vec![root]);
+    }
+
+    #[test]
+    fn execution_order_root_comes_last() {
+        let mut graph = RenderGraph::new();
+        let filter1 = graph.add_node(RenderNodeKind::FilterLayer {
+            layer_id: 1,
+            filter: dummy_filter(),
+            wtile_bbox: dummy_bbox(),
+            transform: Affine::IDENTITY,
+        });
+        let filter2 = graph.add_node(RenderNodeKind::FilterLayer {
+            layer_id: 2,
+            filter: dummy_filter(),
+            wtile_bbox: dummy_bbox(),
+            transform: Affine::IDENTITY,
+        });
+        let root = graph.add_node(RenderNodeKind::RootLayer {
+            layer_id: 0,
+            wtile_bbox: dummy_bbox(),
+        });
+
+        graph.record_node_for_execution(filter2);
+        graph.record_node_for_execution(filter1);
+
+        let order: Vec<_> = graph.execution_order().collect();
+        assert_eq!(order, vec![filter2, filter1, root]);
+    }
+
+    #[test]
+    fn topological_sort_diamond_dependency() {
+        let mut graph = RenderGraph::new();
+        let bottom = graph.add_node(RenderNodeKind::FilterLayer {
+            layer_id: 3,
+            filter: dummy_filter(),
+            wtile_bbox: dummy_bbox(),
+            transform: Affine::IDENTITY,
+        });
+        let left = graph.add_node(RenderNodeKind::FilterLayer {
+            layer_id: 1,
+            filter: dummy_filter(),
+            wtile_bbox: dummy_bbox(),
+            transform: Affine::IDENTITY,
+        });
+        let right = graph.add_node(RenderNodeKind::FilterLayer {
+            layer_id: 2,
+            filter: dummy_filter(),
+            wtile_bbox: dummy_bbox(),
+            transform: Affine::IDENTITY,
+        });
+        let top = graph.add_node(RenderNodeKind::RootLayer {
+            layer_id: 0,
+            wtile_bbox: dummy_bbox(),
+        });
+
+        // Diamond: bottom -> left -> top, bottom -> right -> top
+        graph.add_edge(bottom, left, DependencyKind::Sequential { layer_id: 3 });
+        graph.add_edge(bottom, right, DependencyKind::Sequential { layer_id: 3 });
+        graph.add_edge(left, top, DependencyKind::Sequential { layer_id: 1 });
+        graph.add_edge(right, top, DependencyKind::Sequential { layer_id: 2 });
+
+        let sorted = graph.topological_sort();
+        assert_eq!(sorted, vec![bottom, right, left, top]);
+    }
+
+    fn dummy_filter() -> Filter {
+        Filter::from_primitive(crate::filter_effects::FilterPrimitive::Flood {
+            color: AlphaColor::from_rgba8(0, 0, 0, 255),
+        })
+    }
+
+    fn dummy_bbox() -> WideTilesBbox {
+        WideTilesBbox::ZERO
+    }
+}
diff --git a/vendor/vello_common/src/render_state.rs b/vendor/vello_common/src/render_state.rs
new file mode 100644
index 000000000..11e9056db
--- /dev/null
+++ b/vendor/vello_common/src/render_state.rs
@@ -0,0 +1,56 @@
+// Copyright 2025 the Vello Authors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+//! Shared render state.
+
+use crate::kurbo::{Affine, Cap, Join, Stroke};
+use crate::paint::{PaintType, Tint};
+use crate::peniko::color::palette::css::BLACK;
+use crate::peniko::{BlendMode, Compose, Fill, Mix};
+
+/// A render state which contains the style properties for path rendering and
+/// the current transform.
+#[derive(Debug, Clone)]
+pub struct RenderState {
+    /// The paint type (solid color, gradient, or image).
+    pub paint: PaintType,
+    /// Transform applied to the paint coordinates.
+    pub paint_transform: Affine,
+    /// Stroke style for path stroking operations.
+    pub stroke: Stroke,
+    /// Transform applied to geometry.
+    pub transform: Affine,
+    /// Fill rule for path filling operations.
+    pub fill_rule: Fill,
+    /// Blend mode for compositing.
+    pub blend_mode: BlendMode,
+    /// The tint for image painting.
+    pub tint: Option<Tint>,
+}
+
+impl Default for RenderState {
+    fn default() -> Self {
+        Self {
+            paint: BLACK.into(),
+            paint_transform: Affine::IDENTITY,
+            stroke: Stroke {
+                width: 1.0,
+                join: Join::Bevel,
+                start_cap: Cap::Butt,
+                end_cap: Cap::Butt,
+                ..Default::default()
+            },
+            transform: Affine::IDENTITY,
+            fill_rule: Fill::NonZero,
+            blend_mode: BlendMode::new(Mix::Normal, Compose::SrcOver),
+            tint: None,
+        }
+    }
+}
+
+impl RenderState {
+    /// Reset to default state.
+    pub fn reset(&mut self) {
+        *self = Self::default();
+    }
+}
diff --git a/vendor/vello_common/src/simd.rs b/vendor/vello_common/src/simd.rs
new file mode 100644
index 000000000..d267fc33e
--- /dev/null
+++ b/vendor/vello_common/src/simd.rs
@@ -0,0 +1,76 @@
+// Copyright 2025 the Vello Authors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+//! A number of SIMD extension traits.
+
+use fearless_simd::*;
+
+/// Splatting every 4th element in the vector, used for splatting the alpha value of
+/// a color to all lanes.
+pub trait Splat4thExt<S> {
+    /// Splat every 4th element of the vector.
+    fn splat_4th(self) -> Self;
+}
+
+impl<S: Simd> Splat4thExt<S> for f32x4<S> {
+    #[inline(always)]
+    fn splat_4th(self) -> Self {
+        // TODO: Explore whether it's just faster to manually access the 4th element and splat it.
+        let zip1 = self.zip_high(self);
+        zip1.zip_high(zip1)
+    }
+}
+
+impl<S: Simd> Splat4thExt<S> for f32x8<S> {
+    #[inline(always)]
+    fn splat_4th(self) -> Self {
+        let (mut p1, mut p2) = self.simd.split_f32x8(self);
+        p1 = p1.splat_4th();
+        p2 = p2.splat_4th();
+
+        self.simd.combine_f32x4(p1, p2)
+    }
+}
+
+impl<S: Simd> Splat4thExt<S> for f32x16<S> {
+    #[inline(always)]
+    fn splat_4th(self) -> Self {
+        let (mut p1, mut p2) = self.simd.split_f32x16(self);
+        p1 = p1.splat_4th();
+        p2 = p2.splat_4th();
+
+        self.simd.combine_f32x8(p1, p2)
+    }
+}
+
+impl<S: Simd> Splat4thExt<S> for u8x16<S> {
+    #[inline(always)]
+    fn splat_4th(self) -> Self {
+        // TODO: SIMDify
+        [
+            self[3], self[3], self[3], self[3], self[7], self[7], self[7], self[7], self[11],
+            self[11], self[11], self[11], self[15], self[15], self[15], self[15],
+        ]
+        .simd_into(self.simd)
+    }
+}
+
+impl<S: Simd> Splat4thExt<S> for u8x32<S> {
+    #[inline(always)]
+    fn splat_4th(self) -> Self {
+        let (mut p1, mut p2) = self.simd.split_u8x32(self);
+        p1 = p1.splat_4th();
+        p2 = p2.splat_4th();
+
+        self.simd.combine_u8x16(p1, p2)
+    }
+}
+
+/// Splat each single element in the vector to 4 lanes.
+#[inline(always)]
+pub fn element_wise_splat<S: Simd>(simd: S, input: f32x4<S>) -> f32x16<S> {
+    simd.combine_f32x8(
+        simd.combine_f32x4(f32x4::splat(simd, input[0]), f32x4::splat(simd, input[1])),
+        simd.combine_f32x4(f32x4::splat(simd, input[2]), f32x4::splat(simd, input[3])),
+    )
+}
diff --git a/vendor/vello_common/src/strip.rs b/vendor/vello_common/src/strip.rs
new file mode 100644
index 000000000..315f1972e
--- /dev/null
+++ b/vendor/vello_common/src/strip.rs
@@ -0,0 +1,535 @@
+// Copyright 2025 the Vello Authors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+//! Rendering strips.
+
+use crate::flatten::Line;
+use crate::peniko::Fill;
+use crate::tile::{Tile, Tiles};
+use crate::util::f32_to_u8;
+use alloc::vec::Vec;
+use fearless_simd::*;
+
+/// A strip.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Strip {
+    /// The x coordinate of the strip, in user coordinates.
+    pub x: u16,
+    /// The y coordinate of the strip, in user coordinates.
+    pub y: u16,
+    /// Packed alpha index and fill gap flag.
+    ///
+    /// Bit layout (u32):
+    /// - bit 31: `fill_gap` (See `Strip::fill_gap()`).
+    /// - bits 0..=30: `alpha_idx` (See `Strip::alpha_idx()`).
+    packed_alpha_idx_fill_gap: u32,
+}
+
+impl Strip {
+    /// The bit mask for `fill_gap` packed into `packed_alpha_idx_fill_gap`.
+    const FILL_GAP_MASK: u32 = 1 << 31;
+
+    /// Creates a new strip.
+    pub fn new(x: u16, y: u16, alpha_idx: u32, fill_gap: bool) -> Self {
+        // Ensure `alpha_idx` does not collide with the fill flag bit.
+        assert!(
+            alpha_idx & Self::FILL_GAP_MASK == 0,
+            "`alpha_idx` too large"
+        );
+        let fill_gap = u32::from(fill_gap) << 31;
+        Self {
+            x,
+            y,
+            packed_alpha_idx_fill_gap: alpha_idx | fill_gap,
+        }
+    }
+
+    /// Return whether the strip is a sentinel strip.
+    pub fn is_sentinel(&self) -> bool {
+        self.x == u16::MAX
+    }
+
+    /// Return the y coordinate of the strip, in strip units.
+    pub fn strip_y(&self) -> u16 {
+        self.y / Tile::HEIGHT
+    }
+
+    /// Returns the alpha index.
+    #[inline(always)]
+    pub fn alpha_idx(&self) -> u32 {
+        self.packed_alpha_idx_fill_gap & !Self::FILL_GAP_MASK
+    }
+
+    /// Sets the alpha index.
+    ///
+    /// Note that the largest value that can be stored in the alpha index is `u32::MAX << 1`, as the
+    /// highest bit is reserved for `fill_gap`.
+    #[inline(always)]
+    pub fn set_alpha_idx(&mut self, alpha_idx: u32) {
+        // Ensure `alpha_idx` does not collide with the fill flag bit.
+        assert!(
+            alpha_idx & Self::FILL_GAP_MASK == 0,
+            "`alpha_idx` too large"
+        );
+        let fill_gap = self.packed_alpha_idx_fill_gap & Self::FILL_GAP_MASK;
+        self.packed_alpha_idx_fill_gap = alpha_idx | fill_gap;
+    }
+
+    /// Returns whether the gap that lies between this strip and the previous in the same row should be filled.
+    #[inline(always)]
+    pub fn fill_gap(&self) -> bool {
+        (self.packed_alpha_idx_fill_gap & Self::FILL_GAP_MASK) != 0
+    }
+
+    /// Sets whether the gap that lies between this strip and the previous in the same row should be filled.
+    #[inline(always)]
+    pub fn set_fill_gap(&mut self, fill: bool) {
+        let fill = u32::from(fill) << 31;
+        self.packed_alpha_idx_fill_gap =
+            (self.packed_alpha_idx_fill_gap & !Self::FILL_GAP_MASK) | fill;
+    }
+
+    /// When early culling is active, geometry fully to the left of the viewport creates no tiles.
+    /// However, if that geometry has a non-zero winding (e.g. a large shape surrounding the
+    /// viewport), then we must output strips for those fills.
+    ///
+    /// We reconstruct this "background" fill using `row_windings` (the winding at x=0) to emit solid
+    /// strips for:
+    ///      1. All rows vertically above the first visible tile.
+    ///      2. 'Captive' rows between two tile-containing rows.
+    ///      3. All rows vertically below the last visible tile.
+    #[inline(always)]
+    fn emit_culled_background<F>(
+        start: u16,
+        end: u16,
+        strips: &mut Vec<Self>,
+        alphas: &mut Vec<u8>,
+        windings: &crate::tile::CulledWindings,
+        mut should_fill: F,
+    ) where
+        F: FnMut(i32) -> bool,
+    {
+        windings.for_active_rows_in_range(start as usize, end as usize, |row| {
+            if should_fill(windings.coarse[row] as i32) {
+                let y_pos = row as u16 * Tile::HEIGHT;
+                strips.push(Self::new(0, y_pos, alphas.len() as u32, false));
+                alphas.extend([255_u8; Tile::HEIGHT as usize * Tile::WIDTH as usize]);
+                // TODO: Clamp to the scene width instead of u16::MAX; in the future there might
+                // not be clamping on the x.
+                strips.push(Self::new(u16::MAX, y_pos, alphas.len() as u32, true));
+            }
+        });
+    }
+}
+
+/// Render the tiles stored in `tiles` into the strip and alpha buffer.
+pub fn render(
+    level: Level,
+    tiles: &Tiles,
+    strip_buf: &mut Vec<Strip>,
+    alpha_buf: &mut Vec<u8>,
+    fill_rule: Fill,
+    aliasing_threshold: Option<u8>,
+    lines: &[Line],
+) {
+    dispatch!(level, simd => render_impl(simd,
+                                         tiles,
+                                         strip_buf,
+                                         alpha_buf,
+                                         fill_rule,
+                                         aliasing_threshold,
+                                         lines));
+}
+
+#[inline(always)]
+fn render_impl<S: Simd>(
+    s: S,
+    tiles: &Tiles,
+    strip_buf: &mut Vec<Strip>,
+    alpha_buf: &mut Vec<u8>,
+    fill_rule: Fill,
+    aliasing_threshold: Option<u8>,
+    lines: &[Line],
+) {
+    let row_windings = &tiles.windings.coarse;
+    let has_culled_tiles = tiles.has_culled_tiles();
+
+    // If no tiles were culled and the tile buffer is empty, we can simply exit. If tiles were
+    // culled, the tile buffer may be empty but there may be winding produced by culled geometry
+    // left of the viewport that must be checked for filling.
+    if !has_culled_tiles && tiles.is_empty() {
+        return;
+    }
+
+    let should_fill = |winding: i32| match fill_rule {
+        Fill::NonZero => winding != 0,
+        Fill::EvenOdd => winding % 2 != 0,
+    };
+
+    // Helper to handle "captive strips". When a row has tiles, but the first tile
+    // is not at the left edge of the viewport (x != 0), we must emit a solid strip
+    // from x=0 to that tile if the coarse winding dictates a fill.
+    let emit_captive_strip =
+        |y: u16, is_left_viewport: bool, strips: &mut Vec<Strip>, alphas: &mut Vec<u8>| {
+            let coarse_wd = tiles.windings.coarse[y as usize] as i32;
+
+            if should_fill(coarse_wd) && !is_left_viewport {
+                strips.push(Strip::new(0, y * Tile::HEIGHT, alphas.len() as u32, false));
+                alphas.extend([255_u8; Tile::HEIGHT as usize * Tile::WIDTH as usize]);
+            }
+
+            let mut acc = f32x4::splat(s, coarse_wd as f32);
+            if is_left_viewport {
+                let fine_winding: f32x4<_> = tiles.windings.partial[y as usize].simd_into(s);
+                acc += fine_winding;
+            }
+
+            (coarse_wd, acc)
+        };
+
+    // The accumulated tile winding delta. A line that crosses the top edge of a tile
+    // increments the delta if the line is directed upwards, and decrements it if goes
+    // downwards. Horizontal lines leave it unchanged.
+    let mut winding_delta: i32 = 0;
+
+    // The previous tile visited.
+    let mut prev_tile = if has_culled_tiles && tiles.is_empty() {
+        Tile::SENTINEL
+    } else {
+        *tiles.get(0)
+    };
+
+    // The accumulated (fractional) winding of the tile-sized location we're currently at.
+    // Note multiple tiles can be at the same location.
+    // Note that we are also implicitly assuming here that the tile height exactly fits into a
+    // SIMD vector (i.e. 128 bits).
+    let mut location_winding = [f32x4::splat(s, 0.0); Tile::WIDTH as usize];
+    // The accumulated (fractional) windings at this location's right edge. When we move to the
+    // next location, this is splatted to that location's starting winding.
+    let mut accumulated_winding = f32x4::splat(s, 0.0);
+
+    let left_viewport = prev_tile.x == 0;
+    if has_culled_tiles {
+        let row_max = prev_tile.y.min(row_windings.len() as u16);
+        Strip::emit_culled_background(
+            0,
+            row_max,
+            strip_buf,
+            alpha_buf,
+            &tiles.windings,
+            should_fill,
+        );
+        if tiles.is_empty() {
+            return;
+        }
+        let (wd, acc) = emit_captive_strip(prev_tile.y, left_viewport, strip_buf, alpha_buf);
+        winding_delta = wd;
+        accumulated_winding = acc;
+        location_winding = [accumulated_winding; Tile::WIDTH as usize];
+    }
+
+    // The strip we're building.
+    let mut strip = Strip::new(
+        prev_tile.x * Tile::WIDTH,
+        prev_tile.y * Tile::HEIGHT,
+        alpha_buf.len() as u32,
+        should_fill(winding_delta) && !left_viewport,
+    );
+
+    for (tile_idx, tile) in tiles.iter().copied().chain([Tile::SENTINEL]).enumerate() {
+        let line = lines[tile.line_idx() as usize];
+        let tile_left_x = f32::from(tile.x) * f32::from(Tile::WIDTH);
+        let tile_top_y = f32::from(tile.y) * f32::from(Tile::HEIGHT);
+        let p0_x = line.p0.x - tile_left_x;
+        let p0_y = line.p0.y - tile_top_y;
+        let p1_x = line.p1.x - tile_left_x;
+        let p1_y = line.p1.y - tile_top_y;
+
+        // Push out the winding as an alpha mask when we move to the next location (i.e., a tile
+        // without the same location).
+        if !prev_tile.same_loc(&tile) {
+            match fill_rule {
+                Fill::NonZero => {
+                    let p1 = f32x4::splat(s, 0.5);
+                    let p2 = f32x4::splat(s, 255.0);
+
+                    #[expect(clippy::needless_range_loop, reason = "dimension clarity")]
+                    for x in 0..Tile::WIDTH as usize {
+                        let area = location_winding[x];
+                        let coverage = area.abs();
+                        let mulled = coverage.mul_add(p2, p1);
+                        // Note that we are not storing the location winding here but the actual
+                        // alpha value as f32, so we reuse the variable as a temporary storage.
+                        // Also note that we need the `min` here because the winding can be > 1
+                        // and thus the calculated alpha value need to be clamped to 255.
+                        location_winding[x] = mulled.min(p2);
+                    }
+                }
+                Fill::EvenOdd => {
+                    let p1 = f32x4::splat(s, 0.5);
+                    let p2 = f32x4::splat(s, -2.0);
+                    let p3 = f32x4::splat(s, 255.0);
+
+                    #[expect(clippy::needless_range_loop, reason = "dimension clarity")]
+                    for x in 0..Tile::WIDTH as usize {
+                        let area = location_winding[x];
+                        let im1 = area.mul_add(p1, p1).floor();
+                        let coverage = p2.mul_add(im1, area).abs();
+                        let mulled = p3.mul_add(coverage, p1);
+                        // TODO: It is possible that, unlike for `NonZero`, we don't need the `min`
+                        // here.
+                        location_winding[x] = mulled.min(p3);
+                    }
+                }
+            };
+
+            let p1 = s.combine_f32x4(location_winding[0], location_winding[1]);
+            let p2 = s.combine_f32x4(location_winding[2], location_winding[3]);
+
+            let mut u8_vals = f32_to_u8(s.combine_f32x8(p1, p2));
+
+            if let Some(aliasing_threshold) = aliasing_threshold {
+                u8_vals = s.select_u8x16(
+                    u8_vals.simd_ge(u8x16::splat(s, aliasing_threshold)),
+                    u8x16::splat(s, 255),
+                    u8x16::splat(s, 0),
+                );
+            }
+
+            alpha_buf.extend_from_slice(u8_vals.as_slice());
+
+            #[expect(clippy::needless_range_loop, reason = "dimension clarity")]
+            for x in 0..Tile::WIDTH as usize {
+                location_winding[x] = accumulated_winding;
+            }
+        }
+
+        // Push out the strip if we're moving to a next strip.
+        if !prev_tile.same_loc(&tile) && !prev_tile.prev_loc(&tile) {
+            debug_assert_eq!(
+                (prev_tile.x as u32 + 1) * Tile::WIDTH as u32 - strip.x as u32,
+                ((alpha_buf.len() - strip.alpha_idx() as usize) / usize::from(Tile::HEIGHT)) as u32,
+                "The number of columns written to the alpha buffer should equal the number of columns spanned by this strip."
+            );
+            strip_buf.push(strip);
+
+            let is_sentinel = tile_idx == tiles.len() as usize;
+            let left_viewport = tile.x == 0;
+            if !prev_tile.same_row(&tile) {
+                // Emit a final strip in the row if there is non-zero winding for the sparse fill,
+                // or unconditionally if we've reached the sentinel tile to end the path (the
+                // `alpha_idx` field is used for width calculations).
+                if winding_delta != 0 || is_sentinel {
+                    strip_buf.push(Strip::new(
+                        u16::MAX,
+                        prev_tile.y * Tile::HEIGHT,
+                        alpha_buf.len() as u32,
+                        should_fill(winding_delta),
+                    ));
+                }
+
+                // Logic identical to the start (see above): fill any vertical gaps (empty rows)
+                // between the previous and current tile using the row windings.
+                if has_culled_tiles && !is_sentinel {
+                    Strip::emit_culled_background(
+                        prev_tile.y + 1,
+                        tile.y,
+                        strip_buf,
+                        alpha_buf,
+                        &tiles.windings,
+                        should_fill,
+                    );
+
+                    let (wd, acc) = emit_captive_strip(tile.y, left_viewport, strip_buf, alpha_buf);
+                    winding_delta = wd;
+                    accumulated_winding = acc;
+                } else {
+                    winding_delta = 0;
+                    accumulated_winding = f32x4::splat(s, 0.0);
+                };
+
+                #[expect(clippy::needless_range_loop, reason = "dimension clarity")]
+                for x in 0..Tile::WIDTH as usize {
+                    location_winding[x] = accumulated_winding;
+                }
+            } else {
+                // Note: this fill is mathematically not necessary. It provides a way to reduce
+                // accumulation of float rounding errors.
+                accumulated_winding = f32x4::splat(s, winding_delta as f32);
+            }
+
+            if is_sentinel {
+                break;
+            }
+
+            strip = Strip::new(
+                tile.x * Tile::WIDTH,
+                tile.y * Tile::HEIGHT,
+                alpha_buf.len() as u32,
+                should_fill(winding_delta) && !left_viewport,
+            );
+        }
+        prev_tile = tile;
+
+        // TODO: horizontal geometry has no impact on winding. This branch will be removed when
+        // horizontal geometry is culled at the tile-generation stage.
+        if p0_y == p1_y {
+            continue;
+        }
+
+        // Lines moving upwards (in a y-down coordinate system) add to winding; lines moving
+        // downwards subtract from winding.
+        let sign = (p0_y - p1_y).signum();
+
+        // Calculate winding / pixel area coverage.
+        //
+        // Conceptually, horizontal rays are shot from left to right. Every time the ray crosses a
+        // line that is directed upwards (decreasing `y`), the winding is incremented. Every time
+        // the ray crosses a line moving downwards (increasing `y`), the winding is decremented.
+        // The fractional area coverage of a pixel is the integral of the winding within it.
+        //
+        // Practically, to calculate this, each pixel is considered individually, and we determine
+        // whether the line moves through this pixel. The line's y-delta within this pixel is
+        // accumulated and added to the area coverage of pixels to the right. Within the pixel
+        // itself, the area to the right of the line segment forms a trapezoid (or a triangle in
+        // the degenerate case). The area of this trapezoid is added to the pixel's area coverage.
+        //
+        // For example, consider the following pixel square, with a line indicated by asterisks
+        // starting inside the pixel and crossing its bottom edge. The area covered is the
+        // trapezoid on the bottom-right enclosed by the line and the pixel square. The area is
+        // positive if the line moves down, and negative otherwise.
+        //
+        //  __________________
+        //  |                |
+        //  |         *------|
+        //  |        *       |
+        //  |       *        |
+        //  |      *         |
+        //  |     *          |
+        //  |    *           |
+        //  |___*____________|
+        //     *
+        //    *
+
+        let (line_top_y, line_top_x, line_bottom_y, line_bottom_x) = if p0_y < p1_y {
+            (p0_y, p0_x, p1_y, p1_x)
+        } else {
+            (p1_y, p1_x, p0_y, p0_x)
+        };
+
+        let y_slope = (line_bottom_y - line_top_y) / (line_bottom_x - line_top_x);
+        let x_slope = 1. / y_slope;
+
+        winding_delta += sign as i32 * i32::from(tile.winding());
+
+        let line_top_y = f32x4::splat(s, line_top_y);
+        let line_bottom_y = f32x4::splat(s, line_bottom_y);
+
+        // See the explanation of this term on the `line_px_left_yx` and `line_px_right_yx`
+        // variables below.
+        let line_px_base_yx = line_top_y.mul_add(-x_slope, line_top_x);
+
+        let px_top_y = f32x4::simd_from(s, [0., 1., 2., 3.]);
+        let px_bottom_y = 1. + px_top_y;
+
+        let ymin = line_top_y.max(px_top_y);
+        let ymax = line_bottom_y.min(px_bottom_y);
+
+        let mut acc = f32x4::splat(s, 0.0);
+
+        for x_idx in 0..Tile::WIDTH {
+            let x_idx_s = f32x4::splat(s, x_idx as f32);
+            let px_left_x = x_idx_s;
+            let px_right_x = 1.0 + x_idx_s;
+
+            // The y-coordinate of the intersections between the line and the pixel's left and
+            // right edges respectively.
+            //
+            // There is some subtlety going on here: `y_slope` will usually be finite, but will
+            // be `inf` for purely vertical lines (`p0_x == p1_x`).
+            //
+            // In the case of `inf`, the resulting slope calculation will be `-inf` or `inf`
+            // depending on whether the pixel edge is left or right of the line, respectively
+            // (from the viewport's coordinate system perspective). The `min` and `max`
+            // y-clamping logic generalizes nicely, as a pixel edge to the left of the line is
+            // clamped to `ymin`, and a pixel edge to the right is clamped to `ymax`.
+            //
+            // In the special case where a vertical line and pixel edge are at the exact same
+            // x-position (collinear), the line belongs to the pixel on whose _left_ edge it is
+            // situated. The resulting slope calculation for the edge the line is situated on
+            // will be NaN, as `0 * inf` results in NaN. This is true for both the left and
+            // right edge.
+            //
+            // We know `ymin` and `ymax` are finite. We require the `max` operation to pick `ymin`
+            // if its first operand is NaN. On x86, that maps to the semantics of `_mm_max_ps`,
+            // which `f32x4::max` emits: that instruction takes element-wise
+            // `if first > second { first } else { second }`. For AArch64, we do require the
+            // `f32x4::max_precise` semantics (as `vmax_f32` returns NaN if either operand is NaN);
+            // however, for AArch64 the precise version should be comparatively less expensive than
+            // on x86. For `min`, we then know both operands are finite, so we can unambiguously
+            // use the relaxed version. If this ever breaks, tests should fail loudly, because NaNs
+            // happen a lot here!
+            trait F32x4MaxExt {
+                fn max_if_first_nan_take_second(self, rhs: Self) -> Self;
+            }
+            #[cfg(any(target_arch = "x86", target_arch = "x86_64"))]
+            impl<S: Simd> F32x4MaxExt for f32x4<S> {
+                #[inline(always)]
+                fn max_if_first_nan_take_second(self, rhs: Self) -> Self {
+                    self.max(rhs)
+                }
+            }
+            #[cfg(not(any(target_arch = "x86", target_arch = "x86_64")))]
+            impl<S: Simd> F32x4MaxExt for f32x4<S> {
+                #[inline(always)]
+                fn max_if_first_nan_take_second(self, rhs: Self) -> Self {
+                    self.max_precise(rhs)
+                }
+            }
+            let line_px_left_y = (px_left_x - line_top_x)
+                .mul_add(y_slope, line_top_y)
+                .max_if_first_nan_take_second(ymin)
+                .min(ymax);
+            let line_px_right_y = (px_right_x - line_top_x)
+                .mul_add(y_slope, line_top_y)
+                .max_if_first_nan_take_second(ymin)
+                .min(ymax);
+
+            // For each pixel we calculate the x-coordinates of the left- and rightmost points on
+            // the line segment within that pixel. We do this based on the y-offsets of those two
+            // points from the top of the line. This can be calculated as, e.g.,
+            // `(line_px_left_y - line_top_y) * x_slope + line_top_x`.
+            //
+            // Rather than calculating that y-offset twice for each pixel within the loop through
+            // subtracting from the points' y-coordinates, we get rid of that subtraction by baking
+            // it into the algebraic "base" x-coordinate `line_px_base_yx` calculated above the
+            // loop. When adding that term to `y * x_slope` it gives the x-coordinate of the point
+            // along the line.
+            //
+            // Note `x_slope` is always finite, as horizontal geometry is elided.
+            let line_px_left_yx = line_px_left_y.mul_add(x_slope, line_px_base_yx);
+            let line_px_right_yx = line_px_right_y.mul_add(x_slope, line_px_base_yx);
+            let h = (line_px_right_y - line_px_left_y).abs();
+
+            // The trapezoidal area enclosed between the line and the right edge of the pixel
+            // square. More straightforwardly written as follows, but the `madd` is faster.
+            // 0.5 * h * (2. * px_right_x - line_px_right_yx - line_px_left_yx).
+            let area = h * (line_px_right_yx + line_px_left_yx).mul_add(-0.5, px_right_x);
+            location_winding[x_idx as usize] += area.mul_add(sign, acc);
+            acc = h.mul_add(sign, acc);
+        }
+
+        accumulated_winding += acc;
+    }
+
+    if has_culled_tiles {
+        Strip::emit_culled_background(
+            (prev_tile.y + 1).min(row_windings.len() as u16),
+            row_windings.len() as u16,
+            strip_buf,
+            alpha_buf,
+            &tiles.windings,
+            should_fill,
+        );
+    }
+}
diff --git a/vendor/vello_common/src/strip_generator.rs b/vendor/vello_common/src/strip_generator.rs
new file mode 100644
index 000000000..9a8bfc237
--- /dev/null
+++ b/vendor/vello_common/src/strip_generator.rs
@@ -0,0 +1,440 @@
+// Copyright 2025 the Vello Authors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+//! Abstraction for generating strips from paths.
+
+use crate::clip::{PathDataRef, intersect};
+use crate::fearless_simd::Level;
+use crate::flatten::{FlattenCtx, Line};
+use crate::geometry::RectU16;
+use crate::kurbo::{Affine, PathEl, Rect, Stroke};
+use crate::peniko::Fill;
+use crate::strip::Strip;
+use crate::tile::Tiles;
+use crate::{flatten, rect, strip};
+use alloc::vec::Vec;
+use peniko::kurbo::StrokeCtx;
+
+/// A storage for storing strip-related data.
+#[derive(Debug, Default, PartialEq, Eq)]
+pub struct StripStorage {
+    /// The strips in the storage.
+    pub strips: Vec<Strip>,
+    /// The alphas in the storage.
+    pub alphas: Vec<u8>,
+    generation_mode: GenerationMode,
+}
+
+/// The generation mode of the strip storage.
+#[derive(Debug, Default, Copy, Clone, PartialEq, Eq)]
+pub enum GenerationMode {
+    #[default]
+    /// Clear strips before generating the new ones.
+    Replace,
+    /// Don't clear strips, append to the existing buffer.
+    Append,
+    /// Truncate strips to the given index before generating new ones,
+    /// preserving strips in `[0..n]`.
+    ReplaceAfter(usize),
+}
+
+impl StripStorage {
+    /// Create a new strip storage with the given generation mode.
+    pub fn new(generation_mode: GenerationMode) -> Self {
+        Self {
+            strips: Vec::new(),
+            alphas: Vec::new(),
+            generation_mode,
+        }
+    }
+
+    /// Reset the storage.
+    pub fn clear(&mut self) {
+        self.strips.clear();
+        self.alphas.clear();
+    }
+
+    /// Get the current generation mode.
+    pub fn generation_mode(&self) -> GenerationMode {
+        self.generation_mode
+    }
+
+    /// Set the generation mode of the storage.
+    pub fn set_generation_mode(&mut self, mode: GenerationMode) {
+        self.generation_mode = mode;
+    }
+
+    /// Whether the strip storage is empty.
+    pub fn is_empty(&self) -> bool {
+        self.strips.is_empty() && self.alphas.is_empty()
+    }
+
+    /// Extend the current strip storage with the data from another storage.
+    pub fn extend(&mut self, other: &Self) {
+        self.strips.extend(&other.strips);
+        self.alphas.extend(&other.alphas);
+    }
+}
+
+/// An object for easily generating strips for a filled/stroked path.
+#[derive(Debug)]
+pub struct StripGenerator {
+    pub(crate) level: Level,
+    line_buf: Vec<Line>,
+    flatten_ctx: FlattenCtx,
+    stroke_ctx: StrokeCtx,
+    temp_storage: StripStorage,
+    tiles: Tiles,
+    width: u16,
+    height: u16,
+}
+
+impl StripGenerator {
+    /// Create a new strip generator.
+    pub fn new(width: u16, height: u16, level: Level) -> Self {
+        Self {
+            level,
+            line_buf: Vec::new(),
+            tiles: Tiles::new(level, height),
+            flatten_ctx: FlattenCtx::default(),
+            stroke_ctx: StrokeCtx::default(),
+            temp_storage: StripStorage::default(),
+            width,
+            height,
+        }
+    }
+
+    /// Get this strip generator's viewport width.
+    #[inline(always)]
+    pub fn width(&self) -> u16 {
+        self.width
+    }
+
+    /// Get this strip generator's viewport height.
+    #[inline(always)]
+    pub fn height(&self) -> u16 {
+        self.height
+    }
+
+    /// Generate the strips for a filled path.
+    pub fn generate_filled_path(
+        &mut self,
+        path: impl IntoIterator<Item = PathEl>,
+        fill_rule: Fill,
+        transform: Affine,
+        aliasing_threshold: Option<u8>,
+        strip_storage: &mut StripStorage,
+        clip_path: Option<PathDataRef<'_>>,
+    ) {
+        let cull_bbox = clip_path
+            .map(|clip_path| clip_path.bbox)
+            .unwrap_or(RectU16::new(0, 0, self.width, self.height));
+        flatten::fill(
+            self.level,
+            path,
+            transform,
+            &mut self.line_buf,
+            &mut self.flatten_ctx,
+            cull_bbox,
+        );
+
+        self.generate_with_clip(aliasing_threshold, strip_storage, fill_rule, clip_path);
+    }
+
+    /// Generate the strips for a stroked path.
+    pub fn generate_stroked_path(
+        &mut self,
+        path: impl IntoIterator<Item = PathEl>,
+        stroke: &Stroke,
+        transform: Affine,
+        aliasing_threshold: Option<u8>,
+        strip_storage: &mut StripStorage,
+        clip_path: Option<PathDataRef<'_>>,
+    ) {
+        let cull_bbox = clip_path
+            .map(|clip_path| clip_path.bbox)
+            .unwrap_or(RectU16::new(0, 0, self.width, self.height));
+        flatten::stroke(
+            self.level,
+            path,
+            stroke,
+            transform,
+            &mut self.line_buf,
+            &mut self.flatten_ctx,
+            &mut self.stroke_ctx,
+            cull_bbox,
+        );
+        self.generate_with_clip(aliasing_threshold, strip_storage, Fill::NonZero, clip_path);
+    }
+
+    fn generate_with_clip(
+        &mut self,
+        aliasing_threshold: Option<u8>,
+        strip_storage: &mut StripStorage,
+        fill_rule: Fill,
+        clip_path: Option<PathDataRef<'_>>,
+    ) {
+        self.tiles
+            .make_tiles_analytic_aa(self.level, &self.line_buf, self.width, self.height);
+
+        self.tiles.sort_tiles();
+
+        let level = self.level;
+        let tiles = &self.tiles;
+        let line_buf = &self.line_buf;
+        render_with_clip(
+            level,
+            &mut self.temp_storage,
+            strip_storage,
+            clip_path,
+            |strips, alphas| {
+                strip::render(
+                    level,
+                    tiles,
+                    strips,
+                    alphas,
+                    fill_rule,
+                    aliasing_threshold,
+                    line_buf,
+                );
+            },
+        );
+    }
+
+    /// Generate strips directly for a pixel-aligned rectangle.
+    ///
+    /// This bypasses the full path processing pipeline (flatten -> tiles -> strips)
+    /// by directly creating strip coverage data for the rectangle.
+    pub fn generate_filled_rect_fast(
+        &mut self,
+        rect: &Rect,
+        strip_storage: &mut StripStorage,
+        clip_path: Option<PathDataRef<'_>>,
+    ) {
+        let viewport = Rect::new(0.0, 0.0, self.width as f64, self.height as f64);
+        let clip_bbox = clip_path
+            .map(|clip| {
+                // Clip bbox is always guaranteed to be within viewport bounds, so no need to
+                // intersect again.
+                Rect::new(
+                    f64::from(clip.bbox.x0),
+                    f64::from(clip.bbox.y0),
+                    f64::from(clip.bbox.x1),
+                    f64::from(clip.bbox.y1),
+                )
+            })
+            .unwrap_or(viewport);
+        let clamped = rect.abs().intersect(clip_bbox);
+
+        let level = self.level;
+        render_with_clip(
+            level,
+            &mut self.temp_storage,
+            strip_storage,
+            clip_path,
+            |strips, alphas| {
+                rect::render(level, clamped, strips, alphas);
+            },
+        );
+    }
+
+    /// Reset the strip generator.
+    pub fn reset(&mut self) {
+        self.line_buf.clear();
+        self.tiles.reset();
+        self.temp_storage.clear();
+    }
+}
+
+/// Render strips via `render_fn` with optional clip intersection.
+///
+/// When `clip_path` is `Some`, strips are rendered into `temp_storage` first, then
+/// intersected with the clip mask into `strip_storage`. Otherwise strips are rendered
+/// directly into `strip_storage`.
+fn render_with_clip(
+    level: Level,
+    temp_storage: &mut StripStorage,
+    strip_storage: &mut StripStorage,
+    clip_path: Option<PathDataRef<'_>>,
+    render_fn: impl FnOnce(&mut Vec<Strip>, &mut Vec<u8>),
+) {
+    match strip_storage.generation_mode {
+        GenerationMode::Replace => strip_storage.strips.clear(),
+        GenerationMode::Append => {}
+        GenerationMode::ReplaceAfter(n) => strip_storage.strips.truncate(n),
+    }
+
+    if let Some(clip_path) = clip_path {
+        temp_storage.clear();
+
+        render_fn(&mut temp_storage.strips, &mut temp_storage.alphas);
+
+        let path_data = PathDataRef {
+            strips: &temp_storage.strips,
+            alphas: &temp_storage.alphas,
+            bbox: RectU16::new(0, 0, u16::MAX, u16::MAX),
+        };
+        intersect(level, clip_path, path_data, strip_storage);
+    } else {
+        render_fn(&mut strip_storage.strips, &mut strip_storage.alphas);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use alloc::format;
+
+    use crate::fearless_simd::Level;
+    use crate::kurbo::{Affine, Rect, Shape};
+    use crate::peniko::Fill;
+    use crate::strip_generator::{StripGenerator, StripStorage};
+
+    #[test]
+    fn reset() {
+        let mut generator = StripGenerator::new(100, 100, Level::baseline());
+        let mut storage = StripStorage::default();
+        let rect = Rect::new(0.0, 0.0, 100.0, 100.0);
+
+        generator.generate_filled_path(
+            rect.to_path(0.1),
+            Fill::NonZero,
+            Affine::IDENTITY,
+            None,
+            &mut storage,
+            None,
+        );
+
+        assert!(!generator.line_buf.is_empty());
+        assert!(!storage.is_empty());
+
+        generator.reset();
+        storage.clear();
+
+        assert!(generator.line_buf.is_empty());
+        assert!(storage.is_empty());
+    }
+
+    /// Assert that `generate_filled_rect_fast` produces the same strips as the
+    /// path-based pipeline for the given rectangle.
+    fn assert_rect_fast_eq_path(rect: Rect, test_name: &str) {
+        let mut generator = StripGenerator::new(100, 100, Level::baseline());
+        let mut storage_path = StripStorage::default();
+        let mut storage_rect = StripStorage::default();
+
+        generator.generate_filled_path(
+            rect.to_path(0.1),
+            Fill::NonZero,
+            Affine::IDENTITY,
+            None,
+            &mut storage_path,
+            None,
+        );
+        generator.reset();
+
+        generator.generate_filled_rect_fast(&rect, &mut storage_rect, None);
+
+        assert_eq!(
+            storage_path.strips, storage_rect.strips,
+            "{test_name}: strips mismatch",
+        );
+        assert_eq!(
+            storage_path.alphas, storage_rect.alphas,
+            "{test_name}: alphas mismatch",
+        );
+    }
+
+    #[test]
+    fn rect_small_single_tile() {
+        assert_rect_fast_eq_path(Rect::new(1.0, 1.0, 3.0, 3.0), "small_single_tile");
+    }
+
+    #[test]
+    fn rect_spanning_multiple_tiles_horizontally() {
+        assert_rect_fast_eq_path(Rect::new(2.0, 1.0, 14.0, 3.0), "spanning_horizontal");
+    }
+
+    #[test]
+    fn rect_spanning_multiple_tiles_vertically() {
+        assert_rect_fast_eq_path(Rect::new(1.0, 2.0, 3.0, 14.0), "spanning_vertical");
+    }
+
+    #[test]
+    fn rect_spanning_multiple_tiles_both_directions() {
+        assert_rect_fast_eq_path(Rect::new(2.0, 2.0, 18.0, 18.0), "spanning_both");
+    }
+
+    #[test]
+    fn rect_tile_aligned() {
+        assert_rect_fast_eq_path(Rect::new(0.0, 0.0, 8.0, 8.0), "tile_aligned");
+    }
+
+    #[test]
+    fn rect_one_pixel_wide() {
+        assert_rect_fast_eq_path(Rect::new(5.0, 2.0, 6.0, 12.0), "one_pixel_wide");
+    }
+
+    #[test]
+    fn rect_one_pixel_tall() {
+        assert_rect_fast_eq_path(Rect::new(2.0, 5.0, 12.0, 6.0), "one_pixel_tall");
+    }
+
+    #[test]
+    fn rect_fractional_within_single_tile() {
+        let cases: &[(f64, f64, f64, f64)] = &[
+            (0.25, 0.75, 2.5, 3.5),
+            (1.2, 1.3, 1.8, 1.7),
+            (0.1, 0.1, 3.9, 3.9),
+            (2.5, 2.5, 2.6, 2.6),
+            (0.01, 0.99, 3.99, 3.01),
+        ];
+        for (i, &(x0, y0, x1, y1)) in cases.iter().enumerate() {
+            assert_rect_fast_eq_path(Rect::new(x0, y0, x1, y1), &format!("single_tile_{i}"));
+        }
+    }
+
+    #[test]
+    fn rect_fractional_multi_tile() {
+        let cases: &[(f64, f64, f64, f64)] = &[
+            (1.5, 2.3, 10.7, 8.9),
+            (0.5, 0.5, 8.5, 8.5),
+            (2.3, 5.1, 15.7, 5.9),
+            (5.1, 2.3, 5.9, 15.7),
+            (0.25, 0.25, 12.75, 12.75),
+            (1.0 / 3.0, 2.0 / 3.0, 10.33, 8.67),
+            (1.99, 2.01, 9.01, 7.99),
+            (3.9, 3.9, 8.1, 8.1),
+            (3.2, 6.3, 14.8, 6.7),
+            (6.3, 3.2, 6.7, 14.8),
+            (0.1, 0.9, 49.9, 49.1),
+            (4.0, 2.7, 12.0, 9.3),
+            (2.7, 4.0, 9.3, 12.0),
+            (1.5, 1.2, 10.5, 2.8),
+            (1.5, 2.5, 14.5, 18.5),
+            (0.7, 0.3, 30.2, 25.8),
+            (7.9, 7.9, 8.1, 8.1),
+            (3.5, 0.5, 4.5, 0.9),
+            (0.01, 0.01, 99.99, 99.99),
+            (10.0, 10.0, 10.1, 10.1),
+        ];
+        for (i, &(x0, y0, x1, y1)) in cases.iter().enumerate() {
+            assert_rect_fast_eq_path(Rect::new(x0, y0, x1, y1), &format!("multi_tile_{i}"));
+        }
+    }
+
+    #[test]
+    fn rect_fractional_exhaustive() {
+        for xi in 0..100_u32 {
+            for yi in 0..100_u32 {
+                let dx = xi as f64 * 0.01;
+                let dy = yi as f64 * 0.01;
+                let rect = Rect::new(dx, dy, 50.0 + dx, 50.0 + dy);
+                assert_rect_fast_eq_path(rect, &format!("exhaustive_{dx}_{dy}"));
+            }
+        }
+    }
+
+    #[test]
+    fn rect_inverted_both_axes() {
+        assert_rect_fast_eq_path(Rect::new(18.0, 18.0, 2.0, 2.0), "inverted_both_axes");
+    }
+}
diff --git a/vendor/vello_common/src/tile.rs b/vendor/vello_common/src/tile.rs
new file mode 100644
index 000000000..92e3da418
--- /dev/null
+++ b/vendor/vello_common/src/tile.rs
@@ -0,0 +1,2426 @@
+// Copyright 2025 the Vello Authors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+//! Primitives for creating tiles.
+
+use crate::flatten::Line;
+use alloc::vec;
+use alloc::vec::Vec;
+use fearless_simd::*;
+#[cfg(not(feature = "std"))]
+use peniko::kurbo::common::FloatFuncs as _;
+
+/// T-op bit
+const T: u32 = 0b00001;
+/// B-ottom bit
+const B: u32 = 0b00010;
+/// L-eft bit
+const L: u32 = 0b00100;
+/// R-ight bit
+const R: u32 = 0b01000;
+/// W-inding bit
+const W: u32 = 0b10000;
+
+/// Shift amount corresponding to the bottom bit.
+const BOT_SHIFT: u32 = B.trailing_zeros();
+/// Shift amount corresponding to the left bit.
+const LEFT_SHIFT: u32 = L.trailing_zeros();
+/// Shift amount corresponding to the right bit.
+const RIGHT_SHIFT: u32 = R.trailing_zeros();
+/// Shift amount corresponding to the winding bit.
+const WINDING_SHIFT: u32 = W.trailing_zeros();
+
+/// Mask for all intersection and winding bits (Bits 0-4).
+const INTERSECTION_MASK: u32 = W | R | L | B | T;
+/// Shift amount corresponding to the intersection bits.
+const INT_MASK_SHIFT: u32 = INTERSECTION_MASK.count_ones();
+
+/// The max number of lines per path.
+///
+/// Trying to render a path with more lines than this may result in visual artifacts.
+pub const MAX_LINES_PER_PATH: u32 = 1 << (32 - INT_MASK_SHIFT);
+
+/// A logical grouping of arrays used for culled tile processing,
+#[derive(Debug, Clone, Default)]
+pub struct CulledWindings {
+    /// Fractional winding coverage for each individual scanline in a row.
+    pub partial: Vec<[f32; Tile::HEIGHT as usize]>,
+    // Note that this will cause issues if we have windings greater/less than i8,
+    // but this should only occur in pathological cases.
+    /// Accumulated integer winding deltas for each tile row.
+    pub coarse: Vec<i8>,
+    /// Bitmask tracking which rows contain active geometry or winding data.
+    pub active: Vec<u32>,
+    /// Flag indicating if any geometry was early-culled outside the viewport.
+    pub culled: bool,
+}
+
+impl CulledWindings {
+    /// Number of bits in a single active mask word.
+    const WORD_BITS: usize = 32;
+    /// Bit shift equivalent to dividing by `WORD_BITS` (2^5 = 32).
+    const WORD_SHIFT: usize = 5;
+    /// Bitmask equivalent to modulo `WORD_BITS` (32 - 1 = 31).
+    const WORD_MASK: usize = 31;
+
+    /// Constructor chained to `Tiles`' constructor and matches its lifetime. Since `Tiles` itself
+    /// matches the lifetime of `StripGenerator`, we know that the viewport dimensions will never
+    /// change, and thus the backing vecs never need to be resized. (For now).
+    pub fn new(height: u16) -> Self {
+        let height_usize = height as usize;
+        let tile_height = Tile::HEIGHT as usize;
+        let num_rows = height_usize.div_ceil(tile_height);
+        let num_bits = num_rows.div_ceil(Self::WORD_BITS);
+
+        Self {
+            partial: vec![[0.0; Tile::HEIGHT as usize]; num_rows],
+            coarse: vec![0; num_rows],
+            active: vec![0; num_bits],
+            culled: false,
+        }
+    }
+
+    /// Clears but does not resize
+    pub fn reset(&mut self) {
+        // TODO: Maybe consider tracking touched regions and only resetting those
+        // instead of always the full array?
+        if self.culled {
+            self.partial.fill([0.0; Tile::HEIGHT as usize]);
+            self.coarse.fill(0);
+            self.active.fill(0);
+            self.culled = false;
+        }
+    }
+
+    /// Marks if a row was culled early for faster traversal in strip generation.
+    #[inline(always)]
+    pub fn mark_row_active(&mut self, row_idx: usize) {
+        self.active[row_idx >> Self::WORD_SHIFT] |= 1 << (row_idx & Self::WORD_MASK);
+    }
+
+    /// Bulk marks a range of rows as active [`start_row`, `end_row`).
+    #[inline(always)]
+    pub fn mark_row_range_active(&mut self, start_row: usize, end_row: usize) {
+        if start_row >= end_row {
+            return;
+        }
+
+        let start_word = start_row >> Self::WORD_SHIFT;
+        let end_word = (end_row - 1) >> Self::WORD_SHIFT;
+
+        if start_word == end_word {
+            // All bits fall within the same u32 word
+            let shift = start_row & Self::WORD_MASK;
+            let count = end_row - start_row;
+            let mask = if count == Self::WORD_BITS {
+                u32::MAX
+            } else {
+                ((1_u32 << count) - 1) << shift
+            };
+            self.active[start_word] |= mask;
+        } else {
+            // Bits span multiple words: handle start, full middle words, and end
+            self.active[start_word] |= u32::MAX << (start_row & Self::WORD_MASK);
+
+            self.active[(start_word + 1)..end_word].fill(u32::MAX);
+
+            let end_shift = ((end_row - 1) & Self::WORD_MASK) + 1;
+            let mask = if end_shift == Self::WORD_BITS {
+                u32::MAX
+            } else {
+                (1_u32 << end_shift) - 1
+            };
+            self.active[end_word] |= mask;
+        }
+    }
+
+    /// Calls `f` on active rows in the range [`start`, `end`).
+    #[inline(always)]
+    pub fn for_active_rows_in_range<F>(&self, start: usize, end: usize, mut f: F)
+    where
+        F: FnMut(usize),
+    {
+        if start >= end {
+            return;
+        }
+
+        let start_word = start >> Self::WORD_SHIFT;
+        let end_word = (end - 1) >> Self::WORD_SHIFT;
+
+        let mut process_word = |mut word: u32, word_idx: usize| {
+            while word != 0 {
+                let bit = word.trailing_zeros();
+                word &= !(1_u32 << bit);
+                f((word_idx << Self::WORD_SHIFT) + bit as usize);
+            }
+        };
+
+        let end_limit = ((end - 1) & Self::WORD_MASK) + 1;
+        let end_mask = if end_limit == Self::WORD_BITS {
+            u32::MAX
+        } else {
+            (1_u32 << end_limit) - 1
+        };
+
+        // Start Word
+        {
+            let mut word = self.active[start_word];
+            let start_bit = start & Self::WORD_MASK;
+            word &= !((1_u32 << start_bit) - 1);
+
+            if start_word == end_word {
+                word &= end_mask;
+            }
+
+            process_word(word, start_word);
+        }
+
+        // Middle Words & End Word
+        if start_word < end_word {
+            for (word_idx, &word_val) in self
+                .active
+                .iter()
+                .enumerate()
+                .take(end_word)
+                .skip(start_word + 1)
+            {
+                process_word(word_val, word_idx);
+            }
+
+            // End Word
+            process_word(self.active[end_word] & end_mask, end_word);
+        }
+    }
+}
+
+/// A tile represents an aligned area on the pixmap, used to subdivide the viewport into sub-areas
+/// (currently 4x4) and analyze line intersections inside each such area.
+///
+/// Keep in mind that it is possible to have multiple tiles with the same index,
+/// namely if we have multiple lines crossing the same 4x4 area!
+///
+/// # Note
+///
+/// This struct is `#[repr(C)]`, but the byte order of its fields is dependent on the endianness of
+/// the compilation target.
+#[derive(Debug, Clone, Copy)]
+#[repr(C)]
+pub struct Tile {
+    // The field ordering is important.
+    //
+    // The given ordering (variant over little and big endian compilation targets), ensures that
+    // `Tile::to_bits` doesn't do any actual work, as the ordering of the fields is such that the
+    // numeric value of a `Tile` in memory is identical as returned by that method. This allows
+    // for, e.g., comparison and sorting.
+    #[cfg(target_endian = "big")]
+    /// The index of the tile in the y direction.
+    pub y: u16,
+
+    #[cfg(target_endian = "big")]
+    /// The index of the tile in the x direction.
+    pub x: u16,
+
+    /// The index of the line this tile belongs to into the line buffer, intersection data,
+    /// and winding data packed together.
+    ///
+    /// The layout is:
+    /// - **Bits 0-4 (5 bits):** Intersection and Winding Mask (`W | R | L | B | T`).
+    ///   - Bit 0 (mask `0b00001`): Intersects top edge (T)
+    ///   - Bit 1 (mask `0b00010`): Intersects bottom edge (B)
+    ///   - Bit 2 (mask `0b00100`): Intersects left edge (L)
+    ///   - Bit 3 (mask `0b01000`): Intersects right edge (R)
+    ///   - Bit 4 (mask `0b10000`): Winding (W) - 1 if crosses top edge.
+    /// - **Bits 5-31 (27 bits):** The line index (`line_idx`).
+    ///
+    /// **Sorting Note:** The `line_idx` occupies the higher bits to ensure that when sorting
+    /// tiles with the same (x, y) coordinates, they are sorted by their line index first,
+    /// and then by their intersection mask.
+    pub packed_winding_line_idx: u32,
+
+    #[cfg(target_endian = "little")]
+    /// The index of the tile in the x direction.
+    pub x: u16,
+
+    #[cfg(target_endian = "little")]
+    /// The index of the tile in the y direction.
+    pub y: u16,
+}
+
+impl Tile {
+    /// The width of a tile in pixels.
+    pub const WIDTH: u16 = 4;
+
+    /// The height of a tile in pixels.
+    pub const HEIGHT: u16 = 4;
+
+    /// A special tile used to signal the end of a tile stream during rendering.
+    pub const SENTINEL: Self = Self::new(u16::MAX, u16::MAX, 0, 0);
+
+    /// Create a new tile.
+    /// `x` and `y` will be clamped to the largest possible coordinate if they are too large.
+    ///
+    /// `line_idx` must be smaller than [`MAX_LINES_PER_PATH`].
+    #[inline]
+    pub fn new_clamped(x: u16, y: u16, line_idx: u32, intersection_mask: u32) -> Self {
+        Self::new(
+            // Make sure that x and y stay in range when multiplying
+            // with the tile width and height during strips generation.
+            x.min(u16::MAX / Self::WIDTH),
+            y.min(u16::MAX / Self::HEIGHT),
+            line_idx,
+            intersection_mask,
+        )
+    }
+
+    /// The base tile constructor
+    ///
+    /// Unlike [`Self::new_clamped`], this constructor stores `x` and `y` exactly as provided.
+    /// Callers must ensure these coordinates do not exceed the limits required by downstream
+    /// processing (typically `u16::MAX / WIDTH` and `u16::MAX / HEIGHT`).
+    #[inline]
+    pub const fn new(x: u16, y: u16, line_idx: u32, intersection_mask: u32) -> Self {
+        #[cfg(debug_assertions)]
+        if line_idx >= MAX_LINES_PER_PATH {
+            panic!("Max. number of lines per path exceeded.");
+        }
+        // The intersection_mask is expected to contain bits 0-4 (T, B, L, R, W).
+        // We pack line_idx into the high bits (5-31) and intersection_mask into low bits (0-4).
+        Self {
+            x,
+            y,
+            packed_winding_line_idx: (line_idx << INT_MASK_SHIFT) | intersection_mask,
+        }
+    }
+
+    /// Check whether two tiles are at the same location.
+    #[inline]
+    pub const fn same_loc(&self, other: &Self) -> bool {
+        self.same_row(other) && self.x == other.x
+    }
+
+    /// Check whether `self` is adjacent to the left of `other`.
+    #[inline]
+    pub const fn prev_loc(&self, other: &Self) -> bool {
+        self.same_row(other) && self.x + 1 == other.x
+    }
+
+    /// Check whether two tiles are on the same row.
+    #[inline]
+    pub const fn same_row(&self, other: &Self) -> bool {
+        self.y == other.y
+    }
+
+    /// The index of the line this tile belongs to into the line buffer.
+    ///
+    /// Returns the high 27 bits.
+    #[inline]
+    pub const fn line_idx(&self) -> u32 {
+        self.packed_winding_line_idx >> INT_MASK_SHIFT
+    }
+
+    /// Whether the line crosses the top edge of the tile.
+    ///
+    /// Lines making this crossing increment or decrement the coarse tile winding, depending on the
+    /// line direction.
+    ///
+    /// Checks Bit 4 (Winding).
+    #[inline]
+    pub const fn winding(&self) -> bool {
+        (self.packed_winding_line_idx & W) != 0
+    }
+
+    /// The 5 bits of intersection and winding data.
+    #[inline]
+    pub const fn intersection_mask(&self) -> u32 {
+        self.packed_winding_line_idx & INTERSECTION_MASK
+    }
+
+    /// Whether the line intersects the top edge of the tile.
+    #[inline]
+    pub const fn intersects_top(&self) -> bool {
+        (self.intersection_mask() & T) != 0
+    }
+
+    /// Whether the line intersects the bottom edge of the tile.
+    #[inline]
+    pub const fn intersects_bottom(&self) -> bool {
+        (self.intersection_mask() & B) != 0
+    }
+
+    /// Whether the line intersects the left edge of the tile.
+    #[inline]
+    pub const fn intersects_left(&self) -> bool {
+        (self.intersection_mask() & L) != 0
+    }
+
+    /// Whether the line intersects the right edge of the tile.
+    #[inline]
+    pub const fn intersects_right(&self) -> bool {
+        (self.intersection_mask() & R) != 0
+    }
+
+    /// Return the `u64` representation of this tile.
+    ///
+    /// This is the u64 interpretation of `(y, x, packed_winding_line_idx)` where `y` is the
+    /// most-significant part of the number and `packed_winding_line_idx` the least significant.
+    #[inline(always)]
+    const fn to_bits(self) -> u64 {
+        // Note that for correct rendering, tiles only need to be sorted on `(y, x)`. Sorting on
+        // the line index in addition to the coordinate improves data locality in strip rendering.
+        // This is trading off increased sorting time for decreased strip rendering time. How the
+        // trade-off falls is scene-dependent.
+        //
+        // This operation compiles to a no-op: `Tile`'s field order is such that this is exactly
+        // the in-memory representation.
+        ((self.y as u64) << 48) | ((self.x as u64) << 32) | self.packed_winding_line_idx as u64
+    }
+
+    /// Whether a tile is a sentinel tile
+    //
+    // A tile produced organically by a make_tiles call can never have this coordinate because of
+    // the division by tile size on creation, so checking on x is sufficient to identify it.
+    #[inline(always)]
+    pub const fn is_sentinel(&self) -> bool {
+        self.x == u16::MAX
+    }
+}
+
+impl PartialEq for Tile {
+    #[inline(always)]
+    fn eq(&self, other: &Self) -> bool {
+        self.to_bits() == other.to_bits()
+    }
+}
+
+impl Ord for Tile {
+    #[inline(always)]
+    fn cmp(&self, other: &Self) -> core::cmp::Ordering {
+        self.to_bits().cmp(&other.to_bits())
+    }
+}
+
+impl PartialOrd for Tile {
+    #[inline(always)]
+    fn partial_cmp(&self, other: &Self) -> Option<core::cmp::Ordering> {
+        Some(self.cmp(other))
+    }
+}
+
+impl Eq for Tile {}
+
+/// Handles the tiling of paths.
+#[derive(Clone, Debug)]
+pub struct Tiles {
+    tile_buf: Vec<Tile>,
+    level: Level,
+    sorted: bool,
+    /// Auxiliary data tracking row windings and active rows for early culling.
+    pub windings: CulledWindings,
+}
+
+impl Tiles {
+    /// Create a new tiles container.
+    pub fn new(level: Level, height: u16) -> Self {
+        Self {
+            tile_buf: vec![],
+            level,
+            sorted: false,
+            windings: CulledWindings::new(height),
+        }
+    }
+
+    /// Get the number of tiles in the container.
+    pub fn len(&self) -> u32 {
+        self.tile_buf.len() as u32
+    }
+
+    /// Returns `true` if the container has no tiles.
+    pub fn is_empty(&self) -> bool {
+        self.tile_buf.is_empty()
+    }
+
+    /// Returns `true` if any geometry was early-culled outside the viewport.
+    pub fn has_culled_tiles(&self) -> bool {
+        self.windings.culled
+    }
+
+    /// Reset the tiles' container.
+    pub fn reset(&mut self) {
+        self.windings.reset();
+        self.tile_buf.clear();
+        self.sorted = false;
+    }
+
+    /// Sort the tiles in the container.
+    pub fn sort_tiles(&mut self) {
+        self.sorted = true;
+        // To enable auto-vectorization.
+        self.level.dispatch(|_| self.tile_buf.sort_unstable());
+    }
+
+    /// Get the tile at a certain index.
+    ///
+    /// Panics if the container hasn't been sorted before.
+    #[inline]
+    pub fn get(&self, index: u32) -> &Tile {
+        assert!(
+            self.sorted,
+            "attempted to call `get` before sorting the tile container."
+        );
+
+        &self.tile_buf[index as usize]
+    }
+
+    /// Iterate over the tiles in sorted order.
+    ///
+    /// Panics if the container hasn't been sorted before.
+    #[inline]
+    pub fn iter(&self) -> impl Iterator<Item = &Tile> {
+        assert!(
+            self.sorted,
+            "attempted to call `iter` before sorting the tile container."
+        );
+
+        self.tile_buf.iter()
+    }
+
+    /// Generates tile commands for Analytic Anti-Aliasing rasterization. Unlike the MSAA path, this
+    /// function performs "coarse binning" to simply identify every tile a line segment traverses.
+    /// It encodes the line index and winding direction, delegating the precise calculation of pixel
+    /// coverage to `strip::render`.
+    pub fn make_tiles_analytic_aa(
+        &mut self,
+        level: Level,
+        lines: &[Line],
+        width: u16,
+        height: u16,
+    ) -> bool {
+        dispatch!(level, simd => self.make_tiles_analytic_aa_impl::<_>(
+            simd,
+            lines,
+            width,
+            height,
+        ))
+    }
+
+    fn make_tiles_analytic_aa_impl<S: Simd>(
+        &mut self,
+        s: S,
+        lines: &[Line],
+        width: u16,
+        height: u16,
+    ) -> bool {
+        self.reset();
+
+        if width == 0 || height == 0 {
+            return self.windings.culled;
+        }
+
+        debug_assert!(
+            lines.len() <= MAX_LINES_PER_PATH as usize,
+            "Max. number of lines per path exceeded. Max is {}, got {}.",
+            MAX_LINES_PER_PATH,
+            lines.len()
+        );
+
+        let tile_columns = width.div_ceil(Tile::WIDTH);
+        let tile_rows = height.div_ceil(Tile::HEIGHT);
+
+        let px_top = f32x4::from_slice(s, &[0.0, 1.0, 2.0, 3.0]);
+        let px_bottom = px_top + f32x4::splat(s, 1.0);
+        let simd_zero = f32x4::splat(s, 0.0);
+        let tile_height_f32 = Tile::HEIGHT as f32;
+
+        for (line_idx, line) in lines.iter().take(MAX_LINES_PER_PATH as usize).enumerate() {
+            let line_idx = line_idx as u32;
+
+            let p0_x = line.p0.x / f32::from(Tile::WIDTH);
+            let p0_y = line.p0.y / f32::from(Tile::HEIGHT);
+            let p1_x = line.p1.x / f32::from(Tile::WIDTH);
+            let p1_y = line.p1.y / f32::from(Tile::HEIGHT);
+
+            let (line_left_x, line_right_x) = if p0_x < p1_x {
+                (p0_x, p1_x)
+            } else {
+                (p1_x, p0_x)
+            };
+
+            // Lines whose left-most endpoint exceed the right edge of the viewport are culled
+            if line_left_x > tile_columns as f32 {
+                continue;
+            }
+
+            let (line_top_y, line_top_x, line_bottom_y, line_bottom_x) = if p0_y < p1_y {
+                (p0_y, p0_x, p1_y, p1_x)
+            } else {
+                (p1_y, p1_x, p0_y, p0_x)
+            };
+
+            // The `as u16` casts here intentionally clamp negative coordinates to 0.
+            let y_top_tiles = (line_top_y as u16).min(tile_rows);
+            let line_bottom_y_ceil = line_bottom_y.ceil();
+            let y_bottom_tiles = (line_bottom_y_ceil as u16).min(tile_rows);
+
+            // If y_top_tiles == y_bottom_tiles, then the line is either completely above or below
+            // the viewport OR it is perfectly horizontal and aligned to the tile grid, contributing
+            // no winding. In either case, it should be culled.
+            if y_top_tiles >= y_bottom_tiles {
+                // Technically, the `>` part of the `>=` is unnecessary due to clamping, but this
+                // gives stronger signal
+                continue;
+            }
+
+            let dir = if p0_y >= p1_y { 1 } else { -1 };
+            let f_dir = dir as f32;
+            let f_dir_v = f32x4::splat(s, f_dir);
+
+            macro_rules! calc_fractional_coverage {
+                ($y_idx:expr, $segment_top_y:expr, $segment_bottom_y:expr) => {{
+                    let y_idx_f32 = f32::from($y_idx);
+                    let local_y_start = ($segment_top_y - y_idx_f32) * tile_height_f32;
+                    let local_y_end = ($segment_bottom_y - y_idx_f32) * tile_height_f32;
+
+                    let start_v = f32x4::splat(s, local_y_start);
+                    let end_v = f32x4::splat(s, local_y_end);
+
+                    (px_bottom.min(end_v) - px_top.max(start_v)).max(simd_zero)
+                }};
+            }
+
+            // Lines fully to the left of the viewport are not visible but still produce winding
+            // which we record here and forward to the rendering stage.
+            if line_right_x < 0.0 {
+                let is_start_culled = line_top_y < 0.0;
+
+                // This branch is for handling the "start" of the line. In case
+                // the line reaches above the viewport, we are already in the
+                // middle so we can skip that part.
+                if !is_start_culled {
+                    self.windings.mark_row_active(y_top_tiles as usize);
+
+                    // Note: In theory, == should be enough, but just as
+                    // additional safety against numerical precision errors we
+                    // use <=.
+                    let at_top_of_tile = line_top_y <= f32::from(y_top_tiles);
+                    if at_top_of_tile {
+                        self.windings.coarse[y_top_tiles as usize] += dir;
+                    }
+
+                    let fractional_coverage =
+                        calc_fractional_coverage!(y_top_tiles, line_top_y, line_bottom_y);
+                    let target_row = &mut self.windings.partial[y_top_tiles as usize];
+                    let current = f32x4::from_slice(s, target_row);
+
+                    // See comment below on the double counting risk!
+                    let double_count = if at_top_of_tile {
+                        f_dir_v
+                    } else {
+                        f32x4::splat(s, 0.0)
+                    };
+                    let next = fractional_coverage.mul_add(f_dir_v, current - double_count);
+                    next.store_slice(target_row);
+                }
+
+                let y_start_middle = if is_start_culled {
+                    y_top_tiles
+                } else {
+                    y_top_tiles + 1
+                };
+                let line_bottom_floor = line_bottom_y.floor();
+                let y_end_middle = (line_bottom_floor as u16).min(tile_rows);
+
+                for y_idx in y_start_middle..y_end_middle {
+                    self.windings.coarse[y_idx as usize] += dir;
+                }
+                self.windings
+                    .mark_row_range_active(y_start_middle as usize, y_end_middle as usize);
+
+                if line_bottom_y != line_bottom_floor
+                    && y_end_middle < tile_rows
+                    // Prevent double-processing, unless the start was off-screen and hasn't been
+                    // handled yet.
+                    && (is_start_culled || y_end_middle != y_top_tiles)
+                {
+                    self.windings.mark_row_active(y_end_middle as usize);
+                    // Ends implicitly cross the top.
+                    self.windings.coarse[y_end_middle as usize] += dir;
+                    let fractional_coverage =
+                        calc_fractional_coverage!(y_end_middle, line_top_y, line_bottom_y);
+                    let target_row = &mut self.windings.partial[y_end_middle as usize];
+                    let current = f32x4::from_slice(s, target_row);
+                    // Subtract the inverse direction to avoid double counting with the coarse winding.
+                    let next = fractional_coverage.mul_add(f_dir_v, current - f_dir_v);
+                    next.store_slice(target_row);
+                }
+
+                self.windings.culled = true;
+                continue;
+            }
+
+            // Get tile coordinates for start/end points, use i32 to preserve negative coordinates.
+            let p0_tile_x = line_top_x.floor() as i32;
+            let p0_tile_y = line_top_y.floor() as i32;
+            let p1_tile_x = line_bottom_x.floor() as i32;
+            let p1_tile_y = line_bottom_y.floor() as i32;
+
+            // Special-case out lines which are fully contained within a tile.
+            let not_same_tile = p0_tile_y != p1_tile_y || p0_tile_x != p1_tile_x;
+            if not_same_tile {
+                // Case vertical lines: By definition, these cannot be horizontally crossing, and
+                // thus require no additional left-edge culling handling.
+                if line_left_x == line_right_x {
+                    let x = (line_left_x as u16).min(tile_columns.saturating_sub(1));
+
+                    // Row Start, not culled.
+                    let is_start_culled = line_top_y < 0.0;
+                    if !is_start_culled {
+                        let winding =
+                            ((f32::from(y_top_tiles) >= line_top_y) as u32) << WINDING_SHIFT;
+                        let tile = Tile::new_clamped(x, y_top_tiles, line_idx, winding);
+                        self.tile_buf.push(tile);
+                    }
+
+                    // Middle
+                    // If the start was culled, the first tile inside the viewport is a middle.
+                    let y_start = if is_start_culled {
+                        y_top_tiles
+                    } else {
+                        y_top_tiles + 1
+                    };
+
+                    for y_idx in y_start..y_bottom_tiles {
+                        let tile = Tile::new_clamped(x, y_idx, line_idx, W);
+                        self.tile_buf.push(tile);
+                    }
+                } else {
+                    // General case, any line which crosses more than one tile and is not vertical.
+                    let dx = p1_x - p0_x;
+                    let dy = p1_y - p0_y;
+                    let x_slope = dx / dy;
+                    let dx_dir = (line_bottom_x >= line_top_x) as u32;
+                    let not_dx_dir = dx_dir ^ 1;
+
+                    let w_start_base = dx_dir << WINDING_SHIFT;
+                    let w_end_base = not_dx_dir << WINDING_SHIFT;
+
+                    let mut push_row = {
+                        #[inline(always)]
+                        |y_idx: u16,
+                         row_top_y: f32,
+                         row_bottom_y: f32,
+                         w_start: u32,
+                         w_end: u32,
+                         w_single: u32| {
+                            let row_top_x = p0_x + (row_top_y - p0_y) * x_slope;
+                            let row_bottom_x = p0_x + (row_bottom_y - p0_y) * x_slope;
+
+                            let row_left_x = f32::min(row_top_x, row_bottom_x).max(line_left_x);
+                            let row_right_x = f32::max(row_top_x, row_bottom_x).min(line_right_x);
+
+                            if row_left_x < 0.0 {
+                                self.windings.culled = true;
+
+                                if row_right_x < 0.0 {
+                                    // Although the line may cross the left edge, the rightmost point in
+                                    // this row may still be fully left of the viewport. In this case,
+                                    // record the winding and emit no tiles.
+                                    self.windings.mark_row_active(y_idx as usize);
+
+                                    let crosses_top = (w_single & W) != 0;
+                                    if crosses_top {
+                                        self.windings.coarse[y_idx as usize] += dir;
+                                    }
+
+                                    let fractional_coverage =
+                                        calc_fractional_coverage!(y_idx, row_top_y, row_bottom_y);
+                                    let target_row = &mut self.windings.partial[y_idx as usize];
+                                    let current = f32x4::from_slice(s, target_row);
+
+                                    let double_count = if crosses_top {
+                                        f_dir_v
+                                    } else {
+                                        f32x4::splat(s, 0.0)
+                                    };
+                                    let next = fractional_coverage
+                                        .mul_add(f_dir_v, current - double_count);
+                                    next.store_slice(target_row);
+
+                                    return;
+                                } else {
+                                    // The line crosses into the viewport in this row. Record only the
+                                    // fractional portion of the winding, as the coarse winding will
+                                    // naturally get included by the clamped tile logic!
+                                    let y_slope = dy / dx;
+                                    let y_intersect = row_top_y - (row_top_x * y_slope);
+
+                                    let (off_screen_top_y, off_screen_bottom_y) = if row_top_x < 0.0
+                                    {
+                                        (row_top_y, f32::min(row_bottom_y, y_intersect))
+                                    } else {
+                                        (f32::max(row_top_y, y_intersect), row_bottom_y)
+                                    };
+
+                                    if off_screen_top_y < off_screen_bottom_y {
+                                        self.windings.mark_row_active(y_idx as usize);
+                                        let fractional_coverage = calc_fractional_coverage!(
+                                            y_idx,
+                                            off_screen_top_y,
+                                            off_screen_bottom_y
+                                        );
+                                        let target_row = &mut self.windings.partial[y_idx as usize];
+                                        let current = f32x4::from_slice(s, target_row);
+                                        let next = fractional_coverage.mul_add(f_dir_v, current);
+                                        next.store_slice(target_row);
+                                    }
+                                }
+                            }
+
+                            let x_start = row_left_x as u16;
+                            let x_end = (row_right_x as u16).min(tile_columns.saturating_sub(1));
+
+                            if x_start <= x_end {
+                                let winding = if x_start == x_end { w_single } else { w_start };
+
+                                self.tile_buf
+                                    .push(Tile::new(x_start, y_idx, line_idx, winding));
+
+                                for x_idx in x_start.saturating_add(1)..x_end {
+                                    self.tile_buf.push(Tile::new(x_idx, y_idx, line_idx, 0));
+                                }
+
+                                if x_start < x_end {
+                                    self.tile_buf.push(Tile::new(x_end, y_idx, line_idx, w_end));
+                                }
+                            }
+                        }
+                    };
+
+                    let is_start_culled = line_top_y < 0.0;
+                    if !is_start_culled {
+                        let y = f32::from(y_top_tiles);
+                        let row_bottom_y = (y + 1.0).min(line_bottom_y);
+                        let mask = ((y >= line_top_y) as u32) << WINDING_SHIFT;
+                        push_row(
+                            y_top_tiles,
+                            line_top_y,
+                            row_bottom_y,
+                            w_start_base & mask,
+                            w_end_base & mask,
+                            W & mask,
+                        );
+                    }
+
+                    let y_start = if is_start_culled {
+                        y_top_tiles
+                    } else {
+                        y_top_tiles + 1
+                    };
+
+                    for y_idx in y_start..y_bottom_tiles {
+                        let y = f32::from(y_idx);
+                        let row_bottom_y = (y + 1.0).min(line_bottom_y);
+                        push_row(y_idx, y, row_bottom_y, w_start_base, w_end_base, W);
+                    }
+                }
+            } else {
+                // Case line is fully contained within a single tile: These also cannot cross edges!
+                let tile = Tile::new_clamped(
+                    (line_left_x as u16).min(tile_columns + 1),
+                    y_top_tiles,
+                    line_idx,
+                    ((f32::from(y_top_tiles) >= line_top_y) as u32) << WINDING_SHIFT,
+                );
+                self.tile_buf.push(tile);
+            }
+        }
+
+        self.windings.culled
+    }
+
+    /// Generates tile commands for MSAA (Multisample Anti-Aliasing) rasterization.
+    ///
+    /// [ Architecture & Watertightness ]
+    /// The primary goal of this function is to establish a source of "ground truth" for line-tile
+    /// intersections. Because the downstream rasterization (MSAA) occurs in parallel, it is
+    /// critical that intersections are "watertight." If Thread A handles Tile (0,0) and Thread B
+    /// handles Tile (1,0), they must agree exactly on whether a line crosses the shared edge.
+    ///
+    /// While calculating exact intersection coordinates here is feasible, it is computationally
+    /// expensive. Instead, we defer the heavy math to the GPU/rasterizer and produce a lightweight
+    /// Intersection Bitmask. This mask unambiguously defines which edges of a tile a line segment
+    /// touches or crosses.
+    ///
+    /// [ The Intersection Bitmask (5 bits) ]
+    /// The bitmask encodes winding information and edge intersections. A line is said to
+    /// "intersect" an edge if it touches that edge AND continues into the neighboring tile.
+    ///
+    /// Bit representation:
+    /// Bit: 4 | 3 | 2 | 1 | 0
+    /// Val: W | R | L | B | T
+    ///
+    /// - W (Winding): Tracks whether the line touched the top edge of the tile.
+    /// - R/L/B/T: Right, Left, Bottom, and Top edge intersections.
+    pub fn make_tiles_msaa(&mut self, lines: &[Line], width: u16, height: u16) {
+        self.reset();
+
+        if width == 0 || height == 0 {
+            return;
+        }
+
+        debug_assert!(
+            lines.len() <= MAX_LINES_PER_PATH as usize,
+            "Max. number of lines per path exceeded. Max is {}, got {}.",
+            MAX_LINES_PER_PATH,
+            lines.len()
+        );
+
+        let tile_columns = width.div_ceil(Tile::WIDTH);
+        let tile_rows = height.div_ceil(Tile::HEIGHT);
+
+        for (line_idx, line) in lines.iter().take(MAX_LINES_PER_PATH as usize).enumerate() {
+            let line_idx = line_idx as u32;
+
+            let p0_x = line.p0.x / f32::from(Tile::WIDTH);
+            let p0_y = line.p0.y / f32::from(Tile::HEIGHT);
+            let p1_x = line.p1.x / f32::from(Tile::WIDTH);
+            let p1_y = line.p1.y / f32::from(Tile::HEIGHT);
+
+            let (line_left_x, line_right_x) = if p0_x < p1_x {
+                (p0_x, p1_x)
+            } else {
+                (p1_x, p0_x)
+            };
+
+            // Lines whose left-most endpoint exceed the right edge of the viewport are culled
+            if line_left_x > tile_columns as f32 {
+                continue;
+            }
+
+            let (line_top_y, line_top_x, line_bottom_y, line_bottom_x) = if p0_y < p1_y {
+                (p0_y, p0_x, p1_y, p1_x)
+            } else {
+                (p1_y, p1_x, p0_y, p0_x)
+            };
+
+            // The `as u16` casts here intentionally clamp negative coordinates to 0.
+            let y_top_tiles = (line_top_y as u16).min(tile_rows);
+            let line_bottom_y_ceil = line_bottom_y.ceil();
+            let y_bottom_tiles = (line_bottom_y_ceil as u16).min(tile_rows);
+
+            // If y_top_tiles == y_bottom_tiles, then the line is either completely above or below
+            // the viewport OR it is perfectly horizontal and aligned to the tile grid, contributing
+            // no winding. In either case, it should be culled.
+            if y_top_tiles >= y_bottom_tiles {
+                continue;
+            }
+
+            // Get tile coordinates for start/end points, use i32 to preserve negative coordinates
+            let p0_tile_x = line_top_x.floor() as i32;
+            let p0_tile_y = line_top_y.floor() as i32;
+            let p1_tile_x = line_bottom_x.floor() as i32;
+
+            let p1_tile_y = if line_bottom_y == line_bottom_y_ceil {
+                line_bottom_y as i32 - 1
+            } else {
+                line_bottom_y.floor() as i32
+            };
+
+            // Special-case out lines which are fully contained within a tile.
+            let not_same_tile = p0_tile_y != p1_tile_y || p0_tile_x != p1_tile_x;
+            if not_same_tile {
+                // For ease of logic, special-case purely vertical tiles.
+                if line_left_x == line_right_x {
+                    let x = (line_left_x as u16).min(tile_columns.saturating_sub(1));
+
+                    // Row Start, not culled.
+                    let is_start_culled = line_top_y < 0.0;
+                    if !is_start_culled {
+                        let winding =
+                            ((f32::from(y_top_tiles) >= line_top_y) as u32) << WINDING_SHIFT;
+                        let intersection_mask = B | winding;
+                        let tile = Tile::new_clamped(x, y_top_tiles, line_idx, intersection_mask);
+                        self.tile_buf.push(tile);
+                    }
+
+                    // Middle
+                    // If the start was culled, the first tile inside the viewport is a middle.
+                    let y_start = if is_start_culled {
+                        y_top_tiles
+                    } else {
+                        y_top_tiles + 1
+                    };
+                    let line_bottom_floor = line_bottom_y.floor();
+                    let y_end_idx = (line_bottom_floor as u16).min(tile_rows);
+
+                    if y_start < y_end_idx {
+                        let y_last = y_end_idx - 1;
+                        for y_idx in y_start..y_last {
+                            let intersection_mask = W | B | T;
+                            let tile = Tile::new_clamped(x, y_idx, line_idx, intersection_mask);
+                            self.tile_buf.push(tile);
+                        }
+
+                        // Perfect touching B case.
+                        {
+                            let is_end_tile = ((y_last as i32) == p1_tile_y) as u32;
+                            let intersection_mask = W | T | ((1 ^ is_end_tile) << BOT_SHIFT);
+                            let tile = Tile::new_clamped(x, y_last, line_idx, intersection_mask);
+                            self.tile_buf.push(tile);
+                        }
+                    }
+
+                    // Row End, handle the final tile (y_end_idx), but *only* if the line does
+                    // not perfectly end on the top edge of the tile. In the case that it does,
+                    // it gets handled by the middle logic above.
+                    if line_bottom_y != line_bottom_floor && y_end_idx < tile_rows {
+                        let intersection_mask = W | T;
+                        let tile = Tile::new_clamped(x, y_end_idx, line_idx, intersection_mask);
+                        self.tile_buf.push(tile);
+                    }
+                } else {
+                    let dx = p1_x - p0_x;
+                    let dy = p1_y - p0_y;
+                    let x_slope = dx / dy;
+                    let dx_dir = (line_bottom_x >= line_top_x) as u32;
+                    let not_dx_dir = dx_dir ^ 1;
+
+                    let w_start_base = dx_dir << WINDING_SHIFT;
+                    let w_end_base = not_dx_dir << WINDING_SHIFT;
+
+                    // Check if the line is fully within the horizontal viewport bounds. If it is,
+                    // we can skip the min/max clamping per row.
+                    let min_x = p0_x.min(p1_x);
+                    let max_x = p0_x.max(p1_x);
+                    // Note: We use >= on the right edge to ensure strictly safe integer truncation
+                    let needs_clamping = min_x < line_left_x || max_x >= line_right_x;
+
+                    // Handles the bitmask logic for start/end tiles. Invariant to clamping.
+                    macro_rules! push_edge {
+                        ($x:expr, $y:expr, $row_top_x:expr, $row_bottom_x:expr,
+                         $canonical_start:expr, $canonical_end:expr, $winding_input:expr,
+                         $check_s:tt, $check_e:expr) => {{
+                            let x_idx = $x;
+
+                            let unc_row_start = (x_idx as i32 == $canonical_start) as u32;
+                            let unc_row_end = (x_idx == $canonical_end) as u32;
+
+                            let canonical_row_start =
+                                (dx_dir & unc_row_start) | (not_dx_dir & unc_row_end);
+                            let canonical_row_end =
+                                (not_dx_dir & unc_row_start) | (dx_dir & unc_row_end);
+
+                            let start_tile = if $check_s {
+                                ((x_idx as i32 == p0_tile_x) && ($y as i32 == p0_tile_y)) as u32
+                            } else {
+                                0
+                            };
+
+                            let end_tile = if $check_e {
+                                ((x_idx as i32 == p1_tile_x) && ($y as i32 == p1_tile_y)) as u32
+                            } else {
+                                0
+                            };
+
+                            let mut mask = $winding_input;
+
+                            // Entrant/Exit
+                            mask |= canonical_row_start & (1 ^ start_tile);
+                            mask |= (1 ^ canonical_row_start) << not_dx_dir << LEFT_SHIFT;
+                            mask |= (canonical_row_end & (1 ^ end_tile)) << BOT_SHIFT;
+                            mask |= (1 ^ canonical_row_end) << dx_dir << LEFT_SHIFT;
+
+                            // Corner
+                            let x_left_f = x_idx as f32;
+                            let x_right_f = (x_idx + 1) as f32;
+                            let trc = (($row_top_x == x_right_f) as u32) & (1 ^ start_tile);
+                            let tlc = (($row_top_x == x_left_f) as u32) & (1 ^ start_tile);
+                            let brc = (($row_bottom_x == x_right_f) as u32) & (1 ^ end_tile);
+                            let blc = (($row_bottom_x == x_left_f) as u32) & (1 ^ end_tile);
+                            // Top left is handled specially
+                            let tie_break = tlc & (canonical_row_start ^ 1);
+
+                            mask |= (tie_break | blc) << LEFT_SHIFT;
+                            mask |= (trc | brc) << RIGHT_SHIFT;
+                            mask &= !(tie_break | trc);
+                            mask &= !((blc | brc) << BOT_SHIFT);
+
+                            self.tile_buf.push(Tile::new(x_idx, $y, line_idx, mask));
+                        }};
+                    }
+
+                    // Handles row geometry and clamping logic.
+                    macro_rules! process_row {
+                        ($y_idx:expr, $row_top_y:expr, $row_bottom_y:expr, $w_mask:expr,
+                     $check_s:tt, $check_e:tt, $clamped:tt) => {{
+                            let row_top_x = p0_x + ($row_top_y - p0_y) * x_slope;
+                            let row_bottom_x = p0_x + ($row_bottom_y - p0_y) * x_slope;
+
+                            let (row_left_x, row_right_x, x_end) = if $clamped {
+                                let lx = f32::min(row_top_x, row_bottom_x).max(line_left_x);
+                                let rx = f32::max(row_top_x, row_bottom_x).min(line_right_x);
+                                let xe = (rx as u16).min(tile_columns.saturating_sub(1));
+                                (lx, rx, xe)
+                            } else {
+                                let lx = f32::min(row_top_x, row_bottom_x);
+                                let rx = f32::max(row_top_x, row_bottom_x);
+                                let xe = rx as u16; // Safe because we checked bounds earlier
+                                (lx, rx, xe)
+                            };
+
+                            let canonical_x_start = row_left_x.floor() as i32;
+                            let canonical_x_end = row_right_x as u16;
+                            let x_start = row_left_x as u16;
+
+                            if x_start <= x_end {
+                                let is_single = (x_start == x_end) as u32;
+                                let w_left = (w_start_base | (is_single << 4)) & $w_mask;
+
+                                push_edge!(
+                                    x_start,
+                                    $y_idx,
+                                    row_top_x,
+                                    row_bottom_x,
+                                    canonical_x_start,
+                                    canonical_x_end,
+                                    w_left,
+                                    $check_s,
+                                    $check_e
+                                );
+
+                                for x_idx in x_start.saturating_add(1)..x_end {
+                                    self.tile_buf
+                                        .push(Tile::new(x_idx, $y_idx, line_idx, R | L));
+                                }
+
+                                if x_start < x_end {
+                                    let w_right = w_end_base & $w_mask;
+                                    push_edge!(
+                                        x_end,
+                                        $y_idx,
+                                        row_top_x,
+                                        row_bottom_x,
+                                        canonical_x_start,
+                                        canonical_x_end,
+                                        w_right,
+                                        $check_s,
+                                        $check_e
+                                    );
+                                }
+                            }
+                        }};
+                    }
+
+                    // Central macro
+                    macro_rules! run_loops {
+                        ($clamped:tt) => {{
+                            // Top Row
+                            let is_start_culled = line_top_y < 0.0;
+                            if !is_start_culled {
+                                let y = f32::from(y_top_tiles);
+                                let row_bottom_y = (y + 1.0).min(line_bottom_y);
+                                let mask = ((y >= line_top_y) as u32) << WINDING_SHIFT;
+                                process_row!(
+                                    y_top_tiles,
+                                    line_top_y,
+                                    row_bottom_y,
+                                    mask,
+                                    true,
+                                    true,
+                                    $clamped
+                                );
+                            }
+
+                            let y_start_middle = if is_start_culled {
+                                y_top_tiles
+                            } else {
+                                y_top_tiles + 1
+                            };
+                            let line_bottom_floor = line_bottom_y.floor();
+                            let y_end_middle = (line_bottom_floor as u16).min(tile_rows);
+                            let has_separate_bottom_row = line_bottom_y != line_bottom_floor
+                                && y_end_middle < tile_rows
+                                && (is_start_culled || y_end_middle != y_top_tiles);
+
+                            if y_start_middle < y_end_middle {
+                                for y_idx in y_start_middle..y_end_middle {
+                                    let y = f32::from(y_idx);
+                                    let row_bottom_y = (y + 1.0).min(line_bottom_y);
+                                    let is_last_middle = y_idx == y_end_middle - 1;
+                                    let check_end = is_last_middle && !has_separate_bottom_row;
+
+                                    process_row!(
+                                        y_idx,
+                                        y,
+                                        row_bottom_y,
+                                        u32::MAX,
+                                        false,
+                                        check_end,
+                                        $clamped
+                                    );
+                                }
+                            }
+
+                            // Bottom Row
+                            if has_separate_bottom_row {
+                                let y_idx = y_end_middle;
+                                let y = f32::from(y_idx);
+                                process_row!(
+                                    y_idx,
+                                    y,
+                                    line_bottom_y,
+                                    u32::MAX,
+                                    false,
+                                    true,
+                                    $clamped
+                                );
+                            }
+                        }};
+                    }
+
+                    if needs_clamping {
+                        run_loops!(true);
+                    } else {
+                        run_loops!(false);
+                    }
+                }
+            } else {
+                // Case: Line is fully contained within a single tile.
+                let tile = Tile::new_clamped(
+                    (line_left_x as u16).min(tile_columns + 1),
+                    y_top_tiles,
+                    line_idx,
+                    ((f32::from(y_top_tiles) >= line_top_y) as u32) << WINDING_SHIFT,
+                );
+                self.tile_buf.push(tile);
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::flatten::{FlattenCtx, Line, Point, fill};
+    use crate::geometry::RectU16;
+    use crate::kurbo::{Affine, BezPath};
+    use crate::tile::CulledWindings;
+    use crate::tile::{B, L, R, T, Tile, Tiles, W};
+    use fearless_simd::Level;
+    use std::vec::Vec;
+
+    const VIEW_DIM: u16 = 100;
+    const F_V_DIM: f32 = VIEW_DIM as f32;
+
+    impl Tiles {
+        fn assert_tiles_match(
+            &mut self,
+            lines: &[Line],
+            width: u16,
+            height: u16,
+            expected: &[Tile],
+        ) {
+            self.make_tiles_msaa(lines, width, height);
+            assert_eq!(self.tile_buf, expected, "MSAA: Tile buffer mismatch");
+
+            self.make_tiles_analytic_aa(Level::baseline(), lines, width, height);
+            check_analytic_aa_matches(&self.tile_buf, expected);
+        }
+    }
+
+    fn check_analytic_aa_matches(actual: &[Tile], expected: &[Tile]) {
+        assert_eq!(
+            actual.len(),
+            expected.len(),
+            "Analytic AA: Tile count mismatch."
+        );
+
+        for (i, (got, want)) in actual.iter().zip(expected.iter()).enumerate() {
+            assert_eq!(got.x, want.x, "Analytic AA: Tile[{}] X mismatch", i);
+            assert_eq!(got.y, want.y, "Analytic AA: Tile[{}] Y mismatch", i);
+            assert_eq!(
+                got.line_idx(),
+                want.line_idx(),
+                "Analytic AA: Tile[{}] Line Index mismatch",
+                i
+            );
+
+            let got_winding = got.packed_winding_line_idx & W;
+            let want_winding = want.packed_winding_line_idx & W;
+            assert_eq!(
+                got_winding, want_winding,
+                "Analytic AA: Tile[{}] Winding mismatch",
+                i
+            );
+        }
+    }
+
+    //==============================================================================================
+    // Culled Lines
+    //==============================================================================================
+    #[test]
+    fn cull_sloped_outside_lines() {
+        let lines = [
+            Line {
+                p0: Point { x: 1.0, y: -7.0 },
+                p1: Point { x: 3.0, y: -1.0 },
+            },
+            Line {
+                p0: Point { x: 1.0, y: -11.0 },
+                p1: Point { x: 3.0, y: -1.0 },
+            },
+            Line {
+                p0: Point {
+                    x: F_V_DIM + 1.0,
+                    y: 50.0,
+                },
+                p1: Point {
+                    x: F_V_DIM + 3.0,
+                    y: 70.0,
+                },
+            },
+            Line {
+                p0: Point {
+                    x: 1.0,
+                    y: F_V_DIM + 1.0,
+                },
+                p1: Point {
+                    x: 3.0,
+                    y: F_V_DIM + 7.0,
+                },
+            },
+            Line {
+                p0: Point {
+                    x: 1.0,
+                    y: F_V_DIM + 1.0,
+                },
+                p1: Point {
+                    x: 3.0,
+                    y: F_V_DIM + 13.0,
+                },
+            },
+        ];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &[]);
+    }
+
+    #[test]
+    fn sloped_line_crossing_top() {
+        let lines = [
+            Line {
+                p0: Point { x: -2.0, y: -3.0 },
+                p1: Point { x: 2.0, y: 1.0 },
+            },
+            Line {
+                p0: Point { x: 6.0, y: -1.0 },
+                p1: Point { x: 5.0, y: 2.0 },
+            },
+            Line {
+                p0: Point { x: 9.0, y: -10.0 },
+                p1: Point { x: 10.0, y: 3.0 },
+            },
+            Line {
+                p0: Point { x: 2.0, y: 1.0 },
+                p1: Point { x: -2.0, y: -3.0 },
+            },
+        ];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [
+            Tile::new(0, 0, 0, W | T),
+            Tile::new(1, 0, 1, W | T),
+            Tile::new(2, 0, 2, W | T),
+            Tile::new(0, 0, 3, W | T),
+        ];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    #[test]
+    fn sloped_line_crossing_bot() {
+        let lines = [
+            Line {
+                p0: Point {
+                    x: 5.0,
+                    y: F_V_DIM + 3.0,
+                },
+                p1: Point {
+                    x: 6.0,
+                    y: F_V_DIM - 2.0,
+                },
+            },
+            Line {
+                p0: Point {
+                    x: 10.0,
+                    y: F_V_DIM + 1.0,
+                },
+                p1: Point {
+                    x: 9.0,
+                    y: F_V_DIM - 1.0,
+                },
+            },
+            Line {
+                p0: Point {
+                    x: 2.0,
+                    y: F_V_DIM - 2.0,
+                },
+                p1: Point {
+                    x: 3.0,
+                    y: F_V_DIM + 3.0,
+                },
+            },
+        ];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [
+            Tile::new(1, 24, 0, B),
+            Tile::new(2, 24, 1, B),
+            Tile::new(0, 24, 2, B),
+        ];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    #[test]
+    fn sloped_line_crossing_top_multi_tile() {
+        let lines = [
+            Line {
+                p0: Point { x: 1.0, y: -5.0 },
+                p1: Point { x: 6.0, y: 7.0 },
+            },
+            Line {
+                p0: Point { x: 2.5, y: -10.0 },
+                p1: Point { x: 3.5, y: 6.0 },
+            },
+        ];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [
+            Tile::new(0, 0, 0, W | T | R),
+            Tile::new(1, 0, 0, L | B),
+            Tile::new(1, 1, 0, W | T),
+            Tile::new(0, 0, 1, W | T | B),
+            Tile::new(0, 1, 1, W | T),
+        ];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    #[test]
+    fn sloped_line_crossing_bot_multi_tile() {
+        let lines = [
+            Line {
+                p0: Point {
+                    x: 12.0,
+                    y: F_V_DIM + 10.0,
+                },
+                p1: Point { x: 2.0, y: 94.0 },
+            },
+            Line {
+                p0: Point {
+                    x: 1.5,
+                    y: F_V_DIM + 5.0,
+                },
+                p1: Point { x: 3.5, y: 94.0 },
+            },
+        ];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [
+            Tile::new(0, 23, 0, B),
+            Tile::new(0, 24, 0, W | T | R),
+            Tile::new(1, 24, 0, B | L),
+            Tile::new(0, 23, 1, B),
+            Tile::new(0, 24, 1, W | T | B),
+        ];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    #[test]
+    fn sloped_line_crossing_right() {
+        let lines = [
+            Line {
+                p0: Point { x: 97.0, y: 1.0 },
+                p1: Point {
+                    x: F_V_DIM + 1.0,
+                    y: 2.0,
+                },
+            },
+            Line {
+                p0: Point { x: 93.0, y: 1.0 },
+                p1: Point {
+                    x: F_V_DIM + 5.0,
+                    y: 2.0,
+                },
+            },
+        ];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [
+            Tile::new(24, 0, 0, R),
+            Tile::new(23, 0, 1, R),
+            Tile::new(24, 0, 1, R | L),
+        ];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    #[test]
+    fn sloped_line_crossing_left() {
+        let lines = [
+            Line {
+                p0: Point { x: -5.0, y: 1.0 },
+                p1: Point { x: 1.0, y: 2.0 },
+            },
+            Line {
+                p0: Point { x: -5.0, y: 1.0 },
+                p1: Point { x: 5.0, y: 2.0 },
+            },
+            Line {
+                p0: Point { x: -5.0, y: 1.0 },
+                p1: Point { x: 13.0, y: 9.0 },
+            },
+        ];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [
+            Tile::new(0, 0, 0, L),
+            Tile::new(0, 0, 1, L | R),
+            Tile::new(1, 0, 1, L),
+            Tile::new(0, 0, 2, L | B),
+            Tile::new(0, 1, 2, W | R | T),
+            Tile::new(1, 1, 2, R | L),
+            Tile::new(2, 1, 2, L | B),
+            Tile::new(2, 2, 2, W | R | T),
+            Tile::new(3, 2, 2, L),
+        ];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    #[test]
+    fn horizontal_line_above_viewport() {
+        let lines = [Line {
+            p0: Point { x: 10.0, y: -5.0 },
+            p1: Point { x: 90.0, y: -5.0 },
+        }];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &[]);
+    }
+
+    #[test]
+    fn horizontal_line_below_viewport() {
+        let lines = [Line {
+            p0: Point {
+                x: 10.0,
+                y: F_V_DIM + 5.0,
+            },
+            p1: Point {
+                x: 90.0,
+                y: F_V_DIM + 5.0,
+            },
+        }];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &[]);
+    }
+
+    #[test]
+    fn horizontal_line_crossing_left_viewport() {
+        let lines = [Line {
+            p0: Point { x: -10.0, y: 10.0 },
+            p1: Point { x: 10.0, y: 10.0 },
+        }];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [
+            Tile::new(0, 2, 0, L | R),
+            Tile::new(1, 2, 0, L | R),
+            Tile::new(2, 2, 0, L),
+        ];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    #[test]
+    fn horizontal_line_crossing_right_viewport() {
+        let lines = [Line {
+            p0: Point {
+                x: F_V_DIM - 5.0,
+                y: 10.0,
+            },
+            p1: Point {
+                x: F_V_DIM + 5.0,
+                y: 10.0,
+            },
+        }];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [Tile::new(23, 2, 0, R), Tile::new(24, 2, 0, L | R)];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    #[test]
+    fn vertical_lines_outside_viewport() {
+        let lines = [
+            Line {
+                p0: Point { x: 1.0, y: -5.0 },
+                p1: Point { x: 1.0, y: -1.0 },
+            },
+            Line {
+                p0: Point {
+                    x: 1.0,
+                    y: F_V_DIM + 1.0,
+                },
+                p1: Point {
+                    x: 1.0,
+                    y: F_V_DIM + 5.0,
+                },
+            },
+        ];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &[]);
+    }
+
+    #[test]
+    fn vertical_path_on_the_right_of_viewport() {
+        const VIEWPORT_WIDTH: u16 = 10;
+        const VIEWPORT_HEIGHT: u16 = 10;
+
+        let path = BezPath::from_svg("M261,0 L78848,0 L78848,4 L261,4 Z").unwrap();
+        let mut line_buf: Vec<Line> = Vec::new();
+        fill(
+            Level::try_detect().unwrap_or(Level::baseline()),
+            &path,
+            Affine::IDENTITY,
+            &mut line_buf,
+            &mut FlattenCtx::default(),
+            RectU16::new(0, 0, VIEWPORT_WIDTH, VIEWPORT_HEIGHT),
+        );
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        tiles.assert_tiles_match(&line_buf, VIEWPORT_WIDTH, VIEWPORT_HEIGHT, &[]);
+    }
+
+    #[test]
+    fn vertical_line_crossing_top_viewport() {
+        let lines = [
+            Line {
+                p0: Point { x: 1.0, y: -7.0 },
+                p1: Point { x: 1.0, y: 3.0 },
+            },
+            Line {
+                p0: Point { x: 1.0, y: -7.0 },
+                p1: Point { x: 1.0, y: 7.0 },
+            },
+            Line {
+                p0: Point { x: 1.0, y: -7.0 },
+                p1: Point { x: 1.0, y: 8.0 },
+            },
+        ];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [
+            Tile::new(0, 0, 0, W | T),
+            Tile::new(0, 0, 1, W | B | T),
+            Tile::new(0, 1, 1, W | T),
+            Tile::new(0, 0, 2, W | B | T),
+            Tile::new(0, 1, 2, W | T),
+        ];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    #[test]
+    fn vertical_line_crossing_bot_viewport() {
+        let lines = [
+            Line {
+                p0: Point {
+                    x: 1.0,
+                    y: F_V_DIM - 1.0,
+                },
+                p1: Point {
+                    x: 1.0,
+                    y: F_V_DIM + 5.0,
+                },
+            },
+            Line {
+                p0: Point {
+                    x: 1.0,
+                    y: F_V_DIM - 5.0,
+                },
+                p1: Point {
+                    x: 1.0,
+                    y: F_V_DIM + 5.0,
+                },
+            },
+        ];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [
+            Tile::new(0, 24, 0, B),
+            Tile::new(0, 23, 1, B),
+            Tile::new(0, 24, 1, W | T | B),
+        ];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    #[test]
+    fn clip_top_left_corner() {
+        let lines = [Line {
+            p0: Point { x: -1.0, y: 2.0 },
+            p1: Point { x: 2.0, y: -1.0 },
+        }];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [Tile::new(0, 0, 0, W | L | T)];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    #[test]
+    fn clip_bottom_right_corner() {
+        let lines = [Line {
+            p0: Point {
+                x: F_V_DIM + 1.0,
+                y: F_V_DIM - 2.0,
+            },
+            p1: Point {
+                x: F_V_DIM - 2.0,
+                y: F_V_DIM + 1.0,
+            },
+        }];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [Tile::new(24, 24, 0, R | B)];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    //==============================================================================================
+    // Axis-aligned lines
+    //==============================================================================================
+    #[test]
+    fn horizontal_line_left_to_right_three_tile() {
+        let lines = [Line {
+            p0: Point { x: 1.5, y: 1.0 },
+            p1: Point { x: 8.5, y: 1.0 },
+        }];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [
+            Tile::new(0, 0, 0, R),
+            Tile::new(1, 0, 0, R | L),
+            Tile::new(2, 0, 0, L),
+        ];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    #[test]
+    fn horizontal_line_right_to_left_three_tile() {
+        let lines = [Line {
+            p0: Point { x: 8.5, y: 1.0 },
+            p1: Point { x: 1.5, y: 1.0 },
+        }];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [
+            Tile::new(0, 0, 0, R),
+            Tile::new(1, 0, 0, R | L),
+            Tile::new(2, 0, 0, L),
+        ];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    #[test]
+    fn horizontal_line_multi_tile() {
+        let lines = [Line {
+            p0: Point { x: 1.5, y: 1.0 },
+            p1: Point { x: 12.5, y: 1.0 },
+        }];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [
+            Tile::new(0, 0, 0, R),
+            Tile::new(1, 0, 0, R | L),
+            Tile::new(2, 0, 0, R | L),
+            Tile::new(3, 0, 0, L),
+        ];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    #[test]
+    fn vertical_line_down_three_tile() {
+        let lines = [Line {
+            p0: Point { x: 1.0, y: 1.5 },
+            p1: Point { x: 1.0, y: 8.5 },
+        }];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [
+            Tile::new(0, 0, 0, B),
+            Tile::new(0, 1, 0, W | T | B),
+            Tile::new(0, 2, 0, W | T),
+        ];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    #[test]
+    fn vertical_line_down_multi_tile() {
+        let lines = [Line {
+            p0: Point { x: 1.0, y: 1.0 },
+            p1: Point { x: 1.0, y: 13.0 },
+        }];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [
+            Tile::new(0, 0, 0, B),
+            Tile::new(0, 1, 0, W | T | B),
+            Tile::new(0, 2, 0, W | T | B),
+            Tile::new(0, 3, 0, W | T),
+        ];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    #[test]
+    fn vertical_line_up_three_tile() {
+        let lines = [Line {
+            p0: Point { x: 1.0, y: 13.0 },
+            p1: Point { x: 1.0, y: 1.0 },
+        }];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [
+            Tile::new(0, 0, 0, B),
+            Tile::new(0, 1, 0, W | T | B),
+            Tile::new(0, 2, 0, W | T | B),
+            Tile::new(0, 3, 0, W | T),
+        ];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    #[test]
+    fn vertical_line_up_multi_tile() {
+        let lines = [Line {
+            p0: Point { x: 1.0, y: 8.5 },
+            p1: Point { x: 1.0, y: 1.5 },
+        }];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [
+            Tile::new(0, 0, 0, B),
+            Tile::new(0, 1, 0, W | T | B),
+            Tile::new(0, 2, 0, W | T),
+        ];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    // Exclusive to the bottom edge, no P required.
+    #[test]
+    fn vertical_line_touching_bot() {
+        let lines = [Line {
+            p0: Point { x: 1.0, y: 1.0 },
+            p1: Point { x: 1.0, y: 8.0 },
+        }];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [Tile::new(0, 0, 0, B), Tile::new(0, 1, 0, W | T)];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    #[test]
+    fn vertical_line_touching_top() {
+        let lines = [Line {
+            p0: Point { x: 1.0, y: 0.0 },
+            p1: Point { x: 1.0, y: 7.0 },
+        }];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [Tile::new(0, 0, 0, W | B), Tile::new(0, 1, 0, W | T)];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    //==============================================================================================
+    // Sloped Lines
+    //==============================================================================================
+    #[test]
+    fn top_left_to_bottom_right() {
+        let lines = [Line {
+            p0: Point { x: 1.0, y: 1.0 },
+            p1: Point { x: 11.0, y: 9.0 },
+        }];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [
+            Tile::new(0, 0, 0, R),
+            Tile::new(1, 0, 0, L | B),
+            Tile::new(1, 1, 0, W | R | T),
+            Tile::new(2, 1, 0, L | B),
+            Tile::new(2, 2, 0, W | T),
+        ];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    #[test]
+    fn bottom_right_to_top_left() {
+        let lines = [Line {
+            p0: Point { x: 11.0, y: 9.0 },
+            p1: Point { x: 1.0, y: 1.0 },
+        }];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [
+            Tile::new(0, 0, 0, R),
+            Tile::new(1, 0, 0, L | B),
+            Tile::new(1, 1, 0, W | R | T),
+            Tile::new(2, 1, 0, L | B),
+            Tile::new(2, 2, 0, W | T),
+        ];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    #[test]
+    fn bottom_left_to_top_right() {
+        let lines = [Line {
+            p0: Point { x: 2.0, y: 11.0 },
+            p1: Point { x: 14.0, y: 6.0 },
+        }];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [
+            Tile::new(2, 1, 0, R | B),
+            Tile::new(3, 1, 0, L),
+            Tile::new(0, 2, 0, R),
+            Tile::new(1, 2, 0, R | L),
+            Tile::new(2, 2, 0, W | L | T),
+        ];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    #[test]
+    fn top_right_to_bottom_left() {
+        let lines = [Line {
+            p0: Point { x: 14.0, y: 6.0 },
+            p1: Point { x: 2.0, y: 11.0 },
+        }];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [
+            Tile::new(2, 1, 0, R | B),
+            Tile::new(3, 1, 0, L),
+            Tile::new(0, 2, 0, R),
+            Tile::new(1, 2, 0, R | L),
+            Tile::new(2, 2, 0, W | L | T),
+        ];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    #[test]
+    fn two_lines_in_single_tile() {
+        let lines = [
+            Line {
+                p0: Point { x: 1.0, y: 3.0 },
+                p1: Point { x: 3.0, y: 3.0 },
+            },
+            Line {
+                p0: Point { x: 3.0, y: 3.0 },
+                p1: Point { x: 0.0, y: 1.0 },
+            },
+        ];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [Tile::new(0, 0, 0, 0), Tile::new(0, 0, 1, 0)];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    #[test]
+    fn diagonal_cross_corner() {
+        let lines = [Line {
+            p0: Point { x: 3.0, y: 5.0 },
+            p1: Point { x: 5.0, y: 3.0 },
+        }];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [
+            Tile::new(1, 0, 0, L),
+            Tile::new(0, 1, 0, R),
+            Tile::new(1, 1, 0, W | L | T),
+        ];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    #[test]
+    fn diagonal_cross_corner_two() {
+        let lines = [Line {
+            p0: Point { x: 7.9, y: 7.9 },
+            p1: Point { x: 0.1, y: 0.1 },
+        }];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [
+            Tile::new(0, 0, 0, R),
+            Tile::new(1, 0, 0, L),
+            Tile::new(1, 1, 0, W | T),
+        ];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    #[test]
+    fn diagonal_down_slope_tiles() {
+        let lines = [Line {
+            p0: Point { x: 5.0, y: 5.0 },
+            p1: Point { x: 9.0, y: 9.0 },
+        }];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [
+            Tile::new(1, 1, 0, R),
+            Tile::new(2, 1, 0, L),
+            Tile::new(2, 2, 0, W | T),
+        ];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    #[test]
+    fn diagonal_up_slope_tiles() {
+        let lines = [Line {
+            p0: Point { x: 5.0, y: 9.0 },
+            p1: Point { x: 9.0, y: 5.0 },
+        }];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [
+            Tile::new(1, 1, 0, R | B),
+            Tile::new(2, 1, 0, L),
+            Tile::new(1, 2, 0, W | T),
+        ];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    #[test]
+    fn diagonal_down_one_tile() {
+        let lines = [Line {
+            p0: Point { x: 0.0, y: 0.0 },
+            p1: Point { x: 4.0, y: 4.0 },
+        }];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [Tile::new(0, 0, 0, W | R), Tile::new(1, 0, 0, L)];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    #[test]
+    fn diagonal_up_one_tile() {
+        let lines = [Line {
+            p0: Point { x: 0.0, y: 4.0 },
+            p1: Point { x: 4.0, y: 0.0 },
+        }];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [Tile::new(0, 0, 0, R), Tile::new(1, 0, 0, W | L)];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    #[test]
+    fn diagonal_down_two_tile() {
+        let lines = [Line {
+            p0: Point { x: 0.0, y: 0.0 },
+            p1: Point { x: 8.0, y: 8.0 },
+        }];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [
+            Tile::new(0, 0, 0, W | R),
+            Tile::new(1, 0, 0, L),
+            Tile::new(1, 1, 0, W | R | T),
+            Tile::new(2, 1, 0, L),
+        ];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    #[test]
+    fn diagonal_up_two_tile() {
+        let lines = [Line {
+            p0: Point { x: 0.0, y: 8.0 },
+            p1: Point { x: 8.0, y: 0.0 },
+        }];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [
+            Tile::new(1, 0, 0, R | L),
+            Tile::new(2, 0, 0, W | L),
+            Tile::new(0, 1, 0, R),
+            Tile::new(1, 1, 0, W | L | T),
+        ];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    #[test]
+    fn sloped_ending_right() {
+        let lines = [Line {
+            p0: Point { x: 1.0, y: 1.0 },
+            p1: Point { x: 8.0, y: 2.0 },
+        }];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [
+            Tile::new(0, 0, 0, R),
+            Tile::new(1, 0, 0, R | L),
+            Tile::new(2, 0, 0, L),
+        ];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    #[test]
+    fn sloped_touching_top() {
+        let lines = [Line {
+            p0: Point { x: 0.0, y: 8.0 },
+            p1: Point { x: 4.0, y: 0.0 },
+        }];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [
+            Tile::new(0, 0, 0, R | B),
+            Tile::new(1, 0, 0, W | L),
+            Tile::new(0, 1, 0, W | T),
+        ];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    #[test]
+    fn sloped_touching_bot() {
+        let lines = [Line {
+            p0: Point { x: 0.0, y: 0.0 },
+            p1: Point { x: 4.0, y: 8.0 },
+        }];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [
+            Tile::new(0, 0, 0, W | B),
+            Tile::new(0, 1, 0, W | R | T),
+            Tile::new(1, 1, 0, L),
+        ];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    //==============================================================================================
+    // Same Tile Cases
+    //==============================================================================================
+    #[test]
+    fn same_tile() {
+        let lines = [Line {
+            p0: Point { x: 1.0, y: 1.0 },
+            p1: Point { x: 3.0, y: 3.0 },
+        }];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [Tile::new(0, 0, 0, 0)];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    #[test]
+    fn same_tile_left() {
+        let lines = [Line {
+            p0: Point { x: 0.0, y: 1.0 },
+            p1: Point { x: 3.0, y: 1.0 },
+        }];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [Tile::new(0, 0, 0, 0)];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    #[test]
+    fn same_tile_top() {
+        let lines = [Line {
+            p0: Point { x: 1.0, y: 0.0 },
+            p1: Point { x: 1.0, y: 3.0 },
+        }];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [Tile::new(0, 0, 0, W)];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    #[test]
+    fn same_tile_right() {
+        let lines = [Line {
+            p0: Point { x: 1.0, y: 1.0 },
+            p1: Point { x: 4.0, y: 1.0 },
+        }];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [Tile::new(0, 0, 0, R), Tile::new(1, 0, 0, L)];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    #[test]
+    fn same_tile_bottom() {
+        let lines = [
+            Line {
+                p0: Point { x: 1.0, y: 1.0 },
+                p1: Point { x: 1.0, y: 4.0 },
+            },
+            Line {
+                p0: Point { x: 1.0, y: 1.0 },
+                p1: Point { x: 2.0, y: 4.0 },
+            },
+        ];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [Tile::new(0, 0, 0, 0), Tile::new(0, 0, 1, 0)];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    #[test]
+    fn same_tile_top_left() {
+        let lines = [
+            Line {
+                p0: Point { x: 0.0, y: 1.0 },
+                p1: Point { x: 1.0, y: 0.0 },
+            },
+            Line {
+                p0: Point { x: 0.0, y: 0.0001 },
+                p1: Point { x: 0.0001, y: 0.0 },
+            },
+        ];
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        let expected = [Tile::new(0, 0, 0, W), Tile::new(0, 0, 1, W)];
+
+        tiles.assert_tiles_match(&lines, VIEW_DIM, VIEW_DIM, &expected);
+    }
+
+    //==============================================================================================
+    // CulledWindings & Row Marking Logic
+    //==============================================================================================
+    #[test]
+    fn test_culled_windings_new_and_reset() {
+        let mut windings = CulledWindings::new(100);
+        assert_eq!(windings.partial.len(), 25);
+        assert_eq!(windings.coarse.len(), 25);
+        assert_eq!(windings.active.len(), 1);
+
+        windings.coarse[0] = 1;
+        windings.active[0] = 0xFF;
+        windings.culled = true;
+
+        windings.reset();
+        assert_eq!(windings.coarse[0], 0);
+        assert_eq!(windings.active[0], 0);
+
+        windings.coarse[0] = 1;
+        windings.active[0] = 0xFF;
+        windings.culled = false;
+
+        windings.reset();
+        assert_eq!(windings.coarse[0], 1);
+        assert_eq!(windings.active[0], 0xFF);
+    }
+
+    #[test]
+    fn test_mark_row_active() {
+        let mut windings = CulledWindings::new(200);
+        windings.mark_row_active(0);
+        windings.mark_row_active(5);
+        windings.mark_row_active(31);
+        windings.mark_row_active(32);
+        assert_eq!(windings.active[0], (1 << 0) | (1 << 5) | (1 << 31));
+        assert_eq!(windings.active[1], 1 << 0);
+    }
+
+    #[test]
+    fn test_mark_row_range_single_word() {
+        let mut windings = CulledWindings::new(200);
+        windings.mark_row_range_active(5, 10);
+        let expected_mask = ((1_u32 << 5) - 1) << 5;
+        assert_eq!(windings.active[0], expected_mask);
+        assert_eq!(windings.active[1], 0);
+    }
+
+    #[test]
+    fn test_mark_row_range_full_word() {
+        let mut windings = CulledWindings::new(200);
+        windings.mark_row_range_active(0, 32);
+        assert_eq!(windings.active[0], u32::MAX);
+        assert_eq!(windings.active[1], 0);
+    }
+
+    #[test]
+    fn test_mark_row_range_spanning_two_words() {
+        let mut windings = CulledWindings::new(200);
+        windings.mark_row_range_active(30, 35);
+        assert_eq!(windings.active[0], (1 << 30) | (1 << 31));
+        assert_eq!(windings.active[1], (1 << 0) | (1 << 1) | (1 << 2));
+    }
+
+    #[test]
+    fn test_mark_row_range_spanning_multiple_words() {
+        let mut windings = CulledWindings::new(500);
+        windings.mark_row_range_active(10, 80);
+        assert_eq!(windings.active[0], u32::MAX << 10);
+        assert_eq!(windings.active[1], u32::MAX);
+        assert_eq!(windings.active[2], (1 << 16) - 1);
+        assert_eq!(windings.active[3], 0);
+    }
+
+    #[test]
+    fn test_mark_row_range_empty_or_invalid() {
+        let mut windings = CulledWindings::new(200);
+        windings.mark_row_range_active(10, 10);
+        windings.mark_row_range_active(15, 10);
+        assert_eq!(windings.active[0], 0);
+        assert_eq!(windings.active[1], 0);
+    }
+
+    //==============================================================================================
+    // Miscellaneous Cases
+    //==============================================================================================
+    #[test]
+    // See https://github.com/LaurenzV/cpu-sparse-experiments/issues/46.
+    fn infinite_loop() {
+        let line = Line {
+            p0: Point { x: 22.0, y: 552.0 },
+            p1: Point { x: 224.0, y: 388.0 },
+        };
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        tiles.make_tiles_msaa(&[line], 600, 600);
+        tiles.make_tiles_analytic_aa(Level::baseline(), &[line], 600, 600);
+    }
+
+    #[test]
+    // See https://github.com/linebender/vello/issues/1321
+    fn overflow() {
+        let line = Line {
+            p0: Point {
+                x: 59.60001,
+                y: 40.78,
+            },
+            p1: Point {
+                x: 520599.6,
+                y: 100.18,
+            },
+        };
+
+        let mut tiles = Tiles::new(Level::try_detect().unwrap_or(Level::baseline()), VIEW_DIM);
+        tiles.make_tiles_analytic_aa(Level::baseline(), &[line], 200, 100);
+        tiles.make_tiles_msaa(&[line], 200, 100);
+    }
+
+    #[test]
+    fn sort_test() {
+        let mut lines: Vec<Line> = Vec::new();
+        let mut tiles = Tiles::new(Level::baseline(), VIEW_DIM);
+
+        let step = 4.0;
+        let mut y = F_V_DIM - 10.0;
+        while y > 10.0 {
+            lines.push(Line {
+                p0: Point {
+                    x: F_V_DIM - 10.0,
+                    y,
+                },
+                p1: Point { x: 10.0, y },
+            });
+
+            lines.push(Line {
+                p0: Point {
+                    x: F_V_DIM - 12.0,
+                    y,
+                },
+                p1: Point { x: 12.0, y },
+            });
+
+            y -= step;
+        }
+
+        tiles.make_tiles_msaa(&lines, VIEW_DIM, VIEW_DIM);
+        assert!(tiles.tile_buf.first().unwrap().y > tiles.tile_buf.last().unwrap().y);
+        tiles.sort_tiles();
+        check_sorted(&tiles.tile_buf);
+
+        tiles.make_tiles_analytic_aa(Level::baseline(), &lines, VIEW_DIM, VIEW_DIM);
+        assert!(tiles.tile_buf.first().unwrap().y > tiles.tile_buf.last().unwrap().y);
+        tiles.sort_tiles();
+        check_sorted(&tiles.tile_buf);
+    }
+
+    fn check_sorted(buf: &[Tile]) {
+        for i in 0..buf.len() - 1 {
+            let current = buf[i];
+            let next = buf[i + 1];
+
+            if current.y > next.y {
+                panic!(
+                    "Sort Failure [Y]: Tile[{}] (y={}) > Tile[{}] (y={})",
+                    i,
+                    current.y,
+                    i + 1,
+                    next.y
+                );
+            }
+
+            if current.y == next.y {
+                if current.x > next.x {
+                    panic!(
+                        "Sort Failure [X]: at Row y={}, Tile[{}] (x={}) > Tile[{}] (x={})",
+                        current.y,
+                        i,
+                        current.x,
+                        i + 1,
+                        next.x
+                    );
+                }
+
+                if current.x == next.x
+                    && current.packed_winding_line_idx > next.packed_winding_line_idx
+                {
+                    panic!(
+                        "Sort Failure [Payload]: at {}x{}, Tile[{}] (val={}) > Tile[{}] (val={})",
+                        current.x,
+                        current.y,
+                        i,
+                        current.packed_winding_line_idx,
+                        i + 1,
+                        next.packed_winding_line_idx
+                    );
+                }
+            }
+        }
+    }
+}
diff --git a/vendor/vello_common/src/util.rs b/vendor/vello_common/src/util.rs
new file mode 100644
index 000000000..a2dce6ea5
--- /dev/null
+++ b/vendor/vello_common/src/util.rs
@@ -0,0 +1,126 @@
+// Copyright 2025 the Vello Authors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+//! Utility functions.
+
+use crate::math::FloatExt;
+use fearless_simd::{
+    Bytes, Simd, SimdBase, SimdFloat, f32x16, u8x16, u8x32, u16x16, u16x32, u32x16,
+};
+use peniko::kurbo::Affine;
+#[cfg(not(feature = "std"))]
+use peniko::kurbo::common::FloatFuncs as _;
+
+/// Convert f32x16 to u8x16.
+///
+/// **Important note: The values need to be between 0.0 and 1.0, otherwise you might
+/// get inconsistent results across different platforms.**
+// We can't guarantee correctness for values < 0.0 due to a restriction in fearless_simd:
+// https://github.com/linebender/fearless_simd/blob/3f4489389940b7c3c6ee1847a2d007a22494eeff/fearless_simd/src/generated/simd_types.rs#L1623
+#[inline(always)]
+pub fn f32_to_u8<S: Simd>(val: f32x16<S>) -> u8x16<S> {
+    let simd = val.simd;
+    let converted = val.to_int::<u32x16<S>>().to_bytes();
+
+    let (x8_1, x8_2) = simd.split_u8x64(converted);
+    let (p1, p2) = simd.split_u8x32(x8_1);
+    let (p3, p4) = simd.split_u8x32(x8_2);
+
+    let uzp1 = simd.unzip_low_u8x16(p1, p2);
+    let uzp2 = simd.unzip_low_u8x16(p3, p4);
+    simd.unzip_low_u8x16(uzp1, uzp2)
+}
+
+/// A trait for implementing a fast approximal division by 255 for integers.
+pub trait Div255Ext {
+    /// Divide by 255.
+    fn div_255(self) -> Self;
+}
+
+impl<S: Simd> Div255Ext for u16x32<S> {
+    #[inline(always)]
+    fn div_255(self) -> Self {
+        let p1 = Self::splat(self.simd, 255);
+        let p2 = self + p1;
+        p2 >> 8
+    }
+}
+
+impl<S: Simd> Div255Ext for u16x16<S> {
+    #[inline(always)]
+    fn div_255(self) -> Self {
+        let p1 = Self::splat(self.simd, 255);
+        let p2 = self + p1;
+        p2 >> 8
+    }
+}
+
+/// Perform a normalized multiplication for u8x32.
+#[inline(always)]
+pub fn normalized_mul_u8x32<S: Simd>(a: u8x32<S>, b: u8x32<S>) -> u16x32<S> {
+    (S::widen_u8x32(a.simd, a) * S::widen_u8x32(b.simd, b)).div_255()
+}
+
+/// Perform a normalized multiplication for u8x16.
+#[inline(always)]
+pub fn normalized_mul_u8x16<S: Simd>(a: u8x16<S>, b: u8x16<S>) -> u16x16<S> {
+    (S::widen_u8x16(a.simd, a) * S::widen_u8x16(b.simd, b)).div_255()
+}
+
+/// Check if an affine transform is a pure integer translation.
+///
+/// Returns true if the transform only contains integer translation (no rotation,
+/// skew, or scaling), meaning rectangles will remain pixel-aligned after transformation.
+#[inline]
+pub fn is_integer_translation(transform: &Affine) -> bool {
+    let [a, b, c, d, e, f] = transform.as_coeffs();
+    (a - 1.0).is_nearly_zero()
+        && b.is_nearly_zero()
+        && c.is_nearly_zero()
+        && (d - 1.0).is_nearly_zero()
+        && (e - e.round()).is_nearly_zero()
+        && (f - f.round()).is_nearly_zero()
+}
+/// Check if an affine transform has no skewing (i.e. preserves axis alignment).
+#[inline]
+pub fn is_axis_aligned(transform: &Affine) -> bool {
+    let [_, b, c, ..] = transform.as_coeffs();
+    b.is_nearly_zero() && c.is_nearly_zero()
+}
+
+/// Extract scale factors from an affine transform using singular value decomposition.
+///
+/// Returns a tuple of (`scale_x`, `scale_y`) representing the scale along each axis.
+/// This uses the same algorithm as kurbo's internal `svd()` method.
+///
+/// # Arguments
+/// * `transform` - The affine transformation to extract scales from.
+///
+/// # Returns
+/// A tuple `(scale_x, scale_y)` with minimum values clamped to 1e-6 to avoid division by zero.
+///
+/// # Note
+/// TODO: Consider making `Affine::svd()` public in kurbo to avoid duplicating this code.
+/// This implementation mirrors kurbo's internal SVD calculation for extracting scale factors
+/// from arbitrary affine transformations.
+#[inline]
+pub fn extract_scales(transform: &Affine) -> (f32, f32) {
+    let [a, b, c, d, _, _] = transform.as_coeffs();
+    let a = a as f32;
+    let b = b as f32;
+    let c = c as f32;
+    let d = d as f32;
+
+    // Compute singular values using the same formula as kurbo's svd()
+    let a2 = a * a;
+    let b2 = b * b;
+    let c2 = c * c;
+    let d2 = d * d;
+    let s1 = a2 + b2 + c2 + d2;
+    let s2 = ((a2 - b2 + c2 - d2).powi(2) + 4.0 * (a * b + c * d).powi(2)).sqrt();
+
+    let scale_x = (0.5 * (s1 + s2)).sqrt();
+    let scale_y = (0.5 * (s1 - s2)).sqrt();
+
+    (scale_x.max(1e-6), scale_y.max(1e-6))
+}
diff --git a/vendor/winit/src/platform_impl/linux/wayland/seat/pointer/mod.rs b/vendor/winit/src/platform_impl/linux/wayland/seat/pointer/mod.rs
index 3dcb00b26..8a789a869 100644
--- a/vendor/winit/src/platform_impl/linux/wayland/seat/pointer/mod.rs
+++ b/vendor/winit/src/platform_impl/linux/wayland/seat/pointer/mod.rs
@@ -34,6 +34,7 @@ use crate::platform_impl::wayland::state::WinitState;
 use crate::platform_impl::wayland::{self, DeviceId, WindowId};
 
 pub mod relative_pointer;
+mod scroll;
 
 impl PointerHandler for WinitState {
     fn pointer_frame(
@@ -169,26 +170,20 @@ impl PointerHandler for WinitState {
                         window_id,
                     );
                 },
-                PointerEventKind::Axis { horizontal, vertical, .. } => {
+                PointerEventKind::Axis { horizontal, vertical, source, .. } => {
                     // Get the current phase.
                     let mut pointer_data = pointer.winit_data().inner.lock().unwrap();
 
                     let has_discrete_scroll = horizontal.discrete != 0 || vertical.discrete != 0;
 
-                    // Figure out what to do about start/ended phases here.
-                    //
-                    // Figure out how to deal with `Started`. Also the `Ended` is not guaranteed
-                    // to be sent for mouse wheels.
-                    let phase = if horizontal.stop || vertical.stop {
-                        TouchPhase::Ended
-                    } else {
-                        match pointer_data.phase {
-                            // Discrete scroll only results in moved events.
-                            _ if has_discrete_scroll => TouchPhase::Moved,
-                            TouchPhase::Started | TouchPhase::Moved => TouchPhase::Moved,
-                            _ => TouchPhase::Started,
-                        }
-                    };
+                    // PdfCraft patch (13, #991): use the source as well as discrete steps;
+                    // pixel-only wheels do not promise an Ended event either.
+                    let phase = scroll::phase(
+                        pointer_data.phase,
+                        source,
+                        has_discrete_scroll,
+                        horizontal.stop || vertical.stop,
+                    );
 
                     // Update the phase.
                     pointer_data.phase = phase;
diff --git a/vendor/winit/src/platform_impl/linux/wayland/seat/pointer/scroll.rs b/vendor/winit/src/platform_impl/linux/wayland/seat/pointer/scroll.rs
new file mode 100644
index 000000000..791637132
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/wayland/seat/pointer/scroll.rs
@@ -0,0 +1,21 @@
+//! PdfCraft patch (13): Wayland scroll-phase policy, shared with the desktop regression tests.
+
+use wayland_client::protocol::wl_pointer::AxisSource;
+
+use crate::event::TouchPhase;
+
+pub(crate) fn phase(previous: TouchPhase, source: Option<AxisSource>, has_discrete_scroll: bool, stopped: bool) -> TouchPhase {
+    // Wayland does not guarantee axis_stop for these sources. A pixel-only wheel must
+    // not start a finger gesture: consumers would retain its modifiers indefinitely.
+    // https://wayland.freedesktop.org/docs/html/apa.html#protocol-spec-wl_pointer-event-axis_source
+    if stopped {
+        TouchPhase::Ended
+    } else if has_discrete_scroll || matches!(source, Some(AxisSource::Wheel | AxisSource::WheelTilt | AxisSource::Continuous)) {
+        TouchPhase::Moved
+    } else {
+        match previous {
+            TouchPhase::Started | TouchPhase::Moved => TouchPhase::Moved,
+            _ => TouchPhase::Started,
+        }
+    }
+}
diff --git a/vendor/winit/src/platform_impl/macos/view.rs b/vendor/winit/src/platform_impl/macos/view.rs
index 13cc718f6..2423d5724 100644
--- a/vendor/winit/src/platform_impl/macos/view.rs
+++ b/vendor/winit/src/platform_impl/macos/view.rs
@@ -144,6 +144,8 @@ pub struct ViewState {
 
     marked_text: RefCell<Retained<NSMutableAttributedString>>,
     accepts_first_mouse: bool,
+    /// PdfCraft patch: answers `mouseDownCanMoveWindow` (see there).
+    movable_by_window_background: bool,
 
     // Weak reference because the window keeps a strong reference to the view
     _ns_window: WeakId<WinitWindow>,
@@ -882,6 +884,17 @@ declare_class!(
             trace_scope!("acceptsFirstMouse:");
             self.ivars().accepts_first_mouse
         }
+
+        // PdfCraft patch: a press on this view never moves the window unless the window asked to
+        // be movable by its background. NSView answers YES when it isn't opaque, so with a
+        // transparent title bar and a full-size content view AppKit moved the window for any drag
+        // that started in the title-bar band, before the app saw it: tabs drawn there could not
+        // be dragged. Apps that draw their own title bar move the window with `drag_window`.
+        #[method(mouseDownCanMoveWindow)]
+        fn mouse_down_can_move_window(&self) -> bool {
+            trace_scope!("mouseDownCanMoveWindow");
+            self.ivars().movable_by_window_background
+        }
     }
 );
 
@@ -890,6 +903,7 @@ impl WinitView {
         app_delegate: &ApplicationDelegate,
         window: &WinitWindow,
         accepts_first_mouse: bool,
+        movable_by_window_background: bool,
         option_as_alt: OptionAsAlt,
     ) -> Retained<Self> {
         let mtm = MainThreadMarker::from(window);
@@ -911,6 +925,7 @@ impl WinitView {
             committed_in_key_down: Default::default(),
             marked_text: Default::default(),
             accepts_first_mouse,
+            movable_by_window_background,
             _ns_window: WeakId::new(&window.retain()),
             option_as_alt: Cell::new(option_as_alt),
         });
diff --git a/vendor/winit/src/platform_impl/macos/window_delegate.rs b/vendor/winit/src/platform_impl/macos/window_delegate.rs
index e293505eb..86587bdcf 100644
--- a/vendor/winit/src/platform_impl/macos/window_delegate.rs
+++ b/vendor/winit/src/platform_impl/macos/window_delegate.rs
@@ -634,6 +634,7 @@ fn new_window(
             app_delegate,
             &window,
             attrs.platform_specific.accepts_first_mouse,
+            attrs.platform_specific.movable_by_window_background,
             attrs.platform_specific.option_as_alt,
         );
 
diff --git a/xtask/Cargo.toml b/xtask/Cargo.toml
index def0fe755..7c6ca7aed 100644
--- a/xtask/Cargo.toml
+++ b/xtask/Cargo.toml
@@ -6,6 +6,8 @@ publish = false
 license.workspace = true
 
 [dependencies]
+pdfcraft-oracle = { workspace = true }
+pdfcraft-cos = { workspace = true }
 anyhow = "1"
 lopdf = "0.45"
 png = "0.18"
diff --git a/xtask/src/gates.rs b/xtask/src/gates.rs
index 4406a957c..6591233e9 100644
--- a/xtask/src/gates.rs
+++ b/xtask/src/gates.rs
@@ -200,9 +200,10 @@ pub fn check(args: &[String]) -> anyhow::Result<()> {
 /// median. Plan target (M2): median ≥ 0.97.
 pub fn text_oracle(args: &[String]) -> anyhow::Result<()> {
     let limit: usize = args.iter().position(|a| a == "--limit").and_then(|i| args.get(i + 1)).and_then(|v| v.parse().ok()).unwrap_or(usize::MAX);
-    if Command::new("pdftotext").arg("-v").output().is_err() {
-        bail!("pdftotext (poppler) not found; install it to run the text oracle (brew install poppler / apt install poppler-utils)");
-    }
+    let pdftotext = match pdfcraft_oracle::pdftotext() {
+        Ok(o) => o,
+        Err(absent) => bail!("{absent}"),
+    };
     run_args(&["build", "--release", "-p", "pdfcraft-cli"])?;
     let corpus = root().join("corpus/pdfjs/test/pdfs");
     let mut files: Vec<PathBuf> =
@@ -211,9 +212,18 @@ pub fn text_oracle(args: &[String]) -> anyhow::Result<()> {
     let cli = release_cli();
     let mut scores = Vec::new();
     let mut worst: Vec<(f64, String)> = Vec::new();
+    let mut not_permitted = 0usize;
     for f in files.iter().take(limit) {
+        // A document may forbid copying its text, and we honour that: `pdfcraft-cli text` refuses
+        // and says how to override it with the owner password. pdftotext ignores the flag and
+        // extracts anyway, so scoring us against it there measures obedience, not quality --
+        // bug1815476.pdf scored 0.000 for behaving correctly on a page we render perfectly.
+        if !copying_allowed(f) {
+            not_permitted = not_permitted.saturating_add(1);
+            continue;
+        }
         let ours = run_capture(Command::new(&cli).arg("text").arg(f), 20);
-        let theirs = run_capture(Command::new("pdftotext").arg("-q").arg(f).arg("-"), 20);
+        let theirs = run_capture(pdftotext.command().arg("-q").arg(f).arg("-"), 20);
         let (Some(ours), Some(theirs)) = (ours, theirs) else { continue };
         let (a, b) = (words(&ours), words(&theirs));
         if b.len() < 20 {
@@ -231,6 +241,9 @@ pub fn text_oracle(args: &[String]) -> anyhow::Result<()> {
     let median = scores[scores.len() / 2];
     let mean = scores.iter().sum::<f64>() / scores.len() as f64;
     println!("text oracle: {} files with text; median F1 {:.3}, mean {:.3}, p10 {:.3}", scores.len(), median, mean, scores[scores.len() / 10]);
+    if not_permitted > 0 {
+        println!("  {not_permitted} skipped: the document forbids copying its text, which we honour and pdftotext does not");
+    }
     println!("lowest:");
     for (s, n) in worst.iter().take(12) {
         println!("  {s:.3}  {n}");
@@ -238,15 +251,153 @@ pub fn text_oracle(args: &[String]) -> anyhow::Result<()> {
     Ok(())
 }
 
+/// Compare our rendering against Poppler's, page 1 of every PDF in a directory.
+///
+/// This is the measured half of the fidelity gap (`docs/gaps.md` gap 12): until it exists, every
+/// claim about rendering quality is a judgement. It reports rather than gates, because the corpus
+/// is not fetched on CI and because a first reading of a borrowed renderer is a baseline to
+/// improve on, not a bar to clear.
+///
+/// The score is the share of pixels with no near match in the other renderer's 3x3 neighbourhood
+/// (`pdfcraft_oracle::pixels`), which forgives antialiasing and subpixel placement but not
+/// missing or wrong content. **Lower is better; it is a disagreement rate, not a quality score.**
+pub fn render_oracle(args: &[String]) -> anyhow::Result<()> {
+    let limit: usize = flag_num(args, "--limit").unwrap_or(usize::MAX);
+    let dpi: u32 = flag_num(args, "--dpi").unwrap_or(72);
+    let tolerance: u8 = flag_num(args, "--tolerance").unwrap_or(8);
+    // Annotations are shown by default, which is not the obvious choice and was settled by
+    // measurement rather than argument. Poppler synthesises an appearance for an annotation that
+    // has none, where we draw only what the document carries (`view.render-annotation-appearances`
+    // records link borders without `/AP` as not covered), so showing them scores us for a known
+    // gap: bug1552113.pdf is 84% purely because Poppler paints a 112-unit link border over the
+    // text that fixture exists to show -- and our rendering, not Poppler's, is the readable one.
+    //
+    // Hiding them is worse, though, because it scores Poppler for every appearance we *do* draw.
+    // Over the same 250 files: shown gives mean 2.16%, p90 5.35%, 25 files within 0.1%; hidden
+    // gives 2.18%, 5.55% and 22, with annotation-tx3.pdf jumping to 45.64%. The two biases very
+    // nearly cancel, so the default stays with the fuller picture and this flag exists to tell
+    // the two apart when a single file's score needs explaining.
+    let hide_annotations = args.iter().any(|a| a == "--hide-annotations");
+    let dir =
+        args.iter().position(|a| a == "--dir").and_then(|i| args.get(i + 1)).map_or_else(|| root().join("corpus/pdfjs/test/pdfs"), PathBuf::from);
+
+    let pdftoppm = match pdfcraft_oracle::pdftoppm() {
+        Ok(tool) => tool,
+        Err(absent) => bail!("{absent}"),
+    };
+    run_args(&["build", "--release", "-p", "pdfcraft-cli"])?;
+    let cli = release_cli();
+
+    let mut files: Vec<PathBuf> = std::fs::read_dir(&dir)
+        .with_context(|| format!("{}: no such directory (cargo xtask corpus, or pass --dir)", dir.display()))?
+        .flatten()
+        .map(|e| e.path())
+        .filter(|p| p.extension().is_some_and(|e| e.eq_ignore_ascii_case("pdf")))
+        .collect();
+    files.sort();
+
+    let out_pam = std::env::temp_dir().join(format!("pdfcraft-render-oracle-{}.pam", std::process::id()));
+    let (mut scores, mut sizes_differed, mut ours_failed, mut theirs_failed) = (Vec::new(), 0usize, 0usize, 0usize);
+    let mut worst: Vec<(f64, String)> = Vec::new();
+    for file in files.iter().take(limit) {
+        let name = file.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
+        let ours = Command::new(&cli)
+            .args(["render", "--page", "1", "--dpi"])
+            .arg(dpi.to_string())
+            .arg("--out")
+            .arg(&out_pam)
+            .arg(file)
+            .status()
+            .ok()
+            .filter(std::process::ExitStatus::success)
+            .and_then(|_| std::fs::read(&out_pam).ok())
+            .and_then(|b| pdfcraft_oracle::pixels::decode_pam_gray(&b));
+        let mut theirs_cmd = pdftoppm.command();
+        theirs_cmd.args(["-singlefile", "-gray", "-f", "1", "-l", "1", "-r"]).arg(dpi.to_string());
+        if hide_annotations {
+            theirs_cmd.arg("-hide-annotations");
+        }
+        theirs_cmd.arg(file);
+        let theirs = run_capture_bytes(&mut theirs_cmd, 30).and_then(|b| pdfcraft_oracle::pixels::decode_pgm(&b));
+        // An oracle that cannot read a file says nothing about our fidelity, and a file we cannot
+        // read is `xtask check`'s business, not this one's. Count each side and move on.
+        if ours.is_none() {
+            ours_failed = ours_failed.saturating_add(1);
+        }
+        if theirs.is_none() {
+            theirs_failed = theirs_failed.saturating_add(1);
+        }
+        let (Some((aw, ah, a)), Some((bw, bh, b))) = (ours, theirs) else { continue };
+        let (Some(a), Some(b)) = (pixels_of(aw, ah, &a), pixels_of(bw, bh, &b)) else { continue };
+        match pdfcraft_oracle::pixels::compare(a, b, tolerance) {
+            Ok(diff) => {
+                scores.push(diff.percent());
+                worst.push((diff.percent(), name));
+            }
+            // Different rounding of the page box at this scale: not a fidelity signal.
+            Err(_) => sizes_differed = sizes_differed.saturating_add(1),
+        }
+    }
+    let _ = std::fs::remove_file(&out_pam);
+
+    if scores.is_empty() {
+        bail!(
+            "no comparable files in {} ({sizes_differed} size mismatches, {ours_failed} we could not render, {theirs_failed} Poppler could not)",
+            dir.display()
+        );
+    }
+    scores.sort_by(f64::total_cmp);
+    worst.sort_by(|a, b| b.0.total_cmp(&a.0));
+    let median = scores.get(scores.len() / 2).copied().unwrap_or(0.0);
+    let mean = scores.iter().sum::<f64>() / scores.len() as f64;
+    let p90 = scores.get(scores.len().saturating_mul(9) / 10).copied().unwrap_or(0.0);
+    let clean = scores.iter().filter(|s| **s < 0.1).count();
+    println!("render oracle vs Poppler at {dpi} dpi, tolerance {tolerance} (disagreement rate, lower is better)");
+    println!("  {} compared: median {median:.2}%, mean {mean:.2}%, p90 {p90:.2}%", scores.len());
+    println!("  {clean} within 0.1%; {sizes_differed} size mismatches, {ours_failed} we could not render, {theirs_failed} Poppler could not");
+    println!("worst:");
+    for (score, name) in worst.iter().take(12) {
+        println!("  {score:6.2}%  {name}");
+    }
+    Ok(())
+}
+
+/// Whether the document lets its text be copied.
+///
+/// `true` when it is unencrypted, when the flag is set, and when the file cannot be opened at all
+/// — a file we cannot read is a different problem, and silently dropping it from the comparison
+/// would hide it.
+fn copying_allowed(path: &Path) -> bool {
+    let Ok(bytes) = std::fs::read(path) else { return true };
+    let Ok(doc) = pdfcraft_cos::Document::open(std::sync::Arc::new(bytes)) else { return true };
+    doc.permissions().is_none_or(|p| p.copy())
+}
+
+/// The value after `name` on the command line, parsed, or `None` when it is absent or malformed.
+fn flag_num<T: std::str::FromStr>(args: &[String], name: &str) -> Option<T> {
+    args.iter().position(|a| a == name).and_then(|i| args.get(i.checked_add(1)?)).and_then(|v| v.parse().ok())
+}
+
+fn pixels_of(w: usize, h: usize, buf: &[u8]) -> Option<pdfcraft_oracle::pixels::Gray<'_>> {
+    pdfcraft_oracle::pixels::Gray::new(w, h, buf)
+}
+
 fn run_capture(cmd: &mut Command, timeout_s: u64) -> Option<String> {
+    // `read_to_string` left the buffer empty when the output was not UTF-8; `from_utf8` keeps
+    // exactly that behaviour now that the capture itself is byte-oriented.
+    Some(String::from_utf8(run_capture_bytes(cmd, timeout_s)?).unwrap_or_default())
+}
+
+/// [`run_capture`] for output that is not text — an oracle's image on stdout, for instance.
+fn run_capture_bytes(cmd: &mut Command, timeout_s: u64) -> Option<Vec<u8>> {
     let mut child = cmd.stdout(std::process::Stdio::piped()).stderr(std::process::Stdio::null()).spawn().ok()?;
     let start = std::time::Instant::now();
-    let mut out = String::new();
+    let mut out = Vec::new();
     let mut stdout = child.stdout.take()?;
     let reader = std::thread::spawn(move || {
         use std::io::Read;
-        let mut s = String::new();
-        let _ = stdout.read_to_string(&mut s);
+        let mut s = Vec::new();
+        let _ = stdout.read_to_end(&mut s);
         s
     });
     loop {
@@ -261,7 +412,7 @@ fn run_capture(cmd: &mut Command, timeout_s: u64) -> Option<String> {
             Err(_) => return None,
         }
     }
-    out.push_str(&reader.join().ok()?);
+    out.extend_from_slice(&reader.join().ok()?);
     Some(out)
 }
 
diff --git a/xtask/src/layers.rs b/xtask/src/layers.rs
index 1bda1dc4d..a0907cb1a 100644
--- a/xtask/src/layers.rs
+++ b/xtask/src/layers.rs
@@ -198,11 +198,17 @@ pub fn check(crates: &[Crate]) -> Vec<Violation> {
                 continue;
             }
             if d.workspace {
-                if matches!(class, Class::Standalone(_)) && !standalone_allowed(&c.name, &d.name) {
+                let dep_class = classify(&d.name);
+                // Test support is a dev-dependency only (`Class::Testkit`) and so never reaches
+                // the product graph a standalone crate publishes. Checking it against the
+                // standalone allow-list would stop `cos` using the shared oracles in its own
+                // tests, which is the one thing those crates exist for.
+                let testkit_dev = dep_class == Some(Class::Testkit) && d.kind == DepKind::Dev;
+                if matches!(class, Class::Standalone(_)) && !testkit_dev && !standalone_allowed(&c.name, &d.name) {
                     out.push(Violation::StandaloneHasWorkspaceDep { krate: c.name.clone(), dep: d.name.clone() });
                     continue;
                 }
-                match classify(&d.name) {
+                match dep_class {
                     None => {}
                     Some(Class::Testkit) if d.kind != DepKind::Dev && class != Class::Testkit => {
                         out.push(Violation::TestkitAsNormalDep { krate: c.name.clone(), dep: d.name.clone() });
@@ -322,6 +328,17 @@ mod tests {
         assert!(check(&[c("pdfcraft-render", &[("pdfcraft-oracle", Dev, true)])]).is_empty());
         let v = check(&[c("pdfcraft-render", &[("pdfcraft-oracle", Normal, true)])]);
         assert!(matches!(v[..], [Violation::TestkitAsNormalDep { .. }]));
+
+        // A standalone crate may use test support in its own tests: a dev-dependency is not part
+        // of the graph the standalone rule protects. `cos` is where the qpdf oracle is needed.
+        assert!(check(&[c("pdfcraft-cos", &[("pdfcraft-oracle", Dev, true)])]).is_empty());
+        assert!(check(&[c("pdfcraft-geom", &[("pdfcraft-testkit", Dev, true)])]).is_empty());
+        // ...but only as a dev-dependency, and only for test support. Product crates are still
+        // off-limits to a standalone crate however they are depended on.
+        let v = check(&[c("pdfcraft-cos", &[("pdfcraft-oracle", Normal, true)])]);
+        assert!(matches!(v[..], [Violation::StandaloneHasWorkspaceDep { .. }]), "{v:?}");
+        let v = check(&[c("pdfcraft-cos", &[("pdfcraft-model", Dev, true)])]);
+        assert!(matches!(v[..], [Violation::StandaloneHasWorkspaceDep { .. }]), "{v:?}");
     }
 
     #[test]
diff --git a/xtask/src/main.rs b/xtask/src/main.rs
index 70741d22b..f06c09944 100644
--- a/xtask/src/main.rs
+++ b/xtask/src/main.rs
@@ -33,6 +33,11 @@ const COMMANDS: &[(&str, &str, Command)] = &[
         macos_integration::run,
     ),
     ("text-oracle", "Compare text extraction with pdftotext over corpus/ (word F1; target median ≥ 0.97)", gates::text_oracle),
+    (
+        "render-oracle",
+        "Compare page rendering with Poppler over corpus/ (pixel disagreement rate; --dir, --dpi, --limit, --tolerance, --hide-annotations)",
+        gates::render_oracle,
+    ),
     ("screenshots", "Regenerate the README screenshots in docs/images/ and their ATTRIBUTION entries", screenshots::run),
     ("models", "Fetch the OCR models (ATTRIBUTION.toml kind = \"model\") into assets/models/, verified by SHA-256", assets::models),
     ("demo-pdf", "Build dist/demo/pdfcraft-showcase.pdf (needs Google Chrome or Chromium)", demo_pdf::run),