diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 94a4c545fe..38ee53caf3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -29,6 +29,10 @@ jobs:
     permissions:
       contents: read
     steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
+        with:
+          egress-policy: audit
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index b7b1d409c8..78dc1b614b 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -24,13 +24,17 @@ jobs:
     name: fuzz (mutation, 15 min)
     runs-on: ubuntu-latest
     steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
+        with:
+          egress-policy: audit
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
+      - uses: step-security/dtolnay-rust-toolchain@8dd607977d06adf4ed49b190381e74c17a9dd25f # v1.0.0
         with:
           toolchain: stable
-      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+      - uses: step-security/rust-cache@8871c8ba063416da7c32246932ea6ae08700453e # v2.9.2
         with:
           key: fuzz
       - name: Fetch the pdf.js corpus (seeds)
diff --git a/.github/workflows/packaging-lint.yml b/.github/workflows/packaging-lint.yml
index ea61d84303..1771a35fea 100644
--- a/.github/workflows/packaging-lint.yml
+++ b/.github/workflows/packaging-lint.yml
@@ -27,6 +27,10 @@ jobs:
     name: Windows installation policy (no app build)
     runs-on: windows-latest
     steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
+        with:
+          egress-policy: audit
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
diff --git a/Cargo.lock b/Cargo.lock
index b5867bcf8d..cecedc12c9 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -238,7 +238,7 @@ dependencies = [
  "objc2-foundation 0.3.2",
  "parking_lot",
  "percent-encoding",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
  "wl-clipboard-rs",
  "x11rb",
 ]
@@ -321,7 +321,7 @@ dependencies = [
  "futures-lite",
  "parking",
  "polling",
- "rustix 1.1.5",
+ "rustix 1.1.6",
  "slab",
  "windows-sys 0.61.2",
 ]
@@ -352,7 +352,7 @@ dependencies = [
  "cfg-if",
  "event-listener",
  "futures-lite",
- "rustix 1.1.5",
+ "rustix 1.1.6",
 ]
 
 [[package]]
@@ -378,7 +378,7 @@ dependencies = [
  "cfg-if",
  "futures-core",
  "futures-io",
- "rustix 1.1.5",
+ "rustix 1.1.6",
  "signal-hook-registry",
  "slab",
  "windows-sys 0.61.2",
@@ -878,7 +878,7 @@ checksum = "4dbf9978365bac10f54d1d4b04f7ce4427e51f71d61f2fe15e3fed5166474df7"
 dependencies = [
  "bitflags 2.13.2",
  "polling",
- "rustix 1.1.5",
+ "rustix 1.1.6",
  "slab",
  "tracing",
 ]
@@ -902,7 +902,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "138efcf0940a02ebf0cc8d1eff41a1682a46b431630f4c52450d6265876021fa"
 dependencies = [
  "calloop 0.14.4",
- "rustix 1.1.5",
+ "rustix 1.1.6",
  "wayland-backend",
  "wayland-client",
 ]
@@ -1243,14 +1243,14 @@ dependencies = [
 [[package]]
 name = "craft-print"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=1ee01a4c58729d781638b8afbd8982726dbdefcb#1ee01a4c58729d781638b8afbd8982726dbdefcb"
+source = "git+https://github.com/storytold/craft-libs?rev=60ede99985ef1e5df87a2aca66ed538eb23dec99#60ede99985ef1e5df87a2aca66ed538eb23dec99"
 dependencies = [
  "craft-winprint-gdi",
  "log",
  "miniz_oxide 0.9.1",
  "roxmltree 0.21.2",
  "tempfile",
- "winprint 0.2.1 (git+https://github.com/storytold/winprint.rs?rev=3c978dfcf3d460577fabd87aeea7a84ffdcfb396)",
+ "winprint 0.2.1 (git+https://github.com/storytold/winprint.rs?rev=bc06a7c48b768eb27a828c7986f6d2868b245ee0)",
  "winsafe",
 ]
 
@@ -1289,7 +1289,7 @@ dependencies = [
 [[package]]
 name = "craft-update"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=1b34eba41e62138fc2438d2734523b302840b45d#1b34eba41e62138fc2438d2734523b302840b45d"
+source = "git+https://github.com/storytold/craft-libs?rev=6e03f65bf45181db77ba6229716e6624db9eb25b#6e03f65bf45181db77ba6229716e6624db9eb25b"
 dependencies = [
  "chrono",
  "dunce",
@@ -1299,6 +1299,7 @@ dependencies = [
  "image",
  "log",
  "plist",
+ "rustix 1.1.6",
  "semver",
  "serde",
  "serde_json",
@@ -2050,7 +2051,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -2427,7 +2428,7 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1bd49230192a3797a9a4d6abe9b3eed6f7fa4c8a8a4947977c6f80025f92cbd8"
 dependencies = [
- "rustix 1.1.5",
+ "rustix 1.1.6",
  "windows-link",
 ]
 
@@ -4172,7 +4173,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7d8fae84b431384b68627d0f9b3b1245fcf9f46f6c0e3dc902e9dce64edd1967"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -4263,7 +4264,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft"
-version = "0.18.1"
+version = "0.21.0"
 dependencies = [
  "chrono",
  "craft-update",
@@ -4288,7 +4289,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-a11y"
-version = "0.18.1"
+version = "0.21.0"
 dependencies = [
  "pdfcraft-content",
  "pdfcraft-cos",
@@ -4299,7 +4300,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-annot"
-version = "0.18.1"
+version = "0.21.0"
 dependencies = [
  "hayro-syntax",
  "pdfcraft-cos",
@@ -4311,7 +4312,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-audit"
-version = "0.18.1"
+version = "0.21.0"
 dependencies = [
  "pdfcraft-content",
  "pdfcraft-cos",
@@ -4322,7 +4323,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-automation"
-version = "0.18.1"
+version = "0.21.0"
 dependencies = [
  "base64 0.23.1",
  "flate2",
@@ -4338,7 +4339,7 @@ dependencies = [
  "pdfcraft-render",
  "pdfcraft-xfa",
  "png 0.18.1",
- "rustix 1.1.5",
+ "rustix 1.1.6",
  "serde_json",
  "sha2 0.11.1",
  "tempfile",
@@ -4346,7 +4347,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-cli"
-version = "0.18.1"
+version = "0.21.0"
 dependencies = [
  "base64 0.23.1",
  "pdfcraft-audit",
@@ -4357,18 +4358,18 @@ dependencies = [
  "pdfcraft-preflight",
  "pdfcraft-render",
  "png 0.18.1",
- "rustix 1.1.5",
+ "rustix 1.1.6",
  "serde_json",
  "winresource",
 ]
 
 [[package]]
 name = "pdfcraft-compare"
-version = "0.18.1"
+version = "0.21.0"
 
 [[package]]
 name = "pdfcraft-content"
-version = "0.18.1"
+version = "0.21.0"
 dependencies = [
  "hayro-syntax",
  "pdfcraft-cos",
@@ -4376,7 +4377,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-cos"
-version = "0.18.1"
+version = "0.21.0"
 dependencies = [
  "chrono",
  "hayro-syntax",
@@ -4393,7 +4394,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-create"
-version = "0.18.1"
+version = "0.21.0"
 dependencies = [
  "encoding_rs",
  "hayro-ccitt",
@@ -4405,6 +4406,7 @@ dependencies = [
  "pdfcraft-model",
  "pdfcraft-xfa",
  "png 0.18.1",
+ "rustix 1.1.6",
  "thiserror 2.0.21",
  "tiff",
  "zune-jpeg",
@@ -4412,7 +4414,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-crypt"
-version = "0.18.1"
+version = "0.21.0"
 dependencies = [
  "aes",
  "md-5",
@@ -4425,7 +4427,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-edit"
-version = "0.18.1"
+version = "0.21.0"
 dependencies = [
  "hayro-syntax",
  "icu_segmenter",
@@ -4444,7 +4446,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-engine"
-version = "0.18.1"
+version = "0.21.0"
 dependencies = [
  "chrono",
  "craft-docpath",
@@ -4488,14 +4490,14 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-export"
-version = "0.18.1"
+version = "0.21.0"
 dependencies = [
  "flate2",
 ]
 
 [[package]]
 name = "pdfcraft-filters"
-version = "0.18.1"
+version = "0.21.0"
 dependencies = [
  "fax",
  "flate2",
@@ -4508,7 +4510,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-fonts"
-version = "0.18.1"
+version = "0.21.0"
 dependencies = [
  "harfrust",
  "pdfcraft-cos",
@@ -4518,7 +4520,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-forms"
-version = "0.18.1"
+version = "0.21.0"
 dependencies = [
  "hayro-syntax",
  "pdfcraft-content",
@@ -4531,11 +4533,11 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-geom"
-version = "0.18.1"
+version = "0.21.0"
 
 [[package]]
 name = "pdfcraft-js"
-version = "0.18.1"
+version = "0.21.0"
 dependencies = [
  "boa_engine",
  "chrono",
@@ -4543,7 +4545,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-measure"
-version = "0.18.1"
+version = "0.21.0"
 dependencies = [
  "pdfcraft-annot",
  "pdfcraft-content",
@@ -4556,14 +4558,14 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-model"
-version = "0.18.1"
+version = "0.21.0"
 dependencies = [
  "pdfcraft-cos",
 ]
 
 [[package]]
 name = "pdfcraft-ocr"
-version = "0.18.1"
+version = "0.21.0"
 dependencies = [
  "ocrs",
  "pdfcraft-fonts",
@@ -4578,7 +4580,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-ocr-worker"
-version = "0.18.1"
+version = "0.21.0"
 dependencies = [
  "js-sys",
  "pdfcraft-ocr",
@@ -4588,7 +4590,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-optimize"
-version = "0.18.1"
+version = "0.21.0"
 dependencies = [
  "image",
  "pdfcraft-annot",
@@ -4605,11 +4607,11 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-oracle"
-version = "0.18.1"
+version = "0.21.0"
 
 [[package]]
 name = "pdfcraft-organize"
-version = "0.18.1"
+version = "0.21.0"
 dependencies = [
  "hayro-syntax",
  "pdfcraft-content",
@@ -4620,18 +4622,18 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-platform"
-version = "0.18.1"
+version = "0.21.0"
 dependencies = [
  "async-channel",
  "futures-lite",
  "log",
- "rustix 1.1.5",
+ "rustix 1.1.6",
  "zbus",
 ]
 
 [[package]]
 name = "pdfcraft-prc"
-version = "0.18.1"
+version = "0.21.0"
 dependencies = [
  "flate2",
  "proptest",
@@ -4640,7 +4642,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-prc-render"
-version = "0.18.1"
+version = "0.21.0"
 dependencies = [
  "flate2",
  "pdfcraft-prc",
@@ -4649,7 +4651,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-preflight"
-version = "0.18.1"
+version = "0.21.0"
 dependencies = [
  "flate2",
  "pdfcraft-content",
@@ -4660,7 +4662,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-print"
-version = "0.18.1"
+version = "0.21.0"
 dependencies = [
  "craft-print",
  "log",
@@ -4675,7 +4677,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-redact"
-version = "0.18.1"
+version = "0.21.0"
 dependencies = [
  "aho-corasick",
  "pdfcraft-annot",
@@ -4699,7 +4701,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-render"
-version = "0.18.1"
+version = "0.21.0"
 dependencies = [
  "bytemuck",
  "flate2",
@@ -4723,7 +4725,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-sign"
-version = "0.18.1"
+version = "0.21.0"
 dependencies = [
  "aes",
  "aws-lc-rs",
@@ -4762,11 +4764,11 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-testkit"
-version = "0.18.1"
+version = "0.21.0"
 
 [[package]]
 name = "pdfcraft-ui-egui"
-version = "0.18.1"
+version = "0.21.0"
 dependencies = [
  "arboard",
  "base64 0.23.1",
@@ -4807,7 +4809,7 @@ dependencies = [
  "pollster 1.0.1",
  "proptest",
  "rfd",
- "rustix 1.1.5",
+ "rustix 1.1.6",
  "serde",
  "serde_json",
  "skrifa 0.44.0",
@@ -4825,7 +4827,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-web"
-version = "0.18.1"
+version = "0.21.0"
 dependencies = [
  "craft-web-api",
  "craft-web-host",
@@ -4840,7 +4842,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-xfa"
-version = "0.18.1"
+version = "0.21.0"
 dependencies = [
  "base64 0.23.1",
  "image",
@@ -4854,7 +4856,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-xfdf"
-version = "0.18.1"
+version = "0.21.0"
 dependencies = [
  "base64 0.23.1",
  "pdfcraft-annot",
@@ -5143,7 +5145,7 @@ dependencies = [
  "concurrent-queue",
  "hermit-abi",
  "pin-project-lite",
- "rustix 1.1.5",
+ "rustix 1.1.6",
  "windows-sys 0.61.2",
 ]
 
@@ -5401,7 +5403,7 @@ dependencies = [
  "once_cell",
  "socket2",
  "tracing",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -5953,15 +5955,15 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "1.1.5"
+version = "1.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "891efababe418670775f199f0d233d84843c227a0949a883ce15b37c78d6629d"
+checksum = "e5e76742e5294153d4dde1207dbec5bdd81eef6fabdc0d2118babadabfd858aa"
 dependencies = [
  "bitflags 2.13.2",
  "errno",
  "libc",
  "linux-raw-sys 0.12.1",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -6031,7 +6033,7 @@ dependencies = [
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -6655,7 +6657,7 @@ dependencies = [
  "libc",
  "log",
  "memmap2",
- "rustix 1.1.5",
+ "rustix 1.1.6",
  "thiserror 2.0.21",
  "wayland-backend",
  "wayland-client",
@@ -6920,8 +6922,8 @@ dependencies = [
  "fastrand",
  "getrandom 0.4.3",
  "once_cell",
- "rustix 1.1.5",
- "windows-sys 0.61.2",
+ "rustix 1.1.6",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -7673,7 +7675,7 @@ checksum = "38a91b4eaddff87b1cd1074985e3713da4af2c49742d1b356b2c01670a67a078"
 dependencies = [
  "cc",
  "downcast-rs",
- "rustix 1.1.5",
+ "rustix 1.1.6",
  "scoped-tls",
  "smallvec",
  "wayland-sys",
@@ -7686,7 +7688,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e3c36a0f861ad76d0901f2800b46321410d9f73f2ea88aac0650d86c32688073"
 dependencies = [
  "bitflags 2.13.2",
- "rustix 1.1.5",
+ "rustix 1.1.6",
  "wayland-backend",
  "wayland-scanner",
 ]
@@ -7708,7 +7710,7 @@ version = "0.31.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4a52d18780be9b1314328a3de5f930b73d2200112e3849ca6cb11822793fb34d"
 dependencies = [
- "rustix 1.1.5",
+ "rustix 1.1.6",
  "wayland-client",
  "xcursor",
 ]
@@ -8046,7 +8048,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -8320,28 +8322,6 @@ dependencies = [
  "memchr",
 ]
 
-[[package]]
-name = "winprint"
-version = "0.2.1"
-source = "git+https://github.com/storytold/winprint.rs?rev=3c978dfcf3d460577fabd87aeea7a84ffdcfb396#3c978dfcf3d460577fabd87aeea7a84ffdcfb396"
-dependencies = [
- "flate2",
- "fmt-derive",
- "reqwest",
- "scopeguard",
- "sigstore-trust-root",
- "sigstore-types",
- "sigstore-verify",
- "strum",
- "tar",
- "thiserror 2.0.21",
- "windows",
- "windows-core",
- "windows-implement",
- "windows-numerics",
- "xml",
-]
-
 [[package]]
 name = "winprint"
 version = "0.2.1"
@@ -8363,6 +8343,28 @@ dependencies = [
  "xml",
 ]
 
+[[package]]
+name = "winprint"
+version = "0.2.1"
+source = "git+https://github.com/storytold/winprint.rs?rev=bc06a7c48b768eb27a828c7986f6d2868b245ee0#bc06a7c48b768eb27a828c7986f6d2868b245ee0"
+dependencies = [
+ "flate2",
+ "fmt-derive",
+ "reqwest",
+ "scopeguard",
+ "sigstore-trust-root",
+ "sigstore-types",
+ "sigstore-verify",
+ "strum",
+ "tar",
+ "thiserror 2.0.21",
+ "windows",
+ "windows-core",
+ "windows-implement",
+ "windows-numerics",
+ "xml",
+]
+
 [[package]]
 name = "winreg"
 version = "0.55.0"
@@ -8404,7 +8406,7 @@ dependencies = [
  "libc",
  "log",
  "os_pipe",
- "rustix 1.1.5",
+ "rustix 1.1.6",
  "thiserror 2.0.21",
  "tree_magic_mini",
  "wayland-backend",
@@ -8462,7 +8464,7 @@ dependencies = [
  "libc",
  "libloading",
  "once_cell",
- "rustix 1.1.5",
+ "rustix 1.1.6",
  "x11rb-protocol",
 ]
 
@@ -8504,7 +8506,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32e45ad4206f6d2479085147f02bc2ef834ac85886624a23575ae137c8aa8156"
 dependencies = [
  "libc",
- "rustix 1.1.5",
+ "rustix 1.1.6",
 ]
 
 [[package]]
@@ -8611,7 +8613,7 @@ dependencies = [
  "hex",
  "libc",
  "ordered-stream",
- "rustix 1.1.5",
+ "rustix 1.1.6",
  "serde",
  "serde_repr",
  "tracing",
diff --git a/Cargo.toml b/Cargo.toml
index 30367fa35c..9cd5b3b7c3 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -5,7 +5,7 @@ exclude = ["vendor"]
 default-members = ["crates/*", "apps/pdfcraft", "apps/pdfcraft-cli", "xtask"]
 
 [workspace.package]
-version = "0.18.1"
+version = "0.21.0"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
@@ -26,47 +26,47 @@ craft-keymap = { git = "https://github.com/storytold/craft-libs", version = "0.1
 # the commit in `craft-i18n.rev`). Already in the tree through craft-ui.
 craft-i18n = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "787a7a0f972fd1d7a7618fdbeca3a5267a0407ff" }
 # Shared system spooler; document composition remains in pdfcraft-print.
-craft-print = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "1ee01a4c58729d781638b8afbd8982726dbdefcb" }
+craft-print = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "60ede99985ef1e5df87a2aca66ed538eb23dec99" }
 # Whether a path stored in a document may be opened (GoToR link targets).
 craft-docpath = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "787a7a0f972fd1d7a7618fdbeca3a5267a0407ff" }
 # craft-update: app-specific pretend versions apply to startup and manual checks.
-craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "1b34eba41e62138fc2438d2734523b302840b45d", features = ["egui"] }
+craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "6e03f65bf45181db77ba6229716e6624db9eb25b", features = ["egui"] }
 # internal
-pdfcraft-geom = { path = "crates/geom", version = "0.18.1" }
-pdfcraft-filters = { path = "crates/filters", version = "0.18.1" }
-pdfcraft-cos = { path = "crates/cos", version = "0.18.1" }
-pdfcraft-crypt = { path = "crates/crypt", version = "0.18.1" }
-pdfcraft-organize = { path = "crates/organize", version = "0.18.1" }
-pdfcraft-measure = { path = "crates/measure", version = "0.18.1" }
-pdfcraft-annot = { path = "crates/annot", version = "0.18.1" }
-pdfcraft-audit = { path = "crates/audit", version = "0.18.1" }
-pdfcraft-fonts = { path = "crates/fonts", version = "0.18.1" }
-pdfcraft-model = { path = "crates/model", version = "0.18.1" }
-pdfcraft-content = { path = "crates/content", version = "0.18.1" }
-pdfcraft-redact = { path = "crates/redact", version = "0.18.1" }
-pdfcraft-print = { path = "crates/print", version = "0.18.1" }
-pdfcraft-xfdf = { path = "crates/xfdf", version = "0.18.1" }
-pdfcraft-sign = { path = "crates/sign", version = "0.18.1" }
-pdfcraft-optimize = { path = "crates/optimize", version = "0.18.1" }
-pdfcraft-a11y = { path = "crates/a11y", version = "0.18.1" }
-pdfcraft-oracle = { path = "crates/oracle", version = "0.18.1" }
-pdfcraft-testkit = { path = "crates/testkit", version = "0.18.1" }
-pdfcraft-ocr = { path = "crates/ocr", version = "0.18.1" }
-pdfcraft-js = { path = "crates/js", version = "0.18.1" }
-pdfcraft-compare = { path = "crates/compare", version = "0.18.1" }
-pdfcraft-preflight = { path = "crates/preflight", version = "0.18.1" }
-pdfcraft-export = { path = "crates/export", version = "0.18.1" }
-pdfcraft-edit = { path = "crates/edit", version = "0.18.1" }
-pdfcraft-create = { path = "crates/create", version = "0.18.1" }
-pdfcraft-forms = { path = "crates/forms", version = "0.18.1" }
-pdfcraft-xfa = { path = "crates/xfa", version = "0.18.1" }
-pdfcraft-render = { path = "crates/render", version = "0.18.1" }
-pdfcraft-engine = { path = "crates/engine", version = "0.18.1" }
-pdfcraft-platform = { path = "crates/platform", version = "0.18.1" }
-pdfcraft-ui-egui = { path = "crates/ui-egui", version = "0.18.1" }
-pdfcraft-automation = { path = "crates/automation", version = "0.18.1", default-features = false }
-pdfcraft-prc = { path = "crates/prc", version = "0.18.1" }
-pdfcraft-prc-render = { path = "crates/prc-render", version = "0.18.1" }
+pdfcraft-geom = { path = "crates/geom", version = "0.21.0" }
+pdfcraft-filters = { path = "crates/filters", version = "0.21.0" }
+pdfcraft-cos = { path = "crates/cos", version = "0.21.0" }
+pdfcraft-crypt = { path = "crates/crypt", version = "0.21.0" }
+pdfcraft-organize = { path = "crates/organize", version = "0.21.0" }
+pdfcraft-measure = { path = "crates/measure", version = "0.21.0" }
+pdfcraft-annot = { path = "crates/annot", version = "0.21.0" }
+pdfcraft-audit = { path = "crates/audit", version = "0.21.0" }
+pdfcraft-fonts = { path = "crates/fonts", version = "0.21.0" }
+pdfcraft-model = { path = "crates/model", version = "0.21.0" }
+pdfcraft-content = { path = "crates/content", version = "0.21.0" }
+pdfcraft-redact = { path = "crates/redact", version = "0.21.0" }
+pdfcraft-print = { path = "crates/print", version = "0.21.0" }
+pdfcraft-xfdf = { path = "crates/xfdf", version = "0.21.0" }
+pdfcraft-sign = { path = "crates/sign", version = "0.21.0" }
+pdfcraft-optimize = { path = "crates/optimize", version = "0.21.0" }
+pdfcraft-a11y = { path = "crates/a11y", version = "0.21.0" }
+pdfcraft-oracle = { path = "crates/oracle", version = "0.21.0" }
+pdfcraft-testkit = { path = "crates/testkit", version = "0.21.0" }
+pdfcraft-ocr = { path = "crates/ocr", version = "0.21.0" }
+pdfcraft-js = { path = "crates/js", version = "0.21.0" }
+pdfcraft-compare = { path = "crates/compare", version = "0.21.0" }
+pdfcraft-preflight = { path = "crates/preflight", version = "0.21.0" }
+pdfcraft-export = { path = "crates/export", version = "0.21.0" }
+pdfcraft-edit = { path = "crates/edit", version = "0.21.0" }
+pdfcraft-create = { path = "crates/create", version = "0.21.0" }
+pdfcraft-forms = { path = "crates/forms", version = "0.21.0" }
+pdfcraft-xfa = { path = "crates/xfa", version = "0.21.0" }
+pdfcraft-render = { path = "crates/render", version = "0.21.0" }
+pdfcraft-engine = { path = "crates/engine", version = "0.21.0" }
+pdfcraft-platform = { path = "crates/platform", version = "0.21.0" }
+pdfcraft-ui-egui = { path = "crates/ui-egui", version = "0.21.0" }
+pdfcraft-automation = { path = "crates/automation", version = "0.21.0", default-features = false }
+pdfcraft-prc = { path = "crates/prc", version = "0.21.0" }
+pdfcraft-prc-render = { path = "crates/prc-render", version = "0.21.0" }
 
 # pdf
 hayro = "0.7.1"
diff --git a/ROADMAP.md b/ROADMAP.md
index f7573603c7..8472b709d9 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -1,3 +1,8 @@
+- 2026-11-04 (M6, PR #5699 group/cache/MK/button review): Expand calculation groups/duplicates with streaming bounded lookup; retain one canonical Field object per exposed identity and prune stale roots. Protect outside shared-MK owners and carry exact button IDs through native clicks and js_run, with regression and persistence coverage.
+- 2026-11-04 (M6, PR #5699 early reset/duplicate identities): Enforce the shared 64-call reset budget before argument conversion/scanning, with sticky atomic rejection and Open/event budget sharing. Preserve PDF object identity in Calculate order, live targets and value writeback; regress duplicate names, reversed order, native completion and persistence.
+- 2026-11-04 (M6, PR #5699 independent review): Preserve unknown defaults through the JS reset shadow; bound menu/response text before copies. Cover native/console reset persistence, inherited defaults, decode-budget exhaustion and exact Unicode dialog boundaries.
+- 2026-11-04 (M6, PR #5699 memory/widget bounds): Count reset widgets and bound escaped UTF-8 text conversion before copies; add negative and Unicode boundary regressions.
+- 2026-11-04 (M6, PR #5699 reset estimate): Charge expanded-name scans and field-name copy/comparison bytes; add three negative regressions and byte-exact refusal checks.
 # PdfCraft roadmap
 
 > **Last reviewed:** 2026-10-31 | **Last updated:** 2026-10-31 | **Change:** patch (M6, PR #4166/#4088: integrate main f137a289 at 0.16.1; retain automatic-field Print suppression, explicit button/console printing and document-error provenance; 761 scoped tests and verification gates passed; 13-step CLI exercise and render inspection passed; existing warnings retained; estimates unchanged)
@@ -6,22 +11,25 @@
 > **Last reviewed:** 2026-11-08 | **Last updated:** 2026-11-08 | **Change:** patch (M10 #6514: refresh craft-print to 7ee35a9f, PDF loader to 51934db3 and public GDI kept at 64e7afd4 after #605 merged; preserve crash fix and stream-test repairs; new-graph CI pending; estimates unchanged)
 
 > **Last reviewed:** 2026-11-07 | **Last updated:** 2026-11-07 | **Change:** patch (M10: file-backed Windows PDF loading without whole-job buffering or per-chunk async waits; approved dependency chain retains #5006; physical output still unqualified; estimates unchanged)
-
 > **Last reviewed:** 2026-11-05 | **Last updated:** 2026-11-05 | **Change:** patch (M7 #2964: directly edit Thai source text inside supported Form XObjects; estimates unchanged)
-
 > **Last reviewed:** 2026-11-05 | **Last updated:** 2026-11-05 | **Change:** minor (M3, #5452: native Recent rows gain Reveal in Finder / File Explorer; estimates unchanged)
-
 > **Last reviewed:** 2026-11-03 | **Last updated:** 2026-11-03 | **Change:** patch (M5 #5850 review: indirect typewriter intent and composer edits preserve outer whitespace; movement regression commits by outside click; estimates unchanged)
-
 > **Last reviewed:** 2026-11-03 | **Last updated:** 2026-11-03 | **Change:** patch (M5 #5850: Enter adds Fill & Sign line breaks; outside clicks commit, Escape cancels, and saved multiline appearances retain their text and height; estimates unchanged)
 > **Last reviewed:** 2026-10-31 | **Last updated:** 2026-10-31 | **Change:** minor (M3/M4, #5330: Crop pages is directly available in the document quick toolbar; estimates unchanged)
-
-
+> **2026-11-04 (M6, PR #5699 reset budget):** Reject reset amplification before request copies, preview and PDF mutation; cap reset/selector counts and aggregate estimated work. Add native completion, boundary, flood and large-form regressions; preserve ordered under-budget resets.
+> **2026-11-04 (M6, PR #5699 dependent reset):** Reuse form reset on an isolated comparison document so unnamed built-in calculated text/combo fields are included; retain normal post-write calculation. Extend persisted-default and typed-response regressions.
+> **2026-11-04 (M6, PR #5699 reset ordering):** Reset live field values synchronously, commit resets before final script deltas using a reset baseline, and cover Doc Open reinitialization, save/reopen, Undo/Redo and replay-sensitive UI counters.
+> **2026-11-04 (M6, PR #5699 review):** Bound worker capacity and synchronous deadlines, isolate expired/pending realms before edits, keep script prompts above other dialogs, and cover block ASI, control-position regex literals, event routing and complete undo state. Validation is reported in the PR; parity remains partial.
+> **2026-11-03 (M6, PR #5699 follow-up):** Accept independent top-level statements separated by automatic semicolon insertion while retaining continuation-chain limits; assert cyclic calculation results and preserve upstream multiline Fill & Sign coverage.
+> **2026-11-02 (M6, PR #5699 second review):** Count active expression chains instead of whole-source tokens; align native button events and automation schemas, block document input under script prompts, and validate prompt dismissal and idle repaint scheduling.
+> **2026-11-02 (M6, PR #5699 review):** Cache per-edit script geometry/calculation plans, expose live document metadata, and bound persistent worker stacks to 64 MiB; add operation-count, lifecycle and isolated hostile-input/address-space regressions.
+> **2026-11-02 (M6, #5211/#269):** Integrate persistent native AcroForm realms, synchronous calculation, page boxes, appearance/geometry/icon writeback and native button prompt continuation. Synthetic workflow and cancellation tests added; validation details accompany the PR. Remaining JavaScript parity stays partial.
 > **Last reviewed:** 2026-11-01 | **Last updated:** 2026-11-01 | **Change:** patch (M7, PR #2155 further review: inherited drawing/text state, affine image gestures, paste/selection ownership, no-op scripts and menu permissions; estimates unchanged)
 
 > **Last reviewed:** 2026-11-01 | **Last updated:** 2026-11-01 | **Change:** patch (M7, PR #2155 latest comments: explicit image-paste events, mixed-size field refresh, and documented mixed-script normalization with Undo; estimates unchanged)
 
 > **Last reviewed:** 2026-11-01 | **Last updated:** 2026-11-01 | **Change:** patch (M7, PR #2155 review follow-up: preserve image crop/tag/stream ownership, resize in page orientation, harden clipboard and text formatting, and reload installed fonts; estimates unchanged)
+
 > **Last reviewed:** 2026-10-31 | **Last updated:** 2026-10-31 | **Change:** patch (M2, PR #4172: GBK rasters compared with explicit Unicode and independently selected installed faces; wrong-glyph and wrong-family negative controls fail; estimates unchanged)
 > **Last reviewed:** 2026-10-31 | **Last updated:** 2026-10-31 | **Change:** patch (M2, PR #4172: integrate main fa5f9f8c; retain CJK viewer and upstream raster regressions, restore explicit display_config imports; estimates unchanged)
 > **Last reviewed:** 2026-10-28 · **Last updated:** 2026-10-28 · **Change:** patch (M2, PR #4172: integrate main 5af10276; retain both roadmap histories and viewer-only CJK font policy; estimates unchanged)
@@ -80,6 +88,7 @@
 > **Last reviewed:** 2026-10-18 · **Last updated:** 2026-10-18 · **Change:** minor (M8, #1350: named replacement descriptions retired during Sanitize and across shared resources; estimates unchanged)
 > **Last reviewed:** 2026-10-17 · **Last updated:** 2026-10-17 · **Change:** minor (M4 #2997: Ctrl-drag (Option on macOS) in the Organize grid copies the pages into the drop gap; `page_duplicate` takes `at`; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-15 · **Last updated:** 2026-10-15 · **Change:** minor (M6: AcroForm XML text; estimates unchanged)
+> **Last reviewed:** 2026-10-17 · **Last updated:** 2026-10-17 · **Change:** minor (M10, gap 8: Office documents open through an installed LibreOffice; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-15 · **Last updated:** 2026-10-15 · **Change:** minor (M2/gap 12: the Annex D.2 alias codes read as the ink they draw in both tables; the text oracle scores reading order; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-15 · **Last updated:** 2026-10-15 · **Change:** minor (M14/#2383 GPU-limit candidate; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-13 · **Change:** minor (M4: indirect page rotations; M13: CLI check visits each directory once through aliases and cycles; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
@@ -297,8 +306,6 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 
 - **2026-11-02 (M10, #5743):** macOS print jobs name their title and owner (`com.apple.print.JobInfo.PMJobName`, `PMJobOwner`), as the system print dialog does, because a Kyocera filter crashes on a job without them. Checked by a test and through `doc_print` against a stand-in `lp`; not yet on a physical printer.
 
-- **2026-10-31 (M3, #5452):** Native Home Recent rows offer Reveal in Finder / File Explorer from their context menu. They reuse the tab action’s platform dispatch and missing-file notification without opening the PDF or changing Recent. Browser behavior and milestone estimates unchanged.
-
 - **2026-11-02 (M3, #5708):** Pages shorter than the window sit in its middle, one page or row at a time and when scrolling continuously with every page in view.
 - **2026-11-02 (M3, #5716):** A snapshot is drawn at 300 ppi, or at the zoom if that is finer, so one taken zoomed out stays readable; an area too large for one 4096-pixel tile comes out as fine as a tile allows (about 147 ppi for 2000 pt). A choice of resolution and a selection that stays active remain.
 - **2026-11-02 (M14, #5737, #5460):** Preferences can turn off the update check at start. It stays on by default, and Help ▸ Check for updates still asks.
@@ -316,6 +323,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 - 2026-11-01: PR #2155 maintainer edits remove redundant image/text helpers and add regressions for crop ownership, arrange scope/state fidelity, clipboard precedence, crop-drag bounds, and font scanning. Transform and Unicode-script tools complete the headless paths.
 - **2026-10-31 (M3/M4, #5330):** The document quick toolbar offers Crop pages directly through the existing page.crop command, with the command’s assembly-permission check and an active-tool highlight. The existing crop, undo and headless page_set_box paths are unchanged. No toolbar customization or new shortcut. Estimates unchanged.
 
+- **2026-10-30 (M6):** Button scripts can read and change the normal push-button caption with `buttonGetCaption` and `buttonSetCaption`. The caption is drawn and retained through undo/redo and save/reopen; unsupported face indices are refused. Estimates unchanged.
 - **2026-10-18 (M3, #1354, local candidate):** Integrated --two-paged with current main, retaining upstream modal/picker ownership and single-tab reuse. Native launch/opening/password regressions, negative checks against the old wrapper, visual inspection, formatting, strict scoped Clippy, layers, assets, parity and scoped WASM compilation pass. Three existing socket tests are unavailable in this workspace; one existing network test remains ignored. No push or GitHub merge; estimates unchanged.
 - **2026-10-31 (M2, PR #4172 review):** Added same-machine pixel oracles for GBK Song, Hei, Kai and FangSong, including all four subset-prefixed Founder aliases. Reference PDFs use explicit Unicode mappings and independently selected installed faces; font data and rasters remain in memory. All eight cases ran; wrong-glyph and wrong-family production mutations each failed the new assertion and were restored. Validation: 422 renderer unit tests, renderer all-target Clippy with -D warnings, formatting, layers/assets/parity and renderer WASM checks passed; existing optional-patch/WASM warnings and parity notes remain. Estimates unchanged.
 
@@ -488,6 +496,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 - **2026-10-16 (M14, localization):** Czech goes from menus-and-dialogs to the whole surface: 2,674 entries after adding the ~220 keys the other catalogs had -- the sentences the engine words (signature details, accessibility findings and report, PDF/A problems, pages to print, history labels), the date picker's weekday heads, the certificate viewer's fields and shared buttons. "Tag" is *tag* throughout (the Tags panel said *značky*, which is also a redaction mark), and "{n} tags" no longer reads "1 značek". Two new catalog tests. Estimates unchanged.
 - **2026-10-16 (M5, #2583, #1869):** A sticky note on a page with `/Rotate` is drawn upright, with its top-left where it was placed. Notes are saved with the NoRotate flag, and the renderer now honours it: the appearance is turned against the page's rotation about the upper-left corner of `/Rect`, which stays put (ISO 32000-2 §12.5.3; vendored hayro-interpret patch 37). Attachment icons follow the same rule. Selection, hover, the edit composer, the Comments panel's flash and the `comment_list` and `doc_info` rectangles use the drawn box, and `comment_add` anchors an icon's displayed top-left at `at`. Estimates unchanged.
 - **2026-10-16 (M11, #1201):** Optimize decodes a JPEG with its colour transform: an Adobe APP14 marker's flag, else the filter's `/ColorTransform` (ISO 32000-2 §7.4.8). An RGB JPEG stored untransformed (`/ColorTransform 0`, no marker) used to be converted from YCbCr anyway and came out in other colours, recompressed or merged from strips; it now keeps them. A JPEG whose marker and `/ColorTransform` disagree, or whose components are named R, G and B without `/ColorTransform 0`, is left as it is, since readers differ on it. Estimates unchanged.
+- **2026-10-17 (M10, gap 8):** File ▸ Open opens Word, Excel, PowerPoint, OpenDocument and RTF files as new, unsaved PDFs, converted on the open worker by an installed LibreOffice (headless, a private temporary folder and fresh profile with macros off, stopped after 120 s); without LibreOffice the user is told it is needed. The Open dialog lists PDF (the default), Images, Office documents, Text and All files. Insert, Combine and Create ▸ Multiple files refuse Office documents for now, since they convert on the frame thread. `create.from-office` planned → partial. On 2026-10-26 the profile also stopped Writer and Calc from updating linked content (Impress has no such setting), and tests that skip without LibreOffice convert generated DOCX, XLSX, PPTX and RTF files through `doc_create_multiple` and `doc_combine` and check their text. Estimates unchanged.
 - **2026-10-15 (M2, gap 12):** `cargo xtask text-oracle` scores reading order as well as word F1: the longest common subsequence of the two word sequences over the longer one. F1 is a bag of words and cannot see order at all -- measuring #2431, a change that moves text and nothing else, it called 26 of the 29 files whose output changed identical, where the order score separated 18 improvements from 6 regressions. Reports, does not gate; a disagreement with Poppler, not a verdict. Estimates unchanged.
 - **2026-10-15 (M2, #2305 follow-up):** WinAnsiEncoding 0xA0 and 0xAD and MacRomanEncoding 0xCA extract as the ordinary space and hyphen Annex D.2 names them, in the vendored hayro tables (patch 30) as well as `crates/fonts`, so search, copy and redaction see characters that were hidden behind U+00A0 and U+00AD. Across the pdf.js corpus the soft hyphens we extract fall 117 to 13 and the non-breaking spaces 30 to 26; the rest come from `/ToUnicode`. An explicit `/Differences` name keeps its glyph list value, as pdftotext does. Estimates unchanged.
 - **2026-10-15 (M14, gap 16, #1683):** Split view. View ▸ Split (⌘\\ / Ctrl+\\) and a tab's Split right / Split down show two panes, each with its own tab strip, scroll and zoom; a tab dropped on the right half of the page area splits right, and the divider drags. One document in both panes is one document with one Undo; closing one of its views keeps it open. The pane last clicked is the one menus, keys and panels act on. Nothing about the panes is kept across restarts. `view.split-window` planned → shipped. Multiple windows stay planned. Estimates unchanged.
@@ -991,3 +1000,5 @@ PR #2133 retains document-local Pages sidebar focus for Ctrl/Cmd+A and Escape af
 PR #1952 retains per-widget checkbox/radio export-value editing in the split form-authoring and Prepare modules. Caption editing remains supported. Tests cover preserved appearances and selection, invalid/locked refusals, data-format round trips, and Apply/Cancel/Undo. Current-head hosted validation is pending; feature estimates are unchanged.
 
 - **2026-10-31 (#1577):** Reconciled the page-shadow preference with split viewer, organizer, settings and control modules, preserving upstream page-gap shadow suppression. CI validation pending.
+
+- 2026-11-04: AcroForm review follow-up covers field-instance retirement across history, rejected-writeback realm invalidation, mixed widget icons, shared calculation budgets and multi-select/checkbox consistency, frozen-global events, exact image imports, comparison-half scripts, focus reveal and explicit busy/timeout feedback. Synthetic regressions and elapsed UI deadlines accompany the fixes.
diff --git a/crates/a11y/src/headings.rs b/crates/a11y/src/headings.rs
index 235ba4b452..a9de970b65 100644
--- a/crates/a11y/src/headings.rs
+++ b/crates/a11y/src/headings.rs
@@ -206,7 +206,9 @@ fn sub(doc: &Document, d: &Dict, key: &[u8]) -> Dict {
 pub(crate) fn mcid_texts(doc: &Document, page: &Dict) -> HashMap<i64, String> {
     let res = sub(doc, page, b"Resources");
     let (fonts, props) = (sub(doc, &res, b"Font"), sub(doc, &res, b"Properties"));
-    let mut metrics: HashMap<Vec<u8>, Metrics> = HashMap::new();
+    let mut metrics: HashMap<Vec<u8>, std::rc::Rc<Metrics>> = HashMap::new();
+    // Built once per font object, however many resource names alias it.
+    let mut by_font: HashMap<ObjRef, std::rc::Rc<Metrics>> = HashMap::new();
     // The id each open marked-content sequence is in: its own, else the enclosing one's.
     let mut stack: Vec<Option<i64>> = Vec::new();
     let mut out: HashMap<i64, String> = HashMap::new();
@@ -255,9 +257,30 @@ pub(crate) fn mcid_texts(doc: &Document, page: &Dict) -> HashMap<i64, String> {
                 gs.font = op.name(0).map(<[u8]>::to_vec);
                 if let Some(name) = op.name(0)
                     && !metrics.contains_key(name)
-                    && let Some(f) = fonts.get(name).map(|f| doc.resolve(f)).and_then(|f| f.as_dict().cloned())
                 {
-                    metrics.insert(name.to_vec(), Metrics::from_dict(doc, &f));
+                    // Keyed by the object at the end of the reference chain, so names that reach one
+                    // font through different chains share its metrics (the hop limit is resolve's).
+                    let font = fonts.get(name).and_then(|o| {
+                        let (mut cur, mut last) = (o.clone(), None);
+                        for _ in 0..16 {
+                            let Object::Ref(r) = cur else { break };
+                            last = Some(r);
+                            cur = (*doc.get(r)).clone();
+                        }
+                        last
+                    });
+                    let built = match font.and_then(|r| by_font.get(&r)) {
+                        Some(m) => Some(m.clone()),
+                        None => {
+                            fonts.get(name).map(|f| doc.resolve(f)).and_then(|f| f.as_dict().map(|d| std::rc::Rc::new(Metrics::from_dict(doc, d))))
+                        }
+                    };
+                    if let Some(m) = built {
+                        if let Some(r) = font {
+                            by_font.insert(r, m.clone());
+                        }
+                        metrics.insert(name.to_vec(), m);
+                    }
                 }
             }
             b"Tc" => gs.char_spacing = op.num(0).unwrap_or(0.0),
diff --git a/crates/annot/src/modify.rs b/crates/annot/src/modify.rs
index ae2222b387..6566337ca1 100644
--- a/crates/annot/src/modify.rs
+++ b/crates/annot/src/modify.rs
@@ -857,19 +857,38 @@ pub fn set_points(doc: &mut Document, page: usize, index: usize, points: &[[f64;
 
 /// Scale a drawing's strokes into `rect`. The margin between the strokes and the old `/Rect` (half
 /// the line width and a little more) stays the same on each side, so the line isn't clipped.
+/// Most stroke points a stored drawing may have for resizing or erasing it. Counted as each
+/// stroke is resolved, so one stroke array referenced again and again can't expand past it.
+const MAX_STORED_INK_POINTS: usize = 1_000_000;
+/// Most points the eraser densifies a drawing into before testing them against its path.
+const MAX_ERASE_SAMPLES: usize = 4_000_000;
+
+/// The strokes of an ink annotation's `/InkList`, at most [`MAX_STORED_INK_POINTS`] points.
+fn ink_strokes(doc: &Document, d: &Dict) -> Result<Vec<Vec<[f64; 2]>>, AnnotError> {
+    let too_many = || AnnotError::Invalid(format!("the drawing has more than {MAX_STORED_INK_POINTS} points"));
+    let list = d.get(b"InkList").map(|l| doc.resolve(l));
+    let mut points = 0usize;
+    let mut strokes = Vec::new();
+    for s in list.as_deref().and_then(Object::as_array).map(Vec::as_slice).unwrap_or_default() {
+        let stroke = doc.resolve(s);
+        let Some(a) = stroke.as_array() else {
+            strokes.push(Vec::new());
+            continue;
+        };
+        // Charged before the coordinates are read: a shared array costs each time it is listed.
+        points = points.saturating_add(a.len() / 2);
+        if points > MAX_STORED_INK_POINTS {
+            return Err(too_many());
+        }
+        let v: Vec<f64> = a.iter().filter_map(|x| doc.resolve(x).as_f64()).collect();
+        strokes.push(v.as_chunks::<2>().0.iter().map(|p| [p[0], p[1]]).collect());
+    }
+    Ok(strokes)
+}
+
 fn resize_ink(doc: &mut Document, r: ObjRef, rect: [f64; 4], meta: &Meta) -> Result<(), AnnotError> {
     let d = annot_dict(doc, r);
-    let strokes: Vec<Vec<[f64; 2]>> = d
-        .get(b"InkList")
-        .map(|l| doc.resolve(l))
-        .and_then(|l| l.as_array().cloned())
-        .unwrap_or_default()
-        .iter()
-        .map(|s| {
-            let v: Vec<f64> = doc.resolve(s).as_array().map(|a| a.iter().filter_map(|x| doc.resolve(x).as_f64()).collect()).unwrap_or_default();
-            v.as_chunks::<2>().0.iter().map(|p| [p[0], p[1]]).collect()
-        })
-        .collect();
+    let strokes = ink_strokes(doc, &d)?;
     let Some(inner) = bounds(strokes.iter().flatten().copied()) else {
         return Err(AnnotError::Invalid("the drawing has no strokes".into()));
     };
@@ -1475,17 +1494,7 @@ pub fn erase_ink(doc: &mut Document, page: usize, index: usize, path: &[[f64; 2]
     if path.is_empty() || !path.iter().all(|p| finite(p)) || !radius.is_finite() || radius <= 0.0 {
         return Err(AnnotError::Invalid("invalid eraser path".into()));
     }
-    let strokes: Vec<Vec<[f64; 2]>> = d
-        .get(b"InkList")
-        .map(|l| doc.resolve(l))
-        .and_then(|l| l.as_array().cloned())
-        .unwrap_or_default()
-        .iter()
-        .map(|s| {
-            let v: Vec<f64> = doc.resolve(s).as_array().map(|a| a.iter().filter_map(|x| doc.resolve(x).as_f64()).collect()).unwrap_or_default();
-            v.as_chunks::<2>().0.iter().map(|p| [p[0], p[1]]).collect()
-        })
-        .collect();
+    let strokes = ink_strokes(doc, &d)?;
     // Distance from a point to the eraser's path (segments, or a single point).
     let near = |p: [f64; 2]| -> bool {
         if path.len() == 1 {
@@ -1501,17 +1510,27 @@ pub fn erase_ink(doc: &mut Document, page: usize, index: usize, path: &[[f64; 2]
     };
     let mut kept: Vec<Vec<[f64; 2]>> = Vec::new();
     let mut erased = false;
+    let mut samples = 0usize;
     for s in &strokes {
         // Densify so long segments are cut where the eraser crosses them.
         let mut pts: Vec<[f64; 2]> = Vec::new();
         for w in s.windows(2) {
             let n = ((w[1][0] - w[0][0]).hypot(w[1][1] - w[0][1]) / (radius / 2.0)).ceil().clamp(1.0, 2000.0) as usize;
+            samples = samples.saturating_add(n);
+            if samples > MAX_ERASE_SAMPLES {
+                return Err(AnnotError::Invalid("the drawing is too large to erase at this eraser size".into()));
+            }
             for k in 0..n {
                 let t = k as f64 / n as f64;
                 pts.push([w[0][0] + (w[1][0] - w[0][0]) * t, w[0][1] + (w[1][1] - w[0][1]) * t]);
             }
         }
         if let Some(last) = s.last() {
+            // The final point is a sample too.
+            samples = samples.saturating_add(1);
+            if samples > MAX_ERASE_SAMPLES {
+                return Err(AnnotError::Invalid("the drawing is too large to erase at this eraser size".into()));
+            }
             pts.push(*last);
         }
         let mut run: Vec<[f64; 2]> = Vec::new();
@@ -1537,6 +1556,12 @@ pub fn erase_ink(doc: &mut Document, page: usize, index: usize, path: &[[f64; 2]
         delete_annotation(doc, page, index)?;
         return Ok(true);
     }
+    // The retained runs are stored as the new `/InkList`: past the cap, writing them would leave a
+    // drawing that later `resize_ink` and `erase_ink` refuse to read.
+    let points: usize = kept.iter().map(Vec::len).sum();
+    if points > MAX_STORED_INK_POINTS {
+        return Err(AnnotError::Invalid(format!("erasing would leave a drawing with more than {MAX_STORED_INK_POINTS} points")));
+    }
     let width = d.get(b"BS").and_then(|b| b.as_dict()).and_then(|b| b.get(b"W")).and_then(|w| w.as_f64()).unwrap_or(1.0);
     let rect = grow(bounds(kept.iter().flatten().copied()).unwrap_or_default(), width / 2.0 + 1.0);
     doc.update_dict(r, |d| {
diff --git a/crates/annot/src/tests.rs b/crates/annot/src/tests.rs
index ce5a8c1604..980959d4d9 100644
--- a/crates/annot/src/tests.rs
+++ b/crates/annot/src/tests.rs
@@ -4797,6 +4797,73 @@ fn freehand_highlight_is_compatible_ink_with_marker_blending() {
     }
 }
 
+/// A drawing whose /InkList lists one stroke array over and over is refused once its points
+/// pass the cap, counted as each stroke is resolved, before they are collected or scaled.
+#[test]
+fn ink_points_are_counted_as_strokes_resolve() {
+    let numbers: String = (0..2000).map(|k| format!(" {}", k % 100)).collect();
+    let refs = " 5 0 R".repeat(501);
+    let doc_with = |refs: &str| {
+        doc_of(&[
+            "<< /Type /Catalog /Pages 2 0 R >>".into(),
+            "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 612 792] >>".into(),
+            "<< /Type /Page /Parent 2 0 R /Annots [4 0 R] >>".into(),
+            format!("<< /Type /Annot /Subtype /Ink /Rect [0 0 100 100] /InkList [{refs}] >>"),
+            format!("[{numbers}]"),
+        ])
+    };
+    // 501 × 1,000 points is under the cap: the points are read (this bare drawing then has no
+    // appearance it can be redrawn with, which is another matter).
+    let mut doc = doc_with(&refs);
+    let under = set_rect(&mut doc, 0, 0, [0.0, 0.0, 50.0, 50.0], &meta(""));
+    assert!(!matches!(&under, Err(AnnotError::Invalid(m)) if m.contains("points")), "{under:?}");
+    // 1,001 × 1,000 points is over it.
+    let mut doc = doc_with(&" 5 0 R".repeat(1001));
+    match set_rect(&mut doc, 0, 0, [0.0, 0.0, 50.0, 50.0], &meta("")) {
+        Err(AnnotError::Invalid(m)) => assert!(m.contains("more than 1000000 points"), "{m}"),
+        other => panic!("refused: {other:?}"),
+    }
+    match erase_ink(&mut doc, 0, 0, &[[1.0, 1.0]], 1.0, &meta("")) {
+        Err(AnnotError::Invalid(m)) => assert!(m.contains("more than 1000000 points"), "{m}"),
+        other => panic!("refused: {other:?}"),
+    }
+}
+
+/// The eraser's densified samples have a total: a tiny eraser over long strokes is refused
+/// instead of interpolating millions of points.
+#[test]
+fn the_eraser_densifies_within_a_total() {
+    let zigzag: String = (0..2100).map(|k| format!(" {} {}", if k % 2 == 0 { 0 } else { 5000 }, k)).collect();
+    let mut doc = doc_of(&[
+        "<< /Type /Catalog /Pages 2 0 R >>".into(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 612 792] >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Annots [4 0 R] >>".into(),
+        format!("<< /Type /Annot /Subtype /Ink /Rect [0 0 5000 2100] /InkList [[{zigzag}]] >>"),
+    ]);
+    match erase_ink(&mut doc, 0, 0, &[[1.0, 1.0]], 0.01, &meta("")) {
+        Err(AnnotError::Invalid(m)) => assert!(m.contains("too large to erase"), "{m}"),
+        other => panic!("refused: {other:?}"),
+    }
+}
+
+/// Each stroke's final point is a sample too: 500,000 strokes of two points at 8 samples a segment
+/// are 4,000,000 densified samples and as many final points again, past the total.
+#[test]
+fn the_eraser_counts_each_strokes_final_point() {
+    let refs = " 5 0 R".repeat(500_000);
+    let mut doc = doc_of(&[
+        "<< /Type /Catalog /Pages 2 0 R >>".into(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 612 792] >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Annots [4 0 R] >>".into(),
+        format!("<< /Type /Annot /Subtype /Ink /Rect [0 0 100 100] /InkList [{refs}] >>"),
+        "[0 0 8 0]".into(),
+    ]);
+    match erase_ink(&mut doc, 0, 0, &[[1.0, 1.0]], 2.0, &meta("")) {
+        Err(AnnotError::Invalid(m)) => assert!(m.contains("too large to erase"), "{m}"),
+        other => panic!("refused: {other:?}"),
+    }
+}
+
 /// A 3D annotation is PDF 1.6 and a PRC model 1.7 (ISO 32000-2 §13.6): an older document's
 /// catalog says so, and a newer one is left as it is.
 #[test]
diff --git a/crates/automation/README.md b/crates/automation/README.md
index cf9e82982b..82a00c509a 100644
--- a/crates/automation/README.md
+++ b/crates/automation/README.md
@@ -333,6 +333,14 @@ navigation-history tool; use the opt-in UI control channel to navigate the displ
 FreeText appearance and survives reopening. Other mark/signature types reject
 `color`; their appearance controls are separate.
 
+## AcroForm script interactions
+
+`js_run` accepts optional `answers` (strings or null, at most 32), consumed in popup, response and alert order. Missing responses cancel menus/input; explicit viewer requests remain data in automation. See [the runtime contract](../../docs/acroform-script-workflows.md).
+
+For distinct PDF fields sharing a name, form_fields exposes a document-local integer field_id. Pass it with field to js_run to bind event.target to that exact field (including ordered answers); omit it for existing first-match behavior. Mismatched names/IDs, missing names and non-integer/out-of-range IDs are refused before execution.
+
+`form_set_image` accepts the optional document-local `field_id` from `form_fields` alongside the matching `field` name, selecting an exact duplicate-name image button. Omit it for the legacy first-name match. IDs are unsigned 48-bit integers and must be rediscovered after structural edits or reopening.
+
 ## Reviewing OCR headlessly
 
 `ocr_words {doc, retain_review: true}` reads words without editing the document and returns
diff --git a/crates/automation/src/a11y/documents.rs b/crates/automation/src/a11y/documents.rs
index 137c98c5d4..bfc8b3379a 100644
--- a/crates/automation/src/a11y/documents.rs
+++ b/crates/automation/src/a11y/documents.rs
@@ -118,6 +118,9 @@ impl Automation {
         Ok(json!({ "actions": actions, "steps": steps }))
     }
 
+    /// `action_run`: run a named action or a list of steps on each file in `paths`, writing the
+    /// results into `folder`; each file is processed in its own session that keeps this
+    /// session's JavaScript preference.
     pub(crate) fn action_run(&mut self, a: &Args) -> Result<Value> {
         use pdfcraft_engine::actions::{Action, Step, builtin, run_on};
         let action = if let Some(name) = a.opt_str("action")? {
@@ -138,6 +141,8 @@ impl Automation {
         };
         let folder = self.resolve(a.str("folder")?, true)?;
         std::fs::create_dir_all(&folder).map_err(|e| failed(e.to_string()))?;
+        // Each file runs in its own session; it keeps this one's JavaScript preference.
+        let javascript = self.session.javascript();
         let mut out = Vec::new();
         for p in a.strs("paths")? {
             let name = std::path::Path::new(p).file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_else(|| "document.pdf".into());
@@ -145,7 +150,7 @@ impl Automation {
                 .resolve(p, false)
                 .map_err(|e| e.to_string())
                 .and_then(|src| crate::read_input_bytes(&src).map_err(|e| e.to_string()))
-                .and_then(|bytes| run_on(&action, &name, std::sync::Arc::new(bytes), |_, _| {}));
+                .and_then(|bytes| run_on(&action, &name, std::sync::Arc::new(bytes), javascript, |_, _| {}));
             out.push(match result {
                 Ok(r) => {
                     let target = crate::batch::publish(&child(&folder, &name), &r.bytes)?;
diff --git a/crates/automation/src/a11y/form_tools.rs b/crates/automation/src/a11y/form_tools.rs
index dee8eff646..0ef6b92821 100644
--- a/crates/automation/src/a11y/form_tools.rs
+++ b/crates/automation/src/a11y/form_tools.rs
@@ -11,6 +11,8 @@ fn request_json(r: &pdfcraft_engine::js::Request) -> Value {
         R::LaunchUrl(u) => json!({ "url": u }),
         R::Submit(u) => json!({ "submit": u }),
         R::Focus(f) => json!({ "focus": f }),
+        R::FocusField { name, object_id } => json!({ "focus": name, "field_id": object_id }),
+        R::Zoom(z) => json!({"zoom":z}),
         R::Beep => json!({ "beep": true }),
         R::Highlight(on) => json!({ "highlight": on }),
         R::SaveAs => json!({ "save_as": true }),
@@ -19,20 +21,56 @@ fn request_json(r: &pdfcraft_engine::js::Request) -> Value {
     }
 }
 
+/// The optional `field_id` argument: a field's identity from form_fields, selecting one of
+/// fields sharing a name.
+fn field_id(a: &Args) -> Result<Option<u64>> {
+    a.0.get("field_id")
+        .map(|v| {
+            v.as_u64()
+                .filter(|id| *id < 1 << 48)
+                .ok_or_else(|| ToolError::InvalidArgs("field_id must be an integer between 0 and 281474976710655".into()))
+        })
+        .transpose()
+}
+
 /// A message a script showed, as `js_run` reports it: its text, title (null when it gave none),
 /// icon and buttons.
 pub(crate) fn alert_json(m: &pdfcraft_engine::js::Message) -> Value {
     json!({ "message": m.text, "title": m.title, "icon": m.icon.name(), "buttons": m.buttons.name() })
 }
 
+/// What scripts that ran unasked (a document's Will Save or Will Print actions) showed, said
+/// or asked for, as tools report it.
+pub(crate) fn js_output_json(out: &pdfcraft_engine::js::JsOutput) -> Value {
+    json!({
+        "alerts": out.alerts.iter().map(alert_json).collect::<Vec<_>>(),
+        "console": out.console,
+        "requests": out.requests.iter().map(request_json).collect::<Vec<_>>(),
+        "errors": out.errors,
+    })
+}
+
 impl Automation {
     /// `js_run`: run `script` in the document, or as button `field`'s script, and report its
     /// messages, console lines, requests, error, the failing document scripts' errors and result.
     pub(crate) fn js_run(&mut self, a: &Args) -> Result<Value> {
         let id = self.doc(a)?.id;
+        let answers = match a.0.get("answers") {
+            None => Vec::new(),
+            Some(Value::Array(values)) if values.len() <= 32 => values
+                .iter()
+                .map(|v| match v {
+                    Value::Null => Ok(None),
+                    Value::String(s) if s.len() <= 4096 => Ok(Some(s.clone())),
+                    _ => Err(ToolError::InvalidArgs("answers must contain strings or null".into())),
+                })
+                .collect::<Result<Vec<_>>>()?,
+            _ => return Err(ToolError::InvalidArgs("answers must be an array of at most 32 strings or null".into())),
+        };
+        let identity = field_id(a)?;
         let (script, field) = (a.str("script")?, a.opt_str("field")?);
-        // Applying the script's field changes runs the field scripts again; their output is reported with the script's.
-        let (mut o, edit) = self.session.with_own_js_output(id, |s| s.run_javascript(id, script, field)).map_err(failed)?;
+        let (mut o, edit) =
+            self.session.with_own_js_output(id, |s| s.run_javascript_answers_target(id, script, field, identity, &answers)).map_err(failed)?;
         o.alerts.extend(edit.alerts);
         o.console.extend(edit.console);
         o.requests.extend(edit.requests);
@@ -100,6 +138,39 @@ impl Automation {
         )
     }
 
+    /// `js_event`: run the JavaScript widget `widget` (1-based) of field `field` has for `event`
+    /// (a trigger id: mouse_enter, mouse_exit, mouse_down, mouse_up, on_focus, on_blur); returns
+    /// whether the form changed and what the script showed or asked for.
+    pub(crate) fn js_event(&mut self, a: &Args) -> Result<Value> {
+        let event = a.str("event")?;
+        let trigger = pdfcraft_engine::FieldTrigger::from_id(event).ok_or_else(|| {
+            ToolError::InvalidArgs(format!("event must be mouse_enter, mouse_exit, mouse_down, mouse_up, on_focus or on_blur, not {event:?}"))
+        })?;
+        let name = a.str("field")?;
+        let identity = field_id(a)?;
+        let doc = self.doc(a)?;
+        let field =
+            doc.form.iter().find(|f| f.name == name && identity.is_none_or(|i| pdfcraft_engine::js::field_object_id(f.obj) == i)).ok_or_else(
+                || match identity {
+                    Some(i) => failed(format!("there is no field named {name:?} with field_id {i} (see form_fields)")),
+                    None => failed(format!("there is no field named {name:?} (see form_fields)")),
+                },
+            )?;
+        let widgets = field.widgets.len();
+        let widget = a.opt_int("widget")?.unwrap_or(1);
+        let widget = usize::try_from(widget).ok().and_then(|w| w.checked_sub(1)).filter(|w| *w < widgets).ok_or_else(|| match widgets {
+            0 => ToolError::InvalidArgs(format!("{name:?} has no widget")),
+            n => ToolError::InvalidArgs(format!("widget must be 1 to {n} for {name:?}")),
+        })?;
+        let (id, object) = (doc.id, pdfcraft_engine::js::field_object_id(field.obj));
+        // Only this event's output: what opening or an earlier tool left waiting stays.
+        let (changed, out) =
+            self.session.with_own_js_output(id, |s| s.field_trigger_target(id, name, Some(object), widget, trigger)).map_err(failed)?;
+        let mut result = js_output_json(&out);
+        result["changed"] = json!(changed);
+        Ok(result)
+    }
+
     /// `form_merge_data`: merge the form data files at `paths` into one CSV at `path`, a row per
     /// file; returns the path and the row and column counts.
     pub(crate) fn form_merge_data(&mut self, a: &Args) -> Result<Value> {
diff --git a/crates/automation/src/a11y/ocr.rs b/crates/automation/src/a11y/ocr.rs
index 6d1eaaa389..9f21fc285e 100644
--- a/crates/automation/src/a11y/ocr.rs
+++ b/crates/automation/src/a11y/ocr.rs
@@ -164,6 +164,8 @@ impl Automation {
         }
         // The engines are built (and named if they cannot be) before the first file is read.
         let recognizers = pdfcraft_engine::ocr::recognizers(&settings).map_err(failed)?;
+        // Each file opens in its own session; it keeps this one's JavaScript preference.
+        let javascript = self.session.javascript();
         let mut out = Vec::new();
         let (mut ok, mut skipped_files, mut words) = (0usize, 0usize, 0usize);
         for p in paths {
@@ -171,7 +173,15 @@ impl Automation {
             let result =
                 self.resolve(p, false).map_err(|e| e.to_string()).and_then(|src| crate::read_input_bytes(&src).map_err(|e| e.to_string())).and_then(
                     |bytes| {
-                        pdfcraft_engine::ocr::recognize_file(&name, std::sync::Arc::new(bytes), None, settings.clone(), &recognizers, |_, _| true)
+                        pdfcraft_engine::ocr::recognize_file(
+                            &name,
+                            std::sync::Arc::new(bytes),
+                            None,
+                            settings.clone(),
+                            &recognizers,
+                            javascript,
+                            |_, _| true,
+                        )
                     },
                 );
             match result {
diff --git a/crates/automation/src/assemble.rs b/crates/automation/src/assemble.rs
index 5fd9d9b0be..b091e54d19 100644
--- a/crates/automation/src/assemble.rs
+++ b/crates/automation/src/assemble.rs
@@ -239,6 +239,8 @@ impl Automation {
         Ok(json!({ "files": out }))
     }
 
+    /// `page_extract`: the chosen pages as one new PDF, or with `separate` one file per page in
+    /// `out_dir`; with `delete` the pages are then removed from the original.
     pub(crate) fn page_extract(&mut self, a: &Args) -> Result<Value> {
         let doc = self.doc(a)?;
         let (id, name) = (doc.id, format!("{} (extract)", doc.name));
@@ -246,16 +248,8 @@ impl Automation {
         let pages = self.pages(a, "pages")?;
         let mut out = if a.opt_bool("separate")?.unwrap_or(false) {
             // Each page as its own file.
-            let dir = self.resolve(a.str("out_dir").map_err(|_| ToolError::InvalidArgs("separate files need out_dir".into()))?, true)?;
-            std::fs::create_dir_all(&dir).map_err(|e| failed(format!("{}: {e}", dir.display())))?;
-            let mut files = Vec::new();
-            for &p in &pages {
-                let bytes = self.session.extract(id, &[p]).map_err(failed)?;
-                let path = child(&dir, &format!("{stem}-page{}.pdf", p + 1));
-                write_atomic(&path, &bytes)?;
-                files.push(path.to_string_lossy().into_owned());
-            }
-            json!({ "files": files })
+            let out_dir = a.str("out_dir").map_err(|_| ToolError::InvalidArgs("separate files need out_dir".into()))?;
+            json!({ "files": self.extract_separate(id, &pages, out_dir, &stem)? })
         } else {
             let bytes = self.session.extract(id, &pages).map_err(failed)?;
             self.deliver(a, &name, bytes)?
@@ -267,6 +261,45 @@ impl Automation {
         Ok(out)
     }
 
+    /// Each of `pages` as its own `<stem>-page<n>.pdf` in `out_dir`, extracted and written one at a
+    /// time, so only one page's PDF is held at once. The first page is extracted before `out_dir` is
+    /// resolved and made, so a refusal (the permissions refuse every page alike, #5081) leaves nothing
+    /// behind; if a later page fails, the files this call created, and the directory if it made it,
+    /// are removed.
+    fn extract_separate(&self, id: pdfcraft_engine::DocId, pages: &[usize], out_dir: &str, stem: &str) -> Result<Vec<String>> {
+        let Some(&first) = pages.first() else { return Ok(Vec::new()) };
+        let mut first_bytes = Some(self.session.extract(id, &[first]).map_err(failed)?);
+        let dir = self.resolve(out_dir, true)?;
+        let made_dir = !dir.exists();
+        std::fs::create_dir_all(&dir).map_err(|e| failed(format!("{}: {e}", dir.display())))?;
+        let (mut files, mut created) = (Vec::new(), Vec::new());
+        let outcome = pages.iter().try_for_each(|&p| -> Result<()> {
+            let bytes = match first_bytes.take() {
+                Some(bytes) => bytes,
+                None => self.session.extract(id, &[p]).map_err(failed)?,
+            };
+            let path = child(&dir, &format!("{stem}-page{}.pdf", p.saturating_add(1)));
+            let existed = path.exists();
+            write_atomic(&path, &bytes)?;
+            if !existed {
+                created.push(path.clone());
+            }
+            files.push(path.to_string_lossy().into_owned());
+            Ok(())
+        });
+        if let Err(e) = outcome {
+            // Best effort: whatever can't be removed stays, and the error reported is the extraction's.
+            for path in &created {
+                let _ = std::fs::remove_file(path);
+            }
+            if made_dir {
+                let _ = std::fs::remove_dir(&dir);
+            }
+            return Err(e);
+        }
+        Ok(files)
+    }
+
     pub(crate) fn doc_combine(&mut self, a: &Args) -> Result<Value> {
         let paths = a.strs("paths")?;
         if paths.len() < 2 {
diff --git a/crates/automation/src/batch.rs b/crates/automation/src/batch.rs
index 14a98f23e2..9359cb50b8 100644
--- a/crates/automation/src/batch.rs
+++ b/crates/automation/src/batch.rs
@@ -19,9 +19,13 @@ struct Recipe<'a> {
     images: optimize::ImageSettings,
     mono: optimize::MonoSettings,
     ocr: ocr::OcrSettings,
+    /// The calling session's JavaScript preference, carried into each file's own session.
+    javascript: bool,
 }
 
 impl<'a> Recipe<'a> {
+    /// Read and validate `doc_batch`'s steps and settings, taking the JavaScript preference from
+    /// `auto`'s session.
     fn parse(auto: &Automation, args: &'a Args) -> Result<Self> {
         let steps = args.strs("steps")?;
         if steps.is_empty() || steps.len() > 3 {
@@ -60,7 +64,7 @@ impl<'a> Recipe<'a> {
         if args.opt_num("dpi")?.is_some_and(|dpi| !(72.0..=600.0).contains(&dpi)) {
             return Err(Args::wrong("dpi", "72 to 600"));
         }
-        Ok(Self { steps, images, mono, ocr: auto.ocr_settings(args)? })
+        Ok(Self { steps, images, mono, ocr: auto.ocr_settings(args)?, javascript: auto.session.javascript() })
     }
 
     fn accepts(&self, path: &Path) -> bool {
@@ -68,9 +72,13 @@ impl<'a> Recipe<'a> {
         extension == "pdf" || (self.steps.contains(&"convert") && pdfcraft_engine::CONVERTIBLE.contains(&extension.as_str()))
     }
 
+    /// Run the recipe's steps on the file at `path` in a fresh session; returns the output bytes
+    /// and a report entry per step.
     fn process(&self, path: &Path) -> Result<(Arc<Vec<u8>>, Vec<Value>)> {
         // A fresh session per file bounds retained document state and never touches caller tabs.
+        // It keeps the caller's JavaScript preference, set before any open runs open-time scripts.
         let mut session = Session::new();
+        session.set_javascript(self.javascript);
         let mut input = Vec::new();
         std::fs::File::open(path).map_err(failed)?.take(MAX_INPUT + 1).read_to_end(&mut input).map_err(failed)?;
         if input.len() as u64 > MAX_INPUT {
@@ -85,7 +93,8 @@ impl<'a> Recipe<'a> {
                 "convert" => bytes = session.convert_to_pdf(name, &bytes)?.1,
                 "ocr" => {
                     let recognizers = ocr::recognizers(&self.ocr).map_err(failed)?;
-                    let result = ocr::recognize_file(name, bytes, None, self.ocr.clone(), &recognizers, |_, _| true).map_err(failed)?;
+                    let result =
+                        ocr::recognize_file(name, bytes, None, self.ocr.clone(), &recognizers, self.javascript, |_, _| true).map_err(failed)?;
                     log.push(
                         json!({"step":"ocr","words":result.words(),"skipped_pages":result.pages.iter().filter(|p| p.skipped.is_some()).count()}),
                     );
diff --git a/crates/automation/src/dispatch.rs b/crates/automation/src/dispatch.rs
index 3b40832b83..4a91942fe4 100644
--- a/crates/automation/src/dispatch.rs
+++ b/crates/automation/src/dispatch.rs
@@ -711,11 +711,7 @@ impl Automation {
             "form_fields" => self.form_fields(&a)?,
             "form_fill" => self.form_fill(&a)?,
             "form_focus" => self.form_focus(&a)?,
-            "form_set_image" => {
-                let path = self.resolve(a.str("path")?, false)?;
-                let bytes = read_input(&path)?;
-                self.apply(&a, Edit::SetFieldImage { name: a.str("field")?.to_owned(), image: Arc::new(bytes) })?
-            }
+            "form_set_image" => self.form_set_image(&a)?,
             "form_reset" => self.form_reset(&a)?,
             "form_add_field" => self.form_add_field(&a)?,
             "form_add_field_table" => self.form_add_field_table(&a)?,
@@ -839,6 +835,7 @@ impl Automation {
             "accessibility_autotag_form_fields" => self.accessibility_autotag_form_fields(&a)?,
             "ocr_recognize" => self.ocr_recognize(&a)?,
             "js_run" => self.js_run(&a)?,
+            "js_event" => self.js_event(&a)?,
             "js_document_scripts" => self.js_document_scripts(&a)?,
             "js_set_document_script" => self.js_set_document_script(&a)?,
             "js_enabled" => self.js_enabled(&a)?,
diff --git a/crates/automation/src/documents.rs b/crates/automation/src/documents.rs
index c00034521c..7dd78cff98 100644
--- a/crates/automation/src/documents.rs
+++ b/crates/automation/src/documents.rs
@@ -168,11 +168,19 @@ impl Automation {
         if flatten_fill_sign {
             self.apply(a, Edit::FlattenFillSign)?;
         }
+        // The document's Will Save actions run first: what they change is saved (#269).
+        let scripts = self.session.run_document_actions(id, pdfcraft_engine::js::DocumentScriptEvent::WillSave);
         let bytes = if full { self.session.save_full_bytes(id) } else { self.session.save_bytes(id) }.map_err(failed)?;
         // A save that adds or removes encryption, or must not keep the old revision (Sanitize,
         // redaction), is rewritten in full even when an incremental save was asked for.
         let incremental = !full && bytes.starts_with(&self.doc(a)?.saved_bytes());
-        self.publish_save(id, &target, bytes, incremental, write)
+        let mut out = self.publish_save(id, &target, bytes, incremental, write)?;
+        if !scripts.is_empty()
+            && let Some(o) = out.as_object_mut()
+        {
+            o.insert("will_save".into(), crate::a11y::form_tools::js_output_json(&scripts));
+        }
+        Ok(out)
     }
 
     /// Validate the prepared bytes before publishing them or marking the document saved.
diff --git a/crates/automation/src/forms.rs b/crates/automation/src/forms.rs
index 37f1ed2cbb..f1f34836ad 100644
--- a/crates/automation/src/forms.rs
+++ b/crates/automation/src/forms.rs
@@ -272,6 +272,27 @@ fn value_for(f: &FormField, v: &Value) -> Result<FieldValue> {
 }
 
 impl Automation {
+    /// Import an image using an optional exact field ID, preserving the legacy name-only tool.
+    pub(crate) fn form_set_image(&mut self, a: &Args) -> Result<Value> {
+        let name = a.str("field")?.to_owned();
+        let object = a
+            .0
+            .get("field_id")
+            .map(|value| -> Result<pdfcraft_cos::ObjRef> {
+                let key =
+                    value.as_u64().filter(|key| *key < 1u64 << 48).ok_or_else(|| bad("field_id must be an integer between 0 and 281474976710655"))?;
+                Ok(pdfcraft_cos::ObjRef::new((key >> 16) as u32, key as u16))
+            })
+            .transpose()?;
+        let path = self.resolve(a.str("path")?, false)?;
+        let image = std::sync::Arc::new(crate::paths::read_input(&path)?);
+        let edit = match object {
+            Some(object) => Edit::SetFieldImageTarget { name, object, image },
+            None => Edit::SetFieldImage { name, image },
+        };
+        self.apply(a, edit)
+    }
+
     pub(crate) fn form_fields(&self, a: &Args) -> Result<Value> {
         let doc = self.doc(a)?;
         let out: Vec<Value> = doc
@@ -286,6 +307,7 @@ impl Automation {
                 });
                 let mut v = json!({
                     "name": f.name,
+                    "field_id": pdfcraft_engine::js::field_object_id(f.obj),
                     "type": kind_name(f.kind),
                     "value": match f.kind {
                         FormFieldKind::CheckBox => json!(!f.value.is_empty()),
@@ -645,6 +667,7 @@ impl Automation {
                     Ok((wi, caption.to_owned()))
                 })
                 .transpose()?,
+            caption_all: None,
             read_only: a.opt_bool("read_only")?,
             required: a.opt_bool("required")?,
             multiline: a.opt_bool("multiline")?,
diff --git a/crates/automation/src/json.rs b/crates/automation/src/json.rs
index e6ca95e905..f612c3050d 100644
--- a/crates/automation/src/json.rs
+++ b/crates/automation/src/json.rs
@@ -256,7 +256,7 @@ pub(crate) fn security(d: &Document) -> Value {
                 "method": s.method,
                 "pending": s.pending,
                 "printing": if !p.print() { "none" } else if p.print_high_quality() { "high" } else { "low" },
-                "modify": p.modify(), "assemble": p.assemble(), "copy": p.copy(), "annotate": p.annotate(),
+                "modify": p.modify(), "assemble": p.assemble(), "extract_pages": p.extract_pages(), "copy": p.copy(), "annotate": p.annotate(),
                 "fill_forms": p.fill_forms(), "accessibility": p.extract_for_accessibility(),
             })
         }
diff --git a/crates/automation/src/printing.rs b/crates/automation/src/printing.rs
index c2a330a095..3d7a76865a 100644
--- a/crates/automation/src/printing.rs
+++ b/crates/automation/src/printing.rs
@@ -361,26 +361,50 @@ impl Automation {
         let settings = print::Settings { pages, paper, orientation, layout, content, raster, crops: Vec::new(), area };
         let laid_out = print::layout(&sizes, &settings).map_err(|e| bad(e.to_string()))?;
         let sheets = laid_out.len();
+        // Where it goes is checked before the Will Print actions run, so a call that can't print
+        // doesn't change the document.
+        let destination = match (a.opt_str("path")?, printer) {
+            (Some(p), None) => Destination::File(self.resolve(p, true)?),
+            (None, Some(printer)) => {
+                let actual_printer = resolved_printer.as_deref().unwrap_or(printer);
+                Destination::Printer(spool_job(a, actual_printer, self.doc(a)?.name.clone(), duplex, media.as_deref(), settings.raster, &laid_out)?)
+            }
+            _ => return Err(bad("pass either path (save the print-ready PDF) or printer (a name from printers, or \"default\")")),
+        };
+        // The document's Will Print actions run first: what they change is printed (#269).
+        let scripts = if self.doc(a)?.allows_printing() {
+            self.session.run_document_actions(id, pdfcraft_engine::js::DocumentScriptEvent::WillPrint)
+        } else {
+            Default::default()
+        };
         let bytes = self.session.print_pdf(id, &settings).map_err(failed)?;
         let mut out = json!({ "sheets": sheets, "pages": settings.pages.len(), "bytes": bytes.len() });
-        match (a.opt_str("path")?, printer) {
-            (Some(p), None) => {
-                let path = self.resolve(p, true)?;
+        if !scripts.is_empty() {
+            out["will_print"] = crate::a11y::form_tools::js_output_json(&scripts);
+        }
+        match destination {
+            Destination::File(path) => {
                 write_atomic(&path, &bytes)?;
                 out["path"] = json!(path.to_string_lossy());
             }
-            (None, Some(printer)) => {
-                let actual_printer = resolved_printer.as_deref().unwrap_or(printer);
-                let mut job = spool_job(a, actual_printer, self.doc(a)?.name.clone(), duplex, media.as_deref(), settings.raster, &laid_out)?;
-                let bytes = pdfcraft_engine::spooler::spooler_copy(bytes, &mut job);
+            Destination::Printer(mut job) => {
+                // A GDI (v3) driver gets transparent sheets flattened (#6155, #5838, #5940); XPS
+                // (v4) drivers print them as they are.
+                let flatten = job.printer.as_deref().is_some_and(spool::gdi_driver);
+                let bytes = pdfcraft_engine::spooler::spooler_copy(bytes, &mut job, flatten);
                 out["job"] = json!(spool::submit(&bytes, &job).map_err(|e| failed(e.to_string()))?);
             }
-            _ => return Err(bad("pass either path (save the print-ready PDF) or printer (a name from printers, or \"default\")")),
         }
         Ok(out)
     }
 }
 
+/// Where `doc_print` sends the sheets: a print-ready PDF file, or a printer's queue.
+enum Destination {
+    File(std::path::PathBuf),
+    Printer(spool::Job),
+}
+
 /// "WxH" with a unit (in, mm, cm or pt) as a portrait paper size in points; each side 1 to 200
 /// inches (PDF's own page limit).
 fn paper_size(spec: &str) -> Option<(f64, f64)> {
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 56c654fa1c..fa29d07634 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -347,7 +347,7 @@ pub fn tools() -> Vec<ToolDef> {
                 json!({ "doc": doc(), "pages": pages("to extract"), "out": save_out.clone(), "open": open.clone(), "separate": { "type": "boolean" }, "out_dir": { "type": "string" }, "delete": { "type": "boolean" } }),
                 &["doc", "pages"],
             )),
-        t("doc_combine", "Combine files", "Combine files, in order, into one PDF (bookmarks are kept under one entry per file). Images (PNG, JPEG, TIFF, GIF, BMP, JPEG 2000) and .txt files are made into PDFs first. pages optionally chooses each file's pages, in step with paths: a range such as \"1-3, 6\" or null for all pages. passwords, also in step with paths, opens encrypted files (the open password, or the permissions password where a file's security doesn't allow copying pages; null for none). The result is not encrypted. Passwords are never echoed back. groups, also in step with paths, splits a file around others: entries with the same number (they must name the same path) are one file, copied once, so it keeps one bookmark at its first page, its links and its form fields; null for a file of its own. A group uses its first entry's password. When two files' forms name the same field, field_conflicts says what happens: \"rename\" (the default) keeps the fields separate by renaming the later one (Text1 becomes Text1-1) and the result lists renamed_fields as [[old, new], …] — scripts that refer to the old name are not rewritten; \"merge\" makes them one field, as before.")
+        t("doc_combine", "Combine files", "Combine files, in order, into one PDF (bookmarks are kept under one entry per file). Images (PNG, JPEG, TIFF, GIF, BMP, JPEG 2000), .txt files and Office documents (Word, Excel, PowerPoint, OpenDocument, RTF; through an installed LibreOffice) are made into PDFs first. pages optionally chooses each file's pages, in step with paths: a range such as \"1-3, 6\" or null for all pages. passwords, also in step with paths, opens encrypted files (the open password, or the permissions password where a file's security doesn't allow copying pages; null for none). The result is not encrypted. Passwords are never echoed back. groups, also in step with paths, splits a file around others: entries with the same number (they must name the same path) are one file, copied once, so it keeps one bookmark at its first page, its links and its form fields; null for a file of its own. A group uses its first entry's password. When two files' forms name the same field, field_conflicts says what happens: \"rename\" (the default) keeps the fields separate by renaming the later one (Text1 becomes Text1-1) and the result lists renamed_fields as [[old, new], …] — scripts that refer to the old name are not rewritten; \"merge\" makes them one field, as before.")
             .cmd("page.combine")
             .with(schema(
                 json!({
@@ -361,7 +361,7 @@ pub fn tools() -> Vec<ToolDef> {
                 }),
                 &["paths"],
             )),
-        t("doc_create_multiple", "Create PDF from multiple files", "Convert several files (PDFs, PNG/JPEG/JPEG 2000/TIFF/GIF/BMP images, .txt files) to PDF in one run. mode \"combine\" (default) joins them, in order, into one PDF with a bookmark per file; pages optionally chooses each file's pages, in step with paths (a range such as \"1-3, 6\" or null). mode \"separate\" writes one PDF per file into out_dir (files that are already PDFs are skipped; existing files are never overwritten) and reports each file's result.")
+        t("doc_create_multiple", "Create PDF from multiple files", "Convert several files (PDFs, PNG/JPEG/JPEG 2000/TIFF/GIF/BMP images, .txt files, Office documents through an installed LibreOffice) to PDF in one run. mode \"combine\" (default) joins them, in order, into one PDF with a bookmark per file; pages optionally chooses each file's pages, in step with paths (a range such as \"1-3, 6\" or null). mode \"separate\" writes one PDF per file into out_dir (files that are already PDFs are skipped; existing files are never overwritten) and reports each file's result.")
             .cmd("create.multiple")
             .with(schema(
                 json!({
@@ -543,7 +543,7 @@ pub fn tools() -> Vec<ToolDef> {
         t(
             "form_focus",
             "Move the focus into or out of a field",
-            "A field gains (event enter) or loses (event exit) focus, as when someone clicks or tabs into or out of it, and the dynamic XFA form's enter or exit scripts for it run (other forms have none, and nothing happens). widget picks the radio button or copy of the field (1-based, default 1; see form_fields). What the scripts change is one undoable edit, and none when they change nothing. Changing a field's value (form_fill) runs its exit scripts already, so the next exit of that field doesn't run them again. Returns changed, and the scripts' alerts, console output, requests and errors.",
+            "A field gains (event enter) or loses (event exit) focus, as when someone clicks or tabs into or out of it, and the dynamic XFA form's enter or exit scripts for it run; on another form, the widget's own On Focus or On Blur JavaScript runs, if it has one (see also js_event). widget picks the radio button or copy of the field (1-based, default 1; see form_fields). What the scripts change is one undoable edit, and none when they change nothing. Changing a field's value (form_fill) runs its exit scripts already, so the next exit of that field doesn't run them again. Returns changed, and the scripts' alerts, console output, requests and errors.",
         )
         .with(schema(
             json!({
@@ -631,7 +631,7 @@ pub fn tools() -> Vec<ToolDef> {
                 &["doc", "page", "path", "rect"],
             )),
         t("form_set_image", "Set an image field's picture", "Show an image file (PNG, JPEG, TIFF, GIF or BMP) in an image field or button, scaled to fit and centred (what clicking an image field does). On an XFA form the picture is kept in its data too (base64, as Designer saves it) and the form shows it from there. Undoable.")
-            .with(schema(json!({ "doc": doc(), "field": { "type": "string" }, "path": { "type": "string" } }), &["doc", "field", "path"])),
+            .with(schema(json!({ "doc": doc(), "field": { "type": "string" }, "field_id": {"type":"integer","minimum":0,"maximum":281474976710655u64,"description":"Optional exact document-local identity from form_fields; requires matching field name."}, "path": { "type": "string" } }), &["doc", "field", "path"])),
         t(
             "form_set_props",
             "Field properties",
@@ -726,7 +726,7 @@ pub fn tools() -> Vec<ToolDef> {
         t(
             "doc_hidden_info",
             "Find hidden information",
-            "What Remove Hidden Information would remove, by category (metadata, attachments, comments, form-fields, hidden-text, hidden-layers, bookmarks, links-actions-scripts, private-data) with counts.",
+            "What Remove Hidden Information would remove, by category (metadata, attachments, comments, form-fields, hidden-text, hidden-layers, bookmarks, links-actions-scripts, private-data) with counts. A page that can't be read in full (its content streams don't decode, or they or a form they draw hold bytes the parser can't read or an inline image whose end is a guess) counts as one item of hidden-text and of hidden-layers: removing either category then fails on that page. With form-fields removed too, a field's appearance becomes page content and is read the same way, though it isn't counted here.",
         )
         .ro()
         .with(schema(json!({ "doc": doc() }), &["doc"])),
@@ -757,7 +757,7 @@ pub fn tools() -> Vec<ToolDef> {
         t(
             "printer_papers",
             "List printer paper sizes",
-            "The media sizes (names and dimensions in points) and default paper supported by a printer driver. Pass printer: a name from printers, or \"default\".",
+            "The media sizes (names and dimensions in points) and default paper supported by a printer driver (CUPS: its PPD's, by the driver's names, the default being its *DefaultPageSize; a job on one, or on a standard size of one, is fed it under the PPD's own keyword). Pass printer: a name from printers, or \"default\".",
         )
         .ro()
         .with(schema(json!({ "printer": { "type": "string" } }), &["printer"])),
@@ -1415,12 +1415,27 @@ pub fn tools() -> Vec<ToolDef> {
         t("form_merge_data", "Merge data files into spreadsheet", "Collect the field values of form data files (FDF, XFDF) or filled-in PDF forms into one CSV file at path: a column per field name, a row per file. Returns the row and column counts.")
             .cmd("form.merge_data")
             .with(schema(json!({ "paths": { "type": "array", "items": { "type": "string" }, "minItems": 1 }, "path": { "type": "string" } }), &["paths", "path"])),
-        t("js_run", "Run JavaScript", "Run Acrobat JavaScript in the document, as the JavaScript console does (or as push button `field`'s Mouse Up script when field is given; on a laid-out XFA form, `field` runs that button's XFA click script instead, JavaScript or FormCalc, which can add and remove rows and show or hide subforms). The form object model is available: this/getField, event, app, util, console, display, color, and the document-level scripts (except the PDF container scripts when XFA layout is active; they remain available through js_document_scripts). Field changes and resetForm are applied as one undoable step; returns the alerts (each with its message, title, icon and buttons, in order; every question is still answered OK), console output and requests (print, page, url, submit, attachment) of the script and of the field scripts its changes ran, the script's error, the errors of document-level scripts that failed (the rest still ran), and in warnings the errors of applying the changes, such as values of an XFA form that could not be written to its data.")
+        t("js_run", "Run JavaScript", "Run Acrobat JavaScript in the document, as the JavaScript console does (or as push button `field`'s Mouse Up script when field is given; on a laid-out XFA form, `field` runs that button's XFA click script instead, JavaScript or FormCalc, which can add and remove rows and show or hide subforms). The form object model is available: this/getField, event, app, util, console, display, color, and the document-level scripts (except the PDF container scripts when XFA layout is active; they remain available through js_document_scripts). Field changes and resetForm are applied as one undoable step; returns the script's and subsequent field scripts' alerts (each with its message, title, icon and buttons, in order; AcroForm replies consume ordered answers; missing replies cancel input or use the alert button set's safe default), console output, requests (print, page, url, submit, attachment), error, and the errors of document-level scripts that failed (the rest still ran), plus warnings from applying the changes.")
             .cmd("tools.js_console")
             .with(schema(
-                json!({ "doc": doc(), "script": { "type": "string" }, "field": { "type": "string", "description": "Run as this button's Mouse Up event." } }),
+                json!({ "doc": doc(), "script": { "type": "string" }, "field": { "type": "string", "description": "Run as this button's Mouse Up event." }, "field_id": {"type":"integer","minimum":0,"maximum":281474976710655u64,"description":"Optional exact field identity from form_fields; requires matching field name and is scoped to this document."}, "answers": {"type":"array","maxItems":32,"items":{"type":["string","null"],"maxLength":4096},"description":"Ordered popup, response and alert answers; strings are limited to 4096 UTF-8 bytes at runtime; null cancels a popup or response, and selects an alert default (OK, Cancel or No, by button set)."} }),
                 &["doc", "script"],
             )),
+        t(
+            "js_event",
+            "Run a field's pointer or focus script",
+            "Run the JavaScript action widget `widget` of AcroForm field `field` has for `event`, as when the pointer enters (mouse_enter), leaves (mouse_exit), presses (mouse_down) or releases (mouse_up) it, or it gains (on_focus) or loses (on_blur) the focus, in the document's script realm (variables document scripts and earlier scripts left are kept), with event.name Mouse Enter, Mouse Exit, Mouse Down, Mouse Up, Focus or Blur. Nothing runs when the widget has no JavaScript for that event, JavaScript is off, or the form is a laid-out XFA form (use form_focus and js_run there). What it changes is one undoable edit. Pointer-over and focus scripts run unasked in a viewer, so their requests to print, open Save As or show a panel are dropped (noted on the console); mouse_down and mouse_up keep them. Returns changed, and the script's alerts, console output, requests and errors.",
+        )
+        .with(schema(
+            json!({
+                "doc": doc(),
+                "field": { "type": "string", "description": "Field name (from form_fields)." },
+                "event": { "type": "string", "enum": ["mouse_enter", "mouse_exit", "mouse_down", "mouse_up", "on_focus", "on_blur"] },
+                "field_id": {"type":"integer","minimum":0,"maximum":281474976710655u64,"description":"Optional exact field identity from form_fields: of fields sharing the name, the one to run."},
+                "widget": { "type": "integer", "minimum": 1, "description": "Widget of the field (1-based, default 1): a radio button of the group, or a copy of the field." },
+            }),
+            &["doc", "field", "event"],
+        )),
         t("js_document_scripts", "Document JavaScripts", "List the document-level JavaScripts (name and source), which define functions field scripts use.")
             .ro()
             .cmd("tools.document_js")
@@ -1745,7 +1760,7 @@ pub fn tools() -> Vec<ToolDef> {
             .with(schema(json!({ "doc": doc() }), &["doc"])),
         t("doc_open_revision", "Open a revision", "Open saved revision `revision` (1 = the oldest) of a document as a new, unsaved document, to see the file as it was then.")
             .with(schema(json!({ "doc": doc(), "revision": { "type": "integer", "minimum": 1 } }), &["doc", "revision"])),
-        t("doc_optimize", "Optimize PDF", "Write an optimized copy to `path` (Acrobat's PDF Optimizer). preset: standard (default; Reduce File Size's choices) or mobile (images to 96 ppi above 144, JPEG high quality); the options below change it. compatibility: retain (default; keeps the document's version, or 1.5 when object streams are written), 1.4, 1.5, 1.6, 1.7 or 2.0. merge_fragments (default true) first puts a page picture drawn as many stacked image strips (as some PDF printers write it) back together into one image, so it can be resampled (merged_images, fragments_merged). color / gray: { downsample, ppi, above_ppi, compression: jpeg|zip|retain, quality 1–100 } (defaults: downsample to 150 ppi above 225, JPEG 60). mono: { downsample, ppi, above_ppi, compression: ccitt_g4|jbig2|retain } for black-and-white images and image masks (default: averaged down to 300 ppi above 450 ppi, counted in images_resampled; stored losslessly as CCITT Group 4 or JBIG2 (or 1-bit Flate, once resampled or packed from more bits) when that is smaller, up to 16 JBIG2 images sharing one symbol dictionary (/JBIG2Globals) where that is smaller still (image masks and DeviceGray images named directly, of at most 64 Mi pixels, which redaction can store again without it), Group 3 fax images, JBIG2 images, black-and-white RGB and indexed images using only palette entries 0 and 1 among them, counted in images_recompressed; retain resamples only, a CCITT image staying CCITT, a JBIG2 image JBIG2 and any other becoming Flate). Images past what one run may decode stay as they are, counted in images_refused; streams it only stores with Flate past that stay LZW, uncounted. Images are measured where pages draw them and replaced only when smaller. discard_*: thumbnails (default true), alternate_images (true), tags, search_index (removes the catalog's /PieceInfo entries whose application name contains \"index\" in any letter case; search_indexes), print_settings (entries removed: print_settings), form_actions (submit, import and reset actions removed: form_actions; the fields and links stay, and the actions chained after one still run); flate_unencoded (true); object_streams (default true; always off for 1.4); lzw_to_flate (true) decodes LZW streams and stores them with Flate instead, leaving any it cannot decode unchanged (lzw_streams counts the streams converted); remove_invalid_links and remove_unreferenced_dests (true); discard_external_refs takes GoToR, GoToE, Launch and ImportData actions, and Thread actions with /F, out of links and bookmarks, removes a link left with nothing to do, and keeps links within the document and web links (external_links, external_bookmarks); images and forms the pages list but never draw are always dropped (unused_xobjects). discard: Remove Hidden Information categories (metadata, attachments, comments, form-fields, hidden-text, hidden-layers, bookmarks, links-actions-scripts, private-data). Signed documents are refused. target_bytes (optional): if the copy is larger, retry with up to 5 progressively stronger image settings (downsample to at most 110, 96, 72, 54, 36 ppi, applied to colour and grey images; images set to JPEG also get JPEG quality at most 45, 35, 28, 20, 12, while zip and retain images keep their encoding and only get the lower ppi) and stop at the first copy that fits; reports target_reached, attempts and target_settings, and writes the smallest copy with target_reached false when none fits. Without it nothing changes. The open document is unchanged.")
+        t("doc_optimize", "Optimize PDF", "Write an optimized copy to `path` (Acrobat's PDF Optimizer). preset: standard (default; Reduce File Size's choices) or mobile (images to 96 ppi above 144, JPEG high quality); the options below change it. compatibility: retain (default; keeps the document's version, or 1.5 when object streams are written), 1.4, 1.5, 1.6, 1.7 or 2.0. merge_fragments (default true) first puts a page picture drawn as many stacked image strips (as some PDF printers write it) back together into one image, so it can be resampled (merged_images, fragments_merged). color / gray: { downsample, ppi, above_ppi, compression: jpeg|zip|retain, quality 1–100 } (defaults: downsample to 150 ppi above 225, JPEG 60). mono: { downsample, ppi, above_ppi, compression: ccitt_g4|jbig2|retain } for black-and-white images and image masks (default: averaged down to 300 ppi above 450 ppi, counted in images_resampled; stored losslessly as CCITT Group 4 or JBIG2 (or 1-bit Flate, once resampled or packed from more bits) when that is smaller, up to 16 JBIG2 images sharing one symbol dictionary (/JBIG2Globals) where that is smaller still (image masks and DeviceGray images named directly, of at most 64 Mi pixels, which redaction can store again without it), Group 3 fax images, JBIG2 images, black-and-white RGB and indexed images using only palette entries 0 and 1 among them, counted in images_recompressed; a picture's stencil /Mask and one-bit /SMask are stored again the same way, at their size, not resampled and sharing no dictionary, counted as images; retain resamples only, a CCITT image staying CCITT, a JBIG2 image JBIG2 and any other becoming Flate). Images past what one run may decode stay as they are, counted in images_refused; streams it only stores with Flate past that stay LZW, uncounted. Images are measured where pages draw them and replaced only when smaller. discard_*: thumbnails (default true), alternate_images (true), tags, search_index (removes the catalog's /PieceInfo entries whose application name contains \"index\" in any letter case; search_indexes), print_settings (entries removed: print_settings), form_actions (submit, import and reset actions removed: form_actions; the fields and links stay, and the actions chained after one still run); flate_unencoded (true); object_streams (default true; always off for 1.4); lzw_to_flate (true) decodes LZW streams and stores them with Flate instead, leaving any it cannot decode unchanged (lzw_streams counts the streams converted); remove_invalid_links and remove_unreferenced_dests (true); discard_external_refs takes GoToR, GoToE, Launch and ImportData actions, and Thread actions with /F, out of links and bookmarks, removes a link left with nothing to do, and keeps links within the document and web links (external_links, external_bookmarks); images and forms the pages list but never draw are always dropped (unused_xobjects). discard: Remove Hidden Information categories (metadata, attachments, comments, form-fields, hidden-text, hidden-layers, bookmarks, links-actions-scripts, private-data). Signed documents are refused. target_bytes (optional): if the copy is larger, retry with up to 5 progressively stronger image settings (downsample to at most 110, 96, 72, 54, 36 ppi, applied to colour and grey images; images set to JPEG also get JPEG quality at most 45, 35, 28, 20, 12, while zip and retain images keep their encoding and only get the lower ppi) and stop at the first copy that fits; reports target_reached, attempts and target_settings, and writes the smallest copy with target_reached false when none fits. Without it nothing changes. The open document is unchanged.")
             .cmd("optimize.advanced")
             .with(schema(
                 json!({
diff --git a/crates/automation/tests/it/action_failures.rs b/crates/automation/tests/it/action_failures.rs
index b487103a21..cae72832ab 100644
--- a/crates/automation/tests/it/action_failures.rs
+++ b/crates/automation/tests/it/action_failures.rs
@@ -19,14 +19,14 @@ fn one_step(step: Step) -> Action {
 /// The standard fonts can't draw the character, so the watermark step fails and no file is produced.
 #[test]
 fn failing_watermark_step_fails_the_file_and_publishes_nothing() {
-    let r = run_on(&one_step(Step::AddWatermark("中".into())), "one.pdf", Arc::new(pdf()), |_, _| {});
+    let r = run_on(&one_step(Step::AddWatermark("中".into())), "one.pdf", Arc::new(pdf()), true, |_, _| {});
     assert!(r.is_err(), "a failed step must fail its file: {r:?}");
 }
 
 /// A comment step on a document with no comments has nothing to do, which is not a failure.
 #[test]
 fn nothing_to_do_step_still_succeeds() {
-    let r = run_on(&one_step(Step::FlattenComments), "one.pdf", Arc::new(pdf()), |_, _| {});
+    let r = run_on(&one_step(Step::FlattenComments), "one.pdf", Arc::new(pdf()), true, |_, _| {});
     assert!(r.is_ok(), "a step with nothing to do is not a failure: {r:?}");
 }
 
@@ -61,6 +61,6 @@ fn action_run_marks_the_failing_file_as_error_without_output() {
 /// A removal step with nothing to remove keeps its existing note and succeeds.
 #[test]
 fn removal_step_with_nothing_to_remove_still_succeeds() {
-    let r = run_on(&one_step(Step::RemoveHiddenInformation), "one.pdf", Arc::new(pdf()), |_, _| {});
+    let r = run_on(&one_step(Step::RemoveHiddenInformation), "one.pdf", Arc::new(pdf()), true, |_, _| {});
     assert!(r.is_ok(), "nothing to remove is not a failure: {r:?}");
 }
diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index 9516a76542..db139844a7 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -1226,7 +1226,7 @@ fn combine_takes_images_and_text_files() {
     std::fs::write(dir.join("scan.png"), png).unwrap();
     std::fs::write(dir.join("notes.txt"), "Some notes").unwrap();
     std::fs::write(dir.join("broken.png"), b"\x89PNG\r\n\x1a\nbroken").unwrap();
-    std::fs::write(dir.join("report.docx"), b"PK\x03\x04").unwrap();
+    std::fs::write(dir.join("archive.zip"), b"PK\x03\x04").unwrap();
     let mut a = auto(&dir);
     let combined = ok(&mut a, "doc_combine", json!({ "paths": ["a.pdf", "scan.png", "notes.txt"], "pages": [null, null, "1"], "open": true }));
     let doc = combined["document"]["doc"].as_u64().unwrap();
@@ -1236,7 +1236,7 @@ fn combine_takes_images_and_text_files() {
     let titles: Vec<&str> = marks.as_array().unwrap().iter().map(|b| b["title"].as_str().unwrap()).collect();
     assert_eq!(titles, ["a", "scan", "notes"]);
     // A file that can't be made into a PDF stops the combine, and says which.
-    for bad in ["broken.png", "report.docx"] {
+    for bad in ["broken.png", "archive.zip"] {
         let refused = a.call("doc_combine", &json!({ "paths": ["a.pdf", bad] }));
         assert!(matches!(&refused, Err(ToolError::Failed(e)) if e.contains(bad)), "{bad}: {refused:?}");
     }
@@ -3040,6 +3040,8 @@ fn replace_text_lists_its_replacement() {
     }
 }
 
+/// Protect through the tools, then reopen: the open password is required, the restrictions
+/// (including page extraction) hold for the user, and the permissions password lifts them.
 #[test]
 fn protecting_through_tools() {
     let dir = workdir("protect");
@@ -3057,12 +3059,14 @@ fn protecting_through_tools() {
         (r["security"]["printing"].as_str(), r["security"]["annotate"].as_bool(), r["security"]["copy"].as_bool()),
         (Some("low"), Some(true), Some(false))
     );
+    assert_eq!(r["security"]["extract_pages"], false);
     assert!(!r.to_string().contains("boss"), "passwords are never echoed");
     ok(&mut a, "doc_save", json!({ "doc": doc, "path": "locked.pdf" }));
     // Another session: the open password is required, and the restrictions hold.
     let mut b = auto(&dir);
     assert!(matches!(b.call("doc_open", &json!({ "path": "locked.pdf" })), Err(ToolError::Failed(_))));
     let re = ok(&mut b, "doc_open", json!({ "path": "locked.pdf", "password": "open" }))["doc"].as_u64().unwrap();
+    assert_eq!(ok(&mut b, "doc_info", json!({ "doc": re }))["security"]["extract_pages"], false);
     assert!(matches!(b.call("page_delete", &json!({ "doc": re, "pages": [1] })), Err(ToolError::Failed(_))));
     assert!(matches!(b.call("doc_unprotect", &json!({ "doc": re })), Err(ToolError::Failed(_))));
     ok(&mut b, "comment_add", json!({ "doc": re, "page": 1, "type": "note", "at": [10, 10], "contents": "allowed" }));
@@ -3086,6 +3090,7 @@ fn protecting_through_tools() {
     assert_eq!(ok(&mut b, "text_find", json!({ "doc": re, "query": "Page" }))["count"], 3);
     // With the permissions password everything is possible, including removing security.
     let owner = ok(&mut b, "doc_open", json!({ "path": "locked.pdf", "password": "boss" }))["doc"].as_u64().unwrap();
+    assert_eq!(ok(&mut b, "doc_info", json!({ "doc": owner }))["security"]["extract_pages"], true);
     assert!(ok(&mut b, "text_extract", json!({ "doc": owner }))["pages"][0]["text"].as_str().is_some_and(|t| t.contains("Page")));
     assert_eq!(ok(&mut b, "doc_unprotect", json!({ "doc": owner }))["security"]["protected"], false);
     ok(&mut b, "doc_save", json!({ "doc": owner, "path": "open.pdf" }));
@@ -3093,6 +3098,45 @@ fn protecting_through_tools() {
     ok(&mut c, "doc_open", json!({ "path": "open.pdf" }));
 }
 
+/// A refused `doc_split` or separate-file `page_extract` leaves no output directory behind
+/// (#5081), whether the protection allows no page changes ("Any except extracting pages") or
+/// page changes without copying; with copying allowed as well, the user may extract.
+#[test]
+fn refused_extraction_writes_no_split_or_page_output() {
+    let dir = workdir("refused-extraction-output");
+    // (changes, copy, assemble, extract_pages) as the user sees them.
+    let cases = [("any-except-extract", false, false, false), ("pages", false, true, false), ("pages", true, true, true)];
+    for (i, (changes, copy, assemble, extract)) in cases.into_iter().enumerate() {
+        let mut a = auto(&dir);
+        let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+        let protect = json!({ "doc": doc, "open_password": "open", "permissions_password": "boss", "changes": changes, "copy": copy });
+        ok(&mut a, "doc_protect", protect);
+        let path = format!("restricted-{i}.pdf");
+        ok(&mut a, "doc_save", json!({ "doc": doc, "path": path }));
+
+        let mut b = auto(&dir);
+        let restricted = ok(&mut b, "doc_open", json!({ "path": path, "password": "open" }))["doc"].as_u64().unwrap();
+        let security = ok(&mut b, "doc_info", json!({ "doc": restricted }))["security"].clone();
+        assert_eq!((security["assemble"].as_bool(), security["extract_pages"].as_bool()), (Some(assemble), Some(extract)), "{changes}, copy {copy}");
+        let (split_dir, extract_dir) = (format!("split-{i}"), format!("extract-{i}"));
+        let split = b.call("doc_split", &json!({ "doc": restricted, "every": 1, "out_dir": split_dir }));
+        let pages = b.call("page_extract", &json!({ "doc": restricted, "pages": [1, 2], "separate": true, "out_dir": extract_dir }));
+        if extract {
+            assert!(split.is_ok() && dir.join(&split_dir).exists(), "{changes}, copy {copy}");
+            let files = match pages.as_deref() {
+                Ok([Content::Json(v), ..]) => v["files"].as_array().map(Vec::len),
+                other => panic!("{changes}, copy {copy}: page_extract: {other:?}"),
+            };
+            assert_eq!(files, Some(2), "{changes}, copy {copy}");
+        } else {
+            assert!(matches!(split, Err(ToolError::Failed(_))), "{changes}, copy {copy}");
+            assert!(!dir.join(&split_dir).exists(), "refused split creates no output directory");
+            assert!(matches!(pages, Err(ToolError::Failed(_))), "{changes}, copy {copy}");
+            assert!(!dir.join(&extract_dir).exists(), "refused extraction creates no output directory");
+        }
+    }
+}
+
 /// A document that allows changes but not copying: the tools that return a page's text refuse,
 /// or leave the text out where the tool also changes the page (a restyled paragraph, recognized
 /// words).
@@ -5408,7 +5452,7 @@ fn creating_from_multiple_files_through_tools() {
     }
     std::fs::write(dir.join("scan.png"), png).unwrap();
     std::fs::write(dir.join("notes.txt"), "hello").unwrap();
-    std::fs::write(dir.join("report.docx"), b"PK\x03\x04").unwrap();
+    std::fs::write(dir.join("archive.zip"), b"PK\x03\x04").unwrap();
     let mut a = auto(&dir);
 
     // Combine: every file converted, in the order given, with a bookmark per file.
@@ -5428,8 +5472,8 @@ fn creating_from_multiple_files_through_tools() {
     assert_eq!(titles, ["notes", "a", "scan"]);
     assert!(dir.join("all.pdf").is_file());
     // A file that can't be converted fails the whole combine, naming it.
-    let err = a.call("doc_create_multiple", &json!({ "paths": ["a.pdf", "report.docx"] })).unwrap_err();
-    assert!(matches!(&err, ToolError::Failed(m) if m.contains("report.docx") && m.contains("can't be converted")), "{err}");
+    let err = a.call("doc_create_multiple", &json!({ "paths": ["a.pdf", "archive.zip"] })).unwrap_err();
+    assert!(matches!(&err, ToolError::Failed(m) if m.contains("archive.zip") && m.contains("can't be converted")), "{err}");
     assert!(matches!(a.call("doc_create_multiple", &json!({ "paths": [] })), Err(ToolError::InvalidArgs(_))));
     assert!(matches!(a.call("doc_create_multiple", &json!({ "paths": ["a.pdf"], "mode": "zip" })), Err(ToolError::InvalidArgs(_))));
     assert!(matches!(a.call("doc_create_multiple", &json!({ "paths": ["a.pdf"], "mode": "separate" })), Err(ToolError::InvalidArgs(_))));
@@ -5438,7 +5482,7 @@ fn creating_from_multiple_files_through_tools() {
     // existing file is never overwritten.
     std::fs::create_dir_all(dir.join("out")).unwrap();
     std::fs::write(dir.join("out/notes.pdf"), b"mine").unwrap();
-    let args = json!({ "paths": ["notes.txt", "report.docx", "a.pdf", "scan.png", "missing.txt"], "mode": "separate", "out_dir": "out" });
+    let args = json!({ "paths": ["notes.txt", "archive.zip", "a.pdf", "scan.png", "missing.txt"], "mode": "separate", "out_dir": "out" });
     let made = ok(&mut a, "doc_create_multiple", args);
     let files = made["files"].as_array().unwrap();
     assert!(files[0]["output"].as_str().unwrap().ends_with("notes (2).pdf"), "{files:?}");
@@ -8942,6 +8986,61 @@ fn doc_optimize_stores_black_and_white_images_as_ccitt_group_4() {
     }
 }
 
+/// A mixed-raster page: a flat colour layer drawn through a one-bit soft mask, [`scanned_page`]'s
+/// scan, which the page no longer draws by name. `doc_optimize` stores the mask as Group 4, at its
+/// size, still the picture's soft mask, and counts it as an image; with `mono: retain` it stays.
+#[test]
+fn doc_optimize_stores_a_pictures_one_bit_soft_mask_as_ccitt_group_4() {
+    use pdfcraft_cos::{Dict, Document, ObjRef, Object, SaveOptions, Stream, write_full};
+    let dir = workdir("optimize-mono-mask");
+    let mut doc = Document::open(std::sync::Arc::new(scanned_page())).unwrap();
+    let find = |doc: &Document, kind: &[u8], key: &[u8]| {
+        doc.object_numbers().into_iter().map(|num| ObjRef { num, generation: doc.generation(num) }).find(|r| match &*doc.get(*r) {
+            Object::Stream(s) => s.dict.name(key) == Some(kind),
+            Object::Dict(d) => d.name(key) == Some(kind),
+            _ => false,
+        })
+    };
+    let scan = find(&doc, b"Image", b"Subtype").unwrap();
+    let page = find(&doc, b"Page", b"Type").unwrap();
+    let mut d = Dict::new();
+    d.set(b"Type".to_vec(), Object::name("XObject"));
+    d.set(b"Subtype".to_vec(), Object::name("Image"));
+    d.set(b"Width".to_vec(), Object::Int(250));
+    d.set(b"Height".to_vec(), Object::Int(100));
+    d.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+    d.set(b"ColorSpace".to_vec(), Object::name("DeviceRGB"));
+    d.set(b"SMask".to_vec(), Object::Ref(scan));
+    let picture = doc.add(Object::Stream(Stream::flate(d, &[0, 102, 204].repeat(250 * 100))));
+    doc.update_dict(page, |p| {
+        let mut x = Dict::new();
+        x.set(b"Scan".to_vec(), Object::Ref(picture));
+        let mut res = Dict::new();
+        res.set(b"XObject".to_vec(), Object::Dict(x));
+        p.set(b"Resources".to_vec(), Object::Dict(res));
+    })
+    .unwrap();
+    std::fs::write(dir.join("masked.pdf"), write_full(&doc, &SaveOptions::default()).unwrap()).unwrap();
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "masked.pdf" }))["doc"].as_u64().unwrap();
+    let kept = ok(&mut a, "doc_optimize", json!({ "doc": doc, "path": "kept.pdf", "mono": { "compression": "retain" } }));
+    assert_eq!(kept["images_recompressed"].as_u64(), Some(0), "{kept}");
+    let r = ok(&mut a, "doc_optimize", json!({ "doc": doc, "path": "small.pdf" }));
+    assert_eq!((r["images"].as_u64(), r["images_recompressed"].as_u64()), (Some(2), Some(1)), "the picture and its mask: {r}");
+    // In the copy written, the picture's soft mask is Group 4, at its size.
+    let small = Document::open(std::sync::Arc::new(std::fs::read(dir.join("small.pdf")).unwrap())).unwrap();
+    let picture = small
+        .object_numbers()
+        .into_iter()
+        .map(|num| small.get(ObjRef { num, generation: small.generation(num) }))
+        .find(|o| matches!(&**o, Object::Stream(s) if s.dict.contains(b"SMask")))
+        .unwrap();
+    let Object::Stream(picture) = &*picture else { unreachable!() };
+    let Object::Stream(mask) = &*small.get(picture.dict.reference(b"SMask").unwrap()) else { panic!("the soft mask is a stream") };
+    assert_eq!(mask.dict.name(b"Filter"), Some(&b"CCITTFaxDecode"[..]));
+    assert_eq!((mask.dict.int(b"Width"), mask.dict.int(b"Height")), (Some(1000), Some(400)));
+}
+
 /// A scan drawn at 600 ppi is averaged down to 300 ppi by default. `mono: { downsample: false }`
 /// keeps its size, `ppi` and `above_ppi` choose others, and values of the wrong type are refused.
 #[test]
@@ -9482,6 +9581,13 @@ fn javascript_through_tools() {
     assert_eq!(r["requests"][0]["page"], 2);
     let r = ok(&mut a, "js_run", json!({ "doc": doc, "script": "JSON.stringify(this.getPageBox())" }));
     assert_eq!(r["result"], "[0,300,200,0]");
+    ok(&mut a, "page_set_box", json!({ "doc":doc, "pages":[1], "box":"crop", "margins":[10,20,30,40] }));
+    let cropped = ok(&mut a, "js_run", json!({ "doc":doc, "script":"JSON.stringify(getPageBox('Crop',0))" }));
+    assert_eq!(cropped["result"], "[0,240,160,0]");
+    ok(&mut a, "page_set_box", json!({ "doc":doc, "pages":[2], "box":"media", "margins":[0,0,40,50] }));
+    let other_boxes = ok(&mut a, "js_run", json!({ "doc":doc, "script":"JSON.stringify([getPageBox('Media',0),getPageBox('Crop',1)])" }));
+    assert_eq!(other_boxes["result"], "[[-10,280,190,-20],[0,250,160,0]]");
+    ok(&mut a, "page_set_box", json!({ "doc":doc, "pages":[1], "box":"crop" }));
     let f = ok(&mut a, "form_fields", json!({ "doc": doc }));
     let total = f["fields"].as_array().unwrap().iter().find(|x| x["name"] == "Total").unwrap().clone();
     assert_eq!(total["value"], "3750");
@@ -9501,6 +9607,26 @@ fn javascript_through_tools() {
     let r = ok(&mut a, "js_run", json!({ "doc": doc, "script": "money(5)" }));
     assert_eq!((r["error"].clone(), r["result"].clone()), (json!(null), json!("EUR 5,00")));
     assert!(r["document_errors"][0].as_str().unwrap().starts_with("document script 2: TypeError"), "{r}");
+    ok(
+        &mut a,
+        "form_add_field",
+        json!({ "doc": doc, "page": 1, "type": "button", "rect": [20, 150, 120, 180], "name": "CaptionButton", "caption": "Before" }),
+    );
+    let r = ok(
+        &mut a,
+        "js_run",
+        json!({ "doc": doc, "field": "CaptionButton", "script": "getField('CaptionButton').buttonSetCaption('Continue'); getField('CaptionButton').buttonGetCaption();" }),
+    );
+    assert_eq!(r["result"], "Continue");
+    let routed = ok(&mut a, "js_run", json!({ "doc":doc, "field":"CaptionButton", "script":"event.name+'|'+event.targetName" }));
+    assert_eq!(routed["result"], "Mouse Up|CaptionButton");
+    assert_eq!(
+        ok(&mut a, "form_fields", json!({ "doc": doc }))["fields"].as_array().unwrap().iter().find(|f| f["name"] == "CaptionButton").unwrap()["caption"],
+        "Continue"
+    );
+    let bad_face =
+        ok(&mut a, "js_run", json!({ "doc": doc, "field": "CaptionButton", "script": "getField('CaptionButton').buttonSetCaption('Ignored', 1);" }));
+    assert!(bad_face["error"].as_str().is_some_and(|e| e.contains("normal button face")));
     assert_eq!(ok(&mut a, "js_enabled", json!({ "enabled": false }))["enabled"], false);
     assert!(a.call("js_run", &json!({ "doc": doc, "script": "1" })).is_err());
 }
@@ -9589,6 +9715,14 @@ fn detecting_form_fields_preserves_content_piece_comments() {
         } else {
             json!([])
         };
+        let check_inventory = |a: &mut Automation, doc| {
+            let mut fields = ok(a, "form_fields", json!({"doc": doc}))["fields"].clone();
+            for field in fields.as_array_mut().unwrap() {
+                assert!(field["field_id"].as_u64().is_some());
+                field.as_object_mut().unwrap().remove("field_id");
+            }
+            assert_eq!(fields, inventory);
+        };
         let check_text = |a: &mut Automation, doc| {
             let text = page_text(a, doc).join(" ");
             assert_eq!(text.split_whitespace().collect::<Vec<_>>(), ["FIRST", "LAST"]);
@@ -9609,12 +9743,12 @@ fn detecting_form_fields_preserves_content_piece_comments() {
         assert_eq!(ok(&mut a, "form_detect_fields", json!({"doc": doc, "add": false}))["fields"], candidates);
         assert_eq!(ok(&mut a, "form_fields", json!({"doc": doc}))["fields"], json!([]));
         assert_eq!(ok(&mut a, "form_detect_fields", json!({"doc": doc}))["fields"], candidates);
-        assert_eq!(ok(&mut a, "form_fields", json!({"doc": doc}))["fields"], inventory);
+        check_inventory(&mut a, doc);
         assert_eq!(ok(&mut a, "form_detect_fields", json!({"doc": doc}))["fields"], json!([]));
         ok(&mut a, "doc_save", json!({"doc": doc, "path": "saved.pdf"}));
         let mut reopened = auto(&dir);
         let again = ok(&mut reopened, "doc_open", json!({"path": "saved.pdf"}))["doc"].as_u64().unwrap();
-        assert_eq!(ok(&mut reopened, "form_fields", json!({"doc": again}))["fields"], inventory);
+        check_inventory(&mut reopened, again);
         check_text(&mut reopened, again);
         check_render(&mut reopened, again);
         std::fs::remove_dir_all(dir).unwrap();
@@ -9676,6 +9810,8 @@ fn comparing_documents_through_tools() {
     assert!(a.call("doc_compare", &json!({ "doc": v2, "other": 999 })).is_err());
 }
 
+/// `action_list` and `action_run`: built-in actions by name and ad-hoc steps run on files,
+/// missing inputs are reported per file, and an unknown step is refused.
 #[test]
 fn actions_through_tools() {
     let dir = workdir("actions");
@@ -9693,6 +9829,71 @@ fn actions_through_tools() {
     assert!(a.call("action_run", &json!({ "steps": [{ "step": "fly" }], "paths": ["a.pdf"], "folder": "x" })).is_err());
 }
 
+/// JavaScript stays off in the short-lived sessions used by the three file-processing entry
+/// points (#5080). The input's initialize script changes `qty` to 42, which is visible in the
+/// saved XFA data if any entry point opens it with JavaScript enabled.
+#[test]
+fn file_processing_keeps_javascript_off_for_xfa_open_scripts() {
+    let dir = workdir("batch-javascript-off-xfa");
+    let mut seed = 0x1234_5678_u32;
+    let padding: String = (0..32_000)
+        .map(|_| {
+            seed ^= seed << 13;
+            seed ^= seed >> 17;
+            seed ^= seed << 5;
+            char::from(b'a' + (seed % 26) as u8)
+        })
+        .collect();
+    let template = pdfcraft_xfa::fixtures::scripted_template()
+        .replace("if (qty.rawValue === null) qty.rawValue = 2;", "qty.rawValue = 42; pad.rawValue = '';")
+        .replace(
+            "<field name=\"qty\"",
+            &format!(
+                "<field name=\"pad\" w=\"2in\" h=\"0.3in\"><ui><textEdit/></ui><value><text>{padding}</text></value></field>\n  <field name=\"qty\""
+            ),
+        );
+    let mut source = pdfcraft_xfa::fixtures::shell(&template);
+    // Give the optimizer an unreferenced stream to discard so the optimized output is saved,
+    // carrying any XFA script mutation along with it if JavaScript was accidentally enabled.
+    let previous_xref =
+        std::str::from_utf8(&source).unwrap().rsplit_once("startxref\n").unwrap().1.split_whitespace().next().unwrap().parse::<usize>().unwrap();
+    let orphan = "x".repeat(64_000);
+    let orphan_offset = source.len();
+    source.extend_from_slice(format!("999 0 obj\n<< /Length {} >>\nstream\n{orphan}\nendstream\nendobj\n", orphan.len()).as_bytes());
+    let xref = source.len();
+    source.extend_from_slice(
+        format!("xref\n999 1\n{orphan_offset:010} 00000 n \ntrailer\n<< /Size 1000 /Root 1 0 R /Prev {previous_xref} >>\nstartxref\n{xref}\n%%EOF\n")
+            .as_bytes(),
+    );
+    std::fs::write(dir.join("scripted.pdf"), &source).unwrap();
+
+    let mut a = auto(&dir);
+    ok(&mut a, "js_enabled", json!({ "enabled": false }));
+
+    ok(&mut a, "action_run", json!({ "steps": [{ "step": "set_title", "arg": "Processed" }], "paths": ["scripted.pdf"], "folder": "actions" }));
+    ok(&mut a, "doc_batch", json!({ "paths": ["scripted.pdf"], "steps": ["optimize"], "out_dir": "batch" }));
+
+    // Open each result through the same JavaScript-off session and inspect the field data.
+    for path in ["actions/scripted.pdf", "batch/scripted.pdf"] {
+        let doc = ok(&mut a, "doc_open", json!({ "path": path }))["doc"].as_u64().unwrap();
+        let fields = ok(&mut a, "form_fields", json!({ "doc": doc }));
+        let qty = fields["fields"].as_array().unwrap().iter().find(|field| field["name"] == "qty").unwrap();
+        assert_ne!(qty["value"], "42", "{path} ran the XFA initialize script");
+    }
+
+    // OCR needs its language models. When present, it uses the same per-file open path and must
+    // also keep the script from changing the saved field value. Without them, the engine's
+    // `ocr::tests::files_open_for_recognition_with_the_callers_javascript_preference` still
+    // checks the preference `recognize_file` opens each file with.
+    if ok(&mut a, "ocr_status", json!({}))["available"] == true {
+        ok(&mut a, "ocr_recognize_files", json!({ "paths": ["scripted.pdf"], "folder": "ocr", "skip_text_pages": false }));
+        let doc = ok(&mut a, "doc_open", json!({ "path": "ocr/scripted.pdf" }))["doc"].as_u64().unwrap();
+        let fields = ok(&mut a, "form_fields", json!({ "doc": doc }));
+        let qty = fields["fields"].as_array().unwrap().iter().find(|field| field["name"] == "qty").unwrap();
+        assert_ne!(qty["value"], "42", "OCR ran the XFA initialize script");
+    }
+}
+
 #[test]
 fn action_run_keeps_outputs_with_duplicate_input_basenames() {
     let dir = workdir("action-duplicate-basenames");
diff --git a/crates/automation/tests/it/button_caption.rs b/crates/automation/tests/it/button_caption.rs
index cb1a22a026..0290df7343 100644
--- a/crates/automation/tests/it/button_caption.rs
+++ b/crates/automation/tests/it/button_caption.rs
@@ -12,6 +12,7 @@ fn tool(a: &mut Automation, name: &str, args: Value) -> Value {
 }
 
 #[test]
+/// Changing an existing caption regenerates the saved appearance and preserves form values.
 fn button_caption_can_be_changed_after_creation() {
     let dir = std::env::temp_dir().join(format!("pdfcraft-button-caption-{}", std::process::id()));
     std::fs::create_dir_all(&dir).unwrap();
@@ -34,11 +35,16 @@ fn button_caption_can_be_changed_after_creation() {
     let id = tool(&mut a, "doc_open", json!({"path": "buttons.pdf"}))["doc"].as_u64().unwrap();
     let before = a.session().save_bytes(DocId(id)).unwrap();
     let (_, _, empty_pixels) = a.render_pixels(id, 1, 1.0).unwrap();
-    tool(&mut a, "form_set_props", json!({"doc": id, "field": "clear_button", "caption": "Clear Form"}));
+    let result = tool(
+        &mut a,
+        "js_run",
+        json!({ "doc": id, "field": "clear_button", "script": "getField('clear_button').value='ignored'; getField('clear_button').buttonSetCaption('Clear Form'); getField('clear_button').buttonGetCaption();" }),
+    );
+    assert_eq!(result["result"], "Clear Form");
     let fields = tool(&mut a, "form_fields", json!({"doc": id}));
     assert_eq!(fields["fields"][0]["caption"], "Clear Form");
     assert_eq!(fields["fields"][0]["captions"], json!([{"widget": 1, "caption": "Clear Form"}]));
-    assert_eq!(a.session().get(DocId(id)).unwrap().can_undo(), Some("Change field properties"));
+    assert_eq!(a.session().get(DocId(id)).unwrap().can_undo(), Some("Run JavaScript"));
     let (_, _, labelled_pixels) = a.render_pixels(id, 1, 1.0).unwrap();
     assert_ne!(empty_pixels, labelled_pixels, "the label must reach the actual page appearance");
     tool(&mut a, "edit_undo", json!({"doc": id}));
@@ -89,3 +95,69 @@ fn button_caption_can_be_changed_after_creation() {
     assert_eq!(pixels, empty_pixels);
     std::fs::remove_dir_all(dir).unwrap();
 }
+
+/// An unindexed setter reaches both widgets even when the first caption already matches.
+#[test]
+fn javascript_caption_updates_all_widgets_with_undo_and_save() {
+    use pdfcraft_cos::{Dict, Document, Object, PdfString, SaveOptions, write_full};
+
+    let dir = std::env::temp_dir().join(format!("pdfcraft-js-multi-caption-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let mut session = Session::new();
+    let bytes = session.create_blank(300.0, 400.0, 1).unwrap();
+    let id = session.open("buttons.pdf", None, bytes, None).unwrap();
+    for (name, caption, y) in [("first", "First", 300.0), ("second", "Second", 240.0)] {
+        session
+            .apply(
+                id,
+                Edit::AddField {
+                    page: 0,
+                    rect: [40.0, y, 200.0, y + 30.0],
+                    kind: NewField::Button { caption: caption.into() },
+                    name: Some(name.into()),
+                },
+            )
+            .unwrap();
+    }
+    let mut doc = Document::open(session.save_bytes(id).unwrap()).unwrap();
+    let af = doc.get(doc.root().unwrap()).as_dict().unwrap().reference(b"AcroForm").unwrap();
+    let form = doc.get(af);
+    let fields = doc.resolve(form.as_dict().unwrap().get(b"Fields").unwrap());
+    let widgets: Vec<_> = fields.as_array().unwrap().iter().map(|w| w.as_ref().unwrap()).collect();
+    let mut parent = Dict::new();
+    parent.set(b"FT".to_vec(), Object::name("Btn"));
+    parent.set(b"Ff".to_vec(), Object::Int(1 << 16));
+    parent.set(b"T".to_vec(), PdfString::text("go"));
+    parent.set(b"Kids".to_vec(), Object::Array(widgets.iter().copied().map(Object::Ref).collect()));
+    let parent = doc.add(parent);
+    for w in widgets {
+        doc.update_dict(w, |d| {
+            for key in [b"FT".as_slice(), b"Ff", b"T"] {
+                d.remove(key);
+            }
+            d.set(b"Parent".to_vec(), Object::Ref(parent));
+        })
+        .unwrap();
+    }
+    doc.update_dict(af, |d| d.set(b"Fields".to_vec(), Object::Array(vec![Object::Ref(parent)]))).unwrap();
+    std::fs::write(dir.join("buttons.pdf"), write_full(&doc, &SaveOptions::default()).unwrap()).unwrap();
+    let mut a = Automation::new().with_root(&dir).unwrap();
+    let id = tool(&mut a, "doc_open", json!({"path": "buttons.pdf"}))["doc"].as_u64().unwrap();
+    let (_, _, before) = a.render_pixels(id, 1, 1.0).unwrap();
+    let result = tool(&mut a, "js_run", json!({"doc": id, "script": "getField('go').buttonSetCaption('First'); getField('go').buttonGetCaption();"}));
+    assert_eq!(result["error"], Value::Null);
+    assert_eq!(result["result"], "First");
+    let expected = json!([{"widget": 1, "caption": "First"}, {"widget": 2, "caption": "First"}]);
+    assert_eq!(tool(&mut a, "form_fields", json!({"doc": id}))["fields"][0]["captions"], expected);
+    let (_, _, after) = a.render_pixels(id, 1, 1.0).unwrap();
+    assert_ne!(before, after, "the second widget must visibly change");
+    tool(&mut a, "edit_undo", json!({"doc": id}));
+    assert_eq!(a.render_pixels(id, 1, 1.0).unwrap().2, before);
+    tool(&mut a, "edit_redo", json!({"doc": id}));
+    assert_eq!(a.render_pixels(id, 1, 1.0).unwrap().2, after);
+    tool(&mut a, "doc_save", json!({"doc": id, "path": "saved.pdf"}));
+    let reopened = tool(&mut a, "doc_open", json!({"path": "saved.pdf"}))["doc"].as_u64().unwrap();
+    assert_eq!(tool(&mut a, "form_fields", json!({"doc": reopened}))["fields"][0]["captions"], expected);
+    assert_eq!(a.render_pixels(reopened, 1, 1.0).unwrap().2, after);
+    std::fs::remove_dir_all(dir).unwrap();
+}
diff --git a/crates/automation/tests/it/document_actions.rs b/crates/automation/tests/it/document_actions.rs
new file mode 100644
index 0000000000..a8646a4437
--- /dev/null
+++ b/crates/automation/tests/it/document_actions.rs
@@ -0,0 +1,125 @@
+//! A form's document actions and pointer/focus scripts through the tool table (#269, ported
+//! from #344): the open action runs on doc_open, Will Save on doc_save, Will Print on
+//! doc_print, and js_event runs a widget's pointer and focus scripts, all in one realm.
+
+use pdfcraft_automation::{Automation, Content};
+use serde_json::{Value, json};
+
+fn tool(a: &mut Automation, name: &str, args: Value) -> Value {
+    match a.call(name, &args).unwrap().remove(0) {
+        Content::Json(value) => value,
+        other => panic!("expected JSON: {other:?}"),
+    }
+}
+
+fn pdf_of(objs: &[String]) -> Vec<u8> {
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    out
+}
+
+/// `log` records what ran; `hot` has Mouse Enter and On Blur scripts. The open action counts
+/// in a variable the Will Save and Will Print actions and `hot`'s scripts read.
+fn form() -> Vec<u8> {
+    pdf_of(&[
+        "<< /Type /Catalog /Pages 2 0 R /OpenAction 6 0 R /AA << /WS 7 0 R /WP 8 0 R >> /AcroForm << /Fields [4 0 R 9 0 R] /DA (/Helv 0 Tf 0 g) /DR << /Font << /Helv 5 0 R >> >> >> >>".into(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 300] >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Annots [4 0 R 9 0 R] >>".into(),
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (log) /V () /Rect [20 250 180 270] /P 3 0 R /F 4 >>".into(),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >>".into(),
+        "<< /S /JavaScript /JS (var n = 1; getField\\('log'\\).value = 'open' + n;) >>".into(),
+        "<< /S /JavaScript /JS (n++; getField\\('log'\\).value += ' save' + n; console.println\\('saving'\\);) >>".into(),
+        "<< /S /JavaScript /JS (n++; getField\\('log'\\).value += ' print' + n;) >>".into(),
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (hot) /V () /Rect [20 200 180 220] /P 3 0 R /F 4 /AA << /E << /S /JavaScript /JS (n++; getField\\('log'\\).value += ' ' + event.name + n;) >> /Bl << /S /JavaScript /JS (this.print\\(\\); getField\\('log'\\).value += ' ' + event.name;) >> >> >>".into(),
+    ])
+}
+
+fn log(a: &mut Automation, doc: u64) -> Value {
+    let f = tool(a, "form_fields", json!({ "doc": doc }));
+    f["fields"].as_array().unwrap().iter().find(|f| f["name"] == "log").map(|f| f["value"].clone()).unwrap()
+}
+
+#[test]
+fn open_will_save_will_print_and_field_events_share_the_document_realm() {
+    let dir = std::env::temp_dir().join(format!("pdfcraft-document-actions-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    std::fs::write(dir.join("form.pdf"), form()).unwrap();
+    let mut a = Automation::new().with_root(&dir).unwrap().with_clock(|| 1_700_000_000);
+    let doc = tool(&mut a, "doc_open", json!({ "path": "form.pdf" }))["doc"].as_u64().unwrap();
+    assert_eq!(log(&mut a, doc), "open1");
+
+    let entered = tool(&mut a, "js_event", json!({ "doc": doc, "field": "hot", "event": "mouse_enter" }));
+    assert_eq!(entered["changed"], true, "{entered}");
+    assert_eq!(log(&mut a, doc), "open1 Mouse Enter2");
+    // Losing the focus happens unasked: its print request is dropped and noted.
+    let blurred = tool(&mut a, "js_event", json!({ "doc": doc, "field": "hot", "event": "on_blur" }));
+    assert_eq!(blurred["requests"], json!([]), "{blurred}");
+    assert_eq!(log(&mut a, doc), "open1 Mouse Enter2 Blur");
+    let none = tool(&mut a, "js_event", json!({ "doc": doc, "field": "log", "event": "mouse_down" }));
+    assert_eq!(none["changed"], false, "no script: {none}");
+    assert!(a.call("js_event", &json!({ "doc": doc, "field": "hot", "event": "keystroke" })).is_err());
+    assert!(a.call("js_event", &json!({ "doc": doc, "field": "hot", "event": "mouse_up", "widget": 2 })).is_err());
+
+    // Saved in place (incrementally): object numbers stay, so the realm is kept. A full
+    // rewrite starts a fresh realm for the next event.
+    let saved = tool(&mut a, "doc_save", json!({ "doc": doc }));
+    assert_eq!(saved["incremental"], true, "{saved}");
+    std::fs::copy(dir.join("form.pdf"), dir.join("saved.pdf")).unwrap();
+    assert_eq!(saved["will_save"]["console"], json!(["saving"]), "{saved}");
+    assert_eq!(log(&mut a, doc), "open1 Mouse Enter2 Blur save3");
+
+    let printed = tool(&mut a, "doc_print", json!({ "doc": doc, "path": "printed.pdf" }));
+    assert!(printed.get("will_print").is_none(), "nothing to report: {printed}");
+    assert_eq!(log(&mut a, doc), "open1 Mouse Enter2 Blur save3 print4");
+    // A print with nowhere to go fails before Will Print runs.
+    assert!(a.call("doc_print", &json!({ "doc": doc })).is_err());
+    assert_eq!(log(&mut a, doc), "open1 Mouse Enter2 Blur save3 print4");
+
+    // What Will Save changed is in the saved file.
+    tool(&mut a, "js_enabled", json!({ "enabled": false }));
+    let reopened = tool(&mut a, "doc_open", json!({ "path": "saved.pdf" }))["doc"].as_u64().unwrap();
+    assert_eq!(log(&mut a, reopened), "open1 Mouse Enter2 Blur save3");
+}
+
+/// Of two fields sharing a name, `field_id` (from form_fields) picks the one js_event runs; by
+/// name alone it is the first.
+#[test]
+fn js_event_runs_the_field_its_field_id_names() {
+    let enter = |text: &str| format!("/AA << /E << /S /JavaScript /JS (getField\\('log'\\).value += '{text}';) >> >>");
+    let pdf = pdf_of(&[
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R 6 0 R 7 0 R] /DA (/Helv 0 Tf 0 g) /DR << /Font << /Helv 5 0 R >> >> >> >>".into(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 300] >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Annots [4 0 R 6 0 R 7 0 R] >>".into(),
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (log) /V () /Rect [20 250 180 270] /P 3 0 R /F 4 >>".into(),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >>".into(),
+        format!("<< /Type /Annot /Subtype /Widget /FT /Tx /T (dup) /V () /Rect [20 200 180 220] /P 3 0 R /F 4 {} >>", enter("first;")),
+        format!("<< /Type /Annot /Subtype /Widget /FT /Tx /T (dup) /V () /Rect [20 150 180 170] /P 3 0 R /F 4 {} >>", enter("second;")),
+    ]);
+    let dir = std::env::temp_dir().join(format!("pdfcraft-js-event-dup-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    std::fs::write(dir.join("dup.pdf"), pdf).unwrap();
+    let mut a = Automation::new().with_root(&dir).unwrap();
+    let doc = tool(&mut a, "doc_open", json!({ "path": "dup.pdf" }))["doc"].as_u64().unwrap();
+    let fields = tool(&mut a, "form_fields", json!({ "doc": doc }));
+    let ids: Vec<u64> = fields["fields"].as_array().unwrap().iter().filter(|f| f["name"] == "dup").map(|f| f["field_id"].as_u64().unwrap()).collect();
+    assert_eq!(ids.len(), 2, "{fields}");
+    tool(&mut a, "js_event", json!({ "doc": doc, "field": "dup", "field_id": ids[1], "event": "mouse_enter" }));
+    assert_eq!(log(&mut a, doc), "second;");
+    tool(&mut a, "js_event", json!({ "doc": doc, "field": "dup", "event": "mouse_enter" }));
+    assert_eq!(log(&mut a, doc), "second;first;");
+    assert!(
+        a.call("js_event", &json!({ "doc": doc, "field": "log", "field_id": ids[1], "event": "mouse_enter" })).is_err(),
+        "the id is another field's"
+    );
+    let _ = std::fs::remove_dir_all(&dir);
+}
diff --git a/crates/automation/tests/it/main.rs b/crates/automation/tests/it/main.rs
index cdb072a888..77c3d3eff3 100644
--- a/crates/automation/tests/it/main.rs
+++ b/crates/automation/tests/it/main.rs
@@ -9,16 +9,19 @@ mod batch;
 mod batch_failures;
 mod batch_secrets;
 mod button_caption;
+mod document_actions;
 mod find_text;
 mod form_bulk;
 mod hostile_args;
 mod list_selection;
 mod model_3d;
 mod model_render;
+mod office;
 mod optimize_content_boundaries;
 mod portfolio_info;
 mod redact_after_stray_q_form;
 mod redact_text_after_q;
 mod render_warnings;
 mod text_copy;
+mod timesheet_compat;
 mod unreadable_objects;
diff --git a/crates/automation/tests/it/office.rs b/crates/automation/tests/it/office.rs
new file mode 100644
index 0000000000..e406b19ad8
--- /dev/null
+++ b/crates/automation/tests/it/office.rs
@@ -0,0 +1,277 @@
+//! Office documents converted by a real LibreOffice through the tools that take them
+//! (`doc_create_multiple`, `doc_combine`), with the converted text checked. Every test here
+//! skips when LibreOffice isn't installed, which is the case on CI; run them on a machine that
+//! has it. The Word, Excel and PowerPoint files are written here, as the smallest packages
+//! LibreOffice reads, so no binary fixtures are committed.
+
+use std::path::Path;
+
+use pdfcraft_automation::{Automation, Content, ToolError};
+use serde_json::{Value, json};
+
+fn auto(dir: &Path) -> Automation {
+    Automation::new().with_root(dir).unwrap().with_clock(|| 1_700_000_000)
+}
+
+fn ok(a: &mut Automation, tool: &str, args: Value) -> Value {
+    match a.call(tool, &args) {
+        Ok(mut c) => match c.remove(0) {
+            Content::Json(v) => v,
+            other => panic!("{tool}: expected JSON, got {other:?}"),
+        },
+        Err(e) => panic!("{tool} {args}: {e}"),
+    }
+}
+
+/// Each page's text, with runs of whitespace made single spaces.
+fn page_text(a: &mut Automation, doc: u64) -> Vec<String> {
+    ok(a, "text_extract", json!({ "doc": doc }))["pages"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .map(|p| p["text"].as_str().unwrap().split_whitespace().collect::<Vec<_>>().join(" "))
+        .collect()
+}
+
+/// A ZIP of `entries`, stored without compression (Office packages may be).
+fn zip(entries: &[(&str, &str)]) -> Vec<u8> {
+    fn crc32(data: &[u8]) -> u32 {
+        let mut crc = !0u32;
+        for &b in data {
+            crc ^= u32::from(b);
+            for _ in 0..8 {
+                crc = if crc & 1 == 1 { (crc >> 1) ^ 0xEDB8_8320 } else { crc >> 1 };
+            }
+        }
+        !crc
+    }
+    let (mut out, mut central) = (Vec::new(), Vec::new());
+    for (name, data) in entries {
+        let (crc, size, offset) = (crc32(data.as_bytes()), data.len() as u32, out.len() as u32);
+        // version 2.0, no flags, stored, 1980-01-01 00:00
+        let common = [&20u16.to_le_bytes()[..], &0u16.to_le_bytes(), &0u16.to_le_bytes(), &0u16.to_le_bytes(), &0x21u16.to_le_bytes()].concat();
+        let sizes = [crc.to_le_bytes(), size.to_le_bytes(), size.to_le_bytes()].concat();
+        out.extend_from_slice(&0x0403_4b50u32.to_le_bytes());
+        out.extend_from_slice(&common);
+        out.extend_from_slice(&sizes);
+        out.extend_from_slice(&(name.len() as u16).to_le_bytes());
+        out.extend_from_slice(&0u16.to_le_bytes());
+        out.extend_from_slice(name.as_bytes());
+        out.extend_from_slice(data.as_bytes());
+        central.extend_from_slice(&0x0201_4b50u32.to_le_bytes());
+        central.extend_from_slice(&20u16.to_le_bytes());
+        central.extend_from_slice(&common);
+        central.extend_from_slice(&sizes);
+        central.extend_from_slice(&(name.len() as u16).to_le_bytes());
+        // extra, comment, disk, internal and external attributes
+        central.extend_from_slice(&[0u8; 12]);
+        central.extend_from_slice(&offset.to_le_bytes());
+        central.extend_from_slice(name.as_bytes());
+    }
+    let (at, count) = (out.len() as u32, entries.len() as u16);
+    out.extend_from_slice(&central);
+    out.extend_from_slice(&0x0605_4b50u32.to_le_bytes());
+    out.extend_from_slice(&[0u8; 4]);
+    out.extend_from_slice(&count.to_le_bytes());
+    out.extend_from_slice(&count.to_le_bytes());
+    out.extend_from_slice(&(central.len() as u32).to_le_bytes());
+    out.extend_from_slice(&at.to_le_bytes());
+    out.extend_from_slice(&0u16.to_le_bytes());
+    out
+}
+
+const XML: &str = r#"<?xml version="1.0" encoding="UTF-8" standalone="yes"?>"#;
+const PACKAGE_RELS: &str = "http://schemas.openxmlformats.org/package/2006/relationships";
+const DOC_RELS: &str = "http://schemas.openxmlformats.org/officeDocument/2006/relationships";
+
+/// `[Content_Types].xml` with one override per (part, type).
+fn content_types(parts: &[(&str, &str)]) -> String {
+    let overrides: String = parts.iter().map(|(part, kind)| format!(r#"<Override PartName="/{part}" ContentType="{kind}"/>"#)).collect();
+    format!(
+        r#"{XML}<Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types"><Default Extension="rels" ContentType="application/vnd.openxmlformats-package.relationships+xml"/><Default Extension="xml" ContentType="application/xml"/>{overrides}</Types>"#
+    )
+}
+
+/// A relationships part with one relationship per (id, type under officeDocument, target).
+fn rels(list: &[(&str, &str, &str)]) -> String {
+    let items: String =
+        list.iter().map(|(id, kind, target)| format!(r#"<Relationship Id="{id}" Type="{DOC_RELS}/{kind}" Target="{target}"/>"#)).collect();
+    format!(r#"{XML}<Relationships xmlns="{PACKAGE_RELS}">{items}</Relationships>"#)
+}
+
+/// A Word document of one paragraph.
+fn docx(text: &str) -> Vec<u8> {
+    let document = format!(
+        r#"{XML}<w:document xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main"><w:body><w:p><w:r><w:t>{text}</w:t></w:r></w:p></w:body></w:document>"#
+    );
+    zip(&[
+        (
+            "[Content_Types].xml",
+            &content_types(&[("word/document.xml", "application/vnd.openxmlformats-officedocument.wordprocessingml.document.main+xml")]),
+        ),
+        ("_rels/.rels", &rels(&[("rId1", "officeDocument", "word/document.xml")])),
+        ("word/document.xml", &document),
+    ])
+}
+
+/// An Excel workbook whose one sheet holds `text` in A1 and a formula, `=6*7`, in A2.
+fn xlsx(text: &str) -> Vec<u8> {
+    let workbook = format!(
+        r#"{XML}<workbook xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:r="{DOC_RELS}"><sheets><sheet name="Sheet1" sheetId="1" r:id="rId1"/></sheets></workbook>"#
+    );
+    let sheet = format!(
+        r#"{XML}<worksheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main"><sheetData><row r="1"><c r="A1" t="inlineStr"><is><t>{text}</t></is></c></row><row r="2"><c r="A2"><f>6*7</f></c></row></sheetData></worksheet>"#
+    );
+    zip(&[
+        (
+            "[Content_Types].xml",
+            &content_types(&[
+                ("xl/workbook.xml", "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml"),
+                ("xl/worksheets/sheet1.xml", "application/vnd.openxmlformats-officedocument.spreadsheetml.worksheet+xml"),
+            ]),
+        ),
+        ("_rels/.rels", &rels(&[("rId1", "officeDocument", "xl/workbook.xml")])),
+        ("xl/workbook.xml", &workbook),
+        ("xl/_rels/workbook.xml.rels", &rels(&[("rId1", "worksheet", "worksheets/sheet1.xml")])),
+        ("xl/worksheets/sheet1.xml", &sheet),
+    ])
+}
+
+/// A PowerPoint presentation of one slide with one text box.
+fn pptx(text: &str) -> Vec<u8> {
+    const P: &str =
+        r#"xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:p="http://schemas.openxmlformats.org/presentationml/2006/main""#;
+    let presentation = format!(
+        r#"{XML}<p:presentation {P} xmlns:r="{DOC_RELS}"><p:sldMasterIdLst><p:sldMasterId id="2147483648" r:id="rId1"/></p:sldMasterIdLst><p:sldIdLst><p:sldId id="256" r:id="rId2"/></p:sldIdLst><p:sldSz cx="9144000" cy="6858000"/><p:notesSz cx="6858000" cy="9144000"/></p:presentation>"#
+    );
+    let tree = r#"<p:cSld><p:spTree><p:nvGrpSpPr><p:cNvPr id="1" name=""/><p:cNvGrpSpPr/><p:nvPr/></p:nvGrpSpPr><p:grpSpPr/>"#;
+    let master = format!(
+        r#"{XML}<p:sldMaster {P} xmlns:r="{DOC_RELS}">{tree}</p:spTree></p:cSld><p:clrMap bg1="lt1" tx1="dk1" bg2="lt2" tx2="dk2" accent1="accent1" accent2="accent2" accent3="accent3" accent4="accent4" accent5="accent5" accent6="accent6" hlink="hlink" folHlink="folHlink"/><p:sldLayoutIdLst><p:sldLayoutId id="2147483649" r:id="rId1"/></p:sldLayoutIdLst></p:sldMaster>"#
+    );
+    let layout = format!(r#"{XML}<p:sldLayout {P}>{tree}</p:spTree></p:cSld></p:sldLayout>"#);
+    let slide = format!(
+        r#"{XML}<p:sld {P}>{tree}<p:sp><p:nvSpPr><p:cNvPr id="2" name="Text"/><p:cNvSpPr txBox="1"/><p:nvPr/></p:nvSpPr><p:spPr><a:xfrm><a:off x="914400" y="914400"/><a:ext cx="6000000" cy="1000000"/></a:xfrm><a:prstGeom prst="rect"><a:avLst/></a:prstGeom></p:spPr><p:txBody><a:bodyPr/><a:p><a:r><a:rPr lang="en-US" sz="2800"/><a:t>{text}</a:t></a:r></a:p></p:txBody></p:sp></p:spTree></p:cSld></p:sld>"#
+    );
+    let theme = format!(
+        r#"{XML}<a:theme xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" name="Plain"><a:themeElements><a:clrScheme name="Plain"><a:dk1><a:srgbClr val="000000"/></a:dk1><a:lt1><a:srgbClr val="FFFFFF"/></a:lt1><a:dk2><a:srgbClr val="000000"/></a:dk2><a:lt2><a:srgbClr val="FFFFFF"/></a:lt2><a:accent1><a:srgbClr val="4472C4"/></a:accent1><a:accent2><a:srgbClr val="ED7D31"/></a:accent2><a:accent3><a:srgbClr val="A5A5A5"/></a:accent3><a:accent4><a:srgbClr val="FFC000"/></a:accent4><a:accent5><a:srgbClr val="5B9BD5"/></a:accent5><a:accent6><a:srgbClr val="70AD47"/></a:accent6><a:hlink><a:srgbClr val="0563C1"/></a:hlink><a:folHlink><a:srgbClr val="954F72"/></a:folHlink></a:clrScheme><a:fontScheme name="Plain"><a:majorFont><a:latin typeface="Arial"/><a:ea typeface=""/><a:cs typeface=""/></a:majorFont><a:minorFont><a:latin typeface="Arial"/><a:ea typeface=""/><a:cs typeface=""/></a:minorFont></a:fontScheme><a:fmtScheme name="Plain"><a:fillStyleLst><a:solidFill><a:schemeClr val="phClr"/></a:solidFill><a:solidFill><a:schemeClr val="phClr"/></a:solidFill><a:solidFill><a:schemeClr val="phClr"/></a:solidFill></a:fillStyleLst><a:lnStyleLst><a:ln><a:solidFill><a:schemeClr val="phClr"/></a:solidFill></a:ln><a:ln><a:solidFill><a:schemeClr val="phClr"/></a:solidFill></a:ln><a:ln><a:solidFill><a:schemeClr val="phClr"/></a:solidFill></a:ln></a:lnStyleLst><a:effectStyleLst><a:effectStyle><a:effectLst/></a:effectStyle><a:effectStyle><a:effectLst/></a:effectStyle><a:effectStyle><a:effectLst/></a:effectStyle></a:effectStyleLst><a:bgFillStyleLst><a:solidFill><a:schemeClr val="phClr"/></a:solidFill><a:solidFill><a:schemeClr val="phClr"/></a:solidFill><a:solidFill><a:schemeClr val="phClr"/></a:solidFill></a:bgFillStyleLst></a:fmtScheme></a:themeElements></a:theme>"#
+    );
+    const PML: &str = "application/vnd.openxmlformats-officedocument.presentationml";
+    let types = content_types(&[
+        ("ppt/presentation.xml", &format!("{PML}.presentation.main+xml")),
+        ("ppt/slideMasters/slideMaster1.xml", &format!("{PML}.slideMaster+xml")),
+        ("ppt/slideLayouts/slideLayout1.xml", &format!("{PML}.slideLayout+xml")),
+        ("ppt/slides/slide1.xml", &format!("{PML}.slide+xml")),
+        ("ppt/theme/theme1.xml", "application/vnd.openxmlformats-officedocument.theme+xml"),
+    ]);
+    zip(&[
+        ("[Content_Types].xml", &types),
+        ("_rels/.rels", &rels(&[("rId1", "officeDocument", "ppt/presentation.xml")])),
+        ("ppt/presentation.xml", &presentation),
+        (
+            "ppt/_rels/presentation.xml.rels",
+            &rels(&[
+                ("rId1", "slideMaster", "slideMasters/slideMaster1.xml"),
+                ("rId2", "slide", "slides/slide1.xml"),
+                ("rId3", "theme", "theme/theme1.xml"),
+            ]),
+        ),
+        ("ppt/slideMasters/slideMaster1.xml", &master),
+        (
+            "ppt/slideMasters/_rels/slideMaster1.xml.rels",
+            &rels(&[("rId1", "slideLayout", "../slideLayouts/slideLayout1.xml"), ("rId2", "theme", "../theme/theme1.xml")]),
+        ),
+        ("ppt/slideLayouts/slideLayout1.xml", &layout),
+        ("ppt/slideLayouts/_rels/slideLayout1.xml.rels", &rels(&[("rId1", "slideMaster", "../slideMasters/slideMaster1.xml")])),
+        ("ppt/slides/slide1.xml", &slide),
+        ("ppt/slides/_rels/slide1.xml.rels", &rels(&[("rId1", "slideLayout", "../slideLayouts/slideLayout1.xml")])),
+        ("ppt/theme/theme1.xml", &theme),
+    ])
+}
+
+/// An RTF document of one paragraph.
+fn rtf(text: &str) -> Vec<u8> {
+    format!("{{\\rtf1\\ansi{{\\fonttbl\\f0\\fswiss Helvetica;}}\\f0\\pard {text}\\par}}").into_bytes()
+}
+
+/// A folder with one Word, Excel, PowerPoint and RTF file, each carrying its own word, and the
+/// tools rooted there; `None` when LibreOffice isn't installed.
+fn office_files() -> Option<(tempfile::TempDir, Automation)> {
+    let dir = tempfile::tempdir().unwrap();
+    std::fs::write(dir.path().join("letter.docx"), docx("Quokka letter")).unwrap();
+    std::fs::write(dir.path().join("budget.xlsx"), xlsx("Narwhal budget")).unwrap();
+    std::fs::write(dir.path().join("deck.pptx"), pptx("Axolotl deck")).unwrap();
+    std::fs::write(dir.path().join("notes.rtf"), rtf("Pangolin notes")).unwrap();
+    let mut a = auto(dir.path());
+    match a.call("doc_create_multiple", &json!({ "paths": ["notes.rtf"] })) {
+        Err(ToolError::Failed(e)) if e.contains("needs LibreOffice") => {
+            eprintln!("skipped: LibreOffice isn't installed");
+            None
+        }
+        _ => Some((dir, a)),
+    }
+}
+
+/// Each Office format converts to a PDF of its own that holds the document's text (and, for
+/// the spreadsheet, the formula's value).
+#[test]
+fn office_documents_convert_separately_with_their_text() {
+    let Some((dir, mut a)) = office_files() else { return };
+    let paths = ["letter.docx", "budget.xlsx", "deck.pptx", "notes.rtf"];
+    let made = ok(&mut a, "doc_create_multiple", json!({ "paths": paths, "mode": "separate", "out_dir": "out" }));
+    let files = made["files"].as_array().unwrap();
+    assert_eq!(files.len(), 4, "{made}");
+    let expected = [
+        ("letter.pdf", &["Quokka letter"][..]),
+        ("budget.pdf", &["Narwhal budget", "42"]),
+        ("deck.pdf", &["Axolotl deck"]),
+        ("notes.pdf", &["Pangolin notes"]),
+    ];
+    for (file, (name, words)) in files.iter().zip(expected) {
+        let output = file["output"].as_str().unwrap_or_else(|| panic!("{file}"));
+        // The tool reports the folder in its canonical form (`\\?\C:\…` on Windows).
+        assert_eq!(Path::new(output).file_name(), Some(std::ffi::OsStr::new(name)), "{output}");
+        assert!(dir.path().join("out").join(name).is_file(), "{name}");
+        let doc = ok(&mut a, "doc_open", json!({ "path": output }))["doc"].as_u64().unwrap();
+        let text = page_text(&mut a, doc).join("\n");
+        for word in words {
+            assert!(text.contains(word), "{output}: {word:?} not in {text:?}");
+        }
+    }
+}
+
+/// Office documents combine, in the order given, with a PDF made here, one bookmark each.
+#[test]
+fn office_documents_combine_in_order_with_a_bookmark_each() {
+    let Some((dir, mut a)) = office_files() else { return };
+    let made = ok(
+        &mut a,
+        "doc_create_multiple",
+        json!({ "paths": ["deck.pptx", "letter.docx", "budget.xlsx", "notes.rtf"], "out": "all.pdf", "open": true }),
+    );
+    let doc = made["document"]["doc"].as_u64().unwrap();
+    let pages = page_text(&mut a, doc);
+    assert_eq!(pages.len(), 4, "{pages:?}");
+    for (page, word) in pages.iter().zip(["Axolotl deck", "Quokka letter", "Narwhal budget", "Pangolin notes"]) {
+        assert!(page.contains(word), "{word:?} not in {page:?}");
+    }
+    let titles: Vec<String> = ok(&mut a, "bookmark_list", json!({ "doc": doc }))["bookmarks"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .map(|b| b["title"].as_str().unwrap().to_string())
+        .collect();
+    assert_eq!(titles, ["deck", "letter", "budget", "notes"]);
+    assert!(dir.path().join("all.pdf").is_file());
+
+    // doc_combine takes them beside a PDF, with a page range for one of them.
+    std::fs::write(dir.path().join("cover.txt"), "Cover page").unwrap();
+    ok(&mut a, "doc_create_multiple", json!({ "paths": ["cover.txt"], "out": "cover.pdf" }));
+    assert!(dir.path().join("cover.pdf").is_file());
+    let combined = ok(&mut a, "doc_combine", json!({ "paths": ["cover.pdf", "notes.rtf", "letter.docx"], "pages": [null, "1", null], "open": true }));
+    let doc = combined["document"]["doc"].as_u64().unwrap();
+    let pages = page_text(&mut a, doc);
+    assert_eq!(pages.len(), 3, "{pages:?}");
+    for (page, word) in pages.iter().zip(["Cover page", "Pangolin notes", "Quokka letter"]) {
+        assert!(page.contains(word), "{word:?} not in {page:?}");
+    }
+}
diff --git a/crates/automation/tests/it/timesheet_compat.rs b/crates/automation/tests/it/timesheet_compat.rs
new file mode 100644
index 0000000000..f6910543b6
--- /dev/null
+++ b/crates/automation/tests/it/timesheet_compat.rs
@@ -0,0 +1,243 @@
+//! Original synthetic workflow: no private timesheet, employee, PIN or signature assets.
+use pdfcraft_automation::{Automation, Content};
+use pdfcraft_cos::{Dict, Document, Object, SaveOptions, Stream, write_full};
+use pdfcraft_engine::{Edit, NewField, Session};
+use serde_json::{Value, json};
+use std::sync::Arc;
+
+/// Dispatch a synthetic automation step and fail with the returned tool error on refusal.
+fn call(a: &mut Automation, name: &str, args: Value) -> Value {
+    match a.call(name, &args).unwrap().remove(0) {
+        Content::Json(v) => v,
+        _ => panic!("expected JSON"),
+    }
+}
+/// Construct a synthetic form and transparent Form XObject without private files or font assets.
+fn fixture() -> Vec<u8> {
+    let mut session = Session::new();
+    let bytes = session.create_blank(600.0, 800.0, 1).unwrap();
+    let id = session.open("synthetic.pdf", None, bytes, None).unwrap();
+    for (i, name) in ["input", "double", "seen", "choice", "go", "source", "target"].into_iter().enumerate() {
+        session
+            .apply(
+                id,
+                Edit::AddField {
+                    page: 0,
+                    rect: [40.0, 700.0 - i as f64 * 45.0, 200.0, 730.0 - i as f64 * 45.0],
+                    kind: if i >= 4 { NewField::Button { caption: name.into() } } else { NewField::Text { multiline: false } },
+                    name: Some(name.into()),
+                },
+            )
+            .unwrap();
+    }
+    let mut doc = Document::open(session.save_bytes(id).unwrap()).unwrap();
+    let source = session.get(id).unwrap().form.iter().find(|f| f.name == "source").unwrap().obj;
+    let mut gs = Dict::new();
+    gs.set(b"ca".to_vec(), Object::Real(0.5));
+    let mut states = Dict::new();
+    states.set(b"Half".to_vec(), Object::Dict(gs));
+    let mut resources = Dict::new();
+    resources.set(b"ExtGState".to_vec(), Object::Dict(states));
+    let mut dict = Dict::new();
+    dict.set(b"Type".to_vec(), Object::name("XObject"));
+    dict.set(b"Subtype".to_vec(), Object::name("Form"));
+    dict.set(b"BBox".to_vec(), Object::Array([0, 0, 60, 30].map(Object::Int).to_vec()));
+    dict.set(b"Resources".to_vec(), Object::Dict(resources));
+    let icon = doc.add(Object::Stream(Stream::from_raw(dict, b"q /Half gs 1 0 0 rg 0 0 60 30 re f Q".to_vec())));
+    let mut mk = Dict::new();
+    mk.set(b"I".to_vec(), Object::Ref(icon));
+    mk.set(b"TP".to_vec(), Object::Int(1));
+    doc.update_dict(source, |d| d.set(b"MK".to_vec(), Object::Dict(mk))).unwrap();
+    write_full(&doc, &SaveOptions::default()).unwrap()
+}
+const HELPERS: &str = r#"
+var initialized=1, buffer='', savedIcon=null;
+function openPad(){var b=getPageBox('Crop',0);var f=getField('go');f.rect=[b[0]+40,b[1]-400,b[0]+200,b[1]-450];f.textSize=16;f.fillColor=['RGB',0.9,0.8,0.7];f.strokeColor=['G',0.4];f.lineWidth=2;f.borderStyle='dashed';f.textColor=color.blue;f.userName='Synthetic keypad';f.display=display.noPrint;}
+function digit(d){buffer+=d;getField('go').buttonSetCaption(buffer);if(buffer==='1234'){getField('target').buttonSetIcon(savedIcon);getField('go').display=display.hidden;}}
+function selectTime(){var v=app.popUpMenuEx({cName:'Unavailable',cReturn:'bad',bEnabled:false},{cName:'Times',oSubMenu:[{cName:'Seven',cReturn:'07:00',bMarked:true},{cName:'Manual',cReturn:'manual'}]});if(v==='manual')v=app.response({cQuestion:'Time',cDefault:'07:00'});if(v!==null)getField('choice').value=v;}
+"#;
+
+#[test]
+/// Exercise retained keypad state, geometry, synchronous calculation and transparent icons through save/reopen and Undo/Redo.
+fn timesheet_keypad_geometry_icons_calculation_and_persistence() {
+    let dir = std::env::temp_dir().join(format!("pdfcraft-timesheet-compat-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    std::fs::write(dir.join("synthetic.pdf"), fixture()).unwrap();
+    let mut a = Automation::new().with_root(&dir).unwrap();
+    let id = call(&mut a, "doc_open", json!({"path":"synthetic.pdf"}))["doc"].as_u64().unwrap();
+    call(&mut a, "form_set_script", json!({"doc":id,"field":"double","event":"calculate","script":"event.value=Number(getField('input').value)*2;"}));
+    call(&mut a, "js_set_document_script", json!({"doc":id,"name":"helpers","script":HELPERS}));
+    let out = call(
+        &mut a,
+        "js_run",
+        json!({"doc":id,"script":"getField('input').value=3;calculateNow();getField('seen').value=getField('double').value;getField('seen').value;"}),
+    );
+    assert_eq!(out["error"], Value::Null);
+    assert_eq!(out["result"], "6");
+    let out = call(&mut a, "js_run", json!({"doc":id,"script":"openPad();savedIcon=getField('source').buttonGetIcon();initialized;"}));
+    assert_eq!(out["error"], Value::Null);
+    assert_eq!(out["result"], "1");
+    let fields = call(&mut a, "form_fields", json!({"doc":id}));
+    let go = fields["fields"].as_array().unwrap().iter().find(|f| f["name"] == "go").unwrap();
+    assert_eq!(go["tooltip"], "Synthetic keypad");
+    let model = a.session().get(pdfcraft_engine::DocId(id)).unwrap().form.iter().find(|f| f.name == "go").unwrap();
+    assert_eq!(model.widgets[0].rect, [40.0, 350.0, 200.0, 400.0]);
+    assert!(model.da.contains("16 Tf"), "{}", model.da);
+    for (key, expected) in [("1", "1"), ("2", "12"), ("3", "123")] {
+        let out = call(&mut a, "js_run", json!({"doc":id,"field":"go","script":format!("digit('{key}');buffer;")}));
+        assert_eq!(out["error"], Value::Null);
+        assert_eq!(out["result"], expected);
+    }
+    let (_, _, before) = a.render_pixels(id, 1, 1.0).unwrap();
+    let out = call(&mut a, "js_run", json!({"doc":id,"field":"go","script":"digit('4');buffer;"}));
+    assert_eq!(out["error"], Value::Null);
+    assert_eq!(out["result"], "1234");
+    let (_, _, after) = a.render_pixels(id, 1, 1.0).unwrap();
+    assert_ne!(before, after);
+    let blended = after
+        .as_chunks::<4>()
+        .0
+        .iter()
+        .filter(|p| p[0] > p[1].saturating_add(50) && (50..180).contains(&p[1]) && (p[1] as i16 - p[2] as i16).abs() <= 2)
+        .count();
+    assert!(blended > 500, "half-opacity red icon must blend across its area with the button's grey background, got {blended} pixels");
+    call(&mut a, "edit_undo", json!({"doc":id}));
+    assert_eq!(a.render_pixels(id, 1, 1.0).unwrap().2, before);
+    call(&mut a, "edit_redo", json!({"doc":id}));
+    assert_eq!(a.render_pixels(id, 1, 1.0).unwrap().2, after);
+    let rejected = call(&mut a, "js_run", json!({"doc":id,"script":"getField('target').buttonSetIcon({});"}));
+    assert!(rejected["error"].as_str().unwrap().contains("icon"));
+    call(&mut a, "doc_save", json!({"doc":id,"path":"saved.pdf"}));
+    let saved = Document::open(Arc::new(std::fs::read(dir.join("saved.pdf")).unwrap())).unwrap();
+    let root = saved.get(saved.root().unwrap());
+    let af = saved.resolve(root.as_dict().unwrap().get(b"AcroForm").unwrap());
+    let fields = saved.resolve(af.as_dict().unwrap().get(b"Fields").unwrap());
+    let target = fields
+        .as_array()
+        .unwrap()
+        .iter()
+        .map(|f| saved.resolve(f))
+        .find(|f| f.as_dict().unwrap().get(b"T").and_then(Object::as_string).is_some_and(|s| s.to_text() == "target"))
+        .unwrap();
+    let mk = saved.resolve(target.as_dict().unwrap().get(b"MK").unwrap());
+    let icon = saved.resolve(mk.as_dict().unwrap().get(b"I").unwrap());
+    let Object::Stream(icon) = &*icon else { panic!("icon stream") };
+    assert!(String::from_utf8_lossy(&icon.decoded().unwrap()).contains("/Half gs"));
+    let reopened = call(&mut a, "doc_open", json!({"path":"saved.pdf"}))["doc"].as_u64().unwrap();
+    assert_eq!(a.render_pixels(reopened, 1, 1.0).unwrap().2, after);
+    let reset = call(&mut a, "js_run", json!({"doc":reopened,"script":"buffer;"}));
+    assert_eq!(reset["result"], "");
+    std::fs::remove_dir_all(dir).unwrap();
+}
+
+#[test]
+/// Resume one invocation across popup/text prompts and reject disabled or invented choices.
+fn popup_and_manual_response_resume_the_same_script_and_validate_choices() {
+    let dir = std::env::temp_dir().join(format!("pdfcraft-timesheet-menu-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    std::fs::write(dir.join("synthetic.pdf"), fixture()).unwrap();
+    let mut a = Automation::new().with_root(&dir).unwrap();
+    let id = call(&mut a, "doc_open", json!({"path":"synthetic.pdf"}))["doc"].as_u64().unwrap();
+    call(&mut a, "js_set_document_script", json!({"doc":id,"name":"helpers","script":HELPERS}));
+    let out = call(&mut a, "js_run", json!({"doc":id,"script":"selectTime();getField('choice').value;","answers":["manual","07:45"]}));
+    assert_eq!(out["error"], Value::Null);
+    assert_eq!(out["result"], "07:45");
+    let cancel = call(&mut a, "js_run", json!({"doc":id,"script":"selectTime();getField('choice').value;","answers":[null]}));
+    assert_eq!(cancel["result"], "07:45");
+    let invalid = call(&mut a, "js_run", json!({"doc":id,"script":"selectTime();","answers":["bad"]}));
+    assert!(invalid["error"].as_str().unwrap().contains("invalid popup"));
+    let alert = call(&mut a, "js_run", json!({"doc":id,"script":"app.alert({cMsg:'Continue?',nType:2});","answers":["4"]}));
+    assert_eq!(alert["result"], "4");
+    std::fs::remove_dir_all(dir).unwrap();
+}
+
+/// The advertised schema must bound prompt strings before clients dispatch them.
+#[test]
+fn prompt_answer_schema_advertises_the_length_budget() {
+    let tool = pdfcraft_automation::tools().into_iter().find(|t| t.name == "js_run").unwrap();
+    assert_eq!(tool.input_schema["properties"]["answers"]["items"]["maxLength"], 4096);
+}
+
+#[test]
+fn js_run_exact_field_ids_are_discoverable_and_strictly_validated() {
+    let dir = std::env::temp_dir().join(format!("pdfcraft-field-identity-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    std::fs::write(dir.join("synthetic.pdf"), fixture()).unwrap();
+    let mut a = Automation::new().with_root(&dir).unwrap();
+    let id = call(&mut a, "doc_open", json!({"path":"synthetic.pdf"}))["doc"].as_u64().unwrap();
+    let fields = call(&mut a, "form_fields", json!({"doc":id}));
+    let entries = fields["fields"].as_array().unwrap();
+    let go = entries.iter().find(|f| f["name"] == "go").unwrap()["field_id"].as_u64().unwrap();
+    let other = entries.iter().find(|f| f["name"] == "input").unwrap()["field_id"].as_u64().unwrap();
+    let out = call(
+        &mut a,
+        "js_run",
+        json!({"doc":id,"field":"go","field_id":go,"script":"event.target.buttonSetCaption(app.response({cQuestion:'Caption'}));event.target.name;","answers":["exact"]}),
+    );
+    assert_eq!(out["error"], Value::Null);
+    assert_eq!(out["result"], "go");
+    for invalid in [json!(-1), json!(1.5), json!("bad"), json!(281474976710656u64), json!(other)] {
+        assert!(a.call("js_run", &json!({"doc":id,"field":"go","field_id":invalid,"script":"getField('input').value='bad';"})).is_err());
+    }
+    assert!(a.call("js_run", &json!({"doc":id,"field_id":go,"script":"true;"})).is_err());
+    let schema = pdfcraft_automation::tools().into_iter().find(|t| t.name == "js_run").unwrap();
+    assert_eq!(schema.input_schema["properties"]["field_id"]["maximum"], 281474976710655u64);
+    std::fs::remove_dir_all(dir).unwrap();
+}
+
+/// The headless image picker counterpart accepts exact duplicate identities and keeps legacy lookup.
+#[test]
+fn exact_image_field_tool_targets_duplicates_and_rejects_invalid_ids() {
+    let dir = std::env::temp_dir().join(format!("pdfcraft-exact-image-tool-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let mut session = Session::new();
+    let bytes = session.create_blank(300.0, 300.0, 1).unwrap();
+    let id = session.open("synthetic.pdf", None, bytes, None).unwrap();
+    for (name, x) in [("first", 20.0), ("second", 160.0)] {
+        session.apply(id, Edit::AddField { page: 0, rect: [x, 20.0, x + 100.0, 80.0], kind: NewField::Image, name: Some(name.into()) }).unwrap();
+    }
+    let mut cos = Document::open(session.save_bytes(id).unwrap()).unwrap();
+    for field in session.get(id).unwrap().form.iter() {
+        cos.update_dict(field.obj, |d| d.set(b"T".to_vec(), pdfcraft_cos::PdfString::text("same"))).unwrap();
+    }
+    std::fs::write(dir.join("synthetic.pdf"), write_full(&cos, &Default::default()).unwrap()).unwrap();
+    std::fs::write(dir.join("picture.gif"), pdfcraft_xfa::fixtures::TINY_GIF).unwrap();
+    let mut a = Automation::new().with_root(&dir).unwrap();
+    let id = call(&mut a, "doc_open", json!({"path":"synthetic.pdf"}))["doc"].as_u64().unwrap();
+    let fields = call(&mut a, "form_fields", json!({"doc":id}));
+    let second = fields["fields"][1]["field_id"].as_u64().unwrap();
+    call(&mut a, "form_set_image", json!({"doc":id,"field":"same","field_id":second,"path":"picture.gif"}));
+    let icons = |a: &mut Automation| {
+        call(a, "doc_save", json!({"doc":id,"path":"saved.pdf"}));
+        let cos = Document::open(Arc::new(std::fs::read(dir.join("saved.pdf")).unwrap())).unwrap();
+        let root = cos.get(cos.root().unwrap());
+        let form = cos.resolve(root.as_dict().unwrap().get(b"AcroForm").unwrap());
+        form.as_dict()
+            .unwrap()
+            .get(b"Fields")
+            .unwrap()
+            .as_array()
+            .unwrap()
+            .iter()
+            .map(|r| {
+                cos.resolve(r)
+                    .as_dict()
+                    .and_then(|d| d.get(b"MK").map(|v| cos.resolve(v)))
+                    .is_some_and(|m| m.as_dict().is_some_and(|d| d.contains(b"I")))
+            })
+            .collect::<Vec<_>>()
+    };
+    assert_eq!(icons(&mut a), [false, true]);
+    for invalid in [json!(-1), json!(1.5), json!("bad"), json!(281474976710656u64)] {
+        assert!(a.call("form_set_image", &json!({"doc":id,"field":"same","field_id":invalid,"path":"picture.gif"})).is_err());
+    }
+    assert!(a.call("form_set_image", &json!({"doc":id,"field":"missing","field_id":second,"path":"picture.gif"})).is_err());
+    assert_eq!(icons(&mut a), [false, true]);
+    call(&mut a, "edit_undo", json!({"doc":id}));
+    assert_eq!(icons(&mut a), [false, false]);
+    call(&mut a, "form_set_image", json!({"doc":id,"field":"same","path":"picture.gif"}));
+    assert_eq!(icons(&mut a), [true, false]);
+    let tool = pdfcraft_automation::tools().into_iter().find(|t| t.name == "form_set_image").unwrap();
+    assert_eq!(tool.input_schema["properties"]["field_id"]["maximum"], 281474976710655u64);
+    std::fs::remove_dir_all(dir).unwrap();
+}
diff --git a/crates/content/src/lib.rs b/crates/content/src/lib.rs
index fb17a903d1..f77c54e1dc 100644
--- a/crates/content/src/lib.rs
+++ b/crates/content/src/lib.rs
@@ -58,6 +58,23 @@ impl Op {
     pub fn last_name(&self) -> Option<&[u8]> {
         self.operands.last().and_then(Object::as_name)
     }
+
+    /// Operand `k` counted from the end (0 is the last), as the renderer reads an operator's
+    /// operands: `(x) /OC /MC0 BDC` marks with `/OC /MC0`, and `(x) /F1 10 Tf` selects `/F1`.
+    pub fn back(&self, k: usize) -> Option<&Object> {
+        let i = self.operands.len().checked_sub(k)?.checked_sub(1)?;
+        self.operands.get(i)
+    }
+
+    /// [`Op::back`] as a name.
+    pub fn name_back(&self, k: usize) -> Option<&[u8]> {
+        self.back(k).and_then(Object::as_name)
+    }
+
+    /// [`Op::back`] as a number.
+    pub fn num_back(&self, k: usize) -> Option<f64> {
+        self.back(k).and_then(Object::as_f64)
+    }
 }
 
 /// A parsed stream.
diff --git a/crates/content/src/tests.rs b/crates/content/src/tests.rs
index 9ca12c4536..89f258853d 100644
--- a/crates/content/src/tests.rs
+++ b/crates/content/src/tests.rs
@@ -10,6 +10,17 @@ thread_local! {
     pub(crate) static PIECE_VISITS: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
 }
 
+#[test]
+fn operands_are_counted_from_the_end() {
+    let op = parse(b"(x) /OC /MC0 BDC").ops.remove(0);
+    assert_eq!((op.name_back(1), op.name_back(0)), (Some(&b"OC"[..]), Some(&b"MC0"[..])));
+    assert_eq!(op.back(2).and_then(Object::as_string).map(|s| s.bytes.clone()), Some(b"x".to_vec()));
+    assert_eq!((op.back(3), op.back(usize::MAX)), (None, None));
+    let op = parse(b"/F1 10 Tf").ops.remove(0);
+    assert_eq!((op.name_back(1), op.num_back(0), op.num_back(1)), (Some(&b"F1"[..]), Some(10.0), None));
+    assert_eq!(Op::new("Q", vec![]).back(0), None);
+}
+
 #[test]
 fn splicing_visits_each_piece_a_few_times() {
     let n = 5_000;
diff --git a/crates/cos/src/document/objects.rs b/crates/cos/src/document/objects.rs
index 925a7c879d..42aef4af0f 100644
--- a/crates/cos/src/document/objects.rs
+++ b/crates/cos/src/document/objects.rs
@@ -2,8 +2,8 @@ use std::collections::HashSet;
 
 use super::reader::find;
 use super::state::{
-    LENGTHS, LoadGuard, ObjStm, ObjectReader, ReadState, ScanLengths, Slot, SourceIdentity, loaded_bytes, loading, note_overlay_read, objstm_member,
-    overlay_reads,
+    LENGTHS, LoadGuard, ObjStm, ObjectReader, ReadFrame, ReadState, ScanLengths, Slot, SourceIdentity, loaded_bytes, loading, note_overlay_read,
+    note_read, objstm_member, overlay_reads,
 };
 use super::xref::{Revision, XrefEntry, XrefIndex};
 use super::{
@@ -244,6 +244,12 @@ impl Document {
 
     pub(super) fn try_get_reference(&self, r: ObjRef) -> Result<Arc<Object>, CosError> {
         if !self.reference_matches(r) {
+            // An edit of `r.num` can make it match, so a load that read null here read it too;
+            // with `r.num` edited (freed, or set at another generation) the null is the edit's.
+            if self.overlay.contains_key(&r.num) {
+                note_overlay_read();
+            }
+            note_read(r.num, None);
             return Ok(Arc::new(Object::Null));
         }
         self.try_get(r.num)
@@ -554,22 +560,32 @@ impl Document {
 
     pub fn try_get(&self, num: u32) -> Result<Arc<Object>, CosError> {
         if let Some(slot) = self.overlay.get(&num) {
+            note_read(num, None);
             note_overlay_read();
             return Ok(match slot {
                 Slot::Set(_, o) | Slot::RepairedSet(_, _, o) => o.clone(),
                 Slot::Freed(_) => Arc::new(Object::Null),
             });
         }
-        if let Some(loaded) = self.cache.lock().map_err(|_| CosError::Poisoned)?.get(&num) {
+        // Clones share the cache: what a load read that this document has edited since (the
+        // member's object stream, a `/Length`) makes the entry another document's.
+        if let Some((loaded, reads)) = self.cache.lock().map_err(|_| CosError::Poisoned)?.get(&num)
+            && !reads.touch(&self.overlay)
+        {
+            note_read(num, Some(reads));
             return loaded.clone();
         }
+        note_read(num, None);
         // Loading can re-enter (indirect stream `/Length`, object streams); damaged files make
         // cycles such as `6 0 obj << /Length 6 0 R >>`. Bound the nesting on every path.
         let _guard =
             LoadGuard::enter(num).ok_or_else(|| CosError::Syntax { offset: 0, detail: format!("reference cycle while loading object {num}") })?;
         let _scope = crate::security::FollowScope::enter();
         let edits_read = overlay_reads();
+        let frame = ReadFrame::enter();
         let loaded = self.load(num, 0).map(Arc::new);
+        let reads = frame.reads();
+        drop(frame);
         if let Err(e) = &loaded
             && !matches!(e, CosError::Poisoned)
         {
@@ -581,7 +597,7 @@ impl Document {
         if overlay_reads() == edits_read && !matches!(loaded, Err(CosError::Poisoned)) {
             // The editing cache is bounded like the scan reader's: re-parsing a file-backed view
             // is cheap, and returned objects outlive eviction.
-            self.cache.lock().map_err(|_| CosError::Poisoned)?.insert(num, loaded.clone(), loaded_bytes(&loaded, &self.data));
+            self.cache.lock().map_err(|_| CosError::Poisoned)?.insert(num, loaded.clone(), loaded_bytes(&loaded, &self.data), reads);
             self.evict_editor_cache_if_over_budget(num)?;
         }
         loaded
@@ -724,9 +740,14 @@ impl Document {
     pub(super) fn objstm(&self, num: u32) -> Result<Arc<ObjStm>, CosError> {
         // An edited or freed stream is this document's alone: clones share the parsed streams.
         let edited = self.overlay.contains_key(&num);
-        if !edited && let Some(s) = self.objstms.lock().map_err(|_| CosError::Poisoned)?.get(&num) {
+        if !edited
+            && let Some(s) = self.objstms.lock().map_err(|_| CosError::Poisoned)?.get(&num)
+            && !s.reads.touch(&self.overlay)
+        {
+            note_read(num, Some(&s.reads));
             return Ok(s.clone());
         }
+        let frame = ReadFrame::enter();
         // A file entry that cannot place the stream (one that says it is itself compressed
         // inside another stream, as in #2367, or points nowhere) is tried by the stream's own
         // header, as a plain object with a wrong offset is. An edited or freed stream, in the
@@ -740,8 +761,6 @@ impl Document {
             }
             _ => Arc::new(self.scan_for(num).map(|(id, o)| self.decrypted(id, o)).ok_or(CosError::MissingObject(num))?),
         };
-        // A stream whose load read this document's edits (its `/Length`) is as much its own as an edited one.
-        let own = edited || overlay_reads() != edits_read;
         let Object::Stream(s) = &*loaded else { return Err(CosError::MissingObject(num)) };
         let n = s.dict.int(b"N").unwrap_or(0).clamp(0, 1_000_000) as usize;
         let first = usize::try_from(s.dict.int(b"First").unwrap_or(0).max(0)).ok();
@@ -758,8 +777,10 @@ impl Document {
             let (Some(Object::Int(onum)), Some(Object::Int(off))) = (lx.object().ok(), lx.object().ok()) else { break };
             index.push(objstm_member(onum, off, first, data.len()));
         }
-        let stm = Arc::new(ObjStm { index, data: Arc::new(data) });
-        if own {
+        let stm = Arc::new(ObjStm { index, data: Arc::new(data), reads: frame.reads() });
+        // A stream whose load or decoding read this document's edits (its `/Length`, its
+        // `/DecodeParms`) is as much its own as an edited one.
+        if edited || overlay_reads() != edits_read {
             return Ok(stm);
         }
         // Same bound as the object cache: decoded object streams can be megabytes each.
@@ -777,17 +798,21 @@ impl Document {
             note_overlay_read();
         }
         let cached = loading();
-        // A length resolved through this document's edits counts as an edit read on every reuse.
-        if cached && let Some((known, edits)) = LENGTHS.with(|m| m.borrow().get(&r).copied()) {
+        // Each reuse counts as a read of the length and of what resolving it read, and as an edit
+        // read when that went through this document's edits.
+        if cached && let Some((known, edits, reads)) = LENGTHS.with(|m| m.borrow().get(&r).cloned()) {
             if edits {
                 note_overlay_read();
             }
+            note_read(r.num, Some(&reads));
             return known;
         }
+        note_read(r.num, None);
         let edits_read = overlay_reads();
+        let frame = ReadFrame::enter();
         let length = self.try_get_reference(r).ok().and_then(|o| o.as_int());
         if cached {
-            LENGTHS.with(|m| m.borrow_mut().insert(r, (length, overlay_reads() != edits_read)));
+            LENGTHS.with(|m| m.borrow_mut().insert(r, (length, overlay_reads() != edits_read, frame.reads())));
         }
         length
     }
@@ -847,7 +872,6 @@ impl Document {
     pub fn set(&mut self, r: ObjRef, obj: impl Into<Object>) {
         let obj = self.adopt(obj.into());
         self.overlay.insert(r.num, Slot::Set(r.generation, Arc::new(obj)));
-        self.forget_member_failures(r.num);
         if r.num >= self.next_num {
             self.next_num = r.num.saturating_add(1);
         }
@@ -907,16 +931,6 @@ impl Document {
     /// Delete an object (its number becomes free with the next generation).
     pub fn free(&mut self, r: ObjRef) {
         self.overlay.insert(r.num, Slot::Freed(r.generation.saturating_add(1)));
-        self.forget_member_failures(r.num);
-    }
-
-    /// Forget cached failures of the members `stream` held in the file: they were failures of
-    /// the file's copy, and an edit of `stream` may read. Clones share the cache, so theirs are
-    /// searched again too, which costs time only. A poisoned lock leaves the cache as it is.
-    fn forget_member_failures(&self, stream: u32) {
-        if let Ok(mut cache) = self.cache.lock() {
-            cache.forget_failures(|n| matches!(self.entries.lookup(*n, &self.data), Some(XrefEntry::InStream { stream: s, .. }) if s == stream));
-        }
     }
 
     /// Free what was added since the file was read and nothing refers to any more: the objects
diff --git a/crates/cos/src/document/reader.rs b/crates/cos/src/document/reader.rs
index 18f5ce848a..3e0b9684c1 100644
--- a/crates/cos/src/document/reader.rs
+++ b/crates/cos/src/document/reader.rs
@@ -320,10 +320,25 @@ impl Document {
         Ok(Some((section, stream.dict.clone(), true)))
     }
 
+    /// Read the cross-reference chain from `startxref` into one map of entries, newer sections
+    /// winning, with the trailer, the revisions oldest first and the set-aside entries. A chain
+    /// that lists more than [`MAX_XREF_OBJECTS`] rows in all is refused with
+    /// [`CosError::Syntax`], and the caller rebuilds the file from object headers (#5082).
     #[allow(clippy::type_complexity)]
     pub(super) fn read_xref_chain_materialized(
         &self,
         log: &mut Vec<String>,
+    ) -> Result<(BTreeMap<u32, XrefEntry>, Dict, Vec<Revision>, Vec<(u64, u32)>, Vec<String>), CosError> {
+        self.read_xref_chain_materialized_with_limit(log, MAX_XREF_OBJECTS)
+    }
+
+    /// [`Self::read_xref_chain_materialized`] refusing a chain past `row_limit` rows in all
+    /// instead of [`MAX_XREF_OBJECTS`], so tests can reach the limit with a few rows.
+    #[allow(clippy::type_complexity)]
+    pub(super) fn read_xref_chain_materialized_with_limit(
+        &self,
+        log: &mut Vec<String>,
+        row_limit: usize,
     ) -> Result<(BTreeMap<u32, XrefEntry>, Dict, Vec<Revision>, Vec<(u64, u32)>, Vec<String>), CosError> {
         let data = &self.data;
         let tail_start = data.len().saturating_sub(4096);
@@ -347,6 +362,9 @@ impl Document {
         let mut generation_repairs = Vec::new();
         let mut recorded = HashSet::new();
         let mut diagnose = true;
+        // Every row the sections (and their hybrid streams) list, counted by `read_section` as it
+        // reads them, before any are merged or deduplicated.
+        let mut merged_rows = 0usize;
         let mut next = Some(first);
         while let Some(off) = next.take() {
             if !visited.insert(off) || visited.len() > 10_000 {
@@ -357,13 +375,15 @@ impl Document {
             let mut sect = BTreeMap::new();
             // Object numbers whose entry in this section was set aside ([`Self::xref_oddities`]).
             let mut odd = Vec::new();
-            let ((sect_trailer, is_stream), header_relative) = match self.read_section(off as usize, &mut sect, &mut odd, log) {
+            let rows_before = merged_rows;
+            let ((sect_trailer, is_stream), header_relative) = match self.read_section(off as usize, &mut sect, &mut odd, &mut merged_rows, log) {
                 Ok(v) => (v, false),
                 Err(e) if self.header_offset > 0 => {
                     log.push(format!("xref at {off} unreadable ({e}); retrying relative to the header"));
                     sect.clear();
                     odd.clear();
-                    (self.read_section(off as usize + self.header_offset, &mut sect, &mut odd, log)?, true)
+                    merged_rows = rows_before;
+                    (self.read_section(off as usize + self.header_offset, &mut sect, &mut odd, &mut merged_rows, log)?, true)
                 }
                 Err(e) => {
                     // An unreadable older section loses every object only it locates (the page
@@ -398,7 +418,7 @@ impl Document {
                 }
             } else if let Some(x) = hybrid {
                 let mut stm = BTreeMap::new();
-                let read = match self.read_section(x as usize, &mut stm, &mut odd, log) {
+                let read = match self.read_section(x as usize, &mut stm, &mut odd, &mut merged_rows, log) {
                     Ok(_) => {
                         for (&num, &entry) in &stm {
                             if !diagnose {
@@ -429,6 +449,22 @@ impl Document {
                     hybrids.insert(x, read);
                 }
             }
+            // Each section's rows are capped, so the chain is too: at most `row_limit` rows
+            // (MAX_XREF_OBJECTS outside tests) read in all, or the file is rebuilt from object
+            // headers, as when one section's stream decodes past that. This counts every row
+            // read, before deduplication, not the map's size: a chain that relists the same
+            // objects, or a stream whose `/Index` repeats a range (`[0 4 0 4]`), costs as much to
+            // merge (#5082). Rows set aside are among the rows read, and a row is set aside at
+            // most twice (in its section and against a hybrid stream), so they stay bounded too. A
+            // section's rows (its hybrid stream's included) never outnumber the rows the compact
+            // reader counts for it, and that reader stops at about a quarter of MAX_XREF_OBJECTS:
+            // no chain within its limit is refused.
+            if merged_rows > row_limit {
+                return Err(CosError::Syntax {
+                    offset: usize::try_from(off).unwrap_or(usize::MAX),
+                    detail: format!("cross-reference chain lists more than {row_limit} entries"),
+                });
+            }
             oddities.extend(odd.into_iter().map(|num| (off, num)));
             for (num, e) in sect {
                 entries.entry(num).or_insert(e);
@@ -447,12 +483,14 @@ impl Document {
     }
 
     /// Read one section at `off`, adding entries not already known (newer sections win). `odd`
-    /// collects the object numbers whose entry here is set aside ([`Self::xref_oddities`]).
+    /// collects the object numbers whose entry here is set aside ([`Self::xref_oddities`]), and
+    /// `counted` grows by every row read, repeated and set-aside rows included (#5082).
     fn read_section(
         &self,
         off: usize,
         entries: &mut BTreeMap<u32, XrefEntry>,
         odd: &mut Vec<u32>,
+        counted: &mut usize,
         log: &mut Vec<String>,
     ) -> Result<(Dict, bool), CosError> {
         #[cfg(test)]
@@ -479,6 +517,7 @@ impl Document {
                 }
                 let start = shifted;
                 for i in 0..count {
+                    *counted = counted.saturating_add(1);
                     lx.skip_ws();
                     let o = lx.token();
                     lx.skip_ws();
@@ -549,6 +588,7 @@ impl Document {
             }
             for i in 0..*count {
                 let Some(r) = rows.next() else { break };
+                *counted = counted.saturating_add(1);
                 let t = field(r, 0, w[0], 1);
                 let a = field(r, w[0], w[1], 0);
                 let b = field(r, w[0] + w[1], w[2], 0);
diff --git a/crates/cos/src/document/state.rs b/crates/cos/src/document/state.rs
index c5bd85c065..7359ce715a 100644
--- a/crates/cos/src/document/state.rs
+++ b/crates/cos/src/document/state.rs
@@ -8,7 +8,10 @@ thread_local! {
     /// retries a parse several ways, and each retry would resolve the same lengths again
     /// (exponential in the chain of streams whose lengths point at further streams). Each is
     /// kept with whether resolving it read unsaved edits.
-    pub(super) static LENGTHS: std::cell::RefCell<HashMap<ObjRef, (Option<i64>, bool)>> = std::cell::RefCell::new(HashMap::new());
+    pub(super) static LENGTHS: std::cell::RefCell<HashMap<ObjRef, Length>> = std::cell::RefCell::new(HashMap::new());
+    /// What the loads running on this thread have read ([`ReadFrame`]): how many frames are
+    /// open, the object numbers read inside them, and how often that list was full.
+    static READS: std::cell::RefCell<(u32, Vec<u32>, u64)> = const { std::cell::RefCell::new((0, Vec::new(), 0)) };
     /// Unsaved edits read on this thread (`Document::try_get`, and a `/Length` in `Document::load`).
     static OVERLAY_READS: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
     /// How deep `Document::scan_for` is nested on this thread, and how many indirect `/Length`
@@ -59,6 +62,94 @@ impl Drop for ScanLengths {
     }
 }
 
+/// A resolved `/Length` in [`LENGTHS`]: its value, whether resolving it read unsaved edits, and
+/// what it read.
+pub(super) type Length = (Option<i64>, bool, Reads);
+
+/// The other objects a cached load read: an object stream for a member, an indirect `/Length`,
+/// and what those read in turn. Clones share the caches, so a document whose edits include one of
+/// them reads the object again instead (`Document::try_get`); `None` is a load that read more
+/// than [`Reads::MAX`], which such a document always reads again.
+#[derive(Clone, Debug, Default)]
+pub(super) struct Reads(Option<Arc<[u32]>>);
+
+impl Reads {
+    /// Objects one entry keeps: a member's stream and a length or two, and what they read.
+    const MAX: usize = 64;
+    /// Object numbers the open frames keep between them.
+    const HELD: usize = 4096;
+
+    /// Whether `overlay` (a document's edits) holds any of these objects.
+    pub(super) fn touch(&self, overlay: &BTreeMap<u32, Slot>) -> bool {
+        !overlay.is_empty() && self.0.as_ref().is_none_or(|nums| nums.iter().any(|n| overlay.contains_key(n)))
+    }
+
+    fn bytes(&self) -> usize {
+        self.0.as_ref().map_or(0, |nums| nums.len().saturating_mul(std::mem::size_of::<u32>()))
+    }
+}
+
+/// Counts `num` as read by the loads open on this thread, with what loading it read (`reads`).
+pub(super) fn note_read(num: u32, reads: Option<&Reads>) {
+    READS.with(|r| {
+        let (depth, held, full) = &mut *r.borrow_mut();
+        if *depth == 0 {
+            return;
+        }
+        let more = reads.map_or(Some(&[][..]), |r| r.0.as_deref());
+        match more {
+            Some(more) if held.len().saturating_add(more.len()) < Reads::HELD => {
+                held.push(num);
+                held.extend_from_slice(more);
+            }
+            _ => *full = full.wrapping_add(1),
+        }
+    });
+}
+
+/// Collects what one load reads, for [`Reads`]; frames nest, and each read counts for every
+/// frame open around it.
+pub(super) struct ReadFrame {
+    start: usize,
+    full: u64,
+}
+
+impl ReadFrame {
+    pub(super) fn enter() -> Self {
+        READS.with(|r| {
+            let (depth, held, full) = &mut *r.borrow_mut();
+            *depth = depth.saturating_add(1);
+            ReadFrame { start: held.len(), full: *full }
+        })
+    }
+
+    /// What was read since the frame opened.
+    pub(super) fn reads(&self) -> Reads {
+        READS.with(|r| {
+            let (_, held, full) = &*r.borrow();
+            if *full != self.full {
+                return Reads(None);
+            }
+            let mut nums = held.get(self.start..).unwrap_or_default().to_vec();
+            nums.sort_unstable();
+            nums.dedup();
+            Reads((nums.len() <= Reads::MAX).then(|| Arc::from(nums)))
+        })
+    }
+}
+
+impl Drop for ReadFrame {
+    fn drop(&mut self) {
+        READS.with(|r| {
+            let (depth, held, _) = &mut *r.borrow_mut();
+            *depth = depth.saturating_sub(1);
+            if *depth == 0 {
+                held.clear();
+            }
+        });
+    }
+}
+
 /// Unsaved edits read so far on this thread: a load during which this changes depended on one.
 pub(super) fn overlay_reads() -> u64 {
     OVERLAY_READS.with(std::cell::Cell::get)
@@ -122,6 +213,8 @@ pub(super) struct ObjStm {
     /// or offset is unusable ([`objstm_member`]).
     pub(super) index: Vec<Option<(u32, usize)>>,
     pub(super) data: Arc<Vec<u8>>,
+    /// What parsing it read: the stream itself and its `/Length`, `/DecodeParms` and so on.
+    pub(super) reads: Reads,
 }
 
 /// Where member `num` of an object stream starts: its `offset` past `/First` (`first`), when the
@@ -317,13 +410,14 @@ thread_local! {
 /// (#5873).
 #[derive(Default)]
 pub(crate) struct ObjectCache {
-    entries: HashMap<u32, (Loaded, usize)>,
+    entries: HashMap<u32, (Loaded, usize, Reads)>,
     owned: usize,
 }
 
 impl ObjectCache {
-    pub(crate) fn get(&self, num: &u32) -> Option<&Loaded> {
-        self.entries.get(num).map(|(object, _)| object)
+    /// What loading `num` gave, and what that load read.
+    pub(super) fn get(&self, num: &u32) -> Option<(&Loaded, &Reads)> {
+        self.entries.get(num).map(|(object, _, reads)| (object, reads))
     }
 
     #[cfg(test)]
@@ -331,9 +425,10 @@ impl ObjectCache {
         self.entries.contains_key(num)
     }
 
-    /// Keep what loading `num` gave, which holds `owned` bytes ([`loaded_bytes`]).
-    pub(crate) fn insert(&mut self, num: u32, object: Loaded, owned: usize) {
-        if let Some((_, before)) = self.entries.insert(num, (object, owned)) {
+    /// Keep what loading `num` gave, which holds `owned` bytes ([`loaded_bytes`]), and what it read.
+    pub(super) fn insert(&mut self, num: u32, object: Loaded, owned: usize, reads: Reads) {
+        let owned = owned.saturating_add(reads.bytes());
+        if let Some((_, before, _)) = self.entries.insert(num, (object, owned, reads)) {
             self.owned = self.owned.saturating_sub(before);
         }
         self.owned = self.owned.saturating_add(owned);
@@ -358,19 +453,14 @@ impl ObjectCache {
         self.owned = 0;
     }
 
-    /// Drop the cached failures `stale` picks. A failure holds no bytes, so the total stands.
-    pub(crate) fn forget_failures(&mut self, mut stale: impl FnMut(&u32) -> bool) {
-        self.entries.retain(|num, (loaded, _)| loaded.is_ok() || !stale(num));
-    }
-
     pub(crate) fn retain(&mut self, mut keep: impl FnMut(&u32) -> bool) {
         self.entries.retain(|num, _| keep(num));
-        self.owned = self.entries.values().fold(0usize, |n, (_, owned)| n.saturating_add(*owned));
+        self.owned = self.entries.values().fold(0usize, |n, (_, owned, _)| n.saturating_add(*owned));
     }
 
     #[cfg(test)]
     pub(crate) fn values(&self) -> impl Iterator<Item = &Arc<Object>> {
-        self.entries.values().filter_map(|(object, _)| object.as_ref().ok())
+        self.entries.values().filter_map(|(object, _, _)| object.as_ref().ok())
     }
 }
 
diff --git a/crates/cos/src/document/tests.rs b/crates/cos/src/document/tests.rs
index 68215efc98..814d4ef8eb 100644
--- a/crates/cos/src/document/tests.rs
+++ b/crates/cos/src/document/tests.rs
@@ -883,6 +883,179 @@ fn an_edited_object_stream_leaves_other_clones_members_alone() {
     assert_eq!(text_of(&doc, 3, b"Hidden").as_deref(), Some("yes"), "the replacement reached another clone");
 }
 
+/// A member another clone read from the file's object stream is not what a clone that replaced
+/// the stream reads, nor is one the document read itself before replacing it.
+#[test]
+fn a_replaced_object_stream_hides_the_members_read_before() {
+    let replacement = || {
+        let mut dict = Dict::new();
+        dict.set(b"Type".to_vec(), Object::name("ObjStm"));
+        dict.set(b"N".to_vec(), Object::Int(1));
+        dict.set(b"First".to_vec(), Object::Int(4));
+        crate::Stream::from_raw(dict, b"3 0 << /Hidden (no) >>".to_vec())
+    };
+    let file = Arc::new(object_stream_file("3 0 ", "<< /Hidden (yes) >>", 0));
+    let doc = Document::open(file.clone()).unwrap();
+    assert_eq!(text_of(&doc, 3, b"Hidden").as_deref(), Some("yes"));
+    let mut replaced = doc.clone();
+    replaced.set(ObjRef::new(4, 0), replacement());
+    assert_eq!(text_of(&replaced, 3, b"Hidden").as_deref(), Some("no"), "another clone's read of the file's stream");
+    assert_eq!(text_of(&doc, 3, b"Hidden").as_deref(), Some("yes"), "the replacement reached another clone");
+    let mut doc = Document::open(file.clone()).unwrap();
+    assert_eq!(text_of(&doc, 3, b"Hidden").as_deref(), Some("yes"));
+    doc.set(ObjRef::new(4, 0), replacement());
+    assert_eq!(text_of(&doc, 3, b"Hidden").as_deref(), Some("no"), "the document's own read before the edit");
+    let doc = Document::open(file).unwrap();
+    assert_eq!(text_of(&doc, 3, b"Hidden").as_deref(), Some("yes"));
+    let mut freed = doc.clone();
+    freed.free(ObjRef::new(4, 0));
+    assert_eq!(freed.try_get(3), Err(CosError::MissingObject(4)), "another clone's read before the free");
+}
+
+/// An object stream another clone framed by the file's indirect `/Length` is not what a clone
+/// that edited that length reads.
+#[test]
+fn an_edited_object_stream_length_hides_the_members_read_before() {
+    let file = Arc::new(object_stream_file_with("3 0 ", "<< /Hidden (cut endstream here) >>", 0, true));
+    let doc = Document::open(file).unwrap();
+    assert_eq!(text_of(&doc, 3, b"Hidden").as_deref(), Some("cut endstream here"));
+    let mut edited = doc.clone();
+    edited.set(ObjRef::new(6, 0), Object::Int("3 0 << /Hidden (cut".len() as i64));
+    assert_ne!(text_of(&edited, 3, b"Hidden").as_deref(), Some("cut endstream here"), "another clone's framing of the stream");
+    assert_eq!(text_of(&doc, 3, b"Hidden").as_deref(), Some("cut endstream here"), "the edited length reached another clone");
+}
+
+/// A stream another clone read by the file's indirect `/Length` is not what a clone that edited
+/// that length reads.
+#[test]
+fn an_edited_stream_length_hides_the_stream_read_before() {
+    let bodies = [
+        "<< /Type /Catalog /Pages 2 0 R >>",
+        "<< /Type /Pages /Kids [] /Count 0 >>",
+        "<< /Length 4 0 R >>\nstream\nshort\nendstream long\nendstream",
+        "20",
+    ];
+    let mut out = b"%PDF-1.4\n".to_vec();
+    let mut table = String::from("xref\n0 5\n0000000000 65535 f \n");
+    for (n, body) in bodies.iter().enumerate() {
+        table.push_str(&format!("{:010} 00000 n \n", out.len()));
+        out.extend_from_slice(format!("{} 0 obj\n{body}\nendobj\n", n + 1).as_bytes());
+    }
+    let start = out.len();
+    out.extend_from_slice(format!("{table}trailer\n<< /Size 5 /Root 1 0 R >>\nstartxref\n{start}\n%%EOF\n").as_bytes());
+    let data = |doc: &Document| match &*doc.get(ObjRef::new(3, 0)) {
+        Object::Stream(s) => s.raw.to_vec(),
+        other => panic!("{other:?}"),
+    };
+    let doc = Document::open(Arc::new(out)).unwrap();
+    assert_eq!(data(&doc), b"short\nendstream long");
+    let mut edited = doc.clone();
+    edited.set(ObjRef::new(4, 0), Object::Int(5));
+    assert_eq!(data(&edited), b"short", "another clone's read by the file's length");
+    assert_eq!(data(&doc), b"short\nendstream long", "the edited length reached another clone");
+}
+
+/// A file whose object 3 sits in an object stream PNG-predicted by `/DecodeParms 6 1 R`, a
+/// generation the file doesn't have, and the parameters that make it decode.
+fn predicted_object_stream() -> (Vec<u8>, Dict) {
+    let members = b"3 0 << /Hidden (yes) >>";
+    // PNG Sub, one row.
+    let mut rows = vec![1u8];
+    let mut before = 0u8;
+    for b in members {
+        rows.push(b.wrapping_sub(before));
+        before = *b;
+    }
+    let coded = pdfcraft_filters::encode_flate(&rows);
+    let mut out = b"%PDF-1.5\n".to_vec();
+    let mut offs = [0usize; 7];
+    let mut obj = |out: &mut Vec<u8>, n: usize, body: &[u8]| {
+        offs[n] = out.len();
+        out.extend_from_slice(format!("{n} 0 obj\n").as_bytes());
+        out.extend_from_slice(body);
+        out.extend_from_slice(b"\nendobj\n");
+    };
+    obj(&mut out, 1, b"<< /Type /Catalog /Pages 2 0 R >>");
+    obj(&mut out, 2, b"<< /Type /Pages /Kids [] /Count 0 /Extra 3 0 R >>");
+    let mut stm = format!("<< /Type /ObjStm /N 1 /First 4 /Filter /FlateDecode /DecodeParms 6 1 R /Length {} >>\nstream\n", coded.len()).into_bytes();
+    stm.extend_from_slice(&coded);
+    stm.extend_from_slice(b"\nendstream");
+    obj(&mut out, 4, &stm);
+    let data = [2u8, 0, 4, 0];
+    let mut xs = format!("<< /Type /XRef /Size 7 /W [1 2 1] /Index [3 1] /Length {} >>\nstream\n", data.len()).into_bytes();
+    xs.extend_from_slice(&data);
+    xs.extend_from_slice(b"\nendstream");
+    obj(&mut out, 5, &xs);
+    obj(&mut out, 6, b"null");
+    let table = out.len();
+    out.extend_from_slice(b"xref\n0 7\n0000000000 65535 f \n");
+    for (n, off) in offs.iter().enumerate().skip(1) {
+        let line = if n == 3 { "0000000000 65535 f \n".to_string() } else { format!("{off:010} 00000 n \n") };
+        out.extend_from_slice(line.as_bytes());
+    }
+    out.extend_from_slice(format!("trailer << /Size 7 /Root 1 0 R /XRefStm {} >>\nstartxref\n{table}\n%%EOF\n", offs[5]).as_bytes());
+    let mut parms = Dict::new();
+    parms.set(b"Predictor".to_vec(), Object::Int(11));
+    parms.set(b"Columns".to_vec(), Object::Int(members.len() as i64));
+    (out, parms)
+}
+
+fn hidden(doc: &Document) -> Option<Vec<u8>> {
+    doc.get(ObjRef::new(3, 0)).as_dict().and_then(|d| d.get(b"Hidden")).and_then(Object::as_string).map(|s| s.bytes.clone())
+}
+
+/// An object stream whose `/DecodeParms` names a generation the file doesn't have decodes without
+/// them; a clone that sets that generation decodes with them, not by the stream another clone read.
+#[test]
+fn parameters_an_edit_makes_match_hide_the_object_stream_read_before() {
+    let (file, parms) = predicted_object_stream();
+    let doc = Document::open(Arc::new(file)).unwrap();
+    assert_eq!(hidden(&doc), None, "no object 6 1: no predictor undone");
+    let mut edited = doc.clone();
+    edited.set(ObjRef::new(6, 1), Object::Dict(parms));
+    assert_eq!(hidden(&edited), Some(b"yes".to_vec()), "another clone's stream, decoded without them");
+}
+
+/// The other way round: an object stream a clone decoded by its edited parameters stays that
+/// clone's, so the document it was cloned from still decodes by the file's.
+#[test]
+fn an_object_stream_decoded_by_edited_parameters_is_not_shared() {
+    let (file, parms) = predicted_object_stream();
+    let doc = Document::open(Arc::new(file)).unwrap();
+    let mut edited = doc.clone();
+    edited.set(ObjRef::new(6, 1), Object::Dict(parms));
+    assert_eq!(hidden(&edited), Some(b"yes".to_vec()));
+    assert_eq!(hidden(&doc), None, "the clone's decoding, read from the shared streams");
+}
+
+/// What a load read is kept only up to a bound; past it the load counts as having read every
+/// object, so a document with any edit reads it again.
+#[test]
+fn a_load_that_read_too_much_counts_as_reading_everything() {
+    use super::state::{ReadFrame, note_read};
+    let mut overlay = BTreeMap::new();
+    overlay.insert(999_999, Slot::Freed(1));
+    let frame = ReadFrame::enter();
+    for n in 0..8 {
+        note_read(n, None);
+    }
+    assert!(!frame.reads().touch(&overlay), "a few reads, none edited");
+    assert!(!frame.reads().touch(&BTreeMap::new()), "nothing is edited");
+    for n in 8..100 {
+        note_read(n, None);
+    }
+    assert!(frame.reads().touch(&overlay), "more objects than an entry keeps");
+    drop(frame);
+    let outer = ReadFrame::enter();
+    let inner = ReadFrame::enter();
+    for n in 0..5_000 {
+        note_read(n % 4, None);
+    }
+    assert!(inner.reads().touch(&overlay), "more reads than the thread keeps");
+    drop(inner);
+    assert!(outer.reads().touch(&overlay), "an outer frame missed them too");
+}
+
 /// A member that failed to load from the file's object stream is kept as a failure, but replacing
 /// or freeing that stream forgets it: the member then reads from the edit.
 #[test]
@@ -1500,7 +1673,7 @@ fn temporary_reader_keeps_file_views_and_evicts_data_of_its_own() {
     // cleared after the next read, including a failed one.
     let owned = Object::Stream(crate::Stream::from_raw(Dict::new(), vec![b'y'; ObjectReader::STREAM_BYTES + 1]));
     let size = held_bytes(&owned, &reader.document.data, 0);
-    reader.document.cache.lock().unwrap().insert(3, Ok(Arc::new(owned)), size);
+    reader.document.cache.lock().unwrap().insert(3, Ok(Arc::new(owned)), size, Default::default());
     assert_eq!(*reader.get(ObjRef::new(99, 0)), Object::Null);
     assert!(reader.document.cache.lock().unwrap().is_empty(), "owned data over budget is evicted");
 }
@@ -2085,6 +2258,176 @@ fn a_decompression_bomb_in_an_xref_stream_is_refused_and_the_file_reconstructed(
     assert!(doc.repair_log().iter().any(|l| l.contains("limit")), "{:?}", doc.repair_log());
 }
 
+/// A chain of cross-reference streams whose sections each stay well under the per-section
+/// limit but together list more than 8,388,607 rows (#5082). Too many rows for the compact
+/// reader, the chain was merged whole; it is now refused and the file rebuilt from object
+/// headers. The bulk rows are set aside (in use at offset 0), so the test holds a few bytes a row.
+#[test]
+fn a_cross_reference_chain_past_the_total_cap_is_refused_and_the_file_reconstructed() {
+    const BULK: usize = 4_200_000;
+    let mut bytes = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for body in
+        ["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [3 0 R] /Count 1 >>", "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] >>"]
+    {
+        offsets.push(bytes.len());
+        bytes.extend_from_slice(format!("{} 0 obj\n{body}\nendobj\n", offsets.len()).as_bytes());
+    }
+    // Objects 4 and 5: /W [1 0 0] rows of type 1 at offset 0, each a set-aside entry.
+    let bulk = pdfcraft_filters::encode_flate(&vec![1u8; BULK]);
+    let size = 16 + 2 * BULK;
+    let mut prev = None;
+    for (num, start) in [(4, 16 + BULK), (5, 16)] {
+        offsets.push(bytes.len());
+        let prev_key = prev.map(|p| format!(" /Prev {p}")).unwrap_or_default();
+        bytes.extend_from_slice(
+            format!(
+                "{num} 0 obj\n<< /Type /XRef /Size {size} /W [1 0 0] /Index [{start} {BULK}]{prev_key} /Filter /FlateDecode /Length {} >>\nstream\n",
+                bulk.len()
+            )
+            .as_bytes(),
+        );
+        bytes.extend_from_slice(&bulk);
+        bytes.extend_from_slice(b"\nendstream\nendobj\n");
+        prev = offsets.last().copied();
+    }
+    // Object 6, the newest section: objects 0 to 6 at their offsets.
+    let x = bytes.len();
+    offsets.push(x);
+    let mut rows = vec![0u8, 0, 0, 0, 0, 255];
+    for o in &offsets {
+        rows.push(1);
+        rows.extend_from_slice(&u32::try_from(*o).unwrap().to_be_bytes());
+        rows.push(0);
+    }
+    bytes.extend_from_slice(
+        format!("6 0 obj\n<< /Type /XRef /Size {size} /Root 1 0 R /W [1 4 1] /Index [0 7] /Prev {} /Length {} >>\nstream\n", offsets[4], rows.len())
+            .as_bytes(),
+    );
+    bytes.extend_from_slice(&rows);
+    bytes.extend_from_slice(format!("\nendstream\nendobj\nstartxref\n{x}\n%%EOF\n").as_bytes());
+
+    let doc = Document::open(Arc::new(bytes)).unwrap();
+    let log = doc.repair_log();
+    assert!(
+        log.iter().any(|l| l.contains("cross-reference chain lists more than 8388607 entries") && l.contains("rebuilding from object headers")),
+        "{log:?}"
+    );
+    assert!(log.iter().any(|l| l.starts_with("rebuilt cross-reference index")), "{log:?}");
+    assert!(doc.revisions().is_empty());
+    assert_eq!(doc.root(), Some(ObjRef::new(1, 0)));
+    let page = doc.try_get(3).unwrap();
+    assert_eq!(page.as_dict().and_then(|d| d.name(b"Type")), Some(&b"Page"[..]));
+    // The chain read itself is refused at the second bulk section, which each decode within its own limit.
+    let Err(CosError::Syntax { offset, detail }) = doc.read_xref_chain_materialized(&mut Vec::new()) else { panic!("the chain must be refused") };
+    assert_eq!(offset, offsets[3]);
+    assert!(detail.contains("more than 8388607 entries"), "{detail}");
+}
+
+/// Three classic tables listing 2, 1 and 1 rows, newest first: objects 1 and 2, then object 3
+/// (or object 1 again when `overlap`), then object 4.
+fn three_table_chain(overlap: bool) -> (Vec<u8>, usize) {
+    let mut bytes = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (num, body) in
+        ["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [] /Count 0 >>", "<< /Value 3 >>", "<< /Value 4 >>"].iter().enumerate()
+    {
+        offsets.push(bytes.len());
+        bytes.extend_from_slice(format!("{} 0 obj\n{body}\nendobj\n", num + 1).as_bytes());
+    }
+    let older = bytes.len();
+    bytes.extend_from_slice(format!("xref\n4 1\n{:010} 00000 n \ntrailer << /Size 5 /Root 1 0 R >>\n", offsets[3]).as_bytes());
+    let middle = bytes.len();
+    let middle_num = if overlap { 1 } else { 3 };
+    bytes.extend_from_slice(
+        format!("xref\n{middle_num} 1\n{:010} 00000 n \ntrailer << /Size 5 /Root 1 0 R /Prev {older} >>\n", offsets[middle_num - 1]).as_bytes(),
+    );
+    let newer = bytes.len();
+    bytes.extend_from_slice(
+        format!(
+            "xref\n1 1\n{:010} 00000 n \n2 1\n{:010} 00000 n \ntrailer << /Size 5 /Root 1 0 R /Prev {middle} >>\nstartxref\n{newer}\n%%EOF\n",
+            offsets[0], offsets[1],
+        )
+        .as_bytes(),
+    );
+    (bytes, older)
+}
+
+/// The chain's row limit counts every row merged (#5082): four rows over three sections pass a
+/// limit of 4 and are refused at the oldest section by a limit of 3, both when the sections
+/// list different objects and when one relists an object a newer section has (a map of three
+/// entries, but four rows merged).
+#[test]
+fn the_chain_row_limit_counts_disjoint_and_relisted_rows() {
+    for overlap in [false, true] {
+        let (bytes, older) = three_table_chain(overlap);
+        let doc = Document::open(Arc::new(bytes)).unwrap();
+        let (entries, ..) = doc.read_xref_chain_materialized_with_limit(&mut Vec::new(), 4).unwrap();
+        assert_eq!(entries.len(), if overlap { 3 } else { 4 });
+        let Err(CosError::Syntax { offset, detail }) = doc.read_xref_chain_materialized_with_limit(&mut Vec::new(), 3) else {
+            panic!("four rows must be refused by a limit of 3 (overlap: {overlap})")
+        };
+        assert_eq!(offset, older);
+        assert!(detail.contains("more than 3 entries"), "{detail}");
+    }
+}
+
+/// Rows set aside count against the chain's row limit (#5082): a hybrid file whose table puts
+/// object 3 at an offset while its /XRefStm puts it in an object stream merges six rows and sets
+/// one aside, so a limit of 7 passes and a limit of 6 refuses it.
+#[test]
+fn the_chain_row_limit_counts_hybrid_rows_set_aside() {
+    let mut bytes = object_stream_file("3 0 ", "<< /Hidden (yes) >>", 0);
+    // Object 3's row in the table (`xref\n0 6\n`, 20-byte rows): free, now in use at offset 9.
+    let row = find(&bytes, b"xref\n0 6\n", 0, bytes.len()).unwrap() + 9 + 3 * 20;
+    assert_eq!(&bytes[row..row + 20], b"0000000000 65535 f \n");
+    bytes[row..row + 20].copy_from_slice(b"0000000009 00000 n \n");
+    let doc = Document::open(Arc::new(bytes)).unwrap();
+    let (entries, _, _, oddities, _) = doc.read_xref_chain_materialized_with_limit(&mut Vec::new(), 7).unwrap();
+    assert_eq!(entries.len(), 6);
+    assert_eq!(oddities.iter().map(|(_, num)| *num).collect::<Vec<_>>(), vec![3]);
+    let Err(CosError::Syntax { detail, .. }) = doc.read_xref_chain_materialized_with_limit(&mut Vec::new(), 6) else {
+        panic!("six rows and one set aside must be refused by a limit of 6")
+    };
+    assert!(detail.contains("more than 6 entries"), "{detail}");
+}
+
+/// A cross-reference stream whose `/Index [0 4 0 4]` lists objects 0 to 3 twice, the same rows
+/// both times: eight rows read, four entries (#5082). The chain's row limit counts the rows
+/// read, before deduplication, so a limit of 8 passes and a limit of 7 refuses it.
+#[test]
+fn the_chain_row_limit_counts_rows_an_xref_stream_index_repeats() {
+    let mut bytes = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for body in ["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [] /Count 0 >>"] {
+        offsets.push(bytes.len());
+        bytes.extend_from_slice(format!("{} 0 obj\n{body}\nendobj\n", offsets.len()).as_bytes());
+    }
+    let x = bytes.len();
+    offsets.push(x);
+    let mut once = vec![0u8, 0, 0, 0, 0, 255];
+    for o in &offsets {
+        once.push(1);
+        once.extend_from_slice(&u32::try_from(*o).unwrap().to_be_bytes());
+        once.push(0);
+    }
+    let rows = [once.clone(), once].concat();
+    bytes.extend_from_slice(
+        format!("3 0 obj\n<< /Type /XRef /Size 4 /Root 1 0 R /W [1 4 1] /Index [0 4 0 4] /Length {} >>\nstream\n", rows.len()).as_bytes(),
+    );
+    bytes.extend_from_slice(&rows);
+    bytes.extend_from_slice(format!("\nendstream\nendobj\nstartxref\n{x}\n%%EOF\n").as_bytes());
+    let doc = Document::open(Arc::new(bytes)).unwrap();
+    let (entries, _, _, oddities, _) = doc.read_xref_chain_materialized_with_limit(&mut Vec::new(), 8).unwrap();
+    assert_eq!(entries.len(), 4);
+    assert!(oddities.is_empty(), "{oddities:?}");
+    let Err(CosError::Syntax { offset, detail }) = doc.read_xref_chain_materialized_with_limit(&mut Vec::new(), 7) else {
+        panic!("eight rows listing four objects must be refused by a limit of 7")
+    };
+    assert_eq!(offset, x);
+    assert!(detail.contains("more than 7 entries"), "{detail}");
+}
+
 #[test]
 fn a_stream_whose_length_is_itself_and_never_ends_loads_quickly() {
     // From the nightly fuzz job: `6 0 obj << /Length 6 0 R >> stream` with no `endstream`
@@ -2238,10 +2581,10 @@ fn the_object_cache_keeps_its_total_as_objects_come_and_go() {
     let two = Arc::new(Object::Array(vec![Object::Int(1); 10]));
     let (a, b) = (held_bytes(&one, &data, 0), held_bytes(&two, &data, 0));
     let mut cache = super::state::ObjectCache::default();
-    cache.insert(1, Ok(one.clone()), a);
-    cache.insert(2, Ok(two), b);
+    cache.insert(1, Ok(one.clone()), a, Default::default());
+    cache.insert(2, Ok(two), b, Default::default());
     assert_eq!(cache.owned(), a + b);
-    cache.insert(2, Ok(one), a);
+    cache.insert(2, Ok(one), a, Default::default());
     assert_eq!(cache.owned(), a + a, "a replaced object no longer counts");
     cache.retain(|n| *n == 1);
     assert_eq!((cache.len(), cache.owned()), (1, a));
diff --git a/crates/cos/src/object.rs b/crates/cos/src/object.rs
index f2c9760c12..5d121dc41e 100644
--- a/crates/cos/src/object.rs
+++ b/crates/cos/src/object.rs
@@ -746,6 +746,13 @@ mod tests {
         }
     }
 
+    #[test]
+    fn strict_decoding_is_bounded_by_the_callers_remaining_allowance() {
+        let stream = Stream::flate(Dict::new(), &vec![0u8; 1 << 20]);
+        assert!(matches!(stream.decoded_strict_within(1000), Err(CosError::Filter(_))));
+        assert_eq!(stream.decoded_strict_within(1 << 20).map(|v| v.len()).ok(), Some(1 << 20));
+    }
+
     #[test]
     fn empty_filter_arrays_refuse_decoding_past_a_caller_limit() {
         let mut dict = Dict::new();
diff --git a/crates/create/Cargo.toml b/crates/create/Cargo.toml
index 51eca668d0..79c7a4f276 100644
--- a/crates/create/Cargo.toml
+++ b/crates/create/Cargo.toml
@@ -24,6 +24,11 @@ thiserror = { workspace = true }
 # Already in the graph through lopdf; used only to read plain-text files (decode_text).
 encoding_rs = "0.8"
 
+[target.'cfg(unix)'.dependencies]
+# Already in the graph (pdfcraft-platform, ui-egui); stops a timed-out LibreOffice's whole process
+# group, soffice.bin included, without unsafe code.
+rustix = { version = "1", features = ["process"] }
+
 [dev-dependencies]
 # An independent CCITT decoder, to check Create PDF's Group 4 images.
 hayro-ccitt.workspace = true
diff --git a/crates/create/README.md b/crates/create/README.md
index 95d47d27a9..4c9d1a8823 100644
--- a/crates/create/README.md
+++ b/crates/create/README.md
@@ -28,6 +28,30 @@ Layer L4. Create a PDF (Acrobat's Create a PDF tool), execution plan M10.2:
 
 Every function returns a `pdfcraft_cos::Document`; the caller writes it.
 
+Office documents (`office.rs`) are the exception: PdfCraft doesn't read Word, Excel, PowerPoint,
+OpenDocument or RTF itself. `is_office(name, bytes)` recognises them (an `OFFICE_EXTENSIONS`
+name and an OLE, ZIP or RTF signature; `source_kind` reports `SourceKind::Office`), and
+`office_to_pdf(name, bytes)` returns PDF bytes made by an installed LibreOffice, run headless as
+a separate process: a private temporary folder (owner-only on Unix; the document is always
+`document.<ext>` there, never its own name), a fresh profile with macros disabled, untrusted
+links blocked and Writer and Calc set never to update linked content (sections, files, external
+data) on load, no console window on Windows, and a stop after `TIMEOUT` (120 s) or as soon as the
+output grows past 512 MB (the whole process tree is stopped, not only `soffice`). LibreOffice is
+found through `PDFCRAFT_SOFFICE`, the `PATH`, then the usual install folders (`libreoffice()`).
+A snap-installed LibreOffice is not among those folders: its private `/tmp` cannot see the work
+folder. Where `/snap/bin` is on the `PATH` it can still be found there, so point
+`PDFCRAFT_SOFFICE` at a non-snap install if conversions fail. It takes seconds, so callers keep it
+off the frame thread. On the web it returns an error.
+
+Impress has no setting for linked content, and the profile settings are LibreOffice's own:
+PdfCraft doesn't sandbox the process's network access. Converting test documents whose linked
+sections, pictures and external cell references point at a local listener made no connection,
+with or without the Writer and Calc settings (LibreOffice 26.8.1, Windows, 2026-10-26), so the settings are a
+second line of defence rather than a measured fix.
+
+`IMAGE_EXTENSIONS`, `TEXT_EXTENSIONS` and `OFFICE_EXTENSIONS` are what the app's file pickers
+offer, so detection and pickers agree.
+
 Image export and Save Image As apply each lossless image's Decode pair before converting its color components.
 JBIG2 images and masks are decoded through `pdfcraft_cos::ImageBudget` (`pdfcraft_filters::decode_jbig2_within`), behind
 other filters too, with the `/JBIG2Globals` of their own `/DecodeParms` entry, as `JBIG2Decode` gives them: black as 0. An image
diff --git a/crates/create/src/lib.rs b/crates/create/src/lib.rs
index 389173d848..d6c2208a83 100644
--- a/crates/create/src/lib.rs
+++ b/crates/create/src/lib.rs
@@ -1,4 +1,4 @@
-//! pdfcraft-create — create PDFs from nothing, images or text (L4). See the README.
+//! pdfcraft-create — create PDFs from nothing, images, text or (through LibreOffice) Office documents (L4). See the README.
 
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
@@ -8,6 +8,10 @@ mod extract;
 mod text_font;
 mod upright_image;
 pub use extract::{ExtractedImage, ImageExport, extract_images, image_file, image_file_within};
+mod office;
+#[cfg(not(target_arch = "wasm32"))]
+pub use office::libreoffice;
+pub use office::{OFFICE_EXTENSIONS, is_office, office_to_pdf};
 use pdfcraft_fonts::wrap_with;
 use text_font::TextFont;
 
@@ -17,6 +21,9 @@ pub enum CreateError {
     Image(String, String),
     #[error("{0}")]
     Invalid(String),
+    /// An Office document LibreOffice couldn't convert, or LibreOffice isn't installed.
+    #[error("{0}")]
+    Office(String),
 }
 
 /// US Letter in points.
@@ -757,9 +764,18 @@ pub enum SourceKind {
     Pdf,
     Image,
     Text,
+    /// A Word, Excel, PowerPoint or OpenDocument file, converted through LibreOffice.
+    Office,
 }
 
-/// File extensions Create converts to PDF (images and plain text).
+/// File extensions of the images Create converts to PDF.
+pub const IMAGE_EXTENSIONS: [&str; 11] = ["png", "jpg", "jpeg", "tif", "tiff", "gif", "bmp", "jp2", "j2k", "jpx", "pcx"];
+
+/// File extensions of the plain-text files Create converts to PDF.
+pub const TEXT_EXTENSIONS: [&str; 2] = ["txt", "text"];
+
+/// File extensions Create converts to PDF itself: [`IMAGE_EXTENSIONS`] and [`TEXT_EXTENSIONS`]
+/// (Office documents go through LibreOffice, [`OFFICE_EXTENSIONS`]).
 pub const CONVERTIBLE: [&str; 13] = ["png", "jpg", "jpeg", "tif", "tiff", "gif", "bmp", "jp2", "j2k", "jpx", "pcx", "txt", "text"];
 
 /// A PCX file: its manufacturer byte, a version (1 was never used), run-length coding and 1 or 8
@@ -792,8 +808,8 @@ fn is_image(bytes: &[u8]) -> bool {
             && bytes.get(14..18).and_then(|h| <[u8; 4]>::try_from(h).ok()).is_some_and(|h| matches!(u32::from_le_bytes(h), 12 | 40 | 52 | 56 | 108 | 124)))
 }
 
-/// Whether `bytes` named `name` is a PDF, an image Create can embed, or plain text (a `.txt` or
-/// `.text` file). `None` for anything else.
+/// Whether `bytes` named `name` is a PDF, an image Create can embed, plain text (a `.txt` or
+/// `.text` file) or an Office document ([`is_office`]). `None` for anything else.
 pub fn source_kind(name: &str, bytes: &[u8]) -> Option<SourceKind> {
     let head = bytes.get(..bytes.len().min(1024)).unwrap_or_default();
     if head.windows(5).any(|w| w == b"%PDF-") {
@@ -802,6 +818,9 @@ pub fn source_kind(name: &str, bytes: &[u8]) -> Option<SourceKind> {
     if is_image(bytes) {
         return Some(SourceKind::Image);
     }
+    if is_office(name, bytes) {
+        return Some(SourceKind::Office);
+    }
     let lower = name.to_ascii_lowercase();
     (lower.ends_with(".txt") || lower.ends_with(".text")).then_some(SourceKind::Text)
 }
diff --git a/crates/create/src/office.rs b/crates/create/src/office.rs
new file mode 100644
index 0000000000..3d8332c149
--- /dev/null
+++ b/crates/create/src/office.rs
@@ -0,0 +1,599 @@
+//! Office documents (Word, Excel, PowerPoint, OpenDocument, RTF) to PDF through an installed
+//! LibreOffice, run as a separate process: the "LibreOffice sidecar" of
+//! `docs/file-format-parity.md`. PdfCraft never parses these formats itself.
+//!
+//! Detection ([`is_office`]) is pure and works everywhere. Conversion ([`office_to_pdf`]) runs
+//! only on desktop builds: each run gets its own temporary folder and a fresh LibreOffice
+//! profile with macros and untrusted links turned off, and is stopped after [`TIMEOUT`].
+
+use crate::CreateError;
+
+/// File extensions of the Office documents converted through LibreOffice.
+pub const OFFICE_EXTENSIONS: &[&str] = &[
+    // Word and Writer
+    "doc", "docx", "docm", "dot", "dotx", "dotm", "odt", "ott", "rtf", //
+    // Excel and Calc
+    "xls", "xlsx", "xlsm", "xlt", "xltx", "xltm", "ods", "ots", //
+    // PowerPoint and Impress
+    "ppt", "pptx", "pptm", "pot", "potx", "potm", "pps", "ppsx", "ppsm", "odp", "otp",
+];
+
+/// The OLE compound-file signature of Office 97–2003 files (`.doc`, `.xls`, `.ppt`).
+const OLE: &[u8] = &[0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1];
+
+/// The longest a conversion may run before LibreOffice is stopped. A fresh profile costs a
+/// few seconds on its own; large spreadsheets take longer.
+#[cfg_attr(target_arch = "wasm32", allow(dead_code))]
+pub const TIMEOUT: std::time::Duration = std::time::Duration::from_secs(120);
+
+/// The largest PDF read back from LibreOffice.
+#[cfg_attr(target_arch = "wasm32", allow(dead_code))]
+const MAX_PDF: u64 = 512 * 1024 * 1024;
+
+/// `name`'s extension as it appears in [`OFFICE_EXTENSIONS`], if it is one.
+fn office_extension(name: &str) -> Option<&'static str> {
+    let (_, ext) = name.rsplit_once('.')?;
+    OFFICE_EXTENSIONS.iter().copied().find(|e| ext.eq_ignore_ascii_case(e))
+}
+
+/// Whether `bytes` named `name` is an Office document: an Office extension, and the bytes start
+/// like one (an OLE compound file, a ZIP package as OOXML and OpenDocument are, or RTF).
+pub fn is_office(name: &str, bytes: &[u8]) -> bool {
+    office_extension(name).is_some() && (bytes.starts_with(OLE) || bytes.starts_with(b"PK\x03\x04") || bytes.starts_with(b"{\\rtf"))
+}
+
+/// Convert the Office document `bytes` named `name` to PDF bytes with LibreOffice.
+#[cfg(target_arch = "wasm32")]
+pub fn office_to_pdf(name: &str, _bytes: &[u8]) -> Result<Vec<u8>, CreateError> {
+    Err(CreateError::Office(format!("{name}: Office documents open only in the desktop app, which converts them with LibreOffice")))
+}
+
+/// Convert the Office document `bytes` named `name` to PDF bytes with LibreOffice.
+#[cfg(not(target_arch = "wasm32"))]
+pub fn office_to_pdf(name: &str, bytes: &[u8]) -> Result<Vec<u8>, CreateError> {
+    let program = native::libreoffice().ok_or_else(|| {
+        CreateError::Office(format!(
+            "{name}: opening Word, Excel and PowerPoint files needs LibreOffice, which isn't installed (get it free from libreoffice.org)"
+        ))
+    })?;
+    native::convert_with(&program, name, bytes, TIMEOUT)
+}
+
+/// Where LibreOffice is installed, if it is: `PDFCRAFT_SOFFICE`, then the `PATH`, then the
+/// usual install folders.
+#[cfg(not(target_arch = "wasm32"))]
+pub fn libreoffice() -> Option<std::path::PathBuf> {
+    native::libreoffice()
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+mod native {
+    use super::{CreateError, MAX_PDF, office_extension};
+    use std::ffi::OsString;
+    use std::path::{Path, PathBuf};
+    use std::process::{Child, Command, ExitStatus, Stdio};
+    use std::sync::atomic::{AtomicU64, Ordering};
+    use std::time::{Duration, Instant};
+
+    /// The program names LibreOffice installs on the `PATH`.
+    #[cfg(windows)]
+    const PATH_NAMES: &[&str] = &["soffice.exe"];
+    #[cfg(not(windows))]
+    const PATH_NAMES: &[&str] = &["soffice", "libreoffice"];
+
+    pub(super) fn libreoffice() -> Option<PathBuf> {
+        let defaults = default_locations(&|key| std::env::var_os(key));
+        candidates(std::env::var_os("PDFCRAFT_SOFFICE"), std::env::var_os("PATH"), defaults).into_iter().find(|p| p.is_file())
+    }
+
+    /// Where to look, in order: the override, each `PATH` folder, then `defaults`.
+    pub(super) fn candidates(override_path: Option<OsString>, path: Option<OsString>, defaults: Vec<PathBuf>) -> Vec<PathBuf> {
+        let mut out: Vec<PathBuf> = override_path.filter(|p| !p.is_empty()).map(PathBuf::from).into_iter().collect();
+        if let Some(path) = path {
+            for dir in std::env::split_paths(&path) {
+                out.extend(PATH_NAMES.iter().map(|name| dir.join(name)));
+            }
+        }
+        out.extend(defaults);
+        out
+    }
+
+    /// The usual install locations, given a way to read environment variables.
+    #[cfg(windows)]
+    pub(super) fn default_locations(env: &dyn Fn(&str) -> Option<OsString>) -> Vec<PathBuf> {
+        ["ProgramFiles", "ProgramW6432", "ProgramFiles(x86)"]
+            .iter()
+            .filter_map(|key| env(key))
+            .map(|dir| PathBuf::from(dir).join("LibreOffice").join("program").join("soffice.exe"))
+            .collect()
+    }
+
+    /// The usual install locations, given a way to read environment variables.
+    #[cfg(target_os = "macos")]
+    pub(super) fn default_locations(env: &dyn Fn(&str) -> Option<OsString>) -> Vec<PathBuf> {
+        let app = Path::new("LibreOffice.app/Contents/MacOS/soffice");
+        let mut out = vec![Path::new("/Applications").join(app)];
+        out.extend(env("HOME").map(|home| PathBuf::from(home).join("Applications").join(app)));
+        out
+    }
+
+    /// The usual install locations, given a way to read environment variables.
+    #[cfg(not(any(windows, target_os = "macos")))]
+    pub(super) fn default_locations(_env: &dyn Fn(&str) -> Option<OsString>) -> Vec<PathBuf> {
+        [
+            "/usr/bin/soffice",
+            "/usr/bin/libreoffice",
+            "/usr/local/bin/soffice",
+            "/usr/local/bin/libreoffice",
+            "/usr/lib/libreoffice/program/soffice",
+            "/opt/libreoffice/program/soffice",
+        ]
+        .iter()
+        .map(PathBuf::from)
+        .collect()
+    }
+
+    /// The fresh profile's settings: no macros at all, no links to untrusted locations, and
+    /// linked content in Writer and Calc documents (sections, files, external data) never
+    /// updated on load, so a document can't make LibreOffice fetch from the network or a share.
+    /// The two `Link` settings number "Never" differently (Writer.xcs: 0 Always, 1 On request,
+    /// 2 Never; Calc.xcs: 0 Always, 1 Never, 2 On request). Impress has no such setting.
+    pub(super) const PROFILE_SETTINGS: &str = r#"<?xml version="1.0" encoding="UTF-8"?>
+<oor:items xmlns:oor="http://openoffice.org/2001/registry" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+<item oor:path="/org.openoffice.Office.Common/Security/Scripting"><prop oor:name="DisableMacrosExecution" oor:op="fuse"><value>true</value></prop></item>
+<item oor:path="/org.openoffice.Office.Common/Security/Scripting"><prop oor:name="MacroSecurityLevel" oor:op="fuse"><value>3</value></prop></item>
+<item oor:path="/org.openoffice.Office.Common/Security/Scripting"><prop oor:name="BlockUntrustedRefererLinks" oor:op="fuse"><value>true</value></prop></item>
+<item oor:path="/org.openoffice.Office.Writer/Content/Update"><prop oor:name="Link" oor:op="fuse"><value>2</value></prop></item>
+<item oor:path="/org.openoffice.Office.Calc/Content/Update"><prop oor:name="Link" oor:op="fuse"><value>1</value></prop></item>
+</oor:items>
+"#;
+
+    /// A private temporary folder, removed (with everything in it) when dropped.
+    pub(super) struct WorkDir(pub(super) PathBuf);
+
+    impl WorkDir {
+        pub(super) fn new() -> std::io::Result<Self> {
+            static NEXT: AtomicU64 = AtomicU64::new(0);
+            let n = NEXT.fetch_add(1, Ordering::Relaxed);
+            let nanos = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map_or(0, |d| d.subsec_nanos());
+            let dir = std::env::temp_dir().join(format!("pdfcraft-office-{}-{n}-{nanos}", std::process::id()));
+            // Not recursive: a folder that already exists is not ours. Owner-only on Unix, where the
+            // temporary folder is shared: the document and its PDF are not for other users.
+            #[cfg_attr(not(unix), allow(unused_mut))]
+            let mut builder = std::fs::DirBuilder::new();
+            #[cfg(unix)]
+            {
+                use std::os::unix::fs::DirBuilderExt;
+                builder.mode(0o700);
+            }
+            builder.create(&dir)?;
+            Ok(Self(dir))
+        }
+    }
+
+    impl Drop for WorkDir {
+        fn drop(&mut self) {
+            let _ = std::fs::remove_dir_all(&self.0);
+        }
+    }
+
+    /// `path` as a `file://` URL, which `-env:UserInstallation` takes.
+    pub(super) fn file_url(path: &Path) -> String {
+        let path = path.to_string_lossy().replace('\\', "/");
+        let mut url = String::from("file://");
+        // A Windows path (`C:/…`) needs the third slash a Unix path already starts with.
+        if !path.starts_with('/') {
+            url.push('/');
+        }
+        for b in path.bytes() {
+            if b.is_ascii_alphanumeric() || b"-._~/:".contains(&b) {
+                url.push(char::from(b));
+            } else {
+                url.push_str(&format!("%{b:02X}"));
+            }
+        }
+        url
+    }
+
+    pub(super) enum Run {
+        Exited(ExitStatus),
+        TimedOut,
+        /// The watched folder grew past its limit while the command ran.
+        TooLarge,
+    }
+
+    /// The bytes in the files directly inside `dir` (LibreOffice writes its one output there).
+    /// Anything unreadable counts as nothing, and the sum saturates. Each size is read from the
+    /// file itself: on Windows a directory listing keeps the old size while a process still
+    /// has the file open for writing.
+    pub(super) fn folder_size(dir: &Path) -> u64 {
+        let Ok(entries) = std::fs::read_dir(dir) else { return 0 };
+        entries
+            .flatten()
+            .filter_map(|entry| std::fs::symlink_metadata(entry.path()).ok())
+            .filter(|meta| meta.is_file())
+            .fold(0u64, |sum, meta| sum.saturating_add(meta.len()))
+    }
+
+    /// Run `command` to completion, killing it and every process it started once `timeout`
+    /// passes, or once the files in `watch`'s folder add up to more than its limit (so a
+    /// document that converts to an enormous PDF can't fill the disk before it is checked).
+    /// `soffice` hands the conversion to its own child, `soffice.bin`, which would
+    /// otherwise outlive the kill, holding the profile folder and its memory.
+    pub(super) fn run_limited(mut command: Command, timeout: Duration, watch: Option<(&Path, u64)>) -> std::io::Result<Run> {
+        #[cfg(unix)]
+        {
+            use std::os::unix::process::CommandExt;
+            // Its own process group, so the whole group can be stopped together.
+            command.process_group(0);
+        }
+        let mut child = command.spawn()?;
+        let start = Instant::now();
+        loop {
+            match child.try_wait() {
+                Ok(Some(status)) => return Ok(Run::Exited(status)),
+                Ok(None) => {}
+                Err(error) => {
+                    kill_tree(&mut child);
+                    return Err(error);
+                }
+            }
+            if watch.is_some_and(|(dir, limit)| folder_size(dir) > limit) {
+                kill_tree(&mut child);
+                return Ok(Run::TooLarge);
+            }
+            if start.elapsed() >= timeout {
+                kill_tree(&mut child);
+                return Ok(Run::TimedOut);
+            }
+            std::thread::sleep(Duration::from_millis(50));
+        }
+    }
+
+    /// Kill `child` and every process it started, then reap it.
+    fn kill_tree(child: &mut Child) {
+        #[cfg(unix)]
+        {
+            use rustix::process::{Pid, Signal, kill_process_group};
+            // The group `process_group(0)` made has the child's id.
+            if let Some(group) = i32::try_from(child.id()).ok().and_then(Pid::from_raw) {
+                let _ = kill_process_group(group, Signal::KILL);
+            }
+        }
+        #[cfg(windows)]
+        {
+            use std::os::windows::process::CommandExt;
+            // `/T` walks the tree from the child's id, so it runs while the child is still alive.
+            // Windows' own copy, not whatever `taskkill` the PATH finds first.
+            let taskkill = std::env::var_os("SystemRoot")
+                .map_or_else(|| PathBuf::from("taskkill.exe"), |root| PathBuf::from(root).join("System32").join("taskkill.exe"));
+            let _ = Command::new(taskkill)
+                .args(["/T", "/F", "/PID", &child.id().to_string()])
+                .stdin(Stdio::null())
+                .stdout(Stdio::null())
+                .stderr(Stdio::null())
+                // CREATE_NO_WINDOW, as for LibreOffice itself.
+                .creation_flags(0x0800_0000)
+                .status();
+        }
+        // The child itself, if the tree kill couldn't reach it.
+        let _ = child.kill();
+        let _ = child.wait();
+    }
+
+    /// Convert with the LibreOffice at `program`, giving up after `timeout`.
+    pub(super) fn convert_with(program: &Path, name: &str, bytes: &[u8], timeout: Duration) -> Result<Vec<u8>, CreateError> {
+        convert_capped(program, name, bytes, timeout, MAX_PDF)
+    }
+
+    /// [`convert_with`] with the converted PDF's size limit given: the output folder is watched
+    /// while LibreOffice runs, and the finished file is checked again.
+    pub(super) fn convert_capped(program: &Path, name: &str, bytes: &[u8], timeout: Duration, max_pdf: u64) -> Result<Vec<u8>, CreateError> {
+        let too_large = || format!("the converted PDF is larger than {} MB", max_pdf / (1024 * 1024));
+        let failed = |why: String| CreateError::Office(format!("{name}: {why}"));
+        let ext = office_extension(name).ok_or_else(|| failed("this isn't a Word, Excel or PowerPoint file".into()))?;
+        let work = WorkDir::new().map_err(|e| failed(format!("couldn't make a temporary folder: {e}")))?;
+        // A fixed input name: the document's own name never reaches LibreOffice's command line.
+        let input = work.0.join(format!("document.{ext}"));
+        let profile = work.0.join("profile");
+        let out = work.0.join("out");
+        let prepared = std::fs::write(&input, bytes)
+            .and_then(|()| std::fs::create_dir_all(profile.join("user")))
+            .and_then(|()| std::fs::write(profile.join("user").join("registrymodifications.xcu"), PROFILE_SETTINGS))
+            .and_then(|()| std::fs::create_dir(&out));
+        prepared.map_err(|e| failed(format!("couldn't prepare the conversion: {e}")))?;
+
+        let mut command = Command::new(program);
+        command
+            .arg(format!("-env:UserInstallation={}", file_url(&profile)))
+            .args(["--headless", "--invisible", "--nologo", "--norestore", "--nodefault", "--nolockcheck", "--convert-to", "pdf", "--outdir"])
+            .arg(&out)
+            .arg(&input)
+            .stdin(Stdio::null())
+            .stdout(Stdio::null())
+            .stderr(Stdio::null());
+        #[cfg(windows)]
+        {
+            use std::os::windows::process::CommandExt;
+            // CREATE_NO_WINDOW: no console window flashes up during the conversion.
+            command.creation_flags(0x0800_0000);
+        }
+        let status = match run_limited(command, timeout, Some((&out, max_pdf))) {
+            Ok(Run::Exited(status)) => status,
+            Ok(Run::TooLarge) => return Err(failed(format!("{}; LibreOffice was stopped", too_large()))),
+            Ok(Run::TimedOut) => return Err(failed(format!("LibreOffice took longer than {} seconds and was stopped", timeout.as_secs()))),
+            Err(e) => return Err(failed(format!("couldn't start LibreOffice ({}): {e}", program.display()))),
+        };
+        let pdf = out.join("document.pdf");
+        let size = match std::fs::metadata(&pdf) {
+            Ok(meta) => meta.len(),
+            Err(_) if !status.success() => return Err(failed(format!("LibreOffice couldn't convert it ({status})"))),
+            Err(_) => return Err(failed("LibreOffice didn't produce a PDF; the file may be damaged or password-protected".into())),
+        };
+        if size > max_pdf {
+            return Err(failed(too_large()));
+        }
+        let bytes = std::fs::read(&pdf).map_err(|e| failed(format!("couldn't read the converted PDF: {e}")))?;
+        if !bytes.starts_with(b"%PDF-") {
+            return Err(failed("LibreOffice's output isn't a PDF".into()));
+        }
+        Ok(bytes)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const DOCX_HEAD: &[u8] = b"PK\x03\x04\x14\x00\x06\x00";
+
+    #[test]
+    fn office_files_are_recognised_by_extension_and_signature() {
+        assert!(is_office("Report.docx", DOCX_HEAD));
+        assert!(is_office("SHEET.XLSX", DOCX_HEAD));
+        assert!(is_office("deck.odp", DOCX_HEAD));
+        assert!(is_office("old.doc", OLE));
+        assert!(is_office("old.ppt", &[OLE, b"rest"].concat()));
+        assert!(is_office("letter.rtf", b"{\\rtf1\\ansi"));
+        // Word saves RTF under .doc too.
+        assert!(is_office("letter.doc", b"{\\rtf1\\ansi"));
+    }
+
+    #[test]
+    fn other_files_are_not_office_documents() {
+        // The right signature with another extension, or an Office name with other bytes.
+        assert!(!is_office("archive.zip", DOCX_HEAD));
+        assert!(!is_office("Report.docx", b"%PDF-1.7"));
+        assert!(!is_office("Report.docx", b"plain text"));
+        assert!(!is_office("Report.docx", b""));
+        assert!(!is_office("docx", DOCX_HEAD));
+        assert!(!is_office("", DOCX_HEAD));
+        // A multi-byte name never splits a character.
+        assert!(!is_office("résumé.dócx", DOCX_HEAD));
+        assert!(is_office("résumé.docx", DOCX_HEAD));
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    mod native {
+        use super::super::native::*;
+        use super::DOCX_HEAD;
+        use std::ffi::OsString;
+        use std::path::{Path, PathBuf};
+        use std::time::Duration;
+
+        #[test]
+        fn file_urls_escape_spaces_and_keep_drive_letters() {
+            assert_eq!(file_url(Path::new("/tmp/a b/profile")), "file:///tmp/a%20b/profile");
+            assert_eq!(file_url(Path::new(r"C:\Users\Jo Ann\profile")), "file:///C:/Users/Jo%20Ann/profile");
+            assert_eq!(file_url(Path::new("/tmp/é")), "file:///tmp/%C3%A9");
+        }
+
+        #[test]
+        fn the_override_comes_first_then_the_path_then_the_defaults() {
+            let path = std::env::join_paths([Path::new("first"), Path::new("second")]).unwrap();
+            let found = candidates(Some(OsString::from("custom/soffice")), Some(path), vec![PathBuf::from("default/soffice")]);
+            assert_eq!(found.first(), Some(&PathBuf::from("custom/soffice")));
+            assert!(found.get(1).is_some_and(|p| p.starts_with("first")));
+            assert_eq!(found.last(), Some(&PathBuf::from("default/soffice")));
+            // An empty override is no override.
+            assert_eq!(candidates(Some(OsString::new()), None, Vec::new()), Vec::<PathBuf>::new());
+        }
+
+        #[test]
+        fn default_locations_read_only_the_given_environment() {
+            let found = default_locations(&|_| None);
+            assert!(found.iter().all(|p| p.is_absolute()), "{found:?}");
+        }
+
+        /// Each setting the fresh profile makes, as (path, property, value).
+        fn profile_settings() -> Vec<(&'static str, &'static str, &'static str)> {
+            let between = |s: &'static str, start: &str, end: &str| s.split_once(start).and_then(|(_, rest)| rest.split_once(end)).map(|(v, _)| v);
+            PROFILE_SETTINGS
+                .split("<item ")
+                .skip(1)
+                .filter_map(|item| {
+                    Some((between(item, "oor:path=\"", "\"")?, between(item, "oor:name=\"", "\"")?, between(item, "<value>", "</value>")?))
+                })
+                .collect()
+        }
+
+        #[test]
+        fn the_profile_turns_off_macros_and_never_updates_links() {
+            let settings = profile_settings();
+            let scripting = "/org.openoffice.Office.Common/Security/Scripting";
+            assert!(settings.contains(&(scripting, "DisableMacrosExecution", "true")), "{settings:?}");
+            assert!(settings.contains(&(scripting, "MacroSecurityLevel", "3")), "{settings:?}");
+            assert!(settings.contains(&(scripting, "BlockUntrustedRefererLinks", "true")), "{settings:?}");
+            // "Never" is 2 for Writer but 1 for Calc (Writer.xcs and Calc.xcs); Writer's 1 is
+            // its default, "On request".
+            assert!(settings.contains(&("/org.openoffice.Office.Writer/Content/Update", "Link", "2")), "{settings:?}");
+            assert!(settings.contains(&("/org.openoffice.Office.Calc/Content/Update", "Link", "1")), "{settings:?}");
+            assert_eq!(settings.len(), 5, "{settings:?}");
+        }
+
+        #[test]
+        fn a_missing_converter_is_an_error_not_a_crash() {
+            let missing = std::env::temp_dir().join("pdfcraft-no-such-soffice").join("soffice");
+            let error = convert_with(&missing, "Report.docx", DOCX_HEAD, Duration::from_secs(5)).unwrap_err();
+            assert!(error.to_string().contains("couldn't start LibreOffice"), "{error}");
+        }
+
+        #[test]
+        fn a_converter_that_makes_no_pdf_is_reported() {
+            // This test binary stands in for LibreOffice: it rejects the arguments and exits
+            // without writing anything.
+            let program = std::env::current_exe().unwrap();
+            let error = convert_with(&program, "Report.docx", DOCX_HEAD, Duration::from_secs(60)).unwrap_err();
+            assert!(error.to_string().contains("LibreOffice"), "{error}");
+        }
+
+        #[test]
+        fn a_converter_that_hangs_is_stopped() {
+            let mut command = std::process::Command::new(std::env::current_exe().unwrap());
+            command.args(["--ignored", "--exact", "office::tests::native::sleeps_for_a_minute", "--nocapture"]);
+            command.stdout(std::process::Stdio::null()).stderr(std::process::Stdio::null());
+            let started = std::time::Instant::now();
+            assert!(matches!(run_limited(command, Duration::from_millis(500), None), Ok(Run::TimedOut)));
+            assert!(started.elapsed() < Duration::from_secs(30));
+        }
+
+        /// The stand-in for a LibreOffice that never finishes (run only by the test above).
+        #[test]
+        #[ignore]
+        fn sleeps_for_a_minute() {
+            std::thread::sleep(Duration::from_secs(60));
+        }
+
+        /// Where the stand-ins below write their heartbeat.
+        const HEARTBEAT: &str = "PDFCRAFT_TEST_OFFICE_HEARTBEAT";
+
+        /// This test binary run as one of its own ignored tests, with the heartbeat file set.
+        fn stand_in(test: &str, heartbeat: &Path) -> std::process::Command {
+            let mut command = std::process::Command::new(std::env::current_exe().unwrap());
+            command.args(["--ignored", "--exact", test, "--nocapture"]).env(HEARTBEAT, heartbeat);
+            command.stdin(std::process::Stdio::null()).stdout(std::process::Stdio::null()).stderr(std::process::Stdio::null());
+            command
+        }
+
+        /// `soffice` starts `soffice.bin` as its own child: a timeout must stop both, or the
+        /// child keeps running, holding the profile folder.
+        #[test]
+        fn a_timeout_stops_the_processes_the_converter_started() {
+            let work = WorkDir::new().unwrap();
+            let heartbeat = work.0.join("heartbeat");
+            let parent = stand_in("office::tests::native::starts_a_child_that_keeps_beating", &heartbeat);
+            assert!(matches!(run_limited(parent, Duration::from_secs(5), None), Ok(Run::TimedOut)));
+            let beats = || std::fs::metadata(&heartbeat).map_or(0, |m| m.len());
+            // A killed process may take a moment to go.
+            std::thread::sleep(Duration::from_millis(300));
+            let after_kill = beats();
+            assert!(after_kill > 0, "the grandchild started and was beating before the timeout");
+            std::thread::sleep(Duration::from_secs(1));
+            assert_eq!(beats(), after_kill, "the grandchild was stopped with its parent");
+        }
+
+        /// The stand-in for `soffice`: starts [`beats_until_stopped`] and waits (run only by the
+        /// test above).
+        #[test]
+        #[ignore]
+        fn starts_a_child_that_keeps_beating() {
+            let Some(heartbeat) = std::env::var_os(HEARTBEAT) else { return };
+            let mut child = stand_in("office::tests::native::beats_until_stopped", Path::new(&heartbeat)).spawn().unwrap();
+            std::thread::sleep(Duration::from_secs(60));
+            let _ = child.kill();
+            let _ = child.wait();
+        }
+
+        /// The stand-in for `soffice.bin`: appends to the heartbeat file every 50 ms for a minute.
+        #[test]
+        #[ignore]
+        fn beats_until_stopped() {
+            use std::io::Write;
+            let Some(heartbeat) = std::env::var_os(HEARTBEAT) else { return };
+            let mut file = std::fs::OpenOptions::new().create(true).append(true).open(heartbeat).unwrap();
+            for _ in 0..1200 {
+                file.write_all(b".").unwrap();
+                std::thread::sleep(Duration::from_millis(50));
+            }
+        }
+
+        /// Where the stand-in below writes.
+        const FILL_DIR: &str = "PDFCRAFT_TEST_OFFICE_FILL_DIR";
+
+        /// A converter that writes without end is stopped as soon as its output passes the
+        /// limit, not after it has run out its time.
+        #[test]
+        fn a_converter_whose_output_grows_past_the_limit_is_stopped() {
+            let work = WorkDir::new().unwrap();
+            let mut command = std::process::Command::new(std::env::current_exe().unwrap());
+            command.args(["--ignored", "--exact", "office::tests::native::writes_without_end", "--nocapture"]).env(FILL_DIR, &work.0);
+            command.stdin(std::process::Stdio::null()).stdout(std::process::Stdio::null()).stderr(std::process::Stdio::null());
+            let limit = 256 * 1024;
+            let started = std::time::Instant::now();
+            let run = run_limited(command, Duration::from_secs(60), Some((&work.0, limit)));
+            assert!(matches!(run, Ok(Run::TooLarge)), "stopped for size, not for time");
+            assert!(started.elapsed() < Duration::from_secs(30), "stopped long before the timeout");
+            // A killed process may take a moment to go; after that nothing is written.
+            std::thread::sleep(Duration::from_millis(300));
+            let after_kill = folder_size(&work.0);
+            assert!(after_kill > limit, "the stand-in had written past the limit");
+            std::thread::sleep(Duration::from_secs(1));
+            assert_eq!(folder_size(&work.0), after_kill, "the converter was stopped");
+        }
+
+        /// The stand-in for a LibreOffice that fills the disk: 64 KiB every 10 ms for a minute
+        /// (run only by the test above).
+        #[test]
+        #[ignore]
+        fn writes_without_end() {
+            use std::io::Write;
+            let Some(dir) = std::env::var_os(FILL_DIR) else { return };
+            let mut file = std::fs::File::create(Path::new(&dir).join("document.pdf")).unwrap();
+            let chunk = vec![0u8; 64 * 1024];
+            for _ in 0..6000 {
+                file.write_all(&chunk).unwrap();
+                std::thread::sleep(Duration::from_millis(10));
+            }
+        }
+
+        #[test]
+        fn a_folder_that_cannot_be_read_counts_as_empty() {
+            assert_eq!(folder_size(&std::env::temp_dir().join("pdfcraft-no-such-folder")), 0);
+        }
+
+        /// The temporary folder holds a confidential document and its PDF: on Unix only the owner
+        /// may enter it.
+        #[cfg(unix)]
+        #[test]
+        fn the_temporary_folder_is_private_to_its_owner() {
+            use std::os::unix::fs::PermissionsExt;
+            let work = WorkDir::new().unwrap();
+            let mode = std::fs::metadata(&work.0).unwrap().permissions().mode();
+            assert_eq!(mode & 0o777, 0o700, "{mode:o}");
+        }
+
+        #[test]
+        fn temporary_folders_are_removed_with_their_contents() {
+            let work = WorkDir::new().unwrap();
+            let other = WorkDir::new().unwrap();
+            assert_ne!(work.0, other.0);
+            let dir = work.0.clone();
+            std::fs::create_dir_all(dir.join("profile").join("user")).unwrap();
+            std::fs::write(dir.join("document.docx"), DOCX_HEAD).unwrap();
+            drop(work);
+            assert!(!dir.exists());
+        }
+
+        /// A real conversion, when LibreOffice is installed (skipped otherwise).
+        #[test]
+        fn libreoffice_converts_a_document_when_installed() {
+            let Some(program) = super::super::libreoffice() else {
+                eprintln!("skipped: LibreOffice isn't installed");
+                return;
+            };
+            let rtf = b"{\\rtf1\\ansi{\\fonttbl\\f0\\fswiss Helvetica;}\\f0\\pard Hello from PdfCraft.\\par}";
+            let pdf = convert_with(&program, "hello.rtf", rtf, super::super::TIMEOUT).unwrap();
+            assert!(pdf.starts_with(b"%PDF-"));
+        }
+    }
+}
diff --git a/crates/create/src/tests.rs b/crates/create/src/tests.rs
index d2a8c143e7..f8b870832b 100644
--- a/crates/create/src/tests.rs
+++ b/crates/create/src/tests.rs
@@ -559,7 +559,7 @@ fn source_kind_tells_pdfs_images_and_text_apart() {
     // Text that merely starts like a BMP stays text; a truncated BMP header is not an image.
     assert_eq!(source_kind("b.txt", b"BMW drivers"), Some(SourceKind::Text));
     assert_eq!(source_kind("b.bmp", b"BM"), None);
-    assert_eq!(source_kind("a.docx", b"PK\x03\x04"), None);
+    assert_eq!(source_kind("a.docx", b"PK\x03\x04"), Some(SourceKind::Office), "Office documents convert through LibreOffice");
     assert_eq!(source_kind("", b""), None);
     // Only the GIF versions Create decodes count as images, so detection never promises a
     // conversion that then fails.
@@ -2952,3 +2952,19 @@ fn stripping_extended_xmp_leaves_the_rest_of_the_jpeg() {
     // The helper puts a stray byte before the chunks, which the decoder skips: it stays.
     assert_eq!(crate::upright_image::without_extended_xmp(&flooded), [&plain[..2], b"\0".as_slice(), &plain[2..]].concat());
 }
+
+#[test]
+fn convertible_is_the_image_and_text_extensions() {
+    let both: Vec<&str> = IMAGE_EXTENSIONS.iter().chain(TEXT_EXTENSIONS.iter()).copied().collect();
+    assert_eq!(both, CONVERTIBLE.to_vec());
+    assert!(OFFICE_EXTENSIONS.iter().all(|e| !CONVERTIBLE.contains(e) && *e != "pdf"));
+}
+
+#[test]
+fn office_documents_are_their_own_kind() {
+    assert_eq!(source_kind("Report.docx", b"PK\x03\x04\x14\x00"), Some(SourceKind::Office));
+    assert_eq!(source_kind("Budget.xls", &[0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1]), Some(SourceKind::Office));
+    // A PDF saved with a Word name is still a PDF; a ZIP that isn't named like Office is nothing.
+    assert_eq!(source_kind("Report.docx", b"%PDF-1.7\n"), Some(SourceKind::Pdf));
+    assert_eq!(source_kind("photos.zip", b"PK\x03\x04\x14\x00"), None);
+}
diff --git a/crates/crypt/src/lib.rs b/crates/crypt/src/lib.rs
index 8b520d281d..31c4963ae5 100644
--- a/crates/crypt/src/lib.rs
+++ b/crates/crypt/src/lib.rs
@@ -127,6 +127,13 @@ impl Permissions {
     pub fn assemble(&self) -> bool {
         if self.is_revision_3_or_later() { self.bit(11) } else { self.bit(4) }
     }
+    /// Take pages out into another document (Extract, Split, a source of Combine or Insert
+    /// Pages): [`Self::assemble`] and copying (bit 5), since the pages carry their text and
+    /// graphics into a new file without the document's protection (#5081). "Any except
+    /// extracting pages" sets bit 4 but not bit 11, so at revision 3 and later it grants neither.
+    pub fn extract_pages(&self) -> bool {
+        self.assemble() && self.copy()
+    }
     /// Revision 3 and later need bit 3 as well as bit 12. Table 22 defines bit 12 for those
     /// revisions only: at revision 2 the print flag (bit 3) is all there is.
     pub fn print_high_quality(&self) -> bool {
diff --git a/crates/crypt/src/tests.rs b/crates/crypt/src/tests.rs
index f7bbb874bb..39853f33ad 100644
--- a/crates/crypt/src/tests.rs
+++ b/crates/crypt/src/tests.rs
@@ -248,6 +248,23 @@ fn permission_bits_follow_table_22() {
     assert!(p.modify(), "owners ignore /P");
 }
 
+/// Page extraction (#5081) is assembly as the revision reads it, and copying (bit 5).
+#[test]
+fn page_extraction_needs_assembly_and_copying() {
+    let bit = |n: u32| 1i32 << (n - 1);
+    let user = |bits: i32, revision: i64| Permissions { bits, owner: false, revision };
+    // "Any except extracting pages" (bits 4, 6, 9; copying off) at revision 3 and later.
+    assert!(!user(bit(4) | bit(6) | bit(9), 4).extract_pages());
+    // Pages may change in place, but copying is withheld.
+    assert!(user(bit(11), 6).assemble() && !user(bit(11), 6).extract_pages());
+    assert!(user(bit(11) | bit(5), 6).extract_pages());
+    // Revision 2: bit 4 covers assembly, and its reserved bit 11 grants nothing.
+    assert!(user(bit(4), 2).assemble() && !user(bit(4) | bit(11), 2).extract_pages(), "copying withheld");
+    assert!(user(bit(4) | bit(5), 2).extract_pages());
+    assert!(!user(bit(5) | bit(11), 2).extract_pages(), "no assembly without bit 4 at revision 2");
+    assert!(Permissions { bits: 0, owner: true, revision: 2 }.extract_pages(), "owners ignore /P");
+}
+
 #[test]
 fn perms_limits_what_an_edited_p_grants() {
     let made = new(Algorithm::Aes256, "user pw", "owner pw", 0b0100); // print only
diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index e9bf8370f8..b956cb7079 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -10060,11 +10060,16 @@ fn rewriting_a_paragraph_drawn_with_quote_operators_keeps_their_line_move_and_sp
 fn replacing_a_line_keeps_what_a_dropped_quote_copy_did() {
     let cases = [
         // The copy's `'` moves to the line the footer is placed from.
-        "BT /F1 12 Tf 14 TL 72 700 Td (Target line here) Tj ET BT 72.3 714 Td (Target line here) ' 0 -100 Td (Footer stays put) Tj ET",
+        (2, "BT /F1 12 Tf 14 TL 72 700 Td (Target line here) Tj ET BT 72.3 714 Td (Target line here) ' 0 -100 Td (Footer stays put) Tj ET"),
         // The copy's `"` sets the spacing the footer inherits in the next text object.
-        "BT /F1 12 Tf 0 TL 72 700 Td (Target line here) Tj ET BT 72.3 700 Td 3 2 (Target line here) \" ET BT 72 600 Td (Footer stays put) Tj ET",
+        (2, "BT /F1 12 Tf 0 TL 72 700 Td (Target line here) Tj ET BT 72.3 700 Td 3 2 (Target line here) \" ET BT 72 600 Td (Footer stays put) Tj ET"),
+        // Two copies, a `'` one and a `"` one: the footer takes the second's line and spacing.
+        (
+            3,
+            "BT /F1 12 Tf 0 TL 72 700 Td (Target line here) Tj ET BT 72.3 700 Td (Target line here) ' ET BT 72.6 700 Td 3 2 (Target line here) \" 0 -100 Td (Footer stays put) Tj ET",
+        ),
     ];
-    for content in cases {
+    for (drawn, content) in cases {
         let footer = |doc: &Document| {
             let lines = text::text_lines(doc, 0).unwrap();
             let f = lines.iter().find(|l| l.text == "Footer stays put").unwrap_or_else(|| panic!("no footer in {content}"));
@@ -10074,7 +10079,7 @@ fn replacing_a_line_keeps_what_a_dropped_quote_copy_did() {
         let before = footer(&original);
         let targets: Vec<usize> =
             text::text_lines(&original, 0).unwrap().iter().enumerate().filter(|(_, l)| l.text == "Target line here").map(|(i, _)| i).collect();
-        assert_eq!(targets.len(), 2, "{content}");
+        assert_eq!(targets.len(), drawn, "{content}");
         for target in targets {
             let mut doc = original.clone();
             text::replace_line(&mut doc, 0, target, "NEW TEXT").unwrap();
@@ -14037,6 +14042,39 @@ fn review_inside_scope_group_move_matches_direct_transform_under_outer_scale() {
     }
 }
 
+/// A page that names one font under 300 resource names builds its metrics once: each alias
+/// used to build (and keep) a set of its own.
+#[test]
+fn font_aliases_share_one_set_of_metrics() {
+    let fonts: String = (0..300).map(|i| format!(" /A{i} 5 0 R")).collect();
+    let content: String = format!("BT 72 700 Td {} ET", (0..300).map(|i| format!("/A{i} 12 Tf (x) Tj ")).collect::<String>());
+    let objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R >>".into(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
+        format!("<< /Type /Page /Parent 2 0 R /MediaBox [0 0 600 800] /Contents 4 0 R /Resources << /Font <<{fonts} >> >> >>"),
+        format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len()),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >>".into(),
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offs = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offs.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let x = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offs {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{x}\n%%EOF\n", objs.len() + 1).as_bytes());
+    let doc = Document::open(Arc::new(out)).unwrap();
+    text::METRICS_BUILT.with(|n| n.set(0));
+    let lines = text::text_lines(&doc, 0).unwrap();
+    assert!(lines.iter().map(|l| l.text.matches('x').count()).sum::<usize>() >= 300, "{lines:?}");
+    let built = text::METRICS_BUILT.with(std::cell::Cell::get);
+    assert!(built < 10, "metrics built {built} times for one font");
+}
+
 /// Each `Tj`/`TJ` moves the text matrix by the width of its text. A run shown later in the same
 /// text object without a `Td` or `Tm` of its own (a raised run in another colour, a column after
 /// a `TJ` gap) is placed by those advances. Rewriting the paragraph before it must keep them, as
@@ -14845,6 +14883,38 @@ fn a_thai_edit_that_spends_its_allowance_to_the_byte_goes_through() {
     assert!(error.contains("THSarabunPSK") && error.contains("MiB of font data"), "{error}");
 }
 
+/// Only a read the allowance refuses leaves a font of the face unread for want of it. With the
+/// allowance spent to the byte as above, another font of the face, whose ToUnicode is an empty
+/// stream behind a filter nothing decodes (unread with any allowance), still has its program read,
+/// which the allowance refuses: the edit is refused, rather than going through without that font.
+#[test]
+fn a_font_of_the_face_unread_on_its_own_once_the_allowance_is_spent_still_refuses_the_edit() {
+    let mut program = legacy_thai_program();
+    program.resize((16 << 20) - 192, 0);
+    let mut unicode = LEGACY_THAI_UNICODE.to_vec();
+    unicode.resize(256, b' ');
+    let mut doc = text_page("BT /F1 16 Tf 50 650 Td <00d6> Tj ET");
+    let font = legacy_thai_font(&mut doc, "ABCDEF+THSarabunPSK", &program, &unicode);
+    doc.set(pdfcraft_cos::ObjRef::new(5, 0), Object::Dict(font));
+    // Not a subset, so its metrics read no program, only the ToUnicode.
+    let mut other = legacy_thai_font(&mut doc, "THSarabunPSK", &legacy_thai_program(), LEGACY_THAI_UNICODE);
+    let mut dict = Dict::new();
+    dict.set(b"Filter".to_vec(), Object::name("NoSuchFilter"));
+    other.set(b"ToUnicode".to_vec(), Object::Ref(doc.add(Object::Stream(Stream::from_raw(dict, Vec::new())))));
+    let other = doc.add(Object::Dict(other));
+    doc.update_dict(pdfcraft_cos::ObjRef::new(3, 0), |page| {
+        let Some(Object::Dict(mut resources)) = page.get(b"Resources").cloned() else { panic!("fixture") };
+        let Some(Object::Dict(mut fonts)) = resources.get(b"Font").cloned() else { panic!("fixture") };
+        fonts.set(b"F2".to_vec(), Object::Ref(other));
+        resources.set(b"Font".to_vec(), Object::Dict(fonts));
+        page.set(b"Resources".to_vec(), Object::Dict(resources));
+    })
+    .unwrap();
+    let style = BlockStyle { width: Some(400.0), ..Default::default() };
+    let error = text::rewrite_block(&mut doc, 0, 0, Some("กขค"), &style).unwrap_err().to_string();
+    assert!(error.contains("THSarabunPSK") && error.contains("MiB of font data"), "{error}");
+}
+
 /// A THSarabunPSK-named subset that has OpenType Thai mark positioning is a modern face: it is
 /// shaped with its own layout like any source font, not by the legacy shaper (which would ask
 /// for Windows PUA alternates such a face doesn't need).
diff --git a/crates/edit/src/text.rs b/crates/edit/src/text.rs
index b58c41303f..eba8834c2b 100644
--- a/crates/edit/src/text.rs
+++ b/crates/edit/src/text.rs
@@ -54,6 +54,8 @@ pub(crate) use fallback::{SOURCE_SPACE_CALLS, take_source_character_measurements
 #[cfg(test)]
 use fallback::{add_type3_font, is_type3_fallback};
 pub(crate) use fallback::{glyph_path, type3_font_dict, unique_font_name};
+#[cfg(test)]
+pub(crate) use interp::METRICS_BUILT;
 use interp::{Origin, Paint, union};
 #[cfg(test)]
 pub(crate) use lines::dropped_advances_within;
diff --git a/crates/edit/src/text/editor.rs b/crates/edit/src/text/editor.rs
index 4f4abf3a43..e6df1dbfee 100644
--- a/crates/edit/src/text/editor.rs
+++ b/crates/edit/src/text/editor.rs
@@ -2,7 +2,7 @@ use super::blocks::{BlockStyle, TextBlock};
 use super::fallback::MAX_TYPE3_GLYPHS;
 use super::lines::{page_dict, text_lines};
 use super::rewrite::rewrite_block_from;
-use super::{DecodeBudget, Dict, Document, EditError, Metrics, Object, TextLine, TextSession};
+use super::{DecodeBudget, Dict, Document, EditError, Object, TextLine, TextSession};
 
 /// An embedded source font or an approved bundled document-font choice.
 /// Source bytes stay in memory and are never installed or copied into another document.
@@ -45,7 +45,7 @@ pub fn text_editor_fonts(doc: &Document, page: usize) -> Result<Vec<TextEditorFo
         budget -= bytes.len();
         result.push(TextEditorFont {
             resource: String::from_utf8_lossy(name).into_owned(),
-            face: Metrics::from_dict(doc, &font).base_font.rsplit('+').next().unwrap_or_default().to_owned(),
+            face: pdfcraft_fonts::pdf::base_font_name(doc, &font).rsplit('+').next().unwrap_or_default().to_owned(),
             bytes,
             choice_only: false,
         });
diff --git a/crates/edit/src/text/interp.rs b/crates/edit/src/text/interp.rs
index 0bc9373899..e628e017c4 100644
--- a/crates/edit/src/text/interp.rs
+++ b/crates/edit/src/text/interp.rs
@@ -664,6 +664,13 @@ impl Carry {
 /// The advance is an error message when the font's writing mode can't be read.
 type CachedFont = (Rc<Metrics>, Option<String>, Result<Option<f64>, String>);
 
+#[cfg(test)]
+thread_local! {
+    /// Font metrics built by [`interpret`] on this thread, for the test that keeps font aliases
+    /// sharing one set.
+    pub(crate) static METRICS_BUILT: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
+}
+
 /// A `Do` met while interpreting: its operator index, XObject name and the state there.
 type Invocation = (usize, Vec<u8>, Ts);
 
@@ -976,6 +983,7 @@ pub(super) fn interpret(
     let fonts_res = super::resource_dict(doc, resources, b"Font", &mut held_fonts).unwrap_or(&none);
     let states = super::resource_dict(doc, resources, b"ExtGState", &mut held_states).unwrap_or(&none);
     let mut out: Vec<Shown> = Vec::new();
+    let mut by_font: HashMap<pdfcraft_cos::ObjRef, CachedFont> = HashMap::new();
     let mut ts = carry.ts.clone();
     let mut at_bt = (0usize, ts.clone());
     let mut stack: Vec<(Ts, Matrix, Matrix)> = std::mem::take(&mut carry.stack);
@@ -1105,11 +1113,23 @@ pub(super) fn interpret(
                 ts.size = op.num(1).unwrap_or(ts.size);
                 if let Some(name) = op.name(0) {
                     let (m, face, vertical) = cache.entry(name.to_vec()).or_insert_with(|| {
+                        // Names that refer to one font object share what was built for it: a
+                        // thousand aliases of one font are one set of metrics, not a thousand.
+                        let font = fonts_res.get(name).and_then(Object::as_ref);
+                        if let Some(built) = font.and_then(|r| by_font.get(&r)) {
+                            return built.clone();
+                        }
+                        #[cfg(test)]
+                        METRICS_BUILT.with(|n| n.set(n.get() + 1));
                         let dict = fonts_res.get(name).and_then(|f| doc.resolve(f).as_dict().cloned());
                         let metrics = dict.as_ref().map_or_else(Metrics::fallback, |d| Metrics::from_dict(doc, d));
                         let vertical = dict.as_ref().map_or(Ok(None), |d| vertical_advance(doc, d).map_err(|e| e.to_string()));
                         let face = dict.filter(is_type3_fallback).map(|_| metrics.base_font.clone());
-                        (Rc::new(metrics), face, vertical)
+                        let built: CachedFont = (Rc::new(metrics), face, vertical);
+                        if let Some(r) = font {
+                            by_font.insert(r, built.clone());
+                        }
+                        built
                     });
                     ts.font = Some((name.to_vec(), m.clone()));
                     ts.face = face.clone();
diff --git a/crates/engine/src/actions.rs b/crates/engine/src/actions.rs
index 249279e09d..6608cb3297 100644
--- a/crates/engine/src/actions.rs
+++ b/crates/engine/src/actions.rs
@@ -151,6 +151,8 @@ fn images_refused_note(images: usize) -> Option<String> {
     (images > 0).then(|| format!("Reduce file size: {images} image(s) stayed as they were, past what one run may decode"))
 }
 
+/// Apply one action step to document `id`, adding what it did to `log`; returns the new
+/// document when the step replaced it.
 fn apply_step(s: &mut Session, id: DocId, step: &Step, log: &mut Vec<String>) -> Result<Option<DocId>, EditError> {
     let pages = s.get(id).map_or(0, |d| d.info.pages.len());
     let all: Vec<usize> = (0..pages).collect();
@@ -209,9 +211,19 @@ fn apply_step(s: &mut Session, id: DocId, step: &Step, log: &mut Vec<String>) ->
     Ok(None)
 }
 
-/// Run `action` on one file. `progress(step, steps)` is called before each step.
-pub fn run_on(action: &Action, name: &str, bytes: Arc<Vec<u8>>, mut progress: impl FnMut(usize, usize)) -> Result<FileResult, String> {
+/// Run `action` on one file. `javascript` is the caller's [`Session::javascript`] preference:
+/// when off, neither open-time scripts nor "Run a JavaScript" steps run. `progress(step, steps)`
+/// is called before each step.
+pub fn run_on(
+    action: &Action,
+    name: &str,
+    bytes: Arc<Vec<u8>>,
+    javascript: bool,
+    mut progress: impl FnMut(usize, usize),
+) -> Result<FileResult, String> {
     let mut s = Session::new();
+    // Before the open: open-time (XFA) scripts read it there.
+    s.set_javascript(javascript);
     let mut id = s.open(name, None, bytes, None).map_err(|e| e.to_string())?;
     if let Some(why) = s.get(id).and_then(|d| d.read_only_reason.clone()) {
         return Err(why);
diff --git a/crates/engine/src/commands.rs b/crates/engine/src/commands.rs
index dfbc33d658..55a5d840ba 100644
--- a/crates/engine/src/commands.rs
+++ b/crates/engine/src/commands.rs
@@ -18,8 +18,10 @@ pub enum Needs {
     Nothing,
     /// A document is open.
     Document,
-    /// The open document's security allows page changes (insert, delete, rotate, extract…).
+    /// The open document's security allows page changes (insert, delete, rotate…).
     Assembly,
+    /// The open document's security allows taking pages out into new files (extract, split).
+    PageExtraction,
     /// The open document's security allows content and metadata changes.
     Modification,
     /// The open document's security allows adding and changing comments.
@@ -416,8 +418,8 @@ pub const COMMANDS: &[CommandSpec] = &[
     c("page.boxes", "Set page boxes…", PAGES, None, Assembly, "square-dashed-mouse-pointer"),
     c("page.insert", "Insert pages from file…", PAGES, None, Assembly, "file-input"),
     c("page.replace", "Replace pages…", PAGES, None, Assembly, "replace"),
-    c("page.extract", "Extract pages…", PAGES, None, Assembly, "file-output"),
-    c("page.split", "Split document…", PAGES, None, Assembly, "scissors"),
+    c("page.extract", "Extract pages…", PAGES, None, PageExtraction, "file-output"),
+    c("page.split", "Split document…", PAGES, None, PageExtraction, "scissors"),
     c("page.number", "Number pages…", PAGES, None, Assembly, "hash"),
     c("prepress.marks", "Add printer marks…", None, None, Modification, "ruler"),
     c("prepress.marks.remove", "Remove printer marks", None, None, Marks(crate::MarkKind::PrinterMarks), "ruler"),
@@ -449,6 +451,7 @@ pub fn is_enabled(spec: &CommandSpec, session: &Session, active: Option<DocId>)
         Nothing => true,
         Document | TwoPageView => doc.is_some(),
         Assembly => doc.is_some_and(|d| d.allows_assembly()),
+        PageExtraction => doc.is_some_and(|d| d.allows_page_extraction()),
         Modification => doc.is_some_and(|d| d.allows_modification()),
         Annotate => doc.is_some_and(|d| d.allows_annotation()),
         Copying => doc.is_some_and(|d| d.allows_copying()),
diff --git a/crates/engine/src/document.rs b/crates/engine/src/document.rs
index 530f8787af..805e089dd7 100644
--- a/crates/engine/src/document.rs
+++ b/crates/engine/src/document.rs
@@ -52,6 +52,9 @@ pub struct Document {
     pub(crate) config: RenderConfig,
     /// What field scripts printed or asked for (see [`Session::take_js_output`]).
     pub(crate) js_output: js::JsOutput,
+    pub(crate) js_runtime: js::Runtime,
+    pub(crate) js_zoom: f64,
+    pub(crate) js_page: usize,
     /// Dynamic XFA forms: what laying the template out produced (pages and fields are
     /// PdfCraft's; Adobe's viewers draw the form from the XFA packets themselves).
     pub xfa: Option<XfaLayout>,
@@ -551,11 +554,17 @@ impl Document {
         if self.allows_copying() { Ok(()) } else { Err(EditError::NotPermitted("copying text and images")) }
     }
 
-    /// Page changes (insert, delete, rotate, move, extract) are allowed.
+    /// Page changes (insert, delete, rotate, move) are allowed.
     pub fn allows_assembly(&self) -> bool {
         self.editable() && self.permissions().is_none_or(|p| p.assemble())
     }
 
+    /// Pages may be taken out into new files (Extract, Split): the page changes above and copying,
+    /// since the new files don't keep the document's protection (#5081).
+    pub fn allows_page_extraction(&self) -> bool {
+        self.editable() && self.permissions().is_none_or(|p| p.extract_pages())
+    }
+
     /// Redaction marks waiting to be applied.
     pub fn redaction_marks(&self) -> usize {
         self.info.annotations.iter().filter(|a| a.subtype == "Redact").count()
@@ -949,41 +958,60 @@ pub(crate) fn recovered_render_password(cos: &pdfcraft_cos::Document) -> Option<
 /// the document as it was.
 pub(crate) fn shown_under_redactions(
     after: &pdfcraft_cos::Document,
-    marks: &[pdfcraft_redact::Mark],
+    marks: &[(pdfcraft_cos::ObjRef, pdfcraft_redact::Mark)],
     overlays: &[pdfcraft_cos::ObjRef],
-    pages: &[pdfcraft_render::PageInfo],
     password: Option<&str>,
 ) -> Result<(), EditError> {
     use pdfcraft_cos::Object;
     use pdfcraft_redact::RedactError;
-    let mut marked: Vec<usize> = marks.iter().map(|m| m.page).collect();
+    let mut shown = after.clone();
+    let model = pdfcraft_model::pages(&shown);
+    // A batch can move pages after the marks were collected: a mark is found by the page object it
+    // was placed on, not by the index that page had when it was drawn. A page the batch deleted
+    // takes its marks with it, so they are not checked against whatever page now holds the index.
+    // One index, built once: each mark is resolved against it instead of scanning every page,
+    // and the marks are grouped by resolved page in the same pass.
+    let mut index: std::collections::HashMap<pdfcraft_cos::ObjRef, usize> = std::collections::HashMap::new();
+    for (i, p) in model.iter().enumerate() {
+        index.entry(p.obj).or_insert(i);
+    }
+    let mut marked: Vec<usize> = Vec::new();
+    let mut rects_of: std::collections::HashMap<usize, Vec<[f64; 4]>> = std::collections::HashMap::new();
+    for (obj, m) in marks {
+        let Some(&pi) = index.get(obj) else { continue };
+        if !rects_of.contains_key(&pi) {
+            marked.push(pi);
+        }
+        rects_of.entry(pi).or_default().extend(m.rects.iter().map(|r| [r[0].min(r[2]), r[1].min(r[3]), r[0].max(r[2]), r[1].max(r[3])]));
+    }
     marked.sort_unstable();
-    marked.dedup();
     if marked.is_empty() {
         return Ok(());
     }
-    let mut shown = after.clone();
-    let model = pdfcraft_model::pages(&shown);
     for &pi in &marked {
         let Some(page) = model.get(pi) else { continue };
         let Some(Object::Array(list)) = page.dict.get(b"Contents").map(|c| (*shown.resolve(c)).clone()) else { continue };
         let kept: Vec<Object> = list.into_iter().filter(|o| !o.as_ref().is_some_and(|r| overlays.contains(&r))).collect();
         shown.update_dict(page.obj, |d| d.set(b"Contents".to_vec(), Object::Array(kept))).map_err(|e| EditError::Write(e.to_string()))?;
     }
-    let bytes = write_incremental(&shown, &SaveOptions::default()).map_err(|e| EditError::Write(e.to_string()))?;
+    let bytes = Arc::new(write_incremental(&shown, &SaveOptions::default()).map_err(|e| EditError::Write(e.to_string()))?);
+    // Page geometry comes from the document as it is now written: a page moved earlier in the batch
+    // brings its own size and rotation with it.
+    let pages = pdfcraft_render::inspect(bytes.clone(), password).map_err(|e| EditError::Write(e.to_string()))?.pages;
+    // The model counts one entry per `/Kids` entry; the renderer one per page it draws. If they
+    // disagree, a mark's index could land on another page's text, and the check cannot confirm
+    // the redaction.
+    if pages.len() != model.len() {
+        return Err(RedactError::AmbiguousPages.into());
+    }
     let config = RenderConfig { password: password.map(Arc::from), ..Default::default() };
-    let mut renderer = pdfcraft_render::PageRenderer::new(Arc::new(bytes), config);
+    let mut renderer = pdfcraft_render::PageRenderer::new(bytes, config);
     let mut residue = 0;
     for &pi in &marked {
         let request = pdfcraft_render::RenderRequest { page: pi, kind: pdfcraft_render::RequestKind::Text, scale: 1.0, ..Default::default() };
         // A page that cannot be read back cannot be confirmed clean.
         let (Some(info), Some(text)) = (pages.get(pi), renderer.render(request).text) else { return Err(RedactError::Unreadable(pi + 1).into()) };
-        let rects: Vec<[f64; 4]> = marks
-            .iter()
-            .filter(|m| m.page == pi)
-            .flat_map(|m| m.rects.iter())
-            .map(|r| [r[0].min(r[2]), r[1].min(r[3]), r[0].max(r[2]), r[1].max(r[3])])
-            .collect();
+        let rects = rects_of.get(&pi).cloned().unwrap_or_default();
         for glyph in text.glyphs.iter().filter(|g| !g.text.trim().is_empty()) {
             let [x0, y0, x1, y1] = info.view_rect_to_user(glyph.rect).map(f64::from);
             let area = (x1 - x0) * (y1 - y0);
diff --git a/crates/engine/src/document_actions_tests.rs b/crates/engine/src/document_actions_tests.rs
new file mode 100644
index 0000000000..8511163eff
--- /dev/null
+++ b/crates/engine/src/document_actions_tests.rs
@@ -0,0 +1,379 @@
+//! Catalog JavaScript actions (#269, ported from #344): the `/OpenAction` runs once on opening
+//! and again on Revert, `/AA /WS` before a save and `/AA /WP` before printing, all in the
+//! document's retained realm.
+
+use std::sync::Arc;
+
+use crate::js::DocumentScriptEvent;
+use crate::{DocId, Session};
+
+/// A PDF of `objs`, numbered from 1, with a cross-reference table.
+fn pdf_of(objs: &[String]) -> Vec<u8> {
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    out
+}
+
+/// A one-field form (`log`, a text field) whose catalog carries `catalog` (PDF syntax, e.g.
+/// `/OpenAction 6 0 R`), with `extra` objects numbered from 6.
+fn form(catalog: &str, extra: &[&str]) -> Vec<u8> {
+    let mut objs = vec![
+        format!("<< /Type /Catalog /Pages 2 0 R {catalog} /AcroForm << /Fields [4 0 R] /DA (/Helv 0 Tf 0 g) /DR << /Font << /Helv 5 0 R >> >> >> >>"),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 300] >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Annots [4 0 R] >>".into(),
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (log) /V () /Rect [20 250 180 270] /P 3 0 R /F 4 >>".into(),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >>".into(),
+    ];
+    objs.extend(extra.iter().map(|s| s.to_string()));
+    pdf_of(&objs)
+}
+
+fn log(s: &Session, id: DocId) -> String {
+    s.get(id).unwrap().form.iter().find(|f| f.name == "log").unwrap().value.join(",")
+}
+
+/// The open action runs once on opening, after the document scripts and in their realm, and
+/// sees `event.name` "Open"; its field change is applied.
+#[test]
+fn the_open_action_runs_once_on_opening_in_the_document_realm() {
+    let bytes = form(
+        "/OpenAction 6 0 R /Names << /JavaScript << /Names [(init) 7 0 R] >> >>",
+        &[
+            "<< /S /JavaScript /JS (opened++; getField\\('log'\\).value = event.type + '/' + event.name + '/' + opened;) >>",
+            "<< /S /JavaScript /JS (var opened = 0;) >>",
+        ],
+    );
+    let mut s = Session::new();
+    let id = s.open("open.pdf", None, Arc::new(bytes), None).unwrap();
+    assert_eq!(log(&s, id), "Doc/Open/1");
+    assert!(s.take_js_output(id).errors.is_empty());
+    // The realm is kept: a later script sees the count the open action left.
+    assert_eq!(s.run_javascript(id, "opened;", None).unwrap().result.as_deref(), Some("1"));
+}
+
+/// An open action chain runs in order through `/Next` (a dictionary or an array), skipping
+/// actions of other types, and a cycle in it runs each action once.
+#[test]
+fn an_open_action_chain_runs_in_order_and_a_cycle_runs_each_action_once() {
+    let bytes = form(
+        "/OpenAction 6 0 R",
+        &[
+            "<< /S /JavaScript /JS (var seen = ['a'];) /Next [7 0 R 8 0 R] >>",
+            "<< /S /GoTo /D [3 0 R /Fit] /Next 9 0 R >>",
+            "<< /S /JavaScript /JS (seen.push\\('c'\\); getField\\('log'\\).value = seen.join\\(''\\);) /Next 6 0 R >>",
+            "<< /S /JavaScript /JS (seen.push\\('b'\\);) /Next 7 0 R >>",
+        ],
+    );
+    let mut s = Session::new();
+    let id = s.open("chain.pdf", None, Arc::new(bytes), None).unwrap();
+    assert_eq!(log(&s, id), "abc");
+}
+
+/// What an open action asks for that needs a click (a URL, printing) is dropped; a page
+/// change it asks for is kept.
+#[test]
+fn an_open_action_may_not_open_a_url_or_print() {
+    let bytes = form("/OpenAction << /S /JavaScript /JS (app.launchURL\\('https://example.com'\\); this.print\\(\\); this.pageNum = 0;) >>", &[]);
+    let mut s = Session::new();
+    let id = s.open("asks.pdf", None, Arc::new(bytes), None).unwrap();
+    let out = s.take_js_output(id);
+    assert_eq!(out.requests, [crate::js::Request::GoToPage(0)], "{out:?}");
+}
+
+/// With JavaScript off the open action doesn't run.
+#[test]
+fn the_open_action_does_not_run_with_javascript_off() {
+    let bytes = form("/OpenAction << /S /JavaScript /JS (getField\\('log'\\).value = 'ran';) >>", &[]);
+    let mut s = Session::new();
+    s.set_javascript(false);
+    let id = s.open("off.pdf", None, Arc::new(bytes), None).unwrap();
+    assert_eq!(log(&s, id), "");
+    assert!(s.run_document_actions(id, DocumentScriptEvent::CatalogOpen).is_empty());
+}
+
+/// Revert reopens the saved file in a fresh realm, so the open action runs again from scratch.
+#[test]
+fn revert_runs_the_open_action_again_in_a_fresh_realm() {
+    let bytes = form(
+        "/OpenAction << /S /JavaScript /JS (if \\(typeof runs == 'undefined'\\) var runs = 0; runs++; getField\\('log'\\).value = 'run ' + runs;) >>",
+        &[],
+    );
+    let mut s = Session::new();
+    let id = s.open("revert.pdf", None, Arc::new(bytes), None).unwrap();
+    assert_eq!(log(&s, id), "run 1");
+    s.run_javascript(id, "getField('log').value = 'typed';", None).unwrap();
+    s.revert(id).unwrap();
+    assert_eq!(log(&s, id), "run 1", "a fresh realm counts from zero again");
+}
+
+/// Will Save runs in the document realm before the bytes are written, and what it changes is in
+/// the saved file; a failing Will Save is reported and the save still has bytes to write.
+#[test]
+fn will_save_changes_what_is_saved_and_a_failing_one_does_not_stop_the_save() {
+    let bytes = form(
+        "/Names << /JavaScript << /Names [(init) 6 0 R] >> >> /AA << /WS << /S /JavaScript /JS (saves++; getField\\('log'\\).value = event.name + ' ' + saves;) >> >>",
+        &["<< /S /JavaScript /JS (var saves = 0;) >>"],
+    );
+    let mut s = Session::new();
+    let id = s.open("save.pdf", None, Arc::new(bytes), None).unwrap();
+    let out = s.run_document_actions(id, DocumentScriptEvent::WillSave);
+    assert!(out.errors.is_empty(), "{out:?}");
+    assert_eq!(log(&s, id), "WillSave 1");
+    let saved = s.save_bytes(id).unwrap();
+    let mut reopened = Session::new();
+    reopened.set_javascript(false);
+    let again = reopened.open("saved.pdf", None, saved, None).unwrap();
+    assert_eq!(log(&reopened, again), "WillSave 1");
+
+    let failing = form("/AA << /WS << /S /JavaScript /JS (throw new Error\\('no'\\);) >> >>", &[]);
+    let id = s.open("fail.pdf", None, Arc::new(failing), None).unwrap();
+    let out = s.run_document_actions(id, DocumentScriptEvent::WillSave);
+    assert!(out.errors.iter().any(|e| e.contains("no")), "{out:?}");
+    assert!(s.save_bytes(id).is_ok());
+}
+
+/// Will Print runs before printing, in the same realm, and sees `event.name` "WillPrint".
+#[test]
+fn will_print_runs_in_the_document_realm() {
+    let bytes = form("/AA << /WP << /S /JavaScript /JS (getField\\('log'\\).value = event.name;) >> >>", &[]);
+    let mut s = Session::new();
+    let id = s.open("print.pdf", None, Arc::new(bytes), None).unwrap();
+    assert!(s.run_document_actions(id, DocumentScriptEvent::WillSave).is_empty(), "no Will Save action: nothing runs");
+    assert_eq!(log(&s, id), "");
+    s.run_document_actions(id, DocumentScriptEvent::WillPrint);
+    assert_eq!(log(&s, id), "WillPrint");
+}
+
+/// A form with a text field `log` and a text field `hot` whose widget has JavaScript for every
+/// pointer and focus trigger, each appending `event.name` to `log`.
+fn triggers_form() -> Vec<u8> {
+    let add =
+        || "<< /S /JavaScript /JS (var l = getField\\('log'\\); l.value = l.value + event.name + ':' + event.target.name + ';';) >>".to_string();
+    let objs = vec![
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R 6 0 R] /DA (/Helv 0 Tf 0 g) /DR << /Font << /Helv 5 0 R >> >> >> >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 300] >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Annots [4 0 R 6 0 R] >>".into(),
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (log) /V () /Rect [20 250 180 270] /P 3 0 R /F 4 >>".into(),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >>".into(),
+        format!(
+            "<< /Type /Annot /Subtype /Widget /FT /Tx /T (hot) /V () /Rect [20 200 180 220] /P 3 0 R /F 4 /AA << /E {} /X {} /D {} /U {} /Fo {} /Bl {} >> >>",
+            add(),
+            add(),
+            "<< /S /JavaScript /JS (getField\\('log'\\).value += 'D;'; this.print\\(\\);) >>",
+            add(),
+            add(),
+            "<< /S /JavaScript /JS (getField\\('log'\\).value += 'Bl;'; this.print\\(\\);) >>",
+        ),
+    ];
+    pdf_of(&objs)
+}
+
+/// Pointer and focus triggers run the widget's JavaScript with the event names Acrobat uses,
+/// each as one undoable edit; a field without such a script runs nothing.
+#[test]
+fn pointer_and_focus_triggers_run_the_widget_scripts() {
+    use crate::js::FieldFocus;
+    use pdfcraft_forms::Trigger;
+    let mut s = Session::new();
+    let id = s.open("hot.pdf", None, Arc::new(triggers_form()), None).unwrap();
+    assert!(s.field_trigger(id, "hot", 0, Trigger::MouseEnter).unwrap());
+    assert!(s.field_focus(id, "hot", 0, FieldFocus::Enter).unwrap());
+    assert!(s.field_trigger(id, "hot", 0, Trigger::MouseUp).unwrap());
+    assert!(s.field_trigger(id, "hot", 0, Trigger::MouseExit).unwrap());
+    assert_eq!(log(&s, id), "Mouse Enter:hot;Focus:hot;Mouse Up:hot;Mouse Exit:hot;");
+    assert_eq!(s.get(id).unwrap().can_undo(), Some("Run JavaScript"));
+    assert!(!s.field_trigger(id, "log", 0, Trigger::MouseEnter).unwrap(), "no script: nothing runs");
+    assert!(!s.field_trigger(id, "hot", 5, Trigger::MouseEnter).unwrap(), "no such widget: nothing runs");
+    assert!(s.field_trigger(id, "missing", 0, Trigger::MouseEnter).is_err());
+    s.set_javascript(false);
+    assert!(!s.field_trigger(id, "hot", 0, Trigger::MouseEnter).unwrap(), "JavaScript off");
+}
+
+/// A click's Mouse Down may ask to print; losing the focus, which happens unasked, may not.
+#[test]
+fn only_a_click_trigger_may_print() {
+    use crate::js::{FieldFocus, Request};
+    use pdfcraft_forms::Trigger;
+    let mut s = Session::new();
+    let id = s.open("hot.pdf", None, Arc::new(triggers_form()), None).unwrap();
+    s.field_trigger(id, "hot", 0, Trigger::MouseDown).unwrap();
+    assert_eq!(s.take_js_output(id).requests, [Request::Print]);
+    s.field_focus(id, "hot", 0, FieldFocus::Exit).unwrap();
+    let out = s.take_js_output(id);
+    assert!(out.requests.is_empty(), "{out:?}");
+    assert_eq!(log(&s, id), "D;Bl;");
+}
+
+/// `setItems` and `setAction` are written to the document: the combo box gets its new items
+/// (pairs where text and export value differ), the installed scripts run on their triggers, and
+/// both survive a save (#269, from #344).
+#[test]
+fn set_items_and_set_action_are_written_to_the_document() {
+    use pdfcraft_forms::Trigger;
+    let objs = vec![
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R 6 0 R] /DA (/Helv 0 Tf 0 g) /DR << /Font << /Helv 5 0 R >> >> >> >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 300] >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Annots [4 0 R 6 0 R] >>".into(),
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (log) /V () /Rect [20 250 180 270] /P 3 0 R /F 4 >>".into(),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >>".into(),
+        "<< /Type /Annot /Subtype /Widget /FT /Ch /Ff 131072 /T (size) /Opt [(Small) (Large)] /V (Large) /Rect [20 200 180 220] /P 3 0 R /F 4 >>"
+            .into(),
+    ];
+    let mut s = Session::new();
+    let id = s.open("items.pdf", None, Arc::new(pdf_of(&objs)), None).unwrap();
+    let out = s
+        .run_javascript(
+            id,
+            "var f = getField('size'); f.setItems([['Medium', 'm'], 'Large']); \
+             f.setAction('MouseEnter', \"getField('log').value = 'entered ' + event.target.value;\");",
+            None,
+        )
+        .unwrap();
+    assert_eq!(out.error, None, "{out:?}");
+    let size = s.get(id).unwrap().form.iter().find(|f| f.name == "size").unwrap().clone();
+    assert_eq!(size.options, [("m".to_string(), "Medium".to_string()), ("Large".into(), "Large".into())]);
+    assert_eq!(size.value, ["Large"], "the value is still an item: it stays");
+    assert!(s.field_trigger(id, "size", 0, Trigger::MouseEnter).unwrap());
+    assert_eq!(log(&s, id), "entered Large");
+    s.undo(id).unwrap();
+    s.undo(id).unwrap();
+    assert_eq!(s.get(id).unwrap().form.iter().find(|f| f.name == "size").unwrap().options[0].1, "Small", "undone");
+    s.redo(id).unwrap();
+    let saved = s.save_bytes(id).unwrap();
+    let mut again = Session::new();
+    let reopened = again.open("saved.pdf", None, saved, None).unwrap();
+    let size = again.get(reopened).unwrap().form.iter().find(|f| f.name == "size").unwrap().clone();
+    assert_eq!(size.options[0], ("m".to_string(), "Medium".to_string()));
+    assert!(again.field_trigger(reopened, "size", 0, Trigger::MouseEnter).unwrap(), "the installed script is in the file");
+}
+
+/// A check box's Mouse Up, run after the click stored the new value, reads that value and can
+/// show or hide another field by it (#247).
+#[test]
+fn a_check_box_mouse_up_reads_the_value_its_click_stored() {
+    use crate::{Edit, FieldValue};
+    use pdfcraft_forms::Trigger;
+    let objs = vec![
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R 6 0 R 7 0 R] /DA (/Helv 0 Tf 0 g) /DR << /Font << /Helv 5 0 R >> >> >> >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 300] >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Annots [4 0 R 6 0 R 7 0 R] >>".into(),
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (log) /V () /Rect [20 250 180 270] /P 3 0 R /F 4 >>".into(),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >>".into(),
+        "<< /Type /Annot /Subtype /Widget /FT /Btn /T (strike) /V /Off /AS /Off /Rect [20 150 50 180] /P 3 0 R /F 4 /MK << /CA (4) >> /AP << /N << /Yes 8 0 R /Off 8 0 R >> >> /A << /S /JavaScript /JS (getField\\('note'\\).display = event.target.value == 'Off' ? display.hidden : display.visible; getField\\('log'\\).value += 'up:' + event.target.value + ';';) >> >>".into(),
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (note) /V (struck) /Rect [60 150 180 180] /P 3 0 R /F 6 >>".into(),
+        "<< /Type /XObject /Subtype /Form /BBox [0 0 30 30] /Length 0 >>\nstream\n\nendstream".into(),
+    ];
+    let mut s = Session::new();
+    let id = s.open("strike.pdf", None, Arc::new(pdf_of(&objs)), None).unwrap();
+    s.apply(id, Edit::SetFieldValue { name: "strike".into(), value: FieldValue::Text("Yes".into()) }).unwrap();
+    let ran = s.field_trigger(id, "strike", 0, Trigger::MouseUp);
+    let out = s.take_js_output(id);
+    assert!(ran.unwrap(), "{out:?}");
+    assert_eq!(log(&s, id), "up:Yes;");
+    let note = |s: &Session| s.get(id).unwrap().form.iter().find(|f| f.name == "note").unwrap().widgets[0].hidden;
+    assert!(!note(&s), "shown by the script");
+    s.apply(id, Edit::SetFieldValue { name: "strike".into(), value: FieldValue::Check(false) }).unwrap();
+    assert!(s.field_trigger(id, "strike", 0, Trigger::MouseUp).unwrap());
+    assert_eq!(log(&s, id), "up:Yes;up:Off;");
+    assert!(note(&s), "hidden again");
+}
+
+/// A widget action's `/Next` chain runs too, each JavaScript action in order (depth first), past
+/// an action of another type at its head.
+#[test]
+fn a_widget_actions_next_chain_runs_each_script_in_order() {
+    use pdfcraft_forms::Trigger;
+    let js = |text: &str, next: &str| format!("<< /S /JavaScript /JS (getField\\('log'\\).value += '{text}';) {next} >>");
+    let chain = format!("<< /S /URI /URI (https://example.com/) /Next [{} {}] >>", js("a;", &format!("/Next {}", js("b;", ""))), js("c;", ""));
+    let objs = vec![
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R 6 0 R] /DA (/Helv 0 Tf 0 g) /DR << /Font << /Helv 5 0 R >> >> >> >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 300] >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Annots [4 0 R 6 0 R] >>".into(),
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (log) /V () /Rect [20 250 180 270] /P 3 0 R /F 4 >>".into(),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >>".into(),
+        format!("<< /Type /Annot /Subtype /Widget /FT /Tx /T (hot) /V () /Rect [20 200 180 220] /P 3 0 R /F 4 /AA << /E {chain} >> >>"),
+    ];
+    let mut s = Session::new();
+    let id = s.open("chain.pdf", None, Arc::new(pdf_of(&objs)), None).unwrap();
+    assert!(s.field_trigger(id, "hot", 0, Trigger::MouseEnter).unwrap());
+    assert_eq!(log(&s, id), "a;b;c;");
+}
+
+/// `setAction` on a field that shares its name with another installs the script on that field,
+/// the one the script's object stands for, not the first of the name.
+#[test]
+fn set_action_installs_on_the_field_the_object_stands_for() {
+    let objs = vec![
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R 6 0 R] /DA (/Helv 0 Tf 0 g) /DR << /Font << /Helv 5 0 R >> >> >> >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 300] >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Annots [4 0 R 6 0 R] >>".into(),
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (dup) /V () /Rect [20 250 180 270] /P 3 0 R /F 4 >>".into(),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >>".into(),
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (dup) /V () /Rect [20 200 180 220] /P 3 0 R /F 4 >>".into(),
+    ];
+    let mut s = Session::new();
+    let id = s.open("dup.pdf", None, Arc::new(pdf_of(&objs)), None).unwrap();
+    let second = crate::js::field_object_id(pdfcraft_cos::ObjRef::new(6, 0));
+    let out =
+        s.run_javascript_answers_target(id, "event.target.setAction('Format', \"event.value = 'x';\");", Some("dup"), Some(second), &[]).unwrap();
+    assert_eq!(out.error, None, "{out:?}");
+    let cos = s.get(id).unwrap().editor.as_ref().unwrap().cos.clone();
+    let formats: Vec<(u32, bool)> = pdfcraft_forms::fields(&cos).iter().map(|f| (f.obj.num, f.actions.scripts.format.is_some())).collect();
+    assert_eq!(formats, [(4, false), (6, true)]);
+}
+
+/// Of two fields sharing a name, the one the pointer is on runs its own widget script.
+#[test]
+fn a_trigger_on_a_field_sharing_a_name_runs_that_fields_script() {
+    use pdfcraft_forms::Trigger;
+    let enter = |text: &str| format!("/AA << /E << /S /JavaScript /JS (getField\\('log'\\).value += '{text}';) >> >>");
+    let objs = vec![
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R 6 0 R 7 0 R] /DA (/Helv 0 Tf 0 g) /DR << /Font << /Helv 5 0 R >> >> >> >>"
+            .to_string(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 300] >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Annots [4 0 R 6 0 R 7 0 R] >>".into(),
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (log) /V () /Rect [20 250 180 270] /P 3 0 R /F 4 >>".into(),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >>".into(),
+        format!("<< /Type /Annot /Subtype /Widget /FT /Tx /T (dup) /V () /Rect [20 200 180 220] /P 3 0 R /F 4 {} >>", enter("first;")),
+        format!("<< /Type /Annot /Subtype /Widget /FT /Tx /T (dup) /V () /Rect [20 150 180 170] /P 3 0 R /F 4 {} >>", enter("second;")),
+    ];
+    let mut s = Session::new();
+    let id = s.open("dup.pdf", None, Arc::new(pdf_of(&objs)), None).unwrap();
+    let second = crate::js::field_object_id(pdfcraft_cos::ObjRef::new(7, 0));
+    assert!(s.field_trigger_target(id, "dup", Some(second), 0, Trigger::MouseEnter).unwrap());
+    assert_eq!(log(&s, id), "second;");
+    assert!(s.field_trigger(id, "dup", 0, Trigger::MouseEnter).unwrap(), "by name alone, the first");
+    assert_eq!(log(&s, id), "second;first;");
+}
+
+/// Focus too: of two fields sharing a name, the one that gained focus runs its On Focus script.
+#[test]
+fn focus_on_a_field_sharing_a_name_runs_that_fields_script() {
+    use crate::js::FieldFocus;
+    let focus = |text: &str| format!("/AA << /Fo << /S /JavaScript /JS (getField\\('log'\\).value += '{text}';) >> >>");
+    let objs = vec![
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R 6 0 R 7 0 R] /DA (/Helv 0 Tf 0 g) /DR << /Font << /Helv 5 0 R >> >> >> >>"
+            .to_string(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 300] >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Annots [4 0 R 6 0 R 7 0 R] >>".into(),
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (log) /V () /Rect [20 250 180 270] /P 3 0 R /F 4 >>".into(),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >>".into(),
+        format!("<< /Type /Annot /Subtype /Widget /FT /Tx /T (dup) /V () /Rect [20 200 180 220] /P 3 0 R /F 4 {} >>", focus("first;")),
+        format!("<< /Type /Annot /Subtype /Widget /FT /Tx /T (dup) /V () /Rect [20 150 180 170] /P 3 0 R /F 4 {} >>", focus("second;")),
+    ];
+    let mut s = Session::new();
+    let id = s.open("dup.pdf", None, Arc::new(pdf_of(&objs)), None).unwrap();
+    let second = crate::js::field_object_id(pdfcraft_cos::ObjRef::new(7, 0));
+    assert!(s.field_focus_target(id, "dup", Some(second), 0, FieldFocus::Enter).unwrap());
+    assert_eq!(log(&s, id), "second;");
+}
diff --git a/crates/engine/src/edit.rs b/crates/engine/src/edit.rs
index 1d5181bf65..80c51658e4 100644
--- a/crates/engine/src/edit.rs
+++ b/crates/engine/src/edit.rs
@@ -6,8 +6,8 @@ use crate::{
     AddedContent, AddedText, Background, BorderShape, BoxSpec, EditError, FieldProps, FieldValue, FillMark, Hairlines, HeaderFooter, Hidden,
     ImageEdit, InitialView, Label, LineEnding, LinkAction, LinkStyle, MarkFile, MarkKind, Markup, NewAnnotation, NewField, NoteIcon, ObjectTarget,
     PageBox, PrinterMarks, Protection, ReviewState, Rgb, Shape, Standard, Style, TabOrder, TransitionSpec, Watermark, a11y, copy_image,
-    decode_data_file, embed_image, field_table, fit_picture, image_content_type, is_xfa_data_file, js, mark_source, measure, model_poster,
-    open_source, strip_xfa, unrestricted, xfa, xfa_after_data_change,
+    decode_data_file, embed_image, field_table, fit_picture, image_content_type, is_xfa_data_file, js, mark_source, measure, model_poster, strip_xfa,
+    unrestricted, xfa, xfa_after_data_change,
 };
 
 mod labels;
@@ -338,6 +338,12 @@ pub enum Edit {
         name: String,
         image: Arc<Vec<u8>>,
     },
+    /// Set the picture of one exact push-button field; legacy name-only calls remain available.
+    SetFieldImageTarget {
+        name: String,
+        object: pdfcraft_cos::ObjRef,
+        image: Arc<Vec<u8>>,
+    },
     /// Duplicate a field onto other pages (same field, shared value).
     DuplicateField {
         name: String,
@@ -452,8 +458,8 @@ pub enum Edit {
     RemoveStandardId {
         standard: Standard,
     },
-    /// What a script (button or console) changed in form fields: values, read-only, required
-    /// and visibility.
+    /// What a script (button or console) changed in form fields: values, appearance colours,
+    /// read-only, required and visibility.
     ApplyScriptChanges {
         changes: Vec<pdfcraft_forms::FieldChange>,
     },
diff --git a/crates/engine/src/edit/labels.rs b/crates/engine/src/edit/labels.rs
index bfbdc5f7e5..93045146ae 100644
--- a/crates/engine/src/edit/labels.rs
+++ b/crates/engine/src/edit/labels.rs
@@ -256,7 +256,7 @@ impl Edit {
             | Edit::BorderShapeAnnotation { .. }
             | Edit::SetAnnotationInfo { .. } => Label::of("Change comment properties"),
             Edit::SetFieldValue { name, .. } => Label::with("Fill in {name}", name.as_str()),
-            Edit::SetFieldImage { name, .. } => Label::with("Set the image of {name}", name.as_str()),
+            Edit::SetFieldImage { name, .. } | Edit::SetFieldImageTarget { name, .. } => Label::with("Set the image of {name}", name.as_str()),
             Edit::ResetForm { .. } => Label::of("Clear form"),
             Edit::AddField { .. } => Label::of("Add field"),
             Edit::SetFieldProps { .. } => Label::of("Change field properties"),
diff --git a/crates/engine/src/edit/run.rs b/crates/engine/src/edit/run.rs
index ebb8a5f323..0a7a348fca 100644
--- a/crates/engine/src/edit/run.rs
+++ b/crates/engine/src/edit/run.rs
@@ -1,6 +1,6 @@
 use super::{
     AddedContent, Arc, Edit, EditError, FieldValue, ImageEdit, NewAnnotation, Shape, a11y, copy_image, decode_data_file, embed_image, fit_picture,
-    image_content_type, is_xfa_data_file, js, mark_source, measure, model_poster, open_source, strip_xfa, unrestricted, xfa, xfa_after_data_change,
+    image_content_type, is_xfa_data_file, js, mark_source, measure, model_poster, strip_xfa, unrestricted, xfa, xfa_after_data_change,
 };
 use crate::SourceProblem;
 use crate::sources::{comment_source, import_pdf_comments};
@@ -78,7 +78,7 @@ pub(crate) fn check_permission(edit: &Edit, p: &pdfcraft_cos::Permissions) -> Re
                 Err(EditError::NotPermitted("comments"))
             }
         }
-        Edit::SetFieldValue { .. } | Edit::ResetForm { .. } | Edit::SetFieldImage { .. } | Edit::ApplyScriptChanges { .. } | Edit::XfaEvent { .. } => {
+        Edit::SetFieldValue { .. } | Edit::ResetForm { .. } | Edit::SetFieldImage { .. } | Edit::SetFieldImageTarget { .. } | Edit::ApplyScriptChanges { .. } | Edit::XfaEvent { .. } => {
             if p.fill_forms() {
                 Ok(())
             } else {
@@ -221,6 +221,7 @@ fn skipped_text(s: &str) -> String {
 pub(crate) struct EditCtx {
     /// Field scripts run (`None`: JavaScript is off) and what they produced.
     pub(crate) js: Option<js::JsRunner>,
+    defer_reset_callbacks: bool,
     /// A laid-out XFA form's template (`None`: not an XFA form, or JavaScript is off) and what
     /// its scripts produced.
     pub(crate) xfa: Option<Arc<pdfcraft_xfa::model::Template>>,
@@ -252,6 +253,11 @@ pub(crate) struct EditCtx {
     /// The overlay streams the edit's applied redactions added, which alone the renderer's check
     /// leaves out.
     pub(crate) redaction_overlays: Vec<pdfcraft_cos::ObjRef>,
+    /// The marks the edit's applied redactions took out (a batch's included), as they were when
+    /// each apply ran, for the renderer's check.
+    /// Each applied mark with the page object it was drawn on, which a later page move changes the
+    /// index of but not the identity.
+    pub(crate) redaction_marks: Vec<(pdfcraft_cos::ObjRef, pdfcraft_redact::Mark)>,
     /// What the edit's applied redactions left as it was that still holds the removed text.
     pub(crate) redaction_elsewhere: Option<pdfcraft_redact::Elsewhere>,
     /// What became of the PDF/A and PDF/UA identification when the edit's applied redactions
@@ -266,7 +272,7 @@ impl EditCtx {
     /// The field highlight (`app.runtimeHighlight`) the edit's next script reads: the field
     /// scripts' runner holds it while there is one (its scripts change it there), else the edit.
     pub(crate) fn highlight(&self) -> bool {
-        self.js.as_ref().map_or(self.highlight, |js| js.doc.highlight)
+        self.js.as_ref().map_or(self.highlight, |js| js.doc.runtime_highlight)
     }
 
     /// A script changed the field highlight: both script runtimes of the edit read the new one,
@@ -274,7 +280,7 @@ impl EditCtx {
     pub(crate) fn set_highlight(&mut self, on: bool) {
         self.highlight = on;
         if let Some(js) = self.js.as_mut() {
-            js.doc.highlight = on;
+            js.doc.runtime_highlight = on;
         }
     }
 
@@ -292,6 +298,7 @@ impl EditCtx {
         }
         Self {
             js: None,
+            defer_reset_callbacks: false,
             xfa: None,
             xfa_out: Default::default(),
             xfa_datasets: None,
@@ -308,6 +315,7 @@ impl EditCtx {
             rng: getrandom::fill,
             renamed_fields: Vec::new(),
             redaction_overlays: Vec::new(),
+            redaction_marks: Vec::new(),
             redaction_elsewhere: None,
             redaction_identification: pdfcraft_redact::Identification::default(),
             prepared: None,
@@ -508,11 +516,11 @@ fn run_edit_page_image(doc: &mut pdfcraft_cos::Document, page: usize, index: usi
     Ok(())
 }
 
-/// After an edit that changes fields, their scripts or the calculation order: the edit's
-/// script runner reads the document as it now is, and builds its `calculateNow()` list again.
-fn invalidate_calculations(cx: &mut EditCtx, doc: &pdfcraft_cos::Document) {
+/// Forget cached calculation order and field metadata after changing the form structure.
+fn invalidate_form_script_snapshot(cx: &mut EditCtx) {
     if let Some(js) = cx.js.as_mut() {
-        js.invalidate_calculations(doc);
+        js.invalidate_calculations();
+        js.invalidate_field_snapshots();
     }
 }
 
@@ -527,15 +535,25 @@ pub(crate) fn run_edit(doc: &mut pdfcraft_cos::Document, edit: &Edit, cx: &mut E
             pdfcraft_organize::insert_blank_page(doc, *at, *width, *height)?;
         }
         Edit::SetInfo { key, value } => pdfcraft_organize::set_info(doc, key, value)?,
-        Edit::DuplicatePages { pages, at } => pdfcraft_organize::duplicate_pages(doc, pages, *at)?,
+        Edit::DuplicatePages { pages, at } => {
+            // A copy of a page cannot be tied back to the marks an earlier redaction of this edit
+            // applied: text put back under a mark would sit on the copy, unchecked. Fail closed.
+            if !cx.redaction_marks.is_empty() {
+                return Err(EditError::Invalid(
+                    "a batch that applies redactions can't also copy pages: the copies can't be checked against the marks; the document was not changed"
+                        .into(),
+                ));
+            }
+            pdfcraft_organize::duplicate_pages(doc, pages, *at)?
+        }
         Edit::ReplacePages { pages, name, bytes, src_pages } => {
-            let src = open_source(name, bytes)?;
+            let src = crate::sources::open_source_into(name, bytes, doc)?;
             pdfcraft_organize::replace_pages(doc, pages, &src, src_pages)?;
         }
         Edit::SetPageBox { pages, which, spec } => pdfcraft_organize::set_page_box(doc, pages, *which, *spec)?,
         Edit::SetTransition { pages, spec } => pdfcraft_organize::set_transition(doc, pages, spec)?,
         Edit::InsertPagesFrom { name, bytes, pages, at, field_conflicts } => {
-            let src = open_source(name, bytes)?;
+            let src = crate::sources::open_source_into(name, bytes, doc)?;
             let pages = match pages {
                 Some(p) => p.clone(),
                 None => (0..pdfcraft_organize::page_count(&src)?).collect(),
@@ -544,7 +562,7 @@ pub(crate) fn run_edit(doc: &mut pdfcraft_cos::Document, edit: &Edit, cx: &mut E
             let title = std::path::Path::new(name).file_stem().map_or_else(|| name.clone(), |s| s.to_string_lossy().into_owned());
             let outcome = pdfcraft_organize::insert_file_pages(doc, &src, &title, &pages, *at, *field_conflicts)?;
             cx.renamed_fields = outcome.renamed_fields;
-            invalidate_calculations(cx, doc);
+            invalidate_form_script_snapshot(cx);
         }
         Edit::AddBookmark { parent, index, title, page, left, top } => {
             pdfcraft_organize::add_bookmark_at(doc, parent, *index, title, *page, *left, *top)?;
@@ -731,7 +749,10 @@ pub(crate) fn run_edit(doc: &mut pdfcraft_cos::Document, edit: &Edit, cx: &mut E
             set(doc, typed.as_ref().unwrap_or(value))?;
         }
         Edit::ApplyScriptChanges { changes } => match cx.js.as_mut() {
-            Some(js) => pdfcraft_forms::apply_script_changes(doc, changes, js)?,
+            Some(js) => {
+                js.invalidate_field_snapshots();
+                pdfcraft_forms::apply_script_changes(doc, changes, js)?;
+            }
             None => pdfcraft_forms::apply_script_changes(doc, changes, &mut pdfcraft_forms::NoScripts)?,
         },
         Edit::XfaEvent { som, activity } => {
@@ -757,7 +778,14 @@ pub(crate) fn run_edit(doc: &mut pdfcraft_cos::Document, edit: &Edit, cx: &mut E
             cx.set_highlight(on);
             cx.xfa_unchanged = ran.map_err(EditError::Invalid)?;
         }
-        Edit::SetFieldImage { name, image } => {
+        Edit::SetFieldImage { name, image } | Edit::SetFieldImageTarget { name, image, .. } => {
+            let object = match edit {
+                Edit::SetFieldImageTarget { object, .. } => Some(*object),
+                _ => None,
+            };
+            if object.is_some_and(|object| !pdfcraft_forms::fields(doc).iter().any(|f| f.name == *name && f.obj == object)) {
+                return Err(EditError::Invalid("the selected image field is no longer available".into()));
+            }
             let (img, _) = embed_image(doc, name, image)?;
             let px = match &*doc.get(img) {
                 pdfcraft_cos::Object::Stream(s) => (s.dict.int(b"Width").unwrap_or(1) as u32, s.dict.int(b"Height").unwrap_or(1) as u32),
@@ -774,7 +802,7 @@ pub(crate) fn run_edit(doc: &mut pdfcraft_cos::Document, edit: &Edit, cx: &mut E
                 let Some(content_type) = image_content_type(image) else {
                     return Err(EditError::Invalid(format!("{name}: an XFA form keeps a PNG, JPEG, GIF, BMP or TIFF picture; choose one of those")));
                 };
-                pdfcraft_forms::set_button_icon(doc, name, img, px)?;
+                pdfcraft_forms::set_button_icon_target(doc, name, object, img, px)?;
                 let som = pdfcraft_xfa::fields_by_som(doc).into_iter().find(|(_, n)| n == name).map(|(s, _)| s).unwrap_or_else(|| name.clone());
                 let path = match cx.xfa.as_deref() {
                     Some(tpl) => pdfcraft_xfa::data_path(tpl, &som),
@@ -789,40 +817,46 @@ pub(crate) fn run_edit(doc: &mut pdfcraft_cos::Document, edit: &Edit, cx: &mut E
                 cx.xfa_out.errors.extend(r.warnings);
                 xfa_after_data_change(doc, cx, false)?;
             } else {
-                pdfcraft_forms::set_button_icon(doc, name, img, px)?;
+                pdfcraft_forms::set_button_icon_target(doc, name, object, img, px)?;
             }
         }
         Edit::ResetForm { names } => {
-            pdfcraft_forms::reset(doc, names.as_deref())?;
+            if let Some(js) = cx.js.as_mut() {
+                pdfcraft_forms::reset_with_formatting(doc, names.as_deref(), js, !cx.defer_reset_callbacks)?;
+            } else {
+                pdfcraft_forms::reset(doc, names.as_deref())?;
+            }
         }
         Edit::AddField { page, rect, kind, name } => {
             pdfcraft_forms::add_field(doc, *page, *rect, kind, name.as_deref())?;
-            invalidate_calculations(cx, doc);
+            invalidate_form_script_snapshot(cx);
         }
         Edit::SetFieldProps { name, props } => {
             pdfcraft_forms::set_props(doc, name, props)?;
-            invalidate_calculations(cx, doc);
+            invalidate_form_script_snapshot(cx);
         }
         Edit::DuplicateField { name, pages } => {
             if pdfcraft_forms::duplicate_field(doc, name, pages)? == 0 {
                 return Err(EditError::Form(pdfcraft_forms::FormError::Invalid(format!("{name} is already on those pages"))));
             }
-            invalidate_calculations(cx, doc);
+            invalidate_form_script_snapshot(cx);
         }
         Edit::DeleteField { name } => {
             pdfcraft_forms::delete_field(doc, name)?;
-            invalidate_calculations(cx, doc);
+            invalidate_form_script_snapshot(cx);
         }
         Edit::DeleteWidget { name, widget } => {
             pdfcraft_forms::delete_widget(doc, name, *widget)?;
-            invalidate_calculations(cx, doc);
+            invalidate_form_script_snapshot(cx);
         }
         Edit::SetTabOrder { pages, order } => pdfcraft_forms::set_tab_order(doc, pages, *order)?,
         Edit::MoveInTabOrder { name, earlier } => pdfcraft_forms::move_in_tab_order(doc, name, *earlier)?,
         // As after a script edit: the values the new order gives show at once.
         Edit::SetCalculationOrder { names } => {
             pdfcraft_forms::set_calculation_order(doc, names)?;
-            invalidate_calculations(cx, doc);
+            if let Some(js) = cx.js.as_mut() {
+                js.invalidate_calculations();
+            }
             match cx.js.as_mut() {
                 Some(js) => pdfcraft_forms::recalculate_with(doc, js)?,
                 None => pdfcraft_forms::recalculate(doc)?,
@@ -850,7 +884,9 @@ pub(crate) fn run_edit(doc: &mut pdfcraft_cos::Document, edit: &Edit, cx: &mut E
         }
         Edit::SetFieldScript { name, event, script } => {
             pdfcraft_forms::set_field_script(doc, name, event, script.as_deref())?;
-            invalidate_calculations(cx, doc);
+            if let Some(js) = cx.js.as_mut() {
+                js.invalidate_calculations();
+            }
             match cx.js.as_mut() {
                 Some(js) => pdfcraft_forms::recalculate_with(doc, js)?,
                 None => pdfcraft_forms::recalculate(doc)?,
@@ -971,8 +1007,15 @@ pub(crate) fn run_edit(doc: &mut pdfcraft_cos::Document, edit: &Edit, cx: &mut E
             pdfcraft_edit::add_content(doc, *page, &content)?;
         }
         Edit::ApplyRedactions { pages } => {
+            let model = pdfcraft_model::pages(doc);
+            cx.redaction_marks.extend(
+                pdfcraft_redact::marks(doc)
+                    .into_iter()
+                    .filter(|m| pages.as_ref().is_none_or(|p| p.contains(&m.page)))
+                    .filter_map(|m| model.get(m.page).map(|p| (p.obj, m))),
+            );
             let report = pdfcraft_redact::apply(doc, pages.as_deref())?;
-            cx.redaction_overlays = report.overlays;
+            cx.redaction_overlays.extend(report.overlays);
             cx.redaction_elsewhere = Some(report.still_holding);
             cx.redaction_identification = report.identification;
         }
@@ -1090,15 +1133,40 @@ pub(crate) fn run_edit(doc: &mut pdfcraft_cos::Document, edit: &Edit, cx: &mut E
             }
             doc.remove_encryption();
         }
-        Edit::Batch { edits, .. } => {
-            // A form-script event runs on its own: in a batch, its scripts and those the batch's
-            // value edits run afterwards (change, exit) would interleave, an exit running twice.
-            if edits.iter().any(|e| matches!(e, Edit::XfaEvent { .. })) {
-                return Err(EditError::Invalid("a form script event can't be part of a batch of edits".into()));
-            }
-            for e in edits {
-                run_edit(doc, e, cx)?;
+        Edit::Batch { edits, .. } => run_batch(doc, edits, cx)?,
+    }
+    Ok(())
+}
+
+/// Apply an edit batch while keeping reset deferral scoped to adjacent script writeback.
+fn run_batch(doc: &mut pdfcraft_cos::Document, edits: &[Edit], cx: &mut EditCtx) -> Result<(), EditError> {
+    // A form-script event runs on its own: in a batch, its scripts and those the batch's
+    // value edits run afterwards (change, exit) would interleave, an exit running twice.
+    if edits.iter().any(|e| matches!(e, Edit::XfaEvent { .. })) {
+        return Err(EditError::Invalid("a form script event can't be part of a batch of edits".into()));
+    }
+    // Only contiguous resets immediately preceding script value writeback can
+    // defer callbacks. Other edits may read calculated values during validation.
+    let mut script_writeback = vec![false; edits.len()];
+    let mut writes_values = false;
+    for (index, edit) in edits.iter().enumerate().rev() {
+        match edit {
+            Edit::ResetForm { .. } => script_writeback[index] = writes_values,
+            Edit::ApplyScriptChanges { changes } => writes_values = changes.iter().any(|change| change.value.is_some()),
+            _ => writes_values = false,
+        }
+    }
+    let deferred = cx.defer_reset_callbacks;
+    for (index, e) in edits.iter().enumerate() {
+        cx.defer_reset_callbacks = script_writeback[index];
+        let result = run_edit(doc, e, cx);
+        cx.defer_reset_callbacks = deferred;
+        result?;
+        if let Some(js) = cx.js.as_mut() {
+            if js.refused.is_some() {
+                break;
             }
+            js.refresh_after_batch_edit(doc, e);
         }
     }
     Ok(())
diff --git a/crates/engine/src/history.rs b/crates/engine/src/history.rs
index 4259e6c721..393c233297 100644
--- a/crates/engine/src/history.rs
+++ b/crates/engine/src/history.rs
@@ -38,7 +38,11 @@ pub(crate) enum Scope {
 /// Edits during which field scripts run.
 pub(crate) fn uses_scripts(edit: &Edit) -> bool {
     match edit {
-        Edit::SetFieldValue { .. } | Edit::ApplyScriptChanges { .. } | Edit::SetFieldScript { .. } | Edit::SetCalculationOrder { .. } => true,
+        Edit::SetFieldValue { .. }
+        | Edit::ResetForm { .. }
+        | Edit::ApplyScriptChanges { .. }
+        | Edit::SetFieldScript { .. }
+        | Edit::SetCalculationOrder { .. } => true,
         Edit::Batch { edits, .. } => edits.iter().any(uses_scripts),
         _ => false,
     }
@@ -77,7 +81,11 @@ pub(crate) fn scope_of(edit: &Edit) -> Scope {
         | Edit::BorderShapeAnnotation { .. }
         | Edit::SetAnnotationInfo { .. } => Scope::Comments,
         Edit::AddLink { .. } | Edit::SetLink { .. } | Edit::DeleteLink { .. } | Edit::RemoveLinks { .. } | Edit::AddLinks { .. } => Scope::Links,
-        Edit::SetFieldValue { .. } | Edit::ResetForm { .. } | Edit::SetFieldImage { .. } | Edit::ApplyScriptChanges { .. } => Scope::Form,
+        Edit::SetFieldValue { .. }
+        | Edit::ResetForm { .. }
+        | Edit::SetFieldImage { .. }
+        | Edit::SetFieldImageTarget { .. }
+        | Edit::ApplyScriptChanges { .. } => Scope::Form,
         // Page content, resources and added content/marks only: the page tree, annotations,
         // fields, links and document metadata are untouched (see `refresh_content`).
         Edit::MoveObjects { .. }
diff --git a/crates/engine/src/js.rs b/crates/engine/src/js.rs
index 13939aad54..bde0d5a02c 100644
--- a/crates/engine/src/js.rs
+++ b/crates/engine/src/js.rs
@@ -11,6 +11,77 @@ pub use pdfcraft_js::{Limits, Message, MessageButtons, MessageIcon, Outcome, Pan
 
 use crate::{DocId, Edit, EditError, Session};
 
+/// Reset writeback does two full passes (preview and commit); reject amplification before either.
+const MAX_SCRIPT_RESETS: usize = pdfcraft_js::MAX_RESET_CALLS;
+const MAX_SCRIPT_RESET_SELECTORS: usize = 4096;
+const MAX_SCRIPT_RESET_WORK: usize = 1 << 24;
+
+/// Bound request count, selector storage/scans and estimated form/calculation visits before cloning a PDF.
+fn validate_reset_work(fields: &[Field], states: &[pdfcraft_js::FieldState], requests: &[Request]) -> Result<(), EditError> {
+    let invalid = || EditError::Invalid("script reset work limit exceeded; use fewer reset calls or combine field selections".into());
+    let (mut resets, mut selectors, mut bytes) = (0usize, 0usize, 0usize);
+    for request in requests {
+        if let Request::Reset(names) = request {
+            resets = resets.saturating_add(1);
+            selectors = selectors.saturating_add(names.len());
+            if resets > MAX_SCRIPT_RESETS || selectors > MAX_SCRIPT_RESET_SELECTORS {
+                return Err(invalid());
+            }
+            bytes = names.iter().fold(bytes, |n, name| n.saturating_add(name.len()));
+        }
+    }
+    if resets == 0 {
+        return Ok(());
+    }
+    let count = fields.len().max(states.len());
+    let (mut calculations, mut references, mut source_bytes) = (0usize, 0usize, 0usize);
+    for field in fields {
+        use pdfcraft_forms::af::Calculate;
+        if field.actions.calculate != Calculate::None || field.actions.scripts.calculate.is_some() {
+            calculations = calculations.saturating_add(1);
+        }
+        references = references.saturating_add(match &field.actions.calculate {
+            Calculate::Simple { fields, .. } => fields.len(),
+            Calculate::Notation(source) | Calculate::Custom(source) => source.len(),
+            Calculate::None => 0,
+        });
+        source_bytes = source_bytes.saturating_add(field.actions.scripts.calculate.as_ref().map_or(0, String::len));
+    }
+    let name_bytes =
+        fields.iter().fold(0usize, |n, f| n.saturating_add(f.name.len())).max(states.iter().fold(0usize, |n, f| n.saturating_add(f.name.len())));
+    let widgets = fields.iter().fold(0usize, |n, f| n.saturating_add(f.widgets.len()));
+    let per_pass = count
+        .saturating_mul(1usize.saturating_add(calculations).saturating_add(references))
+        .saturating_add(source_bytes)
+        .saturating_add(name_bytes)
+        .saturating_add(widgets);
+    // Bound the expansion scan before doing it, then charge only the actual selections
+    // for the forms layer's membership and validation scans in both reset passes.
+    let comparisons = count.saturating_mul(selectors).saturating_add(count.saturating_mul(bytes));
+    let mut work = resets.saturating_mul(per_pass).saturating_add(comparisons).saturating_add(bytes);
+    if work > MAX_SCRIPT_RESET_WORK / 2 {
+        return Err(invalid());
+    }
+    for request in requests {
+        let Request::Reset(names) = request else { continue };
+        if names.is_empty() {
+            continue;
+        }
+        for field in states.iter().filter(|f| reset_name_matches(&f.name, names)) {
+            work = work.saturating_add(count.saturating_mul(field.name.len().saturating_add(1)).saturating_mul(2));
+            if work > MAX_SCRIPT_RESET_WORK / 2 {
+                return Err(invalid());
+            }
+        }
+    }
+    Ok(())
+}
+
+/// Match an exact reset selector or one of its dotted descendants.
+fn reset_name_matches(name: &str, selectors: &[String]) -> bool {
+    selectors.iter().any(|selector| name == selector || name.strip_prefix(selector).is_some_and(|rest| rest.starts_with('.')))
+}
+
 /// A field gaining or losing focus ([`Session::field_focus`]).
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum FieldFocus {
@@ -206,23 +277,90 @@ fn display(doc: &pdfcraft_cos::Document, f: &Field) -> i32 {
     }
 }
 
-/// A form field as scripts see it.
-pub fn field_state(doc: &pdfcraft_cos::Document, f: &Field) -> pdfcraft_js::FieldState {
-    field_state_with_display(f, display(doc, f))
+/// Document-local PDF field identity used by snapshots, tools and native hit tests.
+pub fn field_object_id(object: pdfcraft_cos::ObjRef) -> u64 {
+    (u64::from(object.num) << 16) | u64::from(object.generation)
 }
 
-fn field_state_with_display(f: &Field, display: i32) -> pdfcraft_js::FieldState {
+/// Check that a supplied field identity belongs to the requested field name.
+fn validate_script_target(target: Option<&str>, identity: Option<u64>, fields: &[Field]) -> Result<(), EditError> {
+    if let Some(id) = identity
+        && !fields.iter().any(|f| Some(f.name.as_str()) == target && field_object_id(f.obj) == id)
+    {
+        return Err(EditError::Invalid("script field identity does not match the named field in this document".into()));
+    }
+    Ok(())
+}
+
+/// Snapshot a current form field using page geometry already read once for this runner.
+/// Values/appearances come from `doc` and `f`, never from the cached calculation plan.
+pub fn field_state(doc: &pdfcraft_cos::Document, f: &Field, geometry: &pdfcraft_js::DocInfo) -> pdfcraft_js::FieldState {
     let mut s = pdfcraft_js::FieldState::new(f.name.clone(), kind(f.kind), f.value.clone());
+    s.object_id = Some(field_object_id(f.obj));
     s.default = f.default.clone();
+    s.default_known = pdfcraft_forms::default_value_known(doc, f);
     s.readonly = f.read_only();
     s.required = f.has(pdfcraft_forms::flags::REQUIRED);
-    s.display = display;
-    s.rect = f.widgets.first().map(|w| w.rect);
+    s.display = display(doc, f);
+    let look = pdfcraft_forms::look(doc, f);
+    s.text_color = Some(std::iter::once("RGB".to_string()).chain(look.text.map(|v| v.to_string())).collect());
     s.char_limit = f.max_len;
     s.options = match f.kind {
         FieldKind::CheckBox | FieldKind::Radio => f.widgets.iter().filter_map(|w| w.on_state.clone()).map(|o| (o.clone(), o)).collect(),
         _ => f.options.clone(),
     };
+    s.caption = f.widgets.first().and_then(|w| w.caption.clone());
+    s.caption_mixed = f.widgets.iter().any(|w| w.caption != s.caption);
+    s.line_width = look.width;
+    s.border_style = match look.style {
+        pdfcraft_forms::BorderStyle::Solid => "solid",
+        pdfcraft_forms::BorderStyle::Dashed => "dashed",
+        pdfcraft_forms::BorderStyle::Beveled => "beveled",
+        pdfcraft_forms::BorderStyle::Inset => "inset",
+        pdfcraft_forms::BorderStyle::Underline => "underline",
+    }
+    .into();
+    s.stroke_color = Some(
+        look.border
+            .map_or_else(|| std::sync::Arc::from(["T".into()]), |rgb| std::iter::once("RGB".into()).chain(rgb.map(|v| v.to_string())).collect()),
+    );
+    s.fill_color = Some(
+        look.fill.map_or_else(|| std::sync::Arc::from(["T".into()]), |rgb| std::iter::once("RGB".into()).chain(rgb.map(|v| v.to_string())).collect()),
+    );
+    s.user_name = doc
+        .get(f.obj)
+        .as_dict()
+        .and_then(|d| d.get(b"TU").map(|v| doc.resolve(v)))
+        .and_then(|v| v.as_string().map(|v| v.to_text()))
+        .unwrap_or_default();
+    s.text_size =
+        f.da.split_whitespace()
+            .collect::<Vec<_>>()
+            .windows(2)
+            .find_map(|p| (p.get(1) == Some(&"Tf")).then(|| p.first()?.parse::<f64>().ok()).flatten())
+            .unwrap_or(0.0);
+    if let Some(w) = f.widgets.first() {
+        let page = w.page.unwrap_or(0);
+        s.page_rotation = geometry.page_rotations.get(page).copied().unwrap_or(0);
+        s.page_crop = geometry.page_boxes.get(page).map_or([0.0; 4], |boxes| boxes[1]);
+        s.rect = Some(pdfcraft_js::rotate_rect(w.rect, s.page_crop, s.page_rotation));
+        s.icon = doc
+            .get(w.obj)
+            .as_dict()
+            .and_then(|d| d.get(b"MK").map(|v| doc.resolve(v)))
+            .and_then(|v| v.as_dict().and_then(|d| d.get(b"I")).and_then(pdfcraft_cos::Object::as_ref))
+            .map(|r| ((r.num as u64) << 16) | r.generation as u64);
+    }
+
+    s.icon_mixed = f.widgets.iter().any(|w| {
+        let icon = doc
+            .get(w.obj)
+            .as_dict()
+            .and_then(|d| d.get(b"MK").map(|v| doc.resolve(v)))
+            .and_then(|v| v.as_dict().and_then(|d| d.get(b"I")).and_then(pdfcraft_cos::Object::as_ref))
+            .map(field_object_id);
+        icon != s.icon
+    });
     s
 }
 
@@ -241,55 +379,191 @@ fn changes(
     for field in before {
         by_name.entry(field.name.as_str()).or_insert(field);
     }
+    let by_id: std::collections::HashMap<_, _> = before.iter().filter_map(|f| f.object_id.map(|id| (id, f))).collect();
+    let mut names = std::collections::HashSet::new();
+    let duplicates: std::collections::HashSet<_> =
+        before.iter().filter_map(|f| (!names.insert(f.name.as_str())).then_some(f.name.as_str())).collect();
     after
         .iter()
         .filter_map(|a| {
-            let b = by_name.get(a.name.as_str())?;
+            let b = if let Some(id) = a.object_id { by_id.get(&id)? } else { by_name.get(a.name.as_str())? };
             let c = FieldChange {
                 name: a.name.clone(),
+                object: a
+                    .object_id
+                    .filter(|_| duplicates.contains(a.name.as_str()))
+                    .map(|id| pdfcraft_cos::ObjRef::new((id >> 16) as u32, id as u16)),
                 value: (a.value != b.value).then(|| a.value.clone()),
                 formatted: a.value != b.value && formatted.contains(&a.name),
                 read_only: (a.readonly != b.readonly).then_some(a.readonly),
                 required: (a.required != b.required).then_some(a.required),
                 display: (a.display != b.display).then_some(a.display),
-                rect: (a.rect != b.rect).then_some(a.rect).flatten(),
+                rect: (a.rect != b.rect).then(|| a.rect.map(|r| pdfcraft_js::unrotate_rect(r, b.page_crop, b.page_rotation))).flatten(),
+                stroke_color: a.stroke_color.as_deref().filter(|_| a.stroke_color != b.stroke_color).map(<[_]>::to_vec),
+                text_size: (a.text_size != b.text_size).then_some(a.text_size),
+                line_width: (a.line_width != b.line_width).then_some(a.line_width),
+                border_style: (a.border_style != b.border_style).then(|| a.border_style.clone()),
+                user_name: (a.user_name != b.user_name).then(|| a.user_name.clone()),
+                icon: (a.icon != b.icon || (a.icon_written && b.icon_mixed)).then_some(a.icon),
+                text_color: a.text_color.as_deref().filter(|_| a.text_color != b.text_color).map(<[_]>::to_vec),
+                fill_color: a.fill_color.as_deref().filter(|_| a.fill_color != b.fill_color).map(<[_]>::to_vec),
+                caption: (a.caption != b.caption || (a.caption_written && b.caption_mixed)).then(|| a.caption.clone()).flatten(),
+                options: (a.options != b.options).then(|| a.options.clone()),
+                actions: a.actions.clone(),
             };
-            (c.value.is_some() || c.read_only.is_some() || c.required.is_some() || c.display.is_some() || c.rect.is_some()).then_some(c)
+            (c.value.is_some()
+                || c.read_only.is_some()
+                || c.required.is_some()
+                || c.display.is_some()
+                || c.caption.is_some()
+                || c.text_color.is_some()
+                || c.fill_color.is_some()
+                || c.rect.is_some()
+                || c.stroke_color.is_some()
+                || c.text_size.is_some()
+                || c.line_width.is_some()
+                || c.border_style.is_some()
+                || c.user_name.is_some()
+                || c.icon.is_some()
+                || c.options.is_some()
+                || !c.actions.is_empty())
+            .then_some(c)
         })
         .collect()
 }
 
 /// Runs field scripts with the document's object model and keeps what they print or ask for.
+pub type Runtime = std::sync::Arc<std::sync::Mutex<pdfcraft_js::session::ScriptSession>>;
+
+/// Invalidate pending results while retaining the document's native worker reservation.
+pub(crate) fn replace_runtime(runtime: &mut Runtime) {
+    let Ok(mut old) = runtime.lock() else { return };
+    let next = old.fresh_realm();
+    drop(old);
+    *runtime = std::sync::Arc::new(std::sync::Mutex::new(next));
+}
+
 pub struct JsRunner {
+    pub runtime: Runtime,
     pub doc: pdfcraft_js::DocInfo,
     pub doc_scripts: Vec<String>,
     pub output: JsOutput,
-    /// Immutable document snapshot from the start of the edit (for widget `display`).
-    cos: pdfcraft_cos::Document,
-    // `cos` is the same immutable pre-edit snapshot for the runner's lifetime. Cache only
-    // its scalar display readings, not COS objects: large forms exceed the object cache and
-    // otherwise reparse every widget for every calculation. Values/flags still come from
-    // the live `fields` snapshot on each call. A new edit gets a new runner and cache.
-    displays: std::collections::HashMap<pdfcraft_cos::ObjRef, i32>,
-    calculations: Option<std::sync::Arc<Vec<(String, String)>>>,
+    pub(crate) refused: Option<String>,
+    pub(crate) callbacks_touched_realm: bool,
+    #[cfg(not(target_arch = "wasm32"))]
+    callback_started: Option<std::time::Instant>,
+    /// Source/order cache for this edit only; each callback still snapshots current field values.
+    calculations: Option<Vec<(usize, String)>>,
+    // Cache at most 4,096 field identities in the current edit. Entries only survive value-only
+    // callbacks. Appearance and structural edits clear them before the next snapshot.
+    snapshot_fields: std::collections::HashMap<pdfcraft_cos::ObjRef, pdfcraft_js::FieldState>,
+    // The last callback's snapshot. A calculation chain changes one or two values per callback,
+    // so the next callback patches those entries instead of rebuilding every field.
+    last_snapshot: Option<std::sync::Arc<Vec<pdfcraft_js::FieldState>>>,
 }
 
 impl JsRunner {
+    pub(crate) fn invalidate_field_snapshots(&mut self) {
+        self.snapshot_fields.clear();
+        self.last_snapshot = None;
+    }
+
+    fn callback_fields(&mut self, doc: &pdfcraft_cos::Document, fields: &[Field]) -> std::sync::Arc<Vec<pdfcraft_js::FieldState>> {
+        if let Some(snapshot) = self.last_snapshot.as_mut()
+            && snapshot.len() == fields.len()
+            && snapshot.iter().zip(fields).all(|(state, field)| state.object_id == Some(field_object_id(field.obj)))
+        {
+            let stale = |state: &pdfcraft_js::FieldState, field: &Field| {
+                state.name != field.name
+                    || state.value != field.value
+                    || state.readonly != field.read_only()
+                    || state.required != field.has(pdfcraft_forms::flags::REQUIRED)
+            };
+            if snapshot.iter().zip(fields).any(|(state, field)| stale(state, field)) {
+                for (state, field) in std::sync::Arc::make_mut(snapshot).iter_mut().zip(fields) {
+                    if stale(state, field) {
+                        state.name.clone_from(&field.name);
+                        state.value.clone_from(&field.value);
+                        state.readonly = field.read_only();
+                        state.required = field.has(pdfcraft_forms::flags::REQUIRED);
+                    }
+                }
+            }
+            if let Ok(mut runtime) = self.runtime.lock() {
+                runtime.stamp_fields(snapshot);
+            }
+            return std::sync::Arc::clone(snapshot);
+        }
+        let states = fields
+            .iter()
+            .map(|field| {
+                if self.snapshot_fields.len() >= 4096 && !self.snapshot_fields.contains_key(&field.obj) {
+                    return field_state(doc, field, &self.doc);
+                }
+                let template = self.snapshot_fields.entry(field.obj).or_insert_with(|| {
+                    let mut state = field_state(doc, field, &self.doc);
+                    state.value.clear();
+                    state
+                });
+                let mut state = template.clone();
+                state.name.clone_from(&field.name);
+                state.value.clone_from(&field.value);
+                state.readonly = field.read_only();
+                state.required = field.has(pdfcraft_forms::flags::REQUIRED);
+                state
+            })
+            .collect();
+        let mut states = std::sync::Arc::new(states);
+        if let Ok(mut runtime) = self.runtime.lock() {
+            runtime.stamp_fields(&mut states);
+        }
+        self.last_snapshot = Some(std::sync::Arc::clone(&states));
+        states
+    }
+
+    /// Forget the per-edit calculation plan after a calculation source is changed.
+    pub(crate) fn invalidate_calculations(&mut self) {
+        self.calculations = None;
+    }
+
+    /// Refresh structural/document sources between batch children, retaining the realm,
+    /// accumulated output and the current viewer snapshot. Ordinary value edits reuse caches.
+    pub(crate) fn refresh_after_batch_edit(&mut self, cos: &pdfcraft_cos::Document, edit: &Edit) {
+        if matches!(edit, Edit::SetFieldValue { .. } | Edit::ResetForm { .. } | Edit::ApplyScriptChanges { .. } | Edit::Batch { .. }) {
+            return;
+        }
+        let mut current = Self::new(cos, &self.doc.file_name, self.doc.runtime_highlight);
+        current.doc.zoom = self.doc.zoom;
+        current.doc.page = self.doc.page;
+        self.doc = current.doc;
+        self.doc_scripts = current.doc_scripts;
+        self.calculations = None;
+        self.invalidate_field_snapshots();
+    }
+
     /// A runner for `cos`: what scripts read about the document (pages, info, whether it is
     /// an XFA form) and its document-level scripts, read once. `highlight`: whether the viewer
     /// highlights form fields (`app.runtimeHighlight`).
     pub fn new(cos: &pdfcraft_cos::Document, file_name: &str, highlight: bool) -> JsRunner {
         let xfa = pdfcraft_xfa::xfa_shape(cos).is_some();
+        #[cfg(test)]
+        SNAPSHOT_WORK.with(|c| {
+            let (g, p) = c.get();
+            c.set((g + 1, p));
+        });
         let pages = pdfcraft_model::pages(cos);
         let doc = pdfcraft_js::DocInfo {
             file_name: file_name.to_string(),
             num_pages: pages.len(),
             page: 0,
             info: info(cos),
-            highlight,
             page_boxes: pdfcraft_organize::page_boxes(cos).unwrap_or_default(),
             page_rotations: pages.iter().map(|page| page.rotation(cos)).collect(),
             xfa,
+            zoom: 100.0,
+            runtime_highlight: highlight,
+            icon_epoch: 0,
+            icon_versions: Default::default(),
         };
         // Once XFA owns the form, the PDF container's scripts belong to its fallback view.
         // Keep them in the file and in Document JavaScripts, but do not initialize an
@@ -297,33 +571,40 @@ impl JsRunner {
         // Packets alone are not enough: static XFA and an unlaid-out shell keep their scripts.
         let xfa_active = xfa && pdfcraft_xfa::existing_layout(cos).is_some();
         let doc_scripts = if xfa_active { Vec::new() } else { pdfcraft_forms::document_scripts(cos) };
-        JsRunner { doc, doc_scripts, output: JsOutput::default(), cos: cos.clone(), displays: std::collections::HashMap::new(), calculations: None }
-    }
-
-    fn calculations(&mut self, fields: &[Field]) -> std::sync::Arc<Vec<(String, String)>> {
-        if let Some(calculations) = &self.calculations {
-            return std::sync::Arc::clone(calculations);
+        JsRunner {
+            doc,
+            doc_scripts,
+            output: JsOutput::default(),
+            refused: None,
+            callbacks_touched_realm: false,
+            #[cfg(not(target_arch = "wasm32"))]
+            callback_started: None,
+            runtime: Default::default(),
+            calculations: None,
+            snapshot_fields: Default::default(),
+            last_snapshot: None,
         }
-        let calculations = std::sync::Arc::new(calculation_scripts(&self.cos, fields));
-        self.calculations = Some(std::sync::Arc::clone(&calculations));
-        calculations
     }
 
-    pub(crate) fn invalidate_calculations(&mut self, cos: &pdfcraft_cos::Document) {
-        self.cos = cos.clone();
-        self.displays.clear();
-        self.calculations = None;
+    #[cfg(not(target_arch = "wasm32"))]
+    fn callback_time_left(&mut self) -> std::time::Duration {
+        std::time::Duration::from_secs(10).saturating_sub(self.callback_started.get_or_insert_with(std::time::Instant::now).elapsed())
     }
 }
 
-fn calculation_scripts(cos: &pdfcraft_cos::Document, fields: &[Field]) -> Vec<(String, String)> {
+/// Index calculation sources by PDF object identity, retaining their matching snapshot positions.
+fn calculation_scripts(cos: &pdfcraft_cos::Document, fields: &[Field]) -> Vec<(usize, String)> {
     #[cfg(test)]
-    CALCULATION_SCRIPT_BUILDS.with(|calls| calls.set(calls.get().saturating_add(1)));
+    SNAPSHOT_WORK.with(|c| {
+        let (g, p) = c.get();
+        c.set((g, p + 1));
+    });
+    let by_object: std::collections::HashMap<_, _> = fields.iter().enumerate().map(|(i, f)| (f.obj, (i, f))).collect();
     pdfcraft_forms::calculation_order(cos, fields)
         .fields
         .iter()
         .filter_map(|ordered| {
-            let field = fields.iter().find(|f| f.name == ordered.name)?;
+            let (index, field) = by_object.get(&ordered.obj)?;
             let script = field.actions.scripts.calculate.clone().or_else(|| {
                 let source = pdfcraft_forms::af::calculate_js(&field.actions.calculate)?;
                 Some(match &field.actions.calculate {
@@ -331,29 +612,11 @@ fn calculation_scripts(cos: &pdfcraft_cos::Document, fields: &[Field]) -> Vec<(S
                     _ => source,
                 })
             })?;
-            Some((field.name.clone(), script))
+            Some((*index, script))
         })
         .collect()
 }
 
-#[cfg(test)]
-thread_local! {
-    pub(crate) static CALCULATION_SCRIPT_BUILDS: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
-}
-
-fn calls_calculate_now(script: &str, doc_scripts: &[String]) -> bool {
-    script.contains("calculateNow") || doc_scripts.iter().any(|source| source.contains("calculateNow"))
-}
-
-fn calculations_for_script(
-    cos: &pdfcraft_cos::Document,
-    fields: &[Field],
-    script: &str,
-    doc_scripts: &[String],
-) -> std::sync::Arc<Vec<(String, String)>> {
-    if calls_calculate_now(script, doc_scripts) { std::sync::Arc::new(calculation_scripts(cos, fields)) } else { std::sync::Arc::new(Vec::new()) }
-}
-
 /// The field highlight the last of `requests` that sets it asks for (`app.runtimeHighlight`).
 fn last_highlight(requests: &[Request]) -> Option<bool> {
     requests.iter().rev().find_map(|r| match r {
@@ -374,67 +637,140 @@ fn info(cos: &pdfcraft_cos::Document) -> Vec<(String, String)> {
 }
 
 impl Scripts for JsRunner {
+    fn stopped(&self) -> bool {
+        self.refused.is_some()
+    }
+
     /// Run field `target`'s script for `event` over the form's fields, keeping what it showed and
     /// asked for; a refusal carries its last message.
-    fn run(&mut self, event: FieldEvent, script: &str, target: &Field, value: &str, fields: &[Field]) -> ScriptResult {
-        // As in Acrobat, a failing script leaves the value alone (the error goes to the console).
-        self.run_logged(event, script, target, value, fields, true).unwrap_or_else(|| ScriptResult {
-            rc: true,
-            value: value.to_string(),
-            value_set: false,
-            changes: Vec::new(),
-            message: None,
-        })
-    }
-
-    fn rerun_with_english_dates(&mut self, event: FieldEvent, script: &str, target: &Field, value: &str, fields: &[Field]) -> Option<ScriptResult> {
-        pdfcraft_js::with_english_printd(true, || self.run_logged(event, script, target, value, fields, false))
-    }
-}
-
-impl JsRunner {
-    /// [`Scripts::run`], keeping what the script showed and asked for only when `log`; `None`
-    /// when the script failed.
-    fn run_logged(&mut self, event: FieldEvent, script: &str, target: &Field, value: &str, fields: &[Field], log: bool) -> Option<ScriptResult> {
-        let states: Vec<_> = fields
-            .iter()
-            .map(|f| {
-                let display = match f.widgets.first() {
-                    Some(w) => *self.displays.entry(w.obj).or_insert_with(|| display(&self.cos, f)),
-                    None => pdfcraft_js::DISPLAY_VISIBLE,
-                };
-                field_state_with_display(f, display)
-            })
-            .collect();
-        let states = std::sync::Arc::new(states);
-        let ev = pdfcraft_js::Event::field(event.name(), &target.name, value);
-        let calculations = if calls_calculate_now(script, &self.doc_scripts) { self.calculations(fields) } else { std::sync::Arc::new(Vec::new()) };
-        let o = pdfcraft_js::run_shared_calculations_shared(
-            script,
-            &ev,
-            &self.doc,
-            std::sync::Arc::clone(&states),
-            &self.doc_scripts,
-            &calculations,
-            Limits::default(),
-        );
-        if log {
-            self.output.absorb(&o);
+    fn run(&mut self, event: FieldEvent, script: &str, target: &Field, value: &str, fields: &[Field], doc: &pdfcraft_cos::Document) -> ScriptResult {
+        let unchanged = || ScriptResult { rc: true, value: value.to_string(), value_set: false, changes: Vec::new(), message: None };
+        if self.stopped() {
+            return unchanged();
+        }
+        #[cfg(not(target_arch = "wasm32"))]
+        if self.callback_time_left().is_zero() {
+            self.refused = Some("form script callbacks exceeded their shared execution budget".into());
+            return unchanged();
+        }
+        let states = self.callback_fields(doc, fields);
+        let mut ev = pdfcraft_js::Event::field(event.name(), &target.name, value);
+        ev.target_id = Some((u64::from(target.obj.num) << 16) | u64::from(target.obj.generation));
+        let calculations = self.calculations.get_or_insert_with(|| calculation_scripts(doc, fields)).clone();
+        let job = pdfcraft_js::session::Job {
+            script: script.into(),
+            event: ev,
+            doc: self.doc.clone(),
+            fields: states,
+            doc_scripts: self.doc_scripts.clone(),
+            calculations,
+        };
+        #[cfg(not(target_arch = "wasm32"))]
+        let remaining = self.callback_time_left();
+        let o = match self.runtime.lock() {
+            #[cfg(not(target_arch = "wasm32"))]
+            Ok(mut runtime) if !remaining.is_zero() => runtime.run_with_limit(job, &[], remaining),
+            #[cfg(not(target_arch = "wasm32"))]
+            Ok(_) => Outcome {
+                execution_refused: true,
+                realm_untouched: true,
+                error: Some("form script callbacks exceeded their shared execution budget".into()),
+                ..Default::default()
+            },
+            #[cfg(target_arch = "wasm32")]
+            Ok(mut runtime) => runtime.run(job, &[]),
+            Err(_) => Outcome { execution_refused: true, error: Some("document script runtime is unavailable".into()), ..Default::default() },
+        };
+        self.callbacks_touched_realm |= !o.realm_untouched;
+        self.output.absorb(&o);
+        if o.execution_refused || o.reset_limit_exceeded || o.calculation_limit_exceeded {
+            self.refused = Some(o.error.clone().unwrap_or_else(|| "form script exceeded its execution budget".into()));
+        }
+        if o.error.is_some() || o.reset_limit_exceeded || o.calculation_limit_exceeded {
+            // As in Acrobat, a failing script leaves the value alone (the error goes to the console).
+            return unchanged();
         }
         // The edit's later scripts read the field highlight this one set.
         if let Some(on) = last_highlight(&o.requests) {
-            self.doc.highlight = on;
+            self.doc.runtime_highlight = on;
         }
-        if o.error.is_some() {
-            return None;
+        // Most field callbacks only set event.value. Hand the unique snapshot to the
+        // session so stamping field identities does not clone every field. Reconstruct
+        // the baseline only for a callback that also wrote to Field objects.
+        let changes = if o.changed.is_empty() {
+            Vec::new()
+        } else {
+            let baseline = self.callback_fields(doc, fields);
+            changes(&baseline, &o.changed, &o.formatted)
+        };
+        if changes.iter().any(|change| {
+            *change != FieldChange { name: change.name.clone(), object: change.object, value: change.value.clone(), ..Default::default() }
+        }) {
+            self.invalidate_field_snapshots();
         }
-        Some(ScriptResult {
+        ScriptResult {
             rc: o.rc,
             value: o.value.clone(),
             value_set: o.value_set,
-            changes: changes(&states, &o.changed, &o.formatted),
+            changes,
             message: (!o.rc).then(|| o.alerts.last().map(|m| m.text.clone())).flatten(),
-        })
+        }
+    }
+
+    /// Retry appearance formatting in isolation so the font fallback cannot replay persistent side effects.
+    fn rerun_with_english_dates(
+        &mut self,
+        event: FieldEvent,
+        script: &str,
+        target: &Field,
+        value: &str,
+        fields: &[Field],
+        doc: &pdfcraft_cos::Document,
+    ) -> Option<ScriptResult> {
+        if self.stopped() {
+            return None;
+        }
+        #[cfg(not(target_arch = "wasm32"))]
+        if self.callback_time_left().is_zero() {
+            self.refused = Some("form script callbacks exceeded their shared execution budget".into());
+            return None;
+        }
+        let states = self.callback_fields(doc, fields);
+        let mut ev = pdfcraft_js::Event::field(event.name(), &target.name, value);
+        ev.target_id = Some(field_object_id(target.obj));
+        let calculations = self.calculations.get_or_insert_with(|| calculation_scripts(doc, fields));
+        #[cfg(target_arch = "wasm32")]
+        let o = pdfcraft_js::with_english_printd(true, || {
+            pdfcraft_js::run_shared_calculations(script, &ev, &self.doc, states, &self.doc_scripts, calculations, Limits::default())
+        });
+        #[cfg(not(target_arch = "wasm32"))]
+        let o = {
+            let job = pdfcraft_js::session::Job {
+                script: script.into(),
+                event: ev,
+                doc: self.doc.clone(),
+                fields: states,
+                doc_scripts: self.doc_scripts.clone(),
+                calculations: calculations.clone(),
+            };
+            let remaining = self.callback_time_left();
+            let outcome = if remaining.is_zero() {
+                Outcome { execution_refused: true, ..Default::default() }
+            } else if let Ok(mut runtime) = self.runtime.lock() {
+                runtime.run_english_retry(job, remaining)
+            } else {
+                Outcome { execution_refused: true, error: Some("document script runtime is unavailable".into()), ..Default::default() }
+            };
+            if outcome.execution_refused {
+                self.refused = Some(outcome.error.unwrap_or_else(|| "form script callbacks exceeded their shared execution budget".into()));
+                return None;
+            }
+            outcome
+        };
+        if o.error.is_some() || o.reset_limit_exceeded || o.calculation_limit_exceeded {
+            return None;
+        }
+        Some(ScriptResult { rc: o.rc, value: o.value.clone(), value_set: o.value_set, changes: Vec::new(), message: None })
     }
 }
 
@@ -479,10 +815,50 @@ impl SignEvent {
     }
 }
 
+/// A PDF document action dispatched by the host through its existing AcroForm session.
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum DocumentScriptEvent {
+    CatalogOpen,
+    WillSave,
+    WillPrint,
+}
+
+impl DocumentScriptEvent {
+    fn name(self) -> &'static str {
+        match self {
+            Self::CatalogOpen => "Open",
+            Self::WillSave => "WillSave",
+            Self::WillPrint => "WillPrint",
+        }
+    }
+
+    /// Where the catalog keeps this event's actions.
+    fn trigger(self) -> pdfcraft_forms::DocumentTrigger {
+        match self {
+            Self::CatalogOpen => pdfcraft_forms::DocumentTrigger::Open,
+            Self::WillSave => pdfcraft_forms::DocumentTrigger::WillSave,
+            Self::WillPrint => pdfcraft_forms::DocumentTrigger::WillPrint,
+        }
+    }
+}
+
+/// Keep only what a script that ran unasked (on opening, before saving or printing) may ask
+/// the viewer for: highlighting, zoom, focus and the page shown. Opening a URL, a file, mail or
+/// a dialog needs a click.
+fn unasked_requests(requests: &mut Vec<Request>) {
+    requests
+        .retain(|r| matches!(r, Request::Highlight(_) | Request::Zoom(_) | Request::Focus(_) | Request::FocusField { .. } | Request::GoToPage(_)));
+}
+
 impl Session {
     /// Preferences ▸ JavaScript ▸ Enable Acrobat JavaScript (on by default).
     pub fn set_javascript(&mut self, on: bool) {
         self.js_off = !on;
+        if !on {
+            for doc in &mut self.docs {
+                replace_runtime(&mut doc.js_runtime);
+            }
+        }
     }
 
     /// Whether JavaScript is on (Preferences ▸ JavaScript ▸ Enable Acrobat JavaScript).
@@ -523,13 +899,33 @@ impl Session {
     /// change runs it) isn't run a second time. Returns whether the document changed; what the
     /// scripts showed or asked for is in [`Session::take_js_output`].
     pub fn field_focus(&mut self, id: DocId, name: &str, widget: usize, focus: FieldFocus) -> Result<bool, EditError> {
+        self.field_focus_target(id, name, None, widget, focus)
+    }
+
+    /// [`Session::field_focus`] for the field object `target` ([`field_object_id`]) when given:
+    /// of fields sharing `name`, the one that gained or lost focus runs its own script.
+    pub fn field_focus_target(&mut self, id: DocId, name: &str, target: Option<u64>, widget: usize, focus: FieldFocus) -> Result<bool, EditError> {
         if self.js_off {
             return Ok(false);
         }
         let doc = self.doc_mut(id)?;
-        let Some(tpl) = doc.xfa_template.clone().filter(|t| pdfcraft_xfa::has_focus_scripts(t)) else { return Ok(false) };
+        let Some(tpl) = doc.xfa_template.clone().filter(|t| pdfcraft_xfa::has_focus_scripts(t)) else {
+            // An AcroForm widget's own On Focus / On Blur JavaScript (#269).
+            let trigger = match focus {
+                FieldFocus::Enter => pdfcraft_forms::Trigger::OnFocus,
+                FieldFocus::Exit => pdfcraft_forms::Trigger::OnBlur,
+            };
+            return self.field_trigger_target(id, name, target, widget, trigger);
+        };
         let Some(cos) = doc.editor.as_ref().map(|e| &e.cos) else { return Ok(false) };
-        let Some(som) = doc.form.iter().find(|f| f.name == name).and_then(|f| crate::xfa::widget_som(cos, f, widget)) else { return Ok(false) };
+        let Some(som) = doc
+            .form
+            .iter()
+            .find(|f| f.name == name && target.is_none_or(|t| field_object_id(f.obj) == t))
+            .and_then(|f| crate::xfa::widget_som(cos, f, widget))
+        else {
+            return Ok(false);
+        };
         let activity = match focus {
             FieldFocus::Enter => "enter",
             FieldFocus::Exit => "exit",
@@ -547,6 +943,85 @@ impl Session {
         Ok(self.get(id).is_some_and(|d| d.generation != before))
     }
 
+    /// Widget `widget` (0-based) of AcroForm field `name` in document `id` saw `trigger`: the
+    /// pointer entered, left, pressed or released it, or it gained or lost the focus. Run that
+    /// widget's JavaScript action for the trigger, if it has one, in the document's realm, with
+    /// `event.type` "Field" and `event.name` "Mouse Enter", "Mouse Exit", "Mouse Down", "Mouse
+    /// Up", "Focus" or "Blur" (#269, ported from #344), then those of the actions chained after
+    /// it (`/Next`). What each action changes is one undoable edit.
+    /// Returns whether the document changed; what the script showed or asked for is in
+    /// [`Session::take_js_output`]. Pointer and focus scripts run unasked, so they may not
+    /// print, open Save As or show a panel; Mouse Down and Mouse Up come from a click and may.
+    /// Nothing runs on an XFA form (its own events run instead), with JavaScript off, or for a
+    /// widget with no JavaScript for the trigger.
+    pub fn field_trigger(&mut self, id: DocId, name: &str, widget: usize, trigger: pdfcraft_forms::Trigger) -> Result<bool, EditError> {
+        self.field_trigger_target(id, name, None, widget, trigger)
+    }
+
+    /// [`Session::field_trigger`] for the field object `target` ([`field_object_id`]) when given:
+    /// of fields sharing `name`, the one the pointer is on runs its own script.
+    pub fn field_trigger_target(
+        &mut self,
+        id: DocId,
+        name: &str,
+        target: Option<u64>,
+        widget: usize,
+        trigger: pdfcraft_forms::Trigger,
+    ) -> Result<bool, EditError> {
+        use pdfcraft_forms::Trigger;
+        if self.js_off {
+            return Ok(false);
+        }
+        let doc = self.get(id).ok_or(EditError::NoDocument)?;
+        if doc.info.xfa.is_some() {
+            return Ok(false);
+        }
+        let Some(cos) = doc.editor.as_ref().map(|e| &e.cos) else { return Ok(false) };
+        let field = doc
+            .form
+            .iter()
+            .find(|f| f.name == name && target.is_none_or(|t| field_object_id(f.obj) == t))
+            .ok_or_else(|| EditError::Invalid(format!("there is no field named {name:?}")))?;
+        let Some(w) = field.widgets.get(widget) else { return Ok(false) };
+        let scripts = pdfcraft_forms::widget_scripts(cos, w.obj, trigger);
+        if scripts.is_empty() {
+            return Ok(false);
+        }
+        let target_id = Some(field_object_id(field.obj));
+        let event = match trigger {
+            Trigger::OnFocus => "Focus",
+            Trigger::OnBlur => "Blur",
+            other => other.label(),
+        };
+        let before = doc.generation;
+        let mut out = JsOutput::default();
+        // Each action of a /Next chain runs on its own, as Acrobat runs them: one that fails
+        // doesn't stop the next.
+        for script in scripts {
+            let o = match self.run_javascript_job(id, &script, (Some(name), target_id), &[], Some(event), false) {
+                Ok(o) => o,
+                Err(e) => {
+                    out.errors.push(e.to_string());
+                    continue;
+                }
+            };
+            if matches!(trigger, Trigger::MouseUp | Trigger::MouseDown) {
+                out.append(JsOutput {
+                    alerts: o.alerts,
+                    console: o.console,
+                    requests: o.requests,
+                    errors: o.error.into_iter().chain(o.doc_errors.iter().cloned()).collect(),
+                    doc_errors: o.doc_errors,
+                });
+            } else {
+                out.absorb(&o);
+            }
+        }
+        let doc = self.doc_mut(id)?;
+        doc.js_output.append(out);
+        Ok(doc.generation != before)
+    }
+
     /// Run signature field `field`'s XFA signing scripts for `event` in document `id`: `preSign`
     /// before it is signed, `postSign` after, as one undoable step, as a form's signing events run
     /// (DA 31's dates the signature and locks the date). `Ok(false)`, with nothing changed, when
@@ -582,16 +1057,122 @@ impl Session {
     /// the console (no target). Field changes and `resetForm` are applied as one undoable step;
     /// everything else the script asked for is returned.
     pub fn run_javascript(&mut self, id: DocId, script: &str, target: Option<&str>) -> Result<Outcome, EditError> {
+        self.run_javascript_answers(id, script, target, &[])
+    }
+
+    /// Run a button/console event with ordered headless prompt answers and commit field changes as one undo step.
+    pub fn run_javascript_answers(
+        &mut self,
+        id: DocId,
+        script: &str,
+        target: Option<&str>,
+        answers: &[Option<String>],
+    ) -> Result<Outcome, EditError> {
+        self.run_javascript_answers_target(id, script, target, None, answers)
+    }
+    /// Run with an optional exact PDF field identity; name-only callers keep first-match behavior.
+    pub fn run_javascript_target(&mut self, id: DocId, script: &str, target: Option<&str>, target_id: Option<u64>) -> Result<Outcome, EditError> {
+        self.run_javascript_answers_target(id, script, target, target_id, &[])
+    }
+    /// Exact-target counterpart of run_javascript_answers, including deterministic prompt replies.
+    pub fn run_javascript_answers_target(
+        &mut self,
+        id: DocId,
+        script: &str,
+        target: Option<&str>,
+        target_id: Option<u64>,
+        answers: &[Option<String>],
+    ) -> Result<Outcome, EditError> {
+        self.run_javascript_job(id, script, (target, target_id), answers, None, false)
+    }
+
+    pub(crate) fn run_opening_javascript(&mut self, id: DocId) -> Result<Outcome, EditError> {
+        self.run_javascript_job(id, "", (None, None), &[], None, true)
+    }
+
+    /// Opening document `id`: its document-level scripts run once, then the catalog
+    /// `/OpenAction`'s JavaScript, in the document's retained realm (#269). Not on an XFA form
+    /// (its own opening scripts run instead) or with JavaScript off. What they showed or asked
+    /// for waits in [`Session::take_js_output`].
+    pub(crate) fn run_open_scripts(&mut self, id: DocId) {
+        if self.js_off {
+            return;
+        }
+        let Some(doc) = self.get(id).filter(|d| d.info.xfa.is_none()) else { return };
+        let has_document_scripts = !doc.document_scripts().is_empty();
+        let opens =
+            doc.editor.as_ref().map(|e| pdfcraft_forms::document_action_scripts(&e.cos, pdfcraft_forms::DocumentTrigger::Open)).unwrap_or_default();
+        if !has_document_scripts && opens.is_empty() {
+            return;
+        }
+        let mut out = JsOutput::default();
+        if has_document_scripts && opens.is_empty() {
+            match self.run_opening_javascript(id) {
+                Ok(o) => out.absorb(&o),
+                Err(e) => out.errors.push(e.to_string()),
+            }
+        }
+        // The first open action initializes the realm with the document scripts too.
+        out.append(self.run_actions(id, DocumentScriptEvent::CatalogOpen, &opens));
+        unasked_requests(&mut out.requests);
+        if let Some(doc) = self.docs.iter_mut().find(|d| d.id == id) {
+            doc.js_output.append(out);
+        }
+    }
+
+    /// Run the catalog's JavaScript actions for document event `event` (`/AA /WS` before a save,
+    /// `/AA /WP` before printing, `/OpenAction` on opening) in document `id`'s retained realm.
+    /// Each action's field changes are one undoable edit. A failing action is reported in the
+    /// output and the next one still runs; it never stops the save or print, which must not
+    /// lose the user's work. Requests are limited to what an unasked script may make. With
+    /// JavaScript off, on an XFA form, or with no such action, nothing runs.
+    pub fn run_document_actions(&mut self, id: DocId, event: DocumentScriptEvent) -> JsOutput {
+        if self.js_off {
+            return JsOutput::default();
+        }
+        let Some(doc) = self.get(id).filter(|d| d.info.xfa.is_none()) else { return JsOutput::default() };
+        let scripts = doc.editor.as_ref().map(|e| pdfcraft_forms::document_action_scripts(&e.cos, event.trigger())).unwrap_or_default();
+        self.run_actions(id, event, &scripts)
+    }
+
+    fn run_actions(&mut self, id: DocId, event: DocumentScriptEvent, scripts: &[String]) -> JsOutput {
+        let mut out = JsOutput::default();
+        for script in scripts {
+            match self.run_javascript_job(id, script, (None, None), &[], Some(event.name()), event == DocumentScriptEvent::CatalogOpen) {
+                Ok(o) => out.absorb(&o),
+                Err(e) => out.errors.push(format!("{} script: {e}", event.name())),
+            }
+        }
+        unasked_requests(&mut out.requests);
+        out
+    }
+
+    /// Run an explicitly dispatched PDF document action in the document's retained runtime.
+    pub fn run_document_script_event(&mut self, id: DocId, event: DocumentScriptEvent, script: &str) -> Result<Outcome, EditError> {
+        self.run_javascript_job(id, script, (None, None), &[], Some(event.name()), false)
+    }
+
+    /// Route generated XFA clicks to the XFA engine, or run a synchronous AcroForm job and apply its outcome.
+    fn run_javascript_job(
+        &mut self,
+        id: DocId,
+        script: &str,
+        (target, target_id): (Option<&str>, Option<u64>),
+        answers: &[Option<String>],
+        event_name: Option<&'static str>,
+        opening: bool,
+    ) -> Result<Outcome, EditError> {
         if self.js_off {
             return Err(EditError::Invalid("JavaScript is turned off (Preferences ▸ JavaScript)".into()));
         }
         let doc = self.get(id).ok_or(EditError::NoDocument)?;
         let cos = doc.editor.as_ref().map(|e| e.cos.clone()).ok_or_else(|| EditError::ReadOnly(doc.read_only_reason.clone().unwrap_or_default()))?;
-        // A button PdfCraft generated from an XFA template runs its XFA click script (the app runs
-        // click scripts for buttons only, so other fields' click events don't run here either).
+        validate_script_target(target, target_id, &doc.form)?;
+        // A button PdfCraft generated from an XFA template runs its XFA click script.
         if let Some(t) = target
+            && event_name.is_none_or(|n| n == "Mouse Up")
             && let Some(tpl) = doc.xfa_template.clone()
-            && let Some(field) = doc.form.iter().find(|f| f.name == t)
+            && let Some(field) = doc.form.iter().find(|f| f.name == t && target_id.is_none_or(|id| field_object_id(f.obj) == id))
             && field.kind == crate::FormFieldKind::PushButton
             && let Some(som) = crate::xfa::clickable_som(&cos, &tpl, field)
         {
@@ -606,24 +1187,53 @@ impl Session {
                 ..Default::default()
             });
         }
-        let runner = JsRunner::new(&cos, &doc.name, self.field_highlight);
+        let mut runner = JsRunner::new(&cos, &doc.name, self.field_highlight);
+        runner.doc.zoom = doc.js_zoom;
+        runner.doc.page = doc.js_page;
         let fields = pdfcraft_forms::fields(&cos);
-        let states = std::sync::Arc::new(fields.iter().map(|f| field_state(&cos, f)).collect::<Vec<_>>());
+        let states = std::sync::Arc::new(fields.iter().map(|f| field_state(&cos, f, &runner.doc)).collect::<Vec<_>>());
         let event = match target {
-            Some(t) => pdfcraft_js::Event { will_commit: false, ..pdfcraft_js::Event::field("Mouse Up", t, "") },
-            None => pdfcraft_js::Event::doc("Console"),
+            Some(t) => pdfcraft_js::Event { will_commit: false, target_id, ..pdfcraft_js::Event::field(event_name.unwrap_or("Mouse Up"), t, "") },
+            None => pdfcraft_js::Event::doc(event_name.unwrap_or("Console")),
         };
-        let calculations = calculations_for_script(&cos, &fields, script, &runner.doc_scripts);
-        let mut o = pdfcraft_js::run_shared_calculations_shared(
-            script,
-            &event,
-            &runner.doc,
-            std::sync::Arc::clone(&states),
-            &runner.doc_scripts,
-            &calculations,
-            Limits::default(),
+        let calculations = calculation_scripts(&cos, &fields);
+        let runtime = doc.js_runtime.clone();
+        let o = runtime.lock().map_err(|_| EditError::Invalid("document script runtime is unavailable".into()))?.run(
+            pdfcraft_js::session::Job {
+                script: script.into(),
+                event,
+                doc: runner.doc,
+                fields: states.clone(),
+                doc_scripts: runner.doc_scripts,
+                calculations,
+            },
+            answers,
         );
-        let changes = changes(&states, &o.changed, &o.formatted);
+        let discard = o.execution_refused && !o.realm_untouched;
+        let result = self.apply_script_outcome(id, &states, o, opening);
+        if discard || result.is_err() {
+            self.invalidate_javascript(id);
+        }
+        result
+    }
+
+    /// Convert the worker snapshot delta and reset requests into permission-checked atomic document edits.
+    fn apply_script_outcome(&mut self, id: DocId, states: &[pdfcraft_js::FieldState], mut o: Outcome, opening: bool) -> Result<Outcome, EditError> {
+        if o.execution_refused {
+            o.changed.clear();
+            o.requests.clear();
+            return Ok(o);
+        }
+        if o.calculation_limit_exceeded {
+            return Err(EditError::Invalid(o.error.unwrap_or_else(|| "script calculation work limit exceeded".into())));
+        }
+        if o.reset_limit_exceeded {
+            return Err(EditError::Invalid("script reset call limit exceeded; no script edits were committed".into()));
+        }
+        if o.requests.iter().any(|r| matches!(r, Request::Reset(_))) {
+            let doc = self.get(id).ok_or(EditError::NoDocument)?;
+            validate_reset_work(&doc.form, states, &o.requests)?;
+        }
         let resets: Vec<Vec<String>> = o
             .requests
             .iter()
@@ -633,18 +1243,47 @@ impl Session {
             })
             .collect();
         o.requests.retain(|r| !matches!(r, Request::Reset(_)));
+        // Reset the PDF first, then apply the final live shadow. Compare against the
+        // reset baseline so writes restoring an original value are not mistaken for no-ops.
+        let mut baseline = std::borrow::Cow::Borrowed(states);
+        let mut reset_document = if resets.is_empty() {
+            None
+        } else {
+            let doc = self.get(id).ok_or(EditError::NoDocument)?;
+            let editor = doc.editor.as_ref().ok_or_else(|| EditError::ReadOnly(doc.read_only_reason.clone().unwrap_or_default()))?;
+            Some(editor.cos.clone())
+        };
         // The calculations the script's changes set off read the field highlight it asked for.
         if let Some(on) = last_highlight(&o.requests) {
             self.field_highlight = on;
         }
         let mut edits = Vec::new();
+        for names in resets {
+            let names = (!names.is_empty())
+                .then(|| states.iter().filter(|field| reset_name_matches(&field.name, &names)).map(|field| field.name.clone()).collect::<Vec<_>>());
+            if let Some(doc) = reset_document.as_mut() {
+                // The preview includes dependent calculation writes as well as direct resets.
+                let (reset, recalculated) = pdfcraft_forms::reset_with_counts(doc, names.as_deref())?;
+                if !opening || reset != 0 || recalculated != 0 {
+                    edits.push(Edit::ResetForm { names });
+                }
+            }
+        }
+        if let Some(doc) = reset_document {
+            let mut values = std::collections::HashMap::new();
+            for field in pdfcraft_forms::fields(&doc) {
+                values.entry((u64::from(field.obj.num) << 16) | u64::from(field.obj.generation)).or_insert(field.value);
+            }
+            for field in baseline.to_mut() {
+                if let Some(value) = field.object_id.and_then(|id| values.get(&id)) {
+                    field.value.clone_from(value);
+                }
+            }
+        }
+        let changes = changes(&baseline, &o.changed, &o.formatted);
         if !changes.is_empty() {
             edits.push(Edit::ApplyScriptChanges { changes });
         }
-        if !resets.is_empty() {
-            let all: Vec<&str> = fields.iter().map(|f| f.name.as_str()).collect();
-            edits.push(Edit::ResetForm { names: reset_targets(&all, &resets) });
-        }
         if !edits.is_empty() {
             self.apply(id, Edit::Batch { label: "Run JavaScript".into(), edits })?;
         }
@@ -652,21 +1291,6 @@ impl Session {
     }
 }
 
-/// The fields every `resetForm` call of one script asked for, as one reset: a reset is to the
-/// defaults, so resetting the union once does what each call in turn would, and recalculates
-/// once. `None` is the whole form (a call with no names). A field is named by a selector that
-/// is its name or the name of a field above it, looked up in a set of the selectors, so the
-/// work is the fields times their depth, not the fields times the selectors, which a script
-/// controls.
-fn reset_targets(fields: &[&str], requests: &[Vec<String>]) -> Option<Vec<String>> {
-    if requests.iter().any(Vec::is_empty) {
-        return None;
-    }
-    let wanted: std::collections::HashSet<&str> = requests.iter().flatten().map(String::as_str).collect();
-    let matched = |name: &str| name.match_indices('.').map(|(i, _)| &name[..i]).chain(std::iter::once(name)).any(|p| wanted.contains(p));
-    Some(fields.iter().filter(|n| matched(n)).map(|n| n.to_string()).collect())
-}
-
 /// A page's words for form-field detection, in user space (underscore runs split from the
 /// text around them).
 fn detection_words(text: &pdfcraft_render::PageText, info: &pdfcraft_render::PageInfo) -> Vec<pdfcraft_forms::detect::Word> {
@@ -816,26 +1440,6 @@ impl Session {
 mod review_tests {
     use super::*;
 
-    /// Many `resetForm` calls with many selectors over a big form: one reset of the union, found
-    /// by looking each field's name and parents up, not by comparing every field with every
-    /// selector.
-    #[test]
-    fn reset_requests_are_coalesced_and_matched_through_an_index() {
-        let fields: Vec<String> = (0..20_000).map(|i| format!("group{}.row{i}.cell", i % 100)).collect();
-        let names: Vec<&str> = fields.iter().map(String::as_str).collect();
-        let requests: Vec<Vec<String>> = (0..1_000).map(|k| (0..20).map(|j| format!("nothing{}", k * 20 + j)).collect()).collect();
-        let started = std::time::Instant::now();
-        assert_eq!(reset_targets(&names, &requests), Some(Vec::new()), "no selector names a field");
-        let mut requests = requests;
-        requests.push(vec!["group7".into(), "group7.row7.cell".into(), "group8.row8".into()]);
-        let hit = reset_targets(&names, &requests).unwrap();
-        assert_eq!(hit.len(), 200 + 1, "group7 has 200 fields, one more by its exact name");
-        assert!(hit.iter().all(|n| n.starts_with("group7.") || n == "group8.row8.cell"));
-        assert!(started.elapsed() < std::time::Duration::from_secs(5), "{:?}", started.elapsed());
-        requests.push(Vec::new());
-        assert_eq!(reset_targets(&names, &requests), None, "a call without names resets the whole form");
-    }
-
     /// A click returns its own alert when the output waiting in the document is full, and the
     /// waiting output stays.
     #[test]
@@ -995,3 +1599,467 @@ mod review_tests {
         assert!(changes(&before, &[missing], &formatted).is_empty());
     }
 }
+
+#[cfg(test)]
+mod caption_tests {
+    use super::*;
+
+    #[test]
+    /// A setter matching widget zero still updates other widgets whose normal captions differ.
+    fn setting_the_first_widgets_caption_still_emits_a_field_wide_change() {
+        let mut button = pdfcraft_js::FieldState::new("go", pdfcraft_js::FieldType::Button, vec![]);
+        button.caption = Some("First".into());
+        button.caption_mixed = true;
+        let before = vec![button];
+        let outcome = pdfcraft_js::run(
+            "getField('go').buttonSetCaption('First');",
+            &pdfcraft_js::Event::field("Mouse Up", "go", ""),
+            &pdfcraft_js::DocInfo { file_name: "buttons.pdf".into(), num_pages: 1, page: 0, info: vec![], xfa: false, ..Default::default() },
+            &before,
+            &[],
+            Limits::default(),
+        );
+        assert_eq!(outcome.error, None);
+        let changed = changes(&before, &outcome.changed, &outcome.formatted);
+        assert_eq!(changed.len(), 1, "other widgets may have different captions");
+        assert_eq!(changed[0].caption.as_deref(), Some("First"));
+    }
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+pub struct PendingScript {
+    pub id: DocId,
+    generation: u64,
+    runtime: Runtime,
+    states: std::sync::Arc<Vec<pdfcraft_js::FieldState>>,
+    pub receiver: std::sync::mpsc::Receiver<pdfcraft_js::interaction::InteractiveEvent>,
+}
+#[cfg(not(target_arch = "wasm32"))]
+impl Session {
+    /// Check document identity/generation and the JavaScript preference before accepting a worker completion.
+    pub fn script_pending_current(&self, p: &PendingScript) -> bool {
+        !self.js_off && self.get(p.id).is_some_and(|d| d.generation == p.generation && std::sync::Arc::ptr_eq(&d.js_runtime, &p.runtime))
+    }
+    /// Capture the current fields/view and start a native script without blocking the caller on its prompts.
+    pub fn start_javascript(&mut self, id: DocId, script: &str, target: Option<&str>) -> Result<PendingScript, EditError> {
+        self.start_javascript_target(id, script, target, None)
+    }
+    /// Start an asynchronous button event retaining the clicked field's exact identity.
+    pub fn start_javascript_target(
+        &mut self,
+        id: DocId,
+        script: &str,
+        target: Option<&str>,
+        target_id: Option<u64>,
+    ) -> Result<PendingScript, EditError> {
+        if self.js_off {
+            return Err(EditError::Invalid("JavaScript is disabled".into()));
+        }
+        let doc = self.get(id).ok_or(EditError::NoDocument)?;
+        let cos = &doc.editor.as_ref().ok_or_else(|| EditError::ReadOnly(doc.read_only_reason.clone().unwrap_or_default()))?.cos;
+        let mut runner = JsRunner::new(cos, &doc.name, self.field_highlight);
+        runner.doc.zoom = doc.js_zoom;
+        runner.doc.page = doc.js_page;
+        let fields = pdfcraft_forms::fields(cos);
+        validate_script_target(target, target_id, &fields)?;
+        let states = std::sync::Arc::new(fields.iter().map(|f| field_state(cos, f, &runner.doc)).collect::<Vec<_>>());
+        let job = pdfcraft_js::session::Job {
+            script: script.into(),
+            event: target.map_or_else(
+                || pdfcraft_js::Event::doc("Console"),
+                |t| pdfcraft_js::Event { will_commit: false, target_id, ..pdfcraft_js::Event::field("Mouse Up", t, "") },
+            ),
+            doc: runner.doc,
+            fields: states.clone(),
+            doc_scripts: runner.doc_scripts,
+            calculations: calculation_scripts(cos, &fields),
+        };
+        let receiver =
+            doc.js_runtime.lock().map_err(|_| EditError::Invalid("script runtime unavailable".into()))?.start(job).map_err(EditError::Invalid)?;
+        Ok(PendingScript { id, generation: doc.generation, runtime: doc.js_runtime.clone(), states, receiver })
+    }
+    /// Discard only the captured runtime, preserving a newer realm created by an intervening edit.
+    pub fn discard_javascript(&mut self, p: &PendingScript) {
+        if let Some(doc) = self.docs.iter_mut().find(|d| d.id == p.id)
+            && std::sync::Arc::ptr_eq(&doc.js_runtime, &p.runtime)
+        {
+            replace_runtime(&mut doc.js_runtime);
+        }
+    }
+    /// Discard a timed-out invocation and retain the worker slot until its thread exits.
+    pub fn timeout_javascript(&mut self, p: PendingScript) {
+        if self.script_pending_current(&p)
+            && let Ok(mut runtime) = p.runtime.lock()
+        {
+            runtime.retire_timed_out_worker();
+        } else {
+            self.discard_javascript(&p);
+        }
+    }
+
+    /// Apply a current worker result, or discard it and reset the realm when the document changed.
+    pub fn finish_javascript(&mut self, p: PendingScript, out: Outcome) -> Result<Outcome, EditError> {
+        if !self.script_pending_current(&p) {
+            self.discard_javascript(&p);
+            return Err(EditError::Invalid("document changed while the script was running".into()));
+        }
+        p.runtime.lock().map_err(|_| EditError::Invalid("script runtime unavailable".into()))?.acknowledge_completion();
+        let discard = out.execution_refused && !out.realm_untouched;
+        let result = self.apply_script_outcome(p.id, &p.states, out, false);
+        if discard || result.is_err() {
+            self.invalidate_javascript(p.id);
+        }
+        result
+    }
+}
+pub use pdfcraft_js::interaction::{InteractiveEvent, MenuItem, Prompt};
+impl Session {
+    /// Supply current viewer state for script getters, clamping invalid zoom to the supported range.
+    pub fn set_javascript_view(&mut self, id: DocId, zoom: f64, highlight: bool, page: usize) {
+        self.set_field_highlight(highlight);
+        if let Some(doc) = self.docs.iter_mut().find(|d| d.id == id) {
+            doc.js_zoom = if zoom.is_finite() { zoom.clamp(1.0, 6400.0) } else { 100.0 };
+
+            doc.js_page = page;
+        }
+    }
+}
+
+impl Session {
+    /// Release this document runtime after cancellation or lifecycle changes; the next event initializes anew.
+    pub fn invalidate_javascript(&mut self, id: DocId) {
+        if let Some(doc) = self.docs.iter_mut().find(|d| d.id == id) {
+            replace_runtime(&mut doc.js_runtime);
+        }
+    }
+}
+
+#[cfg(test)]
+thread_local! {
+    /// Page-tree snapshots and calculation-plan builds performed on this test thread.
+    static SNAPSHOT_WORK: std::cell::Cell<(usize,usize)> = const { std::cell::Cell::new((0,0)) };
+}
+
+#[cfg(test)]
+mod snapshot_review_tests {
+    use super::*;
+
+    #[test]
+    fn document_actions_use_the_document_realm_and_obey_javascript_setting() {
+        let mut session = Session::new();
+        let bytes = session.create_blank(200.0, 300.0, 1).unwrap();
+        let first = session.open("first.pdf", None, bytes.clone(), None).unwrap();
+        let second = session.open("second.pdf", None, bytes, None).unwrap();
+        session.run_javascript(first, "var counter = 4;", None).unwrap();
+
+        for (event, name) in
+            [(DocumentScriptEvent::CatalogOpen, "Open"), (DocumentScriptEvent::WillSave, "WillSave"), (DocumentScriptEvent::WillPrint, "WillPrint")]
+        {
+            let result = session.run_document_script_event(first, event, "[event.name,counter].join('/');").unwrap();
+            assert_eq!(result.result, Some(format!("{name}/4")));
+        }
+        let result = session.run_document_script_event(second, DocumentScriptEvent::WillSave, "typeof counter;").unwrap();
+        assert_eq!(result.result.as_deref(), Some("undefined"));
+        session.set_javascript(false);
+        assert!(session.run_document_script_event(first, DocumentScriptEvent::WillPrint, "counter++;").is_err());
+    }
+
+    /// Real page/info edits and completed Save As refresh metadata without losing script state.
+    #[test]
+    fn retained_document_metadata_tracks_edits_undo_and_save_as() {
+        let mut session = Session::new();
+        let bytes = session.create_blank(200.0, 300.0, 1).unwrap();
+        let id = session.open("before.pdf", None, bytes, None).unwrap();
+        assert_eq!(session.run_javascript(id, "var retained=41;numPages;", None).unwrap().result.as_deref(), Some("1"));
+        session.apply(id, Edit::InsertBlankPage { at: 1, width: 200.0, height: 300.0 }).unwrap();
+        session.apply(id, Edit::SetInfo { key: "Title".into(), value: "After".into() }).unwrap();
+        let out = session.run_javascript(id, "[numPages,info.title,retained].join('/');", None).unwrap();
+        assert_eq!(out.result.as_deref(), Some("2/After/41"));
+        session.undo(id).unwrap();
+        assert_eq!(session.run_javascript(id, "typeof info.title;", None).unwrap().result.as_deref(), Some("undefined"));
+        session.redo(id).unwrap();
+        let saved = session.save_bytes(id).unwrap();
+        session.mark_saved(id, saved, Some("after.pdf".into())).unwrap();
+        assert_eq!(
+            session.run_javascript(id, "[documentFileName,numPages,info.title,retained].join('/');", None).unwrap().result.as_deref(),
+            Some("after.pdf/2/After/41")
+        );
+        session.apply(id, Edit::DeletePages { pages: vec![1] }).unwrap();
+        assert_eq!(session.run_javascript(id, "[numPages,retained].join('/');", None).unwrap().result.as_deref(), Some("1/41"));
+        session.undo(id).unwrap();
+        assert_eq!(session.run_javascript(id, "numPages;", None).unwrap().result.as_deref(), Some("2"));
+        session.redo(id).unwrap();
+        assert_eq!(session.run_javascript(id, "numPages;", None).unwrap().result.as_deref(), Some("1"));
+    }
+
+    /// A batch child that changes page structure or calculation sources invalidates cached plans.
+    #[test]
+    fn batch_children_refresh_geometry_metadata_and_calculation_sources() {
+        let mut session = Session::new();
+        let bytes = session.create_blank(200.0, 300.0, 1).unwrap();
+        let id = session.open("batch.pdf", None, bytes, None).unwrap();
+        for (i, name) in ["input", "total", "seen"].into_iter().enumerate() {
+            session
+                .apply(
+                    id,
+                    Edit::AddField {
+                        page: 0,
+                        rect: [20.0, 20.0 + i as f64 * 40.0, 120.0, 40.0 + i as f64 * 40.0],
+                        kind: crate::NewField::Text { multiline: false },
+                        name: Some(name.into()),
+                    },
+                )
+                .unwrap();
+        }
+        session.apply(id, Edit::SetFieldValue { name: "input".into(), value: crate::FieldValue::Text("2".into()) }).unwrap();
+        session
+            .apply(
+                id,
+                Edit::SetFieldScript {
+                    name: "total".into(),
+                    event: "calculate".into(),
+                    script: Some("event.value=Number(getField('input').value)+1;".into()),
+                },
+            )
+            .unwrap();
+        session
+            .apply(
+                id,
+                Edit::SetFieldScript {
+                    name: "input".into(),
+                    event: "validate".into(),
+                    script: Some("calculateNow();getField('seen').value=numPages+'/'+getField('total').value;".into()),
+                },
+            )
+            .unwrap();
+        session
+            .apply(
+                id,
+                Edit::Batch {
+                    label: "Structural batch".into(),
+                    edits: vec![
+                        Edit::SetFieldValue { name: "input".into(), value: crate::FieldValue::Text("3".into()) },
+                        Edit::InsertBlankPage { at: 1, width: 200.0, height: 300.0 },
+                        Edit::SetFieldScript {
+                            name: "total".into(),
+                            event: "calculate".into(),
+                            script: Some("event.value=Number(getField('input').value)+10;".into()),
+                        },
+                        Edit::SetFieldValue { name: "input".into(), value: crate::FieldValue::Text("4".into()) },
+                    ],
+                },
+            )
+            .unwrap();
+        let out = session.run_javascript(id, "getField('seen').value;", None).unwrap();
+        assert_eq!(out.error, None);
+        assert_eq!(out.result.as_deref(), Some("2/13"));
+    }
+
+    #[test]
+    fn callback_field_cache_keeps_live_values_and_uses_object_identity() {
+        let mut session = Session::new();
+        let bytes = session.create_blank(200.0, 300.0, 1).unwrap();
+        let id = session.open("cache.pdf", None, bytes, None).unwrap();
+        for (name, rect) in [("first", [20.0, 20.0, 100.0, 40.0]), ("second", [20.0, 60.0, 100.0, 80.0])] {
+            session.apply(id, Edit::AddField { page: 0, rect, kind: crate::NewField::Text { multiline: false }, name: Some(name.into()) }).unwrap();
+        }
+
+        let cos = &session.get(id).unwrap().editor.as_ref().unwrap().cos;
+        let mut fields = pdfcraft_forms::fields(cos);
+        fields[1].name = fields[0].name.clone();
+        let mut runner = JsRunner::new(cos, "cache.pdf", false);
+        let initial = runner.callback_fields(cos, &fields);
+        assert_ne!(initial[0].object_id, initial[1].object_id);
+        assert_ne!(initial[0].rect, initial[1].rect);
+        fields[0].value = vec!["fresh".into()];
+        let updated = runner.callback_fields(cos, &fields);
+        assert_eq!(updated[0].value, ["fresh"]);
+        assert_eq!(updated[1].value, initial[1].value);
+        assert_eq!(runner.snapshot_fields.len(), 2);
+
+        fields[0].widgets[0].rect = [20.0, 100.0, 100.0, 120.0];
+        runner.invalidate_field_snapshots();
+        let moved = runner.callback_fields(cos, &fields[..1]);
+        assert_ne!(moved[0].rect, updated[0].rect);
+        assert_eq!(runner.snapshot_fields.len(), 1);
+    }
+
+    /// A callback reuses the previous callback's snapshot, patching only values that changed,
+    /// and a snapshot a caller still holds is never changed under it.
+    #[test]
+    fn callback_snapshots_are_patched_in_place_and_copied_only_when_shared() {
+        let mut session = Session::new();
+        let bytes = session.create_blank(200.0, 300.0, 1).unwrap();
+        let id = session.open("patch.pdf", None, bytes, None).unwrap();
+        for (name, rect) in [("first", [20.0, 20.0, 100.0, 40.0]), ("second", [20.0, 60.0, 100.0, 80.0])] {
+            session.apply(id, Edit::AddField { page: 0, rect, kind: crate::NewField::Text { multiline: false }, name: Some(name.into()) }).unwrap();
+        }
+        let cos = &session.get(id).unwrap().editor.as_ref().unwrap().cos;
+        let mut fields = pdfcraft_forms::fields(cos);
+        let mut runner = JsRunner::new(cos, "patch.pdf", false);
+        let first = runner.callback_fields(cos, &fields);
+        let first_ptr = std::sync::Arc::as_ptr(&first);
+        drop(first);
+        // Nothing changed: the same snapshot comes back.
+        let same = runner.callback_fields(cos, &fields);
+        assert_eq!(std::sync::Arc::as_ptr(&same), first_ptr);
+        drop(same);
+        // A value changed and no one else holds the snapshot: it is patched in place.
+        fields[1].value = vec!["7".into()];
+        let patched = runner.callback_fields(cos, &fields);
+        assert_eq!(std::sync::Arc::as_ptr(&patched), first_ptr);
+        assert_eq!(patched[1].value, ["7"]);
+        // A held snapshot keeps its values; the next callback gets a copy.
+        fields[0].value = vec!["held".into()];
+        let copied = runner.callback_fields(cos, &fields);
+        assert_eq!(patched[0].value, Vec::<String>::new());
+        assert_eq!(copied[0].value, ["held"]);
+        assert_eq!(copied[1].value, ["7"]);
+        // Instance tokens are stamped before dispatch, so the worker does not copy it again.
+        assert!(copied.iter().all(|f| f.instance_id != 0));
+    }
+
+    /// Operation counts, rather than wall time, pin the absence of per-field tree/plan walks.
+    #[test]
+    fn field_events_reuse_page_geometry_and_calculation_plans() {
+        let mut session = Session::new();
+        let bytes = session.create_blank(600.0, 800.0, 4).unwrap();
+        let id = session.open("synthetic.pdf", None, bytes, None).unwrap();
+        for i in 0..12 {
+            session
+                .apply(
+                    id,
+                    Edit::AddField {
+                        page: i % 4,
+                        rect: [20.0, 20.0, 100.0, 40.0],
+                        kind: crate::NewField::Text { multiline: false },
+                        name: Some(format!("f{i}")),
+                    },
+                )
+                .unwrap();
+        }
+        let cos = &session.get(id).unwrap().editor.as_ref().unwrap().cos;
+        let mut fields = pdfcraft_forms::fields(cos);
+        fields[1].actions.scripts.calculate = Some("event.value=Number(getField('f0').value)+1;".into());
+        SNAPSHOT_WORK.with(|c| c.set((0, 0)));
+        let mut runner = JsRunner::new(cos, "synthetic.pdf", false);
+        for i in 0..8 {
+            fields[0].value = vec![i.to_string()];
+            let out = runner.run(FieldEvent::Calculate, "calculateNow();event.value=getField('f1').value;", &fields[1], "", &fields, cos);
+            assert_eq!(out.value, (i + 1).to_string());
+            assert!(runner.output.errors.is_empty(), "{:?}", runner.output.errors);
+        }
+        let work = SNAPSHOT_WORK.with(std::cell::Cell::get);
+        eprintln!("geometry snapshots={}, calculation plan builds={}", work.0, work.1);
+        assert_eq!(work, (1, 1), "one geometry snapshot and one calculation plan per runner");
+    }
+}
+
+#[cfg(test)]
+mod reset_budget_review_tests {
+    use super::*;
+    fn state(name: String) -> pdfcraft_js::FieldState {
+        pdfcraft_js::FieldState::new(name, pdfcraft_js::FieldType::Text, Vec::new())
+    }
+    #[test]
+    fn reset_budget_accepts_one_selected_field_in_a_large_form() {
+        let states: Vec<_> = (0..1000).map(|i| state(format!("parent.field_{i:04}"))).collect();
+        assert!(validate_reset_work(&[], &states, &[Request::Reset(vec!["parent.field_0001".into()])]).is_ok());
+        assert!(validate_reset_work(&[], &states, &[Request::Reset(vec!["parent".into()])]).is_err());
+    }
+
+    #[test]
+    fn reset_budget_charges_expanded_descendants() {
+        let states: Vec<_> = (0..3000).map(|i| state(format!("parent.{i}"))).collect();
+        assert!(validate_reset_work(&[], &states, &[Request::Reset(vec!["parent".into()])]).is_err());
+        assert!(validate_reset_work(&[], &states, &[Request::Reset(Vec::new())]).is_ok());
+    }
+    #[test]
+    fn reset_budget_charges_shared_prefix_comparisons() {
+        let prefix = "p".repeat(4096);
+        let states: Vec<_> = (0..128).map(|i| state(format!("{prefix}.{i}"))).collect();
+        let names = (0..128).map(|i| format!("{prefix}.missing{i}")).collect();
+        assert!(validate_reset_work(&[], &states, &[Request::Reset(names)]).is_err());
+    }
+    #[test]
+    fn reset_budget_charges_full_form_name_copies() {
+        let states = vec![state("n".repeat(140_000))];
+        let resets = vec![Request::Reset(Vec::new()); 64];
+        assert!(validate_reset_work(&[], &states, &resets).is_err());
+        assert!(validate_reset_work(&[], &states, &[Request::Reset(Vec::new())]).is_ok());
+    }
+}
+
+#[cfg(test)]
+mod widget_budget_review_tests {
+    use super::*;
+    #[test]
+    fn reset_budget_charges_all_widgets() {
+        let widget = pdfcraft_forms::Widget {
+            obj: pdfcraft_cos::ObjRef { num: 1, generation: 0 },
+            page: None,
+            rect: [0.0; 4],
+            on_state: None,
+            state: None,
+            tab: 0,
+            locked: false,
+            hidden: false,
+            read_only: false,
+            rotation: 0,
+            caption: None,
+            mouse_up_script: None,
+            list: None,
+            round: false,
+        };
+        let mut field = Field {
+            name: "x".into(),
+            obj: widget.obj,
+            kind: FieldKind::Text,
+            value: vec![],
+            default: vec![],
+            flags: 0,
+            max_len: None,
+            options: vec![],
+            da: String::new(),
+            quadding: 0,
+            tooltip: None,
+            selected: vec![],
+            single_value_is_array: false,
+            widgets: vec![widget; 140_000],
+            actions: Default::default(),
+            button: None,
+        };
+        let resets = vec![Request::Reset(Vec::new()); 64];
+        assert!(validate_reset_work(std::slice::from_ref(&field), &[], &resets).is_err());
+        field.widgets.truncate(1);
+        assert!(validate_reset_work(&[field], &[], &resets).is_ok());
+    }
+}
+
+#[cfg(test)]
+mod icon_mixed_review_tests {
+    use super::*;
+    /// Mixed widgets need a field-wide icon delta even when the first icon is already correct.
+    #[test]
+    fn mixed_icons_emit_only_after_an_explicit_setter() {
+        for icon in [None, Some(7)] {
+            let mut before = pdfcraft_js::FieldState::new("go", pdfcraft_js::FieldType::Button, vec![]);
+            before.icon = icon;
+            before.icon_mixed = true;
+            let fields = vec![before.clone()];
+            let script =
+                if icon.is_some() { "getField('go').buttonSetIcon(getField('go').buttonGetIcon());" } else { "getField('go').buttonSetIcon(null);" };
+            let out = pdfcraft_js::run(
+                script,
+                &pdfcraft_js::Event::doc("Test"),
+                &pdfcraft_js::DocInfo::default(),
+                &fields,
+                &[],
+                pdfcraft_js::Limits::default(),
+            );
+            assert_eq!(out.error, None);
+            assert_eq!(changes(&[before.clone()], &out.changed, &out.formatted)[0].icon, Some(icon));
+            assert!(changes(&[before.clone()], &[before], &Default::default()).is_empty());
+        }
+    }
+}
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index 161b2c1d34..adb69cec46 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -92,7 +92,9 @@ pub use pdfcraft_organize::check_custom_key;
 pub use pdfcraft_organize::view::{InitialView, Layout as InitialLayout, Magnification, Navigation};
 
 pub use pdfcraft_cos::{Algorithm, civil_from_days};
-pub use pdfcraft_create::{CONVERTIBLE, CreateError, ImageResolution, SourceKind, decode_text, source_kind};
+pub use pdfcraft_create::{
+    CONVERTIBLE, CreateError, IMAGE_EXTENSIONS, ImageResolution, OFFICE_EXTENSIONS, SourceKind, TEXT_EXTENSIONS, decode_text, source_kind,
+};
 pub use pdfcraft_edit::added::{
     CHAR_SPACING_LIMIT as ADDED_CHAR_SPACING_LIMIT, paste_place as added_paste_place, paste_rect as added_paste_rect, text_rect as added_text_rect,
     text_width as added_text_width,
@@ -166,7 +168,7 @@ use pictures::{embed_image, fit_picture, mark_source, model_poster};
 use protection::unrestricted;
 pub use protection::{Changes, Printing, Protection, SecuritySummary};
 pub use session::Session;
-pub use sources::{CombineSource, Combined, combine_source_check, source_page_count};
+pub use sources::{CombineSource, Combined, combine_source_check, office_to_pdf, source_page_count};
 use sources::{open_source, open_source_with};
 #[cfg(test)]
 use test_hooks::{
@@ -198,5 +200,7 @@ fn display_config(config: &pdfcraft_render::RenderConfig) -> pdfcraft_render::Re
 /// How long a custom stamp's text line may be, in characters (#1741).
 pub const MAX_STAMP_LINE: usize = 200;
 
+#[cfg(test)]
+mod document_actions_tests;
 #[cfg(test)]
 mod tests;
diff --git a/crates/engine/src/ocr.rs b/crates/engine/src/ocr.rs
index 539a03a6aa..b2a4717e46 100644
--- a/crates/engine/src/ocr.rs
+++ b/crates/engine/src/ocr.rs
@@ -1156,6 +1156,7 @@ pub struct FileResult {
 }
 
 impl FileResult {
+    /// How many words were recognized on all of the file's pages.
     pub fn words(&self) -> usize {
         self.pages.iter().map(|p| p.words.len()).sum()
     }
@@ -1202,19 +1203,21 @@ pub fn low_confidence_pages(pages: &[OcrPage], threshold: f32) -> Option<(usize,
     (count > 0).then_some((count, page_numbers))
 }
 
-/// Recognize text in multiple files: one PDF's bytes in, the searchable PDF out. `progress`
-/// works as for [`OcrJob::run`]. A file that the skip-files option passes over comes back with
-/// [`FileResult::file_skipped`] set and its original bytes; the caller decides what to do with
-/// it, but it is never an OCR success.
+/// Recognize text in multiple files: one PDF's bytes in, the searchable PDF out. `javascript` is
+/// the caller's [`Session::javascript`] preference (when off, no open-time script runs).
+/// `progress` works as for [`OcrJob::run`]. A file that the skip-files option passes over comes
+/// back with [`FileResult::file_skipped`] set and its original bytes; the caller decides what to
+/// do with it, but it is never an OCR success.
 pub fn recognize_file(
     name: &str,
     bytes: Arc<Vec<u8>>,
     password: Option<&str>,
     settings: OcrSettings,
     recognizers: &Recognizers,
+    javascript: bool,
     progress: impl FnMut(usize, usize) -> bool,
 ) -> Result<FileResult, String> {
-    match FileJob::open(name, bytes, password, settings)? {
+    match FileJob::open(name, bytes, password, settings, javascript)? {
         Opened::Skipped(result) => Ok(result),
         Opened::Read(mut file) => {
             let job = file.job.take().ok_or("the document could not be read")?;
@@ -1242,12 +1245,9 @@ pub enum Opened {
 }
 
 impl FileJob {
-    pub fn open(name: &str, bytes: Arc<Vec<u8>>, password: Option<&str>, settings: OcrSettings) -> Result<Opened, String> {
-        let mut session = Session::new();
-        let id = session.open(name, None, bytes.clone(), password).map_err(|e| e.to_string())?;
-        if let Some(why) = session.get(id).and_then(|d| d.read_only_reason.clone()) {
-            return Err(why);
-        }
+    /// Open the file; `javascript` is as for [`recognize_file`].
+    pub fn open(name: &str, bytes: Arc<Vec<u8>>, password: Option<&str>, settings: OcrSettings, javascript: bool) -> Result<Opened, String> {
+        let (session, id) = open_file(name, bytes.clone(), password, javascript)?;
         let job = session.ocr_job(id, &[], settings.clone()).ok_or("the document could not be read")?;
         // The skip-files probe runs before any engine work: a file with text needs no engine at
         // all, and the original bytes come back unchanged.
@@ -1280,11 +1280,38 @@ impl FileJob {
     }
 }
 
+/// Open one of [`recognize_file`]'s files in a session of its own that keeps the caller's
+/// JavaScript preference; a file that cannot be changed is refused with the reason.
+fn open_file(name: &str, bytes: Arc<Vec<u8>>, password: Option<&str>, javascript: bool) -> Result<(Session, DocId), String> {
+    let mut s = Session::new();
+    // Before the open: open-time (XFA) scripts read it there.
+    s.set_javascript(javascript);
+    let id = s.open(name, None, bytes, password).map_err(|e| e.to_string())?;
+    if let Some(why) = s.get(id).and_then(|d| d.read_only_reason.clone()) {
+        return Err(why);
+    }
+    Ok((s, id))
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
     use crate::export;
 
+    /// #5080: [`recognize_file`] opens each file with the caller's JavaScript preference, so an
+    /// XFA initialize script (it sets an empty `qty` to 2) runs only when that is on. This checks
+    /// the open path without the recognition models, which the end-to-end test needs.
+    #[test]
+    fn files_open_for_recognition_with_the_callers_javascript_preference() {
+        let bytes = Arc::new(pdfcraft_xfa::fixtures::shell(&pdfcraft_xfa::fixtures::scripted_template()));
+        let qty = |javascript| {
+            let (s, id) = open_file("scripted.pdf", bytes.clone(), None, javascript).unwrap();
+            s.get(id).unwrap().form.iter().find(|f| f.name == "qty").unwrap().value.clone()
+        };
+        assert!(qty(false).is_empty(), "the initialize script ran with JavaScript off");
+        assert_eq!(qty(true), ["2"], "the initialize script did not run with JavaScript on");
+    }
+
     /// One 300 × 300 page drawing `content`, with Helvetica as `/F1`.
     fn page(content: &str) -> Arc<Vec<u8>> {
         let pdf = format!(
@@ -1741,7 +1768,7 @@ mod tests {
         let bytes = s.create_from_text("t", "Already typed here").unwrap();
         let (r, fake) = fake_recognizers();
         let settings = OcrSettings { skip_text_files: true, ..Default::default() };
-        let out = recognize_file("t.pdf", bytes.clone(), None, settings, &r, |_, _| true).unwrap();
+        let out = recognize_file("t.pdf", bytes.clone(), None, settings, &r, true, |_, _| true).unwrap();
         assert_eq!(fake.calls(), 0, "the engine never ran");
         assert_eq!(out.bytes.as_ptr(), bytes.as_ptr(), "the original bytes came back");
         assert_eq!(out.file_skipped.as_deref(), Some("the file already contains text"));
@@ -1756,7 +1783,7 @@ mod tests {
         let bytes = s.create_from_text("t", "Already typed here").unwrap();
         let (r, fake) = fake_recognizers();
         let settings = OcrSettings { skip_text_files: true, force_ocr: true, ..Default::default() };
-        let out = recognize_file("t.pdf", bytes, None, settings, &r, |_, _| true).unwrap();
+        let out = recognize_file("t.pdf", bytes, None, settings, &r, true, |_, _| true).unwrap();
         assert_eq!(fake.calls(), 1);
         assert_eq!(out.file_skipped, None);
         assert_eq!(out.words(), 1);
@@ -1770,7 +1797,7 @@ mod tests {
         let bytes = s.create_from_text("t", "A page with text").unwrap();
         let (r, fake) = fake_recognizers();
         let settings = OcrSettings { force_ocr: true, ..Default::default() };
-        let out = recognize_file("t.pdf", bytes, None, settings, &r, |_, _| true).unwrap();
+        let out = recognize_file("t.pdf", bytes, None, settings, &r, true, |_, _| true).unwrap();
         assert_eq!(fake.calls(), 1, "the page's own text did not stop the run");
         assert_eq!(out.pages[0].skipped, None);
     }
@@ -1782,12 +1809,12 @@ mod tests {
         let s = Session::new();
         let bytes = s.create_from_text("t", "A page with text").unwrap();
         let (r, fake) = fake_recognizers();
-        let out = recognize_file("t.pdf", bytes, None, OcrSettings::default(), &r, |_, _| true).unwrap();
+        let out = recognize_file("t.pdf", bytes, None, OcrSettings::default(), &r, true, |_, _| true).unwrap();
         assert_eq!(fake.calls(), 0);
         assert_eq!(out.pages[0].skipped.as_deref(), Some("the page already contains text"));
         assert_eq!(out.words(), 0);
         // Second run over the same (already text-bearing) file: skipped pages again, no calls.
-        let again = recognize_file("t.pdf", out.bytes, None, OcrSettings::default(), &r, |_, _| true).unwrap();
+        let again = recognize_file("t.pdf", out.bytes, None, OcrSettings::default(), &r, true, |_, _| true).unwrap();
         assert_eq!(fake.calls(), 0);
         assert_eq!(again.pages[0].skipped.as_deref(), Some("the page already contains text"));
     }
@@ -1863,14 +1890,14 @@ mod tests {
         let bytes = s.create_from_text("t", "Already typed here").unwrap();
         let (r, fake) = fake_recognizers();
         let skip = OcrSettings { skip_text_files: true, ..Default::default() };
-        let Ok(Opened::Skipped(out)) = FileJob::open("t.pdf", bytes.clone(), None, skip) else { panic!("the file should be skipped") };
+        let Ok(Opened::Skipped(out)) = FileJob::open("t.pdf", bytes.clone(), None, skip, true) else { panic!("the file should be skipped") };
         assert_eq!(out.file_skipped.as_deref(), Some("the file already contains text"));
         let force = OcrSettings { force_ocr: true, ..Default::default() };
-        let Ok(Opened::Read(mut file)) = FileJob::open("t.pdf", bytes.clone(), None, force.clone()) else { panic!("the file should be read") };
+        let Ok(Opened::Read(mut file)) = FileJob::open("t.pdf", bytes.clone(), None, force.clone(), true) else { panic!("the file should be read") };
         let pages = file.job.take().unwrap().run(&r, |_, _| true);
         let out = file.finish(pages).unwrap();
         assert_eq!((fake.calls(), out.words(), out.file_skipped.clone()), (1, 1, None));
-        let whole = recognize_file("t.pdf", bytes, None, force, &r, |_, _| true).unwrap();
+        let whole = recognize_file("t.pdf", bytes, None, force, &r, true, |_, _| true).unwrap();
         // The saved bytes carry a modification time, so two saves a second apart differ there alone.
         assert_eq!((out.pages, out.file_skipped), (whole.pages, whole.file_skipped), "the same as reading it in one call");
     }
diff --git a/crates/engine/src/open.rs b/crates/engine/src/open.rs
index 28dd235928..685ac50432 100644
--- a/crates/engine/src/open.rs
+++ b/crates/engine/src/open.rs
@@ -101,6 +101,7 @@ impl Session {
             Self::draw_captions(&mut document, self.captions.clone());
         }
         self.docs.push(document);
+        self.run_open_scripts(id);
         id
     }
 
@@ -381,6 +382,9 @@ impl Session {
             editor,
             config,
             js_output: Default::default(),
+            js_runtime: Default::default(),
+            js_zoom: 100.0,
+            js_page: 0,
             xfa,
             xfa_template: None,
             xfa_scripts_off: false,
diff --git a/crates/engine/src/print_raster.rs b/crates/engine/src/print_raster.rs
index c5a1295e92..a6076d5b05 100644
--- a/crates/engine/src/print_raster.rs
+++ b/crates/engine/src/print_raster.rs
@@ -59,7 +59,7 @@ pub fn rasterize(doc: &Document, pages: &[usize], raster: &Raster, content: Cont
 }
 
 /// Premultiplied RGBA composed over white paper (opaque), in grey when asked (Rec. 601 luma).
-fn over_white(rgba: &mut [u8], grayscale: bool) {
+pub(crate) fn over_white(rgba: &mut [u8], grayscale: bool) {
     for px in rgba.as_chunks_mut::<4>().0 {
         let gap = 255 - u32::from(px[3]);
         let (r, g, b) = ((u32::from(px[0]) + gap).min(255), (u32::from(px[1]) + gap).min(255), (u32::from(px[2]) + gap).min(255));
diff --git a/crates/engine/src/session.rs b/crates/engine/src/session.rs
index bd83242682..187cc217d8 100644
--- a/crates/engine/src/session.rs
+++ b/crates/engine/src/session.rs
@@ -13,7 +13,7 @@ use crate::{
     BookmarkPage, BookmarkRow, CombineSource, Combined, DataFormat, DocId, Document, Edit, EditError, Hairlines, HairlinesFixed, Hidden,
     ImageResolution, LOW_RESOLUTION_PRINT_DPI, Label, ObjectKind, OptimizeReport, RecoverySnapshot, SignOptions, SourceKind, SplitPart,
     StatusCaptions, SummarySort, TrustStore, XFA_REMOVED_PREFIX, XFA_SCRIPTS_OFF, apply_layer_state, carry_verdict_marks, comment_list,
-    comment_summary, decode_text, display_bytes, display_config, guard, info_fields, js, local_utc_offset, note_warnings, open_source,
+    comment_summary, decode_text, display_bytes, display_config, guard, info_fields, js, local_utc_offset, note_warnings, office_to_pdf, open_source,
     open_source_with, optimize, outline_rows, parse_ymd, print, print_layer_states, print_raster, render_threads, scan_colours,
     set_default_layer_state, shown_under_redactions, signatures_of, source_kind, sync_xfa_state, undrawn_notices, use_layer_choices, writable, xfa,
     xfa_sync_datasets,
diff --git a/crates/engine/src/session/editing.rs b/crates/engine/src/session/editing.rs
index 1584fb5209..a039f56798 100644
--- a/crates/engine/src/session/editing.rs
+++ b/crates/engine/src/session/editing.rs
@@ -8,6 +8,34 @@ use super::{
 };
 use crate::{EditNotice, MarkKind, print_preview_layers};
 
+/// Add scan cover and ink to edits of invisible OCR text, returning no edit for an unchanged draft.
+fn prepare_ocr_text_edit(editor: &mut crate::history::Editor, info: &pdfcraft_render::DocInfo, edit: Edit) -> Option<Edit> {
+    // Rewriting an OCR word (invisible text over a scan) also hides the scanned word: cover it
+    // in the paper's colour and draw the new text in the ink's.
+    Some(match edit {
+        Edit::EditTextBlock { page, block, text, mut style } => {
+            let plain = style == pdfcraft_edit::BlockStyle::default();
+            // Only invisible text is sampled; the blocks are usually cached from opening it.
+            if style.cover.is_none()
+                && let Some(info) = info.pages.get(page)
+                && let Some(b) = editor.text_blocks(page).ok().and_then(|b| b.get(block).filter(|b| b.invisible).cloned())
+                && let Some((paper, ink)) = guard(|| scan_colours::sample(&editor.cos, info, page, &b)).ok().flatten()
+            {
+                style.cover = Some(paper);
+                style.color = style.color.or(Some(ink));
+                // A text edit alone leaves the words it doesn't change as the scan shows them.
+                style.changed_words_only = plain;
+                // Nothing to redraw: leave undo history and the dirty flag alone.
+                if plain && b.same_words(&text) {
+                    return None;
+                }
+            }
+            Edit::EditTextBlock { page, block, text, style }
+        }
+        other => other,
+    })
+}
+
 /// Whether the edit, or any edit inside a batch, deletes pages.
 fn deletes_pages(edit: &Edit) -> bool {
     match edit {
@@ -17,6 +45,83 @@ fn deletes_pages(edit: &Edit) -> bool {
     }
 }
 
+/// Keep edits to the working copy until both the operation and its script callbacks succeed.
+fn run_checked_edit(next: &mut pdfcraft_cos::Document, edit: &Edit, cx: &mut EditCtx) -> Result<(), EditError> {
+    let result = guard(|| run_edit(next, edit, cx))
+        .unwrap_or_else(|m| Err(EditError::Invalid(format!("{} failed unexpectedly ({m}); the document was not changed", edit.label()))));
+    let refusal = cx.js.as_mut().and_then(|runner| runner.refused.take());
+    if refusal.is_some() || result.is_err() {
+        discard_edit_callbacks(cx);
+    }
+    refusal.map_or(result, |reason| Err(EditError::Invalid(reason)))
+}
+
+/// Discard callback effects if PDF commit fails after any code entered the retained realm.
+fn discard_edit_callbacks(cx: &EditCtx) {
+    if let Some(runner) = cx.js.as_ref()
+        && runner.callbacks_touched_realm
+        && let Ok(mut runtime) = runner.runtime.lock()
+    {
+        runtime.reset_after_refusal();
+    }
+}
+
+/// Compare the icon and all of its indirect resources. Conservatively retire on budget exhaustion.
+fn icon_changed(previous: &pdfcraft_cos::Document, restored: &pdfcraft_cos::Document, root: pdfcraft_cos::ObjRef, budget: &mut usize) -> bool {
+    use pdfcraft_cos::Object;
+
+    fn visit(object: &Object, refs: &mut Vec<pdfcraft_cos::ObjRef>, budget: &mut usize, depth: usize) -> Option<()> {
+        *budget = budget.checked_sub(1)?;
+        if depth == 128 {
+            return None;
+        }
+        match object {
+            Object::Ref(reference) => refs.push(*reference),
+            Object::Array(values) => {
+                for value in values {
+                    visit(value, refs, budget, depth + 1)?;
+                }
+            }
+            _ => {
+                if let Some(dict) = object.as_dict() {
+                    for (_, value) in dict.iter() {
+                        visit(value, refs, budget, depth + 1)?;
+                    }
+                }
+            }
+        }
+        Some(())
+    }
+
+    let mut pending = vec![root];
+    let mut seen = std::collections::HashSet::new();
+    while let Some(reference) = pending.pop() {
+        if !seen.insert(reference) {
+            continue;
+        }
+        if *budget == 0 {
+            return true;
+        }
+        let before = previous.get(reference);
+        let after = restored.get(reference);
+        if (!Arc::ptr_eq(&before, &after) && before != after) || visit(&before, &mut pending, budget, 0).is_none() {
+            return true;
+        }
+    }
+    false
+}
+
+fn sync_script_history(doc: &Document, previous: &pdfcraft_cos::Document, restored: &pdfcraft_cos::Document) {
+    if let Ok(mut runtime) = doc.js_runtime.lock() {
+        let mut budget = 250_000;
+        runtime.retire_changed_icons(|id| {
+            let object = pdfcraft_cos::ObjRef::new((id >> 16) as u32, id as u16);
+            icon_changed(previous, restored, object, &mut budget)
+        });
+        runtime.sync_field_ids(doc.form.iter().map(|f| crate::js::field_object_id(f.obj)));
+    }
+}
+
 impl Session {
     /// Apply an edit. On success the previous state is undoable and the view data is refreshed.
     pub fn apply(&mut self, id: DocId, edit: Edit) -> Result<(), EditError> {
@@ -39,6 +144,12 @@ impl Session {
         let highlight = self.field_highlight;
         let xfa_time_scale = self.xfa_time_scale.unwrap_or(1);
         let doc = self.doc_mut(id)?;
+        // An edit must never read globals from a completed-but-unapplied button invocation.
+        // Fork its realm before any edit-triggered calculation, even if the edit later fails.
+        #[cfg(not(target_arch = "wasm32"))]
+        if doc.js_runtime.lock().map_err(|_| EditError::Invalid("script runtime unavailable".into()))?.is_pending() {
+            js::replace_runtime(&mut doc.js_runtime);
+        }
         doc.edit_notices.clear();
         let name = doc.name.clone();
         let is_xfa = doc.info.xfa.is_some();
@@ -57,29 +168,8 @@ impl Session {
         if let Some(p) = editor.cos.permissions() {
             check_permission(&edit, &p)?;
         }
-        // Rewriting an OCR word (invisible text over a scan) also hides the scanned word: cover it
-        // in the paper's colour and draw the new text in the ink's.
-        let edit = match edit {
-            Edit::EditTextBlock { page, block, text, mut style } => {
-                let plain = style == pdfcraft_edit::BlockStyle::default();
-                // Only invisible text is sampled; the blocks are usually cached from opening it.
-                if style.cover.is_none()
-                    && let Some(info) = doc.info.pages.get(page)
-                    && let Some(b) = editor.text_blocks(page).ok().and_then(|b| b.get(block).filter(|b| b.invisible).cloned())
-                    && let Some((paper, ink)) = guard(|| scan_colours::sample(&editor.cos, info, page, &b)).ok().flatten()
-                {
-                    style.cover = Some(paper);
-                    style.color = style.color.or(Some(ink));
-                    // A text edit alone leaves the words it doesn't change as the scan shows them.
-                    style.changed_words_only = plain;
-                    // Nothing to redraw: leave undo history and the dirty flag alone.
-                    if plain && b.same_words(&text) {
-                        return Ok(None);
-                    }
-                }
-                Edit::EditTextBlock { page, block, text, style }
-            }
-            other => other,
+        let Some(edit) = prepare_ocr_text_edit(editor, &doc.info, edit) else {
+            return Ok(None);
         };
         // Nothing to bake: leave undo history and the dirty flag alone.
         if matches!(&edit, Edit::FlattenFillSign) && !pdfcraft_annot::has_visible_fill_sign(&editor.cos) {
@@ -87,13 +177,17 @@ impl Session {
         }
         let mut next = editor.cos.clone();
         if !js_off && uses_scripts(&edit) {
-            cx.js = Some(js::JsRunner::new(&next, &name, highlight));
+            let mut runner = js::JsRunner::new(&next, &name, highlight);
+            runner.runtime = doc.js_runtime.clone();
+            runner.doc.zoom = doc.js_zoom;
+            runner.doc.page = doc.js_page;
+            cx.js = Some(runner);
         }
         cx.renamed_fields.clear();
         cx.redaction_overlays.clear();
+        cx.redaction_marks.clear();
         // `next` is a copy: if the edit fails or crashes, the document is unchanged.
-        guard(|| run_edit(&mut next, &edit, &mut cx))
-            .unwrap_or_else(|m| Err(EditError::Invalid(format!("{} failed unexpectedly ({m}); the document was not changed", edit.label()))))?;
+        run_checked_edit(&mut next, &edit, &mut cx)?;
         // A field's enter or exit scripts that changed nothing leave no edit behind (no undo step,
         // nothing unsaved); what they showed or asked for still goes out. Only an event on its own:
         // a batch keeps the other edits it holds.
@@ -102,11 +196,20 @@ impl Session {
             return Ok(None);
         }
         // Redaction removed what its own interpreter places under the marks. The marks were drawn
-        // over the page as the renderer shows it, so the renderer has the last word.
-        if let Edit::ApplyRedactions { pages } = &edit {
-            let marks: Vec<pdfcraft_redact::Mark> =
-                pdfcraft_redact::marks(&editor.cos).into_iter().filter(|m| pages.as_ref().is_none_or(|p| p.contains(&m.page))).collect();
-            guard(|| shown_under_redactions(&next, &marks, &cx.redaction_overlays, &doc.info.pages, doc.password.as_deref()))
+        // over the page as the renderer shows it, so the renderer has the last word: on every
+        // apply the edit ran, a batch's included.
+        if !cx.redaction_marks.is_empty() {
+            // A batch that deletes a marked page and adds pages cannot be tied back to the marks:
+            // a copy of a page may carry the text the redaction removed from the original only.
+            // Fail closed.
+            let before: std::collections::HashSet<_> = pdfcraft_model::pages(&editor.cos).iter().map(|p| p.obj).collect();
+            let after: std::collections::HashSet<_> = pdfcraft_model::pages(&next).iter().map(|p| p.obj).collect();
+            if cx.redaction_marks.iter().any(|(o, _)| !after.contains(o)) && after.iter().any(|o| !before.contains(o)) {
+                return Err(EditError::Invalid(
+                    "a batch that deletes a page with a redaction mark and adds pages can't be verified; the document was not changed".into(),
+                ));
+            }
+            guard(|| shown_under_redactions(&next, &cx.redaction_marks, &cx.redaction_overlays, doc.password.as_deref()))
                 .unwrap_or_else(|m| Err(EditError::Invalid(format!("{} failed unexpectedly ({m}); the document was not changed", edit.label()))))?;
         }
         // Renamed fields are said, not slipped in: a repair-log note (with the caveat that
@@ -192,12 +295,14 @@ impl Session {
             let (tpl, datasets) = (cx.xfa.as_deref(), &mut cx.xfa_datasets);
             xfa_notes = guard(|| xfa_sync_datasets(&mut next, tpl, datasets))
                 .unwrap_or_else(|m| Err(format!("writing the XFA data failed unexpectedly ({m})")))
-                .map_err(EditError::Write)?;
+                .map_err(EditError::Write)
+                .inspect_err(|_| discard_edit_callbacks(&cx))?;
             // Rebuilding from stale data would discard accepted widget values.
             if xfa_notes.is_empty() {
                 let reflow = guard(|| xfa::relayout_changed_text(&mut next, tpl, &doc.form))
                     .unwrap_or_else(|m| Err(format!("laying out the XFA text failed unexpectedly ({m})")))
-                    .map_err(EditError::Write)?;
+                    .map_err(EditError::Write)
+                    .inspect_err(|_| discard_edit_callbacks(&cx))?;
                 if let Some(warnings) = reflow {
                     xfa_notes.extend(warnings);
                     // Layout replaces pages and widgets, even if the page count is unchanged.
@@ -216,6 +321,7 @@ impl Session {
         }
         let rewrites = |c: &pdfcraft_cos::Document| c.full_save_required() || c.encryption_changed();
         if signed && ((rewrites(&next) && !rewrites(&editor.cos)) || (next.is_modified() && next.revisions().is_empty())) {
+            discard_edit_callbacks(&cx);
             return Err(EditError::SignedRewrite(edit.label().to_string()));
         }
         let mut notices = edit_notices(&edit, &editor.cos, &next);
@@ -237,6 +343,7 @@ impl Session {
         let refreshed = guard(|| if scope == Scope::Content { Self::refresh_content(doc, Some(&edit)) } else { Self::refresh_scoped(doc, scope) })
             .unwrap_or_else(|m| Err(EditError::Reopen(m)));
         if let Err(e) = refreshed {
+            discard_edit_callbacks(&cx);
             // Roll back: the edit produced something we cannot display.
             if let Some(ed) = doc.editor.as_mut()
                 && let Some((_, prev, keys, _)) = ed.undo.pop()
@@ -251,6 +358,9 @@ impl Session {
             return Err(e);
         }
         doc.dirty = true;
+        if let Ok(mut runtime) = doc.js_runtime.lock() {
+            runtime.sync_field_ids(doc.form.iter().map(|f| crate::js::field_object_id(f.obj)));
+        }
         doc.generation += 1;
         doc.edit_notices = notices;
         // Only this edit's exits are skipped on the next focus loss: one an earlier change ran is
@@ -299,6 +409,11 @@ impl Session {
         }
         doc.edit_notices.clear();
         Self::sync_dirty(doc);
+        if let Some(editor) = doc.editor.as_ref()
+            && let Some((_, previous, _, _)) = editor.redo.last()
+        {
+            sync_script_history(doc, previous, &editor.cos);
+        }
         // The change whose exit ran is undone (or redone without its scripts): skip no exit.
         doc.xfa_exited.clear();
         doc.generation += 1;
@@ -331,6 +446,11 @@ impl Session {
         }
         doc.edit_notices.clear();
         Self::sync_dirty(doc);
+        if let Some(editor) = doc.editor.as_ref()
+            && let Some((_, previous, _, _)) = editor.undo.last()
+        {
+            sync_script_history(doc, previous, &editor.cos);
+        }
         // The change whose exit ran is undone (or redone without its scripts): skip no exit.
         doc.xfa_exited.clear();
         doc.generation += 1;
diff --git a/crates/engine/src/session/files.rs b/crates/engine/src/session/files.rs
index 4177d1705f..2f2774ed22 100644
--- a/crates/engine/src/session/files.rs
+++ b/crates/engine/src/session/files.rs
@@ -1,9 +1,17 @@
 use super::{
     Arc, CombineSource, Combined, DataFormat, DocId, EditError, Hairlines, HairlinesFixed, Hidden, ImageResolution, LOW_RESOLUTION_PRINT_DPI,
-    OptimizeReport, SaveOptions, Session, SourceKind, SplitPart, decode_text, guard, open_source, open_source_with, optimize, print,
+    OptimizeReport, SaveOptions, Session, SourceKind, SplitPart, decode_text, guard, office_to_pdf, open_source, open_source_with, optimize, print,
     print_layer_states, print_raster, set_default_layer_state, source_kind, writable, write_full,
 };
 
+/// Whether a conversion may run LibreOffice for an Office document (seconds, in another
+/// process) or must refuse it because the caller is on the frame thread.
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum Office {
+    Convert,
+    Refuse,
+}
+
 impl Session {
     /// The page count of another PDF (Replace Pages, Insert Pages dialogs).
     pub fn page_count_of(&self, name: &str, bytes: &Arc<Vec<u8>>) -> Result<usize, EditError> {
@@ -41,33 +49,96 @@ impl Session {
         self.write_new(&doc)
     }
 
-    /// Convert a file Create understands (an image or plain text) to PDF bytes; a PDF is checked
-    /// (it must open and allow copying pages) and returned as it is.
+    /// Convert a file Create understands (an image, plain text or an Office document) to PDF
+    /// bytes; a PDF is checked (it must open and allow copying pages) and returned as it is.
+    /// An Office document runs LibreOffice ([`office_to_pdf`]), which takes seconds: keep it off
+    /// the frame thread ([`Self::convert_to_pdf_inline`] there).
     pub fn convert_to_pdf(&self, name: &str, bytes: &Arc<Vec<u8>>) -> Result<(SourceKind, Arc<Vec<u8>>), EditError> {
+        self.convert(name, bytes, Office::Convert)
+    }
+
+    /// [`Self::convert_to_pdf`] for a caller on the frame thread, which must not wait seconds for
+    /// LibreOffice: an Office document is refused, pointing to File ▸ Open, which converts it in
+    /// the background.
+    pub fn convert_to_pdf_inline(&self, name: &str, bytes: &Arc<Vec<u8>>) -> Result<(SourceKind, Arc<Vec<u8>>), EditError> {
+        self.convert(name, bytes, Office::Refuse)
+    }
+
+    fn convert(&self, name: &str, bytes: &Arc<Vec<u8>>, office: Office) -> Result<(SourceKind, Arc<Vec<u8>>), EditError> {
         let Some(kind) = source_kind(name, bytes) else {
-            return Err(EditError::Source(format!("{name}: this file type can't be converted; use a PDF, an image or a .txt file")));
+            return Err(EditError::Source(format!(
+                "{name}: this file type can't be converted; use a PDF, an image, a .txt file or a Word, Excel or PowerPoint file"
+            )));
         };
+        if kind == SourceKind::Office && office == Office::Refuse {
+            return Err(EditError::Source(format!(
+                "{name}: Word, Excel and PowerPoint files can't be added here yet; open it with File ▸ Open, which converts it to a PDF"
+            )));
+        }
         let title = name.rsplit_once('.').map_or(name, |(s, _)| s);
         // Image decoders read untrusted bytes: a panic in one must not take the app down.
         let created = guard(|| match kind {
             SourceKind::Pdf => open_source(name, bytes).map(|_| bytes.clone()),
             SourceKind::Image => self.create_from_images(&[(name.to_string(), bytes.to_vec())]),
             SourceKind::Text => self.create_from_text(title, &decode_text(bytes)),
+            SourceKind::Office => office_to_pdf(name, bytes),
         })
         .map_err(|_| EditError::Source(format!("{name}: the file could not be read")))?;
         Ok((kind, created?))
     }
 
-    /// A file for Combine as PDF bytes: an image or text file is converted; a PDF is returned as
-    /// it is, unchecked (Combine reads it itself, with its password), as is a file named .pdf
-    /// without a `%PDF-` header, which the reader may still open.
+    /// A file for Insert Pages into `dest`, as PDF bytes and its page count: an image, text or
+    /// Office file is converted, and a PDF is checked as the insert itself checks it, so a file
+    /// under `dest`'s own protection that withholds only page extraction is accepted, as pasted
+    /// pages are (#5081). An Office document runs LibreOffice: keep it off the frame thread
+    /// ([`Self::insert_source_inline`] there).
+    pub fn insert_source(&self, dest: DocId, name: &str, bytes: &Arc<Vec<u8>>) -> Result<(usize, Arc<Vec<u8>>), EditError> {
+        self.insert_source_with(dest, name, bytes, Office::Convert)
+    }
+
+    /// [`Self::insert_source`] on the frame thread: Office documents are refused, as
+    /// [`Self::convert_to_pdf_inline`] refuses them. PDFs are still checked as the insert itself
+    /// checks them (#5081).
+    pub fn insert_source_inline(&self, dest: DocId, name: &str, bytes: &Arc<Vec<u8>>) -> Result<(usize, Arc<Vec<u8>>), EditError> {
+        self.insert_source_with(dest, name, bytes, Office::Refuse)
+    }
+
+    fn insert_source_with(&self, dest: DocId, name: &str, bytes: &Arc<Vec<u8>>, office: Office) -> Result<(usize, Arc<Vec<u8>>), EditError> {
+        if !matches!(source_kind(name, bytes), Some(SourceKind::Pdf)) {
+            let (_, pdf) = self.convert(name, bytes, office)?;
+            return Ok((self.page_count_of(name, &pdf)?, pdf));
+        }
+        let src = crate::sources::open_source_into(name, bytes, self.cos(dest)?)?;
+        Ok((pdfcraft_organize::page_count(&src)?, bytes.clone()))
+    }
+
+    /// The page count of a PDF for Replace Pages in `dest`, checked as the replace itself checks
+    /// it: as with [`Self::insert_source`], a file under `dest`'s own protection that withholds
+    /// only page extraction is accepted (#5081).
+    pub fn replace_source(&self, dest: DocId, name: &str, bytes: &Arc<Vec<u8>>) -> Result<usize, EditError> {
+        Ok(pdfcraft_organize::page_count(&crate::sources::open_source_into(name, bytes, self.cos(dest)?)?)?)
+    }
+
+    /// A file for Combine as PDF bytes: an image, text or Office file is converted; a PDF is
+    /// returned as it is, unchecked (Combine reads it itself, with its password), as is a file
+    /// named .pdf without a `%PDF-` header, which the reader may still open.
     pub fn as_pdf(&self, name: &str, bytes: &Arc<Vec<u8>>) -> Result<Arc<Vec<u8>>, EditError> {
+        self.as_pdf_with(name, bytes, Office::Convert)
+    }
+
+    /// [`Self::as_pdf`] on the frame thread: Office documents are refused, as
+    /// [`Self::convert_to_pdf_inline`] refuses them.
+    pub fn as_pdf_inline(&self, name: &str, bytes: &Arc<Vec<u8>>) -> Result<Arc<Vec<u8>>, EditError> {
+        self.as_pdf_with(name, bytes, Office::Refuse)
+    }
+
+    fn as_pdf_with(&self, name: &str, bytes: &Arc<Vec<u8>>, office: Office) -> Result<Arc<Vec<u8>>, EditError> {
         let pdf = match source_kind(name, bytes) {
             Some(SourceKind::Pdf) => true,
-            Some(SourceKind::Image | SourceKind::Text) => false,
+            Some(SourceKind::Image | SourceKind::Text | SourceKind::Office) => false,
             None => name.to_ascii_lowercase().ends_with(".pdf"),
         };
-        if pdf { Ok(bytes.clone()) } else { self.convert_to_pdf(name, bytes).map(|(_, pdf)| pdf) }
+        if pdf { Ok(bytes.clone()) } else { self.convert(name, bytes, office).map(|(_, pdf)| pdf) }
     }
 
     /// Reduce File Size: Acrobat's defaults (colour and grey images above 225 ppi to 150 ppi,
@@ -397,7 +468,7 @@ impl Session {
     /// New PDF bytes containing copies of `pages` of the document (Extract Pages).
     pub fn extract(&self, id: DocId, pages: &[usize]) -> Result<Arc<Vec<u8>>, EditError> {
         let src = self.cos(id)?;
-        if src.permissions().is_some_and(|p| !p.assemble()) {
+        if src.permissions().is_some_and(|p| !p.extract_pages()) {
             return Err(EditError::NotPermitted("extracting pages"));
         }
         let out = pdfcraft_organize::extract_pages(src, pages)?;
@@ -407,7 +478,7 @@ impl Session {
     /// Split the document into several new PDFs.
     pub fn split(&self, id: DocId, by: &pdfcraft_organize::SplitBy) -> Result<Vec<SplitPart>, EditError> {
         let src = self.cos(id)?;
-        if src.permissions().is_some_and(|p| !p.assemble()) {
+        if src.permissions().is_some_and(|p| !p.extract_pages()) {
             return Err(EditError::NotPermitted("splitting the document"));
         }
         let n = pdfcraft_organize::page_count(src)?;
@@ -425,7 +496,7 @@ impl Session {
     /// images count once per part) fits; a page larger than the limit is a part of its own.
     pub fn split_by_size(&self, id: DocId, max_bytes: usize) -> Result<Vec<SplitPart>, EditError> {
         let src = self.cos(id)?;
-        if src.permissions().is_some_and(|p| !p.assemble()) {
+        if src.permissions().is_some_and(|p| !p.extract_pages()) {
             return Err(EditError::NotPermitted("splitting the document"));
         }
         let n = pdfcraft_organize::page_count(src)?;
diff --git a/crates/engine/src/session/save.rs b/crates/engine/src/session/save.rs
index dd32cdbc5c..ec0033d318 100644
--- a/crates/engine/src/session/save.rs
+++ b/crates/engine/src/session/save.rs
@@ -71,8 +71,15 @@ impl Session {
             let keys = editor.keys.clone();
             // The saved file carries no Password-field values (#3943, #3944); the open document keeps them.
             let typed = pdfcraft_forms::password_values(&editor.cos);
-            editor.cos =
+            // An incremental save keeps the old byte prefix and its object identities. A
+            // rewrite can reuse the same numbers for unrelated fields and icons.
+            let preserves_objects = bytes.starts_with(editor.saved.as_slice()) || bytes.starts_with(editor.cos.bytes().as_slice());
+            let reopened =
                 pdfcraft_cos::Document::open_with_password(bytes.clone(), keys.reopen.as_deref()).map_err(|e| EditError::Reopen(e.to_string()))?;
+            if !preserves_objects {
+                crate::js::replace_runtime(&mut doc.js_runtime);
+            }
+            editor.cos = reopened;
             pdfcraft_forms::restore_password_values(&mut editor.cos, &typed).map_err(|e| EditError::Reopen(e.to_string()))?;
             if !typed.is_empty() && doc.info.xfa.is_some() {
                 let mut datasets = None;
@@ -125,8 +132,9 @@ impl Session {
     }
 
     /// File ▸ Revert: back to the last saved version (or the file as opened). Undo history is
-    /// cleared, as in Acrobat.
+    /// cleared, as in Acrobat, and the document's opening scripts run again.
     pub fn revert(&mut self, id: DocId) -> Result<(), EditError> {
+        self.invalidate_javascript(id);
         let doc = self.doc_mut(id)?;
         let editor = doc.editor.as_mut().ok_or_else(|| EditError::ReadOnly(doc.read_only_reason.clone().unwrap_or_default()))?;
         let base = editor.saved.clone();
@@ -148,7 +156,11 @@ impl Session {
         // The changes whose exits ran are gone with the rest: skip no exit.
         doc.xfa_exited.clear();
         doc.generation += 1;
-        Self::refresh(doc).inspect_err(|_| Self::show_released(doc))
+        Self::refresh(doc).inspect_err(|_| Self::show_released(doc))?;
+        // Reverting reopens the saved file, in a fresh realm: its opening scripts run again,
+        // as they do on opening it (#269).
+        self.run_open_scripts(id);
+        Ok(())
     }
 
     /// The document's file changed on disk (a LaTeX or Typst build rewrote it, #431): open
@@ -159,6 +171,12 @@ impl Session {
     pub fn reload(&mut self, id: DocId, bytes: Arc<Vec<u8>>) -> Result<(), OpenError> {
         let old = self.docs.iter().position(|d| d.id == id).ok_or_else(|| OpenError::Invalid("the document is not open".into()))?;
         let doc = &self.docs[old];
+        // Opening the replacement can initialize a new worker. Wait for the old
+        // invocation to finish before allowing repeated reloads of this document.
+        #[cfg(not(target_arch = "wasm32"))]
+        if doc.js_runtime.lock().map_err(|_| OpenError::Invalid("script runtime unavailable".into()))?.is_executing() {
+            return Err(OpenError::Invalid("a script is still running in this document; retry the reload once it finishes".into()));
+        }
         let (name, path, generation) = (doc.name.clone(), doc.path.clone(), doc.generation);
         let password = doc.editor.as_ref().and_then(|e| e.keys.reopen.clone()).or_else(|| doc.password.clone());
         let new_id = self.open(name, path, bytes, password.as_deref())?;
diff --git a/crates/engine/src/sources.rs b/crates/engine/src/sources.rs
index 91d6efa3ee..4d1b5ab133 100644
--- a/crates/engine/src/sources.rs
+++ b/crates/engine/src/sources.rs
@@ -15,6 +15,16 @@ pub struct Combined {
     pub renamed_fields: Vec<(String, String)>,
 }
 
+/// Convert the Office document `bytes` named `name` (Word, Excel, PowerPoint, OpenDocument,
+/// RTF) to PDF with an installed LibreOffice, and check the result opens. It runs a separate
+/// process for seconds, so callers keep it off the frame thread. Desktop only: on the web it
+/// returns an error.
+pub fn office_to_pdf(name: &str, bytes: &Arc<Vec<u8>>) -> Result<Arc<Vec<u8>>, EditError> {
+    let pdf = Arc::new(pdfcraft_create::office_to_pdf(name, bytes)?);
+    open_source(name, &pdf)?;
+    Ok(pdf)
+}
+
 /// Parse another PDF to copy pages from.
 pub(crate) fn open_source(name: &str, bytes: &Arc<Vec<u8>>) -> Result<pdfcraft_cos::Document, EditError> {
     open_source_with(name, bytes, None)
@@ -25,6 +35,19 @@ pub(crate) fn open_source_with(name: &str, bytes: &Arc<Vec<u8>>, password: Optio
     source_document(bytes, password).map_err(|p| EditError::Source(format!("{name}: {p}")))
 }
 
+/// [`open_source`] for pages inserted into `dest`. A source that withholds page extraction but
+/// allows assembly is accepted when `dest` will be saved under the very same protection (file
+/// key and `/Encrypt` values), as when pages cut or copied from a document are pasted back into
+/// it: they never leave its protection (#5081).
+pub(crate) fn open_source_into(name: &str, bytes: &Arc<Vec<u8>>, dest: &pdfcraft_cos::Document) -> Result<pdfcraft_cos::Document, EditError> {
+    let same_protection = |src: &pdfcraft_cos::Document| match (src.security(), dest.output_handler()) {
+        (Some(s), Some(d)) => s.file_key() == d.file_key() && s.dict() == d.dict(),
+        _ => false,
+    };
+    let permitted = |src: &pdfcraft_cos::Document| src.permissions().is_none_or(|p| p.extract_pages() || (p.assemble() && same_protection(src)));
+    source_document_if(bytes, None, permitted).map_err(|p| EditError::Source(format!("{name}: {p}")))
+}
+
 /// Import the comments of `src` onto the pages of `doc` with the same numbers.
 pub(crate) fn import_pdf_comments(doc: &mut pdfcraft_cos::Document, src: &pdfcraft_cos::Document) -> Result<(), EditError> {
     if pdfcraft_organize::import_comments(doc, src)? == 0 {
@@ -44,8 +67,17 @@ pub(crate) fn comment_source(bytes: &Arc<Vec<u8>>) -> Result<pdfcraft_cos::Docum
 }
 
 fn source_document(bytes: &Arc<Vec<u8>>, password: Option<&str>) -> Result<pdfcraft_cos::Document, SourceProblem> {
+    source_document_if(bytes, password, |d| d.permissions().is_none_or(|p| p.extract_pages()))
+}
+
+/// Open `bytes` as a page source, refused as [`SourceProblem::NotPermitted`] unless `permitted`.
+fn source_document_if(
+    bytes: &Arc<Vec<u8>>,
+    password: Option<&str>,
+    permitted: impl Fn(&pdfcraft_cos::Document) -> bool,
+) -> Result<pdfcraft_cos::Document, SourceProblem> {
     match std::panic::catch_unwind(|| pdfcraft_cos::Document::open_with_password(bytes.clone(), password)) {
-        Ok(Ok(d)) if d.permissions().is_some_and(|p| !p.assemble()) => Err(SourceProblem::NotPermitted),
+        Ok(Ok(d)) if !permitted(&d) => Err(SourceProblem::NotPermitted),
         Ok(Ok(d)) => Ok(d),
         Ok(Err(pdfcraft_cos::CosError::NeedsPassword)) => Err(SourceProblem::Password),
         Ok(Err(pdfcraft_cos::CosError::WrongPassword)) => Err(SourceProblem::WrongPassword),
diff --git a/crates/engine/src/spooler.rs b/crates/engine/src/spooler.rs
index 56347d8f09..5c76bd6739 100644
--- a/crates/engine/src/spooler.rs
+++ b/crates/engine/src/spooler.rs
@@ -2,25 +2,51 @@
 
 use std::sync::Arc;
 
-use pdfcraft_cos::{SaveOptions, write_full};
+use pdfcraft_cos::{Dict, Object, SaveOptions, Stream, write_full};
+use pdfcraft_render::{PRINT_TAG, PageRenderer, RenderConfig, RenderRequest, Tile};
 
 use crate::guard;
 
+/// The resolution [`spooler_copy`] flattens a sheet at, unless the sheet is too large for it
+/// ([`MAX_FLATTENED_PIXELS`], [`MAX_FLATTENED_SIDE`]).
+pub const FLATTEN_DPI: f64 = 300.0;
+/// The side of the largest tile a flattened sheet is drawn with, in pixels: 2000 × 2000 stays
+/// under the 2²² pixels past which Windows' PDF renderer shrinks an image (#5131), so [`tiled`]
+/// leaves the tiles alone, and under the renderer's own tile limit.
+pub const FLATTEN_TILE: u32 = 2000;
+/// The most pixels one flattened sheet has. A 24 × 36 in sheet at 300 dpi (78 MP) keeps its
+/// resolution; a larger one is drawn at a lower one. The sheet is rendered and encoded a tile at
+/// a time, so this bounds the encoded picture (240 MB as raw RGB) and the time it takes, not the
+/// memory one render needs.
+pub const MAX_FLATTENED_PIXELS: f64 = 80.0e6;
+/// The most pixels along a flattened sheet's longer side: a long banner gets a lower resolution
+/// rather than hundreds of tiles, each of which interprets the whole sheet's content again.
+pub const MAX_FLATTENED_SIDE: f64 = 16_000.0;
+/// The most bytes of encoded pictures one copy holds. A sheet whose picture would pass it keeps
+/// its vectors and prints as it would have without flattening.
+const MAX_FLATTENED_BYTES: usize = 512 << 20;
+
 /// The print-ready PDF `bytes` ([`crate::Session::print_pdf`]) as they go to the system spooler
-/// with `job`. Two things happen on Windows only; elsewhere the bytes go as they are.
+/// with `job`. Three things happen on Windows only, in this order; elsewhere the bytes go as they
+/// are.
 ///
 /// - A job in grayscale is made grey here first ([`greyed`]), and `job.grey_pages` says so.
 ///   Windows has no colour conversion of its own, and a driver that lists no grey option (Microsoft
 ///   Print to PDF, or one with only a vendor's own grey setting) refused the job outright
 ///   (#5806). The driver is still asked for grey where it has it.
+/// - With `flatten_transparency`, each sheet that uses transparency becomes an opaque picture of
+///   itself at [`FLATTEN_DPI`] ([`flattened`]). It is meant for GDI (v3) drivers, which get the
+///   job through Windows' XPS-to-GDI conversion: that conversion fails on soft masks (#6155),
+///   prints halos around them (#5838) or prints transparency as black boxes (#5940). It comes
+///   after greying, so the picture is of the grey sheet.
 /// - Large images are drawn as tiles ([`pdfcraft_optimize::tile_large_images`], #5131): Windows'
 ///   PDF renderer prints an image of more than 2²² pixels from a shrunk copy, so a scan comes out
-///   at the printer's resolution.
+///   at the printer's resolution. A flattened sheet's tiles are already under that.
 ///
-/// When the copy can't be read or written, the bytes go as they are: neither step ever stops a
-/// print, and a grayscale job whose pages couldn't be made grey keeps asking the driver for grey,
+/// When the copy can't be read or written, the bytes go as they are: no step ever stops a print,
+/// and a grayscale job whose pages couldn't be made grey keeps asking the driver for grey,
 /// strictly, as before.
-pub fn spooler_copy(bytes: Vec<u8>, job: &mut crate::print::spool::Job) -> Vec<u8> {
+pub fn spooler_copy(bytes: Vec<u8>, job: &mut crate::print::spool::Job, flatten_transparency: bool) -> Vec<u8> {
     if !cfg!(windows) {
         return bytes;
     }
@@ -35,6 +61,9 @@ pub fn spooler_copy(bytes: Vec<u8>, job: &mut crate::print::spool::Job) -> Vec<u
             None => {}
         }
     }
+    if flatten_transparency && let Some(flat) = flattened(bytes.clone(), FLATTEN_DPI) {
+        bytes = Arc::new(flat);
+    }
     // Once `tiled` returns, its document is gone and `bytes` is the only owner left: no copy.
     tiled(bytes.clone()).unwrap_or_else(|| Arc::try_unwrap(bytes).unwrap_or_else(|shared| (*shared).clone()))
 }
@@ -77,6 +106,154 @@ pub fn tiled(bytes: Arc<Vec<u8>>) -> Option<Vec<u8>> {
     .flatten()
 }
 
+/// `bytes` with each page that uses transparency ([`pdfcraft_preflight::page_uses_transparency`])
+/// replaced by an opaque picture of itself, or `None` when no page needs it, none could be
+/// rendered, or the copy can't be read or written. Pages without transparency stay as they are.
+///
+/// The picture is at `dpi` (72 to 600; [`FLATTEN_DPI`] if not a number), lower on a sheet past
+/// [`MAX_FLATTENED_PIXELS`] or [`MAX_FLATTENED_SIDE`], in tiles of at most [`FLATTEN_TILE`]
+/// pixels a side, each one image (RGB over white, Flate) rendered and encoded on its own. The
+/// page keeps its boxes, `/Rotate` and `/UserUnit`, so the sheet keeps its size and orientation.
+/// Its transparency group goes, since nothing on it is transparent any more, and so do its
+/// annotations, which the picture already shows. A print-ready PDF has none:
+/// [`pdfcraft_print::impose`] draws them into the sheet.
+///
+/// A page whose picture can't be rendered keeps its vectors, as does one whose picture would take
+/// the pictures past 512 MB encoded.
+pub fn flattened(bytes: Arc<Vec<u8>>, dpi: f64) -> Option<Vec<u8>> {
+    guard(|| {
+        let mut doc = pdfcraft_cos::Document::open(bytes.clone()).ok()?;
+        let pages = pdfcraft_model::pages(&doc);
+        let transparent: Vec<usize> =
+            pages.iter().enumerate().filter(|(_, p)| pdfcraft_preflight::page_uses_transparency(&doc, &p.dict)).map(|(i, _)| i).collect();
+        if transparent.is_empty() {
+            return None;
+        }
+        // As Print as image renders (`print_raster`): printing is not the View event, comments
+        // are drawn, and the sheet clears to white; `PRINT_TAG` turns reading colours off. The
+        // print-ready PDF already holds the layers as they print.
+        let config = RenderConfig { for_print: true, ..RenderConfig::default() };
+        let mut renderer = PageRenderer::new(bytes, config);
+        // The renderer must list the same pages, or a sheet could get another one's picture.
+        if renderer.page_count() != pages.len() {
+            return None;
+        }
+        let dpi = if dpi.is_finite() { dpi.clamp(72.0, 600.0) } else { FLATTEN_DPI };
+        let mut budget = MAX_FLATTENED_BYTES;
+        let mut done = 0usize;
+        for i in transparent {
+            let Some(page) = pages.get(i) else { continue };
+            let Some(picture) = sheet_picture(&doc, &mut renderer, page, i, dpi, &mut budget) else { continue };
+            let mut xobjects = Dict::new();
+            for (name, image) in picture.tiles {
+                xobjects.set(name, Object::Ref(doc.add(Object::Stream(image))));
+            }
+            let mut resources = Dict::new();
+            resources.set("XObject", Object::Dict(xobjects));
+            let contents = doc.add(Object::Stream(Stream::flate(Dict::new(), &picture.content)));
+            let replaced = doc.update_dict(page.obj, |d| {
+                d.set("Contents", Object::Ref(contents));
+                d.set("Resources", Object::Dict(resources));
+                d.remove(b"Annots");
+                d.remove(b"Group");
+            });
+            if replaced.is_ok() {
+                done += 1;
+            }
+        }
+        (done > 0).then(|| write_full(&doc, &SaveOptions::default()).ok()).flatten()
+    })
+    .ok()
+    .flatten()
+}
+
+/// A page drawn as tiles: the content that draws them, and each tile's resource name and image.
+struct Picture {
+    content: Vec<u8>,
+    tiles: Vec<(Vec<u8>, Stream)>,
+}
+
+/// The scale (pixels per point) a `w` × `h` pt sheet is flattened at for `dpi`: lowered so the
+/// sheet stays within [`MAX_FLATTENED_PIXELS`] and [`MAX_FLATTENED_SIDE`].
+fn flatten_scale(w: f64, h: f64, dpi: f64) -> f64 {
+    let (w, h) = (w.max(1.0), h.max(1.0));
+    (dpi / 72.0).min((MAX_FLATTENED_PIXELS / (w * h)).sqrt()).min(MAX_FLATTENED_SIDE / w.max(h))
+}
+
+/// Page `index` of `doc` rendered by `renderer` as tiles at `dpi` (see [`flattened`]), with the
+/// content that draws them where the page shows. `None` when a tile doesn't render, or the
+/// tiles' encoded size would pass what is left of `budget`, which a page that succeeds is
+/// charged.
+fn sheet_picture(
+    doc: &pdfcraft_cos::Document,
+    renderer: &mut PageRenderer,
+    page: &pdfcraft_model::Page,
+    index: usize,
+    dpi: f64,
+    budget: &mut usize,
+) -> Option<Picture> {
+    // The renderer draws the page as displayed (crop box, `/UserUnit`, `/Rotate`), y down; the
+    // view matrix takes that display space (y up) back to the page's user space.
+    let (w, h) = page.display_size(doc);
+    let scale = flatten_scale(w, h, dpi) as f32;
+    if !(scale.is_finite() && scale > 0.0) {
+        return None;
+    }
+    let (width, height) = (pdfcraft_render::device_pixels(w as f32, scale), pdfcraft_render::device_pixels(h as f32, scale));
+    let s = f64::from(scale);
+    let mut content = format!("q {} cm\n", matrix(page.view_matrix(doc)));
+    let mut tiles = Vec::new();
+    let mut used = 0usize;
+    for y in (0..height).step_by(FLATTEN_TILE as usize) {
+        for x in (0..width).step_by(FLATTEN_TILE as usize) {
+            let (tw, th) = (FLATTEN_TILE.min(width - x), FLATTEN_TILE.min(height - y));
+            let r =
+                renderer.render(RenderRequest { page: index, scale, tile: Some(Tile { x, y, w: tw, h: th }), tag: PRINT_TAG, ..Default::default() });
+            let pixels = (tw as usize) * (th as usize);
+            if r.error.is_some() || r.width != tw || r.height != th || r.rgba.len() != pixels * 4 {
+                return None;
+            }
+            let mut rgba = r.rgba.to_vec();
+            crate::print_raster::over_white(&mut rgba, false);
+            let rgb: Vec<u8> = rgba.as_chunks::<4>().0.iter().flat_map(|p| [p[0], p[1], p[2]]).collect();
+            let mut image = Dict::new();
+            image.set("Type", Object::name("XObject"));
+            image.set("Subtype", Object::name("Image"));
+            image.set("Width", Object::Int(i64::from(tw)));
+            image.set("Height", Object::Int(i64::from(th)));
+            image.set("ColorSpace", Object::name("DeviceRGB"));
+            image.set("BitsPerComponent", Object::Int(8));
+            let image = Stream::flate(image, &rgb);
+            used = used.saturating_add(image.raw.len());
+            if used > *budget {
+                return None;
+            }
+            // The tile's place in display space, y up: its top edge is `y` pixels below the top.
+            // The last row and column may reach past the page by under a pixel, which the crop
+            // box clips.
+            let name = format!("PCFlat{}", tiles.len());
+            let place = [f64::from(tw) / s, 0.0, 0.0, f64::from(th) / s, f64::from(x) / s, h - f64::from(y + th) / s];
+            content.push_str(&format!("q {} cm /{name} Do Q\n", matrix(place)));
+            tiles.push((name.into_bytes(), image));
+        }
+    }
+    content.push_str("Q\n");
+    *budget -= used;
+    Some(Picture { content: content.into_bytes(), tiles })
+}
+
+/// `m` as the six operands of `cm`, at full precision.
+fn matrix(m: [f64; 6]) -> String {
+    let mut out = Vec::new();
+    for (i, v) in m.into_iter().enumerate() {
+        if i > 0 {
+            out.push(b' ');
+        }
+        pdfcraft_cos::serialize(&Object::Real(v), &mut out);
+    }
+    String::from_utf8_lossy(&out).into_owned()
+}
+
 #[cfg(test)]
 mod tests {
     use pdfcraft_cos::{Dict, Document, Object, Stream};
@@ -137,13 +314,13 @@ mod tests {
         assert_eq!(tiled(Arc::new(page_with_image(100, 100))), None);
         assert_eq!(tiled(Arc::new(b"not a PDF".to_vec())), None);
         let mut job = Job::default();
-        assert_eq!(spooler_copy(b"not a PDF".to_vec(), &mut job), b"not a PDF");
+        assert_eq!(spooler_copy(b"not a PDF".to_vec(), &mut job, false), b"not a PDF");
         let small = page_with_image(100, 100);
-        assert_eq!(spooler_copy(small.clone(), &mut job), small);
+        assert_eq!(spooler_copy(small.clone(), &mut job, false), small);
         assert!(!job.grey_pages);
         // A grayscale job whose copy can't be read asks the driver for grey as before.
         let mut grey = Job { grayscale: true, ..Job::default() };
-        assert_eq!(spooler_copy(b"not a PDF".to_vec(), &mut grey), b"not a PDF");
+        assert_eq!(spooler_copy(b"not a PDF".to_vec(), &mut grey, false), b"not a PDF");
         assert!(!grey.grey_pages);
     }
 
@@ -195,7 +372,7 @@ mod tests {
     fn a_grayscale_job_sends_grey_pages_on_windows_only() {
         let red = red_page();
         let mut job = Job { grayscale: true, ..Job::default() };
-        let sent = spooler_copy(red.clone(), &mut job);
+        let sent = spooler_copy(red.clone(), &mut job, false);
         if cfg!(windows) {
             assert!(job.grey_pages);
             assert!(!first_page_content(sent).contains(" rg"));
@@ -204,7 +381,7 @@ mod tests {
             assert_eq!(sent, red);
         }
         let mut colour = Job::default();
-        assert_eq!(spooler_copy(red.clone(), &mut colour), red);
+        assert_eq!(spooler_copy(red.clone(), &mut colour, false), red);
         assert!(!colour.grey_pages);
     }
 
@@ -212,7 +389,7 @@ mod tests {
     #[test]
     fn the_spooler_gets_tiles_on_windows_only() {
         let large = page_with_image(2100, 2100);
-        let sent = spooler_copy(large.clone(), &mut Job::default());
+        let sent = spooler_copy(large.clone(), &mut Job::default(), false);
         if cfg!(windows) {
             assert_eq!(Some(&sent), tiled(Arc::new(large.clone())).as_ref());
             assert_ne!(sent, large);
@@ -220,4 +397,239 @@ mod tests {
             assert_eq!(sent, large);
         }
     }
+
+    /// A PDF with the pages `make` returns, each given its type, its parent and, when it has
+    /// none, a US Letter MediaBox. `make` adds what the pages refer to.
+    fn pdf_of(make: impl FnOnce(&mut Document) -> Vec<Dict>) -> Vec<u8> {
+        let mut doc = Document::new_empty();
+        let pages = doc.root().and_then(|r| doc.get(r).as_dict().and_then(|d| d.reference(b"Pages"))).unwrap();
+        let made = make(&mut doc);
+        let count = made.len() as i64;
+        let kids: Vec<Object> = made
+            .into_iter()
+            .map(|mut page| {
+                page.set("Type", Object::name("Page"));
+                page.set("Parent", Object::Ref(pages));
+                if !page.contains(b"MediaBox") {
+                    page.set("MediaBox", Object::Array([0, 0, 612, 792].map(Object::Int).to_vec()));
+                }
+                Object::Ref(doc.add(Object::Dict(page)))
+            })
+            .collect();
+        doc.update_dict(pages, |d| {
+            d.set("Count", Object::Int(count));
+            d.set("Kids", Object::Array(kids));
+        })
+        .unwrap();
+        write_full(&doc, &SaveOptions::default()).unwrap()
+    }
+
+    /// A page drawing `content` with `resources`.
+    fn page(doc: &mut Document, resources: Dict, content: &[u8]) -> Dict {
+        let content = doc.add(Object::Stream(Stream::from_raw(Dict::new(), content.to_vec())));
+        let mut page = Dict::new();
+        page.set("Resources", Object::Dict(resources));
+        page.set("Contents", Object::Ref(content));
+        page
+    }
+
+    /// An image XObject dictionary of `w` × `h` 8-bit samples in `space`.
+    fn image_dict(w: i64, h: i64, space: &str) -> Dict {
+        let mut image = Dict::new();
+        image.set("Type", Object::name("XObject"));
+        image.set("Subtype", Object::name("Image"));
+        image.set("Width", Object::Int(w));
+        image.set("Height", Object::Int(h));
+        image.set("ColorSpace", Object::name(space));
+        image.set("BitsPerComponent", Object::Int(8));
+        image
+    }
+
+    /// A blue square, the content of a page without transparency.
+    const BLUE_SQUARE: &[u8] = b"0 0 1 rg 100 100 200 200 re f";
+
+    /// A page without transparency: a blue square.
+    fn vector_page(doc: &mut Document) -> Dict {
+        page(doc, Dict::new(), BLUE_SQUARE)
+    }
+
+    /// A page drawing a red image over a blue square, with a soft mask that fades the image in
+    /// from left to right.
+    fn soft_masked_page(doc: &mut Document) -> Dict {
+        let alpha: Vec<u8> = (0..64 * 64).map(|i| (i % 64 * 4) as u8).collect();
+        let mask = doc.add(Object::Stream(Stream::flate(image_dict(64, 64, "DeviceGray"), &alpha)));
+        let mut image = image_dict(64, 64, "DeviceRGB");
+        image.set("SMask", Object::Ref(mask));
+        let red: Vec<u8> = (0..64 * 64).flat_map(|_| [255, 0, 0]).collect();
+        let image = doc.add(Object::Stream(Stream::flate(image, &red)));
+        let mut xobjects = Dict::new();
+        xobjects.set("Im", Object::Ref(image));
+        let mut resources = Dict::new();
+        resources.set("XObject", Object::Dict(xobjects));
+        page(doc, resources, b"0 0 1 rg 100 100 200 200 re f q 300 0 0 300 150 150 cm /Im Do Q")
+    }
+
+    /// Page `n`'s dictionary, inherited entries filled in, and the operators of its content.
+    fn page_of(doc: &Document, n: usize) -> (Dict, String) {
+        let page = pdfcraft_model::pages(doc).swap_remove(n);
+        let contents = page.dict.reference(b"Contents").unwrap();
+        let content = match &*doc.get(contents) {
+            Object::Stream(s) => String::from_utf8_lossy(&s.decoded().unwrap()).into_owned(),
+            other => panic!("{other:?}"),
+        };
+        (page.dict, content)
+    }
+
+    /// The images among page `n`'s XObjects, as (width, height, has a soft mask), sorted.
+    fn page_images(doc: &Document, n: usize) -> Vec<(i64, i64, bool)> {
+        let (page, _) = page_of(doc, n);
+        let resources = doc.resolve(page.get(b"Resources").unwrap());
+        let xobjects = doc.resolve(resources.as_dict().unwrap().get(b"XObject").unwrap());
+        let mut images: Vec<(i64, i64, bool)> = xobjects
+            .as_dict()
+            .unwrap()
+            .iter()
+            .filter_map(|(_, x)| match &*doc.resolve(x) {
+                Object::Stream(s) if s.dict.name(b"Subtype") == Some(b"Image") => {
+                    Some((s.dict.int(b"Width")?, s.dict.int(b"Height")?, s.dict.contains(b"SMask")))
+                }
+                _ => None,
+            })
+            .collect();
+        images.sort();
+        images
+    }
+
+    /// #6155, #5838, #5940: a page with a soft-masked image becomes an opaque picture in tiles
+    /// under Windows' image cap, on a sheet of the same size, and tiling leaves them alone.
+    #[test]
+    fn a_soft_masked_page_is_flattened_into_tiles() {
+        let flat = flattened(Arc::new(pdf_of(|doc| vec![soft_masked_page(doc)])), FLATTEN_DPI).expect("flattened");
+        let doc = Document::open(Arc::new(flat.clone())).unwrap();
+        // US Letter at 300 dpi is 2550 × 3300 pixels: two tiles across, two down.
+        assert_eq!(page_images(&doc, 0), [(550, 1300, false), (550, 2000, false), (2000, 1300, false), (2000, 2000, false)]);
+        assert!(doc.scan_objects().all(|(_, o)| !matches!(&*o, Object::Stream(s) if s.dict.contains(b"SMask"))));
+        let (page, content) = page_of(&doc, 0);
+        assert_eq!(page.get(b"MediaBox"), Some(&Object::Array([0, 0, 612, 792].map(Object::Int).to_vec())));
+        assert_eq!(content.matches(" Do").count(), 4, "{content}");
+        assert!(!pdfcraft_preflight::page_uses_transparency(&doc, &page));
+        assert_eq!(tiled(Arc::new(flat)), None);
+    }
+
+    /// A page without transparency, or with a transparency group around opaque content only (as
+    /// a print-ready sheet draws a page that Word gave one), keeps its vectors; so does a copy
+    /// that can't be read.
+    #[test]
+    fn a_page_without_transparency_or_unreadable_is_not_flattened() {
+        assert_eq!(flattened(Arc::new(pdf_of(|doc| vec![vector_page(doc)])), FLATTEN_DPI), None);
+        assert_eq!(flattened(Arc::new(page_with_image(100, 100)), FLATTEN_DPI), None);
+        let grouped = pdf_of(|doc| {
+            let mut group = Dict::new();
+            group.set("S", Object::name("Transparency"));
+            let mut form = Dict::new();
+            form.set("Type", Object::name("XObject"));
+            form.set("Subtype", Object::name("Form"));
+            form.set("BBox", Object::Array([0, 0, 612, 792].map(Object::Int).to_vec()));
+            form.set("Group", Object::Dict(group));
+            let form = doc.add(Object::Stream(Stream::from_raw(form, BLUE_SQUARE.to_vec())));
+            let mut xobjects = Dict::new();
+            xobjects.set("Fm", Object::Ref(form));
+            let mut resources = Dict::new();
+            resources.set("XObject", Object::Dict(xobjects));
+            vec![page(doc, resources, b"/Fm Do")]
+        });
+        assert_eq!(flattened(Arc::new(grouped), FLATTEN_DPI), None);
+        assert_eq!(flattened(Arc::new(b"not a PDF".to_vec()), FLATTEN_DPI), None);
+    }
+
+    /// Of two pages, only the one with transparency becomes a picture; the other keeps its
+    /// content as it was.
+    #[test]
+    fn only_the_transparent_page_of_two_is_flattened() {
+        let source = pdf_of(|doc| vec![vector_page(doc), soft_masked_page(doc)]);
+        let flat = flattened(Arc::new(source), 150.0).expect("flattened");
+        let doc = Document::open(Arc::new(flat)).unwrap();
+        assert_eq!(page_of(&doc, 0).1, String::from_utf8_lossy(BLUE_SQUARE));
+        // US Letter at 150 dpi is 1275 × 1650 pixels: one tile.
+        assert_eq!(page_images(&doc, 1), [(1275, 1650, false)]);
+        assert_eq!(page_of(&doc, 1).1.matches(" Do").count(), 1);
+    }
+
+    /// The picture lands where the page showed what it pictures, on a page turned a quarter
+    /// with a crop box away from the origin.
+    #[test]
+    fn a_flattened_turned_page_looks_as_it_did() {
+        let source = pdf_of(|doc| {
+            let mut half = Dict::new();
+            half.set("ca", Object::Real(0.5));
+            let mut states = Dict::new();
+            states.set("Half", Object::Dict(half));
+            let mut resources = Dict::new();
+            resources.set("ExtGState", Object::Dict(states));
+            // Half-transparent red over the crop box's lower left 100 × 100 pt.
+            let mut page = page(doc, resources, b"/Half gs 1 0 0 rg 50 0 100 100 re f");
+            page.set("MediaBox", Object::Array([0, 0, 300, 200].map(Object::Int).to_vec()));
+            page.set("CropBox", Object::Array([50, 0, 300, 200].map(Object::Int).to_vec()));
+            page.set("Rotate", Object::Int(90));
+            vec![page]
+        });
+        let flat = flattened(Arc::new(source.clone()), 72.0).expect("flattened");
+        let (page, _) = page_of(&Document::open(Arc::new(flat.clone())).unwrap(), 0);
+        assert_eq!(page.get(b"Rotate"), Some(&Object::Int(90)));
+        assert_eq!(page.get(b"CropBox"), Some(&Object::Array([50, 0, 300, 200].map(Object::Int).to_vec())));
+        let render = |bytes: Vec<u8>| {
+            let r = PageRenderer::new(Arc::new(bytes), RenderConfig::default()).render(RenderRequest {
+                page: 0,
+                scale: 1.0,
+                tag: PRINT_TAG,
+                ..Default::default()
+            });
+            assert!(r.error.is_none(), "{:?}", r.error);
+            r
+        };
+        let (before, after) = (render(source), render(flat));
+        // Turned a quarter clockwise, the page shows 200 × 250 pt with the red at its top left.
+        assert_eq!((before.width, before.height), (200, 250));
+        assert_eq!((after.width, after.height), (200, 250));
+        let px = |r: &pdfcraft_render::RenderedPage, x: u32, y: u32| {
+            let i = ((y * r.width + x) * 4) as usize;
+            [r.rgba[i], r.rgba[i + 1], r.rgba[i + 2]]
+        };
+        let pink = px(&before, 50, 50);
+        assert!(pink[0] > 240 && (100..160).contains(&pink[1]), "{pink:?}");
+        assert_eq!(px(&before, 150, 200), [255, 255, 255]);
+        // Sampled away from the red's edges (at 100 px), where pixels may blend.
+        for y in (5..250).step_by(10) {
+            for x in (5..200).step_by(10) {
+                let (b, a) = (px(&before, x, y), px(&after, x, y));
+                assert!(b.iter().zip(a).all(|(b, a)| b.abs_diff(a) <= 3), "({x}, {y}): {b:?} became {a:?}");
+            }
+        }
+    }
+
+    /// A sheet keeps the full resolution up to 24 × 36 in; a larger one gets a lower one within
+    /// the pixel bound, and a long banner one within the side bound.
+    #[test]
+    fn a_large_sheet_is_flattened_at_a_lower_resolution() {
+        let dpi = |w: f64, h: f64| flatten_scale(w * 72.0, h * 72.0, FLATTEN_DPI) * 72.0;
+        assert!((dpi(8.5, 11.0) - 300.0).abs() < 1e-9);
+        assert!((dpi(24.0, 36.0) - 300.0).abs() < 1e-9);
+        let large = dpi(36.0, 48.0);
+        assert!(large < 300.0 && 36.0 * 48.0 * large * large <= MAX_FLATTENED_PIXELS * 1.000_001, "{large}");
+        assert!((dpi(36.0, 1200.0) * 1200.0 - MAX_FLATTENED_SIDE).abs() < 1e-6);
+    }
+
+    /// With the flag off a transparent page goes to the spooler as it is; on, Windows gets the
+    /// flattened copy.
+    #[test]
+    fn the_spooler_flattens_transparency_only_when_asked() {
+        let source = pdf_of(|doc| vec![soft_masked_page(doc)]);
+        assert_eq!(spooler_copy(source.clone(), &mut Job::default(), false), source);
+        let sent = spooler_copy(source.clone(), &mut Job::default(), true);
+        if cfg!(windows) {
+            assert_eq!(Some(&sent), flattened(Arc::new(source), FLATTEN_DPI).as_ref());
+        } else {
+            assert_eq!(sent, source);
+        }
+    }
 }
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index 56972abaa6..91b00df4cc 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -1575,8 +1575,13 @@ fn a_page_with_a_form_field_shown_twice_keeps_one_field() {
 #[test]
 fn files_that_cannot_be_converted_are_refused_clearly() {
     let s = Session::new();
-    let err = s.convert_to_pdf("report.docx", &Arc::new(b"PK\x03\x04".to_vec())).unwrap_err();
-    assert_eq!(err, EditError::Source("report.docx: this file type can't be converted; use a PDF, an image or a .txt file".into()));
+    let err = s.convert_to_pdf("archive.zip", &Arc::new(b"PK\x03\x04".to_vec())).unwrap_err();
+    assert_eq!(
+        err,
+        EditError::Source(
+            "archive.zip: this file type can't be converted; use a PDF, an image, a .txt file or a Word, Excel or PowerPoint file".into()
+        )
+    );
     assert!(matches!(s.convert_to_pdf("empty", &Arc::new(Vec::new())), Err(EditError::Source(_))));
     // Damaged inputs of a known type fail with an error, not a panic.
     assert!(s.convert_to_pdf("bad.png", &Arc::new(b"\x89PNG\r\n\x1a\nnope".to_vec())).is_err());
@@ -1597,8 +1602,8 @@ fn files_for_combine_are_made_into_pdfs_and_pdfs_pass_through() {
     assert!(Arc::ptr_eq(&s.as_pdf("old.PDF", &headless).unwrap(), &headless));
     assert!(s.as_pdf("scan.jpg", &Arc::new(jpeg_bytes())).unwrap().starts_with(b"%PDF-"));
     assert!(s.as_pdf("notes.txt", &Arc::new(b"hello".to_vec())).unwrap().starts_with(b"%PDF-"));
-    let err = s.as_pdf("report.docx", &Arc::new(b"PK\x03\x04".to_vec())).unwrap_err();
-    assert!(matches!(err, EditError::Source(m) if m.starts_with("report.docx: this file type can't be converted")));
+    let err = s.as_pdf("archive.zip", &Arc::new(b"PK\x03\x04".to_vec())).unwrap_err();
+    assert!(matches!(err, EditError::Source(m) if m.starts_with("archive.zip: this file type can't be converted")));
 }
 
 fn protected(user: &str, owner: &str, permissions: i32) -> Arc<Vec<u8>> {
@@ -1615,6 +1620,206 @@ fn protected(user: &str, owner: &str, permissions: i32) -> Arc<Vec<u8>> {
     Arc::new(pdfcraft_cos::write_full(&doc, &Default::default()).unwrap())
 }
 
+/// Two pages protected with `algorithm` under the permissions password "boss" (no open
+/// password), restricting changes to `changes`.
+fn protected_with_changes(algorithm: pdfcraft_cos::Algorithm, changes: Changes) -> Arc<Vec<u8>> {
+    protected_pages(2, algorithm, changes, 8)
+}
+
+/// [`protected_with_changes`] with `pages` pages; `seed` gives the file key and salts, so two
+/// files with the same arguments but `pages` share their protection exactly.
+fn protected_pages(pages: usize, algorithm: pdfcraft_cos::Algorithm, changes: Changes, seed: u8) -> Arc<Vec<u8>> {
+    let mut doc = pdfcraft_cos::Document::open(Arc::new(fixture(pages))).unwrap();
+    let protection = Protection { permissions_password: Some("boss".into()), changes, algorithm, ..Protection::default() };
+    doc.set_encryption(&pdfcraft_cos::NewEncryption {
+        algorithm,
+        user_password: "",
+        owner_password: "boss",
+        permissions: protection.permission_bits(),
+        encrypt_metadata: true,
+        seed: [seed; 32],
+    })
+    .unwrap();
+    Arc::new(pdfcraft_cos::write_full(&doc, &Default::default()).unwrap())
+}
+
+/// "Any except extracting pages" (#5081) withholds page extraction on every handler revision. At
+/// revision 3 and later the preset (bit 4 without bit 11) allows no page changes either; at
+/// revision 2, where bit 4 covers assembly, extraction, splitting and being a page source are
+/// still refused because copying is withheld.
+#[test]
+fn extraction_permissions_refuse_any_except_extract_on_every_revision() {
+    use pdfcraft_cos::Algorithm::{Aes128, Aes256, Rc4_40, Rc4_128};
+
+    for algorithm in [Rc4_128, Aes128, Aes256] {
+        let bytes = protected_with_changes(algorithm, Changes::AnyExceptExtract);
+        let doc = pdfcraft_cos::Document::open_with_password(bytes.clone(), None).unwrap();
+        let permissions = doc.permissions().unwrap();
+        assert!(!permissions.extract_pages(), "{algorithm:?}, /P={:#x}", permissions.bits);
+        assert!(!permissions.assemble(), "{algorithm:?}: bit 4 without bit 11 allows no page changes");
+    }
+    let r2 = protected_with_changes(Rc4_40, Changes::AnyExceptExtract);
+    let mut session = Session::new();
+    let r2_id = session.open("r2.pdf", None, r2.clone(), None).unwrap();
+    let permissions = session.get(r2_id).unwrap().permissions().unwrap();
+    assert!(permissions.assemble() && !permissions.extract_pages(), "revision 2, /P={:#x}", permissions.bits);
+    assert_eq!(session.extract(r2_id, &[0]), Err(EditError::NotPermitted("extracting pages")));
+    assert_eq!(session.split(r2_id, &pdfcraft_organize::SplitBy::PageCount(1)), Err(EditError::NotPermitted("splitting the document")));
+    assert_eq!(crate::combine_source_check(&r2, None), Err(crate::SourceProblem::NotPermitted));
+}
+
+/// "Any except extracting pages" (#5081): Extract, Split and Combine refuse the file without the
+/// permissions password and leave it unchanged; Combine takes it with that password.
+#[test]
+fn extraction_permissions_cover_revision_three_to_six_and_leave_no_partial_output() {
+    let bytes = protected_with_changes(pdfcraft_cos::Algorithm::Aes256, Changes::AnyExceptExtract);
+    assert_eq!(crate::combine_source_check(&bytes, None), Err(crate::SourceProblem::NotPermitted));
+    assert_eq!(crate::combine_source_check(&bytes, Some("boss")), Ok(()));
+    let mut restricted = Session::new();
+    let id = restricted.open("restricted.pdf", None, bytes.clone(), None).unwrap();
+    let before = restricted.get(id).unwrap().bytes.clone();
+    assert_eq!(restricted.extract(id, &[0]), Err(EditError::NotPermitted("extracting pages")));
+    assert_eq!(restricted.split(id, &pdfcraft_organize::SplitBy::PageCount(1)), Err(EditError::NotPermitted("splitting the document")));
+    assert_eq!(restricted.split_by_size(id, 1), Err(EditError::NotPermitted("splitting the document")));
+    let doc = restricted.get(id).unwrap();
+    assert_eq!(doc.info.pages.len(), 2);
+    assert!(!doc.dirty);
+    assert_eq!(doc.bytes, before, "a refused extraction leaves the source untouched");
+
+    let sources = vec![("restricted.pdf".into(), bytes.clone(), None)];
+    assert!(matches!(restricted.combine_unlocked(&sources, &[None]), Err(EditError::Source(_))));
+    let combined = restricted.combine_unlocked(&sources, &[Some("boss")]).unwrap();
+    assert_eq!(pdfcraft_organize::page_count(&pdfcraft_cos::Document::open(combined).unwrap()).unwrap(), 2);
+}
+
+/// A file under "Any except extracting pages" (#5081) is refused as an Insert Pages or Replace
+/// Pages source for an unprotected document, which is left as it was, with nothing to undo.
+#[test]
+fn extraction_permissions_refuse_a_restricted_page_source() {
+    let bytes = protected_with_changes(pdfcraft_cos::Algorithm::Aes256, Changes::AnyExceptExtract);
+    let plain = Arc::new(fixture(1));
+    let mut destination = Session::new();
+    let dest = destination.open("destination.pdf", None, plain.clone(), None).unwrap();
+    let insert = Edit::InsertPagesFrom {
+        name: "restricted.pdf".into(),
+        bytes: bytes.clone(),
+        pages: None,
+        at: 1,
+        field_conflicts: pdfcraft_organize::FieldConflicts::Rename,
+    };
+    assert!(matches!(destination.apply(dest, insert), Err(EditError::Source(_))));
+    assert_eq!(destination.get(dest).unwrap().bytes, plain, "a refused insert leaves the destination untouched");
+    assert_eq!(destination.get(dest).unwrap().info.pages.len(), 1);
+    assert_eq!(destination.get(dest).unwrap().can_undo(), None);
+    assert!(matches!(
+        destination.apply(dest, Edit::ReplacePages { pages: vec![0], name: "restricted.pdf".into(), bytes: bytes.clone(), src_pages: vec![0] }),
+        Err(EditError::Source(_))
+    ));
+    assert_eq!(destination.get(dest).unwrap().bytes, plain, "a refused replace leaves the destination untouched");
+}
+
+/// Opened with the permissions password, a file under "Any except extracting pages" (#5081) can
+/// be extracted from and split.
+#[test]
+fn extraction_permissions_yield_to_the_owner_password() {
+    let bytes = protected_with_changes(pdfcraft_cos::Algorithm::Aes256, Changes::AnyExceptExtract);
+    let mut owner = Session::new();
+    let owner_id = owner.open("restricted.pdf", None, bytes, Some("boss")).unwrap();
+    assert!(owner.get(owner_id).unwrap().permissions().unwrap().extract_pages());
+    assert!(owner.extract(owner_id, &[0]).is_ok());
+    assert_eq!(owner.split(owner_id, &pdfcraft_organize::SplitBy::PageCount(1)).unwrap().len(), 2);
+    assert_eq!(owner.split_by_size(owner_id, 1).unwrap().len(), 2);
+}
+
+/// A document that allows page changes but not copying, so not page extraction (#5081), takes
+/// pages back from a file under exactly its own protection (a cut and paste, or another file
+/// made with the same key and `/Encrypt` values), through Insert Pages' file check as well, and
+/// through Replace Pages and its check, and keeps the restriction; the same file is refused as a
+/// source for an unprotected or a differently protected document.
+#[test]
+fn pages_under_the_same_protection_are_inserted_without_page_extraction() {
+    use pdfcraft_cos::Algorithm::Aes256;
+
+    let bytes = protected_pages(2, Aes256, Changes::Pages, 8);
+    let mut same = Session::new();
+    let same_id = same.open("same.pdf", None, bytes.clone(), None).unwrap();
+    let permissions = same.get(same_id).unwrap().permissions().unwrap();
+    assert!(permissions.assemble() && !permissions.extract_pages(), "/P={:#x}", permissions.bits);
+    let insert = |name: &str, bytes: &Arc<Vec<u8>>, at| Edit::InsertPagesFrom {
+        name: name.into(),
+        bytes: bytes.clone(),
+        pages: None,
+        at,
+        field_conflicts: pdfcraft_organize::FieldConflicts::Rename,
+    };
+    // Its own bytes, as Paste inserts them after a cut or copy.
+    same.apply(same_id, insert("same.pdf", &bytes, 2)).unwrap();
+    assert_eq!(same.get(same_id).unwrap().info.pages.len(), 4);
+    assert!(same.get(same_id).unwrap().dirty);
+
+    // A separate file made with the same key and /Encrypt values, and other pages.
+    let other = protected_pages(3, Aes256, Changes::Pages, 8);
+    let (a, b) = (pdfcraft_cos::Document::open(bytes.clone()).unwrap(), pdfcraft_cos::Document::open(other.clone()).unwrap());
+    let (a, b) = (a.security().unwrap(), b.security().unwrap());
+    assert!(a.file_key() == b.file_key() && a.dict() == b.dict(), "the two files share their protection");
+    assert!(matches!(same.page_count_of("other.pdf", &other), Err(EditError::Source(_))), "a plain page source must allow extraction");
+    assert_eq!(same.insert_source(same_id, "other.pdf", &other).map(|(n, _)| n), Ok(3));
+    same.apply(same_id, insert("other.pdf", &other, 4)).unwrap();
+    // Replace Pages takes them on the same terms.
+    let replace = |bytes: &Arc<Vec<u8>>| Edit::ReplacePages { pages: vec![0], name: "other.pdf".into(), bytes: bytes.clone(), src_pages: vec![2] };
+    assert_eq!(same.replace_source(same_id, "other.pdf", &other), Ok(3));
+    same.apply(same_id, replace(&other)).unwrap();
+    assert_eq!(same.get(same_id).unwrap().info.pages.len(), 7);
+    let saved = same.save_bytes(same_id).unwrap();
+    let reopened = pdfcraft_cos::Document::open_with_password(saved, None).unwrap();
+    assert_eq!(pdfcraft_organize::page_count(&reopened).unwrap(), 7);
+    assert!(!reopened.permissions().unwrap().extract_pages(), "same-protection assembly keeps the extraction restriction");
+
+    // Neither an unprotected document nor one under other protection takes them.
+    for destination in [Arc::new(fixture(1)), protected_pages(1, Aes256, Changes::Pages, 9)] {
+        let mut session = Session::new();
+        let dest = session.open("destination.pdf", None, destination, None).unwrap();
+        let before = session.get(dest).unwrap().bytes.clone();
+        assert!(matches!(session.insert_source(dest, "same.pdf", &bytes), Err(EditError::Source(_))));
+        assert!(matches!(session.apply(dest, insert("same.pdf", &bytes, 1)), Err(EditError::Source(_))));
+        assert!(matches!(session.replace_source(dest, "same.pdf", &bytes), Err(EditError::Source(_))));
+        assert!(matches!(session.apply(dest, replace(&bytes)), Err(EditError::Source(_))));
+        assert_eq!(session.get(dest).unwrap().bytes, before, "a refused insert or replace leaves the destination untouched");
+        assert_eq!(session.get(dest).unwrap().info.pages.len(), 1);
+    }
+}
+
+/// Taking pages out also needs copying (bit 5, #5081): a document that withholds only copying
+/// refuses Extract, Split and being a page source, on a revision-2 handler too, whose reserved
+/// bit 11 is always set. The owner password still lifts it.
+#[test]
+fn page_extraction_needs_the_copy_permission_on_every_revision() {
+    for algorithm in [pdfcraft_cos::Algorithm::Rc4_40, pdfcraft_cos::Algorithm::Aes256] {
+        let mut doc = pdfcraft_cos::Document::open(Arc::new(fixture(2))).unwrap();
+        doc.set_encryption(&pdfcraft_cos::NewEncryption {
+            algorithm,
+            user_password: "",
+            owner_password: "boss",
+            permissions: -1 ^ 0b1_0000, // everything but copying
+            encrypt_metadata: true,
+            seed: [9; 32],
+        })
+        .unwrap();
+        let bytes = Arc::new(pdfcraft_cos::write_full(&doc, &Default::default()).unwrap());
+        let mut s = Session::new();
+        let id = s.open("no-copy.pdf", None, bytes.clone(), None).unwrap();
+        let permissions = s.get(id).unwrap().permissions().unwrap();
+        assert!(permissions.assemble() && !permissions.extract_pages(), "{algorithm:?}");
+        assert!(s.get(id).unwrap().allows_assembly() && !s.get(id).unwrap().allows_page_extraction(), "{algorithm:?}");
+        assert_eq!(s.extract(id, &[0]), Err(EditError::NotPermitted("extracting pages")), "{algorithm:?}");
+        assert_eq!(s.split(id, &pdfcraft_organize::SplitBy::PageCount(1)), Err(EditError::NotPermitted("splitting the document")));
+        assert_eq!(crate::combine_source_check(&bytes, None), Err(crate::SourceProblem::NotPermitted), "{algorithm:?}");
+        assert_eq!(crate::combine_source_check(&bytes, Some("boss")), Ok(()), "{algorithm:?}");
+        let owner = s.open("no-copy.pdf", None, bytes, Some("boss")).unwrap();
+        assert!(s.extract(owner, &[0]).is_ok(), "{algorithm:?}");
+    }
+}
+
 #[test]
 fn encrypted_documents_open_edit_and_save_encrypted() {
     let bytes = protected("pw", "owner", -1);
@@ -3337,9 +3542,10 @@ fn the_renderer_check_refuses_text_still_shown_under_a_mark() {
     mark_shown_text(&mut s, id, "SECRET42");
     let doc = s.get(id).unwrap();
     let mut cos = doc.editor.as_ref().unwrap().cos.clone();
-    let marks = pdfcraft_redact::marks(&cos);
+    let model = pdfcraft_model::pages(&cos);
+    let marks: Vec<_> = pdfcraft_redact::marks(&cos).into_iter().filter_map(|m| model.get(m.page).map(|p| (p.obj, m))).collect();
     let refused = |cos: &pdfcraft_cos::Document| {
-        let shown = shown_under_redactions(cos, &marks, &[], &doc.info.pages, None);
+        let shown = shown_under_redactions(cos, &marks, &[], None);
         matches!(shown, Err(EditError::Redact(pdfcraft_redact::RedactError::Residue(n))) if n > 0)
     };
     assert!(refused(&cos));
@@ -6625,6 +6831,43 @@ fn form_javascript_validates_calculates_and_formats() {
     assert!(s.get(id).unwrap().form.iter().find(|f| f.name == "total").unwrap().read_only());
     assert_eq!(s.get(id).unwrap().can_undo(), Some("Run JavaScript"));
 
+    s.apply(id, Edit::InsertBlankPage { at: 1, width: 200.0, height: 300.0 }).unwrap();
+    s.apply(id, Edit::DuplicateField { name: "go".into(), pages: vec![1] }).unwrap();
+    let props = Box::new(FieldProps { caption: Some((0, "Continue".into())), ..Default::default() });
+    s.apply(id, Edit::SetFieldProps { name: "go".into(), props }).unwrap();
+    s.apply(id, Edit::SetFieldProps { name: "go".into(), props: Box::new(FieldProps { caption: Some((1, "Old".into())), ..Default::default() }) })
+        .unwrap();
+    let caption =
+        s.run_javascript(id, "getField('go').buttonSetCaption('Continue'); event.value = getField('go').buttonGetCaption();", Some("go")).unwrap();
+    assert_eq!(caption.error, None);
+    assert_eq!(caption.result.as_deref(), Some("Continue"));
+    assert_eq!(
+        s.get(id).unwrap().form.iter().find(|f| f.name == "go").map(|f| f.widgets.iter().map(|w| w.caption.as_deref()).collect::<Vec<_>>()),
+        Some(vec![Some("Continue"), Some("Continue")]),
+        "setting a caption already shown by the first widget updates every widget",
+    );
+    assert_eq!(s.get(id).unwrap().can_undo(), Some("Run JavaScript"));
+    s.undo(id).unwrap();
+    assert_eq!(
+        s.get(id).unwrap().form.iter().find(|f| f.name == "go").and_then(|f| f.widgets.first()).and_then(|w| w.caption.as_deref()),
+        Some("Continue"),
+        "undo keeps the first widget's original caption",
+    );
+    assert_eq!(
+        s.get(id).unwrap().form.iter().find(|f| f.name == "go").and_then(|f| f.widgets.get(1)).and_then(|w| w.caption.as_deref()),
+        Some("Old"),
+        "undo restores the second widget's original caption",
+    );
+    s.redo(id).unwrap();
+    assert_eq!(
+        s.get(id).unwrap().form.iter().find(|f| f.name == "go").and_then(|f| f.widgets.first()).and_then(|w| w.caption.as_deref()),
+        Some("Continue")
+    );
+    assert_eq!(
+        s.get(id).unwrap().form.iter().find(|f| f.name == "go").and_then(|f| f.widgets.get(1)).and_then(|w| w.caption.as_deref()),
+        Some("Continue")
+    );
+
     // JavaScript off: scripts don't run.
     s.set_javascript(false);
     s.apply(id, Edit::SetFieldValue { name: "qty".into(), value: FieldValue::Text("500".into()) }).unwrap();
@@ -6633,9 +6876,96 @@ fn form_javascript_validates_calculates_and_formats() {
 }
 
 #[test]
+fn javascript_field_colours_persist_and_undo_without_changing_other_appearance_properties() {
+    let mut s = Session::new().with_clock(|| 1_700_000_000);
+    let id = s.open("order.pdf", None, Arc::new(scripted_form()), None).unwrap();
+    s.apply(
+        id,
+        Edit::SetFieldProps {
+            name: "price".into(),
+            props: Box::new(FieldProps {
+                appearance: Some(pdfcraft_forms::LookPatch {
+                    border: Some(Some([0.1, 0.2, 0.3])),
+                    font: Some(pdfcraft_forms::FieldFont::Courier),
+                    ..Default::default()
+                }),
+                ..Default::default()
+            }),
+        },
+    )
+    .unwrap();
+    let before = s.get(id).unwrap().form.iter().find(|f| f.name == "price").unwrap().value.clone();
+    let out = s.run_javascript(id, "var f = getField('price'); f.fillColor = color.red; f.textColor = color.blue;", None).unwrap();
+    assert_eq!(out.error, None);
+    assert_eq!(s.get(id).unwrap().can_undo(), Some("Run JavaScript"));
+
+    let inspect = |bytes: Arc<Vec<u8>>| {
+        let doc = pdfcraft_cos::Document::open(bytes).unwrap();
+        let f = pdfcraft_forms::fields(&doc).into_iter().find(|f| f.name == "price").unwrap();
+        let look = pdfcraft_forms::look(&doc, &f);
+        assert_eq!(look.fill, Some([1.0, 0.0, 0.0]));
+        assert_eq!(look.text, [0.0, 0.0, 1.0]);
+        assert_eq!(look.border, Some([0.1, 0.2, 0.3]));
+        assert_eq!(look.font, pdfcraft_forms::FieldFont::Courier);
+        assert_eq!(f.value, before);
+    };
+    inspect(s.save_bytes(id).unwrap());
+    s.undo(id).unwrap();
+    let undone = pdfcraft_cos::Document::open(s.save_bytes(id).unwrap()).unwrap();
+    let f = pdfcraft_forms::fields(&undone).into_iter().find(|f| f.name == "price").unwrap();
+    assert_eq!(pdfcraft_forms::look(&undone, &f).fill, None);
+    s.redo(id).unwrap();
+    inspect(s.save_bytes(id).unwrap());
+
+    let reopened = s.open("saved.pdf", None, s.save_bytes(id).unwrap(), None).unwrap();
+    let reopened_doc = pdfcraft_cos::Document::open(s.save_bytes(reopened).unwrap()).unwrap();
+    let f = pdfcraft_forms::fields(&reopened_doc).into_iter().find(|f| f.name == "price").unwrap();
+    assert_eq!(pdfcraft_forms::look(&reopened_doc, &f).fill, Some([1.0, 0.0, 0.0]));
+    assert_eq!(pdfcraft_forms::look(&reopened_doc, &f).text, [0.0, 0.0, 1.0]);
+}
+
+#[test]
+fn javascript_invalid_field_colour_array_is_refused_without_partial_changes() {
+    let mut s = Session::new().with_clock(|| 1_700_000_000);
+    let id = s.open("order.pdf", None, Arc::new(scripted_form()), None).unwrap();
+    let before = s.save_bytes(id).unwrap();
+    let err = s.run_javascript(id, "var f = getField('price'); f.value = '9'; f.fillColor = ['RGB', 2, 0, 0];", None).unwrap_err();
+    assert!(err.to_string().contains("finite components between 0 and 1"), "{err}");
+    assert_eq!(s.save_bytes(id).unwrap(), before, "a refused script changes nothing");
+}
+
+#[test]
+fn javascript_field_colours_respect_document_fill_permissions() {
+    let mut plain = pdfcraft_cos::Document::open(Arc::new(scripted_form())).unwrap();
+    plain
+        .set_encryption(&pdfcraft_cos::NewEncryption {
+            algorithm: pdfcraft_cos::Algorithm::Aes256,
+            user_password: "",
+            owner_password: "owner",
+            permissions: 0,
+            encrypt_metadata: true,
+            seed: [7; 32],
+        })
+        .unwrap();
+    let bytes = Arc::new(pdfcraft_cos::write_full(&plain, &Default::default()).unwrap());
+    let mut s = Session::new().with_clock(|| 1_700_000_000);
+    let id = s.open("locked.pdf", None, bytes, None).unwrap();
+    assert!(!s.get(id).unwrap().allows_form_filling());
+    assert_eq!(
+        s.run_javascript(id, "getField('price').fillColor = color.red;", None).unwrap_err(),
+        EditError::NotPermitted("filling in form fields")
+    );
+    assert!(!s.get(id).unwrap().dirty);
+}
+
+#[test]
+/// Synchronous calculation exposes pending values immediately and persists the invocation as one undo transaction.
 fn calculate_now_updates_live_fields_in_one_undo_step() {
     let mut s = Session::new().with_clock(|| 1_700_000_000);
     let id = s.open("calculate-now.pdf", None, Arc::new(scripted_form()), None).unwrap();
+    let value = |s: &Session, name: &str| s.get(id).unwrap().form.iter().find(|f| f.name == name).unwrap().value.clone();
+    let before_price = value(&s, "price");
+    let before_qty = value(&s, "qty");
     let out = s
         .run_javascript(
             id,
@@ -6648,52 +6978,18 @@ fn calculate_now_updates_live_fields_in_one_undo_step() {
     assert_eq!(total, ["6"]);
     assert_eq!(s.get(id).unwrap().can_undo(), Some("Run JavaScript"));
     s.undo(id).unwrap();
+    assert_eq!(value(&s, "price"), before_price);
+    assert_eq!(value(&s, "qty"), before_qty);
     assert!(s.get(id).unwrap().form.iter().find(|f| f.name == "total").unwrap().value.is_empty());
     s.redo(id).unwrap();
+    assert_eq!(value(&s, "price"), ["3"]);
+    assert_eq!(value(&s, "qty"), ["2"]);
     assert_eq!(s.get(id).unwrap().form.iter().find(|f| f.name == "total").unwrap().value, ["6"]);
     let bytes = s.save_bytes(id).unwrap();
     let reopened = s.open("reopened.pdf", None, bytes, None).unwrap();
     assert_eq!(s.get(reopened).unwrap().form.iter().find(|f| f.name == "total").unwrap().value, ["6"]);
 }
 
-#[test]
-fn calculate_now_applies_format_script_to_updated_appearance() {
-    let mut session = Session::new().with_clock(|| 1_700_000_000);
-    let id = session.open("calculate-format.pdf", None, Arc::new(scripted_form()), None).unwrap();
-    session.run_javascript(id, "getField('price').value = 3; getField('qty').value = 2; calculateNow();", None).unwrap();
-
-    assert_eq!(session.get(id).unwrap().form.iter().find(|field| field.name == "total").unwrap().value, ["6"]);
-    assert!(page_texts(&session, id)[0].contains("USD 6.00"), "the appearance uses the Format script");
-}
-
-#[test]
-fn calculation_scripts_are_built_only_for_scripts_that_call_calculate_now() {
-    let mut s = Session::new().with_clock(|| 1_700_000_000);
-    let id = s.open("calculate-list.pdf", None, Arc::new(scripted_form()), None).unwrap();
-    crate::js::CALCULATION_SCRIPT_BUILDS.with(|calls| calls.set(0));
-
-    s.run_javascript(id, "1 + 1", None).unwrap();
-    assert_eq!(crate::js::CALCULATION_SCRIPT_BUILDS.with(std::cell::Cell::get), 0);
-
-    s.run_javascript(id, "calculateNow();", None).unwrap();
-    assert_eq!(crate::js::CALCULATION_SCRIPT_BUILDS.with(std::cell::Cell::get), 1);
-
-    use pdfcraft_forms::{FieldEvent, Scripts};
-    let cos = pdfcraft_cos::Document::open(Arc::new(scripted_form())).unwrap();
-    let fields = pdfcraft_forms::fields(&cos);
-    let target = fields.iter().find(|f| f.name == "go").unwrap();
-    let mut runner = crate::js::JsRunner::new(&cos, "calculate-list.pdf", false);
-    crate::js::CALCULATION_SCRIPT_BUILDS.with(|calls| calls.set(0));
-
-    runner.run(FieldEvent::Calculate, "1 + 1", target, "", &fields);
-    assert_eq!(crate::js::CALCULATION_SCRIPT_BUILDS.with(std::cell::Cell::get), 0);
-
-    runner.run(FieldEvent::Calculate, "calculateNow();", target, "", &fields);
-    assert_eq!(crate::js::CALCULATION_SCRIPT_BUILDS.with(std::cell::Cell::get), 1);
-    runner.run(FieldEvent::Calculate, "calculateNow();", target, "", &fields);
-    assert_eq!(crate::js::CALCULATION_SCRIPT_BUILDS.with(std::cell::Cell::get), 1);
-}
-
 #[test]
 fn calculate_now_in_a_document_script_helper_gets_the_calculation_list() {
     let helpers = "function times\\(a, b\\) { return a * b; } function recalc\\(\\) { calculateNow\\(\\); }";
@@ -6708,6 +7004,7 @@ fn calculate_now_in_a_document_script_helper_gets_the_calculation_list() {
 }
 
 #[test]
+/// Respect explicit calculation order, restore the outer event and stop recursive calculation requests.
 fn calculate_now_uses_calculation_order_and_bounds_recursion() {
     let mut s = Session::new().with_clock(|| 1_700_000_000);
     let id = s.open("calculate-chain.pdf", None, Arc::new(scripted_form()), None).unwrap();
@@ -6721,18 +7018,34 @@ fn calculate_now_uses_calculation_order_and_bounds_recursion() {
     assert!(out.error.is_none(), "{out:?}");
     assert!(out.console.iter().any(|line| line == "8"), "{out:?}");
 
+    s.set_javascript(false); // Installing scripts must not change the 4/8 starting values.
     for (name, script) in
         [("qty", "event.value = Number(getField('total').value) + 1;"), ("total", "event.value = Number(getField('qty').value) + 1;")]
     {
         s.apply(id, Edit::SetFieldScript { name: name.into(), event: "calculate".into(), script: Some(script.into()) }).unwrap();
     }
-    let cyclic = s.run_javascript(id, "calculateNow();", None).unwrap();
+    s.set_javascript(true);
+    let starting = |name: &str| s.get(id).unwrap().form.iter().find(|f| f.name == name).unwrap().value.clone();
+    assert_eq!(starting("qty"), ["4"]);
+    assert_eq!(starting("total"), ["8"]);
+    let cyclic =
+        s.run_javascript(id, "calculateNow(); console.println(getField('qty').value); console.println(getField('total').value);", None).unwrap();
     assert!(cyclic.error.is_none(), "a cyclic calculation runs once in order: {cyclic:?}");
+    let field = |name: &str| s.get(id).unwrap().form.iter().find(|f| f.name == name).unwrap().value.clone();
+    assert_eq!(cyclic.console, ["9", "10"], "the explicit ordered pass runs exactly once");
+    // Applying the value delta invokes the existing automatic form-recalculation pass.
+    assert_eq!(field("qty"), ["11"]);
+    assert_eq!(field("total"), ["12"]);
 
-    s.apply(id, Edit::SetFieldScript { name: "total".into(), event: "calculate".into(), script: Some("calculateNow(); event.value = 12;".into()) })
-        .unwrap();
-    let out = s.run_javascript(id, "calculateNow();", None).unwrap();
-    assert!(out.console.iter().any(|line| line.contains("calculateNow recursion limit exceeded")), "{out:?}");
+    let recursive =
+        Edit::SetFieldScript { name: "total".into(), event: "calculate".into(), script: Some("calculateNow(); event.value = 12;".into()) };
+    let refused = s.apply(id, recursive.clone()).unwrap_err();
+    assert!(refused.to_string().contains("calculateNow recursion limit exceeded"), "{refused:?}");
+    s.set_javascript(false);
+    s.apply(id, recursive).unwrap();
+    s.set_javascript(true);
+    let error = s.run_javascript(id, "calculateNow();", None).unwrap_err();
+    assert!(error.to_string().contains("calculateNow recursion limit exceeded"), "{error:?}");
     s.set_javascript(false);
     assert!(s.run_javascript(id, "calculateNow();", None).is_err());
     s.set_javascript(true);
@@ -6815,7 +7128,7 @@ fn calculation_order_cache_refreshes_after_inserting_pages() {
     let fields = pdfcraft_forms::fields(&doc);
     let qty = fields.iter().find(|field| field.name == "qty").unwrap();
     let mut js = crate::js::JsRunner::new(&doc, "destination.pdf", false);
-    js.run(FieldEvent::Format, "calculateNow();", qty, "", &fields);
+    js.run(FieldEvent::Format, "calculateNow();", qty, "", &fields, &doc);
 
     let source = pdfcraft_testkit::Pdf::new()
         .obj("<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R] /CO [4 0 R] >> >>")
@@ -6841,7 +7154,7 @@ fn calculation_order_cache_refreshes_after_inserting_pages() {
     let fields = pdfcraft_forms::fields(&doc);
     let qty = fields.iter().find(|field| field.name == "qty").unwrap();
     let js = cx.js.as_mut().unwrap();
-    let result = js.run(FieldEvent::Format, "calculateNow();", qty, "", &fields);
+    let result = js.run(FieldEvent::Format, "calculateNow();", qty, "", &fields, &doc);
     assert!(
         result.changes.iter().any(|change| {
             change.name == "importedTotal" && change.value.as_ref().is_some_and(|value| value.len() == 1 && value.first().is_some_and(|v| v == "9"))
@@ -6857,7 +7170,7 @@ fn javascript_field_rect_moves_first_widget_and_undoes() {
     let mut s = Session::new();
     let id = s.open("rect.pdf", None, Arc::new(scripted_form()), None).unwrap();
     let initial = s.get(id).unwrap().form.iter().find(|f| f.name == "price").unwrap().widgets[0].rect;
-    s.run_javascript(id, "getField('price').rect = [30, 40, 130, 60];", Some("go")).unwrap();
+    s.run_javascript(id, "getField('price').rect = [30, 60, 130, 40];", Some("go")).unwrap();
     assert_eq!(s.get(id).unwrap().form.iter().find(|f| f.name == "price").unwrap().widgets[0].rect, [30.0, 40.0, 130.0, 60.0]);
     assert_eq!(s.get(id).unwrap().can_undo(), Some("Run JavaScript"));
     s.undo(id).unwrap();
@@ -6885,20 +7198,39 @@ fn scripts_in_an_xfa_form_see_the_xfa_plugin_installed() {
 /// helper stays defined, the form calculates, and the error is reported once.
 #[test]
 fn a_document_script_that_throws_still_lets_the_form_calculate() {
-    let helpers =
-        "function times\\(a, b\\) { return a * b; } this.getField\\('go'\\).buttonSetIcon\\(this.getField\\('go'\\).buttonGetIcon\\(\\)\\);";
+    let helpers = "function times\\(a, b\\) { return a * b; } this.getField\\('go'\\).missingTestMethod\\(\\);";
     let mut s = Session::new().with_clock(|| 1_700_000_000);
     let id = s.open("order.pdf", None, Arc::new(scripted_form_with(helpers)), None).unwrap();
-    let _ = s.take_js_output(id);
+    let initial = s.take_js_output(id);
+    assert_eq!(initial.doc_errors.len(), 1, "the initializer error is reported at open");
     s.apply(id, Edit::SetFieldValue { name: "qty".into(), value: FieldValue::Text("4".into()) }).unwrap();
     let total = s.get(id).unwrap().form.iter().find(|f| f.name == "total").unwrap().value.clone();
     assert_eq!(total, ["10"], "calculated through the helper the failing script defined");
     let out = s.take_js_output(id);
-    assert_eq!(out.errors.len(), 1, "reported once, not once per script: {out:?}");
-    assert!(out.errors[0].starts_with("document script 1: TypeError"), "{out:?}");
-    // The console runs too, and says which document script failed.
+    assert!(out.errors.is_empty(), "the initializer is not replayed: {out:?}");
+    // The console runs too, without replaying the failed initializer.
     let o = s.run_javascript(id, "times(2, 3)", None).unwrap();
-    assert_eq!((o.error, o.result.as_deref(), o.doc_errors.len()), (None, Some("6"), 1));
+    assert_eq!((o.error, o.result.as_deref(), o.doc_errors.len()), (None, Some("6"), 0));
+}
+
+/// A looping initializer is reported once and later initializers and field events still run.
+#[test]
+fn a_document_script_at_the_vm_limit_does_not_block_field_edits() {
+    let mut cos = pdfcraft_cos::Document::open(Arc::new(scripted_form_with(r"while \(true\) {}"))).unwrap();
+    pdfcraft_forms::set_document_script(&mut cos, "later", Some("function times(a, b) { return a * b; }")).unwrap();
+    let bytes = Arc::new(pdfcraft_cos::write_full(&cos, &Default::default()).unwrap());
+    let mut s = Session::new().with_clock(|| 1_700_000_000);
+    let id = s.open("order.pdf", None, bytes, None).unwrap();
+    let initial = s.take_js_output(id);
+    assert_eq!(initial.doc_errors.len(), 1, "{initial:?}");
+    assert!(initial.doc_errors[0].contains("RuntimeLimitError"), "{initial:?}");
+
+    for (qty, total) in [("4", "10"), ("6", "15")] {
+        s.apply(id, Edit::SetFieldValue { name: "qty".into(), value: FieldValue::Text(qty.into()) }).unwrap();
+        assert_eq!(s.get(id).unwrap().form.iter().find(|f| f.name == "total").unwrap().value, [total]);
+        let out = s.take_js_output(id);
+        assert!(out.errors.is_empty() && out.doc_errors.is_empty(), "{out:?}");
+    }
 }
 
 #[test]
@@ -6974,14 +7306,13 @@ fn inactive_xfa_and_ordinary_pdfs_keep_document_helpers_and_alerts() {
 }
 
 #[test]
+/// Read inherited page boxes without dirtying the document and reject invalid box/page requests.
 fn js_get_page_box_reads_effective_boxes_without_editing_the_document() {
     let (mut s, id) = session_with(1);
     let before = s.get(id).expect("opened document").can_undo().map(str::to_owned);
-    let out = s
-        .run_javascript(id, "JSON.stringify([this.getPageBox(), this.getPageBox('Media', 0), this.getPageBox('Trim', 0)])", None)
-        .expect("script runs");
+    let out = s.run_javascript(id, "JSON.stringify([this.getPageBox(), this.getPageBox('Media', 0)])", None).expect("script runs");
     assert_eq!(out.error, None, "{out:?}");
-    assert_eq!(out.result.as_deref(), Some("[[0,300,200,0],[0,300,200,0],[0,300,200,0]]"));
+    assert_eq!(out.result.as_deref(), Some("[[0,300,200,0],[0,300,200,0]]"));
     assert_eq!(s.get(id).expect("document remains open").can_undo(), before.as_deref());
 
     s.apply(id, Edit::RotatePages { pages: vec![0], degrees: 90 }).expect("rotate page");
@@ -7007,6 +7338,7 @@ fn automatic_field_scripts_cannot_print() {
             target,
             "2",
             &fields,
+            &cos,
         );
         assert!(result.rc, "{event:?}: {result:?}");
         assert_eq!(result.value, "4");
@@ -7018,7 +7350,7 @@ fn automatic_field_scripts_cannot_print() {
         assert!(runner.output.errors.is_empty());
 
         runner.output = js::JsOutput::default();
-        runner.run(event, "this.print(); throw new Error('broken script');", target, "2", &fields);
+        runner.run(event, "this.print(); throw new Error('broken script');", target, "2", &fields, &cos);
         assert!(runner.output.requests.is_empty(), "{event:?}: {:?}", runner.output);
         assert!(runner.output.errors.iter().any(|e| e.contains("broken script")));
     }
@@ -7033,7 +7365,7 @@ fn automatic_print_suppression_preserves_document_errors() {
     let target = fields.iter().find(|f| f.name == "qty").unwrap();
     let mut runner = js::JsRunner::new(&cos, "order.pdf", false);
     for event in [FieldEvent::Keystroke, FieldEvent::Validate, FieldEvent::Calculate, FieldEvent::Format] {
-        runner.run(event, "this.print(); throw new Error('field failure');", target, "2", &fields);
+        runner.run(event, "this.print(); throw new Error('field failure');", target, "2", &fields, &cos);
     }
     let out = runner.output;
     assert!(out.requests.is_empty(), "{out:?}");
@@ -7371,13 +7703,15 @@ fn comparing_two_versions_of_a_document() {
     assert!(marks[0].contents.as_deref().unwrap().starts_with("Replaced: \"Monday.\""));
 }
 
+/// Built-in and custom actions run their steps on a file (with JavaScript on), report each
+/// step's progress, and fail cleanly on a file that is not a PDF.
 #[test]
 fn actions_run_their_steps_on_files() {
     let s = Session::new();
     let src = s.create_from_text("t", "Quarterly numbers").unwrap();
     let built = actions::builtin();
     let numbers = built.iter().find(|a| a.name == "Add Page Numbers").unwrap();
-    let r = actions::run_on(numbers, "q.pdf", src.clone(), |_, _| {}).unwrap();
+    let r = actions::run_on(numbers, "q.pdf", src.clone(), true, |_, _| {}).unwrap();
     let mut s2 = Session::new();
     let id = s2.open("out.pdf", None, r.bytes, None).unwrap();
     assert!(page_texts(&s2, id)[0].contains("Page 1 of 1"), "{:?}", page_texts(&s2, id));
@@ -7395,14 +7729,38 @@ fn actions_run_their_steps_on_files() {
         builtin: false,
     };
     let mut steps = Vec::new();
-    let r = actions::run_on(&custom, "q.pdf", src, |i, n| steps.push((i, n))).unwrap();
+    let r = actions::run_on(&custom, "q.pdf", src, true, |i, n| steps.push((i, n))).unwrap();
     assert_eq!(steps, [(0, 4), (1, 4), (2, 4), (3, 4)]);
     assert_eq!(r.log.len(), 4, "{:?}", r.log);
     let id = s2.open("out2.pdf", None, r.bytes, None).unwrap();
     let d = s2.get(id).unwrap();
     assert_eq!(d.info.title.as_deref(), Some("Q3"));
     assert!(page_texts(&s2, id)[0].contains("DRAFT"));
-    assert!(actions::run_on(&custom, "bad.pdf", Arc::new(b"nope".to_vec()), |_, _| {}).is_err());
+    assert!(actions::run_on(&custom, "bad.pdf", Arc::new(b"nope".to_vec()), true, |_, _| {}).is_err());
+}
+
+/// #5080: a "Run a JavaScript" step honours the caller's JavaScript preference. With it on, the
+/// step runs and writes the field; with it off, the step does not run, so `run_on` reports the
+/// refused script's error instead of saving a script-produced value. Before the fix each file
+/// opened in a fresh JavaScript-on session, so the step ran whatever the caller chose.
+#[test]
+fn an_action_runs_a_javascript_step_only_when_javascript_is_on() {
+    let action = actions::Action {
+        name: "Set price".into(),
+        description: String::new(),
+        steps: vec![actions::Step::RunJavaScript("getField('price').value = 3;".into())],
+        builtin: false,
+    };
+    let src = Arc::new(scripted_form());
+    // JavaScript on: the step runs, so the saved file has price = 3.
+    let on = actions::run_on(&action, "f.pdf", src.clone(), true, |_, _| {}).unwrap();
+    let mut s = Session::new();
+    s.set_javascript(false); // read the saved state without re-running any script
+    let id = s.open("on.pdf", None, on.bytes, None).unwrap();
+    let price = s.get(id).unwrap().form.iter().find(|f| f.name == "price").unwrap().value.clone();
+    assert_eq!(price, ["3"], "the script ran with JavaScript on");
+    // JavaScript off: the step does not run, so run_on fails rather than writing a scripted value.
+    assert!(actions::run_on(&action, "f.pdf", src, false, |_, _| {}).is_err());
 }
 
 /// A removal step that fails (here: a signed file can't be rewritten without its hidden data)
@@ -7419,7 +7777,7 @@ fn actions_fail_when_hidden_information_could_not_be_removed() {
     let signed = s.sign(id, &digital_id, SignOptions { page: 1, ..SignOptions::default() }).unwrap();
     let built = actions::builtin();
     let sanitize = built.iter().find(|a| a.name == "Sanitize Documents").unwrap();
-    let e = actions::run_on(sanitize, "signed.pdf", signed, |_, _| {}).map(|r| r.log).unwrap_err();
+    let e = actions::run_on(sanitize, "signed.pdf", signed, true, |_, _| {}).map(|r| r.log).unwrap_err();
     assert!(e.starts_with("Sanitize document:"), "{e}");
 }
 
@@ -9377,6 +9735,26 @@ fn hostile_xfa_scripts_cannot_hang_or_bloat_the_document() {
     assert!(started.elapsed() < std::time::Duration::from_secs(60), "{:?}", started.elapsed());
 }
 
+#[test]
+fn xfa_focus_follows_the_surviving_row_after_removal() {
+    let tpl = pdfcraft_xfa::fixtures::scripted_template().replace(
+        r#"if (table._row.count > 1) { table._row.removeInstance(table._row.count - 1); }"#,
+        r#"xfa.host.setFocus("table.row[0].amount"); xfa.host.setFocus("table.row[1].amount"); table._row.removeInstance(0);"#,
+    );
+    let mut s = Session::new();
+    let id = s.open("focus-row.pdf", None, Arc::new(pdfcraft_xfa::fixtures::shell(&tpl)), None).unwrap();
+    for _ in 0..2 {
+        s.run_javascript(id, "", Some("addRow")).unwrap();
+    }
+    let out = s.run_javascript(id, "", Some("removeRow")).unwrap();
+    let doc = s.get(id).unwrap();
+    assert_eq!(doc.form.iter().filter(|f| f.name.starts_with("amount")).count(), 2);
+    let cos = &doc.editor.as_ref().unwrap().cos;
+    let by_som = pdfcraft_xfa::field_objects_by_som(cos);
+    let (name, object) = &by_som["form[0].page1[0].table[0].row[0].amount[0]"];
+    assert_eq!(out.requests, [pdfcraft_js::Request::FocusField { name: name.clone(), object_id: crate::js::field_object_id(*object) }], "{out:?}");
+}
+
 #[test]
 fn xfa_scripts_can_remove_rows_twice_and_reset_fields_by_name() {
     let tpl = pdfcraft_xfa::fixtures::scripted_template()
@@ -10847,7 +11225,7 @@ fn an_action_appends_to_a_file_whose_field_walk_passes_a_signature_over() {
     let bytes = Arc::new(signed_field_named(64 << 10));
     let steps = vec![actions::Step::from_id("set_title", "Checked").unwrap()];
     let title = actions::Action { name: "Title".into(), description: String::new(), steps, builtin: false };
-    let r = actions::run_on(&title, "form.pdf", bytes.clone(), |_, _| {}).unwrap();
+    let r = actions::run_on(&title, "form.pdf", bytes.clone(), true, |_, _| {}).unwrap();
     assert!(r.bytes.starts_with(&bytes[..]), "the action rewrote the file instead of appending to it");
     let mut s = Session::new();
     let id = s.open("out.pdf", None, r.bytes, None).unwrap();
@@ -11586,39 +11964,51 @@ fn dynamic_calculation_reads_and_side_effects_reach_later_fields() {
     assert!(s.take_js_output(id).errors.is_empty());
 }
 
-/// Within one edit, a field's `display` reads as the file had it before the edit, even after a
-/// script set it with the value cached; the next edit's runner reads what the script wrote.
 #[test]
-fn scripted_display_changes_survive_warm_cache_and_new_edit() {
+/// Later field callbacks see current COS appearance/flags rather than the runner creation snapshot.
+fn field_scripts_read_current_appearance_during_an_edit() {
     use pdfcraft_forms::{FieldEvent, Scripts};
     let mut cos = pdfcraft_cos::Document::open(Arc::new(synthetic_acroform(2, 0))).unwrap();
     for (display, flags) in [(1, 6), (3, 36), (2, 0), (0, 4)] {
         let fields = pdfcraft_forms::fields(&cos);
-        let target = fields.iter().find(|f| f.name == "ranks").unwrap();
-        let other = fields.iter().find(|f| f.name == "trained").unwrap();
-        let old_display = crate::js::field_state(&cos, other).display;
+        let target = fields.iter().find(|f| f.name == "trained").unwrap();
+        let other = fields.iter().find(|f| f.name == "ranks").unwrap();
         let mut runner = crate::js::JsRunner::new(&cos, "synthetic.pdf", false);
-        // Populate the display cache before a script writes the same field.
-        let warm = runner.run(FieldEvent::Calculate, "event.value = getField('trained').display;", target, "", &fields);
+        let old_display = crate::js::field_state(&cos, other, &runner.doc).display;
+        // Populate script state before a script writes the same field.
+        let warm = runner.run(FieldEvent::Calculate, "event.value = getField('ranks').display;", target, "", &fields, &cos);
         assert_eq!(warm.value, old_display.to_string());
         let result = runner.run(
             FieldEvent::Calculate,
-            &format!("getField('trained').display = {display}; event.value = getField('trained').display;"),
+            &format!("getField('ranks').display = {display}; event.value = getField('ranks').display;"),
             target,
             "",
             &fields,
+            &cos,
         );
         assert_eq!(result.value, display.to_string());
         assert_eq!(result.changes.len(), 1);
         assert_eq!(result.changes.first().unwrap().display, Some(display));
         pdfcraft_forms::apply_script_changes(&mut cos, &result.changes, &mut pdfcraft_forms::NoScripts).unwrap();
         assert_eq!(cos.get(other.widgets.first().unwrap().obj).as_dict().unwrap().int(b"F").unwrap() & 38, flags);
-        // Within an edit the original implementation reads an immutable pre-edit COS snapshot.
-        let same_edit = runner.run(FieldEvent::Calculate, "event.value = getField('trained').display;", target, "", &fields);
-        assert_eq!(same_edit.value, old_display.to_string());
-        // The next edit must rebuild its cache from the newly written annotation flags.
+        pdfcraft_forms::apply_script_changes(
+            &mut cos,
+            &[pdfcraft_forms::FieldChange {
+                name: "ranks".into(),
+                fill_color: Some(vec!["RGB".into(), "0".into(), "1".into(), "0".into()]),
+                ..Default::default()
+            }],
+            &mut pdfcraft_forms::NoScripts,
+        )
+        .unwrap();
+        // A later script in this edit sees the document after the earlier appearance change.
+        let same_edit = runner.run(FieldEvent::Calculate, "event.value = getField('ranks').display;", target, "", &fields, &cos);
+        assert_eq!(same_edit.value, display.to_string());
+        let same_edit_color = runner.run(FieldEvent::Calculate, "event.value = getField('ranks').fillColor.join(',');", target, "", &fields, &cos);
+        assert_eq!(same_edit_color.value, "RGB,0,1,0");
+        // A new runner sees the same current appearance.
         let mut next = crate::js::JsRunner::new(&cos, "synthetic.pdf", false);
-        let read = next.run(FieldEvent::Calculate, "event.value = getField('trained').display;", target, "", &pdfcraft_forms::fields(&cos));
+        let read = next.run(FieldEvent::Calculate, "event.value = getField('ranks').display;", target, "", &pdfcraft_forms::fields(&cos), &cos);
         assert_eq!(read.value, display.to_string());
         assert!(read.changes.is_empty());
         assert!(runner.output.errors.is_empty());
@@ -11779,9 +12169,9 @@ fn an_edits_xfa_and_field_scripts_share_the_field_highlight() {
     let mut cx = EditCtx::new(None, 0);
     cx.js = Some(js::JsRunner::new(&cos, "synthetic.pdf", false));
     cx.set_highlight(true);
-    assert!(cx.js.as_ref().is_some_and(|js| js.doc.highlight), "an XFA script's change reaches the field scripts");
+    assert!(cx.js.as_ref().is_some_and(|js| js.doc.runtime_highlight), "an XFA script's change reaches the field scripts");
     if let Some(js) = cx.js.as_mut() {
-        js.doc.highlight = false;
+        js.doc.runtime_highlight = false;
     }
     assert!(!cx.highlight(), "the next XFA script reads the field scripts' change");
 }
@@ -12075,6 +12465,36 @@ fn a_reset_clears_a_floating_field_in_every_row() {
 
 /// An XFA button's click script may show the attachments panel; a text field's exit script
 /// asking the same is noted on the console and ignored.
+#[test]
+fn xfa_focus_targets_the_widget_after_relayout() {
+    let xdp = r##"<?xml version="1.0" encoding="UTF-8"?>
+<xdp:xdp xmlns:xdp="http://ns.adobe.com/xdp/">
+<template xmlns="http://www.xfa.org/schema/xfa-template/3.3/">
+<subform name="form" layout="tb">
+ <pageSet><pageArea name="front"><contentArea x="0.5in" y="0.5in" w="7.5in" h="10in"/><medium short="8.5in" long="11in"/></pageArea></pageSet>
+ <field name="go" w="2in" h="0.3in"><ui><button/></ui>
+  <event activity="click"><script contentType="application/x-javascript">
+   xfa.host.setFocus(note); extra.presence = "hidden";
+  </script></event>
+ </field>
+ <field name="extra" w="2in" h="0.3in"><ui><textEdit/></ui></field>
+ <field name="note" w="2in" h="0.3in"><ui><textEdit/></ui></field>
+</subform>
+</template>
+</xdp:xdp>
+"##;
+    let mut s = Session::new();
+    let id = s.open("focus.pdf", None, Arc::new(pdfcraft_xfa::fixtures::shell(xdp)), None).unwrap();
+    let note = |s: &Session| s.get(id).unwrap().form.iter().find(|f| f.name == "note").unwrap().obj;
+    let before = note(&s);
+    s.take_js_output(id);
+    s.apply(id, Edit::XfaEvent { som: "form[0].go[0]".into(), activity: "click".into() }).unwrap();
+    let after = note(&s);
+    assert_ne!(before, after);
+    let out = s.take_js_output(id);
+    assert_eq!(out.requests, [pdfcraft_js::Request::FocusField { name: "note".into(), object_id: crate::js::field_object_id(after) }], "{out:?}");
+}
+
 #[test]
 fn an_xfa_button_may_show_a_side_panel_and_other_events_may_not() {
     let xdp = r##"<?xml version="1.0" encoding="UTF-8"?>
@@ -13359,6 +13779,66 @@ fn image_transform_engine_refuses_singular_matrices_without_mutation() {
     }
 }
 
+/// The renderer's check covers a redaction applied inside a batch too, with the marks as they
+/// were when it ran: one the batch itself added is checked, and text a later edit of the batch
+/// puts back under a mark refuses the whole batch.
+#[test]
+fn redactions_applied_in_a_batch_get_the_renderer_check() {
+    let mut s = Session::new().with_clock(|| 1_700_000_000);
+    let page = one_line_page_with("/Font << /F1 4 0 R >>", "", "BT /F1 16 Tf 20 150 Td (Public words then SECRET42) Tj ET");
+    let id = s.open("batch.pdf", None, Arc::new(page), None).unwrap();
+    mark_shown_text(&mut s, id, "SECRET42");
+    let apply = Edit::ApplyRedactions { pages: None };
+    // Text added where the mark was shows under it again: the renderer sees it and refuses.
+    let under = AddedText { rect: [150.0, 130.0, 300.0, 160.0], text: "SECRET42 SECRET42".into(), ..Default::default() };
+    let refused = s.apply(id, Edit::Batch { label: "Redact then write".into(), edits: vec![apply.clone(), Edit::AddText { page: 0, text: under }] });
+    assert!(matches!(refused, Err(EditError::Redact(pdfcraft_redact::RedactError::Residue(n))) if n > 0), "{refused:?}");
+    assert!(page_texts(&s, id)[0].contains("SECRET42"), "nothing changed");
+    assert_eq!(s.get(id).unwrap().redaction_marks(), 1);
+    // Applied alone in a batch, the redaction goes through, and the text is gone.
+    s.apply(id, Edit::Batch { label: "Redact".into(), edits: vec![apply] }).unwrap();
+    assert!(!page_texts(&s, id)[0].contains("SECRET42"), "{:?}", page_texts(&s, id));
+    assert_eq!(s.get(id).unwrap().redaction_marks(), 0);
+}
+
+/// A batch that deletes a page holding a redaction mark and adds pages is refused whole: the
+/// marks cannot be tied to copies, so redaction fails closed. Without added pages it goes through.
+#[test]
+fn a_batch_that_deletes_a_marked_page_and_adds_pages_is_refused() {
+    let mut s = Session::new().with_clock(|| 1_700_000_000);
+    let page = one_line_page_with("/Font << /F1 4 0 R >>", "", "BT /F1 16 Tf 20 150 Td (Public words then SECRET42) Tj ET");
+    let id = s.open("batch.pdf", None, Arc::new(page), None).unwrap();
+    mark_shown_text(&mut s, id, "SECRET42");
+    let edits = vec![
+        Edit::ApplyRedactions { pages: None },
+        Edit::InsertBlankPage { at: 1, width: 612.0, height: 792.0 },
+        Edit::DeletePages { pages: vec![0] },
+    ];
+    let refused = s.apply(id, Edit::Batch { label: "x".into(), edits });
+    assert!(matches!(refused, Err(EditError::Invalid(_))), "{refused:?}");
+    assert!(page_texts(&s, id)[0].contains("SECRET42"), "nothing changed");
+    assert_eq!(s.get(id).unwrap().redaction_marks(), 1);
+}
+
+/// A batch that applies redactions and then copies a page is refused whole: the copy can't be tied
+/// to the marks, so text restored under one would be unchecked. Copying first, or alone, is fine.
+#[test]
+fn a_batch_that_applies_redactions_and_copies_a_page_is_refused() {
+    let mut s = Session::new().with_clock(|| 1_700_000_000);
+    let page = one_line_page_with("/Font << /F1 4 0 R >>", "", "BT /F1 16 Tf 20 150 Td (Public words then SECRET42) Tj ET");
+    let id = s.open("batch.pdf", None, Arc::new(page), None).unwrap();
+    mark_shown_text(&mut s, id, "SECRET42");
+    let apply = Edit::ApplyRedactions { pages: None };
+    let copy = Edit::DuplicatePages { pages: vec![0], at: None };
+    let refused = s.apply(id, Edit::Batch { label: "x".into(), edits: vec![apply.clone(), copy.clone()] });
+    assert!(matches!(&refused, Err(EditError::Invalid(m)) if m.contains("copy pages")), "{refused:?}");
+    assert!(page_texts(&s, id)[0].contains("SECRET42"), "nothing changed");
+    assert_eq!(s.get(id).unwrap().redaction_marks(), 1);
+    // Copying before the redaction is applied puts the mark on the copy too, and both are checked.
+    s.apply(id, Edit::Batch { label: "y".into(), edits: vec![copy, apply] }).unwrap();
+    assert!(page_texts(&s, id).iter().all(|t| !t.contains("SECRET42")), "{:?}", page_texts(&s, id));
+}
+
 /// A reset in an opening script reaches a field of a row an earlier opening script added, before
 /// the form is laid out again with the row's widgets: its data goes back to its default and stays
 /// so when the form is saved.
@@ -13675,6 +14155,803 @@ fn fill_sign_multiline_text_survives_engine_save_reopen_and_render() {
     assert_eq!(before.rgba, render_page(&reopened, again).rgba, "the saved appearance is identical");
 }
 
+/// An intervening edit gets a fresh realm before calculation, even after the worker has completed.
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn pending_button_globals_cannot_leak_into_intervening_edits() {
+    use crate::js::InteractiveEvent;
+    for valid in [true, false] {
+        let mut s = Session::new();
+        let id = s.open("pending.pdf", None, Arc::new(scripted_form()), None).unwrap();
+        let value = |s: &Session, name: &str| s.get(id).unwrap().form.iter().find(|f| f.name == name).unwrap().value.clone();
+        s.apply(id, Edit::SetDocumentScript { name: "lib".into(), script: Some("var retained='clean';".into()) }).unwrap();
+        s.apply(id, Edit::SetFieldScript { name: "total".into(), event: "calculate".into(), script: Some("event.value=retained;".into()) }).unwrap();
+        let pending = s.start_javascript(id, "retained='stale';getField('price').value=99;", Some("go")).unwrap();
+        let InteractiveEvent::Complete(out) = pending.receiver.recv_timeout(std::time::Duration::from_secs(2)).unwrap() else { panic!("completion") };
+        let edited = s.apply(id, Edit::SetFieldValue { name: if valid { "qty" } else { "missing" }.into(), value: FieldValue::Text("3".into()) });
+        assert_eq!(edited.is_ok(), valid);
+        assert_eq!(value(&s, "total"), ["clean"]);
+        assert_eq!(s.run_javascript(id, "retained='fresh'", None).unwrap().error, None);
+        assert!(s.finish_javascript(pending, out).is_err());
+        assert_eq!(s.run_javascript(id, "retained", None).unwrap().result.as_deref(), Some("fresh"));
+        assert_ne!(value(&s, "price"), ["99"]);
+    }
+}
+
+/// Shared synthetic reset fixture; scripts are disabled while the document and actions are installed.
+fn reset_order_session(reset: &str) -> (Session, DocId) {
+    let mut cos = pdfcraft_cos::Document::open(Arc::new(scripted_form())).unwrap();
+    let source = pdfcraft_forms::fields(&cos).into_iter().find(|f| f.name == "price").unwrap();
+    cos.update_dict(source.obj, |d| {
+        d.set(b"DV".to_vec(), pdfcraft_cos::PdfString::text("7"));
+        d.set(b"V".to_vec(), pdfcraft_cos::PdfString::text("99"));
+    })
+    .unwrap();
+    let bytes = Arc::new(pdfcraft_cos::write_full(&cos, &Default::default()).unwrap());
+    let mut s = Session::new();
+    s.set_javascript(false);
+    let id = s.open("reset-order.pdf", None, bytes, None).unwrap();
+    s.apply(
+        id,
+        Edit::SetDocumentScript { name: "reset".into(), script: Some(format!("var held=getField('price');{reset}var openedValue=held.value;")) },
+    )
+    .unwrap();
+    (s, id)
+}
+
+#[test]
+fn an_unavailable_validation_runtime_rejects_the_field_edit() {
+    let mut s = Session::new();
+    let script = " ".repeat((1 << 20) + 1);
+    let id = s.open("oversized-script-library.pdf", None, Arc::new(scripted_form_with(&script)), None).unwrap();
+    let result = s.apply(id, Edit::SetFieldValue { name: "qty".into(), value: pdfcraft_forms::FieldValue::Text("101".into()) });
+    assert!(matches!(result, Err(EditError::Invalid(reason)) if reason.contains("document scripts exceed")));
+    assert!(s.get(id).unwrap().can_undo().is_none());
+}
+
+#[test]
+fn opening_reset_recalculates_custom_dependents() {
+    let (mut s, id) = reset_order_session("resetForm(['price']);");
+    s.apply(id, Edit::SetFieldValue { name: "qty".into(), value: pdfcraft_forms::FieldValue::Text("2".into()) }).unwrap();
+    let bytes = s.save_bytes(id).unwrap();
+    let mut s = Session::new();
+    let id = s.open("opening-calculation.pdf", None, bytes, None).unwrap();
+    let doc = s.get(id).unwrap();
+    assert_eq!(doc.form.iter().find(|f| f.name == "total").unwrap().value, ["14"]);
+}
+
+#[test]
+fn batch_reset_recalculates_before_later_validation() {
+    let (mut s, id) = reset_order_session("");
+    for (name, event, script) in [
+        ("total", "calculate", "event.value = Number(getField('price').value);"),
+        ("qty", "validate", "event.rc = Number(getField('total').value) === 7;"),
+    ] {
+        s.apply(id, Edit::SetFieldScript { name: name.into(), event: event.into(), script: Some(script.into()) }).unwrap();
+    }
+    s.set_javascript(true);
+    s.run_javascript(id, "calculateNow();", None).unwrap();
+    let value = |s: &Session, name: &str| s.get(id).unwrap().form.iter().find(|f| f.name == name).unwrap().value.clone();
+    assert_eq!(value(&s, "total"), ["99"]);
+    s.apply(
+        id,
+        Edit::Batch {
+            label: "Reset and edit".into(),
+            edits: vec![
+                Edit::ResetForm { names: Some(vec!["price".into()]) },
+                Edit::SetFieldValue { name: "qty".into(), value: pdfcraft_forms::FieldValue::Text("10".into()) },
+            ],
+        },
+    )
+    .unwrap();
+    assert_eq!(value(&s, "qty"), ["10"]);
+    assert_eq!(value(&s, "total"), ["7"]);
+}
+
+#[test]
+fn reset_draws_the_formatted_default() {
+    let (mut s, id) = reset_order_session("");
+    s.apply(
+        id,
+        Edit::SetFieldProps { name: "qty".into(), props: Box::new(FieldProps { default_value: Some(Some("3".into())), ..Default::default() }) },
+    )
+    .unwrap();
+    s.apply(id, Edit::SetFieldValue { name: "qty".into(), value: FieldValue::Text("9".into()) }).unwrap();
+    for (name, event, script) in [
+        ("price", "format", "event.value = 'USD ' + Number(event.value).toFixed(2) + ' ' + getField('qty').value + '/' + getField('total').value;"),
+        ("price", "validate", "var resetValidated = true; event.rc = false;"),
+        ("price", "keystroke", "var resetKeystroked = true;"),
+        ("total", "calculate", "event.value = Number(getField('price').value) * Number(getField('qty').value);"),
+    ] {
+        s.apply(id, Edit::SetFieldScript { name: name.into(), event: event.into(), script: Some(script.into()) }).unwrap();
+    }
+    s.set_javascript(true);
+    s.apply(id, Edit::ResetForm { names: Some(vec!["price".into(), "qty".into()]) }).unwrap();
+    let form = &s.get(id).unwrap().form;
+    for (name, value) in [("price", "7"), ("qty", "3"), ("total", "21")] {
+        assert_eq!(form.iter().find(|f| f.name == name).unwrap().value, [value]);
+    }
+    assert!(page_texts(&s, id)[0].contains("USD 7.00 3/21"), "{:?}", page_texts(&s, id));
+    let scripts = s.run_javascript(id, "typeof resetValidated + '/' + typeof resetKeystroked;", None).unwrap();
+    assert_eq!(scripts.result.as_deref(), Some("undefined/undefined"));
+}
+
+/// VM limits reject earlier writes in the same script and clear its uncommitted globals.
+#[test]
+fn vm_limit_refuses_partial_script_writes() {
+    let (mut s, id) = reset_order_session("");
+    s.set_javascript(true);
+    let before = s.save_bytes(id).unwrap();
+    let script = "var rejected = 42; getField('price').value = 1; function recurse(){ return recurse(); } recurse();";
+    let out = s.run_javascript(id, script, None).unwrap();
+    assert!(out.execution_refused, "{out:?}");
+    assert!(out.changed.is_empty() && out.requests.is_empty());
+    assert_eq!(s.save_bytes(id).unwrap(), before);
+    assert_eq!(s.run_javascript(id, "typeof rejected;", None).unwrap().result.as_deref(), Some("undefined"));
+}
+
+/// A script refused before it runs fails on its own, as on `main`: the edit goes through, the
+/// error is reported, and the committed realm is untouched.
+#[test]
+fn preflight_refusal_preserves_committed_callback_state() {
+    let (mut s, id) = reset_order_session("");
+    let nested = format!("{}1{}", "(".repeat(1_000), ")".repeat(1_000));
+    s.apply(id, Edit::SetFieldScript { name: "qty".into(), event: "validate".into(), script: Some(nested) }).unwrap();
+    s.set_javascript(true);
+    s.run_javascript(id, "var committed = 42;", None).unwrap();
+    let _ = s.take_js_output(id);
+    let edit = Edit::SetFieldValue { name: "qty".into(), value: pdfcraft_forms::FieldValue::Text("10".into()) };
+    s.apply(id, edit).unwrap();
+    assert!(s.take_js_output(id).errors.iter().any(|e| e.contains("nested too deeply")));
+    assert_eq!(s.run_javascript(id, "committed;", None).unwrap().result.as_deref(), Some("42"));
+}
+
+/// Validation can reject an edit without hitting a runtime limit.
+#[test]
+fn validation_rejection_discards_callback_side_effects() {
+    let (mut s, id) = reset_order_session("");
+    let script = "var rejectedValue = event.value; event.rc = false;";
+    s.apply(id, Edit::SetFieldScript { name: "qty".into(), event: "validate".into(), script: Some(script.into()) }).unwrap();
+    s.set_javascript(true);
+    let before = s.save_bytes(id).unwrap();
+    let edit = Edit::SetFieldValue { name: "qty".into(), value: pdfcraft_forms::FieldValue::Text("10".into()) };
+    assert!(s.apply(id, edit).is_err());
+    assert_eq!(s.save_bytes(id).unwrap(), before);
+    assert_eq!(s.run_javascript(id, "typeof rejectedValue;", None).unwrap().result.as_deref(), Some("undefined"));
+}
+
+/// Replacing a document realm while a prompt is outstanding cannot spawn a second worker.
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn invalidated_prompt_retains_the_documents_worker_until_completion() {
+    use crate::js::InteractiveEvent;
+    let (mut s, id) = reset_order_session("");
+    s.set_javascript(true);
+    let pending = s.start_javascript(id, "var discarded = app.response('wait');", None).unwrap();
+    let InteractiveEvent::Prompt(_, reply) = pending.receiver.recv_timeout(std::time::Duration::from_secs(2)).unwrap() else {
+        panic!("expected prompt")
+    };
+    let same_file = s.get(id).unwrap().bytes.clone();
+    assert!(matches!(s.reload(id, same_file), Err(OpenError::Invalid(reason)) if reason.contains("a script is still running")));
+    for _ in 0..3 {
+        s.invalidate_javascript(id);
+        assert!(matches!(s.start_javascript(id, "1;", None), Err(EditError::Invalid(reason)) if reason.contains("another script is active")));
+    }
+    reply.send(Some("discarded".into())).unwrap();
+    let InteractiveEvent::Complete(out) = pending.receiver.recv_timeout(std::time::Duration::from_secs(2)).unwrap() else {
+        panic!("expected completion")
+    };
+    assert!(s.finish_javascript(pending, out).is_err());
+    assert_eq!(s.run_javascript(id, "typeof discarded;", None).unwrap().result.as_deref(), Some("undefined"));
+}
+
+#[test]
+fn a_budget_refusal_discards_pdf_edits_and_callback_globals() {
+    let (mut s, id) = reset_order_session("");
+    for (event, script) in [("keystroke", "var fromRejectedEdit = 99;"), ("validate", "for (var i = 0; i < 65; i++) resetForm();")] {
+        s.apply(id, Edit::SetFieldScript { name: "qty".into(), event: event.into(), script: Some(script.into()) }).unwrap();
+    }
+    s.set_javascript(true);
+    let before = s.save_bytes(id).unwrap();
+    let edit = Edit::SetFieldValue { name: "qty".into(), value: pdfcraft_forms::FieldValue::Text("10".into()) };
+    assert!(matches!(s.apply(id, edit), Err(EditError::Invalid(_))));
+    assert_eq!(s.save_bytes(id).unwrap(), before);
+    assert_eq!(s.run_javascript(id, "typeof fromRejectedEdit;", None).unwrap().result.as_deref(), Some("undefined"));
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn timeout_after_undo_releases_the_stale_script_runtime() {
+    let (mut s, id) = reset_order_session("");
+    s.set_javascript(true);
+    let pending = s.start_javascript(id, "1+1", None).unwrap();
+    assert!(matches!(pending.receiver.recv_timeout(std::time::Duration::from_secs(2)).unwrap(), crate::js::InteractiveEvent::Complete(_)));
+    s.undo(id).unwrap();
+    s.timeout_javascript(pending);
+    assert_eq!(s.run_javascript(id, "2+2", None).unwrap().result.as_deref(), Some("4"));
+}
+
+#[test]
+fn a_no_op_opening_reset_leaves_the_document_clean() {
+    let (mut s, id) = reset_order_session("resetForm(['price']);");
+    s.apply(id, Edit::SetFieldValue { name: "price".into(), value: pdfcraft_forms::FieldValue::Text("7".into()) }).unwrap();
+    let bytes = s.save_bytes(id).unwrap();
+    let mut s = Session::new();
+    let id = s.open("already-reset.pdf", None, bytes, None).unwrap();
+    assert!(s.get(id).unwrap().can_undo().is_none());
+    assert_eq!(s.run_javascript(id, "openedValue;", None).unwrap().result.as_deref(), Some("7"));
+}
+
+/// Reinitialization resets before the first event reads, while later writes survive save and Undo/Redo.
+#[test]
+fn doc_open_reset_and_first_event_persist_in_script_order() {
+    for reset in ["resetForm();", "resetForm(['price']);"] {
+        for (target, restore) in [(None, false), (None, true), (Some("go"), false), (Some("go"), true)] {
+            let (mut s, id) = reset_order_session(reset);
+            let value = |s: &Session, id, name: &str| s.get(id).unwrap().form.iter().find(|f| f.name == name).unwrap().value.clone();
+            let before = [value(&s, id, "price"), value(&s, id, "qty")];
+            s.set_javascript(true);
+            let script =
+                format!("getField('qty').value=held.value;{}openedValue+'/'+getField('qty').value", if restore { "held.value='99';" } else { "" });
+            let out = s.run_javascript(id, &script, target).unwrap();
+            let expected = if restore { "99" } else { "7" };
+            assert_eq!(out.error, None);
+            assert_eq!(out.result.as_deref(), Some("7/7"));
+            assert_eq!(value(&s, id, "price"), [expected]);
+            assert_eq!(value(&s, id, "qty"), ["7"]);
+            s.undo(id).unwrap();
+            assert_eq!([value(&s, id, "price"), value(&s, id, "qty")], before);
+            s.redo(id).unwrap();
+            assert_eq!(value(&s, id, "price"), [expected]);
+            assert_eq!(value(&s, id, "qty"), ["7"]);
+            let saved = s.save_bytes(id).unwrap();
+            s.set_javascript(false);
+            let reopened = s.open("saved-reset.pdf", None, saved, None).unwrap();
+            assert_eq!(value(&s, reopened, "price"), [expected]);
+            assert_eq!(value(&s, reopened, "qty"), ["7"]);
+        }
+    }
+}
+
+/// Reset comparison includes unnamed built-in dependents and never runs custom calculations in the preview.
+#[test]
+fn reset_baseline_includes_builtin_dependents_without_custom_preview_runs() {
+    use form_scripts::{CalcOp, Calculate};
+    for combo in [false, true] {
+        let mut cos = pdfcraft_cos::Document::open(Arc::new(scripted_form())).unwrap();
+        for f in pdfcraft_forms::fields(&cos) {
+            match f.name.as_str() {
+                "price" => cos
+                    .update_dict(f.obj, |d| {
+                        d.set(b"V".to_vec(), pdfcraft_cos::PdfString::text("99"));
+                        d.set(b"DV".to_vec(), pdfcraft_cos::PdfString::text("7"));
+                    })
+                    .unwrap(),
+                "qty" => cos.update_dict(f.obj, |d| d.set(b"V".to_vec(), pdfcraft_cos::PdfString::text("2"))).unwrap(),
+                "total" if combo => cos
+                    .update_dict(f.obj, |d| {
+                        d.set(b"FT".to_vec(), pdfcraft_cos::Object::Name(b"Ch".to_vec()));
+                        d.set(b"Ff".to_vec(), pdfcraft_cos::Object::Int((1 << 17) | (1 << 18)));
+                        d.set(
+                            b"Opt".to_vec(),
+                            pdfcraft_cos::Object::Array(vec![
+                                pdfcraft_cos::PdfString::text("14").into(),
+                                pdfcraft_cos::PdfString::text("198").into(),
+                            ]),
+                        );
+                    })
+                    .unwrap(),
+                _ => (),
+            }
+        }
+        let mut s = Session::new();
+        s.set_javascript(false);
+        let id = s.open("reset-dependent.pdf", None, Arc::new(pdfcraft_cos::write_full(&cos, &Default::default()).unwrap()), None).unwrap();
+        s.apply(id, Edit::SetDocumentScript { name: "counter".into(), script: Some("var calculationCalls=0;".into()) }).unwrap();
+        s.apply(id, Edit::SetFieldScript { name: "qty".into(), event: "calculate".into(), script: Some("calculationCalls++;event.value=2;".into()) })
+            .unwrap();
+        s.apply(
+            id,
+            Edit::SetFieldProps {
+                name: "total".into(),
+                props: Box::new(FieldProps {
+                    calculate: Some(Calculate::Simple { op: CalcOp::Product, fields: vec!["price".into(), "qty".into()] }),
+                    ..Default::default()
+                }),
+            },
+        )
+        .unwrap();
+        let value = |s: &Session, n: &str| s.get(id).unwrap().form.iter().find(|f| f.name == n).unwrap().value.clone();
+        assert_eq!(value(&s, "total"), ["198"]);
+        s.set_javascript(true);
+        let out = s.run_javascript(id, "resetForm(['price']);getField('total').value=198;", None).unwrap();
+        assert_eq!(out.error, None);
+        // The explicit dependent-field delta must be emitted even though it restores its original value.
+        // Its normal writeback recalculation runs the custom callback exactly once; preview/reset run none.
+        assert_eq!(s.run_javascript(id, "calculationCalls", None).unwrap().result.as_deref(), Some("1"));
+        assert_eq!(value(&s, "price"), ["7"]);
+        assert_eq!(value(&s, "total"), ["14"], "existing automatic calculation after a value write is preserved");
+    }
+}
+
+/// Native completions preserve reset/default/restore ordering and persist the resulting values.
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn native_reset_completion_preserves_values_and_atomic_undo() {
+    use crate::js::InteractiveEvent;
+    for repetitions in [1, 64] {
+        for restore in [false, true] {
+            let (mut s, id) = reset_order_session(&"resetForm(['price']);".repeat(repetitions));
+            s.set_javascript(true);
+            let script =
+                format!("getField('qty').value=held.value;{}openedValue+'/'+getField('qty').value", if restore { "held.value='99';" } else { "" });
+            let pending = s.start_javascript(id, &script, Some("go")).unwrap();
+            let InteractiveEvent::Complete(out) = pending.receiver.recv_timeout(std::time::Duration::from_secs(3)).unwrap() else {
+                panic!("completion")
+            };
+            let out = s.finish_javascript(pending, out).unwrap();
+            assert_eq!(out.error, None);
+            assert_eq!(out.result.as_deref(), Some("7/7"));
+            let value = |s: &Session, id, n: &str| s.get(id).unwrap().form.iter().find(|f| f.name == n).unwrap().value.clone();
+            let expected = if restore { "99" } else { "7" };
+            assert_eq!(value(&s, id, "price"), [expected]);
+            assert_eq!(value(&s, id, "qty"), ["7"]);
+            assert_eq!(s.get(id).unwrap().can_undo(), Some("Run JavaScript"));
+            s.undo(id).unwrap();
+            assert_eq!(value(&s, id, "price"), ["99"]);
+            s.redo(id).unwrap();
+            assert_eq!(value(&s, id, "price"), [expected]);
+            let bytes = s.save_bytes(id).unwrap();
+            s.set_javascript(false);
+            let reopened = s.open("native-reset-saved.pdf", None, bytes, None).unwrap();
+            assert_eq!(value(&s, reopened, "price"), [expected]);
+            assert_eq!(value(&s, reopened, "qty"), ["7"]);
+        }
+    }
+}
+
+/// Over-budget native results are rejected before resetting or committing any PDF edits.
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn native_reset_flood_is_rejected_without_changing_the_document() {
+    use crate::js::InteractiveEvent;
+    for (repetitions, caught) in [(65, false), (10_000, false), (10_000, true)] {
+        let mut s = Session::new().with_clock(|| 1_700_000_000);
+        let id = s.open("reset-flood.pdf", None, Arc::new(scripted_form()), None).unwrap();
+        let before = s.save_bytes(id).unwrap();
+        let generation = s.get(id).unwrap().generation;
+        let reset = if caught { "try{resetForm(['price']);}catch(e){}" } else { "resetForm(['price']);" };
+        let script = format!("for(var i=0;i<{repetitions};i++){{{reset}}}getField('qty').value='uncommitted';");
+        let pending = s.start_javascript(id, &script, Some("go")).unwrap();
+        let InteractiveEvent::Complete(out) = pending.receiver.recv_timeout(std::time::Duration::from_secs(3)).unwrap() else { panic!("completion") };
+        assert!(out.reset_limit_exceeded);
+        assert_eq!(out.error.is_none(), caught);
+        assert_eq!(out.requests.iter().filter(|r| matches!(r, crate::js::Request::Reset(_))).count(), pdfcraft_js::MAX_RESET_CALLS);
+        let error = s.finish_javascript(pending, out).expect_err("the reset flood must be rejected before applying it");
+        assert!(error.to_string().contains("reset"), "{error}");
+        assert_eq!(s.get(id).unwrap().generation, generation);
+        assert_eq!(s.get(id).unwrap().can_undo(), None);
+        assert_eq!(s.save_bytes(id).unwrap(), before);
+        assert!(s.run_javascript(id, "1+1", None).unwrap().error.is_none());
+    }
+}
+
+/// The aggregate budget also rejects expensive batches below the reset-count cap.
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn native_reset_aggregate_work_is_bounded() {
+    use crate::js::InteractiveEvent;
+    let mut s = Session::new().with_clock(|| 1_700_000_000);
+    let id = s.open("large-reset.pdf", None, Arc::new(synthetic_acroform(1200, 500)), None).unwrap();
+    let before = s.save_bytes(id).unwrap();
+    let generation = s.get(id).unwrap().generation;
+    let pending = s.start_javascript(id, "for(var i=0;i<32;i++)resetForm();", None).unwrap();
+    let InteractiveEvent::Complete(out) = pending.receiver.recv_timeout(std::time::Duration::from_secs(3)).unwrap() else { panic!("completion") };
+    assert_eq!(out.error, None);
+    let error = s.finish_javascript(pending, out).expect_err("aggregate reset work must be refused");
+    assert!(error.to_string().contains("reset work limit"), "{error}");
+    assert_eq!(s.get(id).unwrap().generation, generation);
+    assert_eq!(s.get(id).unwrap().can_undo(), None);
+    assert_eq!(s.save_bytes(id).unwrap(), before);
+}
+
+/// A huge selector list must be rejected before copying requests or expanding names against fields.
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn native_reset_selector_count_is_bounded() {
+    use crate::js::InteractiveEvent;
+    let mut s = Session::new().with_clock(|| 1_700_000_000);
+    let id = s.open("selectors.pdf", None, Arc::new(scripted_form()), None).unwrap();
+    let before = s.save_bytes(id).unwrap();
+    let generation = s.get(id).unwrap().generation;
+    let pending = s.start_javascript(id, "resetForm(new Array(4097).fill('price'));", Some("go")).unwrap();
+    let InteractiveEvent::Complete(out) = pending.receiver.recv_timeout(std::time::Duration::from_secs(3)).unwrap() else { panic!("completion") };
+    assert_eq!(out.error, None);
+    assert!(s.finish_javascript(pending, out).unwrap_err().to_string().contains("reset work limit"));
+    assert_eq!(s.get(id).unwrap().generation, generation);
+    assert_eq!(s.save_bytes(id).unwrap(), before);
+}
+
+/// An unread default is preserved by both reset paths; explicit script assignments still win.
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn javascript_reset_preserves_unknown_default_like_native_reset() {
+    for inherited in [false, true] {
+        for native in [false, true] {
+            for reset in ["resetForm(['price']);", "resetForm();"] {
+                for (before, after, expected) in
+                    [("", "", "99"), ("getField('price').value=42;", "", "42"), ("", "getField('price').value=43;", "43")]
+                {
+                    let mut cos = pdfcraft_cos::Document::open(Arc::new(scripted_form())).unwrap();
+                    let price = pdfcraft_forms::fields(&cos).into_iter().find(|f| f.name == "price").unwrap();
+                    let mut dict = pdfcraft_cos::Dict::new();
+                    dict.set(b"Filter".to_vec(), pdfcraft_cos::Object::name("UnknownReviewFilter"));
+                    let dv = cos.add(pdfcraft_cos::Object::Stream(pdfcraft_cos::Stream::from_raw(dict, vec![1])));
+                    let parent = if inherited {
+                        let mut parent = pdfcraft_cos::Dict::new();
+                        parent.set(b"DV".to_vec(), pdfcraft_cos::Object::Ref(dv));
+                        parent.set(b"Kids".to_vec(), pdfcraft_cos::Object::Array(vec![pdfcraft_cos::Object::Ref(price.obj)]));
+                        Some(cos.add(pdfcraft_cos::Object::Dict(parent)))
+                    } else {
+                        None
+                    };
+                    cos.update_dict(price.obj, |d| {
+                        d.set(b"V".to_vec(), pdfcraft_cos::PdfString::text("99"));
+                        if let Some(parent) = parent {
+                            d.set(b"Parent".to_vec(), pdfcraft_cos::Object::Ref(parent));
+                        } else {
+                            d.set(b"DV".to_vec(), pdfcraft_cos::Object::Ref(dv));
+                        }
+                    })
+                    .unwrap();
+                    if let Some(parent) = parent {
+                        let root = cos.root().unwrap();
+                        cos.update_dict(root, |catalog| {
+                            let mut form = catalog.get(b"AcroForm").unwrap().as_dict().unwrap().clone();
+                            let mut refs = form.get(b"Fields").unwrap().as_array().unwrap().clone();
+                            for reference in &mut refs {
+                                if reference.as_ref() == Some(price.obj) {
+                                    *reference = pdfcraft_cos::Object::Ref(parent);
+                                }
+                            }
+                            form.set(b"Fields".to_vec(), pdfcraft_cos::Object::Array(refs));
+                            catalog.set(b"AcroForm".to_vec(), pdfcraft_cos::Object::Dict(form));
+                        })
+                        .unwrap();
+                    }
+                    let mut direct = cos.clone();
+                    pdfcraft_forms::reset(&mut direct, Some(&["price".into()])).unwrap();
+                    assert_eq!(pdfcraft_forms::fields(&direct).into_iter().find(|f| f.name == "price").unwrap().value, ["99"]);
+                    let mut s = Session::new().with_clock(|| 1_700_000_000);
+                    s.set_javascript(false);
+                    let id =
+                        s.open("unknown-default.pdf", None, Arc::new(pdfcraft_cos::write_full(&cos, &Default::default()).unwrap()), None).unwrap();
+                    s.set_javascript(true);
+                    let script = format!("{before}{reset}{after}String(getField('price').value);");
+                    let out = if native {
+                        let pending = s.start_javascript(id, &script, Some("go")).unwrap();
+                        let crate::js::InteractiveEvent::Complete(out) = pending.receiver.recv_timeout(std::time::Duration::from_secs(3)).unwrap()
+                        else {
+                            panic!("completion")
+                        };
+                        s.finish_javascript(pending, out).unwrap()
+                    } else {
+                        s.run_javascript(id, &script, None).unwrap()
+                    };
+                    assert_eq!(out.error, None);
+                    assert_eq!(out.result.as_deref(), Some(expected));
+                    let value = |s: &Session, id| s.get(id).unwrap().form.iter().find(|f| f.name == "price").unwrap().value.clone();
+                    assert_eq!(value(&s, id), [expected]);
+                    assert_eq!(s.get(id).unwrap().can_undo(), Some("Run JavaScript"));
+                    s.undo(id).unwrap();
+                    assert_eq!(value(&s, id), ["99"]);
+                    s.redo(id).unwrap();
+                    assert_eq!(value(&s, id), [expected]);
+                    let saved = s.save_bytes(id).unwrap();
+                    s.set_javascript(false);
+                    let reopened = s.open("saved-unknown.pdf", None, saved, None).unwrap();
+                    assert_eq!(value(&s, reopened), [expected]);
+                }
+            }
+        }
+    }
+}
+
+/// Exhausting the shared default decode budget must also reach the JavaScript snapshot as unknown.
+#[test]
+fn javascript_snapshot_preserves_default_decode_budget_exhaustion() {
+    let mut cos = pdfcraft_cos::Document::open(Arc::new(scripted_form())).unwrap();
+    let stream = cos.add(pdfcraft_cos::Object::Stream(pdfcraft_cos::Stream::from_raw(pdfcraft_cos::Dict::new(), vec![b'd'; 1 << 20])));
+    let mut refs = Vec::new();
+    for i in 0..70 {
+        let mut field = pdfcraft_cos::Dict::new();
+        field.set(b"FT".to_vec(), pdfcraft_cos::Object::name("Tx"));
+        field.set(b"T".to_vec(), pdfcraft_cos::PdfString::text(&format!("budget{i}")));
+        field.set(b"V".to_vec(), pdfcraft_cos::PdfString::text("typed"));
+        field.set(b"DV".to_vec(), pdfcraft_cos::Object::Ref(stream));
+        refs.push(pdfcraft_cos::Object::Ref(cos.add(pdfcraft_cos::Object::Dict(field))));
+    }
+    let root = cos.root().unwrap();
+    cos.update_dict(root, |catalog| {
+        let mut form = pdfcraft_cos::Dict::new();
+        form.set(b"Fields".to_vec(), pdfcraft_cos::Object::Array(refs));
+        catalog.set(b"AcroForm".to_vec(), pdfcraft_cos::Object::Dict(form));
+    })
+    .unwrap();
+    let fields = pdfcraft_forms::fields(&cos);
+    assert_eq!(fields.first().unwrap().default.first().unwrap().len(), 1 << 20);
+    let last = fields.iter().find(|f| f.name == "budget69").unwrap();
+    assert!(last.default.is_empty());
+    let snapshot = crate::js::field_state(&cos, last, &pdfcraft_js::DocInfo::default());
+    assert!(!snapshot.default_known);
+    let out = pdfcraft_js::run(
+        "resetForm();String(getField('budget69').value);",
+        &pdfcraft_js::Event::doc("Console"),
+        &Default::default(),
+        &[snapshot],
+        &[],
+        Default::default(),
+    );
+    assert_eq!(out.error, None);
+    assert_eq!(out.result.as_deref(), Some("typed"));
+    assert!(out.changed.is_empty());
+}
+
+/// Immediate dependent reads can explicitly request calculation without changing reset callback ordering.
+#[test]
+fn calculate_now_after_reset_reads_and_persists_recalculated_dependents() {
+    use form_scripts::{CalcOp, Calculate};
+    let (mut s, id) = reset_order_session("");
+    s.apply(id, Edit::SetFieldValue { name: "qty".into(), value: FieldValue::Text("2".into()) }).unwrap();
+    s.apply(
+        id,
+        Edit::SetFieldProps {
+            name: "total".into(),
+            props: Box::new(FieldProps {
+                calculate: Some(Calculate::Simple { op: CalcOp::Product, fields: vec!["price".into(), "qty".into()] }),
+                ..Default::default()
+            }),
+        },
+    )
+    .unwrap();
+    s.set_javascript(true);
+    let out = s.run_javascript(id, "resetForm(['price']);calculateNow();String(getField('total').value);", None).unwrap();
+    assert_eq!(out.error, None);
+    assert_eq!(out.result.as_deref(), Some("14"));
+    assert_eq!(s.get(id).unwrap().form.iter().find(|f| f.name == "total").unwrap().value, ["14"]);
+}
+
+/// Duplicate names retain distinct Calculate scripts, targets and persisted values.
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn calculate_now_preserves_duplicate_field_object_identity() {
+    for (native, reverse) in [(false, false), (false, true), (true, false), (true, true)] {
+        let mut cos = pdfcraft_cos::Document::open(Arc::new(scripted_form())).unwrap();
+        let fields = pdfcraft_forms::fields(&cos);
+        let a = fields.iter().find(|f| f.name == "price").unwrap().obj;
+        let b = fields.iter().find(|f| f.name == "qty").unwrap().obj;
+        for (obj, tag, color) in [(a, "A", "color.red"), (b, "B", "color.blue")] {
+            cos.update_dict(obj, |d| {
+                d.set(b"T".to_vec(), pdfcraft_cos::PdfString::text("duplicate"));
+                d.set(b"V".to_vec(), pdfcraft_cos::PdfString::text(tag));
+                let mut action = pdfcraft_cos::Dict::new();
+                action.set(b"S".to_vec(), pdfcraft_cos::Object::name("JavaScript"));
+                action.set(
+                    b"JS".to_vec(),
+                    pdfcraft_cos::PdfString::text(&format!(
+                        "trace+='{tag}'+event.target.value;event.target.userName='{tag}';event.target.fillColor={color};event.target.value='{tag}-temporary';event.value='{tag}-done';"
+                    )),
+                );
+                let mut aa = pdfcraft_cos::Dict::new();
+                aa.set(b"C".to_vec(), pdfcraft_cos::Object::Dict(action));
+                d.set(b"AA".to_vec(), pdfcraft_cos::Object::Dict(aa));
+            })
+            .unwrap();
+        }
+        let root = cos.root().unwrap();
+        cos.update_dict(root, |d| {
+            let mut af = d.get(b"AcroForm").unwrap().as_dict().unwrap().clone();
+            af.set(b"CO".to_vec(), pdfcraft_cos::Object::Array(if reverse { vec![b.into(), a.into()] } else { vec![a.into(), b.into()] }));
+            d.set(b"AcroForm".to_vec(), pdfcraft_cos::Object::Dict(af));
+        })
+        .unwrap();
+        // Disable the unrelated original total calculation.
+        let total = fields.iter().find(|f| f.name == "total").unwrap().obj;
+        cos.update_dict(total, |d| {
+            d.remove(b"AA");
+        })
+        .unwrap();
+        let mut s = Session::new();
+        s.set_javascript(false);
+        let id = s.open("duplicate-calculations.pdf", None, Arc::new(pdfcraft_cos::write_full(&cos, &Default::default()).unwrap()), None).unwrap();
+        s.set_javascript(true);
+        let script = "var trace='';calculateNow();trace;";
+        let out = if native {
+            let p = s.start_javascript(id, script, Some("go")).unwrap();
+            let crate::js::InteractiveEvent::Complete(out) = p.receiver.recv_timeout(std::time::Duration::from_secs(3)).unwrap() else {
+                panic!("completion")
+            };
+            s.finish_javascript(p, out).unwrap()
+        } else {
+            s.run_javascript(id, script, None).unwrap()
+        };
+        assert_eq!(out.error, None);
+        let duplicate_fields: Vec<_> = s.get(id).unwrap().form.iter().filter(|f| f.name == "duplicate").collect();
+        assert_eq!(duplicate_fields.iter().map(|f| f.tooltip.as_deref()).collect::<Vec<_>>(), [Some("A"), Some("B")]);
+        let cos = &s.get(id).unwrap().editor.as_ref().unwrap().cos;
+        assert_eq!(pdfcraft_forms::look(cos, duplicate_fields[0]).fill, Some([1.0, 0.0, 0.0]));
+        assert_eq!(pdfcraft_forms::look(cos, duplicate_fields[1]).fill, Some([0.0, 0.0, 1.0]));
+
+        assert_eq!(out.result.as_deref(), Some(if reverse { "BBAA" } else { "AABB" }));
+        let values = |s: &Session| s.get(id).unwrap().form.iter().filter(|f| f.name == "duplicate").map(|f| f.value.clone()).collect::<Vec<_>>();
+        assert_eq!(values(&s), vec![vec!["A-done"], vec!["B-done"]]);
+        s.undo(id).unwrap();
+        assert_eq!(values(&s), vec![vec!["A"], vec!["B"]]);
+        s.redo(id).unwrap();
+        assert_eq!(values(&s), vec![vec!["A-done"], vec!["B-done"]]);
+        let bytes = s.save_bytes(id).unwrap();
+        s.set_javascript(false);
+        let reopened = s.open("saved-duplicates.pdf", None, bytes, None).unwrap();
+        assert_eq!(
+            s.get(reopened).unwrap().form.iter().filter(|f| f.name == "duplicate").map(|f| f.value.clone()).collect::<Vec<_>>(),
+            vec![vec!["A-done"], vec!["B-done"]]
+        );
+    }
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn script_colors_do_not_mutate_another_fields_shared_mk() {
+    for native in [false, true] {
+        for (script, fill, border) in [
+            ("getField('price').fillColor=color.red;", Some([1., 0., 0.]), Some([0., 0., 0.])),
+            ("getField('price').strokeColor=color.blue;", Some([1., 1., 1.]), Some([0., 0., 1.])),
+            ("getField('price').fillColor=color.red;getField('price').strokeColor=color.blue;", Some([1., 0., 0.]), Some([0., 0., 1.])),
+            ("getField('price').fillColor=color.transparent;", None, Some([0., 0., 0.])),
+        ] {
+            let mut cos = pdfcraft_cos::Document::open(Arc::new(scripted_form())).unwrap();
+            let all = pdfcraft_forms::fields(&cos);
+            let price = all.iter().find(|f| f.name == "price").unwrap().obj;
+            let qty = all.iter().find(|f| f.name == "qty").unwrap().obj;
+            let total = all.iter().find(|f| f.name == "total").unwrap().obj;
+            let mut mk = pdfcraft_cos::Dict::new();
+            mk.set(b"BG".to_vec(), pdfcraft_cos::Object::Array(vec![1.into(), 1.into(), 1.into()]));
+            mk.set(b"BC".to_vec(), pdfcraft_cos::Object::Array(vec![0.into(), 0.into(), 0.into()]));
+            mk.set(b"CA".to_vec(), pdfcraft_cos::PdfString::text("keep"));
+            let shared = cos.add(pdfcraft_cos::Object::Dict(mk));
+            let alias = cos.add(pdfcraft_cos::Object::Ref(shared));
+            for (object, reference) in [(qty, shared), (total, alias)] {
+                cos.update_dict(object, |d| d.set(b"MK".to_vec(), reference)).unwrap();
+            }
+            let mut widgets = Vec::new();
+            for x in [20, 90] {
+                let mut w = pdfcraft_cos::Dict::new();
+                w.set(b"Subtype".to_vec(), pdfcraft_cos::Object::name("Widget"));
+                w.set(b"Parent".to_vec(), price);
+                w.set(b"P".to_vec(), pdfcraft_cos::ObjRef::new(3, 0));
+                w.set(b"Rect".to_vec(), pdfcraft_cos::Object::Array(vec![x.into(), 250.into(), (x + 50).into(), 270.into()]));
+                w.set(b"MK".to_vec(), shared);
+                widgets.push(cos.add(pdfcraft_cos::Object::Dict(w)));
+            }
+            cos.update_dict(price, |d| {
+                d.remove(b"Rect");
+                d.set(b"Kids".to_vec(), pdfcraft_cos::Object::Array(widgets.iter().map(|r| (*r).into()).collect()));
+            })
+            .unwrap();
+            cos.update_dict(pdfcraft_cos::ObjRef::new(3, 0), |d| {
+                let mut a = d.get(b"Annots").unwrap().as_array().unwrap().clone();
+                a.retain(|o| o.as_ref() != Some(price));
+                a.extend(widgets.iter().map(|r| (*r).into()));
+                d.set(b"Annots".to_vec(), pdfcraft_cos::Object::Array(a));
+            })
+            .unwrap();
+            let mut alias_probe = cos.clone();
+            pdfcraft_forms::apply_script_changes(
+                &mut alias_probe,
+                &[pdfcraft_forms::FieldChange {
+                    name: "price".into(),
+                    fill_color: Some(vec!["RGB".into(), "1".into(), "0".into(), "0".into()]),
+                    ..Default::default()
+                }],
+                &mut pdfcraft_forms::NoScripts,
+            )
+            .unwrap();
+            for name in ["qty", "total"] {
+                let field = pdfcraft_forms::fields(&alias_probe).into_iter().find(|f| f.name == name).unwrap();
+                assert_eq!(pdfcraft_forms::look(&alias_probe, &field).fill, Some([1., 1., 1.]));
+            }
+            let mut s = Session::new();
+            s.set_javascript(false);
+            let id = s.open("shared-colors.pdf", None, Arc::new(pdfcraft_cos::write_full(&cos, &Default::default()).unwrap()), None).unwrap();
+            s.set_javascript(true);
+            let original_id = id;
+            let owned_reference = {
+                let doc = s.get(id).unwrap();
+                let widget = doc.form.iter().find(|f| f.name == "price").unwrap().widgets.first().unwrap().obj;
+                doc.editor.as_ref().unwrap().cos.get(widget).as_dict().unwrap().reference(b"MK").unwrap()
+            };
+            let out = if native {
+                let p = s.start_javascript(id, script, Some("go")).unwrap();
+                let crate::js::InteractiveEvent::Complete(out) = p.receiver.recv_timeout(std::time::Duration::from_secs(3)).unwrap() else {
+                    panic!("completion")
+                };
+                s.finish_javascript(p, out).unwrap()
+            } else {
+                s.run_javascript(id, script, None).unwrap()
+            };
+            assert_eq!(out.error, None);
+            let verify = |s: &Session, id, expected_fill, expected_border| {
+                let doc = s.get(id).unwrap();
+                let cos = &doc.editor.as_ref().unwrap().cos;
+                let f = doc.form.iter().find(|f| f.name == "price").unwrap();
+                assert_eq!(f.widgets.len(), 2);
+                let look = pdfcraft_forms::look(cos, f);
+                assert_eq!(look.fill, expected_fill);
+                assert_eq!(look.border, expected_border);
+                let actual_reference = cos.get(f.widgets.first().unwrap().obj).as_dict().unwrap().reference(b"MK").unwrap();
+                if id == original_id {
+                    assert_eq!(actual_reference, owned_reference);
+                }
+                for w in &f.widgets {
+                    assert_eq!(cos.get(w.obj).as_dict().unwrap().reference(b"MK"), Some(actual_reference));
+                }
+                for name in ["qty", "total"] {
+                    let f = doc.form.iter().find(|f| f.name == name).unwrap();
+                    let look = pdfcraft_forms::look(cos, f);
+                    assert_eq!(look.fill, Some([1., 1., 1.]));
+                    assert_eq!(look.border, Some([0., 0., 0.]));
+                    let mk = cos.get(f.widgets.first().unwrap().obj).as_dict().unwrap().get(b"MK").cloned().unwrap();
+                    assert_eq!(cos.resolve(&mk).as_dict().unwrap().get(b"CA").unwrap().as_string().unwrap().to_text(), "keep");
+                }
+            };
+            verify(&s, id, fill, border);
+            s.undo(id).unwrap();
+            verify(&s, id, Some([1., 1., 1.]), Some([0., 0., 0.]));
+            s.redo(id).unwrap();
+            verify(&s, id, fill, border);
+            let bytes = s.save_bytes(id).unwrap();
+            s.set_javascript(false);
+            let reopened = s.open("saved-colors.pdf", None, bytes, None).unwrap();
+            verify(&s, reopened, fill, border);
+        }
+    }
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn exact_button_target_ids_are_validated_before_script_execution() {
+    for native in [false, true] {
+        let mut s = Session::new().with_clock(|| 1_700_000_000);
+        let id = s.open("buttons.pdf", None, Arc::new(scripted_form()), None).unwrap();
+        let fields = s.get(id).unwrap().form.clone();
+        let go = fields.iter().find(|f| f.name == "go").unwrap();
+        let identity = crate::js::field_object_id(go.obj);
+        let price = crate::js::field_object_id(fields.iter().find(|f| f.name == "price").unwrap().obj);
+        let before = s.save_bytes(id).unwrap();
+        for (name, key) in [(Some("go"), price), (None, identity), (Some("missing"), identity), (Some("go"), u64::MAX)] {
+            if native {
+                assert!(s.start_javascript_target(id, "var shouldNotRun=1;", name, Some(key)).is_err());
+            } else {
+                assert!(s.run_javascript_target(id, "var shouldNotRun=1;", name, Some(key)).is_err());
+            }
+        }
+        assert_eq!(s.save_bytes(id).unwrap(), before);
+        assert_eq!(s.run_javascript(id, "typeof shouldNotRun", None).unwrap().result.as_deref(), Some("undefined"));
+        let out = s
+            .run_javascript_answers_target(
+                id,
+                "event.target.buttonSetCaption(app.response({cQuestion:'Caption'}));event.target.name;",
+                Some("go"),
+                Some(identity),
+                &[Some("answered".into())],
+            )
+            .unwrap();
+        assert_eq!(out.error, None);
+        assert_eq!(out.result.as_deref(), Some("go"));
+        assert_eq!(s.get(id).unwrap().form.iter().find(|f| f.name == "go").unwrap().widgets.first().unwrap().caption.as_deref(), Some("answered"));
+    }
+}
+
 /// A whole tree goes in as one undoable step, and a refused tree changes nothing.
 #[test]
 fn imported_bookmarks_undo_in_one_step() {
@@ -13707,6 +14984,214 @@ fn imported_bookmarks_undo_in_one_step() {
     assert!(s.get(id).unwrap().info.outline.is_empty());
 }
 
+/// Rejected host writeback must invalidate globals for both synchronous and native completion.
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn refused_script_writeback_retires_the_runtime() {
+    for native in [false, true] {
+        let mut s = Session::new().with_clock(|| 1_700_000_000);
+        let id = s.open("bounded.pdf", None, Arc::new(synthetic_acroform(1200, 500)), None).unwrap();
+        let before = s.save_bytes(id).unwrap();
+        let script = "var refusedGlobal=42;for(var i=0;i<32;i++)resetForm();";
+        if native {
+            let pending = s.start_javascript(id, script, None).unwrap();
+            let crate::js::InteractiveEvent::Complete(out) = pending.receiver.recv_timeout(std::time::Duration::from_secs(5)).unwrap() else {
+                panic!("completion")
+            };
+            assert!(s.finish_javascript(pending, out).is_err());
+        } else {
+            assert!(s.run_javascript(id, script, None).is_err());
+        }
+        assert_eq!(s.save_bytes(id).unwrap(), before);
+        assert_eq!(s.run_javascript(id, "typeof refusedGlobal", None).unwrap().result.as_deref(), Some("undefined"));
+    }
+}
+/// History retires removed fields without discarding document globals or aliasing reused numbers.
+#[test]
+fn undo_removed_field_references_cannot_write_replacement_fields() {
+    let (mut s, id) = session_with(1);
+    let add =
+        |name: &str| Edit::AddField { page: 0, rect: [20.0, 20.0, 120.0, 40.0], kind: NewField::Text { multiline: false }, name: Some(name.into()) };
+    s.apply(id, add("old")).unwrap();
+    let original = s.get(id).unwrap().form.iter().find(|f| f.name == "old").unwrap().obj;
+    s.run_javascript(id, "var kept=99;var held=getField('old');held.custom=42;", None).unwrap();
+    s.undo(id).unwrap();
+    s.apply(id, add("replacement")).unwrap();
+    let replacement = s.get(id).unwrap().form.iter().find(|f| f.name == "replacement").unwrap().obj;
+    assert_eq!(original, replacement, "exercise the reused PDF number");
+    assert_eq!(
+        s.run_javascript(id, "kept===99 && getField('replacement')!==held && getField('replacement').custom===undefined;", None)
+            .unwrap()
+            .result
+            .as_deref(),
+        Some("true")
+    );
+    let out = s.run_javascript(id, "held.value='wrong';", None).unwrap();
+    assert!(out.error.is_some());
+    assert!(s.get(id).unwrap().form.iter().find(|f| f.name == "replacement").unwrap().value.is_empty());
+    s.undo(id).unwrap();
+    s.redo(id).unwrap();
+    assert_eq!(s.run_javascript(id, "kept", None).unwrap().result.as_deref(), Some("99"));
+}
+/// An exact image target changes only the selected duplicate-name field, with history and persistence.
+#[test]
+fn exact_image_import_targets_only_the_selected_duplicate_button() {
+    let (mut s, id) = session_with(1);
+    for (name, x) in [("first", 20.0), ("second", 160.0)] {
+        s.apply(id, Edit::AddField { page: 0, rect: [x, 20.0, x + 100.0, 80.0], kind: NewField::Image, name: Some(name.into()) }).unwrap();
+    }
+    let mut cos = pdfcraft_cos::Document::open(s.save_bytes(id).unwrap()).unwrap();
+    for field in pdfcraft_forms::fields(&cos) {
+        cos.update_dict(field.obj, |d| d.set(b"T".to_vec(), pdfcraft_cos::PdfString::text("same"))).unwrap();
+    }
+    let bytes = pdfcraft_cos::write_full(&cos, &Default::default()).unwrap();
+    let id = s.open("duplicate-image.pdf", None, Arc::new(bytes), None).unwrap();
+    let target = s.get(id).unwrap().form[1].obj;
+    let edit = Edit::SetFieldImageTarget { name: "same".into(), object: target, image: Arc::new(pdfcraft_xfa::fixtures::TINY_GIF.to_vec()) };
+    let has_icons = |s: &Session, id| {
+        let doc = s.get(id).unwrap();
+        let cos = &doc.editor.as_ref().unwrap().cos;
+        doc.form
+            .iter()
+            .map(|f| {
+                cos.get(f.widgets[0].obj)
+                    .as_dict()
+                    .and_then(|d| d.get(b"MK").map(|m| cos.resolve(m)))
+                    .is_some_and(|m| m.as_dict().is_some_and(|d| d.contains(b"I")))
+            })
+            .collect::<Vec<_>>()
+    };
+    s.apply(id, edit).unwrap();
+    assert_eq!(has_icons(&s, id), [false, true]);
+    s.undo(id).unwrap();
+    assert_eq!(has_icons(&s, id), [false, false]);
+    s.redo(id).unwrap();
+    assert_eq!(has_icons(&s, id), [false, true]);
+    let bytes = s.save_bytes(id).unwrap();
+    let reopened = s.open("again.pdf", None, bytes, None).unwrap();
+    s.apply(reopened, Edit::SetInfo { key: "Title".into(), value: "check".into() }).unwrap();
+    assert_eq!(has_icons(&s, reopened), [false, true]);
+}
+
+/// Native automatic calculations and explicit calculateNow agree on the first selected value.
+#[test]
+fn multiselect_calculation_matches_explicit_script_and_saved_result() {
+    let (mut s, id) = session_with(1);
+    for (name, kind, y) in [
+        ("choices", NewField::List { options: vec!["2".into(), "5".into()], multi: true }, 100.0),
+        ("sum", NewField::Text { multiline: false }, 50.0),
+    ] {
+        s.apply(id, Edit::AddField { page: 0, rect: [20.0, y, 120.0, y + 30.0], kind, name: Some(name.into()) }).unwrap();
+    }
+    s.apply(
+        id,
+        Edit::SetFieldProps {
+            name: "sum".into(),
+            props: Box::new(pdfcraft_forms::FieldProps {
+                calculate: Some(pdfcraft_forms::af::Calculate::Simple { op: pdfcraft_forms::af::CalcOp::Sum, fields: vec!["choices".into()] }),
+                ..Default::default()
+            }),
+        },
+    )
+    .unwrap();
+    s.apply(id, Edit::SetFieldValue { name: "choices".into(), value: pdfcraft_forms::FieldValue::Choice(vec!["2".into(), "5".into()]) }).unwrap();
+    assert_eq!(s.get(id).unwrap().form.iter().find(|f| f.name == "sum").unwrap().value, ["2"]);
+    let out = s.run_javascript(id, "calculateNow();getField('sum').value", None).unwrap();
+    assert_eq!(out.error, None);
+    assert_eq!(out.result.as_deref(), Some("2"));
+    assert_eq!(s.get(id).unwrap().form.iter().find(|f| f.name == "sum").unwrap().value, ["2"]);
+    let bytes = s.save_bytes(id).unwrap();
+    let reopened = s.open("again.pdf", None, bytes, None).unwrap();
+    assert_eq!(s.get(reopened).unwrap().form.iter().find(|f| f.name == "sum").unwrap().value, ["2"]);
+}
+
+/// Real mixed widgets converge even when buttonSetIcon repeats widget zero's existing icon.
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn mixed_widget_icons_are_normalized_with_history_and_save() {
+    for native in [false, true] {
+        for first_has_icon in [false, true] {
+            use pdfcraft_cos::{Dict, ObjRef, Object, Stream};
+            let mut cos = pdfcraft_cos::Document::open(Arc::new(scripted_form())).unwrap();
+            let go = pdfcraft_forms::fields(&cos).into_iter().find(|f| f.name == "go").unwrap().obj;
+            let mut dict = Dict::new();
+            dict.set(b"Type".to_vec(), Object::name("XObject"));
+            dict.set(b"Subtype".to_vec(), Object::name("Form"));
+            dict.set(b"BBox".to_vec(), Object::Array(vec![0.into(), 0.into(), 10.into(), 10.into()]));
+            let a = cos.add(Object::Stream(Stream::flate(dict.clone(), b"")));
+            let b = cos.add(Object::Stream(Stream::flate(dict, b"")));
+            let mut widgets = vec![];
+            for (i, icon) in [first_has_icon.then_some(a), Some(b)].into_iter().enumerate() {
+                let mut w = Dict::new();
+                w.set(b"Subtype".to_vec(), Object::name("Widget"));
+                w.set(b"Parent".to_vec(), go);
+                w.set(b"P".to_vec(), ObjRef::new(3, 0));
+                w.set(b"Rect".to_vec(), Object::Array(vec![(20 + i as i64 * 80).into(), 20.into(), (80 + i as i64 * 80).into(), 60.into()]));
+                let mut mk = Dict::new();
+                if let Some(icon) = icon {
+                    mk.set(b"I".to_vec(), icon);
+                }
+                w.set(b"MK".to_vec(), Object::Dict(mk));
+                widgets.push(cos.add(Object::Dict(w)));
+            }
+            cos.update_dict(go, |d| {
+                d.remove(b"Rect");
+                d.set(b"Kids".to_vec(), Object::Array(widgets.iter().map(|r| (*r).into()).collect()));
+            })
+            .unwrap();
+            cos.update_dict(ObjRef::new(3, 0), |d| {
+                let mut annots = d.get(b"Annots").unwrap().as_array().unwrap().clone();
+                annots.retain(|v| v.as_ref() != Some(go));
+                annots.extend(widgets.iter().map(|r| Object::Ref(*r)));
+                d.set(b"Annots".to_vec(), Object::Array(annots));
+            })
+            .unwrap();
+            let mut s = Session::new().with_clock(|| 1_700_000_000);
+            let id = s.open("mixed-icons.pdf", None, Arc::new(pdfcraft_cos::write_full(&cos, &Default::default()).unwrap()), None).unwrap();
+            let script = "getField('go').buttonSetIcon(getField('go').buttonGetIcon());";
+            if native {
+                let pending = s.start_javascript(id, script, Some("go")).unwrap();
+                let crate::js::InteractiveEvent::Complete(out) = pending.receiver.recv_timeout(std::time::Duration::from_secs(5)).unwrap() else {
+                    panic!("completion")
+                };
+                assert_eq!(s.finish_javascript(pending, out).unwrap().error, None);
+            } else {
+                assert_eq!(s.run_javascript(id, script, Some("go")).unwrap().error, None);
+            }
+            let icons = |s: &mut Session, id| {
+                let cos = pdfcraft_cos::Document::open(s.save_bytes(id).unwrap()).unwrap();
+                pdfcraft_forms::fields(&cos)
+                    .iter()
+                    .find(|f| f.name == "go")
+                    .unwrap()
+                    .widgets
+                    .iter()
+                    .map(|w| {
+                        cos.get(w.obj)
+                            .as_dict()
+                            .and_then(|d| d.get(b"MK").map(|v| cos.resolve(v)))
+                            .and_then(|v| v.as_dict().and_then(|d| d.reference(b"I")))
+                    })
+                    .collect::<Vec<_>>()
+            };
+            let after = icons(&mut s, id);
+            assert_eq!(after.len(), 2);
+            assert_eq!(after[0], after[1]);
+            assert_eq!(after[0].is_some(), first_has_icon);
+            s.undo(id).unwrap();
+            let before = icons(&mut s, id);
+            assert_ne!(before[0], before[1]);
+            s.redo(id).unwrap();
+            let after = icons(&mut s, id);
+            assert_eq!(after[0], after[1]);
+            let bytes = s.save_bytes(id).unwrap();
+            let reopened = s.open("again.pdf", None, bytes, None).unwrap();
+            let after = icons(&mut s, reopened);
+            assert_eq!(after[0], after[1]);
+            assert_eq!(after[0].is_some(), first_has_icon);
+        }
+    }
+}
 /// A comment imported or pasted without the appearance its file carried (unreadable there) is
 /// said in the repair log, which the interface shows and the tools return.
 #[test]
@@ -13822,6 +15307,96 @@ fn a_document_encrypting_only_its_embedded_files_opens_and_saves_without_a_passw
     assert!(reopened.embedded_files_locked(), "the attachment stays encrypted");
 }
 
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn script_objects_survive_incremental_save_but_not_a_full_rewrite() {
+    let mut session = Session::new();
+    let id = session.open("fields.pdf", None, Arc::new(scripted_form()), None).unwrap();
+    session.set_javascript(true);
+    let stored = session.run_javascript(id, "var retainedPrice = getField('price'); retainedPrice.value = '17';", None).unwrap();
+    assert!(stored.error.is_none(), "{stored:?}");
+    let incremental = session.save_bytes(id).unwrap();
+    session.mark_saved(id, incremental.clone(), None).unwrap();
+    let after_incremental = session.run_javascript(id, "String(retainedPrice.value)", None).unwrap();
+    assert_eq!(after_incremental.result.as_deref(), Some("17"));
+    let full = session.save_full_bytes(id).unwrap();
+    assert!(!full.starts_with(incremental.as_slice()));
+    session.mark_saved(id, full, Some("rewritten.pdf".into())).unwrap();
+    let after_full = session.run_javascript(id, "typeof retainedPrice + ':' + getField('price').value", None).unwrap();
+    assert_eq!(after_full.result.as_deref(), Some("undefined:17"));
+}
+
+#[test]
+fn calculate_now_applies_format_script_to_updated_appearance() {
+    let mut session = Session::new().with_clock(|| 1_700_000_000);
+    let id = session.open("calculate-format.pdf", None, Arc::new(scripted_form()), None).unwrap();
+    session.run_javascript(id, "getField('price').value = 3; getField('qty').value = 2; calculateNow();", None).unwrap();
+
+    assert_eq!(session.get(id).unwrap().form.iter().find(|field| field.name == "total").unwrap().value, ["6"]);
+    assert!(page_texts(&session, id)[0].contains("USD 6.00"), "the appearance uses the Format script");
+}
+
+#[test]
+fn javascript_non_rgb_field_colours_convert_and_keep_the_scripts_other_changes() {
+    let fill_after = |colour: &str| {
+        let mut s = Session::new().with_clock(|| 1_700_000_000);
+        let id = s.open("order.pdf", None, Arc::new(scripted_form()), None).unwrap();
+        s.run_javascript(id, "getField('price').fillColor = color.red;", None).unwrap();
+        let out = s.run_javascript(id, &format!("var f = getField('price'); f.value = '9'; f.fillColor = {colour}; f.textColor = {colour};"), None);
+        assert!(out.is_ok(), "{colour}: {out:?}");
+        let f = s.get(id).unwrap().form.iter().find(|f| f.name == "price").unwrap().clone();
+        assert_eq!(f.value, ["9"], "{colour}: the value write is kept");
+        let doc = pdfcraft_cos::Document::open(s.save_bytes(id).unwrap()).unwrap();
+        let f = pdfcraft_forms::fields(&doc).into_iter().find(|f| f.name == "price").unwrap();
+        let look = pdfcraft_forms::look(&doc, &f);
+        (look.fill, look.text)
+    };
+    assert_eq!(fill_after("color.white"), (Some([1.0, 1.0, 1.0]), [1.0, 1.0, 1.0]));
+    assert_eq!(fill_after("color.gray"), (Some([0.5, 0.5, 0.5]), [0.5, 0.5, 0.5]));
+    assert_eq!(fill_after("color.cyan"), (Some([0.0, 1.0, 1.0]), [0.0, 1.0, 1.0]));
+    assert_eq!(fill_after("['CMYK', 0, 0, 0, 1]"), (Some([0.0, 0.0, 0.0]), [0.0, 0.0, 0.0]));
+    // Transparent clears the fill; text can't be transparent, so its colour stays.
+    let (fill, text) = fill_after("color.transparent");
+    assert_eq!(fill, None);
+    assert_eq!(text, [0.0, 0.0, 0.0]);
+
+    let mut s = Session::new().with_clock(|| 1_700_000_000);
+    let id = s.open("order.pdf", None, Arc::new(scripted_form()), None).unwrap();
+    let before = s.save_bytes(id).unwrap();
+    for bad in ["['CMYK', 1]", "['G']", "['T', 0]", "['Lab', 0, 0, 0]", "['G', 'x']"] {
+        let err = s.run_javascript(id, &format!("var f = getField('price'); f.value = '9'; f.fillColor = {bad};"), None).unwrap_err();
+        assert!(err.to_string().contains("T, G, RGB or CMYK"), "{bad}: {err}");
+        assert_eq!(s.save_bytes(id).unwrap(), before, "{bad}: a malformed colour still refuses the script");
+    }
+}
+
+#[test]
+fn a_later_field_script_in_the_same_edit_reads_a_colour_an_earlier_one_wrote() {
+    let mut s = Session::new().with_clock(|| 1_700_000_000);
+    let id = s.open("order.pdf", None, Arc::new(scripted_form()), None).unwrap();
+    for (name, script) in
+        [("qty", "getField('price').fillColor = color.green; event.value = 1;"), ("total", "event.value = getField('price').fillColor.join(',');")]
+    {
+        s.apply(id, Edit::SetFieldScript { name: name.into(), event: "calculate".into(), script: Some(script.into()) }).unwrap();
+    }
+    s.apply(id, Edit::SetFieldScript { name: "total".into(), event: "format".into(), script: None }).unwrap();
+    s.apply(id, Edit::SetCalculationOrder { names: vec!["qty".into(), "total".into()] }).unwrap();
+    s.apply(id, Edit::SetFieldValue { name: "price".into(), value: FieldValue::Text("3".into()) }).unwrap();
+    let total = s.get(id).unwrap().form.iter().find(|f| f.name == "total").unwrap().value.clone();
+    assert_eq!(total, ["RGB,0,1,0"]);
+}
+
+#[test]
+fn a_document_script_helper_can_set_field_colours() {
+    let helpers = "function mark\\(name\\) { getField\\(name\\).fillColor = color.red; }";
+    let mut s = Session::new().with_clock(|| 1_700_000_000);
+    let id = s.open("helpers.pdf", None, Arc::new(scripted_form_with(helpers)), None).unwrap();
+    s.run_javascript(id, "mark('price');", None).unwrap();
+    let doc = pdfcraft_cos::Document::open(s.save_bytes(id).unwrap()).unwrap();
+    let f = pdfcraft_forms::fields(&doc).into_iter().find(|f| f.name == "price").unwrap();
+    assert_eq!(pdfcraft_forms::look(&doc, &f).fill, Some([1.0, 0.0, 0.0]));
+}
+
 #[test]
 fn calculate_now_simple_calculation_reads_formatted_values_and_groups_as_the_native_path_does() {
     // amount (4), group b (5) with kids b.c (6) and b.d (7), total (8) = SUM(amount, b).
@@ -13850,3 +15425,48 @@ fn calculate_now_simple_calculation_reads_formatted_values_and_groups_as_the_nat
     assert!(out.console.iter().any(|line| line == "3244.75"), "calculateNow agrees with the native path: {out:?}");
     assert_eq!(total(&s), ["3244.75"]);
 }
+
+/// A Word document converts through LibreOffice when it is installed; without it, the error
+/// says what is missing rather than calling the file a broken PDF.
+#[test]
+fn office_documents_convert_through_libreoffice_or_explain_why_not() {
+    let mut s = Session::new();
+    let text = s.create_from_text("t", "Quarterly report").unwrap();
+    let id = s.open("t.pdf", None, text, None).unwrap();
+    let docx = Arc::new(s.get(id).unwrap().export_office(compare::OfficeFormat::Docx));
+    assert_eq!(source_kind("Report.docx", &docx), Some(SourceKind::Office));
+    match s.convert_to_pdf("Report.docx", &docx) {
+        Ok((kind, pdf)) => {
+            assert_eq!(kind, SourceKind::Office);
+            let converted = s.open_new("Report.pdf", pdf).unwrap();
+            assert!(page_texts(&s, converted).concat().contains("Quarterly report"));
+        }
+        // Only "not installed" is an acceptable failure: a conversion that fails, times out or
+        // makes no PDF must fail this test.
+        Err(e) => assert!(e.to_string().contains("LibreOffice, which isn't installed"), "{e}"),
+    }
+    // Combine treats it as a file to convert, not as a PDF to pass through.
+    assert!(
+        s.as_pdf("Report.docx", &docx).map_or_else(|e| e.to_string().contains("LibreOffice, which isn't installed"), |pdf| pdf.starts_with(b"%PDF-"))
+    );
+}
+
+/// The frame thread never waits for LibreOffice: Insert, Combine and Create Multiple refuse an
+/// Office document and point to File ▸ Open, while images and text still convert there.
+#[test]
+fn inline_conversions_refuse_office_documents_without_running_libreoffice() {
+    let s = Session::new();
+    let docx = Arc::new(b"PK\x03\x04\x14\x00".to_vec());
+    for err in
+        [s.convert_to_pdf_inline("Report.docx", &docx).map(|_| ()).unwrap_err(), s.as_pdf_inline("Report.docx", &docx).map(|_| ()).unwrap_err()]
+    {
+        assert_eq!(
+            err,
+            EditError::Source(
+                "Report.docx: Word, Excel and PowerPoint files can't be added here yet; open it with File ▸ Open, which converts it to a PDF".into()
+            )
+        );
+    }
+    assert_eq!(s.convert_to_pdf_inline("notes.txt", &Arc::new(b"hello".to_vec())).unwrap().0, SourceKind::Text);
+    assert!(s.as_pdf_inline("scan.jpg", &Arc::new(jpeg_bytes())).unwrap().starts_with(b"%PDF-"));
+}
diff --git a/crates/engine/src/xfa.rs b/crates/engine/src/xfa.rs
index 9b28320a55..ee8c92cfdd 100644
--- a/crates/engine/src/xfa.rs
+++ b/crates/engine/src/xfa.rs
@@ -327,6 +327,28 @@ fn split_instance(tpl: &Template, som: &str) -> Option<(pdfcraft_xfa::DataPath,
     Some((path, parent_som, name, index))
 }
 
+/// The final layout index, which can differ from the index of the bound data node.
+fn indexed_som_tail(som: &str) -> Option<(&str, usize)> {
+    let (prefix, index) = som.strip_suffix(']')?.rsplit_once('[')?;
+    Some((prefix, index.parse().ok()?))
+}
+
+/// Adjust a pending focus when a sibling is deleted and its later instances are renumbered.
+fn shift_focus_after_removal(target: &mut Option<String>, prefix: &str, removed: usize) {
+    let Some((index, suffix)) = target
+        .as_deref()
+        .and_then(|som| som.strip_prefix(prefix)?.strip_prefix('[')?.split_once(']'))
+        .and_then(|(i, tail)| Some((i.parse::<usize>().ok()?, tail)))
+    else {
+        return;
+    };
+    if index == removed {
+        *target = None;
+    } else if index > removed {
+        *target = Some(format!("{prefix}[{}]{suffix}", index - 1));
+    }
+}
+
 /// A SOM path without its indexes (`form.page1.qty`), for matching names scripts pass.
 fn plain_som(som: &str) -> String {
     let mut out = String::with_capacity(som.len());
@@ -451,6 +473,8 @@ struct Runner<'a, 'b> {
     /// Field values to write, by name (the last wins).
     field_changes: std::collections::BTreeMap<String, Vec<String>>,
     by_som: Option<HashMap<String, String>>,
+    objects_by_som: HashMap<String, pdfcraft_cos::ObjRef>,
+    focus_requests: Vec<(usize, Option<String>)>,
     /// Widget names by the data node they bind to (built with `by_som`).
     by_path: Option<HashMap<pdfcraft_xfa::DataPath, Vec<String>>>,
     fields: Option<HashMap<String, FieldInfo>>,
@@ -498,6 +522,8 @@ impl<'a, 'b> Runner<'a, 'b> {
             pending: Vec::new(),
             field_changes: Default::default(),
             by_som: None,
+            objects_by_som: HashMap::new(),
+            focus_requests: Vec::new(),
             by_path: None,
             fields: None,
             cached: None,
@@ -559,7 +585,12 @@ impl<'a, 'b> Runner<'a, 'b> {
 
     fn by_som(&mut self) -> &HashMap<String, String> {
         if self.by_som.is_none() {
-            let by_som = pdfcraft_xfa::fields_by_som(self.doc);
+            let mut by_som = HashMap::new();
+            self.objects_by_som.clear();
+            for (som, (name, object)) in pdfcraft_xfa::field_objects_by_som(self.doc) {
+                self.objects_by_som.insert(som.clone(), object);
+                by_som.insert(som, name);
+            }
             let mut by_path: HashMap<pdfcraft_xfa::DataPath, Vec<String>> = HashMap::new();
             for (som, name) in &by_som {
                 by_path.entry(pdfcraft_xfa::data_path(self.tpl, som)).or_default().push(name.clone());
@@ -891,6 +922,13 @@ impl<'a, 'b> Runner<'a, 'b> {
                         // The data holds every shown instance before one is taken out.
                         counts.insert(key, have.saturating_sub(1));
                         self.data_op(pdfcraft_xfa::DataOp::Instances { parent: parent.clone(), name: name.clone(), count: have });
+                        // SOM indexes after the removed instance shift down. A focus on
+                        // the deleted instance itself must never reach its replacement.
+                        if let Some((prefix, removed)) = indexed_som_tail(som) {
+                            for (_, target) in &mut self.focus_requests {
+                                shift_focus_after_removal(target, prefix, removed);
+                            }
+                        }
                         let mut path = parent;
                         path.push((name, index));
                         self.data_op(pdfcraft_xfa::DataOp::Remove(path));
@@ -914,9 +952,8 @@ impl<'a, 'b> Runner<'a, 'b> {
                 XfaEffect::OpenAttachment { name, open } => self.run.out.requests.push(Request::OpenAttachment { name: name.clone(), open: *open }),
                 XfaEffect::ShowPanel(p) => self.run.out.requests.push(Request::ShowPanel(*p)),
                 XfaEffect::SetFocus(som) => {
-                    if let Some(name) = self.by_som().get(som).cloned() {
-                        self.run.out.requests.push(Request::Focus(name));
-                    }
+                    self.focus_requests.push((self.run.out.requests.len(), Some(som.clone())));
+                    self.run.out.requests.push(Request::Focus(String::new()));
                 }
                 XfaEffect::Beep => self.run.out.requests.push(Request::Beep),
                 XfaEffect::Highlight(on) => {
@@ -1026,6 +1063,16 @@ impl<'a, 'b> Runner<'a, 'b> {
             self.relayout()?;
         }
         self.flush()?;
+        if !self.focus_requests.is_empty() {
+            self.by_som();
+            for (index, som) in self.focus_requests.into_iter().rev() {
+                if let Some((name, object)) = som.as_ref().and_then(|som| self.by_som.as_ref()?.get(som).zip(self.objects_by_som.get(som))) {
+                    self.run.out.requests[index] = Request::FocusField { name: name.clone(), object_id: crate::js::field_object_id(*object) };
+                } else {
+                    self.run.out.requests.remove(index);
+                }
+            }
+        }
         self.session = None;
         if self.skipped > 0 {
             let why = if self.run.ran_away {
@@ -1442,6 +1489,30 @@ mod tests {
         assert!(started.elapsed() < std::time::Duration::from_secs(2), "took {:?}", started.elapsed());
     }
 
+    /// Verify that a shared layout name cannot cause a data-binding index to redirect pending focus.
+    #[test]
+    fn focus_shift_uses_the_som_index_when_data_binding_omits_the_segment() {
+        let (tpl, _) = pdfcraft_xfa::parse(
+            r#"<template xmlns="http://www.xfa.org/schema/xfa-template/3.3/">
+                <subform name="form"><area name="row"/><subform name="row"><occur min="1" max="4"/></subform></subform>
+            </template>"#,
+        )
+        .unwrap();
+        let removed = "form[0].row[1]";
+        assert_eq!(split_instance(&tpl, removed).unwrap().3, 0);
+        let (prefix, index) = indexed_som_tail(removed).unwrap();
+        for (before, after) in [
+            ("form[0].row[0].amount[0]", Some("form[0].row[0].amount[0]")),
+            ("form[0].row[1].amount[0]", None),
+            ("form[0].row[2].amount[0]", Some("form[0].row[1].amount[0]")),
+        ] {
+            let mut target = Some(before.to_owned());
+            shift_focus_after_removal(&mut target, prefix, index);
+            assert_eq!(target.as_deref(), after);
+        }
+        assert!(indexed_som_tail("form[0].row[bad]").is_none());
+    }
+
     #[test]
     fn script_names_match_indexed_som_paths() {
         let som_matches = |som: &str, name: &str| ResetTargets::new(&[name.to_string()]).matches(som);
diff --git a/crates/engine/tests/form_date_language.rs b/crates/engine/tests/form_date_language.rs
index 55a701b6a9..ba4193522e 100644
--- a/crates/engine/tests/form_date_language.rs
+++ b/crates/engine/tests/form_date_language.rs
@@ -21,7 +21,7 @@ fn names_lock() -> MutexGuard<'static, ()> {
 
 /// `util.printd(fmt)` of 18 October 2026, then of what `util.scand(fmt, typed)` reads.
 fn printd(fmt: &str, typed: &str) -> String {
-    let doc = DocInfo { file_name: "form.pdf".into(), num_pages: 1, page: 0, info: Vec::new(), xfa: false, highlight: false, ..Default::default() };
+    let doc = DocInfo { file_name: "form.pdf".into(), num_pages: 1, page: 0, ..Default::default() };
     let script = format!("event.value = util.printd('{fmt}', new Date(2026, 9, 18)) + '|' + util.printd('{fmt}', util.scand('{fmt}', '{typed}'));");
     let o = run(&script, &Event::field("Format", "date", ""), &doc, &[], &[], Limits::default());
     assert_eq!(o.error, None);
@@ -75,7 +75,7 @@ fn form_dates_follow_the_date_language() {
 #[test]
 fn an_english_weekday_before_a_shared_month_name_reads_as_english() {
     let _names = names_lock();
-    let doc = DocInfo { file_name: "form.pdf".into(), num_pages: 1, page: 0, info: Vec::new(), xfa: false, highlight: false, ..Default::default() };
+    let doc = DocInfo { file_name: "form.pdf".into(), num_pages: 1, page: 0, ..Default::default() };
     let mar17 = DateTime { y: 2026, m: 3, d: 17, hh: 0, mm: 0, ss: 0 };
     let mut bad = Vec::new();
     for language in ["it", "es", "ro", "sq"] {
@@ -111,7 +111,7 @@ fn an_english_weekday_before_a_shared_month_name_reads_as_english() {
 /// letter that writes a name, through the form path and through `util.scand`. Called from the
 /// one test, which owns the process-wide names.
 fn every_date_language_reads_back_what_it_writes() {
-    let doc = DocInfo { file_name: "form.pdf".into(), num_pages: 1, page: 0, info: Vec::new(), xfa: false, highlight: false, ..Default::default() };
+    let doc = DocInfo { file_name: "form.pdf".into(), num_pages: 1, page: 0, ..Default::default() };
     let mut bad = Vec::new();
     for l in pdfcraft_engine::dates::DATE_LANGUAGES.iter() {
         use_form_date_language(l.code);
@@ -319,7 +319,7 @@ fn an_english_run_that_prints_the_stored_value_is_drawn() {
 
 /// What `util.scand(fmt, text)` reads, as `yyyy-mm-dd`, or `null`.
 fn scanned(fmt: &str, text: &str) -> String {
-    let doc = DocInfo { file_name: "form.pdf".into(), num_pages: 1, page: 0, info: Vec::new(), xfa: false, highlight: false, ..Default::default() };
+    let doc = DocInfo { file_name: "form.pdf".into(), num_pages: 1, page: 0, ..Default::default() };
     let script = format!("var d = util.scand('{fmt}', {text:?}); event.value = d ? util.printd('yyyy-mm-dd', d) : 'null';");
     let o = run(&script, &Event::field("Format", "date", ""), &doc, &[], &[], Limits::default());
     assert_eq!(o.error, None);
diff --git a/crates/fonts/src/pdf.rs b/crates/fonts/src/pdf.rs
index f68761e02e..7ae75ddf31 100644
--- a/crates/fonts/src/pdf.rs
+++ b/crates/fonts/src/pdf.rs
@@ -70,7 +70,10 @@ pub struct Metrics {
     /// A stream these metrics come from (a CMap, the program, `/CIDToGIDMap`, a Type 3 glyph
     /// description) was left unread because the decode allowance [`Metrics::from_dict_within`]
     /// was given was spent: what it would have decided (code lengths, CIDs, widths, meanings, a
-    /// Type 3 font's height) is a guess.
+    /// Type 3 font's height) is a guess. It is set exactly when the allowance counted a refusal
+    /// during the read ([`DecodeBudget::refused`]), which callers that share it may refuse on; a
+    /// read that fails without one, such as an empty stream behind a filter nothing decodes,
+    /// doesn't set it, with or without anything left.
     pub past_allowance: bool,
 }
 
@@ -420,12 +423,16 @@ impl<'a> Reads<'a> {
     /// stage past `max` is unread. When what is left is more than what the stages before that one
     /// made and `max`, it is charged those two and isn't refused; otherwise, with more left than
     /// the stages' total (behind one filter, `max`), it is charged that total and isn't refused;
-    /// with no more left than that total, it spends all of it and counts as refused.
+    /// with no more left than that total, it spends all of it and counts as refused. Only what
+    /// the allowance counts as refused ([`DecodeBudget::refused`]) is noted: a read that fails
+    /// without one, such as an empty stream behind a filter nothing decodes, fails the same with
+    /// more left, and callers that refuse on that count must agree with [`Metrics::past_allowance`].
     fn decode(&mut self, stream: &Stream, max: usize) -> Option<Vec<u8>> {
+        let refused = self.budget.refused();
         match self.budget.decode_stages_within(self.doc, stream, max) {
             Ok(data) => Some(data),
             Err(_) => {
-                self.refused |= self.budget.remaining() == 0;
+                self.refused |= self.budget.refused() > refused;
                 None
             }
         }
@@ -491,10 +498,14 @@ fn type3_glyph_box(doc: &Document, font: &Dict, reads: &mut Reads<'_>) -> Option
             break;
         }
         let before = reads.budget.remaining();
+        let refused = reads.budget.refused();
         let read = reads.budget.decode_with_damage(doc, s, MAX_TYPE3_GLYPH_BYTES.min(left)).map(|(data, _)| data);
         left = left.saturating_sub(before.saturating_sub(reads.budget.remaining()));
         let Ok(data) = read else {
-            if reads.budget.remaining() == 0 {
+            // As in `Reads::decode`, only a refusal the allowance counts: a description that fails
+            // without one (an empty one nothing decodes, once the allowance is spent) leaves the
+            // rest to be read, or refused above.
+            if reads.budget.refused() > refused {
                 // The rest go unread too, for want of the reading's allowance.
                 reads.refused = true;
                 complete = false;
@@ -810,6 +821,20 @@ fn number(t: &Tok) -> Option<u32> {
     }
 }
 
+/// The font's `/BaseFont` (a Type 3 font's descriptor `/FontName` when it has none), read without
+/// building its metrics, so it decodes no CMap.
+pub fn base_font_name(doc: &Document, font: &Dict) -> String {
+    font.name(b"BaseFont")
+        .map(|name| String::from_utf8_lossy(name).into_owned())
+        .or_else(|| {
+            (font.name(b"Subtype") == Some(b"Type3"))
+                .then(|| dict(doc, font.get(b"FontDescriptor")))
+                .flatten()
+                .and_then(|d| d.name(b"FontName").map(|name| String::from_utf8_lossy(name).into_owned()))
+        })
+        .unwrap_or_default()
+}
+
 /// Codespace ranges and CID mappings from an embedded CMap stream, at most
 /// [`MAX_CMAP_RANGES`] of each (every glyph searches them).
 #[allow(clippy::type_complexity)]
@@ -898,16 +923,7 @@ impl Metrics {
     pub fn from_dict_within(doc: &Document, font: &Dict, budget: &mut DecodeBudget) -> Self {
         let mut reads = Reads::new(doc, budget);
         let mut m = Self::read_metrics(doc, font, &mut reads);
-        let base = font
-            .name(b"BaseFont")
-            .map(|name| String::from_utf8_lossy(name).into_owned())
-            .or_else(|| {
-                (font.name(b"Subtype") == Some(b"Type3"))
-                    .then(|| dict(doc, font.get(b"FontDescriptor")))
-                    .flatten()
-                    .and_then(|d| d.name(b"FontName").map(|name| String::from_utf8_lossy(name).into_owned()))
-            })
-            .unwrap_or_default();
+        let base = base_font_name(doc, font);
         m.subset = base.len() > 7 && base.as_bytes()[6] == b'+' && base[..6].bytes().all(|b| b.is_ascii_uppercase());
         let (bold, italic) = style_from_name(&base);
         m.bold |= bold;
diff --git a/crates/fonts/src/pdf/tests.rs b/crates/fonts/src/pdf/tests.rs
index 975b71289e..74880c94a4 100644
--- a/crates/fonts/src/pdf/tests.rs
+++ b/crates/fonts/src/pdf/tests.rs
@@ -309,17 +309,27 @@ fn a_fonts_streams_are_paid_for_from_its_allowance() {
 }
 
 /// With nothing left, an empty stream still reads, as the allowance reads one, and is no reason to
-/// call the font read past it; a stream with data is left unread, and is.
+/// call the font read past it; a stream with data is left unread, and is. An empty stream behind a
+/// filter nothing decodes is unread with any allowance, so it isn't either: the font is read past
+/// its allowance exactly when the allowance counts a refusal, which is what callers refuse on.
 #[test]
 fn an_empty_stream_reads_with_nothing_left() {
-    let past = |data: &[u8]| {
+    let past = |filter: Option<&str>, data: &[u8]| {
         let mut doc = Document::new_empty();
-        let unicode = Object::Ref(doc.add(Object::Stream(Stream::from_raw(Dict::new(), data.to_vec()))));
+        let mut dict = Dict::new();
+        if let Some(filter) = filter {
+            dict.set(b"Filter".to_vec(), Object::name(filter));
+        }
+        let unicode = Object::Ref(doc.add(Object::Stream(Stream::from_raw(dict, data.to_vec()))));
         let f = font(&mut doc, vec![("Subtype", Object::name("TrueType")), ("ToUnicode", unicode)]);
-        Metrics::from_dict_within(&doc, &f, &mut DecodeBudget::new(0, 0)).past_allowance
+        let mut budget = DecodeBudget::new(0, 0);
+        let past = Metrics::from_dict_within(&doc, &f, &mut budget).past_allowance;
+        assert_eq!(past, budget.refused() > 0, "{filter:?}");
+        past
     };
-    assert!(!past(b""));
-    assert!(past(b"1 beginbfchar <41> <0058> endbfchar"));
+    assert!(!past(None, b""));
+    assert!(!past(Some("NoSuchFilter"), b""));
+    assert!(past(None, b"1 beginbfchar <41> <0058> endbfchar"));
 }
 
 /// A stream behind one filter past its own limit, with more left than its limit, is left unread as
@@ -424,6 +434,45 @@ fn each_stage_of_a_metrics_stream_is_held_to_its_limit() {
     assert_eq!(read(MAX_CID_TO_GID / 4), (false, false));
 }
 
+/// The editor's program list reads a legacy Thai font's metrics after its program. With the program
+/// spending the allowance to the byte, a ToUnicode that is an empty stream behind a filter nothing
+/// decodes, unread with any allowance, doesn't put the metrics past the allowance: the program is
+/// listed. A ToUnicode with data is refused by the allowance, and the program isn't.
+#[test]
+fn an_editors_program_is_listed_past_a_stream_unread_on_its_own() {
+    let bytes = include_bytes!("../../../../assets/fonts/Inter-Regular.ttf");
+    let listed = |filter: Option<&str>, data: &[u8]| {
+        let mut doc = Document::new_empty();
+        let mut dict = Dict::new();
+        if let Some(filter) = filter {
+            dict.set(b"Filter".to_vec(), Object::name(filter));
+        }
+        let unicode = Object::Ref(doc.add(Object::Stream(Stream::from_raw(dict, data.to_vec()))));
+        let program = Object::Ref(doc.add(Object::Stream(Stream::from_raw(Dict::new(), bytes.to_vec()))));
+        let mut descriptor = Dict::new();
+        descriptor.set(b"FontFile2".to_vec(), program);
+        let f = font(
+            &mut doc,
+            vec![
+                ("Subtype", Object::name("TrueType")),
+                ("BaseFont", Object::name("THSarabunPSK")),
+                ("FirstChar", Object::Int(65)),
+                ("LastChar", Object::Int(65)),
+                ("Widths", Object::Array(vec![Object::Int(500)])),
+                ("Encoding", Object::name("WinAnsiEncoding")),
+                ("FontDescriptor", Object::Dict(descriptor)),
+                ("ToUnicode", unicode),
+            ],
+        );
+        let mut budget = DecodeBudget::new(bytes.len(), 0);
+        let listed = embedded_sfnt_within(&doc, &f, &mut budget).is_some();
+        assert_eq!(budget.remaining(), 0, "the program spends the allowance to the byte");
+        (listed, budget.refused())
+    };
+    assert_eq!(listed(Some("NoSuchFilter"), b""), (true, 0));
+    assert_eq!(listed(None, b"1 beginbfchar <41> <0058> endbfchar"), (false, 1));
+}
+
 /// The editor's program is held to its limit as the metrics reads' streams are: a 12 MiB program
 /// whose Flate data is about 8 MiB reads behind ASCIIHex and Flate as behind Flate alone, though
 /// the two stages make about 20 MiB together. A program of the limit reads behind either, and one a
@@ -969,6 +1018,41 @@ fn type3_glyph_boxes_are_paid_for_from_the_allowance() {
     assert!(m.past_allowance, "a byte short, the second description is left unread");
 }
 
+/// A glyph description that fails on its own once the allowance is spent to the byte, an empty one
+/// behind a filter nothing decodes, fails the same with more left: it doesn't make the metrics read
+/// past the allowance, and the descriptions after it are read, or refused by the allowance.
+#[test]
+fn a_type3_description_unread_on_its_own_is_not_past_the_allowance() {
+    let mut doc = Document::new_empty();
+    let procs = ["1 0 0 -20 1 300 d1", "", "1 0 0 0 1 400 d1"];
+    let mut f = type3(&mut doc, [1.0, 0.0, 0.0, 1.0, 0.0, 0.0], [0, 0, 0, 0], &procs);
+    let mut dict = Dict::new();
+    dict.set(b"Filter".to_vec(), Object::name("NoSuchFilter"));
+    let unread = Object::Ref(doc.add(Object::Stream(Stream::from_raw(dict, Vec::new()))));
+    let Some(Object::Dict(mut charprocs)) = f.get(b"CharProcs").cloned() else { panic!("CharProcs") };
+    charprocs.set(b"g1".to_vec(), unread);
+    f.set(b"CharProcs".to_vec(), Object::Dict(charprocs));
+    with_differences(&mut f, &["g0", "g1", "g2"].map(String::from));
+    let first = procs[0].len();
+    let whole = Metrics::from_dict_within(&doc, &f, &mut DecodeBudget::new(usize::MAX, 0));
+    assert!(!whole.past_allowance);
+    assert_eq!((whole.ascent, whole.descent), (400.0, -20.0));
+    // The first description spends it to the byte; the third, which has data, is refused.
+    let mut budget = DecodeBudget::new(first, 0);
+    let m = Metrics::from_dict_within(&doc, &f, &mut budget);
+    assert_eq!(budget.refused(), 1);
+    assert!(m.past_allowance);
+    // Without the third, nothing is refused, and the metrics aren't past the allowance.
+    let Some(Object::Dict(mut charprocs)) = f.get(b"CharProcs").cloned() else { panic!("CharProcs") };
+    charprocs.remove(b"g2");
+    f.set(b"CharProcs".to_vec(), Object::Dict(charprocs));
+    let mut budget = DecodeBudget::new(first, 0);
+    let m = Metrics::from_dict_within(&doc, &f, &mut budget);
+    assert_eq!((budget.refused(), budget.remaining()), (0, 0));
+    assert!(!m.past_allowance);
+    assert_eq!((m.ascent, m.descent), (300.0, -20.0));
+}
+
 /// A Type 3 font measured from its glyphs' `d1` boxes keeps them over a descriptor's `/Ascent`
 /// and `/Descent`, which are optional for Type 3 (ISO 32000-2 Table 120).
 #[test]
@@ -1739,6 +1823,16 @@ fn low_codes_resolve_to_the_covering_range() {
     assert_eq!((u.covering(0xFFFF).is_some(), u.covering(0x1_0001).is_some(), u.covering(0x1_0002).is_none()), (true, true, true));
 }
 
+#[test]
+fn base_font_name_matches_the_metrics_name() {
+    let doc = Document::new_empty();
+    let mut f = Dict::new();
+    f.set(b"BaseFont".to_vec(), Object::name("ABCDEF+Body"));
+    assert_eq!(base_font_name(&doc, &f), "ABCDEF+Body");
+    assert_eq!(base_font_name(&doc, &f), Metrics::from_dict(&doc, &f).base_font);
+    assert_eq!(base_font_name(&doc, &Dict::new()), "");
+}
+
 #[test]
 fn refused_subset_reads_do_not_encode_unverified_glyphs() {
     let mut doc = Document::new_empty();
diff --git a/crates/forms/src/actions.rs b/crates/forms/src/actions.rs
index 6a91220713..96d03e1869 100644
--- a/crates/forms/src/actions.rs
+++ b/crates/forms/src/actions.rs
@@ -128,6 +128,21 @@ fn read(doc: &Document, o: &Object, pages: &[pdfcraft_cos::ObjRef], scripts: &mu
     })
 }
 
+/// The JavaScript widget annotation `widget` runs for `trigger` (ISO 32000-2 Table 197: `/A`
+/// or `/AA /U` for Mouse Up, the other `/AA` entries for the rest): that action's, when it is a
+/// JavaScript action, then those of the actions chained after it with `/Next`, in the order
+/// they run (bounded as [`crate::document_action_scripts`] is). Reads only the widget's own
+/// dictionary, so a pointer moving over a large form costs nothing per field.
+pub fn widget_scripts(doc: &Document, widget: pdfcraft_cos::ObjRef, trigger: Trigger) -> Vec<String> {
+    let w = doc.get(widget);
+    let Some(wd) = w.as_dict() else { return Vec::new() };
+    let action = match trigger.key() {
+        None => wd.get(b"A").cloned().or_else(|| wd.get(b"AA").map(|a| doc.resolve(a)).and_then(|a| a.as_dict()?.get(b"U").cloned())),
+        Some(k) => wd.get(b"AA").map(|a| doc.resolve(a)).and_then(|a| a.as_dict()?.get(k).cloned()),
+    };
+    crate::scripting::chained_scripts(doc, action)
+}
+
 /// The actions of field `name` (its first widget), by trigger, in the tab's order.
 pub fn field_actions(doc: &Document, name: &str) -> Result<Vec<(Trigger, FieldAction)>, FormError> {
     let all = fields(doc);
diff --git a/crates/forms/src/author.rs b/crates/forms/src/author.rs
index ee6eef518b..f347909b58 100644
--- a/crates/forms/src/author.rs
+++ b/crates/forms/src/author.rs
@@ -19,9 +19,13 @@ mod tree;
 pub(crate) use tree::ancestor_sets;
 
 pub use edit::set_props;
+pub(crate) use edit::set_props_object;
 pub use lifecycle::{add_field, delete_field, delete_field_object, delete_widget, duplicate_field};
 pub(crate) use look::button_appearance;
-pub use look::{BorderStyle, CheckStyle, FieldFont, Look, LookPatch, check_style, look, redraw_field, redraw_fields, set_button_icon};
+pub(crate) use look::redraw_field_object;
+pub use look::{
+    BorderStyle, CheckStyle, FieldFont, Look, LookPatch, check_style, look, redraw_field, redraw_fields, set_button_icon, set_button_icon_target,
+};
 pub(crate) use tree::{ensure_form, form_fonts_as_objects};
 
 /// The smallest width and height of a field's widget, in points: a smaller one is refused.
@@ -82,6 +86,8 @@ pub struct FieldProps {
     /// Normal push-button label (`/MK /CA`) of one widget (0-based index).
     /// An empty string clears the label; other widgets and icon layouts are preserved.
     pub caption: Option<(usize, String)>,
+    /// Normal push-button label for every widget in the field.
+    pub caption_all: Option<String>,
     pub read_only: Option<bool>,
     pub required: Option<bool>,
     pub multiline: Option<bool>,
diff --git a/crates/forms/src/author/edit.rs b/crates/forms/src/author/edit.rs
index ea718369bf..b539bfc118 100644
--- a/crates/forms/src/author/edit.rs
+++ b/crates/forms/src/author/edit.rs
@@ -111,6 +111,15 @@ fn calculate_action(c: &crate::af::Calculate) -> Option<Object> {
 
 /// Change a field's properties (General and Options tabs) and redraw it.
 pub fn set_props(doc: &mut Document, name: &str, props: &FieldProps) -> Result<String, FormError> {
+    set_props_target(doc, name, None, props)
+}
+
+/// An exact script target can share its name with another field.
+pub(crate) fn set_props_object(doc: &mut Document, name: &str, object: ObjRef, props: &FieldProps) -> Result<String, FormError> {
+    set_props_target(doc, name, Some(object), props)
+}
+
+fn set_props_target(doc: &mut Document, name: &str, object: Option<ObjRef>, props: &FieldProps) -> Result<String, FormError> {
     if props.font_size.is_some_and(|size| !size.is_finite() || size < 0.0) {
         return invalid("font size must be a finite, non-negative number");
     }
@@ -127,7 +136,7 @@ pub fn set_props(doc: &mut Document, name: &str, props: &FieldProps) -> Result<S
         return invalid(crate::af::NOTATION_NOT_STORABLE);
     }
     let all = fields(doc);
-    let f = all.iter().find(|f| f.name == name).ok_or_else(|| FormError::NoSuchField(name.into()))?.clone();
+    let f = all.iter().find(|f| f.name == name && object.is_none_or(|obj| f.obj == obj)).ok_or_else(|| FormError::NoSuchField(name.into()))?.clone();
     let export_options = props.export_value.as_ref().map(|(index, value)| button_export_options(&f, *index, value)).transpose()?;
     if props.export_value.is_some() && props.options.is_some() {
         return invalid("give export_value or options, not both");
@@ -141,6 +150,15 @@ pub fn set_props(doc: &mut Document, name: &str, props: &FieldProps) -> Result<S
             return invalid(format!("{name} has no widget {}", wi.saturating_add(1)));
         }
     }
+    if props.caption_all.is_some() && f.kind != FieldKind::PushButton {
+        return invalid("only push buttons have a caption");
+    }
+    if props.caption_all.is_some() && f.widgets.is_empty() {
+        return invalid(format!("{name} has no widgets"));
+    }
+    if props.caption_all.is_some() && props.caption.is_some() {
+        return invalid("give a field caption or a widget caption, not both");
+    }
     // Validated before anything is written, so a refused rotation leaves the document unchanged.
     if let Some(rotation) = props.rotation {
         check_rotation(&f, name, rotation)?;
@@ -503,7 +521,7 @@ fn redraw_or_join(doc: &mut Document, f: &Field, name: &str, new_name: &str, joi
         }
         Ok(())
     } else {
-        redraw_widgets(doc, new_name, only)
+        super::look::redraw_widgets_target(doc, new_name, Some(f.obj), only)
     }
 }
 
@@ -577,6 +595,13 @@ fn apply_late_widget_props(doc: &mut Document, f: &Field, props: &FieldProps, ne
         mk.set(b"CA".to_vec(), PdfString::text(caption));
         doc.update_dict(w.obj, |d| d.set(b"MK".to_vec(), Object::Dict(mk)))?;
     }
+    if let Some(caption) = &props.caption_all {
+        for w in &f.widgets {
+            let mut mk = doc.get(w.obj).as_dict().and_then(|d| d.get(b"MK").map(|m| doc.resolve(m).as_dict().cloned())).flatten().unwrap_or_default();
+            mk.set(b"CA".to_vec(), PdfString::text(caption));
+            doc.update_dict(w.obj, |d| d.set(b"MK".to_vec(), Object::Dict(mk)))?;
+        }
+    }
     // A label-only edit must not replace another widget's custom appearances.
     let only = props.caption.as_ref().filter(|_| *props == (FieldProps { caption: props.caption.clone(), ..Default::default() })).map(|(wi, _)| *wi);
     Ok(only)
diff --git a/crates/forms/src/author/lifecycle.rs b/crates/forms/src/author/lifecycle.rs
index f719292a80..28b56749d9 100644
--- a/crates/forms/src/author/lifecycle.rs
+++ b/crates/forms/src/author/lifecycle.rs
@@ -172,6 +172,7 @@ pub fn add_field(doc: &mut Document, page: usize, rect: [f64; 4], kind: &NewFiel
                 read_only: false,
                 rotation: 0,
                 caption: None,
+                mouse_up_script: None,
                 list: None,
                 round: true,
             };
@@ -261,10 +262,26 @@ pub fn delete_widget(doc: &mut Document, name: &str, widget: usize) -> Result<()
 fn delete_found_field(doc: &mut Document, f: Field) -> Result<(), FormError> {
     let widgets: std::collections::HashSet<ObjRef> = f.widgets.iter().map(|w| w.obj).collect();
     drop_from_pages(doc, &widgets)?;
+    let mut parent = doc.get(f.obj).as_dict().and_then(|d| d.reference(b"Parent"));
     detach(doc, f.obj)?;
     // Out of the calculation order too: a `/CO` entry would keep the field, its value and its
     // widgets reachable for a full save.
-    drop_from_calculation_order(doc, |r| r == f.obj || widgets.contains(&r))
+    drop_from_calculation_order(doc, |r| r == f.obj || widgets.contains(&r))?;
+    // An ancestor left with no kids would become a field of its own, and keep the `/V` and `/DV`
+    // the deleted field inherited from it: it goes too, up the chain.
+    let mut gone = std::collections::HashSet::new();
+    while let Some(p) = parent.filter(|p| gone.len() < 64 && !gone.contains(p)) {
+        let Some(d) = doc.get(p).as_dict().cloned() else { break };
+        let empty = d.get(b"Kids").map(|o| doc.resolve(o)).and_then(|o| o.as_array().map(Vec::is_empty)) == Some(true);
+        if !empty {
+            break;
+        }
+        parent = d.reference(b"Parent");
+        gone.insert(p);
+        drop_from_pages(doc, &std::iter::once(p).collect())?;
+        detach(doc, p)?;
+    }
+    drop_from_calculation_order(doc, |r| gone.contains(&r))
 }
 
 /// Take the annotations `widgets` off every page's `/Annots`, held directly or by reference.
diff --git a/crates/forms/src/author/look.rs b/crates/forms/src/author/look.rs
index 01e78f8dc1..ca352e9815 100644
--- a/crates/forms/src/author/look.rs
+++ b/crates/forms/src/author/look.rs
@@ -314,7 +314,18 @@ pub fn redraw_field(doc: &mut Document, name: &str) -> Result<(), FormError> {
 /// other widgets' appearances as they are), or for every widget when `only` is `None`. Fails with
 /// `FormError::NoSuchField` when no field is named `name`.
 pub(super) fn redraw_widgets(doc: &mut Document, name: &str, only: Option<usize>) -> Result<(), FormError> {
-    let f = fields(doc).into_iter().find(|f| f.name == name).ok_or_else(|| FormError::NoSuchField(name.into()))?;
+    redraw_widgets_target(doc, name, None, only)
+}
+
+pub(crate) fn redraw_field_object(doc: &mut Document, name: &str, object: ObjRef) -> Result<(), FormError> {
+    redraw_widgets_target(doc, name, Some(object), None)
+}
+
+pub(super) fn redraw_widgets_target(doc: &mut Document, name: &str, object: Option<ObjRef>, only: Option<usize>) -> Result<(), FormError> {
+    let f = fields(doc)
+        .into_iter()
+        .find(|f| f.name == name && object.is_none_or(|obj| f.obj == obj))
+        .ok_or_else(|| FormError::NoSuchField(name.into()))?;
     redraw_widgets_of(doc, &f, only)
 }
 
@@ -436,8 +447,12 @@ pub(crate) fn button_appearance(doc: &Document, w: &Widget, field_da: &str) -> (
             && x1 > x0
             && y1 > y0
         {
-            // Proportional, as large as fits (Acrobat's default icon placement), centred.
-            let k = ((width - 2.0) / (x1 - x0)).min((height - 2.0) / (y1 - y0)).max(0.0);
+            // /IF /FB fits the icon to the whole widget, including its border area.
+            let fit_bounds = mk.get(b"IF").is_some_and(|fit| {
+                doc.resolve(fit).as_dict().and_then(|fit| fit.get(b"FB")).is_some_and(|flag| matches!(&*doc.resolve(flag), Object::Bool(true)))
+            });
+            let inset = if fit_bounds { 0.0 } else { 2.0 };
+            let k = ((width - inset) / (x1 - x0)).min((height - inset) / (y1 - y0)).max(0.0);
             let (dx, dy) = ((width - (x1 - x0) * k) / 2.0 - x0 * k, (height - (y1 - y0) * k) / 2.0 - y0 * k);
             content.extend(format!("q {k:.6} 0 0 {k:.6} {dx:.3} {dy:.3} cm /Icon Do Q\n").bytes());
             xobjects.set(b"Icon".to_vec(), Object::Ref(icon));
@@ -464,7 +479,15 @@ pub(crate) fn button_appearance(doc: &Document, w: &Widget, field_da: &str) -> (
 /// Give a push button (an image field) the picture `image` (an image XObject of `px` pixels):
 /// it becomes the button's icon (`/MK /I`) and its appearance.
 pub fn set_button_icon(doc: &mut Document, name: &str, image: ObjRef, px: (u32, u32)) -> Result<(), FormError> {
-    let f = fields(doc).into_iter().find(|f| f.name == name).ok_or_else(|| FormError::NoSuchField(name.into()))?;
+    set_button_icon_target(doc, name, None, image, px)
+}
+
+/// Give the exact field its image without changing another field with the same name.
+pub fn set_button_icon_target(doc: &mut Document, name: &str, object: Option<ObjRef>, image: ObjRef, px: (u32, u32)) -> Result<(), FormError> {
+    let f = fields(doc)
+        .into_iter()
+        .find(|f| f.name == name && object.is_none_or(|obj| f.obj == obj))
+        .ok_or_else(|| FormError::NoSuchField(name.into()))?;
     if f.kind != FieldKind::PushButton {
         return invalid(format!("{name} is not a button or image field"));
     }
@@ -485,7 +508,7 @@ pub fn set_button_icon(doc: &mut Document, name: &str, image: ObjRef, px: (u32,
         }
         doc.update_dict(wd.obj, |d| d.set(b"MK".to_vec(), Object::Dict(mk)))?;
     }
-    redraw_field(doc, name)
+    redraw_field_object(doc, name, f.obj)
 }
 
 fn empty_box(doc: &Document, w: &Widget) -> Stream {
diff --git a/crates/forms/src/lib.rs b/crates/forms/src/lib.rs
index c1c91f8872..414132b42b 100644
--- a/crates/forms/src/lib.rs
+++ b/crates/forms/src/lib.rs
@@ -24,15 +24,15 @@ mod calc_order;
 pub mod detect;
 mod scripting;
 pub mod table;
-pub use actions::{FieldAction, Trigger, field_action_chains, field_actions, set_field_actions};
+pub use actions::{FieldAction, Trigger, field_action_chains, field_actions, set_field_actions, widget_scripts};
 pub use author::{
     BorderStyle, CheckStyle, FieldFont, FieldProps, Look, LookPatch, MIN_FIELD_SIDE, NewField, add_field, check_style, delete_field,
-    delete_field_object, delete_widget, duplicate_field, look, redraw_field, redraw_fields, set_button_icon, set_props,
+    delete_field_object, delete_widget, duplicate_field, look, redraw_field, redraw_fields, set_button_icon, set_button_icon_target, set_props,
 };
 pub use calc_order::{CalculatedField, CalculationIssue, CalculationOrder, calculation_order, set_calculation_order};
 pub use scripting::{
-    FieldChange, FieldEvent, NoScripts, ScriptResult, Scripts, apply_script_changes, document_scripts, document_scripts_named, set_document_script,
-    set_field_script,
+    DocumentTrigger, FieldChange, FieldEvent, NoScripts, ScriptResult, Scripts, apply_script_changes, document_action_scripts, document_scripts,
+    document_scripts_named, set_document_script, set_field_script,
 };
 
 mod appearances;
@@ -53,8 +53,8 @@ use values::has_password_flag;
 use values::write_value;
 pub(crate) use values::{ask_viewers_to_redraw, merged_appearance, redraw_calculated_value};
 pub use values::{
-    calculations_changed, clear_password_values, has_password_values, password_values, recalculate, recalculate_with, reset, restore_password_values,
-    set_value, set_value_with, set_values,
+    calculations_changed, clear_password_values, default_value_known, has_password_values, password_values, recalculate, recalculate_with, reset,
+    reset_with_counts, reset_with_formatting, reset_with_scripts, restore_password_values, set_value, set_value_with, set_values,
 };
 
 #[cfg(test)]
@@ -138,6 +138,8 @@ pub struct Widget {
     pub rotation: i64,
     /// Push buttons: the normal label (`/MK /CA`), separate from the field's name.
     pub caption: Option<String>,
+    /// Text widget JavaScript to run on a mouse-up click.
+    pub mouse_up_script: Option<String>,
     /// List boxes: where the options are drawn, so a click can pick the one under the pointer.
     pub list: Option<appearance::ListRows>,
     /// Drawn round: a radio button, or a check box laid out for a round XFA check button
diff --git a/crates/forms/src/read.rs b/crates/forms/src/read.rs
index ddd71f0b05..4a7904f620 100644
--- a/crates/forms/src/read.rs
+++ b/crates/forms/src/read.rs
@@ -724,6 +724,15 @@ fn walk(
                         value.as_string().map(|s| s.to_text())
                     })
                     .flatten(),
+                mouse_up_script: if kind == FieldKind::Text {
+                    let aa = wd.get(b"AA").map(|a| doc.resolve(a));
+                    let action = aa.as_deref().and_then(Object::as_dict).and_then(|aa| aa.get(b"U")).or_else(|| wd.get(b"A"));
+                    action
+                        .filter(|a| doc.resolve(a).as_dict().and_then(|a| a.name(b"S")) == Some(b"JavaScript"))
+                        .and_then(|a| script(doc, a, &mut seen.scripts))
+                } else {
+                    None
+                },
                 list: (kind == FieldKind::List).then(|| appearance::list_rows_of(doc, inh.da.as_deref().unwrap_or("/Helv 0 Tf 0 g"), Some(d), wd)),
                 round: kind == FieldKind::Radio || (kind == FieldKind::CheckBox && appearance::is_round(doc, wd)),
             })
diff --git a/crates/forms/src/scripting.rs b/crates/forms/src/scripting.rs
index 09fa1ea803..8ce3f1f68a 100644
--- a/crates/forms/src/scripting.rs
+++ b/crates/forms/src/scripting.rs
@@ -37,6 +37,8 @@ impl FieldEvent {
 #[derive(Clone, Debug, Default, PartialEq)]
 pub struct FieldChange {
     pub name: String,
+    /// Optional exact object target for malformed forms with duplicate field names.
+    pub object: Option<ObjRef>,
     pub value: Option<Vec<String>>,
     /// This value came from a Calculate script; redraw it through the field's Format script.
     pub formatted: bool,
@@ -44,8 +46,22 @@ pub struct FieldChange {
     pub required: Option<bool>,
     /// `display.visible` 0, `hidden` 1, `noPrint` 2, `noView` 3.
     pub display: Option<i32>,
-    /// Move/resize the first widget, in PDF user space.
+    /// Normal push-button caption, applied to every widget of the field.
+    pub caption: Option<String>,
+    pub text_color: Option<Vec<String>>,
+    pub fill_color: Option<Vec<String>>,
     pub rect: Option<[f64; 4]>,
+    pub stroke_color: Option<Vec<String>>,
+    pub text_size: Option<f64>,
+    pub line_width: Option<f64>,
+    pub border_style: Option<String>,
+    pub user_name: Option<String>,
+    pub icon: Option<Option<u64>>,
+    /// A combo box's or list box's new items (export value, text), from `setItems`.
+    pub options: Option<Vec<(String, String)>>,
+    /// JavaScript actions the script installed with `setAction`, by trigger name (`MouseUp`,
+    /// `OnFocus`, `Keystroke`, …), each replacing what the field ran for that trigger.
+    pub actions: Vec<(String, String)>,
 }
 
 /// What a script did.
@@ -64,8 +80,13 @@ pub struct ScriptResult {
 
 /// Runs field scripts (JavaScript).
 pub trait Scripts {
+    /// Whether the host stopped this edit's callbacks.
+    fn stopped(&self) -> bool {
+        false
+    }
+
     /// Run `script` for `event` on `target`, whose value is `value`; `fields` is the whole form.
-    fn run(&mut self, event: FieldEvent, script: &str, target: &Field, value: &str, fields: &[Field]) -> ScriptResult;
+    fn run(&mut self, event: FieldEvent, script: &str, target: &Field, value: &str, fields: &[Field], doc: &Document) -> ScriptResult;
 
     /// [`Self::run`] again for an appearance, with dates written in English names (`util.printd`)
     /// because no font of the field can draw the date language's (#5303); what it logs was
@@ -78,6 +99,7 @@ pub trait Scripts {
         _target: &Field,
         _value: &str,
         _fields: &[Field],
+        _doc: &Document,
     ) -> Option<ScriptResult> {
         None
     }
@@ -87,72 +109,212 @@ pub trait Scripts {
 pub struct NoScripts;
 
 impl Scripts for NoScripts {
-    fn run(&mut self, _: FieldEvent, _: &str, _: &Field, value: &str, _: &[Field]) -> ScriptResult {
+    /// Provide the no-JavaScript fallback: accept the current field value without additional script mutations.
+    fn run(&mut self, _: FieldEvent, _: &str, _: &Field, value: &str, _: &[Field], _: &Document) -> ScriptResult {
         ScriptResult { rc: true, value: value.to_string(), value_set: false, changes: Vec::new(), message: None }
     }
 }
 
 /// Run the Keystroke (commit) and Validate scripts for a new text value. Returns the value to
 /// store, or why it is rejected.
-pub(crate) fn accept(doc: &mut Document, f: &Field, value: &str, scripts: &mut dyn Scripts) -> Result<String, FormError> {
+pub(crate) fn accept(doc: &mut Document, f: &Field, value: &str, scripts: &mut dyn Scripts) -> Result<(String, bool), FormError> {
     let mut v = value.to_string();
+    let mut refresh_field = false;
     for (event, script, default) in [
         (FieldEvent::Keystroke, &f.actions.scripts.keystroke, "The value entered does not match the format of the field"),
         (FieldEvent::Validate, &f.actions.scripts.validate, "The value entered is not valid for the field"),
     ] {
         let Some(js) = script else { continue };
         let all = fields(doc);
-        let r = scripts.run(event, js, f, &v, &all);
-        apply_changes(doc, &r.changes, &f.name, scripts)?;
+        let r = scripts.run(event, js, f, &v, &all, doc);
+        refresh_field |= r.changes.iter().any(|change| change.name == f.name && change.object.is_none_or(|id| id == f.obj));
+        apply_changes(doc, &r.changes, &f.name, Some(f.obj), scripts)?;
         if !r.rc {
             return Err(FormError::Invalid(r.message.unwrap_or_else(|| format!("{default} [ {} ]", f.name))));
         }
         v = r.value;
     }
-    Ok(v)
+    Ok((v, refresh_field))
 }
 
 /// The text a custom Format script shows for `value`, if the field has one.
 pub(crate) fn formatted(doc: &Document, f: &Field, value: &str, scripts: &mut dyn Scripts) -> Option<String> {
     let js = f.actions.scripts.format.as_ref()?;
-    let r = scripts.run(FieldEvent::Format, js, f, value, &fields(doc));
+    let r = scripts.run(FieldEvent::Format, js, f, value, &fields(doc), doc);
     Some(r.value)
 }
 
+/// Immediate and aliased MK references of one widget; cycles and depth are bounded.
+fn widget_mk_refs(doc: &Document, widget: ObjRef) -> Vec<ObjRef> {
+    let mut value = doc.get(widget).as_dict().and_then(|d| d.get(b"MK")).cloned();
+    let mut seen = Vec::new();
+    for _ in 0..64 {
+        let Some(Object::Ref(reference)) = value else { break };
+        if seen.contains(&reference) {
+            break;
+        }
+        seen.push(reference);
+        value = Some(doc.get(reference).as_ref().clone());
+    }
+    seen
+}
+
+/// Keep target widgets' shared indirect MK in place, while outside widgets retain old colors.
+fn protect_other_mk_owners(doc: &mut Document, field: &Field, owners: &std::collections::HashMap<ObjRef, Vec<ObjRef>>) -> Result<(), FormError> {
+    let own: HashSet<_> = field.widgets.iter().map(|w| w.obj).collect();
+    let refs: HashSet<_> = field.widgets.iter().filter_map(|w| doc.get(w.obj).as_dict().and_then(|d| d.reference(b"MK"))).collect();
+    for reference in refs {
+        for widget in owners.get(&reference).into_iter().flatten().filter(|w| !own.contains(w)) {
+            if !widget_mk_refs(doc, *widget).contains(&reference) {
+                continue;
+            }
+            let mk =
+                doc.get(*widget).as_dict().and_then(|d| d.get(b"MK")).map(|m| doc.resolve(m)).and_then(|v| v.as_dict().cloned()).unwrap_or_default();
+            doc.update_dict(*widget, |d| d.set(b"MK".to_vec(), Object::Dict(mk)))?;
+        }
+    }
+    Ok(())
+}
+
+/// Most items a script may give a choice field ([`FieldChange::options`]).
+const MAX_SCRIPT_OPTIONS: usize = 10_000;
+
+/// Write a combo box's or list box's items (export value, text) as its `/Opt`: a plain text
+/// where the two are the same, a pair where they differ (ISO 32000-2 Table 231). The selected
+/// indices (`/I`) no longer apply and go; the value is written after, and the field redrawn.
+fn write_options(doc: &mut Document, f: &Field, options: &[(String, String)]) -> Result<(), FormError> {
+    if !matches!(f.kind, FieldKind::Combo | FieldKind::List) {
+        return Err(FormError::Invalid(format!("{} is not a combo box or list box: it has no items to set", f.name)));
+    }
+    if options.len() > MAX_SCRIPT_OPTIONS {
+        return Err(FormError::Invalid(format!("a script may give a field at most {MAX_SCRIPT_OPTIONS} items")));
+    }
+    let opt = options
+        .iter()
+        .map(|(export, text)| {
+            if export == text {
+                Object::String(PdfString::text(text))
+            } else {
+                Object::Array(vec![Object::String(PdfString::text(export)), Object::String(PdfString::text(text))])
+            }
+        })
+        .collect();
+    doc.update_dict(f.obj, |d| {
+        d.set(b"Opt".to_vec(), Object::Array(opt));
+        d.remove(b"I");
+    })?;
+    crate::author::redraw_field_object(doc, &f.name, f.obj)
+}
+
+/// Install `script` as field `f`'s JavaScript for `trigger` (a `setAction` trigger name),
+/// replacing the action it had there: the field's `/AA` for Keystroke, Validate, Calculate and
+/// Format, each widget's `/A` (Mouse Up) or `/AA` for the rest.
+fn set_action(doc: &mut Document, f: &Field, trigger: &str, script: &str) -> Result<(), FormError> {
+    let event = match trigger {
+        "Keystroke" => Some("keystroke"),
+        "Validate" => Some("validate"),
+        "Calculate" => Some("calculate"),
+        "Format" => Some("format"),
+        "MouseUp" => Some("mouse_up"),
+        _ => None,
+    };
+    if let Some(event) = event {
+        // The field the script's object stands for, even when another shares its name.
+        return set_script_of(doc, f, event, Some(script));
+    }
+    let key: &[u8] = match trigger {
+        "MouseDown" => b"D",
+        "MouseEnter" => b"E",
+        "MouseExit" => b"X",
+        "OnFocus" => b"Fo",
+        "OnBlur" => b"Bl",
+        other => return Err(FormError::Invalid(format!("unknown action trigger {other:?}"))),
+    };
+    let mut action = pdfcraft_cos::Dict::new();
+    action.set(b"S".to_vec(), Object::name("JavaScript"));
+    action.set(b"JS".to_vec(), PdfString::text(script));
+    let action = doc.add(Object::Dict(action));
+    for w in &f.widgets {
+        let mut aa =
+            doc.get(w.obj).as_dict().and_then(|d| d.get(b"AA").map(|a| doc.resolve(a))).and_then(|a| a.as_dict().cloned()).unwrap_or_default();
+        aa.set(key.to_vec(), Object::Ref(action));
+        doc.update_dict(w.obj, |d| d.set(b"AA".to_vec(), Object::Dict(aa)))?;
+    }
+    Ok(())
+}
+
 /// [`formatted`] with dates in English names, for widgets whose fonts can't draw the date
 /// language's; `None` when the field has no Format script or the English run didn't happen.
 pub(crate) fn formatted_in_english(doc: &Document, f: &Field, value: &str, scripts: &mut dyn Scripts) -> Option<String> {
     let js = f.actions.scripts.format.as_ref()?;
-    scripts.rerun_with_english_dates(FieldEvent::Format, js, f, value, &fields(doc)).map(|r| r.value)
+    scripts.rerun_with_english_dates(FieldEvent::Format, js, f, value, &fields(doc), doc).map(|r| r.value)
 }
 
 /// Apply script changes to other fields (values written without re-running their scripts;
-/// read-only, required and visibility as flags). `except` is the event's own field, whose value
-/// the event sets.
-pub(crate) fn apply_changes(doc: &mut Document, changes: &[FieldChange], except: &str, scripts: &mut dyn Scripts) -> Result<(), FormError> {
+/// read-only, required and visibility as flags; button captions). `except` is the event's own
+/// field, whose value the event sets.
+pub(crate) fn apply_changes(
+    doc: &mut Document,
+    changes: &[FieldChange],
+    except: &str,
+    except_object: Option<ObjRef>,
+    scripts: &mut dyn Scripts,
+) -> Result<(), FormError> {
     if changes.is_empty() {
         return Ok(());
     }
-    let all = fields(doc);
+    // Validate every colour before applying any part of the script's changes.
     for c in changes {
-        let Some(f) = all.iter().find(|f| f.name == c.name) else { continue };
+        for color in [&c.text_color, &c.fill_color, &c.stroke_color].into_iter().flatten() {
+            js_color(color)?;
+        }
+    }
+    let all = fields(doc);
+    let mut mk_owners: std::collections::HashMap<ObjRef, Vec<ObjRef>> = std::collections::HashMap::new();
+    if changes.iter().any(|c| c.fill_color.is_some() || c.stroke_color.is_some()) {
+        for field in &all {
+            for widget in &field.widgets {
+                for reference in widget_mk_refs(doc, widget.obj) {
+                    mk_owners.entry(reference).or_default().push(widget.obj);
+                }
+            }
+        }
+    }
+
+    for c in changes {
+        let Some(f) = all.iter().find(|f| f.name == c.name && c.object.is_none_or(|obj| f.obj == obj)) else { continue };
+        // New items go first, so a value among them is written against them.
+        let reread;
+        let f = match &c.options {
+            Some(options) => {
+                write_options(doc, f, options)?;
+                reread = fields(doc).into_iter().find(|x| x.obj == f.obj).unwrap_or_else(|| f.clone());
+                &reread
+            }
+            None => f,
+        };
+        for (trigger, script) in &c.actions {
+            set_action(doc, f, trigger, script)?;
+        }
         if let Some(v) = &c.value
-            && c.name != except
+            && !except_object.map_or(c.name == except, |obj| f.obj == obj)
             && *v != f.value
         {
             let value = match f.kind {
-                FieldKind::Text => FieldValue::Text(v.first().cloned().unwrap_or_default()),
-                FieldKind::CheckBox => f.check_box_value(v.first().map(String::as_str)),
-                FieldKind::Radio => FieldValue::Radio(v.first().cloned()),
-                FieldKind::Combo | FieldKind::List => FieldValue::Choice(v.clone()),
-                _ => continue,
+                FieldKind::Text => Some(FieldValue::Text(v.first().cloned().unwrap_or_default())),
+                FieldKind::CheckBox => Some(f.check_box_value(v.first().map(String::as_str))),
+                FieldKind::Radio => Some(FieldValue::Radio(v.first().cloned())),
+                FieldKind::Combo | FieldKind::List => Some(FieldValue::Choice(v.clone())),
+                _ => None,
             };
-            let mut tmp = f.clone();
-            tmp.flags &= !flags::NO_TOGGLE_TO_OFF;
-            tmp.actions = Default::default();
-            crate::write_value(doc, &tmp, &value, &mut NoScripts)?;
-            if c.formatted {
-                crate::redraw_calculated_value(doc, f, v, scripts)?;
+            if let Some(value) = value {
+                let mut tmp = f.clone();
+                tmp.flags &= !flags::NO_TOGGLE_TO_OFF;
+                tmp.actions = Default::default();
+                crate::write_value(doc, &tmp, &value, &mut NoScripts)?;
+                if c.formatted {
+                    crate::redraw_calculated_value(doc, f, v, scripts)?;
+                }
             }
         }
         let mut ff = f.flags;
@@ -182,18 +344,129 @@ pub(crate) fn apply_changes(doc: &mut Document, changes: &[FieldChange], except:
                 }
             }
         }
+        if c.fill_color.is_some() || c.stroke_color.is_some() {
+            protect_other_mk_owners(doc, f, &mk_owners)?;
+        }
+        let appearance = crate::LookPatch {
+            text: c.text_color.as_deref().map(js_color).transpose()?.flatten(),
+            fill: c.fill_color.as_deref().map(js_color).transpose()?,
+            border: c.stroke_color.as_deref().map(js_color).transpose()?,
+            width: c.line_width,
+            style: c
+                .border_style
+                .as_deref()
+                .map(|style| match style {
+                    "solid" => Ok(crate::BorderStyle::Solid),
+                    "dashed" => Ok(crate::BorderStyle::Dashed),
+                    "beveled" => Ok(crate::BorderStyle::Beveled),
+                    "inset" => Ok(crate::BorderStyle::Inset),
+                    "underline" => Ok(crate::BorderStyle::Underline),
+                    _ => Err(FormError::Invalid("unsupported borderStyle".into())),
+                })
+                .transpose()?,
+            ..Default::default()
+        };
+        if appearance != crate::LookPatch::default() || c.text_size.is_some() || c.user_name.is_some() {
+            crate::author::set_props_object(
+                doc,
+                &c.name,
+                f.obj,
+                &crate::FieldProps {
+                    appearance: (appearance != crate::LookPatch::default()).then_some(appearance),
+                    font_size: c.text_size,
+                    tooltip: c.user_name.clone(),
+                    ..Default::default()
+                },
+            )?;
+        }
         if let Some(rect) = c.rect {
-            crate::set_props(doc, &c.name, &crate::FieldProps { rect: Some((0, rect)), ..Default::default() })?;
+            if !rect.iter().all(|v| v.is_finite() && v.abs() <= 1e7) || rect[2] < rect[0] || rect[3] < rect[1] {
+                return Err(FormError::Invalid("invalid script rectangle".into()));
+            }
+            let widget = f.widgets.first().ok_or_else(|| FormError::Invalid("field has no widget rectangle".into()))?;
+            doc.update_dict(widget.obj, |d| d.set(b"Rect".to_vec(), Object::Array(rect.into_iter().map(Object::Real).collect())))?;
+            crate::author::redraw_field_object(doc, &c.name, f.obj)?;
+        }
+        if let Some(icon) = c.icon {
+            if f.kind != FieldKind::PushButton {
+                return Err(FormError::Invalid("icons require a push button".into()));
+            }
+            if icon.is_some_and(|id| id >> 48 != 0) {
+                return Err(FormError::Invalid("invalid button icon handle".into()));
+            }
+            let reference = icon.map(|id| pdfcraft_cos::ObjRef::new((id >> 16) as u32, id as u16));
+            if let Some(reference) = reference {
+                let obj = doc.get(reference);
+                let valid = match &*obj {
+                    Object::Stream(stream) => stream.dict.name(b"Subtype") == Some(b"Form".as_slice()),
+                    _ => false,
+                };
+                if !valid {
+                    return Err(FormError::Invalid("button icon is not a form in this document".into()));
+                }
+            }
+            for widget in &f.widgets {
+                let mut mk = doc
+                    .get(widget.obj)
+                    .as_dict()
+                    .and_then(|d| d.get(b"MK").map(|m| doc.resolve(m)))
+                    .and_then(|m| m.as_dict().cloned())
+                    .unwrap_or_default();
+                match reference {
+                    Some(r) => mk.set(b"I".to_vec(), Object::Ref(r)),
+                    None => {
+                        mk.remove(b"I");
+                    }
+                }
+                doc.update_dict(widget.obj, |d| d.set(b"MK".to_vec(), Object::Dict(mk)))?;
+            }
+            crate::author::redraw_field_object(doc, &c.name, f.obj)?;
+        }
+        if let Some(caption) = &c.caption {
+            if f.kind != FieldKind::PushButton {
+                return Err(FormError::Invalid(format!("{} is not a push button", f.name)));
+            }
+            crate::author::set_props_object(doc, &f.name, f.obj, &crate::FieldProps { caption_all: Some(caption.clone()), ..Default::default() })?;
         }
     }
     Ok(())
 }
 
+/// An Acrobat colour array as the RGB the look model stores, `None` for transparent (`["T"]`).
+/// Gray and CMYK convert as Acrobat's `color.convert` does. Anything else (an unknown colour
+/// space, the wrong number of components, or a component that is not a finite number between
+/// 0 and 1) is refused, and with it the script's changes.
+fn js_color(values: &[String]) -> Result<Option<[f64; 3]>, FormError> {
+    let invalid = || FormError::Invalid("JavaScript field colours must be T, G, RGB or CMYK arrays with finite components between 0 and 1".into());
+    let (space, parts) = values.split_first().ok_or_else(invalid)?;
+    let mut numbers = [0.0; 4];
+    if parts.len() > numbers.len() {
+        return Err(invalid());
+    }
+    for (slot, part) in numbers.iter_mut().zip(parts) {
+        *slot = part.trim().parse::<f64>().ok().filter(|v| v.is_finite() && (0.0..=1.0).contains(v)).ok_or_else(invalid)?;
+    }
+    match (space.as_str(), parts.len()) {
+        ("T", 0) => Ok(None),
+        ("G", 1) => Ok(Some([numbers[0]; 3])),
+        ("RGB", 3) => Ok(Some([numbers[0], numbers[1], numbers[2]])),
+        ("CMYK", 4) => {
+            let [c, m, y, k] = numbers;
+            Ok(Some([1.0 - (c + k).min(1.0), 1.0 - (m + k).min(1.0), 1.0 - (y + k).min(1.0)]))
+        }
+        _ => Err(invalid()),
+    }
+}
+
 /// Apply what a button or console script changed (values, read-only, required, visibility),
 /// then recalculate.
 pub fn apply_script_changes(doc: &mut Document, changes: &[FieldChange], scripts: &mut dyn Scripts) -> Result<(), FormError> {
-    apply_changes(doc, changes, "", scripts)?;
-    crate::recalculate_with(doc, scripts)?;
+    apply_changes(doc, changes, "", None, scripts)?;
+    // Acrobat's automatic calculation is driven by value changes. A keypad caption,
+    // position or visibility update must not execute every calculated field again.
+    if changes.iter().any(|change| change.value.is_some()) {
+        crate::recalculate_with(doc, scripts)?;
+    }
     Ok(())
 }
 
@@ -266,6 +539,79 @@ pub fn document_scripts_named(doc: &Document) -> Vec<(String, String)> {
     out
 }
 
+/// A document-level action trigger whose JavaScript the viewer runs (ISO 32000-2 §12.6.3,
+/// Table 199): the catalog's `/OpenAction`, or its `/AA` entries.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum DocumentTrigger {
+    /// The catalog `/OpenAction`, once the document has opened.
+    Open,
+    /// `/AA /WS`, before the document is saved.
+    WillSave,
+    /// `/AA /WP`, before the document is printed.
+    WillPrint,
+}
+
+/// Most actions read for one document trigger, along its `/Next` chain. A chain can be cyclic
+/// or arbitrarily long; the rest are ignored.
+const MAX_CHAINED_ACTIONS: usize = 256;
+
+/// The JavaScript of the catalog actions for `trigger`, in the order a viewer runs them: the
+/// action, then its `/Next` actions depth first (§12.6.2). Actions of other types (a `/GoTo`
+/// open action, say) are skipped; their `/Next` chains are still followed. Bounded: each object
+/// is read once and at most [`MAX_CHAINED_ACTIONS`] actions are visited.
+pub fn document_action_scripts(doc: &Document, trigger: DocumentTrigger) -> Vec<String> {
+    let Some(root) = doc.root() else { return Vec::new() };
+    let cat = doc.get(root);
+    let Some(cat) = cat.as_dict() else { return Vec::new() };
+    let first = match trigger {
+        DocumentTrigger::Open => cat.get(b"OpenAction").cloned(),
+        DocumentTrigger::WillSave | DocumentTrigger::WillPrint => {
+            let key: &[u8] = if trigger == DocumentTrigger::WillSave { b"WS" } else { b"WP" };
+            cat.get(b"AA").map(|a| doc.resolve(a)).and_then(|a| a.as_dict().and_then(|d| d.get(key)).cloned())
+        }
+    };
+    chained_scripts(doc, first)
+}
+
+/// The JavaScript of action `first` and of the actions chained after it, in the order they run:
+/// the action, then its `/Next` actions depth first (ISO 32000-2 §12.6.2). Actions of other
+/// types are skipped; their `/Next` chains are still followed. Bounded: each object is read
+/// once and at most [`MAX_CHAINED_ACTIONS`] actions are visited.
+pub(crate) fn chained_scripts(doc: &Document, first: Option<Object>) -> Vec<String> {
+    let mut budget = crate::script_budget();
+    let mut seen: HashSet<u32> = HashSet::new();
+    let mut pending: Vec<Object> = first.into_iter().collect();
+    let mut visited = 0usize;
+    let mut out = Vec::new();
+    while let Some(raw) = pending.pop() {
+        visited += 1;
+        if visited > MAX_CHAINED_ACTIONS {
+            break;
+        }
+        if let Some(r) = raw.as_ref()
+            && !seen.insert(r.num)
+        {
+            continue;
+        }
+        let action = doc.resolve(&raw);
+        if let Some(list) = action.as_array() {
+            // Pushed in reverse so they run in the order listed.
+            pending.extend(list.iter().take(MAX_CHAINED_ACTIONS).rev().cloned());
+            continue;
+        }
+        let Some(d) = action.as_dict() else { continue };
+        if d.name(b"S") == Some(b"JavaScript".as_slice())
+            && let Some(js) = crate::script(doc, &raw, &mut budget)
+        {
+            out.push(js);
+        }
+        if let Some(next) = d.get(b"Next") {
+            pending.push(next.clone());
+        }
+    }
+    out
+}
+
 /// Call `f` on the array `o` is, or refers to, read in place: resolving a direct array would
 /// copy it.
 fn in_array(doc: &Document, o: &Object, f: impl FnOnce(&[Object])) {
@@ -323,7 +669,12 @@ pub fn set_document_script(doc: &mut Document, name: &str, js: Option<&str>) ->
 /// (its widgets' `/A`). Calculated fields join the calculation order (`/CO`).
 pub fn set_field_script(doc: &mut Document, name: &str, event: &str, js: Option<&str>) -> Result<(), FormError> {
     let all = fields(doc);
-    let f = all.iter().find(|f| f.name == name).ok_or_else(|| FormError::NoSuchField(name.into()))?.clone();
+    let f = all.iter().find(|f| f.name == name).ok_or_else(|| FormError::NoSuchField(name.into()))?;
+    set_script_of(doc, f, event, js)
+}
+
+/// [`set_field_script`] for the field `f` itself, which may share its name with another.
+fn set_script_of(doc: &mut Document, f: &Field, event: &str, js: Option<&str>) -> Result<(), FormError> {
     let action = |doc: &mut Document, js: &str| {
         let mut a = pdfcraft_cos::Dict::new();
         a.set(b"S".to_vec(), Object::name("JavaScript"));
diff --git a/crates/forms/src/tests.rs b/crates/forms/src/tests.rs
index 55cb97c887..a2a87f3a73 100644
--- a/crates/forms/src/tests.rs
+++ b/crates/forms/src/tests.rs
@@ -137,6 +137,71 @@ fn a_button_caption_its_fonts_encoding_cant_hold_is_reported() {
     assert_eq!(undrawn_fields(&doc), [("go".to_string(), '\u{2000B}')]);
 }
 
+/// A field-wide script caption must reach every widget, including shared dictionaries.
+#[test]
+fn script_caption_updates_every_widget_and_survives_save() {
+    let mut doc = one_page();
+    let a = add_field(&mut doc, 0, [40.0, 600.0, 200.0, 630.0], &NewField::Button { caption: "Original".into() }, Some("first")).unwrap();
+    let b = add_field(&mut doc, 0, [40.0, 500.0, 200.0, 530.0], &NewField::Button { caption: "Original".into() }, Some("second")).unwrap();
+    let all = fields(&doc);
+    let (first, second) = (field(&all, &a).obj, field(&all, &b).obj);
+    let mut parent = Dict::new();
+    parent.set(b"FT".to_vec(), Object::name("Btn"));
+    parent.set(b"Ff".to_vec(), Object::Int(flags::PUSH_BUTTON as i64));
+    parent.set(b"T".to_vec(), PdfString::text("clear_button"));
+    parent.set(b"Kids".to_vec(), Object::Array(vec![Object::Ref(first), Object::Ref(second)]));
+    let mut action = Dict::new();
+    action.set(b"S".to_vec(), Object::name("ResetForm"));
+    parent.set(b"A".to_vec(), Object::Dict(action.clone()));
+    let parent = doc.add(parent);
+    let mut mk = Dict::new();
+    let ca = Object::String(PdfString::text("Original"));
+    let ca = Object::Ref(doc.add(ca));
+    mk.set(b"CA".to_vec(), ca);
+    mk.set(b"TP".to_vec(), Object::Int(0));
+    mk.set(b"R".to_vec(), Object::Int(90));
+    mk.set(b"VendorNote".to_vec(), PdfString::text("kept"));
+    let mk = doc.add(mk);
+    let mut shared_ap = doc.get(first).as_dict().unwrap().get(b"AP").unwrap().as_dict().unwrap().clone();
+    let normal = shared_ap.get(b"N").unwrap().clone();
+    shared_ap.set(b"R".to_vec(), normal.clone());
+    shared_ap.set(b"D".to_vec(), normal);
+    shared_ap.set(b"VendorAP".to_vec(), PdfString::text("kept"));
+    let shared_ap = doc.add(shared_ap);
+    for widget in [first, second] {
+        doc.update_dict(widget, |d| {
+            for key in [b"FT".as_slice(), b"Ff", b"T"] {
+                d.remove(key);
+            }
+            d.set(b"Parent".to_vec(), Object::Ref(parent));
+            d.set(b"MK".to_vec(), Object::Ref(mk));
+            d.set(b"AP".to_vec(), Object::Ref(shared_ap));
+        })
+        .unwrap();
+    }
+    let af = doc.get(doc.root().unwrap()).as_dict().unwrap().reference(b"AcroForm").unwrap();
+    doc.update_dict(af, |d| d.set(b"Fields".to_vec(), Object::Array(vec![Object::Ref(parent)]))).unwrap();
+
+    for caption in ["Original", "", "Continue"] {
+        apply_script_changes(
+            &mut doc,
+            &[FieldChange { name: "clear_button".into(), caption: Some(caption.into()), ..Default::default() }],
+            &mut NoScripts,
+        )
+        .unwrap();
+        let bytes = pdfcraft_cos::write_full(&doc, &SaveOptions::default()).unwrap();
+        doc = Document::open(Arc::new(bytes)).unwrap();
+        let all = fields(&doc);
+        let button = field(&all, "clear_button");
+        assert_eq!(button.widgets.len(), 2);
+        for widget in &button.widgets {
+            assert_eq!(widget.caption.as_deref(), Some(caption));
+            let ap = doc.resolve(doc.get(widget.obj).as_dict().unwrap().get(b"AP").unwrap());
+            assert!(ap.as_dict().unwrap().get(b"N").is_some());
+        }
+    }
+}
+
 /// Changing one widget's caption on a push button with two widgets leaves the other widget, the
 /// shared `/MK` and the parent's action untouched, keeps the other `/MK` and `/AP` entries, and
 /// drops the stale rollover and down appearances, with a direct or indirect caption and either save.
@@ -221,6 +286,24 @@ fn button_caption_preserves_other_widgets_and_shared_dictionaries() {
             assert!(!apd.contains(b"R") && !apd.contains(b"D"), "stale hover/pressed text must not survive");
             assert!(ap(&doc, &f.widgets[1]).contains("(Clear Form) Tj"));
         }
+        let mut doc = original.clone();
+        set_props(&mut doc, "clear_button", &FieldProps { caption_all: Some("Continue".into()), ..Default::default() }).unwrap();
+        let doc = Document::open(Arc::new(pdfcraft_cos::write_full(&doc, &SaveOptions::default()).unwrap())).unwrap();
+        let f = field(&fields(&doc), "clear_button").clone();
+        assert_eq!(f.widgets.iter().map(|w| w.caption.as_deref()).collect::<Vec<_>>(), [Some("Continue"), Some("Continue")]);
+        assert!(f.widgets.iter().all(|w| ap(&doc, w).contains("(Continue) Tj")));
+
+        let mut doc = original.clone();
+        apply_script_changes(
+            &mut doc,
+            &[FieldChange { name: "clear_button".into(), caption: Some("Proceed".into()), ..Default::default() }],
+            &mut NoScripts,
+        )
+        .unwrap();
+        let doc = Document::open(Arc::new(pdfcraft_cos::write_full(&doc, &SaveOptions::default()).unwrap())).unwrap();
+        let f = field(&fields(&doc), "clear_button").clone();
+        assert_eq!(f.widgets.iter().map(|w| w.caption.as_deref()).collect::<Vec<_>>(), [Some("Proceed"), Some("Proceed")]);
+        assert!(f.widgets.iter().all(|w| ap(&doc, w).contains("(Proceed) Tj")));
     }
 }
 
@@ -242,6 +325,26 @@ fn button_caption_rejects_wrong_type_and_index_before_mutation() {
     assert!(!ap(&doc, &field(&fields(&doc), "go").widgets[0]).contains(" Tj"));
 }
 
+#[test]
+fn field_wide_button_caption_rejects_a_field_without_widgets() {
+    let objs = vec![
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm 4 0 R >>".into(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 600 800] >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Annots [] >>".into(),
+        "<< /Fields [5 0 R] >>".into(),
+        "<< /FT /Btn /T (empty) /Ff 65536 /Kids [] >>".into(),
+    ];
+    let mut doc = document(&objs);
+    let all_fields = fields(&doc);
+    let button = field(&all_fields, "empty");
+    assert_eq!(button.kind, FieldKind::PushButton);
+    assert!(button.widgets.is_empty());
+    let before = pdfcraft_cos::write_full(&doc, &SaveOptions::default()).unwrap();
+    let result = set_props(&mut doc, "empty", &FieldProps { caption_all: Some("Caption".into()), ..Default::default() });
+    assert!(result.is_err());
+    assert_eq!(pdfcraft_cos::write_full(&doc, &SaveOptions::default()).unwrap(), before);
+}
+
 /// Read the drawn strings together with the appearance's actual font after saving and reopening.
 fn appearance_text(doc: &Document, w: &Widget, font_name: &[u8]) -> (Object, Vec<Vec<u8>>) {
     let widget = doc.get(w.obj);
@@ -1368,6 +1471,52 @@ fn reset_restores_defaults() {
     assert!(matches!(reset(&mut doc, Some(&["nope".to_string()])), Err(FormError::NoSuchField(_))));
 }
 
+/// Check saved values and appearances when the host stops callbacks during calculation or formatting.
+#[test]
+fn reset_redraws_remaining_widgets_after_callbacks_stop() {
+    struct StopOn {
+        event: FieldEvent,
+        stopped: bool,
+        calls: Vec<FieldEvent>,
+    }
+    impl Scripts for StopOn {
+        fn stopped(&self) -> bool {
+            self.stopped
+        }
+
+        fn run(&mut self, event: FieldEvent, _: &str, _: &Field, value: &str, _: &[Field], _: &Document) -> ScriptResult {
+            assert!(!self.stopped, "callbacks must stop after refusal");
+            self.calls.push(event);
+            self.stopped = event == self.event;
+            ScriptResult { rc: true, value: value.into(), value_set: false, changes: Vec::new(), message: None }
+        }
+    }
+
+    for stop_event in [FieldEvent::Calculate, FieldEvent::Format] {
+        let mut doc = one_page();
+        for (name, y) in [("a", 700.0), ("b", 650.0), ("total", 600.0)] {
+            add_field(&mut doc, 0, [40.0, y, 200.0, y + 30.0], &NewField::Text { multiline: false }, Some(name)).unwrap();
+        }
+        for name in ["a", "b"] {
+            set_props(&mut doc, name, &FieldProps { default_value: Some(Some("Default".into())), ..Default::default() }).unwrap();
+            set_value(&mut doc, name, &FieldValue::Text("Before".into())).unwrap();
+            set_field_script(&mut doc, name, "format", Some("event.value = event.value;")).unwrap();
+        }
+        set_field_script(&mut doc, "total", "calculate", Some("event.value = 1;")).unwrap();
+        let mut host = StopOn { event: stop_event, stopped: false, calls: Vec::new() };
+        assert_eq!(reset_with_formatting(&mut doc, Some(&["a".into(), "b".into()]), &mut host, true).unwrap(), (2, 0));
+        assert_eq!(host.calls.last(), Some(&stop_event));
+        let saved = reopen(&doc);
+        let all = fields(&saved);
+        for name in ["a", "b"] {
+            let f = field(&all, name);
+            assert_eq!(f.value, ["Default"]);
+            let drawn = ap(&saved, &f.widgets[0]);
+            assert!(drawn.contains("(Default) Tj") && !drawn.contains("(Before) Tj"), "{name}: {drawn}");
+        }
+    }
+}
+
 #[test]
 fn documents_without_forms_say_so() {
     let mut doc = Document::new_empty();
@@ -1515,6 +1664,38 @@ fn properties_rename_and_delete() {
     assert_eq!(annots.as_array().unwrap().len(), 13 - 3, "the deleted widgets left the page");
 }
 
+/// A deleted field's ancestor left with no kids stays in `/Fields` as a field of its own, with the
+/// `/V` the deleted field inherited from it: it leaves too. An ancestor a sibling still has stays.
+#[test]
+fn deleting_the_last_kid_removes_the_emptied_ancestors_and_their_values() {
+    let form = |kids: &str, annots: &str| {
+        document(&[
+            "<< /Type /Catalog /Pages 2 0 R /AcroForm 4 0 R >>".into(),
+            "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 600 800] >>".into(),
+            format!("<< /Type /Page /Parent 2 0 R /Annots [{annots}] >>"),
+            "<< /Fields [5 0 R] >>".into(),
+            "<< /FT /Tx /T (outer) /V (SECRET) /DV (SECRET) /Kids [6 0 R] >>".into(),
+            format!("<< /T (inner) /Parent 5 0 R /Kids [{kids}] >>"),
+            "<< /Type /Annot /Subtype /Widget /T (a) /Parent 6 0 R /Rect [50 700 250 720] /P 3 0 R >>".into(),
+            "<< /Type /Annot /Subtype /Widget /T (b) /Parent 6 0 R /Rect [50 650 250 670] /P 3 0 R >>".into(),
+        ])
+    };
+    let top = |doc: &Document| {
+        let af = doc.get(doc.root().unwrap()).as_dict().unwrap().get(b"AcroForm").map(|o| doc.resolve(o)).unwrap().as_dict().unwrap().clone();
+        doc.resolve(af.get(b"Fields").unwrap()).as_array().unwrap().len()
+    };
+    let mut doc = form("7 0 R", "7 0 R");
+    delete_field(&mut doc, "outer.inner.a").unwrap();
+    assert_eq!(top(&doc), 0, "the emptied ancestors left /Fields");
+    let saved = pdfcraft_cos::write_full(&doc, &SaveOptions::default()).unwrap();
+    assert!(!saved.windows(6).any(|w| w == b"SECRET"), "the inherited value is gone from a full save");
+
+    let mut doc = form("7 0 R 8 0 R", "7 0 R 8 0 R");
+    delete_field(&mut doc, "outer.inner.a").unwrap();
+    assert_eq!(top(&doc), 1, "an ancestor with a surviving kid stays");
+    assert!(fields(&doc).iter().any(|f| f.name == "outer.inner.b"));
+}
+
 /// A parent `MASTER` with kids `a` and `b` (each a field merged with its widget) and `e` (a field
 /// with two widget kids), and the top-level fields `c` and `d`.
 fn dotted_form() -> Document {
@@ -1708,7 +1889,8 @@ fn formats_validation_and_calculations_run_like_acrobat() {
 fn a_script_that_spells_the_markers_in_a_string_runs_as_a_script() {
     struct Ran;
     impl Scripts for Ran {
-        fn run(&mut self, _event: FieldEvent, _script: &str, _target: &Field, _value: &str, _fields: &[Field]) -> ScriptResult {
+        /// Synthetic script hook that returns controlled values/side effects so the calculation-chain behavior is observable.
+        fn run(&mut self, _event: FieldEvent, _script: &str, _target: &Field, _value: &str, _fields: &[Field], _doc: &Document) -> ScriptResult {
             ScriptResult { rc: true, value: "ran".into(), value_set: true, changes: Vec::new(), message: None }
         }
     }
@@ -1798,7 +1980,7 @@ fn unsupported_first_validation_call_preserves_custom_script_dispatch() {
         calls: usize,
     }
     impl Scripts for RejectingInterpreter {
-        fn run(&mut self, event: FieldEvent, script: &str, target: &Field, value: &str, _fields: &[Field]) -> ScriptResult {
+        fn run(&mut self, event: FieldEvent, script: &str, target: &Field, value: &str, _fields: &[Field], _doc: &Document) -> ScriptResult {
             assert_eq!(event, FieldEvent::Validate);
             assert_eq!(script, JS);
             assert_eq!(target.name, "amount");
@@ -3603,10 +3785,12 @@ fn check_box_redraw_keeps_down_states_it_still_draws() {
 }
 
 #[test]
+/// A calculation side effect on a checkbox is visible to following calculated fields.
 fn recalc_chain_where_script_changes_checkbox() {
     struct TestScripts;
     impl Scripts for TestScripts {
-        fn run(&mut self, _event: FieldEvent, script: &str, _target: &Field, _value: &str, fields: &[Field]) -> ScriptResult {
+        /// Synthetic script hook that returns controlled values/side effects so the calculation-chain behavior is observable.
+        fn run(&mut self, _event: FieldEvent, script: &str, _target: &Field, _value: &str, fields: &[Field], _doc: &Document) -> ScriptResult {
             if script == "set_box" {
                 ScriptResult {
                     rc: true,
@@ -3619,7 +3803,10 @@ fn recalc_chain_where_script_changes_checkbox() {
                         read_only: None,
                         required: None,
                         display: None,
-                        rect: None,
+                        caption: None,
+                        text_color: None,
+                        fill_color: None,
+                        ..Default::default()
                     }],
                     message: None,
                 }
@@ -3654,7 +3841,7 @@ fn recalc_chain_where_script_changes_checkbox() {
 fn a_calculated_combo_stores_the_export_value_of_the_option_it_names() {
     struct Pick;
     impl Scripts for Pick {
-        fn run(&mut self, _event: FieldEvent, script: &str, _target: &Field, _value: &str, _fields: &[Field]) -> ScriptResult {
+        fn run(&mut self, _event: FieldEvent, script: &str, _target: &Field, _value: &str, _fields: &[Field], _doc: &Document) -> ScriptResult {
             ScriptResult { rc: true, value: script.into(), value_set: true, changes: Vec::new(), message: None }
         }
     }
@@ -3679,7 +3866,7 @@ fn a_calculated_combo_stores_the_export_value_of_the_option_it_names() {
 fn an_export_value_wins_over_an_earlier_options_display_text() {
     struct Pick;
     impl Scripts for Pick {
-        fn run(&mut self, _event: FieldEvent, script: &str, _target: &Field, _value: &str, _fields: &[Field]) -> ScriptResult {
+        fn run(&mut self, _event: FieldEvent, script: &str, _target: &Field, _value: &str, _fields: &[Field], _doc: &Document) -> ScriptResult {
             ScriptResult { rc: true, value: script.into(), value_set: true, changes: Vec::new(), message: None }
         }
     }
@@ -3703,6 +3890,65 @@ fn an_export_value_wins_over_an_earlier_options_display_text() {
     }
 }
 
+#[test]
+fn validation_script_colour_is_used_when_the_field_redraws() {
+    struct TestScripts;
+    impl Scripts for TestScripts {
+        fn run(&mut self, _event: FieldEvent, _script: &str, _target: &Field, value: &str, _fields: &[Field], _doc: &Document) -> ScriptResult {
+            ScriptResult {
+                rc: true,
+                value: value.into(),
+                value_set: false,
+                changes: vec![FieldChange {
+                    name: "name".into(),
+                    text_color: Some(vec!["RGB".into(), "1".into(), "0".into(), "0".into()]),
+                    ..Default::default()
+                }],
+                message: None,
+            }
+        }
+    }
+
+    let mut doc = fixture();
+    set_field_script(&mut doc, "name", "validate", Some("set_red")).unwrap();
+    set_value_with(&mut doc, "name", &FieldValue::Text("Grace".into()), &mut TestScripts).unwrap();
+
+    let all = fields(&doc);
+    let f = field(&all, "name");
+    assert!(f.da.contains("1 0 0 rg"));
+    assert!(ap(&doc, &f.widgets[0]).contains("1 0 0 rg"), "redraw uses the Validate script's updated appearance");
+}
+
+#[test]
+fn calculation_script_colour_is_used_when_the_field_redraws() {
+    struct TestScripts;
+    impl Scripts for TestScripts {
+        fn run(&mut self, _event: FieldEvent, _script: &str, _target: &Field, _value: &str, _fields: &[Field], _doc: &Document) -> ScriptResult {
+            ScriptResult {
+                rc: true,
+                value: "Grace".into(),
+                value_set: true,
+                changes: vec![FieldChange {
+                    name: "name".into(),
+                    text_color: Some(vec!["RGB".into(), "1".into(), "0".into(), "0".into()]),
+                    ..Default::default()
+                }],
+                message: None,
+            }
+        }
+    }
+
+    let mut doc = fixture();
+    set_field_script(&mut doc, "name", "calculate", Some("set_red")).unwrap();
+    recalculate_with(&mut doc, &mut TestScripts).unwrap();
+
+    let all = fields(&doc);
+    let f = field(&all, "name");
+    assert_eq!(f.value, ["Grace"]);
+    assert!(f.da.contains("1 0 0 rg"));
+    assert!(ap(&doc, &f.widgets[0]).contains("1 0 0 rg"), "redraw uses the Calculate script's updated appearance");
+}
+
 #[test]
 fn partial_appearance_keeps_custom_default_appearance_and_font_resources() {
     let mut doc = fixture();
@@ -6556,6 +6802,77 @@ fn locked_button_export_edits_leave_the_document_unchanged() {
     }
 }
 
+/// A radio button that is read-only on its own (its own `/Ff`) can't be picked, and a selected one
+/// can't be switched away from, though the group as a whole is writable.
+#[test]
+fn a_read_only_radio_button_is_neither_picked_nor_left() {
+    let lock = |doc: &mut Document, num: u32| doc.update_dict(pdfcraft_cos::ObjRef::new(num, 0), |d| d.set(b"Ff".to_vec(), Object::Int(1))).unwrap();
+    let mut doc = radio_group_form();
+    lock(&mut doc, 7); // Medium
+    assert!(matches!(set_value(&mut doc, "size", &FieldValue::Radio(Some("M".into()))), Err(FormError::ReadOnly(_))));
+    set_value(&mut doc, "size", &FieldValue::Radio(Some("L".into()))).expect("an unlocked button is picked");
+    // Small (selected) locked: the group stays on it.
+    let mut doc = radio_group_form();
+    lock(&mut doc, 6);
+    assert!(matches!(set_value(&mut doc, "size", &FieldValue::Radio(Some("L".into()))), Err(FormError::ReadOnly(_))));
+    assert_eq!(field(&fields(&doc), "size").value, ["S"]);
+}
+
+/// The group's `/V` names its selection even when the button's `/AS` says nothing: a read-only
+/// button that `/V` selects is not switched away from either.
+#[test]
+fn a_read_only_radio_button_selected_by_the_group_value_is_not_left() {
+    let mut doc = radio_group_form();
+    doc.update_dict(pdfcraft_cos::ObjRef::new(6, 0), |d| {
+        d.set(b"Ff".to_vec(), Object::Int(1));
+        d.set(b"AS".to_vec(), Object::name("Off"));
+    })
+    .unwrap();
+    assert!(matches!(set_value(&mut doc, "size", &FieldValue::Radio(Some("L".into()))), Err(FormError::ReadOnly(_))));
+    assert_eq!(field(&fields(&doc), "size").value, ["S"]);
+}
+
+/// Clearing the form skips a group held by a read-only button and still clears the rest.
+#[test]
+fn clearing_the_form_goes_on_past_a_group_held_by_a_read_only_button() {
+    let mut doc = radio_group_form();
+    doc.update_dict(pdfcraft_cos::ObjRef::new(6, 0), |d| d.set(b"Ff".to_vec(), Object::Int(1))).unwrap();
+    doc.update_dict(pdfcraft_cos::ObjRef::new(9, 0), |d| d.set(b"DV".to_vec(), pdfcraft_cos::PdfString::text("Bob"))).unwrap();
+    assert_eq!(reset(&mut doc, None).unwrap(), 1);
+    let all = fields(&doc);
+    assert_eq!(field(&all, "size").value, ["S"]);
+    assert_eq!(field(&all, "name").value, ["Bob"]);
+}
+
+#[test]
+/// Cosmetic field updates skip calculations, while a value write still triggers the chain.
+fn script_cosmetic_mutations_do_not_run_the_calculation_chain() {
+    struct Counter(usize);
+    impl Scripts for Counter {
+        /// Synthetic script hook that returns controlled values/side effects so the calculation-chain behavior is observable.
+        fn run(&mut self, event: FieldEvent, _: &str, _: &Field, value: &str, _: &[Field], _: &Document) -> ScriptResult {
+            if event == FieldEvent::Calculate {
+                self.0 += 1;
+            }
+            ScriptResult { rc: true, value: value.into(), value_set: false, changes: Vec::new(), message: None }
+        }
+    }
+    let mut doc = one_page();
+    add_field(&mut doc, 0, [40.0, 700.0, 200.0, 730.0], &NewField::Text { multiline: false }, Some("input")).unwrap();
+    add_field(&mut doc, 0, [40.0, 650.0, 200.0, 680.0], &NewField::Text { multiline: false }, Some("total")).unwrap();
+    set_field_script(&mut doc, "total", "calculate", Some("event.value = 1;")).unwrap();
+    let mut count = Counter(0);
+    apply_script_changes(
+        &mut doc,
+        &[FieldChange { name: "input".into(), fill_color: Some(vec!["RGB".into(), "1".into(), "0".into(), "0".into()]), ..Default::default() }],
+        &mut count,
+    )
+    .unwrap();
+    assert_eq!(count.0, 0, "a visual change must not evaluate the whole form");
+    apply_script_changes(&mut doc, &[FieldChange { name: "input".into(), value: Some(vec!["2".into()]), ..Default::default() }], &mut count).unwrap();
+    assert!(count.0 > 0, "value changes still calculate dependent fields");
+}
+
 /// Three radio groups whose buttons have the on states given (`S`, `M` … or a repeated `Yes`):
 /// `free` (Radio), `plain` (Radio | NoToggleToOff) and `unison` (… | RadiosInUnison).
 fn radio_groups() -> Document {
@@ -6662,6 +6979,26 @@ fn radio_buttons_without_as_sharing_the_value_show_one_on() {
     assert_eq!(on_widgets(&doc, "r").0, [false, true, false]);
 }
 
+/// Two buttons share the on state `Yes`; the first is on by its `/AS` and the second is read-only
+/// and off. `/V` is `Yes` for both, but only the first is selected: picking another option switches
+/// the first off, which is allowed, and the read-only one never changes.
+#[test]
+fn a_read_only_button_sharing_the_on_state_of_the_selected_one_does_not_block() {
+    let mut doc = radio_without_as(49152, "/Ff 1 /AS /Off");
+    doc.update_dict(pdfcraft_cos::ObjRef::new(6, 0), |d| d.set(b"AS".to_vec(), Object::name("Yes"))).unwrap();
+    set_value(&mut doc, "r", &FieldValue::Radio(Some("No".into()))).expect("the writable selected button may be switched off");
+    assert_eq!(on_widgets(&doc, "r").0, [false, false, true]);
+}
+
+/// Selecting another button through `FieldValue::Widget` can't switch a read-only selected one off.
+#[test]
+fn a_read_only_selected_radio_button_is_not_left_by_picking_a_widget() {
+    let mut doc = radio_group_form();
+    doc.update_dict(pdfcraft_cos::ObjRef::new(6, 0), |d| d.set(b"Ff".to_vec(), Object::Int(1))).unwrap();
+    assert!(matches!(set_value(&mut doc, "size", &FieldValue::Widget(2)), Err(FormError::ReadOnly(_))));
+    assert_eq!(field(&fields(&doc), "size").value, ["S"]);
+}
+
 /// Table 227, ReadOnly: a processor "shall not allow a user to change the value". A button whose own
 /// dictionary sets it can't be turned on by number.
 #[test]
@@ -7056,3 +7393,21 @@ fn a_four_entry_mk_colour_with_a_null_is_cmyk_with_zero() {
     let rgb = off(&mut doc, "rgb");
     assert!(rgb.contains("0 0 1 rg") && rgb.contains("1 0 0 RG"), "three numbers stay RGB: {rgb}");
 }
+
+/// A Simple calculation counts the first value of a multiple-selection list, as `main` always
+/// has, so the native total and `AFSimple_Calculate` in a script agree.
+#[test]
+fn simple_calculation_counts_the_first_value_of_a_multiple_selection_list() {
+    let objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm 4 0 R >>".into(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 600 800] >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Annots [5 0 R 6 0 R] >>".into(),
+        "<< /Fields [5 0 R 6 0 R] /CO [6 0 R] /DA (/Helv 0 Tf 0 g) >>".into(),
+        "<< /Type /Annot /Subtype /Widget /FT /Ch /Ff 2097152 /T (picks) /Opt [(4) (6)] /V [(4) (6)] /Rect [50 700 250 760] /P 3 0 R >>".into(),
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (total) /Rect [50 640 250 660] /P 3 0 R /AA << /C << /S /JavaScript /JS (AFSimple_Calculate\\(\"SUM\", new Array\\(\"picks\"\\)\\);) >> >> >>".into(),
+    ];
+    let mut doc = document(&objs);
+    assert_eq!(field(&fields(&doc), "picks").value, ["4", "6"]);
+    recalculate(&mut doc).unwrap();
+    assert_eq!(field(&fields(&doc), "total").value, ["4"]);
+}
diff --git a/crates/forms/src/values.rs b/crates/forms/src/values.rs
index b1d50a87ae..b60d8aa140 100644
--- a/crates/forms/src/values.rs
+++ b/crates/forms/src/values.rs
@@ -203,6 +203,15 @@ pub fn recalculate(doc: &mut Document) -> Result<usize, FormError> {
 
 /// [`recalculate`], running custom Calculate (and Format) scripts through `scripts`.
 pub fn recalculate_with(doc: &mut Document, scripts: &mut dyn Scripts) -> Result<usize, FormError> {
+    recalculate_values(doc, scripts, None)
+}
+
+/// Evaluate fields in calculation order. When a redraw set is supplied, record changed fields for formatting after the pass.
+fn recalculate_values(
+    doc: &mut Document,
+    scripts: &mut dyn Scripts,
+    mut deferred: Option<&mut std::collections::HashSet<ObjRef>>,
+) -> Result<usize, FormError> {
     let mut all = fields(doc);
     if !all.iter().any(calc_order::is_calculated) {
         return Ok(0);
@@ -211,6 +220,9 @@ pub fn recalculate_with(doc: &mut Document, scripts: &mut dyn Scripts) -> Result
     let order: Vec<ObjRef> = calc_order::run_order(doc, &all).0.into_iter().filter_map(|(i, _)| all.get(i)).map(|f| f.obj).collect();
     let mut changed = 0;
     for obj in order {
+        if scripts.stopped() {
+            break;
+        }
         let Some(f) = all.iter().find(|f| f.obj == obj).cloned() else { continue };
         let lookup = |n: &str| -> Vec<String> {
             let prefix = format!("{n}.");
@@ -218,13 +230,18 @@ pub fn recalculate_with(doc: &mut Document, scripts: &mut dyn Scripts) -> Result
         };
         let current = f.value.first().cloned().unwrap_or_default();
         let v = if let Some(js) = &f.actions.scripts.calculate {
-            let r = scripts.run(FieldEvent::Calculate, js, &f, &current, &all);
+            let r = scripts.run(FieldEvent::Calculate, js, &f, &current, &all, doc);
             // A script may set its own field through the field object (`getField("Total").value
             // = …`) rather than through `event.value`. `apply_changes` leaves the event's own
             // field to the event, so that value is the result unless the script also assigned
             // `event.value`, even the value it already had.
-            let own = r.changes.iter().find(|c| c.name == f.name).and_then(|c| c.value.as_ref()).map(|v| v.first().cloned().unwrap_or_default());
-            scripting::apply_changes(doc, &r.changes, &f.name, scripts)?;
+            let own = r
+                .changes
+                .iter()
+                .find(|c| c.name == f.name && c.object.is_none_or(|obj| obj == f.obj))
+                .and_then(|c| c.value.as_ref())
+                .map(|v| v.first().cloned().unwrap_or_default());
+            scripting::apply_changes(doc, &r.changes, &f.name, Some(f.obj), scripts)?;
             if !r.changes.is_empty() {
                 all = fields(doc);
             }
@@ -262,7 +279,12 @@ pub fn recalculate_with(doc: &mut Document, scripts: &mut dyn Scripts) -> Result
                     _ => {}
                 }
             })?;
-            redraw(doc, &f, std::slice::from_ref(&v), scripts)?;
+            if let Some(pending) = deferred.as_deref_mut() {
+                pending.insert(obj);
+            } else {
+                let current = all.iter().find(|field| field.obj == obj).unwrap_or(&f);
+                redraw(doc, current, std::slice::from_ref(&v), scripts)?;
+            }
             if let Some(target) = all.iter_mut().find(|x| x.obj == obj) {
                 target.value = vec![v];
             }
@@ -290,6 +312,11 @@ pub fn calculations_changed(before: &[Field], after: &[Field]) -> Vec<String> {
 }
 
 pub(crate) fn write_value(doc: &mut Document, f: &Field, value: &FieldValue, scripts: &mut dyn Scripts) -> Result<(), FormError> {
+    write_value_impl(doc, f, value, scripts, false)
+}
+
+/// Persist a value according to the field kind. A reset bypasses custom input validation and defers text and choice appearances.
+fn write_value_impl(doc: &mut Document, f: &Field, value: &FieldValue, scripts: &mut dyn Scripts, resetting: bool) -> Result<(), FormError> {
     match (f.kind, value) {
         (FieldKind::Text, FieldValue::Text(t)) => {
             if let Some(max) = f.max_len
@@ -305,17 +332,21 @@ pub(crate) fn write_value(doc: &mut Document, f: &Field, value: &FieldValue, scr
             // Keystroke (on commit) and Validate, as Acrobat runs them before accepting a value.
             let t = &f.actions.keystroke(&f.name, t).map_err(FormError::Format)?;
             af::validate(&f.actions.validate, t).map_err(FormError::Invalid)?;
-            let t = &scripting::accept(doc, f, t, scripts)?;
+            let (t, refresh_field) = if resetting { (t.clone(), false) } else { scripting::accept(doc, f, t, scripts)? };
             let shadow = t.is_empty() && crate::author::ancestor_sets(doc, f.obj, b"V");
             doc.update_dict(f.obj, |d| {
                 if t.is_empty() && !shadow {
                     d.remove(b"V");
                 } else {
-                    d.set(b"V".to_vec(), PdfString::text(t));
+                    d.set(b"V".to_vec(), PdfString::text(&t));
                 }
                 d.remove(b"RV");
             })?;
-            redraw(doc, f, std::slice::from_ref(t), scripts)
+            if resetting {
+                return Ok(());
+            }
+            let current = refresh_field.then(|| fields(doc).into_iter().find(|current| current.obj == f.obj)).flatten();
+            redraw(doc, current.as_ref().unwrap_or(f), std::slice::from_ref(&t), scripts)
         }
         (FieldKind::CheckBox | FieldKind::Radio, FieldValue::Widget(i)) => {
             // A button can be read-only on its own (its own `/Ff`), though the field isn't.
@@ -325,6 +356,9 @@ pub(crate) fn write_value(doc: &mut Document, f: &Field, value: &FieldValue, scr
             let Some(state) = f.widgets.get(*i).and_then(|w| w.on_state.clone()) else {
                 return invalid(format!("{:?} has no button {} with an on state", f.name, i.saturating_add(1)));
             };
+            if f.kind == FieldKind::Radio && radio_change_blocked(f, Some(&state), Some(*i)) {
+                return Err(FormError::ReadOnly(f.name.clone()));
+            }
             set_states(doc, f, Some(&state), Some(*i))
         }
         (FieldKind::CheckBox, v) => {
@@ -375,6 +409,9 @@ pub(crate) fn write_value(doc: &mut Document, f: &Field, value: &FieldValue, scr
             if choice.is_none() && f.has(flags::NO_TOGGLE_TO_OFF) && !f.value.is_empty() {
                 return invalid(format!("{:?} must keep one option selected", f.name));
             }
+            if radio_change_blocked(f, choice.as_deref(), None) {
+                return Err(FormError::ReadOnly(f.name.clone()));
+            }
             set_states(doc, f, choice.as_deref(), None)
         }
         (FieldKind::Combo | FieldKind::List, FieldValue::Choice(_) | FieldValue::Text(_) | FieldValue::ChoiceIndices(_)) => {
@@ -462,6 +499,9 @@ pub(crate) fn write_value(doc: &mut Document, f: &Field, value: &FieldValue, scr
                 }
             })?;
             scroll_widgets(doc, f, &picked, f.options.len())?;
+            if resetting {
+                return Ok(());
+            }
             let mut shown = f.clone();
             shown.value = exports.clone();
             shown.selected = picked;
@@ -507,17 +547,49 @@ pub(crate) fn scroll_widgets(doc: &mut Document, f: &Field, picked: &[usize], co
     Ok(())
 }
 
+/// The one widget of an exclusive radio group that turns on when `on` is chosen (`pick` when it has
+/// that state, else the one already on, else the first); `None` when `on` is `None` or the group
+/// turns every widget with that state on together.
+fn chosen_widget(f: &Field, on: Option<&str>, pick: Option<usize>) -> Option<usize> {
+    let exclusive = f.kind == FieldKind::Radio && !f.has(flags::RADIOS_IN_UNISON);
+    on.filter(|_| exclusive).and_then(|c| {
+        let has = |i: &usize| f.widgets.get(*i).is_some_and(|w| w.on_state.as_deref() == Some(c));
+        let n = f.widgets.len();
+        pick.filter(has).or_else(|| (0..n).filter(has).find(|&i| f.widget_on(i))).or_else(|| (0..n).find(has))
+    })
+}
+
+/// Whether setting a radio group to `on` (through widget `pick`, when the caller chose a widget)
+/// would turn a read-only button on or off: such a button can't be picked, and a selected one can't
+/// be switched off by picking another. Judged per widget, by the state `set_states` would give it,
+/// so buttons sharing an on-state name are told apart by their `/AS`; the group's `/V` stands for
+/// the selection only when no button's `/AS` says which is on.
+fn radio_change_blocked(f: &Field, on: Option<&str>, pick: Option<usize>) -> bool {
+    let chosen = chosen_widget(f, on, pick);
+    let before = |i: usize, w: &Widget| {
+        let Some(s) = w.on_state.as_deref() else { return false };
+        if f.widget_on(i) {
+            return true;
+        }
+        // No button sharing this on state is on by its `/AS` and the group's `/V` names it: the
+        // first of them holds the selection, whatever its own `/AS` says (an `Off` among them).
+        let sharing = |x: &Widget| x.on_state.as_deref() == Some(s);
+        f.value.first().map(String::as_str) == Some(s)
+            && !f.widgets.iter().any(|x| sharing(x) && x.state.as_deref() == Some(s))
+            && f.widgets.iter().position(sharing) == Some(i)
+    };
+    f.widgets.iter().enumerate().any(|(i, w)| {
+        let after = on.is_some() && w.on_state.as_deref() == on && chosen.is_none_or(|k| k == i);
+        w.read_only && before(i, w) != after
+    })
+}
+
 /// Check boxes and radio buttons: `/V` on the field, `/AS` on each widget. The widgets whose on
 /// state is `on` turn on together in a check box (ISO 32000-2 §12.7.5.2.3, EXAMPLE 2) and in a
 /// radio group with RadiosInUnison. Without it, at most one radio button is on (Table 229,
 /// §12.7.5.2.3): widget `pick` when it has that state, else the one already on, else the first.
 fn set_states(doc: &mut Document, f: &Field, on: Option<&str>, pick: Option<usize>) -> Result<(), FormError> {
-    let exclusive = f.kind == FieldKind::Radio && !f.has(flags::RADIOS_IN_UNISON);
-    let chosen = on.filter(|_| exclusive).and_then(|c| {
-        let has = |i: &usize| f.widgets.get(*i).is_some_and(|w| w.on_state.as_deref() == Some(c));
-        let n = f.widgets.len();
-        pick.filter(has).or_else(|| (0..n).filter(has).find(|&i| f.widget_on(i))).or_else(|| (0..n).find(has))
-    });
+    let chosen = chosen_widget(f, on, pick);
     // `/V` names the on state, the same for every widget that has it: which of them is on is
     // their `/AS` alone (§12.7.5.2.4).
     let v = on.unwrap_or("Off");
@@ -824,8 +896,35 @@ fn unread_stream(doc: &Document, field: ObjRef, key: &[u8]) -> bool {
     false
 }
 
+/// Whether this snapshot contains a known default, including a genuinely absent /DV.
+/// An unread nonempty default stream is unknown, not an instruction to clear the field.
+/// Reuse this policy when exposing reset defaults to other execution layers.
+pub fn default_value_known(doc: &Document, field: &Field) -> bool {
+    !field.default.is_empty() || !unread_stream(doc, field.obj, b"DV")
+}
+
 /// Acrobat's Clear form: every field (or the named ones) back to its default value.
 pub fn reset(doc: &mut Document, names: Option<&[String]>) -> Result<usize, FormError> {
+    reset_with_counts(doc, names).map(|(reset, _)| reset)
+}
+
+/// Restore defaults and report direct resets and dependent calculation writes separately.
+pub fn reset_with_counts(doc: &mut Document, names: Option<&[String]>) -> Result<(usize, usize), FormError> {
+    reset_with_scripts(doc, names, &mut NoScripts)
+}
+
+/// Restore defaults and then run the active calculation callbacks once.
+pub fn reset_with_scripts(doc: &mut Document, names: Option<&[String]>, scripts: &mut dyn Scripts) -> Result<(usize, usize), FormError> {
+    reset_with_formatting(doc, names, scripts, true)
+}
+
+/// Restore defaults with their script formatting, optionally deferring custom calculations.
+pub fn reset_with_formatting(
+    doc: &mut Document,
+    names: Option<&[String]>,
+    scripts: &mut dyn Scripts,
+    calculate_with_scripts: bool,
+) -> Result<(usize, usize), FormError> {
     let all = fields(doc);
     if all.is_empty() {
         return Err(FormError::NoForm);
@@ -839,12 +938,13 @@ pub fn reset(doc: &mut Document, names: Option<&[String]>) -> Result<usize, Form
     }
     let named: Option<std::collections::HashSet<&str>> = names.map(|n| n.iter().map(String::as_str).collect());
     let mut changed = 0;
+    let mut redraw_fields = std::collections::HashSet::new();
     for f in all.iter().filter(|f| named.as_ref().is_none_or(|n| n.contains(f.name.as_str()))) {
         // A default the reading didn't decode (its budget spent) is unknown, not empty: clearing
         // the field to nothing would lose the value it should go back to. A value it didn't decode
         // isn't known to be the default, so it is reset.
         let unread = |key: &[u8], read: &[String]| read.is_empty() && unread_stream(doc, f.obj, key);
-        if unread(b"DV", &f.default) || (f.value == f.default && !unread(b"V", &f.value)) {
+        if !default_value_known(doc, f) || (f.value == f.default && !unread(b"V", &f.value)) {
             continue;
         }
         let v = match f.kind {
@@ -857,11 +957,33 @@ pub fn reset(doc: &mut Document, names: Option<&[String]>) -> Result<usize, Form
         // A reset is not blocked by NoToggleToOff: go through the writer directly.
         let mut tmp = f.clone();
         tmp.flags &= !flags::NO_TOGGLE_TO_OFF;
-        write_value(doc, &tmp, &v, &mut NoScripts)?;
-        changed += 1;
+        match write_value_impl(doc, &tmp, &v, scripts, true) {
+            Ok(()) => {
+                changed += 1;
+                if matches!(f.kind, FieldKind::Text | FieldKind::Combo | FieldKind::List) {
+                    redraw_fields.insert(f.obj);
+                }
+            }
+            // a read-only button of the group holds the value: this field is left as it is, and the
+            // rest of the form is still cleared
+            Err(FormError::ReadOnly(_)) => {}
+            Err(e) => return Err(e),
+        }
     }
-    recalculate(doc)?;
-    Ok(changed)
+    let calculation_runner: &mut dyn Scripts = if calculate_with_scripts { scripts } else { &mut NoScripts };
+    let recalculated = recalculate_values(doc, calculation_runner, Some(&mut redraw_fields))?;
+    // Format scripts can read other fields. Draw from the final values once all
+    // selected defaults and calculated values have been written.
+    if !redraw_fields.is_empty() {
+        let mut no_scripts = NoScripts;
+        for f in fields(doc).into_iter().filter(|f| redraw_fields.contains(&f.obj)) {
+            // A host may stop callbacks and still commit the reset. Its widgets must
+            // continue to reflect the saved values.
+            let formatting: &mut dyn Scripts = if scripts.stopped() { &mut no_scripts } else { scripts };
+            redraw(doc, &f, &f.value, formatting)?;
+        }
+    }
+    Ok((changed, recalculated))
 }
 
 /// Marks option `i` picked; false when it already was, or there is no such option.
diff --git a/crates/js/src/document.rs b/crates/js/src/document.rs
index 54274bb140..cccf89a7a2 100644
--- a/crates/js/src/document.rs
+++ b/crates/js/src/document.rs
@@ -1,10 +1,12 @@
-use super::host::{arg, colour, error, function, host, read, s, set_value, strings, text, value_of, write};
+use super::host::{
+    FieldKey, arg, charge, colour, error, function, host, kind_of, read, s, strings, text, text_bytes, text_line, value_for, value_of, write,
+};
 use super::model::{DISPLAY_HIDDEN, DISPLAY_VISIBLE, FieldType, Request};
 use super::{Attribute, Context, JsArray, JsObject, JsResult, JsString, JsValue, NativeFunction, ObjectInitializer, js_string};
 
 macro_rules! getter {
     ($ctx:expr, $name:expr, |$f:ident, $c:ident| $body:expr) => {{
-        fn get(_: &JsValue, _: &[JsValue], name: &JsString, $c: &mut Context) -> JsResult<JsValue> {
+        fn get(_: &JsValue, _: &[JsValue], name: &FieldKey, $c: &mut Context) -> JsResult<JsValue> {
             let $f = read($c, name)?;
             Ok($body)
         }
@@ -12,13 +14,38 @@ macro_rules! getter {
     }};
 }
 
+/// Resolve public name lookups to their first matching object, preserving ordinary getField behavior.
 pub(crate) fn field_object(ctx: &mut Context, name: &str) -> JsObject {
-    let n = JsString::from(name);
+    let id = host(ctx).ok().and_then(|h| h.borrow().fields.iter().find(|f| f.name == name).and_then(|f| f.object_id));
+    field_object_by_id(ctx, name, id)
+}
+/// Cache by object identity as well as name so duplicate-named targets remain distinct.
+pub(crate) fn field_object_by_id(ctx: &mut Context, name: &str, id: Option<u64>) -> JsObject {
+    let token = host(ctx)
+        .ok()
+        .and_then(|h| h.borrow().fields.iter().find(|f| f.object_id == id && (id.is_some() || f.name == name)).map(|f| f.instance_id))
+        .unwrap_or(0);
+    let key = crate::host::field_cache_key(name, id, token);
+    if let Some(object) = host(ctx).ok().and_then(|h| h.borrow().objects.get(&key).cloned()) {
+        return object;
+    }
+    let object = field_object_new(ctx, name, id, token);
+    if let Ok(h) = host(ctx)
+        && h.borrow().field_keys.contains(&key)
+    {
+        h.borrow_mut().objects.insert(key, object.clone());
+    }
+    object
+}
+/// Construct live accessors whose identity survives host snapshot refreshes.
+fn field_object_new(ctx: &mut Context, name: &str, id: Option<u64>, token: u64) -> JsObject {
+    let n = (JsString::from(name), id, token);
     let value_get = getter!(ctx, n, |f, c| value_of(&f, c));
     let value_set = {
-        fn set(_: &JsValue, args: &[JsValue], name: &JsString, c: &mut Context) -> JsResult<JsValue> {
-            let vals = strings(&arg(args, 0), c)?;
-            write(c, name, |f| set_value(f, vals))?;
+        fn set(_: &JsValue, args: &[JsValue], name: &FieldKey, c: &mut Context) -> JsResult<JsValue> {
+            let vals = value_for(kind_of(c, name)?, strings(&arg(args, 0), c)?);
+            charge(c, name, |f| text_bytes(&f.value), text_bytes(&vals))?;
+            write(c, name, |f| f.value = vals)?;
             Ok(JsValue::undefined())
         }
         function(ctx, NativeFunction::from_copy_closure_with_captures(set, n.clone()))
@@ -32,7 +59,7 @@ pub(crate) fn field_object(ctx: &mut Context, name: &str) -> JsObject {
     let fname = getter!(ctx, n, |f, _c| s(&f.name));
     let readonly_get = getter!(ctx, n, |f, _c| JsValue::from(f.readonly));
     let readonly_set = {
-        fn set(_: &JsValue, args: &[JsValue], name: &JsString, c: &mut Context) -> JsResult<JsValue> {
+        fn set(_: &JsValue, args: &[JsValue], name: &FieldKey, c: &mut Context) -> JsResult<JsValue> {
             let on = arg(args, 0).to_boolean();
             write(c, name, |f| f.readonly = on)?;
             Ok(JsValue::undefined())
@@ -41,7 +68,7 @@ pub(crate) fn field_object(ctx: &mut Context, name: &str) -> JsObject {
     };
     let required_get = getter!(ctx, n, |f, _c| JsValue::from(f.required));
     let required_set = {
-        fn set(_: &JsValue, args: &[JsValue], name: &JsString, c: &mut Context) -> JsResult<JsValue> {
+        fn set(_: &JsValue, args: &[JsValue], name: &FieldKey, c: &mut Context) -> JsResult<JsValue> {
             let on = arg(args, 0).to_boolean();
             write(c, name, |f| f.required = on)?;
             Ok(JsValue::undefined())
@@ -50,7 +77,7 @@ pub(crate) fn field_object(ctx: &mut Context, name: &str) -> JsObject {
     };
     let display_get = getter!(ctx, n, |f, _c| JsValue::from(f.display));
     let display_set = {
-        fn set(_: &JsValue, args: &[JsValue], name: &JsString, c: &mut Context) -> JsResult<JsValue> {
+        fn set(_: &JsValue, args: &[JsValue], name: &FieldKey, c: &mut Context) -> JsResult<JsValue> {
             let d = arg(args, 0).to_number(c)? as i32;
             write(c, name, |f| f.display = d.clamp(0, 3))?;
             Ok(JsValue::undefined())
@@ -59,7 +86,7 @@ pub(crate) fn field_object(ctx: &mut Context, name: &str) -> JsObject {
     };
     let hidden_get = getter!(ctx, n, |f, _c| JsValue::from(f.display == DISPLAY_HIDDEN));
     let hidden_set = {
-        fn set(_: &JsValue, args: &[JsValue], name: &JsString, c: &mut Context) -> JsResult<JsValue> {
+        fn set(_: &JsValue, args: &[JsValue], name: &FieldKey, c: &mut Context) -> JsResult<JsValue> {
             let on = arg(args, 0).to_boolean();
             write(c, name, |f| f.display = if on { DISPLAY_HIDDEN } else { DISPLAY_VISIBLE })?;
             Ok(JsValue::undefined())
@@ -76,56 +103,149 @@ pub(crate) fn field_object(ctx: &mut Context, name: &str) -> JsObject {
         let idx: Vec<JsValue> = f.options.iter().enumerate().filter(|(_, o)| f.value.contains(&o.0)).map(|(i, _)| JsValue::from(i as f64)).collect();
         if idx.len() == 1 { idx[0].clone() } else { JsArray::from_iter(idx, c).into() }
     });
-    let text_color_get = getter!(ctx, n, |f, c| colour(&f.text_color, c));
+    let text_color_get = getter!(ctx, n, |f, c| colour(f.text_color.as_deref(), c));
     let text_color_set = {
-        fn set(_: &JsValue, args: &[JsValue], name: &JsString, c: &mut Context) -> JsResult<JsValue> {
+        fn set(_: &JsValue, args: &[JsValue], name: &FieldKey, c: &mut Context) -> JsResult<JsValue> {
             let v = strings(&arg(args, 0), c)?;
-            write(c, name, |f| f.text_color = Some(v))?;
+            charge(c, name, |f| f.text_color.as_deref().map_or(0, text_bytes), text_bytes(&v))?;
+            write(c, name, |f| f.text_color = Some(v.into()))?;
             Ok(JsValue::undefined())
         }
         function(ctx, NativeFunction::from_copy_closure_with_captures(set, n.clone()))
     };
-    let fill_color_get = getter!(ctx, n, |f, c| colour(&f.fill_color, c));
+    let fill_color_get = getter!(ctx, n, |f, c| colour(f.fill_color.as_deref(), c));
     let fill_color_set = {
-        fn set(_: &JsValue, args: &[JsValue], name: &JsString, c: &mut Context) -> JsResult<JsValue> {
+        fn set(_: &JsValue, args: &[JsValue], name: &FieldKey, c: &mut Context) -> JsResult<JsValue> {
             let v = strings(&arg(args, 0), c)?;
-            write(c, name, |f| f.fill_color = Some(v))?;
+            charge(c, name, |f| f.fill_color.as_deref().map_or(0, text_bytes), text_bytes(&v))?;
+            write(c, name, |f| f.fill_color = Some(v.into()))?;
             Ok(JsValue::undefined())
         }
         function(ctx, NativeFunction::from_copy_closure_with_captures(set, n.clone()))
     };
-    let rect_get = getter!(ctx, n, |f, c| match f.rect {
-        Some(rect) => JsArray::from_iter(rect.into_iter().map(JsValue::from).collect::<Vec<_>>(), c).into(),
-        None => JsValue::null(),
-    });
+    let text_size_get = getter!(ctx, n, |f, c| JsValue::from(f.text_size));
+    let text_size_set = {
+        /// Validate a finite text size in 0..=300 points before staging the field appearance change.
+        fn set(_: &JsValue, args: &[JsValue], name: &FieldKey, c: &mut Context) -> JsResult<JsValue> {
+            let v = arg(args, 0).to_number(c)?;
+            if !v.is_finite() || !(0.0..=300.0).contains(&v) {
+                return Err(error("textSize must be between 0 and 300"));
+            }
+            write(c, name, |f| f.text_size = v)?;
+            Ok(JsValue::undefined())
+        }
+        function(ctx, NativeFunction::from_copy_closure_with_captures(set, n.clone()))
+    };
+    let line_width_get = getter!(ctx, n, |f, c| JsValue::from(f.line_width));
+    let line_width_set = {
+        /// Validate a finite border width in 0..=12 points before staging the appearance change.
+        fn set(_: &JsValue, args: &[JsValue], name: &FieldKey, c: &mut Context) -> JsResult<JsValue> {
+            let v = arg(args, 0).to_number(c)?;
+            if !v.is_finite() || !(0.0..=12.0).contains(&v) {
+                return Err(error("lineWidth must be between 0 and 12"));
+            }
+            write(c, name, |f| f.line_width = v)?;
+            Ok(JsValue::undefined())
+        }
+        function(ctx, NativeFunction::from_copy_closure_with_captures(set, n.clone()))
+    };
+    let border_style_get = getter!(ctx, n, |f, c| s(&f.border_style));
+    let border_style_set = {
+        /// Accept only supported border styles and stage the validated value for PDF writeback.
+        fn set(_: &JsValue, args: &[JsValue], name: &FieldKey, c: &mut Context) -> JsResult<JsValue> {
+            let v = text(&arg(args, 0), c)?;
+            if !["solid", "dashed", "beveled", "inset", "underline"].contains(&v.as_str()) {
+                return Err(error("unsupported borderStyle"));
+            }
+            write(c, name, |f| f.border_style = v)?;
+            Ok(JsValue::undefined())
+        }
+        function(ctx, NativeFunction::from_copy_closure_with_captures(set, n.clone()))
+    };
+    let user_name_get = getter!(ctx, n, |f, c| s(&f.user_name));
+    let user_name_set = {
+        /// Bound the tooltip string to 4,096 bytes before staging the field user name.
+        fn set(_: &JsValue, args: &[JsValue], name: &FieldKey, c: &mut Context) -> JsResult<JsValue> {
+            let v = text(&arg(args, 0), c)?;
+            if v.len() > 4096 {
+                return Err(error("userName is too long"));
+            }
+            write(c, name, |f| f.user_name = v)?;
+            Ok(JsValue::undefined())
+        }
+        function(ctx, NativeFunction::from_copy_closure_with_captures(set, n.clone()))
+    };
+    let stroke_color_get = getter!(ctx, n, |f, c| colour(f.stroke_color.as_deref(), c));
+    let stroke_color_set = {
+        /// Read the bounded stroke-colour array for validation at the form writeback boundary.
+        fn set(_: &JsValue, args: &[JsValue], name: &FieldKey, c: &mut Context) -> JsResult<JsValue> {
+            let colour = strings(&arg(args, 0), c)?;
+            write(c, name, |f| f.stroke_color = Some(colour.into()))?;
+            Ok(JsValue::undefined())
+        }
+        function(ctx, NativeFunction::from_copy_closure_with_captures(set, n.clone()))
+    };
+    let rect_get = getter!(ctx, n, |f, c| f.rect.map_or_else(JsValue::undefined, |r| JsArray::from_iter(r.map(JsValue::from), c).into()));
     let rect_set = {
-        fn set(_: &JsValue, args: &[JsValue], name: &JsString, c: &mut Context) -> JsResult<JsValue> {
-            let value = arg(args, 0);
-            let object = value.as_object().filter(|o| o.is_array()).ok_or_else(|| error("rect must be an array of four finite numbers"))?;
-            let array = JsArray::from_object(object.clone())?;
-            if array.length(c)? != 4 {
-                return Err(error("rect must be an array of four finite numbers"));
+        /// Validate finite ordered rectangle coordinates while permitting zero-sized script overlays.
+        fn set(_: &JsValue, args: &[JsValue], name: &FieldKey, c: &mut Context) -> JsResult<JsValue> {
+            let a = arg(args, 0).as_object().ok_or_else(|| error("rect needs an array"))?;
+            let a = JsArray::from_object(a)?;
+            if a.length(c)? != 4 {
+                return Err(error("rect needs four coordinates"));
             }
-            let mut rect = [0.0; 4];
-            for (i, coordinate) in rect.iter_mut().enumerate() {
-                *coordinate = array.get(i as u64, c)?.to_number(c)?;
+            let mut coords = [0.0; 4];
+            for (i, v) in coords.iter_mut().enumerate() {
+                *v = a.get(i as u32, c)?.to_number(c)?;
+                if !v.is_finite() || v.abs() > 1e7 {
+                    return Err(error("rect coordinates are out of range"));
+                }
             }
-            if !rect.iter().all(|coordinate| coordinate.is_finite()) {
-                return Err(error("rect coordinates must be finite"));
+            if coords[2] < coords[0] || coords[1] < coords[3] {
+                return Err(error("rect must use left, top, right, bottom order"));
             }
-            let width = (rect[2] - rect[0]).abs();
-            let height = (rect[3] - rect[1]).abs();
-            if !width.is_finite() || !height.is_finite() || width < 4.0 || height < 4.0 {
-                return Err(error("rect must be at least 4 points wide and high"));
-            }
-            let rect = [rect[0].min(rect[2]), rect[1].min(rect[3]), rect[0].max(rect[2]), rect[1].max(rect[3])];
-            write(c, name, |f| f.rect = Some(rect))?;
+            let v = Some(coords);
+            write(c, name, |f| f.rect = v)?;
             Ok(JsValue::undefined())
         }
         function(ctx, NativeFunction::from_copy_closure_with_captures(set, n.clone()))
     };
 
-    fn get_item_at(_: &JsValue, args: &[JsValue], name: &JsString, c: &mut Context) -> JsResult<JsValue> {
+    /// Read the normal caption of the first button widget and refuse unsupported caption faces.
+    fn button_get_caption(_: &JsValue, args: &[JsValue], name: &FieldKey, c: &mut Context) -> JsResult<JsValue> {
+        let f = read(c, name)?;
+        if f.kind != FieldType::Button {
+            return Err(error(format!("{} is not a push button", f.name)));
+        }
+        let face = if args.is_empty() { 0.0 } else { arg(args, 0).to_number(c)? };
+        if !face.is_finite() || face != 0.0 {
+            return Err(error("only the normal button face (0) is supported"));
+        }
+        Ok(s(f.caption.as_deref().unwrap_or("")))
+    }
+    /// Record a normal-caption setter even when widget zero already matches, allowing all-widget writeback.
+    fn button_set_caption(_: &JsValue, args: &[JsValue], name: &FieldKey, c: &mut Context) -> JsResult<JsValue> {
+        let f = read(c, name)?;
+        if f.kind != FieldType::Button {
+            return Err(error("buttonSetCaption is only available on push buttons"));
+        }
+        let caption_arg = args.first().ok_or_else(|| error("buttonSetCaption requires a caption argument"))?;
+        let caption = text_line(caption_arg, c)?;
+        let face = if args.get(1).is_none() { 0.0 } else { arg(args, 1).to_number(c)? };
+        if !face.is_finite() || face != 0.0 {
+            return Err(error("only the normal button face (0) is supported"));
+        }
+        if host(c)?.borrow().event_name == "Format" {
+            return Err(error("buttonSetCaption is not available in a Format event"));
+        }
+        write(c, name, |f| {
+            f.caption = Some(caption);
+            f.caption_written = true;
+        })?;
+        Ok(JsValue::undefined())
+    }
+
+    fn get_item_at(_: &JsValue, args: &[JsValue], name: &FieldKey, c: &mut Context) -> JsResult<JsValue> {
         let f = read(c, name)?;
         let i = arg(args, 0).to_number(c)?;
         // bExportValue defaults to true.
@@ -134,13 +254,13 @@ pub(crate) fn field_object(ctx: &mut Context, name: &str) -> JsObject {
         let o = f.options.get(i).ok_or_else(|| error(format!("{} has no item {i}", f.name)))?;
         Ok(s(if export { &o.0 } else { &o.1 }))
     }
-    fn is_box_checked(_: &JsValue, args: &[JsValue], name: &JsString, c: &mut Context) -> JsResult<JsValue> {
+    fn is_box_checked(_: &JsValue, args: &[JsValue], name: &FieldKey, c: &mut Context) -> JsResult<JsValue> {
         let f = read(c, name)?;
         let i = arg(args, 0).to_number(c)? as usize;
         let on = f.options.get(i).is_some_and(|o| f.value.first() == Some(&o.0));
         Ok(JsValue::from(on))
     }
-    fn check_this_box(_: &JsValue, args: &[JsValue], name: &JsString, c: &mut Context) -> JsResult<JsValue> {
+    fn check_this_box(_: &JsValue, args: &[JsValue], name: &FieldKey, c: &mut Context) -> JsResult<JsValue> {
         let f = read(c, name)?;
         let i = arg(args, 0).to_number(c)? as usize;
         let on = args.get(1).is_none_or(JsValue::to_boolean);
@@ -154,16 +274,89 @@ pub(crate) fn field_object(ctx: &mut Context, name: &str) -> JsObject {
         })?;
         Ok(JsValue::undefined())
     }
-    fn set_focus(_: &JsValue, _: &[JsValue], name: &JsString, c: &mut Context) -> JsResult<JsValue> {
-        host(c)?.borrow_mut().request(Request::Focus(name.to_std_string_escaped()));
+    fn set_focus(_: &JsValue, _: &[JsValue], name: &FieldKey, c: &mut Context) -> JsResult<JsValue> {
+        let field = read(c, name)?;
+        let request = match field.object_id {
+            Some(object_id) => Request::FocusField { name: field.name, object_id },
+            None => Request::Focus(field.name),
+        };
+        host(c)?.borrow_mut().request(request);
+        Ok(JsValue::undefined())
+    }
+
+    /// `setAction(cTrigger, cScript)`: install `cScript` as the field's JavaScript for
+    /// `cTrigger`, replacing what it ran before; saved with the document (#269).
+    fn set_action(_: &JsValue, args: &[JsValue], name: &FieldKey, c: &mut Context) -> JsResult<JsValue> {
+        let trigger = text(&arg(args, 0), c)?;
+        if !SET_ACTION_TRIGGERS.contains(&trigger.as_str()) {
+            return Err(error(format!("setAction: unknown trigger {trigger:?}; use one of {}", SET_ACTION_TRIGGERS.join(", "))));
+        }
+        let script = text(&arg(args, 1), c)?;
+        if let Some(why) = crate::run::refuse(&script) {
+            return Err(error(format!("setAction: {why}")));
+        }
+        write(c, name, |f| {
+            f.actions.retain(|(t, _)| *t != trigger);
+            f.actions.push((trigger, script));
+        })?;
+        Ok(JsValue::undefined())
+    }
+    /// `setItems(oArray)`: replace a combo box's or list box's items. Each item is its text, or
+    /// a `[text, exportValue]` pair. The value stays when an item still has it, and otherwise
+    /// becomes the first item's (#269).
+    fn set_items(_: &JsValue, args: &[JsValue], name: &FieldKey, c: &mut Context) -> JsResult<JsValue> {
+        let f = read(c, name)?;
+        if !matches!(f.kind, FieldType::ComboBox | FieldType::ListBox) {
+            return Err(error(format!("setItems: {} is not a combo box or list box", f.name)));
+        }
+        let list = arg(args, 0).as_object().filter(JsObject::is_array).ok_or_else(|| error("setItems needs an array of items"))?;
+        let list = JsArray::from_object(list)?;
+        let len = list.length(c)?;
+        if len > MAX_ITEMS as u64 {
+            return Err(error(format!("setItems: at most {MAX_ITEMS} items")));
+        }
+        let mut items = Vec::new();
+        let mut bytes = 0usize;
+        for i in 0..len {
+            let item = list.get(i, c)?;
+            let (label, export) = match item.as_object().filter(JsObject::is_array) {
+                Some(pair) => {
+                    let pair = JsArray::from_object(pair.clone())?;
+                    let label = text(&pair.get(0, c)?, c)?;
+                    let export = pair.get(1, c)?;
+                    let export = if export.is_undefined() { label.clone() } else { text(&export, c)? };
+                    (label, export)
+                }
+                None => {
+                    let label = text(&item, c)?;
+                    (label.clone(), label)
+                }
+            };
+            bytes = bytes.saturating_add(label.len()).saturating_add(export.len());
+            if bytes > MAX_ITEM_BYTES {
+                return Err(error("setItems: the items are too long"));
+            }
+            items.push((export, label));
+        }
+        write(c, name, |f| {
+            let kept: Vec<String> = f.value.iter().filter(|v| items.iter().any(|(export, _)| export == *v)).cloned().collect();
+            f.value = if kept.is_empty() { items.first().map(|(export, _)| vec![export.clone()]).unwrap_or_default() } else { kept };
+            f.options = items;
+        })?;
         Ok(JsValue::undefined())
     }
 
     let rw = Attribute::CONFIGURABLE | Attribute::ENUMERABLE;
+    let set_action = NativeFunction::from_copy_closure_with_captures(set_action, n.clone());
+    let set_items = NativeFunction::from_copy_closure_with_captures(set_items, n.clone());
     let get_item_at = NativeFunction::from_copy_closure_with_captures(get_item_at, n.clone());
     let is_box_checked = NativeFunction::from_copy_closure_with_captures(is_box_checked, n.clone());
     let check_this_box = NativeFunction::from_copy_closure_with_captures(check_this_box, n.clone());
     let set_focus = NativeFunction::from_copy_closure_with_captures(set_focus, n.clone());
+    let button_get_caption = NativeFunction::from_copy_closure_with_captures(button_get_caption, n.clone());
+    let button_set_caption = NativeFunction::from_copy_closure_with_captures(button_set_caption, n.clone());
+    let button_get_icon = NativeFunction::from_copy_closure_with_captures(crate::icons::get, n.clone());
+    let button_set_icon = NativeFunction::from_copy_closure_with_captures(crate::icons::set, n.clone());
     ObjectInitializer::new(ctx)
         .accessor(js_string!("value"), Some(value_get), Some(value_set), rw)
         .accessor(js_string!("valueAsString"), Some(as_string), None, rw)
@@ -180,14 +373,33 @@ pub(crate) fn field_object(ctx: &mut Context, name: &str) -> JsObject {
         .accessor(js_string!("currentValueIndices"), Some(indices), None, rw)
         .accessor(js_string!("textColor"), Some(text_color_get), Some(text_color_set), rw)
         .accessor(js_string!("fillColor"), Some(fill_color_get), Some(fill_color_set), rw)
+        .accessor(js_string!("textSize"), Some(text_size_get), Some(text_size_set), rw)
+        .accessor(js_string!("lineWidth"), Some(line_width_get), Some(line_width_set), rw)
+        .accessor(js_string!("borderStyle"), Some(border_style_get), Some(border_style_set), rw)
+        .accessor(js_string!("userName"), Some(user_name_get), Some(user_name_set), rw)
+        .accessor(js_string!("strokeColor"), Some(stroke_color_get), Some(stroke_color_set), rw)
         .accessor(js_string!("rect"), Some(rect_get), Some(rect_set), rw)
         .function(get_item_at, js_string!("getItemAt"), 2)
         .function(is_box_checked, js_string!("isBoxChecked"), 1)
         .function(check_this_box, js_string!("checkThisBox"), 2)
         .function(set_focus, js_string!("setFocus"), 0)
+        .function(set_action, js_string!("setAction"), 2)
+        .function(set_items, js_string!("setItems"), 1)
+        .function(button_get_icon, js_string!("buttonGetIcon"), 1)
+        .function(button_set_icon, js_string!("buttonSetIcon"), 2)
+        .function(button_get_caption, js_string!("buttonGetCaption"), 1)
+        .function(button_set_caption, js_string!("buttonSetCaption"), 2)
         .build()
 }
 
+/// The triggers `field.setAction` takes (Acrobat JavaScript reference, Field.setAction).
+const SET_ACTION_TRIGGERS: [&str; 10] =
+    ["MouseUp", "MouseDown", "MouseEnter", "MouseExit", "OnFocus", "OnBlur", "Keystroke", "Validate", "Calculate", "Format"];
+/// Most items one `setItems` call takes, and most bytes of their texts and export values: a
+/// script must not grow a field without bound.
+const MAX_ITEMS: usize = 10_000;
+const MAX_ITEM_BYTES: usize = 1 << 20;
+
 // ── the document (global object) ────────────────────────────────────────────────────────────
 
 pub(crate) fn get_field(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
@@ -209,8 +421,31 @@ pub(crate) fn get_nth_field_name(_: &JsValue, args: &[JsValue], ctx: &mut Contex
 }
 
 pub(crate) fn reset_form(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    {
+        let mut h = host(ctx)?.borrow_mut();
+        if h.reset_calls >= crate::MAX_RESET_CALLS {
+            h.reset_limit_exceeded = true;
+            return Err(error("reset call limit exceeded"));
+        }
+        h.reset_calls = h.reset_calls.saturating_add(1);
+    }
     let names = strings(&arg(args, 0), ctx)?;
-    host(ctx)?.borrow_mut().request(Request::Reset(names));
+    let mut h = host(ctx)?.borrow_mut();
+    let queued = h.requests.len();
+    h.request(Request::Reset(names));
+    // Keep the live shadow and the bounded host request in agreement, including clipped names.
+    let Some(Request::Reset(names)) = h.requests.get(queued).cloned() else { return Ok(JsValue::undefined()) };
+    let super::host::Host { fields, changed, .. } = &mut *h;
+    for (i, field) in std::sync::Arc::make_mut(fields).iter_mut().enumerate() {
+        if field.default_known
+            && !matches!(field.kind, FieldType::Button | FieldType::Signature)
+            && (names.is_empty() || names.iter().any(|n| field.name == *n || field.name.strip_prefix(n).is_some_and(|rest| rest.starts_with('.'))))
+        {
+            field.value.clone_from(&field.default);
+            // Retain the final snapshot even when a later assignment restores the pre-reset value.
+            changed.insert(i);
+        }
+    }
     Ok(JsValue::undefined())
 }
 
diff --git a/crates/js/src/formcalc/access.rs b/crates/js/src/formcalc/access.rs
index 26de7ba9eb..3c323ca088 100644
--- a/crates/js/src/formcalc/access.rs
+++ b/crates/js/src/formcalc/access.rs
@@ -33,9 +33,12 @@ impl Interp<'_> {
         Ok(())
     }
 
-    /// `more` nodes into `out`, each once, never past [`MAX_LIST`].
+    /// `more` nodes into `out`, each once, never past [`MAX_LIST`]. Every node visited costs a
+    /// step, kept or not, and the call itself one more: a search that matches nothing still
+    /// costs work when it is repeated over a long list.
     pub(super) fn gather(&mut self, out: &mut Vec<usize>, seen: &mut HashSet<usize>, more: impl IntoIterator<Item = usize>) -> R<()> {
         for i in more {
+            self.step()?;
             if seen.insert(i) {
                 out.push(i);
                 if out.len() > MAX_LIST {
@@ -43,7 +46,7 @@ impl Interp<'_> {
                 }
             }
         }
-        self.charge(1)
+        self.step()
     }
 
     /// The nodes of `v`, each once.
@@ -294,8 +297,10 @@ impl Interp<'_> {
         }
     }
 
-    /// `v` onto `out`: a node only once, never past [`MAX_LIST`].
+    /// `v` onto `out`: a node only once, never past [`MAX_LIST`]. A duplicate costs its step
+    /// too: `all` on a list of same-named siblings makes one for every pair.
     fn list_push(&mut self, out: &mut Vec<Val>, seen: &mut HashSet<usize>, v: Val) -> R<()> {
+        self.step()?;
         if let Val::Node(i) = v
             && !seen.insert(i)
         {
@@ -305,7 +310,7 @@ impl Interp<'_> {
         if out.len() > MAX_LIST {
             return Err(LIST_TOO_LONG.into());
         }
-        self.charge(1)
+        Ok(())
     }
 
     /// Property `name` of form object `i` as FormCalc reads it: its value, attributes,
diff --git a/crates/js/src/formcalc/dates.rs b/crates/js/src/formcalc/dates.rs
index 4d9befeab2..f201a23525 100644
--- a/crates/js/src/formcalc/dates.rs
+++ b/crates/js/src/formcalc/dates.rs
@@ -56,6 +56,9 @@ const CENTURY_SPLIT: i64 = 30;
 
 const MONTHS: [&str; 12] = ["January", "February", "March", "April", "May", "June", "July", "August", "September", "October", "November", "December"];
 
+/// Characters of the longest month name: all a month token needs to read of the text.
+const LONGEST_MONTH: usize = 9;
+
 /// Parse `text` as a date by `picture` (`YYYY-MM-DD`, `MM/DD/YYYY`, `MMM D, YYYY`, …).
 pub(super) fn parse_date(text: &str, picture: &str) -> Option<(i64, u32, u32)> {
     let pic: Vec<char> = picture.chars().collect();
@@ -71,8 +74,9 @@ pub(super) fn parse_date(text: &str, picture: &str) -> Option<(i64, u32, u32)> {
             }
             i += run;
             if c == 'M' && run >= 3 {
-                // Month name.
-                let rest: String = txt.get(j..).unwrap_or(&[]).iter().collect();
+                // Month name: only as much of the text as a name can be, so a picture of many
+                // month tokens does not copy the rest of a long text for each of them.
+                let rest: String = txt.get(j..).unwrap_or(&[]).iter().take(LONGEST_MONTH).collect();
                 let lower = rest.to_ascii_lowercase();
                 let found = MONTHS
                     .iter()
diff --git a/crates/js/src/geometry.rs b/crates/js/src/geometry.rs
new file mode 100644
index 0000000000..a2861ee5c1
--- /dev/null
+++ b/crates/js/src/geometry.rs
@@ -0,0 +1,33 @@
+//! Conversion between PDF default user space and Acrobat's widget rectangle convention.
+/// Convert a PDF rectangle to rotated user-space order around the effective crop-box origin.
+pub fn rotate_rect([x0, y0, x1, y1]: [f64; 4], [cx0, cy0, cx1, cy1]: [f64; 4], rotation: i64) -> [f64; 4] {
+    match rotation.rem_euclid(360) {
+        90 => [y0 - cy0, cx1 - x0, y1 - cy0, cx1 - x1],
+        180 => [cx1 - x1, cy1 - y0, cx1 - x0, cy1 - y1],
+        270 => [cy1 - y1, x1 - cx0, cy1 - y0, x0 - cx0],
+        _ => [x0 - cx0, y1 - cy0, x1 - cx0, y0 - cy0],
+    }
+}
+/// Map a script rectangle back to default PDF user space using the inverse page rotation.
+pub fn unrotate_rect([l, t, r, b]: [f64; 4], [cx0, cy0, cx1, cy1]: [f64; 4], rotation: i64) -> [f64; 4] {
+    match rotation.rem_euclid(360) {
+        90 => [cx1 - t, cy0 + l, cx1 - b, cy0 + r],
+        180 => [cx1 - r, cy1 - t, cx1 - l, cy1 - b],
+        270 => [cx0 + b, cy1 - r, cx0 + t, cy1 - l],
+        _ => [l + cx0, b + cy0, r + cx0, t + cy0],
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    /// All quarter-turn rotations round-trip rectangle coordinates with a nonzero crop origin.
+    fn rotated_widget_rectangles_roundtrip_with_shifted_crop_boxes() {
+        let rect = [30.0, 50.0, 90.0, 100.0];
+        let crop = [20.0, 40.0, 620.0, 840.0];
+        for rotation in [0, 90, 180, 270] {
+            assert_eq!(unrotate_rect(rotate_rect(rect, crop, rotation), crop, rotation), rect);
+        }
+    }
+}
diff --git a/crates/js/src/globals.rs b/crates/js/src/globals.rs
index 1acc9bb89f..ef7b95c8c7 100644
--- a/crates/js/src/globals.rs
+++ b/crates/js/src/globals.rs
@@ -1,10 +1,10 @@
-use super::document::{field_object, get_field, get_nth_field_name, noop, num_fields, page_num_get, page_num_set, print, reset_form, submit_form};
+use super::document::{get_field, get_nth_field_name, noop, num_fields, page_num_get, page_num_set, print, reset_form, submit_form};
 use super::format::{printd, printf, printx, scand};
-use super::host::{arg, function, host, s, strings, text, text_line};
+use super::host::{arg, error, function, host, s, strings, text, text_line};
 use super::model::{DISPLAY_HIDDEN, DISPLAY_NO_PRINT, DISPLAY_NO_VIEW, DISPLAY_VISIBLE, Event, Panel, Request};
 use super::{
     Arc, Attribute, Context, JsArray, JsObject, JsResult, JsString, JsValue, Message, MessageButtons, MessageIcon, NativeFunction, ObjectInitializer,
-    Source, error, js_string,
+    Source, js_string,
 };
 
 // ── app, util, console ──────────────────────────────────────────────────────────────────────
@@ -78,10 +78,30 @@ pub(crate) fn message_box_message(args: &[JsValue], ctx: &mut Context) -> JsResu
 /// given in that order or as one object with those keys, and returns 1 (the OK button).
 fn alert(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
     let m = alert_message(args, ctx)?;
-    host(ctx)?.borrow_mut().alert(m);
-    // Always the OK button for now: the viewer can't ask the user and run the script on with
-    // the answer yet (#4291).
-    Ok(JsValue::from(1))
+    host(ctx)?.borrow_mut().alert(m.clone());
+    if !crate::interaction::has_host() {
+        return Ok(JsValue::from(1));
+    }
+    let answer = crate::interaction::ask(crate::interaction::Prompt::Alert(m.clone()))?;
+    let fallback = match m.buttons {
+        MessageButtons::Ok => "1",
+        MessageButtons::YesNo => "3",
+        _ => "2",
+    };
+    let answer = answer.as_deref().unwrap_or(fallback);
+    let accepted = match m.buttons {
+        MessageButtons::Ok => ["1"].as_slice(),
+        MessageButtons::OkCancel => ["1", "2"].as_slice(),
+        MessageButtons::YesNo => ["3", "4"].as_slice(),
+        MessageButtons::YesNoCancel => ["2", "3", "4"].as_slice(),
+    };
+    if answer == "1" && !accepted.contains(&"1") {
+        return Ok(JsValue::from(2));
+    }
+    if !accepted.contains(&answer) {
+        return Err(error("invalid alert response"));
+    }
+    Ok(JsValue::from(answer.parse::<i32>().unwrap_or(2)))
 }
 
 /// `app.beep()`: queues a request to beep.
@@ -92,7 +112,7 @@ fn beep(_: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
 
 /// `app.runtimeHighlight`: whether the viewer highlights form fields.
 fn runtime_highlight(_: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
-    Ok(JsValue::from(host(ctx)?.borrow().doc.highlight))
+    Ok(JsValue::from(host(ctx)?.borrow().doc.runtime_highlight))
 }
 
 /// `app.runtimeHighlight = on`: asks the viewer to highlight form fields, or to stop. Later reads
@@ -100,13 +120,13 @@ fn runtime_highlight(_: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult<
 fn set_runtime_highlight(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
     let on = arg(args, 0).to_boolean();
     let mut h = host(ctx)?.borrow_mut();
-    if h.doc.highlight != on {
+    if h.doc.runtime_highlight != on {
         // Only the setting the script ends with matters: one request, the latest, under the
         // host's request cap like any other. One the cap drops changes nothing, so the script
         // goes on reading the setting the viewer has.
         h.requests.retain(|r| !matches!(r, Request::Highlight(_)));
         if h.request(Request::Highlight(on)) {
-            h.doc.highlight = on;
+            h.doc.runtime_highlight = on;
         }
     }
     Ok(JsValue::undefined())
@@ -212,27 +232,14 @@ fn get_page_box(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<Js
         let rotation = h.doc.page_rotations.get(page).copied().unwrap_or(0);
         (boxes[which], rotation, boxes[1])
     };
-    let [x0, y0, x1, y1] = rect;
-    let [cx0, cy0, cx1, cy1] = crop;
-    let rotated = match rotation {
-        90 => [y0 - cy0, cx1 - x0, y1 - cy0, cx1 - x1],
-        180 => [cx1 - x1, cy1 - y0, cx1 - x0, cy1 - y1],
-        270 => [cy1 - y1, x1 - cx0, cy1 - y0, x0 - cx0],
-        _ => [x0 - cx0, y1 - cy0, x1 - cx0, y0 - cy0],
-    };
+    let rotated = crate::rotate_rect(rect, crop, rotation);
     if !rotated.iter().all(|value| value.is_finite()) {
         return Err(error("getPageBox returned non-finite coordinates"));
     }
     Ok(JsArray::from_iter(rotated.into_iter().map(JsValue::from), ctx).into())
 }
 
-/// `app.response(…)`: always `null`, the answer for a canceled dialog, since no one is there to
-/// type one.
-fn response(_: &JsValue, _: &[JsValue], _: &mut Context) -> JsResult<JsValue> {
-    // No one to answer: as if the dialog was cancelled.
-    Ok(JsValue::null())
-}
-
+/// Write a bounded line to the script console.
 fn println(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
     let m = text_line(&arg(args, 0), ctx)?;
     host(ctx)?.borrow_mut().print(m);
@@ -251,11 +258,15 @@ fn calculate_now(_: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult<JsVa
     let calculations = {
         let shared = host(ctx)?;
         let mut h = shared.borrow_mut();
+        if h.calculation_limit_exceeded {
+            return Err(error("script calculation work limit exceeded"));
+        }
         if h.calculate_depth >= MAX_CALCULATE_DEPTH {
+            h.calculation_limit_exceeded = true;
             return Err(error("calculateNow recursion limit exceeded"));
         }
         h.calculate_depth += 1;
-        Arc::clone(&h.calculations)
+        h.calculations.clone()
     };
     let previous_event = match ctx.global_object().get(js_string!("event"), ctx) {
         Ok(event) => event,
@@ -268,45 +279,60 @@ fn calculate_now(_: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult<JsVa
         }
     };
     let result = (|| {
-        for (name, script) in calculations.iter() {
+        for (index, script) in calculations {
+            let Some(field) = host(ctx)?.borrow().fields.get(index).cloned() else { continue };
             {
-                let mut h = host(ctx)?.borrow_mut();
-                if h.calculate_steps >= super::run::MAX_CALCULATE_STEPS {
-                    return Err(error("calculateNow evaluation limit exceeded"));
+                let shared = host(ctx)?;
+                let mut h = shared.borrow_mut();
+                if h.calculation_limit_exceeded || h.calculation_evaluations >= super::run::MAX_CALCULATE_STEPS {
+                    h.calculation_limit_exceeded = true;
+                    return Err(error("script calculation work limit exceeded"));
+                }
+                h.calculation_evaluations += 1;
+                if let Some(why) = super::run::refuse(&script) {
+                    h.calculation_limit_exceeded = true;
+                    return Err(error(why));
                 }
-                h.calculate_steps = h.calculate_steps.saturating_add(1);
             }
-            let Some(field) = host(ctx)?.borrow().fields.iter().find(|f| f.name == *name).cloned() else { continue };
-            if let Some(why) = super::run::refuse(script) {
-                host(ctx)?.borrow_mut().print(format!("calculation script for {name} failed: {why}"));
-                continue;
-            }
-            let event = Event::field("Calculate", name, &field.value.first().cloned().unwrap_or_default());
-            let (object, _) = event_object(ctx, &event)?;
+            let mut event = Event::field("Calculate", &field.name, &field.value.first().cloned().unwrap_or_default());
+            event.target_id = field.object_id;
+            let (object, value_store) = event_object(ctx, &event)?;
             ctx.global_object().set(js_string!("event"), object.clone(), true, ctx)?;
             let (fields_before, changed_before, formatted_before) = {
-                let h = host(ctx)?.borrow();
+                let shared = host(ctx)?;
+                let h = shared.borrow();
                 (Arc::clone(&h.fields), h.changed.clone(), h.formatted.clone())
             };
-            if let Err(cause) = ctx.eval(Source::from_bytes(script)) {
-                let mut h = host(ctx)?.borrow_mut();
+            if let Err(err) = ctx.eval(Source::from_bytes(&script)) {
+                let shared = host(ctx)?;
+                let mut h = shared.borrow_mut();
+                if err.as_engine().is_some() || h.calculation_limit_exceeded || h.reset_limit_exceeded {
+                    return Err(err);
+                }
                 h.fields = fields_before;
                 h.changed = changed_before;
                 h.formatted = formatted_before;
-                h.print(format!("calculation script for {name} failed: {cause}"));
+                h.print(format!("Calculate {}: {err}", field.name));
                 continue;
             }
+            drop(fields_before);
+            if host(ctx)?.borrow().calculation_limit_exceeded {
+                return Err(error("script calculation work limit exceeded"));
+            }
             let rc = object.get(js_string!("rc"), ctx)?;
             if !rc.to_boolean() {
                 continue;
             }
+            if !value_store.get(js_string!("set"), ctx)?.to_boolean() {
+                continue;
+            }
             let value = object.get(js_string!("value"), ctx)?;
             let value = text(&value, ctx)?;
             let shared = host(ctx)?;
             let mut h = shared.borrow_mut();
-            if let Some((index, _)) = h.fields.iter().enumerate().find(|(_, f)| f.name == *name) {
+            if index < h.fields.len() {
                 let target = Arc::make_mut(&mut h.fields).get_mut(index).ok_or_else(|| error("the field is no longer available"))?;
-                target.value = vec![value];
+                super::host::set_value(target, vec![value]);
                 h.changed.insert(index);
                 h.formatted.insert(index);
             }
@@ -328,35 +354,38 @@ fn calculate_now(_: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult<JsVa
 /// each field counts its first value, and values are read as `AFMakeNumber` reads typed text
 /// (currency, `%`, group separators, a comma decimal separator), anything else counting as 0.
 fn af_simple_calculate(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
-    const MAX_EXPANDED_VALUES: usize = 1 << 20;
     let op = text(&arg(args, 0), ctx)?;
     let names = strings(&arg(args, 1), ctx)?;
-    let values: Vec<f64> = {
-        let shared = host(ctx)?;
-        let h = shared.borrow();
-        let mut values = Vec::new();
-        for name in &names {
-            let prefix = format!("{name}.");
-            for f in h.fields.iter().filter(|f| f.name == *name || f.name.starts_with(&prefix)) {
-                if let Some(v) = f.value.first() {
-                    if values.len() >= MAX_EXPANDED_VALUES {
-                        return Ok(s("0"));
-                    }
-                    values.push(make_number(v).unwrap_or(0.0));
-                }
-            }
-        }
-        values
-    };
+    let fields = host(ctx)?.borrow().fields.clone();
+    // Charge selector comparisons before group expansion; the iterator keeps memory independent
+    // of how often selectors overlap or duplicate the same field.
+    let selector_bytes = names.iter().fold(0usize, |n, s| n.saturating_add(s.len()));
+    let work = fields.len().saturating_mul(names.len().saturating_add(selector_bytes));
+    let shared = host(ctx)?;
+    let mut h = shared.borrow_mut();
+    h.calculation_work = h.calculation_work.saturating_add(work);
+    let exhausted = h.calculation_work > 1 << 24;
+    h.calculation_limit_exceeded |= exhausted;
+    drop(h);
+    if exhausted {
+        return Err(error("calculation field lookup exceeds its work limit"));
+    }
+    let mut values = names
+        .iter()
+        .flat_map(|name| fields.iter().filter(move |f| f.name == *name || f.name.strip_prefix(name).is_some_and(|rest| rest.starts_with('.'))))
+        .filter_map(|field| field.value.first())
+        .map(|v| make_number(v).unwrap_or(0.0))
+        .peekable();
     let result = match op.as_str() {
-        "SUM" => values.iter().sum(),
-        // An empty product is 0, as the native calculation has it, not 1.
-        "PRD" if values.is_empty() => 0.0,
-        "PRD" => values.iter().product(),
-        "AVG" if values.is_empty() => 0.0,
-        "AVG" => values.iter().sum::<f64>() / values.len() as f64,
-        "MIN" => values.iter().copied().fold(f64::INFINITY, f64::min),
-        "MAX" => values.iter().copied().fold(f64::NEG_INFINITY, f64::max),
+        "SUM" => values.sum(),
+        "PRD" if values.peek().is_none() => 0.0,
+        "PRD" => values.product(),
+        "AVG" => {
+            let (count, total) = values.fold((0usize, 0.0), |(n, sum), v| (n.saturating_add(1), sum + v));
+            if count == 0 { 0.0 } else { total / count as f64 }
+        }
+        "MIN" => values.reduce(f64::min).unwrap_or(0.0),
+        "MAX" => values.reduce(f64::max).unwrap_or(0.0),
         _ => 0.0,
     };
     Ok(s(&if result.is_finite() { js_number(result) } else { "0".into() }))
@@ -420,10 +449,45 @@ fn color_object(ctx: &mut Context) -> JsObject {
 /// The XFA version scripts see as `xfa_version`.
 const XFA_VERSION: f64 = 3.5;
 
-/// Defines the form object model's globals: the document's functions (`getField`, `resetForm`,
-/// `print`, `submitForm`, `exportDataObject` and others) and properties (`numFields`, `pageNum`,
-/// `numPages`, `documentFileName`, `info`, the XFA version), and the `app`, `util`, `console`,
-/// `display` and `color` objects.
+/// Read the current zoom percentage, defaulting unset snapshots to actual size.
+fn zoom_get(_: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    let z = host(ctx)?.borrow().doc.zoom;
+    Ok(JsValue::from(if z > 0.0 { z } else { 100.0 }))
+}
+/// Validate the requested percentage, update its live value and queue a native viewer zoom request.
+fn zoom_set(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    let z = arg(args, 0).to_number(ctx)?;
+    if !z.is_finite() || !(1.0..=6400.0).contains(&z) {
+        return Err(error("zoom must be between 1 and 6400"));
+    }
+    let shared = host(ctx)?;
+    let mut host = shared.borrow_mut();
+    if host.request(Request::Zoom(z)) {
+        host.doc.zoom = z;
+    }
+    Ok(JsValue::undefined())
+}
+/// Read the current page count after page insertion/deletion without resetting script globals.
+fn num_pages_get(_: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    Ok(JsValue::from(host(ctx)?.borrow().doc.num_pages as f64))
+}
+
+/// Read the current file name, including a completed Save As in this retained realm.
+fn document_file_name_get(_: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    Ok(s(&host(ctx)?.borrow().doc.file_name))
+}
+
+/// Build the information object from the current snapshot, omitting metadata removed by edits.
+fn document_info_get(_: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    let info = host(ctx)?.borrow().doc.info.clone();
+    let mut object = ObjectInitializer::new(ctx);
+    for (key, value) in info {
+        object.property(JsString::from(key.as_str()), s(&value), Attribute::all());
+    }
+    Ok(object.build().into())
+}
+
+/// Install the host API once; live document properties continue reading each job's snapshot.
 pub(crate) fn install(ctx: &mut Context) -> JsResult<()> {
     let globals: [(&str, usize, NativeFunction); 12] = [
         ("getField", 1, NativeFunction::from_fn_ptr(get_field)),
@@ -433,8 +497,8 @@ pub(crate) fn install(ctx: &mut Context) -> JsResult<()> {
         ("submitForm", 1, NativeFunction::from_fn_ptr(submit_form)),
         ("mailDoc", 1, NativeFunction::from_fn_ptr(noop)),
         ("calculateNow", 0, NativeFunction::from_fn_ptr(calculate_now)),
-        ("AFSimple_Calculate", 2, NativeFunction::from_fn_ptr(af_simple_calculate)),
         ("getPageBox", 2, NativeFunction::from_fn_ptr(get_page_box)),
+        ("AFSimple_Calculate", 2, NativeFunction::from_fn_ptr(af_simple_calculate)),
         ("syncAnnotScan", 0, NativeFunction::from_fn_ptr(noop)),
         ("dirty", 0, NativeFunction::from_fn_ptr(noop)),
         ("exportDataObject", 4, NativeFunction::from_fn_ptr(export_data_object)),
@@ -442,26 +506,39 @@ pub(crate) fn install(ctx: &mut Context) -> JsResult<()> {
     for (name, len, f) in globals {
         ctx.register_global_callable(JsString::from(name), len, f)?;
     }
+    let zg = function(ctx, NativeFunction::from_fn_ptr(zoom_get));
+    let zs = function(ctx, NativeFunction::from_fn_ptr(zoom_set));
+
+    let border = ObjectInitializer::new(ctx)
+        .property(js_string!("s"), s("solid"), Attribute::all())
+        .property(js_string!("d"), s("dashed"), Attribute::all())
+        .property(js_string!("b"), s("beveled"), Attribute::all())
+        .property(js_string!("i"), s("inset"), Attribute::all())
+        .property(js_string!("u"), s("underline"), Attribute::all())
+        .build();
+    ctx.register_global_property(js_string!("border"), border, Attribute::CONFIGURABLE)?;
     let global = ctx.global_object();
+    global.define_property_or_throw(
+        js_string!("zoom"),
+        boa_engine::property::PropertyDescriptor::builder().get(zg).set(zs).configurable(true).build(),
+        ctx,
+    )?;
     let rw = Attribute::CONFIGURABLE;
     let nf = function(ctx, NativeFunction::from_fn_ptr(num_fields));
     let pg = function(ctx, NativeFunction::from_fn_ptr(page_num_get));
     let ps = function(ctx, NativeFunction::from_fn_ptr(page_num_set));
-    let (file, pages, info, xfa) = {
-        let h = host(ctx)?.borrow();
-        (h.doc.file_name.clone(), h.doc.num_pages, h.doc.info.clone(), h.doc.xfa)
-    };
-    let mut io = ObjectInitializer::new(ctx);
-    for (k, v) in &info {
-        io.property(JsString::from(k.as_str()), s(v), Attribute::all());
-    }
-    let info = io.build();
+    let xfa = host(ctx)?.borrow().doc.xfa;
     use boa_engine::property::PropertyDescriptor;
     global.define_property_or_throw(js_string!("numFields"), PropertyDescriptor::builder().get(nf).configurable(true), ctx)?;
     global.define_property_or_throw(js_string!("pageNum"), PropertyDescriptor::builder().get(pg).set(ps).configurable(true), ctx)?;
-    ctx.register_global_property(js_string!("numPages"), JsValue::from(pages as f64), rw)?;
-    ctx.register_global_property(js_string!("documentFileName"), s(&file), rw)?;
-    ctx.register_global_property(js_string!("info"), info, rw)?;
+    for (name, getter) in [
+        ("numPages", num_pages_get as fn(&JsValue, &[JsValue], &mut Context) -> JsResult<JsValue>),
+        ("documentFileName", document_file_name_get),
+        ("info", document_info_get),
+    ] {
+        let getter = function(ctx, NativeFunction::from_fn_ptr(getter));
+        global.define_property_or_throw(JsString::from(name), PropertyDescriptor::builder().get(getter).configurable(true), ctx)?;
+    }
     // XFA forms check both before they run: every document sees the XFA version, and only an
     // XFA form sees `xfa_installed`.
     ctx.register_global_property(js_string!("xfa_version"), JsValue::from(XFA_VERSION), rw)?;
@@ -475,8 +552,9 @@ pub(crate) fn install(ctx: &mut Context) -> JsResult<()> {
         .accessor(js_string!("runtimeHighlight"), Some(highlight_get), Some(highlight_set), rw)
         .function(NativeFunction::from_fn_ptr(alert), js_string!("alert"), 1)
         .function(NativeFunction::from_fn_ptr(beep), js_string!("beep"), 0)
-        .function(NativeFunction::from_fn_ptr(response), js_string!("response"), 1)
+        .function(NativeFunction::from_fn_ptr(crate::interaction::response), js_string!("response"), 1)
         .function(NativeFunction::from_fn_ptr(launch_url), js_string!("launchURL"), 2)
+        .function(NativeFunction::from_fn_ptr(crate::interaction::popup_menu), js_string!("popUpMenuEx"), 0)
         .function(NativeFunction::from_fn_ptr(exec_menu_item), js_string!("execMenuItem"), 1)
         .function(NativeFunction::from_fn_ptr(timer), js_string!("setTimeOut"), 2)
         .function(NativeFunction::from_fn_ptr(timer), js_string!("setInterval"), 2)
@@ -513,6 +591,7 @@ pub(crate) fn install(ctx: &mut Context) -> JsResult<()> {
     ctx.register_global_property(js_string!("display"), display, rw)?;
     let color = color_object(ctx);
     ctx.register_global_property(js_string!("color"), color, rw)?;
+    crate::source::install(ctx)?;
     Ok(())
 }
 
@@ -544,7 +623,13 @@ pub(crate) fn event_object(ctx: &mut Context, e: &Event) -> JsResult<(JsObject,
         .build();
     let value_get = function(ctx, NativeFunction::from_copy_closure_with_captures(get, store.clone()));
     let value_set = function(ctx, NativeFunction::from_copy_closure_with_captures(set, store.clone()));
-    let target = e.target.as_ref().map_or(JsValue::null(), |t| field_object(ctx, t).into());
+    let target = e.target.as_ref().map_or(JsValue::null(), |t| {
+        if e.target_id.is_some() {
+            crate::document::field_object_by_id(ctx, t, e.target_id).into()
+        } else {
+            crate::document::field_object(ctx, t).into()
+        }
+    });
     let event = ObjectInitializer::new(ctx)
         .property(js_string!("name"), s(&e.name), Attribute::all())
         .property(js_string!("type"), s(&e.kind), Attribute::all())
diff --git a/crates/js/src/host.rs b/crates/js/src/host.rs
index d57cccbe74..d829041ce6 100644
--- a/crates/js/src/host.rs
+++ b/crates/js/src/host.rs
@@ -6,18 +6,31 @@ use super::{
 };
 
 pub(crate) struct Host {
+    pub(crate) event_name: String,
     pub(crate) fields: Arc<Vec<FieldState>>,
+    pub(crate) icons: Vec<(super::JsObject, u64)>,
+    pub(crate) objects: std::collections::HashMap<(String, Option<u64>, u64), super::JsObject>,
+    pub(crate) field_keys: std::collections::HashSet<(String, Option<u64>, u64)>,
     pub(crate) changed: BTreeSet<usize>,
     pub(crate) formatted: BTreeSet<usize>,
     pub(crate) alerts: Vec<Message>,
     pub(crate) console: Vec<String>,
     pub(crate) requests: Vec<Request>,
     pub(crate) doc: DocInfo,
-    pub(crate) calculations: Arc<Vec<(String, String)>>,
+    pub(crate) calculations: Vec<(usize, String)>,
     pub(crate) calculate_depth: usize,
-    pub(crate) calculate_steps: usize,
+    pub(crate) calculation_evaluations: usize,
+    pub(crate) calculation_limit_exceeded: bool,
+    pub(crate) calculation_work: usize,
+    pub(crate) current_event: JsValue,
+    pub(crate) reset_calls: usize,
+    pub(crate) reset_limit_exceeded: bool,
     /// Bytes of text kept in alerts, console lines and requests, against [`xfa::MAX_PAYLOAD`].
     pub(crate) kept: usize,
+    /// Bytes of text the script has added to the fields' values and colours, net of what it
+    /// replaced, against [`xfa::MAX_PAYLOAD`]: each assignment alone is capped, so without this
+    /// many fields could each hold a maximal array.
+    pub(crate) retained: usize,
     /// Alerts, console lines and requests the limits left out.
     pub(crate) dropped: usize,
 }
@@ -67,11 +80,13 @@ impl Host {
             Request::LaunchUrl(u) => Request::LaunchUrl(xfa::clip(u)),
             Request::Submit(u) => Request::Submit(xfa::clip(u)),
             Request::Focus(n) => Request::Focus(xfa::clip(n)),
+            Request::FocusField { name, object_id } => Request::FocusField { name: xfa::clip(name), object_id },
             other => other,
         };
         let bytes = match &r {
             Request::Reset(names) => names.iter().fold(0usize, |n, s| n.saturating_add(s.len()).saturating_add(std::mem::size_of::<String>())),
             Request::LaunchUrl(u) | Request::Submit(u) | Request::Focus(u) => u.len(),
+            Request::FocusField { name, .. } => name.len(),
             Request::OpenAttachment { name, .. } => name.len(),
             _ => 0,
         };
@@ -135,6 +150,38 @@ pub(crate) fn function(ctx: &mut Context, f: NativeFunction) -> JsFunction {
     FunctionObjectBuilder::new(ctx.realm(), f).build()
 }
 
+/// Format exactly the escaped UTF-8 representation used by `text`, refusing a
+/// write before it exceeds the remaining aggregate budget. No full Rust copy of
+/// an oversized JavaScript string is made just to discover its byte length.
+pub(crate) fn text_with_budget(v: &JsValue, ctx: &mut Context, remaining: usize, limit_error: &str) -> JsResult<String> {
+    use std::fmt::Write;
+    if v.is_undefined() || v.is_null() {
+        return Ok(String::new());
+    }
+    let js = v.to_string(ctx)?;
+    let exceeded = || error(limit_error);
+    // Every UTF-16 unit contributes at least one byte in the escaped UTF-8 output.
+    if js.len() > remaining {
+        return Err(exceeded());
+    }
+    struct BoundedText {
+        text: String,
+        limit: usize,
+    }
+    impl std::fmt::Write for BoundedText {
+        fn write_str(&mut self, text: &str) -> std::fmt::Result {
+            if self.text.len().checked_add(text.len()).is_none_or(|len| len > self.limit) {
+                return Err(std::fmt::Error);
+            }
+            self.text.push_str(text);
+            Ok(())
+        }
+    }
+    let mut out = BoundedText { text: String::new(), limit: remaining };
+    write!(&mut out, "{}", js.display_escaped()).map_err(|_| exceeded())?;
+    Ok(out.text)
+}
+
 pub(crate) fn strings(v: &JsValue, ctx: &mut Context) -> JsResult<Vec<String>> {
     if let Some(o) = v.as_object()
         && o.is_array()
@@ -145,16 +192,23 @@ pub(crate) fn strings(v: &JsValue, ctx: &mut Context) -> JsResult<Vec<String>> {
             return Err(error(format!("array length exceeds {MAX_ARRAY_LENGTH}")));
         }
         let mut out = Vec::new();
+        let mut remaining = xfa::MAX_PAYLOAD;
         for i in 0..n {
             let x = a.get(i, ctx)?;
-            out.push(text(&x, ctx)?);
+            let value = text_with_budget(&x, ctx, remaining, "string array byte limit exceeded")?;
+            remaining = remaining.saturating_sub(value.len());
+            out.push(value);
         }
         return Ok(out);
     }
-    Ok(if v.is_undefined() || v.is_null() { Vec::new() } else { vec![text(v, ctx)?] })
+    Ok(if v.is_undefined() || v.is_null() {
+        Vec::new()
+    } else {
+        vec![text_with_budget(v, ctx, xfa::MAX_PAYLOAD, "string array byte limit exceeded")?]
+    })
 }
 
-pub(crate) fn colour(c: &Option<Vec<String>>, ctx: &mut Context) -> JsValue {
+pub(crate) fn colour(c: Option<&[String]>, ctx: &mut Context) -> JsValue {
     match c {
         None => JsArray::from_iter([s("T")], ctx).into(),
         Some(parts) => {
@@ -167,17 +221,29 @@ pub(crate) fn colour(c: &Option<Vec<String>>, ctx: &mut Context) -> JsValue {
 
 // ── field objects ───────────────────────────────────────────────────────────────────────────
 
-fn field_index(ctx: &Context, name: &JsString) -> JsResult<usize> {
-    let n = name.to_std_string_escaped();
-    host(ctx)?.borrow().fields.iter().position(|f| f.name == n).ok_or_else(|| error(format!("no field named {n}")))
+pub(crate) type FieldKey = (JsString, Option<u64>, u64);
+
+/// PDF identities survive renames; name-only synthetic fields retain name lookup semantics.
+pub(crate) fn field_cache_key(name: &str, id: Option<u64>, token: u64) -> (String, Option<u64>, u64) {
+    (if id.is_some() { String::new() } else { name.to_string() }, id, token)
 }
 
-pub(crate) fn read(ctx: &Context, name: &JsString) -> JsResult<FieldState> {
+fn field_index(ctx: &Context, name: &FieldKey) -> JsResult<usize> {
+    let n = name.0.to_std_string_escaped();
+    host(ctx)?
+        .borrow()
+        .fields
+        .iter()
+        .position(|f| name.1.map_or(f.name == n, |id| f.object_id == Some(id) && f.instance_id == name.2))
+        .ok_or_else(|| error(format!("no field named {n}")))
+}
+
+pub(crate) fn read(ctx: &Context, name: &FieldKey) -> JsResult<FieldState> {
     let i = field_index(ctx, name)?;
     Ok(host(ctx)?.borrow().fields[i].clone())
 }
 
-pub(crate) fn write(ctx: &Context, name: &JsString, change: impl FnOnce(&mut FieldState)) -> JsResult<()> {
+pub(crate) fn write(ctx: &Context, name: &FieldKey, change: impl FnOnce(&mut FieldState)) -> JsResult<()> {
     let i = field_index(ctx, name)?;
     let mut h = host(ctx)?.borrow_mut();
     let field = Arc::make_mut(&mut h.fields).get_mut(i).ok_or_else(|| error("the field is no longer available"))?;
@@ -200,10 +266,57 @@ pub(crate) fn value_of(f: &FieldState, ctx: &mut Context) -> JsValue {
     }
 }
 
-pub(crate) fn set_value(f: &mut FieldState, vals: Vec<String>) {
-    f.value = match f.kind {
+/// Bytes of text in `v`, counting each string's heap size and its handle.
+pub(crate) fn text_bytes(v: &[String]) -> usize {
+    v.iter().fold(0usize, |n, t| n.saturating_add(t.len()).saturating_add(std::mem::size_of::<String>()))
+}
+
+/// Charge the replacement of the text `old` selects from field `name` with `new_bytes` of text to
+/// the run's retained-text budget; an assignment the budget has no room for is an error and
+/// charges nothing.
+pub(crate) fn charge(ctx: &Context, name: &FieldKey, old: impl FnOnce(&FieldState) -> usize, new_bytes: usize) -> JsResult<()> {
+    let i = field_index(ctx, name)?;
+    let mut h = host(ctx)?.borrow_mut();
+    let freed = old(&h.fields[i]);
+    let total = h.retained.saturating_sub(freed).saturating_add(new_bytes);
+    if total > xfa::MAX_PAYLOAD {
+        return Err(error(format!("the fields' values and colours hold more than {} bytes of text", xfa::MAX_PAYLOAD)));
+    }
+    h.retained = total;
+    Ok(())
+}
+
+pub(crate) fn kind_of(ctx: &Context, name: &FieldKey) -> JsResult<FieldType> {
+    let i = field_index(ctx, name)?;
+    Ok(host(ctx)?.borrow().fields[i].kind)
+}
+
+/// What a field of `kind` keeps of the values assigned to it.
+pub(crate) fn value_for(kind: FieldType, vals: Vec<String>) -> Vec<String> {
+    match kind {
         FieldType::CheckBox | FieldType::RadioButton => vals.into_iter().filter(|v| v != "Off" && !v.is_empty()).take(1).collect(),
         FieldType::ListBox => vals,
         _ => vals.into_iter().take(1).collect(),
-    };
+    }
+}
+
+pub(crate) fn set_value(f: &mut FieldState, vals: Vec<String>) {
+    f.value = value_for(f.kind, vals);
+}
+
+#[cfg(test)]
+mod string_budget_review_tests {
+    use super::*;
+    #[test]
+    fn escaped_text_budget_counts_exact_utf8_bytes() {
+        let mut ctx = Context::default();
+        for (script, bytes) in [("'ascii'", 5), ("'é'", 2), ("'😀'", 4), ("'\\uD800'", 6)] {
+            let value = ctx.eval(boa_engine::Source::from_bytes(script)).unwrap();
+            let expected = text(&value, &mut ctx).unwrap();
+            assert_eq!(expected.len(), bytes);
+            assert_eq!(text_with_budget(&value, &mut ctx, bytes, "text limit").unwrap(), expected);
+            assert!(text_with_budget(&value, &mut ctx, bytes - 1, "text limit").is_err());
+        }
+        assert_eq!(text_with_budget(&JsValue::null(), &mut ctx, 0, "text limit").unwrap(), "");
+    }
 }
diff --git a/crates/js/src/icons.rs b/crates/js/src/icons.rs
new file mode 100644
index 0000000000..f56ec9769f
--- /dev/null
+++ b/crates/js/src/icons.rs
@@ -0,0 +1,59 @@
+//! Document-bound icon handles. Only object identities minted by this host are accepted.
+use crate::host::{FieldKey, arg, error, host, read, write};
+use crate::{Attribute, Context, JsObject, JsResult, JsValue, ObjectInitializer};
+
+/// Accept omitted/normal face zero only; reject unsupported icon states before touching a field.
+fn normal_face(args: &[JsValue], index: usize, c: &mut Context) -> JsResult<()> {
+    if let Some(face) = args.get(index)
+        && !face.is_undefined()
+        && face.to_number(c)? != 0.0
+    {
+        return Err(error("only normal icon face 0 is supported"));
+    }
+    Ok(())
+}
+/// Return a context-minted normal-icon handle, reusing object identity and enforcing the handle limit.
+pub(crate) fn get(_: &JsValue, args: &[JsValue], name: &FieldKey, c: &mut Context) -> JsResult<JsValue> {
+    normal_face(args, 0, c)?;
+    let f = read(c, name)?;
+    if f.kind != crate::FieldType::Button {
+        return Err(error("icons require a push button"));
+    }
+    let Some(id) = f.icon else { return Ok(JsValue::null()) };
+    if let Some((obj, _)) = host(c)?.borrow().icons.iter().find(|(_, i)| *i == id) {
+        return Ok(obj.clone().into());
+    }
+    if host(c)?.borrow().icons.len() >= 4096 {
+        return Err(error("too many icon handles"));
+    }
+    let obj = ObjectInitializer::new(c).property(crate::js_string!("name"), JsValue::null(), Attribute::READONLY).build();
+    host(c)?.borrow_mut().icons.push((obj.clone(), id));
+    Ok(obj.into())
+}
+/// Stage a normal-icon copy/clear only for a handle minted in this context, refusing forged objects.
+pub(crate) fn set(_: &JsValue, args: &[JsValue], name: &FieldKey, c: &mut Context) -> JsResult<JsValue> {
+    normal_face(args, 1, c)?;
+    if read(c, name)?.kind != crate::FieldType::Button {
+        return Err(error("icons require a push button"));
+    }
+    let value = arg(args, 0);
+    let id = if value.is_null() {
+        None
+    } else {
+        let object = value.as_object().ok_or_else(|| error("buttonSetIcon requires an icon from this document"))?;
+        Some(
+            host(c)?
+                .borrow()
+                .icons
+                .iter()
+                .find(|(o, _)| JsObject::equals(o, &object))
+                .map(|(_, i)| *i)
+                .ok_or_else(|| error("buttonSetIcon requires an icon from this document"))?,
+        )
+    };
+    write(c, name, |f| {
+        f.icon = id;
+        f.icon_written = true;
+    })?;
+    Ok(JsValue::undefined())
+}
diff --git a/crates/js/src/interaction.rs b/crates/js/src/interaction.rs
new file mode 100644
index 0000000000..525acf930a
--- /dev/null
+++ b/crates/js/src/interaction.rs
@@ -0,0 +1,203 @@
+//! Bounded synchronous script prompts. The worker waits; the UI never evaluates script text.
+use crate::host::{arg, error, s, text_with_budget};
+use crate::{Context, JsArray, JsResult, JsValue, Outcome, js_string};
+use std::cell::RefCell;
+use std::sync::mpsc::{self, Sender};
+#[derive(Clone, Debug, PartialEq)]
+pub struct MenuItem {
+    pub name: String,
+    pub value: String,
+    pub enabled: bool,
+    pub marked: bool,
+    pub children: Vec<MenuItem>,
+}
+#[derive(Clone, Debug, PartialEq)]
+pub enum Prompt {
+    Menu(Vec<MenuItem>),
+    Text { title: String, question: String, default: String, password: bool, label: String },
+    Alert(crate::Message),
+}
+pub enum InteractiveEvent {
+    Prompt(Prompt, Sender<Option<String>>),
+    Complete(Outcome),
+}
+thread_local! { static HOST:RefCell<Option<(Sender<InteractiveEvent>,usize)>>=const {RefCell::new(None)}; }
+/// Tell alert/menu helpers whether this worker has an interactive or deterministic reply channel.
+pub(crate) fn has_host() -> bool {
+    HOST.with(|h| h.borrow().is_some())
+}
+#[cfg(not(target_arch = "wasm32"))]
+/// Install or clear the worker-local prompt channel and reset the per-invocation prompt budget.
+pub(crate) fn set_host(host: Option<Sender<InteractiveEvent>>) {
+    HOST.with(|h| *h.borrow_mut() = host.map(|h| (h, 0)));
+}
+/// Send a bounded prompt and await its reply, treating disconnect/timeout as cancellation.
+pub(crate) fn ask(prompt: Prompt) -> JsResult<Option<String>> {
+    let sender = HOST.with(|h| {
+        let mut h = h.borrow_mut();
+        let Some((tx, n)) = h.as_mut() else { return Ok(None) };
+        if *n >= 32 {
+            return Err(error("too many interactive prompts"));
+        }
+        *n += 1;
+        Ok(Some(tx.clone()))
+    })?;
+    let Some(sender) = sender else { return Ok(None) };
+    let (tx, rx) = mpsc::channel();
+    sender.send(InteractiveEvent::Prompt(prompt, tx)).map_err(|_| error("interactive host closed"))?;
+    let answer = rx.recv_timeout(std::time::Duration::from_secs(300)).ok().flatten();
+    if answer.as_ref().is_some_and(|s| s.len() > 4096) {
+        return Err(error("interactive response exceeds its limit"));
+    }
+    Ok(answer)
+}
+/// Reject prompt text before copying beyond the public per-property byte limit.
+fn menu_text(value: &JsValue, ctx: &mut Context) -> JsResult<String> {
+    text_with_budget(value, ctx, 4096, "popup menu text exceeds its limit")
+}
+fn response_text(value: &JsValue, ctx: &mut Context) -> JsResult<String> {
+    text_with_budget(value, ctx, 4096, "response dialog text exceeds its limit")
+}
+/// Parse one menu subtree with shared entry/depth/string budgets before exposing it to a host.
+fn read_menu(value: &JsValue, ctx: &mut Context, depth: usize, remaining: &mut usize) -> JsResult<MenuItem> {
+    if depth > 16 || *remaining == 0 {
+        return Err(error("popup menu exceeds its size or depth limit"));
+    }
+    *remaining -= 1;
+    let obj = value.as_object().ok_or_else(|| error("popup menu item must be an object"))?;
+    let name = menu_text(&obj.get(js_string!("cName"), ctx)?, ctx)?;
+    let ret = obj.get(js_string!("cReturn"), ctx)?;
+    let value = if ret.is_undefined() { name.clone() } else { menu_text(&ret, ctx)? };
+    let enabled = obj.get(js_string!("bEnabled"), ctx)?;
+    let marked = obj.get(js_string!("bMarked"), ctx)?.to_boolean();
+    let sub = obj.get(js_string!("oSubMenu"), ctx)?;
+    let mut children = Vec::new();
+    if let Some(o) = sub.as_object() {
+        if o.is_array() {
+            let array = JsArray::from_object(o.clone())?;
+            let len = array.length(ctx)?;
+            if len > *remaining as u64 {
+                return Err(error("popup menu has too many entries"));
+            }
+            for i in 0..len {
+                children.push(read_menu(&array.get(i, ctx)?, ctx, depth + 1, remaining)?);
+            }
+        } else {
+            children.push(read_menu(&sub, ctx, depth + 1, remaining)?);
+        }
+    } else if !sub.is_undefined() && !sub.is_null() {
+        return Err(error("invalid popup submenu"));
+    }
+    Ok(MenuItem { name, value, enabled: enabled.is_undefined() || enabled.to_boolean(), marked, children })
+}
+
+/// Accept only a matching enabled leaf whose ancestors are also enabled, excluding separators.
+fn allowed(items: &[MenuItem], value: &str) -> bool {
+    items.iter().any(|i| i.enabled && i.name != "-" && if i.children.is_empty() { i.value == value } else { allowed(&i.children, value) })
+}
+/// Parse and display a bounded popup, returning null on cancel and refusing invalid host choices.
+pub(crate) fn popup_menu(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    let mut remaining = 1024;
+    let mut items = Vec::new();
+    for a in args {
+        items.push(read_menu(a, ctx, 0, &mut remaining)?);
+    }
+    match ask(Prompt::Menu(items.clone()))? {
+        Some(answer) if allowed(&items, &answer) => Ok(s(&answer)),
+        Some(_) => Err(error("invalid popup menu selection")),
+        None => Ok(JsValue::null()),
+    }
+}
+/// Read named or positional input parameters and return bounded text or null on cancellation.
+pub(crate) fn response(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    let a = arg(args, 0);
+    let (question, title, default, password, label) = if let Some(o) = a.as_object() {
+        (
+            response_text(&o.get(js_string!("cQuestion"), ctx)?, ctx)?,
+            response_text(&o.get(js_string!("cTitle"), ctx)?, ctx)?,
+            response_text(&o.get(js_string!("cDefault"), ctx)?, ctx)?,
+            o.get(js_string!("bPassword"), ctx)?.to_boolean(),
+            response_text(&o.get(js_string!("cLabel"), ctx)?, ctx)?,
+        )
+    } else {
+        (
+            response_text(&a, ctx)?,
+            response_text(&arg(args, 1), ctx)?,
+            response_text(&arg(args, 2), ctx)?,
+            arg(args, 3).to_boolean(),
+            response_text(&arg(args, 4), ctx)?,
+        )
+    };
+    Ok(ask(Prompt::Text { question, title, default, password, label })?.map_or_else(JsValue::null, |v| s(&v)))
+}
+
+#[cfg(test)]
+mod budget_tests {
+    use super::*;
+    /// Reject an oversized question before evaluating or copying any later property.
+    #[test]
+    fn response_refuses_text_before_reading_later_properties() {
+        let mut ctx = Context::default();
+        let input = ctx.eval(crate::Source::from_bytes("({cQuestion:'x'.repeat(4097),get cTitle(){throw Error('later property read');}})")).unwrap();
+        let error = response(&JsValue::undefined(), &[input], &mut ctx).unwrap_err().to_string();
+        assert!(error.contains("response dialog text exceeds its limit"), "{error}");
+        assert!(!error.contains("later property"));
+    }
+    /// Menu labels must fail before an oversized return value's getter is invoked.
+    #[test]
+    fn menu_refuses_name_before_reading_return_value() {
+        let mut ctx = Context::default();
+        let input = ctx.eval(crate::Source::from_bytes("({cName:'x'.repeat(4097),get cReturn(){throw Error('later property read');}})")).unwrap();
+        let mut remaining = 1024;
+        let error = read_menu(&input, &mut ctx, 0, &mut remaining).unwrap_err().to_string();
+        assert!(error.contains("popup menu text exceeds its limit"), "{error}");
+        assert!(!error.contains("later property"));
+    }
+}
+
+#[cfg(test)]
+mod text_boundary_tests {
+    use super::*;
+    #[test]
+    fn prompt_conversions_preserve_exact_unicode_and_user_exceptions() {
+        let mut ctx = Context::default();
+        for (unit, count) in [("a", 4096), ("é", 2048), ("😀", 1024)] {
+            let text = unit.repeat(count);
+            let value = s(&text);
+            assert_eq!(menu_text(&value, &mut ctx).unwrap(), text);
+            assert_eq!(response_text(&value, &mut ctx).unwrap(), text);
+            assert!(menu_text(&s(&(text.clone() + "x")), &mut ctx).is_err());
+            assert!(response_text(&s(&(text + "x")), &mut ctx).is_err());
+        }
+        let surrogate = ctx.eval(crate::Source::from_bytes("'\\uD800'.repeat(682)+'xxxx'")).unwrap();
+        assert_eq!(response_text(&surrogate, &mut ctx).unwrap().len(), 4096);
+        let too_many = ctx.eval(crate::Source::from_bytes("'\\uD800'.repeat(683)")).unwrap();
+        assert!(response_text(&too_many, &mut ctx).is_err());
+        let throwing = ctx.eval(crate::Source::from_bytes("({toString(){throw Error('original conversion failure');}})")).unwrap();
+        assert!(response_text(&throwing, &mut ctx).unwrap_err().to_string().contains("original conversion failure"));
+        assert_eq!(response_text(&JsValue::null(), &mut ctx).unwrap(), "");
+    }
+    #[test]
+    fn all_prompt_text_properties_and_positional_arguments_are_bounded() {
+        let mut ctx = Context::default();
+        for key in ["cQuestion", "cTitle", "cDefault", "cLabel"] {
+            let script = format!("({{{key}:'x'.repeat(4097)}})");
+            let input = ctx.eval(crate::Source::from_bytes(script.as_bytes())).unwrap();
+            assert!(response(&JsValue::undefined(), &[input], &mut ctx).unwrap_err().to_string().contains("response dialog text exceeds its limit"));
+        }
+        for index in [0, 1, 2, 4] {
+            let mut args = vec![JsValue::undefined(); 5];
+            args[index] = s(&"x".repeat(4097));
+            assert!(response(&JsValue::undefined(), &args, &mut ctx).is_err());
+        }
+        let input = ctx.eval(crate::Source::from_bytes("({cName:'ok',cReturn:'x'.repeat(4097)})")).unwrap();
+        assert!(read_menu(&input, &mut ctx, 0, &mut 1024).is_err());
+        // Four independently valid text properties remain supported; no new shared 4096-byte cap.
+        let input = ctx
+            .eval(crate::Source::from_bytes(
+                "({cQuestion:'x'.repeat(4096),cTitle:'x'.repeat(4096),cDefault:'x'.repeat(4096),cLabel:'x'.repeat(4096)})",
+            ))
+            .unwrap();
+        assert!(response(&JsValue::undefined(), &[input], &mut ctx).unwrap().is_null());
+    }
+}
diff --git a/crates/js/src/lib.rs b/crates/js/src/lib.rs
index 1c0fe24f7b..87bb881e13 100644
--- a/crates/js/src/lib.rs
+++ b/crates/js/src/lib.rs
@@ -12,11 +12,14 @@
 //! - Field objects: `name`, `type`, `value`, `valueAsString`, `defaultValue`, `readonly`,
 //!   `required`, `display`, `hidden`, `numItems`, `getItemAt`, `currentValueIndices`,
 //!   `isBoxChecked`, `checkThisBox`, `exportValues`, `charLimit`, `textColor`, `fillColor`,
-//!   `setFocus`.
+//!   `setFocus`, `rect`, appearance properties, and normal button caption/icon methods.
 //! - `app` (`alert`, `beep`, `response`, `launchURL`, `execMenuItem`, `viewerType`, `viewerVersion`,
 //!   `platform`, `setTimeOut`), `util` (`printf`, `printd`, `printx`, `scand`), `console` (`println`,
 //!   `show`, `clear`), `display` and `color`.
 //!
+//! The native engine uses [`session::ScriptSession`] to preserve document globals across events.
+//! Stateless runners remain available for callers that need isolation per invocation.
+//!
 //! The engine is a sandbox: no file, network or timer access exists, and loops and recursion
 //! are bounded. Side effects (alerts, field changes, resets, printing, navigation) are returned
 //! in an [`Outcome`] for the caller to apply.
@@ -39,7 +42,9 @@ mod format;
 mod globals;
 mod host;
 mod model;
+mod nesting;
 mod run;
+mod source;
 
 #[cfg(test)]
 pub(crate) use format::PRINTD_SCANNED;
@@ -56,7 +61,7 @@ pub use model::{
 use run::SCRIPT_STACK;
 use run::refuse;
 pub(crate) use run::{CheckedCodeFromStrings, MAX_SCRIPT_BYTES};
-pub use run::{run, run_shared, run_shared_calculations, run_shared_calculations_shared};
+pub use run::{run, run_shared, run_shared_calculations};
 
 pub mod formcalc;
 pub mod xfa;
@@ -64,3 +69,14 @@ pub mod xfa_session;
 
 #[cfg(test)]
 mod tests;
+
+mod geometry;
+pub use geometry::{rotate_rect, unrotate_rect};
+
+mod icons;
+
+pub mod interaction;
+pub mod session;
+
+/// Maximum reset calls admitted by one document invocation, before argument conversion or field scans.
+pub const MAX_RESET_CALLS: usize = 64;
diff --git a/crates/js/src/model.rs b/crates/js/src/model.rs
index 6314adbfa2..b162007420 100644
--- a/crates/js/src/model.rs
+++ b/crates/js/src/model.rs
@@ -37,11 +37,17 @@ pub const DISPLAY_NO_VIEW: i32 = 3;
 #[derive(Clone, Debug, PartialEq)]
 pub struct FieldState {
     pub name: String,
+    /// Stable PDF object identity, absent for synthetic name-only callers.
+    pub object_id: Option<u64>,
+    /// Runtime instance token; retired field references cannot alias reused PDF numbers.
+    pub instance_id: u64,
     pub kind: FieldType,
     /// Text: the text. Check box / radio: the selected export value (empty when off). Choice:
     /// the selected export values.
     pub value: Vec<String>,
     pub default: Vec<String>,
+    /// False when a PDF default stream was not decoded; reset must preserve the live value.
+    pub default_known: bool,
     pub readonly: bool,
     pub required: bool,
     pub display: i32,
@@ -50,19 +56,42 @@ pub struct FieldState {
     pub options: Vec<(String, String)>,
     pub char_limit: Option<usize>,
     /// `textColor` / `fillColor` as Acrobat colour arrays (`["RGB", r, g, b]` etc.), when set.
-    pub text_color: Option<Vec<String>>,
-    pub fill_color: Option<Vec<String>>,
-    /// Rectangle of the first widget, in PDF user space.
+    pub text_color: Option<std::sync::Arc<[String]>>,
+    pub fill_color: Option<std::sync::Arc<[String]>>,
+    /// Normal push-button caption, when this is a button.
+    pub caption: Option<String>,
+    /// A setter ran, even if its text equals widget 0: other widgets may differ.
+    pub caption_written: bool,
     pub rect: Option<[f64; 4]>,
+    pub page_rotation: i64,
+    pub page_crop: [f64; 4],
+    pub stroke_color: Option<std::sync::Arc<[String]>>,
+    pub text_size: f64,
+    pub line_width: f64,
+    pub border_style: String,
+    pub user_name: String,
+    pub icon: Option<u64>,
+    pub caption_mixed: bool,
+    pub icon_mixed: bool,
+    pub icon_written: bool,
+    /// JavaScript actions a script installed with `setAction` during this run, by trigger
+    /// (`MouseUp`, `MouseDown`, `MouseEnter`, `MouseExit`, `OnFocus`, `OnBlur`, `Keystroke`,
+    /// `Validate`, `Calculate`, `Format`), the last one for each trigger. Empty in a snapshot:
+    /// the host reads the document's own actions from the PDF.
+    pub actions: Vec<(String, String)>,
 }
 
 impl FieldState {
+    /// Construct a field snapshot with explicit defaults for optional appearance and interaction state.
     pub fn new(name: impl Into<String>, kind: FieldType, value: Vec<String>) -> FieldState {
         FieldState {
             name: name.into(),
+            object_id: None,
+            instance_id: 0,
             kind,
             value,
             default: Vec::new(),
+            default_known: true,
             readonly: false,
             required: false,
             display: DISPLAY_VISIBLE,
@@ -70,7 +99,21 @@ impl FieldState {
             char_limit: None,
             text_color: None,
             fill_color: None,
+            caption: None,
+            caption_written: false,
             rect: None,
+            page_rotation: 0,
+            page_crop: [0.0; 4],
+            stroke_color: None,
+            text_size: 0.0,
+            line_width: 1.0,
+            border_style: "solid".into(),
+            user_name: String::new(),
+            icon: None,
+            caption_mixed: false,
+            icon_mixed: false,
+            icon_written: false,
+            actions: Vec::new(),
         }
     }
 
@@ -88,6 +131,8 @@ pub struct Event {
     pub kind: String,
     /// The field the event is for.
     pub target: Option<String>,
+    /// Identity for an unambiguous event.target, even with duplicate field names.
+    pub target_id: Option<u64>,
     pub value: String,
     pub change: String,
     pub will_commit: bool,
@@ -96,18 +141,38 @@ pub struct Event {
 impl Event {
     /// A field event (`event.type` = "Field").
     pub fn field(name: &str, target: &str, value: &str) -> Event {
-        Event { name: name.into(), kind: "Field".into(), target: Some(target.into()), value: value.into(), change: String::new(), will_commit: true }
+        Event {
+            name: name.into(),
+            kind: "Field".into(),
+            target: Some(target.into()),
+            target_id: None,
+            value: value.into(),
+            change: String::new(),
+            will_commit: true,
+        }
     }
 
     /// A document event (`event.type` = "Doc"), e.g. Open or WillSave.
     pub fn doc(name: &str) -> Event {
-        Event { name: name.into(), kind: "Doc".into(), target: None, value: String::new(), change: String::new(), will_commit: false }
+        Event {
+            name: name.into(),
+            kind: "Doc".into(),
+            target: None,
+            target_id: None,
+            value: String::new(),
+            change: String::new(),
+            will_commit: false,
+        }
     }
 }
 
 /// About the document, for `this.numPages`, `this.info` and the like.
 #[derive(Clone, Debug, Default, PartialEq)]
 pub struct DocInfo {
+    /// Changes when history can replace an icon object under the same PDF reference.
+    pub icon_epoch: u64,
+    /// Revisions of referenced icons that can change independently across history.
+    pub icon_versions: std::sync::Arc<std::collections::BTreeMap<u64, u64>>,
     pub file_name: String,
     pub num_pages: usize,
     /// The current page, 0-based.
@@ -118,10 +183,10 @@ pub struct DocInfo {
     pub page_boxes: Vec<[[f64; 4]; 5]>,
     /// Clockwise page rotations, normalized to 0, 90, 180 or 270 degrees.
     pub page_rotations: Vec<i64>,
-    /// Whether the viewer highlights form fields (`app.runtimeHighlight`).
-    pub highlight: bool,
     /// The document has an XFA form, so scripts see `xfa_installed`.
     pub xfa: bool,
+    pub zoom: f64,
+    pub runtime_highlight: bool,
 }
 
 /// The icon a script's message shows: `app.alert`'s `nIcon` and `xfa.host.messageBox`'s
@@ -242,7 +307,14 @@ pub enum Request {
     Submit(String),
     /// `field.setFocus()`.
     Focus(String),
+    /// Focus a specific AcroForm field when several fields share its name.
+    FocusField {
+        name: String,
+        object_id: u64,
+    },
     Beep,
+    Zoom(f64),
+    Highlight(bool),
     /// `app.execMenuItem("SaveAs")` (XFA forms' Save buttons).
     SaveAs,
     /// `this.exportDataObject(cName, …, nLaunch)`: the attached file `name`, to open (`nLaunch`
@@ -251,8 +323,6 @@ pub enum Request {
         name: String,
         open: bool,
     },
-    /// `app.runtimeHighlight = on`: highlight the form's fields, or stop.
-    Highlight(bool),
     /// `app.execMenuItem("ShowHide…")`: show the side panel, or hide it when it is showing.
     ShowPanel(Panel),
 }
@@ -288,6 +358,14 @@ impl Panel {
 /// What running a script did.
 #[derive(Clone, Debug, Default, PartialEq)]
 pub struct Outcome {
+    /// The runtime could not execute the callback safely.
+    pub execution_refused: bool,
+    /// Execution was refused before invoking any code in the retained realm.
+    pub realm_untouched: bool,
+    /// Sticky admission failure: callers must not commit a partial run, even if JS caught the error.
+    pub reset_limit_exceeded: bool,
+    /// Calculation exhaustion rejects script writeback even if the script catches the error.
+    pub calculation_limit_exceeded: bool,
     /// `event.rc`: `false` rejects the keystroke or value.
     pub rc: bool,
     /// `event.value` after the script.
diff --git a/crates/js/src/nesting.rs b/crates/js/src/nesting.rs
new file mode 100644
index 0000000000..9f99c5351a
--- /dev/null
+++ b/crates/js/src/nesting.rs
@@ -0,0 +1,319 @@
+//! The nesting guard: whether a script nests deeper than boa's parser can take.
+//!
+//! boa parses by recursive descent with no depth limit of its own, and a stack overflow aborts
+//! the process (it is not a panic, so `catch_unwind` can't stop it). So every script is scanned
+//! before boa sees it, and one that nests too deeply is refused.
+//!
+//! A scan has to know which brackets are code, and that depends on where strings, templates,
+//! comments and regular expressions begin and end. Most of that follows from the bytes, but a
+//! `/` that isn't a comment is a division or the start of a regular expression depending on
+//! where the parser is, which a scan can't know. A scan that guesses can be put out of phase:
+//! after `/'/`, the quote in the regular expression made the real nesting that followed look
+//! like string text (#5079). So the scan doesn't guess. It follows every reading at once,
+//! splitting at each such `/` into a division and a regular expression, and counts nesting on
+//! each reading. boa's reading is always one of them, so the deepest is at least as deep as
+//! boa's. A reading boa would reject is dropped at the byte where boa stops with a syntax error
+//! (a string or regular expression running into a line break, a regular expression's groups not
+//! matching), which keeps divisions from leaving stray readings behind.
+
+/// Deepest nesting of `(`, `[`, `{` and template substitutions (`${`).
+pub(crate) const MAX_BRACKET_DEPTH: usize = 64;
+
+/// Longest run of prefix operators (`!`, `~`, `+`, `-`).
+pub(crate) const MAX_PREFIX_RUN: usize = 64;
+
+/// Most `?` (conditional expressions nest without brackets).
+pub(crate) const MAX_CONDITIONALS: usize = 4096;
+
+/// Most readings followed at once. Readings that differ only in their counts are merged first,
+/// keeping the larger counts; past this, the script is refused.
+const MAX_READINGS: usize = 16;
+
+/// Where a reading is in the script.
+#[derive(Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Debug)]
+enum Mode {
+    Code,
+    /// In a string that this quote closes.
+    Str(u8),
+    /// In a template's text: after its backtick, or after a substitution's closing `}`.
+    Template,
+    /// In a regular expression literal: in a class (`[...]`), and the groups open outside one.
+    Regex {
+        class: bool,
+        groups: usize,
+    },
+    /// In a `//`, `<!--` or `-->` comment, to the end of the line.
+    LineComment,
+    /// In a `/* */` comment.
+    BlockComment,
+}
+
+/// One way of reading the script, and what it has counted so far.
+#[derive(Clone, PartialEq, Eq, PartialOrd, Ord, Debug)]
+struct Reading {
+    mode: Mode,
+    /// Bytes to pass over: the rest of a two-byte token, or what a backslash escapes.
+    skip: usize,
+    /// For each open template substitution, the braces open inside it, so the `}` that closes
+    /// the substitution is told from one that closes a block.
+    substitutions: Vec<usize>,
+    depth: usize,
+    prefix: usize,
+    conditionals: usize,
+}
+
+impl Reading {
+    fn in_code() -> Self {
+        Self { mode: Mode::Code, skip: 0, substitutions: Vec::new(), depth: 0, prefix: 0, conditionals: 0 }
+    }
+
+    fn with_mode(&self, mode: Mode) -> Self {
+        Self { mode, ..self.clone() }
+    }
+
+    fn over_limit(&self) -> bool {
+        self.depth > MAX_BRACKET_DEPTH || self.prefix > MAX_PREFIX_RUN || self.conditionals > MAX_CONDITIONALS
+    }
+
+    fn open(&mut self) {
+        self.depth = self.depth.saturating_add(1);
+        self.prefix = 0;
+    }
+
+    fn close(&mut self) {
+        self.depth = self.depth.saturating_sub(1);
+        self.prefix = 0;
+    }
+
+    /// Read byte `i` of `b`. A second reading that splits off here goes to `forks`. Returns
+    /// false when boa would stop with a syntax error at this byte, ending this reading.
+    fn advance(&mut self, b: &[u8], i: usize, forks: &mut Vec<Reading>) -> bool {
+        if self.skip > 0 {
+            self.skip -= 1;
+            return true;
+        }
+        let Some(&c) = b.get(i) else { return true };
+        match self.mode {
+            Mode::Code => {
+                self.code(c, b, i, forks);
+                true
+            }
+            Mode::Str(quote) => self.string(quote, c, b, i),
+            Mode::Template => {
+                self.template(c, b, i);
+                true
+            }
+            Mode::Regex { class, groups } => self.regex(class, groups, c, b, i),
+            Mode::LineComment => {
+                let n = line_break(b, i);
+                if n > 0 {
+                    self.mode = Mode::Code;
+                    self.skip = n - 1;
+                }
+                true
+            }
+            Mode::BlockComment => {
+                if c == b'*' && at(b, i + 1, b"/") {
+                    self.mode = Mode::Code;
+                    self.skip = 1;
+                }
+                true
+            }
+        }
+    }
+
+    fn code(&mut self, c: u8, b: &[u8], i: usize, forks: &mut Vec<Reading>) {
+        match c {
+            b'\'' | b'"' => {
+                self.mode = Mode::Str(c);
+                self.prefix = 0;
+            }
+            b'`' => {
+                self.mode = Mode::Template;
+                self.prefix = 0;
+            }
+            b'/' if at(b, i + 1, b"/") => self.mode = Mode::LineComment,
+            b'/' if at(b, i + 1, b"*") => {
+                self.mode = Mode::BlockComment;
+                self.skip = 1;
+            }
+            b'/' => {
+                // A division, or the start of a regular expression: the parser decides, so
+                // follow both.
+                forks.push(self.with_mode(Mode::Regex { class: false, groups: 0 }));
+                self.prefix = 0;
+            }
+            b'(' | b'[' => self.open(),
+            b'{' => {
+                if let Some(open) = self.substitutions.last_mut() {
+                    *open = open.saturating_add(1);
+                }
+                self.open();
+            }
+            b')' | b']' => self.close(),
+            b'}' => {
+                self.close();
+                if self.substitutions.last() == Some(&0) {
+                    self.substitutions.pop();
+                    self.mode = Mode::Template;
+                } else if let Some(open) = self.substitutions.last_mut() {
+                    *open = open.saturating_sub(1);
+                }
+            }
+            b'!' | b'~' | b'+' | b'-' => {
+                // `-->` begins a comment at the start of a line (Annex B); followed anywhere.
+                if c == b'-' && at(b, i + 1, b"->") {
+                    forks.push(self.with_mode(Mode::LineComment));
+                }
+                self.prefix = self.prefix.saturating_add(1);
+            }
+            b'?' => {
+                self.conditionals = self.conditionals.saturating_add(1);
+                self.prefix = 0;
+            }
+            // `<!--` begins a comment (Annex B, in scripts); followed both ways.
+            b'<' if at(b, i + 1, b"!--") => {
+                forks.push(self.with_mode(Mode::LineComment));
+                self.prefix = 0;
+            }
+            // Whitespace and line breaks, and any non-ASCII byte, which may be part of either,
+            // leave a run of prefix operators going.
+            _ if c.is_ascii_whitespace() || !c.is_ascii() => {}
+            _ => self.prefix = 0,
+        }
+    }
+
+    /// In a string closed by `quote`. False at a line break boa rejects.
+    fn string(&mut self, quote: u8, c: u8, b: &[u8], i: usize) -> bool {
+        if c == quote {
+            self.mode = Mode::Code;
+            self.prefix = 0;
+        } else if c == b'\\' {
+            // An escape, or a line continuation (`\` and a line break, CR LF included).
+            self.skip = line_break(b, i + 1).max(1);
+        } else if c == b'\n' || c == b'\r' {
+            // U+2028 and U+2029 may stand in a string; LF and CR may not.
+            return false;
+        }
+        true
+    }
+
+    fn template(&mut self, c: u8, b: &[u8], i: usize) {
+        if c == b'`' {
+            self.mode = Mode::Code;
+            self.prefix = 0;
+        } else if c == b'\\' {
+            self.skip = 1;
+        } else if c == b'$' && at(b, i + 1, b"{") {
+            self.substitutions.push(0);
+            self.open();
+            self.mode = Mode::Code;
+            self.skip = 1;
+        }
+    }
+
+    /// In a regular expression literal. False where boa rejects it: a line break, or groups
+    /// that don't match (boa checks the pattern as it reads the literal).
+    fn regex(&mut self, class: bool, groups: usize, c: u8, b: &[u8], i: usize) -> bool {
+        if line_break(b, i) > 0 || (c == b'\\' && line_break(b, i + 1) > 0) {
+            return false;
+        }
+        match (c, class) {
+            (b'\\', _) => self.skip = 1,
+            (b']', true) => self.mode = Mode::Regex { class: false, groups },
+            (b'[', false) => self.mode = Mode::Regex { class: true, groups },
+            (b'(', false) => self.mode = Mode::Regex { class, groups: groups.saturating_add(1) },
+            (b')', false) if groups == 0 => return false,
+            (b')', false) => self.mode = Mode::Regex { class, groups: groups - 1 },
+            (b'/', false) if groups > 0 => return false,
+            (b'/', false) => {
+                self.mode = Mode::Code;
+                self.prefix = 0;
+            }
+            _ => {}
+        }
+        true
+    }
+}
+
+/// Whether `s` stands in `b` at `i`.
+fn at(b: &[u8], i: usize, s: &[u8]) -> bool {
+    b.get(i..).is_some_and(|rest| rest.starts_with(s))
+}
+
+/// How many bytes the line break at `i` takes: CR LF, LF, CR, U+2028 or U+2029. 0 if none.
+fn line_break(b: &[u8], i: usize) -> usize {
+    let rest = b.get(i..).unwrap_or_default();
+    if rest.starts_with(b"\r\n") {
+        2
+    } else if rest.starts_with(b"\n") || rest.starts_with(b"\r") {
+        1
+    } else if rest.starts_with("\u{2028}".as_bytes()) || rest.starts_with("\u{2029}".as_bytes()) {
+        3
+    } else {
+        0
+    }
+}
+
+/// Whether any reading of `source` nests brackets deeper than [`MAX_BRACKET_DEPTH`], runs more
+/// than [`MAX_PREFIX_RUN`] prefix operators together, or has more than [`MAX_CONDITIONALS`]
+/// conditionals; or the script has more ambiguous readings than the scan follows.
+pub(crate) fn too_deep(source: &str) -> bool {
+    let b = source.as_bytes();
+    // A leading `#!` is a hashbang comment: boa parses scripts and eval code from a goal that
+    // allows one. Read as code it could only be a syntax error (`#` must start a private name).
+    let first = if b.starts_with(b"#!") { Mode::LineComment } else { Mode::Code };
+    let mut readings = vec![Reading::in_code().with_mode(first)];
+    let mut next = Vec::with_capacity(MAX_READINGS + 1);
+    for i in 0..b.len() {
+        let mut ended: Option<Reading> = None;
+        for mut r in readings.drain(..) {
+            if r.advance(b, i, &mut next) {
+                next.push(r);
+            } else {
+                ended = Some(match ended {
+                    Some(e) => merged(e, &r),
+                    None => r,
+                });
+            }
+        }
+        if next.is_empty() {
+            // Every reading ends in a syntax error here, so boa stops by this byte. Carry on as
+            // code anyway, with the largest counts, rather than stop checking.
+            let ended = ended.unwrap_or_else(Reading::in_code);
+            next.push(Reading { mode: Mode::Code, skip: 0, ..ended });
+        }
+        if next.iter().any(Reading::over_limit) {
+            return true;
+        }
+        if next.len() > 1 && !settle(&mut next) {
+            return true;
+        }
+        std::mem::swap(&mut readings, &mut next);
+    }
+    false
+}
+
+/// `a` with the larger of each count in `a` and `b`.
+fn merged(a: Reading, b: &Reading) -> Reading {
+    Reading { depth: a.depth.max(b.depth), prefix: a.prefix.max(b.prefix), conditionals: a.conditionals.max(b.conditionals), ..a }
+}
+
+/// Drop duplicate readings, then merge those in the same place if there are too many. False if
+/// there are still too many to follow.
+fn settle(readings: &mut Vec<Reading>) -> bool {
+    readings.sort_unstable();
+    readings.dedup();
+    if readings.len() > MAX_READINGS {
+        // Sorted, readings in the same place are next to each other. Merging keeps the larger
+        // counts, so it can only refuse more.
+        readings.dedup_by(|r, kept| {
+            let same = r.mode == kept.mode && r.skip == kept.skip && r.substitutions == kept.substitutions;
+            if same {
+                *kept = merged(kept.clone(), r);
+            }
+            same
+        });
+    }
+    readings.len() <= MAX_READINGS
+}
diff --git a/crates/js/src/run.rs b/crates/js/src/run.rs
index 8f760f8130..7019bd768c 100644
--- a/crates/js/src/run.rs
+++ b/crates/js/src/run.rs
@@ -1,7 +1,7 @@
 use super::globals::{event_object, install};
-use super::host::{Host, Shared, text};
+use super::host::{Host, Shared, host, text};
 use super::model::{DocInfo, Event, FieldState, Limits, Outcome};
-use super::{Arc, Attribute, BTreeSet, Context, HostHooks, JsNativeError, JsResult, JsString, Realm, RefCell, Source, js_string};
+use super::{Arc, BTreeSet, Context, HostHooks, JsNativeError, JsResult, JsString, JsValue, NativeFunction, Realm, RefCell, Source, js_string};
 
 /// Longest script, in bytes.
 pub(crate) const MAX_SCRIPT_BYTES: usize = 256 * 1024;
@@ -19,86 +19,48 @@ pub(crate) const MAX_ARRAY_LENGTH: u64 = 1 << 20;
 /// Maximum calculated field scripts evaluated by `calculateNow()` during one JavaScript run.
 pub(crate) const MAX_CALCULATE_STEPS: usize = 4096;
 
-/// Deepest nesting of `(`, `[` and `{`.
-const MAX_BRACKET_DEPTH: usize = 64;
+// The retained document realm also bounds the chains boa's parser descends without brackets
+// (`preflight`); bracket, prefix and conditional limits are the nesting guard's.
+use crate::nesting::{MAX_BRACKET_DEPTH, MAX_CONDITIONALS, MAX_PREFIX_RUN};
 
-/// Longest run of prefix operators (`!`, `~`, `+`, `-`).
-const MAX_PREFIX_RUN: usize = 64;
+/// Longest active arrow-function chain across the currently open bracket levels.
+const MAX_ARROW_FUNCTIONS: usize = 256;
 
-/// Most `?` (conditional expressions nest without brackets).
-const MAX_CONDITIONALS: usize = 4096;
+/// Assignment and exponentiation associate right-to-left without increasing bracket depth.
+/// Bound active chains, rather than the total operators in independent statements.
+const MAX_RIGHT_ASSOCIATIVE_OPERATORS: usize = 4096;
 
 /// The script thread's stack.
 #[cfg(not(target_arch = "wasm32"))]
 pub(crate) const SCRIPT_STACK: usize = 1 << 30;
 
-/// Why `source` is refused, if it is: too long, or nested deeper than any form needs. Strings
-/// and comments are skipped; brackets in regular expressions and templates count, which only
-/// errs on the safe side.
+/// Persistent document-worker stack, bounded separately from transient legacy runners.
+/// Parser/compiler boundary and hostile-input regressions run through the real worker.
+#[cfg(not(target_arch = "wasm32"))]
+pub(crate) const DOCUMENT_WORKER_STACK: usize = 64 << 20;
+
+mod preflight;
+
+/// Why `source` is refused, if it is: too long, or nested deeper than any form needs, which
+/// would overflow the stack in boa's parser ([`crate::nesting`]), or with an arrow-function or
+/// right-associative chain longer than the document worker takes ([`preflight`]).
 pub(crate) fn refuse(source: &str) -> Option<String> {
     if source.len() > MAX_SCRIPT_BYTES {
         return Some(format!("the script is too long ({} KiB; the limit is {} KiB)", source.len() / 1024, MAX_SCRIPT_BYTES / 1024));
     }
-    let too_deep = || Some("the script is nested too deeply to run safely".to_string());
-    let b = source.as_bytes();
-    let (mut depth, mut prefix, mut conditionals) = (0usize, 0usize, 0usize);
-    let mut i = 0;
-    while let Some(&c) = b.get(i) {
-        i += 1;
-        match c {
-            b'\'' | b'"' => {
-                // To the closing quote (or the end of the line, where an unclosed string ends).
-                while let Some(&d) = b.get(i) {
-                    i += 1;
-                    if d == b'\\' {
-                        i += 1;
-                    } else if d == c || d == b'\n' {
-                        break;
-                    }
-                }
-                prefix = 0;
-            }
-            b'/' if b.get(i) == Some(&b'/') => {
-                while b.get(i).is_some_and(|d| *d != b'\n') {
-                    i += 1;
-                }
-            }
-            b'/' if b.get(i) == Some(&b'*') => {
-                i += 1;
-                while i < b.len() && !b[i..].starts_with(b"*/") {
-                    i += 1;
-                }
-                i += 2;
-            }
-            b'(' | b'[' | b'{' => {
-                depth += 1;
-                if depth > MAX_BRACKET_DEPTH {
-                    return too_deep();
-                }
-                prefix = 0;
-            }
-            b')' | b']' | b'}' => {
-                depth = depth.saturating_sub(1);
-                prefix = 0;
-            }
-            b'!' | b'~' | b'+' | b'-' => {
-                prefix += 1;
-                if prefix > MAX_PREFIX_RUN {
-                    return too_deep();
-                }
-            }
-            b'?' => {
-                conditionals += 1;
-                if conditionals > MAX_CONDITIONALS {
-                    return too_deep();
-                }
-                prefix = 0;
-            }
-            c if c.is_ascii_whitespace() => {}
-            _ => prefix = 0,
+    if crate::nesting::too_deep(source) {
+        return Some("the script is nested too deeply to run safely".to_string());
+    }
+    // A leading `#!` line is a comment (the nesting guard reads it so); blank it for the chain
+    // scan, keeping its length.
+    match source.strip_prefix("#!") {
+        Some(rest) => {
+            let end = rest.find(['\n', '\r', '\u{2028}', '\u{2029}']).map_or(source.len(), |i| i + 2);
+            let blanked: String = source[..end].chars().map(|_| ' ').chain(source[end..].chars()).collect();
+            preflight::refuse(&blanked)
         }
+        None => preflight::refuse(source),
     }
-    None
 }
 
 /// Run `script` for `event`, after the document-level scripts (`doc_scripts`, which define the
@@ -111,31 +73,48 @@ pub fn run(script: &str, event: &Event, doc: &DocInfo, fields: &[FieldState], do
 /// context; the first field write copies the snapshot, so neither the caller nor another
 /// script can observe uncommitted writes. Read-only calculations avoid copying the whole form.
 pub fn run_shared(script: &str, event: &Event, doc: &DocInfo, fields: Arc<Vec<FieldState>>, doc_scripts: &[String], limits: Limits) -> Outcome {
-    run_shared_calculations(script, event, doc, fields, doc_scripts, &Arc::new(Vec::new()), limits)
+    run_shared_calculations(script, event, doc, fields, doc_scripts, &[], limits)
 }
 
 /// Like [`run_shared`], with the document's ordered calculated fields available to
-/// `calculateNow()` while this context is running.
+/// `calculateNow()` while this context is running. Each tuple contains the target
+/// position in `fields` and its source; the engine resolves positions by PDF object identity.
 pub fn run_shared_calculations(
     script: &str,
     event: &Event,
     doc: &DocInfo,
     fields: Arc<Vec<FieldState>>,
     doc_scripts: &[String],
-    calculations: &[(String, String)],
+    calculations: &[(usize, String)],
     limits: Limits,
 ) -> Outcome {
-    run_shared_calculations_shared(script, event, doc, fields, doc_scripts, &Arc::new(calculations.to_vec()), limits)
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        let english = crate::format::printd_english();
+        let failed =
+            |why: String| Outcome { rc: true, value: event.value.clone(), change: event.change.clone(), error: Some(why), ..Default::default() };
+        std::thread::scope(|scope| {
+            let spawned = std::thread::Builder::new().name("pdfcraft-js".into()).stack_size(SCRIPT_STACK).spawn_scoped(scope, || {
+                crate::format::with_english_printd(english, || run_shared_here(script, event, doc, fields, doc_scripts, calculations, limits))
+            });
+            match spawned {
+                Ok(thread) => thread.join().unwrap_or_else(|_| failed("the script stopped with an internal error".into())),
+                Err(e) => failed(format!("the script engine could not start: {e}")),
+            }
+        })
+    }
+    #[cfg(target_arch = "wasm32")]
+    run_shared_here(script, event, doc, fields, doc_scripts, calculations, limits)
 }
 
-/// Like [`run_shared_calculations`], sharing its ordered calculation scripts with the context.
-pub fn run_shared_calculations_shared(
+/// Run a snapshot in a fresh context on the calling thread, skipping document scripts that fail source preflight.
+pub(crate) fn run_shared_here(
     script: &str,
     event: &Event,
     doc: &DocInfo,
     fields: Arc<Vec<FieldState>>,
     doc_scripts: &[String],
-    calculations: &Arc<Vec<(String, String)>>,
+    calculations: &[(usize, String)],
     limits: Limits,
 ) -> Outcome {
     let failed = |why: String| Outcome { rc: true, value: event.value.clone(), change: event.change.clone(), error: Some(why), ..Default::default() };
@@ -156,31 +135,28 @@ pub fn run_shared_calculations_shared(
             None => Some((i, d.as_str())),
         })
         .collect();
-    let (kept, skipped) = (&kept, &skipped);
-    #[cfg(not(target_arch = "wasm32"))]
-    {
-        // The script's thread writes dates as this one asked (`with_english_printd`).
-        let english = crate::format::printd_english();
-        std::thread::scope(|scope| {
-            let spawned = std::thread::Builder::new().name("pdfcraft-js".into()).stack_size(SCRIPT_STACK).spawn_scoped(scope, || {
-                crate::format::with_english_printd(english, || {
-                    run_here(script, event, doc, fields, ScriptSetup { doc_scripts: kept, skipped, calculations }, limits)
-                })
-            });
-            match spawned {
-                Ok(thread) => thread.join().unwrap_or_else(|_| failed("the script stopped with an internal error".into())),
-                Err(e) => failed(format!("the script engine could not start: {e}")),
-            }
-        })
-    }
-    #[cfg(target_arch = "wasm32")]
-    run_here(script, event, doc, fields, ScriptSetup { doc_scripts: kept, skipped, calculations }, limits)
+    run_here(
+        script,
+        event,
+        doc,
+        fields,
+        ScriptSetup {
+            doc_scripts: &kept,
+            skipped: &skipped,
+            calculations,
+            initialize: true,
+            reset_calls: 0,
+            calculation_evaluations: 0,
+            calculation_limit_exceeded: false,
+        },
+        limits,
+    )
 }
 
 /// Host hooks that refuse to compile code from strings (`eval`, `Function` and its generator
 /// and async kin). Such code is built at run time, so it never passed [`refuse`], and boa's
 /// recursive parser would overflow the stack on a deeply nested one.
-struct NoCodeFromStrings;
+pub(crate) struct NoCodeFromStrings;
 
 impl HostHooks for NoCodeFromStrings {
     fn ensure_can_compile_strings(&self, _: Realm, _: &[JsString], _: &JsString, _: bool, _: &mut Context) -> JsResult<()> {
@@ -216,45 +192,106 @@ fn doc_error(index: usize, error: &dyn std::fmt::Display) -> String {
 
 /// `doc_scripts` are the document scripts to run with their places among all of them;
 /// `skipped` the ones refused before running, with the reason.
-struct ScriptSetup<'a> {
-    doc_scripts: &'a [(usize, &'a str)],
-    skipped: &'a [(usize, String)],
-    calculations: &'a Arc<Vec<(String, String)>>,
+pub(crate) struct ScriptSetup<'a> {
+    pub(crate) doc_scripts: &'a [(usize, &'a str)],
+    pub(crate) skipped: &'a [(usize, String)],
+    pub(crate) calculations: &'a [(usize, String)],
+    pub(crate) initialize: bool,
+    pub(crate) reset_calls: usize,
+    pub(crate) calculation_evaluations: usize,
+    pub(crate) calculation_limit_exceeded: bool,
 }
 
+/// Create a restricted temporary Boa context and convert initialization failures into script outcomes.
 fn run_here(script: &str, event: &Event, doc: &DocInfo, fields: Arc<Vec<FieldState>>, setup: ScriptSetup<'_>, limits: Limits) -> Outcome {
-    let mut ctx = match Context::builder().host_hooks(std::rc::Rc::new(NoCodeFromStrings)).build() {
-        Ok(ctx) => ctx,
-        Err(e) => {
-            let error = Some(format!("the script engine could not start: {e}"));
-            return Outcome { rc: true, value: event.value.clone(), change: event.change.clone(), error, ..Default::default() };
-        }
-    };
+    match Context::builder().host_hooks(std::rc::Rc::new(NoCodeFromStrings)).build() {
+        Ok(mut ctx) => run_in_context(&mut ctx, script, event, doc, fields, setup, limits),
+        Err(e) => Outcome { rc: true, error: Some(format!("the script engine could not start: {e}")), ..Default::default() },
+    }
+}
+
+/// Replace per-event host state, optionally initialize document scripts, and collect results within runtime limits.
+/// Drop the host's field snapshot once a job is over, keeping the rest of the retained host.
+pub(crate) fn release_fields(ctx: &Context) {
+    if let Ok(h) = host(ctx) {
+        h.borrow_mut().fields = Arc::new(Vec::new());
+    }
+}
+
+pub(crate) fn run_in_context(
+    ctx: &mut Context,
+    script: &str,
+    event: &Event,
+    doc: &DocInfo,
+    fields: Arc<Vec<FieldState>>,
+    setup: ScriptSetup<'_>,
+    limits: Limits,
+) -> Outcome {
     ctx.runtime_limits_mut().set_loop_iteration_limit(limits.loop_iterations);
     ctx.runtime_limits_mut().set_recursion_limit(limits.recursion);
+    let (icons, mut objects, cached_keys) = ctx
+        .remove_data::<Shared>()
+        .map(|h| {
+            let h = h.into_inner();
+            let mut icons = h.icons;
+            if h.doc.icon_epoch == doc.icon_epoch {
+                icons.retain(|(_, id)| h.doc.icon_versions.get(id) == doc.icon_versions.get(id));
+            } else {
+                icons.clear();
+            }
+            // The field identities are those of the previous job when every current key is one
+            // of its keys and there are as many (the previous snapshot itself is not retained).
+            let same_fields = h.field_keys.len() == fields.len()
+                && fields.iter().all(|f| h.field_keys.contains(&crate::host::field_cache_key(&f.name, f.object_id, f.instance_id)));
+            (icons, h.objects, same_fields.then_some(h.field_keys))
+        })
+        .unwrap_or_default();
+    let field_keys =
+        cached_keys.unwrap_or_else(|| fields.iter().map(|f| crate::host::field_cache_key(&f.name, f.object_id, f.instance_id)).collect());
+    objects.retain(|key, _| field_keys.contains(key));
     ctx.insert_data(RefCell::new(Host {
+        event_name: event.name.clone(),
         fields,
+        icons,
+        objects,
+        field_keys,
         changed: BTreeSet::new(),
         formatted: BTreeSet::new(),
         alerts: Vec::new(),
         console: Vec::new(),
         requests: Vec::new(),
         doc: doc.clone(),
-        calculations: Arc::clone(setup.calculations),
+        calculations: setup.calculations.to_vec(),
         calculate_depth: 0,
-        calculate_steps: 0,
+        calculation_evaluations: setup.calculation_evaluations,
+        calculation_limit_exceeded: setup.calculation_limit_exceeded,
+        calculation_work: 0,
+        current_event: JsValue::undefined(),
+        reset_calls: setup.reset_calls,
+        reset_limit_exceeded: false,
         kept: 0,
+        retained: 0,
         dropped: 0,
     }));
     let mut out = Outcome { rc: true, value: event.value.clone(), change: event.change.clone(), ..Default::default() };
     let mut doc_errors: Vec<(usize, String)> = setup.skipped.iter().map(|(i, why)| (*i, doc_error(*i, why))).collect();
     let result = (|| -> JsResult<()> {
-        install(&mut ctx)?;
-        let (ev, value_store) = event_object(&mut ctx, event)?;
-        ctx.register_global_property(js_string!("event"), ev.clone(), Attribute::all())?;
-        // One document script that throws (calling a method PdfCraft lacks, say) must not keep
-        // every field script in the form from running: what it defined before the error, and
-        // the other scripts, stay available (#3940).
+        if setup.initialize {
+            install(ctx)?;
+        }
+        let (ev, value_store) = event_object(ctx, event)?;
+        host(ctx)?.borrow_mut().current_event = ev.clone().into();
+        if setup.initialize {
+            let get = crate::host::function(ctx, NativeFunction::from_fn_ptr(get_event));
+            let set = crate::host::function(ctx, NativeFunction::from_fn_ptr(set_event));
+            ctx.global_object().define_property_or_throw(
+                js_string!("event"),
+                boa_engine::property::PropertyDescriptor::builder().get(get).set(set).enumerable(true).configurable(false),
+                ctx,
+            )?;
+        }
+        // An initializer that throws or reaches a VM limit must not block later scripts.
+        // Definitions it made before the error stay available to field scripts (#3940).
         for &(i, d) in setup.doc_scripts {
             if let Err(e) = ctx.eval(Source::from_bytes(d)) {
                 doc_errors.push((i, doc_error(i, &e)));
@@ -262,32 +299,114 @@ fn run_here(script: &str, event: &Event, doc: &DocInfo, fields: Arc<Vec<FieldSta
         }
         let r = ctx.eval(Source::from_bytes(script))?;
         if !r.is_undefined() {
-            out.result = Some(text(&r, &mut ctx)?);
+            out.result = Some(text(&r, ctx)?);
         }
-        let rc = ev.get(js_string!("rc"), &mut ctx)?;
+        let rc = ev.get(js_string!("rc"), ctx)?;
         out.rc = rc.to_boolean();
-        let v = ev.get(js_string!("value"), &mut ctx)?;
-        out.value = text(&v, &mut ctx)?;
-        out.value_set = value_store.get(js_string!("set"), &mut ctx)?.to_boolean();
-        let c = ev.get(js_string!("change"), &mut ctx)?;
-        out.change = text(&c, &mut ctx)?;
+        let v = ev.get(js_string!("value"), ctx)?;
+        out.value = text(&v, ctx)?;
+        out.value_set = value_store.get(js_string!("set"), ctx)?.to_boolean();
+        let c = ev.get(js_string!("change"), ctx)?;
+        out.change = text(&c, ctx)?;
         Ok(())
     })();
     if let Err(e) = result {
+        out.execution_refused = matches!(e.as_engine(), Some(boa_engine::error::EngineError::RuntimeLimit(_)));
         out.error = Some(e.to_string());
     }
     doc_errors.sort_by_key(|(i, _)| *i);
     out.doc_errors = doc_errors.into_iter().map(|(_, e)| e).collect();
     if let Some(h) = ctx.remove_data::<Shared>() {
-        let h = h.into_inner();
-        out.changed = h.changed.iter().map(|i| h.fields[*i].clone()).collect();
+        let mut h = h.into_inner();
+        out.reset_limit_exceeded = h.reset_limit_exceeded;
+        out.calculation_limit_exceeded = h.calculation_limit_exceeded;
+        if h.calculation_limit_exceeded && out.error.is_none() {
+            out.error = Some("script calculation work limit exceeded".into());
+        }
+        out.changed = h.changed.iter().filter_map(|i| h.fields.get(*i).cloned()).collect();
         out.formatted = h.formatted.iter().filter_map(|&i| h.fields.get(i).map(|f| f.name.clone())).collect();
-        out.alerts = h.alerts;
-        out.console = h.console;
-        out.requests = h.requests;
+        out.alerts = std::mem::take(&mut h.alerts);
+        out.console = std::mem::take(&mut h.console);
+        out.requests = std::mem::take(&mut h.requests);
         if h.dropped > 0 {
             out.console.push(format!("the script's messages, console lines and requests passed their limits; {} more were left out", h.dropped));
         }
+        ctx.insert_data(RefCell::new(h));
     }
     out
 }
+
+#[cfg(test)]
+mod chain_budget_tests {
+    use super::refuse;
+    /// Shift assignments remain right-associative while comparison tokens consume no chain budget.
+    #[test]
+    fn comparisons_and_shift_assignments_are_distinguished() {
+        for token in ["==", "===", "!=", "!==", "<=", ">="] {
+            assert_eq!(refuse(&format!("var a=1;{}true;", format!("if(a{token}1){{;}}").repeat(5000))), None);
+        }
+        for token in ["=", ">>=", ">>>=", "<<=", "**=", "&&=", "||=", "??="] {
+            assert!(refuse(&format!("var a;{}1", format!("a{token}").repeat(5000))).is_some(), "{token}");
+        }
+    }
+    /// Newline boundaries admit flat libraries but never erase a continued expression.
+    #[test]
+    fn newline_continuations_keep_their_chain_budget() {
+        for part in ["a=>\n", "a=\n", "a=function(){}.\nx=", "a=1\n**", "a=1\nin x=", "a=1\ninstanceof x="] {
+            assert!(refuse(&format!("{}1", part.repeat(6000))).is_some(), "{part}");
+        }
+        for newline in ["\n", "\r\n", "/*\n*/", "// comment\n"] {
+            let flat = (0..300).map(|i| format!("const f{i}=()=>1{newline}")).collect::<String>();
+            assert_eq!(refuse(&flat), None, "{newline:?}");
+        }
+    }
+    /// Inner statement separators must not reset a surrounding expression's active chain.
+    #[test]
+    fn inner_separators_do_not_erase_enclosing_chains() {
+        assert!(refuse(&format!("{}1", "a=function(){;}.x=".repeat(3000))).is_some());
+        assert!(refuse(&format!("{}({}1)", "a=>".repeat(200), "b=>".repeat(100))).is_some());
+        assert_eq!(refuse(&format!("var s='{}'; /* {} */ true;", "=>=".repeat(5000), "a=".repeat(5000))), None);
+    }
+}
+
+#[cfg(test)]
+mod literal_chain_tests {
+    use super::refuse;
+    /// Literal semicolons cannot erase a surrounding assignment chain; interpolations remain code.
+    #[test]
+    fn literal_separators_cannot_bypass_chain_guards() {
+        for part in ["a=`;`.x=", "a=/;/.x=", "a=/[;,]/.x="] {
+            assert!(refuse(&format!("{}1", part.repeat(6000))).is_some(), "{part}");
+        }
+        assert!(refuse(&format!("`${{{}1}}`", "a=".repeat(6000))).is_some());
+        assert_eq!(refuse(&format!("var x=`{}${{1+1}}`; true;", "=>;=".repeat(6000))), None);
+    }
+}
+
+#[cfg(test)]
+mod review4_lexical_tests {
+    use super::refuse;
+    /// Function/control blocks may separate statements; array/object/expression contexts may not.
+    #[test]
+    fn block_statements_and_control_regex_literals_are_not_expression_chains() {
+        for head in ["function f(){", "const f=()=>{", "if(true){"] {
+            assert_eq!(refuse(&format!("{head}{} }}", "x=1\n".repeat(6000))), None);
+        }
+        for head in ["if(true)", "while(false)", "for(;false;)", "with({})", "if(false);else", "do"] {
+            assert_eq!(refuse(&format!("{head} /{}/.test('x');", "a=".repeat(6000))), None, "{head}");
+        }
+        for fragment in ["a=({x:1}).x=\n", "a=()=>{x=1\n}.x=\n", "a=(x\n/2).x=\n"] {
+            assert!(refuse(&format!("{}1", fragment.repeat(6000))).is_some(), "{fragment}");
+        }
+    }
+}
+
+/// Read the host-owned event binding without redefining a retained global property.
+fn get_event(_: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    Ok(host(ctx)?.borrow().current_event.clone())
+}
+/// Keep script event assignments and nested calculation restoration compatible with frozen globals.
+fn set_event(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    host(ctx)?.borrow_mut().current_event = args.first().cloned().unwrap_or_default();
+    Ok(JsValue::undefined())
+}
diff --git a/crates/js/src/run/preflight.rs b/crates/js/src/run/preflight.rs
new file mode 100644
index 0000000000..636bbf331d
--- /dev/null
+++ b/crates/js/src/run/preflight.rs
@@ -0,0 +1,303 @@
+//! Bounded lexical preflight before entering Boa's recursive parser/compiler.
+use super::{MAX_ARROW_FUNCTIONS, MAX_BRACKET_DEPTH, MAX_CONDITIONALS, MAX_PREFIX_RUN, MAX_RIGHT_ASSOCIATIVE_OPERATORS, MAX_SCRIPT_BYTES};
+
+/// Active chains live at bracket depths; literal contents never act as statement boundaries.
+struct Guard<'a> {
+    bytes: &'a [u8],
+    i: usize,
+    depth: usize,
+    levels: [[usize; 4]; MAX_BRACKET_DEPTH + 1],
+    template_returns: [bool; MAX_BRACKET_DEPTH + 1],
+    template_text: bool,
+    operand: bool,
+    property: bool,
+    prefix: usize,
+    line_break: bool,
+    blocks: [bool; MAX_BRACKET_DEPTH + 1],
+    controls: [bool; MAX_BRACKET_DEPTH + 1],
+    control: bool,
+    block_expected: bool,
+}
+impl<'a> Guard<'a> {
+    /// Allocate fixed-size nesting state; no input controls an allocation size here.
+    fn new(bytes: &'a [u8]) -> Self {
+        Self {
+            bytes,
+            i: 0,
+            depth: 0,
+            levels: [[0; 4]; MAX_BRACKET_DEPTH + 1],
+            template_returns: [false; MAX_BRACKET_DEPTH + 1],
+            template_text: false,
+            operand: true,
+            property: false,
+            prefix: 0,
+            line_break: false,
+            blocks: [false; MAX_BRACKET_DEPTH + 1],
+            controls: [false; MAX_BRACKET_DEPTH + 1],
+            control: false,
+            block_expected: true,
+        }
+    }
+    /// Consume one exact ASCII byte when present.
+    fn eat(&mut self, c: u8) -> bool {
+        if self.bytes.get(self.i) == Some(&c) {
+            self.i = self.i.saturating_add(1);
+            true
+        } else {
+            false
+        }
+    }
+    /// Reset token context after a value or an operator; comments and whitespace preserve it.
+    fn context(&mut self, operand: bool) {
+        self.prefix = 0;
+        self.property = false;
+        self.operand = operand;
+        self.control = false;
+        self.block_expected = false;
+    }
+    /// Count active operators across enclosing depths without charging completed sibling statements.
+    fn count(&mut self, kind: usize, limit: usize) -> bool {
+        let Some(n) = self.levels.get_mut(self.depth).and_then(|d| d.get_mut(kind)) else { return false };
+        *n = n.saturating_add(1);
+        self.levels.iter().fold(0usize, |sum, d| sum.saturating_add(d.get(kind).copied().unwrap_or(0))) <= limit
+    }
+    /// Enter a bracket or template interpolation while preserving the enclosing expression's counters.
+    fn open(&mut self, c: u8, template: bool) -> bool {
+        let control = c == b'(' && self.control;
+        let block = c == b'{' && !template && (self.block_expected || !self.operand);
+        self.depth = self.depth.saturating_add(1);
+        let Some(level) = self.levels.get_mut(self.depth) else { return false };
+        *level = [0; 4];
+        if let Some(b) = self.blocks.get_mut(self.depth) {
+            *b = block;
+        }
+        if let Some(p) = self.controls.get_mut(self.depth) {
+            *p = control;
+        }
+        if let Some(back) = self.template_returns.get_mut(self.depth) {
+            *back = template;
+        }
+        self.context(true);
+        self.block_expected = block;
+        true
+    }
+    /// Complete a bracketed expression and resume template text at its interpolation boundary.
+    fn close(&mut self, c: u8) {
+        let control = c == b')' && self.controls.get(self.depth).copied().unwrap_or(false);
+        self.template_text = c == b'}' && self.template_returns.get(self.depth).copied().unwrap_or(false);
+        if let Some(level) = self.levels.get_mut(self.depth) {
+            *level = [0; 4];
+        }
+        if let Some(back) = self.template_returns.get_mut(self.depth) {
+            *back = false;
+        }
+        self.depth = self.depth.saturating_sub(1);
+        self.context(!self.template_text && control);
+        self.block_expected = control;
+    }
+    /// A semicolon/comma ends only this depth's chain, never a surrounding function assignment.
+    fn separator(&mut self) {
+        if let Some(level) = self.levels.get_mut(self.depth) {
+            *level = [0; 4];
+        }
+        self.context(true);
+        self.block_expected = true;
+    }
+    /// Skip an ordinary quoted token, including escaped quote bytes.
+    fn quoted(&mut self, quote: u8) {
+        while let Some(&c) = self.bytes.get(self.i) {
+            self.i = self.i.saturating_add(1);
+            if c == b'\\' {
+                self.i = self.i.saturating_add(1);
+            } else if c == quote || c == b'\n' {
+                break;
+            }
+        }
+        self.context(false);
+    }
+    /// Skip a line comment without changing the preceding token context.
+    fn line_comment(&mut self) {
+        while self.bytes.get(self.i).is_some_and(|c| *c != b'\n') {
+            self.i = self.i.saturating_add(1);
+        }
+    }
+    /// Skip a block comment without treating its delimiters as code.
+    fn block_comment(&mut self) {
+        self.i = self.i.saturating_add(1);
+        while self.bytes.get(self.i..).is_some_and(|rest| !rest.is_empty() && !rest.starts_with(b"*/")) {
+            self.line_break |= matches!(self.bytes.get(self.i), Some(b'\n' | b'\r'));
+            self.i = self.i.saturating_add(1);
+        }
+        self.i = self.i.saturating_add(2);
+    }
+    /// In operand position, a regexp is one literal token; escaped slashes/classes stay inside it.
+    fn regexp(&mut self) {
+        let mut class = false;
+        while let Some(&c) = self.bytes.get(self.i) {
+            self.i = self.i.saturating_add(1);
+            match c {
+                b'\\' => self.i += 1,
+                b'[' => class = true,
+                b']' => class = false,
+                b'/' if !class => break,
+                b'\n' | b'\r' => break,
+                _ => {}
+            }
+        }
+        while self.bytes.get(self.i).is_some_and(u8::is_ascii_alphabetic) {
+            self.i = self.i.saturating_add(1);
+        }
+        self.context(false);
+    }
+    /// Template text is literal, but each interpolation re-enters the bounded code scanner.
+    fn template(&mut self, c: u8) -> bool {
+        match c {
+            b'\\' => self.i += 1,
+            b'`' => {
+                self.template_text = false;
+                self.context(false);
+            }
+            b'$' if self.eat(b'{') => {
+                self.template_text = false;
+                return self.open(b'{', true);
+            }
+            _ => {}
+        }
+        true
+    }
+    /// Prefix recursion is independent from binary expression chains; postfix ++/-- ends a value.
+    fn unary(&mut self, c: u8) -> bool {
+        if matches!(c, b'+' | b'-') && !self.operand && self.eat(c) {
+            self.context(false);
+            return true;
+        }
+        self.prefix = self.prefix.saturating_add(1);
+        self.operand = true;
+        self.property = false;
+        self.prefix <= MAX_PREFIX_RUN
+    }
+    /// Scan a keyword/identifier without treating property names such as .return as keywords.
+    fn word(&mut self) -> bool {
+        let start = self.i.saturating_sub(1);
+        while self.bytes.get(self.i).is_some_and(|c| c.is_ascii_alphanumeric() || matches!(c, b'_' | b'$')) {
+            self.i = self.i.saturating_add(1);
+        }
+        let token = self.bytes.get(start..self.i);
+        // At source level, an identifier after a completed value cannot continue that
+        // expression (except the two binary keyword operators). ASI separates it.
+        // Stay conservative inside brackets and after operators/member access.
+        if (self.depth == 0 || self.blocks.get(self.depth).copied().unwrap_or(false))
+            && self.line_break
+            && !self.operand
+            && !self.property
+            && !matches!(token, Some(b"in" | b"instanceof"))
+        {
+            self.separator();
+        }
+        self.line_break = false;
+        let unary = !self.property && matches!(token, Some(b"void" | b"typeof" | b"delete" | b"new"));
+        self.operand =
+            !self.property && (unary || matches!(token, Some(b"return" | b"throw" | b"case" | b"yield" | b"await" | b"in" | b"instanceof")));
+        self.control = !self.property && matches!(token, Some(b"if" | b"while" | b"for" | b"with" | b"switch" | b"catch"));
+        self.block_expected = !self.property && matches!(token, Some(b"else" | b"do" | b"try" | b"finally"));
+        self.operand |= self.block_expected;
+        self.property = false;
+        if unary {
+            self.prefix = self.prefix.saturating_add(1);
+        } else {
+            self.prefix = 0;
+        }
+        self.prefix <= MAX_PREFIX_RUN
+    }
+    /// Distinguish assignment, arrow, power and ternary tokens from comparisons and optional chaining.
+    fn operator(&mut self, c: u8) -> bool {
+        self.context(true);
+        let op = match c {
+            b'=' if self.eat(b'>') => {
+                self.block_expected = true;
+                Some((2, MAX_ARROW_FUNCTIONS))
+            }
+            b'=' if self.eat(b'=') => {
+                self.eat(b'=');
+                None
+            }
+            b'=' => Some((0, MAX_RIGHT_ASSOCIATIVE_OPERATORS)),
+            b'!' => {
+                self.eat(b'=');
+                self.eat(b'=');
+                None
+            }
+            b'<' | b'>' => {
+                if self.eat(c) {
+                    if c == b'>' {
+                        self.eat(c);
+                    }
+                    self.eat(b'=').then_some((0, MAX_RIGHT_ASSOCIATIVE_OPERATORS))
+                } else {
+                    self.eat(b'=');
+                    None
+                }
+            }
+            b'*' if self.eat(b'*') => Some((if self.eat(b'=') { 0 } else { 1 }, MAX_RIGHT_ASSOCIATIVE_OPERATORS)),
+            b'?' if self.eat(b'?') => self.eat(b'=').then_some((0, MAX_RIGHT_ASSOCIATIVE_OPERATORS)),
+            b'?' if self.eat(b'.') => {
+                self.property = true;
+                self.operand = false;
+                None
+            }
+            b'?' => Some((3, MAX_CONDITIONALS)),
+            _ => None,
+        };
+        op.is_none_or(|(kind, limit)| self.count(kind, limit))
+    }
+    /// Scan one code token without entering the JavaScript parser.
+    fn token(&mut self, c: u8) -> bool {
+        let comment = c == b'/' && matches!(self.bytes.get(self.i), Some(b'/' | b'*'));
+        if matches!(c, b'\n' | b'\r') {
+            self.line_break = true;
+        } else if !(c.is_ascii_whitespace() || comment || c.is_ascii_alphabetic() || matches!(c, b'_' | b'$')) {
+            self.line_break = false;
+        }
+        match c {
+            b'`' => {
+                self.template_text = true;
+                self.prefix = 0;
+                self.property = false;
+            }
+            b'\'' | b'"' => self.quoted(c),
+            b'/' if self.bytes.get(self.i) == Some(&b'/') => self.line_comment(),
+            b'/' if self.bytes.get(self.i) == Some(&b'*') => self.block_comment(),
+            b'/' if self.operand => self.regexp(),
+            b'(' | b'[' | b'{' => return self.open(c, false),
+            b')' | b']' | b'}' => self.close(c),
+            b';' | b',' => self.separator(),
+            b'!' if self.bytes.get(self.i) == Some(&b'=') => return self.operator(c),
+            b'!' | b'~' | b'+' | b'-' => return self.unary(c),
+            b'=' | b'<' | b'>' | b'*' | b'?' => return self.operator(c),
+            c if c.is_ascii_alphabetic() || matches!(c, b'_' | b'$') => return self.word(),
+            c if c.is_ascii_whitespace() => {}
+            b'.' => {
+                self.context(false);
+                self.property = true;
+            }
+            _ => self.context(matches!(c, b'/' | b'%' | b'&' | b'|' | b'^' | b':')),
+        }
+        true
+    }
+}
+
+/// Enforce source and active nesting budgets before any parser/compiler work is attempted.
+pub(super) fn refuse(source: &str) -> Option<String> {
+    if source.len() > MAX_SCRIPT_BYTES {
+        return Some(format!("the script is too long ({} KiB; the limit is {} KiB)", source.len() / 1024, MAX_SCRIPT_BYTES / 1024));
+    }
+    let mut guard = Guard::new(source.as_bytes());
+    while let Some(&c) = guard.bytes.get(guard.i) {
+        guard.i = guard.i.saturating_add(1);
+        let safe = if guard.template_text { guard.template(c) } else { guard.token(c) };
+        if !safe {
+            return Some("the script is nested too deeply to run safely".into());
+        }
+    }
+    None
+}
diff --git a/crates/js/src/session.rs b/crates/js/src/session.rs
new file mode 100644
index 0000000000..1e01674df1
--- /dev/null
+++ b/crates/js/src/session.rs
@@ -0,0 +1,1185 @@
+//! One sandboxed realm per open document. No context crosses a document boundary.
+#[cfg(not(target_arch = "wasm32"))]
+use crate::interaction::InteractiveEvent;
+use crate::{DocInfo, Event, FieldState, Limits, Outcome};
+use std::sync::Arc;
+#[cfg(not(target_arch = "wasm32"))]
+use std::sync::mpsc;
+
+/// One event snapshot; the worker owns its context and refreshes this data between invocations.
+#[derive(Clone)]
+pub struct Job {
+    pub script: String,
+    pub event: Event,
+    pub doc: DocInfo,
+    pub fields: Arc<Vec<FieldState>>,
+    pub doc_scripts: Vec<String>,
+    /// Target positions in this job's field snapshot and their ordered script sources.
+    pub calculations: Vec<(usize, String)>,
+}
+/// Live field instances are independent of restorable PDF object-number allocation.
+#[derive(Default)]
+struct FieldInstances {
+    current: std::collections::HashMap<u64, u64>,
+    last_ids: Vec<u64>,
+    next: u64,
+}
+impl FieldInstances {
+    /// Retire absent instances immediately, including history changes between two script jobs.
+    fn sync(&mut self, ids: impl IntoIterator<Item = u64>) {
+        let ids: Vec<_> = ids.into_iter().collect();
+        if ids == self.last_ids {
+            return;
+        }
+        let present: std::collections::BTreeSet<_> = ids.iter().copied().collect();
+        self.last_ids = ids;
+        self.current.retain(|id, _| present.contains(id));
+        for id in present {
+            if !self.current.contains_key(&id) {
+                self.next = self.next.saturating_add(1);
+                self.current.insert(id, self.next);
+            }
+        }
+    }
+    /// Stamp the immutable job snapshot with current instance tokens before worker dispatch.
+    fn stamp(&mut self, job: &mut Job) {
+        self.stamp_fields(&mut job.fields);
+    }
+    /// Stamp a snapshot in place, copying it only when a token actually changes: a caller that
+    /// keeps its snapshot between callbacks (the engine does) then shares it with the worker.
+    fn stamp_fields(&mut self, fields: &mut Arc<Vec<FieldState>>) {
+        self.sync(fields.iter().filter_map(|f| f.object_id));
+        let token =
+            |current: &std::collections::HashMap<u64, u64>, field: &FieldState| field.object_id.and_then(|id| current.get(&id).copied()).unwrap_or(0);
+        if fields.iter().all(|field| field.instance_id == token(&self.current, field)) {
+            return;
+        }
+        for field in Arc::make_mut(fields) {
+            field.instance_id = token(&self.current, field);
+        }
+    }
+}
+impl ScriptSession {
+    /// Stamp the caller's retained snapshot with the current instance tokens before it builds a
+    /// job, so the worker's own stamping finds nothing to change and does not copy it.
+    pub fn stamp_fields(&mut self, fields: &mut Arc<Vec<FieldState>>) {
+        self.instances.stamp_fields(fields);
+    }
+    /// Notify the retained runtime of live PDF fields after an edit or history step.
+    pub fn sync_field_ids(&mut self, ids: impl IntoIterator<Item = u64>) {
+        self.instances.sync(ids);
+    }
+
+    /// Invalidate icon handles after restoring an earlier PDF object graph.
+    pub fn retire_icon_handles(&mut self) {
+        self.icon_epoch = self.icon_epoch.wrapping_add(1);
+        self.icon_versions = Default::default();
+        self.icon_tracking_overflowed = false;
+    }
+
+    /// Invalidate only the recorded references that changed in a history step.
+    pub fn retire_changed_icons(&mut self, mut changed: impl FnMut(u64) -> bool) {
+        if self.icon_tracking_overflowed {
+            self.retire_icon_handles();
+            return;
+        }
+        for (id, version) in Arc::make_mut(&mut self.icon_versions) {
+            if changed(*id) {
+                *version = version.wrapping_add(1);
+            }
+        }
+    }
+
+    /// Attach icon versions to the snapshot and record when history must invalidate all handles because tracking filled up.
+    fn stamp_icons(&mut self, job: &mut Job) {
+        const MAX_TRACKED_ICONS: usize = 16_384;
+        for id in job.fields.iter().filter_map(|field| field.icon) {
+            if self.icon_versions.contains_key(&id) {
+                continue;
+            }
+            if self.icon_versions.len() == MAX_TRACKED_ICONS {
+                self.icon_tracking_overflowed = true;
+                break;
+            }
+            Arc::make_mut(&mut self.icon_versions).insert(id, 0);
+        }
+        job.doc.icon_epoch = self.icon_epoch;
+        job.doc.icon_versions = self.icon_versions.clone();
+    }
+}
+/// Boa context and initialization sources retained by exactly one open-document runtime.
+pub(crate) struct Realm {
+    context: Option<crate::Context>,
+    scripts: Vec<String>,
+}
+impl Realm {
+    /// Create an empty isolated realm; the first job initializes its document scripts.
+    fn new() -> Self {
+        Self { context: None, scripts: Vec::new() }
+    }
+    /// Validate sources, initialize once when needed, and execute this job in the retained document realm.
+    fn run(&mut self, job: Job) -> Outcome {
+        let out = self.run_job(job);
+        // The realm keeps its globals and field objects, not the job's field snapshot: the engine
+        // keeps that snapshot and patches it in place for the next callback.
+        if let Some(ctx) = self.context.as_ref() {
+            crate::run::release_fields(ctx);
+        }
+        out
+    }
+    fn run_job(&mut self, job: Job) -> Outcome {
+        let failed = |why: String| Outcome { rc: true, execution_refused: true, realm_untouched: true, error: Some(why), ..Default::default() };
+        // A script too long or too deeply nested to run is that script's error, as on `main`: the
+        // value stays and the edit's other scripts still run. The realm is not touched.
+        if let Some(why) = crate::refuse(&job.script) {
+            return Outcome {
+                rc: true,
+                realm_untouched: true,
+                value: job.event.value.clone(),
+                change: job.event.change.clone(),
+                error: Some(why),
+                ..Default::default()
+            };
+        }
+        if job.doc_scripts.len() > 1024 || job.doc_scripts.iter().try_fold(0usize, |n, s| n.checked_add(s.len())).is_none_or(|n| n > 1 << 20) {
+            return failed("document scripts exceed their budget".into());
+        }
+        let initialize = self.context.is_none() || self.scripts != job.doc_scripts;
+        if initialize {
+            self.context = match crate::Context::builder().host_hooks(std::rc::Rc::new(crate::run::NoCodeFromStrings)).build() {
+                Ok(c) => Some(c),
+                Err(e) => return failed(e.to_string()),
+            };
+            self.scripts = job.doc_scripts.clone();
+        }
+        let mut skipped = Vec::new();
+        let scripts: Vec<_> = job
+            .doc_scripts
+            .iter()
+            .enumerate()
+            .filter_map(|(i, s)| {
+                if !initialize {
+                    return None;
+                }
+                match crate::refuse(s) {
+                    Some(e) => {
+                        skipped.push((i, e));
+                        None
+                    }
+                    None => Some((i, s.as_str())),
+                }
+            })
+            .collect();
+        let Some(ctx) = self.context.as_mut() else { return failed("script realm unavailable".into()) };
+        if initialize {
+            let mut initial = crate::run::run_in_context(
+                ctx,
+                "",
+                &Event::doc("Open"),
+                &job.doc,
+                job.fields.clone(),
+                crate::run::ScriptSetup {
+                    doc_scripts: &scripts,
+                    skipped: &skipped,
+                    calculations: &job.calculations,
+                    initialize: true,
+                    reset_calls: 0,
+                    calculation_evaluations: 0,
+                    calculation_limit_exceeded: false,
+                },
+                Limits::default(),
+            );
+            if initial.execution_refused {
+                return initial;
+            }
+            let (fields, reset_calls, calculation_evaluations) = crate::host::host(ctx)
+                .map(|h| {
+                    let h = h.borrow();
+                    (h.fields.clone(), h.reset_calls, h.calculation_evaluations)
+                })
+                .unwrap_or((job.fields, 0, 0));
+            let mut out = crate::run::run_in_context(
+                ctx,
+                &job.script,
+                &job.event,
+                &job.doc,
+                fields,
+                crate::run::ScriptSetup {
+                    doc_scripts: &[],
+                    skipped: &[],
+                    calculations: &job.calculations,
+                    initialize: false,
+                    reset_calls,
+                    calculation_evaluations,
+                    calculation_limit_exceeded: initial.calculation_limit_exceeded,
+                },
+                Limits::default(),
+            );
+            out.reset_limit_exceeded |= initial.reset_limit_exceeded;
+            out.calculation_limit_exceeded |= initial.calculation_limit_exceeded;
+            for field in initial.changed {
+                if !out.changed.iter().any(|f| match (f.object_id, field.object_id) {
+                    (Some(a), Some(b)) => a == b,
+                    _ => f.name == field.name,
+                }) {
+                    out.changed.push(field);
+                }
+            }
+            initial.alerts.append(&mut out.alerts);
+            out.alerts = initial.alerts;
+            initial.console.append(&mut out.console);
+            out.console = initial.console;
+            initial.requests.append(&mut out.requests);
+            out.requests = initial.requests;
+            out.doc_errors = initial.doc_errors;
+            if out.error.is_none() {
+                out.error = initial.error;
+            }
+            out
+        } else {
+            crate::run::run_in_context(
+                ctx,
+                &job.script,
+                &job.event,
+                &job.doc,
+                job.fields,
+                crate::run::ScriptSetup {
+                    doc_scripts: &[],
+                    skipped: &[],
+                    calculations: &job.calculations,
+                    initialize: false,
+                    reset_calls: 0,
+                    calculation_evaluations: 0,
+                    calculation_limit_exceeded: false,
+                },
+                Limits::default(),
+            )
+        }
+    }
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+static LIVE_WORKERS: std::sync::atomic::AtomicUsize = std::sync::atomic::AtomicUsize::new(0);
+#[cfg(not(target_arch = "wasm32"))]
+const MAX_DOCUMENT_WORKERS: usize = if usize::BITS == 32 { 4 } else { 16 };
+/// A reservation is released only when its worker exits, including detached timed-out workers.
+#[cfg(not(target_arch = "wasm32"))]
+struct WorkerPermit;
+#[cfg(not(target_arch = "wasm32"))]
+impl WorkerPermit {
+    /// Reserve bounded address space without evicting another document's retained state.
+    fn acquire() -> Result<Self, String> {
+        use std::sync::atomic::Ordering::SeqCst;
+        let mut live = LIVE_WORKERS.load(SeqCst);
+        loop {
+            if live >= MAX_DOCUMENT_WORKERS {
+                return Err("document script worker limit reached; close a scripted document and retry".into());
+            }
+            match LIVE_WORKERS.compare_exchange(live, live.saturating_add(1), SeqCst, SeqCst) {
+                Ok(_) => return Ok(Self),
+                Err(current) => live = current,
+            }
+        }
+    }
+}
+#[cfg(not(target_arch = "wasm32"))]
+impl Drop for WorkerPermit {
+    fn drop(&mut self) {
+        LIVE_WORKERS.fetch_sub(1, std::sync::atomic::Ordering::SeqCst);
+    }
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+type HostTask = Box<dyn FnOnce(&mut crate::Context) -> Outcome + Send>;
+
+#[cfg(not(target_arch = "wasm32"))]
+enum WorkerRequest {
+    Script { job: Box<Job>, english_retry: bool },
+    Host(HostTask),
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+struct WorkerJob {
+    request: WorkerRequest,
+    reset_realm: bool,
+    reply: mpsc::Sender<InteractiveEvent>,
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+/// Native document runtime with one bounded-stack worker and at most one active invocation.
+/// Dropping it releases the sender; after any active job finishes the worker exits and drops its realm.
+#[derive(Default)]
+pub struct ScriptSession {
+    sender: Option<mpsc::SyncSender<WorkerJob>>,
+    executing: Arc<std::sync::atomic::AtomicBool>,
+    reset_realm: bool,
+    busy: Arc<std::sync::atomic::AtomicBool>,
+    worker_lifetime: std::sync::Weak<()>,
+    instances: FieldInstances,
+    icon_epoch: u64,
+    icon_versions: Arc<std::collections::BTreeMap<u64, u64>>,
+    icon_tracking_overflowed: bool,
+}
+#[cfg(not(target_arch = "wasm32"))]
+impl ScriptSession {
+    /// Start a bounded-stack native worker lazily and reject a second active job, including during prompts.
+    pub fn start(&mut self, job: Job) -> Result<mpsc::Receiver<InteractiveEvent>, String> {
+        self.start_job(WorkerRequest::Script { job: Box::new(job), english_retry: false })
+    }
+
+    /// Reserve the document worker and enqueue a job. An English-date retry uses a fresh context and leaves the retained realm alone.
+    fn start_job(&mut self, mut request: WorkerRequest) -> Result<mpsc::Receiver<InteractiveEvent>, String> {
+        use std::sync::atomic::Ordering::SeqCst;
+        if self.is_executing() {
+            return Err("another script is active in this document".into());
+        }
+        if self.sender.is_none() {
+            if self.worker_lifetime.upgrade().is_some() {
+                return Err("the timed-out script is still stopping; retry once it exits".into());
+            }
+            let (tx, rx) = mpsc::sync_channel::<WorkerJob>(1);
+            let permit = WorkerPermit::acquire()?;
+            let lifetime = Arc::new(());
+            self.worker_lifetime = Arc::downgrade(&lifetime);
+            let executing = self.executing.clone();
+            std::thread::Builder::new()
+                .name("pdfcraft-document-js".into())
+                .stack_size(crate::run::DOCUMENT_WORKER_STACK)
+                .spawn(move || {
+                    let _lifetime = lifetime;
+                    let _permit = permit;
+                    let mut realm = Realm::new();
+                    while let Ok(WorkerJob { request, reset_realm, reply }) = rx.recv() {
+                        if reset_realm {
+                            realm = Realm::new();
+                        }
+                        let interactive = matches!(&request, WorkerRequest::Script { english_retry: false, .. });
+                        crate::interaction::set_host(interactive.then(|| reply.clone()));
+                        let out = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| match request {
+                            WorkerRequest::Script { job, english_retry: true } => crate::with_english_printd(true, || {
+                                crate::run::run_shared_here(
+                                    &job.script,
+                                    &job.event,
+                                    &job.doc,
+                                    job.fields,
+                                    &job.doc_scripts,
+                                    &job.calculations,
+                                    Limits::default(),
+                                )
+                            }),
+                            WorkerRequest::Script { job, english_retry: false } => realm.run(*job),
+                            WorkerRequest::Host(task) => match realm.context.as_mut() {
+                                Some(context) => task(context),
+                                None => Outcome {
+                                    execution_refused: true,
+                                    realm_untouched: true,
+                                    error: Some("the document script realm has not been initialized".into()),
+                                    ..Default::default()
+                                },
+                            },
+                        }));
+                        crate::interaction::set_host(None);
+                        let out = out.unwrap_or_else(|_| {
+                            realm = Realm::new();
+                            Outcome {
+                                rc: true,
+                                execution_refused: true,
+                                error: Some("script engine stopped unexpectedly".into()),
+                                ..Default::default()
+                            }
+                        });
+                        executing.store(false, SeqCst);
+                        let _ = reply.send(InteractiveEvent::Complete(out));
+                    }
+                })
+                .map_err(|e| e.to_string())?;
+            self.sender = Some(tx);
+        }
+        if self.busy.compare_exchange(false, true, std::sync::atomic::Ordering::SeqCst, std::sync::atomic::Ordering::SeqCst).is_err() {
+            return Err("another script is active in this document".into());
+        }
+        if let WorkerRequest::Script { job, english_retry: false } = &mut request {
+            self.instances.stamp(job);
+            self.stamp_icons(job);
+        }
+        let (tx, rx) = mpsc::channel();
+        let Some(sender) = self.sender.as_ref() else {
+            self.busy.store(false, std::sync::atomic::Ordering::SeqCst);
+            return Err("script worker unavailable".into());
+        };
+        self.executing.store(true, SeqCst);
+        sender.try_send(WorkerJob { request, reset_realm: self.reset_realm, reply: tx }).map_err(|_| {
+            self.executing.store(false, SeqCst);
+            self.busy.store(false, SeqCst);
+            "script worker disconnected"
+        })?;
+        self.reset_realm = false;
+        Ok(rx)
+    }
+    /// Whether the native worker still owns an invocation, including one waiting for a prompt.
+    pub fn is_executing(&self) -> bool {
+        self.executing.load(std::sync::atomic::Ordering::SeqCst)
+    }
+
+    /// An asynchronous completion remains pending until its document outcome is accepted or discarded.
+    pub fn is_pending(&self) -> bool {
+        self.busy.load(std::sync::atomic::Ordering::SeqCst)
+    }
+    /// Acknowledge a received completion before applying its edits on the same document realm.
+    pub fn acknowledge_completion(&mut self) {
+        self.busy.store(false, std::sync::atomic::Ordering::SeqCst);
+    }
+    /// Detach the old worker and retain its lifetime so it still occupies this document's slot.
+    pub fn retire_timed_out_worker(&mut self) {
+        self.sender = None;
+        self.acknowledge_completion();
+    }
+
+    /// Fork the realm while keeping this document's worker reservation and execution gate.
+    /// Old invocation handles cannot submit work through the successor's channel.
+    pub fn fresh_realm(&mut self) -> Self {
+        Self {
+            sender: self.sender.take(),
+            executing: self.executing.clone(),
+            worker_lifetime: self.worker_lifetime.clone(),
+            reset_realm: true,
+            ..Self::default()
+        }
+    }
+
+    /// Drop state from callbacks belonging to a rejected PDF edit.
+    pub fn reset_after_refusal(&mut self) {
+        *self = self.fresh_realm();
+    }
+
+    /// Run a job with one total deadline, discarding its entire realm when the host times out.
+    pub fn run(&mut self, job: Job, answers: &[Option<String>]) -> Outcome {
+        self.run_with_limit(job, answers, std::time::Duration::from_secs(10))
+    }
+    /// Run a callback within the remaining time of a larger operation.
+    pub fn run_with_limit(&mut self, job: Job, answers: &[Option<String>], limit: std::time::Duration) -> Outcome {
+        self.run_timed(WorkerRequest::Script { job: Box::new(job), english_retry: false }, answers, limit)
+    }
+
+    /// Retry formatting in a fresh context on the document worker, within the caller's remaining time.
+    pub fn run_english_retry(&mut self, job: Job, limit: std::time::Duration) -> Outcome {
+        self.run_timed(WorkerRequest::Script { job: Box::new(job), english_retry: true }, &[], limit)
+    }
+
+    /// Dispatch trusted host work to the document's already initialized realm.
+    /// The callback stays on the document worker and must return cooperatively on its own.
+    pub fn run_host_task(&mut self, limit: std::time::Duration, task: impl FnOnce(&mut crate::Context) -> Outcome + Send + 'static) -> Outcome {
+        self.run_timed(WorkerRequest::Host(Box::new(task)), &[], limit)
+    }
+
+    /// Wait within one deadline for startup, prompt replies and completion. Detach a worker that exceeds the deadline.
+    fn run_timed(&mut self, request: WorkerRequest, answers: &[Option<String>], limit: std::time::Duration) -> Outcome {
+        if limit.is_zero() {
+            return Outcome {
+                execution_refused: true,
+                realm_untouched: true,
+                error: Some("script worker had no time remaining".into()),
+                ..Default::default()
+            };
+        }
+        let started = std::time::Instant::now();
+        let rx = match self.start_job(request) {
+            Ok(rx) => rx,
+            Err(e) => return Outcome { execution_refused: true, realm_untouched: true, error: Some(e), ..Default::default() },
+        };
+        match Self::receive(&rx, answers, started, limit) {
+            Some(out) => {
+                self.acknowledge_completion();
+                out
+            }
+            None => {
+                // The old worker has no route into this replacement realm. Its reservation
+                // remains charged until cooperative execution finishes and the thread exits.
+                self.retire_timed_out_worker();
+                Outcome { execution_refused: true, error: Some("script worker did not complete within its limit".into()), ..Default::default() }
+            }
+        }
+    }
+    /// Prompt replies consume the original deadline instead of restarting it.
+    fn receive(
+        rx: &mpsc::Receiver<InteractiveEvent>,
+        answers: &[Option<String>],
+        started: std::time::Instant,
+        limit: std::time::Duration,
+    ) -> Option<Outcome> {
+        let mut answers = answers.iter();
+        loop {
+            let remaining = limit.saturating_sub(started.elapsed());
+            if remaining.is_zero() {
+                return None;
+            }
+            match rx.recv_timeout(remaining) {
+                Ok(InteractiveEvent::Complete(out)) => return Some(out),
+                Ok(InteractiveEvent::Prompt(_, reply)) => {
+                    let _ = reply.send(answers.next().cloned().flatten());
+                }
+                Err(_) => return None,
+            }
+        }
+    }
+}
+/// Web-local retained realm; native worker/dialog hosting is deliberately unavailable.
+#[cfg(target_arch = "wasm32")]
+pub struct ScriptSession {
+    realm: Realm,
+    instances: FieldInstances,
+    icon_epoch: u64,
+    icon_versions: Arc<std::collections::BTreeMap<u64, u64>>,
+    icon_tracking_overflowed: bool,
+}
+#[cfg(target_arch = "wasm32")]
+impl Default for ScriptSession {
+    /// Create the web runtime without native worker threads or a native prompt host.
+    fn default() -> Self {
+        Self {
+            realm: Realm::new(),
+            instances: FieldInstances::default(),
+            icon_epoch: 0,
+            icon_versions: Default::default(),
+            icon_tracking_overflowed: false,
+        }
+    }
+}
+#[cfg(target_arch = "wasm32")]
+impl ScriptSession {
+    /// Replace the web-local realm and its document bindings.
+    pub fn fresh_realm(&mut self) -> Self {
+        Self::default()
+    }
+
+    /// Drop state from callbacks belonging to a rejected PDF edit.
+    pub fn reset_after_refusal(&mut self) {
+        *self = Self::default();
+    }
+
+    /// Run in the web-local realm; native prompt replies are unavailable on this host.
+    pub fn run(&mut self, mut job: Job, _answers: &[Option<String>]) -> Outcome {
+        self.instances.stamp(&mut job);
+        self.stamp_icons(&mut job);
+        self.realm.run(job)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    /// Create a small button-event job with document globals used by persistent-session regressions.
+    fn job(source: &str) -> Job {
+        Job {
+            script: source.into(),
+            event: Event::field("Mouse Up", "go", ""),
+            doc: DocInfo::default(),
+            fields: Arc::new(vec![FieldState::new("go", crate::FieldType::Button, vec!["old".into()])]),
+            doc_scripts: vec!["var buffer='', init=1, opened=event.name;var held=getField('go');function digit(v){buffer+=v;return buffer;}".into()],
+            calculations: Vec::new(),
+        }
+    }
+    #[test]
+    /// Retained Field identity, custom properties and keypad buffers persist locally while separate documents stay isolated.
+    fn document_realm_keeps_keypad_state_and_isolates_documents() {
+        let mut a = ScriptSession::default();
+        let mut b = ScriptSession::default();
+        assert_eq!(a.run(job("digit('1');"), &[]).result.as_deref(), Some("1"));
+        assert_eq!(a.run(job("getField('go').custom=42;getField('go')===held;"), &[]).result.as_deref(), Some("true"));
+        assert_eq!(a.run(job("getField('go').custom;"), &[]).result.as_deref(), Some("42"));
+        assert_eq!(a.run(job("[digit('2'),init,opened].join('/');"), &[]).result.as_deref(), Some("12/1/Open"));
+        assert_eq!(b.run(job("digit('3');"), &[]).result.as_deref(), Some("3"));
+        let mut changed = job("held.value;");
+        changed.fields = Arc::new(vec![FieldState::new("go", crate::FieldType::Button, vec!["live".into()])]);
+        assert_eq!(a.run(changed, &[]).result.as_deref(), Some("live"));
+        let mut edited = job("buffer;");
+        edited.doc_scripts = vec!["var buffer='changed';".into()];
+        assert_eq!(a.run(edited, &[]).result.as_deref(), Some("changed"));
+    }
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn host_work_reads_globals_in_the_correct_document() {
+        let read_counter = |context: &mut crate::Context| {
+            let result = context
+                .global_object()
+                .get(boa_engine::js_string!("counter"), context)
+                .ok()
+                .and_then(|value| value.as_number())
+                .map(|number| number.to_string());
+            Outcome { result, ..Default::default() }
+        };
+        let mut first = ScriptSession::default();
+        let mut second = ScriptSession::default();
+        assert!(first.run(job("var counter = 17;"), &[]).error.is_none());
+        assert!(second.run(job("var counter = 31;"), &[]).error.is_none());
+        let timeout = std::time::Duration::from_secs(5);
+        assert_eq!(first.run_host_task(timeout, read_counter).result.as_deref(), Some("17"));
+        assert_eq!(second.run_host_task(timeout, read_counter).result.as_deref(), Some("31"));
+    }
+
+    #[test]
+    /// A script too large to run fails on its own, like a script that throws, without refusing the edit.
+    fn an_oversized_script_is_an_error_not_a_refusal() {
+        let mut session = ScriptSession::default();
+        let long = format!("event.value = 1;/*{}*/", "x".repeat(300 * 1024));
+        let out = session.run(job(&long), &[]);
+        assert!(out.error.is_some());
+        assert!(!out.execution_refused);
+        assert!(session.run(job("1 + 1"), &[]).error.is_none());
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    /// A waiting prompt refuses concurrent document runs immediately instead of blocking the caller behind it.
+    fn a_waiting_prompt_refuses_reentrant_host_runs_without_blocking_the_ui() {
+        let mut session = ScriptSession::default();
+        let receiver = session.start(job("app.response({cQuestion:'Wait'});")).unwrap();
+        let InteractiveEvent::Prompt(_, reply) = receiver.recv_timeout(std::time::Duration::from_secs(2)).unwrap() else { panic!("expected prompt") };
+        let started = std::time::Instant::now();
+        let refused = session.run(job("buffer;"), &[]);
+        assert!(refused.error.as_deref().unwrap().contains("another script is active"));
+        let refused = session.run_host_task(std::time::Duration::from_secs(1), |_| panic!("host task entered a busy realm"));
+        assert!(refused.execution_refused && refused.realm_untouched);
+        assert!(started.elapsed() < std::time::Duration::from_secs(1));
+        reply.send(None).unwrap();
+        assert!(matches!(receiver.recv_timeout(std::time::Duration::from_secs(2)).unwrap(), InteractiveEvent::Complete(_)));
+    }
+    /// A retained realm must expose current metadata without replaying document initialization.
+    #[test]
+    fn persistent_document_properties_follow_the_current_snapshot() {
+        let mut session = ScriptSession::default();
+        let source = "[numPages,documentFileName,info.title,init,buffer].join('/');";
+        let mut first = job(source);
+        first.doc = DocInfo { num_pages: 1, file_name: "before.pdf".into(), info: vec![("title".into(), "Before".into())], ..Default::default() };
+        assert_eq!(session.run(first, &[]).result.as_deref(), Some("1/before.pdf/Before/1/"));
+        assert_eq!(session.run(job("buffer='kept';"), &[]).error, None);
+        let mut next = job(source);
+        next.doc = DocInfo { num_pages: 7, file_name: "after.pdf".into(), info: vec![("title".into(), "After".into())], ..Default::default() };
+        assert_eq!(session.run(next, &[]).result.as_deref(), Some("7/after.pdf/After/1/kept"));
+        let mut removed = job("numPages===0 && documentFileName==='' && typeof info.title==='undefined' && buffer==='kept';");
+        removed.doc = DocInfo::default();
+        assert_eq!(session.run(removed, &[]).result.as_deref(), Some("true"));
+    }
+
+    /// Observe real address-space growth for four simultaneously live document workers.
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn persistent_workers_do_not_reserve_a_gibibyte_per_document() {
+        const CHILD: &str = "PDFCRAFT_WORKER_RESERVATION_TEST_CHILD";
+        if std::env::var_os(CHILD).is_none() {
+            let result = std::process::Command::new(std::env::current_exe().unwrap())
+                .args(["--exact", "session::tests::persistent_workers_do_not_reserve_a_gibibyte_per_document", "--nocapture"])
+                .env(CHILD, "1")
+                .output()
+                .unwrap();
+            assert!(result.status.success(), "reservation child failed: {}", String::from_utf8_lossy(&result.stderr));
+            eprintln!("{}", String::from_utf8_lossy(&result.stderr));
+            return;
+        }
+        /// Read the kernel's virtual-size metric, in bytes, for this isolated test process.
+        fn virtual_bytes() -> u64 {
+            let status = std::fs::read_to_string("/proc/self/status").unwrap();
+            status.lines().find_map(|line| line.strip_prefix("VmSize:")?.split_whitespace().next()?.parse::<u64>().ok()).unwrap() * 1024
+        }
+        let before = virtual_bytes();
+        let mut workers: Vec<_> = (0..4).map(|_| ScriptSession::default()).collect();
+        for worker in &mut workers {
+            assert_eq!(worker.run(job("digit('1');"), &[]).result.as_deref(), Some("1"));
+        }
+        let growth = virtual_bytes().saturating_sub(before);
+        eprintln!("four live document workers: virtual address-space growth {growth} bytes");
+        assert!(growth < 768 * 1024 * 1024, "four workers reserved {growth} bytes");
+        for worker in &mut workers {
+            assert_eq!(worker.run(job("digit('2');"), &[]).result.as_deref(), Some("12"));
+        }
+    }
+
+    /// Run parser/compiler boundary cases in a child process so a stack abort is observable.
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn document_worker_contains_hostile_and_boundary_scripts() {
+        const CHILD: &str = "PDFCRAFT_WORKER_STACK_TEST_CHILD";
+        if std::env::var_os(CHILD).is_none() {
+            let result = std::process::Command::new(std::env::current_exe().unwrap())
+                .args(["--exact", "session::tests::document_worker_contains_hostile_and_boundary_scripts", "--nocapture"])
+                .env(CHILD, "1")
+                .output()
+                .unwrap();
+            assert!(result.status.success(), "worker child failed: {}", String::from_utf8_lossy(&result.stderr));
+            return;
+        }
+        let mut worker = ScriptSession::default();
+        for script in [
+            format!("{}1{}", "(".repeat(100_000), ")".repeat(100_000)),
+            format!("{}1", "!".repeat(100_000)),
+            format!("{}1", "1?1:".repeat(10_000)),
+            format!("{}1", "a=>".repeat(100_000)),
+            format!("{}1", "a=>".repeat(70_000)),
+            format!("{}1", "a=>".repeat(257)),
+            "function recursive(){return recursive();} recursive();".into(),
+            "while(true){}".into(),
+        ] {
+            assert!(worker.run(job(&script), &[]).error.is_some());
+        }
+        for (script, expected) in [
+            (format!("{}1{}", "(".repeat(64), ")".repeat(64)), "1"),
+            (format!("1{}", "+1".repeat(50_000)), "50001"),
+            (format!("var a;{}1;true;", "a=".repeat(4096)), "true"),
+            (format!("{}1;true;", "1**".repeat(4096)), "true"),
+            (format!("{}1;true;", "void ".repeat(64)), "true"),
+            (format!("{}1;true;", "typeof ".repeat(64)), "true"),
+            (format!("{}1", "false?1:".repeat(4096)), "1"),
+            (format!("{}1", "!".repeat(64)), "true"),
+            (format!("typeof ({}1)", "a=>".repeat(256)), "function"),
+            (format!("[{}].length", vec!["()=>1"; 256].join(",")), "256"),
+            ("function bounded(n){return n?bounded(n-1)+1:0;} bounded(32);".into(), "32"),
+        ] {
+            let result = worker.run(job(&script), &[]);
+            assert_eq!(result.error, None);
+            assert_eq!(result.result.as_deref(), Some(expected));
+        }
+        assert_eq!(worker.run(job("digit('7');"), &[]).result.as_deref(), Some("7"));
+    }
+
+    /// Isolate unbracketed parser recursion families, which evade bracket-depth checks.
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn document_worker_bounds_unbracketed_expression_chains() {
+        const CHILD: &str = "PDFCRAFT_EXPRESSION_CHAIN_CHILD";
+        let Ok(case) = std::env::var(CHILD) else {
+            for case in 0..5 {
+                let result = std::process::Command::new(std::env::current_exe().unwrap())
+                    .args(["--exact", "session::tests::document_worker_bounds_unbracketed_expression_chains", "--nocapture"])
+                    .env(CHILD, case.to_string())
+                    .output()
+                    .unwrap();
+                assert!(result.status.success(), "expression family {case}: {}", String::from_utf8_lossy(&result.stderr));
+            }
+            return;
+        };
+        let script = match case.as_str() {
+            "0" => format!("var a;{}1", "a=".repeat(70_000)),
+            "1" => format!("{}1", "1**".repeat(60_000)),
+            "2" => format!("{}1", "void ".repeat(40_000)),
+            "3" => format!("{}Object", "new ".repeat(50_000)),
+            _ => format!("var a;{}{}{}1", "a=".repeat(4096), "false?1:".repeat(4096), "1**".repeat(4096)),
+        };
+        let mut worker = ScriptSession::default();
+        let outcome = worker.run(job(&script), &[]);
+        if case == "4" {
+            // Combining individually permitted boundary chains must also fit the worker.
+            assert_eq!(outcome.error, None);
+            assert_eq!(outcome.result.as_deref(), Some("1"));
+        } else {
+            assert!(outcome.error.is_some(), "over-budget chain was admitted");
+        }
+        assert_eq!(worker.run(job("digit('8');"), &[]).result.as_deref(), Some("8"));
+    }
+
+    /// Independent statements and comparisons must not consume a source-wide nesting budget.
+    #[test]
+    fn document_worker_accepts_large_flat_libraries() {
+        let scripts = [
+            format!("var a=1,b=0;{}b;", "if(a===1){b=2;}".repeat(2000)),
+            format!("{}f299();", (0..300).map(|i| format!("const f{i}=()=>1;")).collect::<String>()),
+            format!("{}f299()", (0..300).map(|i| format!("const f{i}=()=>1\n")).collect::<String>()),
+            format!("var a=0\n{}a", "a=2**3\n".repeat(6000)),
+            format!("var a=0;{}a;", "a+=1;".repeat(6000)),
+            format!("var a=0;{}a;", "a=2**3;".repeat(6000)),
+            // Within the nesting guard's 4,096 conditionals.
+            format!("var a=0;{}a;", "a=(1===1)?1:2;".repeat(4000)),
+        ];
+        for (script, expected) in scripts.into_iter().zip(["2", "1", "1", "8", "6000", "8", "1"]) {
+            let mut worker = ScriptSession::default();
+            let result = worker.run(job(&script), &[]);
+            assert_eq!(result.error, None);
+            assert_eq!(result.result.as_deref(), Some(expected));
+        }
+        let block = format!("function library(){{var x=0\n{}return x}}\nlibrary()", "x=1\n".repeat(6000));
+        assert_eq!(ScriptSession::default().run(job(&block), &[]).result.as_deref(), Some("1"));
+        let mut document = job("f299();");
+        document.doc_scripts.push((0..300).map(|i| format!("const f{i}=()=>1\n")).collect::<String>());
+        let result = ScriptSession::default().run(document, &[]);
+        assert_eq!(result.error, None);
+        assert!(result.doc_errors.is_empty());
+        assert_eq!(result.result.as_deref(), Some("1"));
+    }
+
+    #[test]
+    /// Retaining the realm must not re-enable eval or dynamic Function construction.
+    fn persistent_context_keeps_dynamic_compilation_blocked() {
+        let mut a = ScriptSession::default();
+        assert!(a.run(job("eval('1')"), &[]).error.is_some());
+        assert!(a.run(job("new Function('return 1')()"), &[]).error.is_some());
+    }
+    /// The completion itself must not release the realm before its caller accepts the outcome.
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn completion_requires_acknowledgement_before_the_next_job() {
+        let mut session = ScriptSession::default();
+        let rx = session.start(job("buffer='pending';")).unwrap();
+        assert!(matches!(rx.recv_timeout(std::time::Duration::from_secs(2)).unwrap(), InteractiveEvent::Complete(_)));
+        assert!(session.run(job("buffer"), &[]).error.is_some());
+        session.acknowledge_completion();
+        assert_eq!(session.run(job("buffer"), &[]).result.as_deref(), Some("pending"));
+    }
+    /// Multiple prompt round trips share one wall-clock budget.
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn synchronous_prompt_waits_share_one_deadline() {
+        use std::time::{Duration, Instant};
+        let (tx, rx) = mpsc::channel();
+        let producer = std::thread::spawn(move || {
+            for _ in 0..3 {
+                std::thread::sleep(Duration::from_millis(50));
+                let (answer, reply) = mpsc::channel();
+                if tx.send(InteractiveEvent::Prompt(crate::interaction::Prompt::Menu(Vec::new()), answer)).is_err() {
+                    return;
+                }
+                if reply.recv_timeout(Duration::from_secs(1)).is_err() {
+                    return;
+                }
+            }
+            let _ = tx.send(InteractiveEvent::Complete(Outcome::default()));
+        });
+        assert!(ScriptSession::receive(&rx, &[], Instant::now(), Duration::from_millis(80)).is_none());
+        drop(rx);
+        producer.join().unwrap();
+    }
+    /// A timed-out invocation cannot seed globals/custom Field properties in its replacement realm.
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn timed_out_jobs_never_share_the_next_realm() {
+        let mut session = ScriptSession::default();
+        use std::time::{Duration, Instant};
+        let out = session.run_with_limit(job("buffer='late';held.custom=99;"), &[], Duration::ZERO);
+        assert!(out.execution_refused);
+        let deadline = Instant::now() + Duration::from_secs(2);
+        while session.worker_lifetime.upgrade().is_some() {
+            assert!(Instant::now() < deadline);
+            std::thread::sleep(Duration::from_millis(1));
+        }
+        assert_eq!(session.run(job("buffer+'/'+typeof held.custom"), &[]).result.as_deref(), Some("/undefined"));
+    }
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn a_detached_worker_holds_the_documents_slot_until_it_exits() {
+        let worker = Arc::new(());
+        let mut session = ScriptSession { worker_lifetime: Arc::downgrade(&worker), ..Default::default() };
+        let out = session.run(job("1+1"), &[]);
+        assert!(out.execution_refused);
+        assert!(session.sender.is_none());
+        drop(worker);
+        assert_eq!(session.run(job("1+1"), &[]).result.as_deref(), Some("2"));
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn english_retry_is_isolated_and_obeys_the_remaining_time() {
+        use std::time::Duration;
+        let mut session = ScriptSession::default();
+        assert_eq!(session.run(job("var retained = 17; retained;"), &[]).result.as_deref(), Some("17"));
+        let retry = session.run_english_retry(job("var retryOnly = 1; typeof retained;"), Duration::from_secs(2));
+        assert_eq!(retry.result.as_deref(), Some("undefined"));
+        assert_eq!(session.run(job("retained + '/' + typeof retryOnly;"), &[]).result.as_deref(), Some("17/undefined"));
+        let expired = session.run_english_retry(job("1;"), Duration::ZERO);
+        assert!(expired.execution_refused);
+    }
+
+    #[test]
+    fn icon_tracking_overflow_preserves_handles_until_history_changes() {
+        let mut session = ScriptSession::default();
+        Arc::make_mut(&mut session.icon_versions).extend((1..=16_384).map(|id| (id, 0)));
+        let mut capture = job("var oldIcon = getField('go').buttonGetIcon();");
+        Arc::make_mut(&mut capture.fields)[0].icon = Some(16_385);
+        assert_eq!(session.run(capture.clone(), &[]).error, None);
+        capture.script = "getField('go').buttonSetIcon(oldIcon);".into();
+        assert_eq!(session.run(capture.clone(), &[]).error, None);
+        session.retire_changed_icons(|_| false);
+        assert!(session.run(capture, &[]).error.is_some());
+    }
+
+    #[test]
+    fn history_retires_icons_without_discarding_the_document_globals() {
+        let mut session = ScriptSession::default();
+        let mut capture = job("var oldIcon = getField('go').buttonGetIcon(); buffer='retained';");
+        Arc::make_mut(&mut capture.fields)[0].icon = Some(17);
+        assert_eq!(session.run(capture.clone(), &[]).error, None);
+        capture.script = "getField('go').buttonSetIcon(oldIcon);".into();
+        assert_eq!(session.run(capture.clone(), &[]).error, None);
+        session.retire_changed_icons(|id| id == 18);
+        assert_eq!(session.run(capture.clone(), &[]).error, None);
+        session.retire_changed_icons(|id| id == 17);
+        assert!(session.run(capture.clone(), &[]).error.is_some());
+        capture.script = "buffer;".into();
+        assert_eq!(session.run(capture, &[]).result.as_deref(), Some("retained"));
+    }
+
+    /// Exercise the actual process-wide cap in isolation, then recover a slot without resetting other documents.
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn document_worker_capacity_is_bounded_and_reusable() {
+        const CHILD: &str = "PDFCRAFT_WORKER_CAPACITY_CHILD";
+        if std::env::var_os(CHILD).is_none() {
+            let out = std::process::Command::new(std::env::current_exe().unwrap())
+                .args(["--exact", "session::tests::document_worker_capacity_is_bounded_and_reusable"])
+                .env(CHILD, "1")
+                .output()
+                .unwrap();
+            assert!(out.status.success(), "{} {}", String::from_utf8_lossy(&out.stdout), String::from_utf8_lossy(&out.stderr));
+            return;
+        }
+        let mut workers = Vec::new();
+        for _ in 0..MAX_DOCUMENT_WORKERS {
+            let mut worker = ScriptSession::default();
+            assert_eq!(worker.run(job("digit('1')"), &[]).result.as_deref(), Some("1"));
+            workers.push(worker);
+        }
+        let mut extra = ScriptSession::default();
+        assert!(extra.start(job("1")).unwrap_err().contains("worker limit"));
+        drop(workers.pop());
+        let deadline = std::time::Instant::now() + std::time::Duration::from_secs(2);
+        while LIVE_WORKERS.load(std::sync::atomic::Ordering::SeqCst) == MAX_DOCUMENT_WORKERS {
+            assert!(std::time::Instant::now() < deadline);
+            std::thread::sleep(std::time::Duration::from_millis(5));
+        }
+        assert_eq!(extra.run(job("digit('2')"), &[]).result.as_deref(), Some("2"));
+        for worker in &mut workers {
+            assert_eq!(worker.run(job("digit('3')"), &[]).result.as_deref(), Some("13"));
+        }
+    }
+    /// Reset effects are visible during Doc Open and to the first event, including retained Field objects.
+    #[test]
+    fn doc_open_reset_precedes_the_first_event_and_later_writes_win() {
+        for reset in ["resetForm();", "resetForm(['group']);"] {
+            let mut source = FieldState::new("group.source", crate::FieldType::Text, vec!["old".into()]);
+            source.default = vec!["new".into()];
+            let dest = FieldState::new("dest", crate::FieldType::Text, vec!["before".into()]);
+            let mut task = job("getField('dest').value=held.value;held.value='old';openedValue+'/'+getField('dest').value");
+            task.fields = Arc::new(vec![source, dest]);
+            task.doc_scripts = vec![format!("var held=getField('group.source');{reset}var openedValue=held.value;")];
+            let out = ScriptSession::default().run(task, &[]);
+            assert_eq!(out.error, None);
+            assert_eq!(out.result.as_deref(), Some("new/new"));
+            assert_eq!(out.changed.iter().find(|f| f.name == "group.source").unwrap().value, ["old"]);
+            assert_eq!(out.changed.iter().find(|f| f.name == "dest").unwrap().value, ["new"]);
+        }
+    }
+}
+
+#[cfg(all(test, not(target_arch = "wasm32")))]
+mod reset_budget_tests {
+    use super::*;
+    #[test]
+    fn open_and_first_event_share_reset_budget_but_later_jobs_reset_it() {
+        let mut runtime = ScriptSession::default();
+        let mut job = Job {
+            script: "resetForm();".into(),
+            event: Event::doc("Console"),
+            doc: Default::default(),
+            fields: Arc::new(vec![]),
+            doc_scripts: vec!["for(var i=0;i<64;i++)resetForm();".into()],
+            calculations: vec![],
+        };
+        let out = runtime.run(job.clone(), &[]);
+        assert!(out.reset_limit_exceeded);
+        assert_eq!(out.requests.iter().filter(|r| matches!(r, crate::Request::Reset(_))).count(), 64);
+        job.script = "resetForm();true;".into();
+        let out = runtime.run(job, &[]);
+        assert!(!out.reset_limit_exceeded);
+        assert_eq!(out.error, None);
+        assert_eq!(out.result.as_deref(), Some("true"));
+    }
+}
+
+#[cfg(all(test, not(target_arch = "wasm32")))]
+mod event_identity_tests {
+    use super::*;
+    #[test]
+    fn ordinary_button_event_target_reuses_public_field_object() {
+        let mut field = FieldState::new("go", crate::FieldType::Button, vec![]);
+        field.object_id = Some(17);
+        let job = Job {
+            script: "event.target===getField('go');".into(),
+            event: Event::field("Mouse Up", "go", ""),
+            doc: Default::default(),
+            fields: Arc::new(vec![field]),
+            doc_scripts: vec![],
+            calculations: vec![],
+        };
+        let out = ScriptSession::default().run(job, &[]);
+        assert_eq!(out.error, None);
+        assert_eq!(out.result.as_deref(), Some("true"));
+    }
+}
+
+#[cfg(all(test, not(target_arch = "wasm32")))]
+mod cache_capacity_tests {
+    use super::*;
+    #[test]
+    fn every_exposed_field_keeps_identity_beyond_4096_entries() {
+        let fields = Arc::new(
+            (0..4100)
+                .map(|i| {
+                    let mut f = FieldState::new(format!("f{i}"), crate::FieldType::Text, vec![]);
+                    f.object_id = Some(i);
+                    f
+                })
+                .collect(),
+        );
+        let job=Job{script:"for(var i=0;i<4100;i++)getField('f'+i);var held=getField('f4099');held.custom=42;held===getField('f4099') && getField('f4099').custom===42;".into(),event:Event::doc("Console"),doc:Default::default(),fields,doc_scripts:vec![],calculations:vec![]};
+        let mut session = ScriptSession::default();
+        let out = session.run(job.clone(), &[]);
+        assert_eq!(out.error, None);
+        assert_eq!(out.result.as_deref(), Some("true"));
+        let out = session.run(Job { script: "held===getField('f4099') && held.custom===42;".into(), ..job }, &[]);
+        assert_eq!(out.result.as_deref(), Some("true"));
+    }
+}
+
+#[cfg(test)]
+mod cache_lifecycle_tests {
+    use super::*;
+    #[test]
+    fn cache_follows_object_renames_and_prunes_removed_fields() {
+        let mut field = FieldState::new("old", crate::FieldType::Text, vec![]);
+        field.object_id = Some(17);
+        let mut job = Job {
+            script: "var held=getField('old');held.custom=42;".into(),
+            event: Event::doc("Console"),
+            doc: Default::default(),
+            fields: Arc::new(vec![field.clone()]),
+            doc_scripts: vec![],
+            calculations: vec![],
+        };
+        let mut realm = Realm::new();
+        assert_eq!(realm.run(job.clone()).error, None);
+        for i in 0..16 {
+            field.name = format!("renamed{i}");
+            job.fields = Arc::new(vec![field.clone()]);
+            job.script = format!("held.setFocus();held===getField('{}') && held.name==='{}' && held.custom===42;", field.name, field.name);
+            let out = realm.run(job.clone());
+            assert_eq!(out.error, None);
+            assert_eq!(out.result.as_deref(), Some("true"));
+            assert_eq!(out.requests, [crate::Request::FocusField { name: field.name.clone(), object_id: 17 }]);
+            assert_eq!(crate::host::host(realm.context.as_ref().unwrap()).unwrap().borrow().objects.len(), 1);
+        }
+        field.object_id = Some(18);
+        field.name = "replacement".into();
+        job.fields = Arc::new(vec![field]);
+        job.script = "getField('replacement');".into();
+        assert_eq!(realm.run(job.clone()).error, None);
+        assert_eq!(crate::host::host(realm.context.as_ref().unwrap()).unwrap().borrow().objects.len(), 1);
+        job.script = "held.value;".into();
+        assert!(realm.run(job).error.is_some());
+    }
+}
+
+#[cfg(test)]
+mod review13_tests {
+    use super::*;
+    use crate::FieldType;
+    /// Build isolated jobs without document initialization side effects.
+    fn job(script: &str, fields: Vec<FieldState>) -> Job {
+        Job {
+            script: script.into(),
+            event: Event::doc("Test"),
+            doc: DocInfo::default(),
+            fields: Arc::new(fields),
+            doc_scripts: vec![],
+            calculations: vec![],
+        }
+    }
+    /// A retired accessor must not resolve a replacement even if no job observed the deletion.
+    #[test]
+    fn field_instances_retire_between_jobs_without_losing_globals() {
+        let mut session = ScriptSession::default();
+        let mut f = FieldState::new("old", FieldType::Text, vec!["original".into()]);
+        f.object_id = Some(7);
+        assert_eq!(session.run(job("var held=getField('old');held.custom=42;var kept=99;", vec![f.clone()]), &[]).error, None);
+        session.sync_field_ids([]);
+        session.sync_field_ids([7]);
+        f.name = "replacement".into();
+        let out =
+            session.run(job("kept===99 && getField('replacement')!==held && getField('replacement').custom===undefined;", vec![f.clone()]), &[]);
+        assert_eq!(out.result.as_deref(), Some("true"));
+        for script in ["held.value;", "held.value='wrong';", "held.setFocus();"] {
+            let out = session.run(job(script, vec![f.clone()]), &[]);
+            assert!(out.error.is_some());
+            assert!(out.changed.is_empty());
+        }
+    }
+    /// Frozen globals still expose each new event and permit nested calculation event restoration.
+    #[test]
+    fn frozen_global_keeps_live_event_binding() {
+        let mut session = ScriptSession::default();
+        let f = FieldState::new("amount", FieldType::Text, vec!["2".into()]);
+        let mut first = job("event.name", vec![f.clone()]);
+        first.doc_scripts = vec!["Object.freeze(globalThis);".into()];
+        assert_eq!(session.run(first.clone(), &[]).result.as_deref(), Some("Test"));
+        first.event = Event::doc("Next");
+        first.script = "calculateNow();event.name".into();
+        first.calculations = vec![(0, "event.value='3';".into())];
+        let out = session.run(first, &[]);
+        assert_eq!(out.error, None);
+        assert_eq!(out.result.as_deref(), Some("Next"));
+        assert_eq!(out.changed[0].value, ["3"]);
+    }
+    /// Calculation values follow the existing setter normalization, including unchecked empty boxes.
+    #[test]
+    fn calculate_now_normalizes_checkbox_but_preserves_text_and_combo_empty_values() {
+        let mut session = ScriptSession::default();
+        let fields = vec![
+            FieldState::new("box", FieldType::CheckBox, vec!["Yes".into()]),
+            FieldState::new("text", FieldType::Text, vec!["old".into()]),
+            FieldState::new("combo", FieldType::ComboBox, vec!["old".into()]),
+        ];
+        let mut j = job("calculateNow();getField('box').value", fields);
+        j.calculations = (0..3).map(|i| (i, "event.value='';".into())).collect();
+        let out = session.run(j, &[]);
+        assert_eq!(out.error, None);
+        assert_eq!(out.result.as_deref(), Some("Off"));
+        assert!(out.changed[0].value.is_empty());
+        assert_eq!(out.changed[1].value, [""]);
+        assert_eq!(out.changed[2].value, [""]);
+    }
+    /// Small individual lookups cannot multiply unbounded work across calculation sources.
+    #[test]
+    fn calculation_sources_share_one_job_budget_and_later_jobs_reset_it() {
+        let mut session = ScriptSession::default();
+        let fields: Vec<_> = (0..6).map(|i| FieldState::new(format!("f{i}"), FieldType::Text, vec!["1".into()])).collect();
+        let mut j = job("calculateNow();", fields.clone());
+        j.calculations = (0..6).map(|i| (i, "for(var q=0;q<3;q++)AFSimple_Calculate('SUM',new Array(1024).fill('x'.repeat(256)));".into())).collect();
+        let out = session.run(j, &[]);
+        assert!(out.error.as_deref().is_some_and(|e| e.contains("work limit")), "{:?}", out.error);
+        assert_eq!(session.run(job("AFSimple_Calculate('SUM',['f0']);", fields), &[]).result.as_deref(), Some("1"));
+    }
+    #[test]
+    fn calculate_now_continues_after_an_ordinary_field_error() {
+        let mut session = ScriptSession::default();
+        let fields = ["bad", "good"].map(|name| FieldState::new(name, FieldType::Text, vec!["0".into()])).to_vec();
+        let mut j = job("calculateNow(); event.name + ':' + getField('good').value", fields);
+        j.calculations = vec![(0, "throw new Error('broken formula');".into()), (1, "event.value='42';".into())];
+        let out = session.run(j, &[]);
+        assert_eq!(out.error, None);
+        assert_eq!(out.result.as_deref(), Some("Test:42"));
+        assert!(out.console.iter().any(|line| line.contains("broken formula")));
+    }
+
+    #[test]
+    fn caught_calculation_exhaustion_stays_sticky_until_the_next_job() {
+        let mut session = ScriptSession::default();
+        let fields = vec![FieldState::new("amount", FieldType::Text, vec!["0".into()])];
+        let mut j = job("for(var i=0;i<4097;i++){try{calculateNow()}catch(e){}} try{calculateNow()}catch(e){} count;", fields.clone());
+        j.calculations = vec![(0, "count += 1;".into())];
+        j.doc_scripts = vec!["var count = 0;".into()];
+        let out = session.run(j.clone(), &[]);
+        assert!(out.calculation_limit_exceeded);
+        assert!(out.error.as_deref().is_some_and(|e| e.contains("calculation work limit")));
+        assert_eq!(out.result.as_deref(), Some("4096"));
+        j.script = "calculateNow();count".into();
+        let next = session.run(j, &[]);
+        assert!(!next.calculation_limit_exceeded);
+        assert_eq!(next.result.as_deref(), Some("4097"));
+    }
+}
diff --git a/crates/js/src/source.rs b/crates/js/src/source.rs
new file mode 100644
index 0000000000..deafcb8f18
--- /dev/null
+++ b/crates/js/src/source.rs
@@ -0,0 +1,145 @@
+//! `toSource()` on objects and arrays, which older forms use to keep state in a field or a
+//! global as text (#269, ported from #344). It writes a JavaScript literal of the value; scripts
+//! here can't `eval` it back, since strings never compile. Plain data only: strings, numbers,
+//! booleans, null, undefined, arrays and objects of them. Functions and cycles are refused, and
+//! so is a value past the depth, size or length bounds, rather than writing something that
+//! reads as another value.
+
+use super::host::{error, function, s, text};
+use super::{Context, JsArray, JsObject, JsResult, JsValue, NativeFunction, js_string};
+use boa_engine::property::{PropertyDescriptor, PropertyKey};
+
+/// Deepest nesting written.
+const MAX_DEPTH: usize = 64;
+/// Most values (each array item, property and the value itself) written.
+const MAX_VALUES: usize = 10_000;
+/// Longest source written, in bytes.
+const MAX_BYTES: usize = 1 << 20;
+
+/// Install `toSource` on `Object.prototype` (arrays inherit it), not enumerable, as in the
+/// engines that had it.
+pub(crate) fn install(ctx: &mut Context) -> JsResult<()> {
+    let to_source = function(ctx, NativeFunction::from_fn_ptr(to_source));
+    let prototype = ctx.intrinsics().constructors().object().prototype();
+    prototype
+        .insert_property(js_string!("toSource"), PropertyDescriptor::builder().value(to_source).writable(true).configurable(true).enumerable(false));
+    Ok(())
+}
+
+fn to_source(this: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    let mut writer = Writer { values: MAX_VALUES, bytes: MAX_BYTES, open: Vec::new() };
+    let out = writer.value(this, ctx)?;
+    Ok(s(&out))
+}
+
+/// What is left of the bounds, and the objects being written (to refuse a cycle).
+struct Writer {
+    values: usize,
+    bytes: usize,
+    open: Vec<JsObject>,
+}
+
+impl Writer {
+    fn value(&mut self, v: &JsValue, ctx: &mut Context) -> JsResult<String> {
+        self.values = self.values.checked_sub(1).ok_or_else(|| error("toSource: the value has too many parts"))?;
+        let out = if v.is_callable() {
+            return Err(error("toSource: functions can't be written"));
+        } else if let Some(o) = v.as_object() {
+            self.object(&o, ctx)?
+        } else if let Some(text) = v.as_string() {
+            quote(&text.to_std_string_escaped())
+        } else if v.is_null() {
+            "null".into()
+        } else if v.is_undefined() {
+            "undefined".into()
+        } else {
+            text(v, ctx)?
+        };
+        self.charge(out.len())?;
+        Ok(out)
+    }
+
+    fn object(&mut self, o: &JsObject, ctx: &mut Context) -> JsResult<String> {
+        if self.open.iter().any(|open| open == o) {
+            return Err(error("toSource: the value refers to itself"));
+        }
+        if self.open.len() >= MAX_DEPTH {
+            return Err(error("toSource: the value is nested too deeply"));
+        }
+        if !o.is_array() && !plain(o, ctx) {
+            return Err(error("toSource: only plain objects, arrays, strings, numbers, booleans, null and undefined can be written"));
+        }
+        self.open.push(o.clone());
+        let out = if o.is_array() { self.array(o, ctx) } else { self.fields(o, ctx) };
+        self.open.pop();
+        out
+    }
+
+    fn array(&mut self, o: &JsObject, ctx: &mut Context) -> JsResult<String> {
+        let array = JsArray::from_object(o.clone())?;
+        let len = array.length(ctx)?;
+        if len > self.values as u64 {
+            return Err(error("toSource: the array is too long"));
+        }
+        let mut items = Vec::new();
+        for i in 0..len {
+            items.push(self.value(&array.get(i, ctx)?, ctx)?);
+        }
+        Ok(format!("[{}]", items.join(", ")))
+    }
+
+    fn fields(&mut self, o: &JsObject, ctx: &mut Context) -> JsResult<String> {
+        let mut items = Vec::new();
+        for key in o.own_property_keys(ctx)? {
+            let label = match &key {
+                PropertyKey::Symbol(_) => continue,
+                PropertyKey::String(k) => k.to_std_string_escaped(),
+                PropertyKey::Index(i) => i.get().to_string(),
+            };
+            // `"__proto__": v` in a literal sets the prototype rather than an own property.
+            if label == "__proto__" {
+                return Err(error("toSource: a property named __proto__ can't be written"));
+            }
+            self.charge(label.len())?;
+            let value = self.value(&o.get(key, ctx)?, ctx)?;
+            items.push(format!("{}:{value}", quote(&label)));
+        }
+        Ok(format!("({{{}}})", items.join(", ")))
+    }
+
+    /// Count `n` bytes against the length bound. Every part counts, including the parts of what
+    /// is joined later, so a value repeated many times can't build a long result first.
+    fn charge(&mut self, n: usize) -> JsResult<()> {
+        self.bytes = self.bytes.checked_sub(n).ok_or_else(|| error("toSource: the result would be too long"))?;
+        Ok(())
+    }
+}
+
+/// Whether `o` is a plain object: an ordinary one whose prototype is `Object.prototype` (or
+/// none), so its own properties are all there is to it. A Date, a RegExp, a boxed value, a
+/// proxy or a class instance holds more than a literal of its properties would give back.
+fn plain(o: &JsObject, ctx: &Context) -> bool {
+    let object_prototype = ctx.intrinsics().constructors().object().prototype();
+    o.is_ordinary() && o.prototype().is_none_or(|p| p == object_prototype)
+}
+
+/// `text` as a double-quoted JavaScript string literal.
+fn quote(text: &str) -> String {
+    let mut out = String::with_capacity(text.len() + 2);
+    out.push('"');
+    for c in text.chars() {
+        match c {
+            '\\' => out.push_str("\\\\"),
+            '"' => out.push_str("\\\""),
+            '\n' => out.push_str("\\n"),
+            '\r' => out.push_str("\\r"),
+            '\t' => out.push_str("\\t"),
+            '\u{2028}' => out.push_str("\\u2028"),
+            '\u{2029}' => out.push_str("\\u2029"),
+            c if c.is_control() => out.push_str(&format!("\\u{:04x}", c as u32)),
+            c => out.push(c),
+        }
+    }
+    out.push('"');
+    out
+}
diff --git a/crates/js/src/tests.rs b/crates/js/src/tests.rs
index fb49c06532..ece4443b7d 100644
--- a/crates/js/src/tests.rs
+++ b/crates/js/src/tests.rs
@@ -17,7 +17,7 @@ fn fields() -> Vec<FieldState> {
     ]
 }
 
-/// The document these tests' scripts run in.
+/// Provide synthetic document metadata and page boxes for isolated JavaScript API tests.
 fn doc() -> DocInfo {
     DocInfo { file_name: "order.pdf".into(), num_pages: 3, page: 0, info: vec![("title".into(), "Order".into())], ..Default::default() }
 }
@@ -29,8 +29,7 @@ fn go(script: &str, event: &Event) -> Outcome {
 
 #[test]
 fn calculate_now_reports_errors_and_continues() {
-    let calculations =
-        vec![("bad".into(), "getField('price').value = 'partial'; throw new Error('broken');".into()), ("good".into(), "event.value = 'ok';".into())];
+    let calculations = vec![(0, "getField('price').value = 'partial'; throw new Error('broken');".into()), (1, "event.value = 'ok';".into())];
     let state = Arc::new(vec![
         FieldState::new("bad", FieldType::Text, vec![]),
         FieldState::new("good", FieldType::Text, vec![]),
@@ -46,7 +45,7 @@ fn calculate_now_reports_errors_and_continues() {
         Limits::default(),
     );
     assert_eq!(outcome.error, None);
-    assert!(outcome.console.iter().any(|line| line.contains("calculation script for bad failed: Error: broken")), "{outcome:?}");
+    assert!(outcome.console.iter().any(|line| line.contains("Calculate bad: Error: broken")), "{outcome:?}");
     assert!(outcome.console.iter().any(|line| line == "continued"), "{outcome:?}");
     assert_eq!(outcome.changed.iter().find(|field| field.name == "good").unwrap().value, ["ok"]);
     assert!(outcome.changed.iter().all(|field| field.name != "price"), "{outcome:?}");
@@ -62,7 +61,7 @@ fn calculate_now_sets_read_only_fields_and_handles_hundreds() {
         let mut state = FieldState::new(name.clone(), FieldType::Text, vec![]);
         state.readonly = true;
         states.push(state);
-        calculations.push((name, "event.value = 'calculated';".into()));
+        calculations.push((index, "event.value = 'calculated';".into()));
     }
     let state = Arc::new(states);
     let outcome =
@@ -74,10 +73,10 @@ fn calculate_now_sets_read_only_fields_and_handles_hundreds() {
 
 #[test]
 fn caught_calculate_now_recursion_has_a_step_limit() {
-    let calculations: Vec<_> = (0..600).map(|index| (format!("loop{index}"), "try { calculateNow(); } catch (e) {}".into())).collect();
-    let state = Arc::new(calculations.iter().map(|(name, _)| FieldState::new(name.clone(), FieldType::Text, vec![])).collect());
+    let calculations: Vec<_> = (0..600).map(|index| (index, "try { calculateNow(); } catch (e) {}".into())).collect();
+    let state = Arc::new(calculations.iter().map(|(name, _)| FieldState::new(format!("loop{name}"), FieldType::Text, vec![])).collect());
     let outcome = run_shared_calculations("calculateNow();", &Event::doc("Console"), &doc(), state, &[], &calculations, Limits::default());
-    assert!(outcome.error.as_deref().is_some_and(|error| error.contains("calculateNow evaluation limit exceeded")), "{outcome:?}");
+    assert!(outcome.calculation_limit_exceeded && outcome.error.is_some(), "{outcome:?}");
 }
 
 #[test]
@@ -88,6 +87,17 @@ fn calculate_scripts_read_fields_and_set_the_value() {
     assert!(o.rc);
 }
 
+/// An array of field values copies each entry: one long string listed many times is held to
+/// the run's byte budget, not copied once per listing.
+#[test]
+fn an_array_of_values_stops_at_the_byte_budget() {
+    let fill = "var s = 'x'; while (s.length < 65536) s += s; var a = []; for (var i = 0; i < N; i++) a.push(s); getField('qty').value = a;";
+    let o = go(&fill.replace('N', "600"), &Event::field("Calculate", "total", ""));
+    assert!(o.error.as_deref().is_some_and(|e| e.contains("byte limit exceeded")), "{:?}", o.error);
+    let o = go(&fill.replace('N', "400"), &Event::field("Calculate", "total", ""));
+    assert_eq!(o.error, None);
+}
+
 /// `event.value` reads and writes as a plain value, numbers included, and the outcome says whether
 /// the script assigned it, even to the value it already had.
 #[test]
@@ -104,6 +114,7 @@ fn the_outcome_says_whether_the_script_assigned_event_value() {
 }
 
 #[test]
+/// Expose all supported page boxes in rotated-user-space order using only supplied document geometry.
 fn get_page_box_returns_supported_boxes_in_rotated_user_space() {
     let mut document = doc();
     document.page_boxes = vec![
@@ -118,7 +129,7 @@ fn get_page_box_returns_supported_boxes_in_rotated_user_space() {
     ];
     document.page_rotations = vec![0, 90, 270];
     let out = run(
-        "JSON.stringify([this.getPageBox(), this.getPageBox('Media', 1), this.getPageBox('Bleed', 0), this.getPageBox('Trim', 0), this.getPageBox('Art', 2)])",
+        "JSON.stringify([this.getPageBox(), this.getPageBox('Media', 1), this.getPageBox('Art', 2)])",
         &Event::doc("Console"),
         &document,
         &[],
@@ -126,21 +137,15 @@ fn get_page_box_returns_supported_boxes_in_rotated_user_space() {
         Limits::default(),
     );
     assert_eq!(out.error, None);
-    assert_eq!(out.result.as_deref(), Some("[[0,280,180,0],[-10,190,290,-10],[5,275,175,5],[10,270,170,10],[15,165,265,15]]"));
+    assert_eq!(out.result.as_deref(), Some("[[0,280,180,0],[-10,190,290,-10],[15,165,265,15]]"));
 }
 
 #[test]
+/// Unknown box names, malformed page indices and pages outside the snapshot produce script errors.
 fn get_page_box_rejects_unknown_boxes_and_invalid_pages() {
-    for script in [
-        "this.getPageBox('BBox')",
-        "this.getPageBox(1)",
-        "this.getPageBox('Crop', -1)",
-        "this.getPageBox('Crop', 1.5)",
-        "this.getPageBox('Crop', 3)",
-        "this.getPageBox('Crop', null)",
-        "this.getPageBox('Crop', true)",
-        "this.getPageBox('Crop', '0')",
-    ] {
+    for script in
+        ["this.getPageBox('BBox')", "this.getPageBox(1)", "this.getPageBox('Crop', -1)", "this.getPageBox('Crop', 1.5)", "this.getPageBox('Crop', 3)"]
+    {
         let out = go(script, &Event::doc("Console"));
         assert!(out.error.is_some(), "{script}");
     }
@@ -188,17 +193,45 @@ fn scripts_change_other_fields_and_their_properties() {
     assert_eq!(o.changed.iter().find(|f| f.name == "size").unwrap().value, ["l"]);
 }
 
+#[test]
+/// Normal captions read/write correctly; unsupported faces cannot partially mutate a button.
+fn push_button_caption_methods_read_write_and_reject_other_faces() {
+    let mut button = FieldState::new("go", FieldType::Button, vec![]);
+    button.caption = Some("Old".into());
+    let fields = vec![button, FieldState::new("text", FieldType::Text, vec![])];
+    let run = |script: &str| run(script, &Event::field("Mouse Up", "go", ""), &doc(), &fields, &[], Limits::default());
+    let got = run("event.value = getField('go').buttonGetCaption();");
+    assert_eq!(got.value, "Old");
+    let set = run("getField('go').buttonSetCaption('New'); event.value = getField('go').buttonGetCaption();");
+    assert_eq!(set.value, "New");
+    assert_eq!(set.changed[0].caption.as_deref(), Some("New"));
+    assert!(got.changed.is_empty(), "a getter must not change the form");
+    for face in ["1", "2", "-1", "0.5", "NaN", "Infinity"] {
+        for method in [format!("getField('go').buttonGetCaption({face});"), format!("getField('go').buttonSetCaption('Bad', {face});")] {
+            let rejected = run(&method);
+            assert!(rejected.error.is_some(), "{method}");
+            assert!(rejected.changed.is_empty(), "an invalid face must not mutate the caption");
+        }
+    }
+    assert!(run("getField('text').buttonSetCaption('Bad');").error.is_some());
+    assert!(run("getField('text').buttonGetCaption();").error.is_some());
+    let cleared = run("getField('go').buttonSetCaption('', 0); event.value = getField('go').buttonGetCaption(0);");
+    assert_eq!(cleared.error, None);
+    assert_eq!(cleared.value, "");
+    assert_eq!(cleared.changed[0].caption.as_deref(), Some(""));
+}
+
 #[test]
 fn widget_rect_reads_and_writes_a_four_number_array() {
     let o = go(
-        "var t = getField('total'); t.rect = [10, 20, 110, 50]; event.value = getField('total').rect.join(',');",
+        "var t = getField('total'); t.rect = [10, 50, 110, 20]; event.value = getField('total').rect.join(',');",
         &Event::field("Mouse Up", "agree", ""),
     );
     assert_eq!(o.error, None);
-    assert_eq!(o.value, "10,20,110,50");
-    assert_eq!(o.changed.iter().find(|f| f.name == "total").and_then(|f| f.rect), Some([10.0, 20.0, 110.0, 50.0]));
-    let o = go("getField('total').rect = [110, 50, 10, 20];", &Event::field("Mouse Up", "agree", ""));
-    assert_eq!(o.changed.iter().find(|f| f.name == "total").and_then(|f| f.rect), Some([10.0, 20.0, 110.0, 50.0]));
+    assert_eq!(o.value, "10,50,110,20");
+    assert_eq!(o.changed.iter().find(|f| f.name == "total").and_then(|f| f.rect), Some([10.0, 50.0, 110.0, 20.0]));
+    let o = go("getField('total').rect = [110, 20, 10, 50];", &Event::field("Mouse Up", "agree", ""));
+    assert!(o.error.is_some());
     let o = go("getField('total').rect = [0, 0, Infinity, 10];", &Event::field("Mouse Up", "agree", ""));
     assert!(o.error.is_some());
     assert!(o.changed.iter().all(|f| f.name != "total"));
@@ -486,6 +519,10 @@ fn app_alert_titles_are_clipped_and_charged() {
     // The title's bytes count against the budget with the text's, and a message the budget
     // has no room for is left out and counted.
     let mut h = Host {
+        event_name: "Open".into(),
+        icons: Vec::new(),
+        objects: Default::default(),
+        field_keys: Default::default(),
         fields: Arc::new(Vec::new()),
         changed: BTreeSet::new(),
         formatted: BTreeSet::new(),
@@ -493,10 +530,16 @@ fn app_alert_titles_are_clipped_and_charged() {
         console: Vec::new(),
         requests: Vec::new(),
         doc: doc(),
-        calculations: Arc::new(Vec::new()),
+        calculations: Vec::new(),
         calculate_depth: 0,
-        calculate_steps: 0,
+        calculation_evaluations: 0,
+        calculation_limit_exceeded: false,
+        calculation_work: 0,
+        current_event: JsValue::undefined(),
+        reset_calls: 0,
+        reset_limit_exceeded: false,
         kept: 0,
+        retained: 0,
         dropped: 0,
     };
     h.alert(Message { title: Some("Order form".into()), ..Message::plain("Saved") });
@@ -631,6 +674,8 @@ fn deeply_nested_scripts_fail_instead_of_crashing() {
     assert!(o.doc_errors.len() == 1 && o.doc_errors[0].contains("nested too deeply"), "{:?}", o.doc_errors);
 }
 
+/// Ordinary nesting below the guard's limits runs, and brackets in strings and comments don't
+/// count, however many there are.
 #[test]
 fn ordinary_nesting_still_runs() {
     let n = 40;
@@ -638,11 +683,164 @@ fn ordinary_nesting_still_runs() {
     let o = go(&s, &Event::field("Calculate", "a", ""));
     assert_eq!(o.error, None);
     assert_eq!(o.value, "5");
-    // Brackets in strings and comments don't count.
-    let s = format!("// {}\nevent.value = '{}'.length;", "(".repeat(1000), "[".repeat(1000));
+    let s = format!("// {}\n/* {} */ event.value = '{}'.length;", "(".repeat(1000), "{".repeat(1000), "[".repeat(1000));
     assert_eq!(go(&s, &Event::field("Calculate", "a", "")).value, "1000");
 }
 
+/// The reported #5079 reproduction: a regex literal whose body holds a quote (`/'/`) must not
+/// hide the brackets that follow it from the nesting guard. The old scan read `'` as the start
+/// of a string, so every `(` after `/'/` on the line was skipped; boa's unbounded recursive
+/// parser then overflowed the script thread's stack (the console's `js_run` path, on the
+/// `pdfcraft-js` thread) and aborted the app. With that scan, 200 brackets fail this assertion
+/// cleanly (boa reports a SyntaxError) and 64,000, the issue's file, overflow the stack.
+#[test]
+fn a_quote_in_a_regex_cannot_hide_nesting_from_the_guard() {
+    for n in [200, 64_000] {
+        let s = format!("event.value = /'/ {}1;", "(".repeat(n));
+        let o = go(&s, &Event::field("Calculate", "a", ""));
+        assert!(o.error.as_deref().is_some_and(|e| e.contains("nested too deeply")), "{n}: {:?}", o.error);
+    }
+}
+
+/// A quote in a regex character class, with the real nesting after it, is refused, while
+/// ordinary string and regex literals still run, strings of brackets of any length among them.
+#[test]
+fn nesting_guard_counts_brackets_hidden_by_a_regex_quote() {
+    let hidden = format!("var r = /['\"]/; event.value = {}1{}; event.value = 'ok';", "(".repeat(65), ")".repeat(65));
+    assert!(super::run::refuse(&hidden).is_some_and(|e| e.contains("nested too deeply")), "the regex quote must not hide parser nesting");
+
+    let o = go("event.value = '()[]{}'.length;", &Event::field("Calculate", "a", ""));
+    assert_eq!((o.error, o.value.as_str()), (None, "6"));
+    let o = go("var r = /['\"]/; event.value = r.test(\"'\") ? 1 : 0;", &Event::field("Calculate", "a", ""));
+    assert_eq!((o.error, o.value.as_str()), (None, "1"));
+    for n in [64, 65, 10_000] {
+        let o = go(&format!("event.value = '{}'.length;", "(".repeat(n)), &Event::field("Calculate", "a", ""));
+        assert_eq!((o.error, o.value), (None, n.to_string()));
+    }
+}
+
+/// A script that nests one level deeper on each line, behind a quote inside a regular
+/// expression: `x=` followed by lines of `(/"/,"))))",` (#5079, after the first fix). A scan
+/// that reads the regex's quote as the start of a string is out of phase with the real strings
+/// from there on: it reads `"/,"` as a string and the closing brackets in the real string
+/// `"))))"` as code, so on every line its depth falls back to 0 while boa's grows by one. 5,000
+/// lines are 65 KB, under the size limit, and nest 5,000 deep. The same with `'`, and with
+/// template text, which that scan didn't skip at all, is refused too. As deep as the limit,
+/// closed properly, is ordinary code and runs.
+#[test]
+fn a_quote_in_a_regex_cannot_put_the_guard_out_of_phase() {
+    use super::nesting::MAX_BRACKET_DEPTH;
+    for q in ["\"", "'", "`"] {
+        let line = format!("(/{q}/,{q}))))){q},\n");
+        for n in [MAX_BRACKET_DEPTH + 1, 5_000] {
+            let s = format!("x={}", line.repeat(n));
+            assert!(s.len() <= super::MAX_SCRIPT_BYTES);
+            assert!(super::run::refuse(&s).is_some_and(|e| e.contains("nested too deeply")), "{q} x {n}");
+        }
+        // The real strings alone, with no regex in front.
+        let s = format!("x={}", format!("({q}))))){q},").repeat(MAX_BRACKET_DEPTH + 1));
+        assert!(super::run::refuse(&s).is_some_and(|e| e.contains("nested too deeply")), "{q} without the regex");
+
+        let n = MAX_BRACKET_DEPTH;
+        let s = format!("var x={}0{};\nevent.value = x;", line.repeat(n), ")".repeat(n));
+        let o = go(&s, &Event::field("Calculate", "a", ""));
+        assert_eq!((o.error, o.value.as_str()), (None, "0"), "{q}");
+    }
+}
+
+/// Template substitutions nest like brackets, and template text, comments and regular
+/// expressions full of brackets, quotes and slashes still run.
+#[test]
+fn nesting_guard_reads_templates_regexes_and_comments() {
+    use super::nesting::MAX_BRACKET_DEPTH;
+    let nested = |n: usize| (0..n).fold("1".to_string(), |s, _| format!("`${{{s}}}`"));
+    let o = go(&format!("event.value = {};", nested(10)), &Event::field("Calculate", "a", ""));
+    assert_eq!((o.error, o.value.as_str()), (None, "1"));
+    assert!(super::run::refuse(&nested(MAX_BRACKET_DEPTH + 1)).is_some_and(|e| e.contains("nested too deeply")));
+
+    let s = [
+        "var r = /[(\\[{'\"`/]+/g, s = \"a(b[c{d'e`f/g\";",
+        "var t = `((( [[[ {{{ ' \" / ${s.replace(r, '')} ${'}'} )`;",
+        "var u = /\\(/.source + /[)]/.source + /(a)(?:b)/.source + /a{2}/.source;",
+        "// a comment with ((( and ' and \"",
+        "/* another with [[[ and ` and / */",
+        "var v = 10 / 2 / 5, w = (10 / 2) / 5, z = 1; z--> 0; <!-- an old-style comment (((",
+        "event.value = [t.length, u, v, w].join(' ');",
+    ]
+    .join("\n");
+    let o = go(&s, &Event::field("Calculate", "a", ""));
+    assert_eq!((o.error, o.value.as_str()), (None, "29 \\([)](a)(?:b)a{2} 1 1"));
+}
+
+/// A leading `#!` line is a comment: brackets in it don't count, while nesting on the lines
+/// after it still does.
+#[test]
+fn a_hashbang_line_is_read_as_a_comment() {
+    use super::nesting::MAX_BRACKET_DEPTH;
+    let s = format!("#!{}\nevent.value = 1;", "(".repeat(MAX_BRACKET_DEPTH + 1));
+    let o = go(&s, &Event::field("Calculate", "a", ""));
+    assert_eq!((o.error, o.value.as_str()), (None, "1"));
+    let n = MAX_BRACKET_DEPTH + 1;
+    let s = format!("#!\nevent.value = {}1{};", "(".repeat(n), ")".repeat(n));
+    assert!(super::run::refuse(&s).is_some_and(|e| e.contains("nested too deeply")));
+}
+
+/// Divisions don't add up to a refusal: a form's calculation rounds with `/` many times over,
+/// and on one long line, and each `/` could start a regular expression as far as the scan
+/// knows. The reading as a regular expression is dropped where boa would reject it.
+#[test]
+fn divisions_do_not_add_up_to_a_refusal() {
+    let s = format!("var a = 7, b = 2, x = 0;\n{}event.value = x;", "x = Math.round(a / b * 100) / 100; x = (a / b) / (b / b);\n".repeat(500));
+    assert!(s.len() <= super::MAX_SCRIPT_BYTES);
+    let o = go(&s, &Event::field("Calculate", "a", ""));
+    assert_eq!((o.error, o.value.as_str()), (None, "3.5"));
+    let s = format!("event.value = 1{};", "/1".repeat(2_000));
+    let o = go(&s, &Event::field("Calculate", "a", ""));
+    assert_eq!((o.error, o.value.as_str()), (None, "1"));
+}
+
+/// What the guard's reading assumes boa does: a string or regular expression can't run into a
+/// line break, and a regular expression's groups must match, all as syntax errors when boa
+/// reads the script. The guard drops a reading at those points; if boa ever accepted one of
+/// these, that reading could be boa's, and the guard would have to keep it.
+#[test]
+fn boa_rejects_what_the_nesting_guard_drops() {
+    for s in ["var r = /)/;", "var r = /(/;", "var r = /a)(b/;", "var r = /a\n/;", "var r = /a\\\n/;", "var s = 'a\nb';", "var s = \"a\rb\";"] {
+        // Rejected while boa reads the script, before the line in front of it runs.
+        let o = go(&format!("console.println('ran');\n{s}"), &Event::field("Calculate", "a", ""));
+        assert!(o.error.as_deref().is_some_and(|e| !e.contains("nested too deeply")), "{s:?}: {:?}", o.error);
+        assert!(o.console.is_empty(), "{s:?} was rejected only when it ran: {:?}", o.console);
+    }
+    for s in ["var r = /[(]/;", "var r = /\\)/;", "var r = /[)]/;", "var s = 'a\\\nb';", "var s = 'a\u{2028}b';"] {
+        let o = go(s, &Event::field("Calculate", "a", ""));
+        assert_eq!(o.error, None, "{s:?}");
+    }
+}
+
+/// The guard's three limits sit exactly where documented: 64 nested brackets, a run of 64
+/// prefix operators and 4,096 conditionals pass, and one more of each is refused.
+#[test]
+fn nesting_guard_limits_brackets_prefixes_and_conditionals_separately() {
+    assert_eq!(super::run::refuse(&format!("{}1{}", "(".repeat(64), ")".repeat(64))), None);
+    assert!(super::run::refuse(&format!("{}1{}", "(".repeat(65), ")".repeat(65))).is_some());
+
+    assert_eq!(super::run::refuse(&format!("{}1", "!".repeat(64))), None);
+    assert!(super::run::refuse(&format!("{}1", "!".repeat(65))).is_some());
+
+    assert_eq!(super::run::refuse(&"?".repeat(4096)), None);
+    assert!(super::run::refuse(&"?".repeat(4097)).is_some());
+}
+
+/// Closing brackets inside a comment don't cancel real nesting (#5079): 1,000 groups of 50
+/// opening brackets, each followed by a block comment holding 50 closing ones, nest 50,000 deep
+/// for the parser, and the guard refuses the script before boa parses it.
+#[test]
+fn closing_brackets_in_comments_do_not_cancel_nesting() {
+    let group = format!("{}/*{}*/", "(".repeat(50), ")".repeat(50));
+    let s = group.repeat(1000);
+    assert_eq!(super::run::refuse(&s).as_deref(), Some("the script is nested too deeply to run safely"));
+}
+
 /// Code built from strings at run time would reach the parser without the size and nesting
 /// checks the script itself passed, so `eval` and the `Function` constructors refuse it.
 #[test]
@@ -927,6 +1125,24 @@ mod xfa_model {
         assert_eq!(o.result.as_deref(), Some("7"));
     }
 
+    /// A copy of a subform costs its nodes, names and SOMs: instances of one with a long name
+    /// stop at the run's byte budget, well before the instance cap.
+    #[test]
+    fn instances_of_a_subform_with_long_names_stop_at_the_byte_budget() {
+        let mut f = form();
+        let table = &mut f.children[0].children[4];
+        assert_eq!(table.name, "table");
+        for row in &mut table.children {
+            row.children.push(field(&"n".repeat(1 << 20), "", "", false));
+        }
+        let ev = XfaEvent { activity: "click".into(), target: "form1[0].page1[0].go[0]".into(), ..Default::default() };
+        let o = run_xfa("for (var i = 0; i < 100; i++) table._row.addInstance(1); table._row.count", &ev, &XfaDoc::default(), &f, Limits::default());
+        assert_eq!(o.error, None, "{:?}", o.error);
+        let count: usize = o.result.as_deref().unwrap_or_default().parse().expect("a count");
+        assert!((3..50).contains(&count), "{count} instances");
+        assert_eq!(o.effects.iter().filter(|e| matches!(e, XfaEffect::AddInstance { .. })).count(), count - 2);
+    }
+
     /// On screen every page is a sheet of its own: `xfa.layout.sheet` counts it from 0, as
     /// `absPage` does (forms show `sheet(this) + 1`), and `sheetCount` is the page count.
     #[test]
@@ -1439,6 +1655,10 @@ mod formcalc {
 
     #[test]
     fn date2num_rejects_days_past_the_end_of_the_month() {
+        // A month name is read from the text's next few characters only, whatever follows.
+        let serial = calc(r#"Date2Num("2024-09-01")"#);
+        assert_eq!(calc(r#"Date2Num("September 1, 2024, and a note that runs on", "MMMM D, YYYY")"#), serial);
+        assert_eq!(calc(r#"Date2Num("Sep 1, 2024", "MMM D, YYYY")"#), serial);
         assert_eq!(calc(r#"Date2Num("2023-02-30")"#), "0");
         assert_eq!(calc(r#"Date2Num("31/04/2024", "DD/MM/YYYY")"#), "0");
         assert_eq!(calc(r#"Date2Num("2023-02-29")"#), "0");
@@ -1954,6 +2174,22 @@ mod session {
         assert!(started.elapsed() < std::time::Duration::from_secs(10), "{:?}", started.elapsed());
     }
 
+    /// The #5079 reproduction on the XFA-open path: an initialize script of `/'/` followed by
+    /// 64,000 `(` overflowed the `pdfcraft-xfa-session` thread's stack and aborted the app. The
+    /// nesting guard reads past the regex's quote, so the script is refused and the session stays
+    /// alive for the next one. So is one where the quote puts later strings out of phase, nesting
+    /// a level deeper on each of 5,000 lines.
+    #[test]
+    fn a_quote_in_a_regex_cannot_hide_nesting_from_an_initialize_script() {
+        let mut s = XfaSession::new(XfaDoc::default());
+        for hostile in [format!("/'/ {}1", "(".repeat(64_000)), format!("x={}", "(/\"/,\"))))\",\n".repeat(5_000))] {
+            let o = s.run(script(&hostile, false, "form1[0].page1[0].total[0]", "initialize"));
+            assert!(o.error.as_deref().is_some_and(|e| e.contains("nested too deeply")), "{:?}", o.error);
+        }
+        assert_eq!(s.dead(), None);
+        assert_eq!(s.run(script("1 + 1", false, "form1[0].page1[0].total[0]", "calculate")).result.as_deref(), Some("2"));
+    }
+
     /// A JavaScript or FormCalc script whose engine takes longer to be ready than the script's
     /// time limit still runs and returns its result, and the session stays alive.
     #[test]
@@ -2112,7 +2348,7 @@ mod runtime_highlight {
     #[test]
     fn app_runtime_highlight_reads_the_viewers_setting_and_asks_to_change_it() {
         let ev = Event::field("Calculate", "total", "");
-        let on = DocInfo { highlight: true, ..doc() };
+        let on = DocInfo { runtime_highlight: true, ..doc() };
         let o = run("event.value = String(app.runtimeHighlight);", &ev, &on, &fields(), &[], Limits::default());
         assert_eq!((o.value.as_str(), o.requests.len()), ("true", 0));
         let o = go("var was = app.runtimeHighlight; app.runtimeHighlight = true; event.value = was + ',' + app.runtimeHighlight;", &ev);
@@ -2135,6 +2371,15 @@ mod runtime_highlight {
         assert!(!o.requests.iter().any(|r| matches!(r, Request::Highlight(_))));
     }
 
+    #[test]
+    fn dropped_zoom_request_does_not_change_the_script_value() {
+        let document = DocInfo { zoom: 100.0, ..doc() };
+        let script = format!("for (var i = 0; i < {}; i++) app.execMenuItem('Print'); this.zoom = 200; this.zoom;", crate::xfa::MAX_EFFECTS);
+        let out = run(&script, &Event::doc("Console"), &document, &[], &[], Limits::default());
+        assert_eq!(out.error, None);
+        assert_eq!(out.result.as_deref(), Some("100"));
+    }
+
     /// The same in XFA scripts, where the change is an effect; nothing is asked for when the
     /// setting is already what the script wants.
     #[test]
@@ -2429,3 +2674,150 @@ fn a_plain_form_sees_the_xfa_version_but_not_installed() {
     assert_eq!(o.value, "undefined number 3.5");
     assert_eq!(o.alerts, [Message::plain("old viewer")]);
 }
+
+/// Arrays assigned to several fields are held to one run-wide budget, and replacing a field's
+/// array frees its charge.
+#[test]
+fn retained_array_text_is_charged_across_fields() {
+    let fill = "var s = 'x'; while (s.length < 65536) s += s; var a = []; for (var i = 0; i < 320; i++) a.push(s);";
+    let one = |tail: &str| go(&format!("{fill} {tail}"), &Event::field("Calculate", "total", ""));
+    let o = one("getField('qty').textColor = a; getField('qty').textColor = a; getField('zip').textColor = ['RGB'];");
+    assert_eq!(o.error, None, "replacing an array frees its charge: {:?}", o.error);
+    let o = one("getField('qty').textColor = a; getField('zip').fillColor = a;");
+    assert!(o.error.as_deref().is_some_and(|e| e.contains("hold more than")), "{:?}", o.error);
+}
+
+#[test]
+fn string_arrays_refuse_aggregate_text_before_request_clipping() {
+    let o = go("resetForm(new Array(65).fill('x'.repeat(1 << 19)));", &Event::doc("Console"));
+    assert!(o.error.as_deref().is_some_and(|e| e.contains("string array byte limit")), "{:?}", o.error);
+    assert!(o.requests.is_empty() && o.changed.is_empty());
+}
+
+#[test]
+fn reset_call_limit_precedes_argument_conversion_and_survives_catches() {
+    let o = go("for(var i=0;i<64;i++)resetForm();resetForm([{toString(){throw Error('argument read');}}]);", &Event::doc("Console"));
+    assert!(o.error.as_deref().is_some_and(|e| e.contains("reset call limit")), "{:?}", o.error);
+    assert_eq!(o.requests.iter().filter(|r| matches!(r, Request::Reset(_))).count(), 64);
+}
+
+#[test]
+fn caught_reset_limit_cannot_admit_additional_resets() {
+    let out = go("for(var i=0;i<10000;i++){try{resetForm();}catch(e){}} getField('price').value=99;", &Event::doc("Console"));
+    assert_eq!(out.error, None);
+    assert!(out.reset_limit_exceeded);
+    assert_eq!(out.requests.iter().filter(|r| matches!(r, Request::Reset(_))).count(), 64);
+}
+
+#[test]
+fn af_simple_calculate_expands_groups_and_duplicate_names() {
+    let fields = vec![
+        FieldState::new("row.0", FieldType::Text, vec!["2".into()]),
+        FieldState::new("row.1", FieldType::Text, vec!["3".into()]),
+        FieldState::new("row.1", FieldType::Text, vec!["5".into()]),
+        FieldState::new("rowExtra", FieldType::Text, vec!["100".into()]),
+        // A multiple-selection list counts its first value, as the native Simple calculation does.
+        FieldState::new("picks", FieldType::ListBox, vec!["4".into(), "6".into()]),
+    ];
+    for (op, names, expected) in [
+        ("SUM", "['row']", 10.0),
+        ("SUM", "['row.1']", 8.0),
+        ("SUM", "['row','row.1']", 18.0),
+        ("PRD", "['row']", 30.0),
+        ("AVG", "['row']", 10.0 / 3.0),
+        ("MIN", "['row']", 2.0),
+        ("MAX", "['row']", 5.0),
+        ("SUM", "['picks']", 4.0),
+        ("MAX", "['picks']", 4.0),
+        ("SUM", "['missing']", 0.0),
+        ("PRD", "['missing']", 0.0),
+        ("AVG", "['missing']", 0.0),
+        ("MIN", "[]", 0.0),
+        ("MAX", "[]", 0.0),
+    ] {
+        let script = format!("event.value=AFSimple_Calculate('{op}',{names});event.value;");
+        let out = run(&script, &Event::field("Calculate", "out", ""), &Default::default(), &fields, &[], Default::default());
+        assert_eq!(out.error, None, "{script}");
+        assert!((out.result.unwrap().parse::<f64>().unwrap() - expected).abs() < 1e-10, "{script}");
+    }
+}
+#[test]
+fn af_simple_calculate_bounds_selector_work_before_expansion() {
+    let fields = vec![FieldState::new("n", FieldType::Text, vec!["1".into()]); 4096];
+    let out =
+        run("AFSimple_Calculate('SUM',new Array(4096).fill('n'));", &Event::doc("Console"), &Default::default(), &fields, &[], Default::default());
+    assert!(out.error.as_deref().is_some_and(|e| e.contains("calculation field lookup exceeds")));
+}
+
+/// `toSource` writes plain state as a JavaScript literal of the same value (#269, from #344).
+/// Scripts here can't `eval` it back (strings never compile), so the exact text is checked.
+#[test]
+fn to_source_writes_plain_state_as_a_literal() {
+    let event = Event::doc("Console");
+    let out = go(
+        "var v = {tab: 2, name: 'a \"q\"\\n', on: true, none: null, list: ['qty', null, undefined, 1.5, [3]]}; \
+         [v.toSource(), [1, 'x'].toSource(), ({}).toSource()].join('|');",
+        &event,
+    );
+    assert_eq!(out.error, None, "{out:?}");
+    assert_eq!(
+        out.result.as_deref(),
+        Some(r#"({"tab":2, "name":"a \"q\"\n", "on":true, "none":null, "list":["qty", null, undefined, 1.5, [3]]})|[1, "x"]|({})"#)
+    );
+    assert!(go("Object.keys({}).indexOf('toSource') < 0 && !({}).propertyIsEnumerable('toSource');", &event).result.as_deref() == Some("true"));
+}
+
+/// `toSource` refuses what it can't write faithfully or within its bounds, with an error the
+/// script can catch.
+#[test]
+fn to_source_refuses_cycles_functions_and_oversized_state() {
+    let event = Event::doc("Console");
+    for (script, expected) in [
+        ("var v = {}; v.v = v; v.toSource();", "refers to itself"),
+        ("({f: function () {}}).toSource();", "functions"),
+        ("var v = []; v.length = 1000000; v.toSource();", "too long"),
+        ("var v = []; for (var i = 0; i < 100; i++) v = [v]; v.toSource();", "nested too deeply"),
+        ("var s = new Array(4097).join('x'); var v = []; for (var i = 0; i < 300; i++) v.push(s); v.toSource();", "too long"),
+        ("({when: new Date(0)}).toSource();", "only plain objects"),
+        ("[/x/].toSource();", "only plain objects"),
+        ("function C() { this.a = 1; } new C().toSource();", "only plain objects"),
+        ("var v = JSON.parse('{\"__proto__\": 1}'); v.toSource();", "__proto__"),
+    ] {
+        let out = go(script, &event);
+        assert!(out.error.as_deref().is_some_and(|e| e.contains(expected)), "{script}: {out:?}");
+    }
+    let out = go("try { var v = {}; v.v = v; v.toSource(); 'no'; } catch (e) { 'caught'; }", &event);
+    assert_eq!(out.result.as_deref(), Some("caught"));
+}
+
+/// `setItems` replaces a choice field's items (text, or [text, export] pairs), keeping the value
+/// when an item still has it; `setAction` records the script for its trigger, the last one
+/// winning. Both refuse what they can't do.
+#[test]
+fn set_items_and_set_action_change_the_field() {
+    let event = Event::doc("Console");
+    let out = go(
+        "var f = getField('size'); f.setItems([['Medium', 'm'], 'Huge', ['Tiny']]); \
+         f.setAction('OnFocus', 'console.println(1)'); f.setAction('OnFocus', 'console.println(2)'); f.setAction('Keystroke', 'event.rc = true;'); \
+         [f.numItems, f.getItemAt(1, true), f.getItemAt(2, false), f.value].join('|');",
+        &event,
+    );
+    assert_eq!(out.error, None, "{out:?}");
+    assert_eq!(out.result.as_deref(), Some("3|Huge|Tiny|m"));
+    let size = out.changed.iter().find(|f| f.name == "size").unwrap();
+    assert_eq!(size.options, [("m".into(), "Medium".into()), ("Huge".into(), "Huge".into()), ("Tiny".into(), "Tiny".into())]);
+    assert_eq!(size.actions, [("OnFocus".into(), "console.println(2)".into()), ("Keystroke".into(), "event.rc = true;".into())]);
+
+    let out = go("var f = getField('size'); f.setItems(['a', 'b']); f.value;", &event);
+    assert_eq!(out.result.as_deref(), Some("a"), "the old value is gone: the first item's");
+
+    for (script, expected) in [
+        ("getField('price').setItems(['a']);", "not a combo box or list box"),
+        ("getField('size').setItems('a');", "needs an array"),
+        ("var a = []; a.length = 20000; getField('size').setItems(a);", "at most"),
+        ("getField('size').setAction('Explode', 'x');", "unknown trigger"),
+    ] {
+        let out = go(script, &event);
+        assert!(out.error.as_deref().is_some_and(|e| e.contains(expected)), "{script}: {out:?}");
+    }
+}
diff --git a/crates/js/src/xfa/globals.rs b/crates/js/src/xfa/globals.rs
index de57d7fd49..46dc8a713b 100644
--- a/crates/js/src/xfa/globals.rs
+++ b/crates/js/src/xfa/globals.rs
@@ -1,3 +1,5 @@
+use std::collections::HashSet;
+
 use super::host::host;
 use super::instances::instance_manager;
 use super::model::{MAX_DEPTH, XfaDoc, XfaEffect, XfaEvent, clip, payload, reset_names};
@@ -379,7 +381,7 @@ pub(super) fn install(ctx: &mut Context, event: &XfaEvent, doc: &XfaDoc, current
         "DataView",
         "Intl",
     ];
-    let mut defined: Vec<String> = RESERVED.iter().map(ToString::to_string).collect();
+    let mut defined: HashSet<String> = RESERVED.iter().map(ToString::to_string).collect();
     for scope in scopes {
         let kids: Vec<(usize, String, bool)> = {
             let h = host(ctx)?.borrow();
@@ -398,7 +400,7 @@ pub(super) fn install(ctx: &mut Context, event: &XfaEvent, doc: &XfaDoc, current
                 let im = instance_manager(ctx, scope, &name)?;
                 ctx.register_global_property(JsString::from(format!("_{name}").as_str()), im, rw)?;
             }
-            defined.push(name);
+            defined.insert(name);
         }
     }
     Ok(())
diff --git a/crates/js/src/xfa/instances.rs b/crates/js/src/xfa/instances.rs
index 2985794dc3..c737ea9db9 100644
--- a/crates/js/src/xfa/instances.rs
+++ b/crates/js/src/xfa/instances.rs
@@ -137,6 +137,17 @@ fn child_som(parent_som: String, name: &str, index: usize) -> String {
     }
 }
 
+/// Bytes a copy of `src`'s subtree keeps: a node, its name and its SOM (the copy's SOMs differ
+/// in their indices only) for every node [`clone_subtree`] copies.
+fn subtree_bytes(h: &XHost, src: usize, depth: usize) -> usize {
+    let Some(n) = h.nodes.get(src).filter(|_| depth <= MAX_DEPTH) else { return 0 };
+    let own = std::mem::size_of::<HNode>().saturating_add(n.name.len()).saturating_add(n.som.len());
+    n.children
+        .iter()
+        .filter(|&&k| !h.nodes.get(k).is_some_and(|c| c.gone || c.repeatable && c.index > 0))
+        .fold(own, |sum, &k| sum.saturating_add(subtree_bytes(h, k, depth + 1)))
+}
+
 /// A copy of `src`'s subtree (values cleared) under `parent`, returning the copy's index.
 fn clone_subtree(h: &mut XHost, src: usize, parent: Option<usize>, depth: usize) -> Option<usize> {
     if depth > MAX_DEPTH || h.nodes.len() >= MAX_NODES {
@@ -214,7 +225,10 @@ impl XHost {
         let name = h.nodes.get(first).map(|n| n.name.to_string()).unwrap_or_default();
         let parent_som = h.nodes.get(parent).map(|p| p.som.to_string()).unwrap_or_default();
         let som = child_som(parent_som, &name, live.len());
-        if !h.reserve(&XfaEffect::AddInstance { som: String::new() }, som.len()) {
+        // The copy's nodes, their names and SOMs, are charged to the run's byte budget before
+        // they are made: a subtree with long names must not be copied past it.
+        let copied = subtree_bytes(h, first, 0);
+        if !h.reserve(&XfaEffect::AddInstance { som: String::new() }, som.len().saturating_add(copied)) {
             return None;
         }
         let new = clone_subtree(h, first, Some(parent), 0)?;
diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index 08fb23d22b..2eae5e8656 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -32,10 +32,15 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   damaged partway, which may draw an image larger past the damage), no image is resampled. Colour and grayscale images above a
   threshold are resampled with a bicubic (Catmull-Rom) filter to a target resolution and
   stored as JPEG (Acrobat's quality steps) or ZIP; soft masks are resampled with their image. A
-  stencil `/Mask` has its own resolution, so the picture changes under it and it stays as it is.
-  An image is replaced only if the result is smaller. Images over 80 million pixels are left
-  alone by the image steps, here and below, whatever their settings (memory); Clean Up may still
-  Flate an unfiltered or LZW one. Left alone by these colour and grey
+  stencil `/Mask` has its own resolution, so the picture changes under it and it keeps its size and
+  its bits (stored again as a picture's mask, below).
+  An image is replaced only if the result is smaller. Images over 80 million pixels are left alone
+  by the image steps, here and below, whatever their settings (memory), except that the monochrome
+  step below takes an image already of one bit a pixel, a mask included, while its rows hold no more
+  bytes than 80 million pixels of eight bits (each row starts on a new byte: a byte for each 8
+  samples and one for any left over): up to 640 million pixels when it is wide, and a strip one
+  sample wide no taller than one of eight bits. Clean Up may still Flate an unfiltered or LZW one.
+  Left alone by these colour and grey
   settings: CMYK and other colour spaces, image masks, colour-key masks, decode arrays, more than 8 bits, JPEG 2000,
   JBIG2 and CCITT (black-and-white images, CCITT and JBIG2 among them, are below). A JPEG is read with
   its colour transform (an Adobe marker's, else `/ColorTransform`, ISO 32000-2 §7.4.8), so one
@@ -108,10 +113,19 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   - Apart from the downsampling it is lossless: the samples keep their meaning, so the colour
     space, decode array and `/Mask` stay, but for packed RGB, which becomes grey with one decode
     pair. Group 4 wins on scans, whose ragged edges defeat Flate; on clean computer-drawn 1-bit
-    art Flate can be smaller. Not yet: inline images, an image's own `/SMask` or `/Mask`
-    image (only images drawn on a page are visited), Group 4 for rows wider than 32,767
-    samples, and JBIG2 past 65,535 samples on a side, where the decoder stops (its 2^28 in all
-    is past the 80 million pixels above).
+    art Flate can be smaller.
+  - **A picture's masks:** after the pictures, each picture's stencil `/Mask` and one-bit
+    `/SMask` (a picture's own images, which the pages don't draw by name), once however many
+    pictures name it, is stored again as the compression asks when that is smaller, at its size:
+    its bits stay as they are, so it masks as it did. A stencil the pages also draw by name is one
+    of the images above; a soft mask they draw is still stored as a mask. It isn't resampled, as its resolution isn't measured (the walk measures the
+    picture's), and it shares no JBIG2 dictionary, as only images named directly do. A soft mask of
+    more bits stays as it is, to be resampled with its picture, which wants it at eight. The report
+    counts masks as images.
+  - Not yet: inline images, a picture's mask resampled, or packed to one bit from more, Group 4
+    for rows wider than 32,767 samples, and JBIG2 past 65,535 samples on a side or 2^28 in all,
+    where the decoder stops: with JBIG2 chosen, a one-bit image larger than that stays unless
+    it is averaged.
 
   - Lossless JBIG2 uses bounded generic-region encoding or exact-copy symbol dictionaries when
     smaller, a dictionary shared by up to 16 images when that is smaller still. No lossy symbol substitution is used. Export, redaction and this step read JBIG2
diff --git a/crates/optimize/src/audit.rs b/crates/optimize/src/audit.rs
index f5da17c45d..b06d76d6c7 100644
--- a/crates/optimize/src/audit.rs
+++ b/crates/optimize/src/audit.rs
@@ -9,7 +9,7 @@
 
 use std::collections::{HashMap, HashSet};
 
-use pdfcraft_cos::{Dict, Document, MAX_DECODED, Object, XrefEntry};
+use pdfcraft_cos::{Dict, Document, MAX_DECODED, ObjRef, Object, XrefEntry};
 
 /// The categories, in Acrobat's order.
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
@@ -91,6 +91,9 @@ const MAX_FORM_DEPTH: usize = 64;
 struct Audit<'a> {
     doc: &'a Document,
     owner: HashMap<u32, SpaceCategory>,
+    /// Resource dictionaries (by reference) already walked: one shared by many pages, forms or
+    /// appearances is walked once, as claiming is the same each time.
+    walked: HashSet<ObjRef>,
 }
 
 impl Audit<'_> {
@@ -124,6 +127,18 @@ impl Audit<'_> {
         o.map(|x| self.doc.resolve(x)).and_then(|x| x.as_dict().cloned()).unwrap_or_default()
     }
 
+    /// The resource dictionary `holder` points at (if it does), by kind: [`Self::resources`],
+    /// once per dictionary given by reference.
+    fn resources_of(&mut self, holder: Option<&Object>, depth: usize) {
+        if let Some(Object::Ref(r)) = holder
+            && !self.walked.insert(*r)
+        {
+            return;
+        }
+        let res = self.resolve_dict(holder);
+        self.resources(&res, depth);
+    }
+
     /// A resource dictionary, by kind; `depth` counts the form XObjects it is nested in.
     fn resources(&mut self, res: &Dict, depth: usize) {
         let xobjects = self.resolve_dict(res.get(b"XObject"));
@@ -135,8 +150,7 @@ impl Audit<'_> {
                     // A form: its own resources first, by kind, then the rest of it. Owning it
                     // first stops a form that draws itself.
                     self.owner.insert(r.num, SpaceCategory::XObjectForms);
-                    let inner = self.resolve_dict(s.dict.get(b"Resources"));
-                    self.resources(&inner, depth + 1);
+                    self.resources_of(s.dict.get(b"Resources"), depth + 1);
                     self.claim(&Object::Dict(s.dict.clone()), SpaceCategory::XObjectForms);
                 }
                 _ => self.claim(x, SpaceCategory::XObjectForms),
@@ -172,8 +186,7 @@ impl Audit<'_> {
                 _ => Vec::new(),
             };
             for dict in streams {
-                let res = self.resolve_dict(dict.get(b"Resources"));
-                self.resources(&res, 1);
+                self.resources_of(dict.get(b"Resources"), 1);
             }
         }
     }
@@ -216,19 +229,17 @@ fn object_stream(doc: &Document, num: u32) -> Option<u32> {
 /// Audit the space a document uses; `file_len` is the size of the file on disk (the rest is
 /// overhead).
 pub fn audit_space(doc: &Document, file_len: u64) -> Vec<SpaceUse> {
-    let mut a = Audit { doc, owner: HashMap::new() };
+    let mut a = Audit { doc, owner: HashMap::new(), walked: HashSet::new() };
     let cat = doc.root().and_then(|r| doc.get(r).as_dict().cloned()).unwrap_or_default();
     let pages = pdfcraft_model::pages(doc);
     // Order matters: the most specific owners first. Resources by kind before anything that
     // uses them: a content stream's dictionary may point at what it draws (PdfCraft's /PCAdded
     // records an added image), and form fields and comments draw with fonts and images too.
     for p in &pages {
-        let res = a.resolve_dict(p.dict.get(b"Resources"));
-        a.resources(&res, 0);
+        a.resources_of(p.dict.get(b"Resources"), 0);
     }
     let form = a.resolve_dict(cat.get(b"AcroForm"));
-    let form_resources = a.resolve_dict(form.get(b"DR"));
-    a.resources(&form_resources, 0);
+    a.resources_of(form.get(b"DR"), 0);
     for p in &pages {
         for x in annotations(doc, &p.dict) {
             a.appearance_resources(&x);
@@ -495,9 +506,10 @@ mod tests {
         assert_eq!(bytes_of(&after_self_ref, SpaceCategory::StructureInfo), struct_before);
 
         // Editing the object stream itself detaches its members from compressed stream sizing.
+        // The edit leaves the stream readable: one that broke `/First` would leave no members.
         edited
             .update_dict(ObjRef::new(stm_num, 0), |d| {
-                d.set(b"First".to_vec(), Object::Int(999_999));
+                d.set(b"Edited".to_vec(), Object::Bool(true));
             })
             .unwrap();
         let after_stream_edit = audit_space(&edited, 0);
diff --git a/crates/optimize/src/fragments.rs b/crates/optimize/src/fragments.rs
index aa52c20750..9ccca4791f 100644
--- a/crates/optimize/src/fragments.rs
+++ b/crates/optimize/src/fragments.rs
@@ -30,17 +30,21 @@ pub const MIN_FRAGMENTS: usize = 4;
 /// Most pixels a merged image may have (memory).
 const MAX_PIXELS: u64 = 80_000_000;
 
-/// Fragment groups a page's search for runs may read per content operator, and at least. A run
-/// that is not one picture is searched again from each of its groups, so without a limit images
-/// drawn over one another take time quadratic in their number; past it, the rest of the page is
-/// left as it is.
-const SCAN_PER_OP: usize = 16;
+/// Content operators a page's search for runs may read per content operator of the page, and at
+/// least. A run that is not one picture is searched again from each of its groups, so without a
+/// limit images drawn over one another take time quadratic in their number; past it, the rest of
+/// the page is left as it is. Every operator of a group counts (its `cm` operators are composed
+/// each time), not just the group; a group of four operators costs four, so the allowance is 16
+/// groups per operator, as before, and groups with many `cm` operators pay for them.
+const SCAN_PER_OP: usize = 64;
 const MIN_SCAN: usize = 1 << 16;
 
 #[cfg(test)]
 thread_local! {
     /// Fragment groups read, for the test that keeps a page's search linear in its content.
     static GROUP_READS: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
+    /// Operators group reads walked, for the test that keeps the search linear in operators.
+    static OP_READS: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
 }
 
 /// One fragment: its image, its box in the coordinates the run is drawn in, and its size.
@@ -53,21 +57,44 @@ struct Fragment {
 
 /// The ops `q`, one or more `cm`, `Do`, `Q` starting at `i`: the index after them, the matrix
 /// and the name drawn.
-fn group_at(ops: &[Op], i: usize) -> Option<(usize, Matrix, Vec<u8>)> {
+fn group_at(ops: &[Op], i: usize, reads: &std::cell::Cell<usize>) -> Option<(usize, Matrix, Vec<u8>)> {
     #[cfg(test)]
     GROUP_READS.with(|c| c.set(c.get().saturating_add(1)));
-    if !ops.get(i)?.is("q") {
+    let mut looked = 0usize;
+    let found = group_scan(ops, i, &mut looked);
+    // Every operator looked at is charged to the page's search allowance, whether or not the
+    // group turns out to be one.
+    reads.set(reads.get().saturating_add(looked));
+    #[cfg(test)]
+    OP_READS.with(|c| c.set(c.get().saturating_add(looked)));
+    found
+}
+
+/// [`group_at`]'s search, counting in `looked` each operator it examines.
+fn group_scan(ops: &[Op], i: usize, looked: &mut usize) -> Option<(usize, Matrix, Vec<u8>)> {
+    let q = ops.get(i)?;
+    *looked += 1;
+    if !q.is("q") {
         return None;
     }
     let mut j = i + 1;
     let mut m = Matrix([1.0, 0.0, 0.0, 1.0, 0.0, 0.0]);
     while let Some(op) = ops.get(j).filter(|o| o.is("cm")) {
+        *looked += 1;
         m = Matrix::from_operands(&op.operands)?.then(&m);
         j += 1;
     }
-    let draw = ops.get(j).filter(|o| o.is("Do"))?;
+    let draw = ops.get(j)?;
+    *looked += 1;
+    if !draw.is("Do") {
+        return None;
+    }
     let name = draw.name(0)?.to_vec();
-    ops.get(j + 1).filter(|o| o.is("Q"))?;
+    let end = ops.get(j + 1)?;
+    *looked += 1;
+    if !end.is("Q") {
+        return None;
+    }
     (j > i + 1).then_some((j + 2, m, name))
 }
 
@@ -152,7 +179,7 @@ fn stacked(run: &mut [Fragment]) -> Option<Vec<std::ops::Range<usize>>> {
 
 /// The fragment groups from `i` on (at most `limit`) while they form a picture drawn row by row
 /// or strip by strip in one direction, up to a gap or a jump.
-fn drawn_in_sequence(ops: &[Op], i: usize, limit: usize, xobjects: &Dict, doc: &Document) -> Vec<Fragment> {
+fn drawn_in_sequence(ops: &[Op], i: usize, limit: usize, xobjects: &Dict, doc: &Document, reads: &std::cell::Cell<usize>) -> Vec<Fragment> {
     let mut run: Vec<Fragment> = Vec::new();
     let mut row_x = [0.0f64, 0.0];
     let mut cur_x = [0.0f64, 0.0];
@@ -163,7 +190,7 @@ fn drawn_in_sequence(ops: &[Op], i: usize, limit: usize, xobjects: &Dict, doc: &
     let mut complete = 0usize;
     let mut j = i;
     while run.len() < limit {
-        let Some((next, m, name)) = group_at(ops, j) else { break };
+        let Some((next, m, name)) = group_at(ops, j, reads) else { break };
         let Some((image, width, height, ..)) = fragment_image(doc, xobjects, &name) else { break };
         let [a, _, _, d, e, f] = m.0;
         let f2 = Fragment { image, rect: [e, f, e + a, f + d], width, height };
@@ -240,10 +267,10 @@ fn drawn_in_sequence(ops: &[Op], i: usize, limit: usize, xobjects: &Dict, doc: &
 }
 
 /// The op index after the first `count` fragment groups from `i`.
-fn run_end(ops: &[Op], i: usize, count: usize) -> usize {
+fn run_end(ops: &[Op], i: usize, count: usize, reads: &std::cell::Cell<usize>) -> usize {
     let mut j = i;
     for _ in 0..count {
-        match group_at(ops, j) {
+        match group_at(ops, j, reads) {
             Some((next, ..)) => j = next,
             None => break,
         }
@@ -386,9 +413,9 @@ fn merge_page(
     let mut out: Vec<Op> = Vec::with_capacity(ops.len());
     let (mut i, mut merged, mut k) = (0, 0, 0);
     let budget = ops.len().saturating_mul(SCAN_PER_OP).max(MIN_SCAN);
-    let mut scanned = 0usize;
+    let reads = std::cell::Cell::new(0usize);
     while i < ops.len() {
-        if scanned > budget {
+        if reads.get() > budget {
             out.extend(ops.get(i..).unwrap_or_default().iter().cloned());
             break;
         }
@@ -396,7 +423,7 @@ fn merge_page(
         let mut run = Vec::new();
         let mut kind: Option<(Object, usize)> = None;
         let mut j = i;
-        while let Some((next, m, name)) = group_at(&ops, j) {
+        while let Some((next, m, name)) = group_at(&ops, j, &reads) {
             let Some((image, width, height, cs, n)) = fragment_image(doc, &xobjects, &name) else { break };
             let [a, b, c, d, e, f] = m.0;
             if b.abs() > 1e-9 || c.abs() > 1e-9 || !(a > 0.0 && d > 0.0) {
@@ -410,13 +437,11 @@ fn merge_page(
             run.push(Fragment { image, rect: [e, f, e + a, f + d], width, height });
             j = next;
         }
-        scanned = scanned.saturating_add(run.len()).saturating_add(1);
         // Not one picture as a whole: a prefix drawn row by row or strip by strip may be.
         let mut rows = if run.len() >= MIN_FRAGMENTS { stacked(&mut run) } else { None };
         if run.len() >= MIN_FRAGMENTS && rows.is_none() {
-            run = drawn_in_sequence(&ops, i, run.len(), &xobjects, doc);
-            j = run_end(&ops, i, run.len());
-            scanned = scanned.saturating_add(run.len().saturating_mul(2)).saturating_add(2);
+            run = drawn_in_sequence(&ops, i, run.len(), &xobjects, doc, &reads);
+            j = run_end(&ops, i, run.len(), &reads);
             rows = stacked(&mut run);
         }
         let Some(((cs, n), rows)) = kind.zip(rows).filter(|_| run.len() >= MIN_FRAGMENTS) else {
@@ -773,4 +798,37 @@ mod tests {
             assert_eq!((merged, report.merged_images), (0, 0));
         }
     }
+
+    /// The same with many `cm` operators in each group: the search reads a bounded number of operators
+    /// for each one of the page, however the matrices are spread over the groups.
+    #[test]
+    fn groups_with_many_matrices_are_charged_for_each_operator() {
+        let mut doc = Document::new_empty();
+        let mut image = Dict::new();
+        for (k, v) in
+            [("Subtype", Object::name("Image")), ("Width", Object::Int(1)), ("Height", Object::Int(1)), ("BitsPerComponent", Object::Int(8))]
+        {
+            image.set(k.as_bytes().to_vec(), v);
+        }
+        image.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+        let image = doc.add(Object::Stream(Stream::from_raw(image, vec![0])));
+        let groups = 400;
+        let content = doc.add(Object::Stream(Stream::flate(
+            Dict::new(),
+            format!("q 10 0 0 10 0 0 cm {}/Im Do Q\n", "1 0 0 1 0 0 cm ".repeat(49)).repeat(groups).as_bytes(),
+        )));
+        let mut xobjects = Dict::new();
+        xobjects.set(b"Im".to_vec(), Object::Ref(image));
+        let mut resources = Dict::new();
+        resources.set(b"XObject".to_vec(), Object::Dict(xobjects));
+        let mut page = Dict::new();
+        page.set(b"Contents".to_vec(), Object::Ref(content));
+        page.set(b"Resources".to_vec(), Object::Dict(resources));
+        let page = doc.add(Object::Dict(page));
+        OP_READS.with(|c| c.set(0));
+        let merged = merge_page(&mut doc, page, &mut Report::default(), &mut |_| true, &mut ImageBudget::with_work(u64::MAX));
+        assert_eq!(merged.ok(), Some(0));
+        let reads = OP_READS.with(|c| c.get());
+        assert!(reads <= 80 * 53 * groups, "{reads} operator reads");
+    }
 }
diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index 7bfa44dafd..4037de82f3 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -13,6 +13,15 @@ use crate::{Compression, ImageSettings, MonoCompression, MonoSettings, OptimizeE
 /// Images with more pixels than this are left alone (memory).
 pub(crate) const MAX_PIXELS: u64 = 80_000_000;
 
+/// The bytes an image of one bit a pixel holds as stored: each row starts on a new byte, a byte for
+/// each 8 samples and one for any left over. The monochrome step takes such an image while these
+/// are no more than [`MAX_PIXELS`], as many as that many pixels of eight bits hold: a wide one up
+/// to 640 million pixels (an A0 page at 600 ppi is about 560 million), where at eight bits a pixel
+/// it would be left alone, and a strip one sample wide no taller than one of eight bits.
+fn one_bit_bytes(w: u64, h: u64) -> u64 {
+    w.div_ceil(8).saturating_mul(h)
+}
+
 /// The resources of a page, inherited from the page tree if the page has none.
 pub(crate) fn page_resources(doc: &Document, page: ObjRef) -> Option<Dict> {
     held_page_resources(doc, page).map(|(resources, _)| resources)
@@ -829,6 +838,21 @@ fn one_component(doc: &Document, cs: &Object) -> bool {
     }
 }
 
+/// What the filters before a fax image's decoder may produce, its code: at most about a byte a
+/// pixel and each row's end, as redaction allows, but no more than `MAX_PIXELS` bytes for its
+/// pixels (and four a row), so a large page's code can't cost a byte a pixel.
+fn fax_code_allowance(w: usize, h: usize) -> Option<usize> {
+    w.checked_mul(h)?.min(usize::try_from(MAX_PIXELS).ok()?).checked_add(h.checked_mul(4)?)?.checked_add(4096)
+}
+
+/// Whether `d` is an image of one bit a pixel as stored: an image mask, or one bit in one colour
+/// component.
+fn one_bit_as_stored(doc: &Document, d: &Dict) -> bool {
+    let bits = d.int(b"BitsPerComponent");
+    let mask = matches!(d.get(b"ImageMask"), Some(Object::Bool(true)));
+    (mask && bits.is_none_or(|b| b == 1)) || (bits == Some(1) && d.get(b"ColorSpace").is_some_and(|cs| one_component(doc, cs)))
+}
+
 /// A pixel's samples as a 1 or a 0, or `None` for a colour that is neither.
 type Pixel = fn(&[u8]) -> Option<bool>;
 
@@ -854,19 +878,23 @@ fn one_bit(doc: &Document, s: &Stream, pack: bool, defaults: bool, budget: &mut
     let d = &s.dict;
     // Through u32 first, as everywhere here, so the product can't overflow.
     let (w, h) = (u32::try_from(d.int(b"Width")?).ok()?, u32::try_from(d.int(b"Height")?).ok()?);
-    if w == 0 || h == 0 || u64::from(w) * u64::from(h) > MAX_PIXELS {
+    // An image already of one bit a pixel is taken while its rows hold no more than `MAX_PIXELS`
+    // bytes (`one_bit_bytes`), one packed from more bits (2, 4 or 8) up to `MAX_PIXELS` pixels, as
+    // before: its samples are decoded as stored first, eight-bit RGB at three bytes a pixel.
+    let as_stored = one_bit_as_stored(doc, d);
+    let held = if as_stored { one_bit_bytes(u64::from(w), u64::from(h)) } else { u64::from(w) * u64::from(h) };
+    if w == 0 || h == 0 || held > MAX_PIXELS {
         return None;
     }
     let (wu, hu) = (usize::try_from(w).ok()?, usize::try_from(h).ok()?);
     let stride = wu.div_ceil(8);
     let bits = d.int(b"BitsPerComponent");
     let mask = matches!(d.get(b"ImageMask"), Some(Object::Bool(true)));
-    if (mask && bits.is_none_or(|b| b == 1)) || (bits == Some(1) && d.get(b"ColorSpace").is_some_and(|cs| one_component(doc, cs))) {
-        // No further than its rows can need: a fax image's code (the filters before its decoder
-        // produce it) takes at most about a byte a pixel and each row's end, as redaction allows.
+    if as_stored {
+        // No further than its rows can need.
         let len = stride.checked_mul(hu)?;
         let max = match s.filters().last() {
-            Some((pdfcraft_filters::Filter::CcittFax, _)) => wu.checked_mul(hu)?.checked_add(hu.checked_mul(4)?)?.checked_add(4096)?,
+            Some((pdfcraft_filters::Filter::CcittFax, _)) => fax_code_allowance(wu, hu)?,
             // A JBIG2 page, which has to be the image's size, is `len` bytes as rows of a bit.
             _ => allowance(len, h)?,
         };
@@ -937,6 +965,7 @@ fn one_bit(doc: &Document, s: &Stream, pack: bool, defaults: bool, budget: &mut
         _ => return None,
     };
     let row_len = wu.checked_mul(n)?.checked_mul(bpc)?.div_ceil(8);
+    count_decoded(u64::from(w) * u64::from(h));
     // Through its parameters given by reference too: without a PNG predictor's tag bytes taken
     // off, rows of 0 and 255 (or palette entries 0 and 1) would still pass below, each shifted.
     let samples = budget.decode_filters(doc, s, allowance(row_len.checked_mul(hu)?, h)?).ok()?;
@@ -1364,9 +1393,9 @@ pub(crate) fn run(
         .collect();
     let mut refs: Vec<(ObjRef, f64)> = ppi.into_iter().filter(|(r, _)| !masks.contains(r)).collect();
     refs.sort_by_key(|(r, _)| (r.num, r.generation));
-    let total = refs.len();
-    let mut jbig2 = false;
-    let mut group: Vec<Held> = Vec::new();
+    // Then the pictures' masks of one bit a sample, each once ([`decide_mask`]).
+    let mask_refs = picture_masks(doc, &refs);
+    let total = refs.len() + mask_refs.len();
     // By number: a repaired object answers to two generations.
     let mut smask_uses: HashMap<u32, usize> = HashMap::new();
     for (r, _) in &refs {
@@ -1374,23 +1403,96 @@ pub(crate) fn run(
             *smask_uses.entry(m.num).or_default() += 1;
         }
     }
+    let holds = settings.mono.compression == MonoCompression::Jbig2;
+    let threads = threads_for_items(doc, &refs, settings);
+    let mut out = Out { doc, report, budget, jbig2: false, group: Vec::new() };
+    let pictures = Items { items: &refs, threads, first: 0, total };
+    work_through(
+        &mut out,
+        &pictures,
+        &|doc, rest| batch_len(doc, rest, &smask_uses, holds),
+        &|doc, r, ppi, budget| decide(doc, r, ppi, defaults.contains(&r.num), settings, budget),
+        progress,
+    )?;
+    share(out.doc, &mut out.group, out.report);
+    let threads = threads_for_items(out.doc, &mask_refs, settings);
+    let masks = Items { items: &mask_refs, threads, first: refs.len(), total };
+    // Each mask is an object of its own (by number), which only its own decision changes.
+    work_through(
+        &mut out,
+        &masks,
+        &|_, rest| rest.len().min(PICTURES_AT_ONCE),
+        &|doc, r, _, budget| decide_mask(doc, r, settings, budget),
+        progress,
+    )?;
+    if !progress(Stage::Images { done: total, total }) {
+        return Err(OptimizeError::Cancelled);
+    }
+    if out.jbig2 {
+        at_least_pdf_1_4(out.doc)?;
+    }
+    Ok(())
+}
+
+/// What the image pass changes and counts as it goes: the document, the report, the run's
+/// allowance, whether it stored an image as JBIG2, and the JBIG2 images held to share a dictionary
+/// ([`share`]).
+struct Out<'a> {
+    doc: &'a mut Document,
+    report: &'a mut Report,
+    budget: &'a mut ImageBudget,
+    jbig2: bool,
+    group: Vec<Held>,
+}
+
+/// Images the pass works through, each with its effective resolution, on up to `threads` threads;
+/// for progress, the first of them is number `first` of the pass's `total`.
+struct Items<'a> {
+    items: &'a [(ObjRef, f64)],
+    threads: usize,
+    first: usize,
+    total: usize,
+}
+
+/// How many of `items` to work on at once: one below [`MIN_FOR_THREADS`], else as many as the
+/// workers, and as [`PICTURE_MEMORY`] holds of the largest.
+fn threads_for_items(doc: &Document, items: &[(ObjRef, f64)], settings: &Settings) -> usize {
     // Too few to be worth the threads, which keeps a small file's progress in step too.
-    let threads = if total < MIN_FOR_THREADS {
-        1
-    } else {
-        let largest = refs.iter().filter_map(|(r, _)| picture_pixels(doc, *r)).max().unwrap_or(0);
-        threads_for(crate::pool::workers(settings.workers), largest)
-    };
+    if items.len() < MIN_FOR_THREADS {
+        return 1;
+    }
+    let largest = items.iter().filter_map(|(r, _)| picture_pixels(doc, *r)).max().unwrap_or(0);
+    threads_for(crate::pool::workers(settings.workers), largest)
+}
+
+/// How [`work_through`] works out what's to become of an image, at its effective resolution, within
+/// an allowance; threads share it.
+type Decide<'a> = dyn Fn(&Document, ObjRef, f64, &mut ImageBudget) -> Decision + Sync + 'a;
+
+/// How many of the images left, from the first, [`work_through`] may work out beside each other.
+type Batch<'a> = dyn Fn(&Document, &[(ObjRef, f64)]) -> usize + 'a;
+
+/// Works out what's to become of each of `items` by `decide`, and does it, in their order: a batch
+/// of them beside each other where `batch` says they can be, one at a time otherwise.
+fn work_through(
+    out: &mut Out<'_>,
+    items: &Items<'_>,
+    batch: &Batch<'_>,
+    decide: &Decide<'_>,
+    progress: &mut dyn FnMut(Stage) -> bool,
+) -> Result<(), OptimizeError> {
+    let (threads, total) = (items.threads, items.total);
     let mut done = 0;
-    while let Some(rest) = refs.get(done..).filter(|rest| !rest.is_empty()) {
-        let run = if threads > 1 { batch_len(doc, rest, &smask_uses, settings.mono.compression == MonoCompression::Jbig2) } else { 0 };
+    while let Some(rest) = items.items.get(done..).filter(|rest| !rest.is_empty()) {
+        let at = items.first.saturating_add(done);
+        let run = if threads > 1 { batch(out.doc, rest) } else { 0 };
         let Some(batch) = rest.get(..run).filter(|batch| batch.len() > 1) else {
-            if !progress(Stage::Images { done, total }) {
+            if !progress(Stage::Images { done: at, total }) {
                 return Err(OptimizeError::Cancelled);
             }
             if let Some((r, ppi)) = rest.first() {
-                let decision = decide(doc, *r, *ppi, defaults.contains(&r.num), settings, budget);
-                apply(doc, decision, report, &mut jbig2, &mut group);
+                let decision = decide(out.doc, *r, *ppi, out.budget);
+                apply(out.doc, decision, out.report, &mut out.jbig2, &mut out.group);
             }
             done += 1;
             continue;
@@ -1399,10 +1501,10 @@ pub(crate) fn run(
         // order below: a picture the order can't pay for is done again as if there were no threads,
         // so the same pictures are refused with any number of them. Once more than what's left has
         // been used, no more are started.
-        let allowed = budget.work_left();
+        let allowed = out.budget.work_left();
         let used = AtomicU64::new(0);
         let tried = {
-            let (doc, defaults) = (&*doc, &defaults);
+            let doc = &*out.doc;
             crate::pool::map(
                 batch,
                 threads,
@@ -1411,36 +1513,74 @@ pub(crate) fn run(
                         return None;
                     }
                     let mut own = ImageBudget::with_work(allowed);
-                    let decision = decide(doc, *r, *ppi, defaults.contains(&r.num), settings, &mut own);
+                    let decision = decide(doc, *r, *ppi, &mut own);
                     let cost = allowed.saturating_sub(own.work_left());
                     used.fetch_add(cost, Ordering::Relaxed);
                     (own.refused() == 0).then_some((decision, cost))
                 },
-                &mut |finished| progress(Stage::Images { done: done.saturating_add(finished), total }),
+                &mut |finished| progress(Stage::Images { done: at.saturating_add(finished), total }),
             )?
         };
         for ((r, ppi), tried) in batch.iter().zip(tried) {
             let decision = match tried.flatten() {
-                Some((decision, cost)) if cost <= budget.work_left() => {
-                    budget.charge(cost);
+                Some((decision, cost)) if cost <= out.budget.work_left() => {
+                    out.budget.charge(cost);
                     decision
                 }
-                _ => decide(doc, *r, *ppi, defaults.contains(&r.num), settings, budget),
+                _ => decide(out.doc, *r, *ppi, out.budget),
             };
-            apply(doc, decision, report, &mut jbig2, &mut group);
+            apply(out.doc, decision, out.report, &mut out.jbig2, &mut out.group);
         }
         done += batch.len();
     }
-    share(doc, &mut group, report);
-    if !progress(Stage::Images { done: total, total }) {
-        return Err(OptimizeError::Cancelled);
-    }
-    if jbig2 {
-        at_least_pdf_1_4(doc)?;
-    }
     Ok(())
 }
 
+/// The masks of `pictures` the pass stores again after them, each once (by number): their soft
+/// masks and their stencil masks, unless one is drawn as a picture of its own, and so is one of
+/// them. A colour-key `/Mask` is an array, not an image. Their resolution isn't measured.
+fn picture_masks(doc: &Document, pictures: &[(ObjRef, f64)]) -> Vec<(ObjRef, f64)> {
+    let drawn: HashSet<u32> = pictures.iter().map(|(r, _)| r.num).collect();
+    let mut seen = HashSet::new();
+    let mut masks = Vec::new();
+    for (r, _) in pictures {
+        let object = doc.get(*r);
+        let Object::Stream(s) = &*object else { continue };
+        for key in [&b"SMask"[..], b"Mask"] {
+            if let Some(m) = s.dict.reference(key)
+                && !drawn.contains(&m.num)
+                && seen.insert(m.num)
+            {
+                masks.push((m, f64::NAN));
+            }
+        }
+    }
+    masks.sort_by_key(|(r, _)| (r.num, r.generation));
+    masks
+}
+
+/// Work out what's to become of mask `r` of a picture, changing nothing yet: stored again as the
+/// monochrome settings ask ([`mono`]), at its size, when it has one bit a sample (a stencil mask,
+/// or a soft mask of one bit) and that is smaller. The bits stay as they are, so it masks as it did.
+/// It isn't resampled: its resolution isn't measured, and its edges are the picture's. A soft mask
+/// of more bits is left to be resampled with its picture ([`process`]), which wants it at eight. It
+/// shares no JBIG2 dictionary: those are for images named directly, which redaction can store again.
+fn decide_mask(doc: &Document, r: ObjRef, settings: &Settings, budget: &mut ImageBudget) -> Decision {
+    let obj = doc.get(r);
+    let Object::Stream(s) = &*obj else { return Decision::NotAnImage };
+    let stencil = matches!(s.dict.get(b"ImageMask"), Some(Object::Bool(true)));
+    if !stencil && s.dict.int(b"BitsPerComponent") != Some(1) {
+        return Decision::NotAnImage;
+    }
+    let refused = budget.refused();
+    // Its resolution unmeasured, it isn't resampled. As where a default colour space is in force:
+    // at one bit a sample that changes nothing, and nothing is packed.
+    match mono(doc, s, f64::NAN, true, &settings.mono, budget) {
+        Some((new, _, _)) => Decision::Replace { image: r, before: s.raw.len(), new, resampled: false, smask: None, bits: None },
+        None => Decision::Stays { refused: budget.refused() > refused },
+    }
+}
+
 /// A picture's soft mask, if it names one.
 fn smask_of(doc: &Document, r: ObjRef) -> Option<ObjRef> {
     match &*doc.get(r) {
@@ -1494,12 +1634,21 @@ const PICTURE_MEMORY: u64 = 1 << 30;
 /// What a picture holds while it is worked out, for each pixel: decoded, and resampled or encoded.
 const PICTURE_BYTES_PER_PIXEL: u64 = 8;
 
-/// A picture's pixels, if it is small enough to be decoded at all.
+/// A picture's pixels, if it is small enough to be decoded at all. One of one bit a pixel as
+/// stored is taken while the bytes its rows hold ([`one_bit_bytes`]) are no more than
+/// `MAX_PIXELS`, and counts as those and one more a row: decoding allows each row's end a few
+/// bytes besides its samples ([`allowance`], [`fax_code_allowance`]), which for an image a few
+/// samples wide is as much again as its samples.
 fn picture_pixels(doc: &Document, r: ObjRef) -> Option<u64> {
     let object = doc.get(r);
     let Object::Stream(s) = &*object else { return None };
     let (w, h) = (u64::try_from(s.dict.int(b"Width")?).ok()?, u64::try_from(s.dict.int(b"Height")?).ok()?);
-    w.checked_mul(h).filter(|pixels| *pixels <= MAX_PIXELS)
+    if one_bit_as_stored(doc, &s.dict) {
+        let bytes = one_bit_bytes(w, h);
+        return (bytes <= MAX_PIXELS).then(|| bytes.saturating_add(h));
+    }
+    let pixels = w.checked_mul(h)?;
+    (pixels <= MAX_PIXELS).then_some(pixels)
 }
 
 /// How many pictures of `largest` pixels to work on at once: `workers`, or as many as
@@ -1511,7 +1660,7 @@ fn threads_for(workers: usize, largest: u64) -> usize {
 
 /// What's to become of one picture.
 enum Decision {
-    /// Not an image stream after all.
+    /// Not an image stream after all, or a picture's mask the pass doesn't store again.
     NotAnImage,
     /// An image that stays as it is, `refused` if the allowance couldn't pay for it.
     Stays { refused: bool },
@@ -1750,6 +1899,83 @@ mod dimension_tests {
         assert_eq!(threads_for(8, 0), 8);
     }
 
+    /// A one-bit image counts as the bytes its rows hold and one more a row when planning how many
+    /// pictures run at once, while those it holds are up to `MAX_PIXELS`: about an eighth of its
+    /// pixels when wide, two bytes a row when a few samples wide. One of eight bits counts whole,
+    /// up to `MAX_PIXELS`.
+    #[test]
+    fn a_one_bit_picture_counts_as_the_bytes_of_its_rows() {
+        let mut doc = Document::new_empty();
+        let mut add = |w: i64, h: i64, bits: i64| {
+            let mut dict = Dict::new();
+            dict.set(b"Width".to_vec(), Object::Int(w));
+            dict.set(b"Height".to_vec(), Object::Int(h));
+            dict.set(b"BitsPerComponent".to_vec(), Object::Int(bits));
+            dict.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+            doc.add(Object::Stream(Stream::from_raw(dict, Vec::new())))
+        };
+        let (one_bit, past_one_bit, eight_bit) = (add(20_000, 32_000, 1), add(20_000, 32_001, 1), add(10_000, 8_001, 8));
+        let (strip, past_strip, narrow) = (add(1, 80_000_000, 1), add(1, 80_000_001, 1), add(8, 10_000_000, 1));
+        assert_eq!(picture_pixels(&doc, one_bit), Some(80_000_000 + 32_000));
+        assert_eq!(picture_pixels(&doc, past_one_bit), None);
+        assert_eq!(picture_pixels(&doc, strip), Some(160_000_000), "a byte a row, and one more");
+        assert_eq!(picture_pixels(&doc, past_strip), None);
+        assert_eq!(picture_pixels(&doc, narrow), Some(20_000_000));
+        assert_eq!(threads_for(8, 20_000_000), 6);
+        assert_eq!(threads_for(8, 160_000_000), 1);
+        assert_eq!(picture_pixels(&doc, eight_bit), None);
+        assert_eq!(threads_for(8, 80_000_000), 1);
+    }
+
+    /// A fax image's code may take about a byte a pixel and its rows' ends, but no more than
+    /// `MAX_PIXELS` bytes for its pixels however large the page, and four a row.
+    #[test]
+    fn a_fax_images_code_is_allowed_80_million_bytes_and_four_a_row() {
+        assert_eq!(fax_code_allowance(1_000, 1_000), Some(1_000_000 + 4_000 + 4_096));
+        assert_eq!(fax_code_allowance(20_000, 32_000), Some(80_000_000 + 128_000 + 4_096));
+        assert_eq!(fax_code_allowance(1, 80_000_000), Some(80_000_000 + 320_000_000 + 4_096));
+    }
+
+    /// The monochrome step decodes an image already of one bit a pixel while its rows hold no more
+    /// than `MAX_PIXELS` bytes, and one it would pack from eight bits up to `MAX_PIXELS` pixels.
+    /// Past those, nothing is decoded.
+    #[test]
+    fn one_bit_images_are_decoded_up_to_their_own_limit() {
+        let image = |w: i64, h: i64, bits: i64| {
+            let mut dict = Dict::new();
+            dict.set(b"Width".to_vec(), Object::Int(w));
+            dict.set(b"Height".to_vec(), Object::Int(h));
+            dict.set(b"BitsPerComponent".to_vec(), Object::Int(bits));
+            dict.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+            Stream::from_raw(dict, Vec::new())
+        };
+        let decoded = |s: &Stream| {
+            DECODED_PIXELS.with(|c| c.set(0));
+            one_bit(&Document::new_empty(), s, true, false, &mut ImageBudget::with_work(u64::MAX));
+            DECODED_PIXELS.with(|c| c.get())
+        };
+        assert_eq!(decoded(&image(20_000, 32_000, 1)), 640_000_000, "one bit, at the limit");
+        assert_eq!(decoded(&image(20_000, 32_001, 1)), 0, "one bit, past it");
+        assert_eq!(decoded(&image(1, 80_000_000, 1)), 80_000_000, "one bit a sample wide, a byte a row, at the limit");
+        assert_eq!(decoded(&image(1, 80_000_001, 1)), 0, "one bit a sample wide, past it");
+        assert_eq!(decoded(&image(10_000, 8_000, 8)), 80_000_000, "eight bits, at theirs");
+        assert_eq!(decoded(&image(10_000, 8_001, 8)), 0, "eight bits, past theirs");
+    }
+
+    /// A zero-wide image isn't decoded: its rows hold no bytes, but its filters would be allowed
+    /// three a row.
+    #[test]
+    fn a_zero_wide_image_is_not_decoded() {
+        let mut dict = Dict::new();
+        dict.set(b"Width".to_vec(), Object::Int(0));
+        dict.set(b"Height".to_vec(), Object::Int(1_000_000));
+        dict.set(b"ImageMask".to_vec(), Object::Bool(true));
+        let s = Stream::flate(dict, &vec![0u8; 1 << 20]);
+        let mut budget = ImageBudget::with_work(1 << 40);
+        assert!(one_bit(&Document::new_empty(), &s, true, false, &mut budget).is_none());
+        assert_eq!(budget.work_left(), 1 << 40);
+    }
+
     /// Only what redaction can store again without the dictionary shares one: an image mask, or
     /// DeviceGray named directly, of at most 2^26 pixels.
     #[test]
@@ -1994,6 +2220,86 @@ mod dimension_tests {
         }
     }
 
+    /// A picture's mask past the run's allowance stays as it is, counted as refused, as an image
+    /// is; one the allowance paid for and that stays (its noise is no smaller as Group 4) isn't. The
+    /// progress counts the masks with the pictures.
+    #[test]
+    fn a_mask_past_the_runs_allowance_stays_and_is_counted() {
+        let mut seed = 0x2545_F491_4F6C_DD1Du64;
+        let noise: Vec<u8> = (0..32 * 256)
+            .map(|_| {
+                seed ^= seed << 13;
+                seed ^= seed >> 7;
+                seed ^= seed << 17;
+                seed as u8
+            })
+            .collect();
+        let page_of = |pictures: usize, masked: bool| {
+            let mut doc = Document::new_empty();
+            let mut xobjects = Dict::new();
+            let mut drawn = String::from("q 10 0 0 10 0 0 cm ");
+            let mut masks = Vec::new();
+            for i in 0..pictures {
+                let mut dict = Dict::new();
+                dict.set(b"Subtype".to_vec(), Object::name("Image"));
+                dict.set(b"Width".to_vec(), Object::Int(16));
+                dict.set(b"Height".to_vec(), Object::Int(16));
+                dict.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+                dict.set(b"ColorSpace".to_vec(), Object::name("DeviceCMYK"));
+                if masked {
+                    let mut mask = Dict::new();
+                    mask.set(b"Subtype".to_vec(), Object::name("Image"));
+                    mask.set(b"ImageMask".to_vec(), Object::Bool(true));
+                    mask.set(b"Width".to_vec(), Object::Int(256));
+                    mask.set(b"Height".to_vec(), Object::Int(256));
+                    let mask = doc.add(Object::Stream(Stream::flate(mask, &noise)));
+                    dict.set(b"Mask".to_vec(), Object::Ref(mask));
+                    masks.push(mask);
+                }
+                let picture = doc.add(Object::Stream(Stream::flate(dict, &[0; 16 * 16 * 4])));
+                xobjects.set(format!("I{i}").into_bytes(), Object::Ref(picture));
+                drawn.push_str(&format!("/I{i} Do "));
+            }
+            drawn.push('Q');
+            let mut resources = Dict::new();
+            resources.set(b"XObject".to_vec(), Object::Dict(xobjects));
+            let content = doc.add(Object::Stream(Stream::flate(Dict::new(), drawn.as_bytes())));
+            let mut page = Dict::new();
+            page.set(b"Type".to_vec(), Object::name("Page"));
+            page.set(b"Resources".to_vec(), Object::Dict(resources));
+            page.set(b"Contents".to_vec(), Object::Ref(content));
+            let page = doc.add(Object::Dict(page));
+            (doc, page, masks)
+        };
+        let keep = crate::ImageSettings { downsample: false, compression: crate::Compression::Retain, ..crate::ImageSettings::REDUCE };
+        let settings = Settings { color: keep, gray: keep, ..Settings::default() };
+        let cost = |pictures: usize, masked: bool| {
+            let (mut doc, page, _) = page_of(pictures, masked);
+            let mut budget = ImageBudget::with_work(u64::MAX);
+            let mut report = Report::default();
+            run(&mut doc, &[page], &settings, &mut report, &mut |_| true, &mut budget).unwrap();
+            assert_eq!(report.images_refused, 0);
+            u64::MAX - budget.work_left()
+        };
+        let mask = cost(1, true) - cost(1, false);
+        assert!(mask > 0);
+        let (mut doc, page, masks) = page_of(3, true);
+        let before: Vec<_> = masks.iter().map(|m| doc.get(*m)).collect();
+        let mut budget = ImageBudget::with_work(cost(3, false) + 2 * mask);
+        let mut report = Report::default();
+        let mut last = None;
+        let mut progress = |stage: Stage| {
+            if let Stage::Images { done, total } = stage {
+                last = Some((done, total));
+            }
+            true
+        };
+        run(&mut doc, &[page], &settings, &mut report, &mut progress, &mut budget).unwrap();
+        assert_eq!((report.images, report.images_refused), (6, 1), "{report:?}");
+        assert_eq!(last, Some((6, 6)), "three pictures and their three masks");
+        assert!(masks.iter().zip(&before).all(|(m, b)| doc.get(*m) == *b), "every mask stays as it was");
+    }
+
     /// An image the allowance ran out on between being packed and being resampled is rewritten,
     /// as the packed one, so it isn't one that stayed as it was.
     #[test]
diff --git a/crates/optimize/src/lib.rs b/crates/optimize/src/lib.rs
index 750f641a07..4aed8b0786 100644
--- a/crates/optimize/src/lib.rs
+++ b/crates/optimize/src/lib.rs
@@ -15,7 +15,8 @@
 //!   that use only palette entries 0 and 1, packed to one bit) above a threshold are averaged down to a
 //!   target resolution when grey, image masks or indexed, halftones and dithers aside (see the README), and
 //!   are stored as CCITT Group 4 or lossless JBIG2, or 1-bit
-//!   Flate once resampled or packed, when that is smaller.
+//!   Flate once resampled or packed, when that is smaller. So are pictures' stencil and one-bit soft
+//!   masks, at their size.
 //! - **Discard objects:** page thumbnails, alternate images, document tags (structure tree),
 //!   print settings, form submission, import and reset actions.
 //! - **Clean up:** drop images and forms that pages list but never draw (such as a deleted
@@ -159,7 +160,8 @@ pub enum MonoCompression {
 
 /// How black-and-white images (1-bit, CCITT fax among them; and eight-bit grey and RGB of only black
 /// and white, and indexed images that use only palette entries 0 and 1, packed to one bit), and
-/// image masks, are resampled and stored.
+/// image masks, are resampled and stored. Pictures' stencil and one-bit soft masks are stored the
+/// same way, at their size.
 #[derive(Clone, Copy, Debug, PartialEq)]
 pub struct MonoSettings {
     /// Average images whose effective resolution is above `above_ppi` down to `target_ppi`.
@@ -206,7 +208,7 @@ pub struct Settings {
     pub merge_fragments: bool,
     pub color: ImageSettings,
     pub gray: ImageSettings,
-    /// Black-and-white images, and image masks.
+    /// Black-and-white images, image masks, and pictures' one-bit masks.
     pub mono: MonoSettings,
     pub discard_thumbnails: bool,
     pub discard_alternate_images: bool,
@@ -314,6 +316,7 @@ pub struct Report {
     /// Images merged from fragments, and how many fragments went into them.
     pub merged_images: usize,
     pub fragments_merged: usize,
+    /// Images the image step read: those the pages draw, and their pictures' one-bit masks.
     pub images: usize,
     pub images_resampled: usize,
     pub images_recompressed: usize,
diff --git a/crates/optimize/src/links.rs b/crates/optimize/src/links.rs
index 5b74ad7023..bef69c43b7 100644
--- a/crates/optimize/src/links.rs
+++ b/crates/optimize/src/links.rs
@@ -52,8 +52,12 @@ fn tree_entries(doc: &Document, node: &Object) -> Vec<(Vec<u8>, Object)> {
                 }
             }
         }
-        if let Some(kids) = d.get(b"Kids").map(|x| doc.resolve(x)).and_then(|x| x.as_array().cloned()) {
-            queue.extend(kids.into_iter().map(|k| (k, depth + 1)));
+        // A kids array shared by reference is read once, and only kids not yet seen are queued:
+        // nodes sharing one array can't multiply the queue.
+        if let Some(kids) =
+            d.get(b"Kids").filter(|k| !matches!(k, Object::Ref(r) if !seen.insert(*r))).map(|x| doc.resolve(x)).and_then(|x| x.as_array().cloned())
+        {
+            queue.extend(kids.into_iter().filter(|k| !matches!(k, Object::Ref(r) if seen.contains(r))).map(|k| (k, depth + 1)));
         }
     }
     out
diff --git a/crates/optimize/src/unused.rs b/crates/optimize/src/unused.rs
index b8c8a62b23..002d50263f 100644
--- a/crates/optimize/src/unused.rs
+++ b/crates/optimize/src/unused.rs
@@ -168,7 +168,9 @@ fn plain_metadata(doc: &Document) -> bool {
         .is_some_and(|e| matches!(e.as_dict().and_then(|e| e.get(b"EncryptMetadata")), Some(Object::Bool(false))))
 }
 
-fn data(s: &Stream, num: u32, g: &Graph, encrypted: bool, plain_metadata: bool) -> Data {
+/// `left` is what the caller may still decode: a stream that would decode past it (in any filter
+/// stage) is `Unknown`, so no stage is allowed to grow beyond the shared budget first.
+fn data(s: &Stream, num: u32, g: &Graph, encrypted: bool, plain_metadata: bool, left: usize) -> Data {
     let d = &s.dict;
     // Streams the security handler leaves as stored, which a viewer may still decrypt.
     let ty = d.name(b"Type");
@@ -219,7 +221,7 @@ fn data(s: &Stream, num: u32, g: &Graph, encrypted: bool, plain_metadata: bool)
     if !parms_line_up {
         return Data::Unknown;
     }
-    s.decoded_strict().map_or(Data::Unknown, Data::Decoded)
+    s.decoded_strict_within(left).map_or(Data::Unknown, Data::Decoded)
 }
 
 /// Drop the image and form XObjects that `pages` list in their own resources but no stream
@@ -254,7 +256,7 @@ pub(crate) fn remove_unused(doc: &mut Document, pages: &[ObjRef], progress: &mut
         }
         let obj = doc.get(ObjRef::new(*num, doc.generation(*num)));
         let Object::Stream(s) = &*obj else { continue };
-        match data(s, *num, &g, encrypted, plain_metadata) {
+        match data(s, *num, &g, encrypted, plain_metadata, DECODE_BUDGET.saturating_sub(decoded)) {
             Data::Picture => {}
             Data::Decoded(bytes) => {
                 decoded = decoded.saturating_add(bytes.len());
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index 7ab25262f8..eee2e9570c 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -423,8 +423,10 @@ fn black_and_white_images_become_ccitt_group_4() {
 /// Which 1-bit images qualify for Group 4: those of one colour component, an ICC profile of one
 /// component and a DeviceN of one colourant among them, but not one of three components or two
 /// colourants (more than a bit a pixel); image masks of one bit, as `/BitsPerComponent 1` says or
-/// by default, but not one that says 8; and images of up to 80 million pixels, not one row more.
-/// The byte totals count exactly the images stored again.
+/// by default, but not one that says 8; and images past 80 million pixels too, where an image of
+/// eight bits would be left alone (`one_bit_images_are_decoded_up_to_their_own_limit` checks the
+/// bytes of rows a one-bit image may hold without decoding so much). The byte totals count exactly
+/// the images stored again.
 #[test]
 fn group_4_takes_images_of_one_bit_a_pixel_up_to_the_pixel_limit() {
     let mut doc = Document::new_empty();
@@ -457,7 +459,7 @@ fn group_4_takes_images_of_one_bit_a_pixel_up_to_the_pixel_limit() {
     let mask = |bits: i64| [("ImageMask", Object::Bool(true)), ("BitsPerComponent", bits.into())];
     let mask_1 = mono_image(&mut doc, w, h, &text, None, &mask(1));
     let mask_8 = mono_image(&mut doc, w, h, &bilevel(8 * w, h, false), None, &mask(8));
-    // 10,000 × 8,000 is the limit itself.
+    // 10,000 × 8,000 is the limit of an image of eight bits; one of one bit goes past it.
     let grey = one_bit(Object::name("DeviceGray"));
     let at_limit = mono_image(&mut doc, 10_000, 8_000, &bilevel(10_000, 8_000, false), None, &grey);
     let past_limit = mono_image(&mut doc, 10_000, 8_001, &bilevel(10_000, 8_001, false), None, &grey);
@@ -474,8 +476,8 @@ fn group_4_takes_images_of_one_bit_a_pixel_up_to_the_pixel_limit() {
         })
         .collect();
     page(&mut doc, &names.iter().map(String::as_str).zip(all).collect::<Vec<_>>(), &content);
-    let converted = [icc_1, spot, mask_1, at_limit];
-    let left = [icc_3, two_spots, mask_8, past_limit];
+    let converted = [icc_1, spot, mask_1, at_limit, past_limit];
+    let left = [icc_3, two_spots, mask_8];
     let before = |doc: &Document, refs: &[ObjRef]| refs.iter().map(|r| stream(doc, *r).raw).collect::<Vec<_>>();
     let (old, untouched) = (before(&doc, &converted), before(&doc, &left));
     let r = optimize(&mut doc, &Settings::default()).unwrap();
@@ -4925,15 +4927,22 @@ fn indexed_thin_rules_survive_averaging_for_both_palette_orders_and_decodes() {
     }
 }
 
-/// An image past what the JBIG2 decoder takes on a side stays as it is: JBIG2 can state the size,
-/// but PdfCraft's decoder refuses such a stream, so stored as JBIG2 it drew nothing here. At 65,535
-/// on a side, the same bars do become JBIG2, so the fixture does reach that choice, and the coding
-/// stored (symbols, here) reads back through that decoder.
+/// An image past what the JBIG2 decoder takes on a side, or past 2^28 pixels in all, stays as it
+/// is: JBIG2 can state the size, but PdfCraft's decoder refuses such a stream, so stored as JBIG2 it
+/// drew nothing here. At 65,535 on a side, and at 2^28 in all (past 80 million, which the
+/// monochrome step takes of a one-bit image), the same bars do become JBIG2, so the fixture does
+/// reach that choice, and the coding stored reads back through that decoder. Averaged, an image past
+/// 2^28 becomes small enough and is stored as JBIG2 too.
 #[test]
 fn an_image_too_large_for_the_jbig2_decoder_stays_as_it_is() {
-    for (w, h, stored) in
-        [(65_535u32, 16u32, &b"JBIG2Decode"[..]), (16, 65_535, b"JBIG2Decode"), (65_536, 16, b"FlateDecode"), (16, 65_536, b"FlateDecode")]
-    {
+    for (w, h, stored) in [
+        (65_535u32, 16u32, &b"JBIG2Decode"[..]),
+        (16, 65_535, b"JBIG2Decode"),
+        (65_536, 16, b"FlateDecode"),
+        (16, 65_536, b"FlateDecode"),
+        (16_384, 16_384, b"JBIG2Decode"),
+        (16_384, 16_385, b"FlateDecode"),
+    ] {
         let mut doc = Document::new_empty();
         let image = mono_image(&mut doc, w, h, &bars(w, h), None, &[("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceGray"))]);
         page(&mut doc, &[("Im", image)], &format!("q {w} 0 0 {h} 0 0 cm /Im Do Q"));
@@ -4958,6 +4967,15 @@ fn an_image_too_large_for_the_jbig2_decoder_stays_as_it_is() {
             assert!(decoded_image(&doc, &s).unwrap() == bits, "{w} × {h} reads back");
         }
     }
+    let (w, h) = (16_384u32, 16_385u32);
+    let mut doc = Document::new_empty();
+    let image = mono_image(&mut doc, w, h, &bars(w, h), None, &[("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceGray"))]);
+    let (pw, ph) = (f64::from(w) * 72.0 / 600.0, f64::from(h) * 72.0 / 600.0);
+    page(&mut doc, &[("Im", image)], &format!("q {pw} 0 0 {ph} 0 0 cm /Im Do Q"));
+    let settings = Settings { mono: MonoSettings { compression: MonoCompression::Jbig2, ..MonoSettings::REDUCE }, ..Settings::default() };
+    let r = optimize(&mut doc, &settings).unwrap();
+    assert_eq!(r.images_resampled, 1, "{r:?}");
+    assert_eq!(stream(&doc, image).dict.name(b"Filter"), Some(&b"JBIG2Decode"[..]), "averaged, it is stored as JBIG2");
 }
 
 /// The colour and grey steps leave an image over 80 million pixels as it is, whatever their settings
@@ -5363,7 +5381,8 @@ fn stencil(doc: &mut Document, w: u32, h: u32) -> ObjRef {
 }
 
 /// A picture with a stencil mask is made smaller like any other: the mask has a resolution of its
-/// own, so it stays exactly as it was and the hole it cuts stays where it was.
+/// own, so it keeps its size and its bits (stored again as Group 4, as a picture's mask is) and the
+/// hole it cuts stays where it was.
 #[test]
 fn a_picture_with_a_stencil_mask_is_downsampled_under_its_mask() {
     let mut doc = Document::new_empty();
@@ -5381,7 +5400,9 @@ fn a_picture_with_a_stencil_mask_is_downsampled_under_its_mask() {
     let after = stream(&doc, img);
     assert_eq!(after.dict.int(b"Width"), Some(300), "150 ppi");
     assert_eq!(after.dict.reference(b"Mask"), Some(mask), "the mask stays on it");
-    assert_eq!(stream(&doc, mask), mask_before, "and doesn't change");
+    let mask_after = stream(&doc, mask);
+    assert_eq!((mask_after.dict.int(b"Width"), mask_after.dict.int(b"Height")), (Some(1200), Some(1200)), "the mask isn't resampled");
+    assert_eq!(decoded_image(&doc, &mask_after).unwrap(), decoded_image(&doc, &mask_before).unwrap(), "and keeps its bits");
     let rendered = render(&doc);
     assert_eq!(rendered.len(), before.len());
     let changed = before.iter().zip(&rendered).filter(|(a, b)| a.abs_diff(**b) > 96).count();
@@ -5396,6 +5417,156 @@ fn a_picture_with_a_stencil_mask_is_downsampled_under_its_mask() {
     }
 }
 
+/// A picture's masks of one bit a sample, which the page doesn't draw by name, are stored again as
+/// the monochrome settings ask, losslessly: a stencil `/Mask` (with a decode array that inverts it)
+/// and a one-bit `/SMask` become Group 4, keep their size and bits, and stay the pictures' masks;
+/// the page looks the same to the pixel. A mask two pictures share is stored once, and a stencil
+/// the page also draws by name is stored as that image. An eight-bit soft mask of only black and
+/// white stays as it is, to be resampled with its picture. With `mono: Retain` nothing changes.
+/// One-bit images past 80 million pixels are stored again, as images of eight bits that large are
+/// not: their rows hold a byte for each 8 samples. A picture's stencil mask and one-bit soft mask
+/// too.
+#[test]
+fn one_bit_images_past_80_million_pixels_are_stored_as_group_4() {
+    let mut doc = Document::new_empty();
+    let (w, h) = (9_000, 8_900);
+    let text = bilevel(w, h, false);
+    let one_bit = mono_image(&mut doc, w, h, &text, None, &[("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceGray"))]);
+    let stencil = mono_image(&mut doc, w, h, &text, None, &[("ImageMask", Object::Bool(true))]);
+    let soft = mono_image(&mut doc, w, h, &text, None, &[("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceGray"))]);
+    let masked = |doc: &mut Document, key: &str, mask: ObjRef| {
+        let picture = image(doc, 200, 80, 3, false, None);
+        let mut s = stream(doc, picture);
+        s.dict.set(key.as_bytes().to_vec(), Object::Ref(mask));
+        doc.set(picture, Object::Stream(s));
+        picture
+    };
+    let (picture, shaded) = (masked(&mut doc, "Mask", stencil), masked(&mut doc, "SMask", soft));
+    page(
+        &mut doc,
+        &[("I", one_bit), ("P", picture), ("S", shaded)],
+        "q 300 0 0 300 20 400 cm /I Do Q q 300 0 0 120 20 100 cm /P Do Q q 300 0 0 120 20 250 cm /S Do Q",
+    );
+    let keep = ImageSettings { downsample: false, compression: Compression::Retain, ..ImageSettings::REDUCE };
+    let mono = MonoSettings { downsample: false, ..MonoSettings::REDUCE };
+    let before = [one_bit, stencil, soft].map(|r| stream(&doc, r));
+    let r = optimize(&mut doc, &Settings { color: keep, gray: keep, mono, ..Settings::default() }).unwrap();
+    assert_eq!(r.images_recompressed, 3, "{r:?}");
+    for (r, old) in [one_bit, stencil, soft].into_iter().zip(&before) {
+        let new = stream(&doc, r);
+        assert_eq!(new.dict.name(b"Filter"), Some(&b"CCITTFaxDecode"[..]), "{r:?}");
+        assert!(new.raw.len() < old.raw.len(), "{r:?}: {} against {}", new.raw.len(), old.raw.len());
+        assert_eq!(decoded_image(&doc, &new).unwrap(), text, "{r:?} keeps its bits");
+    }
+}
+
+/// With the default settings (Reduce File Size), a one-bit image past 80 million pixels drawn at
+/// 600 ppi is averaged to 300 ppi, as a smaller one is: vertical stripes four samples wide.
+#[test]
+fn a_one_bit_image_past_80_million_pixels_is_averaged_with_the_default_settings() {
+    let (w, h) = (9_000u32, 8_900u32);
+    let mut doc = Document::new_empty();
+    let stripes = vec![0x0F; (w as usize).div_ceil(8) * h as usize];
+    let one_bit = mono_image(&mut doc, w, h, &stripes, None, &[("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceGray"))]);
+    let (pw, ph) = (f64::from(w) * 72.0 / 600.0, f64::from(h) * 72.0 / 600.0);
+    page(&mut doc, &[("I", one_bit)], &format!("q {pw} 0 0 {ph} 0 0 cm /I Do Q"));
+    let r = optimize(&mut doc, &Settings::default()).unwrap();
+    assert_eq!(r.images_resampled, 1, "{r:?}");
+    let s = stream(&doc, one_bit);
+    assert_eq!((s.dict.int(b"Width"), s.dict.int(b"Height")), (Some(4_500), Some(4_450)));
+}
+
+#[test]
+fn a_pictures_one_bit_masks_are_stored_again() {
+    let mut doc = Document::new_empty();
+    let (w, h) = (1200, 480);
+    let text = bilevel(w, h, false);
+    let decode = Object::Array(vec![1.into(), 0.into()]);
+    let stencil_mask = mono_image(&mut doc, w, h, &text, None, &[("ImageMask", Object::Bool(true)), ("Decode", decode.clone())]);
+    let one_bit = mono_image(&mut doc, w, h, &text, None, &[("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceGray"))]);
+    let wide: Vec<u8> = text.iter().flat_map(|b| (0..8).rev().map(move |i| if b >> i & 1 == 1 { 255 } else { 0 })).collect();
+    let eight_bit = mono_image(&mut doc, w, h, &wide, None, &[("BitsPerComponent", 8.into()), ("ColorSpace", Object::name("DeviceGray"))]);
+    let drawn = mono_image(&mut doc, w, h, &text, None, &[("ImageMask", Object::Bool(true))]);
+    let masked = |doc: &mut Document, key: &str, mask: ObjRef| {
+        let picture = image(doc, 200, 80, 3, false, None);
+        let mut s = stream(doc, picture);
+        s.dict.set(key.as_bytes().to_vec(), Object::Ref(mask));
+        doc.set(picture, Object::Stream(s));
+        picture
+    };
+    let a = masked(&mut doc, "Mask", stencil_mask);
+    let b = masked(&mut doc, "Mask", stencil_mask);
+    let c = masked(&mut doc, "SMask", one_bit);
+    let d = masked(&mut doc, "SMask", eight_bit);
+    let e = masked(&mut doc, "Mask", drawn);
+    page(
+        &mut doc,
+        &[("A", a), ("B", b), ("C", c), ("D", d), ("E", e), ("M", drawn)],
+        "q 300 0 0 120 20 660 cm /A Do Q q 300 0 0 120 320 660 cm /B Do Q q 300 0 0 120 20 520 cm /C Do Q \
+         q 300 0 0 120 320 520 cm /D Do Q q 300 0 0 120 20 380 cm /E Do Q q 0 0.4 0.8 rg 300 0 0 120 320 380 cm /M Do Q",
+    );
+    // Pictures in colour and grey are left as they are, so only the masks can change.
+    let keep = ImageSettings { downsample: false, compression: Compression::Retain, ..ImageSettings::REDUCE };
+    let settings = Settings { color: keep, gray: keep, ..Settings::default() };
+    let before = render(&doc);
+    let masks = [stencil_mask, one_bit, eight_bit, drawn].map(|r| stream(&doc, r));
+
+    let mut kept = doc.clone();
+    let r = optimize(&mut kept, &Settings { mono: RETAIN, ..settings.clone() }).unwrap();
+    assert_eq!(r.images_recompressed, 0, "Retain keeps every mask as it is");
+    assert_eq!([stencil_mask, one_bit, eight_bit, drawn].map(|r| stream(&kept, r)), masks);
+
+    let r = optimize(&mut doc, &settings).unwrap();
+    assert_eq!(r.images_recompressed, 3, "the shared stencil once, the soft mask, the stencil drawn by name once: {r:?}");
+    for (mask, old) in [(stencil_mask, &masks[0]), (one_bit, &masks[1]), (drawn, &masks[3])] {
+        let new = stream(&doc, mask);
+        assert_eq!(new.dict.name(b"Filter"), Some(&b"CCITTFaxDecode"[..]), "{mask:?}");
+        assert_eq!((new.dict.int(b"Width"), new.dict.int(b"Height")), (Some(w as i64), Some(h as i64)));
+        assert_eq!(decoded_image(&doc, &new).unwrap(), decoded_image(&doc, old).unwrap(), "{mask:?} keeps its bits");
+    }
+    assert_eq!(stream(&doc, stencil_mask).dict.get(b"Decode"), Some(&decode), "the decode array stays");
+    assert_eq!(stream(&doc, eight_bit), masks[2], "an eight-bit soft mask stays");
+    for (picture, key, mask) in
+        [(a, "Mask", stencil_mask), (b, "Mask", stencil_mask), (c, "SMask", one_bit), (d, "SMask", eight_bit), (e, "Mask", drawn)]
+    {
+        assert_eq!(stream(&doc, picture).dict.reference(key.as_bytes()), Some(mask), "{picture:?} keeps its mask");
+    }
+    assert!(render(&doc) == before, "the page looks the same");
+}
+
+/// Stored as JBIG2, a picture's mask is coded on its own: it shares no symbol dictionary with the
+/// images the page draws by name, which do share one.
+#[test]
+fn a_pictures_mask_stored_as_jbig2_shares_no_dictionary() {
+    let mut doc = Document::new_empty();
+    let (w, h) = (1200, 480);
+    let text = bilevel(w, h, false);
+    let mask = mono_image(&mut doc, w, h, &text, None, &[("ImageMask", Object::Bool(true))]);
+    let picture = image(&mut doc, 200, 80, 3, false, None);
+    let mut s = stream(&doc, picture);
+    s.dict.set(b"Mask".to_vec(), Object::Ref(mask));
+    doc.set(picture, Object::Stream(s));
+    let named: Vec<ObjRef> = (0..3)
+        .map(|_| mono_image(&mut doc, w, h, &text, None, &[("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceGray"))]))
+        .collect();
+    page(
+        &mut doc,
+        &[("P", picture), ("G0", named[0]), ("G1", named[1]), ("G2", named[2])],
+        "q 300 0 0 120 20 660 cm /P Do Q q 300 0 0 120 320 660 cm /G0 Do Q q 300 0 0 120 20 520 cm /G1 Do Q q 300 0 0 120 320 520 cm /G2 Do Q",
+    );
+    let keep = ImageSettings { downsample: false, compression: Compression::Retain, ..ImageSettings::REDUCE };
+    let jbig2 = MonoSettings { compression: MonoCompression::Jbig2, ..MonoSettings::REDUCE };
+    let before = render(&doc);
+    let old = stream(&doc, mask);
+    optimize(&mut doc, &Settings { color: keep, gray: keep, mono: jbig2, ..Settings::default() }).unwrap();
+    let new = stream(&doc, mask);
+    assert_eq!(new.dict.name(b"Filter"), Some(&b"JBIG2Decode"[..]));
+    assert!(!new.dict.contains(b"DecodeParms"), "no /JBIG2Globals");
+    assert_eq!(decoded_image(&doc, &new).unwrap(), decoded_image(&doc, &old).unwrap());
+    assert!(named.iter().any(|r| stream(&doc, *r).dict.get(b"DecodeParms").is_some()), "the images drawn by name share one");
+    assert!(render(&doc) == before, "the page looks the same");
+}
+
 /// A colour-key mask names sample values: resampling or JPEG would make holes where there were none
 /// and fill those there were, so the picture stays as it is, however the array is written. A mask
 /// that can't be read as a stencil is no reason to change the picture either.
@@ -5442,6 +5613,70 @@ fn a_picture_whose_mask_is_not_a_stencil_is_left_alone() {
     }
 }
 
+/// A resource dictionary shared by reference between thousands of pages is walked once by the
+/// space audit, not once per page.
+#[test]
+fn space_audit_walks_a_shared_resource_dictionary_once() {
+    let mut doc = Document::new_empty();
+    let img = image(&mut doc, 4, 4, 3, false, None);
+    let mut x = Dict::new();
+    for i in 0..5_000 {
+        x.set(format!("Im{i}").into_bytes(), Object::Ref(img));
+    }
+    let mut res = Dict::new();
+    res.set(b"XObject".to_vec(), Object::Dict(x));
+    let shared = doc.add(Object::Dict(res));
+    let pages = doc.root().and_then(|r| doc.get(r).as_dict().and_then(|d| d.reference(b"Pages"))).unwrap();
+    let mut kids = Vec::new();
+    for _ in 0..2_000 {
+        let mut p = Dict::new();
+        p.set(b"Type".to_vec(), Object::name("Page"));
+        p.set(b"Parent".to_vec(), Object::Ref(pages));
+        p.set(b"MediaBox".to_vec(), Object::Array(vec![0.into(), 0.into(), 612.into(), 792.into()]));
+        p.set(b"Resources".to_vec(), Object::Ref(shared));
+        kids.push(Object::Ref(doc.add(Object::Dict(p))));
+    }
+    doc.update_dict(pages, |d| {
+        d.set(b"Count".to_vec(), Object::Int(kids.len() as i64));
+        d.set(b"Kids".to_vec(), Object::Array(kids));
+    })
+    .unwrap();
+    let started = std::time::Instant::now();
+    let audit = audit_space(&doc, 1 << 20);
+    assert!(started.elapsed() < std::time::Duration::from_secs(5), "{:?}", started.elapsed());
+    assert!(audit.iter().any(|u| u.category == SpaceCategory::Images && u.bytes > 0), "{audit:?}");
+}
+
+/// A name tree whose nodes all share one kids array (by reference) is read once per node, not
+/// once per node per kid: the queue can't grow to the nodes times the kids.
+#[test]
+fn a_name_tree_sharing_one_kids_array_is_walked_once() {
+    let mut doc = Document::new_empty();
+    let p = page(&mut doc, &[], "BT ET");
+    let s = |t: &str| Object::String(pdfcraft_cos::PdfString::literal(t.as_bytes().to_vec()));
+    let fit = Object::Array(vec![Object::Ref(p), Object::name("Fit")]);
+    let kids = doc.add(Object::Array(Vec::new()));
+    let mut nodes = Vec::new();
+    for i in 0..3_000 {
+        let mut node = Dict::new();
+        node.set(b"Kids".to_vec(), Object::Ref(kids));
+        node.set(b"Names".to_vec(), Object::Array(vec![s(&format!("d{i}")), fit.clone()]));
+        nodes.push(Object::Ref(doc.add(Object::Dict(node))));
+    }
+    doc.set(kids, Object::Array(nodes));
+    let mut tree = Dict::new();
+    tree.set(b"Kids".to_vec(), Object::Ref(kids));
+    let tree = doc.add(Object::Dict(tree));
+    let mut names = Dict::new();
+    names.set(b"Dests".to_vec(), Object::Ref(tree));
+    let root = doc.root().unwrap();
+    doc.update_dict(root, |c| c.set(b"Names".to_vec(), Object::Dict(names))).unwrap();
+    let started = std::time::Instant::now();
+    let report = optimize(&mut doc, &Settings::default()).unwrap();
+    assert!(started.elapsed() < std::time::Duration::from_secs(10), "{:?}", started.elapsed());
+    assert_eq!(report.unreferenced_dests, 3_000, "every node's destination was found, once");
+}
+
 /// Pictures run on several threads: what comes out doesn't depend on how many.
 #[test]
 fn the_same_file_comes_out_with_any_number_of_threads() {
diff --git a/crates/organize/src/tests.rs b/crates/organize/src/tests.rs
index a04d9f2dcb..fa240f777f 100644
--- a/crates/organize/src/tests.rs
+++ b/crates/organize/src/tests.rs
@@ -689,6 +689,38 @@ fn document_info_falls_back_to_the_xmp_packet() {
     assert_eq!(info(&doc, "Subject"), None);
 }
 
+/// The title read from XMP each frame (Initial View ▸ Show: Document Title) decodes the packet
+/// once, not on every read; an edit of the packet, or another document, reads afresh.
+#[test]
+fn the_xmp_packet_is_decoded_once_for_repeated_reads() {
+    let decodes = || crate::xmp::XMP_DECODES.with(std::cell::Cell::get);
+    let mut doc = doc_with_xmp(LIBREOFFICE_XMP.as_bytes());
+    doc.trailer_mut().remove(b"Info");
+    let before = decodes();
+    for _ in 0..10 {
+        assert_eq!(info(&doc, "Title").as_deref(), Some("Untitled 1"));
+        assert_eq!(info(&doc, "Author").as_deref(), Some("Old Author"));
+    }
+    assert_eq!(decodes() - before, 1);
+    set_info(&mut doc, "Title", "Report").unwrap();
+    doc.trailer_mut().remove(b"Info");
+    assert_eq!(info(&doc, "Title").as_deref(), Some("Report"), "the edited packet, not the one read before");
+    assert_eq!(decodes() - before, 2);
+    let mut other = doc_with_xmp(LIBREOFFICE_XMP.replace("Untitled 1", "Other").as_bytes());
+    other.trailer_mut().remove(b"Info");
+    assert_eq!(info(&other, "Title").as_deref(), Some("Other"), "another document's packet");
+    assert_eq!(info(&doc, "Title").as_deref(), Some("Report"));
+    let mut latin1 = LIBREOFFICE_XMP.as_bytes().to_vec();
+    latin1.extend_from_slice(&[b'<', 0xE9, b'>']);
+    let mut bad = doc_with_xmp(&latin1);
+    bad.trailer_mut().remove(b"Info");
+    let before = decodes();
+    for _ in 0..10 {
+        assert_eq!(info(&bad, "Title"), None);
+    }
+    assert_eq!(decodes() - before, 1, "an unreadable packet is not decoded again either");
+}
+
 #[test]
 fn document_info_edits_leave_files_without_usable_xmp_alone() {
     // No packet: none is added, for a custom property either.
diff --git a/crates/organize/src/xmp.rs b/crates/organize/src/xmp.rs
index 23eca1e1aa..0a828002e4 100644
--- a/crates/organize/src/xmp.rs
+++ b/crates/organize/src/xmp.rs
@@ -16,6 +16,9 @@
 //! none, and a packet this can't edit safely (not UTF-8, no `rdf:RDF`, too large to decode) is
 //! left as it was.
 
+use std::cell::RefCell;
+use std::sync::{Arc, Weak};
+
 use pdfcraft_cos::{Document, Object, Stream};
 
 use crate::OrganizeError;
@@ -177,12 +180,43 @@ pub(crate) fn info_value(doc: &Document, key: &str) -> Option<String> {
     let (name, _, shape) = property(key)?;
     let root = doc.root()?;
     let r = doc.get(root).as_dict()?.reference(b"Metadata")?;
-    let obj = doc.get(r);
-    let Object::Stream(stream) = &*obj else { return None };
-    let xmp = String::from_utf8(stream.decoded_within(MAX_XMP).ok()?).ok()?;
+    let xmp = decoded_packet(&doc.get(r))?;
     get_property(&xmp, name, shape)
 }
 
+/// A decoded packet (`None`: unreadable) and the stream object it came from.
+type Held = (Weak<Object>, Option<Arc<str>>);
+
+thread_local! {
+    /// The packet [`decoded_packet`] last decoded (`None`: unreadable), with the stream object it
+    /// came from. The tab title can come from XMP and is read every frame; a packet decodes to
+    /// up to [`MAX_XMP`] bytes.
+    static PACKET: RefCell<Option<Held>> = const { RefCell::new(None) };
+}
+
+/// The text of the XMP stream `obj`, `None` when it isn't a stream or isn't UTF-8 within
+/// [`MAX_XMP`]. Decoded once while the document keeps handing out the same object: an edit or
+/// another document gives another one. The [`Weak`] keeps its address from being reused.
+fn decoded_packet(obj: &Arc<Object>) -> Option<Arc<str>> {
+    let same = |held: &Held| std::ptr::eq(held.0.as_ptr(), Arc::as_ptr(obj));
+    if let Ok(Some(text)) = PACKET.try_with(|p| p.borrow().as_ref().filter(|held| same(held)).map(|held| held.1.clone())) {
+        return text;
+    }
+    let Object::Stream(stream) = &**obj else { return None };
+    #[cfg(test)]
+    XMP_DECODES.with(|n| n.set(n.get() + 1));
+    let text = stream.decoded_within(MAX_XMP).ok().and_then(|b| String::from_utf8(b).ok()).map(Arc::<str>::from);
+    // Past the thread's end (a destructor reading it) the packet just isn't kept.
+    let _ = PACKET.try_with(|p| *p.borrow_mut() = Some((Arc::downgrade(obj), text.clone())));
+    text
+}
+
+#[cfg(test)]
+thread_local! {
+    /// Packets [`decoded_packet`] decoded on this thread.
+    pub(crate) static XMP_DECODES: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
+}
+
 /// The text of the property `name` in `xmp`, element or attribute form (see [`info_value`]).
 fn get_property(xmp: &str, name: &str, shape: Shape) -> Option<String> {
     let value = if let Some((start, end)) = element_span(xmp, name) {
diff --git a/crates/prc/src/lib.rs b/crates/prc/src/lib.rs
index d594e74065..513b28a683 100644
--- a/crates/prc/src/lib.rs
+++ b/crates/prc/src/lib.rs
@@ -34,4 +34,4 @@ pub use error::PrcError;
 pub use geometry::Matrix;
 pub use schema::Schema;
 pub use tess::{Tessellation, TriangleMesh, TriangleStyle};
-pub use tree::{EntityOverrides, MAX_PLACEMENTS, ModelNode, NameSource, Placement, Rgba, StyleAlpha};
+pub use tree::{EntityOverrides, MAX_PLACEMENTS, ModelNode, ModelUnits, NameSource, Placement, Rgba, StyleAlpha};
diff --git a/crates/prc/src/tree/mod.rs b/crates/prc/src/tree/mod.rs
index 3ed9d8eb20..db2d5352c8 100644
--- a/crates/prc/src/tree/mod.rs
+++ b/crates/prc/src/tree/mod.rs
@@ -221,6 +221,20 @@ struct Tree {
 #[derive(Debug, Clone, PartialEq)]
 struct ModelFile {
     roots: Vec<(UniqueId, u32)>,
+    units_in_mm: f64,
+    units_from_cad_file: bool,
+}
+
+/// The unit a PRC model's coordinates are in, from its model file [WD 7.3.3].
+#[derive(Debug, Clone, Copy, PartialEq)]
+#[non_exhaustive]
+pub struct ModelUnits {
+    /// Millimetres per model unit: 1 for millimetres, 25.4 for inches.
+    pub mm_per_unit: f64,
+    /// The file says the unit is the CAD system's own. When `false` it is the exporter's
+    /// default and may not be the model's real scale, so a measurement should say the unit
+    /// is assumed.
+    pub from_cad_file: bool,
 }
 
 impl PrcFile {
@@ -270,6 +284,22 @@ impl PrcFile {
         self.model_file.iter().any(|&b| b != 0)
     }
 
+    /// The unit the model's coordinates are in. `None` when the file stores no tree
+    /// ([`Self::stores_tree`]) or the stored unit is not a positive finite number.
+    ///
+    /// # Errors
+    /// [`PrcError::Malformed`] or a read error when the model file is stored but does not read.
+    pub fn units(&self) -> Result<Option<ModelUnits>, PrcError> {
+        if !self.stores_tree() {
+            return Ok(None);
+        }
+        let mut r = BitReader::with_budget(&self.model_file, Budget::FULL);
+        let schema = Schema::read(&mut r)?;
+        let model = Ctx::new(r, &schema, self.header.authoring_version).model_file()?;
+        let mm = model.units_in_mm;
+        Ok((mm.is_finite() && mm > 0.0).then_some(ModelUnits { mm_per_unit: mm, from_cad_file: model.units_from_cad_file }))
+    }
+
     fn walk(&self, rule: StyleAlpha, scope: EntityOverrides) -> Result<(Vec<Placement>, Vec<ModelNode>), PrcError> {
         self.walk_within(rule, scope, Budget::FULL)
     }
diff --git a/crates/prc/src/tree/read.rs b/crates/prc/src/tree/read.rs
index ff3affaeee..f3361dfeef 100644
--- a/crates/prc/src/tree/read.rs
+++ b/crates/prc/src/tree/read.rs
@@ -437,8 +437,8 @@ impl Ctx<'_, '_> {
     pub(super) fn model_file(&mut self) -> Result<ModelFile, PrcError> {
         self.expect_type(MODEL_FILE)?;
         self.content_prc_base()?;
-        self.r.bit()?; // units_from_cad_file
-        self.r.double()?; // units_in_mm
+        let units_from_cad_file = self.r.bit()?;
+        let units_in_mm = self.r.double()?;
         let n = self.count(6, "root occurrences")?;
         let mut roots = Vec::with_capacity(n);
         for _ in 0..n {
@@ -447,6 +447,6 @@ impl Ctx<'_, '_> {
             self.r.bit()?; // is_active
             roots.push((id, index));
         }
-        Ok(ModelFile { roots })
+        Ok(ModelFile { roots, units_in_mm, units_from_cad_file })
     }
 }
diff --git a/crates/prc/src/tree/tests.rs b/crates/prc/src/tree/tests.rs
index a2264588bd..fe9c72aa55 100644
--- a/crates/prc/src/tree/tests.rs
+++ b/crates/prc/src/tree/tests.rs
@@ -9,7 +9,7 @@ use crate::bits::{BitReader, Budget};
 use crate::entity::Ctx;
 use crate::tess::tests::two_face_square;
 use crate::testw::W;
-use crate::{PrcError, PrcFile, Rgba, Schema, Tessellation, TriangleMesh, UniqueId};
+use crate::{ModelUnits, PrcError, PrcFile, Rgba, Schema, Tessellation, TriangleMesh, UniqueId};
 
 const RED: Rgba = Rgba { r: 1., g: 0., b: 0., a: 1. };
 const GREEN: Rgba = Rgba { r: 0., g: 1., b: 0., a: 1. };
@@ -274,10 +274,15 @@ fn ref_faces(brep: (u32, u32), faces: &[u32], g: (u32, u16)) -> W {
 
 /// A model file (schema included) whose roots are `(file structure, biased occurrence)`.
 fn model(roots: &[(usize, u32)]) -> W {
+    model_in(roots, false, 1.)
+}
+
+/// [`model`] with its unit: whether it is the CAD file's, and millimetres per unit.
+fn model_in(roots: &[(usize, u32)], from_cad_file: bool, units_in_mm: f64) -> W {
     let mut w = W::default();
     w.uint(0).uint(301);
     base(&mut w, None);
-    w.bit(false).double(1.).uint(len(roots.len()));
+    w.bit(from_cad_file).double(units_in_mm).uint(len(roots.len()));
     for &(fs, index) in roots {
         for v in fs_id(fs).0 {
             w.uint(v);
@@ -391,6 +396,22 @@ fn a_parsed_assembly_places_names_and_colours_each_occurrence() {
     );
 }
 
+#[test]
+fn the_model_file_gives_the_unit_and_whether_it_is_assumed() {
+    let fs = || Fs { globals: palette(), tree: tree(&[plate(S_RED)], &[Occ::default()]), tess: two_face_square() };
+    let units = |model: W| PrcFile::parse(&prc(&[fs()], &model)).unwrap().units();
+    let unit = |mm_per_unit, from_cad_file| Some(ModelUnits { mm_per_unit, from_cad_file });
+    assert_eq!(units(model(&[(0, 1)])).unwrap(), unit(1., false));
+    assert_eq!(units(model_in(&[(0, 1)], true, 25.4)).unwrap(), unit(25.4, true));
+    for bad in [0., -1., f64::NAN, f64::INFINITY] {
+        assert_eq!(units(model_in(&[(0, 1)], true, bad)).unwrap(), None, "{bad}");
+    }
+    assert_eq!(units(W::default()).unwrap(), None);
+    let mut not_a_model = W::default();
+    not_a_model.uint(0).uint(302);
+    assert!(units(not_a_model).is_err());
+}
+
 #[test]
 fn a_file_without_a_model_file_entity_has_no_tree() {
     let fs = Fs { globals: palette(), tree: tree(&[], &[]), tess: two_face_square() };
diff --git a/crates/preflight/src/lib.rs b/crates/preflight/src/lib.rs
index 54a8a9508f..90c6d9db83 100644
--- a/crates/preflight/src/lib.rs
+++ b/crates/preflight/src/lib.rs
@@ -203,6 +203,7 @@ pub const WORDINGS: &[&str] = &[
     "A graphics state has the rendering intent {}, which isn't a standard one",
     "A graphics state has a rendering intent that isn't a name",
     "The form asks viewers to make appearances (NeedAppearances)",
+    "Some content could not be read for device colour",
     // Pages, actions, annotations and fields.
     "Page {} has additional actions",
     "A {} action isn't allowed",
@@ -229,7 +230,8 @@ pub struct Declared {
     /// `pdfaid:part` and `pdfaid:conformance`, e.g. (2, "B").
     pub pdfa: Option<(u8, String)>,
     pub pdfua: Option<u8>,
-    /// Output intents' condition identifiers.
+    /// Output intents' condition identifiers: every intent the document lists (each object
+    /// once), each identifier cut to [`MAX_IDENTIFIER_BYTES`].
     pub output_intents: Vec<String>,
 }
 
@@ -276,10 +278,27 @@ pub fn declared(doc: &Document) -> Declared {
         d.pdfua = xmp::identifier(&x, xmp::PDFUA_ID, "part").and_then(|p| p.parse().ok());
     }
     let cat = catalog(doc);
-    if let Some(list) = cat.get(b"OutputIntents").map(|o| doc.resolve(o)).and_then(|o| o.as_array().cloned()) {
-        for oi in list {
-            if let Some(od) = doc.resolve(&oi).as_dict() {
-                let id = od.get(b"OutputConditionIdentifier").and_then(|v| doc.resolve(v).as_string().map(|s| s.to_text())).unwrap_or_default();
+    let list = cat.get(b"OutputIntents").map(|o| doc.resolve(o));
+    if let Some(list) = list.as_deref().and_then(Object::as_array) {
+        // One intent object listed again is one declaration: its identifier is not copied once
+        // per listing. Every distinct one is kept (verification reads them all too), and only
+        // the start of an identifier longer than any real one.
+        let mut seen = std::collections::HashSet::new();
+        for oi in list.iter().filter(|oi| oi.as_ref().is_none_or(|r| seen.insert(r))) {
+            if let Some(od) = doc.resolve(oi).as_dict() {
+                let id = od
+                    .get(b"OutputConditionIdentifier")
+                    .and_then(|v| {
+                        doc.resolve(v).as_string().map(|s| {
+                            if s.bytes.len() <= MAX_IDENTIFIER_BYTES {
+                                s.to_text()
+                            } else {
+                                // An even cut keeps UTF-16 text whole code units.
+                                pdfcraft_cos::PdfString { bytes: s.bytes[..MAX_IDENTIFIER_BYTES & !1].to_vec(), hex: s.hex }.to_text()
+                            }
+                        })
+                    })
+                    .unwrap_or_default();
                 d.output_intents.push(id);
             }
         }
@@ -287,6 +306,14 @@ pub fn declared(doc: &Document) -> Declared {
     d
 }
 
+/// The most bytes of an output condition identifier [`declared`] keeps (a real one is a few
+/// dozen).
+const MAX_IDENTIFIER_BYTES: usize = 1024;
+
+/// Decoded bytes one verification reads looking for device colour, all content streams
+/// together. Past it, content is not inspected, and the report says so.
+const MAX_COLOUR_DECODED: usize = 1 << 30;
+
 /// Every indirect object, with its reference.
 fn objects(doc: &Document) -> Vec<(ObjRef, std::sync::Arc<Object>)> {
     doc.object_numbers()
@@ -361,6 +388,9 @@ struct DeviceColour {
     /// space, which PDF/A accepts whatever the output intent (ISO 19005-2 6.2.4.3).
     default_rgb: bool,
     default_cmyk: bool,
+    /// Content that could not be read (undecodable, or past [`MAX_COLOUR_DECODED`]) may use
+    /// device colour that was not seen.
+    incomplete: bool,
 }
 
 impl DeviceColour {
@@ -388,27 +418,35 @@ const MAX_DIRECT_DEPTH: u8 = 8;
 
 /// The glyph procedures of every Type 3 font in `d`: `d` itself, or a font held directly inside
 /// it (a font can sit inline in a resource dictionary).
-fn type3_procs(doc: &Document, d: &Dict, depth: u8, out: &mut std::collections::HashSet<ObjRef>) {
+fn type3_procs(doc: &Document, d: &Dict, depth: u8, read: &mut std::collections::HashSet<ObjRef>, out: &mut std::collections::HashSet<ObjRef>) {
     if d.name(b"Subtype") == Some(b"Type3")
-        && let Some(procs) = d.get(b"CharProcs").map(|c| doc.resolve(c))
-        && let Some(procs) = procs.as_dict()
+        && let Some(c) = d.get(b"CharProcs")
+        // One glyph dictionary shared by many fonts is read once: its entries are the same.
+        && c.as_ref().is_none_or(|r| read.insert(r))
+        && let Some(procs) = doc.resolve(c).as_dict()
     {
         out.extend(procs.iter().filter_map(|(_, p)| p.as_ref()));
     }
     for (_, v) in d.iter() {
-        type3_procs_within(doc, v, depth.saturating_add(1), out);
+        type3_procs_within(doc, v, depth.saturating_add(1), read, out);
     }
 }
 
-fn type3_procs_within(doc: &Document, o: &Object, depth: u8, out: &mut std::collections::HashSet<ObjRef>) {
+fn type3_procs_within(
+    doc: &Document,
+    o: &Object,
+    depth: u8,
+    read: &mut std::collections::HashSet<ObjRef>,
+    out: &mut std::collections::HashSet<ObjRef>,
+) {
     if depth > MAX_DIRECT_DEPTH {
         return;
     }
     match o {
-        Object::Dict(d) => type3_procs(doc, d, depth, out),
+        Object::Dict(d) => type3_procs(doc, d, depth, read, out),
         Object::Array(a) => {
             for v in a {
-                type3_procs_within(doc, v, depth.saturating_add(1), out);
+                type3_procs_within(doc, v, depth.saturating_add(1), read, out);
             }
         }
         _ => {}
@@ -430,9 +468,10 @@ fn referenced_content(doc: &Document, objs: &[(ObjRef, std::sync::Arc<Object>)])
         };
         out.extend(contents.iter().filter_map(Object::as_ref));
     }
+    let mut read = std::collections::HashSet::new();
     for (_, o) in objs {
         if let Some(d) = dict_of(o) {
-            type3_procs(doc, d, 0, &mut out);
+            type3_procs(doc, d, 0, &mut read, &mut out);
         }
     }
     out
@@ -560,6 +599,7 @@ fn mark_cs_object(doc: &Document, cs: &Object, used: &mut DeviceColour, depth: u
 fn uses_device_colour(doc: &Document, objs: &[(ObjRef, std::sync::Arc<Object>)]) -> DeviceColour {
     let mut used = DeviceColour::default();
     let referenced = referenced_content(doc, objs);
+    let mut budget = pdfcraft_cos::DecodeBudget::new(MAX_COLOUR_DECODED, usize::MAX);
     for (r, o) in objs {
         let Some(d) = dict_of(o) else { continue };
         // A resource dictionary's /ColorSpace, whether it is this object or the page's inline
@@ -586,9 +626,14 @@ fn uses_device_colour(doc: &Document, objs: &[(ObjRef, std::sync::Arc<Object>)])
         if !(used.gray && used.rgb && used.cmyk)
             && let Object::Stream(s) = &**o
             && (referenced.contains(r) || is_content(&s.dict))
-            && let Ok(data) = s.decoded()
         {
-            let _ = content_colour(&data, &mut used);
+            match budget.decode(s) {
+                Ok(data) => {
+                    let _ = content_colour(&data, &mut used);
+                }
+                // Not read: it may draw in a device space nothing above saw.
+                Err(_) => used.incomplete = true,
+            }
         }
     }
     used
@@ -830,6 +875,9 @@ fn check_output_intent(
     issue: &mut impl FnMut(&'static str, &'static str, Option<String>, Option<usize>, bool),
 ) {
     let used = uses_device_colour(doc, objs);
+    if used.incomplete {
+        issue("6.2.3", "Some content could not be read for device colour", None, None, false);
+    }
     match pdfa_intent_profile(doc) {
         None if used.any() => {
             issue("6.2.3", "Device colour is used, but there is no PDF/A output intent", None, None, !used.cmyk);
@@ -868,6 +916,22 @@ fn check_catalog_actions(doc: &Document, issue: &mut impl FnMut(&'static str, &'
     }
 }
 
+/// Whether something the page `page` paints with can paint transparently: a graphics state with
+/// a soft mask, a constant alpha (`/CA`, `/ca`) below 1 or a blend mode other than `Normal` or
+/// `Compatible`, or an image with a soft mask. `page` is a page dictionary with its inherited
+/// attributes filled in, as [`pdfcraft_model::pages`] lists it.
+///
+/// The search is the one PDF/A verification makes (ISO 32000-1 11.6.4.4 to 11.6.6): through the
+/// page's resources, the form XObjects, tiling patterns and Type 3 fonts they hold, and its
+/// annotations' appearance streams, within the same budgets, so a page that nests deeper than
+/// those reports what was found within them. A resource the page holds counts whether or not its
+/// content uses it. Unlike PDF/A, a transparency group on its own doesn't count: opaque content
+/// with normal blending looks the same inside one as without it, and many producers (Microsoft
+/// Word among them) give every page a group.
+pub fn page_uses_transparency(doc: &Document, page: &Dict) -> bool {
+    transparency::page_painting(doc, page, &mut transparency::Shared::default()).paints_transparently
+}
+
 fn check_transparency(
     doc: &Document,
     pages: &[pdfcraft_model::Page],
@@ -1199,22 +1263,56 @@ const MAX_ACTION_CHAIN: usize = 1024;
 fn chain_forbidden(doc: &Document, a: &Dict) -> Option<String> {
     let mut read = 0;
     let mut seen = std::collections::HashSet::new();
-    // Actions written in an indirect `/Next` array, copied out of it.
-    let mut held: Vec<Dict> = Vec::new();
+    // Objects `/Next` refers to (an action, or an array of them), each read once and borrowed:
+    // one array shared by many chains is not copied per chain.
+    let mut held: Vec<std::sync::Arc<Object>> = Vec::new();
     if let Some(s) = walk_chain(doc, a, &mut read, &mut seen, &mut held) {
         return Some(s);
     }
-    while let Some(d) = held.pop() {
-        if let Some(s) = walk_chain(doc, &d, &mut read, &mut seen, &mut held) {
-            return Some(s);
+    while let Some(o) = held.pop() {
+        let dicts: Vec<&Dict> = match &*o {
+            Object::Dict(d) => vec![d],
+            Object::Array(list) => {
+                // An array read is work too, with its entries: a chain of arrays alone must
+                // still reach the limit.
+                read = read.saturating_add(1 + list.len().min(MAX_ACTION_CHAIN));
+                if read > MAX_ACTION_CHAIN {
+                    return Some("too deeply chained".into());
+                }
+                // More than the chain limit can't be read anyway.
+                hold_referenced(doc, list, &mut seen, &mut held);
+                list.iter().filter_map(Object::as_dict).take(MAX_ACTION_CHAIN).collect()
+            }
+            _ => continue,
+        };
+        for d in dicts {
+            if let Some(s) = walk_chain(doc, d, &mut read, &mut seen, &mut held) {
+                return Some(s);
+            }
         }
     }
     None
 }
 
-/// [`chain_forbidden`] for the actions reachable from `a` through direct `/Next` entries. The
-/// actions of each indirect `/Next` array (each read once) go to `held`.
-fn walk_chain(doc: &Document, a: &Dict, read: &mut usize, seen: &mut std::collections::HashSet<ObjRef>, held: &mut Vec<Dict>) -> Option<String> {
+/// Queue the objects the references in a `/Next` array name, each once.
+fn hold_referenced(doc: &Document, list: &[Object], seen: &mut std::collections::HashSet<ObjRef>, held: &mut Vec<std::sync::Arc<Object>>) {
+    for r in list.iter().filter_map(Object::as_ref).take(MAX_ACTION_CHAIN) {
+        if seen.insert(r) {
+            // Resolved through any alias: a reference to a reference names its object's value.
+            held.push(doc.resolve(&Object::Ref(r)));
+        }
+    }
+}
+
+/// [`chain_forbidden`] for the actions reachable from `a` through direct `/Next` entries. What
+/// an indirect `/Next`, or a reference inside a `/Next` array, names goes to `held`.
+fn walk_chain(
+    doc: &Document,
+    a: &Dict,
+    read: &mut usize,
+    seen: &mut std::collections::HashSet<ObjRef>,
+    held: &mut Vec<std::sync::Arc<Object>>,
+) -> Option<String> {
     let mut stack = vec![a];
     while let Some(d) = stack.pop() {
         *read += 1;
@@ -1226,13 +1324,16 @@ fn walk_chain(doc: &Document, a: &Dict, read: &mut usize, seen: &mut std::collec
         }
         match d.get(b"Next") {
             Some(Object::Dict(next)) => stack.push(next),
-            Some(Object::Array(list)) => stack.extend(list.iter().filter_map(Object::as_dict)),
-            Some(Object::Ref(r)) if seen.insert(*r) => {
-                if let Object::Array(list) = &*doc.get(*r) {
-                    // More than the chain limit can't be read anyway.
-                    held.extend(list.iter().filter_map(Object::as_dict).take(MAX_ACTION_CHAIN).cloned());
+            Some(Object::Array(list)) => {
+                *read = read.saturating_add(list.len().min(MAX_ACTION_CHAIN));
+                // A wide array is refused before any of it is queued.
+                if *read > MAX_ACTION_CHAIN {
+                    return Some("too deeply chained".into());
                 }
+                hold_referenced(doc, list, seen, held);
+                stack.extend(list.iter().filter_map(Object::as_dict));
             }
+            Some(Object::Ref(r)) if seen.insert(*r) => held.push(doc.resolve(&Object::Ref(*r))),
             _ => {}
         }
     }
@@ -1275,6 +1376,26 @@ fn strip_actions(doc: &Document, d: &mut Dict) -> bool {
     changed
 }
 
+/// Take the annotations `gone` off every page that lists them, each page's list rewritten once, and
+/// replace their indirect objects with `Null`.
+fn remove_from_pages(doc: &mut Document, gone: &std::collections::HashSet<ObjRef>) -> Result<(), pdfcraft_cos::CosError> {
+    if gone.is_empty() {
+        return Ok(());
+    }
+    for p in pdfcraft_model::pages(doc) {
+        let annots = p.dict.get(b"Annots").map(|a| doc.resolve(a)).and_then(|a| a.as_array().cloned()).unwrap_or_default();
+        let listed = |a: &Object| a.as_ref().is_some_and(|r| gone.contains(&r));
+        if annots.iter().any(listed) {
+            let kept: Vec<Object> = annots.into_iter().filter(|a| !listed(a)).collect();
+            doc.update_dict(p.obj, |pd| pd.set(b"Annots".to_vec(), Object::Array(kept)))?;
+        }
+    }
+    for r in gone {
+        doc.set(*r, Object::Null);
+    }
+    Ok(())
+}
+
 /// Collects every indirect annotation reference listed in any page's `/Annots` array.
 fn page_annot_refs(doc: &Document) -> std::collections::HashSet<ObjRef> {
     let mut refs = std::collections::HashSet::new();
@@ -1288,19 +1409,6 @@ fn page_annot_refs(doc: &Document) -> std::collections::HashSet<ObjRef> {
     refs
 }
 
-/// Removes annotation `r` from every page's `/Annots` list and replaces its indirect object with `Null`.
-fn remove_annot_from_pages(doc: &mut Document, r: ObjRef) -> Result<(), pdfcraft_cos::CosError> {
-    for p in pdfcraft_model::pages(doc) {
-        let annots = p.dict.get(b"Annots").map(|a| doc.resolve(a)).and_then(|a| a.as_array().cloned()).unwrap_or_default();
-        if annots.iter().any(|a| a.as_ref() == Some(r)) {
-            let kept: Vec<Object> = annots.into_iter().filter(|a| a.as_ref() != Some(r)).collect();
-            doc.update_dict(p.obj, |pd| pd.set(b"Annots".to_vec(), Object::Array(kept)))?;
-        }
-    }
-    doc.set(r, Object::Null);
-    Ok(())
-}
-
 fn fix_annot_or_field(doc: &Document, nd: &mut Dict, is_annot: bool, sub: Option<&[u8]>, actions: &mut usize, flags: &mut usize) -> bool {
     let mut changed = strip_actions(doc, nd);
     *actions += changed as usize;
@@ -1397,8 +1505,10 @@ pub fn convert(doc: &mut Document, level: Level) -> Result<Report, pdfcraft_cos:
         fixed.push("Cleared NeedAppearances".into());
     }
     // An sRGB output intent describes RGB and gray content only: a document with CMYK content
-    // needs a CMYK output condition, which only the user can choose (#667).
-    if !has_pdfa_intent(doc) && !uses_device_colour(doc, &objects(doc)).cmyk {
+    // needs a CMYK output condition, which only the user can choose (#667). Content that could
+    // not all be read may hold CMYK too, so it gets none either.
+    let colour = uses_device_colour(doc, &objects(doc));
+    if !has_pdfa_intent(doc) && !colour.cmyk && !colour.incomplete {
         let mut icc = Dict::new();
         icc.set(b"N".to_vec(), Object::Int(3));
         let profile = doc.add(Object::Stream(Stream::flate(icc, &icc::srgb())));
@@ -1432,13 +1542,18 @@ pub fn convert(doc: &mut Document, level: Level) -> Result<Report, pdfcraft_cos:
         actions += changed as usize;
         convert_direct_page_annots(doc, &p, &mut actions, &mut flags, &mut removed)?;
     }
+    let mut forbidden_annots = std::collections::HashSet::new();
     for (r, o) in objects(doc) {
         let Some(d) = dict_of(&o).cloned() else { continue };
         let ty = d.name(b"Type").map(<[u8]>::to_vec);
         let sub = d.name(b"Subtype").map(<[u8]>::to_vec);
-        let is_annot = matches!(&*o, Object::Dict(_)) && is_annotation(doc, &d, ty.as_deref(), sub.as_deref(), page_annots.contains(&r));
+        let is_annot = matches!(&*o, Object::Dict(_))
+            // A widget is an annotation whether or not it says `/Type /Annot` (the form reader
+            // finds it by its field), so its actions go the same way.
+            && (is_annotation(doc, &d, ty.as_deref(), sub.as_deref(), page_annots.contains(&r)) || sub.as_deref() == Some(b"Widget"));
         if is_annot && sub.as_deref().is_some_and(|s| FORBIDDEN_ANNOTS.contains(&s)) {
-            remove_annot_from_pages(doc, r)?;
+            // Taken off its page below, all of them in one pass over the pages.
+            forbidden_annots.insert(r);
             removed += 1;
             continue;
         }
@@ -1473,6 +1588,7 @@ pub fn convert(doc: &mut Document, level: Level) -> Result<Report, pdfcraft_cos:
             files += 1;
         }
     }
+    remove_from_pages(doc, &forbidden_annots)?;
     // Forbidden actions left as objects of their own, or chained to by one, and those written
     // directly in an /A elsewhere (an outline item's, say).
     for (r, o) in objects(doc) {
diff --git a/crates/preflight/src/tests.rs b/crates/preflight/src/tests.rs
index fca88769e0..1ed98b9316 100644
--- a/crates/preflight/src/tests.rs
+++ b/crates/preflight/src/tests.rs
@@ -452,6 +452,20 @@ fn forbidden_actions_chained_behind_allowed_ones_are_found_and_removed() {
         build(&["<< /Type /Catalog /Pages 2 0 R >>", pages, page, &link(&format!("<< /S /GoTo /D [3 0 R /Fit] /Next {js} >>"))], ""),
         // `/Next` refers to an array that holds the action directly.
         build(&["<< /Type /Catalog /Pages 2 0 R >>", pages, page, &link("<< /S /GoTo /D [3 0 R /Fit] /Next 5 0 R >>"), &format!("[{js}]")], ""),
+        // `/Next` refers to the action itself, which carries `/P` and `/K` as a structure
+        // element would: those keys must not exempt it.
+        build(
+            &[
+                "<< /Type /Catalog /Pages 2 0 R >>",
+                pages,
+                page,
+                &link("<< /S /GoTo /D [3 0 R /Fit] /Next 5 0 R >>"),
+                "<< /S /JavaScript /JS (app.alert(1)) /P 3 0 R /K 0 >>",
+            ],
+            "",
+        ),
+        // A `/Next` array refers to the action.
+        build(&["<< /Type /Catalog /Pages 2 0 R >>", pages, page, &link("<< /S /GoTo /D [3 0 R /Fit] /Next [5 0 R] >>"), js], ""),
     ];
     for (i, mut doc) in cases.into_iter().enumerate() {
         let found = messages(&verify(&doc, Level::A2b)).contains(&"A JavaScript action isn't allowed");
@@ -495,6 +509,116 @@ fn an_output_intent_profile_header_is_read_within_a_size_cap() {
     }
 }
 
+/// A widget the form reader finds by its field is an annotation whether or not it writes
+/// `/Type /Annot`: conversion takes its additional actions off all the same.
+#[test]
+fn a_widget_without_a_type_loses_its_additional_actions() {
+    let pages = "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 200] >>";
+    let page = "<< /Type /Page /Parent 2 0 R /Annots [4 0 R] >>";
+    let widget = "<< /Subtype /Widget /Rect [0 0 10 10] /F 4 /T (f) /AA << /K << /S /JavaScript /JS (1) >> >> >>";
+    let mut doc = build(&["<< /Type /Catalog /Pages 2 0 R >>", pages, page, widget], "");
+    convert(&mut doc, Level::A2b).unwrap();
+    let w = doc.get(pdfcraft_cos::ObjRef::new(4, 0));
+    assert!(w.as_dict().is_some_and(|d| d.get(b"AA").is_none()), "{w:?}");
+}
+
+/// Forbidden annotations on one page are taken off it in one pass, all of them.
+#[test]
+fn forbidden_annotations_leave_their_page_together() {
+    let n = 300;
+    let annots: Vec<String> = (0..n).map(|i| format!("{} 0 R", i + 4)).collect();
+    let page = format!("<< /Type /Page /Parent 2 0 R /Annots [{} 2 0 R] >>", annots.join(" "));
+    let mut objs =
+        vec!["<< /Type /Catalog /Pages 2 0 R >>".to_string(), "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 200] >>".into(), page];
+    objs.extend((0..n).map(|_| "<< /Type /Annot /Subtype /Sound /Rect [0 0 0 0] /P 3 0 R >>".to_string()));
+    let refs: Vec<&str> = objs.iter().map(String::as_str).collect();
+    let mut doc = build(&refs, "");
+    let r = convert(&mut doc, Level::A2b).unwrap();
+    assert!(r.fixed.iter().any(|f| f.starts_with(&format!("{n}: removed multimedia"))), "{:?}", r.fixed);
+    let left = pdfcraft_model::pages(&doc)[0].dict.get(b"Annots").and_then(|a| doc.resolve(a).as_array().map(Vec::len));
+    assert_eq!(left, Some(1));
+}
+
+/// Content that can't be read may draw in DeviceCMYK: convert then adds no sRGB output intent.
+#[test]
+fn convert_adds_no_srgb_intent_when_colour_could_not_all_be_read() {
+    let mut doc = build(
+        &[
+            "<< /Type /Catalog /Pages 2 0 R >>",
+            "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 200] >>",
+            "<< /Type /Page /Parent 2 0 R /Contents 4 0 R /Resources << >> >>",
+            // A /Filter that isn't a name can't be decoded: the content isn't read.
+            "<< /Length 9 /Filter 5 >>\nstream\nnot flate\nendstream",
+        ],
+        "",
+    );
+    convert(&mut doc, Level::A2b).unwrap();
+    assert!(declared(&doc).output_intents.is_empty());
+}
+
+/// A `/Next` chain of arrays alone (each array naming the next) still reaches the chain limit,
+/// so the walk's work is bounded however the arrays are linked.
+#[test]
+fn an_array_only_next_chain_is_too_deeply_chained() {
+    let mut doc = Document::new_empty();
+    let mut next = Object::Array(Vec::new());
+    for _ in 0..2 * MAX_ACTION_CHAIN {
+        next = Object::Array(vec![Object::Ref(doc.add(next))]);
+    }
+    let mut action = Dict::new();
+    action.set(b"S".to_vec(), Object::name("URI"));
+    action.set(b"Next".to_vec(), Object::Ref(doc.add(next)));
+    assert_eq!(chain_forbidden(&doc, &action).as_deref(), Some("too deeply chained"));
+    // A short chain of arrays is read through.
+    let mut short = Object::Array(Vec::new());
+    for _ in 0..10 {
+        short = Object::Array(vec![Object::Ref(doc.add(short))]);
+    }
+    action.set(b"Next".to_vec(), Object::Ref(doc.add(short)));
+    assert_eq!(chain_forbidden(&doc, &action), None);
+}
+
+/// A direct `/Next` array wider than the chain limit is refused as soon as it is charged, and a
+/// `/Next` that reaches its array through a reference alias is read through it.
+#[test]
+fn a_wide_direct_next_array_is_refused_and_an_alias_is_followed() {
+    let uri = || {
+        let mut d = Dict::new();
+        d.set(b"S".to_vec(), Object::name("URI"));
+        d
+    };
+    let mut action = uri();
+    action.set(b"Next".to_vec(), Object::Array((0..=MAX_ACTION_CHAIN).map(|_| Object::Dict(uri())).collect()));
+    let doc = Document::new_empty();
+    assert_eq!(chain_forbidden(&doc, &action).as_deref(), Some("too deeply chained"));
+    // `/Next` -> 1 0 R -> 2 0 R -> [ << /S /JavaScript >> ]
+    let mut doc = Document::new_empty();
+    let mut js = Dict::new();
+    js.set(b"S".to_vec(), Object::name("JavaScript"));
+    let list = doc.add(Object::Array(vec![Object::Dict(js)]));
+    let alias = doc.add(Object::Ref(list));
+    let mut action = uri();
+    action.set(b"Next".to_vec(), Object::Ref(alias));
+    assert_eq!(chain_forbidden(&doc, &action).as_deref(), Some("JavaScript"));
+}
+
+/// Every distinct output intent is declared, past eight; an identifier longer than any real one
+/// keeps its start.
+#[test]
+fn every_output_intent_is_declared_with_its_identifier_cut_to_the_bound() {
+    let long = "x".repeat(4 * MAX_IDENTIFIER_BYTES);
+    let intents: Vec<String> = (0..9)
+        .map(|i| {
+            format!("<< /Type /OutputIntent /S /GTS_PDFA1 /OutputConditionIdentifier ({}) >>", if i == 8 { long.clone() } else { format!("c{i}") })
+        })
+        .collect();
+    let catalog = format!("<< /Type /Catalog /Pages 2 0 R /OutputIntents [{}] >>", intents.join(" "));
+    let doc = build(&[catalog.as_str(), "<< /Type /Pages /Kids [] /Count 0 >>"], "");
+    let d = declared(&doc);
+    assert_eq!(d.output_intents.len(), 9);
+    assert_eq!(d.output_intents[8].len(), MAX_IDENTIFIER_BYTES);
+}
+
 #[test]
 fn typeless_annotations_indexed_cmyk_and_indirect_filter_elements_are_handled() {
     // Annotations in /Annots that omit optional /Type /Annot and /P (while keeping required /Subtype
diff --git a/crates/preflight/src/transparency.rs b/crates/preflight/src/transparency.rs
index ad2fe97c0b..16d49c3eb0 100644
--- a/crates/preflight/src/transparency.rs
+++ b/crates/preflight/src/transparency.rs
@@ -35,6 +35,10 @@ const MAX_SHARED: usize = 1 << 16;
 pub(crate) struct Painting {
     /// Something paints transparently.
     pub(crate) transparency: bool,
+    /// Something paints with a soft mask, a constant alpha below 1 or a blend mode: what
+    /// `transparency` holds except a transparency group, which on its own paints opaque content
+    /// as it would be painted without it ([`crate::page_uses_transparency`]).
+    pub(crate) paints_transparently: bool,
     /// The blend modes graphics states name that ISO 32000-1 doesn't define.
     pub(crate) unknown_blend_modes: Vec<String>,
 }
@@ -42,6 +46,7 @@ pub(crate) struct Painting {
 impl Painting {
     fn add(&mut self, other: &Painting) {
         self.transparency |= other.transparency;
+        self.paints_transparently |= other.paints_transparently;
         for name in &other.unknown_blend_modes {
             self.add_blend_mode(name);
         }
@@ -297,7 +302,9 @@ impl Walk<'_> {
         // A soft mask is a dictionary; `/None`, null or anything else is none (ISO 32000-1 Table 58).
         let smask = g.get(b"SMask").map(|m| held(doc, m));
         let mask = smask.as_deref().is_some_and(|m| matches!(m, Object::Dict(_)));
-        self.found.transparency |= below_one(b"CA") || below_one(b"ca") || blend || mask;
+        let paints = below_one(b"CA") || below_one(b"ca") || blend || mask;
+        self.found.transparency |= paints;
+        self.found.paints_transparently |= paints;
         if let Some(bm) = bm.as_deref() {
             unknown_blend_modes(doc, bm, &mut self.found);
         }
@@ -319,6 +326,7 @@ impl Walk<'_> {
             let soft_mask = d.get(b"SMask").is_some_and(|m| matches!(&*held(doc, m), Object::Stream(_)));
             let in_data = d.get(b"SMaskInData").and_then(|v| held(doc, v).as_int()).is_some_and(|v| v > 0);
             self.found.transparency |= soft_mask || in_data;
+            self.found.paints_transparently |= soft_mask || in_data;
             return;
         }
         let group = d
@@ -523,4 +531,27 @@ mod tests {
         assert!(!page_names_blending_space(&doc, &pages[2].dict));
         assert!(!page_names_blending_space(&doc, &pages[3].dict));
     }
+
+    #[test]
+    fn a_transparency_group_alone_does_not_paint_transparently() {
+        let doc = build(&[
+            "<< /Type /Catalog /Pages 2 0 R >>",
+            "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 200] >>",
+            "<< /Type /Page /Parent 2 0 R /Resources << /XObject << /Fm 4 0 R >> >> >>",
+            "<< /Type /XObject /Subtype /Form /BBox [0 0 10 10] /Group << /S /Transparency >> /Length 0 >>\nstream\n\nendstream",
+        ]);
+        let page = &pdfcraft_model::pages(&doc)[0];
+        assert!(page_painting(&doc, &page.dict, &mut Shared::default()).transparency);
+        assert!(!crate::page_uses_transparency(&doc, &page.dict));
+
+        // The same group with a constant alpha below 1 inside it.
+        let doc = build(&[
+            "<< /Type /Catalog /Pages 2 0 R >>",
+            "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 200] >>",
+            "<< /Type /Page /Parent 2 0 R /Resources << /XObject << /Fm 4 0 R >> >> >>",
+            "<< /Type /XObject /Subtype /Form /BBox [0 0 10 10] /Group << /S /Transparency >> /Resources << /ExtGState << /G << /ca 0.5 >> >> >> /Length 0 >>\nstream\n\nendstream",
+        ]);
+        let page = &pdfcraft_model::pages(&doc)[0];
+        assert!(crate::page_uses_transparency(&doc, &page.dict));
+    }
 }
diff --git a/crates/print/src/spool.rs b/crates/print/src/spool.rs
index 73a267daa5..598a9a8ce6 100644
--- a/crates/print/src/spool.rs
+++ b/crates/print/src/spool.rs
@@ -89,6 +89,26 @@ pub fn printer_queues() -> Vec<Printer> {
     craft_print::printer_queues()
 }
 
+/// Whether `printer`'s driver renders XPS itself (Windows: v4 drivers, and v3 drivers with an XPS
+/// rendering filter); `Some(false)` for a GDI driver, `None` when it can't be read, on a Windows
+/// installation without the print DLLs, and on other systems. See [`gdi_driver`].
+pub fn xps_driver(printer: &str) -> Option<bool> {
+    if missing_print_dll().is_some() {
+        return None;
+    }
+    #[cfg(windows)]
+    let _provider = print_ticket_provider();
+    craft_print::xps_driver(printer)
+}
+
+/// Whether `printer`'s driver is a GDI (v3) one, which the XPS print API reaches through Windows'
+/// XPS-to-GDI conversion: a page with transparency prints there with halos, as black boxes or not
+/// at all (#5838, #5940, #6155), so the copy for it has its transparent sheets flattened first
+/// (`pdfcraft_engine::spooler::spooler_copy`). False when that can't be told.
+pub fn gdi_driver(printer: &str) -> bool {
+    xps_driver(printer) == Some(false)
+}
+
 /// Whether `printer`'s driver takes two-sided settings, read for that one printer; it can wait
 /// on the device, so call it off the UI thread. Unknown on a Windows installation without the
 /// print DLLs: reading it goes through them.
@@ -194,6 +214,35 @@ pub(crate) fn output_within(command: &mut std::process::Command, limit: std::tim
     }
 }
 
+/// The queue of a CUPS destination (`queue` or `queue/instance`); `None` when either part is not
+/// a plain name. Neither part is a path: dot components, backslashes and any further separator
+/// are refused before I/O. A leading `-` is refused too: `lpoptions` parses its argv with getopt,
+/// so `-p -E -l` would read `-E` as an option rather than as the destination, and `--` cannot
+/// help because it ends option parsing before the `-p` that names the queue.
+#[cfg(all(unix, not(target_arch = "wasm32")))]
+fn queue_of(printer: &str) -> Option<&str> {
+    let (queue, instance) = printer.split_once('/').map_or((printer, None), |(q, i)| (q, Some(i)));
+    let valid = |name: &str| {
+        !name.is_empty()
+            && name.len() <= 64
+            && !name.starts_with('-')
+            && !matches!(name, "." | "..")
+            && name.bytes().all(|b| b.is_ascii_graphic() && !matches!(b, b'/' | b'\\' | b':' | b'=' | b'"'))
+    };
+    (valid(queue) && instance.is_none_or(valid)).then_some(queue)
+}
+
+/// The queue's PPD in `ppd_dir`, at most 16 MiB of it; `None` when the queue has none.
+#[cfg(all(unix, not(target_arch = "wasm32")))]
+fn read_ppd(ppd_dir: &std::path::Path, queue: &str) -> Option<Vec<u8>> {
+    use std::io::Read as _;
+    const PPD_CAP: u64 = 16 << 20;
+    let file = std::fs::File::open(ppd_dir.join(format!("{queue}.ppd"))).ok()?;
+    let mut bytes = Vec::new();
+    file.take(PPD_CAP).read_to_end(&mut bytes).ok()?;
+    Some(bytes)
+}
+
 /// Read a destination's options with the PPD directory and command supplied, so tests need
 /// neither a system queue nor a physical printer. CUPS instances share their queue's PPD but
 /// have their own defaults, queried with the complete `queue/instance` destination. `limit` is
@@ -206,28 +255,8 @@ pub(crate) fn printer_options_via_within(
     limit: std::time::Duration,
     lang: &str,
 ) -> Vec<PrinterOption> {
-    let (queue, instance) = printer.split_once('/').map_or((printer, None), |(q, i)| (q, Some(i)));
-    // Retain the conservative name checks, applied to each component. Neither component is
-    // a path: reject dot components, backslashes and any additional separator before I/O. A
-    // leading `-` is refused too: `lpoptions` parses its argv with getopt, so `-p -E -l` would
-    // read `-E` as an option rather than as the destination, and `--` cannot help because it
-    // ends option parsing before the `-p` that names the queue.
-    let valid = |name: &str| {
-        !name.is_empty()
-            && name.len() <= 64
-            && !name.starts_with('-')
-            && !matches!(name, "." | "..")
-            && name.bytes().all(|b| b.is_ascii_graphic() && !matches!(b, b'/' | b'\\' | b':' | b'=' | b'"'))
-    };
-    if !valid(queue) || instance.is_some_and(|name| !valid(name)) {
-        return Vec::new();
-    }
-    const PPD_CAP: u64 = 16 << 20;
-    let ppd = std::fs::File::open(ppd_dir.join(format!("{queue}.ppd"))).ok().and_then(|f| {
-        use std::io::Read as _;
-        let mut bytes = Vec::new();
-        f.take(PPD_CAP).read_to_end(&mut bytes).ok().map(|_| bytes)
-    });
+    let Some(queue) = queue_of(printer) else { return Vec::new() };
+    let ppd = read_ppd(ppd_dir, queue);
     let mut options = ppd.as_deref().map(|b| parse_ppd(&ppd_text(b))).unwrap_or_default();
     let lpoptions_out = output_within(lpoptions.args(["-p", printer, "-l"]), limit).ok();
     let current = lpoptions_out.as_deref().map(|out| parse_lpoptions(&String::from_utf8_lossy(out))).unwrap_or_default();
@@ -390,6 +419,8 @@ pub(crate) fn with_job_info(job: &Job, owner: Option<&str>) -> Job {
 
 /// The job as the system spooler takes it.
 fn spooled(job: &Job) -> Job {
+    #[cfg(all(unix, not(target_arch = "wasm32")))]
+    let job = &with_ppd_media(job, |printer| ppd_papers_in(printer, std::path::Path::new("/etc/cups/ppd")));
     #[cfg(target_os = "macos")]
     {
         with_job_info(job, std::env::var("USER").ok().as_deref())
@@ -492,10 +523,206 @@ fn printer_papers_internal(printer: &str) -> Vec<Paper> {
     papers
 }
 
-/// The paper sizes supported by `printer` (fallback for non-Windows platforms).
+/// The paper sizes supported by `printer` on CUPS: its PPD's (see [`cups_paper_info`]); none on
+/// the web.
 #[cfg(not(windows))]
-pub fn printer_papers(_printer: &str) -> Vec<Paper> {
-    Vec::new()
+pub fn printer_papers(printer: &str) -> Vec<Paper> {
+    cups_paper_info(printer).0
+}
+
+/// CUPS: the papers of the queue's PPD, each named by the driver's label, and its
+/// `*DefaultPageSize` one (the stock a label printer is set up for, an office printer's tray
+/// paper); none for a queue without a PPD and on the web. A job on one of them is fed it under
+/// the PPD's own keyword ([`with_ppd_media`]).
+#[cfg(not(windows))]
+fn cups_paper_info(printer: &str) -> (Vec<Paper>, Option<Paper>) {
+    #[cfg(all(unix, not(target_arch = "wasm32")))]
+    {
+        cups_paper_info_in(printer, std::path::Path::new("/etc/cups/ppd"))
+    }
+    #[cfg(not(all(unix, not(target_arch = "wasm32"))))]
+    {
+        let _ = printer;
+        (Vec::new(), None)
+    }
+}
+
+/// [`cups_paper_info`] with the PPD directory supplied, so tests need no system queue.
+#[cfg(all(unix, not(target_arch = "wasm32")))]
+pub(crate) fn cups_paper_info_in(printer: &str, ppd_dir: &std::path::Path) -> (Vec<Paper>, Option<Paper>) {
+    let papers = ppd_papers_in(printer, ppd_dir);
+    let default = papers.iter().find(|p| p.default).map(|p| (p.label.clone(), p.size));
+    (papers.into_iter().map(|p| (p.label, p.size)).collect(), default)
+}
+
+/// A paper of a PPD: one `*PaperDimension` entry.
+#[cfg(any(test, all(unix, not(target_arch = "wasm32"))))]
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct PpdPaper {
+    /// The driver's keyword for it (`Letter`, `w288h432`), which a job's `media` names.
+    pub key: String,
+    /// What the driver calls it (`US Letter`); the keyword when it gives no name.
+    pub label: String,
+    /// Width and height in points as the driver feeds it: a label's width is across the feed,
+    /// so a 2.25 × 1.25 in label and a 1.25 × 2.25 in one are different stock.
+    pub size: (f64, f64),
+    /// Whether it is the PPD's `*DefaultPageSize`.
+    pub default: bool,
+}
+
+/// The papers of the queue's PPD in `ppd_dir`; none when the destination is not a plain name or
+/// its queue has no PPD.
+#[cfg(all(unix, not(target_arch = "wasm32")))]
+fn ppd_papers_in(printer: &str, ppd_dir: &std::path::Path) -> Vec<PpdPaper> {
+    queue_of(printer).and_then(|queue| read_ppd(ppd_dir, queue)).map(|ppd| parse_ppd_papers(&ppd_text(&ppd))).unwrap_or_default()
+}
+
+/// The largest side a PPD paper may have, in points: PDF's own page limit (200 inches).
+#[cfg(any(test, all(unix, not(target_arch = "wasm32"))))]
+const MAX_PAPER_SIDE: f64 = 14_400.0;
+/// How many papers a PPD may list (PPDs are text files from the printer vendor).
+#[cfg(any(test, all(unix, not(target_arch = "wasm32"))))]
+const MAX_PAPERS: usize = 400;
+
+/// The paper sizes a PPD offers: its `*PaperDimension key/label: "width height"` entries in
+/// file order and as written, each named by its own label, else its `*PageSize` label, else the
+/// keyword, the `*DefaultPageSize` one marked as the default. Custom-size placeholders,
+/// translations (`*fr.PaperDimension`), repeated keywords, keywords that could not be passed as
+/// a CUPS option value, and sizes outside 1 pt to 200 in are left out. Lenient: malformed lines
+/// are skipped.
+#[cfg(any(test, all(unix, not(target_arch = "wasm32"))))]
+pub(crate) fn parse_ppd_papers(ppd: &str) -> Vec<PpdPaper> {
+    // A keyword goes to `lp -o media=<keyword>`: no space, quote, separator or `=`.
+    let keyword = |s: &str| {
+        !s.is_empty() && s.len() <= 64 && s.bytes().all(|b| b.is_ascii_graphic() && !matches!(b, b'/' | b':' | b'=' | b'"' | b'\'' | b'\\' | b','))
+    };
+    // `*Prefix key/label: value` → (key, label, value), the label falling back to the key.
+    let entry = |line: &str, prefix: &str| -> Option<(String, String, String)> {
+        let (head, value) = line.trim_end_matches('\r').strip_prefix(prefix)?.split_once(':')?;
+        let head = head.trim();
+        let (key, label) = match head.split_once('/') {
+            Some((k, l)) if !l.trim().is_empty() => (k.trim(), l.trim()),
+            Some((k, _)) => (k.trim(), k.trim()),
+            None => (head, head),
+        };
+        keyword(key).then(|| (key.to_string(), label.to_string(), value.trim().to_string()))
+    };
+    let mut names: std::collections::BTreeMap<String, String> = Default::default();
+    for line in ppd.lines() {
+        if let Some((key, label, _)) = entry(line, "*PageSize ")
+            && label != key
+        {
+            names.entry(key).or_insert(label);
+        }
+    }
+    let default_key = ppd
+        .lines()
+        .find_map(|line| line.trim_end_matches('\r').strip_prefix("*DefaultPageSize:").map(str::trim))
+        .filter(|k| keyword(k))
+        .map(str::to_string);
+    let fits = |v: f64| v.is_finite() && (1.0..=MAX_PAPER_SIDE).contains(&v);
+    let mut out: Vec<PpdPaper> = Vec::new();
+    for line in ppd.lines() {
+        if out.len() >= MAX_PAPERS {
+            break;
+        }
+        let Some((key, label, value)) = entry(line, "*PaperDimension ") else { continue };
+        if key.starts_with("Custom") || out.iter().any(|p| p.key == key) {
+            continue;
+        }
+        let mut sides = value.trim_matches('"').split_whitespace().map(|v| v.parse::<f64>().ok());
+        let (Some(Some(w)), Some(Some(h))) = (sides.next(), sides.next()) else { continue };
+        if !fits(w) || !fits(h) {
+            continue;
+        }
+        let label = if label == key { names.get(&key).cloned().unwrap_or(label) } else { label };
+        let default = default_key.as_deref() == Some(key.as_str());
+        out.push(PpdPaper { key, label, size: (w, h), default });
+    }
+    out
+}
+
+/// The paper of `papers` of this size, within half a point a side: the one fed that way round
+/// first (a label's width is its width across the feed), else the one fed the other way round.
+#[cfg(any(test, all(unix, not(target_arch = "wasm32"))))]
+pub(crate) fn ppd_paper_of_size(papers: &[PpdPaper], (w, h): (f64, f64)) -> Option<&PpdPaper> {
+    let same = |p: &&PpdPaper, (w, h): (f64, f64)| (p.size.0 - w).abs() <= 0.5 && (p.size.1 - h).abs() <= 0.5;
+    papers.iter().find(|p| same(p, (w, h))).or_else(|| papers.iter().find(|p| same(p, (h, w))))
+}
+
+/// How far a side of a PPD paper may be from a standard name's nominal size and still be that
+/// paper: Adobe's 5 points, which CUPS also uses to find the PPD size for a media name. A driver
+/// may measure a stock in millimetres (a "4 × 6 in" label of 102 × 152 mm is 1.1 pt off), and
+/// neighbouring label sizes differ by more.
+#[cfg(any(test, all(unix, not(target_arch = "wasm32"))))]
+const NOMINAL_SIZE_EPSILON: f64 = 5.0;
+
+/// The paper of `papers` nearest a nominal size, within [`NOMINAL_SIZE_EPSILON`] a side, fed
+/// either way round; on a tie the one fed that way round, then the first.
+#[cfg(any(test, all(unix, not(target_arch = "wasm32"))))]
+pub(crate) fn ppd_paper_near_size(papers: &[PpdPaper], (w, h): (f64, f64)) -> Option<&PpdPaper> {
+    let off = |p: &PpdPaper, (w, h): (f64, f64)| {
+        let (dw, dh) = ((p.size.0 - w).abs(), (p.size.1 - h).abs());
+        (dw <= NOMINAL_SIZE_EPSILON && dh <= NOMINAL_SIZE_EPSILON).then_some(dw + dh)
+    };
+    let fed_as_is = papers.iter().filter_map(|p| Some((off(p, (w, h))?, 0, p)));
+    let turned = papers.iter().filter_map(|p| Some((off(p, (h, w))?, 1, p)));
+    fed_as_is.chain(turned).min_by(|a, b| a.0.total_cmp(&b.0).then(a.1.cmp(&b.1))).map(|(_, _, p)| p)
+}
+
+/// The size in points that a standard media name stands for: one of [`crate::cups_media`]'s
+/// names, a PPD-style `w<width>h<height>` in points, or a PWG 5101.1 self-describing name
+/// (`na_index-4x6_4x6in`, `iso_a6_105x148mm`). `None` for any other name.
+#[cfg(any(test, all(unix, not(target_arch = "wasm32"))))]
+pub(crate) fn nominal_media_size(media: &str) -> Option<(f64, f64)> {
+    let sides = |s: &str, x: char, scale: f64| {
+        let (w, h) = s.split_once(x)?;
+        let (w, h) = (w.parse::<f64>().ok()? * scale, h.parse::<f64>().ok()? * scale);
+        (w.is_finite() && h.is_finite() && w > 0.0 && h > 0.0).then_some((w, h))
+    };
+    if let Some(index) = (0..crate::PAPERS.len()).find(|&i| crate::cups_media(i).is_some_and(|m| m.eq_ignore_ascii_case(media))) {
+        return crate::PAPERS.get(index).map(|(_, size)| *size);
+    }
+    if let Some(size) = media.strip_prefix('w').and_then(|s| sides(s, 'h', 1.0)) {
+        return Some(size);
+    }
+    let (class_name, dims) = media.rsplit_once('_')?;
+    if !class_name.contains('_') {
+        return None;
+    }
+    if let Some(dims) = dims.strip_suffix("in") {
+        return sides(dims, 'x', 72.0);
+    }
+    sides(dims.strip_suffix("mm")?, 'x', 72.0 / 25.4)
+}
+
+/// CUPS: the job with its `media` named by the printer's own PPD keyword when it names one of
+/// the PPD's papers by its label (as [`printer_papers`] lists them), as `Custom.<w>x<h>` points
+/// of one of their sizes ([`crate::custom_media`]), or by a standard name of one of their sizes
+/// ([`nominal_media_size`], such as the `w288h432` of PdfCraft's 4 × 6 in label). Fed under the
+/// PPD's keyword, the paper is the driver's own: a driver may take no custom sizes, and a label
+/// printer's stock is set up under its keyword. A keyword the PPD has, any other value, a job
+/// without `media` and one for the default destination go as they are.
+#[cfg(any(test, all(unix, not(target_arch = "wasm32"))))]
+pub(crate) fn with_ppd_media(job: &Job, papers: impl FnOnce(&str) -> Vec<PpdPaper>) -> Job {
+    let mut job = job.clone();
+    let Some(printer) = job.printer.clone() else { return job };
+    let Some(media) = job.options.iter_mut().rev().find(|(k, _)| k.eq_ignore_ascii_case("media")) else { return job };
+    let papers = papers(&printer);
+    if papers.iter().any(|p| p.key == media.1) {
+        return job;
+    }
+    let custom =
+        media.1.strip_prefix("Custom.").and_then(|s| s.split_once('x')).and_then(|(w, h)| Some((w.parse::<f64>().ok()?, h.parse::<f64>().ok()?)));
+    let paper = papers
+        .iter()
+        .find(|p| p.label == media.1)
+        .or_else(|| custom.and_then(|size| ppd_paper_of_size(&papers, size)))
+        .or_else(|| nominal_media_size(&media.1).and_then(|size| ppd_paper_near_size(&papers, size)));
+    if let Some(paper) = paper {
+        media.1 = paper.key.clone();
+    }
+    job
 }
 
 /// Match `paper_pts` against detected driver `papers` within a 1.0 pt tolerance.
@@ -528,7 +755,7 @@ pub fn printer_paper_info(printer: &str) -> (Vec<Paper>, Option<Paper>) {
     #[cfg(windows)]
     let papers = printer_papers_internal(printer);
     #[cfg(not(windows))]
-    let papers = printer_papers(printer);
+    let (papers, cups_default) = cups_paper_info(printer);
     #[cfg(windows)]
     let default_paper = {
         let settings = craft_print::rgb::default_settings(printer).ok();
@@ -536,10 +763,7 @@ pub fn printer_paper_info(printer: &str) -> (Vec<Paper>, Option<Paper>) {
         page.map(|p| resolve_paper_name(&papers, p.paper))
     };
     #[cfg(not(windows))]
-    let default_paper = {
-        let _ = &papers;
-        None
-    };
+    let default_paper = cups_default;
     (papers, default_paper)
 }
 
diff --git a/crates/print/src/tests.rs b/crates/print/src/tests.rs
index 98a37a98cc..057986901e 100644
--- a/crates/print/src/tests.rs
+++ b/crates/print/src/tests.rs
@@ -801,6 +801,137 @@ fn a_job_that_names_its_orientation_keeps_it() {
     }
 }
 
+/// A label printer's PPD: `*PageSize` labels, `*PaperDimension` sizes, and the lines that
+/// must not become papers (custom placeholders, repeats, translations, nonsense, malformed).
+const LABEL_PPD: &str = "*PPD-Adobe: \"4.3\"\n\
+*OpenUI *PageSize/Media Size: PickOne\n\
+*DefaultPageSize: w288h432\n\
+*PageSize Letter/US Letter: \"<</PageSize[612 792]>>setpagedevice\"\n\
+*PageSize w288h432/4 x 6 in: \"\"\n\
+*PageSize Env10/#10 Envelope: \"\"\n\
+*PageSize Wide/Wide: \"\"\n\
+*PageSize Custom.WIDTHxHEIGHT/Custom: \"\"\n\
+*fr.PageSize Letter/Lettre US: \"\"\n\
+*CloseUI: *PageSize\n\
+*PaperDimension Letter: \"612.0000 792.0000\"\r\n\
+*PaperDimension w288h432: \"288 432\"\n\
+*PaperDimension Env10/Envelope #10: \"297 684\"\n\
+*PaperDimension Wide: \"1224 792\"\n\
+*PaperDimension Custom: \"0 0\"\n\
+*PaperDimension Letter: \"1 1\"\n\
+*fr.PaperDimension Letter/Lettre: \"612 792\"\n\
+*PaperDimension Huge: \"20000 300\"\n\
+*PaperDimension Tiny: \"0.5 300\"\n\
+*PaperDimension Broken: \"abc 300\"\n\
+*PaperDimension Short: \"300\"\n\
+*PaperDimension NoColon \"1 2\"\n\
+*PaperDimension Bad/Key: \"300 300\"\n\
+*PaperDimension Two Words: \"300 300\"\n\
+*PaperDimension media=x: \"300 300\"\n\
+*PaperDimension Quo\"te: \"300 300\"\n\
+*PaperDimension a,b: \"300 300\"\n";
+
+#[test]
+fn ppd_papers_come_from_the_ppd() {
+    let papers = spool::parse_ppd_papers(LABEL_PPD);
+    let listed: Vec<(&str, &str, (f64, f64))> = papers.iter().map(|p| (p.key.as_str(), p.label.as_str(), p.size)).collect();
+    assert_eq!(
+        listed,
+        [
+            ("Letter", "US Letter", (612.0, 792.0)),
+            ("w288h432", "4 x 6 in", (288.0, 432.0)),
+            ("Env10", "Envelope #10", (297.0, 684.0)),
+            ("Wide", "Wide", (1224.0, 792.0)),
+            ("Bad", "Key", (300.0, 300.0)),
+        ],
+        "a *PageSize label names a size, its own label wins, sizes stay as the driver feeds them; placeholders, repeats, translations, impossible sizes, malformed lines and keywords that would break a CUPS option (a space, `=`, a quote, a comma) are left out"
+    );
+    assert_eq!(papers.iter().map(|p| p.default).collect::<Vec<_>>(), [false, true, false, false, false], "the *DefaultPageSize one is the default");
+    let key = |size| spool::ppd_paper_of_size(&papers, size).map(|p| p.key.as_str());
+    assert_eq!(key((432.0, 288.0)), Some("w288h432"), "the other way round too");
+    assert_eq!(key((612.4, 792.4)), Some("Letter"), "within half a point");
+    assert_eq!(key((613.0, 792.0)), None);
+    assert_eq!(key((f64::NAN, 792.0)), None);
+    // A label fed either way is different stock: the exact way round wins when both exist.
+    let labels = spool::parse_ppd_papers("*PaperDimension w90h162/1.25x2.25: \"90 162\"\n*PaperDimension w162h90/2.25x1.25: \"162 90\"\n");
+    let key = |size| spool::ppd_paper_of_size(&labels, size).map(|p| p.key.as_str());
+    assert_eq!((key((162.0, 90.0)), key((90.0, 162.0))), (Some("w162h90"), Some("w90h162")));
+    assert!(spool::parse_ppd_papers("").is_empty());
+    assert!(spool::parse_ppd_papers("*PaperDimension").is_empty());
+    let many: String = (0..500).map(|i| format!("*PaperDimension P{i}: \"100 200\"\n")).collect();
+    assert_eq!(spool::parse_ppd_papers(&many).len(), 400, "capped");
+}
+
+/// A CUPS job on one of the PPD's papers, as the Print dialog and `doc_print` name it (by its
+/// label, or as custom points of its size), is fed it under the PPD's keyword; anything else
+/// goes as it is.
+#[test]
+fn a_job_on_a_ppd_paper_names_the_ppd_keyword() {
+    let papers = |printer: &str| if printer == "Label" { spool::parse_ppd_papers(LABEL_PPD) } else { Vec::new() };
+    let media = |printer: Option<&str>, options: &[(&str, &str)]| {
+        let job = Job {
+            printer: printer.map(Into::into),
+            options: options.iter().map(|(k, v)| (k.to_string(), v.to_string())).collect(),
+            ..Job::default()
+        };
+        spool::with_ppd_media(&job, papers).options.into_iter().map(|(k, v)| format!("{k}={v}")).collect::<Vec<_>>()
+    };
+    assert_eq!(media(Some("Label"), &[("media", "Custom.288x432")]), ["media=w288h432"], "custom points of a PPD size");
+    assert_eq!(media(Some("Label"), &[("media", "Custom.432x288")]), ["media=w288h432"], "turned");
+    assert_eq!(media(Some("Label"), &[("media", "Custom.162x90")]), ["media=Custom.162x90"], "a size the PPD lacks");
+    assert_eq!(media(Some("Label"), &[("media", "Envelope #10")]), ["media=Env10"], "by label");
+    assert_eq!(media(Some("Label"), &[("media", "Wide")]), ["media=Wide"], "a keyword it has");
+    assert_eq!(media(Some("Label"), &[("media", "na_letter_8.5x11in")]), ["media=Letter"], "a PWG name of a PPD size");
+    assert_eq!(media(Some("Label"), &[("media", "iso_a4_210x297mm")]), ["media=iso_a4_210x297mm"], "a PWG name the PPD lacks");
+    assert_eq!(media(Some("Label"), &[("InputSlot", "Tray2")]), ["InputSlot=Tray2"], "no media");
+    assert_eq!(media(None, &[("media", "Custom.288x432")]), ["media=Custom.288x432"], "the default destination");
+    assert_eq!(media(Some("Office"), &[("media", "Custom.288x432")]), ["media=Custom.288x432"], "a queue without the PPD");
+    // The last `media` is the one CUPS uses, so that is the one named.
+    assert_eq!(media(Some("Label"), &[("media", "Letter"), ("MEDIA", "Custom.288x432")]), ["media=Letter", "MEDIA=w288h432"]);
+}
+
+/// A driver that measures its label stock in millimetres, under keywords of its own.
+const METRIC_LABEL_PPD: &str = "*PPD-Adobe: \"4.3\"\n\
+*PageSize 102x152/4\" x 6\": \"\"\n\
+*PageSize 57x32/57 x 32 mm: \"\"\n\
+*PageSize 58x32/58 x 32 mm: \"\"\n\
+*PaperDimension 102x152: \"289.13 430.87\"\n\
+*PaperDimension 57x32: \"161.57 90.71\"\n\
+*PaperDimension 58x32: \"164.41 90.71\"\n";
+
+#[test]
+fn a_job_on_a_standard_size_names_the_ppd_keyword_of_that_size() {
+    let media = |value: &str| {
+        let job = Job { printer: Some("Label".into()), options: vec![("media".into(), value.into())], ..Job::default() };
+        let job = spool::with_ppd_media(&job, |_| spool::parse_ppd_papers(METRIC_LABEL_PPD));
+        job.options.into_iter().map(|(_, v)| v).collect::<Vec<_>>()
+    };
+    let label = cups_media(LABEL_PAPER).unwrap_or_default();
+    assert_eq!(media(label), ["102x152"], "PdfCraft's 4 × 6 in label on the driver's 102 × 152 mm stock");
+    assert_eq!(media("na_index-4x6_4x6in"), ["102x152"], "a PWG name in inches");
+    assert_eq!(media("oe_4x6-label_4x6in"), ["102x152"]);
+    assert_eq!(media("w432h288"), ["102x152"], "turned");
+    assert_eq!(media("w162h90"), ["57x32"], "the nearest of two sizes in reach");
+    assert_eq!(media("om_small-label_57x32mm"), ["57x32"], "a PWG name in millimetres");
+    assert_eq!(media("w288h440"), ["w288h440"], "more than 5 pt off");
+    assert_eq!(media("Custom.288x432"), ["Custom.288x432"], "custom points match within half a point or not at all");
+    for name in ["w288", "wxh432", "w-288h432", "na_x_4x6", "na_x_axbin", "x_4x6in", "winfhinf"] {
+        assert_eq!(media(name), [name], "{name} names no size");
+    }
+}
+
+#[test]
+fn nominal_media_sizes() {
+    assert_eq!(spool::nominal_media_size("Letter"), Some((612.0, 792.0)));
+    assert_eq!(spool::nominal_media_size("a4"), Some((595.28, 841.89)), "cups_media's names, in any case");
+    assert_eq!(spool::nominal_media_size("w288h432"), Some((288.0, 432.0)));
+    assert_eq!(spool::nominal_media_size("na_index-4x6_4x6in"), Some((288.0, 432.0)));
+    let a6 = spool::nominal_media_size("iso_a6_105x148mm").unwrap_or_default();
+    assert!((a6.0 - 297.64).abs() < 0.01 && (a6.1 - 419.53).abs() < 0.01, "{a6:?}");
+    assert_eq!(spool::nominal_media_size("Roll80mm"), None);
+    assert_eq!(spool::nominal_media_size("w0h432"), None);
+}
+
 #[cfg(all(unix, not(target_arch = "wasm32")))]
 mod cups_options {
     use crate::spool;
@@ -917,6 +1048,25 @@ mod cups_options {
         std::fs::remove_dir_all(dir).unwrap();
     }
 
+    /// `printer_papers` and `printer_default_paper` on CUPS: the queue's PPD papers by label and
+    /// its `*DefaultPageSize`, instances sharing their queue's PPD; nothing for a queue without
+    /// one or a destination that isn't a plain name.
+    #[test]
+    fn printer_papers_are_read_from_the_queue_ppd() {
+        let dir = folder();
+        std::fs::write(dir.join("Label.ppd"), super::LABEL_PPD).unwrap();
+        for destination in ["Label", "Label/draft"] {
+            let (papers, default) = spool::cups_paper_info_in(destination, &dir);
+            let names: Vec<&str> = papers.iter().map(|(name, _)| name.as_str()).collect();
+            assert_eq!(names, ["US Letter", "4 x 6 in", "Envelope #10", "Wide", "Key"], "{destination}");
+            assert_eq!(default, Some(("4 x 6 in".to_string(), (288.0, 432.0))), "{destination}");
+        }
+        for destination in ["Missing", "../Label", "Label/a/b", "Label\\draft", "", ".", "-Label"] {
+            assert_eq!(spool::cups_paper_info_in(destination, &dir), (Vec::new(), None), "{destination:?}");
+        }
+        std::fs::remove_dir_all(dir).unwrap();
+    }
+
     #[test]
     fn invalid_destinations_are_rejected_before_running_lpoptions() {
         let dir = folder();
diff --git a/crates/redact/README.md b/crates/redact/README.md
index e47df98f17..d8f4b46e94 100644
--- a/crates/redact/README.md
+++ b/crates/redact/README.md
@@ -130,7 +130,10 @@ Text is placed with the font and size set by `Tf` or by an ExtGState's `/Font` t
 form XObject starts from the text state of the content that draws it. Content that can't be
 decoded makes the operation fail rather than leave it unredacted, and so does an inline image the
 renderer's tokenizer reads no image for (`RedactError::Unreadable`): where the page's operators
-resume after it would be a guess. A Redact annotation with neither a usable `/QuadPoints` array nor a usable
+resume after it would be a guess. So do bytes the content parser can't read, in the page's content
+or in a form under an area (a stray `)` or `}` in a `TJ` array, say): the interpreter reads past
+them, so text they hide, which other readers may draw, would be neither found nor removed. Remove
+hidden information refuses a page for both too, in whatever content it walks. A Redact annotation with neither a usable `/QuadPoints` array nor a usable
 `/Rect` makes it fail with `RedactError::UnreadableMark` before anything changes, instead of
 skipping that mark. The count covers the marks on the pages being applied.
 
diff --git a/crates/redact/src/interp.rs b/crates/redact/src/interp.rs
index 1e69cb32e2..80117f451d 100644
--- a/crates/redact/src/interp.rs
+++ b/crates/redact/src/interp.rs
@@ -143,6 +143,11 @@ pub(crate) struct Output {
     /// ([`pdfcraft_content::Parsed::ambiguous_images`]): what this scope placed after it may not
     /// be what the page shows, so a redaction must not trust it.
     pub ambiguous: bool,
+    /// The content holds bytes the parser can't read ([`pdfcraft_content::Parsed::skipped`]), in
+    /// this scope or a nested form: the walk reads past them, so text they hide (a stray `)` in a
+    /// `TJ` array, say), which other readers may still draw, is neither found nor removed, and a
+    /// rewrite would drop the bytes but keep the strings. A redaction must not trust it.
+    pub unparsed: bool,
     pub tag_changes: Vec<(ObjRef, ObjRef, HashSet<i64>, HashSet<i64>)>,
     pub error: Option<CosError>,
 }
@@ -407,6 +412,7 @@ fn process_from(doc: &mut Document, scope: &mut Scope<'_>, streams: &[Vec<u8>],
     let joined = Pieces::join(streams);
     let mut parsed = joined.parse();
     walk.out.ambiguous = parsed.ambiguous_images > 0;
+    walk.out.unparsed = parsed.skipped > 0;
     // A rewritten piece loses its comments, so keep where they began and ended: a comment that
     // ran on into the next piece still hides that piece's first line.
     let comment_edges = joined.comment_edges(&parsed);
@@ -571,7 +577,12 @@ impl Walk {
                 Some(op)
             }
             b"cs" | b"CS" => {
-                if op.name(0) != Some(b"Pattern") {
+                // A Pattern space is told by the name `/Pattern` alone: one named through the
+                // resources' `/ColorSpace` clears the pattern, which the app's renderer keeps and
+                // Poppler doesn't (`cs` resets the colour, ISO 32000-2 §8.6.8). Looking the name up
+                // at each `cs` wants a cache for the page: a `/ColorSpace` too large for the
+                // document to keep is parsed again at each read.
+                if op.last_name() != Some(b"Pattern") {
                     if o == b"cs" {
                         self.gs.fill_pattern = None;
                     } else {
@@ -598,8 +609,12 @@ impl Walk {
         let o = op.op.as_slice();
         let pts: Vec<(f64, f64)> = match o {
             b"re" => op.nums::<4>().map(|[x, y, w, h]| vec![(x, y), (x + w, y), (x, y + h), (x + w, y + h)]).unwrap_or_default(),
-            b"h" | b"W" | b"W*" => Vec::new(),
-            _ => op.operands.iter().filter_map(Object::as_f64).collect::<Vec<_>>().as_chunks::<2>().0.iter().map(|p| (p[0], p[1])).collect(),
+            // Each takes its points from the end, as the renderer reads them: a surplus before
+            // them is ignored, not read as a point.
+            b"m" | b"l" => op.nums::<2>().map(|[x, y]| vec![(x, y)]).unwrap_or_default(),
+            b"c" => op.nums::<6>().map(|[x1, y1, x2, y2, x3, y3]| vec![(x1, y1), (x2, y2), (x3, y3)]).unwrap_or_default(),
+            b"v" | b"y" => op.nums::<4>().map(|[x1, y1, x2, y2]| vec![(x1, y1), (x2, y2)]).unwrap_or_default(),
+            _ => Vec::new(),
         };
         for (x, y) in pts {
             let (u, v) = self.gs.ctm.apply(x, y);
@@ -633,9 +648,12 @@ impl Walk {
         piece.changed = true;
         scope.report.paths_removed += 1;
         if scope.covered(b) && clips {
-            // Keep the clipping, drop the painting.
-            piece.ops.extend(body);
-            piece.ops.push(Op::new("n", vec![]));
+            // Everything this clip lets through is under a mark, so an empty clip hides the same
+            // content. The original outline is confidential and must not stay in the stream.
+            for o in ["re", "W", "n"] {
+                let operands = if o == "re" { vec![num(0.0); 4] } else { vec![] };
+                piece.ops.push(Op::new(o, operands));
+            }
         }
         // Partial vector redaction must not retain underlying drawing commands
         // behind clipping (F-008). Refuse partial clip retention and remove the path.
@@ -656,10 +674,10 @@ impl Walk {
             }
             b"Tf" => self.select_font(doc, scope, op),
             _ => {
-                if let Some((font, vertical, size)) = op.name(0).and_then(|n| extgstate_font(doc, scope, &self.ext_gstates, n, &self.fallback)) {
+                if let Some((font, vertical, size)) = op.last_name().and_then(|n| extgstate_font(doc, scope, &self.ext_gstates, n, &self.fallback)) {
                     (self.gs.font, self.gs.vertical, self.gs.size) = (font, vertical, size);
                     // As for `Tf`: a Type 3 font without /Resources paints through this scope's.
-                    self.gs.type3_inherits = op.name(0).is_some_and(|n| extgstate_type3_inherits(doc, &self.ext_gstates, n));
+                    self.gs.type3_inherits = op.last_name().is_some_and(|n| extgstate_type3_inherits(doc, &self.ext_gstates, n));
                 }
             }
         }
@@ -864,7 +882,8 @@ fn clean_replacements(
             if !op.is("BDC") || !affected.contains(&op.span.start) {
                 continue;
             }
-            let property = match op.operands.get(1) {
+            // The property list is the last operand, as the renderer reads it.
+            let property = match op.back(0) {
                 Some(Object::Name(name)) => properties.get(name).map(|p| doc.resolve(p)),
                 Some(p) => Some(doc.resolve(p)),
                 None => None,
@@ -874,7 +893,7 @@ fn clean_replacements(
                 for key in [&b"ActualText"[..], b"Alt", b"E", b"T"] {
                     stripped |= dict.remove(key).is_some();
                 }
-                if stripped && let Some(property) = op.operands.get_mut(1) {
+                if stripped && let Some(property) = op.operands.last_mut() {
                     *property = Object::Dict(dict);
                     *changed = true;
                     report.replacement_text += 1;
@@ -1071,7 +1090,32 @@ fn xobject(
             }
         }
         Some(b"Form") => {
-            let m = s.dict.get(b"Matrix").and_then(|m| Matrix::from_operands(doc.resolve(m).as_array()?)).unwrap_or_default();
+            // Read as the proof reads it, entries by reference included: read as the identity, a
+            // form moved onto a mark would be tested against the wrong place and never walked.
+            let m = match crate::verify::matrix_of(doc, &s.dict) {
+                Ok(m) => m,
+                // Not six numbers given directly or through one reference. Removing hidden layers alone never asks where content lands, so
+                // the form is walked as it stands.
+                Err(()) if scope.everywhere() && scope.hidden_text.is_none() => Matrix::IDENTITY,
+                // Otherwise where the form draws, and so whether it reaches a mark or leaves the
+                // page, can't be told. Apply refuses the page, and the scans count it, as for a
+                // form past the page's budget below.
+                Err(()) => {
+                    if scope.mode == Mode::Apply {
+                        out.error = Some(CosError::Syntax {
+                            offset: 0,
+                            detail:
+                                "a form XObject's /Matrix isn't six numbers given directly or through one reference, so where it draws can't be told"
+                                    .into(),
+                        });
+                    } else if scope.everywhere() {
+                        scope.layer_blocks += 1;
+                    } else {
+                        out.residue += 1;
+                    }
+                    return None;
+                }
+            };
             let fctm = m.then(&gs.ctm);
             let bbox = s.dict.get(b"BBox").and_then(|b| {
                 let v: Vec<f64> = doc.resolve(b).as_array()?.iter().filter_map(Object::as_f64).collect();
@@ -1150,6 +1194,7 @@ fn xobject(
             out.residue += inner.residue;
             out.vertical |= inner.vertical;
             out.ambiguous |= inner.ambiguous;
+            out.unparsed |= inner.unparsed;
             out.doomed.extend_from_slice(&inner.doomed);
             out.retired_properties.extend(inner.retired_properties);
             // A Type 3 glyph without resources shown inside the form may paint with the page's
diff --git a/crates/redact/src/interp/layers.rs b/crates/redact/src/interp/layers.rs
index 88d1c4e677..7b8ef82120 100644
--- a/crates/redact/src/interp/layers.rs
+++ b/crates/redact/src/interp/layers.rs
@@ -20,7 +20,7 @@ impl<'a> Scope<'a> {
         // groups. A membership dictionary's default policy is AnyOn.
         let d = doc.resolve(o);
         let Some(d) = d.as_dict() else { return false };
-        if d.name(b"Type") != Some(b"OCMD") {
+        if !has_type(doc, d, b"OCMD") {
             return false;
         }
         let groups: Vec<ObjRef> = match d.get(b"OCGs").map(|g| (*doc.resolve(g)).clone()) {
@@ -102,7 +102,7 @@ impl<'a> Scope<'a> {
         }
         let resolved = doc.resolve(expression);
         let complete = match &*resolved {
-            Object::Dict(d) if d.name(b"Type") == Some(b"OCG") => {
+            Object::Dict(d) if has_type(doc, d, b"OCG") => {
                 if let Some(r) = reference
                     && hidden_layers.contains(&r)
                 {
@@ -144,6 +144,11 @@ impl<'a> Scope<'a> {
         }
         *budget -= 1;
         let reference = expression.as_ref();
+        // A reference to a reference is no listed group: the renderer rejects the alias, so it
+        // is not taken as visible because the object it names isn't hidden.
+        if reference.is_some_and(|r| matches!(*doc.get(r), Object::Ref(_))) {
+            return None;
+        }
         if let Some(r) = reference
             && !path.insert(r)
         {
@@ -151,7 +156,7 @@ impl<'a> Scope<'a> {
         }
         let resolved = doc.resolve(expression);
         let result = match &*resolved {
-            Object::Dict(d) if d.name(b"Type") == Some(b"OCG") => reference.map(|r| !self.hidden_layers.contains(&r)),
+            Object::Dict(d) if has_type(doc, d, b"OCG") => reference.map(|r| !self.hidden_layers.contains(&r)),
             Object::Array(items) if (2..=4097).contains(&items.len()) => {
                 let operator = match items.first() {
                     Some(Object::Name(n)) => n.as_slice(),
@@ -195,6 +200,9 @@ impl<'a> Scope<'a> {
             if self.hidden_layers.contains(&r) {
                 return true;
             }
+            if matches!(*doc.get(r), Object::Ref(_)) {
+                return true;
+            }
             if !path.insert(r) {
                 return true;
             }
@@ -202,7 +210,7 @@ impl<'a> Scope<'a> {
         let resolved = doc.resolve(expression);
         let found = match &*resolved {
             Object::Array(items) => items.iter().any(|item| self.expression_mentions_hidden(doc, item, depth + 1, path, budget)),
-            Object::Dict(d) if d.name(b"Type") == Some(b"OCG") => expression.as_ref().is_none_or(|r| self.hidden_layers.contains(&r)),
+            Object::Dict(d) if has_type(doc, d, b"OCG") => expression.as_ref().is_none_or(|r| self.hidden_layers.contains(&r)),
             Object::Dict(_) => true,
             _ => false,
         };
@@ -225,8 +233,10 @@ pub(super) fn strip_hidden_layers(doc: &Document, scope: &mut Scope<'_>, ops: Ve
         match op.op.as_slice() {
             b"BDC" | b"BMC" => {
                 let this = op.is("BDC")
-                    && op.name(0) == Some(b"OC")
-                    && match op.operands.get(1) {
+                    // The tag and the property list are the last two operands, as the renderer
+                    // reads them: `(x) /OC /MC0 BDC` is a layer's block too.
+                    && op.name_back(1) == Some(b"OC")
+                    && match op.back(0) {
                         Some(Object::Name(n)) => props.get(n).is_some_and(|o| scope.layer_hidden(doc, o)),
                         Some(o) => scope.layer_hidden(doc, o),
                         None => false,
@@ -254,3 +264,9 @@ pub(super) fn strip_hidden_layers(doc: &Document, scope: &mut Scope<'_>, ops: Ve
     }
     (out, removed)
 }
+
+/// Is this dictionary's `/Type` the given name? An indirect `/Type` is followed, as a viewer
+/// follows it: a group or membership dictionary must not escape classification through one.
+fn has_type(doc: &Document, d: &Dict, name: &[u8]) -> bool {
+    d.get(b"Type").is_some_and(|t| crate::resolve_chain(doc, t).as_name() == Some(name))
+}
diff --git a/crates/redact/src/interp/prune.rs b/crates/redact/src/interp/prune.rs
index 39089601ec..254d0c7a06 100644
--- a/crates/redact/src/interp/prune.rs
+++ b/crates/redact/src/interp/prune.rs
@@ -9,8 +9,9 @@ use super::{
 /// by a form without /Resources of its own, which draws through `xo` too. Such forms are read
 /// within `budget`, what is left of the page's allowance ([`resource_ops`]). Fails, as the cleanup
 /// of the fonts and properties these forms draw with does, when that can't be told: such a form
-/// doesn't decode (an image codec or a /Filter it can't run, say) or runs past `budget`, the walk
-/// passes 2,000,000 operators, or the parser can't read all of such a form or of `content`.
+/// doesn't decode (an image codec or a /Filter it can't run, say) or runs past `budget` (for the
+/// fonts' cleanup, an allowance of its own when no Type 3 font is listed), the walk passes
+/// 2,000,000 operators, or the parser can't read all of such a form or of `content`.
 /// Corrupt data in such a form is read, tolerantly, up to the damage, which may be nothing.
 pub(crate) fn prune(doc: &Document, budget: &mut DecodeBudget, xo: &mut Dict, replaced: &[Vec<u8>], content: &[Vec<u8>]) -> Result<(), CosError> {
     if replaced.is_empty() {
@@ -357,7 +358,7 @@ fn prune_retired_properties(doc: &Document, res: &mut Dict, names: &[Vec<u8>], c
         // Each is one page's content or one form's, with the allowance of a page.
         for op in resource_ops(doc, &mut DecodeBudget::page(), res, content)? {
             if matches!(op.op.as_slice(), b"BDC" | b"DP")
-                && let Some(name) = op.name(1)
+                && let Some(name) = op.last_name()
             {
                 used.insert(name.to_vec());
             }
@@ -473,7 +474,8 @@ pub(super) fn clip_out(rects: &[[f64; 4]], ctm: &Matrix, around: [f64; 4]) -> Op
 /// The operators of `content`, and of every form without /Resources of its own that it draws
 /// through `res`, nested ones too: what draws with these resources. Each such form is read once,
 /// with its `/DecodeParms` given by reference, its decoded bytes charged to `budget`, so the
-/// cleanups of one page that walk the same forms spend one allowance between them. An error
+/// cleanups of one page that walk the same forms spend one allowance between them (all but the
+/// fonts' cleanup when no Type 3 font is listed, which has one of its own). An error
 /// when that can't all be read: the parser can't read all of `content` or of such a form, the walk
 /// passes 2,000,000 operators, or such a form doesn't decode or runs past `budget`. Operators are
 /// read one at a time, so the walk stops at one past the limit rather than holding them all.
@@ -520,7 +522,7 @@ pub(crate) fn prune_properties(doc: &Document, budget: &mut DecodeBudget, res: &
     let ops = resource_ops(doc, budget, res, content)?;
     let names: Vec<Vec<u8>> = properties.iter().map(|(n, _)| n.to_vec()).collect();
     for name in names {
-        if !ops.iter().any(|op| matches!(op.op.as_slice(), b"BDC" | b"DP") && op.name(1) == Some(&name))
+        if !ops.iter().any(|op| matches!(op.op.as_slice(), b"BDC" | b"DP") && op.last_name() == Some(&name))
             && let Some(value) = properties.remove(&name)
         {
             retired.push(value);
diff --git a/crates/redact/src/lib.rs b/crates/redact/src/lib.rs
index 7c1a65f55a..819cae99cd 100644
--- a/crates/redact/src/lib.rs
+++ b/crates/redact/src/lib.rs
@@ -58,6 +58,12 @@ pub enum RedactError {
     NothingToApply,
     #[error("page {0} has content that can't be read, so it can't be redacted safely")]
     Unreadable(usize),
+    /// The page tree and the renderer count a different number of pages (a page repeated in
+    /// `/Kids`, say), so a mark's page can't be matched to the page the renderer drew.
+    #[error(
+        "the document's page tree and its rendered pages disagree on how many pages there are, so the redaction could not be verified; nothing was changed"
+    )]
+    AmbiguousPages,
     /// Redact annotations with no readable area (neither usable `/QuadPoints` nor a usable `/Rect`).
     /// Skipping them would leave the text under them in the file while the others report success.
     #[error(
@@ -247,6 +253,19 @@ pub(crate) fn annots_of(doc: &Document, page: &Dict) -> Vec<Object> {
     page.get(b"Annots").map(|a| doc.resolve(a)).and_then(|a| a.as_array().cloned()).unwrap_or_default()
 }
 
+/// An annotation's `/Subtype`, resolved: it may be an indirect reference (ISO 32000-2 §7.3.10),
+/// and the audit reads it that way, so a mark it reports must not be one [`apply`] passes over.
+pub(crate) fn subtype(doc: &Document, d: &Dict) -> Option<Vec<u8>> {
+    d.get(b"Subtype").and_then(|s| doc.resolve(s).as_name().map(<[u8]>::to_vec))
+}
+
+/// The pop-up `d` names (`/Popup`), when it is one: it goes with `d`. Anything else it might name
+/// (a mark on another page, say) is left alone.
+fn named_popup(doc: &Document, d: &Dict) -> Option<ObjRef> {
+    let r = d.reference(b"Popup")?;
+    doc.get(r).as_dict().is_some_and(|p| subtype(doc, p).as_deref() == Some(b"Popup")).then_some(r)
+}
+
 /// Every annotation the pages list. Compared before and after a removal, what is no longer listed
 /// leaves the structure tree too ([`tags::drop_object_refs`]).
 pub(crate) fn listed_annotations(doc: &Document) -> HashSet<ObjRef> {
@@ -267,14 +286,14 @@ pub(crate) fn marks_checked(doc: &Document) -> (Vec<Mark>, Vec<usize>) {
             let Some(r) = a.as_ref() else {
                 // A mark written in place has no object to find, apply or remove: refuse it
                 // rather than apply the others as if it were not there.
-                if doc.resolve(&a).as_dict().is_some_and(|d| d.name(b"Subtype") == Some(b"Redact")) {
+                if doc.resolve(&a).as_dict().is_some_and(|d| subtype(doc, d).as_deref() == Some(b"Redact")) {
                     unreadable.push(pi);
                 }
                 continue;
             };
             let obj = doc.get(r);
             let Some(d) = obj.as_dict() else { continue };
-            if d.name(b"Subtype") != Some(b"Redact") {
+            if subtype(doc, d).as_deref() != Some(b"Redact") {
                 continue;
             }
             let mut rects: Vec<[f64; 4]> = quad_points(doc, d)
@@ -580,18 +599,41 @@ fn apply_within(doc: &mut Document, pages: Option<&[usize]>, images: pdfcraft_co
             let annots = annots_of(doc, &p.dict);
             let mut kept = Vec::with_capacity(annots.len());
             for a in &annots {
-                let Some(r) = a.as_ref() else {
-                    kept.push(a.clone());
-                    continue;
-                };
-                let obj = doc.get(r);
+                // An entry written in place is read as one listed by reference: its `/IRT` or
+                // `/Parent` keeps a removed comment reachable all the same, and it has its own text.
+                let obj = doc.resolve(a);
                 let Some(d) = obj.as_dict() else {
                     kept.push(a.clone());
                     continue;
                 };
-                let is_reply =
-                    d.get(b"IRT").and_then(Object::as_ref).is_some_and(|x| removed_everywhere.contains(&x)) && d.name(b"Subtype") != Some(b"Widget");
-                let is_popup = d.get(b"Parent").and_then(Object::as_ref).is_some_and(|x| removed_everywhere.contains(&x));
+                let is_reply = d.reference(b"IRT").is_some_and(|x| removed_everywhere.contains(&x)) && subtype(doc, d).as_deref() != Some(b"Widget");
+                let is_popup = d.reference(b"Parent").is_some_and(|x| removed_everywhere.contains(&x));
+                let Some(r) = a.as_ref() else {
+                    if is_reply || is_popup {
+                        grew = true;
+                        if is_reply {
+                            report.annotations += 1;
+                        }
+                        // Its appearance can be shared with an annotation that stays elsewhere.
+                        if !appearance_scan_limit {
+                            match appearance_refs(doc, d) {
+                                Some(references) => removed_appearances.extend(references),
+                                None => appearance_scan_limit = true,
+                            }
+                            if removed_appearances.len() > 16_384 {
+                                appearance_scan_limit = true;
+                                removed_appearances.clear();
+                            }
+                        }
+                        // It has no reference to remove elsewhere; the pop-up it names has.
+                        if let Some(p) = named_popup(doc, d) {
+                            removed_everywhere.insert(p);
+                        }
+                    } else {
+                        kept.push(a.clone());
+                    }
+                    continue;
+                };
                 if removed_everywhere.contains(&r) || is_reply || is_popup {
                     // A reply or pop-up removed here can share its appearance with an annotation
                     // that stays on an unselected page, like one removed under a mark: the
@@ -638,6 +680,30 @@ fn apply_within(doc: &mut Document, pages: Option<&[usize]>, images: pdfcraft_co
             report.fields += 1;
         }
     }
+    // A widget written in place on another page names its deleted field through `/Parent`, which
+    // would keep the field and its value in the file: it goes with the field.
+    if !doomed_fields.is_empty() {
+        for p in pdfcraft_model::pages(doc) {
+            let annots = annots_of(doc, &p.dict);
+            let kept: Vec<Object> = annots
+                .iter()
+                .filter(|a| {
+                    a.as_ref().is_some() || !matches!(&**a, Object::Dict(d) if d.reference(b"Parent").is_some_and(|f| doomed_fields.contains(&f)))
+                })
+                .cloned()
+                .collect();
+            if kept.len() != annots.len() {
+                report.annotations += annots.len() - kept.len();
+                doc.update_dict(p.obj, |d| {
+                    if kept.is_empty() {
+                        d.remove(b"Annots");
+                    } else {
+                        d.set(b"Annots".to_vec(), Object::Array(kept));
+                    }
+                })?;
+            }
+        }
+    }
 
     // 3a. A tagged PDF's structure tree still points at the removed comments and widgets
     // (`/OBJR`, #2874): drop those references, or a full rewrite keeps them reachable, the
@@ -791,8 +857,10 @@ fn redact_page_content(
     }
     // An inline image the renderer reads no image for (no `EI` it accepts, or parameters it
     // can't read): where the page's operators resume after it is a guess, so neither removal
-    // nor the verify pass can be trusted on this page.
-    if out.ambiguous {
+    // nor the verify pass can be trusted on this page. Likewise bytes the parser can't read in
+    // what the walk read, the page's content or a form under a mark: text they hide is neither
+    // found nor removed, and other readers may draw it.
+    if out.ambiguous || out.unparsed {
         return Err(RedactError::Unreadable(pi + 1));
     }
     doomed_xobjects.extend_from_slice(&out.doomed);
@@ -883,30 +951,66 @@ fn remove_page_annotations(
     page_marks: &[&Mark],
 ) -> Result<(), RedactError> {
     let Applying { report, doomed_fields, widget_owner, removed_everywhere, removed_appearances, appearance_scan_limit, .. } = applying;
-    // 2. Annotations: the marks, and whatever lies under them (with their pop-ups).
+    // 2. Annotations: the marks, and whatever lies under them (with their pop-ups). An entry
+    // written in place (a dictionary in `/Annots`, not a reference) is judged like any other: its
+    // `/Contents` and `/IRT` stay in the file for as long as the page lists it.
     let annots = annots_of(doc, &doc.get(page.obj).as_dict().cloned().unwrap_or_default());
+    /// What decides an entry's fate, read once.
+    struct Entry {
+        r: Option<ObjRef>,
+        widget: bool,
+        irt: Option<ObjRef>,
+        parent: Option<ObjRef>,
+        popup: Option<ObjRef>,
+    }
+    let entries: Vec<Option<Entry>> = annots
+        .iter()
+        .map(|a| {
+            let obj = doc.resolve(a);
+            let d = obj.as_dict()?;
+            Some(Entry {
+                r: a.as_ref(),
+                widget: subtype(doc, d).as_deref() == Some(b"Widget"),
+                irt: d.reference(b"IRT"),
+                parent: d.reference(b"Parent"),
+                popup: named_popup(doc, d),
+            })
+        })
+        .collect();
     let mut removed: Vec<ObjRef> = Vec::new();
-    for a in &annots {
-        let Some(r) = a.as_ref() else { continue };
-        let obj = doc.get(r);
+    // Entries written in place that go, by position in `/Annots`.
+    let mut inline_gone = vec![false; annots.len()];
+    for (i, a) in annots.iter().enumerate() {
+        let obj = doc.resolve(a);
         let Some(d) = obj.as_dict() else { continue };
-        let subtype = d.name(b"Subtype").unwrap_or(b"");
-        if subtype == b"Redact" {
-            if page_marks.iter().any(|m| m.obj == r) {
+        let r = a.as_ref();
+        let kind = subtype(doc, d).unwrap_or_default();
+        if kind == b"Redact" {
+            // A mark written in place was refused before anything changed.
+            if let Some(r) = r
+                && page_marks.iter().any(|m| m.obj == r)
+            {
                 removed.push(r);
             }
             continue;
         }
-        if subtype == b"Popup" {
+        if kind == b"Popup" {
             continue;
         }
         if rect_of(doc, d.get(b"Rect")).is_some_and(|b| rects.iter().any(|x| pdfcraft_content::overlaps(*x, b, 0.0))) {
-            removed.push(r);
-            if subtype == b"Widget" {
-                if let Some((_, field)) = widget_owner.iter().find(|(w, _)| *w == r)
-                    && !doomed_fields.contains(field)
+            match r {
+                Some(r) => removed.push(r),
+                None => inline_gone[i] = true,
+            }
+            if kind == b"Widget" {
+                // A widget written in place has no reference of its own; its `/Parent` is the field,
+                // even one no referenced widget belongs to (it then has no entry in `widget_owner`).
+                // Step 3 deletes only what the form lists as a field, so any `/Parent` is safe here.
+                let owner = r.and_then(|r| widget_owner.iter().find(|(w, _)| *w == r).map(|(_, f)| *f)).or_else(|| d.reference(b"Parent"));
+                if let Some(field) = owner
+                    && !doomed_fields.contains(&field)
                 {
-                    doomed_fields.push(*field);
+                    doomed_fields.push(field);
                 }
             } else {
                 report.annotations += 1;
@@ -917,29 +1021,25 @@ fn remove_page_annotations(
     // those: a reply placed elsewhere would keep its parent — the comment and the QuadPoints
     // of the redacted words — in the file through its `/IRT` (#2659). Each pass removes at
     // least one more annotation of this page or stops, so it ends.
-    let replies: Vec<(ObjRef, ObjRef)> = annots
-        .iter()
-        .filter_map(Object::as_ref)
-        .filter_map(|r| {
-            let obj = doc.get(r);
-            let d = obj.as_dict()?;
-            (d.name(b"Subtype") != Some(b"Widget")).then_some(())?;
-            Some((r, d.get(b"IRT").and_then(Object::as_ref)?))
-        })
-        .collect();
     loop {
-        let before = removed.len();
-        for (r, parent) in &replies {
-            if !removed.contains(r) && removed.contains(parent) {
-                removed.push(*r);
-                report.annotations += 1;
+        let mut grew = false;
+        for (i, e) in entries.iter().enumerate() {
+            let Some(e) = e else { continue };
+            let gone = e.r.map_or(inline_gone[i], |r| removed.contains(&r));
+            if gone || e.widget || !e.irt.is_some_and(|p| removed.contains(&p)) {
+                continue;
             }
+            match e.r {
+                Some(r) => removed.push(r),
+                None => inline_gone[i] = true,
+            }
+            report.annotations += 1;
+            grew = true;
         }
-        if removed.len() == before {
+        if !grew {
             break;
         }
     }
-    removed_everywhere.extend(removed.iter().copied());
     // A removed annotation's appearance streams can be shared with a kept one on another page,
     // which would keep a pruned pattern's cell reachable: remember them for the pattern guard.
     for reference in &removed {
@@ -959,24 +1059,53 @@ fn remove_page_annotations(
             }
         }
     }
-    // Pop-ups dropped with their parent below count too: a reply on another page may answer one.
-    for a in &annots {
-        let Some(r) = a.as_ref() else { continue };
-        if doc.get(r).as_dict().and_then(|d| d.get(b"Parent")).and_then(Object::as_ref).is_some_and(|p| removed.contains(&p)) {
-            removed_everywhere.insert(r);
+    // An entry written in place that goes keeps no reference, but its appearances count as well.
+    for (i, a) in annots.iter().enumerate() {
+        if *appearance_scan_limit {
+            break;
+        }
+        if let (true, Some(annotation)) = (inline_gone[i], doc.resolve(a).as_dict()) {
+            match appearance_refs(doc, annotation) {
+                Some(references) => removed_appearances.extend(references),
+                None => *appearance_scan_limit = true,
+            }
+            if removed_appearances.len() > 16_384 {
+                *appearance_scan_limit = true;
+                removed_appearances.clear();
+            }
         }
     }
+    // Pop-ups go with their annotation: those that name it (`/Parent`), and those it names
+    // (`/Popup`), the only link an annotation written in place can have to its pop-up.
+    let mut going: HashSet<ObjRef> = removed.iter().copied().collect();
+    for (i, e) in entries.iter().enumerate() {
+        let Some(e) = e else { continue };
+        let gone = e.r.map_or(inline_gone[i], |r| removed.contains(&r));
+        if gone {
+            going.extend(e.popup);
+        }
+    }
+    for (i, e) in entries.iter().enumerate() {
+        let Some(e) = e else { continue };
+        if e.parent.is_some_and(|p| removed.contains(&p)) {
+            match e.r {
+                Some(r) => {
+                    going.insert(r);
+                }
+                None => inline_gone[i] = true,
+            }
+        }
+    }
+    // Pop-ups dropped with their parent count too: a reply on another page may answer one.
+    removed_everywhere.extend(going.iter().copied());
     let kept: Vec<Object> = annots
         .into_iter()
-        .filter(|a| {
-            let Some(r) = a.as_ref() else { return true };
-            if removed.contains(&r) {
-                return false;
-            }
-            // Pop-ups of removed annotations go too.
-            let obj = doc.get(r);
-            !obj.as_dict().and_then(|d| d.get(b"Parent")).and_then(Object::as_ref).is_some_and(|p| removed.contains(&p))
+        .enumerate()
+        .filter(|(i, a)| match a.as_ref() {
+            Some(r) => !going.contains(&r),
+            None => !inline_gone[*i],
         })
+        .map(|(_, a)| a)
         .collect();
     doc.update_dict(page.obj, |d| {
         if kept.is_empty() {
@@ -1014,6 +1143,19 @@ pub fn clear_marks(doc: &mut Document, pages: Option<&[usize]>) -> Result<usize,
     Ok(targets.len())
 }
 
+/// `o` with a chain of references followed, as a viewer follows it, to at most 16 links (so a
+/// reference cycle ends): hidden-layer state must not escape classification through one.
+pub(crate) fn resolve_chain(doc: &pdfcraft_cos::Document, o: &pdfcraft_cos::Object) -> std::sync::Arc<pdfcraft_cos::Object> {
+    let mut o = doc.resolve(o);
+    for _ in 0..16 {
+        if !matches!(*o, pdfcraft_cos::Object::Ref(_)) {
+            break;
+        }
+        o = doc.resolve(&o);
+    }
+    o
+}
+
 /// The name to save a document under after [`apply`]: `_Redacted` before the extension, as
 /// Acrobat appends it ("contract.pdf" gives "contract_Redacted.pdf"). The `.pdf` extension is
 /// matched in any letter case. A name that already ends in `_Redacted` keeps it once.
diff --git a/crates/redact/src/sanitize.rs b/crates/redact/src/sanitize.rs
index 0d4ee2e18a..61c7cedda4 100644
--- a/crates/redact/src/sanitize.rs
+++ b/crates/redact/src/sanitize.rs
@@ -479,12 +479,13 @@ fn hidden_layers(doc: &Document) -> Vec<ObjRef> {
         o.and_then(|g| doc.resolve(g).as_array().map(|a| a.iter().filter_map(Object::as_ref).collect())).unwrap_or_default()
     };
     let all = refs(oc.get(b"OCGs"));
-    let (on, off) = (refs(d.get(b"ON")), refs(d.get(b"OFF")));
-    let mut hidden: Vec<ObjRef> = if d.name(b"BaseState") == Some(b"OFF") {
-        all.iter().copied().filter(|g| !on.contains(g)).collect()
-    } else {
-        off.into_iter().filter(|g| all.contains(g)).collect()
-    };
+    // sets: the lists are the document's, and a filter over every group would scan them each time
+    let (on, off): (std::collections::HashSet<ObjRef>, std::collections::HashSet<ObjRef>) =
+        (refs(d.get(b"ON")).into_iter().collect(), refs(d.get(b"OFF")).into_iter().collect());
+    // The default state is /BaseState, then /ON turns groups on and /OFF turns them off, so a
+    // group both lists name ends up off (§8.11.4.3, Table 101) — the viewer reads it the same way.
+    let base_off = d.get(b"BaseState").map(|b| crate::resolve_chain(doc, b)).is_some_and(|b| b.as_name() == Some(b"OFF".as_slice()));
+    let mut hidden: Vec<ObjRef> = all.iter().copied().filter(|g| off.contains(g) || (base_off && !on.contains(g))).collect();
     // Each rule, layer list and layer is read once, however often the rules name them: many rules
     // can share one long list.
     let known: std::collections::HashSet<ObjRef> = all.iter().copied().collect();
@@ -659,6 +660,17 @@ fn content_pass(doc: &mut Document, text: bool, layers: bool, write: bool) -> Re
         if let Some(error) = out.error {
             return Err(error.into());
         }
+        // Bytes the parser can't read, or an inline image whose end is a guess: the walk reads past
+        // them, so what it reads around them may not be what other readers draw (hidden text in a
+        // broken `TJ` is neither found nor removed). As for content that doesn't decode, count the
+        // page so the removal runs and refuses it.
+        if out.unparsed || out.ambiguous {
+            if write {
+                return Err(RedactError::Unreadable(pi + 1));
+            }
+            total += 1;
+            continue;
+        }
         let blocks = scope.layer_blocks;
         let glyphs = scope.report.glyphs;
         let retained_for_page = std::mem::take(&mut scope.retained_off_layers);
diff --git a/crates/redact/src/tags.rs b/crates/redact/src/tags.rs
index 648c0c29e5..03573a9743 100644
--- a/crates/redact/src/tags.rs
+++ b/crates/redact/src/tags.rs
@@ -35,6 +35,14 @@ impl Marked {
 /// left are taken as changed (their descriptions go) rather than compared.
 const MAX_COMPARED: usize = 1 << 28;
 
+/// `f` of `o`, or of the object it refers to, without copying a direct one.
+fn with_held<R>(doc: &Document, o: &Object, f: impl FnOnce(&Object) -> R) -> R {
+    match o {
+        Object::Ref(_) => f(&doc.resolve(o)),
+        o => f(o),
+    }
+}
+
 fn by_mcid(doc: &Document, resources: &Dict, data: &[u8]) -> Marked {
     let mut out = Marked::default();
     // Open sequences: the MCID with where its content starts in `ops` and the drawing operators
@@ -49,14 +57,22 @@ fn by_mcid(doc: &Document, resources: &Dict, data: &[u8]) -> Marked {
             e.1 |= drawn > drawn_before;
         }
     };
+    // The named property lists, read once, and each name's MCID, read once: a stream can name one
+    // at every `BDC` of thousands, and reading an object again can parse it again, all of it (the
+    // document keeps an object larger than its cache only until it reads another). A direct one
+    // is read where it is.
+    let held = resources.get(b"Properties").filter(|p| matches!(p, Object::Ref(_))).map(|p| doc.resolve(p));
+    let named = held.as_deref().or_else(|| resources.get(b"Properties")).and_then(Object::as_dict);
+    let mut mcids: HashMap<Vec<u8>, Option<i64>> = HashMap::new();
     for op in pdfcraft_content::parse(data).ops {
         match op.op.as_slice() {
             b"BDC" => {
-                let id = match op.operands.get(1) {
-                    Some(Object::Name(n)) => resources.get(b"Properties").and_then(|p| {
-                        let props = doc.resolve(p);
-                        let prop = doc.resolve(props.as_dict()?.get(n)?);
-                        prop.as_dict()?.int(b"MCID")
+                // The property list is the last operand, as the renderer reads it.
+                let id = match op.back(0) {
+                    Some(Object::Name(n)) => *mcids.entry(n.to_vec()).or_insert_with(|| {
+                        let prop = named?.get(n)?;
+                        // A named property list may give its MCID by reference.
+                        with_held(doc, prop, |prop| prop.as_dict()?.get(b"MCID").and_then(|id| with_held(doc, id, Object::as_int)))
                     }),
                     Some(p) => doc.resolve(p).as_dict().and_then(|d| d.int(b"MCID")),
                     _ => None,
@@ -86,9 +102,7 @@ fn by_mcid(doc: &Document, resources: &Dict, data: &[u8]) -> Marked {
         }
         let draws = match op.op.as_slice() {
             b"Tj" | b"'" | b"\"" => op.operands.last().and_then(Object::as_string).is_some_and(|s| !s.bytes.is_empty()),
-            b"TJ" => {
-                op.operands.first().and_then(Object::as_array).is_some_and(|a| a.iter().any(|x| x.as_string().is_some_and(|s| !s.bytes.is_empty())))
-            }
+            b"TJ" => op.back(0).and_then(Object::as_array).is_some_and(|a| a.iter().any(|x| x.as_string().is_some_and(|s| !s.bytes.is_empty()))),
             b"f" | b"F" | b"f*" | b"B" | b"B*" | b"b" | b"b*" | b"S" | b"s" | b"sh" | b"Do" | b"BI" => true,
             _ => false,
         };
@@ -139,7 +153,7 @@ fn mcid_of(doc: &Document, o: &Object, page: Option<ObjRef>, target: ObjRef, str
         Object::Dict(m) if m.name(b"Type") == Some(b"MCR") => {
             let pg = m.get(b"Pg").and_then(Object::as_ref).or(page);
             let stm = m.get(b"Stm").and_then(Object::as_ref);
-            (pg == Some(target) && stm == stream.map(|s| s.0)).then(|| m.int(b"MCID")).flatten()
+            (pg == Some(target) && stm == stream.map(|s| s.0)).then(|| m.get(b"MCID").and_then(|id| doc.resolve(id).as_int())).flatten()
         }
         _ => None,
     }
diff --git a/crates/redact/src/tests.rs b/crates/redact/src/tests.rs
index 46ac131450..08125165b5 100644
--- a/crates/redact/src/tests.rs
+++ b/crates/redact/src/tests.rs
@@ -1057,6 +1057,20 @@ fn partially_covered_vector_paths_do_not_leak_drawing_commands() {
     assert!(c.contains("300 300 m\n350 350 l\nS"), "unaffected vector path must be kept: {c}");
 }
 
+#[test]
+fn a_covered_clip_and_paint_path_leaves_an_empty_clip_not_its_outline() {
+    // The outline of a fully covered path that clips and paints is confidential geometry: only
+    // an empty clip may stay, and what follows is hidden as the covered clip would have hidden it.
+    let src = b"q 100 100 m 150 180 l 200 100 l h W f 300 300 50 50 re f Q";
+    let mut doc = one_page(src, "", vec![]);
+    mark(&mut doc, 0, &[[90.0, 90.0, 210.0, 190.0]], "");
+    let r = apply(&mut doc, None).unwrap();
+    assert_eq!(r.paths_removed, 1);
+    let c = content(&doc, 0);
+    assert!(!c.contains("150 180 l") && !c.contains("100 100 m"), "outline must not stay: {c}");
+    assert!(c.contains("0 0 0 0 re\nW\nn"), "an empty clip stays: {c}");
+}
+
 /// A chain of nested forms deeper than the pass can walk was removed from the page, taking
 /// whatever else it drew with it even when nothing in it was marked. The limit now reaches as
 /// deep as the renderer and Edit text read (50), so anything a reader can see can be walked;
@@ -3297,31 +3311,42 @@ fn image_and_a_tail(catalog: &str, image: &str, image_dict: &str, tail: &[u8]) -
     ])
 }
 
-/// The refusal of the check of what content still draws through its resources (`resource_ops`).
-fn unread_content_refusal<T: std::fmt::Debug>(result: &Result<T, RedactError>) -> bool {
-    matches!(result, Err(RedactError::Cos(pdfcraft_cos::CosError::Syntax { detail, .. }))
-        if detail == "redaction could not fully read the content that uses these resources")
-}
-
-/// What the page draws can't be told when a content stream the redaction leaves as it was holds
-/// bytes the parser can't read: the redaction of an image is refused, as it was already on a page
-/// with fonts or properties to clean up.
+/// What the page draws can't be told when content the redaction leaves as it was holds bytes the
+/// parser can't read: the redaction of an image is refused. In a content stream of the page, the
+/// walk reads past them and refuses the page itself (`Unreadable`). In a form without resources of
+/// its own that lies away from the mark, which the walk doesn't enter, the check of what the page
+/// still draws through its resources refuses it.
 #[test]
 fn unreadable_bytes_in_a_stream_left_as_it_was_refuse_the_redaction_of_an_image() {
     for (tail, refused) in [(&b"q Q )"[..], true), (b"q Q", false)] {
         let mut doc = image_and_a_tail("", "Im1", "", tail);
         mark(&mut doc, 0, &[[0.0, 200.0, 300.0, 300.0]], "");
-        let result = apply(&mut doc, None);
-        if refused {
-            assert!(unread_content_refusal(&result), "{result:?}");
-        } else {
-            assert_eq!(result.map(|r| r.images_removed).ok(), Some(1));
-        }
+        let result = apply(&mut doc, None).map(|r| r.images_removed);
+        assert_eq!(result, if refused { Err(RedactError::Unreadable(1)) } else { Ok(1) });
     }
+    let mut doc = image_and_a_tail("", "Im1", "", b"/Fm Do");
+    let bbox = Object::Array(vec![0.into(), 0.into(), 300.into(), 100.into()]);
+    let form = Dict::from_iter([(b"Type".to_vec(), Object::name("XObject")), (b"Subtype".to_vec(), Object::name("Form")), (b"BBox".to_vec(), bbox)]);
+    let form = doc.add(Object::Stream(Stream::from_raw(form, b"q Q )".to_vec())));
+    doc.update_dict(ObjRef::new(3, 0), |d| {
+        if let Some(Object::Dict(res)) = d.get_mut(b"Resources")
+            && let Some(Object::Dict(xo)) = res.get_mut(b"XObject")
+        {
+            xo.set(b"Fm".to_vec(), Object::Ref(form));
+        }
+    })
+    .unwrap();
+    mark(&mut doc, 0, &[[0.0, 200.0, 300.0, 300.0]], "");
+    let result = apply(&mut doc, None);
+    assert!(
+        matches!(&result, Err(RedactError::Cos(pdfcraft_cos::CosError::Syntax { detail, .. })) if detail == "redaction could not fully inspect inherited form resources"),
+        "{result:?}"
+    );
 }
 
-/// Remove Hidden Information makes the same check: removing an off layer's image is refused on a
-/// page whose drawing can't be told.
+/// Remove Hidden Information refuses the same page: removing an off layer's image is refused on a
+/// page whose drawing can't be told. Its walk reads every content stream, and refuses the page
+/// itself.
 #[test]
 fn unreadable_bytes_in_a_stream_left_as_it_was_refuse_removing_a_hidden_image() {
     use crate::sanitize::{Hidden, remove_hidden};
@@ -3329,7 +3354,7 @@ fn unreadable_bytes_in_a_stream_left_as_it_was_refuse_removing_a_hidden_image()
         let mut doc = image_and_a_tail("/OCProperties << /OCGs [7 0 R] /D << /OFF [7 0 R] >> >>", "ImOC", "/OC 7 0 R", tail);
         let result = remove_hidden(&mut doc, &[Hidden::HiddenLayers]);
         if refused {
-            assert!(unread_content_refusal(&result), "{result:?}");
+            assert_eq!(result, Err(RedactError::Unreadable(1)));
         } else {
             assert!(result.unwrap().iter().any(|(h, n)| *h == Hidden::HiddenLayers && *n > 0));
         }
@@ -3571,14 +3596,43 @@ fn what_content_draws_through_its_resources_is_read_within_its_allowance() {
     }
 }
 
+/// An unused Type 3 font, listed as /T3 beside /F1 in the `/Font` of `holder`'s resources (a page's
+/// or a form's), so that the font cleanup, which prunes only Type 3 fonts, charges its read of what
+/// they draw to the page's allowance (without one it has an allowance of its own).
+fn list_type3(doc: &mut Document, holder: ObjRef) {
+    let font = Object::Dict(Dict::from_iter([
+        (b"Type".to_vec(), Object::name("Font")),
+        (b"Subtype".to_vec(), Object::name("Type3")),
+        (b"FontBBox".to_vec(), Object::Array(vec![0.into(), 0.into(), 1000.into(), 1000.into()])),
+        (b"FontMatrix".to_vec(), Object::Array(vec![Object::Real(0.001), 0.into(), 0.into(), Object::Real(0.001), 0.into(), 0.into()])),
+        (b"CharProcs".to_vec(), Object::Dict(Dict::new())),
+    ]));
+    let font = Object::Ref(doc.add(font));
+    let list = |d: &mut Dict| {
+        let Some(Object::Dict(res)) = d.get_mut(b"Resources") else { panic!("{holder:?} has resources") };
+        let Some(Object::Dict(fonts)) = res.get_mut(b"Font") else { panic!("{holder:?} lists fonts") };
+        fonts.set(b"T3".to_vec(), font);
+    };
+    match &*doc.get(holder) {
+        Object::Stream(s) => {
+            let mut s = s.clone();
+            list(&mut s.dict);
+            doc.set(holder, Object::Stream(s));
+        }
+        _ => doc.update_dict(holder, list).unwrap(),
+    }
+}
+
 /// The cleanups after the content walk spend what the walk left of the page's allowance, one
 /// allowance between them. A form without resources of its own that crosses the mark is read by
-/// the walk, then again by the check of what the page still draws and by the font cleanup: at
-/// 100 MiB, three reads are more than the page's 256 MiB, and the redaction is refused; at
-/// 50 MiB it goes on.
+/// the walk, then again by the check of what the page still draws and by the font cleanup, which
+/// charges the page's allowance when the page lists a Type 3 font: at 100 MiB, three reads are more
+/// than the page's 256 MiB, and the redaction is refused; at 50 MiB it goes on. With no Type 3 font
+/// the font cleanup's read has an allowance of its own, so the page's pays for two reads of
+/// 100 MiB, and the redaction goes on.
 #[test]
 fn the_cleanups_after_the_content_walk_spend_what_it_left_of_the_pages_allowance() {
-    for (mib, refused) in [(100, true), (50, false)] {
+    for (mib, type3, refused) in [(100, true, true), (50, true, false), (100, false, false)] {
         let blank = pdfcraft_filters::encode_flate(&vec![b' '; mib << 20]);
         let mut doc = one_page(
             b"q 50 0 0 50 20 230 cm /Im1 Do Q /FmBare Do",
@@ -3588,19 +3642,70 @@ fn the_cleanups_after_the_content_walk_spend_what_it_left_of_the_pages_allowance
                 stream("/Type /XObject /Subtype /Image /Width 1 /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8", b"o"),
             ],
         );
+        if type3 {
+            list_type3(&mut doc, ObjRef::new(3, 0));
+        }
         mark(&mut doc, 0, &[[0.0, 200.0, 300.0, 300.0]], "");
-        assert_eq!(apply(&mut doc, None).is_err(), refused, "{mib} MiB");
+        assert_eq!(apply(&mut doc, None).is_err(), refused, "{mib} MiB, Type 3: {type3}");
     }
 }
 
+/// Text under the mark in a content stream that holds bytes the parser can't read, inside a `TJ`
+/// array, is read past by the walk and would stay. The font cleanup's read of what the content
+/// draws refuses such bytes in the streams and forms the walk leaves as they were, and makes that
+/// read with any font listed, a Type 3 font or not (with none, on an allowance of its own). Here
+/// the walk rewrites the text in the page's first stream and leaves the broken `TJ` as it was:
+/// Apply Redactions refuses the page, whether that `TJ` is in the page's second stream or in a
+/// form without resources of its own, and so does Remove Hidden Information. The cleanups run only
+/// when the walk rewrites some of the page, and read what it rewrote as rewritten, so such bytes in
+/// a stream it rewrites still go by, and so do those on a page it rewrites nothing of, unless the
+/// document still lists a Type 3 font (`unlink_type3` then reads every page).
+#[test]
+fn text_beside_bytes_the_parser_cannot_read_refuses_the_redaction() {
+    use crate::sanitize::{Hidden, remove_hidden};
+    let page_of = |second: &[u8]| {
+        pdf(vec![
+            b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+            b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
+            b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents [4 0 R 5 0 R] /Resources << /Font << /F1 6 0 R >> >> >>".to_vec(),
+            stream("", b"BT /F1 10 Tf 20 230 Td (SECRET) Tj ET"),
+            stream("", second),
+            FONT.replace("95 0 R", "7 0 R").into_bytes(),
+            widths(),
+        ])
+    };
+    for tail in [
+        &b"BT /F1 10 Tf 20 260 Td [(TAIL) ) (SECRET)] TJ ET"[..],
+        b"BT /F1 10 Tf 20 260 Td [(TAIL) } (SECRET)] TJ ET",
+        b"BT /F1 10 Tf 20 260 Td [(TAILSECRET) )] TJ ET",
+        b"BT /F1 10 Tf 20 260 Td [) (TAILSECRET)] TJ ET",
+    ] {
+        let mut doc = page_of(tail);
+        mark(&mut doc, 0, &[[0.0, 200.0, 300.0, 300.0]], "");
+        assert!(apply(&mut doc, None).is_err(), "{}", String::from_utf8_lossy(tail));
+    }
+    let mut doc = one_page(
+        b"BT /F1 10 Tf 20 230 Td (SECRET) Tj ET /FmBare Do",
+        "/XObject << /FmBare 7 0 R >>",
+        vec![stream("/Type /XObject /Subtype /Form /BBox [0 0 300 300]", b"BT /F1 10 Tf 20 260 Td [(TAIL) ) (SECRET)] TJ ET")],
+    );
+    mark(&mut doc, 0, &[[0.0, 200.0, 300.0, 300.0]], "");
+    assert!(apply(&mut doc, None).is_err(), "a form's text");
+    let mut doc = page_of(b"BT /F1 10 Tf 3 Tr 20 260 Td [(TAIL) ) (HIDDEN)] TJ ET");
+    doc.set(ObjRef::new(4, 0), Object::Stream(Stream::from_raw(Dict::new(), b"BT /F1 10 Tf 3 Tr 20 230 Td (HIDDEN) Tj ET".to_vec())));
+    assert!(remove_hidden(&mut doc, &[Hidden::HiddenText]).is_err(), "hidden text");
+}
+
 /// The cleanups of a form the redaction rewrites spend the page's allowance too. The rewritten
 /// form has resources of its own, so the page's cleanups don't follow it, and draws through them a
 /// form without any that crosses the mark: the walk reads that form, then the check of what the
-/// rewritten form still draws and its font cleanup read it again. At 100 MiB, three reads are more
-/// than the page's 256 MiB, and the redaction is refused; at 50 MiB it goes on.
+/// rewritten form still draws and its font cleanup (when it lists a Type 3 font) read it again. At
+/// 100 MiB, three reads are more than the page's 256 MiB, and the redaction is refused; at 50 MiB
+/// it goes on. With no Type 3 font the font cleanup's read has an allowance of its own, so the
+/// page's pays for two reads of 100 MiB, and the redaction goes on.
 #[test]
 fn the_cleanups_of_a_rewritten_form_spend_the_pages_allowance() {
-    for (mib, refused) in [(100, true), (50, false)] {
+    for (mib, type3, refused) in [(100, true, true), (50, true, false), (100, false, false)] {
         let blank = pdfcraft_filters::encode_flate(&vec![b' '; mib << 20]);
         let mut doc = one_page(
             b"/FmText Do",
@@ -3613,20 +3718,25 @@ fn the_cleanups_of_a_rewritten_form_spend_the_pages_allowance() {
                 stream("/Type /XObject /Subtype /Form /BBox [0 0 300 300] /Filter /FlateDecode", &blank),
             ],
         );
+        if type3 {
+            list_type3(&mut doc, ObjRef::new(7, 0));
+        }
         mark(&mut doc, 0, &[[0.0, 200.0, 300.0, 300.0]], "");
-        assert_eq!(apply(&mut doc, None).is_err(), refused, "{mib} MiB");
+        assert_eq!(apply(&mut doc, None).is_err(), refused, "{mib} MiB, Type 3: {type3}");
     }
 }
 
 /// Removing hidden text spends what its content walk left of the page's allowance too. The page
 /// draws a form holding hidden text, which is rewritten, and a form without resources of its own:
 /// the walk reads the second, then the check of what the page still draws and the font cleanup
-/// read it again. At 100 MiB, three reads are more than the page's 256 MiB, and the removal is
-/// refused; at 50 MiB it goes on.
+/// (when the page lists a Type 3 font) read it again. At 100 MiB, three reads are more than the
+/// page's 256 MiB, and the removal is refused; at 50 MiB it goes on. With no Type 3 font the font
+/// cleanup's read has an allowance of its own, so the page's pays for two reads of 100 MiB, and the
+/// removal goes on.
 #[test]
 fn removing_hidden_text_spends_what_the_content_walk_left_of_the_pages_allowance() {
     use crate::sanitize::{Hidden, remove_hidden};
-    for (mib, refused) in [(100, true), (50, false)] {
+    for (mib, type3, refused) in [(100, true, true), (50, true, false), (100, false, false)] {
         let blank = pdfcraft_filters::encode_flate(&vec![b' '; mib << 20]);
         let mut doc = one_page(
             b"/FmHidden Do /FmBare Do",
@@ -3636,7 +3746,10 @@ fn removing_hidden_text_spends_what_the_content_walk_left_of_the_pages_allowance
                 stream("/Type /XObject /Subtype /Form /BBox [0 0 300 300] /Filter /FlateDecode", &blank),
             ],
         );
-        assert_eq!(remove_hidden(&mut doc, &[Hidden::HiddenText]).is_err(), refused, "{mib} MiB");
+        if type3 {
+            list_type3(&mut doc, ObjRef::new(3, 0));
+        }
+        assert_eq!(remove_hidden(&mut doc, &[Hidden::HiddenText]).is_err(), refused, "{mib} MiB, Type 3: {type3}");
     }
 }
 
@@ -4038,6 +4151,8 @@ fn hidden_ocmd_policy_matches_the_default_configuration() {
         (Some("AllOn"), false, Some("not_off"), false),
         (None, false, Some("malformed_not"), true),
         (None, false, Some("malformed_without_ocgs"), true),
+        // `/VE` names the hidden group through an alias object (10 0 R is a reference to 8 0 R).
+        (None, false, Some("alias"), true),
     ];
     for (policy, malformed_policy, visibility, should_remove) in cases {
         let mut doc = one_page(
@@ -4075,9 +4190,11 @@ fn hidden_ocmd_policy_matches_the_default_configuration() {
             Some("malformed_without_ocgs") => {
                 membership.set(b"VE".to_vec(), Object::Array(vec![Object::name("UnknownOperator"), Object::Ref(ObjRef::new(8, 0))]))
             }
+            Some("alias") => membership.set(b"VE".to_vec(), Object::Array(vec![Object::name("Or"), Object::Ref(ObjRef::new(10, 0))])),
             _ => {}
         }
         doc.set(ObjRef::new(9, 0), Object::Dict(membership));
+        doc.set(ObjRef::new(10, 0), Object::Ref(ObjRef::new(8, 0)));
         let root = doc.root().unwrap();
         doc.update_dict(root, |d| {
             d.set(
@@ -6143,15 +6260,18 @@ fn unused_descriptions_in_shared_or_inherited_resources_are_retired() {
 
 mod descriptions;
 mod elsewhere;
+mod form_matrix;
 mod hidden_scope;
 mod identification;
 mod inline_images;
 mod limits;
 mod metadata_fail_closed;
 mod metadata_matching;
+mod operands_from_the_end;
 mod property_retirement;
 mod surviving_references;
 mod text_state;
+mod unparsed;
 
 /// `[(FIRSTARR)] [(LASTARR)] TJ` is malformed (a surplus array operand), but the operator still
 /// draws only the one immediately before it (LASTARR, 7 glyphs, 35 pt wide from x = 10) -- not
@@ -6554,6 +6674,78 @@ fn a_reply_on_another_page_to_a_removed_popup_goes_too() {
     }
 }
 
+/// One page drawing `SECRET` in the `/OC /L` block, with layer 7 0 R in the default
+/// configuration `config` (objects 8 and up are `extra`).
+fn layer_state_page(config: Vec<(&str, Object)>, resource: &str, extra: Vec<Vec<u8>>) -> Document {
+    let mut objects = vec![b"<< /Type /OCG /Name (Secret) >>".to_vec()];
+    objects.extend(extra);
+    let mut doc = one_page(b"/OC /L BDC BT /F1 10 Tf 10 100 Td (SECRET) Tj ET EMC", &format!("/Properties << /L {resource} >>"), objects);
+    let config = Object::Dict(Dict::from_iter(config.into_iter().map(|(k, v)| (k.as_bytes().to_vec(), v))));
+    let root = doc.root().unwrap();
+    doc.update_dict(root, |d| {
+        d.set(
+            b"OCProperties".to_vec(),
+            Object::Dict(Dict::from_iter([(b"OCGs".to_vec(), Object::Array(vec![Object::Ref(ObjRef::new(7, 0))])), (b"D".to_vec(), config)])),
+        );
+    })
+    .unwrap();
+    doc
+}
+
+fn assert_layer_secret_removed(mut doc: Document) {
+    use crate::sanitize::{Hidden, remove_hidden, scan};
+    let counts = scan(&doc);
+    assert!(counts.iter().any(|(h, n)| *h == Hidden::HiddenLayers && *n > 0), "{counts:?}");
+    remove_hidden(&mut doc, &[Hidden::HiddenLayers]).unwrap();
+    let saved = Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap();
+    assert!(!pdfcraft_edit::text_lines(&saved, 0).unwrap().iter().any(|line| line.text.contains("SECRET")));
+}
+
+#[test]
+fn an_indirect_base_state_off_hides_the_layer() {
+    assert_layer_secret_removed(layer_state_page(vec![("BaseState", Object::Ref(ObjRef::new(8, 0)))], "7 0 R", vec![b"/OFF".to_vec()]));
+}
+
+#[test]
+fn a_chained_base_state_off_hides_the_layer() {
+    assert_layer_secret_removed(layer_state_page(
+        vec![("BaseState", Object::Ref(ObjRef::new(8, 0)))],
+        "7 0 R",
+        vec![b"9 0 R".to_vec(), b"/OFF".to_vec()],
+    ));
+}
+
+#[test]
+fn a_chained_membership_type_is_evaluated() {
+    assert_layer_secret_removed(layer_state_page(
+        vec![("BaseState", Object::name("ON"))],
+        "8 0 R",
+        vec![b"<< /Type 9 0 R /OCGs [7 0 R] /P /AllOff >>".to_vec(), b"10 0 R".to_vec(), b"/OCMD".to_vec()],
+    ));
+}
+
+#[test]
+fn off_wins_over_on_when_the_base_state_is_off() {
+    assert_layer_secret_removed(layer_state_page(
+        vec![
+            ("BaseState", Object::name("OFF")),
+            ("ON", Object::Array(vec![Object::Ref(ObjRef::new(7, 0))])),
+            ("OFF", Object::Array(vec![Object::Ref(ObjRef::new(7, 0))])),
+        ],
+        "7 0 R",
+        Vec::new(),
+    ));
+}
+
+#[test]
+fn a_membership_dictionary_with_an_indirect_type_is_evaluated() {
+    assert_layer_secret_removed(layer_state_page(
+        vec![("BaseState", Object::name("ON"))],
+        "8 0 R",
+        vec![b"<< /Type 9 0 R /OCGs [7 0 R] /P /AllOff >>".to_vec(), b"/OCMD".to_vec()],
+    ));
+}
+
 /// An invisible OCR-style text layer drawn in a Type3 font (what the OCR output writes for
 /// characters beyond WinAnsi) is redacted like any other text: its glyphs are hit-tested by
 /// their real advances, removed, and the verifier passes.
@@ -6589,6 +6781,78 @@ fn a_type3_text_layer_is_redacted_like_any_other() {
     assert_eq!(under(&mut doc, 0, &[[98.0, 96.0, 112.0, 110.0]]), 0, "nothing is left under the mark");
 }
 
+#[test]
+fn a_mark_whose_subtype_is_an_indirect_name_is_applied() {
+    // `/Subtype` may be an indirect reference (ISO 32000-2 §7.3.10); the audit reads it that way.
+    // Passing over the mark would leave the text under it while the others report success.
+    let objs: Vec<Vec<u8>> = vec![
+        b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> /Annots [7 0 R] >>".to_vec(),
+        stream("", b"BT /F1 10 Tf 20 20 Td (SECRET) Tj ET"),
+        FONT.replace("95 0 R", "6 0 R").into_bytes(),
+        widths(),
+        b"<< /Type /Annot /Subtype 8 0 R /Rect [10 10 90 40] >>".to_vec(),
+        b"/Redact".to_vec(),
+    ];
+    let mut doc = pdf(objs);
+    assert_eq!(marks(&doc).len(), 1, "the mark is found");
+    let r = apply(&mut doc, None).unwrap();
+    assert_eq!(r.marks, 1);
+    assert!(r.glyphs >= 6, "the text under the mark went: {r:?}");
+    assert!(marks(&doc).is_empty(), "the mark itself went");
+}
+
+#[test]
+fn a_mark_written_in_place_with_an_indirect_subtype_is_refused() {
+    let objs: Vec<Vec<u8>> = vec![
+        b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 4 0 R /Annots [<< /Type /Annot /Subtype 5 0 R /Rect [10 10 70 40] >>] >>"
+            .to_vec(),
+        stream("", b"BT ET"),
+        b"/Redact".to_vec(),
+    ];
+    let mut doc = pdf(objs);
+    mark(&mut doc, 0, &[[100.0, 100.0, 120.0, 120.0]], "");
+    assert!(matches!(apply(&mut doc, None), Err(RedactError::UnreadableMark(1))));
+}
+
+#[test]
+fn annotations_written_in_place_go_when_covered_or_hanging_off_a_removed_one() {
+    // `/Annots` may hold dictionaries rather than references. One under the mark, a reply to a
+    // removed highlight on the same page and on another, and a reply to that inline comment's
+    // pop-up must all go; an inline comment elsewhere stays.
+    let objs: Vec<Vec<u8>> = vec![
+        b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R 4 0 R] /Count 2 >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 5 0 R /Annots [6 0 R \
+          << /Type /Annot /Subtype /Text /Rect [30 15 40 25] /Contents (INLINE-UNDER) /Popup 7 0 R >> \
+          << /Type /Annot /Subtype /Text /Rect [250 250 270 270] /IRT 6 0 R /Contents (INLINE-REPLY) >> \
+          << /Type /Annot /Subtype /Text /Rect [250 100 270 120] /Contents (INLINE-KEPT) >> 7 0 R] >>"
+            .to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 5 0 R /Annots [\
+          << /Type /Annot /Subtype /Text /Rect [250 250 270 270] /IRT 6 0 R /Contents (OTHER-PAGE-INLINE-REPLY) >> \
+          << /Type /Annot /Subtype /Text /Rect [200 200 220 220] /IRT 7 0 R /Contents (POPUP-INLINE-REPLY) >>] >>"
+            .to_vec(),
+        stream("", b"BT ET"),
+        b"<< /Type /Annot /Subtype /Highlight /Rect [20 20 60 30] /QuadPoints [20 30 60 30 20 20 60 20] /Contents (HIGHLIGHT-NOTE) >>".to_vec(),
+        b"<< /Type /Annot /Subtype /Popup /Rect [200 150 290 190] /Contents (INLINE-POPUP) >>".to_vec(),
+    ];
+    let mut doc = pdf(objs);
+    mark(&mut doc, 0, &[[10.0, 10.0, 70.0, 40.0]], "");
+    let r = apply(&mut doc, None).unwrap();
+    assert_eq!(r.annotations, 5, "the highlight, the inline comment and the three replies: {r:?}");
+    let pages = pdfcraft_model::pages(&doc);
+    assert_eq!(annots_of(&doc, &pages[0].dict).len(), 1, "only the inline comment elsewhere stays");
+    assert!(annots_of(&doc, &pages[1].dict).is_empty(), "the replies leave page 2");
+    let bytes = write_full(&doc, &SaveOptions { object_streams: false, ..SaveOptions::default() }).unwrap();
+    for gone in [&b"HIGHLIGHT-NOTE"[..], b"INLINE-UNDER", b"INLINE-REPLY", b"OTHER-PAGE-INLINE-REPLY", b"POPUP-INLINE-REPLY", b"INLINE-POPUP"] {
+        assert!(!bytes.windows(gone.len()).any(|w| w == gone), "{} survived the save", String::from_utf8_lossy(gone));
+    }
+    assert!(bytes.windows(11).any(|w| w == b"INLINE-KEPT"));
+}
+
 #[test]
 fn a_rewritten_form_xobject_drops_the_source_text_of_added_content() {
     // A form drawing invisible text whose dictionary repeats it in /PCAdded.
@@ -6615,6 +6879,49 @@ fn a_redacted_form_xobject_drops_the_source_text_of_added_content() {
     assert!(!bytes.windows(4).any(|w| w == b"1234"), "redacted text left in the saved file");
 }
 
+#[test]
+fn an_inline_widget_takes_its_field_even_with_no_referenced_widget() {
+    // The field's only widget is written in place in `/Annots`, so no referenced widget names it:
+    // the field (and its value) must still go with the widget under the mark.
+    let objs: Vec<Vec<u8>> = vec![
+        b"<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [6 0 R] >> >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 4 0 R /Annots [<< /Type /Annot /Subtype /Widget /Rect [20 20 60 30] /Parent 6 0 R >>] >>"
+            .to_vec(),
+        stream("", b"BT ET"),
+        b"<< >>".to_vec(),
+        b"<< /FT /Tx /T (name) /V (FIELD-SECRET) >>".to_vec(),
+    ];
+    let mut doc = pdf(objs);
+    mark(&mut doc, 0, &[[10.0, 10.0, 70.0, 40.0]], "");
+    let r = apply(&mut doc, None).unwrap();
+    assert_eq!(r.fields, 1, "{r:?}");
+    let bytes = write_full(&doc, &SaveOptions { object_streams: false, ..SaveOptions::default() }).unwrap();
+    assert!(!bytes.windows(12).any(|w| w == b"FIELD-SECRET"), "the field value survived the save");
+}
+
+#[test]
+fn an_inline_widget_of_the_field_on_another_page_goes_with_it() {
+    // Two pages: the widget under the mark, and a sibling widget in place on the second page with the
+    // same `/Parent`. Deleting the field must not leave the sibling naming it.
+    let objs: Vec<Vec<u8>> = vec![
+        b"<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [7 0 R] >> >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R 5 0 R] /Count 2 >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 4 0 R /Annots [<< /Type /Annot /Subtype /Widget /Rect [20 20 60 30] /Parent 7 0 R >>] >>"
+            .to_vec(),
+        stream("", b"BT ET"),
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 4 0 R /Annots [<< /Type /Annot /Subtype /Widget /Rect [200 200 260 230] /Parent 7 0 R >>] >>"
+            .to_vec(),
+        b"<< >>".to_vec(),
+        b"<< /FT /Tx /T (name) /V (SIBLING-SECRET) >>".to_vec(),
+    ];
+    let mut doc = pdf(objs);
+    mark(&mut doc, 0, &[[10.0, 10.0, 70.0, 40.0]], "");
+    apply(&mut doc, None).unwrap();
+    let bytes = write_full(&doc, &SaveOptions { object_streams: false, ..SaveOptions::default() }).unwrap();
+    assert!(!bytes.windows(14).any(|w| w == b"SIBLING-SECRET"), "the field value survived through the sibling widget");
+}
+
 /// Private data takes an image's prepress data too: its OPI link to the original file and its
 /// alternate images, which can be the unedited original.
 #[test]
diff --git a/crates/redact/src/tests/form_matrix.rs b/crates/redact/src/tests/form_matrix.rs
new file mode 100644
index 0000000000..e4bb33608e
--- /dev/null
+++ b/crates/redact/src/tests/form_matrix.rs
@@ -0,0 +1,131 @@
+//! A form's `/Matrix` places what it draws. The redaction walk reads it as the proof does, the
+//! array and each entry direct or by reference: read as the identity, a form moved onto a mark
+//! was tested against the wrong place, never walked, and its text stayed.
+
+use super::*;
+
+/// One page drawing a form with resources of its own, whose content shows SECRET at (20, 60) in a
+/// `/BBox` of [0 0 300 100], with `matrix` in its dictionary; object 8 is `extra`.
+fn moved_form(matrix: &str, extra: &[u8]) -> Document {
+    one_page(
+        b"/Fm Do",
+        "/XObject << /Fm 7 0 R >>",
+        vec![
+            stream(
+                &format!("/Type /XObject /Subtype /Form /BBox [0 0 300 100] {matrix} /Resources << /Font << /F1 5 0 R >> >>"),
+                b"BT /F1 10 Tf 20 60 Td (SECRET) Tj ET",
+            ),
+            extra.to_vec(),
+        ],
+    )
+}
+
+/// Over the top third of the 300 × 300 page, where a move of 200 puts the text.
+const MARK: [f64; 4] = [0.0, 200.0, 300.0, 300.0];
+
+#[test]
+fn a_form_moved_onto_a_mark_is_redacted_however_its_matrix_is_given() {
+    for (matrix, extra) in [
+        ("/Matrix [1 0 0 1 0 200]", &b"null"[..]),
+        ("/Matrix 8 0 R", b"[1 0 0 1 0 200]"),
+        ("/Matrix [1 0 0 1 0 8 0 R]", b"200"),
+        ("/Matrix [8 0 R 0 0 1 0 200]", b"1"),
+    ] {
+        let mut doc = moved_form(matrix, extra);
+        mark(&mut doc, 0, &[MARK], "");
+        assert_eq!(apply(&mut doc, None).map(|r| r.glyphs), Ok(6), "{matrix} with 8 0 obj {}", String::from_utf8_lossy(extra));
+    }
+}
+
+/// A `/Matrix` of null, given directly or by a reference to null, is no `/Matrix` (ISO 32000-2
+/// §7.3.9): the identity, under which the text lies below the mark and stays.
+#[test]
+fn a_form_whose_matrix_is_null_draws_where_it_stands() {
+    for (matrix, extra) in [("/Matrix null", &b"null"[..]), ("/Matrix 8 0 R", b"null")] {
+        let mut doc = moved_form(matrix, extra);
+        mark(&mut doc, 0, &[MARK], "");
+        assert_eq!(apply(&mut doc, None).map(|r| r.glyphs), Ok(0), "{matrix}");
+        let mut doc = moved_form(matrix, extra);
+        mark(&mut doc, 0, &[[0.0, 0.0, 300.0, 100.0]], "");
+        assert_eq!(apply(&mut doc, None).map(|r| r.glyphs), Ok(6), "{matrix}, marked where it stands");
+    }
+}
+
+/// A `/Matrix` that isn't six numbers: where the form draws can't be told, so neither can whether
+/// it reaches the mark, and the page is refused.
+#[test]
+fn a_form_whose_matrix_is_not_six_numbers_is_refused() {
+    for (matrix, extra) in [
+        ("/Matrix [1 0 0 1 0 (up)]", &b"null"[..]),
+        ("/Matrix [1 0 0 1 0]", b"null"),
+        ("/Matrix [1 0 0 1 0 8 0 R]", b"(up)"),
+        ("/Matrix 8 0 R", b"(up)"),
+    ] {
+        let mut doc = moved_form(matrix, extra);
+        mark(&mut doc, 0, &[MARK], "");
+        let result = apply(&mut doc, None);
+        assert!(
+            matches!(&result, Err(RedactError::Cos(pdfcraft_cos::CosError::Syntax { detail, .. })) if detail.contains("/Matrix")),
+            "{matrix} with 8 0 obj {}: {result:?}",
+            String::from_utf8_lossy(extra)
+        );
+    }
+}
+
+/// A reference to a reference, for the matrix or one of its entries: Poppler doesn't follow it (it
+/// reads such a matrix as the identity, such an entry as 0), the app's renderer follows it and
+/// reads the move, so where the form draws can't be told, and the page is refused, as for a matrix that isn't six numbers. Read as either,
+/// a mark where the other reader shows the text would leave it in the file.
+#[test]
+fn a_form_whose_matrix_goes_through_a_reference_to_a_reference_is_refused() {
+    for (matrix, target) in [("/Matrix [1 0 0 1 0 8 0 R]", &b"200"[..]), ("/Matrix 8 0 R", b"[1 0 0 1 0 200]")] {
+        for mark_at in [MARK, [0.0, 0.0, 300.0, 100.0]] {
+            let form = stream(
+                &format!("/Type /XObject /Subtype /Form /BBox [0 0 300 100] {matrix} /Resources << /Font << /F1 5 0 R >> >>"),
+                b"BT /F1 10 Tf 20 60 Td (SECRET) Tj ET",
+            );
+            let mut doc = one_page(b"/Fm Do", "/XObject << /Fm 7 0 R >>", vec![form, b"9 0 R".to_vec(), target.to_vec()]);
+            mark(&mut doc, 0, &[mark_at], "");
+            let result = apply(&mut doc, None);
+            assert!(
+                matches!(&result, Err(RedactError::Cos(pdfcraft_cos::CosError::Syntax { detail, .. })) if detail.contains("/Matrix")),
+                "{matrix}, 8 0 obj 9 0 R, 9 0 obj {}, mark at {mark_at:?}: {result:?}",
+                String::from_utf8_lossy(target)
+            );
+        }
+    }
+}
+
+/// The scans count such a form as content that may remain: the verify pass under a mark, and
+/// Remove Hidden Information's scan, whose removal then refuses the page.
+#[test]
+fn a_form_whose_matrix_is_not_six_numbers_counts_in_the_scans() {
+    use crate::sanitize::{Hidden, remove_hidden, scan};
+    let mut doc = moved_form("/Matrix [1 0 0 1 0 (up)]", b"null");
+    assert_eq!(under(&mut doc, 0, &[MARK]), 1);
+    let counts: std::collections::HashMap<Hidden, usize> = scan(&doc).into_iter().collect();
+    assert_eq!(counts[&Hidden::HiddenText], 1);
+    let removed = remove_hidden(&mut doc, &[Hidden::HiddenText]);
+    assert!(matches!(&removed, Err(RedactError::Cos(pdfcraft_cos::CosError::Syntax { detail, .. })) if detail.contains("/Matrix")), "{removed:?}");
+}
+
+/// Removing hidden layers alone never asks where content lands, so such a form is walked as it
+/// stands: nothing is counted or refused over it in a document without layers.
+#[test]
+fn a_form_whose_matrix_is_not_six_numbers_leaves_removing_hidden_layers_alone() {
+    use crate::sanitize::{Hidden, remove_hidden, scan};
+    let mut doc = moved_form("/Matrix [1 0 0 1 0 (up)]", b"null");
+    let counts: std::collections::HashMap<Hidden, usize> = scan(&doc).into_iter().collect();
+    assert_eq!(counts[&Hidden::HiddenLayers], 0);
+    assert_eq!(remove_hidden(&mut doc, &[Hidden::HiddenLayers]), Err(RedactError::NothingToApply));
+}
+
+/// Remove Hidden Information reads it the same way: text a matrix entry by reference moves off the
+/// page is hidden text, and goes.
+#[test]
+fn text_a_matrix_entry_by_reference_moves_off_the_page_is_hidden_text() {
+    use crate::sanitize::{Hidden, remove_hidden};
+    let mut doc = moved_form("/Matrix [1 0 0 1 0 8 0 R]", b"1000");
+    let removed = remove_hidden(&mut doc, &[Hidden::HiddenText]);
+    assert!(removed.as_ref().is_ok_and(|r| r.iter().any(|(h, n)| *h == Hidden::HiddenText && *n > 0)), "{removed:?}");
+}
diff --git a/crates/redact/src/tests/operands_from_the_end.rs b/crates/redact/src/tests/operands_from_the_end.rs
new file mode 100644
index 0000000000..0c802763e9
--- /dev/null
+++ b/crates/redact/src/tests/operands_from_the_end.rs
@@ -0,0 +1,340 @@
+//! An operator takes its operands from the end, as the renderer reads them, and a surplus before
+//! them is ignored: `(x) /OC /MC0 BDC` marks a layer's block, `(x) /GS1 gs` selects `/GS1`. Read
+//! from the front, the surplus stood in for the operands, and what they named went unseen.
+
+use super::*;
+
+/// Hidden-layer text in a block whose tag and property list follow a string: Remove Hidden
+/// Information found nothing to remove, and the text stayed.
+#[test]
+fn a_hidden_layers_block_after_a_surplus_operand_is_removed() {
+    use crate::sanitize::{Hidden, remove_hidden};
+    let mut doc = one_page(
+        b"(x) /OC /MC0 BDC BT /F1 10 Tf 20 260 Td (LAYERSECRET) Tj ET EMC BT /F1 10 Tf 20 20 Td (PUBLIC) Tj ET",
+        "/Properties << /MC0 7 0 R >>",
+        vec![b"<< /Type /OCG /Name (Hidden) >>".to_vec()],
+    );
+    doc.update_dict(ObjRef::new(1, 0), |d| {
+        d.set(
+            b"OCProperties".to_vec(),
+            Object::Dict(Dict::from_iter([
+                (b"OCGs".to_vec(), Object::Array(vec![Object::Ref(ObjRef::new(7, 0))])),
+                (b"D".to_vec(), Object::Dict(Dict::from_iter([(b"OFF".to_vec(), Object::Array(vec![Object::Ref(ObjRef::new(7, 0))]))]))),
+            ])),
+        );
+    })
+    .unwrap();
+    let removed = remove_hidden(&mut doc, &[Hidden::HiddenLayers]);
+    assert!(removed.as_ref().is_ok_and(|r| r.iter().any(|(h, n)| *h == Hidden::HiddenLayers && *n > 0)), "{removed:?}");
+    let c = content(&doc, 0);
+    assert!(!c.contains("LAYERSECRET") && c.contains("PUBLIC"), "{c}");
+}
+
+/// Paint under a mark named by `/ActualText` in a block after a surplus operand: the name, which
+/// would still read the word, kept it.
+#[test]
+fn actual_text_after_a_surplus_operand_goes_with_the_paint_it_names() {
+    let mut doc = one_page(b"(x) /Span <</ActualText (SECRET)>> BDC 100 100 m 160 100 l 160 120 l 100 120 l h f EMC", "", vec![]);
+    mark(&mut doc, 0, &[[90.0, 95.0, 130.0, 125.0]], "");
+    let r = apply(&mut doc, None).unwrap();
+    assert_eq!(r.paths_removed, 1);
+    let c = content(&doc, 0);
+    assert!(!c.contains("SECRET"), "{c}");
+}
+
+/// A tagged paragraph whose `MCID` follows a surplus operand: its structure element kept the
+/// removed text in `/ActualText` and `/Alt`.
+#[test]
+fn a_tag_after_a_surplus_operand_loses_what_redaction_removed() {
+    let content = b"(x) /P <</MCID 0>> BDC BT /F1 10 Tf 10 200 Td (SECRET) Tj ET EMC";
+    let mut doc = pdf(vec![
+        b"<< /Type /Catalog /Pages 2 0 R /StructTreeRoot 7 0 R /MarkInfo << /Marked true >> >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 4 0 R /StructParents 0 /Resources << /Font << /F1 5 0 R >> >> >>".to_vec(),
+        stream("", content),
+        FONT.replace("95 0 R", "6 0 R").into_bytes(),
+        widths(),
+        b"<< /Type /StructTreeRoot /K 8 0 R >>".to_vec(),
+        b"<< /S /Document /P 7 0 R /K [9 0 R] >>".to_vec(),
+        b"<< /S /P /P 8 0 R /Pg 3 0 R /ActualText (SECRET) /Alt (the secret) /K 0 >>".to_vec(),
+    ]);
+    mark(&mut doc, 0, &[[5.0, 195.0, 60.0, 212.0]], "");
+    assert_eq!(apply(&mut doc, None).unwrap().tags, 1);
+    let secret = doc.get(ObjRef::new(9, 0)).as_dict().cloned().unwrap();
+    assert!(secret.get(b"ActualText").is_none() && secret.get(b"Alt").is_none(), "{secret:?}");
+}
+
+/// A property list still drawn with, named after a surplus operand, stays in the page's resources
+/// when the redaction cleans them; read from the front, it was taken for unused and retired.
+#[test]
+fn a_property_list_named_after_a_surplus_operand_is_kept() {
+    let mut doc = one_page(
+        b"BT /F1 10 Tf 20 260 Td (SECRET) Tj ET (x) /Span /Pr1 BDC BT /F1 10 Tf 20 20 Td (KEPT) Tj ET EMC",
+        "/Properties << /Pr1 << /Lang (en-GB) >> >>",
+        vec![],
+    );
+    mark(&mut doc, 0, &[[0.0, 200.0, 300.0, 300.0]], "");
+    assert_eq!(apply(&mut doc, None).unwrap().glyphs, 6);
+    let page = pdfcraft_model::pages(&doc).swap_remove(0);
+    let res = page.dict.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned()).unwrap_or_default();
+    let props = res.get(b"Properties").map(|p| doc.resolve(p)).and_then(|p| p.as_dict().cloned()).unwrap_or_default();
+    assert!(props.contains(b"Pr1"), "{res:?}");
+}
+
+/// A font set only by an ExtGState selected after a surplus operand: read from the front, no font
+/// was set, every glyph stood at the start of the line with no size, and a mark over the end of
+/// the word removed nothing.
+#[test]
+fn a_font_from_an_extgstate_selected_after_a_surplus_operand_places_the_text() {
+    let mut doc = one_page(b"BT (x) /GS1 gs 20 260 Td (SECRET) Tj ET", "/ExtGState << /GS1 << /Font [5 0 R 10] >> >>", vec![]);
+    // Over the last two glyphs, E and T at x = 40 to 50.
+    mark(&mut doc, 0, &[[42.0, 255.0, 55.0, 275.0]], "");
+    assert_eq!(apply(&mut doc, None).unwrap().glyphs, 2);
+}
+
+/// `/Pattern cs` after a surplus operand, once the pattern's paint under the mark went: it selects
+/// the Pattern space and keeps the pattern, so the fill after it still counts as painting with it
+/// and the pattern stays. Read from the front, the surplus cleared the pattern, which was pruned.
+/// A grey space clears it.
+#[test]
+fn a_pattern_space_selected_after_a_surplus_operand_keeps_the_pattern() {
+    for (space, pruned) in [("(x) /Pattern", 0), ("/Pattern", 0), ("(x) /DeviceGray", 1)] {
+        let mut doc = one_page(
+            format!("/Pattern cs /P0 scn 10 260 20 20 re f {space} cs 200 20 50 50 re f").as_bytes(),
+            "/Pattern << /P0 7 0 R >>",
+            vec![stream("/PatternType 1 /PaintType 1 /TilingType 1 /BBox [0 0 10 10] /XStep 10 /YStep 10 /Resources << >>", b"0 0 5 5 re f")],
+        );
+        mark(&mut doc, 0, &[[0.0, 250.0, 40.0, 290.0]], "");
+        let r = apply(&mut doc, None).unwrap();
+        assert_eq!((r.paths_removed, r.patterns_removed), (1, pruned), "{space}");
+    }
+}
+
+/// A Type 3 font selected after a surplus operand, outside the mark, whose glyph selects an
+/// ExtGState, a colour space, a property list and a font after one too: the cleanups after the
+/// walk took the font for undrawn and those for unused. All stay, with the glyph.
+#[test]
+fn a_type3_font_and_its_glyphs_resources_named_after_a_surplus_operand_are_kept() {
+    let mut doc = pdf(vec![
+        b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 4 0 R /Resources << /Font << /F1 5 0 R /T3 7 0 R >> >> >>".to_vec(),
+        stream("", b"BT /F1 10 Tf 20 260 Td (SECRET) Tj ET BT (x) /T3 12 Tf 20 20 Td (a) Tj ET"),
+        FONT.replace("95 0 R", "6 0 R").into_bytes(),
+        widths(),
+        b"<< /Type /Font /Subtype /Type3 /FontBBox [0 0 10 10] /FontMatrix [0.1 0 0 0.1 0 0] /CharProcs << /a 8 0 R >> \
+           /Encoding << /Differences [97 /a] >> /FirstChar 97 /LastChar 97 /Widths [10] /Resources << /ExtGState << /GS0 << /CA 0.5 >> >> \
+           /ColorSpace << /CS0 /DeviceGray >> /Properties << /P0 << >> >> /Font << /F0 5 0 R >> >> >>"
+            .to_vec(),
+        stream("", b"10 0 d0 (x) /GS0 gs (x) /CS0 cs (x) /Span /P0 BDC 0 0 10 10 re f EMC BT (x) /F0 1 Tf ET"),
+    ]);
+    mark(&mut doc, 0, &[[0.0, 200.0, 300.0, 300.0]], "");
+    assert_eq!(apply(&mut doc, None).unwrap().glyphs, 6);
+    let page = pdfcraft_model::pages(&doc).swap_remove(0);
+    let res = page.dict.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned()).unwrap_or_default();
+    let fonts = res.get(b"Font").map(|f| doc.resolve(f)).and_then(|f| f.as_dict().cloned()).unwrap_or_default();
+    let font = fonts.get(b"T3").map(|f| doc.resolve(f)).and_then(|f| f.as_dict().cloned());
+    let font = font.unwrap_or_else(|| panic!("the drawn Type 3 font stays: {fonts:?}"));
+    let procs = font.get(b"CharProcs").map(|p| doc.resolve(p)).and_then(|p| p.as_dict().cloned()).unwrap_or_default();
+    assert!(procs.contains(b"a"), "its glyph stays: {font:?}");
+    let font_res = font.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned()).unwrap_or_default();
+    let states = font_res.get(b"ExtGState").map(|s| doc.resolve(s)).and_then(|s| s.as_dict().cloned()).unwrap_or_default();
+    assert!(states.contains(b"GS0"), "the ExtGState its glyph selects stays: {font_res:?}");
+    for (kind, name) in [(&b"ColorSpace"[..], &b"CS0"[..]), (b"Properties", b"P0"), (b"Font", b"F0")] {
+        let held = font_res.get(kind).map(|d| doc.resolve(d)).and_then(|d| d.as_dict().cloned()).unwrap_or_default();
+        assert!(held.contains(name), "the {} its glyph uses stays: {font_res:?}", String::from_utf8_lossy(name));
+    }
+}
+
+/// A tagged paragraph whose `TJ` after a surplus operand still draws once the mark has removed the
+/// word beside it: read from the front, that `TJ` drew nothing, the paragraph was taken for empty,
+/// and its structure element lost the content the page still shows.
+#[test]
+fn a_tagged_tj_after_a_surplus_operand_still_draws() {
+    let content = b"/P <</MCID 0>> BDC BT /F1 10 Tf 10 200 Td (SECRET) Tj 10 -100 Td (x) [(KEPT)] TJ ET EMC";
+    let mut doc = pdf(vec![
+        b"<< /Type /Catalog /Pages 2 0 R /StructTreeRoot 7 0 R /MarkInfo << /Marked true >> >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 4 0 R /StructParents 0 /Resources << /Font << /F1 5 0 R >> >> >>".to_vec(),
+        stream("", content),
+        FONT.replace("95 0 R", "6 0 R").into_bytes(),
+        widths(),
+        b"<< /Type /StructTreeRoot /K 8 0 R >>".to_vec(),
+        b"<< /S /Document /P 7 0 R /K [9 0 R] >>".to_vec(),
+        b"<< /S /P /P 8 0 R /Pg 3 0 R /K 0 >>".to_vec(),
+    ]);
+    mark(&mut doc, 0, &[[5.0, 195.0, 60.0, 212.0]], "");
+    assert_eq!(apply(&mut doc, None).unwrap().glyphs, 6);
+    let paragraph = doc.get(ObjRef::new(9, 0)).as_dict().cloned().unwrap();
+    assert_eq!(paragraph.get(b"K").and_then(Object::as_int), Some(0), "it still tags what the page shows: {paragraph:?}");
+}
+
+/// A path's points follow a surplus number: read from the front, each point was shifted by one,
+/// so a square under the mark was placed beside it and kept, and one beside the mark was placed
+/// under it and removed.
+#[test]
+fn a_paths_points_after_a_surplus_number_are_where_the_renderer_draws_them() {
+    let under = b"0 0 1 rg 9 100 100 m 9 140 100 l 9 140 140 l 9 100 140 l h f 9 100 100 m 9 140 140 l S".as_slice();
+    let mut doc = one_page(under, "", vec![]);
+    mark(&mut doc, 0, &[[90.0, 90.0, 150.0, 150.0]], "");
+    assert_eq!(apply(&mut doc, None).unwrap().paths_removed, 2, "both paths under the mark go");
+    let beside =
+        b"0 0 1 rg 0 200 200 m 250 200 l 250 250 l 200 250 l h f 0 200 200 m 210 210 220 220 230 230 c 240 240 250 250 v 200 250 200 260 y h f"
+            .as_slice();
+    let mut doc = one_page(beside, "", vec![]);
+    mark(&mut doc, 0, &[[0.0, 0.0, 20.0, 20.0]], "");
+    assert_eq!(apply(&mut doc, None).unwrap().paths_removed, 0, "the paths beside the mark stay");
+    // Curves whose points, after a surplus, reach under the mark.
+    for curve in [&b"200 200 m 9 10 10 12 12 15 15 c f"[..], b"200 200 m 9 10 10 15 15 v f", b"200 200 m 9 10 10 15 15 y f"] {
+        let mut doc = one_page(curve, "", vec![]);
+        mark(&mut doc, 0, &[[0.0, 0.0, 20.0, 20.0]], "");
+        assert_eq!(apply(&mut doc, None).unwrap().paths_removed, 1, "{}", String::from_utf8_lossy(curve));
+    }
+    // A line, and curves, from a point beside the mark whose points, after a surplus, stay beside
+    // it: read from the front, the surplus was a point under it.
+    for curve in [
+        &b"100 100 500 m 510 510 l S"[..],
+        b"500 500 m 100 100 510 l S",
+        b"100 500 m 100 100 500 110 500 120 500 c f",
+        b"100 500 m 100 110 500 120 500 v f",
+        b"100 500 m 100 110 500 120 500 y f",
+    ] {
+        let mut doc = one_page(curve, "", vec![]);
+        mark(&mut doc, 0, &[[90.0, 90.0, 150.0, 150.0]], "");
+        assert_eq!(apply(&mut doc, None).unwrap().paths_removed, 0, "{}", String::from_utf8_lossy(curve));
+    }
+}
+
+/// An `MCID` given by reference: in a named property list, and in a structure element's `/MCR`.
+/// Read directly, it was missed, and the element kept the removed text.
+#[test]
+fn an_mcid_given_by_reference_loses_what_redaction_removed() {
+    for (content, properties, kid) in [
+        (b"/P /MC0 BDC BT /F1 10 Tf 10 200 Td (SECRET) Tj ET EMC".as_slice(), "/Properties << /MC0 << /MCID 10 0 R >> >>", "0"),
+        (b"/P <</MCID 0>> BDC BT /F1 10 Tf 10 200 Td (SECRET) Tj ET EMC", "", "<< /Type /MCR /Pg 3 0 R /MCID 10 0 R >>"),
+    ] {
+        let mut doc = pdf(vec![
+            b"<< /Type /Catalog /Pages 2 0 R /StructTreeRoot 7 0 R /MarkInfo << /Marked true >> >>".to_vec(),
+            b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
+            format!("<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 4 0 R /StructParents 0 /Resources << /Font << /F1 5 0 R >> {properties} >> >>").into_bytes(),
+            stream("", content),
+            FONT.replace("95 0 R", "6 0 R").into_bytes(),
+            widths(),
+            b"<< /Type /StructTreeRoot /K 8 0 R >>".to_vec(),
+            b"<< /S /Document /P 7 0 R /K [9 0 R] >>".to_vec(),
+            format!("<< /S /P /P 8 0 R /Pg 3 0 R /ActualText (SECRET) /Alt (the SECRET) /K {kid} >>").into_bytes(),
+            b"0".to_vec(),
+        ]);
+        mark(&mut doc, 0, &[[5.0, 195.0, 60.0, 212.0]], "");
+        assert_eq!(apply(&mut doc, None).unwrap().tags, 1, "{properties}{kid}");
+        let secret = doc.get(ObjRef::new(9, 0)).as_dict().cloned().unwrap();
+        assert!(secret.get(b"ActualText").is_none() && secret.get(b"Alt").is_none(), "{secret:?}");
+    }
+    // An `/MCR` naming the same MCID in a form's stream (`/Stm`) is other content: it stays.
+    let mut doc = pdf(vec![
+        b"<< /Type /Catalog /Pages 2 0 R /StructTreeRoot 7 0 R /MarkInfo << /Marked true >> >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 4 0 R /StructParents 0 /Resources << /Font << /F1 5 0 R >> >> >>".to_vec(),
+        stream("", b"/P <</MCID 0>> BDC BT /F1 10 Tf 10 200 Td (SECRET) Tj ET EMC"),
+        FONT.replace("95 0 R", "6 0 R").into_bytes(),
+        widths(),
+        b"<< /Type /StructTreeRoot /K 8 0 R >>".to_vec(),
+        b"<< /S /Document /P 7 0 R /K [9 0 R] >>".to_vec(),
+        b"<< /S /P /P 8 0 R /Pg 3 0 R /ActualText (FORMTEXT) /K << /Type /MCR /Pg 3 0 R /Stm 11 0 R /MCID 10 0 R >> >>".to_vec(),
+        b"0".to_vec(),
+        stream("/Type /XObject /Subtype /Form /BBox [0 0 300 300]", b"/P <</MCID 0>> BDC EMC"),
+    ]);
+    mark(&mut doc, 0, &[[5.0, 195.0, 60.0, 212.0]], "");
+    apply(&mut doc, None).unwrap();
+    let other = doc.get(ObjRef::new(9, 0)).as_dict().cloned().unwrap();
+    assert!(other.get(b"ActualText").is_some(), "{other:?}");
+}
+
+/// The resources of page `page`, resolved.
+fn resources_of(doc: &Document, page: usize) -> Dict {
+    let page = pdfcraft_model::pages(doc).swap_remove(page);
+    page.dict.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned()).unwrap_or_default()
+}
+
+/// `dict`'s dictionary `key`, resolved.
+fn dict_in(doc: &Document, dict: &Dict, key: &[u8]) -> Dict {
+    dict.get(key).map(|d| doc.resolve(d)).and_then(|d| d.as_dict().cloned()).unwrap_or_default()
+}
+
+/// A property list a second page sharing the resources names after a surplus operand, once the
+/// first page's block that named it was redacted: read from the front, the second page's name went
+/// unseen and the list was retired from under it.
+#[test]
+fn a_property_list_another_page_names_after_a_surplus_operand_is_kept() {
+    use pdfcraft_cos::Stream;
+    let mut doc = one_page(
+        b"/Span /P0 BDC BT /F1 10 Tf 10 200 Td (SECRET) Tj ET EMC",
+        "/Properties << /P0 7 0 R >>",
+        vec![b"<< /ActualText (SECRET) >>".to_vec()],
+    );
+    let shared = doc.add(Object::Dict(resources_of(&doc, 0)));
+    doc.update_dict(ObjRef::new(3, 0), |d| d.set(b"Resources".to_vec(), Object::Ref(shared))).unwrap();
+    let mut second = doc.get(ObjRef::new(3, 0)).as_dict().cloned().unwrap();
+    let contents = doc.add(Object::Stream(Stream::from_raw(Dict::new(), b"(x) /Span /P0 BDC BT /F1 10 Tf 10 100 Td (Other) Tj ET EMC".to_vec())));
+    second.set(b"Contents".to_vec(), Object::Ref(contents));
+    let second = doc.add(Object::Dict(second));
+    doc.update_dict(ObjRef::new(2, 0), |d| {
+        d.set(b"Kids".to_vec(), Object::Array(vec![Object::Ref(ObjRef::new(3, 0)), Object::Ref(second)]));
+        d.set(b"Count".to_vec(), Object::Int(2));
+    })
+    .unwrap();
+    mark(&mut doc, 0, &[[5.0, 195.0, 60.0, 212.0]], "");
+    apply(&mut doc, Some(&[0])).unwrap();
+    let properties = dict_in(&doc, &resources_of(&doc, 1), b"Properties");
+    assert!(properties.contains(b"P0"), "the second page's property list stays: {properties:?}");
+}
+
+/// A Type 3 font set only by an ExtGState's `/Font`, selected after a surplus operand: read from the
+/// front, the cleanups took it for undrawn, dropped it from the page and unlinked its glyph.
+#[test]
+fn a_type3_font_an_extgstate_selects_after_a_surplus_operand_is_kept() {
+    let mut doc = pdf(vec![
+        b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 4 0 R /Resources << /Font << /F1 5 0 R /T3 7 0 R >> /ExtGState << /GS1 << /Font [7 0 R 12] >> >> >> >>".to_vec(),
+        stream("", b"BT /F1 10 Tf 20 260 Td (SECRET) Tj ET BT (x) /GS1 gs 20 20 Td (a) Tj ET"),
+        FONT.replace("95 0 R", "6 0 R").into_bytes(),
+        widths(),
+        b"<< /Type /Font /Subtype /Type3 /FontBBox [0 0 10 10] /FontMatrix [0.1 0 0 0.1 0 0] /CharProcs << /a 8 0 R /b 9 0 R >> \
+           /Encoding << /Differences [97 /a /b] >> /FirstChar 97 /LastChar 98 /Widths [10 10] >>"
+            .to_vec(),
+        stream("", b"10 0 d0 0 0 10 10 re f"),
+        stream("", b"10 0 d0 0 0 5 5 re f"),
+    ]);
+    mark(&mut doc, 0, &[[0.0, 200.0, 300.0, 300.0]], "");
+    assert_eq!(apply(&mut doc, None).unwrap().glyphs, 6);
+    let fonts = dict_in(&doc, &resources_of(&doc, 0), b"Font");
+    assert!(fonts.contains(b"T3"), "the page still lists the font: {fonts:?}");
+    let font = doc.get(ObjRef::new(7, 0)).as_dict().cloned().unwrap_or_default();
+    let procs = dict_in(&doc, &font, b"CharProcs");
+    assert!(procs.contains(b"a"), "the glyph the page draws stays: {procs:?}");
+}
+
+/// A Type 3 font without resources of its own, set by an ExtGState selected after a surplus operand:
+/// its glyph paints through the page's resources, so it may paint with the page's pattern, which
+/// stays once the page's own fill with it was redacted (the text itself fills with grey). Read from the front, the font was taken
+/// for one with resources, and the pattern was pruned.
+#[test]
+fn a_type3_font_without_resources_an_extgstate_selects_after_a_surplus_operand_keeps_the_pattern() {
+    let mut doc = pdf(vec![
+        b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> /Pattern << /P0 9 0 R >> /ExtGState << /GS1 << /Font [7 0 R 12] >> >> >> >>".to_vec(),
+        stream("", b"/Pattern cs /P0 scn 10 260 20 20 re f 0 g BT (x) /GS1 gs 150 20 Td (a) Tj ET"),
+        FONT.replace("95 0 R", "6 0 R").into_bytes(),
+        widths(),
+        b"<< /Type /Font /Subtype /Type3 /FontBBox [0 0 10 10] /FontMatrix [0.1 0 0 0.1 0 0] /CharProcs << /a 8 0 R >> \
+           /Encoding << /Differences [97 /a] >> /FirstChar 97 /LastChar 97 /Widths [10] >>"
+            .to_vec(),
+        stream("", b"10 0 d0 /Pattern cs /P0 scn 0 0 10 10 re f"),
+        stream("/PatternType 1 /PaintType 1 /TilingType 1 /BBox [0 0 10 10] /XStep 10 /YStep 10 /Resources << >>", b"0 0 5 5 re f"),
+    ]);
+    mark(&mut doc, 0, &[[0.0, 250.0, 40.0, 290.0]], "");
+    let r = apply(&mut doc, None).unwrap();
+    assert_eq!((r.paths_removed, r.patterns_removed), (1, 0));
+}
diff --git a/crates/redact/src/tests/surviving_references.rs b/crates/redact/src/tests/surviving_references.rs
index 0d171b4008..bec850e302 100644
--- a/crates/redact/src/tests/surviving_references.rs
+++ b/crates/redact/src/tests/surviving_references.rs
@@ -390,6 +390,35 @@ fn type3_font_used_in_a_form_xobject_has_its_redacted_glyph_removed() {
     assert!(!full_save_holds(&doc, b"SECRET_FORM_GLYPH_PAYLOAD"), "redacted glyph program survived");
 }
 
+/// Type 3 cleanup decoded a glyph program again for every font listing it: 2 000 fonts sharing
+/// one large program read it 2 000 times. It is read once now, and the cleanup still keeps the
+/// glyph every font shows.
+#[test]
+fn a_glyph_program_many_type3_fonts_share_is_read_once() {
+    const FONTS: usize = 2_000;
+    let names: String = (0..FONTS).map(|i| format!("/T{i} {} 0 R ", 6 + i)).collect();
+    let shows: String = (0..FONTS).map(|i| format!("/T{i} 10 Tf (A) Tj ")).collect();
+    let mut objs = vec![
+        b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
+        format!("<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 4 0 R /Resources << /Font << {names}>> >> >>").into_bytes(),
+        stream("", format!("BT 10 100 Td {shows}ET").as_bytes()),
+        stream("", [b"SHARED_GLYPH ".as_slice(), &b"0 0 m 1 1 l S ".repeat(50_000)].concat()),
+    ];
+    objs.extend((0..FONTS).map(|_| {
+        b"<< /Type /Font /Subtype /Type3 /FontBBox [0 0 1000 1000] /FontMatrix [0.001 0 0 0.001 0 0] /FirstChar 65 /LastChar 65 /Widths [0] /Encoding << /Differences [65 /A] >> /CharProcs << /A 5 0 R >> >>".to_vec()
+    }));
+    let mut doc = pdf(objs);
+    // The glyphs are drawn at x 10 with no width, so a mark away from them leaves them all.
+    mark(&mut doc, 0, &[[200.0, 200.0, 250.0, 250.0]], "");
+    let started = std::time::Instant::now();
+    apply(&mut doc, None).unwrap();
+    assert!(started.elapsed() < std::time::Duration::from_secs(60), "{:?}", started.elapsed());
+    let font = doc.get(ObjRef::new(6, 0));
+    let procs = doc.resolve(font.as_dict().unwrap().get(b"CharProcs").unwrap());
+    assert!(procs.as_dict().unwrap().contains(b"A"), "the glyph every font shows was unlinked");
+}
+
 /// A Type 3 font with glyphs A (its program object 7) and B (object 8), at object 6.
 const TYPE3: &str = "<< /Type /Font /Subtype /Type3 /FontBBox [0 -200 1000 800] /FontMatrix [0.001 0 0 0.001 0 0] /FirstChar 65 /LastChar 66 /Widths [500 500] /Encoding << /Differences [65 /A /B] >> /CharProcs << /A 7 0 R /B 8 0 R >> >>";
 
@@ -783,6 +812,37 @@ fn a_type3_font_only_a_soft_mask_without_resources_selects_stays_on_the_page() {
     assert!(saved_first_page_lists_font(&doc, b"T4"), "the page no longer lists the font the soft mask selects");
 }
 
+/// The same soft mask, its ExtGState selected after a surplus operand (`(x) /GS1 gs`), which the
+/// renderer ignores: read from the front, the cleanups never read the group, and dropped the font
+/// it selects and its glyph.
+#[test]
+fn a_type3_font_only_a_soft_mask_selected_after_a_surplus_operand_selects_stays_on_the_page() {
+    let mut doc = pdf(vec![
+        b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 4 0 R /Resources 5 0 R >>".to_vec(),
+        stream("", b"BT /T3 10 Tf 10 100 Td (AC) Tj ET (x) /GS1 gs 150 150 100 100 re f"),
+        b"<< /Font << /T3 6 0 R /T4 7 0 R >> /ExtGState << /GS1 << /Type /ExtGState /SMask << /Type /Mask /S /Luminosity /G 8 0 R >> >> >> >>"
+            .to_vec(),
+        type3_abc(9),
+        type3_abc(12),
+        stream(
+            "/Type /XObject /Subtype /Form /BBox [0 0 300 300] /Group << /S /Transparency /CS /DeviceGray >>",
+            b"1 g BT /T4 40 Tf 160 180 Td (B) Tj ET",
+        ),
+        stream("", b"% REDACTED_GLYPH_A"),
+        stream("", b"% UNUSED_GLYPH_B"),
+        stream("", b"% PAGE_GLYPH_C"),
+        stream("", b"% UNUSED_T4_GLYPH_A"),
+        stream("", b"% MASK_GLYPH_B"),
+        stream("", b"% UNUSED_T4_GLYPH_C"),
+    ]);
+    mark(&mut doc, 0, &[[9.0, 95.0, 14.9, 110.0]], "");
+    assert_eq!(apply(&mut doc, None).unwrap().glyphs, 1);
+    assert!(full_save_holds(&doc, b"MASK_GLYPH_B"), "the glyph the soft mask shows was unlinked");
+    assert!(saved_first_page_lists_font(&doc, b"T4"), "the page no longer lists the font the soft mask selects");
+}
+
 /// The same group, its content behind a predictor whose `/DecodeParms` are given by reference:
 /// the page's cleanup reads it through them, and keeps the font it selects.
 #[test]
diff --git a/crates/redact/src/tests/unparsed.rs b/crates/redact/src/tests/unparsed.rs
new file mode 100644
index 0000000000..90dcb1ae47
--- /dev/null
+++ b/crates/redact/src/tests/unparsed.rs
@@ -0,0 +1,170 @@
+//! Bytes the content parser can't read are read past by the redaction walk, so text they hide (a
+//! stray `)` or `}` in a `TJ` array) is neither found nor removed, while other readers still draw
+//! it. A page whose walk meets such bytes is refused, by Apply Redactions and by Remove Hidden
+//! Information.
+
+use super::*;
+use crate::sanitize::{Hidden, remove_hidden, sanitize, scan};
+
+/// `TJ` arrays each holding a byte the parser can't read beside the text.
+const BROKEN: [&[u8]; 4] = [b"[(TAIL) ) (SECRET)] TJ", b"[(TAIL) } (SECRET)] TJ", b"[(TAILSECRET) )] TJ", b"[) (TAILSECRET)] TJ"];
+
+/// Over the top third of the 300 × 300 page.
+const MARK: [f64; 4] = [0.0, 200.0, 300.0, 300.0];
+
+/// `tj` shown in /F1 at (20, 260), under [`MARK`].
+fn shown(tj: &[u8]) -> Vec<u8> {
+    [b"BT /F1 10 Tf 20 260 Td ".as_slice(), tj, b" ET"].concat()
+}
+
+/// The only text under the mark sits in such a `TJ`: the walk finds nothing there and rewrites
+/// nothing, so it went on, and the text stayed in the file.
+#[test]
+fn text_under_a_mark_beside_bytes_the_parser_cannot_read_is_refused() {
+    for tj in BROKEN {
+        let mut doc = one_page(&shown(tj), "", vec![]);
+        mark(&mut doc, 0, &[MARK], "");
+        assert_eq!(apply(&mut doc, None), Err(RedactError::Unreadable(1)), "{}", String::from_utf8_lossy(tj));
+    }
+    // With other text on the page, outside the mark.
+    let mut doc = one_page(&[b"BT /F1 10 Tf 20 20 Td (PUBLIC) Tj ET ".as_slice(), &shown(BROKEN[0])].concat(), "", vec![]);
+    mark(&mut doc, 0, &[MARK], "");
+    assert_eq!(apply(&mut doc, None), Err(RedactError::Unreadable(1)), "beside other text");
+}
+
+/// In a stream the walk rewrites, it removed the text it could read and wrote the broken `TJ` out
+/// as `(TAIL) (SECRET) TJ`: the stray byte and the brackets went, the strings stayed.
+#[test]
+fn bytes_the_parser_cannot_read_in_a_stream_the_walk_rewrites_are_refused() {
+    for tj in BROKEN {
+        let mut doc = one_page(&[b"BT /F1 10 Tf 20 230 Td (SECRET) Tj ET ".as_slice(), &shown(tj)].concat(), "", vec![]);
+        mark(&mut doc, 0, &[MARK], "");
+        assert_eq!(apply(&mut doc, None), Err(RedactError::Unreadable(1)), "{}", String::from_utf8_lossy(tj));
+    }
+}
+
+/// A form under the mark with resources of its own, which the walk enters but doesn't rewrite:
+/// no later read of the page follows it.
+#[test]
+fn bytes_the_parser_cannot_read_in_a_form_under_a_mark_are_refused() {
+    let form = stream("/Type /XObject /Subtype /Form /BBox [0 0 300 300] /Resources << /Font << /F1 5 0 R >> >>", shown(BROKEN[0]));
+    let mut doc = one_page(b"/Fm Do", "/XObject << /Fm 7 0 R >>", vec![form]);
+    mark(&mut doc, 0, &[MARK], "");
+    assert_eq!(apply(&mut doc, None), Err(RedactError::Unreadable(1)));
+}
+
+/// A form the mark doesn't reach isn't walked: bytes in it can't hide anything under the mark, and
+/// the walk doesn't refuse the page over them. This one has resources of its own, so the check after
+/// the walk doesn't read it either (it would refuse one without), and the page is redacted.
+#[test]
+fn bytes_the_parser_cannot_read_in_a_form_away_from_the_marks_are_left() {
+    let form = stream(
+        "/Type /XObject /Subtype /Form /BBox [0 0 300 100] /Resources << /Font << /F1 5 0 R >> >>",
+        [b"BT /F1 10 Tf 20 20 Td ".as_slice(), BROKEN[0], b" ET"].concat(),
+    );
+    let mut doc = one_page(b"BT /F1 10 Tf 20 230 Td (SECRET) Tj ET /Fm Do", "/XObject << /Fm 7 0 R >>", vec![form]);
+    mark(&mut doc, 0, &[MARK], "");
+    assert_eq!(apply(&mut doc, None).unwrap().glyphs, 6);
+    assert!(!content(&doc, 0).contains("(SECRET)"));
+}
+
+/// The page sets its font only through an ExtGState `/Font` and lists no `/Font` resources, so the
+/// cleanups after the walk, which look at the listed fonts, read nothing.
+#[test]
+fn bytes_the_parser_cannot_read_on_a_page_without_font_resources_are_refused() {
+    let mut doc = pdf(vec![
+        b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents [4 0 R 5 0 R] /Resources << /ExtGState << /GS1 << /Font [6 0 R 10] >> >> >> >>"
+            .to_vec(),
+        stream("", b"BT /GS1 gs 20 230 Td (SECRET) Tj ET"),
+        stream("", b"BT /GS1 gs 20 260 Td [(TAIL) ) (SECRET)] TJ ET"),
+        FONT.replace("95 0 R", "7 0 R").into_bytes(),
+        widths(),
+    ]);
+    mark(&mut doc, 0, &[MARK], "");
+    assert_eq!(apply(&mut doc, None), Err(RedactError::Unreadable(1)));
+}
+
+/// Hidden text inside a broken `TJ` is never counted: alone, Remove Hidden Information found
+/// nothing to remove and Sanitize Document went on; beside other hidden text, the removal went on
+/// and left it. The scan now counts the page, and removing hidden text refuses it.
+#[test]
+fn hidden_text_beside_bytes_the_parser_cannot_read_is_refused() {
+    let alone = b"BT /F1 10 Tf 3 Tr 20 260 Td [(TAIL) ) (HIDDEN)] TJ ET".as_slice();
+    let beside = [b"BT /F1 10 Tf 3 Tr 20 230 Td (HIDDEN) Tj ET ".as_slice(), alone].concat();
+    for content in [alone, &beside] {
+        let label = String::from_utf8_lossy(content);
+        let doc = one_page(content, "", vec![]);
+        let counts: std::collections::HashMap<Hidden, usize> = scan(&doc).into_iter().collect();
+        assert!(counts[&Hidden::HiddenText] > 0, "{label}");
+        let mut doc = one_page(content, "", vec![]);
+        assert_eq!(remove_hidden(&mut doc, &[Hidden::HiddenText]), Err(RedactError::Unreadable(1)), "{label}");
+        let mut doc = one_page(content, "", vec![]);
+        assert_eq!(sanitize(&mut doc), Err(RedactError::Unreadable(1)), "{label}");
+    }
+    // In a form with resources of its own, which the walk enters on every page.
+    let form = stream("/Type /XObject /Subtype /Form /BBox [0 0 300 300] /Resources << /Font << /F1 5 0 R >> >>", alone);
+    let mut doc = one_page(b"/Fm Do", "/XObject << /Fm 7 0 R >>", vec![form]);
+    assert_eq!(remove_hidden(&mut doc, &[Hidden::HiddenText]), Err(RedactError::Unreadable(1)), "in a form");
+}
+
+/// Removing hidden layers alone refuses such bytes too, even in a document without
+/// `/OCProperties`: a membership dictionary (`/AllOff` of a layer that is on) still hides what it
+/// marks, for the walk as for the app's renderer. With nothing in front of `/OC`, the marked text
+/// is removed. Here a string beside a stray `}` is left in front of it, which keeps the block from
+/// the walk (it reads a `BDC`'s first operands; a string alone does so too, a matter of its own),
+/// and the stray byte has the page refused rather than the text kept.
+#[test]
+fn bytes_the_parser_cannot_read_refuse_removing_hidden_layers_alone() {
+    let marked = |before: &[u8]| {
+        let content = [before, b" /OC /MC0 BDC BT /F1 10 Tf 20 260 Td (LAYERSECRET) Tj ET EMC BT /F1 10 Tf 20 20 Td (PUBLIC) Tj ET"].concat();
+        one_page(
+            &content,
+            "/Properties << /MC0 8 0 R >>",
+            vec![b"<< /Type /OCG /Name (Layer) >>".to_vec(), b"<< /Type /OCMD /OCGs [7 0 R] /P /AllOff >>".to_vec()],
+        )
+    };
+    let mut doc = marked(b"");
+    let removed = remove_hidden(&mut doc, &[Hidden::HiddenLayers]);
+    assert!(removed.as_ref().is_ok_and(|r| r.iter().any(|(h, n)| *h == Hidden::HiddenLayers && *n > 0)), "{removed:?}");
+    assert!(!content(&doc, 0).contains("LAYERSECRET"));
+    let mut doc = marked(b"(x) }");
+    assert_eq!(remove_hidden(&mut doc, &[Hidden::HiddenLayers]), Err(RedactError::Unreadable(1)));
+}
+
+/// With form fields removed too, a field's appearance is flattened into page content and read the
+/// same way, though the scan, which runs before flattening, doesn't count it: hidden text in a
+/// broken `TJ` there refuses removing hidden text, and Sanitize Document, which went on and left it.
+/// Removing form fields alone doesn't read the content, and goes on.
+#[test]
+fn hidden_text_beside_bytes_the_parser_cannot_read_in_a_field_appearance_is_refused() {
+    let fresh = || {
+        pdf(vec![
+            b"<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [6 0 R] >> >>".to_vec(),
+            b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
+            b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> /Annots [6 0 R] >>"
+                .to_vec(),
+            stream("", b"BT /F1 10 Tf 10 230 Td (Name:) Tj ET"),
+            FONT.replace("95 0 R", "8 0 R").into_bytes(),
+            b"<< /Type /Annot /Subtype /Widget /FT /Tx /T (name) /P 3 0 R /Rect [50 225 200 240] /AP << /N 7 0 R >> >>".to_vec(),
+            stream(
+                "/Type /XObject /Subtype /Form /BBox [0 0 150 15] /Resources << /Font << /F1 5 0 R >> >>",
+                b"BT /F1 10 Tf 3 Tr 2 3 Td [(TAIL) ) (HIDDEN)] TJ ET",
+            ),
+            widths(),
+        ])
+    };
+    assert!(remove_hidden(&mut fresh(), &[Hidden::FormFields]).is_ok());
+    assert_eq!(remove_hidden(&mut fresh(), &[Hidden::FormFields, Hidden::HiddenText]), Err(RedactError::Unreadable(1)));
+    assert_eq!(sanitize(&mut fresh()), Err(RedactError::Unreadable(1)));
+}
+
+/// An inline image whose end the parser guesses, as Apply Redactions already refuses it: what
+/// follows it may not be what the page draws, so Remove Hidden Information refuses it too.
+#[test]
+fn hidden_text_beside_an_inline_image_the_renderer_cannot_end_is_refused() {
+    let page = b"BT /F1 10 Tf 3 Tr 10 100 Td (HIDDEN) Tj ET BI /W 1 /H 1 /CS /G /BPC 8 /F /AHx ID 7F".as_slice();
+    let mut doc = one_page(page, "", vec![]);
+    assert_eq!(remove_hidden(&mut doc, &[Hidden::HiddenText]), Err(RedactError::Unreadable(1)));
+}
diff --git a/crates/redact/src/tests_verify.rs b/crates/redact/src/tests_verify.rs
index 136cb2b207..6e34fba352 100644
--- a/crates/redact/src/tests_verify.rs
+++ b/crates/redact/src/tests_verify.rs
@@ -897,6 +897,119 @@ fn glyphs_are_placed_with_the_text_matrix_and_the_form_matrix() {
     assert!(proof.entries[0].detail.contains("glyph(s) still show"));
 }
 
+/// The proof reads an operator's operands from the end, as the renderer does: a surplus before
+/// them doesn't hide the text a `Tf`, `TJ` or `Do` after it draws, or the image a `Do` draws.
+#[test]
+fn the_proof_reads_operands_from_the_end() {
+    let blank = marked_content(b"BT /F1 10 Tf 10 200 Td (Public) Tj ET", Spec::default());
+    let snap = Snapshot::capture(&blank, None).unwrap();
+    let form = stream(
+        "/Type /XObject /Subtype /Form /BBox [0 0 300 300] /Resources << /Font << /F1 5 0 R >> >>",
+        b"BT /F1 10 Tf 10 100 Td (SECRETVALUE) Tj ET",
+    );
+    let image = stream("/Type /XObject /Subtype /Image /Width 1 /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8", b"o");
+    let image_form =
+        stream("/Type /XObject /Subtype /Form /BBox [0 0 300 300] /Resources << /XObject << /Im1 8 0 R >> >>", b"q 50 0 0 12 10 98 cm (x) /Im1 Do Q");
+    for (content, spec) in [
+        (&b"BT (x) /F1 10 Tf 10 100 Td (SECRETVALUE) Tj ET"[..], Spec::default()),
+        // The size: text starting outside the region reaches into it only at its size.
+        (b"BT (x) /F1 10 Tf -60 100 Td (AAAAAAAAAAAAAAAAAAAAAAAAAAAA) Tj ET", Spec::default()),
+        (b"BT /F1 10 Tf 10 100 Td (x) [(SECRETVALUE)] TJ ET", Spec::default()),
+        (b"(x) /Fm1 Do", Spec { resources: "/XObject << /Fm1 7 0 R >>", extra: vec![form.clone()], ..Spec::default() }),
+        // An image under the mark, and one in a form under it.
+        (b"q 50 0 0 12 10 98 cm (x) /Im1 Do Q", Spec { resources: "/XObject << /Im1 7 0 R >>", extra: vec![image.clone()], ..Spec::default() }),
+        (b"(x) /Fm1 Do", Spec { resources: "/XObject << /Fm1 7 0 R >>", extra: vec![image_form.clone(), image.clone()], ..Spec::default() }),
+    ] {
+        let mut doc = marked_content(content, spec);
+        doc.require_full_save();
+        let proof = snap.prove(&doc, None, &ProofOptions::default());
+        assert_eq!(proof.entries[0].status, Status::Failed, "{}: {}", String::from_utf8_lossy(content), proof.to_text());
+    }
+}
+
+/// The proof reads the text state's operands from the end too. In each case the text starts outside
+/// the region and only the operand after the surplus brings a glyph into it: char spacing, word
+/// spacing, horizontal scaling, leading with `T*`, rise, and the spacing `"` sets.
+#[test]
+fn the_proof_reads_the_text_states_operands_from_the_end() {
+    let blank = marked_content(b"BT /F1 10 Tf 10 200 Td (Public) Tj ET", Spec::default());
+    let snap = Snapshot::capture(&blank, None).unwrap();
+    for content in [
+        &b"BT /F1 10 Tf -60 100 Td (x) 70 Tc (AB) Tj ET"[..],
+        b"BT /F1 10 Tf -60 100 Td (x) 70 Tw (A B) Tj ET",
+        b"BT /F1 10 Tf -60 100 Td (x) 1500 Tz (AB) Tj ET",
+        b"BT /F1 10 Tf 10 200 Td (x) 100 TL T* (A) Tj ET",
+        b"BT /F1 10 Tf 10 200 Td (x) -100 Ts (A) Tj ET",
+        b"BT /F1 10 Tf -60 100 Td (x) 0 70 (AB) \" ET",
+    ] {
+        let mut doc = marked_content(content, Spec::default());
+        doc.require_full_save();
+        let proof = snap.prove(&doc, None, &ProofOptions::default());
+        assert_eq!(proof.entries[0].status, Status::Failed, "{}: {}", String::from_utf8_lossy(content), proof.to_text());
+    }
+}
+
+/// The proof reads a path's points from the end too: a square under the region, its points after
+/// a surplus number, still paints there.
+#[test]
+fn the_proof_reads_a_paths_points_from_the_end() {
+    let blank = marked_content(b"BT /F1 10 Tf 10 200 Td (Public) Tj ET", Spec::default());
+    let snap = Snapshot::capture(&blank, None).unwrap();
+    for content in [
+        &b"0 0 1 rg 9 20 98 m 9 60 98 l 9 60 108 l 9 20 108 l h f"[..],
+        b"0 0 1 rg 9 20 98 40 10 re f",
+        // Curves from a point outside the region whose own points reach into it.
+        b"0 0 1 rg 9 200 200 m 9 20 98 40 100 60 108 c h f",
+        b"0 0 1 rg 9 200 200 m 9 20 98 60 108 v h f",
+        b"0 0 1 rg 9 200 200 m 9 20 98 60 108 y h f",
+        // A segment after a surplus, from a point outside the region.
+        b"0 0 1 rg 200 200 m 200 20 100 l h f",
+        b"0 0 1 rg 200 200 m 200 20 100 30 100 40 100 c h f",
+        b"0 0 1 rg 200 200 m 200 20 100 40 100 v h f",
+        b"0 0 1 rg 200 200 m 200 20 100 40 100 y h f",
+    ] {
+        let mut doc = marked_content(content, Spec::default());
+        doc.require_full_save();
+        let proof = snap.prove(&doc, None, &ProofOptions::default());
+        assert_eq!(proof.entries[0].status, Status::Failed, "{}: {}", String::from_utf8_lossy(content), proof.to_text());
+    }
+}
+
+/// Which font a `Tf` selects, and which strings a `TJ` shows, are read from the end too: text an
+/// undecodable font shows after a surplus operand, away from the mark, leaves the region
+/// unverifiable. Read from the front, no font was set, or no string was shown, and it passed.
+#[test]
+fn the_proof_reads_the_font_and_the_strings_from_the_end() {
+    for content in [&b"BT (x) /F2 10 Tf 10 200 Td <00410042> Tj ET"[..], b"BT /F2 10 Tf 10 200 Td (x) [<00410042>] TJ ET"] {
+        let mut doc = open(build_with(content, opaque_spec()));
+        mark(&mut doc, &[[150.0, 20.0, 200.0, 40.0]]);
+        let (_, proof) = run(&mut doc);
+        assert_eq!(proof.entries[0].status, Status::Unverifiable, "{}: {}", String::from_utf8_lossy(content), proof.to_text());
+    }
+}
+
+/// An image a Type 3 glyph (one without resources of its own, drawing through the page's) draws
+/// after a surplus operand can't be placed, as one it draws without one can't: the region is
+/// unverifiable.
+#[test]
+fn an_image_a_type3_glyph_draws_after_a_surplus_operand_is_found() {
+    let spec = Spec {
+        resources: "/Font << /F1 5 0 R /T3 7 0 R >> /XObject << /Im0 9 0 R >>",
+        extra: vec![
+            b"<< /Type /Font /Subtype /Type3 /FontBBox [0 0 10 10] /FontMatrix [0.1 0 0 0.1 0 0] /CharProcs << /a 8 0 R >> \
+               /Encoding << /Differences [97 /a] >> /FirstChar 97 /LastChar 97 /Widths [10] >>"
+                .to_vec(),
+            stream("", b"10 0 d0 (x) /Im0 Do"),
+            stream("/Type /XObject /Subtype /Image /Width 1 /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8", b"o"),
+        ],
+        ..Spec::default()
+    };
+    let mut doc = open(build_with(b"BT /F1 10 Tf 10 100 Td (SECRETVALUE) Tj ET BT /T3 12 Tf 150 20 Td (a) Tj ET", spec));
+    mark(&mut doc, &[REGION]);
+    let (_, proof) = run(&mut doc);
+    assert_eq!(proof.entries[0].status, Status::Unverifiable, "{}", proof.to_text());
+}
+
 #[test]
 fn an_ambiguous_needle_is_still_swept_outside_page_content() {
     // The word also stays on the page legitimately (so page text, the raw file and decoded
diff --git a/crates/redact/src/type3.rs b/crates/redact/src/type3.rs
index 4c3f2211e8..1817fb3c39 100644
--- a/crates/redact/src/type3.rs
+++ b/crates/redact/src/type3.rs
@@ -3,7 +3,7 @@
 use std::collections::{HashMap, HashSet};
 
 use pdfcraft_content::Pieces;
-use pdfcraft_cos::{CosError, Dict, Document, ObjRef, Object};
+use pdfcraft_cos::{CosError, DecodeBudget, Dict, Document, ObjRef, Object};
 
 use crate::{RedactError, page_streams};
 
@@ -130,6 +130,25 @@ struct UsedInGlyphs {
     properties: HashSet<Vec<u8>>,
 }
 
+impl UsedInGlyphs {
+    fn merge(&mut self, other: &UsedInGlyphs) {
+        self.xobjects.extend(other.xobjects.iter().cloned());
+        self.colorspaces.extend(other.colorspaces.iter().cloned());
+        self.patterns.extend(other.patterns.iter().cloned());
+        self.shadings.extend(other.shadings.iter().cloned());
+        self.extgstates.extend(other.extgstates.iter().cloned());
+        self.fonts.extend(other.fonts.iter().cloned());
+        self.properties.extend(other.properties.iter().cloned());
+    }
+}
+
+/// What one Type 3 cleanup reads of glyph programs: the resource names each indirect program
+/// uses, read once however many fonts share it, and one decoding allowance for all of them.
+struct GlyphReads {
+    used: HashMap<ObjRef, UsedInGlyphs>,
+    budget: DecodeBudget,
+}
+
 fn collect_used_resources_in_stream(data: &[u8], used: &mut UsedInGlyphs) -> Result<(), CosError> {
     // One operator at a time, so a glyph program of millions of them is never held whole. A byte
     // that can't be read anywhere in it still refuses, once the loop has read it all.
@@ -151,7 +170,7 @@ fn record_used(op: &pdfcraft_content::Op, used: &mut UsedInGlyphs) {
                 }
             }
             b"cs" | b"CS" => {
-                if let Some(n) = op.name(0) {
+                if let Some(n) = op.last_name() {
                     used.colorspaces.insert(n.to_vec());
                 }
             }
@@ -166,17 +185,17 @@ fn record_used(op: &pdfcraft_content::Op, used: &mut UsedInGlyphs) {
                 }
             }
             b"gs" => {
-                if let Some(n) = op.name(0) {
+                if let Some(n) = op.last_name() {
                     used.extgstates.insert(n.to_vec());
                 }
             }
             b"Tf" => {
-                if let Some(n) = op.name(0) {
+                if let Some(n) = op.name_back(1) {
                     used.fonts.insert(n.to_vec());
                 }
             }
             b"BDC" | b"DP" => {
-                if let Some(n) = op.name(1) {
+                if let Some(n) = op.last_name() {
                     used.properties.insert(n.to_vec());
                 }
             }
@@ -315,7 +334,7 @@ fn scan_content_stream(
             }
             b"gs" => {
                 apply_text_op(ctx, res, &op, &mut current_font);
-                if let Some(name) = op.name(0) {
+                if let Some(name) = op.last_name() {
                     scan_soft_mask(ctx, res, holder_ref, name, depth)?;
                 }
             }
@@ -338,12 +357,12 @@ fn scan_content_stream(
 fn apply_text_op(ctx: &mut ScanContext<'_>, res: &Dict, op: &pdfcraft_content::Op, current_font: &mut Option<FontKey>) {
     match op.op.as_slice() {
         b"Tf" => {
-            if let Some(name) = op.name(0) {
+            if let Some(name) = op.name_back(1) {
                 *current_font = resolve_font_in_res(ctx.doc, res, name).map(|(k, _)| k);
             }
         }
         b"gs" => {
-            if let Some(name) = op.name(0)
+            if let Some(name) = op.last_name()
                 && let Some((k, _)) = resolve_extgstate_font(ctx.doc, res, name)
             {
                 *current_font = Some(k);
@@ -477,7 +496,7 @@ fn add_soft_mask_ops(doc: &Document, res: &Dict, ops: &mut Vec<pdfcraft_content:
     while let Some(op) = ops.get(cursor) {
         let selected = match op.op.as_slice() {
             b"gs" => op
-                .name(0)
+                .last_name()
                 .and_then(|n| states.get(n))
                 .and_then(|s| doc.resolve(s).as_dict().and_then(|s| s.get(b"SMask").cloned()))
                 .and_then(|m| doc.resolve(&m).as_dict().and_then(|m| m.get(b"G").and_then(Object::as_ref))),
@@ -539,10 +558,19 @@ fn gs_font_object(doc: &Document, state_obj: &Object) -> Option<Object> {
     font_entry.into_iter().next()
 }
 
+/// Whether font `f` (a reference, or a font dictionary) is a Type 3 font, the only kind the font
+/// cleanup prunes: its `/Subtype` is read directly, as the cleanup's other readers read it, so one
+/// given by reference isn't recognised by any of them. Which allowance the cleanup's read is charged
+/// to, and what it prunes, both go by this.
+fn is_type3(doc: &Document, f: &Object) -> bool {
+    doc.resolve(f).as_dict().is_some_and(|d| d.name(b"Subtype") == Some(b"Type3"))
+}
+
 /// Prune Type 3 fonts from a rewritten page or form's `/Resources` dictionary if the rewritten
 /// content no longer draws any text using that font name. `page` is the page's dictionary when
 /// `res` are a page's resources. What it reads is charged to `budget`, what is left of the page's
-/// allowance.
+/// allowance, when the resources list a Type 3 font, and otherwise to an allowance of a page of its
+/// own (below).
 pub(crate) fn prune_type3_from_resources(
     doc: &Document,
     budget: &mut pdfcraft_cos::DecodeBudget,
@@ -556,12 +584,20 @@ pub(crate) fn prune_type3_from_resources(
     }
 
     // The operators of forms that draw through these resources count too: dropping a font a child
-    // form still shows would leave its text without one.
-    let mut ops = crate::interp::resource_ops(doc, budget, res, content)?;
+    // form still shows would leave its text without one. Without a Type 3 font nothing is pruned,
+    // but the read is still made: it refuses bytes the parser can't read in what the content draws,
+    // and on a page with nothing replaced and no properties listed no other check does, unless the
+    // document still lists a Type 3 font (`unlink_type3` then reads every page). The walk reads
+    // past them, so text they hide would stay under the mark. The read is then charged to an
+    // allowance of a page of its own, not to what the walk left of the page's, since it decides
+    // nothing about the fonts.
+    let type3 = fonts.iter().any(|(_, f)| is_type3(doc, f));
+    let mut own = pdfcraft_cos::DecodeBudget::page();
+    let mut ops = crate::interp::resource_ops(doc, if type3 { &mut *budget } else { &mut own }, res, content)?;
     // So do those of a page's annotation appearances, and of soft mask groups, without resources of
     // their own. They are read only when there is a Type 3 font to keep, so other files are not
     // refused over them.
-    if fonts.iter().any(|(_, f)| doc.resolve(f).as_dict().is_some_and(|d| d.name(b"Subtype") == Some(b"Type3"))) {
+    if type3 {
         if let Some(page) = page {
             // One total for all of them, as for the content: each appearance under the cap could
             // still add up to far more than it. Their decoded bytes, and their forms', are charged to
@@ -584,11 +620,11 @@ pub(crate) fn prune_type3_from_resources(
     let mut drawn_font_names = HashSet::new();
     for op in &ops {
         if op.is("Tf") {
-            if let Some(name) = op.name(0) {
+            if let Some(name) = op.name_back(1) {
                 drawn_font_names.insert(name.to_vec());
             }
         } else if op.is("gs")
-            && let Some(name) = op.name(0)
+            && let Some(name) = op.last_name()
         {
             let extg = res_dict(doc, res, b"ExtGState");
             if let Some(font_obj) = extg.get(name).and_then(|state_obj| gs_font_object(doc, state_obj)) {
@@ -605,15 +641,12 @@ pub(crate) fn prune_type3_from_resources(
     let mut changed = false;
     let font_names: Vec<Vec<u8>> = fonts.iter().map(|(n, _)| n.to_vec()).collect();
     for name in font_names {
-        if let Some(font_obj) = fonts.get(&name) {
-            let resolved = doc.resolve(font_obj);
-            if let Some(d) = resolved.as_dict()
-                && d.name(b"Subtype") == Some(b"Type3")
-                && !drawn_font_names.contains(&name)
-            {
-                fonts.remove(&name);
-                changed = true;
-            }
+        if let Some(font_obj) = fonts.get(&name)
+            && is_type3(doc, font_obj)
+            && !drawn_font_names.contains(&name)
+        {
+            fonts.remove(&name);
+            changed = true;
         }
     }
 
@@ -717,9 +750,10 @@ pub(crate) fn unlink_type3(doc: &mut Document) -> Result<(), RedactError> {
     }
 
     // For each Type 3 font: unlink unused glyphs from CharProcs and prune exclusive resources.
+    let mut reads = GlyphReads { used: HashMap::new(), budget: DecodeBudget::page() };
     for (font_key, font_dict) in &type3_fonts {
         let surviving = used_glyphs.get(font_key).cloned().unwrap_or_default();
-        clean_type3_font(doc, &holders, &form_holders, font_key, font_dict, &surviving)?;
+        clean_type3_font(doc, &holders, &form_holders, font_key, font_dict, &surviving, &mut reads)?;
     }
 
     Ok(())
@@ -794,6 +828,7 @@ fn clean_type3_font(
     font_key: &FontKey,
     font_dict: &Dict,
     surviving: &HashSet<Vec<u8>>,
+    reads: &mut GlyphReads,
 ) -> Result<(), RedactError> {
     let Some(char_procs_val) = font_dict.get(b"CharProcs") else {
         return Err(CosError::Syntax { offset: 0, detail: "redaction could not establish safe Type 3 font cleanup: missing CharProcs".into() }.into());
@@ -837,6 +872,10 @@ fn clean_type3_font(
 
     let mut used_in_glyphs = UsedInGlyphs::default();
     for (_, proc_val) in char_procs.iter() {
+        if let Some(used) = proc_val.as_ref().and_then(|r| reads.used.get(&r)) {
+            used_in_glyphs.merge(used);
+            continue;
+        }
         let resolved = doc.resolve(proc_val);
         let Object::Stream(s) = &*resolved else {
             return Err(CosError::Syntax {
@@ -845,8 +884,14 @@ fn clean_type3_font(
             }
             .into());
         };
-        let data = doc.with_direct_parms(s).decoded()?;
-        collect_used_resources_in_stream(&data, &mut used_in_glyphs)?;
+        // Past the allowance the cleanup can't be shown complete, and the redaction is refused.
+        let data = reads.budget.decode(&doc.with_direct_parms(s))?;
+        let mut used = UsedInGlyphs::default();
+        collect_used_resources_in_stream(&data, &mut used)?;
+        used_in_glyphs.merge(&used);
+        if let Some(r) = proc_val.as_ref() {
+            reads.used.insert(r, used);
+        }
     }
 
     if prune_type3_font_resources(doc, &mut f_res, &used_in_glyphs) {
diff --git a/crates/redact/src/verify/extract.rs b/crates/redact/src/verify/extract.rs
index fe92e4e78d..4c76cc6131 100644
--- a/crates/redact/src/verify/extract.rs
+++ b/crates/redact/src/verify/extract.rs
@@ -16,7 +16,7 @@ pub(super) fn carries_glyphs(op: &pdfcraft_content::Op) -> bool {
     let nonempty = |o: &Object| o.as_string().is_some_and(|s| !s.bytes.is_empty());
     match op.op.as_slice() {
         b"Tj" | b"'" | b"\"" => op.operands.last().is_some_and(nonempty),
-        b"TJ" => op.operands.first().and_then(Object::as_array).is_some_and(|a| a.iter().any(nonempty)),
+        b"TJ" => op.back(0).and_then(Object::as_array).is_some_and(|a| a.iter().any(nonempty)),
         _ => false,
     }
 }
@@ -396,17 +396,38 @@ pub(super) fn push_squashed(into: &mut String, s: &str) {
     into.extend(s.chars().filter(|c| !c.is_whitespace() && *c != '\u{feff}'));
 }
 
-/// A form's or pattern's `/Matrix`: absent is the identity, present but malformed is an error
-/// (guessing the identity would put its content in the wrong place).
-pub(super) fn matrix_of(doc: &Document, dict: &Dict) -> Result<Matrix, ()> {
-    match dict.get(b"Matrix") {
-        None => Ok(Matrix::IDENTITY),
-        Some(m) => {
-            let m = doc.resolve(m);
-            let items: Vec<Object> = m.as_array().ok_or(())?.iter().map(|x| (*doc.resolve(x)).clone()).collect();
-            Matrix::from_operands(&items).filter(|m| m.0.iter().all(|v| v.is_finite())).ok_or(())
+/// A form's or an annotation appearance's `/Matrix`, the array and each entry direct or by reference: absent or null
+/// is the identity, present but malformed is an error (guessing the identity would put its content in the
+/// wrong place). A reference to a reference is malformed here: readers disagree on following it
+/// (Poppler doesn't, the app's renderer does), so where the content draws can't be told. The
+/// redaction walk reads a form's with it too.
+pub(crate) fn matrix_of(doc: &Document, dict: &Dict) -> Result<Matrix, ()> {
+    let Some(m) = dict.get(b"Matrix") else { return Ok(Matrix::IDENTITY) };
+    // Each reference is followed one hop. The array is read in place when written directly, and
+    // its length checked before any entry is read: the walk reads it at every `Do`, and an array of
+    // any length would be copied each time.
+    let held;
+    let m = match m {
+        Object::Ref(r) => {
+            held = doc.get(*r);
+            &*held
         }
+        direct => direct,
+    };
+    // A null value is no entry (ISO 32000-2 §7.3.9), whether given directly or by reference.
+    if matches!(m, Object::Null) {
+        return Ok(Matrix::IDENTITY);
     }
+    let items = m.as_array().filter(|a| a.len() == 6).ok_or(())?;
+    let mut values = [0.0; 6];
+    for (value, item) in values.iter_mut().zip(items) {
+        let n = match item {
+            Object::Ref(r) => doc.get(*r).as_f64(),
+            direct => direct.as_f64(),
+        };
+        *value = n.filter(|n| n.is_finite()).ok_or(())?;
+    }
+    Ok(Matrix(values))
 }
 
 /// A form's `/BBox` as `[x0 y0 x1 y1]`: absent is `None`, present but malformed is an error.
@@ -552,7 +573,7 @@ impl Extractor<'_> {
         let o = op.op.as_slice();
         // Strings and TJ adjustments, in order.
         let items: Vec<&Object> = match o {
-            b"TJ" => op.operands.first().and_then(Object::as_array).map(|a| a.iter().collect()).unwrap_or_default(),
+            b"TJ" => op.back(0).and_then(Object::as_array).map(|a| a.iter().collect()).unwrap_or_default(),
             _ => op.operands.last().into_iter().collect(),
         };
         let mut any_text = false;
@@ -637,14 +658,15 @@ impl Extractor<'_> {
                     tm = Matrix::IDENTITY;
                     tlm = Matrix::IDENTITY;
                 }
-                b"Tc" => gs.tc = op.num(0).unwrap_or(0.0),
-                b"Tw" => gs.tw = op.num(0).unwrap_or(0.0),
-                b"Tz" => gs.th = op.num(0).unwrap_or(100.0) / 100.0,
-                b"TL" => gs.tl = op.num(0).unwrap_or(0.0),
-                b"Ts" => gs.rise = op.num(0).unwrap_or(0.0),
+                // Operands are read from the end, as the renderer reads them.
+                b"Tc" => gs.tc = op.num_back(0).unwrap_or(0.0),
+                b"Tw" => gs.tw = op.num_back(0).unwrap_or(0.0),
+                b"Tz" => gs.th = op.num_back(0).unwrap_or(100.0) / 100.0,
+                b"TL" => gs.tl = op.num_back(0).unwrap_or(0.0),
+                b"Ts" => gs.rise = op.num_back(0).unwrap_or(0.0),
                 b"Tf" => {
-                    gs.font = op.name(0).map(<[u8]>::to_vec).unwrap_or_default();
-                    gs.size = op.num(1).unwrap_or(0.0);
+                    gs.font = op.name_back(1).map(<[u8]>::to_vec).unwrap_or_default();
+                    gs.size = op.num_back(0).unwrap_or(0.0);
                 }
                 b"Td" | b"TD" => {
                     if let Some([x, y]) = op.nums::<2>() {
@@ -671,7 +693,7 @@ impl Extractor<'_> {
                         tm = tlm;
                     }
                     if o == b"\""
-                        && let (Some(aw), Some(ac)) = (op.num(0), op.num(1))
+                        && let (Some(aw), Some(ac)) = (op.num_back(2), op.num_back(1))
                     {
                         (gs.tw, gs.tc) = (aw, ac);
                     }
@@ -686,7 +708,7 @@ impl Extractor<'_> {
                     self.show_text(font, &op, &gs, &mut tm, placed);
                 }
                 b"Do" => {
-                    let Some(name) = op.name(0) else { continue };
+                    let Some(name) = op.last_name() else { continue };
                     let Some(entry) = xobjects.get(name) else { continue };
                     if let Object::Stream(s) = &*doc.resolve(entry)
                         && s.dict.name(b"Subtype") == Some(b"Form")
diff --git a/crates/redact/src/verify/geometry.rs b/crates/redact/src/verify/geometry.rs
index 7ea0de5699..7b6833edef 100644
--- a/crates/redact/src/verify/geometry.rs
+++ b/crates/redact/src/verify/geometry.rs
@@ -188,7 +188,7 @@ impl Geo<'_> {
                     }
                 }
                 b"Do" => {
-                    let Some(entry) = op.name(0).and_then(|n| xobjects.get(n)) else { continue };
+                    let Some(entry) = op.last_name().and_then(|n| xobjects.get(n)) else { continue };
                     let obj = self.doc.resolve(entry);
                     let Object::Stream(s) = &*obj else { continue };
                     match s.dict.name(b"Subtype") {
@@ -344,7 +344,7 @@ impl Geo<'_> {
             match op.op.as_slice() {
                 b"BI" => return Ok(true),
                 b"Do" => {
-                    let Some(entry) = op.name(0).and_then(|n| xobjects.get(n)) else { continue };
+                    let Some(entry) = op.last_name().and_then(|n| xobjects.get(n)) else { continue };
                     let Object::Stream(x) = &*self.doc.resolve(entry) else { continue };
                     match x.dict.name(b"Subtype") {
                         Some(b"Image") => return Ok(true),
@@ -372,21 +372,28 @@ impl Geo<'_> {
 /// carries) by one construction operator.
 fn extend_path(op: &pdfcraft_content::Op, ctm: &Matrix, sub: &mut Vec<Vec<(f64, f64)>>, clip: &mut Option<bool>) {
     let o = op.op.as_slice();
-    let nums: Vec<f64> = op.operands.iter().filter_map(Object::as_f64).collect();
     let at = |x: f64, y: f64| ctm.apply(x, y);
+    // Each takes its numbers from the end, as the renderer reads them: a surplus before them is
+    // ignored, not read as a point.
+    let points: Option<Vec<(f64, f64)>> = match o {
+        b"l" => op.nums::<2>().map(|[x, y]| vec![at(x, y)]),
+        b"c" => op.nums::<6>().map(|[x1, y1, x2, y2, x3, y3]| vec![at(x1, y1), at(x2, y2), at(x3, y3)]),
+        b"v" | b"y" => op.nums::<4>().map(|[x1, y1, x2, y2]| vec![at(x1, y1), at(x2, y2)]),
+        _ => None,
+    };
     match o {
         b"m" => {
-            if let [x, y] = nums[..] {
+            if let Some([x, y]) = op.nums::<2>() {
                 sub.push(vec![at(x, y)]);
             }
         }
         b"l" | b"c" | b"v" | b"y" => {
-            if let Some(cur) = sub.last_mut() {
-                cur.extend(nums.as_chunks::<2>().0.iter().map(|p| at(p[0], p[1])));
+            if let (Some(cur), Some(points)) = (sub.last_mut(), points) {
+                cur.extend(points);
             }
         }
         b"re" => {
-            if let [x, y, w, h] = nums[..] {
+            if let Some([x, y, w, h]) = op.nums::<4>() {
                 sub.push(vec![at(x, y), at(x + w, y), at(x + w, y + h), at(x, y + h)]);
             }
         }
diff --git a/crates/redact/src/verify/mod.rs b/crates/redact/src/verify/mod.rs
index 3a36c9e08e..d58d4c307c 100644
--- a/crates/redact/src/verify/mod.rs
+++ b/crates/redact/src/verify/mod.rs
@@ -70,6 +70,7 @@ mod snapshot;
 mod sweep;
 mod util;
 
+pub(crate) use extract::matrix_of;
 pub use snapshot::Snapshot;
 /// What the proof established for one region.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
diff --git a/crates/redact/tests/matrix_work.rs b/crates/redact/tests/matrix_work.rs
new file mode 100644
index 0000000000..d96447ff71
--- /dev/null
+++ b/crates/redact/tests/matrix_work.rs
@@ -0,0 +1,59 @@
+//! Work regression for a form's `/Matrix`, which the redaction walk reads at every `Do` of the
+//! form: an array of any length costs no more than one of seven entries, written directly or by
+//! reference. A test binary of its own, so that none of the crate's other tests shares its process.
+//! The test compares two timings of its own, the least of three runs each, not a fixed time.
+
+use std::sync::Arc;
+use std::time::{Duration, Instant};
+
+use pdfcraft_annot::{Meta, NewAnnotation, Shape, Style, add_annotation, rect_quad};
+use pdfcraft_cos::Document;
+use pdfcraft_redact::apply;
+use pdfcraft_testkit::{Pdf, stream_obj};
+
+/// One page drawing a form `draws` times under a mark, the form's `/Matrix` an array of `entries`
+/// zeros, written in its dictionary or, `by_reference`, as object 6.
+fn document(draws: usize, entries: usize, by_reference: bool) -> Document {
+    let zeros = format!("[{}]", vec!["0"; entries].join(" "));
+    let matrix = if by_reference { "6 0 R".to_string() } else { zeros.clone() };
+    let objs = vec![
+        b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 4 0 R /Resources << /XObject << /Fm 5 0 R >> >> >>".to_vec(),
+        stream_obj("", "/Fm Do ".repeat(draws).as_bytes()),
+        stream_obj(&format!("/Type /XObject /Subtype /Form /BBox [0 0 300 300] /Matrix {matrix}"), b"0 0 10 10 re f"),
+        zeros.into_bytes(),
+    ];
+    let mut doc = Document::open(Arc::new(Pdf::new().objs(objs).build())).unwrap();
+    let shape = Shape::Redact { quads: vec![rect_quad([0.0, 0.0, 300.0, 300.0])], overlay: String::new(), look: Default::default() };
+    let style = Style::default_for(&shape);
+    add_annotation(&mut doc, &NewAnnotation { page: 0, shape, style, contents: String::new(), author: "Synthetic test".into() }, &Meta::default())
+        .unwrap();
+    doc
+}
+
+/// How long redacting `document(draws, entries, by_reference)` takes, the least of three runs. A
+/// matrix that isn't six numbers is refused.
+fn redaction(draws: usize, entries: usize, by_reference: bool) -> Duration {
+    (0..3)
+        .map(|_| {
+            let mut doc = document(draws, entries, by_reference);
+            let start = Instant::now();
+            let refused = apply(&mut doc, None).is_err();
+            let took = start.elapsed();
+            assert!(refused, "a /Matrix of {entries} entries is refused");
+            took
+        })
+        .min()
+        .unwrap_or_default()
+}
+
+/// Written when the walk resolved and copied every entry before checking there were six: 4,000
+/// draws of a form whose `/Matrix` is 4,000 entries long read sixteen million entries.
+#[test]
+fn a_long_form_matrix_costs_no_more_than_a_short_one() {
+    for by_reference in [false, true] {
+        let (short, long) = (redaction(4_000, 7, by_reference), redaction(4_000, 4_000, by_reference));
+        assert!(long < short * 3 + Duration::from_millis(50), "by reference: {by_reference}: long {long:?}, short {short:?}");
+    }
+}
diff --git a/crates/redact/tests/operator_work.rs b/crates/redact/tests/operator_work.rs
new file mode 100644
index 0000000000..e4340fc021
--- /dev/null
+++ b/crates/redact/tests/operator_work.rs
@@ -0,0 +1,98 @@
+//! Work regressions for what a redaction looks up at operators a stream can hold thousands of: the
+//! tags cleanup's named property lists at each `BDC` are not read whole each time. A test binary of
+//! its own, so that none of the crate's other tests shares its process, and its tests run one at a
+//! time. Each test compares two timings of its own, the least of three runs each, with many
+//! entries or operators and with one, not a fixed time. The bound leaves room for slower machines:
+//! each regression took seconds against milliseconds.
+
+use std::sync::{Arc, Mutex, PoisonError};
+use std::time::{Duration, Instant};
+
+use pdfcraft_annot::{Meta, NewAnnotation, Shape, Style, add_annotation, rect_quad};
+use pdfcraft_cos::Document;
+use pdfcraft_redact::apply;
+use pdfcraft_testkit::{Pdf, stream_obj};
+
+/// One page with `resources` and `extra` objects (from object 5 on), drawing a word under a mark
+/// (so the redaction rewrites the page) and then `ops`.
+fn page(resources: &str, ops: &[u8], extra: Vec<Vec<u8>>) -> Document {
+    let content = [b"BT /F1 10 Tf 20 260 Td (SECRET) Tj ET ".as_slice(), ops].concat();
+    let mut objs = vec![
+        b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
+        format!(
+            "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 4 0 R /Resources << /Font << /F1 << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> >> {resources} >> >>"
+        )
+        .into_bytes(),
+        stream_obj("", content),
+    ];
+    objs.extend(extra);
+    let mut doc = Document::open(Arc::new(Pdf::new().objs(objs).build())).unwrap();
+    let shape = Shape::Redact { quads: vec![rect_quad([0.0, 200.0, 300.0, 300.0])], overlay: String::new(), look: Default::default() };
+    let style = Style::default_for(&shape);
+    add_annotation(&mut doc, &NewAnnotation { page: 0, shape, style, contents: String::new(), author: "Synthetic test".into() }, &Meta::default())
+        .unwrap();
+    doc
+}
+
+/// One page whose `/Properties` holds `entries` entries, drawing `ops`.
+fn properties(entries: usize, ops: &[u8]) -> Document {
+    let lists: String = (0..entries).map(|i| format!("/M{i} << /Lang (en) >> ")).collect();
+    page(&format!("/Properties << {lists}>>"), ops, Vec::new())
+}
+
+/// One page whose property list `/M0` is object 5, which gives its `MCID` as object 6 and holds
+/// 400,000 more entries: larger than the document keeps, so that reading it again parses it again,
+/// all of it, once another object has been read since. The page draws `ops`.
+fn oversized(ops: &[u8]) -> Document {
+    let more: String = (0..400_000).map(|i| format!("/J{i} /DeviceGray ")).collect();
+    page("/Properties << /M0 5 0 R >>", ops, vec![format!("<< /MCID 6 0 R {more}>>").into_bytes(), b"0".to_vec()])
+}
+
+/// The tests' lock: they run one at a time, so that none is timed while another works.
+static SERIAL: Mutex<()> = Mutex::new(());
+
+fn one_at_a_time() -> std::sync::MutexGuard<'static, ()> {
+    SERIAL.lock().unwrap_or_else(PoisonError::into_inner)
+}
+
+/// How long redacting a document `make` builds takes, the least of three runs.
+fn redaction(make: impl Fn() -> Document) -> Duration {
+    (0..3)
+        .map(|_| {
+            let mut doc = make();
+            let start = Instant::now();
+            let report = apply(&mut doc, None).unwrap();
+            let took = start.elapsed();
+            assert_eq!(report.glyphs, 6, "the word under the mark goes");
+            took
+        })
+        .min()
+        .unwrap_or_default()
+}
+
+/// Whether `many` took about as long as `one`.
+fn about_as_long(many: Duration, one: Duration) -> bool {
+    many < one * 10 + Duration::from_secs(1)
+}
+
+/// Written when the tags cleanup resolved the page's `/Properties` at every named `BDC`: 20,000 of
+/// them with 5,000 entries took 28 s against 0.07 s with one entry (optimized). Each `BDC` here
+/// names another entry, so that it is the lists, not each name's answer, that are read once.
+#[test]
+fn named_property_lists_are_read_once_for_a_page() {
+    let _serial = one_at_a_time();
+    let ops: Vec<u8> = (0..5_000).map(|i| format!("/P /M{i} BDC EMC ")).collect::<String>().into_bytes();
+    let (one, many) = (redaction(|| properties(1, &ops)), redaction(|| properties(5_000, &ops)));
+    assert!(about_as_long(many, one), "5,000 entries {many:?}, one {one:?}");
+}
+
+/// Written when the tags cleanup read a named property list's `MCID` by reference at each `BDC`: a
+/// list larger than the document keeps was parsed again at each, 50 of them taking 12.3 s against
+/// 0.44 s with the `MCID` given directly (optimized).
+#[test]
+fn an_oversized_property_list_is_read_once_for_a_stream() {
+    let _serial = one_at_a_time();
+    let (one, many) = (redaction(|| oversized(b"/P /M0 BDC EMC ")), redaction(|| oversized(&b"/P /M0 BDC EMC ".repeat(100))));
+    assert!(about_as_long(many, one), "100 operators {many:?}, one {one:?}");
+}
diff --git a/crates/render/src/inspect/annotations.rs b/crates/render/src/inspect/annotations.rs
index 7313716a2e..673d930743 100644
--- a/crates/render/src/inspect/annotations.rs
+++ b/crates/render/src/inspect/annotations.rs
@@ -144,12 +144,7 @@ impl<'a> Inspector<'a> {
                 info.attachments.push(self.attachment(fs, AttachmentSource::Annotation { page, index }, text_budget, fallback));
             }
             if subtype == "Link" {
-                if let Some(link) = self.link(page, index, d, info.uri_base.as_deref(), text_budget, &mut unfit_quads) {
-                    if matches!(&link.target, LinkTarget::Other(s) if s == "JavaScript") {
-                        info.has_javascript = true;
-                    }
-                    info.links.push(link);
-                }
+                self.collect_link(info, (page, index), d, text_budget, &mut unfit_quads);
                 continue;
             }
             // Not comments: form widgets, pop-ups and non-markup annotations such as the
@@ -161,6 +156,20 @@ impl<'a> Inspector<'a> {
             if comments_full {
                 continue;
             }
+            // Text that trims to nothing is not kept, so `retained` never sees it: charge what is
+            // read, so many comments sharing one huge blank string stop being decoded over and over.
+            let raw: usize = [&b"T"[..], b"Contents", b"M", b"NM", b"State", b"DA"]
+                .iter()
+                .filter_map(|k| match d.get(k).map(|o| self.resolve(o)) {
+                    Ok(Object::String(b, _) | Object::Name(b)) => Some(b.len()),
+                    _ => None,
+                })
+                .fold(0, usize::saturating_add);
+            // (charged once: below, by the larger of these raw bytes and what the annotation keeps)
+            if kept.saturating_add(raw) > MAX_ANNOTATION_BYTES {
+                comments_full = true;
+                continue;
+            }
             let rect = rect4(self.resolve(d.get(b"Rect").unwrap_or(&Object::Null)));
             let c = match d.get(b"C").map(|o| self.resolve(o)) {
                 Ok(Object::Array(c)) => Some(c),
@@ -262,7 +271,7 @@ impl<'a> Inspector<'a> {
                 text_box,
                 popup,
             };
-            kept = kept.saturating_add(retained(&annotation));
+            kept = kept.saturating_add(retained(&annotation).max(raw));
             if kept > MAX_ANNOTATION_BYTES {
                 comments_full = true;
                 continue;
@@ -356,6 +365,23 @@ impl<'a> Inspector<'a> {
         Some(Link { page, index, rect, quads, target })
     }
 
+    /// Lists the link annotation `d`, and notes the JavaScript it runs. JavaScript is read from the
+    /// action, not the listed link: once the text budget is spent the action's name is not kept.
+    fn collect_link(&self, info: &mut DocInfo, at: (usize, usize), d: &Dictionary, text_budget: &mut usize, unfit_quads: &mut HashSet<ObjectId>) {
+        info.has_javascript |= self.runs_javascript(d);
+        if let Some(link) = self.link(at.0, at.1, d, info.uri_base.as_deref(), text_budget, unfit_quads) {
+            if matches!(&link.target, LinkTarget::Other(s) if s == "JavaScript") {
+                info.has_javascript = true;
+            }
+            info.links.push(link);
+        }
+    }
+
+    /// Whether the link's own action is a JavaScript action.
+    fn runs_javascript(&self, d: &Dictionary) -> bool {
+        d.get(b"A").ok().and_then(|a| self.dict(a)).is_some_and(|a| self.name(a, b"S").as_deref() == Some("JavaScript"))
+    }
+
     /// What an action does when a link or a bookmark runs it. Only a go-to's `/D` is a place in
     /// this document; a remote go-to's names a page or destination of another file (ISO 32000-2
     /// §12.6.4.3). `None` for an action without a type, or a go-to whose destination is not here.
@@ -376,7 +402,7 @@ impl<'a> Inspector<'a> {
             "SetOCGState" => self.layer_state(a),
             "GoToR" => self.remote_go_to(a).unwrap_or_else(|| LinkTarget::Other("GoToR".into())),
             "Launch" => self.launch_pdf(a).unwrap_or_else(|| LinkTarget::Other("Launch".into())),
-            other => LinkTarget::Other(other.to_string()),
+            other => LinkTarget::Other(spend(other.as_bytes(), text_budget, |b| String::from_utf8_lossy(b).into_owned()).unwrap_or_default()),
         })
     }
 
@@ -492,6 +518,53 @@ impl<'a> Inspector<'a> {
 
     // ── form fields ─────────────────────────────────────────────────────────────────────────
 
+    /// Whether `o` or one of its descendants under `/Kids` carries an action (`/A` or `/AA`). It
+    /// walks the same tree `field` does, bounded the same way: a field left out of the listing for
+    /// want of text allowance can still have its action on a widget several levels down.
+    pub(super) fn has_action(&self, o: &Object, depth: u32) -> bool {
+        self.has_action_seen(o, depth, &mut HashMap::new())
+    }
+
+    /// The walk behind [`Self::has_action`]. Each indirect descendant is read again only from a
+    /// shallower depth than before (the depth limit may have cut its subtree): a field tree whose
+    /// `/Kids` repeat the same objects would otherwise be walked exponentially, and this reads each
+    /// object at most once per depth.
+    fn has_action_seen(&self, o: &Object, depth: u32, seen: &mut HashMap<ObjectId, u32>) -> bool {
+        if depth > 32 {
+            return false;
+        }
+        if let Object::Reference(id) = o {
+            if seen.get(id).is_some_and(|&first| first <= depth) {
+                return false;
+            }
+            seen.insert(*id, depth);
+        }
+        let Some(d) = self.dict(o) else { return false };
+        if self.carries_action(d) {
+            return true;
+        }
+        let kids = match d.get(b"Kids").map(|k| self.resolve(k)) {
+            Ok(Object::Array(k)) => k,
+            _ => return false,
+        };
+        kids.iter().any(|k| self.has_action_seen(k, depth + 1, seen))
+    }
+
+    /// Whether `/A` or `/AA` here holds an action. An editor can leave an empty dictionary (or
+    /// array) behind, and that is no action: a document with none must not report JavaScript. An
+    /// `/A` is an action when it carries `/S`; an `/AA` is one when an event maps to such an action.
+    fn carries_action(&self, d: &Dictionary) -> bool {
+        let action = |o: &Object| matches!(self.resolve(o), Object::Dictionary(a) if a.get(b"S").is_ok());
+        [&b"A"[..], &b"AA"[..]].iter().any(|k| match d.get(k) {
+            Ok(o) => match self.resolve(o) {
+                Object::Dictionary(x) => x.get(b"S").is_ok() || x.iter().any(|(_, v)| action(v)),
+                Object::Array(a) => a.iter().any(action),
+                _ => false,
+            },
+            Err(_) => false,
+        })
+    }
+
     pub(super) fn field(
         &self,
         o: &'a Object,
@@ -510,19 +583,35 @@ impl<'a> Inspector<'a> {
         }
         let Some(d) = self.dict(o) else { return };
         let (parent_name, parent_ft, parent_ff) = parent.unwrap_or(("", None, None));
-        let partial = self.text(d, b"T");
-        let full = match (&partial, parent_name.is_empty()) {
-            (Some(t), true) => t.clone(),
-            (Some(t), false) => format!("{parent_name}.{t}"),
-            (None, _) => parent_name.to_string(),
-        };
-        let ft = self.name(d, b"FT").or(parent_ft);
-        let ff = d.get(b"Ff").ok().and_then(|x| x.as_i64().ok()).or(parent_ff);
         // Non-terminal: has kids that are fields (they carry /T). Widgets-only kids are terminal.
         let mut kids: Vec<Object> = match d.get(b"Kids").map(|k| self.resolve(k)) {
             Ok(Object::Array(k)) => k.clone(),
             _ => Vec::new(),
         };
+        // A field left unlisted for want of text allowance still has its actions counted, through
+        // its whole subtree: an action can sit on a descendant widget, not only on the field.
+        let unlisted = || {
+            if self.has_action(o, 0) {
+                self.field_actions.set(true);
+            }
+        };
+        // A /T that does not fit the allowance lists no field (not one under its parent's name).
+        let Ok(partial) = self.field_text_within(d, b"T") else {
+            unlisted();
+            return;
+        };
+        let full = match (&partial, parent_name.is_empty()) {
+            (Some(t), true) => t.clone(),
+            (Some(t), false) => format!("{parent_name}.{t}"),
+            (None, _) => parent_name.to_string(),
+        };
+        // Every field copies its parent's full name: charge it, and list no more once it is spent.
+        if !self.field_charge(full.len()) {
+            unlisted();
+            return;
+        }
+        let ft = self.name(d, b"FT").or(parent_ft);
+        let ff = d.get(b"Ff").ok().and_then(|x| x.as_i64().ok()).or(parent_ff);
         let (field_kids, widget_kids): (Vec<Object>, Vec<Object>) =
             kids.iter().cloned().partition(|k| self.dict(k).is_some_and(|kd| kd.get(b"T").is_ok()));
         let field_kids: Vec<_> = field_kids.iter().filter(|k| !self.not_a_child(walk, o, k)).collect();
@@ -570,17 +659,37 @@ impl<'a> Inspector<'a> {
             _ => FieldKind::Unknown,
         };
         let value = match d.get(b"V").map(|v| self.resolve(v)) {
-            Ok(Object::Name(n)) => Some(String::from_utf8_lossy(n).into_owned()),
-            Ok(Object::String(bytes, _)) => Some(text_string(bytes)),
-            Ok(Object::Array(a)) => Some(
-                a.iter()
-                    .filter_map(|x| match self.resolve(x) {
-                        Object::String(bytes, _) => Some(text_string(bytes)),
-                        _ => None,
-                    })
-                    .collect::<Vec<_>>()
-                    .join(", "),
-            ),
+            Ok(Object::Name(n)) => self.field_spend(n, |n| String::from_utf8_lossy(n).into_owned()),
+            Ok(Object::String(bytes, _)) => self.field_spend(bytes, text_string),
+            Ok(Object::Array(a)) => {
+                let mut shown = Vec::new();
+                let mut dropped = false;
+                for x in a {
+                    let text = match self.resolve(x) {
+                        Object::String(bytes, _) => self.field_spend(bytes, text_string),
+                        // A name entry (`/V [/Opt1 (b)]`) is a selection too, as the forms reader
+                        // takes it; leaving it out reported a partial selection as complete.
+                        Object::Name(n) => self.field_spend(n, |n| String::from_utf8_lossy(n).into_owned()),
+                        _ => continue,
+                    };
+                    // The ", " between selections is charged to the allowance like the text.
+                    match text {
+                        Some(text) if shown.is_empty() || self.field_charge(2) => shown.push(text),
+                        _ => dropped = true,
+                    }
+                }
+                // A selected value the allowance could not hold shows as an omission rather than
+                // as part of a complete selection (its few bytes are charged, fit or not).
+                let mut value = shown.join(", ");
+                if dropped {
+                    self.field_charge(5);
+                    if !value.is_empty() {
+                        value.push_str(", ");
+                    }
+                    value.push('…');
+                }
+                Some(value)
+            }
             Ok(Object::Dictionary(_)) if kind == FieldKind::Signature => Some("signed".into()),
             _ => None,
         };
@@ -602,9 +711,11 @@ impl<'a> Inspector<'a> {
             .and_then(|p| self.page_of(p))
             .or_else(|| self.find_widget_page(o, &kids))
             .or_else(|| named.and_then(|id| self.annotation_pages.get_or_init(|| self.annotation_pages()).get(&id).copied()));
-        let has_actions = d.get(b"AA").is_ok() || widget.is_some_and(|w| w.get(b"AA").is_ok() || w.get(b"A").is_ok());
+        let has_actions = self.carries_action(d)
+            || widget.is_some_and(|w| self.carries_action(w))
+            || kids.iter().any(|k| self.dict(k).is_some_and(|w| self.carries_action(w)));
         let rect = widget.and_then(|w| w.get(b"Rect").ok()).map(|r| rect4(self.resolve(r)));
-        out.push(Field { name: full, kind, value, page, tooltip: self.text(d, b"TU"), has_actions, rect });
+        out.push(Field { name: full, kind, value, page, tooltip: self.field_text(d, b"TU"), has_actions, rect });
     }
 
     /// Whether `k`, listed in the `/Kids` of field `o`, is not a child of `o` after all: `o` itself
diff --git a/crates/render/src/inspect/core.rs b/crates/render/src/inspect/core.rs
index 88dc13c34a..adf3edffbd 100644
--- a/crates/render/src/inspect/core.rs
+++ b/crates/render/src/inspect/core.rs
@@ -155,16 +155,34 @@ pub(super) struct Inspector<'a> {
     /// has no `/P`. Searching every page's `/Annots` for each such field was O(fields ×
     /// annotations): a second on a form of 8,000 fields.
     pub(super) annotation_pages: OnceCell<HashMap<ObjectId, usize>>,
+    /// What is left of [`MAX_FIELD_TEXT_BYTES`]: names, values and tooltips of form fields and
+    /// layer names, which many entries can share one string of.
+    pub(super) field_text: std::cell::Cell<usize>,
+    /// Set when a field with an action went unlisted because the text allowance was spent, so the
+    /// document still reports JavaScript.
+    pub(super) field_actions: std::cell::Cell<bool>,
     /// The first page widget naming each field as its `/Parent`, built when a field has no widget
     /// among its `/Kids`.
     pub(super) parent_widgets: OnceCell<HashMap<ObjectId, ObjectId>>,
 }
 
+/// Bytes of field and layer text one inspection reads and keeps together.
+pub(super) const MAX_FIELD_TEXT_BYTES: usize = 64 << 20;
+
 impl<'a> Inspector<'a> {
     pub(super) fn new(doc: &'a dyn Structure) -> Self {
         let page_ids = doc.page_ids();
         let page_index = page_ids.iter().copied().enumerate().map(|(index, id)| (id, index)).collect();
-        let mut me = Self { doc, page_ids, page_index, named: HashMap::new(), annotation_pages: OnceCell::new(), parent_widgets: OnceCell::new() };
+        let mut me = Self {
+            doc,
+            page_ids,
+            page_index,
+            named: HashMap::new(),
+            annotation_pages: OnceCell::new(),
+            field_text: MAX_FIELD_TEXT_BYTES.into(),
+            field_actions: false.into(),
+            parent_widgets: OnceCell::new(),
+        };
         let mut named = HashMap::new();
         if let Some(tree) =
             doc.catalog().ok().and_then(|c| c.get(b"Names").ok()).and_then(|o| me.dict(o)).and_then(|n| n.get(b"Dests").ok()).and_then(|o| me.dict(o))
@@ -260,7 +278,7 @@ impl<'a> Inspector<'a> {
                 }
             }
         }
-        info.has_javascript |= info.fields.iter().any(|f| f.has_actions);
+        info.has_javascript |= info.fields.iter().any(|f| f.has_actions) || self.field_actions.get();
         let needs_rendering = catalog.get(b"NeedsRendering").ok().and_then(|o| self.resolve(o).as_bool().ok()).unwrap_or(false);
         if let Some(xfa) = catalog.get(b"AcroForm").ok().and_then(|o| self.dict(o)).and_then(|form| form.get(b"XFA").ok()) {
             // A form with no fields is taken to be laid out from its template, unless its
@@ -351,11 +369,49 @@ impl<'a> Inspector<'a> {
 
     /// Whitespace-trimmed metadata, spent from `budget` as [`spend`] does, so text that trims
     /// short or to nothing still spends its raw length.
+    /// [`Self::budgeted_text`] against the shared field and layer text allowance.
+    pub(super) fn field_text(&self, d: &Dictionary, key: &[u8]) -> Option<String> {
+        let mut left = self.field_text.get();
+        let text = self.budgeted_text(d, key, &mut left);
+        self.field_text.set(left);
+        text
+    }
+
+    /// Converts `bytes` against the field and layer text allowance, as [`spend`] does.
+    pub(super) fn field_spend(&self, bytes: &[u8], convert: impl FnOnce(&[u8]) -> String) -> Option<String> {
+        let mut left = self.field_text.get();
+        let text = spend(bytes, &mut left, convert);
+        self.field_text.set(left);
+        text
+    }
+
+    /// Spends `n` bytes of the field and layer text allowance; `false` when too few are left.
+    pub(super) fn field_charge(&self, n: usize) -> bool {
+        let left = self.field_text.get();
+        self.field_text.set(left.saturating_sub(n));
+        n <= left
+    }
+
     pub(super) fn budgeted_text(&self, d: &Dictionary, key: &[u8], budget: &mut usize) -> Option<String> {
-        let o = self.resolve(d.get(key).ok()?);
-        let (Object::String(bytes, _) | Object::Name(bytes)) = o else { return None };
-        let text = spend(bytes, budget, |_| trimmed_text(o).unwrap_or_default())?;
-        (!text.is_empty()).then_some(text)
+        self.budgeted_text_within(d, key, budget).ok().flatten()
+    }
+
+    /// [`Self::budgeted_text`], but `Err` when the text is there and does not fit `budget`
+    /// (against `Ok(None)`: no text, or none that trims to anything).
+    pub(super) fn budgeted_text_within(&self, d: &Dictionary, key: &[u8], budget: &mut usize) -> Result<Option<String>, ()> {
+        let Ok(o) = d.get(key) else { return Ok(None) };
+        let o = self.resolve(o);
+        let (Object::String(bytes, _) | Object::Name(bytes)) = o else { return Ok(None) };
+        let text = spend(bytes, budget, |_| trimmed_text(o).unwrap_or_default()).ok_or(())?;
+        Ok((!text.is_empty()).then_some(text))
+    }
+
+    /// [`Self::field_text`], but `Err` when the text does not fit the allowance.
+    pub(super) fn field_text_within(&self, d: &Dictionary, key: &[u8]) -> Result<Option<String>, ()> {
+        let mut left = self.field_text.get();
+        let text = self.budgeted_text_within(d, key, &mut left);
+        self.field_text.set(left);
+        text
     }
 
     pub(super) fn name(&self, d: &Dictionary, key: &[u8]) -> Option<String> {
diff --git a/crates/render/src/inspect/navigation.rs b/crates/render/src/inspect/navigation.rs
index c5f2a1be86..f680b46246 100644
--- a/crates/render/src/inspect/navigation.rs
+++ b/crates/render/src/inspect/navigation.rs
@@ -250,7 +250,7 @@ impl<'a> Inspector<'a> {
                 None => {}
             }
             let open = d.get(b"Count").ok().and_then(|c| c.as_i64().ok()).is_some_and(|c| c > 0);
-            let title = self.text(d, b"Title").unwrap_or_default();
+            let title = self.field_text(d, b"Title").unwrap_or_default();
             let color = match d.get(b"C").map(|o| self.resolve(o)) {
                 Ok(Object::Array(c)) => outline_color(c.iter().map(|v| self.resolve(v).as_float().ok())),
                 _ => None,
diff --git a/crates/render/src/inspect/resources.rs b/crates/render/src/inspect/resources.rs
index 3dbc1c665f..6d90f715e1 100644
--- a/crates/render/src/inspect/resources.rs
+++ b/crates/render/src/inspect/resources.rs
@@ -121,9 +121,14 @@ impl<'a> Inspector<'a> {
             .unwrap_or_default();
         let auto = config.map(|c| self.view_auto_state(c)).unwrap_or_default();
         let Ok(Object::Array(ocgs)) = props.get(b"OCGs").map(|o| self.resolve(o)) else { return };
+        let mut seen = HashSet::new();
         for g in ocgs {
             let Some(d) = self.dict(g) else { continue };
             let id = g.as_reference().ok();
+            // A group listed twice is one layer (and its name is read once).
+            if id.is_some_and(|id| !seen.insert(id)) {
+                continue;
+            }
             // The View auto state, when it manages the group, then the configuration.
             let visible = match id {
                 Some(id) if let Some(&state) = auto.get(&id) => state,
@@ -132,7 +137,7 @@ impl<'a> Inspector<'a> {
                 _ => !base_off,
             };
             let Some(id) = id else { continue };
-            out.push(Layer { id, name: self.text(d, b"Name").unwrap_or_else(|| "Layer".into()), visible, initial: visible });
+            out.push(Layer { id, name: self.field_text(d, b"Name").unwrap_or_else(|| "Layer".into()), visible, initial: visible });
         }
     }
 
diff --git a/crates/render/src/inspect/tests.rs b/crates/render/src/inspect/tests.rs
index e89fab5c99..c908b241cf 100644
--- a/crates/render/src/inspect/tests.rs
+++ b/crates/render/src/inspect/tests.rs
@@ -249,6 +249,8 @@ fn object_stream_member_extents_bound_owned_strings() {
     assert!(!parsed.objects.contains_key(&(201, 0)));
 }
 
+/// Members are read at their indexed offsets, in any order and with any whitespace around
+/// them; a number listed twice keeps its last entry.
 #[test]
 fn object_stream_member_extents_preserve_index_order_and_whitespace() {
     let members = b" \n42\n /Name \n[true 7]\n << /Key (value) >>\n (last)";
@@ -262,6 +264,170 @@ fn object_stream_member_extents_preserve_index_order_and_whitespace() {
     assert_eq!(parsed.objects.get(&(12, 0)).unwrap().as_dict().unwrap().get(b"Key").unwrap().as_str().unwrap(), b"value");
 }
 
+/// lopdf patch (7), #5083: a decoded object-stream member could build any number of objects
+/// (`0 0 0 ...` inside the decompression limit built ~120M and aborted). A member now builds at
+/// most the per-object node cap (1 << 22), so one array with more elements than that is skipped
+/// while a small member is kept. Without the node charge in the vendored parser the oversize
+/// array builds in full, so object 11 is present and the last assertion fails.
+#[test]
+fn object_stream_members_over_the_node_cap_are_skipped() {
+    let small = b"[ 1 2 3 ]";
+    let mut big = vec![b'['];
+    for _ in 0..4_300_000 {
+        big.extend_from_slice(b"0 ");
+    }
+    big.push(b']');
+    let mut members = small.to_vec();
+    let big_off = members.len();
+    members.extend_from_slice(&big);
+    let stream = indexed_object_stream(&[(10, 0), (11, big_off)], &members);
+    let parsed = lopdf::ObjectStream::new_with_limit(&stream, Some(16 << 20)).unwrap();
+    assert!(parsed.objects.contains_key(&(10, 0)), "the small member is kept");
+    assert!(!parsed.objects.contains_key(&(11, 0)), "the oversize member is skipped");
+}
+
+/// lopdf patch (7), #5083: an object stream reads at most 1,000,000 index entries (cos's `/N`
+/// clamp), so a huge index can't allocate an entry list or parse a member per entry. Of
+/// 1,000,001 distinct one-byte members, the last is never built.
+#[test]
+fn object_stream_index_entries_past_the_clamp_are_ignored() {
+    let count = 1_000_001_u32;
+    let mut members = Vec::with_capacity(2 * count as usize);
+    let pairs: Vec<(u32, usize)> = (1..=count)
+        .map(|id| {
+            let at = members.len();
+            members.extend_from_slice(b"0 ");
+            (id, at)
+        })
+        .collect();
+    let parsed = lopdf::ObjectStream::new_with_limit(&indexed_object_stream(&pairs, &members), None).unwrap();
+    assert_eq!(parsed.objects.len(), 1_000_000);
+    assert!(parsed.objects.contains_key(&(1_000_000, 0)));
+    assert!(!parsed.objects.contains_key(&(count, 0)), "the entry past the clamp is ignored");
+}
+
+/// Six object streams, each holding one nested member of seven objects.
+fn nested_object_streams() -> Vec<lopdf::Stream> {
+    (0..6).map(|i| indexed_object_stream(&[(100 + i, 0)], b"<< /A [1 [2]] /B << /C 3 >> >>")).collect()
+}
+
+/// lopdf patch (7), #5083: one load's object streams share a single node budget (the load-wide
+/// `MAX_LOAD_NODES`, here 12 nodes so the test stays small), so later streams are skipped once
+/// earlier ones spent it. A stream given a budget of its own would load all six.
+#[test]
+fn object_streams_of_one_load_share_their_node_budget() {
+    let streams = nested_object_streams();
+    let budget = lopdf::NodeBudget::new(12);
+    let loaded: usize = streams.iter().map(|s| lopdf::ObjectStream::new_within(s, None, &budget).unwrap().objects.len()).sum();
+    assert!(loaded > 0);
+    assert!(loaded < streams.len(), "the budget is shared by all streams");
+    assert!(budget.spent());
+}
+
+/// The shared budget holds across threads too, as rayon's workers load object streams in
+/// parallel: members reserve their share before parsing, so together they can't overshoot.
+#[test]
+fn object_streams_loaded_in_parallel_share_their_node_budget() {
+    let streams = nested_object_streams();
+    let budget = &lopdf::NodeBudget::new(12);
+    let loaded: usize = std::thread::scope(|scope| {
+        let workers: Vec<_> =
+            streams.iter().map(|s| scope.spawn(move || lopdf::ObjectStream::new_within(s, None, budget).unwrap().objects.len())).collect();
+        workers.into_iter().map(|w| w.join().unwrap()).sum()
+    });
+    assert!(loaded > 0);
+    assert!(loaded < streams.len(), "the budget is shared by all streams");
+}
+
+/// A member that fails to parse gives back the nodes it reserved and did not build, so a
+/// malformed member doesn't use up the budget of the members after it.
+#[test]
+fn a_malformed_object_stream_member_refunds_its_reservation() {
+    let stream = indexed_object_stream(&[(10, 0), (11, 3)], b"[1 [2]");
+    let budget = lopdf::NodeBudget::new(5);
+    let parsed = lopdf::ObjectStream::new_within(&stream, None, &budget).unwrap();
+    assert!(!parsed.objects.contains_key(&(10, 0)));
+    assert!(parsed.objects.contains_key(&(11, 0)));
+    assert!(!budget.spent(), "unused reservation from the malformed member is refunded");
+}
+
+/// A budget too small for every member builds them in index order, so the members a spent
+/// budget skips are the same on every load. Here the first member takes four of the five
+/// nodes, the second the last one, and the third is skipped. Parsed in parallel from the shared
+/// budget, the second and third could find it held by the first and be skipped as well.
+#[test]
+fn a_tight_budget_builds_object_stream_members_in_index_order() {
+    let stream = indexed_object_stream(&[(10, 0), (11, 8), (12, 10)], b"[1 2 3] 7 8");
+    let budget = lopdf::NodeBudget::new(5);
+    let parsed = lopdf::ObjectStream::new_within(&stream, None, &budget).unwrap();
+    assert!(parsed.objects.contains_key(&(10, 0)));
+    assert!(parsed.objects.contains_key(&(11, 0)), "the second member is built from what the first left");
+    assert!(!parsed.objects.contains_key(&(12, 0)), "the third member finds the budget spent");
+    assert!(budget.spent());
+}
+
+/// A PDF with a cross-reference stream whose Info dictionary (object 4) sits in object stream 3
+/// after `first`, a member listed before it.
+fn info_in_object_stream_pdf(first: &[u8]) -> Vec<u8> {
+    let info = b"<< /Title (Kept) >>";
+    let index = format!("5 0 4 {} ", first.len() + 1);
+    let mut data = index.clone().into_bytes();
+    data.extend_from_slice(first);
+    data.push(b' ');
+    data.extend_from_slice(info);
+    let mut pdf = b"%PDF-1.5\n".to_vec();
+    let mut offsets = [0_u32; 7];
+    let mut append = |pdf: &mut Vec<u8>, id: usize, head: &[u8], body: &[u8], tail: &[u8]| {
+        offsets[id] = pdf.len() as u32;
+        pdf.extend_from_slice(format!("{id} 0 obj\n").as_bytes());
+        pdf.extend_from_slice(head);
+        pdf.extend_from_slice(body);
+        pdf.extend_from_slice(tail);
+        pdf.extend_from_slice(b"\nendobj\n");
+    };
+    append(&mut pdf, 1, b"<< /Type /Catalog /Pages 2 0 R >>", b"", b"");
+    append(&mut pdf, 2, b"<< /Type /Pages /Kids [] /Count 0 >>", b"", b"");
+    let head = format!("<< /Type /ObjStm /N 2 /First {} /Length {} >>\nstream\n", index.len(), data.len());
+    append(&mut pdf, 3, head.as_bytes(), &data, b"\nendstream");
+    let xref_offset = pdf.len() as u32;
+    offsets[6] = xref_offset;
+    let mut records = Vec::new();
+    for (id, &offset) in offsets.iter().enumerate() {
+        let (kind, field, index) = match id {
+            0 => (0_u8, 0_u32, 0xffff_u16),
+            4 => (2, 3, 1),
+            5 => (2, 3, 0),
+            _ => (1, offset, 0),
+        };
+        records.push(kind);
+        records.extend_from_slice(&field.to_be_bytes());
+        records.extend_from_slice(&index.to_be_bytes());
+    }
+    let head = format!("<< /Type /XRef /Size 7 /Root 1 0 R /Info 4 0 R /W [1 4 2] /Length {} >>\nstream\n", records.len());
+    pdf.extend_from_slice(format!("6 0 obj\n{head}").as_bytes());
+    pdf.extend_from_slice(&records);
+    pdf.extend_from_slice(format!("\nendstream\nendobj\nstartxref\n{xref_offset}\n%%EOF\n").as_bytes());
+    pdf
+}
+
+/// lopdf patch (7), #5083: a lookup in an object stream (lopdf's metadata reader, or an indirect
+/// `/Length` read while loading) parses only the member it wants. It used to parse every member
+/// from one object's budget, so a member before it of more than `MAX_OBJECT_NODES` objects spent
+/// that budget and the wanted member was skipped: the Info dictionary read as missing.
+#[test]
+fn a_lookup_in_an_object_stream_parses_only_the_member_it_wants() {
+    let mut big = vec![b'['];
+    for _ in 0..4_300_000 {
+        big.extend_from_slice(b"0 ");
+    }
+    big.push(b']');
+    let metadata = Document::load_metadata_mem(&info_in_object_stream_pdf(&big)).unwrap();
+    assert_eq!(metadata.title.as_deref(), Some("Kept"));
+    // The fixture itself reads: with a small member before it, the Info dictionary was read before too.
+    let metadata = Document::load_metadata_mem(&info_in_object_stream_pdf(b"[1 2 3]")).unwrap();
+    assert_eq!(metadata.title.as_deref(), Some("Kept"));
+}
+
 #[test]
 fn view_and_user_space_round_trip_for_every_rotation() {
     for rotation in [0u16, 90, 180, 270] {
@@ -995,6 +1161,50 @@ fn repeated_annotations_are_listed_once_within_a_byte_budget() {
     assert!(notes.iter().map(retained).sum::<usize>() <= MAX_ANNOTATION_BYTES);
 }
 
+/// Blank text is not kept, so only reading it is charged: many comments sharing one large blank
+/// string stop being built at the budget instead of decoding it once each.
+#[test]
+fn comments_sharing_a_blank_string_stop_at_the_read_budget() {
+    let small = "<< /Subtype /Text /Rect [0 0 1 1] /Contents 7 0 R >> ".repeat(1200);
+    let pdf = format!(
+        "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots [{small}] >> endobj\n\
+             7 0 obj ({}) endobj\ntrailer << /Root 1 0 R >>\n%%EOF",
+        " ".repeat(64 << 10),
+    );
+    let doc = Document::load_mem(pdf.as_bytes()).expect("loads");
+    let page = PageInfo { width: 200.0, height: 200.0, crop: [0.0, 0.0, 200.0, 200.0], rotation: 0, label: String::new() };
+    let mut info = DocInfo { pages: vec![page], ..Default::default() };
+    Inspector::new(&doc).fill(&mut info);
+    assert!(!info.annotations.is_empty() && info.annotations.len() < 1200, "{}", info.annotations.len());
+}
+
+/// Many fields sharing one large tooltip, and one layer listed many times, are read within a byte
+/// allowance rather than once each.
+#[test]
+fn fields_sharing_a_tooltip_and_repeated_layers_stop_at_the_text_budget() {
+    let fields = (0..1300).map(|i| format!("<< /FT /Tx /T (f{i}) /TU 7 0 R /V 7 0 R >> ")).collect::<String>();
+    let pdf = format!(
+        "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [{fields}] >> \
+             /OCProperties << /OCGs [{}] >> >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] >> endobj\n\
+             6 0 obj << /Type /OCG /Name (Ink) >> endobj\n\
+             7 0 obj ({}) endobj\ntrailer << /Root 1 0 R >>\n%%EOF",
+        "6 0 R ".repeat(1000),
+        "x".repeat(32 << 10),
+    );
+    let doc = Document::load_mem(pdf.as_bytes()).expect("loads");
+    let page = PageInfo { width: 200.0, height: 200.0, crop: [0.0, 0.0, 200.0, 200.0], rotation: 0, label: String::new() };
+    let mut info = DocInfo { pages: vec![page], ..Default::default() };
+    Inspector::new(&doc).fill(&mut info);
+    let kept: usize = info.fields.iter().map(|f| f.tooltip.as_ref().map_or(0, String::len) + f.value.as_ref().map_or(0, String::len)).sum();
+    assert!(kept > 0 && kept <= super::core::MAX_FIELD_TEXT_BYTES, "{kept}");
+    assert!(info.fields.iter().any(|f| f.tooltip.is_none()), "text past the allowance is left out");
+    assert_eq!(info.layers.len(), 1);
+}
+
 /// A link reached through an indirect object that holds only a reference to it is the same
 /// annotation as the link itself, and so is a page array reached the same way: each is listed once.
 #[test]
@@ -2520,6 +2730,42 @@ fn inspection_keeps_no_private_page_data() {
     assert_eq!(report(with), report(without), "what inspection reports does not change");
 }
 
+/// A field with several widgets reports an action on any of them, not only the first, and so does
+/// the document's JavaScript flag.
+#[test]
+fn a_field_reports_an_action_on_a_later_widget() {
+    let pdf = "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R] >> >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] >> endobj\n\
+             4 0 obj << /FT /Tx /T (f) /Kids [5 0 R 6 0 R] >> endobj\n\
+             5 0 obj << /Subtype /Widget /Rect [0 0 1 1] >> endobj\n\
+             6 0 obj << /Subtype /Widget /Rect [0 0 1 1] /A << /S /JavaScript /JS (app.alert(1)) >> >> endobj\n\
+             trailer << /Root 1 0 R >>\n%%EOF";
+    let doc = Document::load_mem(pdf.as_bytes()).expect("loads");
+    let page = PageInfo { width: 200.0, height: 200.0, crop: [0.0, 0.0, 200.0, 200.0], rotation: 0, label: String::new() };
+    let mut info = DocInfo { pages: vec![page], ..Default::default() };
+    Inspector::new(&doc).fill(&mut info);
+    assert!(info.fields.iter().any(|f| f.name == "f" && f.has_actions), "{:?}", info.fields);
+    assert!(info.has_javascript);
+}
+
+/// A shared descendant first reached at the depth limit (its action-bearing child cut) is read
+/// again from a shallower path, so the action is still found.
+#[test]
+fn an_action_below_a_shared_field_first_met_deep_is_found_from_a_shallower_path() {
+    // 1 is the root, 2..=32 a chain of 31 fields, 33 the shared field, 34 holds the action,
+    // 35 a short path to 33.
+    let mut bodies = vec!["<< /Kids [2 0 R 35 0 R] >>".to_string()];
+    for i in 2..=32 {
+        bodies.push(format!("<< /Kids [{} 0 R] >>", i + 1));
+    }
+    bodies.push("<< /Kids [34 0 R] >>".into());
+    bodies.push("<< /A << /S /JavaScript /JS (x) >> >>".into());
+    bodies.push("<< /Kids [33 0 R] >>".into());
+    let doc = Document::load_mem(&pdf_of(&bodies)).expect("loads");
+    assert!(Inspector::new(&doc).has_action(&Object::Reference((1, 0)), 0));
+}
+
 /// A `/Kids` entry that loops back, or names a root field that doesn't name this one as its
 /// `/Parent`, is not a child (ISO 32000-2 §12.7.3, Table 224; §12.7.4.1, Table 226): the field
 /// keeps its other kids and is listed with them.
diff --git a/crates/render/src/structure.rs b/crates/render/src/structure.rs
index 441f48998c..914bab731f 100644
--- a/crates/render/src/structure.rs
+++ b/crates/render/src/structure.rs
@@ -166,6 +166,8 @@ impl Structure for LazyStructure {
     fn encrypted(&self) -> bool {
         self.source.security().is_some() || self.trailer.has(b"Encrypt")
     }
+    /// The object `id`, read from the lazy source and converted once, then kept; a failed
+    /// conversion marks the structure so the caller can fall back to the eager loader.
     fn get_object(&self, id: ObjectId) -> Result<&Object> {
         let missing = || Error::ObjectNotFound(id);
         let slot = self.objects.binary_search_by_key(&id.0, |(n, _)| *n).ok().and_then(|i| self.objects.get(i)).ok_or_else(missing)?;
@@ -185,8 +187,15 @@ impl Structure for LazyStructure {
     }
 }
 
+/// Nesting `convert` accepts: the same as `pdfcraft_cos`'s parser (each array or dictionary
+/// one level), so every object cos parsed converts. A lower limit would turn deep but valid
+/// nesting into a lazy-reader failure and force the eager lopdf fallback.
+const CONVERT_DEPTH: usize = 128;
+
+/// Convert a cos dictionary to lopdf's, without `/PieceInfo`. `depth` is the nesting level of
+/// the dictionary itself; its values sit one level deeper.
 fn convert_dict(dict: &pdfcraft_cos::Dict, depth: usize) -> Result<Dictionary> {
-    if depth > 100 {
+    if depth > CONVERT_DEPTH {
         return Err(Error::RecursionLimit);
     }
     dict.iter()
@@ -203,8 +212,10 @@ fn convert_dict(dict: &pdfcraft_cos::Dict, depth: usize) -> Result<Dictionary> {
 /// untouched; this is the read-only view inspection walks.
 const PRIVATE_DATA: &[u8] = b"PieceInfo";
 
+/// Convert a cos object to lopdf's, failing past [`CONVERT_DEPTH`] levels of arrays and
+/// dictionaries.
 fn convert(object: &CosObject, depth: usize) -> Result<Object> {
-    if depth > 100 {
+    if depth > CONVERT_DEPTH {
         return Err(Error::RecursionLimit);
     }
     Ok(match object {
@@ -218,8 +229,8 @@ fn convert(object: &CosObject, depth: usize) -> Result<Object> {
         }
         CosObject::Ref(value) => Object::Reference((value.num, value.generation)),
         CosObject::Array(value) => Object::Array(value.iter().map(|o| convert(o, depth + 1)).collect::<Result<_>>()?),
-        CosObject::Dict(value) => Object::Dictionary(convert_dict(value, depth + 1)?),
-        CosObject::Stream(value) => Object::Stream(lopdf::Stream::new(convert_dict(&value.dict, depth + 1)?, value.raw.to_vec())),
+        CosObject::Dict(value) => Object::Dictionary(convert_dict(value, depth)?),
+        CosObject::Stream(value) => Object::Stream(lopdf::Stream::new(convert_dict(&value.dict, depth)?, value.raw.to_vec())),
     })
 }
 
diff --git a/crates/sign/src/pdf/listing.rs b/crates/sign/src/pdf/listing.rs
index c2a7183db1..2d41477127 100644
--- a/crates/sign/src/pdf/listing.rs
+++ b/crates/sign/src/pdf/listing.rs
@@ -431,8 +431,12 @@ pub fn list(doc: &Document, bytes: &[u8], trust: &TrustStore) -> Vec<SignatureIn
 /// structure and validation against `bytes` and `trust` are read again on every call.
 pub fn list_cached(doc: &Document, bytes: &[u8], trust: &TrustStore, cache: &DigestCache) -> Vec<SignatureInfo> {
     let pages = annot_pages(doc);
-    let mut out = Vec::new();
+    let mut out: Vec<SignatureInfo> = Vec::new();
     let mut field_values: HashSet<ObjRef> = HashSet::new();
+    // Fields that name one signature value are judged once: validation does not depend on the
+    // field, and repeating it per field would repeat the digest, chain and evidence work.
+    // The row of `out` that holds each value's verdict: a later field copies it, not a map of copies.
+    let mut judged: HashMap<ObjRef, usize> = HashMap::new();
     let (fields, whole) = walk_sig_fields(doc);
     for f in fields {
         if let Some(v_ref) = f.dict.get(b"V").and_then(Object::as_ref) {
@@ -445,6 +449,13 @@ pub fn list_cached(doc: &Document, bytes: &[u8], trust: &TrustStore, cache: &Dig
             .filter(|r| r.len() == 4)
             .map(|r| [r[0].min(r[2]), r[1].min(r[3]), r[0].max(r[2]), r[1].max(r[3])]);
         let visible = widget.is_some_and(|(_, w)| widget_shown(doc, w));
+        // A repeat of a judged value reads nothing of it: the signature dictionary is not copied.
+        let shared = f.dict.get(b"V").and_then(Object::as_ref).filter(|_| f.dict.get(b"V").is_some_and(|v| doc.resolve(v).as_dict().is_some()));
+        if let Some(first) = shared.and_then(|r| judged.get(&r)).and_then(|&i| out.get(i)) {
+            let own = SignatureInfo { field: f.name.clone(), signed: true, page, rect, visible, ..first.clone() };
+            out.push(own);
+            continue;
+        }
         let v = f.signature(doc);
         let mut info = SignatureInfo {
             field: f.name.clone(),
@@ -477,6 +488,9 @@ pub fn list_cached(doc: &Document, bytes: &[u8], trust: &TrustStore, cache: &Dig
         if let Some(v) = v {
             validate_into(doc, bytes, trust, &v, &mut info, cache);
         }
+        if let Some(r) = shared {
+            judged.insert(r, out.len());
+        }
         out.push(info);
     }
     // Standalone document timestamps (ISO 32000-2 §12.8.2.2) live outside AcroForm fields.
diff --git a/crates/sign/src/pdf/validate.rs b/crates/sign/src/pdf/validate.rs
index 52bf79351f..d3ad411a62 100644
--- a/crates/sign/src/pdf/validate.rs
+++ b/crates/sign/src/pdf/validate.rs
@@ -371,7 +371,11 @@ pub(crate) const MAX_DSS_BYTES: usize = 64 << 20;
 pub(crate) struct DssEvidence<'a> {
     doc: &'a Document,
     items: std::vec::IntoIter<Object>,
-    seen: HashSet<ObjRef>,
+    /// Object numbers read: `Document::get` resolves a reference by number, so `5 0 R` and `5 1 R`
+    /// are one stream.
+    seen: HashSet<u32>,
+    /// Full references already tried, resolved or not.
+    tried: HashSet<ObjRef>,
     taken: usize,
     left: usize,
     /// A cap stopped the array being read in full.
@@ -381,7 +385,7 @@ pub(crate) struct DssEvidence<'a> {
 impl<'a> DssEvidence<'a> {
     pub(crate) fn new(doc: &'a Document, dss: &Dict, key: &[u8]) -> Self {
         let items = dss.get(key).map(|o| doc.resolve(o)).and_then(|o| o.as_array().cloned()).unwrap_or_default();
-        DssEvidence { doc, items: items.into_iter(), seen: HashSet::new(), taken: 0, left: MAX_DSS_BYTES, cut: false }
+        DssEvidence { doc, items: items.into_iter(), seen: HashSet::new(), tried: HashSet::new(), taken: 0, left: MAX_DSS_BYTES, cut: false }
     }
 }
 
@@ -395,11 +399,21 @@ impl Iterator for DssEvidence<'_> {
         // Repeats are skipped before the caps count anything, so repeating one stream cannot use
         // them up; the scan of the array itself is bounded by the parser's cap on array length.
         for item in self.items.by_ref() {
-            if item.as_ref().is_some_and(|r| !self.seen.insert(r)) {
+            // Resolved first: a reference to a generation the slot doesn't hold reads as null and
+            // must not make a later, valid reference to the same object number a repeat.
+            // A repeat is skipped before anything is resolved: a long chain of repeats costs no
+            // lookups. The number is recorded only once the reference gave a stream.
+            // Each full reference is tried once, so one that never reaches a stream (a cycle) costs
+            // its lookups once, however often it is listed; `seen` keeps object numbers apart so a
+            // dead generation can't hide a live one.
+            if item.as_ref().is_some_and(|r| self.seen.contains(&r.num) || !self.tried.insert(r)) {
                 continue;
             }
             let o = self.doc.resolve(&item);
             let Object::Stream(s) = o.as_ref() else { continue };
+            if let Some(r) = item.as_ref() {
+                self.seen.insert(r.num);
+            }
             if self.taken >= MAX_DSS_ENTRIES {
                 self.cut = true;
                 return None;
diff --git a/crates/sign/src/pdf_discovery_tests.rs b/crates/sign/src/pdf_discovery_tests.rs
index 29f115cb07..d3250d62ed 100644
--- a/crates/sign/src/pdf_discovery_tests.rs
+++ b/crates/sign/src/pdf_discovery_tests.rs
@@ -373,6 +373,19 @@ fn only_grew_compares_huge_arrays_without_quadratic_work() {
     assert!(start.elapsed() < std::time::Duration::from_secs(10), "{:?}", start.elapsed());
 }
 
+/// A reference to a generation the object doesn't have reads as null: it is no repeat of the valid
+/// reference to the same object number that follows it.
+#[test]
+fn dss_evidence_skips_a_dead_reference_without_hiding_the_live_one() {
+    let mut doc = fixture(&[]);
+    let live = doc.add(Object::Stream(Stream::flate(Dict::new(), b"evidence")));
+    let dead = ObjRef::new(live.num, live.generation + 1);
+    let mut dss = Dict::new();
+    dss.set(b"CRLs".to_vec(), Object::Array(vec![Object::Ref(dead), Object::Ref(live)]));
+    let read: Vec<Vec<u8>> = DssEvidence::new(&doc, &dss, b"CRLs").collect();
+    assert_eq!(read, vec![b"evidence".to_vec()]);
+}
+
 #[test]
 fn dss_evidence_decodes_each_stream_once_within_its_caps() {
     // One small stream listed 1000 times, then streams that inflate past the evidence cap.
diff --git a/crates/sign/tests/it/pdf.rs b/crates/sign/tests/it/pdf.rs
index e765941c9a..5d24d05dce 100644
--- a/crates/sign/tests/it/pdf.rs
+++ b/crates/sign/tests/it/pdf.rs
@@ -325,6 +325,21 @@ fn an_indirect_annots_array_is_judged_by_the_annotations_it_gains() {
     assert_eq!((s.status, s.modification), (Status::Invalid, Modification::Disallowed(vec![kind::OTHER])));
 }
 
+/// A signature widget taken off the page's inline /Annots array is covered by no permission (the
+/// indirect-array case is the test above), and stays a change whatever level the signature has.
+#[test]
+fn removing_a_widget_from_an_inline_annots_array_is_not_a_comment_change() {
+    let id = pkcs12::open(&data("rsa-aes.p12"), "test").unwrap();
+    let trust = TrustStore { certs: vec![id.certificate.clone()] };
+    let page = pdfcraft_cos::ObjRef { num: 3, generation: 0 };
+    let signed = pdfcraft_sign::sign(&open(&fixture()), &id, &opts()).unwrap();
+    let inline = open(&signed).get(page).as_dict().and_then(|d| d.get(b"Annots").cloned()).unwrap();
+    assert!(matches!(inline, Object::Array(ref a) if !a.is_empty()), "the page keeps its widgets inline");
+    let stripped = edit_after(&signed, |doc| doc.update_dict(page, |p| p.set(b"Annots".to_vec(), Object::Array(vec![]))).unwrap());
+    let s = signatures(&open(&stripped), &stripped, &trust).into_iter().find(|s| s.signed).unwrap();
+    assert_eq!((s.status, s.modification), (Status::Invalid, Modification::Disallowed(vec![kind::OTHER])));
+}
+
 /// Issue #1328: a signature field whose /V is null, directly or through a reference, is unsigned:
 /// it is listed as unsigned and can be signed by name.
 #[test]
@@ -3354,6 +3369,38 @@ fn signing_a_field_with_a_null_value_after_another_signature_keeps_the_first_val
     );
 }
 
+/// Fields that name one signature value are listed each, under their own name, with the verdict
+/// the value earned once.
+#[test]
+fn fields_sharing_a_signature_value_are_listed_with_one_verdict() {
+    let id = pkcs12::open(&data("rsa-aes.p12"), "test").unwrap();
+    let trust = TrustStore { certs: vec![id.certificate.clone()] };
+    let signed = pdfcraft_sign::sign(&open(&fixture()), &id, &SignOptions { field: Some("Approval".into()), ..opts() }).unwrap();
+    let v = open(&signed).get(pdfcraft_cos::ObjRef { num: 6, generation: 0 }).as_dict().and_then(|d| d.get(b"V").cloned()).unwrap();
+    let shared = edit_after(&signed, |doc| {
+        let mut w = pdfcraft_cos::Dict::new();
+        w.set(b"Type".to_vec(), Object::name("Annot"));
+        w.set(b"Subtype".to_vec(), Object::name("Widget"));
+        w.set(b"FT".to_vec(), Object::name("Sig"));
+        w.set(b"T".to_vec(), PdfString::text("Twin"));
+        w.set(b"V".to_vec(), v.clone());
+        w.set(b"Rect".to_vec(), Object::Array(vec![Object::Int(0); 4]));
+        let w = doc.add(Object::Dict(w));
+        let root = doc.root().unwrap();
+        let af = doc.get(root).as_dict().and_then(|c| c.get(b"AcroForm").cloned()).unwrap();
+        let af = doc.resolve(&af).as_dict().cloned().unwrap();
+        let mut fields = af.get(b"Fields").map(|f| doc.resolve(f)).and_then(|f| f.as_array().cloned()).unwrap();
+        fields.push(Object::Ref(w));
+        let mut af = af;
+        af.set(b"Fields".to_vec(), Object::Array(fields));
+        doc.update_dict(root, |c| c.set(b"AcroForm".to_vec(), Object::Dict(af))).unwrap();
+    });
+    let list = signatures(&open(&shared), &shared, &trust);
+    let (a, b) = (list.iter().find(|s| s.field == "Approval").unwrap(), list.iter().find(|s| s.field == "Twin").unwrap());
+    assert!(a.signed && b.signed);
+    assert_eq!((a.status, &a.modification, &a.signer, a.signed_len), (b.status, &b.modification, &b.signer, b.signed_len));
+}
+
 #[test]
 fn the_catalogs_perms_do_not_change_under_no_changes() {
     // /Perms names the certification signature (DocMDP). Under P=1 nothing may change, so a later
diff --git a/crates/ui-egui/src/app.rs b/crates/ui-egui/src/app.rs
index 7276b6aa10..34297453f6 100644
--- a/crates/ui-egui/src/app.rs
+++ b/crates/ui-egui/src/app.rs
@@ -252,6 +252,8 @@ impl PdfCraftApp {
             compare_pages: String::new(),
             compare: None,
             js_console: Default::default(),
+            #[cfg(not(target_arch = "wasm32"))]
+            script_pending: None,
             doc_js: Default::default(),
             a11y: a11y_ui::A11yState::default(),
             tags_state: Default::default(),
@@ -445,6 +447,10 @@ impl PdfCraftApp {
     /// A dialog or prompt is open over the window: the keyboard is its own, and nothing may act
     /// on the document underneath it.
     pub(crate) fn modal_open(&self) -> bool {
+        #[cfg(not(target_arch = "wasm32"))]
+        if self.script_pending.as_ref().is_some_and(|pending| pending.has_prompt()) {
+            return true;
+        }
         self.dialog.is_some()
             || self.close_request.is_some()
             || self.password_prompt.is_some()
@@ -587,6 +593,8 @@ impl PdfCraftApp {
         self.injected_panic(crate::frame_guard::FramePart::Logic);
         self.ctx = Some(ctx.clone());
         #[cfg(not(target_arch = "wasm32"))]
+        self.poll_script_dialog(ctx);
+        #[cfg(not(target_arch = "wasm32"))]
         self.window_state.repair(ctx);
         self.dialog_epoch();
         // Notices raised outside `ui` (opened files, OS events, the control channel) translate too.
diff --git a/crates/ui-egui/src/app/files.rs b/crates/ui-egui/src/app/files.rs
index 8c96de4529..81c65a2b03 100644
--- a/crates/ui-egui/src/app/files.rs
+++ b/crates/ui-egui/src/app/files.rs
@@ -257,6 +257,14 @@ impl PdfCraftApp {
                 Some(Err(error)) => self.notify_fmt("Couldn't open {name}: {e}", &[("name", &pending.name), ("e", &error)]),
                 None => {}
             },
+            open_worker::ResultKind::Converted(created) => match self.open_converted_pdf(&pending.name, created) {
+                Ok(()) => {
+                    if let Some(command) = pending.then {
+                        self.execute(command);
+                    }
+                }
+                Err(error) => self.notify_fmt("Couldn't open {name}: {e}", &[("name", &pending.name), ("e", &error)]),
+            },
             open_worker::ResultKind::Prepared { bytes, result } => match *result {
                 Ok(prepared) => match self.finish_open(&pending.name, pending.path.clone(), bytes.len(), prepared, pending.activate) {
                     Ok(id) => {
@@ -1009,24 +1017,29 @@ impl PdfCraftApp {
         self.open_path_request(path, None, Some((layout, continuous)));
     }
 
-    /// The File ▸ Open picker: PDFs, and images and text that become PDFs.
-    #[cfg(not(target_arch = "wasm32"))]
+    /// The File ▸ Open picker's file types, in order; the first, PDF, is the default. Images, text
+    /// and (on the desktop, through LibreOffice) Office documents open as new, unsaved PDFs.
+    /// No "All files" in the browser or on macOS, whose panel merges every type into one list
+    /// rather than offering a choice.
+    pub(crate) fn open_filters() -> Vec<(String, Vec<&'static str>)> {
+        let mut filters = vec![("PDF".to_string(), vec!["pdf"]), (tl!("Images").to_string(), pdfcraft_engine::IMAGE_EXTENSIONS.to_vec())];
+        #[cfg(not(target_arch = "wasm32"))]
+        filters.push((tl!("Office documents").to_string(), pdfcraft_engine::OFFICE_EXTENSIONS.to_vec()));
+        filters.push((tl!("Text").to_string(), pdfcraft_engine::TEXT_EXTENSIONS.to_vec()));
+        #[cfg(not(any(target_arch = "wasm32", target_os = "macos")))]
+        filters.push((tl!("All files").to_string(), vec!["*"]));
+        filters
+    }
+
+    /// The File ▸ Open picker ([`Self::open_filters`]), each type matched in any letter case.
     pub(super) fn open_picker() -> rfd::AsyncFileDialog {
-        rfd::AsyncFileDialog::new()
-            .add_filter_any_case("PDF", &["pdf"])
-            .add_filter_any_case(tl!("Images and text (converted to PDF)"), &create_ui::CONVERTIBLE)
+        Self::open_filters().into_iter().fold(rfd::AsyncFileDialog::new(), |dialog, (name, extensions)| dialog.add_filter_any_case(name, &extensions))
     }
 
     pub fn open_dialog(&mut self) {
         self.startup_superseded = true;
         #[cfg(not(target_arch = "wasm32"))]
-        self.pick(
-            pickers::PickFor::Open,
-            rfd::AsyncFileDialog::new()
-                .add_filter_any_case("PDF", &["pdf"])
-                .add_filter_any_case(tl!("Images and text (converted to PDF)"), &create_ui::CONVERTIBLE),
-            true,
-        );
+        self.pick(pickers::PickFor::Open, Self::open_picker(), true);
         // Browsers pick files asynchronously; the bytes arrive through `inbox`.
         #[cfg(target_arch = "wasm32")]
         {
@@ -1035,12 +1048,7 @@ impl PdfCraftApp {
             let read = super::input::WebRead::start(&self.web_reads);
             wasm_bindgen_futures::spawn_local(async move {
                 let _read = read;
-                if let Some(h) = rfd::AsyncFileDialog::new()
-                    .add_filter_any_case("PDF", &["pdf"])
-                    .add_filter_any_case(tl!("Images and text"), &create_ui::CONVERTIBLE)
-                    .pick_file()
-                    .await
-                {
+                if let Some(h) = Self::open_picker().pick_file().await {
                     let bytes = h.read().await;
                     if let Ok(mut q) = inbox.lock() {
                         q.push((h.file_name(), bytes));
diff --git a/crates/ui-egui/src/app/keys.rs b/crates/ui-egui/src/app/keys.rs
index 7894643a4b..7471c2f69f 100644
--- a/crates/ui-egui/src/app/keys.rs
+++ b/crates/ui-egui/src/app/keys.rs
@@ -10,6 +10,10 @@ impl PdfCraftApp {
         if self.close_request.is_some() {
             // These dialogs are drawn after the save prompt and own the keyboard while open.
             // Don't let Escape or Return resolve unsaved work underneath one.
+            #[cfg(not(target_arch = "wasm32"))]
+            if self.script_pending.as_ref().is_some_and(|pending| pending.has_prompt()) {
+                return;
+            }
             let covered = self.pending_link.is_some()
                 || self.pending_remote_link.is_some()
                 || self.pending_full_screen.is_some()
diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index f6afc0327c..79924f7128 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -1448,6 +1448,8 @@ struct PageFrame<'a> {
     current_height: f32,
     pressed_page: Option<usize>,
     calc_hover: Option<crate::calc_order_ui::Focus>,
+    /// The form field widget under the pointer on any page, for its Mouse Enter and Exit scripts.
+    field_hover: Option<crate::forms_ui::WidgetRef>,
     /// A page took this frame's right-click.
     right_clicked: bool,
 }
@@ -1930,6 +1932,7 @@ fn draw_pages(
         current_height: f32::INFINITY,
         pressed_page: None,
         calc_hover: None,
+        field_hover: None,
         right_clicked: false,
     };
     for &i in visible_pages {
@@ -1944,10 +1947,12 @@ fn draw_pages(
         current_height,
         pressed_page,
         calc_hover,
+        field_hover,
         out: page_out,
         right_clicked,
         ..
     } = frame;
+    crate::forms_ui::hover_moved(view, field_hover);
     // A right-click no page took deselects the comment, so the page's menu opens, not the comment's,
     // and with Edit text the picture (one on a page went to that page, `page_input`).
     if resp.secondary_clicked() && !right_clicked {
@@ -3824,8 +3829,8 @@ fn apply_frame_requests(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui,
             crate::forms_ui::FormNotice::NoAction(name) => app.notify_fmt("{name} has no action", &[("name", &name)]),
         }
     }
-    if let Some((name, action)) = app.views[index].forms.button.take() {
-        run_button(app, index, &name, action);
+    if let Some((name, identity, action)) = app.views[index].forms.button.take() {
+        run_button(app, index, &name, identity, action);
     }
     if copy_selected {
         app.execute("edit.copy");
diff --git a/crates/ui-egui/src/canvas/area.rs b/crates/ui-egui/src/canvas/area.rs
index 2e3b63b5f8..daaf88a9c6 100644
--- a/crates/ui-egui/src/canvas/area.rs
+++ b/crates/ui-egui/src/canvas/area.rs
@@ -161,7 +161,7 @@ pub(super) fn page_scroll<R>(
 }
 
 /// Run a push button's action (the ones that need no JavaScript engine).
-pub(super) fn run_button(app: &mut PdfCraftApp, index: usize, name: &str, action: pdfcraft_engine::form_scripts::ButtonAction) {
+pub(super) fn run_button(app: &mut PdfCraftApp, index: usize, name: &str, identity: u64, action: pdfcraft_engine::form_scripts::ButtonAction) {
     use pdfcraft_engine::form_scripts::ButtonAction as B;
     let pages = app.session.get(app.views[index].id).map_or(0, |d| d.info.pages.len());
     match action {
@@ -205,7 +205,10 @@ pub(super) fn run_button(app: &mut PdfCraftApp, index: usize, name: &str, action
                     read_only: None,
                     required: None,
                     display: Some(if hide { 1 } else { 0 }),
-                    rect: None,
+                    caption: None,
+                    text_color: None,
+                    fill_color: None,
+                    ..Default::default()
                 })
                 .collect();
             if !changes.is_empty() {
@@ -234,10 +237,10 @@ pub(super) fn run_button(app: &mut PdfCraftApp, index: usize, name: &str, action
             "{name} submits the form to {url}; PdfCraft doesn't send form data. Save the document to keep your entries.",
             &[("name", name), ("url", &url)],
         ),
-        B::ImportIcon => app.choose_field_image(name),
+        B::ImportIcon => app.choose_field_image_target(app.views[index].id, name, Some(identity)),
         B::Script(js) => {
             let id = app.views[index].id;
-            app.run_button_script(id, name, &js);
+            app.run_button_script_target(id, name, Some(identity), &js);
         }
     }
 }
diff --git a/crates/ui-egui/src/canvas/page_input.rs b/crates/ui-egui/src/canvas/page_input.rs
index b39c16fde0..1f6666933d 100644
--- a/crates/ui-egui/src/canvas/page_input.rs
+++ b/crates/ui-egui/src/canvas/page_input.rs
@@ -966,6 +966,9 @@ pub(super) fn page_overlays(ui: &mut egui::Ui, view: &mut DocView, frame: &mut P
     } else {
         crate::forms_ui::paint_page(painter, &xf, i, info, form, view, input.hover.as_ref());
         crate::forms_ui::tooltip(resp, form, input.hover.as_ref());
+        if let Some(hovered) = crate::forms_ui::hovered(form, input.hover.as_ref()) {
+            frame.field_hover = Some(hovered);
+        }
     }
 
     // Form-field highlight (Acrobat's "Highlight existing fields"); required fields get a
diff --git a/crates/ui-egui/src/canvas/selection.rs b/crates/ui-egui/src/canvas/selection.rs
index f50bbcfa70..3d465a0c8e 100644
--- a/crates/ui-egui/src/canvas/selection.rs
+++ b/crates/ui-egui/src/canvas/selection.rs
@@ -250,16 +250,13 @@ pub(super) fn selection_actions(
     view.clear_selection();
     match action {
         SelectionAction::Note | SelectionAction::Replace => {
-            if matches!(action, SelectionAction::Replace) {
+            let kind = if matches!(action, SelectionAction::Replace) {
                 view.comments.replace = Some(quads);
-            }
-            view.comments.composer = Some(comments::Composer {
-                page,
-                at,
-                kind: if matches!(action, SelectionAction::Replace) { comments::ComposerKind::Replace } else { comments::ComposerKind::Note },
-                text: String::new(),
-                focus: true,
-            });
+                comments::ComposerKind::Replace
+            } else {
+                comments::ComposerKind::TextNote { quads }
+            };
+            view.comments.composer = Some(comments::Composer { page, at, kind, text: String::new(), focus: true });
         }
         SelectionAction::Markup(tool) => {
             // Every markup button carries a markup tool; anything else adds nothing.
diff --git a/crates/ui-egui/src/canvas/sign_tab_tests.rs b/crates/ui-egui/src/canvas/sign_tab_tests.rs
index 60a57f8137..c2d5c20748 100644
--- a/crates/ui-egui/src/canvas/sign_tab_tests.rs
+++ b/crates/ui-egui/src/canvas/sign_tab_tests.rs
@@ -57,6 +57,7 @@ fn field(name: &str, page: usize, rect: [f64; 4]) -> FormField {
         quadding: 0,
         tooltip: None,
         widgets: vec![FormWidget {
+            mouse_up_script: None,
             obj: pdfcraft_cos::ObjRef::new(4, 0),
             page: Some(page),
             rect,
diff --git a/crates/ui-egui/src/commands.rs b/crates/ui-egui/src/commands.rs
index 549a877172..3b422181a9 100644
--- a/crates/ui-egui/src/commands.rs
+++ b/crates/ui-egui/src/commands.rs
@@ -156,7 +156,9 @@ impl PdfCraftApp {
                 }
             }
             commands::Needs::Unlock if self.active.is_some() => tl!("This document has no restrictions to lift").to_string(),
-            commands::Needs::Assembly | commands::Needs::Modification | commands::Needs::Annotate if self.active.is_some() => {
+            commands::Needs::Assembly | commands::Needs::PageExtraction | commands::Needs::Modification | commands::Needs::Annotate
+                if self.active.is_some() =>
+            {
                 tl!("The document's security settings don't allow this change").to_string()
             }
             commands::Needs::Copying if self.active.is_some() => crate::copy_refused().to_string(),
diff --git a/crates/ui-egui/src/dialogs.rs b/crates/ui-egui/src/dialogs.rs
index 1d768e72a2..8316b8bf3d 100644
--- a/crates/ui-egui/src/dialogs.rs
+++ b/crates/ui-egui/src/dialogs.rs
@@ -99,8 +99,10 @@ pub fn show(app: &mut PdfCraftApp, ctx: &egui::Context) {
         ctx.set_cursor_icon(egui::CursorIcon::Default);
     }
     dialogs(app, ctx);
-    // Last, so it sits above Document Properties when Security's Unlock… asked for it.
+    // Above Document Properties when Security's Unlock… asked for it; script prompts stay on top.
     unlock(app, ctx);
+    #[cfg(not(target_arch = "wasm32"))]
+    app.show_script_dialog(ctx);
 }
 
 /// Draw the active modal dialog and apply the action the user chose.
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index 29180aeab7..f6144ec143 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -524,10 +524,22 @@ impl PdfCraftApp {
         // click that brought this pane forward took the focus). It goes in first, as it came first.
         let (other_applied, stay) = self.apply_other_pane_edit(i);
         let modal = self.modal_open();
+        let generation = |app: &Self| app.views.get(i).and_then(|v| app.session.get(v.id)).map(|d| d.edit_generation());
+        let before = generation(self);
+        let queued = self.views.get(i).is_some_and(|v| v.pending_edit.is_some());
         let applied = self.apply_queued_edit(i) && other_applied;
+        // A click's Mouse Up waits on the edit it queued (a check box's toggle, a list's pick):
+        // when that was refused, the click did nothing and its Mouse Up doesn't run either.
+        if queued
+            && generation(self) == before
+            && let Some(view) = self.views.get_mut(i)
+        {
+            view.forms.triggers.retain(|(_, t)| *t != pdfcraft_engine::FieldTrigger::MouseUp);
+        }
         // After the queued edit: a value typed into the field the focus left has been taken (and
         // its change has run the field's exit) before the focus scripts run.
         self.run_focus_scripts(i);
+        self.run_field_triggers(i);
         if !applied {
             // Nor may a shortcut pressed with it (⌘S right after Enter) run behind the refusal.
             self.deferred_commands.clear();
@@ -818,7 +830,8 @@ impl PdfCraftApp {
     /// ([`crate::forms_ui::refresh_draft`]), so leaving the field doesn't write the old value back.
     fn run_focus_scripts(&mut self, i: usize) {
         let Some(view) = self.views.get_mut(i) else { return };
-        let now = view.forms.focus.as_ref().map(|f| (f.name.clone(), f.widget));
+        // The field's object too: moving between fields sharing a name is a move (#344 review).
+        let now = view.forms.focus.as_ref().map(|f| (f.name.clone(), f.obj, f.widget));
         if view.forms.focused == now {
             return;
         }
@@ -826,13 +839,13 @@ impl PdfCraftApp {
         let id = view.id;
         let edited = view.forms.focus.clone();
         use pdfcraft_engine::js::FieldFocus;
-        for ((name, widget), focus) in [left.map(|l| (l, FieldFocus::Exit)), now.map(|n| (n, FieldFocus::Enter))].into_iter().flatten() {
+        for ((name, obj, widget), focus) in [left.map(|l| (l, FieldFocus::Exit)), now.map(|n| (n, FieldFocus::Enter))].into_iter().flatten() {
             // The edited field's value before this script, to tell its untouched draft from typing:
             // the exit of the field left may have changed it already, and the draft with it.
             let before: Option<(String, Vec<String>)> = edited.as_ref().and_then(|e| {
                 crate::forms_ui::focused_field(e, &self.session.get(id)?.form).map(|f| (crate::forms_ui::draft_text(f), f.value.clone()))
             });
-            match self.session.field_focus(id, &name, widget, focus) {
+            match self.session.field_focus_target(id, &name, obj.map(pdfcraft_engine::js::field_object_id), widget, focus) {
                 Ok(changed) => {
                     if changed
                         && let Some(info) = self.session.get(id).map(|d| d.info.clone())
@@ -854,6 +867,42 @@ impl PdfCraftApp {
         }
     }
 
+    /// The pointer triggers tab `i` queued (Mouse Enter, Exit, Down, and a check box's Mouse Up
+    /// after its toggle), each running its widget's JavaScript in the document's realm (#269).
+    fn run_field_triggers(&mut self, i: usize) {
+        let Some(view) = self.views.get_mut(i) else { return };
+        let triggers = std::mem::take(&mut view.forms.triggers);
+        let id = view.id;
+        for ((name, object, widget), trigger) in triggers {
+            // The field being edited as it was, so a script changing it shows in its editor
+            // while a draft the user already typed into is kept (as `run_focus_scripts` does).
+            let before: Option<(String, Vec<String>)> = self.views.get(i).and_then(|v| v.forms.focus.as_ref()).and_then(|e| {
+                crate::forms_ui::focused_field(e, &self.session.get(id)?.form).map(|f| (crate::forms_ui::draft_text(f), f.value.clone()))
+            });
+            match self.session.field_trigger_target(id, &name, Some(object), widget, trigger) {
+                Ok(changed) => {
+                    if changed
+                        && let Some(info) = self.session.get(id).map(|d| d.info.clone())
+                        && let Some(view) = self.views.get_mut(i)
+                    {
+                        view.document_changed(&info);
+                        if let Some(before) = &before
+                            && let Some(draft) = view.forms.focus.as_mut()
+                            && let Some(f) = self.session.get(id).and_then(|d| crate::forms_ui::focused_field(draft, &d.form))
+                        {
+                            crate::forms_ui::refresh_draft(draft, (&before.0, &before.1), (crate::forms_ui::draft_text(f), &f.value));
+                        }
+                    }
+                    let out = self.session.take_js_output(id);
+                    if !out.is_empty() {
+                        self.handle_js(id, out);
+                    }
+                }
+                Err(e) => self.notify_error(e),
+            }
+        }
+    }
+
     /// Apply the edit queued on tab `i` (the active one). Returns false only when it was a
     /// field's typing and the field refused it (#166): the editor reopens with the text, and the
     /// user has been told why, so the typing isn't lost and the caller can stop.
@@ -1202,6 +1251,7 @@ fn is_form_edit(edit: &Edit) -> bool {
             | Edit::DuplicateField { .. }
             | Edit::SetFieldProps { .. }
             | Edit::SetFieldImage { .. }
+            | Edit::SetFieldImageTarget { .. }
             | Edit::SetFieldScript { .. }
             | Edit::SetCalculationOrder { .. }
             | Edit::ApplyScriptChanges { .. }
@@ -1577,6 +1627,43 @@ mod revert_draft_tests {
         assert_eq!(hint(&app), "", "hint's enter ran before the document is read");
         assert_eq!(app.views[0].forms.focus.as_ref().map(|f| f.text.as_str()), Some(""), "and its editor shows it");
     }
+    /// A pointer trigger whose script changes the field being edited shows the change in its
+    /// editor, unless the user already typed there: then the typed draft is kept.
+    #[test]
+    fn a_pointer_trigger_changing_the_edited_field_refreshes_an_untouched_draft() {
+        let objs = [
+            "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R 6 0 R] /DA (/Helv 0 Tf 0 g) /DR << /Font << /Helv 5 0 R >> >> >> >>".to_string(),
+            "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 300] >>".into(),
+            "<< /Type /Page /Parent 2 0 R /Annots [4 0 R 6 0 R] >>".into(),
+            "<< /Type /Annot /Subtype /Widget /FT /Tx /T (name) /V (old) /Rect [20 250 180 270] /P 3 0 R /F 4 >>".into(),
+            "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >>".into(),
+            "<< /Type /Annot /Subtype /Widget /FT /Tx /T (hot) /V () /Rect [20 200 180 220] /P 3 0 R /F 4 /AA << /E << /S /JavaScript /JS (getField\\('name'\\).value = 'new';) >> >> >>".into(),
+        ];
+        let mut pdf = b"%PDF-1.7\n".to_vec();
+        let mut offsets = Vec::new();
+        for (i, o) in objs.iter().enumerate() {
+            offsets.push(pdf.len());
+            pdf.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+        }
+        let xref = pdf.len();
+        pdf.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+        for o in offsets {
+            pdf.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+        }
+        pdf.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+        for (typed, shown) in [(false, "new"), (true, "typed")] {
+            let mut app = PdfCraftApp::new();
+            app.open_bytes("hot.pdf", None, pdf.clone()).unwrap();
+            let hot = app.session.get(app.views[0].id).unwrap().form.iter().find(|f| f.name == "hot").unwrap().obj;
+            let text = if typed { "typed" } else { "old" };
+            app.views[0].forms.focus = Some(Focus { text: text.into(), picked: vec!["old".into()], ..focus("") });
+            let hot = ("hot".to_string(), pdfcraft_engine::js::field_object_id(hot), 0);
+            app.views[0].forms.triggers.push((hot, pdfcraft_engine::FieldTrigger::MouseEnter));
+            app.run_field_triggers(0);
+            assert_eq!(app.views[0].forms.focus.as_ref().map(|f| f.text.as_str()), Some(shown), "typed: {typed}");
+        }
+    }
+
     #[test]
     fn successful_revert_clears_focused_or_queued_drafts_only_on_its_document() {
         for queued in [false, true] {
diff --git a/crates/ui-egui/src/editing/save.rs b/crates/ui-egui/src/editing/save.rs
index ea29f7fe46..77eb9c2b58 100644
--- a/crates/ui-egui/src/editing/save.rs
+++ b/crates/ui-egui/src/editing/save.rs
@@ -128,6 +128,7 @@ impl PdfCraftApp {
             if !self.flatten_fill_sign_for_save(id) {
                 return false;
             }
+            self.run_document_actions(id, pdfcraft_engine::js::DocumentScriptEvent::WillSave);
             let bytes = match self.session.save_bytes(id) {
                 Ok(b) => b,
                 Err(e) => {
@@ -293,6 +294,7 @@ impl PdfCraftApp {
             self.notify_tr("The document was closed before it could be saved.");
             return false;
         };
+        self.run_document_actions(id, pdfcraft_engine::js::DocumentScriptEvent::WillSave);
         let bytes = if full { self.session.save_full_bytes(id) } else { self.session.save_bytes(id) };
         let bytes = match bytes.and_then(|b| self.session.check_save(id, &b).map(|()| b)) {
             Ok(b) => b,
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index 0c64ab3a11..d77c7b1eb7 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -92,6 +92,8 @@ mod frame_guard;
 mod hooks;
 mod persist;
 mod platform;
+#[cfg(not(target_arch = "wasm32"))]
+mod script_dialog;
 mod state;
 mod tools;
 mod workflows;
@@ -658,6 +660,8 @@ pub struct PdfCraftApp {
     pub compare: Option<compare_ui::CompareState>,
     /// The JavaScript console and the Document JavaScripts draft.
     pub js_console: js_ui::JsConsole,
+    #[cfg(not(target_arch = "wasm32"))]
+    pub(crate) script_pending: Option<script_dialog::Pending>,
     pub doc_js: js_ui::DocJsDraft,
     pub a11y: a11y_ui::A11yState,
     pub(crate) tags_state: tags_ui::State,
diff --git a/crates/ui-egui/src/platform/open_worker.rs b/crates/ui-egui/src/platform/open_worker.rs
index 8f7b0c5d3f..b9c3735e4a 100644
--- a/crates/ui-egui/src/platform/open_worker.rs
+++ b/crates/ui-egui/src/platform/open_worker.rs
@@ -20,7 +20,12 @@ pub(crate) enum Input {
 
 pub(crate) enum ResultKind {
     Conversion(Arc<Vec<u8>>),
-    Prepared { bytes: Arc<Vec<u8>>, result: Box<Result<PreparedDocument, OpenError>> },
+    /// An Office document LibreOffice converted here, off the frame thread, or why it couldn't.
+    Converted(Result<Arc<Vec<u8>>, String>),
+    Prepared {
+        bytes: Arc<Vec<u8>>,
+        result: Box<Result<PreparedDocument, OpenError>>,
+    },
     ReadFailed(String),
     RemoteFailed(String),
     RecoveryFailed(String),
@@ -213,8 +218,11 @@ fn prepare(job: Job) -> ResultKind {
         },
         Input::Bytes(bytes) => bytes.clone(),
     };
-    if matches!(pdfcraft_engine::source_kind(&job.name, &bytes), Some(SourceKind::Image | SourceKind::Text)) {
-        return ResultKind::Conversion(bytes);
+    match pdfcraft_engine::source_kind(&job.name, &bytes) {
+        Some(SourceKind::Image | SourceKind::Text) => return ResultKind::Conversion(bytes),
+        // LibreOffice takes seconds: it runs here, and the frame thread only opens the result.
+        Some(SourceKind::Office) => return ResultKind::Converted(pdfcraft_engine::office_to_pdf(&job.name, &bytes).map_err(|e| e.to_string())),
+        Some(SourceKind::Pdf) | None => {}
     }
     let result = job.context.prepare_open(job.name, job.path, bytes.clone(), job.password.as_deref().map(String::as_str));
     ResultKind::Prepared { bytes, result: Box::new(result) }
diff --git a/crates/ui-egui/src/platform/open_worker/tests.rs b/crates/ui-egui/src/platform/open_worker/tests.rs
index 62520f3edf..7f8d73fa8d 100644
--- a/crates/ui-egui/src/platform/open_worker/tests.rs
+++ b/crates/ui-egui/src/platform/open_worker/tests.rs
@@ -130,10 +130,15 @@ impl HeldToolOpen {
         self.started.recv_timeout(Duration::from_secs(5)).expect("the native open reached its preparation barrier");
     }
 
-    #[allow(clippy::expect_used)]
     fn complete(&self, harness: &mut Harness<'static, PdfCraftApp>) {
+        self.complete_within(harness, Duration::from_secs(5));
+    }
+
+    /// [`Self::complete`] for a preparation that may take up to `timeout`.
+    #[allow(clippy::expect_used)]
+    fn complete_within(&self, harness: &mut Harness<'static, PdfCraftApp>, timeout: Duration) {
         self.release.send(()).expect("release the native preparation");
-        self.finished.recv_timeout(Duration::from_secs(5)).expect("the native open returned its result");
+        self.finished.recv_timeout(timeout).expect("the native open returned its result");
         harness.run_steps(2);
     }
 }
@@ -997,3 +1002,55 @@ fn a_password_prompt_keeps_a_place_in_the_open_queue_for_its_retry() {
     assert!(app.password_prompt.is_none(), "the retry is queued: {:?}", app.password_prompt.as_ref().and_then(|p| p.error.clone()));
     assert!(app.password_retry.is_some());
 }
+
+/// A Word document built from the synthetic fixture (PdfCraft's own Word export).
+#[allow(clippy::expect_used)]
+fn synthetic_docx() -> Vec<u8> {
+    let mut session = pdfcraft_engine::Session::new();
+    let id = session.open("source.pdf", None, Arc::new(fixture(1)), None).expect("open the fixture");
+    session.get(id).expect("the fixture").export_office(pdfcraft_engine::compare::OfficeFormat::Docx)
+}
+
+/// File ▸ Open of a Word document: LibreOffice runs on the open worker, never on the frame
+/// thread, and the result opens as a new, unsaved PDF. Without LibreOffice the user is
+/// told it is needed, rather than that the file is a broken PDF.
+#[test]
+#[allow(clippy::expect_used)]
+fn file_open_converts_an_office_document_on_the_worker() {
+    let mut harness = tool_open_harness();
+    let held = HeldToolOpen::install(&mut harness);
+    let file = tool_open_file("office", "docx", &synthetic_docx());
+    harness.state_mut().pick_override = Some(vec![file.0.to_string_lossy().into_owned()]);
+    harness.state_mut().run_command("file.open");
+    harness.run_steps(2);
+    held.wait_started();
+    assert!(harness.state().views.is_empty(), "nothing opens before the conversion finishes");
+    // An installed LibreOffice takes seconds; it is stopped after 120 s.
+    held.complete_within(&mut harness, Duration::from_secs(150));
+    let app = harness.state();
+    assert!(app.pending_opens.is_empty());
+    if let Some(view) = app.views.first() {
+        let doc = app.session.get(view.id).expect("the converted document");
+        // Named after the Word file: `<stem>.docx` opens as `<stem>.pdf`.
+        assert_eq!(doc.name, format!("pdfcraft-open-tool-{}-office.pdf", std::process::id()));
+        assert!(doc.path.is_none(), "the converted PDF is new and unsaved, not the .docx on disk");
+    } else {
+        let message = app.toast.as_ref().map(|(message, _)| message.clone()).unwrap_or_default();
+        assert!(message.contains("LibreOffice, which isn't installed"), "the failure names the missing dependency: {message}");
+    }
+}
+
+#[test]
+fn the_open_picker_defaults_to_pdf_and_offers_images_office_text_and_all_files() {
+    let filters = PdfCraftApp::open_filters();
+    let names: Vec<&str> = filters.iter().map(|(name, _)| name.as_str()).collect();
+    #[cfg(not(target_os = "macos"))]
+    assert_eq!(names, ["PDF", "Images", "Office documents", "Text", "All files"]);
+    #[cfg(target_os = "macos")]
+    assert_eq!(names, ["PDF", "Images", "Office documents", "Text"]);
+    let extensions = |name: &str| filters.iter().find(|(n, _)| n == name).map(|(_, e)| e.clone()).unwrap_or_default();
+    assert_eq!(extensions("PDF"), ["pdf"]);
+    assert_eq!(extensions("Images"), pdfcraft_engine::IMAGE_EXTENSIONS);
+    assert!(["doc", "docx", "xls", "xlsx", "ppt", "pptx", "odt", "rtf"].iter().all(|e| extensions("Office documents").contains(e)));
+    assert_eq!(extensions("Text"), pdfcraft_engine::TEXT_EXTENSIONS);
+}
diff --git a/crates/ui-egui/src/script_dialog.rs b/crates/ui-egui/src/script_dialog.rs
new file mode 100644
index 0000000000..2249f7bfd7
--- /dev/null
+++ b/crates/ui-egui/src/script_dialog.rs
@@ -0,0 +1,412 @@
+//! Script prompts suspend the document worker, never the egui event loop.
+use crate::PdfCraftApp;
+use pdfcraft_engine::{
+    DocId,
+    js::{InteractiveEvent, JsOutput, MenuItem, PendingScript, Prompt},
+};
+use std::sync::mpsc::{Sender, TryRecvError};
+use std::time::{Duration, Instant};
+
+pub(crate) struct Pending {
+    run: PendingScript,
+    prompt: Option<(Prompt, Sender<Option<String>>)>,
+    text: String,
+    focus: bool,
+    started: Instant,
+    zoom: f32,
+    page: usize,
+    serial: u32,
+}
+impl Pending {
+    /// Whether this invocation is waiting for an explicit user reply rather than worker execution.
+    pub(crate) fn has_prompt(&self) -> bool {
+        self.prompt.is_some()
+    }
+}
+
+/// Draw the bounded menu tree and return only the selected enabled leaf value.
+fn menu(ui: &mut egui::Ui, items: &[MenuItem], answer: &mut Option<String>) {
+    for item in items {
+        if item.name == "-" {
+            ui.separator();
+            continue;
+        }
+        ui.add_enabled_ui(item.enabled, |ui| {
+            if item.children.is_empty() {
+                if ui.selectable_label(item.marked, &item.name).clicked() {
+                    *answer = Some(item.value.clone());
+                }
+            } else {
+                egui::CollapsingHeader::new(&item.name).show(ui, |ui| menu(ui, &item.children, answer));
+            }
+        });
+    }
+}
+/// Consume the current prompt before replying so two UI events cannot resume it twice.
+fn reply_to_prompt(ctx: &egui::Context, pending: &mut Pending, answer: Option<String>, cancel: bool) {
+    if let Some((prompt, reply)) = pending.prompt.take() {
+        let answer = if cancel {
+            match prompt {
+                Prompt::Alert(m) => Some(
+                    match m.buttons {
+                        pdfcraft_engine::js::MessageButtons::Ok => "1",
+                        pdfcraft_engine::js::MessageButtons::YesNo => "3",
+                        _ => "2",
+                    }
+                    .into(),
+                ),
+                _ => None,
+            }
+        } else {
+            answer
+        };
+        let _ = reply.send(answer);
+    }
+    pending.started = Instant::now();
+    ctx.request_repaint();
+}
+
+impl PdfCraftApp {
+    /// Start one explicit button interaction with captured document/view state and leave egui responsive.
+    pub(crate) fn start_ui_script(&mut self, id: DocId, script: &str, field: Option<&str>, identity: Option<u64>) {
+        if self.script_pending.is_some() {
+            self.notify("Another form script is active; this click was not run");
+            return;
+        }
+        let Some(view) = self.views.iter().find(|v| v.id == id) else { return };
+        let (zoom, page, highlight) = (view.zoom, view.current, view.highlight_fields);
+        self.session.set_javascript_view(id, zoom as f64 * 100.0, highlight, page);
+        match self.session.start_javascript_target(id, script, field, identity) {
+            Ok(run) => {
+                self.script_pending =
+                    Some(Pending { run, prompt: None, text: String::new(), focus: false, started: Instant::now(), zoom, page, serial: 0 })
+            }
+            Err(e) => self.notify(e.to_string()),
+        }
+    }
+    /// Receive worker prompts/results and invalidate stale or timed-out interactions before applying their edits.
+    pub(crate) fn poll_script_dialog(&mut self, ctx: &egui::Context) {
+        let Some(mut pending) = self.script_pending.take() else { return };
+        let current = (self.active_ids().is_some_and(|(_, id)| id == pending.run.id)
+            || self.compare.as_ref().is_some_and(|c| {
+                c.side_by_side
+                    && (c.old == pending.run.id || c.new == pending.run.id)
+                    && self.active_ids().is_some_and(|(_, active)| active == c.old || active == c.new)
+            }))
+            && self.session.script_pending_current(&pending.run)
+            && self.views.iter().find(|v| v.id == pending.run.id).is_some_and(|v| v.zoom == pending.zoom && v.current == pending.page);
+        if !current {
+            self.session.discard_javascript(&pending.run);
+            return;
+        }
+        if (pending.prompt.is_none() && pending.started.elapsed() > Duration::from_secs(10))
+            || (pending.prompt.is_some() && pending.started.elapsed() > Duration::from_secs(300))
+        {
+            self.session.timeout_javascript(pending.run);
+            self.notify("The form script timed out; its result was discarded");
+            return;
+        }
+        if pending.prompt.is_none() {
+            match pending.run.receiver.try_recv() {
+                Ok(InteractiveEvent::Prompt(prompt, reply)) => {
+                    pending.text = match &prompt {
+                        Prompt::Text { default, .. } => default.clone(),
+                        _ => String::new(),
+                    };
+                    pending.serial = pending.serial.saturating_add(1);
+                    pending.focus = true;
+                    pending.started = Instant::now();
+                    pending.prompt = Some((prompt, reply));
+                }
+                Ok(InteractiveEvent::Complete(out)) => {
+                    let id = pending.run.id;
+                    match self.session.finish_javascript(pending.run, out) {
+                        Ok(out) => {
+                            if let Some(i) = self.views.iter().position(|v| v.id == id)
+                                && let Some(info) = self.session.get(id).map(|d| d.info.clone())
+                            {
+                                self.views[i].document_changed(&info);
+                            }
+                            self.handle_js(
+                                id,
+                                JsOutput {
+                                    alerts: Vec::new(),
+                                    console: out.console,
+                                    requests: out.requests,
+                                    errors: out.error.into_iter().chain(out.doc_errors).collect(),
+                                    doc_errors: Vec::new(),
+                                },
+                            );
+                        }
+                        Err(e) => self.notify(e.to_string()),
+                    }
+                    return;
+                }
+                Err(TryRecvError::Disconnected) => {
+                    self.session.discard_javascript(&pending.run);
+                    self.notify("The form script stopped unexpectedly");
+                    return;
+                }
+                Err(TryRecvError::Empty) => {}
+            }
+        }
+        // Input events wake egui immediately; idle prompts only need a coarse timeout check.
+        ctx.request_repaint_after(if pending.has_prompt() { Duration::from_secs(1) } else { Duration::from_millis(16) });
+        self.script_pending = Some(pending);
+    }
+    /// Display the current typed prompt and send one answer/cancellation without replaying script side effects.
+    pub(crate) fn show_script_dialog(&mut self, ctx: &egui::Context) {
+        self.show_script_dialog_with_menu(ctx, |_, _, _| None);
+    }
+
+    /// Let an alternative renderer own a menu until it returns a selection or cancellation.
+    /// Returning `None` uses the built-in modal; the renderer never receives the reply sender.
+    pub fn show_script_dialog_with_menu(
+        &mut self,
+        ctx: &egui::Context,
+        render_menu: impl FnOnce(&egui::Context, DocId, &[MenuItem]) -> Option<std::task::Poll<Option<String>>>,
+    ) {
+        let Some(pending) = self.script_pending.as_mut() else { return };
+        let Some((prompt, _)) = pending.prompt.as_ref() else { return };
+        let Some(doc) = self.session.get(pending.run.id) else { return };
+        if let Prompt::Menu(items) = prompt
+            && let Some(reply) = render_menu(ctx, pending.run.id, items)
+        {
+            if let std::task::Poll::Ready(answer) = reply {
+                let cancel = answer.is_none();
+                reply_to_prompt(ctx, pending, answer, cancel);
+            }
+            return;
+        }
+        // Keep the filename in a separate, single-line label. It is document data too.
+        let document_name: String = doc
+            .name
+            .chars()
+            .filter(|c| !c.is_control() && !matches!(c, '\u{061c}' | '\u{200e}'..='\u{200f}' | '\u{2028}'..='\u{202e}' | '\u{2066}'..='\u{2069}'))
+            .take(160)
+            .collect();
+        let mut answer = None;
+        let mut cancel = ctx.input(|i| i.key_pressed(egui::Key::Escape));
+        let prompt_modal = crate::widgets::modal(ctx, ("document-script-prompt", pending.run.id.0, pending.serial));
+        // A different dialog may have been opened after this prompt. Drawing last alone
+        // does not reorder retained egui areas, so explicitly retain modal input priority.
+        ctx.move_to_top(prompt_modal.area.layer());
+        let modal = prompt_modal.show(ctx, |ui| {
+            ui.set_width(360.0);
+            ui.heading(tl!("This document's script is asking"));
+            ui.add(egui::Label::new(crate::i18n::fmt(tl!("Document: {name}"), &[("name", &document_name)])).truncate());
+            ui.separator();
+            match prompt {
+                Prompt::Menu(items) => {
+                    egui::ScrollArea::vertical().max_height(400.0).show(ui, |ui| menu(ui, items, &mut answer));
+                }
+                Prompt::Text { title, question, password, label, .. } => {
+                    if *password {
+                        ui.label(tl!("This request comes from the document, not PdfCraft. Only enter a password if you trust this document."));
+                    }
+                    if !title.is_empty() {
+                        ui.label(title);
+                    }
+                    ui.label(question);
+                    if !label.is_empty() {
+                        ui.label(label);
+                    }
+                    let field = ui.add(egui::TextEdit::singleline(&mut pending.text).password(*password).char_limit(4096));
+                    if pending.focus {
+                        field.request_focus();
+                        pending.focus = false;
+                    }
+                    if ui.add_enabled(pending.text.len() <= 4096, egui::Button::new(tl!("OK"))).clicked() {
+                        answer = Some(pending.text.clone());
+                    }
+                }
+                Prompt::Alert(message) => {
+                    if let Some(title) = &message.title {
+                        ui.label(title);
+                    }
+                    ui.label(&message.text);
+                    use pdfcraft_engine::js::MessageButtons as B;
+                    ui.horizontal(|ui| match message.buttons {
+                        B::Ok | B::OkCancel => {
+                            if ui.button(tl!("OK")).clicked() {
+                                answer = Some("1".into());
+                            }
+                        }
+                        B::YesNo | B::YesNoCancel => {
+                            if ui.button(tl!("Yes")).clicked() {
+                                answer = Some("4".into());
+                            }
+                            if ui.button(tl!("No")).clicked() {
+                                answer = Some("3".into());
+                            }
+                        }
+                    });
+                }
+            }
+            if ui.button(tl!("Cancel")).clicked() {
+                cancel = true;
+            }
+        });
+        cancel |= answer.is_none() && modal.should_close();
+        if answer.is_some() || cancel {
+            reply_to_prompt(ctx, pending, answer, cancel);
+        }
+    }
+}
+
+#[cfg(test)]
+mod review_tests {
+    use super::*;
+    /// The central shortcut/page-input gate must see a real pending script prompt.
+    #[test]
+    fn a_script_prompt_blocks_document_input_until_answered() {
+        let mut app = PdfCraftApp::new();
+        let bytes = app.session.create_blank(200.0, 300.0, 1).unwrap();
+        app.open_bytes("synthetic.pdf", None, bytes.to_vec()).unwrap();
+        let id = app.active_ids().unwrap().1;
+        app.start_ui_script(id, "app.response({cQuestion:'Wait'});", None, None);
+        let ctx = egui::Context::default();
+        for _ in 0..300 {
+            app.poll_script_dialog(&ctx);
+            if app.script_pending.as_ref().is_some_and(|p| p.prompt.is_some()) {
+                break;
+            }
+            std::thread::sleep(Duration::from_millis(5));
+        }
+        assert!(app.script_pending.as_ref().unwrap().prompt.is_some());
+        assert!(app.modal_open(), "an unanswered script prompt must block document input");
+        let (_, reply) = app.script_pending.as_mut().unwrap().prompt.take().unwrap();
+        reply.send(None).unwrap();
+        for _ in 0..300 {
+            app.poll_script_dialog(&ctx);
+            if app.script_pending.is_none() {
+                break;
+            }
+            std::thread::sleep(Duration::from_millis(5));
+        }
+        assert!(app.script_pending.is_none());
+        assert!(!app.modal_open());
+    }
+}
+
+#[cfg(test)]
+mod review13_ui_tests {
+    use super::*;
+    /// Create a native app with a visible synthetic blank document and no renderer.
+    fn app() -> (PdfCraftApp, DocId) {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        let bytes = app.session.create_blank(200.0, 300.0, 2).unwrap();
+        app.open_bytes("synthetic.pdf", None, bytes.to_vec()).unwrap();
+        let id = app.active_ids().unwrap().1;
+        (app, id)
+    }
+    /// Refused clicks and execution/prompt timeouts are visible, while stale runs stay silent.
+    #[test]
+    fn busy_and_timeout_notices_do_not_claim_worker_termination() {
+        let ctx = egui::Context::default();
+        for (timeout, prompt) in [(true, false), (true, true), (false, false)] {
+            let (mut app, id) = app();
+            app.start_ui_script(id, "app.response({cQuestion:'Wait'});", None, None);
+            app.start_ui_script(id, "var shouldNotRun=1;", None, None);
+            assert!(app.toast.as_ref().unwrap().0.contains("not run"));
+            app.toast = None;
+            if prompt {
+                let deadline = Instant::now() + Duration::from_secs(5);
+                while app.script_pending.as_ref().unwrap().prompt.is_none() && Instant::now() < deadline {
+                    app.poll_script_dialog(&ctx);
+                    std::thread::sleep(Duration::from_millis(5));
+                }
+                assert!(app.script_pending.as_ref().unwrap().prompt.is_some());
+            }
+            if timeout {
+                app.script_pending.as_mut().unwrap().started = Instant::now() - Duration::from_secs(if prompt { 301 } else { 11 });
+            } else {
+                app.views.iter_mut().find(|v| v.id == id).unwrap().zoom += 1.0;
+            }
+            app.poll_script_dialog(&ctx);
+            assert!(app.script_pending.is_none());
+            if timeout {
+                assert_eq!(app.toast.as_ref().unwrap().0, "The form script timed out; its result was discarded");
+            } else {
+                assert!(app.toast.is_none());
+            }
+        }
+    }
+    /// Comparison completion preserves globals and sends Save As/Print to its source document.
+    #[test]
+    fn non_active_comparison_document_completes_native_script() {
+        for request in ["", "app.execMenuItem('SaveAs');", "print();"] {
+            let (mut app, old) = app();
+            app.views.iter_mut().find(|v| v.id == old).unwrap().current = 1;
+            let bytes = app.session.create_blank(200.0, 300.0, 1).unwrap();
+            app.open_bytes("new.pdf", None, bytes.to_vec()).unwrap();
+            let new = app.active_ids().unwrap().1;
+            assert_ne!(new, old);
+            let new_before = app.session.save_bytes(new).unwrap();
+            app.compare_old = Some(old);
+            app.run_compare();
+            assert!(app.compare.as_ref().unwrap().side_by_side);
+            let dir = std::env::temp_dir().join(format!(
+                "pdfcraft-comparison-request-{}-{}",
+                std::process::id(),
+                std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).unwrap().as_nanos()
+            ));
+            std::fs::create_dir(&dir).unwrap();
+            let saved = dir.join("source.pdf");
+            app.save_override = Some(saved.to_string_lossy().into_owned());
+            app.printer_source = Some(std::sync::Arc::new(Vec::new));
+            app.start_ui_script(old, &format!("var comparisonKept=42;{request}"), None, None);
+            let ctx = egui::Context::default();
+            let deadline = Instant::now() + Duration::from_secs(12);
+            while app.script_pending.is_some() && Instant::now() < deadline {
+                app.poll_script_dialog(&ctx);
+                std::thread::sleep(Duration::from_millis(5));
+            }
+            assert!(app.script_pending.is_none());
+            assert_eq!(app.session.run_javascript(old, "comparisonKept", None).unwrap().result.as_deref(), Some("42"));
+            assert_eq!(app.session.save_bytes(new).unwrap(), new_before);
+            assert!(app.session.get(new).unwrap().path.is_none());
+            if request.contains("SaveAs") {
+                assert_eq!(app.active_ids().unwrap().1, new, "Save As need not change the comparison tab");
+                assert_eq!(app.session.get(old).unwrap().path.as_deref(), saved.to_str());
+                let mut reopened = pdfcraft_engine::Session::new();
+                let id = reopened.open("saved.pdf", None, std::sync::Arc::new(std::fs::read(&saved).unwrap()), None).unwrap();
+                assert_eq!(reopened.get(id).unwrap().info.pages.len(), 2, "the saved file is the two-page source, not the one-page active file");
+            } else if request == "print();" {
+                assert_eq!(app.active_ids().unwrap().1, old, "Print must retain its source as the active document");
+                assert!(matches!(app.dialog, Some(crate::Dialog::Print)));
+                assert_eq!(app.print_draft.current_page, 1);
+                assert!(!saved.exists());
+            } else {
+                assert_eq!(app.active_ids().unwrap().1, new);
+                assert!(!saved.exists());
+            }
+            drop(app);
+            if saved.exists() {
+                std::fs::remove_file(saved).unwrap();
+            }
+            std::fs::remove_dir(dir).unwrap();
+        }
+    }
+    /// Script focus reveals the requested field page before opening its editor.
+    #[test]
+    fn script_focus_reveals_an_offscreen_widget() {
+        let (mut app, id) = app();
+        app.session
+            .apply(
+                id,
+                pdfcraft_engine::Edit::AddField {
+                    page: 1,
+                    rect: [20.0, 20.0, 120.0, 40.0],
+                    kind: pdfcraft_engine::NewField::Text { multiline: false },
+                    name: Some("later".into()),
+                },
+            )
+            .unwrap();
+        app.handle_js(id, JsOutput { requests: vec![pdfcraft_engine::js::Request::Focus("later".into())], ..Default::default() });
+        let view = app.views.iter().find(|v| v.id == id).unwrap();
+        assert_eq!(view.current, 1);
+        assert_eq!(view.forms.focus.as_ref().unwrap().name, "later");
+    }
+}
diff --git a/crates/ui-egui/src/tools/comments/composer.rs b/crates/ui-egui/src/tools/comments/composer.rs
index 5c765f7f41..c4fb1d7cbc 100644
--- a/crates/ui-egui/src/tools/comments/composer.rs
+++ b/crates/ui-egui/src/tools/comments/composer.rs
@@ -2,8 +2,8 @@ use super::geometry::{drawn_text_box_rect, page_rotation, text_box_rect};
 use super::paint::{edited_in_view, new_comment};
 use super::state::{ComposerKind, PageCx};
 use super::{
-    Color32, CommentPrefs, CommentTool, CornerRadius, DocInfo, DocView, Edit, LineEnding, NoteIcon, PagePointer, QuickTool, Shape, Tokens, pos2,
-    theme,
+    Color32, CommentPrefs, CommentTool, CornerRadius, DocInfo, DocView, Edit, LineEnding, Markup, NoteIcon, PagePointer, QuickTool, Shape, Tokens,
+    pos2, theme,
 };
 use crate::page_keys::PageKeys;
 
@@ -38,6 +38,7 @@ pub(crate) fn composer(ctx: &egui::Context, keys: PageKeys, view: &mut DocView,
     let c = view.comments.composer.as_mut()?;
     let title = match c.kind {
         ComposerKind::Note => "Sticky note",
+        ComposerKind::TextNote { .. } => "Add comment",
         ComposerKind::TextBox { .. } => "Text box",
         ComposerKind::Callout { .. } => "Callout",
         ComposerKind::Caret { .. } => "Inserted text",
@@ -125,6 +126,10 @@ pub(crate) fn composer(ctx: &egui::Context, keys: PageKeys, view: &mut DocView,
             view.comments.tool_done = true;
             Some(new_comment(&cx, CommentTool::Note, Shape::Note { at: c.at, icon: NoteIcon::Comment }, text))
         }
+        ComposerKind::TextNote { quads } => {
+            view.comments.tool_done = true;
+            Some(new_comment(&cx, CommentTool::Highlight, Shape::TextMarkup { kind: Markup::Highlight, quads }, text))
+        }
         ComposerKind::TextBox { size } => {
             view.comments.tool_done = true;
             let rotation = page_rotation(info, page);
diff --git a/crates/ui-egui/src/tools/comments/input.rs b/crates/ui-egui/src/tools/comments/input.rs
index 469ff5a262..79b69a6eba 100644
--- a/crates/ui-egui/src/tools/comments/input.rs
+++ b/crates/ui-egui/src/tools/comments/input.rs
@@ -211,10 +211,15 @@ pub(crate) fn describe(cx: &PageCx<'_>, view: &mut DocView) {
         .comments()
         // An open pop-up already shows the comment: no tooltip over it.
         .filter(|a| !a.popup.is_some_and(|w| w.open))
-        .filter(|a| cx.screen_rects(a).any(|r| r.contains(p)))
-        .filter_map(|a| hover_tip(a, cx.prefs).map(|text| (a.index, text)))
-        .max_by_key(|(index, _)| *index);
-    if let Some((_, text)) = top {
+        .filter_map(|a| {
+            let marker = cx.comment_marker_rect(a).is_some_and(|r| r.contains(p));
+            if !marker && !cx.screen_rects(a).any(|r| r.contains(p)) {
+                return None;
+            }
+            hover_tip(a, cx.prefs).map(|text| (marker, a.index, text))
+        })
+        .max_by_key(|(marker, index, _)| (*marker, *index));
+    if let Some((_, _, text)) = top {
         view.cursor.describe(Subject::Comment, text);
     }
 }
diff --git a/crates/ui-egui/src/tools/comments/paint.rs b/crates/ui-egui/src/tools/comments/paint.rs
index 8cdcb03c81..cb85b1c9a0 100644
--- a/crates/ui-egui/src/tools/comments/paint.rs
+++ b/crates/ui-egui/src/tools/comments/paint.rs
@@ -3,7 +3,7 @@ use super::popups::paint_connectors;
 use super::state::{CommentView, Gesture, PageCx, SETTLE_SECS};
 use super::{
     Annotation, Color32, CommentTool, CornerRadius, DocInfo, DocView, Edit, LineEnding, NewAnnotation, Pos2, QuickTool, Rect, SELECT_BLUE, Shape,
-    Stroke, color32, pos2, vec2,
+    Stroke, color32, icons, pos2, vec2,
 };
 use crate::page_router::{CommentPart, Hit, Owner};
 
@@ -21,6 +21,19 @@ pub(super) fn hover_outline<'c>(cx: &'c PageCx<'_>, cv: &CommentView, hover: Opt
 /// pointer.
 pub(crate) fn paint_page(ui: &egui::Ui, painter: &egui::Painter, cx: &PageCx<'_>, view: &DocView, hover: Option<&Hit>) {
     let cv = &view.comments;
+    // All commented text markup, including imported markup, gets a viewer-only
+    // marker. Plain markup has none; comment_marker_rect owns that distinction.
+    for a in cx.comments() {
+        if let Some(marker) = cx.comment_marker_rect(a)
+            && let Some(target) = cx.screen_rects(a).last()
+        {
+            painter.line_segment(
+                [marker.left_bottom(), pos2(target.right(), target.top())],
+                Stroke::new(1.0, Color32::from_rgba_unmultiplied(0xD4, 0x8A, 0x00, 150)),
+            );
+            icons::paint(ui, marker, "message-square", 12.0, Color32::from_rgb(0xD4, 0x8A, 0x00));
+        }
+    }
     let pointer = cx.ptr.pos;
     // A redaction mark shows its fill while the pointer is over it, as Acrobat's does, so the
     // marked area reads before anything is applied.
diff --git a/crates/ui-egui/src/tools/comments/state.rs b/crates/ui-egui/src/tools/comments/state.rs
index e6f9ae75b8..de3265dbd5 100644
--- a/crates/ui-egui/src/tools/comments/state.rs
+++ b/crates/ui-egui/src/tools/comments/state.rs
@@ -1,7 +1,7 @@
 use std::collections::HashMap;
 
 use super::geometry::{corner_ratio, frame, is_markup, resized};
-use super::{Annotation, CommentPrefs, CommentTool, DocInfo, Edit, PagePointer, PageXform, Pos2, QuickTool, Rect};
+use super::{Annotation, CommentPrefs, CommentTool, DocInfo, Edit, PagePointer, PageXform, Pos2, QuickTool, Rect, pos2, vec2};
 use crate::page_keys::PageKeys;
 
 /// The user's login name, which Acrobat uses as the default comment author.
@@ -36,9 +36,13 @@ pub enum Gesture {
     Place { xfdf: String, bounds: [f64; 4], count: usize, outlines: Vec<pdfcraft_engine::CommentOutline> },
 }
 
-#[derive(Clone, Copy, Debug, PartialEq)]
+#[derive(Clone, Debug, PartialEq)]
 pub enum ComposerKind {
     Note,
+    /// A comment anchored to selected text; replacing the composer drops its quads.
+    TextNote {
+        quads: Vec<[f64; 8]>,
+    },
     /// A text box; `size` is the box dragged out (displayed width and height, in user space
     /// units), `None` after a click: then the box fits its text.
     TextBox {
@@ -602,7 +606,7 @@ impl PageCx<'_> {
         self.xf.user_rect(self.info, self.page, frame(a, self.rotation()))
     }
 
-    /// Top-level comments on this page, in paint order.
+    /// Top-level comments on this page, in inspection order.
     pub(super) fn comments(&self) -> impl Iterator<Item = &Annotation> {
         self.info.annotations.iter().filter(move |a| !self.hidden && a.page == self.page && a.is_comment() && a.subtype != "Popup")
     }
@@ -623,6 +627,32 @@ impl PageCx<'_> {
             .chain(fallback)
     }
 
+    /// A viewer-only marker for commented text markup intersecting the page.
+    pub(crate) fn comment_marker_rect(&self, a: &Annotation) -> Option<Rect> {
+        if !is_markup(&a.subtype) || a.contents.as_deref().is_none_or(|s| s.trim().is_empty()) {
+            return None;
+        }
+        let r = self.screen_rects(a).last()?;
+        let size = vec2(12.0, 12.0);
+        let page = self.xf.rect;
+        let marker_max = page.max - size;
+        let desired = pos2(r.right() + 3.0, r.top() - 14.0);
+        // Keep the fixed-size marker visible at page edges. At extremely small zooms,
+        // omit it rather than covering a page that is smaller than the marker itself.
+        if !page.is_finite()
+            || !r.is_finite()
+            || !desired.is_finite()
+            || !page.intersects(r)
+            || page.width() < size.x
+            || page.height() < size.y
+            || marker_max.x < page.min.x
+            || marker_max.y < page.min.y
+        {
+            return None;
+        }
+        Some(Rect::from_min_size(desired.clamp(page.min, marker_max), size))
+    }
+
     /// A redaction mark's areas: one per marked quad, or its rectangle.
     pub(super) fn redact_rects(&self, a: &Annotation) -> Vec<Rect> {
         if a.quads.is_empty() {
@@ -655,9 +685,16 @@ impl PageCx<'_> {
             .filter_map(|s| {
                 let (page, index) = s.parent?;
                 let caret = self.get(index).filter(|c| page == self.page && c.subtype == "Caret")?;
-                Some((s.index, caret))
+                Some((false, s.index, caret))
             });
-        self.comments().filter(under).map(|a| (a.index, a)).chain(strikes).max_by_key(|(i, _)| *i).map(|(_, a)| a)
+        self.comments()
+            .filter_map(|a| {
+                let marker = self.comment_marker_rect(a).is_some_and(|r| r.expand(3.0).contains(p));
+                (marker || under(&a)).then_some((marker, a.index, a))
+            })
+            .chain(strikes)
+            .max_by_key(|(marker, index, _)| (*marker, *index))
+            .map(|(_, _, a)| a)
     }
 
     pub(crate) fn get(&self, index: usize) -> Option<&Annotation> {
diff --git a/crates/ui-egui/src/tools/comments/tests.rs b/crates/ui-egui/src/tools/comments/tests.rs
index 01086e788e..18c511debb 100644
--- a/crates/ui-egui/src/tools/comments/tests.rs
+++ b/crates/ui-egui/src/tools/comments/tests.rs
@@ -561,6 +561,107 @@ fn text_boxes_fit_their_text() {
     assert!(long[3] - long[1] > 50.0);
 }
 
+#[test]
+fn markup_comment_markers_skip_rounded_inverted_clamp_bounds() {
+    let prefs = CommentPrefs::default();
+    let ptr = PagePointer::default();
+    let info = DocInfo {
+        pages: vec![PageInfo { width: 12.0, height: 12.0, label: String::new(), crop: [0.0, 0.0, 12.0, 12.0], rotation: 0 }],
+        ..Default::default()
+    };
+    let a = Annotation { rect: [0.0, 0.0, 12.0, 12.0], contents: Some("Review".into()), ..annotation("Highlight", None, false) };
+    for min in [pos2(1.0e-7, 0.0), pos2(0.0, 1.0e-7)] {
+        let page = Rect::from_min_max(min, pos2(12.0, 12.0));
+        assert_eq!(page.size(), vec2(12.0, 12.0));
+        let marker_max = page.max - vec2(12.0, 12.0);
+        assert!(marker_max.x < page.min.x || marker_max.y < page.min.y);
+        let xf = PageXform { rect: page, rot: 0, pw: 12.0, ph: 12.0 };
+        let cx = PageCx {
+            page: 0,
+            xf: &xf,
+            ptr: &ptr,
+            info: &info,
+            tool: QuickTool::Select,
+            prefs: &prefs,
+            allowed: true,
+            hidden: false,
+            redact_mark: ([0.0; 3], 1.0),
+            keys: crate::page_keys::PageKeys::new(false),
+        };
+        assert!(page.intersects(cx.screen_rects(&a).last().unwrap()));
+        assert!(cx.comment_marker_rect(&a).is_none());
+    }
+}
+
+#[test]
+fn markup_comment_markers_stay_inside_turned_and_zoomed_pages() {
+    let prefs = CommentPrefs::default();
+    for (page_rotation, rotation) in [(0, 0), (90, 0), (180, 0), (270, 0), (0, 90), (0, 180), (0, 270), (90, 270)] {
+        for zoom in [0.25, 1.0, 4.0] {
+            let (pw, ph) = if page_rotation % 180 == 0 { (300.0, 200.0) } else { (200.0, 300.0) };
+            let (w, h) = if rotation % 180 == 0 { (pw, ph) } else { (ph, pw) };
+            let xf = PageXform { rect: Rect::from_min_size(pos2(40.0, 60.0), vec2(w, h) * zoom), rot: rotation, pw, ph };
+            let info = DocInfo {
+                pages: vec![PageInfo { width: pw, height: ph, label: String::new(), crop: [0.0, 0.0, 300.0, 200.0], rotation: page_rotation }],
+                ..Default::default()
+            };
+            let cx = PageCx {
+                page: 0,
+                xf: &xf,
+                ptr: &PagePointer::default(),
+                info: &info,
+                tool: QuickTool::Select,
+                prefs: &prefs,
+                allowed: true,
+                hidden: false,
+                redact_mark: ([0.0; 3], 1.0),
+                keys: crate::page_keys::PageKeys::new(false),
+            };
+            for rect in [[0.0, 180.0, 30.0, 200.0], [270.0, 180.0, 300.0, 200.0], [270.0, 0.0, 300.0, 20.0], [0.0, 0.0, 30.0, 20.0]] {
+                let [x0, y0, x1, y1] = rect;
+                let mut a = Annotation {
+                    page: 0,
+                    subtype: "Highlight".into(),
+                    author: Some("Ada".into()),
+                    contents: Some("Review".into()),
+                    modified: None,
+                    name: None,
+                    in_reply_to: None,
+                    parent: None,
+                    grouped: false,
+                    rect,
+                    color: None,
+                    index: 0,
+                    state: None,
+                    quads: vec![[x0, y1, x1, y1, x0, y0, x1, y0]],
+                    locked: false,
+                    intent: None,
+                    fill_sign: false,
+                    no_rotate: false,
+                    points: Vec::new(),
+                    text_box: None,
+                    popup: None,
+                };
+                let marker = cx.comment_marker_rect(&a).expect("commented markup has a marker");
+                assert!((marker.width() - 12.0).abs() < 0.001 && (marker.height() - 12.0).abs() < 0.001, "{marker:?}");
+                assert!(xf.rect.contains_rect(marker), "page/view rotation {page_rotation}/{rotation}, zoom {zoom}, anchor {rect:?}: {marker:?}");
+                let mut top = a.clone();
+                top.index = 1;
+                // Inspection order can differ from /Annots order. Picking the marker
+                // must select the same topmost comment as hovering its marked text.
+                let hit_info = DocInfo { annotations: vec![top, a.clone()], ..info.clone() };
+                let hit_cx = PageCx { info: &hit_info, ..cx };
+                assert_eq!(hit_cx.comment_at(marker.center()).map(|a| a.index), Some(1));
+                a.contents = None;
+                assert!(cx.comment_marker_rect(&a).is_none(), "plain markup has no marker");
+                a.contents = Some("Review".into());
+                a.quads = vec![[1000.0, 1010.0, 1010.0, 1010.0, 1000.0, 1000.0, 1010.0, 1000.0]];
+                assert!(cx.comment_marker_rect(&a).is_none(), "off-page markup stays off the page");
+            }
+        }
+    }
+}
+
 #[test]
 fn stale_comment_state_is_cleared_and_delete_never_hits_non_comment_slots() {
     let annot = |index: usize, name: &str| Annotation {
@@ -762,3 +863,38 @@ fn the_hover_outline_goes_round_what_a_press_would_take() {
     let selected = CommentView { selected: Some((0, 0)), ..CommentView::default() };
     assert!(hover_outline(&cx, &selected, Some(&comment)).is_none(), "the selected comment has its own frame");
 }
+
+#[test]
+fn comment_marker_wins_over_an_overlapping_body_for_pick_and_hover() {
+    let page = PageInfo { width: 200.0, height: 200.0, label: String::new(), crop: [0.0, 0.0, 200.0, 200.0], rotation: 0 };
+    let xf = PageXform { rect: Rect::from_min_size(Pos2::ZERO, vec2(200.0, 200.0)), rot: 0, pw: 200.0, ph: 200.0 };
+    let markup = Annotation { rect: [50.0, 50.0, 80.0, 65.0], index: 0, ..annotation("Highlight", Some("Anchor"), false) };
+    let body = Annotation { rect: [0.0, 0.0, 200.0, 200.0], index: 1, ..annotation("Square", Some("Body"), false) };
+    let info = DocInfo { pages: vec![page], annotations: vec![body, markup], ..Default::default() };
+    let prefs = CommentPrefs::default();
+    let ptr = PagePointer::default();
+    let cx = PageCx {
+        page: 0,
+        xf: &xf,
+        ptr: &ptr,
+        info: &info,
+        tool: QuickTool::Select,
+        prefs: &prefs,
+        allowed: true,
+        hidden: false,
+        redact_mark: ([0.0; 3], 1.0),
+        keys: crate::page_keys::PageKeys::new(false),
+    };
+    let marker = cx.comment_marker_rect(&info.annotations[1]).unwrap();
+    assert_eq!(cx.comment_at(marker.center()).map(|a| a.index), Some(0));
+    let ptr = PagePointer { pos: Some(marker.center()), ..PagePointer::default() };
+    let cx = PageCx { ptr: &ptr, ..cx };
+    let mut view = DocView::new(pdfcraft_engine::DocId(1), &info, crate::canvas::ViewDefaults::default());
+    super::input::describe(&cx, &mut view);
+    let ctx = egui::Context::default();
+    assert_eq!(view.cursor.resolve(&ctx, QuickTool::Select).as_deref(), Some("Highlight\nAnchor"));
+    let hidden = PageCx { hidden: true, ..cx };
+    assert!(hidden.comment_at(marker.center()).is_none());
+    super::input::describe(&hidden, &mut view);
+    assert!(view.cursor.resolve(&ctx, QuickTool::Select).is_none());
+}
diff --git a/crates/ui-egui/src/tools/content_ui.rs b/crates/ui-egui/src/tools/content_ui.rs
index 9393ca8bde..884b32ec98 100644
--- a/crates/ui-egui/src/tools/content_ui.rs
+++ b/crates/ui-egui/src/tools/content_ui.rs
@@ -1091,14 +1091,46 @@ impl crate::PdfCraftApp {
 
     /// Click an image field: pick a picture for it.
     pub fn choose_field_image(&mut self, name: &str) {
+        let Some((_, id)) = self.active_ids() else { return };
+        self.choose_field_image_target(id, name, None);
+    }
+    /// Keep the clicked document and field identity through the asynchronous image picker.
+    pub fn choose_field_image_target(&mut self, id: pdfcraft_engine::DocId, name: &str, identity: Option<u64>) {
+        if identity.is_some_and(|key| key >= 1u64 << 48) {
+            self.notify("The selected image field identity is invalid");
+            return;
+        }
         #[cfg(not(target_arch = "wasm32"))]
         {
             let name = name.to_string();
+            let Some(generation) = self.session.get(id).map(|d| d.edit_generation()) else { return };
             self.pick_image(tl!("Select Icon"), move |app, _, bytes| {
-                app.apply_edit(Edit::SetFieldImage { name, image: std::sync::Arc::new(bytes) });
+                if app.session.get(id).is_none_or(|d| d.edit_generation() != generation) {
+                    app.notify("The document changed while choosing the image; the picture was not applied");
+                    return;
+                }
+                let image = std::sync::Arc::new(bytes);
+                let edit = match identity {
+                    Some(key) => {
+                        Edit::SetFieldImageTarget { name, object: pdfcraft_cos::ObjRef { num: (key >> 16) as u32, generation: key as u16 }, image }
+                    }
+                    None => Edit::SetFieldImage { name, image },
+                };
+                match app.session.apply(id, edit) {
+                    Ok(_) => {
+                        if let Some(view) = app.views.iter_mut().find(|v| v.id == id)
+                            && let Some(doc) = app.session.get(id)
+                        {
+                            view.document_changed(&doc.info);
+                        }
+                    }
+                    Err(e) => app.notify(e.to_string()),
+                }
             });
         }
         #[cfg(target_arch = "wasm32")]
+        let _ = (id, identity);
+        #[cfg(target_arch = "wasm32")]
         self.notify_fmt("{name}: choosing images arrives on the web with file pickers for images", &[("name", &name)]);
     }
 
diff --git a/crates/ui-egui/src/tools/forms_ui.rs b/crates/ui-egui/src/tools/forms_ui.rs
index ec6d85150c..94aafda3f7 100644
--- a/crates/ui-egui/src/tools/forms_ui.rs
+++ b/crates/ui-egui/src/tools/forms_ui.rs
@@ -89,8 +89,8 @@ pub struct FormView {
     pub unbaked: HashSet<(String, usize)>,
     /// A message for the app to show (e.g. "buttons run JavaScript").
     pub notice: Option<FormNotice>,
-    /// A push button was clicked: (its field name, what it does).
-    pub button: Option<(String, pdfcraft_engine::form_scripts::ButtonAction)>,
+    /// A push button was clicked: (its field name, exact PDF identity, what it does).
+    pub button: Option<(String, u64, pdfcraft_engine::form_scripts::ButtonAction)>,
     /// The focused check box or radio button was clicked. It toggles once no other edit is
     /// queued: the text the click committed goes first, and the toggle is dropped if that text
     /// is refused and its field reopens.
@@ -101,11 +101,18 @@ pub struct FormView {
     /// The field and widget that had focus when it was last looked at: when the focus moves, the
     /// one it left runs its XFA exit scripts and the one it reached its enter scripts
     /// (`PdfCraftApp::run_focus_scripts`).
-    pub(crate) focused: Option<(String, usize)>,
+    pub(crate) focused: Option<(String, Option<ObjRef>, usize)>,
     /// The list box row clicked last, without Shift: (its field name, the row). A Shift-click picks
     /// the rows from it to the one clicked; the field's value can't say which row came last when
     /// rows share an export value, and `/I` lists them in ascending order.
     pub(crate) list_anchor: Option<(String, usize)>,
+    /// The field and widget under the pointer when it was last looked at: when it changes, the
+    /// one left runs its Mouse Exit JavaScript and the one reached its Mouse Enter (#269).
+    pub(crate) hovered: Option<WidgetRef>,
+    /// Pointer triggers waiting to run their widget's JavaScript, in order (field name, widget,
+    /// trigger): `PdfCraftApp::run_field_triggers` runs them after the frame's edit, so a check
+    /// box's Mouse Up sees the value its click just stored (#247).
+    pub(crate) triggers: Vec<(WidgetRef, pdfcraft_engine::FieldTrigger)>,
 }
 
 /// A form message for the app to show, with document data kept separate so the visible
@@ -349,7 +356,7 @@ fn list_pick_edit(form: &[FormField], f: &FormField, picked: Vec<usize>) -> Edit
 
 /// Editor state for opening widget `widget` of `f`: it starts from the field's value, asks
 /// for keyboard focus, and gives a drop-down a fresh list that places itself from that value.
-fn open_focus(f: &FormField, widget: usize) -> Focus {
+pub(crate) fn open_focus(f: &FormField, widget: usize) -> Focus {
     Focus {
         name: f.name.clone(),
         obj: Some(f.obj),
@@ -458,6 +465,38 @@ pub(crate) fn hit(xf: &PageXform, info: &DocInfo, page: usize, form: &[FormField
     Some(Hit::new(Owner::Field { field, widget }, Layer::Field, icon))
 }
 
+/// A widget a pointer trigger is for: its field's name and object (so a field sharing another's
+/// name runs its own script), and the widget's index in the field.
+pub(crate) type WidgetRef = (String, u64, usize);
+
+/// `f`'s widget `widget` as a trigger names it.
+fn widget_ref(f: &FormField, widget: usize) -> WidgetRef {
+    (f.name.clone(), pdfcraft_engine::js::field_object_id(f.obj), widget)
+}
+
+/// The field and widget under the pointer on a page, when a press there would take it.
+pub(crate) fn hovered(form: &[FormField], hover: Option<&Hit>) -> Option<WidgetRef> {
+    match hover.map(|h| h.owner) {
+        Some(Owner::Field { field, widget }) => form.get(field).map(|f| widget_ref(f, widget)),
+        _ => None,
+    }
+}
+
+/// Queue Mouse Exit for the widget the pointer left and Mouse Enter for the one it reached, when
+/// they differ from the last frame's (`now`: the widget under the pointer on any page).
+pub(crate) fn hover_moved(view: &mut DocView, now: Option<WidgetRef>) {
+    if view.forms.hovered == now {
+        return;
+    }
+    let left = std::mem::replace(&mut view.forms.hovered, now.clone());
+    if let Some(w) = left {
+        view.forms.triggers.push((w, pdfcraft_engine::FieldTrigger::MouseExit));
+    }
+    if let Some(w) = now {
+        view.forms.triggers.push((w, pdfcraft_engine::FieldTrigger::MouseEnter));
+    }
+}
+
 /// The tooltip (`/TU`) of the field under the pointer, as Acrobat shows it on hover (#3854): only
 /// where the field is what a press would take (`hover`, the top hit there). ISO 32000-2 Table 226
 /// makes it the name the user interface identifies the field by.
@@ -484,6 +523,10 @@ pub(crate) fn page_input(
     let PagePress::Mine(Owner::Field { field, widget: wi }) = press else { return false };
     let Some((f, w)) = form.get(field).and_then(|f| f.widgets.get(wi).map(|w| (f, w))) else { return false };
     let usable = usable(f, w, allowed);
+    // The press runs the widget's Mouse Down JavaScript, as in Acrobat (#269).
+    if usable && ptr.pressed().is_some() {
+        view.forms.triggers.push((widget_ref(f, wi), pdfcraft_engine::FieldTrigger::MouseDown));
+    }
     // A text field opens on the press rather than the click, so a drag that starts on it
     // selects its text (#2213).
     if f.kind == FormFieldKind::Text
@@ -507,9 +550,18 @@ pub(crate) fn page_input(
     match f.kind {
         _ if f.read_only() || w.read_only => view.forms.notice = Some(FormNotice::ReadOnly(f.name.clone())),
         FormFieldKind::PushButton => match &f.button {
-            Some(a) => view.forms.button = Some((f.name.clone(), a.clone())),
+            Some(a) => view.forms.button = Some((f.name.clone(), pdfcraft_engine::js::field_object_id(f.obj), a.clone())),
             None => view.forms.notice = Some(FormNotice::NoAction(f.name.clone())),
         },
+        FormFieldKind::Text if let Some(script) = &w.mouse_up_script => {
+            // Close the editor so the script can replace its value without a stale draft.
+            commit(view, form);
+            view.forms.button = Some((
+                f.name.clone(),
+                pdfcraft_engine::js::field_object_id(f.obj),
+                pdfcraft_engine::form_scripts::ButtonAction::Script(script.clone()),
+            ));
+        }
         FormFieldKind::Signature => view.sign.field = Some(f.name.clone()),
         FormFieldKind::CheckBox | FormFieldKind::Radio => {
             // The box takes the focus, as in Acrobat, so Tab goes on from it (#2223). The overlay
@@ -535,6 +587,10 @@ pub(crate) fn page_input(
                 commit(view, form);
                 view.forms.focus = Some(open_focus(f, wi));
             }
+            // A combo box's click runs its Mouse Up JavaScript (#269).
+            if f.kind == FormFieldKind::Combo {
+                view.forms.triggers.push((widget_ref(f, wi), pdfcraft_engine::FieldTrigger::MouseUp));
+            }
         }
         FormFieldKind::List => {
             let Some(p) = ptr.within(xf.rect) else { return true };
@@ -580,6 +636,8 @@ pub(crate) fn page_input(
                     view.pending_edit = Some(list_pick_edit(form, f, picked));
                 }
             }
+            // A list box's click runs its Mouse Up JavaScript after the pick is stored (#269).
+            view.forms.triggers.push((widget_ref(f, wi), pdfcraft_engine::FieldTrigger::MouseUp));
         }
     }
     true
@@ -588,6 +646,9 @@ pub(crate) fn page_input(
 /// The edit the focused field's draft makes, if it differs from the field's value.
 pub(crate) fn draft_edit(focus: &Focus, form: &[FormField]) -> Option<Edit> {
     let f = focused_field(focus, form)?;
+    if f.read_only() || f.widgets.get(focus.widget).is_some_and(|widget| widget.read_only) {
+        return None;
+    }
     let value = match f.kind {
         FormFieldKind::Text if f.value.first().map(String::as_str).unwrap_or("") != focus.text => FieldValue::Text(focus.text.clone()),
         // Typed into an editable combo box: a shown text picks its option, anything else is the
@@ -1126,6 +1187,40 @@ fn arrow_step(ctx: &egui::Context, keys: PageKeys) -> Option<bool> {
     }
 }
 
+/// Apply keyboard navigation for a focused list without consuming page navigation keys elsewhere.
+fn list_overlay_keys(
+    ctx: &egui::Context,
+    keys: PageKeys,
+    form: &[FormField],
+    f: &FormField,
+    clicked_outside: bool,
+) -> (Option<Edit>, bool, Option<bool>) {
+    let mut edit = None;
+    let mut close = false;
+    let mut next = None;
+    // Taken, so the arrows move the selection without also scrolling the page.
+    let (up, down) = (keys.take(ctx, egui::Key::ArrowUp), keys.take(ctx, egui::Key::ArrowDown));
+    let (esc, tab) = (keys.pressed(ctx, egui::Key::Escape), keys.pressed(ctx, egui::Key::Tab));
+    let shift = ctx.input(|i| i.modifiers.shift);
+    if esc {
+        close = true;
+    } else if tab {
+        next = Some(!shift);
+    } else if (up || down) && !f.options.is_empty() {
+        let current_idx = f.picked_in_order().last().copied().unwrap_or(0);
+        let next_idx = if up { current_idx.saturating_sub(1) } else { current_idx.saturating_add(1).min(f.options.len().saturating_sub(1)) };
+        if next_idx != current_idx && next_idx < f.options.len() {
+            // By position, so the arrows step through options that share an export value,
+            // in the focused twin's own order.
+            edit = Some(list_pick_edit(form, f, vec![next_idx]));
+        }
+    }
+    if clicked_outside {
+        close = true;
+    }
+    (edit, close, next)
+}
+
 /// The in-place editor or option list for the focused field. Returns an edit to apply.
 /// `text_box`, for a text field that doesn't scroll, is how its widget lays text out: the editor
 /// then takes no more than fits.
@@ -1171,8 +1266,9 @@ pub(crate) fn overlay(
     let mut edit = None;
     let mut close = false;
     let mut next: Option<bool> = None; // Tab / Shift+Tab
+    let read_only = f.read_only() || w.read_only;
     match f.kind {
-        FormFieldKind::Text => {
+        FormFieldKind::Text if !read_only => {
             let multiline = f.has(field_flags::MULTILINE);
             // Shown at once, like the paragraph editor: a fade-in shows the field's value through it.
             // Over the page, so only where the document shows: a field scrolled under the mode bar
@@ -1260,7 +1356,7 @@ pub(crate) fn overlay(
                 return view.pending_edit.take();
             }
         }
-        FormFieldKind::Combo => {
+        FormFieldKind::Combo if !read_only => {
             // An editable combo box has a text box over the field as well as its list (ISO
             // 32000-2 Table 233, Edit); the keys are the text box's then, and the list takes
             // the pointer.
@@ -1292,30 +1388,11 @@ pub(crate) fn overlay(
                 close = true;
             }
         }
-        FormFieldKind::List => {
-            // Taken, so the arrows move the selection without also scrolling the page.
-            let (up, down) = (keys.take(ctx, egui::Key::ArrowUp), keys.take(ctx, egui::Key::ArrowDown));
-            let (esc, tab) = (keys.pressed(ctx, egui::Key::Escape), keys.pressed(ctx, egui::Key::Tab));
-            let shift = ctx.input(|i| i.modifiers.shift);
-            if esc {
-                close = true;
-            } else if tab {
-                next = Some(!shift);
-            } else if (up || down) && !f.options.is_empty() {
-                let current_idx = f.picked_in_order().last().copied().unwrap_or(0);
-                let next_idx = if up { current_idx.saturating_sub(1) } else { current_idx.saturating_add(1).min(f.options.len().saturating_sub(1)) };
-                if next_idx != current_idx && next_idx < f.options.len() {
-                    // By position, so the arrows step through options that share an export value,
-                    // in the focused twin's own order.
-                    edit = Some(list_pick_edit(form, f, vec![next_idx]));
-                }
-            }
-            if clicked_outside() {
-                close = true;
-            }
+        FormFieldKind::List if !read_only => {
+            (edit, close, next) = list_overlay_keys(ctx, keys, form, f, clicked_outside());
         }
-        FormFieldKind::CheckBox | FormFieldKind::Radio => {
-            // Nothing is drawn over the box, but a widget there holds egui's keyboard focus, so
+        kind if read_only || matches!(kind, FormFieldKind::CheckBox | FormFieldKind::Radio) => {
+            // Nothing is drawn over the field, but a widget there holds egui's keyboard focus, so
             // Space, Tab and the arrows come here instead of turning or scrolling the page.
             let id = egui::Id::unique(("form-field", view.pane.key, &f.name, focus.widget));
             let mut has_focus = false;
@@ -1342,10 +1419,15 @@ pub(crate) fn overlay(
                 close = true;
             } else if tab {
                 next = Some(!shift);
+            } else if read_only {
+                close = !has_focus && !focus.request_focus;
             } else if toggle && view.pending_edit.is_some() {
                 view.forms.toggle = true;
             } else if toggle {
                 edit = toggle_edit(f, focus.widget);
+                // The click's Mouse Up JavaScript runs once the toggle is stored, so it reads the
+                // new value (#247).
+                view.forms.triggers.push((widget_ref(f, focus.widget), pdfcraft_engine::FieldTrigger::MouseUp));
             } else if space {
                 // Space toggles a check box and selects a radio button, as in browsers: it never
                 // turns the selected button off.
diff --git a/crates/ui-egui/src/tools/prepare/draft.rs b/crates/ui-egui/src/tools/prepare/draft.rs
index d184506948..4acf65d6e5 100644
--- a/crates/ui-egui/src/tools/prepare/draft.rs
+++ b/crates/ui-egui/src/tools/prepare/draft.rs
@@ -263,6 +263,7 @@ impl FieldDraft {
             name: (self.name.trim() != o.name).then(|| self.name.trim().to_string()),
             tooltip: (self.tooltip != o.tooltip).then(|| self.tooltip.clone()),
             caption: (self.caption != o.caption).then(|| (self.widget, self.caption.clone())),
+            caption_all: None,
             read_only: ch(self.read_only, o.read_only),
             required: ch(self.required, o.required),
             multiline: ch(self.multiline, o.multiline),
diff --git a/crates/ui-egui/src/workflows/actions_ui.rs b/crates/ui-egui/src/workflows/actions_ui.rs
index 313d55c5f2..55b94039c0 100644
--- a/crates/ui-egui/src/workflows/actions_ui.rs
+++ b/crates/ui-egui/src/workflows/actions_ui.rs
@@ -98,6 +98,8 @@ impl PdfCraftApp {
         let p = progress.clone();
         // The summary is written on the worker thread: draw it in the UI's language.
         let lang = crate::i18n::current();
+        // Each file runs in its own session; it keeps this one's JavaScript preference.
+        let javascript = self.session.javascript();
         let work = move || {
             crate::i18n::set_current(lang);
             let (mut ok, mut failed) = (0, Vec::new());
@@ -105,7 +107,7 @@ impl PdfCraftApp {
                 if let Ok(mut s) = p.lock() {
                     s.done = i;
                 }
-                let r = pdfcraft_engine::actions::run_on(&action, &name, Arc::new(bytes), |_, _| {}).and_then(|r| {
+                let r = pdfcraft_engine::actions::run_on(&action, &name, Arc::new(bytes), javascript, |_, _| {}).and_then(|r| {
                     #[cfg(not(target_arch = "wasm32"))]
                     write_result(&dir, &name, &r.bytes).map_err(|e| e.to_string())?;
                     #[cfg(target_arch = "wasm32")]
diff --git a/crates/ui-egui/src/workflows/combine_ui/parts.rs b/crates/ui-egui/src/workflows/combine_ui/parts.rs
index 4527ec061d..cc05552ba1 100644
--- a/crates/ui-egui/src/workflows/combine_ui/parts.rs
+++ b/crates/ui-egui/src/workflows/combine_ui/parts.rs
@@ -39,9 +39,15 @@ fn combinable(ext: &str) -> bool {
 }
 
 /// Whether Combine takes a file by what it is: a PDF (by its header or its name) or an image or
-/// text file it converts, as `Session::as_pdf` tells them apart.
+/// text file it converts, as `Session::as_pdf_inline` tells them apart. Not an Office document:
+/// converting one runs LibreOffice for seconds, which Combine can't do on the frame thread, so
+/// it is left out and named rather than listed as a file that can't be read.
 pub(super) fn takes(name: &str, bytes: &[u8]) -> bool {
-    pdfcraft_engine::source_kind(name, bytes).is_some() || name.to_ascii_lowercase().ends_with(".pdf")
+    match pdfcraft_engine::source_kind(name, bytes) {
+        Some(pdfcraft_engine::SourceKind::Office) => false,
+        Some(_) => true,
+        None => name.to_ascii_lowercase().ends_with(".pdf"),
+    }
 }
 
 /// A file's bookmark in the combined PDF: its name without ".pdf", or without the extension of
diff --git a/crates/ui-egui/src/workflows/combine_ui/session.rs b/crates/ui-egui/src/workflows/combine_ui/session.rs
index 2297e70933..124260031c 100644
--- a/crates/ui-egui/src/workflows/combine_ui/session.rs
+++ b/crates/ui-egui/src/workflows/combine_ui/session.rs
@@ -279,7 +279,7 @@ impl PdfCraftApp {
                 notes: Vec::new(),
             };
             let source = bytes.clone();
-            let (bytes, assessed) = match self.session.as_pdf(&name, &bytes) {
+            let (bytes, assessed) = match self.session.as_pdf_inline(&name, &bytes) {
                 Ok(pdf) => {
                     let assessed = assess(&pdf, None);
                     (pdf, assessed)
diff --git a/crates/ui-egui/src/workflows/create_multiple_ui.rs b/crates/ui-egui/src/workflows/create_multiple_ui.rs
index 54d2181d0a..03fd3e1eaa 100644
--- a/crates/ui-egui/src/workflows/create_multiple_ui.rs
+++ b/crates/ui-egui/src/workflows/create_multiple_ui.rs
@@ -43,7 +43,7 @@ impl PdfCraftApp {
                     continue;
                 }
             };
-            let (kind, pdf) = match self.session.convert_to_pdf(&name, &Arc::new(bytes)) {
+            let (kind, pdf) = match self.session.convert_to_pdf_inline(&name, &Arc::new(bytes)) {
                 Ok(converted) => converted,
                 Err(error) => {
                     refused.push(format!("{name} ({error})"));
@@ -111,7 +111,7 @@ impl PdfCraftApp {
         let sources = std::iter::from_fn(|| {
             loop {
                 match files.next()? {
-                    Ok((name, bytes)) => match session.convert_to_pdf(&name, &Arc::new(bytes)) {
+                    Ok((name, bytes)) => match session.convert_to_pdf_inline(&name, &Arc::new(bytes)) {
                         Ok((_, pdf)) => {
                             converted += 1;
                             return Some(Ok((stem(&name).to_string(), pdf, None)));
diff --git a/crates/ui-egui/src/workflows/create_ui.rs b/crates/ui-egui/src/workflows/create_ui.rs
index f74ed10535..5d3d6f4cc6 100644
--- a/crates/ui-egui/src/workflows/create_ui.rs
+++ b/crates/ui-egui/src/workflows/create_ui.rs
@@ -43,9 +43,6 @@ pub(crate) fn image_import_body(ui: &mut egui::Ui, app: &mut PdfCraftApp) -> (bo
     (go, cancel)
 }
 
-/// File types Open accepts besides PDF (converted on open).
-pub use pdfcraft_engine::CONVERTIBLE;
-
 /// What Create ▸ Clipboard found on the clipboard.
 #[derive(Clone, Debug, PartialEq)]
 pub enum Clip {
@@ -105,15 +102,23 @@ fn stem(name: &str) -> &str {
 }
 
 impl PdfCraftApp {
-    /// Convert a non-PDF file (image, text) into a new tab. Returns `None` when `bytes` is not
-    /// something Create understands (the caller then tries to open it as a PDF).
+    /// Convert a non-PDF file (image, text, Office document) into a new tab. Returns `None` when
+    /// `bytes` is not something Create understands (the caller then tries to open it as a PDF).
+    /// An Office document blocks while LibreOffice runs: File ▸ Open converts it on the open
+    /// worker instead ([`Self::open_converted_pdf`]), leaving this for startup and inline opens.
     pub(crate) fn open_converted(&mut self, name: &str, bytes: &[u8]) -> Option<Result<(), String>> {
         use pdfcraft_engine::SourceKind;
-        if !matches!(pdfcraft_engine::source_kind(name, bytes), Some(SourceKind::Image | SourceKind::Text)) {
+        if !matches!(pdfcraft_engine::source_kind(name, bytes), Some(SourceKind::Image | SourceKind::Text | SourceKind::Office)) {
             return None;
         }
         let created = self.session.convert_to_pdf(name, &Arc::new(bytes.to_vec())).map(|(_, pdf)| pdf);
-        Some(self.open_created_bytes(&format!("{}.pdf", stem(name)), created.map_err(|e| e.to_string())))
+        Some(self.open_converted_pdf(name, created.map_err(|e| e.to_string())))
+    }
+
+    /// Open `created`, the PDF converted from the file `name`, as a new, unsaved tab named after
+    /// it (`Report.docx` → `Report.pdf`).
+    pub(crate) fn open_converted_pdf(&mut self, name: &str, created: Result<Arc<Vec<u8>>, String>) -> Result<(), String> {
+        self.open_created_bytes(&format!("{}.pdf", stem(name)), created)
     }
 
     fn open_created_bytes(&mut self, name: &str, created: Result<Arc<Vec<u8>>, String>) -> Result<(), String> {
diff --git a/crates/ui-egui/src/workflows/files.rs b/crates/ui-egui/src/workflows/files.rs
index 6a7a0434b3..82057ecc55 100644
--- a/crates/ui-egui/src/workflows/files.rs
+++ b/crates/ui-egui/src/workflows/files.rs
@@ -619,9 +619,9 @@ impl PdfCraftApp {
 
     /// Open the Replace Pages dialog for `bytes`, replacing the selection (or the current page).
     pub fn start_replace(&mut self, name: String, bytes: Vec<u8>) {
-        let Some(i) = self.active else { return };
+        let Some((i, id)) = self.active_ids() else { return };
         let bytes = Arc::new(bytes);
-        let src_pages = match self.session.page_count_of(&name, &bytes) {
+        let src_pages = match self.session.replace_source(id, &name, &bytes) {
             Ok(n) => n,
             Err(e) => {
                 self.notify_fmt("Couldn't use {name}: {e}", &[("name", &name), ("e", &e.to_string())]);
@@ -666,9 +666,7 @@ impl PdfCraftApp {
                     continue;
                 }
             };
-            let converted =
-                self.session.convert_to_pdf(&name, &Arc::new(bytes)).and_then(|(_, pdf)| Ok((self.session.page_count_of(&name, &pdf)?, pdf)));
-            match converted {
+            match self.session.insert_source_inline(id, &name, &Arc::new(bytes)) {
                 Ok((pages, bytes)) => {
                     if self.apply_edit(Edit::InsertPagesFrom {
                         name,
diff --git a/crates/ui-egui/src/workflows/js_ui.rs b/crates/ui-egui/src/workflows/js_ui.rs
index 2ac0d7b127..1f3721c511 100644
--- a/crates/ui-egui/src/workflows/js_ui.rs
+++ b/crates/ui-egui/src/workflows/js_ui.rs
@@ -70,7 +70,14 @@ impl PdfCraftApp {
         }
         for r in out.requests {
             match r {
-                Request::Print => self.open_print(),
+                Request::Print => {
+                    if let Some(i) = view {
+                        // The print dialog reads the active document throughout its lifetime.
+                        // Keep the source selected; restoring the comparison tab would retarget it.
+                        self.active = Some(i);
+                        self.open_print();
+                    }
+                }
                 Request::GoToPage(p) => {
                     if let Some(i) = view {
                         self.views[i].go_to_page(p);
@@ -81,9 +88,12 @@ impl PdfCraftApp {
                     "The form asks to be submitted to {u}; PdfCraft doesn't send form data. Save the document to keep your entries.",
                     &[("u", &u)],
                 ),
-                Request::SaveAs => self.run_command("file.save_as"),
+                Request::SaveAs => {
+                    if let Some(i) = view {
+                        self.save_view(i, crate::SaveTarget::As);
+                    }
+                }
                 Request::OpenAttachment { name, open } => self.open_script_attachment(id, &name, open),
-                Request::Highlight(on) => self.script_highlight(id, on),
                 Request::ShowPanel(p) => {
                     let panel = match p {
                         Panel::Bookmarks => crate::RightPanel::Bookmarks,
@@ -95,12 +105,36 @@ impl PdfCraftApp {
                     // Show/Hide: a panel already showing closes.
                     self.right = (self.right != Some(panel)).then_some(panel);
                 }
-                Request::Focus(_) | Request::Beep | Request::Reset(_) => {}
+                Request::Zoom(z) => {
+                    if let Some(i) = view {
+                        self.views[i].zoom = (z / 100.0) as f32;
+                        self.views[i].fit = crate::canvas::Fit::None;
+                    }
+                }
+                Request::Highlight(on) => self.script_highlight(id, on),
+                Request::Focus(name) => self.focus_script_field(id, view, &name, None),
+                Request::FocusField { name, object_id } => self.focus_script_field(id, view, &name, Some(object_id)),
+                Request::Beep | Request::Reset(_) => {}
             }
         }
         self.show_script_messages(out.alerts);
     }
 
+    fn focus_script_field(&mut self, id: DocId, view: Option<usize>, name: &str, object_id: Option<u64>) {
+        if let Some(i) = view
+            && let Some(f) = self.session.get(id).and_then(|d| {
+                d.form.iter().find(|f| object_id.map_or_else(|| f.name == name, |key| pdfcraft_engine::js::field_object_id(f.obj) == key))
+            })
+            && let Some((wi, widget)) = f.widgets.iter().enumerate().find(|(_, w)| !w.hidden && w.page.is_some())
+        {
+            let page = widget.page.unwrap_or(0);
+            if self.views[i].page_screen_rect(page).is_none() {
+                self.views[i].go_to_page(page);
+            }
+            self.views[i].forms.focus = Some(crate::forms_ui::open_focus(f, wi));
+        }
+    }
+
     /// Show form script messages `messages` in order, each in the toast with its title and icon.
     /// The first takes the toast at once when it is free; otherwise it waits, like the rest, for
     /// what the toast shows (another message, or a notice such as the run's own submit request)
@@ -166,13 +200,39 @@ impl PdfCraftApp {
         true
     }
 
+    /// Run document `id`'s catalog JavaScript for `event` (Will Save before a save, Will Print
+    /// before printing) and show what it said. What it changed is part of what is saved or
+    /// printed. A failing script is reported and the save or print still goes ahead.
+    pub(crate) fn run_document_actions(&mut self, id: DocId, event: pdfcraft_engine::js::DocumentScriptEvent) {
+        let before = self.session.get(id).map(|d| d.edit_generation());
+        let out = self.session.run_document_actions(id, event);
+        if self.session.get(id).map(|d| d.edit_generation()) != before
+            && let Some(i) = self.views.iter().position(|v| v.id == id)
+            && let Some(info) = self.session.get(id).map(|d| d.info.clone())
+        {
+            self.views[i].document_changed(&info);
+        }
+        if !out.is_empty() {
+            self.handle_js(id, out);
+        }
+    }
+
     /// Run a push button's JavaScript (its Mouse Up action).
     pub fn run_button_script(&mut self, id: DocId, field: &str, script: &str) {
+        self.run_button_script_target(id, field, None, script);
+    }
+    /// Run the action of the exact clicked button, preserving legacy name-only entry points.
+    pub fn run_button_script_target(&mut self, id: DocId, field: &str, identity: Option<u64>, script: &str) {
         // A script reads the fields: include what's still being typed in one (#166).
         if !self.commit_form_typing() {
             return;
         }
-        match self.session.run_javascript(id, script, Some(field)) {
+        #[cfg(not(target_arch = "wasm32"))]
+        if self.session.get(id).is_some_and(|d| d.info.xfa.is_none()) {
+            self.start_ui_script(id, script, Some(field), identity);
+            return;
+        }
+        match self.session.run_javascript_target(id, script, Some(field), identity) {
             Ok(o) => {
                 if let Some(i) = self.views.iter().position(|v| v.id == id)
                     && let Some(info) = self.session.get(id).map(|d| d.info.clone())
diff --git a/crates/ui-egui/src/workflows/ocr_ui.rs b/crates/ui-egui/src/workflows/ocr_ui.rs
index 756da56177..91378d9172 100644
--- a/crates/ui-egui/src/workflows/ocr_ui.rs
+++ b/crates/ui-egui/src/workflows/ocr_ui.rs
@@ -691,7 +691,8 @@ impl PdfCraftApp {
     #[cfg(target_arch = "wasm32")]
     fn start_web_batch(&mut self, files: Vec<(String, Vec<u8>)>, settings: OcrSettings) {
         let progress = Arc::new(Mutex::new(BatchProgress { total: files.len(), ..Default::default() }));
-        self.ocr_web_batch = Some(crate::ocr_web::Batch::new(files, settings));
+        // Each file opens in its own session; it keeps this one's JavaScript preference.
+        self.ocr_web_batch = Some(crate::ocr_web::Batch::new(files, settings, self.session.javascript()));
         self.ocr_batch = Some(progress);
     }
 
@@ -736,13 +737,16 @@ impl PdfCraftApp {
         let p = progress.clone();
         // The summary is written on the worker thread: draw it in the UI's language.
         let lang = crate::i18n::current();
+        // Each file opens in its own session; it keeps this one's JavaScript preference.
+        let javascript = self.session.javascript();
         let work = move || {
             crate::i18n::set_current(lang);
             let write = move |name: &str, r: &pdfcraft_engine::ocr::FileResult| {
                 crate::editing::write_atomically(&dir.join(name).to_string_lossy(), &r.bytes).map_err(|e| e.to_string())
             };
             // A panic in the recognizer still ends the batch with a summary (#3919).
-            let msg = pdfcraft_engine::guard(|| run_batch_files(files, settings, &recognizers, &p, write)).unwrap_or_else(|panic| failed(&panic));
+            let msg = pdfcraft_engine::guard(|| run_batch_files(files, settings, &recognizers, javascript, &p, write))
+                .unwrap_or_else(|panic| failed(&panic));
             if let Ok(mut s) = p.lock() {
                 s.done = s.total;
                 s.message = Some(msg);
@@ -981,12 +985,14 @@ impl PdfCraftApp {
 /// The batch's worker: read each file, hand the searchable copy to `write` (the output folder,
 /// or the web's download), count the buckets, and compose the summary. A file the skip-files
 /// option passes over is its own bucket and `write` is never called for it. A cancel is asked
-/// for between files: the file in flight finishes, the rest are counted as not run.
+/// for between files: the file in flight finishes, the rest are counted as not run. `javascript`
+/// is the app session's preference, for each file's own session.
 #[cfg(not(target_arch = "wasm32"))]
 pub(crate) fn run_batch_files(
     files: Vec<(String, Vec<u8>)>,
     settings: OcrSettings,
     recognizers: &pdfcraft_engine::ocr::Recognizers,
+    javascript: bool,
     progress: &Mutex<BatchProgress>,
     mut write: impl FnMut(&str, &pdfcraft_engine::ocr::FileResult) -> Result<(), String>,
 ) -> String {
@@ -1001,7 +1007,7 @@ pub(crate) fn run_batch_files(
         if let Ok(mut s) = progress.lock() {
             s.done = i;
         }
-        let r = pdfcraft_engine::ocr::recognize_file(&name, Arc::new(bytes), None, settings.clone(), recognizers, |_, _| true);
+        let r = pdfcraft_engine::ocr::recognize_file(&name, Arc::new(bytes), None, settings.clone(), recognizers, javascript, |_, _| true);
         match r {
             Ok(res) if res.skipped() => skipped += 1,
             Ok(res) => match write(&name, &res) {
@@ -1328,7 +1334,7 @@ mod tests {
         let recognizers = Recognizers { primary: Arc::new(Fake { confidence: 95.0 }), secondary: None };
         let writes = Arc::new(std::sync::atomic::AtomicUsize::new(0));
         let w = writes.clone();
-        let msg = run_batch_files(files, OcrSettings { skip_text_files: true, ..Default::default() }, &recognizers, &progress, move |_, _| {
+        let msg = run_batch_files(files, OcrSettings { skip_text_files: true, ..Default::default() }, &recognizers, true, &progress, move |_, _| {
             w.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
             Ok(())
         });
@@ -1338,7 +1344,7 @@ mod tests {
         let files = vec![("a.pdf".into(), pdf.to_vec()), ("b.pdf".into(), pdf.to_vec())];
         let progress = Mutex::new(BatchProgress { total: files.len(), ..Default::default() });
         let w = writes.clone();
-        let msg = run_batch_files(files, OcrSettings { skip_text_files: true, ..Default::default() }, &recognizers, &progress, move |_, _| {
+        let msg = run_batch_files(files, OcrSettings { skip_text_files: true, ..Default::default() }, &recognizers, true, &progress, move |_, _| {
             w.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
             Ok(())
         });
@@ -1359,13 +1365,13 @@ mod tests {
         // The fixtures are text PDFs standing in for scans; the default skip-text-pages option
         // would (correctly) leave them alone, so the batch here reads everything.
         let settings = OcrSettings { skip_text_pages: false, ..Default::default() };
-        let msg = run_batch_files(files, settings.clone(), &recognizers, &progress, |_, _| Ok(()));
+        let msg = run_batch_files(files, settings.clone(), &recognizers, true, &progress, |_, _| Ok(()));
         assert!(msg.contains("Recognized 2 words in 2 files"), "{msg}");
         assert!(msg.contains("scan.pdf: 1 low-confidence word(s) on pages 1"), "{msg}");
         // The write failing is a per-file failure, named in the summary.
         let files = vec![("scan.pdf".into(), pdf.to_vec())];
         let progress = Mutex::new(BatchProgress { total: files.len(), ..Default::default() });
-        let msg = run_batch_files(files, settings, &recognizers, &progress, |_, _| Err("disk full".into()));
+        let msg = run_batch_files(files, settings, &recognizers, true, &progress, |_, _| Err("disk full".into()));
         assert!(msg.contains("; failed: scan.pdf: disk full"), "{msg}");
     }
 
@@ -1380,7 +1386,7 @@ mod tests {
             let files = vec![("scan.pdf".into(), pdf.to_vec())];
             let progress = Mutex::new(BatchProgress { total: files.len(), ..Default::default() });
             let settings = OcrSettings { skip_text_pages: false, low_confidence_threshold: threshold, ..Default::default() };
-            run_batch_files(files, settings, &recognizers, &progress, |_, _| Ok(()))
+            run_batch_files(files, settings, &recognizers, true, &progress, |_, _| Ok(()))
         };
         assert!(run(OcrSettings::default().low_confidence_threshold).contains("1 low-confidence word(s)"), "the default flags a 40% word");
         assert!(run(40.0).contains("1 low-confidence word(s)"), "at the threshold counts");
diff --git a/crates/ui-egui/src/workflows/ocr_web.rs b/crates/ui-egui/src/workflows/ocr_web.rs
index 57f3a8348a..05f587ba63 100644
--- a/crates/ui-egui/src/workflows/ocr_web.rs
+++ b/crates/ui-egui/src/workflows/ocr_web.rs
@@ -446,6 +446,8 @@ fn place(shot: &OcrShot, lines: Result<Vec<Line>, String>) -> OcrPage {
 pub struct Batch {
     files: VecDeque<(String, Vec<u8>)>,
     settings: OcrSettings,
+    /// The app session's JavaScript preference, for each file's own session.
+    javascript: bool,
     current: Option<(String, Box<FileJob>, Pages)>,
     total: usize,
     pub ok: usize,
@@ -459,11 +461,12 @@ pub struct Batch {
 }
 
 impl Batch {
-    pub fn new(files: Vec<(String, Vec<u8>)>, settings: OcrSettings) -> Batch {
+    pub fn new(files: Vec<(String, Vec<u8>)>, settings: OcrSettings, javascript: bool) -> Batch {
         let total = files.len();
         Batch {
             files: files.into(),
             settings,
+            javascript,
             current: None,
             total,
             ok: 0,
@@ -489,7 +492,7 @@ impl Batch {
                 self.files.clear();
             }
             let Some((name, bytes)) = self.files.pop_front() else { return true };
-            match FileJob::open(&name, Arc::new(bytes), None, self.settings.clone()) {
+            match FileJob::open(&name, Arc::new(bytes), None, self.settings.clone(), self.javascript) {
                 Ok(Opened::Skipped(_)) => self.skipped += 1,
                 Ok(Opened::Read(mut file)) => match file.job.take() {
                     Some(job) => self.current = Some((name, file, Pages::new(job.steps()))),
diff --git a/crates/ui-egui/src/workflows/print_ui.rs b/crates/ui-egui/src/workflows/print_ui.rs
index c53feedf75..3ea2099a96 100644
--- a/crates/ui-egui/src/workflows/print_ui.rs
+++ b/crates/ui-egui/src/workflows/print_ui.rs
@@ -633,6 +633,16 @@ impl PdfCraftApp {
             return false;
         }
         let Some((_, id)) = self.active_ids() else { return false };
+        // A form's Will Print script runs first: what it changes is printed.
+        if self.session.get(id).is_some_and(|d| d.allows_printing()) {
+            let before = self.session.get(id).map(|d| d.edit_generation());
+            self.run_document_actions(id, pdfcraft_engine::js::DocumentScriptEvent::WillPrint);
+            // What it showed may lie outside the printed areas Label printing found: find them again.
+            if self.session.get(id).map(|d| d.edit_generation()) != before && self.print_draft.handling == Handling::Label {
+                self.print_draft.crop_pages = None;
+                self.read_label_crops(id);
+            }
+        }
         let Some(doc) = self.session.get(id) else { return false };
         let labels: Vec<String> = doc.info.pages.iter().map(|p| p.label.clone()).collect();
         let settings = match self.print_draft.settings(doc.info.pages.len(), &labels) {
@@ -699,7 +709,10 @@ impl PdfCraftApp {
             };
             // On Windows grayscale makes the pages grey (#5806) and large pictures become tiles
             // (#5131): work on the whole file, kept off the UI thread with the rest.
-            let bytes = pdfcraft_engine::spooler::spooler_copy(bytes, &mut job);
+            // A GDI (v3) driver gets transparent sheets flattened (#6155, #5838, #5940); XPS (v4)
+            // drivers print them as they are.
+            let flatten = job.printer.as_deref().is_some_and(spool::gdi_driver);
+            let bytes = pdfcraft_engine::spooler::spooler_copy(bytes, &mut job, flatten);
             // The receiver may be gone (the app quit): nothing to report to then.
             let result = match &spooler {
                 Some(submit) => submit(&bytes, &job),
diff --git a/crates/ui-egui/tests/it/comments.rs b/crates/ui-egui/tests/it/comments.rs
index 076f08413c..655e25b50c 100644
--- a/crates/ui-egui/tests/it/comments.rs
+++ b/crates/ui-egui/tests/it/comments.rs
@@ -614,10 +614,74 @@ fn selected_text_comment_action_opens_note_composer() {
     h.run_steps(3);
     h.get_by_label("Add comment").click();
     h.run_steps(2);
-    assert!(matches!(h.state().views[0].comments.composer.as_ref().map(|c| &c.kind), Some(pdfcraft_ui_egui::comments::ComposerKind::Note)));
+    assert!(matches!(
+        h.state().views[0].comments.composer.as_ref().map(|c| &c.kind),
+        Some(pdfcraft_ui_egui::comments::ComposerKind::TextNote { .. })
+    ));
+    h.get_by_label("Add comment");
+    assert!(h.query_by_label("Sticky note").is_none());
     assert!(h.state().views[0].selected_text().is_none());
 }
 
+#[test]
+fn selection_note_replaced_by_sticky_note_posts_at_the_new_anchor() {
+    let mut h = harness(|_| {});
+    h.state_mut().views[0].select_text(0, 4, 8);
+    h.run_steps(3);
+    h.get_by_label("Add comment").click();
+    h.run_steps(2);
+    h.state_mut().set_option("quick", "note").unwrap();
+    click_pt(&mut h, (250.0, 180.0));
+    let anchor = h.state().views[0].comments.composer.as_ref().unwrap().at;
+    field(&h, "Add a comment").type_text("New sticky note");
+    h.run_steps(2);
+    h.get_by_label("Post").click();
+    h.run_steps(3);
+    let c = comments(&h);
+    assert_eq!(c.len(), 1);
+    assert_eq!(c[0].subtype, "Text");
+    assert_eq!(c[0].contents.as_deref(), Some("New sticky note"));
+    assert!(c[0].quads.is_empty());
+    assert!((anchor[0] - 250.0).abs() < 1.0 && (anchor[1] - 180.0).abs() < 1.0);
+    assert!((f64::from(c[0].rect[0]) - anchor[0]).abs() < 1.0 && (f64::from(c[0].rect[3]) - anchor[1]).abs() < 1.0, "{:?}", c[0].rect);
+}
+
+#[test]
+fn selection_note_posts_highlight_and_hovers_author_and_comment() {
+    let _gpu = std::env::var_os("PDFCRAFT_SHOTS").map(|_| crate::gpu());
+    let mut h = harness(|_| {});
+    h.state_mut().views[0].select_text(0, 4, 8);
+    let selected = h.state().views[0].selected_text().unwrap();
+    h.run_steps(3);
+    h.get_by_label("Add comment").click();
+    h.run_steps(2);
+    field(&h, "Add a comment").type_text("Check these words");
+    h.run_steps(2);
+    h.get_by_label("Post").click();
+    h.run_steps(3);
+    crate::support::settle(&mut h);
+    let c = comments(&h);
+    assert_eq!(c.len(), 1);
+    assert_eq!(c[0].subtype, "Highlight");
+    assert_eq!(c[0].contents.as_deref(), Some("Check these words"));
+    assert!(!c[0].quads.is_empty());
+    let hover = format!("{}\nCheck these words", c[0].author.as_deref().expect("comment has an author"));
+    h.state_mut().set_option("panel", "none").unwrap();
+    h.state_mut().views[0].comments.selected = None;
+    h.hover_at(pos2(0.0, 0.0));
+    h.run_steps(3);
+    assert!(h.query_by_label(&hover).is_none());
+    let r = c[0].rect;
+    let p = at(&h, (r[0] + r[2]) / 2.0, (r[1] + r[3]) / 2.0);
+    h.hover_at(p);
+    h.run_steps(3);
+    h.get_by_label(&hover);
+    assert!(h.query_by_label_contains(&selected).is_none(), "hover omits the selected text");
+    if let Ok(dir) = std::env::var("PDFCRAFT_SHOTS") {
+        h.render().unwrap().save(format!("{dir}/selection-comment-hover.png")).unwrap();
+    }
+}
+
 #[test]
 fn shapes_and_ink_are_drawn_by_dragging() {
     let mut h = harness(|app| app.set_option("quick", "square").unwrap());
@@ -3099,6 +3163,36 @@ fn hover_markup_at(h: &mut Harness<'static, PdfCraftApp>, x: f32, y: f32) {
     h.run_steps(3);
 }
 
+#[test]
+fn imported_commented_markup_keeps_author_at_rotated_zoomed_page_edges() {
+    let _gpu = std::env::var_os("PDFCRAFT_SHOTS").map(|_| crate::gpu());
+    for subtype in ["Highlight", "Underline", "StrikeOut", "Squiggly"] {
+        for (page_rotation, view_rotation) in [(0, 0), (90, 0), (0, 90), (90, 90)] {
+            for zoom in ["50", "125"] {
+                let pdf = String::from_utf8(markup_hover_fixture(subtype, page_rotation, "", ""))
+                    .unwrap()
+                    .replace("/Rect [20 105 250 165]", "/Rect [270 180 300 200]")
+                    .replace(
+                        "/QuadPoints [120 165 250 165 120 145 250 145 20 125 100 125 20 105 100 105]",
+                        "/QuadPoints [270 200 300 200 270 180 300 180]",
+                    );
+                let mut h = markup_hover_harness(pdf.into_bytes(), view_rotation);
+                h.state_mut().set_option("zoom", zoom).unwrap();
+                h.run_steps(4);
+                support::settle(&mut h);
+                hover_markup_at(&mut h, 285.0, 190.0);
+                h.get_by_label("Ada\nFirst multiline comment");
+                if subtype == "Highlight"
+                    && matches!((page_rotation, view_rotation, zoom), (0, 0, "50") | (90, 90, "125"))
+                    && let Ok(dir) = std::env::var("PDFCRAFT_SHOTS")
+                {
+                    h.render().unwrap().save(format!("{dir}/edge-comment-{page_rotation}-{view_rotation}-{zoom}.png")).unwrap();
+                }
+            }
+        }
+    }
+}
+
 #[test]
 fn multiline_markup_hover_stays_on_marked_lines() {
     // #3541: /Rect encloses both lines, including text before/after the selection and the gap.
diff --git a/crates/ui-egui/tests/it/control.rs b/crates/ui-egui/tests/it/control.rs
index dcb795f130..5911276708 100644
--- a/crates/ui-egui/tests/it/control.rs
+++ b/crates/ui-egui/tests/it/control.rs
@@ -1788,8 +1788,7 @@ fn a_script_opened_panel_shows() {
     assert!(h.query_by_label("This document has no bookmarks.").is_none());
     let id = h.state().active_ids().unwrap().1;
     h.state_mut().run_button_script(id, "", "app.execMenuItem('ShowHideBookmarks')");
-    h.run_steps(4);
-    h.get_by_label("This document has no bookmarks.");
+    assert!(crate::support::step_until(&mut h, |h| h.query_by_label("This document has no bookmarks.").is_some()));
 }
 
 #[test]
diff --git a/crates/ui-egui/tests/it/document_links.rs b/crates/ui-egui/tests/it/document_links.rs
index 341a07526d..3690abcea9 100644
--- a/crates/ui-egui/tests/it/document_links.rs
+++ b/crates/ui-egui/tests/it/document_links.rs
@@ -490,6 +490,7 @@ fn a_button_script_cannot_open_a_local_program() {
     let _gpu = gpu();
     let mut h = harness();
     click_field(&mut h, "sneaky");
+    support::wait_until(&mut h, "script link refusal", |app| app.pending_link.is_some() || app.toast.is_some());
     assert_eq!(h.state().pending_link, None, "a file: address is never offered");
     assert_eq!(h.state().last_opened_url, None);
     let toast = h.state().toast.clone().expect("the user is told").0;
@@ -503,7 +504,7 @@ fn a_script_asks_first_and_only_once() {
     let id = h.state().views[0].id;
     let script = "app.launchURL('https://example.org/?q=' + 'first'); app.launchURL('https://example.org/second');";
     h.state_mut().run_button_script(id, "web", script);
-    h.run_steps(3);
+    support::wait_until(&mut h, "script link request", |app| app.pending_link.is_some());
     assert_eq!(h.state().pending_link, pending("https://example.org/?q=first", LinkOrigin::Script), "one dialog, for the first request");
     assert_eq!(h.state().last_opened_url, None);
 }
@@ -526,7 +527,7 @@ fn a_script_cannot_open_other_kinds_of_address() {
         let id = h.state().views[0].id;
         let script = format!("app.launchURL({});", serde_json::to_string(url).unwrap());
         h.state_mut().run_button_script(id, "web", &script);
-        h.run_steps(3);
+        support::wait_until(&mut h, "script link decision", |app| app.pending_link.is_some() || app.toast.is_some());
         assert_eq!(h.state().pending_link, None, "{url}");
         assert_eq!(h.state().last_opened_url, None, "{url}");
         assert!(h.state().toast.clone().is_some_and(|t| t.0.contains("won't open")), "{url}: {:?}", h.state().toast);
@@ -541,7 +542,7 @@ fn an_email_link_cannot_attach_a_local_file() {
         let id = h.state().views[0].id;
         let script = format!("app.launchURL({});", serde_json::to_string(url).unwrap());
         h.state_mut().run_button_script(id, "web", &script);
-        h.run_steps(3);
+        support::wait_until(&mut h, "script link decision", |app| app.pending_link.is_some() || app.toast.is_some());
         assert_eq!(h.state().pending_link, None, "{url}");
         assert_eq!(h.state().last_opened_url, None, "{url}");
         let toast = h.state().toast.clone().expect("the user is told").0;
@@ -555,7 +556,7 @@ fn prompt_for(url: &str) -> Harness<'static, PdfCraftApp> {
     let id = h.state().views[0].id;
     let script = format!("app.launchURL({});", serde_json::to_string(url).unwrap());
     h.state_mut().run_button_script(id, "web", &script);
-    h.run_steps(3);
+    assert!(support::step_until(&mut h, |h| h.query_by_label("Open link").is_some()), "script link prompt rendered");
     assert_eq!(h.state().pending_link, pending(url, LinkOrigin::Script));
     h
 }
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index 173e64bdea..60c44bbfd5 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -1723,18 +1723,20 @@ fn undo_and_redo_restore_the_combine_list() {
     assert!(h.state().session.get(h.state().views[0].id).unwrap().can_undo().is_none());
 }
 
+/// A protected file that still allows page extraction (only printing is withheld) is listed
+/// for Combine with a warning that the result won't keep its security, not as a problem.
 #[test]
 fn protected_files_that_can_be_combined_are_flagged() {
     let mut h = harness(1, |app| {
         app.set_option("combine-view", "list").unwrap();
         app.use_files(
             pdfcraft_ui_egui::FilePurpose::Combine,
-            vec![("one.pdf".into(), fixture(1)), ("no-copy.pdf".into(), protected("", "owner", -1 ^ 16))],
+            vec![("one.pdf".into(), fixture(1)), ("no-print.pdf".into(), protected("", "owner", -1 ^ 4))],
         );
     });
     h.run_steps(3);
     let app = h.state();
-    assert!(app.combine_draft[1].problem.is_none(), "copying text is withheld, assembling pages isn't");
+    assert!(app.combine_draft[1].problem.is_none(), "printing is withheld, extracting pages isn't");
     h.get_by_label("Protected: the combined file won't keep its security settings");
     assert!(!h.get_by_label("Combine").accesskit_node().is_disabled(), "a warning, not a blocker");
 }
@@ -1837,10 +1839,10 @@ fn images_and_text_files_join_the_combine_list_as_pdfs() {
 #[test]
 fn files_that_cannot_be_read_are_listed_and_left_out_once_the_user_agrees() {
     let mut h = combine_of(&[("one.pdf", 2)]);
-    let bad = vec![("broken.jpg".to_string(), b"\xff\xd8\xff\xe0 not a JPEG".to_vec()), ("report.docx".to_string(), b"PK\x03\x04".to_vec())];
+    let bad = vec![("broken.jpg".to_string(), b"\xff\xd8\xff\xe0 not a JPEG".to_vec()), ("archive.zip".to_string(), b"PK\x03\x04".to_vec())];
     h.state_mut().use_files(pdfcraft_ui_egui::FilePurpose::Combine, bad);
     h.run_steps(3);
-    assert_eq!(combine_names(&h), ["one.pdf", "broken.jpg", "report.docx"]);
+    assert_eq!(combine_names(&h), ["one.pdf", "broken.jpg", "archive.zip"]);
     for f in &h.state().combine_draft[1..] {
         let why = f.problem.as_deref().expect("why it can't be combined");
         assert!(why.starts_with("Can't be read: ") && !why.contains(&f.name), "{why}");
@@ -1857,7 +1859,7 @@ fn files_that_cannot_be_read_are_listed_and_left_out_once_the_user_agrees() {
     h.run_steps(3);
     h.get_by_label("Leave out files that can't be read?");
     h.get_by_label("• broken.jpg");
-    h.get_by_label("• report.docx");
+    h.get_by_label("• archive.zip");
     h.get_by_label("Cancel").click();
     h.run_steps(3);
     assert!(h.query_by_label("Leave out files that can't be read?").is_none());
@@ -2134,7 +2136,7 @@ fn plus_between_pages_inserts_picked_files_there_in_order() {
     assert_eq!(texts_of(h.state(), 0), ["a note", "Page 1", "a note", "Page 2", "Page 3", "a note"]);
     // A file that can't be converted changes nothing.
     let before = texts_of(h.state(), 0);
-    h.state_mut().use_files(pdfcraft_ui_egui::FilePurpose::InsertPages, vec![("report.docx".into(), b"PK\x03\x04".to_vec())]);
+    h.state_mut().use_files(pdfcraft_ui_egui::FilePurpose::InsertPages, vec![("archive.zip".into(), b"PK\x03\x04".to_vec())]);
     h.run_steps(2);
     assert_eq!(texts_of(h.state(), 0), before);
 }
diff --git a/crates/ui-egui/tests/it/field_triggers.rs b/crates/ui-egui/tests/it/field_triggers.rs
new file mode 100644
index 0000000000..f648b7a445
--- /dev/null
+++ b/crates/ui-egui/tests/it/field_triggers.rs
@@ -0,0 +1,104 @@
+//! A form field widget's pointer scripts in the app (#269, ported from #344): the pointer
+//! moving onto and off a widget runs its Mouse Enter and Mouse Exit JavaScript, and a click on a
+//! check box runs its Mouse Up JavaScript after the click stored the new value (#247).
+
+use egui_kittest::Harness;
+use pdfcraft_ui_egui::PdfCraftApp;
+
+/// `log` records what ran; `hot` (a text field) logs the pointer entering and leaving it;
+/// `strike` (a check box) shows or hides `note` from its Mouse Up script by its own new value.
+fn form() -> Vec<u8> {
+    let objs = [
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R 5 0 R 6 0 R 8 0 R] /DA (/Helv 0 Tf 0 g) /DR << /Font << /Helv 7 0 R >> >> >> >>",
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 400] >>",
+        "<< /Type /Page /Parent 2 0 R /Annots [4 0 R 5 0 R 6 0 R 8 0 R] >>",
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (log) /V () /Rect [20 350 280 370] /P 3 0 R /F 4 >>",
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (hot) /V () /Rect [20 250 280 290] /P 3 0 R /F 4 /AA << /E << /S /JavaScript /JS (getField\\('log'\\).value += 'in;';) >> /X << /S /JavaScript /JS (getField\\('log'\\).value += 'out;';) >> >> >>",
+        "<< /Type /Annot /Subtype /Widget /FT /Btn /T (strike) /V /Off /AS /Off /Rect [20 300 50 330] /P 3 0 R /F 4 /MK << /CA (4) >> /AP << /N << /Yes 9 0 R /Off 9 0 R >> >> /A << /S /JavaScript /JS (getField\\('note'\\).display = event.target.value == 'Off' ? display.hidden : display.visible; getField\\('log'\\).value += 'up:' + event.target.value + ';';) >> >>",
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >>",
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (note) /V (struck) /Rect [60 300 280 330] /P 3 0 R /F 6 >>",
+        "<< /Type /XObject /Subtype /Form /BBox [0 0 30 30] /Length 0 >>\nstream\n\nendstream",
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    out
+}
+
+fn harness() -> Harness<'static, PdfCraftApp> {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.set_option("left", "closed").unwrap();
+        app.open_bytes("triggers.pdf", None, form()).unwrap();
+        app
+    });
+    crate::support::settle(&mut h);
+    h
+}
+
+fn field<'a>(app: &'a PdfCraftApp, name: &str) -> &'a pdfcraft_engine::FormField {
+    let id = app.active_ids().unwrap().1;
+    app.session.get(id).unwrap().form.iter().find(|f| f.name == name).unwrap()
+}
+
+fn centre(h: &Harness<'static, PdfCraftApp>, name: &str) -> egui::Pos2 {
+    let app = h.state();
+    let (index, id) = app.active_ids().unwrap();
+    let doc = app.session.get(id).unwrap();
+    pdfcraft_ui_egui::forms_ui::field_screen_rect(&app.views[index], &doc.info, field(app, name), 0).unwrap().center()
+}
+
+fn log(h: &Harness<'static, PdfCraftApp>) -> String {
+    field(h.state(), "log").value.join(",")
+}
+
+#[test]
+fn the_pointer_entering_and_leaving_a_widget_runs_its_scripts() {
+    let mut h = harness();
+    let hot = centre(&h, "hot");
+    let away = hot + egui::vec2(0.0, 200.0);
+    h.hover_at(away);
+    h.run_steps(2);
+    h.hover_at(hot);
+    crate::support::wait_until(&mut h, "Mouse Enter ran", |app| field(app, "log").value.join(",") == "in;");
+    // Moving within the widget runs nothing more.
+    h.hover_at(hot + egui::vec2(10.0, 0.0));
+    h.run_steps(3);
+    assert_eq!(log(&h), "in;");
+    h.hover_at(away);
+    crate::support::wait_until(&mut h, "Mouse Exit ran", |app| field(app, "log").value.join(",") == "in;out;");
+}
+
+/// The check box's Mouse Up reads the value its click stored: checking it shows the note,
+/// unchecking hides it again (#247).
+#[test]
+fn a_check_box_mouse_up_script_sees_the_value_its_click_stored() {
+    let mut h = harness();
+    let strike = centre(&h, "strike");
+    let click = |h: &mut Harness<'static, PdfCraftApp>| {
+        h.hover_at(strike);
+        h.run_steps(1);
+        h.drag_at(strike);
+        h.run_steps(1);
+        h.drop_at(strike);
+        h.run_steps(1);
+    };
+    click(&mut h);
+    crate::support::wait_until(&mut h, "checked and its Mouse Up ran", |app| field(app, "log").value.join(",") == "up:Yes;");
+    assert_eq!(field(h.state(), "strike").value, ["Yes"]);
+    assert!(!field(h.state(), "note").widgets[0].hidden, "shown by the script");
+    h.run_steps(6);
+    click(&mut h);
+    crate::support::wait_until(&mut h, "unchecked and its Mouse Up ran", |app| field(app, "log").value.join(",") == "up:Yes;up:Off;");
+    assert!(field(h.state(), "note").widgets[0].hidden, "hidden again");
+}
diff --git a/crates/ui-egui/tests/it/forms.rs b/crates/ui-egui/tests/it/forms.rs
index 31595def46..3318e1332f 100644
--- a/crates/ui-egui/tests/it/forms.rs
+++ b/crates/ui-egui/tests/it/forms.rs
@@ -1823,20 +1823,20 @@ fn a_form_button_opens_only_a_real_pdf_and_returns_to_the_tab_it_opened() {
     let _ = std::fs::remove_file(&saved);
     h.state_mut().pick_override = Some(vec![saved.to_string_lossy().into_owned()]);
     h.state_mut().run_button_script(id, "go", "this.exportDataObject({cName: 'fake.pdf', nLaunch: 2});");
-    h.run_steps(6);
+    wait_for_file(&mut h, &saved);
     assert_eq!(tabs(&h), 2, "no tab for a file that isn't a PDF: {:?}", h.state().toast);
     assert_eq!(std::fs::read(&saved).ok().as_deref(), Some(&b"not a PDF at"[..]), "offered to save instead");
     let _ = std::fs::remove_file(&saved);
     // The real attached PDF opens in a tab of its own, though another inner.pdf starts with it.
     h.state_mut().active = Some(0);
     h.state_mut().run_button_script(id, "go", "this.exportDataObject({cName: 'Guide.pdf', nLaunch: 2});");
-    h.run_steps(4);
+    crate::support::wait_until(&mut h, "the attachment to open", |app| app.active == Some(2));
     assert_eq!(tabs(&h), 3, "a tab of its own");
     assert_eq!(h.state().active, Some(2));
     // Asked again, it goes back to the tab it opened.
     h.state_mut().active = Some(0);
     h.state_mut().run_button_script(id, "go", "this.exportDataObject({cName: 'Guide.pdf', nLaunch: 2});");
-    h.run_steps(4);
+    crate::support::wait_until(&mut h, "the attachment tab to activate", |app| app.active == Some(2));
     assert_eq!((tabs(&h), h.state().active), (3, Some(2)), "the tab it opened, not the other inner.pdf");
 }
 
@@ -1858,23 +1858,24 @@ fn a_form_button_opens_its_attached_instructions_in_a_new_tab() {
     let id = h.state().views[0].id;
     // By its key in the document's attached files, as forms name it.
     h.state_mut().run_button_script(id, "go", "this.exportDataObject({cName: 'Guide.pdf', nLaunch: 2});");
-    h.run_steps(4);
+    crate::support::wait_until(&mut h, "the attachment to open", |app| app.active == Some(1));
     assert_eq!(tabs(&h), ["form.pdf", "inner.pdf"], "the attached PDF opens in its own tab");
     // Asked again from the form, it goes back to that tab rather than opening another.
     h.state_mut().active = Some(0);
     h.state_mut().run_button_script(id, "go", "this.exportDataObject({cName: 'Guide.pdf', nLaunch: 2});");
-    h.run_steps(4);
+    crate::support::wait_until(&mut h, "the attachment tab to activate", |app| app.active == Some(1));
     assert_eq!(tabs(&h), ["form.pdf", "inner.pdf"], "no second copy");
     assert_eq!(h.state().active, Some(1), "its tab is shown");
     // A file the document doesn't have is said so.
+    h.state_mut().active = Some(0);
     h.state_mut().run_button_script(id, "go", "this.exportDataObject({cName: 'nope.pdf', nLaunch: 2});");
-    h.run_steps(2);
+    crate::support::wait_until(&mut h, "the missing attachment notice", |app| app.toast.as_ref().is_some_and(|t| t.0.contains("nope.pdf")));
     assert!(h.state().toast.as_ref().is_some_and(|t| t.0.contains("nope.pdf")), "{:?}", h.state().toast);
     assert_eq!(tabs(&h).len(), 2);
     // A name of the form's own is shortened in the message, keeping its end. (Past a line's
     // length, the script engine cuts it first, as it cuts every name a script passes.)
     h.state_mut().run_button_script(id, "go", "this.exportDataObject({cName: new Array(3001).join('x') + '.pdf', nLaunch: 2});");
-    h.run_steps(2);
+    crate::support::wait_until(&mut h, "the shortened attachment notice", |app| app.toast.as_ref().is_some_and(|t| t.0.contains("x.pdf")));
     let toast = h.state().toast.as_ref().map(|t| t.0.clone()).unwrap_or_default();
     assert!(toast.contains('…') && toast.contains("x.pdf"), "{toast}");
     assert!(toast.chars().count() < 200, "{} characters", toast.chars().count());
@@ -2017,12 +2018,10 @@ fn a_form_button_shows_and_hides_the_attachments_panel() {
     h.run_steps(2);
     let id = h.state().views[0].id;
     h.state_mut().run_button_script(id, "size", "app.execMenuItem('ShowHideFileAttachment');");
-    h.run_steps(2);
-    assert_eq!(h.state().right, Some(pdfcraft_ui_egui::RightPanel::Attachments));
+    crate::support::wait_until(&mut h, "attachments panel to open", |app| app.right == Some(pdfcraft_ui_egui::RightPanel::Attachments));
     // Show/Hide, as its name says: asked again, it closes.
     h.state_mut().run_button_script(id, "size", "app.execMenuItem('ShowHideFileAttachment');");
-    h.run_steps(2);
-    assert_eq!(h.state().right, None);
+    crate::support::wait_until(&mut h, "attachments panel to close", |app| app.right.is_none());
 }
 
 /// Which widgets of field `name` are on (their `/AS` is their on state).
diff --git a/crates/ui-egui/tests/it/javascript.rs b/crates/ui-egui/tests/it/javascript.rs
index b4aaa4224f..7ed9c784f7 100644
--- a/crates/ui-egui/tests/it/javascript.rs
+++ b/crates/ui-egui/tests/it/javascript.rs
@@ -7,11 +7,16 @@ use pdfcraft_ui_egui::{Dialog, PdfCraftApp};
 
 /// A form with a text field and a push button whose Mouse Up script fills it in.
 fn form() -> Vec<u8> {
+    form_with_text_action("")
+}
+
+fn form_with_text_action(action: &str) -> Vec<u8> {
+    let greeting = format!("<< /Type /Annot /Subtype /Widget /FT /Tx /T (greeting) /Rect [20 250 280 270] /P 3 0 R /F 4 {action} >>");
     let objs = [
         "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R 5 0 R] /DA (/Helv 0 Tf 0 g) /DR << /Font << /Helv 6 0 R >> >> >> >>",
         "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 300] >>",
         "<< /Type /Page /Parent 2 0 R /Annots [4 0 R 5 0 R] >>",
-        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (greeting) /Rect [20 250 280 270] /P 3 0 R /F 4 >>",
+        &greeting,
         "<< /Type /Annot /Subtype /Widget /FT /Btn /Ff 65536 /T (hello) /Rect [20 200 120 230] /P 3 0 R /F 4 /A << /S /JavaScript /JS (getField\\('greeting'\\).value = 'Hello from JavaScript'; app.alert\\('Filled in'\\);) >> >>",
         "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >>",
     ];
@@ -76,9 +81,43 @@ fn button_scripts_run_and_alert() {
     let mut h = harness();
     let id = h.state().active_ids().unwrap().1;
     h.state_mut().run_button_script(id, "hello", "getField('greeting').value = 'Hello from JavaScript'; app.alert('Filled in');");
-    h.run_steps(2);
-    assert_eq!(value(&h, "greeting"), ["Hello from JavaScript"]);
-    assert_eq!(h.state().toast.clone().unwrap().0, "Filled in");
+    wait_for(&mut h, "Filled in");
+    h.get_by_label("OK").click();
+    wait_value(&mut h, "greeting", "Hello from JavaScript");
+}
+
+#[test]
+fn text_widget_mouse_up_runs_its_menu_and_keeps_the_result() {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.set_option("left", "closed").unwrap();
+        let bytes = form_with_text_action(
+            r"/AA << /U << /S /JavaScript /JS (var choice = app.popUpMenuEx\({cName:'Choose test value',cReturn:'selected'}\); if \(choice\) getField\('greeting'\).value = choice;) >> >>",
+        );
+        app.open_bytes("text-action.pdf", None, bytes).unwrap();
+        app
+    });
+    crate::support::settle(&mut h);
+    let point = {
+        let app = h.state();
+        let (index, id) = app.active_ids().unwrap();
+        let doc = app.session.get(id).unwrap();
+        let field = doc.form.iter().find(|field| field.name == "greeting").unwrap();
+        assert!(field.widgets[0].mouse_up_script.is_some());
+        pdfcraft_ui_egui::forms_ui::field_screen_rect(&app.views[index], &doc.info, field, 0).unwrap().center()
+    };
+    for _ in 0..2 {
+        h.hover_at(point);
+        h.run_steps(1);
+        h.drag_at(point);
+        h.run_steps(1);
+        h.drop_at(point);
+        wait_for(&mut h, "Choose test value");
+        h.get_by_label("Choose test value").click();
+        wait_value(&mut h, "greeting", "selected");
+        h.run_steps(8);
+    }
 }
 
 /// One run's messages are all shown, in order (#4294): the first takes the toast with its title
@@ -90,7 +129,12 @@ fn every_message_a_script_shows_takes_the_toast_in_turn() {
     use pdfcraft_engine::js::{MessageButtons, MessageIcon};
     let mut h = harness();
     let id = h.state().active_ids().unwrap().1;
-    h.state_mut().run_button_script(id, "hello", "app.alert('First', 1, 0, 'Order form'); app.alert('Second', 3); app.alert('Third');");
+    let out = h
+        .state_mut()
+        .session
+        .run_javascript(id, "app.alert('First', 1, 0, 'Order form'); app.alert('Second', 3); app.alert('Third');", None)
+        .unwrap();
+    h.state_mut().handle_js(id, pdfcraft_engine::js::JsOutput { alerts: out.alerts, ..Default::default() });
     h.run_steps(2);
     let shown = |h: &Harness<'static, PdfCraftApp>| h.state().toast.clone().map(|t| t.0);
     assert_eq!(shown(&h).as_deref(), Some("First"));
@@ -114,7 +158,8 @@ fn every_message_a_script_shows_takes_the_toast_in_turn() {
     // follows it.
     h.state_mut().toast = None;
     h.run_steps(2);
-    h.state_mut().run_button_script(id, "hello", "this.submitForm('https://example.com/form'); app.alert('Fourth');");
+    let out = h.state_mut().session.run_javascript(id, "this.submitForm('https://example.com/form'); app.alert('Fourth');", None).unwrap();
+    h.state_mut().handle_js(id, pdfcraft_engine::js::JsOutput { alerts: out.alerts, requests: out.requests, ..Default::default() });
     h.run_steps(2);
     let notice = shown(&h).unwrap_or_default();
     assert!(notice.contains("submitted"), "the submit notice stays: {notice}");
@@ -215,3 +260,439 @@ fn prepare_a_form_detects_fields_on_a_paper_form() {
     assert_eq!(names, ["Name", "Phone"]);
     assert_eq!(app.toast.clone().unwrap().0, "Detected 2 form fields");
 }
+
+/// Advance bounded UI frames until the synthetic prompt label becomes available.
+fn wait_for(h: &mut Harness<'static, PdfCraftApp>, label: &str) {
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(12);
+    while std::time::Instant::now() < deadline {
+        h.run_steps(1);
+        if h.query_by_label(label).is_some() {
+            return;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    panic!("script dialog did not show {label}");
+}
+/// Advance bounded UI frames until the worker completion updates the expected synthetic field value.
+fn wait_value(h: &mut Harness<'static, PdfCraftApp>, name: &str, expected: &str) {
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(12);
+    while std::time::Instant::now() < deadline {
+        h.run_steps(1);
+        if value(h, name) == [expected] {
+            return;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    assert_eq!(value(h, name), [expected]);
+}
+#[test]
+/// Every native script prompt identifies its document, even with misleading or empty titles.
+fn native_script_prompts_show_an_app_owned_caption() {
+    for (script, body, title) in [
+        ("app.response({cQuestion:'Type a value',cTitle:'PdfCraft security',bPassword:true});", "Type a value", Some("PdfCraft security")),
+        ("app.response({cQuestion:'Empty title prompt',cTitle:''});", "Empty title prompt", None),
+        ("app.alert({cMsg:'Script message',cTitle:'PdfCraft security'});", "Script message", Some("PdfCraft security")),
+        ("app.alert({cMsg:'Untitled alert',cTitle:''});", "Untitled alert", None),
+        ("app.popUpMenuEx({cName:'Pick a value',cReturn:'yes'});", "Pick a value", None),
+    ] {
+        let mut h = harness();
+        let id = h.state().active_ids().unwrap().1;
+        h.state_mut().run_button_script(id, "hello", script);
+        wait_for(&mut h, body);
+        assert!(h.query_by_label("This document's script is asking").is_some(), "{script}");
+        assert_eq!(
+            h.query_by_label("This request comes from the document, not PdfCraft. Only enter a password if you trust this document.").is_some(),
+            script.contains("bPassword:true"),
+            "{script}"
+        );
+        assert!(h.query_by_label("Document: form.pdf").is_some(), "{script}");
+        if let Some(title) = title {
+            assert!(h.query_by_label(title).is_some(), "{script}");
+        }
+        h.get_by_label("Cancel").click();
+        h.run_steps(2);
+    }
+}
+
+#[test]
+fn native_script_prompt_uses_the_german_catalog_when_available() {
+    use pdfcraft_ui_egui::i18n::{Lang, tr};
+
+    let Some(german) = Lang::from_code("de") else { return };
+    let source = "This document's script is asking";
+    let heading = "Das Skript dieses Dokuments fragt";
+    // Older catalog pins can still build the application with the English fallback.
+    if tr(german, source) == source && std::env::var_os("PDFCRAFT_REQUIRE_SCRIPT_PROMPT_TRANSLATIONS").is_none() {
+        return;
+    }
+    assert_eq!(tr(german, source), heading);
+    let mut h = harness();
+    h.state_mut().set_option("language", "de").unwrap();
+    let id = h.state().active_ids().unwrap().1;
+    h.state_mut().run_button_script(id, "hello", "app.response({cQuestion:'Test',bPassword:true});");
+    wait_for(&mut h, heading);
+    assert!(h.query_by_label("Dokument: form.pdf").is_some());
+    assert!(h.query_by_label("Diese Aufforderung stammt aus dem Dokument und wird von dessen Skript angezeigt. Gib ein Passwort nur ein, wenn du diesem Dokument vertraust.").is_some());
+}
+
+#[test]
+/// A real UI menu followed by input resumes once and does not leak the menu click into the next modal.
+fn native_button_popup_and_response_resume_without_replaying_the_script() {
+    for typed in [false, true] {
+        let mut h = harness();
+        let id = h.state().active_ids().unwrap().1;
+        h.state_mut().run_button_script(id,"hello","var calls=typeof calls==='number'?calls:0;calls++;var choice=app.popUpMenuEx({cName:'Morning',cReturn:'08:00'});var extra=app.response({cTitle:'Manual time',cQuestion:'Suffix',cDefault:'x'});getField('greeting').value=choice+'/'+extra+'/'+calls;");
+        wait_for(&mut h, "Morning");
+        h.get_by_label("Morning").click();
+        wait_for(&mut h, "Suffix");
+        if typed {
+            h.get_by(|n| n.role() == egui::accesskit::Role::TextInput && n.value().as_deref() == Some("x")).focus();
+            h.run_steps(2);
+            h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::A);
+            h.run_steps(1);
+            h.get_by(|n| n.role() == egui::accesskit::Role::TextInput && n.is_focused()).type_text("typed answer");
+            h.run_steps(2);
+        }
+        if let Ok(path) = std::env::var("PDFCRAFT_COMPAT_SCREENSHOT") {
+            let image = h.render().unwrap();
+            let crop = image::imageops::crop_imm(&image, 400, 220, 600, 460).to_image();
+            crop.save(path).unwrap();
+        }
+        h.get_by_label("OK").click();
+        wait_value(&mut h, "greeting", if typed { "08:00/typed answer/1" } else { "08:00/x/1" });
+    }
+}
+#[test]
+/// Cancelling a native menu returns null to the same invocation without duplicating preceding work.
+fn native_popup_cancellation_returns_null_and_preserves_the_single_invocation() {
+    let mut h = harness();
+    let id = h.state().active_ids().unwrap().1;
+    let script = "var calls=typeof calls==='number'?calls:0;calls++;var choice=app.popUpMenuEx({cName:'Choose',cReturn:'yes'});getField('greeting').value=String(choice)+'/'+calls;";
+    h.state_mut().run_button_script(id, "hello", script);
+    wait_for(&mut h, "Choose");
+    h.get_by_label("Cancel").click();
+    wait_value(&mut h, "greeting", "null/1");
+    h.state_mut().run_button_script(id, "hello", script);
+    wait_for(&mut h, "Choose");
+    h.get_by_label("Cancel").click();
+    wait_value(&mut h, "greeting", "null/2");
+}
+
+/// A nested menu exposes only enabled leaves as valid replies to the waiting script.
+#[test]
+fn native_popup_submenu_keeps_disabled_items_unselectable() {
+    let mut h = harness();
+    let id = h.state().active_ids().unwrap().1;
+    let script = "var calls=typeof calls==='number'?calls:0; calls++; \
+                  var choice=app.popUpMenuEx({cName:'Group',oSubMenu:[{cName:'Disabled',bEnabled:false}, \
+                  {cName:'Enabled',cReturn:'chosen'}]}); getField('greeting').value=choice+'/'+calls;";
+    h.state_mut().run_button_script(id, "hello", script);
+    wait_for(&mut h, "Group");
+    h.get_by_label("Group").click();
+    wait_for(&mut h, "Enabled");
+    // The modal recentres while the submenu expands. Settle the layout before sending pointer input.
+    h.run_steps(30);
+    assert!(h.query_by(|node| node.label().as_deref() == Some("Disabled") && node.is_disabled()).is_some());
+    h.get_by_label("Enabled").click();
+    wait_value(&mut h, "greeting", "chosen/1");
+}
+
+#[test]
+/// An intervening document edit prevents an older pending script result from replacing current values.
+fn native_popup_completion_is_discarded_after_the_document_is_edited() {
+    let mut h = harness();
+    let id = h.state().active_ids().unwrap().1;
+    h.state_mut().run_button_script(id, "hello", "app.popUpMenuEx({cName:'Wait',cReturn:'yes'});getField('greeting').value='stale';");
+    wait_for(&mut h, "Wait");
+    h.state_mut()
+        .session
+        .apply(id, pdfcraft_engine::Edit::SetFieldValue { name: "greeting".into(), value: pdfcraft_engine::FieldValue::Text("current".into()) })
+        .unwrap();
+    h.run_steps(5);
+    assert!(h.query_by_label("Wait").is_none(), "the stale prompt must be dismissed");
+    assert_eq!(value(&h, "greeting"), ["current"]);
+    // The document's worker remains reserved until the abandoned prompt exits.
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(5);
+    loop {
+        let out = h.state_mut().session.run_javascript(id, "var afterEdit='kept';", None).unwrap();
+        let Some(error) = out.error else { break };
+        assert!(out.execution_refused && error.contains("another script is active"), "{error}");
+        assert!(std::time::Instant::now() < deadline, "the abandoned worker did not finish");
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    assert_eq!(h.state_mut().session.run_javascript(id, "afterEdit", None).unwrap().result.as_deref(), Some("kept"));
+}
+
+/// Native Mouse Up must expose the same willCommit flag as the headless button path.
+#[test]
+fn native_button_events_match_headless_will_commit() {
+    let mut h = harness();
+    let id = h.state().active_ids().unwrap().1;
+    let headless = h.state_mut().session.run_javascript(id, "String(event.willCommit);", Some("hello")).unwrap();
+    assert_eq!(headless.result.as_deref(), Some("false"));
+    h.state_mut().run_button_script(id, "hello", "getField('greeting').value=String(event.willCommit);");
+    wait_value(&mut h, "greeting", "false");
+}
+
+/// A popup owns keyboard shortcuts; Undo must not edit the document below it.
+#[test]
+fn native_popup_keeps_undo_shortcuts_out_of_the_document() {
+    let mut h = harness();
+    let id = h.state().active_ids().unwrap().1;
+    h.state_mut()
+        .session
+        .apply(id, pdfcraft_engine::Edit::SetFieldValue { name: "greeting".into(), value: pdfcraft_engine::FieldValue::Text("current".into()) })
+        .unwrap();
+    h.state_mut().run_button_script(id, "hello", "app.popUpMenuEx({cName:'Wait',cReturn:'yes'});");
+    wait_for(&mut h, "Wait");
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::Z);
+    h.run_steps(3);
+    assert_eq!(value(&h, "greeting"), ["current"]);
+    assert!(h.query_by_label("Wait").is_some());
+    h.get_by_label("Cancel").click();
+    h.run_steps(5);
+}
+
+/// A script response stays clickable while another modal remains open underneath it.
+#[test]
+fn native_script_prompt_is_above_an_existing_dialog() {
+    let _gpu = crate::gpu();
+    for open_first in [true, false] {
+        let mut h = harness();
+        let id = h.state().active_ids().unwrap().1;
+        if open_first {
+            h.state_mut().dialog = Some(Dialog::JsConsole);
+            h.run_steps(3);
+        }
+        h.state_mut().run_button_script(
+            id,
+            "hello",
+            "getField('greeting').value=app.response({cTitle:'Top prompt',cQuestion:'Answer here',cDefault:'visible'});",
+        );
+        wait_for(&mut h, "Answer here");
+        if !open_first {
+            h.state_mut().dialog = Some(Dialog::JsConsole);
+        }
+        h.run_steps(4);
+        let expected = egui::Id::unique(("document-script-prompt", id.0, 1u32));
+        assert_eq!(h.ctx.memory(|m| m.top_modal_layer()).map(|l| l.id), Some(expected), "the prompt owns modal input, open_first={open_first}");
+        if let Ok(path) = std::env::var("PDFCRAFT_REVIEW4_MODAL_SCREENSHOT") {
+            h.render().unwrap().save(path).unwrap();
+        }
+        h.get_by_label("OK").click();
+        wait_value(&mut h, "greeting", "visible");
+        assert_eq!(h.state().dialog, Some(Dialog::JsConsole));
+        h.state_mut().run_button_script(id, "hello", "getField('greeting').value=String(app.response({cQuestion:'Cancel here'}));");
+        wait_for(&mut h, "Cancel here");
+        h.key_press(egui::Key::Escape);
+        wait_value(&mut h, "greeting", "null");
+        assert_eq!(h.state().dialog, Some(Dialog::JsConsole));
+    }
+}
+
+/// A real pointer click must retain the second same-named button through native completion.
+#[test]
+fn clicking_duplicate_named_buttons_targets_the_clicked_object() {
+    let _gpu = crate::gpu();
+    use pdfcraft_cos::{Dict, ObjRef, Object, PdfString};
+    use std::sync::Arc;
+    let mut cos = pdfcraft_cos::Document::open(Arc::new(form())).unwrap();
+    let first = ObjRef::new(5, 0);
+    let action = |caption: &str| {
+        let mut a = Dict::new();
+        a.set(b"S".to_vec(), Object::name("JavaScript"));
+        a.set(b"JS".to_vec(), PdfString::text(&format!("event.target.buttonSetCaption('{caption}');")));
+        Object::Dict(a)
+    };
+    cos.update_dict(first, |d| {
+        d.set(b"A".to_vec(), action("first"));
+        let mut mk = Dict::new();
+        mk.set(b"CA".to_vec(), PdfString::text("idle"));
+        d.set(b"MK".to_vec(), Object::Dict(mk));
+    })
+    .unwrap();
+    let mut second = cos.get(first).as_dict().unwrap().clone();
+    second.set(b"Rect".to_vec(), Object::Array(vec![160.into(), 200.into(), 280.into(), 230.into()]));
+    second.set(b"A".to_vec(), action("second"));
+    let second = cos.add(Object::Dict(second));
+    let root = cos.root().unwrap();
+    cos.update_dict(root, |d| {
+        let mut af = d.get(b"AcroForm").unwrap().as_dict().unwrap().clone();
+        let mut refs = af.get(b"Fields").unwrap().as_array().unwrap().clone();
+        refs.push(second.into());
+        af.set(b"Fields".to_vec(), Object::Array(refs));
+        d.set(b"AcroForm".to_vec(), Object::Dict(af));
+    })
+    .unwrap();
+    cos.update_dict(ObjRef::new(3, 0), |d| {
+        let mut a = d.get(b"Annots").unwrap().as_array().unwrap().clone();
+        a.push(second.into());
+        d.set(b"Annots".to_vec(), Object::Array(a));
+    })
+    .unwrap();
+    let bytes = pdfcraft_cos::write_full(&cos, &Default::default()).unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("duplicate-buttons.pdf", None, bytes).unwrap();
+        app
+    });
+    h.run_steps(6);
+    let captions = |h: &Harness<'_, PdfCraftApp>| {
+        let id = h.state().active_ids().unwrap().1;
+        h.state()
+            .session
+            .get(id)
+            .unwrap()
+            .form
+            .iter()
+            .filter(|f| f.name == "hello")
+            .map(|f| f.widgets.first().and_then(|w| w.caption.clone()))
+            .collect::<Vec<_>>()
+    };
+    let r = h.state().views[0].page_screen_rect(0).unwrap();
+    let at = r.min + egui::vec2(r.width() * 220.0 / 300.0, r.height() * 85.0 / 300.0);
+    h.hover_at(at);
+    h.run_steps(1);
+    h.drag_at(at);
+    h.run_steps(1);
+    h.drop_at(at);
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(12);
+    while std::time::Instant::now() < deadline {
+        h.run_steps(2);
+        if captions(&h).iter().any(|s| s.as_deref() == Some("second")) {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    assert_eq!(captions(&h), [Some("idle".into()), Some("second".into())]);
+    assert!(h.state_mut().execute("edit.undo"));
+    h.run_steps(3);
+    assert_eq!(captions(&h), [Some("idle".into()), Some("idle".into())]);
+    assert!(h.state_mut().execute("edit.redo"));
+    h.run_steps(3);
+    assert_eq!(captions(&h), [Some("idle".into()), Some("second".into())]);
+    let r = h.state().views[0].page_screen_rect(0).unwrap();
+    let at = r.min + egui::vec2(r.width() * 70.0 / 300.0, r.height() * 85.0 / 300.0);
+    h.hover_at(at);
+    h.run_steps(1);
+    h.drag_at(at);
+    h.run_steps(1);
+    h.drop_at(at);
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(12);
+    while std::time::Instant::now() < deadline {
+        h.run_steps(2);
+        if captions(&h).first().and_then(|s| s.as_deref()) == Some("first") {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    assert_eq!(captions(&h), [Some("first".into()), Some("second".into())]);
+    let id = h.state().active_ids().unwrap().1;
+    let bytes = h.state().session.save_bytes(id).unwrap();
+    let mut reopened = pdfcraft_engine::Session::new();
+    reopened.set_javascript(false);
+    let reopened_id = reopened.open("saved-buttons.pdf", None, bytes, None).unwrap();
+    assert_eq!(
+        reopened
+            .get(reopened_id)
+            .unwrap()
+            .form
+            .iter()
+            .filter(|f| f.name == "hello")
+            .map(|f| f.widgets.first().and_then(|w| w.caption.clone()))
+            .collect::<Vec<_>>(),
+        [Some("first".into()), Some("second".into())]
+    );
+    if let Ok(path) = std::env::var("PDFCRAFT_REVIEW12_BUTTON_SCREENSHOT") {
+        // Let the asynchronous page raster catch up with the final accepted script edit.
+        for _ in 0..60 {
+            h.run_steps(2);
+            std::thread::sleep(std::time::Duration::from_millis(5));
+        }
+        h.render().unwrap().save(path).unwrap();
+    }
+}
+
+/// The real image-button click and picker callback must preserve the second duplicate's identity.
+#[test]
+fn clicking_duplicate_image_buttons_imports_only_into_the_clicked_field() {
+    let _gpu = crate::gpu();
+    let mut session = pdfcraft_engine::Session::new();
+    let bytes = session.create_blank(300.0, 300.0, 1).unwrap();
+    let id = session.open("images.pdf", None, bytes, None).unwrap();
+    for (name, x) in [("first", 20.0), ("second", 160.0)] {
+        session
+            .apply(
+                id,
+                pdfcraft_engine::Edit::AddField {
+                    page: 0,
+                    rect: [x, 200.0, x + 100.0, 230.0],
+                    kind: pdfcraft_engine::NewField::Image,
+                    name: Some(name.into()),
+                },
+            )
+            .unwrap();
+    }
+    let mut cos = pdfcraft_cos::Document::open(session.save_bytes(id).unwrap()).unwrap();
+    for field in session.get(id).unwrap().form.iter() {
+        cos.update_dict(field.obj, |d| d.set(b"T".to_vec(), pdfcraft_cos::PdfString::text("same"))).unwrap();
+    }
+    let bytes = pdfcraft_cos::write_full(&cos, &Default::default()).unwrap();
+    let dir = std::env::temp_dir().join(format!("pdfcraft-exact-image-click-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let path = dir.join("synthetic.png");
+    let mut png = vec![];
+    {
+        let mut encoder = png::Encoder::new(&mut png, 2, 2);
+        encoder.set_color(png::ColorType::Rgb);
+        encoder.set_depth(png::BitDepth::Eight);
+        encoder.write_header().unwrap().write_image_data(&[120u8; 12]).unwrap();
+    }
+    std::fs::write(&path, png).unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("images.pdf", None, bytes).unwrap();
+        app.save_override = Some(path.to_string_lossy().into_owned());
+        app
+    });
+    h.run_steps(6);
+    let rect = h.state().views[0].page_screen_rect(0).unwrap();
+    let at = rect.min + egui::vec2(rect.width() * 210.0 / 300.0, rect.height() * 85.0 / 300.0);
+    h.hover_at(at);
+    h.run_steps(1);
+    h.drag_at(at);
+    h.run_steps(1);
+    h.drop_at(at);
+    h.run_steps(3);
+    let icons = |h: &mut Harness<'_, PdfCraftApp>| {
+        let id = h.state().active_ids().unwrap().1;
+        let cos = pdfcraft_cos::Document::open(h.state_mut().session.save_bytes(id).unwrap()).unwrap();
+        let root = cos.root().unwrap();
+        let form = cos.get(root).as_dict().unwrap().get(b"AcroForm").map(|v| cos.resolve(v)).unwrap();
+        form.as_dict()
+            .unwrap()
+            .get(b"Fields")
+            .unwrap()
+            .as_array()
+            .unwrap()
+            .iter()
+            .map(|r| {
+                cos.resolve(r)
+                    .as_dict()
+                    .and_then(|d| d.get(b"MK").map(|v| cos.resolve(v)))
+                    .is_some_and(|m| m.as_dict().is_some_and(|d| d.contains(b"I")))
+            })
+            .collect::<Vec<_>>()
+    };
+    assert_eq!(icons(&mut h), [false, true]);
+    assert!(h.state_mut().execute("edit.undo"));
+    h.run_steps(2);
+    assert_eq!(icons(&mut h), [false, false]);
+    assert!(h.state_mut().execute("edit.redo"));
+    h.run_steps(2);
+    assert_eq!(icons(&mut h), [false, true]);
+    std::fs::remove_file(path).unwrap();
+    std::fs::remove_dir(dir).unwrap();
+}
diff --git a/crates/ui-egui/tests/it/main.rs b/crates/ui-egui/tests/it/main.rs
index ea5dec6e61..0aae004df6 100644
--- a/crates/ui-egui/tests/it/main.rs
+++ b/crates/ui-egui/tests/it/main.rs
@@ -43,6 +43,7 @@ mod download_mime;
 mod editing;
 mod editor_taps;
 mod export;
+mod field_triggers;
 mod fill_sign;
 mod find_replace;
 mod folders;
diff --git a/crates/ui-egui/tests/it/print.rs b/crates/ui-egui/tests/it/print.rs
index 87d77a7eaa..cf382e095b 100644
--- a/crates/ui-egui/tests/it/print.rs
+++ b/crates/ui-egui/tests/it/print.rs
@@ -1602,6 +1602,14 @@ fn adding_custom_paper_overrides_pending_driver_default() {
         assert!(std::time::Instant::now() < deadline, "paper discovery started");
         std::thread::sleep(std::time::Duration::from_millis(5));
     }
+    // The read starts as the dialog opens; its paper row may take a few more frames to draw (on
+    // hosted macOS it hadn't when the read started).
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(10);
+    while h.query_by_label("Custom…").is_none() {
+        assert!(std::time::Instant::now() < deadline, "the paper row is drawn");
+        h.run_steps(1);
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
     h.get_by_label("Custom…").click();
     h.run_steps(2);
     let units = h.state().print_draft.units.per_point();
diff --git a/crates/xfa/src/data.rs b/crates/xfa/src/data.rs
index 34be028d89..4e7de4af74 100644
--- a/crates/xfa/src/data.rs
+++ b/crates/xfa/src/data.rs
@@ -148,13 +148,21 @@ pub enum DataOp {
 impl DataNode {
     /// The node at `path`, made (with empty siblings before it) where missing; `None` past
     /// the index cap.
-    fn ensure(&mut self, path: &[(String, usize)]) -> Option<&mut DataNode> {
+    fn ensure(&mut self, path: &[(String, usize)], budget: &mut usize) -> Option<&mut DataNode> {
         let mut node = self;
         for (name, idx) in path {
             if *idx >= MAX_INDEX {
                 return None;
             }
             let have = node.children.iter().filter(|c| &c.name == name).count();
+            // Every skipped sibling owns a copy of the name: bounded as `Build::at` bounds a write.
+            // The budget is the whole path's, not each level's: a deep path that is affordable at
+            // every level taken alone would otherwise allocate its way past the bound.
+            let need = (*idx + 1).saturating_sub(have).saturating_mul(name.len());
+            if need > *budget {
+                return None;
+            }
+            *budget -= need;
             for _ in have..=*idx {
                 node.children.push(DataNode { name: name.clone(), ..Default::default() });
             }
@@ -166,9 +174,11 @@ impl DataNode {
     /// Apply `op` to this tree (the root is the `xfa:data` element), as [`write_data_ops`]
     /// will to the packet, so scripts that run before it is written see the change.
     pub fn apply(&mut self, op: &DataOp) {
+        // One budget for the op's whole path, as `Build::at` bounds a write.
+        let mut budget = build::MAX_NEW_NAME_BYTES;
         match op {
             DataOp::Value { path, text } => {
-                if let Some(n) = self.ensure(path) {
+                if let Some(n) = self.ensure(path, &mut budget) {
                     // A multi-select list's picks, one `value` each (see `value_at`), told apart
                     // as the packet writer does: `value` leaves only, or a group holding none.
                     let picks = if n.children.is_empty() { n.group } else { n.children.iter().all(|c| c.name == "value" && c.children.is_empty()) };
@@ -189,7 +199,7 @@ impl DataNode {
                 if let Some(&last) = count.checked_sub(1).as_ref() {
                     let mut path = parent.clone();
                     path.push((name.clone(), last.min(MAX_INDEX.saturating_sub(1))));
-                    let _ = self.ensure(&path);
+                    let _ = self.ensure(&path, &mut budget);
                 }
             }
             DataOp::Remove(path) => {
diff --git a/crates/xfa/src/data/build.rs b/crates/xfa/src/data/build.rs
index 98e34f0f49..e90904d60c 100644
--- a/crates/xfa/src/data/build.rs
+++ b/crates/xfa/src/data/build.rs
@@ -38,7 +38,7 @@ pub(super) const MAX_INDEX: usize = 10_000;
 
 /// Most bytes of names the nodes one write creates hold together: every sibling an index
 /// skips over gets its own copy of the name.
-const MAX_NEW_NAME_BYTES: usize = 4 << 20;
+pub(super) const MAX_NEW_NAME_BYTES: usize = 4 << 20;
 
 /// What one write may still create: nodes and bytes of their names.
 pub(super) struct NewNodes {
diff --git a/crates/xfa/src/data/write.rs b/crates/xfa/src/data/write.rs
index 4667036fe5..554685e1ad 100644
--- a/crates/xfa/src/data/write.rs
+++ b/crates/xfa/src/data/write.rs
@@ -82,6 +82,11 @@ pub fn remove_data_instance(doc: &mut Document, path: &DataPath) -> Result<Datas
 /// pass, which asks for the instances again).
 const MAX_ENSURED: usize = 200_000;
 
+/// Most bytes of path those queued instances hold together: each one owns a copy of its parent
+/// path (segment buffers included, twice while duplicates are dropped) and its name, so a long
+/// ancestor would otherwise be multiplied by the instance count. Ordinary paths are tens of bytes.
+const MAX_ENSURED_BYTES: usize = 128 << 20;
+
 // Instance nodes write_data_ops has queued on this thread, for tests that bound its work.
 #[cfg(test)]
 thread_local! {
@@ -99,7 +104,7 @@ pub fn write_data_ops(doc: &mut Document, ops: &[DataOp], reuse: Option<ObjRef>)
     let mut run: Vec<Want> = Vec::new();
     // Instances queued in this run, by parent and name: asking for more only queues the rest.
     let mut queued: HashMap<(&DataPath, &str), usize> = HashMap::new();
-    let (mut ensured, mut capped) = (0usize, false);
+    let (mut ensured, mut ensured_bytes, mut capped, mut capped_bytes) = (0usize, 0usize, false, false);
     let flush = |run: &mut Vec<Want>, steps: &mut Vec<Vec<Want>>, removes: &mut Vec<Option<DataPath>>| {
         if !run.is_empty() {
             let mut seen = std::collections::HashSet::new();
@@ -117,12 +122,24 @@ pub fn write_data_ops(doc: &mut Document, ops: &[DataOp], reuse: Option<ObjRef>)
             }
             DataOp::Instances { parent, name, count } => {
                 let done = queued.entry((parent, name.as_str())).or_insert(0);
+                // The path (its segments' buffers and their text) is held by the queued step, which a
+                // clone then `push` can leave with up to twice the room, and cloned again into
+                // `flush`'s dedup set, beside the label and the step itself.
+                let segment = std::mem::size_of::<(String, usize)>();
+                let path_bytes =
+                    parent.iter().fold(segment.saturating_add(name.len()), |n, (p, _)| n.saturating_add(segment).saturating_add(p.len()));
+                let per_instance = path_bytes.saturating_mul(3).saturating_add(name.len()).saturating_add(16 + std::mem::size_of::<Want>());
                 while *done < (*count).min(MAX_INDEX) {
                     if ensured >= MAX_ENSURED {
                         capped = true;
                         break;
                     }
+                    if ensured_bytes.saturating_add(per_instance) > MAX_ENSURED_BYTES {
+                        capped_bytes = true;
+                        break;
+                    }
                     ensured += 1;
+                    ensured_bytes += per_instance;
                     #[cfg(test)]
                     ENSURED.with(|n| n.set(n.get() + 1));
                     let k = *done;
@@ -154,6 +171,11 @@ pub fn write_data_ops(doc: &mut Document, ops: &[DataOp], reuse: Option<ObjRef>)
     if capped {
         written.warnings.push(format!("XFA data instances not written past {MAX_ENSURED}: the rows were added and removed too often"));
     }
+    if capped_bytes {
+        written
+            .warnings
+            .push(format!("XFA data instances not written past {MAX_ENSURED_BYTES} bytes of names: the rows were added and removed too often"));
+    }
     Ok(written)
 }
 
diff --git a/crates/xfa/src/lib.rs b/crates/xfa/src/lib.rs
index 4e99093bc8..31c59351ed 100644
--- a/crates/xfa/src/lib.rs
+++ b/crates/xfa/src/lib.rs
@@ -107,8 +107,8 @@ pub use pdf::{AREA_KEY, CLICK_KEY, DATE_KEY, LAYOUT_KEY, NODE_KEY, SOM_KEY, Stri
 pub use picture::typed_date;
 pub use script::{
     FormNode, LiveForm, MAX_FORM_NODES, NodeKind, OVERRIDES_KEY, Overrides, ScriptEvent, apply_overrides, data_of, embedded_fields,
-    field_grows_with_text, field_is_embedded, fields_by_som, form_tree, form_tree_paged, has_focus_scripts, has_scripts, overrides, page_area_uses,
-    path_is_embedded, refresh_value, rerender, reset_default, set_overrides, template_of,
+    field_grows_with_text, field_is_embedded, field_objects_by_som, fields_by_som, form_tree, form_tree_paged, has_focus_scripts, has_scripts,
+    overrides, page_area_uses, path_is_embedded, refresh_value, rerender, reset_default, set_overrides, template_of,
 };
 
 #[derive(Debug, thiserror::Error)]
diff --git a/crates/xfa/src/script.rs b/crates/xfa/src/script.rs
index b2cfbab74c..eaaf3aad14 100644
--- a/crates/xfa/src/script.rs
+++ b/crates/xfa/src/script.rs
@@ -598,6 +598,11 @@ pub fn apply_overrides(tpl: &Template, ov: &Overrides) -> Template {
 
 /// The generated fields of the AcroForm by SOM path: `som → (field name, is a radio group)`.
 pub fn fields_by_som(doc: &Document) -> HashMap<String, String> {
+    field_objects_by_som(doc).into_iter().map(|(som, (name, _))| (som, name)).collect()
+}
+
+/// Resolve each generated SOM path to its AcroForm name and exact field dictionary.
+pub fn field_objects_by_som(doc: &Document) -> HashMap<String, (String, pdfcraft_cos::ObjRef)> {
     // Each field is read once: a field listed twice in `/Kids` (or among its own kids) would
     // otherwise be walked again for every path to it, doubling the work at each level. Fields
     // are told apart by object number, as `Document::get` finds them, so `5 0 R` and `5 1 R`
@@ -606,7 +611,7 @@ pub fn fields_by_som(doc: &Document) -> HashMap<String, String> {
     // long `/Kids` array stay bounded too; `walk_all` returns false once it is spent, and every
     // loop then stops.
     struct Walk {
-        out: HashMap<String, String>,
+        out: HashMap<String, (String, pdfcraft_cos::ObjRef)>,
         /// The shallowest depth each object number was read at.
         seen: HashMap<u32, usize>,
         steps: usize,
@@ -636,7 +641,7 @@ pub fn fields_by_som(doc: &Document) -> HashMap<String, String> {
         if let Some(som) = d.get(crate::pdf::SOM_KEY).map(|s| doc.resolve(s)).and_then(|s| s.as_string().map(|s| s.to_text()))
             && t.is_some()
         {
-            w.out.insert(som, name.clone());
+            w.out.insert(som, (name.clone(), r));
         }
         // Read in place: a copy of the array at every level would cost its length each time.
         let kids = d.get(b"Kids").map(|k| doc.resolve(k));
diff --git a/crates/xfa/src/tests.rs b/crates/xfa/src/tests.rs
index 682887e673..27e6522f26 100644
--- a/crates/xfa/src/tests.rs
+++ b/crates/xfa/src/tests.rs
@@ -7114,6 +7114,31 @@ fn a_container_is_as_wide_as_a_turned_draw_stands() {
     }
 }
 
+/// Every sibling a SOM index skips owns a copy of the element name: the in-memory builder refuses
+/// a path whose copies would pass the name-byte bound the writer holds itself to, and creates
+/// nothing for it.
+#[test]
+fn the_in_memory_data_builder_bounds_copied_name_bytes() {
+    let mut root = DataNode::default();
+    // 1 KiB x 9,999 skipped siblings is about 10 MB, over the 4 MiB bound.
+    let long = "n".repeat(1 << 10);
+    root.apply(&DataOp::Value { path: vec![(long.clone(), 9_999)], text: "x".into() });
+    assert!(root.children.is_empty());
+    // Within the bound, the same shape still builds (and keeps indexes).
+    root.apply(&DataOp::Value { path: vec![(long, 100)], text: "x".into() });
+    assert_eq!(root.children.len(), 101);
+}
+
+/// Each queued instance owns a copy of its parent path: a long ancestor stops the queue at the
+/// byte allowance, reported as capped, instead of being multiplied by the instance count.
+#[test]
+fn queued_instances_are_bounded_by_the_path_bytes_they_copy() {
+    let mut doc = Document::new_empty();
+    let parent: DataPath = vec![("a".repeat(16 << 20), 0), ("b".repeat(16 << 20), 0)];
+    let written = crate::data::write_data_ops(&mut doc, &[DataOp::Instances { parent, name: "row".into(), count: 100 }], None).unwrap();
+    assert!(written.warnings.iter().any(|w| w.contains("not written past")), "{:?}", written.warnings);
+}
+
 /// A page break splits an empty multi-line field that grows with its text (XFA 3.3 pp. 291–292:
 /// text splits between lines, and a field's `keep intact` is `none`): it starts where it is, its
 /// widget runs to the bottom of the content area, and the rest of its box, closed on every side,
diff --git a/docs/acroform-script-workflows.md b/docs/acroform-script-workflows.md
new file mode 100644
index 0000000000..ae08396dc6
--- /dev/null
+++ b/docs/acroform-script-workflows.md
@@ -0,0 +1,175 @@
+# AcroForm script workflows
+
+This contribution connects the existing AcroForm object model to the native viewer and the
+shared automation tools. The regression fixture is generated in Rust; it contains no private
+document, employee, signature image or real PIN.
+
+## Runtime and lifecycle
+
+Each open document owns a `ScriptSession`. On native targets its Boa context lives on one
+worker thread with a dedicated 64 MiB stack reservation (the transient stateless runner retains
+its separate stack policy). Document scripts initialize once with `Doc/Open`, before the requested event;
+button, console, format, validate and calculate scripts then share that context. Field objects
+read the latest snapshot supplied by the engine, including objects retained by earlier scripts.
+Exposed Field objects are cached by PDF object identity; synthetic fields use name keys. Separate documents cannot share globals or
+icon objects. `eval` and dynamic Function construction remain disabled.
+
+Changing the document-script sources recreates the context. Closing, reopening, reloading,
+Revert, disabling JavaScript, and saving a full rewrite release/reset the context. Incremental saves retain it. A rewrite can reuse PDF object numbers, so old Field and icon objects must not be carried across it. PDF Undo/Redo restores PDF state;
+it does not serialize or rewind arbitrary JavaScript variables. Globals are not saved into the
+PDF. A worker fault resets its context; the existing cooperative source/loop/recursion bounds
+remain in force. The source preflight additionally caps active arrow chains at 256 and right-associative
+assignment/exponentiation chains at 4,096 across open bracket levels. Independent statements
+and comma-separated sibling expressions reset only their own level; comparisons do not count.
+Keyword unary/new chains share the prefix
+depth bound of 64. These conservative limits protect recursive parser/compiler paths before
+execution on the smaller worker stack. Boundary and refusal cases run in subprocess regressions.
+These bounds do not establish a hard JavaScript heap quota.
+
+`calculateNow()` evaluates the current calculation list synchronously, in `/CO` order, using
+pending writes. Later statements in the same invocation see the new values. The caller's
+event is restored after calculation, including failure. Reentrancy is capped at eight levels.
+Field writes and their dependent recalculation use the existing single undo transaction.
+Pure caption, geometry, style and visibility updates do not run the calculation chain.
+Page geometry is read once per edit runner. Calculation sources/order are analyzed once on its
+first callback and reused; field values and appearance properties still refresh on every callback.
+Structural/document changes between batch children refresh the snapshot, and editing a field's
+calculation script or calculation order invalidates the cached plan before recalculating.
+`numPages`, `documentFileName` and `info` read the current event snapshot, including page/info edits,
+Undo/Redo and completed Save As, without reinitializing script globals.
+
+## Fields, appearances and icons
+
+- `buttonGetCaption()` reads the first widget. An unindexed `buttonSetCaption()` updates every
+  child widget, including when the first already has the requested text. An unchanged uniform
+  caption does not create an edit. Only normal face `0` is implemented.
+- `rect` reads/writes rotated user-space `[left, top, right, bottom]`. Writes affect widget 0,
+  as specified for an unindexed Field. Conversion uses its page rotation and effective Crop
+  box. Small/zero-area rectangles remain representable, rather than applying the interactive
+  field-authoring minimum size to a script's overlay.
+- `textColor`, `fillColor`, `strokeColor`, `textSize`, `lineWidth`, `borderStyle`, `userName`,
+  `readonly` and `display` flow to the form model and saved appearances. Colour input supports
+  `T`, `G`, `RGB` and `CMYK`; text cannot be transparent. The existing appearance editor writes
+  its canonical RGB representation. Partial changes preserve unrelated fonts and properties.
+- `buttonGetIcon()` returns a host-minted object for a normal Form XObject icon. `buttonSetIcon`
+  accepts only a handle minted in the same context, or null to clear it. It reuses the form and
+  its resources, including transparency, instead of rasterizing a signature/background. The
+  existing button appearance generator draws it. Other icon faces are refused.
+- `getPageBox` reads effective/inherited page boxes in rotated user space. `zoom`,
+  `app.runtimeHighlight` and `setFocus()` communicate with the native viewer. Automation
+  reports viewer requests and does not open an external application or change a real viewer.
+
+## Native menus and input
+
+`app.popUpMenuEx` supports nested menus, separators, marked/disabled items, explicit return
+values and cancellation. `app.response` supports named and positional parameters, defaults,
+password masking and null cancellation. Alert replies use the documented numeric button ids.
+Only the worker waits for a reply; egui continues drawing/input. The central modal gate blocks
+document shortcuts and page input while a prompt is visible. Idle prompt polling uses a
+one-second repaint interval; replying wakes the UI immediately and worker polling remains 16 ms. A reply resumes the same
+invocation, without replaying the script or its side effects.
+
+An explicit button captures document identity, generation and view geometry. Closing/switching
+the document, editing it, disabling scripts or changing the relevant view discards a stale
+completion and invalidates the old runtime. A reply is checked against an enabled menu leaf
+and its enabled ancestors; invented/disabled return values fail with a script error. Prompts
+have at most 1,024 entries, 16 submenu levels, 4,096-byte strings and 32 calls per invocation.
+The native desktop admits one pending button interaction. A document worker refuses a second
+run while the first is active, including while waiting for a prompt; it never queues a
+synchronous field callback behind an unanswered dialog.
+
+The native prompt UI is not implemented for the web build. The existing headless/unsupported
+host path cancels unanswered popups and response dialogs; no web-interaction parity is claimed.
+This work does not add timer execution, PDF annotations/layers to the JS object model, or the
+remaining document action triggers.
+
+## Automation
+
+The existing `js_run` accepts `answers`, an optional array of up to 32 strings or null values:
+
+```json
+{
+  "doc": 1,
+  "script": "var t=app.popUpMenuEx({cName:'Manual',cReturn:'manual'}); if(t==='manual') getField('time').value=app.response({cQuestion:'Time'});",
+  "answers": ["manual", "07:45"]
+}
+```
+
+The schema advertises a 4,096-character maximum per answer; the handler additionally enforces
+a 4,096-byte UTF-8 budget, so multi-byte strings can reach the byte limit earlier.
+Replies are consumed in prompt order. Null/missing replies cancel a menu/response; alert
+defaults choose acknowledgement, cancellation or No according to the button set. No direct
+file, process or network API is exposed by a prompt. Root confinement and permission-checked
+document edits continue through the existing automation/engine boundary.
+
+## Related contributions
+
+The persistent runtime uses the upstream work from #5304 for synchronous calculations,
+#5501 for page boxes, #5499 for colour parsing and writeback, and #5505 for normal captions.
+The integration supplies the live document state, exact field identity, and grouped field
+selection needed by the persistent context.
+
+The bounded `popUpMenuEx` parser in `crates/js/src/interaction.rs` was adapted from #2081.
+The prompt channel and default menu renderer support interactive form scripts. #2081 can
+supply an anchored renderer through the UI menu callback when it adds link actions. Once
+the shared parser lands upstream, this integration can use it directly.
+
+`ScriptSession::run_host_task` gives future timer and page actions (#4751) access to the
+retained realm on its own worker.
+
+Document actions and widget triggers (ported from #344 by @DWAA1660) run through the same
+realm. On opening, the document scripts run, then the catalog `/OpenAction`'s JavaScript
+and its `/Next` chain (event `Doc/Open`); Revert runs them again in a fresh realm.
+`Session::run_document_actions` runs `/AA /WS` before a save and `/AA /WP` before printing:
+the app's Save and Print and the `doc_save` and `doc_print` tools call it first. A failing
+action is reported and never stops the save or print. `Session::field_trigger` runs a
+widget's Mouse Enter, Mouse Exit, Mouse Down, Mouse Up, Focus or Blur JavaScript; the app
+queues them from the pointer and the focus, and `js_event` runs them headlessly. A check
+box's or radio button's Mouse Up runs after its click has stored the new value (#247).
+Scripts that run unasked (open, Will Save, Will Print, pointer over, focus) may only ask for
+highlighting, zoom, focus or a page.
+
+The lexical preflight recognizes unambiguous top-level and block-body ASI boundaries before identifiers, including declarations and assignments separated by line breaks or comments. It preserves counters after operators and member access, and across binary keyword operators. It distinguishes control-statement parentheses for regexp literals; inside expression parentheses, array/object literals and template interpolations it remains conservative; this is not a complete ECMAScript parser or ASI implementation.
+
+Native persistent workers are capped process-wide at four on 32-bit targets and sixteen on 64-bit targets. Each reserves 64 MiB of stack; closing a document releases its slot after the worker exits. Capacity errors ask the caller to close a scripted document and retry; other documents are never silently evicted. The transient stateless runner has its separate existing stack policy.
+
+Synchronous runs have one ten-second host deadline covering startup and every prompt round trip. A timeout replaces the document realm; late globals and custom Field properties cannot reach later runs. This is isolation, not forcible termination of an OS thread: cooperative engine limits still govern the detached worker, whose capacity slot stays charged until it exits. No hard CPU or heap quota is claimed.
+
+An asynchronous completion stays reserved until the engine accepts it. An intervening edit forks a fresh realm before any field calculation, including when the edit later fails. Pending results carry runtime identity as well as generation, so discarding an old result never clears a newer realm. Script prompts render last and explicitly raise their retained egui layer, including when another app dialog opens later. Null prompt answers cancel popup/response input; alert answers instead select the button set's default (OK, Cancel or No).
+
+`resetForm()` updates the live field shadow synchronously, including retained Field references and named parent groups. Reset requests still reach the PDF engine for default-value and appearance semantics; the atomic writeback performs resets before applying the final script delta. Delta comparison uses the reset baseline, so a later script assignment restoring the original pre-reset value is preserved. Doc Open and the first button/console event share this ordering, including after JavaScript is disabled and re-enabled. PDF Undo/Redo and save/reopen preserve the final values.
+
+The reset comparison baseline is obtained by running the existing forms reset path on an isolated document copy. It therefore includes unnamed built-in Calculate text/combo dependents, without executing custom Calculate scripts during the preview. Normal automatic calculation after script value writes remains in force; this does not establish a policy that explicit formula-field writes override their formulas. Tests cover saved defaults left untouched by the event and a non-default typed native response as well as existing default/cancellation paths.
+
+Reset writeback is admitted before request copies, preview cloning and PDF mutation only when it fits 64 reset calls, 4,096 aggregate selectors, and 2^24 estimated work units. Named resets pay for the bounded selector scan and the fields actually matched. The estimate charges both preview/commit passes, field/calculation/dependency scans, calculation source lengths and selector scans/bytes. Excess work returns an explicit error without committing PDF edits or an undo entry. Under-budget requests retain their order; duplicate resets are not silently merged because repeated recalculation can be observable. This is an operation/amplification bound, not a hard UI wall-clock deadline. Native start/completion tests cover the 64-call boundary, 65/10,000-call refusal, selector overflow, aggregate large-form refusal, reset/restore, Undo/Redo and save/reopen.
+
+The reset admission estimate also charges field-name copies, selector comparison bytes, and the worst-case expansion of each named reset to all fields (including both validation and membership scans). This conservative bound can refuse a named reset even if its eventual selection would be small; full-form resets avoid that named-selection cost. Refusal tests compare saved bytes as well as generation and undo state.
+
+Reset admission includes the total widget count for preview and commit. The shared JavaScript string-array converter also enforces a 32 MiB aggregate escaped UTF-8 text budget before copying beyond it (including scalar input), independently of later request clipping. Exact Unicode and unpaired-surrogate output bytes are charged; the existing array-item limit remains. JavaScript ToString/getters may still execute script code before conversion; this is not a general JavaScript heap limit.
+
+Unknown PDF defaults (failed stream decoding or a spent shared value budget) are marked in the JavaScript snapshot. A reset preserves their live values, matching the forms reset policy; explicit assignments before/after reset remain effective. The policy follows inherited defaults too. Menu and response properties now use the bounded escaped UTF-8 conversion at 4096 bytes per property before copying past that limit; user conversion exceptions are preserved. Existing item/depth/prompt/reply limits remain separate. Immediate dependent reads can use resetForm(...); calculateNow(); the reset callback timing itself has not been changed without an Acrobat parity oracle.
+
+The 64-reset call budget is now enforced in the worker before argument conversion and field scanning, shared by document initialization and its first event, and reset for later jobs. A sticky outcome flag rejects PDF writeback even if JavaScript catches the exception. The existing engine admission/work guard remains. Calculations are resolved by PDF object reference to the matching snapshot position; event targets and duplicate-name value and property deltas retain object identity through the host, authoring helpers and redraw. Public getField(name) retains first-match behavior. Tests cover both calculation orders, target reads/writes, native/console completion, Undo/Redo and save/reopen.
+
+AFSimple_Calculate expands exact/group/duplicate field matches without materializing their cross-product; numeric conversion and empty-result fallbacks remain unchanged. Selector comparison work is admitted up to 2^24 estimated units. The Field cache uses canonical PDF identities (name-only keys for synthetic callers), prunes removed fields between jobs and covers every exposed field, including more than 4096; renames preserve retained references/custom properties. Script color changes detach outside widgets that share the target group's indirect MK, including bounded reference aliases, while keeping target widgets' indirect object and unrelated MK entries. Native button clicks carry exact identities through hit testing, action dispatch and event construction. Legacy name-only engine/UI entry points remain wrappers. Headless form_fields returns field_id; js_run accepts that optional 48-bit identity with a matching field name, validates it before execution, and retains deterministic prompt replies. IDs are document-local and must be rediscovered after structural changes.
+
+Field instance tokens live outside PDF undo snapshots. Successful edits and undo/redo retire
+removed field instances immediately, even when no script job observes the gap. Reusing the
+same PDF object number does not revive an old Field accessor; document globals survive history.
+A refused synchronous/native writeback invalidates its document realm before returning an error.
+The host-backed event accessor remains usable when globalThis is frozen. AFSimple_Calculate
+shares a 2^24 selector-work budget across all calculation sources in an event job; later jobs
+receive a fresh budget. Native simple calculations include every selected list export value,
+and calculateNow uses the regular value setter's checkbox/radio normalization.
+
+Native UI feedback distinguishes a refused busy click, a stale interaction and a timeout.
+Timeouts report discarded results without claiming worker termination. Visible comparison halves
+may complete; switching away, changing the view or editing still invalidates stale interactions.
+Focus reveals a laid-out widget's page, and image import carries exact clicked identity through
+the picker and SetFieldImageTarget. The headless form_set_image tool accepts the same optional
+field_id and validates exact name/identity pairs; omitted IDs preserve legacy lookup. Mixed widget icons emit field-wide changes only when an
+icon setter runs. UI waiting helpers use elapsed deadlines rather than machine-speed retry counts.
+
+Comparison script document requests use their source view. Save As captures the source document without changing the comparison tab. Print activates and retains the source tab because the existing print dialog reads the active document throughout its lifetime. Missing source views never fall back to another active document. Regression coverage distinguishes a two-page source from a one-page comparison file and checks saved bytes, print-dialog page state and untouched comparison content.
+
+Explicit calculation logs ordinary field script errors and continues in calculation order. Each job can evaluate at most 4,096 calculation scripts, including nested calls and document initialization on the first event. Exhaustion remains in effect after a JavaScript catch and prevents PDF writeback.
diff --git a/docs/file-format-parity.md b/docs/file-format-parity.md
index 288b7ca0cf..eb38bc65cf 100644
--- a/docs/file-format-parity.md
+++ b/docs/file-format-parity.md
@@ -1,6 +1,6 @@
 # File format parity
 
-> **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-19 · **Change:** patch (`.p7b`/`.p7c` bundles read for trust import) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-22 · **Change:** minor (Word, Excel, PowerPoint, OpenDocument and RTF open through an installed LibreOffice; `.p7b`/`.p7c` bundles read for trust import) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 
 Every format Acrobat Pro reads or writes, and PdfCraft's support for it. Acrobat's list comes from
 its bundle's `Info.plist` `CFBundleDocumentTypes` (what it opens) and its public documentation
@@ -68,9 +68,9 @@ features total).
 | Plain text | yes | yes | good | `create.from-text` |
 | Clipboard (image or text) | yes | yes | good | `create.from-clipboard` |
 | Screenshot | yes | no | none | `create.from-screenshot` planned |
-| Word, Excel, PowerPoint (and Visio, Publisher on Windows) | yes | no | none | `create.from-office` planned (LibreOffice sidecar) |
+| Word, Excel, PowerPoint (and Visio, Publisher on Windows) | yes | yes, desktop only, through an installed LibreOffice (File ▸ Open); not Visio or Publisher | good where LibreOffice is (its layout, not measured against Acrobat) | `create.from-office` partial |
 | HTML file, web page URL | yes | no | none | `create.from-html`, `create.from-web-page` planned |
-| RTF | yes | no | none | |
+| RTF | yes | yes, through LibreOffice (as Office documents) | good where LibreOffice is | `create.from-office` partial |
 | PostScript / EPS (Distiller) | yes | no | none | `create.distiller` planned (P3) |
 | Markdown | no | no | none | `create.from-markdown` planned (P2; not an Acrobat feature) |
 | Scanner | yes | no | none | `ocr.scanner-acquire` planned |
@@ -110,6 +110,7 @@ features total).
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-22 | minor | Office documents (Word, Excel, PowerPoint, OpenDocument, RTF) open from File ▸ Open as new PDFs, converted by an installed LibreOffice; `create.from-office` partial. |
 | 2026-10-19 | patch | Certificates row: `.p7b`/`.p7c` bundles (DER or PEM `PKCS7`/`CMS`) are read for trust import. |
 | 2026-10-12 | minor | XDP split into data (read and write for XFA forms, already shipped under `form.xfa-data`) and opening `.xdp` as a document (none). Create PDF reads BigTIFF; malformed GIF headers are no longer detected as images. |
 | 2026-10-11 | minor | #773: inferred tables have no invented borders; rotated or overlapping invoice pages use floating shapes and page sections. Full Office layout fidelity remains partial. |
diff --git a/docs/gaps.md b/docs/gaps.md
index 8d472eb2d5..1a1c04a9da 100644
--- a/docs/gaps.md
+++ b/docs/gaps.md
@@ -1,5 +1,6 @@
 # Where PdfCraft falls short of Acrobat Pro
 
+> **Last reviewed:** 2026-11-11 | **Last updated:** 2026-11-11 | **Change:** minor (gap 8: known residual risk for the LibreOffice sidecar, sandbox tracked in #6953; estimates unchanged)
 > **Last reviewed:** 2026-10-28 | **Last updated:** 2026-10-28 | **Change:** minor (M10, #4119 partial: Enhance scanned file cleans scanned pages in place: background removal, edge shadow removal, despeckle; estimates unchanged)
 > **Last reviewed:** 2026-10-25 · **Last updated:** 2026-10-25 · **Change:** minor (gaps 5 and 14 current state: native release Hans face via LXGW WenKai Lite; Arabic logical catalog, explicit RTL direction and mirrored stock chrome, with native/browser/IME workflows unqualified; no readiness re-estimate)
 > **Last reviewed:** 2026-10-15 · **Last updated:** 2026-10-15 · **Change:** minor (gap 3: #2517 a blank line stays a paragraph break; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
@@ -45,7 +46,7 @@ update the numbers.
 | 5 | Chinese UI lacks a web glyph face | localization | 6–12 | [localization-parity.md](localization-parity.md) |
 | 6 | Open-issue backlog of wrong results in shipped features | stability | 45–80 | this file |
 | 7 | OCR reads only unaccented Latin | feature | 40–75 | [file-format-parity.md](file-format-parity.md) |
-| 8 | Office export weak, Office import absent | file format | 55–100 | [file-format-parity.md](file-format-parity.md) |
+| 8 | Office export weak, Office import basic | file format | 55–100 | [file-format-parity.md](file-format-parity.md) |
 | 9 | No Preflight; PDF/A partial; PDF/X and PDF/UA absent | standards | 65–115 | [pdf-spec-parity.md](pdf-spec-parity.md) |
 | 10 | Signatures: no PKCS #11, timestamp servers or online revocation | feature, hardware | 40–70 | [pdf-spec-parity.md](pdf-spec-parity.md) |
 | 11 | Accessibility: checker only, no tagging tools | feature | 40–70 | [target-app-parity.md](target-app-parity.md) |
@@ -189,19 +190,29 @@ update the numbers.
 - **Estimate:** 40–75 h, partly blocked on openly licensed models. **Doc:**
   [file-format-parity.md](file-format-parity.md).
 
-### 8. Office export weak, Office import absent
+### 8. Office export weak, Office import basic
 
-- **Missing:** Word export that keeps layout; Excel and PowerPoint export; creating PDFs from Office,
-  HTML, web pages and PostScript; SVG/XML/EPS/PS/JPEG 2000 export.
+- **Missing:** Word export that keeps layout; Excel and PowerPoint export; creating PDFs from HTML,
+  web pages and PostScript; SVG/XML/EPS/PS/JPEG 2000 export. Office documents open from File ▸ Open
+  through an installed LibreOffice, but Insert pages, Combine files and Create ▸ Multiple files
+  don't take them yet.
 - **Evidence:** `create.export-docx` partial; the synthetic invoice regression for
   [#773](https://github.com/storytold/pdfcraft/issues/773) now covers absent inferred borders,
   floating watermark text and per-page section sizes. Exact font matching, vector rules and
   broader layout fidelity remain incomplete;
-  `create.export-xlsx`, `create.export-pptx`, `create.from-office`, `create.from-html` planned.
+  `create.from-office` partial (LibreOffice sidecar; Writer and Calc never update linked content,
+  but Impress has no such setting and the process's network access isn't sandboxed);
+  `create.export-xlsx`, `create.export-pptx`,
+  `create.from-html` planned.
+- **Known residual risk:** conversion runs the user's installed LibreOffice. PdfCraft
+  opens no connection itself. Macros are disabled, untrusted referer links are blocked,
+  and Writer and Calc never update links. Impress has no link-update setting, and the
+  `soffice` process isn't network-sandboxed, so linked content in presentations could be
+  fetched. Sandboxing the converter is [#6953](https://github.com/storytold/pdfcraft/issues/6953).
 - **Impact:** "Export PDF" and "Create PDF" are two of Acrobat's most used tools.
 - **Gate:** lossy or missing sub-cases of the convert-and-share workflow (partial, not blocking).
-  First beta items: Create PDF from Office (LibreOffice sidecar, 10–20 h) and a Word export that
-  keeps layout (20–35 h).
+  First beta items: the rest of Create PDF from Office (Insert, Combine and Create ▸ Multiple files
+  on a worker, a Create ▸ From Office command; 5–10 h) and a Word export that keeps layout (20–35 h).
 - **Estimate:** 55–100 h. **Doc:** [file-format-parity.md](file-format-parity.md).
 
 ### 9. No Preflight; PDF/A partial; PDF/X and PDF/UA absent
@@ -422,6 +433,8 @@ update the numbers.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-11-11 | minor | Gap 8: known residual risk for the LibreOffice sidecar (Impress has no link-update setting; the soffice process isn't network-sandboxed). Sandboxing tracked in #6953. Estimates unchanged. |
+| 2026-10-26 | minor | Gap 8: the LibreOffice profile never updates Writer or Calc linked content on load; Impress has no such setting and the process's network access isn't sandboxed. Estimates unchanged. |
 | 2026-10-25 | minor | Gaps 5 and 14 current state: native release builds embed LXGW WenKai Lite for Simplified Chinese, while the web build has no Hans face; Arabic catalogs stay logical with explicit RTL label direction and mirrored stock chrome, while native/browser RTL input, IME and complex workflows remain unqualified. Estimates unchanged. |
 | 2026-10-18 | minor | Gap 3: #2517 a partial rewrite keeps a kept source row in the paragraph and leaves the next marked region closed around its text. Estimates unchanged. |
 | 2026-10-15 | minor | Gap 3: #2517 a blank line at ordinary leading stays a paragraph break. Estimates unchanged. |
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 987d5bd1b0..9b0b288fa0 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -1,3 +1,8 @@
+- 2026-11-04 (M6, PR #5699 group/cache/MK/button review): Expand calculation groups/duplicates with streaming bounded lookup; retain one canonical Field object per exposed identity and prune stale roots. Protect outside shared-MK owners and carry exact button IDs through native clicks and js_run, with regression and persistence coverage.
+- 2026-11-04 (M6, PR #5699 early reset/duplicate identities): Enforce the shared 64-call reset budget before argument conversion/scanning, with sticky atomic rejection and Open/event budget sharing. Preserve PDF object identity in Calculate order, live targets and value writeback; regress duplicate names, reversed order, native completion and persistence.
+- 2026-11-04 (M6, PR #5699 independent review): Preserve unknown defaults through the JS reset shadow; bound menu/response text before copies. Cover native/console reset persistence, inherited defaults, decode-budget exhaustion and exact Unicode dialog boundaries.
+- 2026-11-04 (M6, PR #5699 memory/widget bounds): Count reset widgets and bound escaped UTF-8 text conversion before copies; add negative and Unicode boundary regressions.
+- 2026-11-04 (M6, PR #5699 reset estimate): Charge expanded-name scans and field-name copy/comparison bytes; add three negative regressions and byte-exact refusal checks.
 # PdfCraft roadmap: milestones and what's next
 
 > **Last reviewed:** 2026-10-27 | **Last updated:** 2026-10-27 | **Change:** minor (M10: vector printing preserves annotation optional-content membership; estimates unchanged)
@@ -12,19 +17,28 @@
 > **Last reviewed:** 2026-11-09 | **Last updated:** 2026-11-09 | **Change:** patch (M10 #5130: preserve manual duplex defaults; validate DocumentDuplex review fix and CI formatting; estimates unchanged)
 >
 > **Last reviewed:** 2026-11-07 | **Last updated:** 2026-11-07 | **Change:** patch (M7 #2964 / #3185: grouped source text and Thai font/style preservation, with reported deep or unsafe groups and a per-glyph check of the Thai map repair; estimates unchanged)
+> **2026-11-04 (M6, PR #5699 reset budget):** Reject reset amplification before request copies, preview and PDF mutation; cap reset/selector counts and aggregate estimated work. Add native completion, boundary, flood and large-form regressions; preserve ordered under-budget resets.
+> **2026-11-04 (M6, PR #5699 dependent reset):** Reuse form reset on an isolated comparison document so unnamed built-in calculated text/combo fields are included; retain normal post-write calculation. Extend persisted-default and typed-response regressions.
+> **2026-11-04 (M6, PR #5699 reset ordering):** Reset live field values synchronously, commit resets before final script deltas using a reset baseline, and cover Doc Open reinitialization, save/reopen, Undo/Redo and replay-sensitive UI counters.
+> **2026-11-04 (M6, PR #5699 review):** Bound worker capacity and synchronous deadlines, isolate expired/pending realms before edits, keep script prompts above other dialogs, and cover block ASI, control-position regex literals, event routing and complete undo state. Validation is reported in the PR; parity remains partial.
+> **2026-11-03 (M6, PR #5699 follow-up):** Accept independent top-level statements separated by automatic semicolon insertion while retaining continuation-chain limits; assert cyclic calculation results and preserve upstream multiline Fill & Sign coverage.
 
 > **Last reviewed:** 2026-11-05 | **Last updated:** 2026-11-05 | **Change:** minor (M3, #5452: native Recent rows gain Reveal in Finder / File Explorer; estimates unchanged)
 
 > **Last reviewed:** 2026-10-28 | **Last updated:** 2026-10-28 | **Change:** minor (M10, #4119 partial: Enhance scanned file cleans scanned pages in place: background removal, edge shadow removal, despeckle; estimates unchanged)
 > **Last reviewed:** 2026-11-03 | **Last updated:** 2026-11-03 | **Change:** patch (M5 #5850 review: indirect typewriter intent and composer edits preserve outer whitespace; movement regression commits by outside click; estimates unchanged)
 
+
 > **Last reviewed:** 2026-11-03 | **Last updated:** 2026-11-03 | **Change:** patch (M5 #5850: Enter adds Fill & Sign line breaks; outside clicks commit, Escape cancels, and saved multiline appearances retain their text and height; estimates unchanged)
 
 > **2026-11-03, M7 / #5835 review:** active image crops retain secondary clicks over overlapping images; crop controls share measured layout with hit detection. Rotation, handle and page-edge regressions added; focused tests, scoped Clippy, formatting, layering and asset checks passed locally. Estimates unchanged.
 > **Last reviewed:** 2026-10-31 | **Last updated:** 2026-10-31 | **Change:** minor (M3/M4, #5330: Crop pages is directly available in the document quick toolbar; estimates unchanged)
 
 
+> **2026-11-02 (M6, PR #5699 second review):** Count active expression chains instead of whole-source tokens; align native button events and automation schemas, block document input under script prompts, and validate prompt dismissal and idle repaint scheduling.
 > **Last reviewed:** 2026-11-01 | **Last updated:** 2026-11-01 | **Change:** patch (M7 #5657: header/footer, watermark and background operations commit all selected pages together; later-page errors preserve marks, content, shared/inherited resources and pending edits; estimates unchanged)
+> **2026-11-02 (M6, PR #5699 review):** Cache per-edit script geometry/calculation plans, expose live document metadata, and bound persistent worker stacks to 64 MiB; add operation-count, lifecycle and isolated hostile-input/address-space regressions.
+> **2026-11-02 (M6, #5211/#269):** Integrate persistent native AcroForm realms, synchronous calculation, page boxes, appearance/geometry/icon writeback and native button prompt continuation. Synthetic workflow and cancellation tests added; validation details accompany the PR. Remaining JavaScript parity stays partial.
 
 > **Last reviewed:** 2026-11-01 | **Last updated:** 2026-11-01 | **Change:** patch (M7, PR #2155 further review: inherited drawing/text state, affine image gestures, paste/selection ownership, no-op scripts and menu permissions; estimates unchanged)
 
@@ -33,6 +47,8 @@
 > **Last reviewed:** 2026-11-01 | **Last updated:** 2026-11-01 | **Change:** patch (M7, PR #2155 review follow-up: preserve image crop/tag/stream ownership, resize in page orientation, harden clipboard and text formatting, and reload installed fonts; estimates unchanged)
 > **Last reviewed:** 2026-10-31 | **Last updated:** 2026-10-31 | **Change:** patch (M2, PR #4172: GBK rasters compared with explicit Unicode and independently selected installed faces; wrong-glyph and wrong-family negative controls fail; estimates unchanged)
 > **Last reviewed:** 2026-10-31 | **Last updated:** 2026-10-31 | **Change:** patch (M2, PR #4172: integrate main fa5f9f8c; retain CJK viewer and upstream raster regressions, restore explicit display_config imports; estimates unchanged)
+> **Last reviewed:** 2026-10-30 | **Last updated:** 2026-10-30 | **Change:** minor (M6: scripts can read and change a push-button's normal caption with undo/redo and save/reopen coverage; estimates unchanged)
+
 > **Last reviewed:** 2026-10-28 · **Last updated:** 2026-10-28 · **Change:** patch (M2, PR #4172: integrate main 5af10276; retain both roadmap histories and viewer-only CJK font policy; estimates unchanged)
 > **Last reviewed:** 2026-10-27 · **Last updated:** 2026-10-27 · **Change:** patch (M2, PR #4172: integrate main 1dd2737b; preserve viewer-only CJK fallback and regression coverage across engine, renderer and Combine module splits; estimates unchanged)
 > **Last reviewed:** 2026-10-27 · **Last updated:** 2026-10-27 · **Change:** patch (M2, PR #4172: integrate main 9a9813bf and migrate viewer-only CJK configuration to the split engine modules; estimates unchanged)
@@ -273,7 +289,7 @@ total matches the parity estimate.
 | M11 | Optimize, preflight, PDF/A/X/UA, print production | 200–350 | 18% | 80–140 | Done: new `optimize` crate: Reduce File Size and the PDF Optimizer (images measured where drawn, bicubic downsampling, JPEG/ZIP recompression only when smaller, discard objects and user data, Flate clean-up, resource merging, object streams). Target-version compatibility is partial: newer content is not detected or converted. Content stream boundaries preserve comments, split operands and graphics state when image fragments merge. Image downsampling includes page-local `/UserUnit` scaling when measuring physical resolution. Done since: reject invalid image and soft-mask dimensions with checked sizing (#2178). Missing: fonts and transparency panels, space audit, preflight, PDF/A/X/UA |
 | M8 | Security + redaction | 100–180 | 68% | 15–30 | Done: opening protected documents, permissions, Protect Using Password, Remove security; redaction (mark text/areas/pages, Search & Redact with patterns, apply removing glyphs, image pixels, vectors, XObject content, annotations and fields, verification, full rewrite on save); Remove hidden information and Sanitize.<br>Done since: redaction codes (U.S. FOIA and Privacy Act sets as overlay text, in Redaction properties and `redact_mark`). Redaction cleans indirect and form structure references, preserving surviving form tags. Redaction retires inherited resource dictionaries, so a parent `/Pages` can't keep a removed XObject reachable; unredacted pages are left untouched. Image redaction removes alternate images and unsupported masks only on affected images. Changed marked-content spans lose replacement descriptions; untouched spans keep theirs. Hidden-text cleanup retires unused named descriptions across inherited/shared page and form resources (64 focused tests and scoped Rust 1.96 Clippy/wasm checks pass; publication CI pending). Retained text/image-bearing or unreadable tiling-pattern cells now make Apply refuse atomically after a bounded check of rewritten resources; fully removed cells still apply, and cross-page retention is checked. The redaction audit counts a filled cover that hides half of any one word of a long line (#2662), applied or not. Phone-pattern redaction also matches labelled Italian geographic numbers with `+39` and a slash after the area code (#3205 follow-up); unlabelled international slash numbers remain unsupported. Missing: certificate security, custom redaction code sets and pattern locales, DCT re-encoding |
 | M9 | Signatures (PAdES, validation) | 160–280 | 60% | 40–70 | Done: new `sign` crate (DER, X.509, CMS, PKCS #12 on RustCrypto; aws-lc-rs for RSA private keys); PAdES B-B signing (visible, invisible, existing fields, certification with DocMDP); validation with trust store and changes-after-signing classification; self-signed digital IDs; Signatures panel, message bar, sign dialogs; agent tools. Checked with pdfsig and OpenSSL.<br>Done since: macOS Keychain and Windows Current User Personal store signing (software-backed CNG keys), certificate viewer, signed documents protected from rewrites, page validation overlays separate from original signature artwork, placed in the widget's bottom-right corner as it lies on the page, at a quarter of its shorter side and 48 screen points at most, so they annotate the artwork from a corner instead of covering the middle of it and turn with the page and the view (a field falling under 32 screen points, as a page does when zoomed out to fit, keeps its outline), snapshot tabs that reuse instead of multiplying, named-layer signature appearances redrawn for their real state (#79; display, the CLI's render, exports and printing, never saves; captions in the interface language, Chinese in English; the badge stays). Missing: timestamps (B-T), LTV (DSS, OCSP, CRL), FieldMDP, smart cards, PKCS #11 |
-| M10 | OCR, create, export, print | 200–350 | 33% | 120–215 | Done: Windows Printer default sends native two-sided bindings only when automatic duplex support is confirmed, preserving manual driver defaults (#5130/#5772); physical output remains unqualified. DocumentDuplex-only bindings use the supported scope through craft-print 9fe50c94. create from blank/text/PNG/JPEG/TIFF (multi-page)/GIF/BMP; export PNG/JPEG/TIFF and text; Print (Acrobat's sizing, n-up, booklet, poster, comments & forms, preview, the CUPS and Windows spoolers, print-ready PDF).<br>Done since: embedded/72/custom DPI choices for image imports; export all images; OCR (searchable image for pages, ranges and multiple files); single-sided cut-and-stack imposition with cut marks, through Print and doc_print; architectural/ANSI/large ISO sheet presets, Match page at 100% and PDF-scale preview (#599 follow-up); Create PDF from multiple files (PDFs, images and text, edited as pages in the grid); OCR can also read pictures on pages that have text, without adding that text twice (#1028). Model staging fetches SHA-256-verified ONNX detection/recognition files after the upstream RTEN URL brownout; runtime discovery prefers complete ONNX pairs per directory, then complete legacy RTEN pairs, without mixing formats or changing directory precedence. Done since: Word invoice export uses borderless inferred tables, floating positioned text/artwork only where text overlaps an image or is rotated, and per-page sizes, covered by synthetic invoice automation regressions (#773); printing on the web through the browser's print dialog, sheets drawn by PdfCraft (gap 4). Lossless image export applies per-component Decode, including Indexed mapping (#1201 partial). Existing 16-bit precision and color-management limits remain. #3532 partial: vector printing retains existing appearances with absent Subtype through a print-owned Form copy; source artwork stays unchanged. #3120: Office export reads form XObjects 50 levels deep, as the renderer does, and up to 50 000 a page; pages past that are listed in `truncated_pages`. Word table cells use the grid columns they span, including cells after a merged cell. Done since: text in a table slot covered by another cell's span remains as paragraph text in Word, HTML, RTF and PowerPoint. Web OCR downloads its models on first use and reads in Web Workers with SIMD (`ocr.ocr-web`, shipped). Missing: OCR languages beyond Latin, web OCR near native speed, editable-text OCR output, full Office layout fidelity/import. Done since: dotted-leader contents entries stay in separate complete paragraphs (#1757) #2156 candidate: last selected print paper persists across sessions; other print preferences unchanged. Image export applies soft-mask Decode opacity intervals before resizing, including indirect entries and inverted ranges. Vector printing gives annotation appearances unoccupied XObject names so existing page artwork survives. Done since: Enhance scanned file cleans scanned pages in place (background removal, edge shadow removal, despeckle; the OCR text layer and comments stay; #4119 partial). |
+| M10 | OCR, create, export, print | 200–350 | 33% | 120–215 | Done: Windows Printer default sends native two-sided bindings only when automatic duplex support is confirmed, preserving manual driver defaults (#5130/#5772); physical output remains unqualified. DocumentDuplex-only bindings use the supported scope through craft-print 9fe50c94. create from blank/text/PNG/JPEG/TIFF (multi-page)/GIF/BMP; export PNG/JPEG/TIFF and text; Print (Acrobat's sizing, n-up, booklet, poster, comments & forms, preview, the CUPS and Windows spoolers, print-ready PDF).<br>Done since: Word, Excel, PowerPoint, OpenDocument and RTF files open from File ▸ Open as new PDFs through an installed LibreOffice (`create.from-office` partial); embedded/72/custom DPI choices for image imports; export all images; OCR (searchable image for pages, ranges and multiple files); single-sided cut-and-stack imposition with cut marks, through Print and doc_print; architectural/ANSI/large ISO sheet presets, Match page at 100% and PDF-scale preview (#599 follow-up); Create PDF from multiple files (PDFs, images and text, edited as pages in the grid); OCR can also read pictures on pages that have text, without adding that text twice (#1028). Model staging fetches SHA-256-verified ONNX detection/recognition files after the upstream RTEN URL brownout; runtime discovery prefers complete ONNX pairs per directory, then complete legacy RTEN pairs, without mixing formats or changing directory precedence. Done since: Word invoice export uses borderless inferred tables, floating positioned text/artwork only where text overlaps an image or is rotated, and per-page sizes, covered by synthetic invoice automation regressions (#773); printing on the web through the browser's print dialog, sheets drawn by PdfCraft (gap 4). Lossless image export applies per-component Decode, including Indexed mapping (#1201 partial). Existing 16-bit precision and color-management limits remain. #3532 partial: vector printing retains existing appearances with absent Subtype through a print-owned Form copy; source artwork stays unchanged. #3120: Office export reads form XObjects 50 levels deep, as the renderer does, and up to 50 000 a page; pages past that are listed in `truncated_pages`. Word table cells use the grid columns they span, including cells after a merged cell. Done since: text in a table slot covered by another cell's span remains as paragraph text in Word, HTML, RTF and PowerPoint. Web OCR downloads its models on first use and reads in Web Workers with SIMD (`ocr.ocr-web`, shipped). Missing: OCR languages beyond Latin, web OCR near native speed, editable-text OCR output, full Office layout fidelity/import. Done since: dotted-leader contents entries stay in separate complete paragraphs (#1757) #2156 candidate: last selected print paper persists across sessions; other print preferences unchanged. Image export applies soft-mask Decode opacity intervals before resizing, including indirect entries and inverted ranges. Vector printing gives annotation appearances unoccupied XObject names so existing page artwork survives. Done since: Enhance scanned file cleans scanned pages in place (background removal, edge shadow removal, despeckle; the OCR text layer and comments stay; #4119 partial). |
 | M11 | Optimize, preflight, PDF/A/X/UA, print production | 200–350 | 18% | 80–140 | Done: new `optimize` crate: Reduce File Size and the PDF Optimizer (images measured where drawn, bicubic downsampling, JPEG/ZIP recompression only when smaller, discard objects and user data, Flate clean-up, resource merging, object streams). Target-version compatibility is partial: newer content is not detected or converted. Content stream boundaries preserve comments, split operands and graphics state when image fragments merge. Image downsampling includes page-local `/UserUnit` scaling when measuring physical resolution. Done since: reject invalid image and soft-mask dimensions with checked sizing (#2178); black-and-white images stored losslessly as CCITT Group 4 when smaller, averaged down to 300 ppi above 450 (halftones aside), Group 3 stored again as Group 4, and black-and-white RGB and indexed images that use only palette entries 0 and 1 packed to one bit. Missing: fonts and transparency panels, space audit, preflight, PDF/A/X/UA |
 | M8 | Security + redaction | 100–180 | 68% | 15–30 | Done: opening protected documents, permissions, Protect Using Password, Remove security; redaction (mark text/areas/pages, Search & Redact with patterns, apply removing glyphs, image pixels, vectors, XObject content, annotations and fields, verification, full rewrite on save); Remove hidden information and Sanitize.<br>Done since: redaction codes (U.S. FOIA and Privacy Act sets as overlay text, in Redaction properties and `redact_mark`). Redaction cleans indirect and form structure references, preserving surviving form tags. Redaction retires inherited resource dictionaries, so a parent `/Pages` can't keep a removed XObject reachable; unredacted pages are left untouched. Image redaction removes alternate images and unsupported masks only on affected images. Changed marked-content spans lose replacement descriptions; untouched spans keep theirs. Hidden-text cleanup retires unused named descriptions across inherited/shared page and form resources (64 focused tests and scoped Rust 1.96 Clippy/wasm checks pass; publication CI pending). The redaction audit counts a filled cover that hides half of any one word of a long line (#2662), applied or not. Phone-pattern redaction also matches labelled Italian geographic numbers with `+39` and a slash after the area code (#3205 follow-up); unlabelled international slash numbers remain unsupported. Missing: certificate security, custom redaction code sets and pattern locales, DCT re-encoding |
 | M9 | Signatures (PAdES, validation) | 160–280 | 60% | 40–70 | Done: new `sign` crate (DER, X.509, CMS, PKCS #12 on RustCrypto; aws-lc-rs for RSA private keys); PAdES B-B signing (visible, invisible, existing fields, certification with DocMDP); validation with trust store and changes-after-signing classification; self-signed digital IDs; Signatures panel, message bar, sign dialogs; agent tools. Checked with pdfsig and OpenSSL.<br>Done since: macOS Keychain and Windows Current User Personal store signing (software-backed CNG keys), certificate viewer, signed documents protected from rewrites, page validation overlays separate from original signature artwork (baked Not Verified captions remain; #79 open), snapshot tabs that reuse instead of multiplying. Missing: timestamps (B-T), LTV (DSS, OCSP, CRL), FieldMDP, smart cards, PKCS #11 |
@@ -506,3 +522,5 @@ Estimates unchanged.
 ## Pages sidebar keyboard refresh (2026-10-30)
 
 PR #2133 retains document-local Pages sidebar focus for Ctrl/Cmd+A and Escape after the UI module split. The selection does not navigate. The focused regression is in `crates/ui-egui/tests/it/view.rs`; current-head hosted validation is pending. Feature counts and estimates are unchanged.
+
+- 2026-11-04: AcroForm review follow-up covers field-instance retirement across history, rejected-writeback realm invalidation, mixed widget icons, shared calculation budgets and multi-select/checkbox consistency, frozen-global events, exact image imports, comparison-half scripts, focus reveal and explicit busy/timeout feedback. Synthetic regressions and elapsed UI deadlines accompany the fixes.
diff --git a/docs/target-app-parity.md b/docs/target-app-parity.md
index 126496547d..2d219b096a 100644
--- a/docs/target-app-parity.md
+++ b/docs/target-app-parity.md
@@ -212,7 +212,7 @@ full parity in that area.
 | G Protect, redact, sanitize | 41 | 23 | 2 | 58.5% | 55% | 15–30 | Passwords and permissions, Remove security, redaction that removes glyphs, pixels, vectors, annotations and tags, with verification; word lists, patterns, FOIA/Privacy Act codes; sanitize. Missing: certificate security, pattern locales, custom code sets, partial-word redaction, folder redaction, protected view |
 | H Digital signatures | 45 | 23 | 10 | 62.2% | 45% | 40–70 | PAdES B-B signing and validation (PKCS #12, macOS Keychain, Windows store with PIN prompts), certification, encrypted documents, certificate usage checks; B-T, LTV, OCSP/CRL with caller-supplied evidence. Missing: PKCS #11 and smart cards outside Windows, timestamp-server preferences, online revocation fetching, FieldMDP and field locking, OS trust store, EU Trusted Lists, compare signed version |
 | I Scan and OCR | 26 | 5 | 2 | 23.1% | 15% | 40–75 | Searchable image (ocrs, Latin script without accents) on pages, ranges and many files. Missing: every other language (#744 Dutch; accents, CJK, Cyrillic, Arabic), editable-text output, deskew, rotation, camera images beyond straightening (found or placed corners): orientation, clean-up, MRC compression, scanners. Background removal, edge shadow removal and despeckle work on scanned pages (Enhance scanned file) but not yet as options of Recognize text, nor on CMYK, indexed, JBIG2 or CCITT scans |
-| J Create and export | 34 | 12 | 3 | 39.7% | 25% | 55–100 | Create from images, multipage TIFF, text, clipboard, blank, many files at once; export PNG/JPEG/TIFF, text, RTF; Word and HTML partial. Missing: Office/HTML/web/PostScript to PDF, Excel and PowerPoint export, Word layout fidelity (#773), SVG/XML/EPS/PS/JPEG 2000 export, accessible text |
+| J Create and export | 34 | 12 | 3 | 39.7% | 25% | 55–100 | Create from images, multipage TIFF, text, clipboard, blank, many files at once; export PNG/JPEG/TIFF, text, RTF; Word and HTML partial. Office documents open through an installed LibreOffice (File ▸ Open only). Missing: HTML/web/PostScript to PDF, Excel and PowerPoint export, Word layout fidelity (#773), SVG/XML/EPS/PS/JPEG 2000 export, accessible text |
 | K Optimize and standards | 58 | 15 | 11 | 35.3% | 20% | 65–115 | Reduce File Size and the Optimizer (images, CCITT and lossless JBIG2 monochrome compression, discards, clean-up, space audit); PDF/A-2b/3b verify and convert (partial). Missing: Preflight (profiles, fixups, reports), PDF/A-1/4 and a/u levels, PDF/X, PDF/UA, PDF/E, PDF/VT, transparency flattening, font unembedding, lossy/refinement JBIG2 |
 | L Print | 39 | 15 | 1 | 39.7% | 35% | 30–55 | Acrobat's sizing, n-up, booklet, poster, comments & forms, preview, print-ready PDF, CUPS on macOS/Linux, the Windows spooler (#756) and the browser's print dialog on the web. Missing: print as image, PostScript, all print-production tools (output preview, separations, ink manager, printer marks, colour conversion) |
 | M Accessibility | 61 | 38 | 1 | 63.1% | 30% | 40–70 | Accessibility Checker (all 32 rules, report, fixes), alternate text, title and language. Missing: autotag, Tags/Order/Content panels, Reading Order tool, artifact marking, table editor, Read Out Loud, full keyboard operation of the app, screen-reader audit |
diff --git a/packaging/freebsd/package.sh b/packaging/freebsd/package.sh
index 0533be9010..b81d33e565 100755
--- a/packaging/freebsd/package.sh
+++ b/packaging/freebsd/package.sh
@@ -43,7 +43,7 @@ esac
 # Only binaries for this machine run here (the --version check at the end); a FreeBSD target built
 # on another OS never does.
 HOST_ARCH="$(release_arch "$(uname -m)" 2>/dev/null)" || HOST_ARCH="$(uname -m)"
-if [ -n "${CARGO_BUILD_TARGET:-}" ] && [ "$(uname -s)" != FreeBSD ]; then
+if [[ -n "${CARGO_BUILD_TARGET:-}" ]] && [[ "$(uname -s)" != FreeBSD ]]; then
   HOST_ARCH="$(uname -s) $HOST_ARCH"
 fi
 BASENAME="pdfcraft-$VERSION-freebsd-$ARCH"
@@ -74,12 +74,12 @@ copy_docs "$STAGE/share/doc/pdfcraft"
 # which has to run here: build it for this machine, not for CARGO_BUILD_TARGET.
 (unset CARGO_BUILD_TARGET; stage_models "$STAGE/share/pdfcraft/models")
 
-if [ -z "${CARGO_BUILD_TARGET:-}" ] && [ "$ARCH" = "$HOST_ARCH" ]; then
+if [[ -z "${CARGO_BUILD_TARGET:-}" ]] && [[ "$ARCH" = "$HOST_ARCH" ]]; then
   "$STAGE/bin/pdfcraft" --version
 else
   # They cannot run here, so check what they are instead: executables, not libraries or objects.
   # An older file(1) calls a PIE a shared object; its interpreter still marks it as a program.
-  want="$ARCH"; [ "$ARCH" != x86_64 ] || want=x86-64
+  want="$ARCH"; [[ "$ARCH" != x86_64 ]] || want=x86-64
   for b in "$STAGE"/bin/*; do
     case "$(file -b "$b")" in
       ELF*" executable, "*"$want"*FreeBSD* | ELF*"$want"*FreeBSD*interpreter*) ;;
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index c3e2adff96..62693573c8 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -3047,7 +3047,7 @@ status = "shipped"
 commands = ["page.combine"]
 tools = ["doc_combine"]
 evidence = ["crates/organize/src/tests.rs::combine_concatenates_with_a_bookmark_per_file", "crates/ui-egui/tests/it/editing.rs::combining_files_opens_a_new_unsaved_tab", "crates/ui-egui/tests/it/ui.rs::files_to_combine_from_the_operating_system", "apps/pdfcraft/src/single_instance.rs::a_second_launch_hands_its_files_to_the_first", "crates/ui-egui/tests/it/editing.rs::combine_files_opens_in_its_own_tab", "crates/ui-egui/tests/it/editing.rs::combine_lists_size_and_warns_before_combining", "crates/ui-egui/tests/it/editing.rs::a_password_protected_file_is_unlocked_with_its_password_and_combined", "crates/ui-egui/tests/it/editing.rs::a_folder_adds_its_pdfs_images_and_text_in_order_and_optionally_its_subfolders", "crates/ui-egui/tests/it/editing.rs::images_and_text_files_join_the_combine_list_as_pdfs", "crates/ui-egui/tests/it/editing.rs::files_that_cannot_be_read_are_listed_and_left_out_once_the_user_agrees", "crates/ui-egui/tests/it/ui.rs::pdfs_dropped_on_the_combine_tab_join_its_list", "crates/ui-egui/tests/it/ui.rs::files_dropped_on_the_combine_tab_join_the_end_of_its_list_in_the_order_dropped", "crates/ui-egui/tests/it/ui.rs::a_file_combine_does_not_take_is_left_out_of_a_drop_and_named", "crates/ui-egui/tests/it/ui.rs::a_pdf_dropped_on_a_document_opens_while_the_combine_tab_waits_behind_it", "crates/automation/tests/it/automation.rs::combine_extract_and_split", "crates/automation/tests/it/automation.rs::combine_opens_protected_files_with_their_passwords", "crates/automation/tests/it/automation.rs::combine_takes_images_and_text_files", "crates/engine/src/tests.rs::files_for_combine_are_made_into_pdfs_and_pdfs_pass_through", "crates/organize/src/tests.rs::combine_keeps_pdfx_when_every_source_agrees", "crates/organize/src/tests.rs::combine_claims_no_pdfx_when_the_sources_disagree"]
-notes = "Combine files is its own tab: a table of the files (name, pages, size, modified, warnings) with column sorting, resizing and moving; files, folders (with subfolders) and open documents can be added, or dropped on the tab (desktop and web): a drop joins the end of the list in the order dropped, as one undo step, not at the place under the pointer; files of a kind Combine does not take are left out and named. Dropped elsewhere, files open as before. File Explorer's \"Combine files in PdfCraft\" and `pdfcraft --combine files…` add files from outside, to the running PdfCraft's tab (#585). Dropping adds no engine behaviour, so it has no tool of its own (doc_combine takes the files). Images (PNG, JPEG, TIFF, GIF, BMP, JPEG 2000) and .txt files become PDFs as they are added (#569; also in doc_combine). A file that can't be read stays in the list with why, and Combine asks before leaving it out; Office documents, HTML and other formats are not converted yet. Problems show before Combine (password, security settings that withhold page assembly, bad page ranges, duplicates); protected files are unlocked with their open or permissions password (also doc_combine passwords). The result is never encrypted, and is not yet offered for protection in the same step. A PDF/X result (output intent, GTS_PDFXVersion, Trapped, XMP pdfxid) only when every source declares the same version and output intent (#263). When they differ the result claims none, and nothing reports that yet; Acrobat behaviour not observed."
+notes = "Combine files is its own tab: a table of the files (name, pages, size, modified, warnings) with column sorting, resizing and moving; files, folders (with subfolders) and open documents can be added, or dropped on the tab (desktop and web): a drop joins the end of the list in the order dropped, as one undo step, not at the place under the pointer; files of a kind Combine does not take are left out and named. Dropped elsewhere, files open as before. File Explorer's \"Combine files in PdfCraft\" and `pdfcraft --combine files…` add files from outside, to the running PdfCraft's tab (#585). Dropping adds no engine behaviour, so it has no tool of its own (doc_combine takes the files). Images (PNG, JPEG, TIFF, GIF, BMP, JPEG 2000) and .txt files become PDFs as they are added (#569; also in doc_combine). A file that can't be read stays in the list with why, and Combine asks before leaving it out; Office documents, HTML and other formats are not converted yet. Problems show before Combine (password, security settings that withhold page extraction, bad page ranges, duplicates); protected files are unlocked with their open or permissions password (also doc_combine passwords). The result is never encrypted, and is not yet offered for protection in the same step. A PDF/X result (output intent, GTS_PDFXVersion, Trapped, XMP pdfxid) only when every source declares the same version and output intent (#263). When they differ the result claims none, and nothing reports that yet; Acrobat behaviour not observed."
 
 [[feature]]
 id = "organize.combine-bookmarks"
@@ -5340,7 +5340,7 @@ status = "shipped"
 commands = ["tools.document_js"]
 tools = ["js_document_scripts", "js_set_document_script"]
 evidence = ["crates/ui-egui/tests/it/javascript.rs::document_scripts_and_preferences", "crates/automation/tests/it/automation.rs::javascript_through_tools", "crates/engine/src/tests.rs::form_javascript_validates_calculates_and_formats", "crates/engine/src/tests.rs::a_document_script_that_throws_still_lets_the_form_calculate"]
-notes = "Names /JavaScript tree: list, add, edit, delete; functions are available to field scripts. A script that throws (calling an Acrobat method PdfCraft lacks, say) stops where it failed, but the others and the field scripts still run and the error is reported once (js_run's document_errors, the console) (#3940). Not like Acrobat: the scripts run again before every field script instead of once when the document opens, so what they do at top level repeats."
+notes = "Names /JavaScript tree: list, add, edit, delete; functions are available to field scripts. A script that throws (calling an Acrobat method PdfCraft lacks, say) stops where it failed, but the others and the field scripts still run and the error is reported once (js_run's document_errors, the console) (#3940). Native engine realms initialize document scripts once with Doc/Open and share state across field, button and console events. Source edits, reopen, Revert and JavaScript disable reset the realm. Stateless low-level runners still replay initialization by design. Remaining document action triggers are tracked separately."
 
 [[feature]]
 id = "form.document-actions"
@@ -5348,11 +5348,11 @@ title = "Document actions (will close, will save, did save, will print, did prin
 area = "F"
 tier = "P1"
 milestone = "M6"
-status = "planned"
-commands = []
-tools = []
-evidence = []
-notes = ""
+status = "partial"
+commands = ["file.save", "print.dialog"]
+tools = ["doc_open", "doc_save", "doc_print"]
+evidence = ["crates/engine/src/document_actions_tests.rs::the_open_action_runs_once_on_opening_in_the_document_realm", "crates/engine/src/document_actions_tests.rs::an_open_action_chain_runs_in_order_and_a_cycle_runs_each_action_once", "crates/engine/src/document_actions_tests.rs::an_open_action_may_not_open_a_url_or_print", "crates/engine/src/document_actions_tests.rs::the_open_action_does_not_run_with_javascript_off", "crates/engine/src/document_actions_tests.rs::revert_runs_the_open_action_again_in_a_fresh_realm", "crates/engine/src/document_actions_tests.rs::will_save_changes_what_is_saved_and_a_failing_one_does_not_stop_the_save", "crates/engine/src/document_actions_tests.rs::will_print_runs_in_the_document_realm", "crates/automation/tests/it/document_actions.rs::open_will_save_will_print_and_field_events_share_the_document_realm"]
+notes = "The catalog /OpenAction's JavaScript (with its /Next chain, bounded and cycle-safe) runs once on opening after the document scripts, and again on Revert in a fresh realm; /AA /WS runs before a save (the app's Save and Save As, doc_save) and /AA /WP before printing (the app's Print, doc_print), in the document's realm, so what they change is saved or printed. A failing action is reported and never stops the save or print. These scripts run unasked, so they may only ask for highlighting, zoom, focus or a page. Missing: Will Close (/WC), Did Save (/DS), Did Print (/DP) and page open/close actions (#269, ported from #344)."
 
 [[feature]]
 id = "form.js-host"
@@ -5362,9 +5362,9 @@ tier = "P0"
 milestone = "M6"
 status = "partial"
 commands = ["tools.js_console"]
-tools = ["js_run"]
-evidence = ["crates/js/src/tests.rs::calculate_scripts_read_fields_and_set_the_value", "crates/engine/src/tests.rs::form_javascript_validates_calculates_and_formats", "crates/automation/tests/it/automation.rs::javascript_through_tools", "crates/js/src/tests.rs::an_xfa_form_sees_the_xfa_plugin_installed", "crates/js/src/tests.rs::a_plain_form_sees_the_xfa_version_but_not_installed", "crates/engine/src/tests.rs::scripts_in_an_xfa_form_see_the_xfa_plugin_installed", "crates/js/src/tests.rs::scand_allows_separators_between_fields_but_nothing_before_or_after_them", "crates/ui-egui/tests/it/forms.rs::a_form_button_opens_its_attached_instructions_in_a_new_tab", "crates/js/src/tests.rs::app_alert_keeps_its_title_icon_and_buttons", "crates/js/src/tests.rs::app_alert_reads_the_object_form", "crates/js/src/tests.rs::app_alert_falls_back_on_bad_icon_and_button_numbers", "crates/js/src/tests.rs::app_alert_titles_are_clipped_and_charged", "crates/ui-egui/tests/it/javascript.rs::every_message_a_script_shows_takes_the_toast_in_turn", "crates/js/src/tests.rs::widget_rect_reads_and_writes_a_four_number_array", "crates/engine/src/tests.rs::javascript_field_rect_moves_first_widget_and_undoes", "crates/engine/src/tests.rs::js_get_page_box_reads_effective_boxes_without_editing_the_document", "crates/js/src/tests.rs::get_page_box_returns_supported_boxes_in_rotated_user_space"]
-notes = "boa (pure Rust) with the forms object model: event, getField/Field (value, readonly, display, colours, items, check boxes, rect), this.getPageBox(cBox, nPage) for effective Media, Crop (default), Trim, Bleed and Art boxes in rotated user space, app (with execMenuItem for the side panels and Save As, from a button only, and Print where this.print() works), util.printf/printd/printx/scand (scand reads dates as another viewer was observed to, in AcroForm and XFA scripts), console, display, color, exportDataObject (from a button only: an attached PDF opens in a new tab, other files are offered to save, also as event.target in XFA scripts); xfa_version (3.5) in every document and xfa_installed in XFA forms, so their version check passes. field.rect reads and writes the first widget in PDF user space. no annotations, layers or dialogs (app.response returns null) yet, and no app.findComponent. app.alert keeps its title, icon (error, warning, question, status) and buttons (OK, OK/Cancel, Yes/No, Yes/No/Cancel), given in order or as one object; js_run reports them with each message, and the app shows every message in turn in the toast with its title and icon. Still missing: answers. Every app.alert returns 1 (OK), so a script is never told No or Cancel (#4291)."
+tools = ["js_run", "js_event"]
+evidence = ["crates/js/src/tests.rs::to_source_writes_plain_state_as_a_literal", "crates/js/src/tests.rs::to_source_refuses_cycles_functions_and_oversized_state", "crates/js/src/tests.rs::set_items_and_set_action_change_the_field", "crates/engine/src/document_actions_tests.rs::set_items_and_set_action_are_written_to_the_document", "crates/engine/src/document_actions_tests.rs::pointer_and_focus_triggers_run_the_widget_scripts", "crates/engine/src/document_actions_tests.rs::only_a_click_trigger_may_print", "crates/engine/src/document_actions_tests.rs::a_check_box_mouse_up_reads_the_value_its_click_stored", "crates/ui-egui/tests/it/field_triggers.rs::the_pointer_entering_and_leaving_a_widget_runs_its_scripts", "crates/ui-egui/tests/it/field_triggers.rs::a_check_box_mouse_up_script_sees_the_value_its_click_stored", "crates/automation/tests/it/timesheet_compat.rs::timesheet_keypad_geometry_icons_calculation_and_persistence", "crates/automation/tests/it/timesheet_compat.rs::popup_and_manual_response_resume_the_same_script_and_validate_choices", "crates/js/src/session.rs::document_realm_keeps_keypad_state_and_isolates_documents", "crates/js/src/tests.rs::calculate_scripts_read_fields_and_set_the_value", "crates/engine/src/tests.rs::form_javascript_validates_calculates_and_formats", "crates/automation/tests/it/automation.rs::javascript_through_tools", "crates/js/src/tests.rs::an_xfa_form_sees_the_xfa_plugin_installed", "crates/js/src/tests.rs::a_plain_form_sees_the_xfa_version_but_not_installed", "crates/engine/src/tests.rs::scripts_in_an_xfa_form_see_the_xfa_plugin_installed", "crates/js/src/tests.rs::scand_allows_separators_between_fields_but_nothing_before_or_after_them", "crates/js/src/tests.rs::app_alert_keeps_its_title_icon_and_buttons", "crates/js/src/tests.rs::app_alert_reads_the_object_form", "crates/js/src/tests.rs::app_alert_falls_back_on_bad_icon_and_button_numbers", "crates/js/src/tests.rs::app_alert_titles_are_clipped_and_charged", "crates/ui-egui/tests/it/javascript.rs::every_message_a_script_shows_takes_the_toast_in_turn", "crates/ui-egui/tests/it/forms.rs::a_form_button_opens_its_attached_instructions_in_a_new_tab", "crates/js/src/tests.rs::widget_rect_reads_and_writes_a_four_number_array", "crates/engine/src/tests.rs::javascript_field_rect_moves_first_widget_and_undoes"]
+notes = "Document-scoped native Boa realms shared by button, console and field events; synchronous calculateNow in CO order; normal captions/icons; rect and appearance/tooltip writeback; effective page boxes; native explicit-button popup/response/alert continuation and viewer requests, including opening or saving attachments from form buttons. Headless js_run has deterministic ordered answers. A widget's Mouse Enter, Mouse Exit, Mouse Down, Focus and Blur JavaScript run in the app and through js_event (and form_focus for focus), and a check box's or radio button's Mouse Up runs after its click stored the new value (#247); field.setItems, field.setAction and a bounded Object.prototype.toSource (plain data only) are written back to the document (#269, ported from #344). Partial: web prompt UI, timers, annotation/layer APIs, non-normal button faces, widget-indexed Field access, and Will Close / Did Save / Did Print are not implemented. See docs/acroform-script-workflows.md for lifecycle, limits and validation scope."
 
 [[feature]]
 id = "form.js-console"
@@ -5375,8 +5375,8 @@ milestone = "M6"
 status = "shipped"
 commands = ["tools.js_console"]
 tools = ["js_run"]
-evidence = ["crates/ui-egui/tests/it/javascript.rs::console_runs_scripts_against_the_document", "crates/automation/tests/it/automation.rs::javascript_through_tools", "crates/engine/src/tests.rs::calculate_now_updates_live_fields_in_one_undo_step"]
-notes = "\u2318J: run JavaScript against the document, with console output, results and errors. calculateNow() runs calculated fields synchronously in /CO order against writes already made by the script."
+evidence = ["crates/ui-egui/tests/it/javascript.rs::console_runs_scripts_against_the_document", "crates/automation/tests/it/automation.rs::javascript_through_tools", "crates/engine/src/tests.rs::javascript_field_colours_persist_and_undo_without_changing_other_appearance_properties", "crates/engine/src/tests.rs::javascript_invalid_field_colour_array_is_refused_without_partial_changes", "crates/engine/src/tests.rs::calculate_now_updates_live_fields_in_one_undo_step"]
+notes = "\u2318J: run JavaScript against the document, with console output, results and errors. `fillColor` and `textColor` changes (transparent, gray, RGB or CMYK) persist through save/reopen and participate in undo/redo; malformed or out-of-range colour arrays are refused without applying partial script changes. calculateNow() runs calculated fields synchronously in /CO order against writes already made by the script."
 
 [[feature]]
 id = "form.js-debugger"
@@ -5920,7 +5920,7 @@ status = "shipped"
 commands = ["redact.apply"]
 tools = ["redact_apply"]
 evidence = ["crates/ui-egui/tests/it/redact.rs::marking_applying_and_clearing", "crates/engine/src/tests.rs::redaction_marks_apply_for_good_and_undo", "crates/automation/tests/it/automation.rs::redacting_through_tools", "crates/engine/src/tests.rs::the_renderer_check_refuses_text_still_shown_under_a_mark", "crates/redact/src/tests.rs::redacted_xobjects_do_not_survive_through_inherited_or_shared_resources", "crates/redact/src/tests.rs::redacted_text_does_not_survive_in_info_or_xmp", "crates/redact/src/tests.rs::metadata_is_cleared_when_the_removed_text_was_cut_short", "crates/redact/src/tests/metadata_fail_closed.rs::an_xmp_stream_whose_filter_data_is_corrupt_goes", "crates/redact/src/tests/elsewhere.rs::places_apply_leaves_that_still_hold_the_removed_text_are_counted_and_kept", "crates/engine/src/tests.rs::applied_redactions_report_a_bookmark_that_still_holds_the_removed_text", "crates/automation/tests/it/automation.rs::redact_apply_reports_places_that_still_hold_the_removed_text", "crates/ui-egui/tests/it/redact.rs::applying_says_where_the_removed_text_is_still_held", "crates/redact/src/tests/metadata_matching.rs::a_heading_tracked_with_tj_numbers_matches_the_metadata", "crates/redact/src/tests/metadata_matching.rs::unicode_forms_of_the_removed_text_match", "crates/redact/src/tests/metadata_matching.rs::a_utf16le_string_is_searched_as_utf16le", "crates/redact/src/tests/identification.rs::the_identification_of_a_removed_packet_is_written_back", "crates/automation/tests/it/automation.rs::redact_apply_reports_the_identification_written_back", "crates/ui-egui/tests/it/redact.rs::applying_says_the_pdfa_identification_was_written_back"]
-notes = "confirmation; one undo step; next save is a full rewrite. Document information entries that contain the removed text, and the document's and pages' XMP streams that do, are removed (#2448; matched without regard to case or spacing, by the whole run of removed text and by its words of three letters or digits or more, and a value wholly part of a run as whole words, each also compared by letters and digits alone (so spacing, hyphens and TJ tracking don't hide it), after NFKC and lower case, with FF FE strings read as UTF-16LE; fail-closed: all of it goes when the removed text can't be known in full (too much to collect or search for, a glyph whose text isn't known, a form removed unread), and an XMP packet goes when it can't be decoded strictly, is over 16 MiB or isn't UTF-8 or UTF-16). When the document's XMP goes, its PDF/A and PDF/UA identification is written back in a packet holding only that, value by value when each is a valid code that doesn't hold the removed text, else reported lost (Report::identification, the notification, redact_apply's identification); /Info entries that remain aren't mirrored into that packet. Bookmark titles, attachments (names, file names, descriptions), the comments that remain and other objects' XMP are not changed: applying counts those that still hold the removed text, and the notification and redact_apply's still_holding say where (Remove hidden information removes them); when the removed text couldn't be searched for, every such place holding any text is counted. Refused, with nothing changed, when the page still shows text under a mark afterwards: text in some predefined CMaps and rotated Type 3 fonts is not removed yet, so those documents cannot be redacted. Also refused on a page with an inline image the renderer reads no image for, since the operators after it can't be known. Removed images and forms are unlinked from page-tree resources (own, inherited or shared) and from surviving forms' resources, not yet from annotation appearances or patterns"
+notes = "confirmation; one undo step; next save is a full rewrite. Document information entries that contain the removed text, and the document's and pages' XMP streams that do, are removed (#2448; matched without regard to case or spacing, by the whole run of removed text and by its words of three letters or digits or more, and a value wholly part of a run as whole words, each also compared by letters and digits alone (so spacing, hyphens and TJ tracking don't hide it), after NFKC and lower case, with FF FE strings read as UTF-16LE; fail-closed: all of it goes when the removed text can't be known in full (too much to collect or search for, a glyph whose text isn't known, a form removed unread), and an XMP packet goes when it can't be decoded strictly, is over 16 MiB or isn't UTF-8 or UTF-16). When the document's XMP goes, its PDF/A and PDF/UA identification is written back in a packet holding only that, value by value when each is a valid code that doesn't hold the removed text, else reported lost (Report::identification, the notification, redact_apply's identification); /Info entries that remain aren't mirrored into that packet. Bookmark titles, attachments (names, file names, descriptions), the comments that remain and other objects' XMP are not changed: applying counts those that still hold the removed text, and the notification and redact_apply's still_holding say where (Remove hidden information removes them); when the removed text couldn't be searched for, every such place holding any text is counted. Refused, with nothing changed, when the page still shows text under a mark afterwards: text in some predefined CMaps and rotated Type 3 fonts is not removed yet, so those documents cannot be redacted. Also refused on a page with an inline image the renderer reads no image for, since the operators after it can't be known, or with bytes the content parser can't read in its content or in a form under a mark, which can hide text other readers draw. Removed images and forms are unlinked from page-tree resources (own, inherited or shared) and from surviving forms' resources, not yet from annotation appearances or patterns"
 
 [[feature]]
 id = "protect.redact-glyph-removal"
@@ -7140,11 +7140,25 @@ title = "Create PDF from Office documents (LibreOffice sidecar)"
 area = "J"
 tier = "P2"
 milestone = "M10"
-status = "planned"
-commands = []
-tools = []
-evidence = []
-notes = ""
+status = "partial"
+commands = ["file.open"]
+tools = ["doc_create_multiple", "doc_combine"]
+evidence = [
+    "crates/create/src/office.rs::office_files_are_recognised_by_extension_and_signature",
+    "crates/create/src/office.rs::other_files_are_not_office_documents",
+    "crates/create/src/office.rs::a_converter_that_hangs_is_stopped",
+    "crates/create/src/office.rs::a_converter_that_makes_no_pdf_is_reported",
+    "crates/create/src/office.rs::libreoffice_converts_a_document_when_installed",
+    "crates/create/src/office.rs::the_profile_turns_off_macros_and_never_updates_links",
+    "crates/create/src/office.rs::a_timeout_stops_the_processes_the_converter_started",
+    "crates/automation/tests/it/office.rs::office_documents_convert_separately_with_their_text",
+    "crates/automation/tests/it/office.rs::office_documents_combine_in_order_with_a_bookmark_each",
+    "crates/engine/src/tests.rs::office_documents_convert_through_libreoffice_or_explain_why_not",
+    "crates/engine/src/tests.rs::inline_conversions_refuse_office_documents_without_running_libreoffice",
+    "crates/ui-egui/src/platform/open_worker/tests.rs::file_open_converts_an_office_document_on_the_worker",
+    "crates/ui-egui/src/platform/open_worker/tests.rs::the_open_picker_defaults_to_pdf_and_offers_images_office_text_and_all_files",
+]
+notes = "File ▸ Open (desktop) opens Word, Excel, PowerPoint, OpenDocument and RTF files (Office documents filter; PDF stays the default) as new, unsaved PDFs, converted on the open worker by an installed LibreOffice run headless in a private temporary folder with a fresh profile (macros disabled, untrusted links blocked, Writer and Calc linked content never updated) and stopped after 120 s. Found through PDFCRAFT_SOFFICE, the PATH, or the usual install folders; without it the user is told LibreOffice is needed. The automation tools that convert files (doc_create_multiple, doc_combine, batch convert) take Office documents too. Not yet: Insert pages, Combine files and Create ▸ Multiple files in the app refuse Office documents (they convert on the frame thread) and point to File ▸ Open; no Create ▸ From Office command or conversion settings; Visio and Publisher; the web build; layout fidelity is LibreOffice's, not measured against Acrobat; Impress has no link-update setting and the process's network access isn't sandboxed (synthetic linked sections, pictures and cell references made no connection with LibreOffice 26.8.1); the real-conversion tests skip where LibreOffice isn't installed, CI included."
 
 [[feature]]
 id = "create.create-multiple"
@@ -7549,8 +7563,8 @@ milestone = "M11"
 status = "partial"
 commands = ["optimize.advanced", "optimize.reduce"]
 tools = ["doc_optimize", "doc_reduce"]
-evidence = ["crates/optimize/src/images.rs::flate_images_past_the_runs_allowance_stay_as_they_are", "crates/optimize/tests/optimize.rs::eight_bit_black_and_white_images_become_one_bit", "crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/optimize/tests/optimize.rs::group_3_fax_images_become_group_4", "crates/optimize/tests/optimize.rs::rgb_and_two_colour_indexed_black_and_white_images_become_one_bit", "crates/optimize/tests/optimize.rs::black_and_white_rgb_used_beyond_the_page_content_read_stays_rgb", "crates/optimize/tests/optimize.rs::black_and_white_rgb_drawn_only_where_the_optimizer_reads_becomes_grey", "crates/optimize/tests/optimize.rs::black_and_white_rgb_in_resources_its_page_tree_and_a_form_share_becomes_grey", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy", "crates/filters/src/mq.rs::the_annex_h_test_sequence_encodes_to_its_bytes", "crates/filters/src/jbig2.rs::bitmaps_round_trip", "crates/filters/src/jbig2.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/optimize/tests/optimize.rs::black_and_white_images_become_jbig2", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_jbig2", "crates/filters/src/jbig2/symbols.rs::repeated_marks_are_stored_once", "crates/filters/src/jbig2/symbols.rs::scattered_marks_round_trip", "crates/optimize/tests/optimize.rs::rendered_text_becomes_jbig2_symbols", "crates/optimize/tests/optimize.rs::jbig2_scans_are_averaged_and_stored_again", "crates/optimize/src/images.rs::jbig2_images_past_the_runs_allowance_stay_as_they_are", "crates/optimize/tests/optimize.rs::an_image_too_large_for_the_jbig2_decoder_stays_as_it_is", "crates/optimize/tests/optimize.rs::what_is_too_large_for_jbig2_is_stored_another_way", "crates/optimize/tests/optimize.rs::group_4_takes_images_of_one_bit_a_pixel_up_to_the_pixel_limit", "crates/filters/src/jbig2/symbols.rs::pages_in_one_font_share_one_dictionary", "crates/filters/src/jbig2/symbols.rs::what_a_page_has_alone_stays_its_own", "crates/filters/src/jbig2/symbols.rs::past_the_shared_limit_the_most_widely_held_marks_are_shared", "crates/optimize/tests/optimize.rs::jbig2_pages_share_one_symbol_dictionary", "crates/optimize/tests/optimize.rs::a_dictionary_that_saves_less_than_it_takes_isnt_shared", "crates/optimize/tests/optimize.rs::sixteen_images_at_most_share_a_dictionary", "crates/engine/src/tests.rs::redacting_an_optimized_jbig2_page_stores_the_rest_of_its_group_again", "crates/optimize/src/images.rs::only_what_redaction_can_store_again_shares_a_dictionary"]
-notes = "All of a run's images share one allowance of decoding, filters, decoders and pixels alike (about 1,000 scanned pages' worth, more for a longer file); those past it stay as they are, those the image pass read being counted in the report, which doc_optimize and doc_reduce return and the panel doesn't show yet. CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Packed to one bit first, then stored the same way (colour-key masks aside): eight-bit grey of only black and white, eight-bit DeviceRGB of only black and white (as DeviceGray; calibrated RGB, RGB with a profile, RGB drawn or listed where /DefaultGray or /DefaultRGB is in force or referred to from anywhere but the page and form resources read (an annotation's appearance or a pattern drawing it, directly or through resources or a form shared with a page; another image's /Alternates), and RGB whose soft mask has a /Matte aside), and an indexed image of 2, 4 or 8 bits that uses only palette entries 0 and 1 (keeping its palette), unless the grey or colour settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Group 3 fax images are stored again as Group 4 when that is smaller (damaged Group 3 with end-of-line codes as the decoder recovers it, as it reports no damage there; byte-aligned Group 3 with end-of-line codes but none before the first row, not as T.4 sends them, as PdfCraft draws it, which at /K 0 may be other rows than were coded). CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Lossless JBIG2 with bounded exact-copy symbol coding is available too, with image export, up to 16 images sharing one symbol dictionary (/JBIG2Globals) where that is smaller still (image masks and DeviceGray images named directly, of at most 64 Mi pixels, which redaction can store again without it); lossy JBIG2 remains unsupported. JBIG2 images are read too: averaged like any (under Retain stored as JBIG2 again), and, not resampled, stored again as the compression asks when that is smaller (as JBIG2 symbols where its own coding is a generic region, say); a symbol-coded scan, averaged, loses its exact repeats and is often larger, and then stays as it is; one whose JBIG2 page isn't its size is left alone. Not yet: images over 80 million pixels (left alone by the image steps, whatever their settings; Clean Up may still Flate an unfiltered or LZW one), inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples, JBIG2 past 65,535 samples on a side, where the decoder stops: such an image isn't stored as JBIG2 (the image step leaves a 1-bit one as it is unless it is averaged, and may store one packed from more bits as 1-bit Flate)."
+evidence = ["crates/optimize/src/images.rs::flate_images_past_the_runs_allowance_stay_as_they_are", "crates/optimize/tests/optimize.rs::one_bit_images_past_80_million_pixels_are_stored_as_group_4", "crates/optimize/tests/optimize.rs::eight_bit_black_and_white_images_become_one_bit", "crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/optimize/tests/optimize.rs::group_3_fax_images_become_group_4", "crates/optimize/tests/optimize.rs::rgb_and_two_colour_indexed_black_and_white_images_become_one_bit", "crates/optimize/tests/optimize.rs::black_and_white_rgb_used_beyond_the_page_content_read_stays_rgb", "crates/optimize/tests/optimize.rs::black_and_white_rgb_drawn_only_where_the_optimizer_reads_becomes_grey", "crates/optimize/tests/optimize.rs::black_and_white_rgb_in_resources_its_page_tree_and_a_form_share_becomes_grey", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy", "crates/filters/src/mq.rs::the_annex_h_test_sequence_encodes_to_its_bytes", "crates/filters/src/jbig2.rs::bitmaps_round_trip", "crates/filters/src/jbig2.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/optimize/tests/optimize.rs::black_and_white_images_become_jbig2", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_jbig2", "crates/filters/src/jbig2/symbols.rs::repeated_marks_are_stored_once", "crates/filters/src/jbig2/symbols.rs::scattered_marks_round_trip", "crates/optimize/tests/optimize.rs::rendered_text_becomes_jbig2_symbols", "crates/optimize/tests/optimize.rs::jbig2_scans_are_averaged_and_stored_again", "crates/optimize/src/images.rs::jbig2_images_past_the_runs_allowance_stay_as_they_are", "crates/optimize/tests/optimize.rs::an_image_too_large_for_the_jbig2_decoder_stays_as_it_is", "crates/optimize/tests/optimize.rs::what_is_too_large_for_jbig2_is_stored_another_way", "crates/optimize/tests/optimize.rs::group_4_takes_images_of_one_bit_a_pixel_up_to_the_pixel_limit", "crates/filters/src/jbig2/symbols.rs::pages_in_one_font_share_one_dictionary", "crates/filters/src/jbig2/symbols.rs::what_a_page_has_alone_stays_its_own", "crates/filters/src/jbig2/symbols.rs::past_the_shared_limit_the_most_widely_held_marks_are_shared", "crates/optimize/tests/optimize.rs::jbig2_pages_share_one_symbol_dictionary", "crates/optimize/tests/optimize.rs::a_dictionary_that_saves_less_than_it_takes_isnt_shared", "crates/optimize/tests/optimize.rs::sixteen_images_at_most_share_a_dictionary", "crates/engine/src/tests.rs::redacting_an_optimized_jbig2_page_stores_the_rest_of_its_group_again", "crates/optimize/src/images.rs::only_what_redaction_can_store_again_shares_a_dictionary", "crates/optimize/tests/optimize.rs::a_pictures_one_bit_masks_are_stored_again", "crates/optimize/tests/optimize.rs::a_pictures_mask_stored_as_jbig2_shares_no_dictionary", "crates/automation/tests/it/automation.rs::doc_optimize_stores_a_pictures_one_bit_soft_mask_as_ccitt_group_4"]
+notes = "All of a run's images share one allowance of decoding, filters, decoders and pixels alike (about 1,000 scanned pages' worth, more for a longer file); those past it stay as they are, those the image pass read being counted in the report, which doc_optimize and doc_reduce return and the panel doesn't show yet. CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Packed to one bit first, then stored the same way (colour-key masks aside): eight-bit grey of only black and white, eight-bit DeviceRGB of only black and white (as DeviceGray; calibrated RGB, RGB with a profile, RGB drawn or listed where /DefaultGray or /DefaultRGB is in force or referred to from anywhere but the page and form resources read (an annotation's appearance or a pattern drawing it, directly or through resources or a form shared with a page; another image's /Alternates), and RGB whose soft mask has a /Matte aside), and an indexed image of 2, 4 or 8 bits that uses only palette entries 0 and 1 (keeping its palette), unless the grey or colour settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Group 3 fax images are stored again as Group 4 when that is smaller (damaged Group 3 with end-of-line codes as the decoder recovers it, as it reports no damage there; byte-aligned Group 3 with end-of-line codes but none before the first row, not as T.4 sends them, as PdfCraft draws it, which at /K 0 may be other rows than were coded). CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Lossless JBIG2 with bounded exact-copy symbol coding is available too, with image export, up to 16 images sharing one symbol dictionary (/JBIG2Globals) where that is smaller still (image masks and DeviceGray images named directly, of at most 64 Mi pixels, which redaction can store again without it); lossy JBIG2 remains unsupported. JBIG2 images are read too: averaged like any (under Retain stored as JBIG2 again), and, not resampled, stored again as the compression asks when that is smaller (as JBIG2 symbols where its own coding is a generic region, say); a symbol-coded scan, averaged, loses its exact repeats and is often larger, and then stays as it is; one whose JBIG2 page isn't its size is left alone. A picture's one-bit /SMask, and its stencil /Mask unless pages also draw it by name (it is then one of the images), are stored again the same way after the pictures, each once, at their size and bits, sharing no symbol dictionary, and counted as images. Not yet: images over 80 million pixels (left alone by the image steps, whatever their settings; Clean Up may still Flate an unfiltered or LZW one), except images and masks already of one bit a pixel whose rows hold no more bytes than 80 million pixels of eight bits (a byte for each 8 samples of a row and one for any left over, so up to 640 million pixels when wide, and a strip one sample wide no taller than at eight bits), which the monochrome step averages and stores again as it does smaller ones (with JBIG2 chosen, those past 2^28 pixels stay unless averaged), inline images, a picture's mask resampled, or a soft mask of more bits packed to one bit (it stays, to be resampled with its picture), Group 4 for rows wider than 32,767 samples, JBIG2 past 65,535 samples on a side or 2^28 in all, where the decoder stops: such an image isn't stored as JBIG2 (the image step leaves a 1-bit one as it is unless it is averaged, and may store one packed from more bits as 1-bit Flate)."
 
 [[feature]]
 id = "optimize.only-if-smaller"
@@ -8409,6 +8423,10 @@ evidence = [
     "crates/ui-egui/tests/it/print.rs::printer_papers_and_properties_selection",
     "crates/automation/tests/it/automation.rs::printer_papers_through_tools",
     "crates/print/src/tests.rs::printer_papers_and_default_paper_api",
+    "crates/print/src/tests.rs::ppd_papers_come_from_the_ppd",
+    "crates/print/src/tests.rs::a_job_on_a_ppd_paper_names_the_ppd_keyword",
+    "crates/print/src/tests.rs::a_job_on_a_standard_size_names_the_ppd_keyword_of_that_size",
+    "crates/print/src/tests.rs::printer_papers_are_read_from_the_queue_ppd",
     "crates/print/src/tests.rs::overlapping_paper_discovery_two_sided_and_queue_queries",
     "crates/ui-egui/tests/it/print.rs::a_custom_paper_prints_at_its_size_and_its_printer_keeps_it",
     "crates/ui-egui/src/workflows/print_paper.rs::the_paper_list_is_the_standard_sizes_then_the_custom_ones",
@@ -8417,7 +8435,7 @@ evidence = [
     "crates/ui-egui/tests/it/print_custom_paper_names.rs::a_custom_paper_cannot_take_a_standard_name",
     "crates/automation/tests/it/automation.rs::doc_print_takes_a_paper_size_of_its_own",
 ]
-notes = "In the Print dialog: Custom… beside Paper adds a named size in the preferences' unit (1 to 200 inches a side), kept with the settings and removable. A printer printed to on a custom paper starts on it next time (#2001). The Page Setup button opens the driver's page setup to choose paper size and orientation. printer_papers enumerates driver-reported papers and default paper headlessly. doc_print takes sizes such as 8.5x14in or 210x297mm or driver papers. Missing: margins."
+notes = "In the Print dialog: Custom… beside Paper adds a named size in the preferences' unit (1 to 200 inches a side), kept with the settings and removable. A printer printed to on a custom paper starts on it next time (#2001). The Page Setup button opens the driver's page setup to choose paper size and orientation. printer_papers enumerates driver-reported papers and default paper headlessly. On CUPS they are the queue's PPD papers by the driver's names and its *DefaultPageSize, and a job on one, or on a standard size of one (such as the 4 x 6 in label), is fed it under the PPD's keyword. doc_print takes sizes such as 8.5x14in or 210x297mm or driver papers. Missing: margins."
 
 [[feature]]
 id = "print.print-ready-pdf"
diff --git a/vendor/README.md b/vendor/README.md
index 391dab88e2..558dbbbc12 100644
--- a/vendor/README.md
+++ b/vendor/README.md
@@ -58,7 +58,7 @@ Other resource categories retain their existing parent-chain lookup.
 | hayro-interpret | 0.7.0 | Apache-2.0 OR MIT | (1) select `/AP /N` appearance states via `/AS` (checkboxes, radios, stateful icons) and honour the NoView flag; (2) Type3 Unicode fallback to `/Encoding` glyph names, then printable ASCII; (3) `Type3Glyph::advance_width`; (4) `InterpreterSettings::ocg_overrides` for viewer layer toggles; (5) soft masks whose group lacks `/CS` were dropped (Chrome gradient text); (6) paint nesting cap `MAX_PAINT_NESTING` for tiling patterns and Type 3 glyphs (self-referencing content overflowed the stack); (7) CID width ranges in `/W` and `/W2` clamped to `MAX_CID` (a `0 4294967295 w` range hung); (8) `InterpreterSettings::hide_comments` skips markup annotations but keeps widgets and links (View ▸ Hide all comments); (9) `image_size_ok`: images and masks over 2^28 pixels are not decoded (a fuzzed `/W 4294967295` stencil mask allocated 4 GiB); (10) `MAX_NESTED_PAINTS`: nested paints (forms, Type 3 glyphs and tiling patterns inside one another) share a per-page budget of 50,000 (a glyph showing eight glyphs of its own font, sixteen deep, hung); (11) depends on skrifa 0.47 instead of 0.42 (upstream read-fonts fixed a Type 1 tokenizer that recursed through runs of numbers: a fuzzed font hung or overflowed the stack), with the one API change (`Charset::glyph_id` returns `Option`); (12) annotation appearances whose `/BBox` or `/Matrix` collapses to a line or a point are skipped (mapping them onto `/Rect` divided by zero and handed the device infinite or NaN matrices); (13) a Highlight annotation without a usable normal appearance is drawn from its `/QuadPoints`, `/C` and `/CA` with Multiply blending, as pdfcraft-annot draws highlights (it was not drawn at all); (14) simple-font `/Widths` (`read_widths`): entries only for codes 0–255 (one entry per code below `/FirstChar` was allocated: `4294967295` asked for 34 GB), an entry that isn't a number leaves its code missing instead of ending the array, and a `/LastChar` below `/FirstChar` gives no widths instead of discarding the font for a standard one; (15) the appearance box is mapped onto `/Rect` corner to corner: the translation now accounts for the scale (an appearance whose box didn't start at the origin and differed in size from `/Rect` was drawn shifted); (16) a clip set by `W`/`W*` takes effect after whichever path-painting operator ends the path (`S`, `f`, `B`, … as well as `n`; ISO 32000-2 §8.5.4): it was applied only on `n`, so `re W* S` clipped nothing and the clip stayed pending for a later, unrelated `n`; (17) `InterpreterSettings::cancelled`: once set, interpretation stops before the next content operator (a render pool sets it for every worker when dropped, after an edit or on closing, and for one worker when the watchdog gives up on its render, so renders whose answers nobody can receive stop instead of running to the end); (18) `MAX_PAGE_CONTENT`: the content a page holds at once (its contents, and the forms, tiling patterns and Type 3 glyph procedures being painted) stays within 512 MiB (`decode_content`; once it runs out, `InterpreterWarning::ContentTruncated` is reported (once per page by pdfcraft-render) so a truncated page is not a clean render; each level gives its bytes back when it finishes): forms nest fifty deep and each level kept its content while the next ran, so a form painting itself around a stream inflating to 256 MiB would have held over 12 GB; and Type 0 sampled functions take at most `MAX_SAMPLE_ENTRIES` (2^21) table points and `MAX_SAMPLE_VALUES` (2^23) samples, read no further than `/Size` asks (256 MiB of 1-bit samples asked for over 8 GB); (19) mesh shadings (types 4–7) are sampled only inside the area being drawn (`ShadingPattern::encode_within`, which the vendored hayro renderer calls with that area plus a pixel), within 8 visits per pixel of it plus 4 per triangle (`TriangleSampler`), and patches are triangulated one at a time: points far off the page were sampled over their whole bounding box, up to 65536 × 65536 entries (a fuzzed 147-byte patch stream; a synthetic page passed 6 GB in six seconds), ten thousand overlapping triangles ran for minutes, and every patch became 722 triangles before any limit; meshes hold at most `MAX_MESH_PATCHES` (2^16) patches and `MAX_MESH_TRIANGLES` (2^20) triangles, a lattice needs two to 2^19 vertices per row (`/VerticesPerRow 0` pushed empty rows for ever; one huge row read the whole stream), and a page samples at most `MAX_PAGE_MESH_TRIANGLES` (2^25) mesh triangles in all (a mesh painted a thousand times was triangulated a thousand times); each cut logs a warning; (20) PDF function construction is limited to 64 levels and 10,000 total nodes with cycle detection; calculator parsing and evaluation share procedure depth/work budgets, integer division/bitshift/rotation/index are panic-free, and fixed-size stack errors propagate; (21) a Type 0 font drawn with a substitute that isn't CID-keyed (it isn't embedded, or its program doesn't load) draws `.notdef` for a CID of an Adobe character collection (Japan1, GB1, CNS1, Korea1) that it can't find by Unicode: hayro took the CID for a glyph index of the substitute, which numbers its glyphs its own way, so the character was drawn as an unrelated one (𠮷 as "Ｑ" in BIZ UDPGothic); (22) a Type 0 font drawn with a substitute finds a character given with a variation selector (`/ToUnicode`, or Adobe-Japan1-UCS2, which maps the JIS X 0208 forms of the kanji JIS X 0213:2004 redrew that way: CID 1247 is 噂 U+E0100) through the substitute's variation sequences, else as the character alone: such a CID found no glyph and was drawn as an unrelated one; (23) backport of hayro 0.8's `gradient` module: `EncodedShadingPattern::as_svg_gradient` turns an axial or radial shading into stops of an sRGB gradient (within 0.01 per channel, a stop at every stitching-function bound via `Function::stitching_bounds`) when a native gradient draws it exactly (extended past the box drawn in; a radial one with no background colour); (24) `DecodedImageCache`: decoded image pixels shared across renders through the interpreter cache within a 64 MiB budget (an image-heavy page decoded its thousands of images again per tile and per scale), keyed by every decode input (`DecodedImageKey`: the stream's place and dictionary bytes, its object, mask/stencil/raster output, interpolation, decode target size, preview or final); images under a transfer function and inline images are not cached, an image over the budget is never kept, and a poisoned lock decodes uncached; (25) `Device::actual_text` hands the device a marked content sequence's `/ActualText` (inline or named in `/Properties`), so text extraction keeps the Thai, Indic and Arabic clusters Chrome marks this way (their shaped tone marks and vowels have no Unicode of their own); (26) non-embedded simple fonts drawn with a standard-font stand-in build the Latin Extended-A letters the stand-in lacks (`/Gbreve`, `/Idotaccent`, `/Scedilla`, `/aogonek`, `/ccaron`…) from the base letter and accent it has (`StandardKind::composite_glyph`, `ACCENTED_LETTERS`): PDFium's Foxit stand-ins hold only the Standard/WinAnsi/Mac Roman glyphs, so iText letters with Times New Roman unembedded showed blanks for Ğ, İ, Ş, ğ and ş; the comma-below letters (`/scommaaccent`, `/Tcommaaccent`, `/kcommaaccent`…, found by character, so `/uni0136` and the glyph list's `/Kcedilla` too) are the letter and the font's comma, smaller and under the baseline, since the stand-ins have no `commaaccent` (Romanian ș drew nothing and ț a cedilla in forms laid out from XFA; ģ, whose comma is turned and above, is not built); (27) an embedded TrueType font without a base encoding reads its codes as WinAnsi for text extraction (`EmbeddedKind::code_to_unicode_name`), matching pdftotext's output, instead of Standard: OCR text layers of scans write WinAnsi codes with no `/Encoding`, and Standard has no ü, ö or ß and reads é as Ø (glyph selection unchanged); (28) an image whose pixels hold at most 16 bits of samples (an 8-bit Separation or DeviceN image, a 1-, 2- or 4-bit gray or indexed one) is converted once per possible pixel value through a lookup table instead of once per pixel (`rgb_via_lookup`): a spot-colour tint transform is often a PostScript calculator program, run for every pixel, so a fillable character sheet's 3304 × 4105 DeviceN background took four seconds and 430 MB to draw a page; each entry is converted on its own (`convert_each`), so a tint transform giving the wrong number of components for a value the image never uses cannot shift the colours of the values it does; (29) `Device::begin_annotations`/`end_annotations` bracket the page's annotations, so a device can tell comment paints from document paints (reading colours recolour the document, never a comment, #1548); (30) the Annex D.2 alias codes read as the ink they draw: WinAnsiEncoding 0xA0 and 0xAD, and MacRomanEncoding 0xCA, carry the glyph names `space` and `hyphen` -- the names those tables also give 0x20 and 0x2D -- not `nbspace` and `sfthyphen`, whose glyph list values U+00A0 and U+00AD are invisible formatting characters. Extraction hid drawn ink behind them, so search and redaction matched neither (`XiaoBiaoSong.pdf` in the pdf.js corpus drew 104 soft hyphens; across the 989 files the soft hyphens we extract fall from 117 to 13 and the non-breaking spaces from 30 to 26, what remains coming from `/ToUnicode` maps, which say so explicitly). The base table only, in the text direction only: a `/Differences` name keeps its glyph list value and glyph lookup is untouched, both as pdftotext does; (31) a Type 0 sampled function keeps its samples in one flat array indexed by strides (`Type0::entry`) instead of a hash map keyed by each grid point: the map was built again, one hashed insert per sample, every time a shading using the function was painted (a 2,097,152-sample ramp painted 30 times took 38 s; `bug1721218` in the pdf.js corpus spent most of a 1.5 s page on it); the interpolation is unchanged, so results are bit for bit the same, a sample missing from a short stream still gives no value, and the maximum sample value is computed without overflowing at 32 bits per sample; (32) the decoded-image cache (24) keys a decode by the size the image is drawn at only when a JPX stream decodes it or its soft mask or mask (`decode_reads_target`): JPX is the only filter that decodes a reduced resolution for a size, so a JPEG or Flate scan was decoded again at every zoom step and kept once per zoom level; one decode now serves every size; `InterpreterCache::decoded_image_decodes` counts the cache's decodes; (33) Coons and tensor-product patches copy their vertices' colours less: each point of a patch's 20 × 20 triangle grid is interpolated once (`generate_patch_triangles`; each cell interpolated its four corners itself, 1,444 interpolations a patch for 400 points), a cell's second triangle takes the vertices its first copied, and the mesh sampler moves a patch's triangles into device space instead of copying each vertex (`TriangleSampler::sample_owned`); the same values, 10–16% faster on mesh-gradient pages; (34) `color::tint_transform_runs`: how many colours the calling thread has run through a Separation or DeviceN tint transform (counted once per batch in `convert_f32`), so a test counts patch (28)'s once-per-sample-value runs instead of timing them (its 10 s deadline failed on a busy FreeBSD VM in CI); (35) `EncodedShadingPattern::extent`: where a mesh shading (types 4–7) can paint at all, the pixels its triangles touched when it was encoded (`None` for the types that paint everywhere, and when the shading has a `/Background`), so the renderer samples a texture there alone and skips a mesh with nothing on the canvas; (36) a mesh shading's pixel whose corner no triangle holds strictly (on an edge two triangles share, or on the mesh's side) takes the triangle that covers its centre, edges included (`Triangle::covers`): testing only the corner left a white seam along every shared edge, and the colour is still taken at the corner; (38) the `/DefaultGray`, `/DefaultRGB` and `/DefaultCMYK` colour spaces of a resource dictionary (ISO 32000-2 §8.6.5.6) replace the device space content selects: with `g`/`G`, `rg`/`RG`, `k`/`K` and `cs`/`CS` (by name, or through a `/ColorSpace` resource that is a device space), and as the `/ColorSpace` of an image XObject, an inline image or a shading painted by `sh` or as a shading pattern (`DefaultColorSpaces`, looked up once per content window in the resources and those they inherit, so a form XObject without a default of its own draws in its page's, as Poppler and MuPDF draw it); a default that is a Lab, Indexed, Pattern or device space, has another number of components or is no colour space is ignored and device colour is drawn as before; device spaces inside other spaces (an Indexed base, a Separation or DeviceN alternate, a Pattern's underlying space), shading dictionaries, masks and transparency group spaces are unchanged, and the decoded-image cache (24) keys a decode by the default it was drawn in. hayro drew device colour as it was, so pages that calibrate it this way (common in PDF/A) came out in the wrong colours; (39) knockout groups (#2971): `Device::set_knockout` right after a `/K true` group is pushed; `Device::knockout_image` for an unmasked image before its group is pushed, when `Device::in_knockout_group`: the device clears its placement rectangle only if it will draw the image (on the canvas, not a preview's tiny image, and it decodes), decoded at its draw size so the draw reuses that decode; and, when `Device::knockout_erase_wanted`, a nested group's content drawn once between `begin_knockout_erase` and `end_knockout_erase` before the group itself, which then always gets a layer of its own; (40) an optional content membership dictionary's visibility expression (`/VE`: `/And`, `/Or`, `/Not`, nested up to 32 deep) decides its visibility ahead of `/OCGs` and `/P` (ISO 32000-2 §8.11.2.2); it was ignored, so content under it stayed visible with its layers hidden; a malformed expression, including one naming an object the document doesn't list in `/OCProperties /OCGs`, falls back to `/OCGs` and `/P` (#2986); (41) a transparency group that is neither isolated nor knockout, entered at full opacity with no soft mask and Normal blending, is drawn straight onto the page instead of into a layer of its own (§11.4.7: its elements composite with the backdrop; the layer made a `/BM /Multiply` highlight appearance an opaque block, #1968); (42) text in a Type 3 font is drawn filled whatever the text rendering mode, except mode 3 (invisible): only that mode has any effect on Type 3 fonts (ISO 32000-1 §9.3.6). Stroking ran the glyph procedure a second time, so `2 Tr` made bitmap fonts look bold, `1 Tr` painted an uncoloured glyph in the stroking colour, and `7 Tr` hid it (`7 Tr` since follows 64); (43) Lab colour spaces honour their own `/WhitePoint`: L\*a\*b\* goes to XYZ relative to that white, is Bradford-adapted to D65 and converted to sRGB (ISO 32000-2 §8.6.5.4) instead of through `LAB.icc` as if every white were D50 (a D65 blue came out 45 levels too red; the profile is removed); components normalised to [0, 1] (`manual_scale`, an `/Indexed` palette over Lab) map onto L\* 0..100 and the a\*/b\* `/Range`; (44) a Type 0 font whose `/ToUnicode` is the name `/Identity-H` or `/Identity-V` (not a CMap stream; WSCAD writes it) reads each code as its Unicode value, as Acrobat shows it (`Type0Font::identity_to_unicode`); the identity CMap the name resolved to maps codes to CIDs only, so such pages had no text to select or find; (46) an image XObject's group applies the fill opacity, so the fill alpha is reset to 1 before a stencil mask takes the fill colour as its paint, and a pattern paint drops the opacity it captured at `scn` (`Pattern::without_opacity`) (it was applied twice: a mask at `ca 0.5` was drawn at a quarter, #2975); (47) `path_as_rect`: a five-element path is a rectangle only when its four points are distinct, each step from one to the next runs along a single axis, and the last returns to the first. The length test admits one MoveTo and four LineTo as well as one MoveTo, three LineTo and a ClosePath, and asking only that every corner of the bounding box was visited says nothing about the order or the steps between, so a five-point polyline whose ends reached the corners was painted as that box -- a fourth side the path does not have -- and a clip of that shape was discarded; the coordinates are compared exactly, since the matrix is applied after this check and a `cm` of 10,000 turns `is_nearly_equal`'s 256th of a unit into tens of device units (#3327); (48) an `/ICCBased` colour space is cached by what its profile is read from (`IccProfileKey`): the stream object it names, looked up without reading the stream, and then the stream's dictionary and its own bytes (decrypted, not decoded), so a byte-for-byte copy of a profile in another object is read once, and a profile stream written directly in its array, which reports the object holding the array as every other stream written there does, is told apart by its bytes. hayro keyed it by the stream dictionary's bytes alone, so two different profiles with the same `/N` and `/Length` shared whichever was read first, and colours in the second were drawn through the first. `InterpreterCache::icc_profile_reads` counts the profiles read; (49) `OpenTypeFontBlob::new` also accepts a `post` table version 1.0, 2.0 or 3.0 written with its 16-bit halves swapped (`00 00 00 03`), as ScanSoft PDF Create! embeds every font; such fonts were refused and their text drawn with a substitute (Hebrew came out garbled or missing, #2946); `glyph_names` reads such a table from a copy with the version written correctly, so a 2.0 table's names serve `/Differences`. Any other unknown version is still refused (pdf.js 9462); (50) `CffFontBlob::glyph_index_by_name` looks a glyph name up in a name to glyph map built on first use (shared between clones) instead of searching the whole charset, with a string lookup per glyph, for every character code of a font; the first glyph with a name still wins; (51) at most 4096 graphics states saved at once, holding at most 64 MiB together (each `q` copies the whole state, dash array and clip list included, so short operators multiplied one large state); a `q` past either limit is counted but not copied, and its `Q` still removes the clips added since (from storytold/craft-libs#239); (52) a `/W2` run whose first CID is past `MAX_CID` stops there, as in `/W` (7), checked before the run's metrics are read: a first CID of 4294967295 inserted one entry and then overflowed, discarding the whole `/W2` table (from storytold/craft-libs#254); (55) a Separation or DeviceN tint transform that cannot be read keeps its colour space, and one that cannot be read or evaluated paints the alternate space's initial colour, as evaluation failures already did; that fallback, and a `cs`/`CS` colour space that cannot be read (drawn in DeviceGray as before), are now reported once per content stream as `InterpreterWarning::ColorFallback` (`RenderWarning::ColourFallback` in `pdfcraft-render`) instead of silently (#4260); (56) an annotation whose Invisible flag (bit 1) is set and whose `/Subtype` is none of the standard types of ISO 32000-2 Table 171 (`is_standard_annotation_type`; no `/Subtype` counts as unknown) is not drawn (Table 167), and a `/Popup` annotation's appearance is never painted on the page (§12.5.6.14: a popup has no appearance stream of its own; the viewer shows it as a window for its parent annotation). Both were drawn from their `/AP`; (57) a simple font drawn with a standard-font stand-in because the document names a font it doesn't embed (`StandardKind` with `fallback`) narrows a glyph to a narrower `/Widths` advance but no longer widens it to a wider one: the advance already places the next glyph (ISO 32000-2 §9.2.4; /Widths in Table 109), and widening drew a non-embedded `Arial,Bold` with 600-unit widths as a heavy fixed-pitch face whose `i` and `l` were solid blocks twice their width; an exact standard-14 font still matches its standard metrics both ways; (58) the fallback request for a Type 0 font that is not embedded (`FallbackFontQuery::with_descriptor`) takes its serif, italic and small-cap flags, `/FontWeight`, `/FontFamily` and `/FontStretch` from the descendant CIDFont's font descriptor (ISO 32000-2 §9.7.4.1, §9.7.6.1; §9.8): it read them from the Type 0 dictionary, which has none, so every such request asked for a regular sans-serif face and no resolver could tell a Song or Mincho font from a Hei or Gothic one, or see `/FontWeight 700`; (59) the NoRotate flag (`/F` bit 5) is honoured: the appearance, fitted to `/Rect`, is turned against the page's `/Rotate` about the rectangle's upper-left corner, which stays where it is, so it reads upright as the page is displayed (ISO 32000-2 §12.5.3). Sticky notes, which are saved NoRotate, were drawn turned with the page (#2583). Form fields and links stay in `/Rect`, where PdfCraft takes their click targets from it; (61) stroke geometry by ISO 32000-2 §8.5.3.2 and §8.4.3: a degenerate subpath (a single-point closed path, or points that all coincide) is stroked as a dot of the line width with round caps and not at all with butt or projecting square caps (upstream nudged a zero-length `l` so square caps drew a square, and `x y m h` lost its `h` because kurbo's `is_empty` counts only segments); a segment after `h` begins a new subpath with a `MoveTo` to the point `h` reached (§8.5.2.1, Table 58), so `h` then an `l` back to that point is a degenerate subpath of its own; a dash array that is all zero or has a negative or non-finite entry is kept as `[]`, a solid line (`[0 0]` became hundredth-of-a-point dashes, a faint half-covered line); a negative or non-finite line width (`w`, `/LW`) is kept as 0, so no device sees one below zero; (63) a luminosity soft mask whose group colour space is `/DeviceCMYK` (by name, not an ICC-based or calibrated space) reads a `/DeviceCMYK` fill or stroke colour drawn in it, and its `/BC`, as their gray `1 - min(1, 0.3 c + 0.59 m + 0.11 y + k)` (ISO 32000-2 §10.4.2.3, §11.5.3: device colour converts to gray with no colour calibration; `Context::luminosity_in_device_cmyk`, `color::device_cmyk_to_gray`): it went through the CMYK display profile, where 100% K is a dark grey, so a 100% K mask let about an eighth of the masked paint through. CMYK images, shadings and tiling patterns inside such a mask, and CMYK on the page, still use the profile; (64) text in a Type 3 font follows ISO 32000-2 §9.3.6 in the clipping modes: under `7 Tr` it is not rendered (reported to the device as clipping text, `GlyphDrawMode::Clip`, so extraction keeps it), and in modes 4 to 7 a Type 3 glyph adds nothing to the clipping path (`clip_glyph`), so text shown only in a Type 3 font leaves no clip at `ET`. Since (42) `7 Tr` painted the glyphs in the fill colour (black by default), so a fill meant to follow showed them wherever it didn't cover them; 4 to 6 still render filled; (65) a fill or clip whose path has no width or no height (but not both) marks the device pixels the line touches (ISO 32000-2 §10.7.4: "A zero-width or zero-height rectangle paints a line 1 pixel wide", and a clip is "the set of pixels that would be included by a fill operation"): whole pixels when the line stays within one device row or column, a band one device pixel wide when a rotated or skewed CTM carries it across rows and columns, built per subpath so the gap between two subpaths on one line stays unpainted (`degenerate_fill_area`). A zero-height clip such as `10 10 100 0 re W n` hid everything painted after it, and the fill fell back to a thinnest-line stroke that half-covered two rows on a pixel boundary. A point paints as before, and a path with area, however thin, is filled as the shape it is (the thinnest-line fallback took a side under 1/256 unit as zero, so a thin rectangle that the CTM scales up to whole pixels was drawn as a hairline across its bounding box); (66) a Separation colour space whose colourant is the special name `All` paints every colourant at once (ISO 32000-2 §8.6.6.4): on screen and in an RGB print raster its tint t is the gray 1 − t, complemented because the device is additive, whatever its alternate space and tint transform say (hayro drew it through the tint transform, so a `/DeviceCMYK` transform giving cyan drew registration marks light cyan); `/None` still paints nothing, any other name still goes through its alternate, and a DeviceN space naming `All` keeps its alternate, since the clause gives the name that meaning in a Separation space; (71) a lookup table in an indirect string reads: it was read as a stream first, which uses up a reference (ISO 32000-2 §8.6.6.3); (72) an uncoloured pattern's underlying space given as a name or a reference is used: it was skipped, so a CMYK cyan drew red (ISO 32000-2 §8.7.3.3); (73) `InterpreterSettings::jbig2_work`, set for each page in `interpret_page` and ended with it, and a JBIG2 image or an image with a JBIG2 mask past it left out with `ContentTruncated`; so is an image whose JBIG2 soft mask or `/Mask` one of the decoder's limits refuses, or PdfCraft's bound on the pixels of an image (`image_size_ok`), where a mask the file damaged still leaves its image whole (#6722), and an image drawn on its own, a stencil mask included, that a limit refuses is still a failed image (`ImageXObject::masks_picture`): `decode_raster` leaves the image out when its mask reported `ContentTruncated`, decoded or kept by the cache (91), and a size or count the file damaged can read as past a limit and is taken for one, the safe side; (74) colour spaces nest at most 32 levels, through every way one names another, so a chain of them ends instead of overflowing the stack; an ICC profile's `/Alternate` is read where it's met and isn't kept with the profile, or a page could build a chain past the limit on spaces already read; (75) a soft hyphen (U+00AD) that a CFF substitute for a CID font has no glyph for draws its hyphen, as Annex D.2 reads WinAnsi 0xAD in (30), instead of the CID taken as a glyph index (#5888); (76) a CID of an Arial the PDF doesn't embed (`CIDFontType2`, not of an Adobe character collection; `ArialMT`, `Arial-BoldMT`, `Arial,Bold` and the other two faces, not Arial Narrow, Black or Unicode MS) that no Unicode route draws names, through its `/CIDToGIDMap`, the Arial glyph of the standard Macintosh order (read-fonts' `post::DEFAULT_GLYPH_NAMES`, its first 258 glyphs), and a CFF substitute draws its glyph of that name (.notdef when it has none) instead of the CID taken as its own glyph index (#5889); (77) a standard 14 font drawn with its bundled stand-in (`StandardFontBlob::Cff`) reads each glyph's own advance from its charstring (`CffFontBlob::advance_width`), so a stand-in glyph wider or narrower than the standard metrics is fitted to them as the OpenType stand-ins already were (ISO 32000-2 §9.6.2.2): with no advance the outline was drawn as it is, and the stand-ins' € (WinAnsiEncoding code 128, Annex D Table D.2), 667 to 722 units wide against the metrics' 556 (Helvetica) and 500 (Times), overlapped the next glyph. Symbol and ZapfDingbats (Annex D.5, D.6) are fitted the same way, the check mark `4` a check box draws for its `/MK /CA` caption among them; (78) `TilingPattern::instance` numbers each setting of a tiling pattern (`scn`/`SCN`), its copies keeping the number, and `TilingPattern::is_coloured` reports `/PaintType 1`, so a renderer can draw a coloured cell once for every fill of one setting (hayro patch (30)); (79) text extraction from a symbolic embedded TrueType font with no `/Encoding` (and no `/ToUnicode`) reads a code through the `post` table name of the glyph its `cmap` selects (`EmbeddedKind::symbolic_text`), when that name has a Unicode value by the glyph-name rules of `glyph_name_text`, which are the Adobe Glyph List Specification's (ISO 32000-2 §9.10.2) and the editor's in pdfcraft-fonts (a `.suffix` is dropped, `_` separates the characters of a ligature, `uni` with one or more groups of exactly four uppercase hex digits and `u` with four to six are code points; lowercase digits, other lengths and surrogate or out-of-range values name nothing, so `uni20ac` reads as WinAnsi), instead of reading the code as WinAnsi: FrameMaker files distilled with Distiller 3 number their codes in the Macintosh glyph order, 29 below ASCII, so `Solid` was extracted, edited and exported to Word as `6ROLG` (#3962). Codes with no glyph, or whose glyph has no such name, still read as WinAnsi; glyph selection is unchanged; (80) an `/Indexed` colour space that breaks ISO 32000-2 §8.6.6.3 is drawn as most readers draw it: a lookup table shorter than m × (hival + 1) bytes keeps the entries it holds in full and an index past them is drawn black after conversion, in any base space (zero bytes would be white in DeviceCMYK, Separation and DeviceN, and blue in Lab); a `hival` past 255 is taken as 255, and a real `hival` is truncated toward zero. An image drawn so reports `InterpreterWarning::MalformedIndexedImage`, surfaced as `RenderWarning::MalformedIndexedImage`, and a fill or stroke colour in such a space reports `ColorFallback`. An image whose lookup is missing, not a string or a stream, or a stream that does not decode (or decodes to nothing although it holds data) is not drawn, with the same warning; a colour set in such a space keeps the upstream DeviceGray fallback. Upstream treated all of these as an unreadable space and fell back to DeviceGray, painting the indices near-black, even ones whose entries were present. A `hival` below zero or not a number has no reading: the space falls back as upstream, and an image in it reports the warning. A lookup string given by an indirect reference is read (upstream consumed the reference trying it as a stream and found no table). The warning is taken from the space as built, so no table is read twice: inline images naming the space through a resource read its table once however many there are (`InterpreterCache::indexed_lookup_reads`); (82) a soft mask (or `/Mask` image) larger than its image and more than twice as large on a side as the device pixels its image is drawn at is averaged down to that size, rounded up to a power of two, in `ImageXObject::decoded_soft_mask`, and cached there (`DecodedImageKey::shrunk_to`, with the image's raster keyed by the same rounded size); every size is made from one cached intermediate mask at most 4096 on a side, so the full mask is decoded once however many sizes it is drawn at: it bypassed the decoded-image cache and was decoded, copied and staged at full size each time it was drawn. A 2 × 2 image with a 34,862 × 4,332 mask drawn 40 times on one slide (pdf.js `issue16263.pdf`) took about 3.6 s a draw and minutes a page; it now decodes the mask once and draws the page in about 2.5 s. A mask no larger than twice its drawn size keeps its resolution, which the renderer filters as before; `InterpreterCache::decoded_mask_decodes` counts the masks among the decodes; (83) an embedded TrueType program whose `head.indexToLocFormat` holds neither 0 nor 1 is read with the `loca` format its table's length gives (`with_loca_format_fixed`): the glyph reader took anything but 1 as short offsets, so a font marked 256 had its long offsets misread and drew boxes (pdf.js `issue2537r.pdf`); (84) a Type 0 font of an Adobe character collection (Japan1, GB1, CNS1, Korea1) reads a code its `/ToUnicode` has nothing for, or every code when it has none, through the collection's UCS2 CMap, code to CID to Unicode, embedded or not (ISO 32000-2 §9.10.2; `Type0Font::ucs2`, parsed the first time a code needs it): only fonts that are not embedded took that route, so Japanese and Chinese pages whose fonts are embedded without a `/ToUnicode`, or with one that maps nothing, had no text to select, find or copy; (85) a Type 0 font's `/ToUnicode` written as a CID CMap (`begincidchar` / `begincidrange`, destinations as numbers, as Word writes it) gives each number as the code's Unicode value for text, as glyph lookup (`map_via_unicode`) already read it and as pdftotext and PDFium extract it; ISO 32000-2 §9.10.3 has `beginbfchar` / `beginbfrange` there, and such text extracted nothing (pdf.js `issue9367`); (86) form fields' widgets are drawn after the page's other annotations, each group in `/Annots` order (`interpret_page`), as MuPDF and PDFium draw them; ISO 32000-2 doesn't order the two: a check box listed before a filled square comment that covers it was hidden under the comment (pdf.js `issue13003.pdf`); (87) a Type 3 font keeps each glyph procedure it decoded (`Type3::decoded_proc`), so a glyph shown again isn't inflated again: a font used as a fill pattern drew one glyph about 650,000 times on a page and decoded its procedure for each; a procedure over 64 KiB isn't kept, and the fonts of one `InterpreterCache` keep at most 32 MiB together (`MAX_CACHED_TYPE3_PROCS`), each kept procedure counting its bytes, its name and 64 bytes besides, as fonts live as long as the cache; a procedure holds its bytes within the page's content budget while the glyph is painted, kept or not (`context::hold_content`), so a page skips the same glyphs once the budget is spent, and one decoded with no more than 64 KiB of budget left, which the budget may have cut short, isn't kept; `InterpreterCache::type3_proc_decodes` counts the procedures decoded; (88) the rule of (76) also reads Times New Roman (`TimesNewRomanPSMT`, `TimesNewRomanPS-BoldMT`, `TimesNewRoman,Bold` and the other faces, not Times or Times New Roman MT Std), whose first 258 glyphs follow that order too: in a public form whose embedded Times New Roman subsets keep their glyph indexes, 941 of 942 `/ToUnicode` entries below 258 name that order's character, and its non-embedded `TimesNewRoman,Bold` drew "Salarié(e) du régime général" as "Salari²*g+f w't²i lo g'ì²p²tcn" (#6449); (89) a form XObject already being drawn is not drawn inside itself (`Context::enter_form`, reported as `ContentTruncated`, §8.10.1): a name in its content that reached it again, through its own resources or the page resources a form with its own still falls back on, drew it until the page's nested-paint budget was spent (PDFBOX-5782, 38 s); the forms being drawn are kept per page and thread, so the tiling patterns, Type 3 glyphs, soft masks and groups painted inside a form, which are interpreted in contexts of their own, see it too; (90) a Type 3 font without `/Widths` (or `/FirstChar`/`/LastChar`) advances each glyph by the width its glyph procedure sets with `d0` or `d1` (`Type3::proc_width`, ISO 32000-2 9.6.4) instead of 0, read once per code; a font with `/Widths` is unchanged, a code outside `/FirstChar`..`/LastChar` keeping width 0 (Table 110) (PDFBOX-2943: a misspelt `/Widths` key drew every glyph on one spot), and selecting such a font reports `InterpreterWarning::Type3WidthsMissing` (`Font::type3_widths_missing`, checked in `Context::resolve_font`); (91) the decoded-image cache keeps a failed decode for its key, as the warnings it reported, so a picture or stencil mask that doesn't decode (damaged data, a JPX or JBIG2 stream its decoder refuses) isn't decoded again at every draw, tile and render that shares the cache, and each draw still reports what the decode did (`DecodedImageCache::get_or_insert_with`, `ImageXObject::reporting_to`); a failure counts 128 bytes towards the cache's budget, and one the page's JBIG2 allowance may have caused (73) isn't kept (the hayro-syntax comment on `charge_page_reading` says so), nor one a JBIG2 mask's decoding work refused, while a JBIG2 mask refused by a limit its stream reaches by itself is kept, with the image it takes out (`note_stream_limited`), so a page drawing that image a hundred times decodes it once; (92) the text of a glyph whose name is not in the glyph list reads `uniXXXX` and `uXXXX` to `uXXXXXX` by the Adobe Glyph List Specification (`agl_unicode_from_name`: `uni` and exactly four uppercase hex digits, `u` and four to six, no surrogate, nothing past U+10FFFF), so `uni65`, `u65`, `uni20ac` and `uni+065` read as nothing instead of `e` and `€`; upstream's lenient `unicode_from_name` stays for finding a glyph in a font (TrueType `cmap` lookup, accented standard-font letters), so drawing is unchanged; (93) a CID-keyed CFF font keeps the font dicts it can read: a font dict without a Private DICT (one a subsetter emptied) leaves only the glyphs FDSelect gives it missing, where one such dict dropped the whole font and its text drew with a fallback (ISO 32000-2 §9.9 Table 124, Adobe TN #5176); (94) a font dictionary whose `/Subtype` is missing or the empty name (`/Subtype /`) is read as Type 1, so its `/BaseFont` picks the face (ISO 32000-2 Table 109 requires `/Subtype`; other readers fall back this way): a `/Courier-Bold` was drawn in the Helvetica fallback (PDFBOX-1988). Any other unknown subtype is still refused; (98) a non-embedded font named `SymbolMT`, or `Symbol`/`SymbolMT` with a `,` or `-` style suffix (`Symbol,Bold`, `Symbol-Bold`; `SYMBOL_STYLES`, so `Symbol-Helvetica` stays another font), is the standard Symbol font and draws through its built-in encoding, so a TrueType `SymbolMT` declaring `/WinAnsiEncoding` draws `mu` for code 0x6D, not `m` (ISO 32000-2 §9.6.2.2); (99) the mesh sampler walks each row of a triangle only across the columns where that row's sample points can lie in it, not its whole box (a row with none still costs a visit): thin triangles of the fixed 19 × 19 patch grid lying across the pixel grid (a narrow curved band of tensor patches) have boxes many times their area, and a mesh painted through a path the size of its own box spent the visit budget before its last patches and left them unpainted; (100) a Type 1 or Type 3 font glyph name that only numbers its glyph (`C39`, `MT72`, `G4E`: one to three letters, then decimal or hexadecimal digits) and names the very code it is shown with reads as that code's Latin-1 character (controls excepted; in a Type 3 font, which already reads codes 32-126 by the code, above 126), in a font where every such name names its own code (`numbered_names_name_their_codes`, worked out once per font); a font with any numbered name at another code (`/C1` at 233, review on #3239; `/Differences [1 /C70 …]`) or at a C0 control code (a subset counting its glyphs from code 1, `/Differences [1 /C1 /C2 …]`, where `/C65` is the 65th glyph used) keeps reading them as nothing (#3170); (101) a symbolic TrueType font with no encoding reads a code as Mac OS Roman in text extraction when its Macintosh Roman (1, 0) `cmap` subtable selects the glyph the code draws (ISO 32000-2 §9.6.5.4) and that glyph sits where the standard Macintosh glyph order (`post` version 1.0) puts the code's Mac OS Roman character, for a font whose `post` table names no glyphs, that names no base encoding (an unknown name included) and that isn't Symbol or ZapfDingbats (§9.6.6.1), after `/Differences` and before the WinAnsi last resort; Windows subsets in the same order keep their WinAnsi reading, and glyph selection is unchanged; (102) `OutlineGlyph::vertical_glyph_width`: a vertical-writing Type 0 glyph's width w0 from `/W` or `/DW`, its extent across the column (ISO 32000-2 §9.7.4.3), which `advance_width` (the horizontal advance, 0 in vertical writing) does not give; (81) a reply of type R (a markup annotation with an `/IRT` and an `/RT` other than `/Group`; R is the default, so a missing, unknown or malformed `/RT` reads as R; a widget, link or pop-up with `/IRT` still draws) is not drawn, whatever its appearance or flags: ISO 32000-2 Table 172 says such replies "shall not" be displayed individually but in their comment's thread (files from editors that give every reply a note-icon appearance showed a stack of icons, #5631); a `/RT /Group` member still draws; (103) `InterpreterSettings::view_auto_state` (on by default): the default configuration's auto state for the View event (`/AS` usage applications with `/Event /View` and `/View` in `/Category`) sets each managed group from its `/Usage /View /ViewState` before `ocg_overrides`, ON only if every recommendation is ON (ISO 32000-2 §8.11.4.4); `/Zoom`, `/User` and `/Language` give no recommendation; at most 256 applications, 4096 `/OCGs` entries and 16 categories each are read; off for print renders | (1) `raster::tests::widget_appearance_states`; (2, 3) `xtask text-oracle` on corpus/pdfjs issue918; (4) `raster::tests::layer_override_hides_content`; (5) `raster::tests::soft_mask_without_group_colour_space_is_applied`; (6) `raster::tests::self_referencing_tiling_pattern_terminates`, `raster::tests::self_referencing_type3_glyph_terminates`; (7) `raster::tests::huge_cid_width_ranges_terminate`; (8) `raster::tests::hiding_comments_keeps_fields`; (9) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (10) `raster::tests::type3_glyphs_that_fan_out_into_themselves_finish`; (11) `raster::tests::type1_font_programs_with_long_runs_of_numbers_load_quickly`; (12) `raster::tests::degenerate_annotation_appearances_are_skipped`; (13) `raster::tests::highlights_without_an_appearance_are_drawn`; (14) `raster::tests::malformed_simple_font_widths_keep_later_widths_and_the_font`, `raster::tests::huge_simple_font_first_char_terminates`; (15) `raster::tests::annotation_appearance_box_maps_onto_rect`; (16) `raster::tests::clipping_path_applies_after_any_painting_operator`; (17) `raster::tests::dropping_the_pool_cancels_its_renders`, `raster::tests::the_watchdog_stops_the_render_it_gives_up_on`; (18) `raster::tests::page_contents_and_nested_forms_share_one_budget`, `raster::tests::content_painted_again_and_again_keeps_drawing`, `raster::tests::sampled_functions_with_billions_of_samples_are_refused`; (19) `raster::tests::mesh_shadings_far_off_the_page_render`, `raster::tests::many_overlapping_mesh_triangles_finish`, `raster::tests::mesh_shadings_with_many_patches_or_no_rows_finish`; (20) `raster::tests::function_limits_calculator_arithmetic_and_depth`, `raster::tests::function_limits_public_construction_work_and_depth`, `raster::tests::function_limits_stitching_cycles_are_refused_and_shared_children_work`, `raster::tests::function_limits_invalid_calculator_keeps_the_page_renderable`; (21) `raster::tests::cids_a_substitute_lacks_are_not_drawn_as_other_glyphs`; (22) `raster::tests::variation_sequences_draw_their_kanji_in_a_substitute`; (23) `raster::tests::axial_and_radial_shadings_draw_as_native_gradients`; (24) `raster::tests::tiles_match_full_render`, `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel` (both decode through the cache), `raster::tests::decoded_images_with_identical_dictionaries_keep_their_own_pixels`, `raster::tests::decoded_images_under_a_transfer_function_are_not_shared`; (25) `text::tests::actual_text_replaces_the_glyphs_it_marks_in_every_writing_direction`, `text::tests::actual_text_follows_the_pdf_rules_for_marked_content`; (26) `raster::tests::accented_letters_the_standard_stand_ins_lack_are_built_from_their_parts`, `raster::tests::comma_below_letters_in_standard_fonts_draw_a_comma_under_the_letter`; (27) `text::tests::truetype_without_an_encoding_reads_its_codes_as_win_ansi`; (28) `raster::tests::spot_colour_images_run_their_tint_transform_once_per_sample_value`, `raster::tests::images_converted_through_a_table_keep_every_samples_colour`, `raster::tests::a_malformed_tint_for_an_unused_sample_keeps_the_used_colours`; (29) `raster::tests::reading_colors_keep_highlight_annotations_readable`; (30) `text::tests::the_annex_d2_alias_codes_read_as_an_ordinary_hyphen_and_space`; (31) `raster::tests::shadings_with_large_sampled_functions_paint_quickly`, `raster::tests::sampled_functions_interpolate_their_grid_as_before`; (32) `raster::tests::decoded_images_serve_every_size_they_are_drawn_at`; (33) `raster::tests::patch_meshes_keep_their_corner_colours`; (34) `raster::tests::spot_colour_images_run_their_tint_transform_once_per_sample_value`; (35) `mesh_extent_tests::{a_mesh_paints_its_triangles_alone, a_mesh_keeps_the_graphics_state_alpha, a_mesh_off_the_canvas_paints_nothing}` (`cargo test -p hayro`); (36) `raster::tests::mesh_triangles_sharing_an_edge_leave_no_seam`; (38) `raster::tests::default_colour_spaces::device_rgb_operators_draw_in_default_rgb`, `raster::tests::default_colour_spaces::device_cmyk_operators_draw_in_default_cmyk`, `raster::tests::default_colour_spaces::device_gray_operators_draw_in_default_gray`, `raster::tests::default_colour_spaces::device_images_draw_in_the_default_colour_spaces`, `raster::tests::default_colour_spaces::device_shadings_draw_in_the_default_colour_spaces`, `raster::tests::default_colour_spaces::an_image_drawn_with_and_without_a_default_keeps_both_colours`, `raster::tests::default_colour_spaces::forms_inherit_the_default_colour_spaces_they_do_not_override`, `raster::tests::default_colour_spaces::unusable_defaults_leave_device_colour_alone`; (39) `raster::tests::knockout_groups_replace_what_their_elements_cover`; (40) `raster::tests::visibility_expressions_decide_what_a_membership_dictionary_shows`; (41) `raster::tests::a_multiply_highlight_inside_a_transparency_group_keeps_the_text`; (42) `raster::tests::rendering_modes_but_3_and_7_draw_type3_glyphs_as_filled`; (43) `raster::tests::lab_honours_the_space_white_point`, `raster::tests::indexed_palettes_over_lab_keep_their_colours`; (44) `text::tests::identity_to_unicode_names_give_text`; (46) `raster::tests::stencil_masks_are_drawn_at_the_fill_opacity_once`; (47) `raster::tests::a_five_point_polyline_is_not_painted_as_its_bounding_box`, `raster::tests::a_path_that_visits_every_corner_out_of_order_is_not_a_rectangle`, `raster::tests::a_rectangle_is_still_painted_as_a_rectangle`; (48) `raster::tests::icc_profile_cache::icc_profiles_with_identical_dictionaries_draw_their_own_colours`, `raster::tests::icc_profile_cache::icc_profiles_used_again_are_read_once`; (49) `raster::tests::a_font_whose_post_version_has_swapped_halves_is_still_used`; (50) `font::blob::tests::glyph_names_resolve_to_the_first_glyph_with_that_name`; (51) `context::saved_state_tests::repeated_saves_stay_bounded_and_balanced`; (52) `font::cid::tests::w2_run_past_the_largest_cid_keeps_the_rest_of_the_table` (hayro-interpret); (55) `raster::tests::devicen_inks::a_tint_transform_that_cannot_be_evaluated_draws_the_rest_of_the_page_and_warns`, `raster::tests::devicen_inks::a_tint_transform_that_cannot_be_read_falls_back_and_warns`; (56) `raster::tests::invisible_unknown_annotations_and_popups_paint_nothing`; (57) `substitute_widths::a_substitute_keeps_its_glyph_shapes_at_wider_advances`, `substitute_widths::a_substitute_still_narrows_glyphs_to_narrower_advances` (pdfcraft-render `tests/it`); (58) `cid_fallback_query::a_cid_font_fallback_request_carries_its_descendants_style`, `cid_fallback_query::a_cid_font_without_a_descriptor_asks_for_the_default_style` (pdfcraft-render integration tests); (59) `raster::tests::no_rotate_notes_stay_upright_at_their_corner_on_rotated_pages` (hayro-interpret); (61) `stroke_geometry::{degenerate_subpaths_draw_a_round_dot_or_nothing, degenerate_subpaths_leave_the_rest_of_the_path_alone, a_segment_after_h_begins_a_new_subpath, all_zero_dash_arrays_draw_a_solid_line, invalid_dash_arrays_reach_a_device_as_solid, valid_dash_patterns_still_dash, negative_line_widths_reach_a_device_as_zero, negative_line_widths_draw_the_thinnest_line_in_the_stroke_colour}` (pdfcraft-render integration tests); (63) `color::device_cmyk_gray_tests::{each_ink_darkens_by_its_iso_weight, ink_past_full_coverage_is_black_and_bad_components_read_as_zero}` (hayro-interpret), `it::luminosity_group_space::{black_ink_in_a_device_cmyk_group_masks_fully_and_no_ink_shows_fully, each_process_ink_in_a_device_cmyk_group_masks_by_its_weight, a_device_cmyk_backdrop_colour_masks_by_its_gray, gray_and_rgb_groups_mask_as_before, device_cmyk_on_the_page_keeps_its_display_colour}` (pdfcraft-render); (64) `type3_text_clip::{clip_only_type3_text_is_not_rendered_and_leaves_no_clip, invisible_type3_text_is_not_rendered, other_modes_render_type3_glyphs_filled_and_never_clip, only_outline_glyphs_shape_a_clip_shared_with_type3_text, self_nesting_type3_text_in_a_clip_mode_stays_bounded}` (`cargo test -p pdfcraft-render --test it`), `raster::tests::rendering_modes_but_3_and_7_draw_type3_glyphs_as_filled`, `text::tests::clipping_mode_type3_text_is_kept_by_the_ocr_filter`; (65) `it::zero_area_fill_clip` (`crates/render/tests/it/zero_area_fill_clip.rs`); (66) `separation_all::{separation_all_fills_paint_the_complemented_tint_as_gray, separation_all_strokes_paint_the_complemented_tint_as_gray, separation_all_images_paint_each_sample_as_the_complemented_gray, separation_all_shadings_paint_the_complemented_gray, separation_none_paints_nothing, a_named_separation_still_paints_through_its_alternate, a_device_n_space_naming_all_still_paints_through_its_alternate}` (`cargo test -p pdfcraft-render --test it`); (71) `raster::tests::an_indexed_lookup_table_is_read_in_every_legal_form` (pdfcraft-render); (72) `raster::tests::an_uncoloured_pattern_uses_its_underlying_space_in_every_form` (pdfcraft-render); (73) `raster::tests::the_jbig2_images_of_a_page_share_one_allowance`, `a_picture_whose_jbig2_mask_is_past_the_pages_allowance_is_not_drawn`, `a_picture_whose_jbig2_mask_a_decoder_limit_refuses_is_not_drawn`, `a_jbig2_image_drawn_on_its_own_that_a_limit_refuses_is_a_failed_image`, `a_limit_refusal_says_nothing_of_the_next_image`, `a_jpx_picture_whose_jbig2_mask_a_limit_refuses_stays_out_at_every_size` and `a_pages_jbig2_allowance_ends_with_the_page` (pdfcraft-render); (74) `raster::tests::{a_chain_of_colour_spaces_ends, colour_spaces_are_read_to_the_limit_of_their_nesting, a_chain_built_on_spaces_already_read_ends, a_profile_read_at_the_limit_keeps_its_alternate_for_a_read_nearer_the_top}` (pdfcraft-render); (75) `raster::tests::a_soft_hyphen_a_substitute_lacks_draws_its_hyphen` (pdfcraft-render); (76) `raster::tests::non_embedded_arial::{an_arial_the_pdf_does_not_embed_draws_the_glyphs_its_codes_name, codes_of_other_fonts_are_not_read_in_the_macintosh_order}` (pdfcraft-render); (77) `euro_width::the_euro_fits_its_standard_advance`, `euro_width::two_euros_stay_apart`, `euro_width::a_slanted_euro_fits_its_standard_advance`, `symbol_dingbats_width::{symbol_glyphs_keep_their_standard_advances, zapf_dingbats_glyphs_keep_their_standard_advances}` (pdfcraft-render `tests/it`), `dingbat_check_box::a_check_box_caption_check_is_drawn_at_its_standard_advance` (pdfcraft-engine `tests/it`); (78) `raster::tests::{fills_of_one_pattern_setting_share_its_cell, fills_of_interleaved_pattern_settings_each_show_their_own_cell, an_uncoloured_pattern_shows_each_settings_colour}` (pdfcraft-render); (79) `raster::tests::a_symbolic_truetype_font_without_an_encoding_reads_its_glyph_names`, `pdf::tests::a_symbolic_truetype_font_without_an_encoding_reads_its_glyph_names` (pdfcraft-fonts, the editor's reading by the same rules) ; (80) `crates/render/tests/it/indexed_lookup.rs` (`cargo test -p pdfcraft-render --test it indexed_lookup`), `raster::tests::indexed_lookup_cache`; (82) `raster::tests::a_soft_mask_far_larger_than_where_it_is_drawn_is_shrunk_once`, `raster::tests::an_averaged_down_soft_mask_follows_its_samples_and_its_drawn_size`, `raster::tests::decoded_images_serve_every_size_they_are_drawn_at` (pdfcraft-render); (83) `raster::tests::truetype_loca_format::a_truetype_font_with_an_out_of_range_loca_format_draws_its_glyphs` (pdfcraft-render); (84) `text::tests::an_embedded_adobe_collection_font_reads_through_its_ucs2_cmap`, `every_adobe_collection_reads_through_its_own_ucs2_cmap` (GB1, CNS1, Korea1, Identity-V, `/H` over CFF) and `a_font_outside_the_adobe_collections_gets_no_text_from_a_ucs2_cmap` (pdfcraft-render); (85) `text::tests::{a_tounicode_written_as_cid_ranges_gives_text, a_tounicode_bf_entry_wins_over_a_cid_entry_for_the_same_code}` (pdfcraft-render); (86) `widgets_above_annotations::a_widget_is_drawn_above_the_comments_on_its_page` (pdfcraft-render `tests/it`); (87) `raster::tests::type3_proc_cache::{a_type3_glyph_shown_again_decodes_its_procedure_once, a_procedure_over_64_kib_is_decoded_for_each_copy, the_procedures_one_cache_keeps_stop_at_32_mib, fonts_with_the_same_glyph_name_keep_their_own_procedures}` (pdfcraft-render); (88) `raster::tests::non_embedded_arial::{a_times_new_roman_the_pdf_does_not_embed_draws_the_glyphs_its_codes_name, codes_of_other_fonts_are_not_read_in_the_macintosh_order}` (pdfcraft-render); (89) `raster::tests::a_form_that_draws_itself_is_drawn_once`, `raster::tests::a_form_that_reaches_itself_through_a_pattern_or_a_glyph_is_drawn_once` (pdfcraft-render); (90) `raster::tests::type3_proc_widths::{a_type3_font_without_widths_advances_by_its_glyph_procedures, a_code_outside_first_char_to_last_char_still_has_width_zero, widths_the_font_gives_are_kept, a_code_without_a_usable_procedure_width_still_advances_nothing, a_type3_font_without_widths_is_reported}` (pdfcraft-render); (91) `raster::tests::failed_image_decodes::{a_picture_that_does_not_decode_is_decoded_once_however_often_it_is_drawn, a_picture_that_does_not_decode_is_decoded_once_at_each_size, a_stencil_mask_that_does_not_decode_is_decoded_once_however_often_it_is_drawn, a_picture_whose_soft_mask_does_not_decode_draws_unmasked_decoded_once, a_picture_that_decodes_is_still_decoded_once_and_drawn_every_time, a_picture_left_out_for_the_pages_allowance_draws_on_the_next_page, a_picture_whose_jbig2_mask_a_limit_refuses_is_decoded_once_however_often_it_is_drawn, a_picture_whose_jbig2_mask_is_refused_for_its_work_is_decoded_at_every_draw}` (pdfcraft-render); (92) `text::tests::agl_unicode_from_name_rule_reads_text` (pdfcraft-render); (93) `cid_cff_unusable_font_dict::{glyphs_of_a_usable_font_dict_draw_beside_an_unusable_one, a_program_with_no_usable_font_dict_draws_no_square}` (pdfcraft-render integration tests); (94) `raster::tests::a_font_without_a_subtype_is_drawn_by_its_base_font` (pdfcraft-render); (98) `symbol_mt_builtin_encoding::{symbol_mt_draws_symbols_through_the_built_in_encoding, a_name_that_only_starts_with_symbol_is_not_symbol, symbol_mt_applies_its_differences, an_embedded_symbol_mt_draws_its_own_program}` (pdfcraft-render integration tests); (99) `raster::tests::thin_patches_of_a_mesh_in_a_tight_path_are_all_painted` (pdfcraft-render); (100) `text::tests::numbered_glyph_names_read_as_their_own_code`, `text::tests::numbered_type3_glyph_names_read_as_their_own_code`, `text::tests::glyph_names_outside_the_glyph_list_still_read_as_text` (pdfcraft-render); (101) `raster::tests::symbolic_truetype_mac_roman_text::{a_symbolic_truetype_font_in_the_macintosh_order_reads_its_codes_as_mac_roman, winansi_codes_of_a_font_in_the_macintosh_order_read_as_before, a_symbolic_truetype_font_without_a_1_0_subtable_reads_as_before, a_1_0_subtable_selecting_other_glyphs_than_the_drawn_ones_is_not_read, a_font_that_names_its_glyphs_is_not_read_by_their_order, a_symbol_or_zapfdingbats_font_in_the_macintosh_order_gets_no_mac_roman_reading, differences_naming_notdef_clear_the_mac_roman_reading_for_its_code, a_base_encoding_name_this_reader_does_not_know_keeps_the_mac_roman_reading_off}` (pdfcraft-render), `pdf::tests::a_symbolic_truetype_font_in_the_macintosh_order_reads_its_codes_as_mac_roman` (pdfcraft-fonts); (102) `text::tests::tracked_vertical_latin_stays_one_line` (pdfcraft-render); (81) `raster::tests::replies_are_not_drawn_but_their_comment_and_group_members_are`, `raster::tests::an_unknown_or_malformed_rt_is_a_reply_and_a_widget_with_irt_still_draws` (hayro-interpret); (103) `raster::tests::the_view_auto_state_sets_a_groups_state_on_screen`, `raster::tests::layer_toggles_and_print_renders_are_not_the_view_auto_state` and `raster::tests::malformed_view_auto_state_is_ignored` (pdfcraft-render) |
 | hayro | 0.7.1 | Apache-2.0 OR MIT | (1) `RenderSettings::{x_offset, y_offset}` to render one tile of a large page; (2) images over `MAX_IMAGE_PIXELS` (2^28) are skipped (a fuzzed `/W 4294967295` hung in resampling); (3) `tiling_cell_scale` keeps a tiling pattern's cell pixmap within 3000 px a side whatever its `/XStep`/`/YStep` (a fuzzed step far beyond `/BBox` allocated 2 GB); (4) stroke widths clamped to 4 × (canvas width + height) device pixels (a fuzzed `/LW 9223372036854775807` allocated 10 GB in stroke expansion); (5) `usable_dash_pattern`: a stroke whose dash pattern could cut it into more than `MAX_DASHES_PER_STROKE` (250,000) pieces, counting kurbo's restart of the pattern at every subpath and `ClosePath`, is drawn solid (a fuzzed `/D [[11] 0]` on a line from x = 92234775807 allocated over 5 GB, `[0.000001] 0 d` on a 20 pt line over 10 GB); (6) a dash pattern with a negative or non-finite entry, or a period that isn't positive, is drawn solid (`[-1 -1] 0 d` looped for ever in kurbo); (7) `render_size` and `render_into`: render into a buffer the caller allocates (PdfCraft renders into pixel-aligned memory that the GUI takes over as texture data); `render` is `render_into` on a new pixmap; (8) checked image source/target/RGBA, alpha-premultiplication scratch and intermediate sizes before resampling, finite transforms and exact source/mask buffers; sources wider than u16 may shrink before backend limits, with a 2^20 source-axis cap and conservative 128 MiB filter-planning estimate; an over-limit or failed resize keeps the original image resolution and geometry when the source fits the backend, otherwise skips it, with a logged warning; staging, resampling output/scratch, RGBA conversion and padding buffers use fallible reserves; (9) `may_paint_canvas`: a fill or stroke whose control-point box, grown by how far its paint reaches past the path (half the stroke width times the larger of the miter limit and √2) plus 0.5 user units and 2 pixels, misses the canvas is not drawn, so a tile no longer strokes and fills every path of its page (item 5 of #623); `set_skip_offscreen_paths` turns this off for the regression test; (10) `/Interpolate` governs the pre-resize too (#624): a minified image that does not request interpolation is pre-resized with nearest-neighbour (since (21), only inside Type 3 glyphs), planned without the Catmull-Rom filter limits (`image_resampling_size` takes the flag); a Type 3 glyph image is sampled bicubically only when interpolated; a minified image with a matching soft mask is nearest-sampled straight into premultiplied RGBA; (11) `may_paint_rect`: an image whose stream-size box, mapped to the device, misses the canvas is skipped before decoding (decoded data can only shrink against that box), so a tile of an image-heavy page no longer decodes, resamples and rasterizes every image on it; (12) preview renders (`InterpreterSettings::preview`: backdrops, thumbnails, grid cells, signature-drag backgrounds) skip images under `PREVIEW_MIN_IMAGE_AREA` device pixels, while final renders always draw them; (13) reading colours (#897): `RenderSettings::color_replacement` takes a `ColorReplacement` (text colour, background, `only_black`, `line_art`) that remaps solid text and line-art paint while rendering, glyph outlines counting as text and stencil-mask ink as line art; images, image alpha masks, soft masks and pattern cells keep their colours; `render_pdf` gains a `color_replacement: Option<ColorReplacement>` argument (pass `None` for true colours); the upstream-only `[dev-dependencies.log]` entry is removed from `Cargo.toml` (log is a normal dependency since the logging patch), so `cargo test -p hayro` runs this crate's unit tests; (14) a shrunk image that is interpolated (or, since (21), area-averaged) and whose axes lie along the device's (upright, mirrored or a quarter turn, as on a page under `/Rotate`) is snapped to whole device pixels: shrunk once to its rounded device rectangle (halves round up, so a tile snaps an edge where the whole page does) and drawn 1:1 from the rounded corner, instead of a ceil-sized raster resampled again at a fractional scale and offset (`snap_minified_image`; scans looked soft next to Acrobat, and until #5530 a turned one still did, up to 200 grey levels off the same page drawn upright). An image counts as axis-aligned when the terms the snap drops move its far edges by at most a hundredth of a device pixel (`SNAP_SKEW`), not by a tolerance on the coefficients, which let a slight skew of a very wide image through; and the snapped 1:1 transform is used only when the shrink produced the snapped size, so a failed resize keeps the full transform instead of drawing the source raster at its source size; (15) a soft mask of another size than its image is filtered when shrunk, whatever its `/Interpolate` (#1649): such a mask carries the shape on its own (Word saves text as a tiny black image with a glyph-bitmap mask), and nearest-neighbour dropped every stroke thinner than the shrink factor; (16) under a soft mask or a blend mode, axial and radial shadings are sampled instead of drawn as native gradients (#2128): vello_cpu 0.0.8 copies an opaque gradient over fully covered tiles without the mask or blend mode, so PowerPoint's faded gradient fills came out solid; (17) the renderer keeps annotation paints out of the reading-colours mapping between `begin_annotations` and `end_annotations` (#1548); (18) the page renders as one transparency group; under reading colours its background is painted inside it as the initial backdrop, so a Multiply highlight blends with the dark background instead of staying an opaque block, and otherwise the background stays outside, so a blend mode over an empty part of the page keeps its colour instead of blending with the white paper (#2970); (19) `set_paint` samples a mesh shading's texture over its triangles alone (`EncodedShadingPattern::extent`, padded rather than repeated) and skips a mesh with none on the canvas: a BricsCAD plan's 310 one-triangle `sh` each covered the whole tile, 2 s per 1024 px tile at any zoom (the watchdog gave the page up on a busy machine), now about 70 ms; (20) a tiling pattern whose step is too large for a cell pixmap, where what is painted (a fill, or a stroke with its width) can only show the first cell (PowerPoint's `/XStep 2147480100` for a picture fill drawn once), has its `/BBox` drawn at full scale with a transparent border and padded instead of tiled (`shows_one_cell`; a cell whose scale isn't finite and positive, from a `/BBox` too thin to divide by, keeps the old path: `usable_cell_scale`); shrinking the cell to fit the 3000 px limit of (3) left the picture under a pixel, so network diagrams lost their pictures (#3349); (21) an image that does not request interpolation and is drawn below its resolution, outside a Type 3 glyph, is shrunk by area averaging (`area_shrink`: each device pixel the coverage-weighted mean of the samples it covers, in 16.16 fixed point whose weights sum to exactly one, premultiplied when the image has a mask; a soft mask no larger than the image is first sampled onto the image's grid by `mask_on_image_grid` (nearest-neighbour, or bilinearly when the mask asks for `/Interpolate`, so its edge stays as smooth as an enlarged mask's), so its colour and mask are averaged together instead of the averaged colour of transparent samples showing under a mask layer at the mask's edges) to its snapped device rectangle, instead of nearest-neighbour: `/Interpolate` asks for smoothing only when an image is enlarged (ISO 32000-2 §8.9.5.3), and nearest-neighbour kept one sample in N per axis, so the text of a 300 dpi scan at 100% lost most of its strokes (sampling them again at a fractional offset dropped more). PicScale's `Box` and `Area` filters were not used: shrinking, both average a window four target pixels wide. On a 13-page 300 dpi scan every rendered sample at 96, 120 and 192 dpi is within 1 of the exact area average (it was up to 255 off, 17-23% of samples by more than 1). A snapped image whose shrink failed keeps the full transform, so it is not drawn at its source size. The shrink never enlarges: a side drawn at or above its resolution (an image shrunk across and stretched down, as a 204 × 98 dpi fax is) keeps its samples for the sampler. Each target row averages the whole source rows it covers (contiguous, cheap) and is then shrunk across with taps worked out once per image, which made the shrink about three times faster (a 300 dpi page at 96 dpi: 25 ms, nearest-neighbour 11 ms); working a row at a time (`area_shrink_rows`) keeps its work memory to a few rows. An image with a soft mask, a stencil's ink included, is premultiplied a source row at a time as it is averaged (`area_shrink_premultiplied`), never as a full-resolution RGBA copy: a 10718 × 13701 stencil shown at page size peaked at 1.16 GB with that copy and peaks at 1.03 GB without it, as with nearest-neighbour. A source with a side over `MAX_RESAMPLING_SOURCE_SIDE` (2^20) keeps (10)'s nearest-neighbour shrink, and `area_shrink` refuses it, so its accumulator row and tap table stay a few times one source row (a 2^27 × 2 image of zeros is a tiny file); (22) knockout groups: while one is innermost, fills, strokes, glyph outlines and shadings are drawn with `Compose::Copy` (weighted by coverage), so each element replaces what earlier elements of the group drew instead of compositing over it; an image or nested group, drawn into a layer of its own, first has what is under its shape cleared (`knockout_image` for an unmasked image's rectangle, only when `draw_image` will draw it, decoded at the size it is drawn; a knockout erase pass that draws a nested group's content with every paint clearing instead of painting, a shading fill's clear clipped to the shading's `/BBox` as its paint is) and then composites over it (#2971); (23) backport of hayro 0.8: shadings that `as_svg_gradient` can represent are painted as a `vello_cpu` linear or two-point radial gradient instead of a texture sampled pixel by pixel through the shading function (InDesign fades are luminosity soft masks of one full-page axial `sh`: 40 on a report page took 15 s at 144 dpi, now under 1 s); without upstream's half-pixel shift, which suits vello_cpu 0.3 but moves 0.0.8's gradients off pixel centres; (25) a tiling cell is drawn at the scale that makes one `/XStep` (`/YStep`) exactly the cell pixmap's whole number of pixels (`tiling_cell_pixels`, at least 1 and at most the cap), so the repeated pixmap puts cells at whole multiples of the step at any device scale; drawing at the unrounded scale repeated the cell up to half a pixel off at every step, and the error grew with distance from the pattern's origin (ISO 32000-2 8.7.3.1); (28) an image of page-scan size (`SMOOTHED_IMAGE_SIDE`: 512 samples or more on its shorter side) that does not request interpolation is drawn with `ImageQuality::Medium` (bilinear, as interpolated images are) when enlarged by more than 1% on either side (`SMOOTHED_IMAGE_SCALE`: a scan drawn at its resolution can come out a few ulps above 1, and blurred by half a pixel at a half-pixel offset), also when the other side is shrunk (the area shrink leaves that side at 1:1), outside a Type 3 glyph: scans rarely set `/Interpolate`, and drawn nearest-neighbour every sample of a zoomed scan became a block, so its text had staircase edges; icons, QR codes and pixel art keep their hard pixels. Bicubic (`High`) looked the same on a zoomed 300 dpi scan and drew four 1024 px tiles at 400% in 267 ms against 50 ms; (30) a stencil mask painted with a pattern is drawn under a clip of its device rectangle, padded by two pixels: the pattern in an isolated layer, cut to the stencil by a layer holding it composited with `Compose::DestIn` (drawn without a Type 3 glyph's image rules, as the sub-render it replaces was), instead of through a canvas-sized luminance mask rendered for every draw; and a coloured tiling pattern's cell pixmap, repeated or shown once under patch (20), is drawn once per setting of the pattern and cell scale (`Renderer::tiling_cell`, `TilingCells`, eight entries per renderer, keyed by hayro-interpret patch (78)'s `TilingPattern::instance`) instead of once per fill, where every cell was kept until the page was composited. pdf.js issue 8078 paints 73,047 16 × 16 stencils with one pattern whose cell is 3.5 MB at 36 dpi: it ran out of memory after 5 minutes and now renders in about 5 s. For its tests, `offscreen_draws` counts on each thread the tiling cells drawn and the pixels of every pixmap drawn offscreen (all made by `offscreen_pixmap`), so a page's cost is checked by count, not by time; (31) `RenderSettings::max_coverage` keeps the rasterizer to that many coverage values for the page (vello_cpu patch 1), and a page whose paths it left out says so with `InterpreterWarning::ContentTruncated` | (1) `raster::tests::tiles_match_full_render`; (2) `raster::tests::absurd_image_dimensions_are_skipped`; (3) `raster::tests::tiling_cells_stay_small_whatever_the_step`; (4) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (5) `raster::tests::dash_patterns_that_cut_a_stroke_into_billions_of_pieces_render`; (6) `raster::tests::invalid_dash_patterns_terminate_and_are_drawn_solid`; (7) `raster::tests::pixels_are_a_plain_renders_bytes_in_a_buffer_a_gui_can_take_over`; (8) `raster::tests::image_resampling_rejects_anisotropic_target_growth`, `raster::tests::image_resampling_bounds_intermediate_before_planning`, `raster::tests::image_resampling_rejects_invalid_sources_and_scales`, `raster::tests::image_resampling_keeps_valid_sizes_and_exact_limits`, `raster::tests::resampling_fallback_preserves_original_geometry_and_pixels`, `raster::tests::image_resampling_wide_sources_shrink_before_backend_side_limits`, `raster::tests::image_resampling_wide_transparent_sources_still_shrink`, `raster::tests::image_resampling_padded_backend_dimensions_stay_checked`, `raster::tests::image_resampling_mismatched_alpha_mask_keeps_pixels_and_placement`; (9) `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel`; (10) `raster::tests::non_interpolated_images_are_not_smoothed_when_minified`, `raster::tests::non_interpolated_gray_images_are_not_smoothed_when_minified`, `raster::tests::non_integer_minification_averages_the_columns_each_pixel_covers`, `raster::tests::non_integer_minification_averages_colour_and_mask_together`, `raster::tests::non_interpolated_alpha_images_keep_their_colours_and_mask_when_minified`, `raster::tests::non_interpolated_type3_glyph_images_are_not_smoothed_when_minified`, `raster::tests::image_resampling_nearest_accepts_wide_sources_the_filter_refuses`, `raster::tests::wide_non_interpolated_sources_draw_after_shrinking`; (11) `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel`; (12) `raster::tests::preview_renders_skip_tiny_images_but_finals_draw_everything`; (13) `color_replacement_tests::{black_maps_to_text_colour, white_maps_to_background, midgrey_interpolates, alpha_copied_verbatim, only_black_threshold, line_art_false_skips_paths_but_not_text}`, `color_replacement_render_tests::{color_replacement_maps_text_and_line_art, color_replacement_maps_stencil_mask_ink}`; (14) `raster::tests::minified_image_edges_snap_to_whole_pixels`, `raster::tests::a_tile_snaps_half_pixel_image_edges_as_the_whole_page_does` (`cargo test -p hayro`), `raster::tests::a_turned_or_mirrored_minified_image_snaps_to_whole_pixels`, `rotated_image_snap::a_shrunk_image_on_a_turned_page_is_the_upright_render_turned` (`cargo test -p pdfcraft-render --test it`), `renderer::snap_tests::a_skew_that_moves_a_far_edge_is_not_snapped` (`cargo test -p hayro`); (15) `raster::tests::shrunk_soft_mask_larger_than_its_image_keeps_thin_strokes`; (16) `raster::tests::soft_mask_applies_to_a_shading_pattern_fill`; (17), (18) `raster::tests::reading_colors_keep_highlight_annotations_readable`; (19) `mesh_extent_tests::{a_mesh_paints_its_triangles_alone, a_mesh_keeps_the_graphics_state_alpha, a_mesh_off_the_canvas_paints_nothing}` (`cargo test -p hayro`); (20) `raster::tests::a_tiling_pattern_drawn_once_shows_its_cell`, `raster::tests::a_large_step_still_tiles_where_the_next_cell_shows`, `raster::tests::a_tiling_cell_too_thin_to_scale_keeps_the_old_path`; (21) `raster::tests::non_interpolated_minification_keeps_thin_strokes`, `raster::tests::non_integer_minification_averages_the_columns_each_pixel_covers`, `raster::tests::non_integer_minification_averages_colour_and_mask_together`, `raster::tests::non_interpolated_minification_does_not_bleed_transparent_colour`, `raster::tests::a_smaller_soft_mask_does_not_bleed_transparent_colour_when_minified`, `raster::tests::an_interpolated_smaller_soft_mask_stays_smooth_when_its_image_is_minified`, `raster::tests::a_shrunk_stencil_mask_keeps_thin_strokes`, `raster::tests::minified_image_edges_snap_to_whole_pixels`, `raster::tests::an_image_shrunk_one_way_and_stretched_the_other_is_still_averaged`, `raster::tests::wide_non_interpolated_sources_draw_after_shrinking`, `renderer::area_shrink_tests` (`cargo test -p hayro`); (22) `raster::tests::knockout_groups_replace_what_their_elements_cover`; (23) `raster::tests::axial_and_radial_shadings_draw_as_native_gradients`; (25) `tiling_cell_placement::{far_cells_of_a_fill_sit_at_whole_steps, far_cells_sit_at_whole_steps_under_a_turned_scaled_matrix, far_cells_of_a_stroke_sit_at_whole_steps, a_cell_pixmap_spans_exactly_one_step}` (`cargo test -p pdfcraft-render --test it`); (28) `raster::tests::large_non_interpolated_images_are_smoothed_when_enlarged`, `raster::tests::small_non_interpolated_images_keep_hard_pixels_when_enlarged`, `raster::tests::a_scan_shrunk_one_way_is_smoothed_the_way_it_is_stretched`, `raster::tests::a_scan_drawn_a_rounding_error_above_its_resolution_stays_sharp`; (30) `raster::tests::{a_patterned_stencil_mask_paints_only_where_it_inks, a_patterned_stencil_mask_under_a_soft_mask_is_masked_once, a_patterned_stencil_mask_in_a_type3_glyph_keeps_thin_strokes, many_patterned_stencil_masks_draw_no_page_sized_masks, fills_of_one_pattern_setting_share_its_cell, fills_of_interleaved_pattern_settings_each_show_their_own_cell, an_uncoloured_pattern_shows_each_settings_colour}`; (31) `raster::tests::coverage_budget::a_page_past_its_coverage_leaves_the_rest_out_and_says_so` |
 | hayro-jbig2 | 0.3.0 | Apache-2.0 OR MIT | (1) at most 2^28 pixels per bitmap and page bitmap, and 2^25 cells per halftone grid and grayscale image (each side could be 65535: 4.3 billion pixels decoded one by one, and a 4-byte value per cell); (2) at most as many symbol pixels per symbol dictionary as the largest page bitmap holds, 2^28 (a fuzzed dictionary decoded for minutes; each symbol now pays for its pixels out of the stream's decoding work and is held in the retained bitmaps, and at the earlier 2^26 the soft mask of a scanned drawing, one dictionary of 7,559 symbols, was refused: #6722), and a refusal by one of the decoder's limits is told apart from damaged data (`DecodeError::is_limit`, `OverflowError::BitmapLimit`); (3) a symbol dictionary's height classes are capped at one per new symbol and its export runs at `2 × symbols + 1`, each plus `EXTRA_EMPTY_STEPS` (1024): an empty height class or a zero-length export run doesn't advance, and past the end of its data the arithmetic decoder can decode them for ever (one changed byte hung the renderer); (4) a segment header's long-form referred-to segment count is capped at `u16::MAX` and a larger count is refused before its retention or referred-to bytes are read: the 29-bit count went straight to `Vec::with_capacity`, a reservation of about 2 GiB whose failure aborts the process (from storytold/craft-libs#176); (5) what a page's segments hold for later ones (intermediate regions, pattern and symbol dictionaries with their headers and retained contexts, and Huffman tables) is at most 64 MiB, two square bitmaps of 16,384 a side (`MAX_RETAINED_WORDS`), and a dictionary's new and exported symbols are counted against it as they are made: each was bounded on its own, but a few dozen bytes an intermediate region held 33 MB each, and 8 MiB symbols exported again and again killed the process, so a few kilobytes could exhaust memory; (6) a segment may refer to at most 2^20 symbols, checked before any are collected: references may repeat, and 65,535 of them to one dictionary, in a 78 KB stream, asked for 17 GB; (7) a pattern dictionary keeps at most 16 MiB of shifted copies, which only speed up drawing, and none that wouldn't fit what the page has left (`MAX_SHIFTED_WORDS`); (8) a custom Huffman table has at most 2^16 lines, and a stream with its globals at most 2^20 segments and 2^22 references, checked as they are read: both grew before anything counted them, and PDFs of a kilobyte or so reached 5 GB and more behind nested Flate; (9) a page past the bounds of (1) is refused when the stream is opened: a caller sizes its output from the header before the page bitmap is made, and an Indexed image in a 743-byte PDF asked for 137 GB, which aborts; (10) a stream may ask for at most 2^30 units of decoding work, four of the largest pages, about 6 s to 17 s (`MAX_WORK`): decoding a bitmap costs a pixel each and 4 a row, copying one a word each and 1 a row, and each integer an item reads costs 38, what one takes at worst, so one with no pixels pays too, before it is decoded: each bitmap was bounded, but nothing bounded how many there were, and a 795-byte PDF took 265 s; (11) `Image::decode_within` spends from what a run of images may still do, starting with its page's pixels, and `charge_reading` charges reading a stream and its globals before anything is parsed, so an operation over a document can bound what `MAX_WORK` bounds for one image, and images that fail or decode nothing add up too: a file of thousands of images made to reach that limit took as many times as long; (12) adding to a location, a reference offset, a symbol's corner or a Huffman range line near the end of an `i32`, and negating a decoded integer of 2^31, overflowed: a panic wherever overflow is checked. The refinement context, a text region's corners, the integer decoder and the Huffman table wrap, as a release build did, and `Bitmap::combine` saturates, which comes to the same, as a location that overflows is past the end of any page. What is drawn doesn't change; (13) a bitmap filled with a default pixel of 1 (a page, or an intermediate text or halftone region) had 1s past its width in the last word of each row, and a refinement, which reads its reference a word at a time, read them as pixels where the standard has 0 (6.3.5.2): refining such a reference not a multiple of 32 wide decoded to other pixels than were coded, release builds too. `Bitmap::clear_padding` clears those bits when a bitmap is filled with 1s, as cutting symbols and patterns from a collective bitmap already did. Ghostscript reads the test's page and text streams as they decode now; (14) a region's location is unsigned (5.4.4), so one past `i32::MAX` is off the page, where the decoder took it for a signed one: a region there was drawn back onto the page from the left or the top (at 0xFFFFFFFC, four pixels left of it), and a refinement there, of the page or of a region at the same place (7.4.7.5), was refused as an overflow, and the page with it. `Bitmap::combine_region` keeps such a location past the page. A refinement of another region refines it where it is, as Table 35 has it (GRREFERENCEDX and GRREFERENCEDY 0), whatever the two locations say; a refinement of the page, see (16); (15) a refinement whose reference is offset right of it (GRREFERENCEDX above 0, which a refined text instance has from a wider bitmap, Table 12, and a refined symbol from an RDX above 0, Table 18) read the reference's first 32 columns as 0: `RefinementContextGatherer::maybe_reload_buffers` emptied its buffers left of the reference and didn't load them again at its first column. Such a refinement decoded to other pixels than were coded, or failed and lost the page. Left of the reference the buffers now keep the words of its first column each row starts with; with an offset of 0 or less nothing changes; (16) a refinement of the page refines "the current contents of the page buffer, restricted to the area of the page buffer specified by this segment's region segment information field" (7.4.7.4), at an offset of 0 (Table 35): `Bitmap::area` copies that area a word at a time, 0 off the page and past its width whatever the padding of its rows holds, and every refinement region reads its reference at offset 0. The page around the area was read too, so a refinement of the page decoded to other pixels than were coded, and one wider or taller than the page was refused. And `RefinementContextGatherer::start_row` loads the reference's words a column left of where a row starts in it, as the reload would, not from column 0: with the reference offset 32 or more left of the refinement (GRREFERENCEDX below −31, as a refined text instance has from a narrower bitmap or an RDX below −31, and a refined symbol from such an RDX), each row's first context read 0 for the reference column it starts at, and from 33 left for the one before it too, and the refinement decoded to other pixels or failed; (17) `Image::new_embedded` reads data that starts with a JBIG2 file header (the ID string `0x97 4A 42 32 0D 0A 1A 0A`, flags and an optional page count, D.4) past it, in the organization the header declares (sequential or random access), its segments counted together with the globals' as (8) has them: ISO 32000-1 7.4.7 has `JBIG2Decode` data in the embedded organization (D.3), but some producers write the file header too, and Acrobat and PDFBox draw such streams. The header's ID string was read as a segment header and the image failed (`unknown or reserved segment type`), so the page drew white | (1) `raster::tests::jbig2_regions_of_billions_of_pixels_are_refused`, `raster::tests::jbig2_halftone_grids_past_their_bound_are_refused`; (2) the nightly `cargo xtask fuzz` finding (about a second at the earlier 2^26 bound; not run at 2^28), `raster::tests::a_symbol_dictionary_holds_as_many_pixels_as_a_page`, and for `is_limit` and `BitmapLimit` `error::pdfcraft_limit_tests`, `bitmap::pdfcraft_limit_tests` and `gray_scale::pdfcraft_limit_tests` (hayro-jbig2); (3) `raster::tests::jbig2_symbol_dictionaries_that_never_advance_terminate`; (4) `segment::tests::test_referred_to_count_is_capped` (`cargo test --manifest-path vendor/hayro-jbig2/Cargo.toml`); (5) `raster::tests::jbig2_regions_held_past_a_pages_bound_are_refused`, `jbig2_symbols_without_pixels_count_towards_a_pages_bound`, `jbig2_retained_contexts_count_towards_a_pages_bound`, `jbig2_huffman_tables_count_towards_a_pages_bound`, `jbig2_new_symbols_count_towards_a_pages_bound`, `jbig2_new_symbols_are_held_to_what_a_page_has_left`, `jbig2_pattern_dictionaries_count_towards_a_pages_bound`, and in the crate (`cargo test --manifest-path vendor/hayro-jbig2/Cargo.toml`) `decode::symbol::tests::exported_symbols_are_counted_before_they_are_copied`, `tests::the_room_left_shrinks_as_segments_are_stored`; (6) `raster::tests::jbig2_segments_referring_to_too_many_symbols_are_refused`; (7) `raster::tests::jbig2_pattern_dictionaries_too_large_to_shift_still_draw`, `jbig2_shifted_patterns_never_refuse_an_image`; (8) `raster::tests::jbig2_huffman_tables_of_too_many_lines_are_refused`, `jbig2_streams_of_too_many_segments_are_refused`, `jbig2_streams_of_too_many_references_are_refused`, and in the crate `tests::the_segments_of_a_stream_and_its_globals_count_together`; (9) `raster::tests::jbig2_pages_past_the_bounds_are_refused_before_anything_is_sized_from_them`, `tests::a_page_past_the_bounds_is_refused_when_opened`; (10) `raster::tests::jbig2_decoding_work_is_counted_item_by_item`; (11) `jbig2::decode::tests::a_run_of_images_spends_its_allowance_down_to_the_step` (pdfcraft-filters); (12) `raster::tests::jbig2_placements_at_the_end_of_an_i32_draw_nothing`; (13) `jbig2::decode::tests::a_refinement_reads_nothing_past_its_references_width` (pdfcraft-filters), and in the crate `tests::a_bitmap_of_1s_has_nothing_past_its_width`; (14) `jbig2::decode::tests::a_region_located_past_i32_max_is_off_the_page` (pdfcraft-filters), and in the crate `tests::a_region_located_past_i32_max_is_off_the_page` and `tests::a_refinement_of_a_region_decodes_the_same_wherever_they_are`; (15) `jbig2::decode::tests::a_refinement_reads_a_reference_right_of_it_from_its_first_column` (pdfcraft-filters), and in the crate `tests::a_refinement_reads_a_reference_right_of_it_from_its_first_column`; (16) `jbig2::decode::tests::a_refinement_refines_the_page_in_its_area_and_any_reference_where_it_is` (pdfcraft-filters), and in the crate `tests::a_refinement_refines_the_page_in_its_area_and_any_reference_where_it_is` and `tests::a_page_area_is_the_page_inside_it_and_0_outside` ; (17) `jbig2::decode::tests::a_stream_with_a_jbig2_file_header_decodes_past_it`, `jbig2::decode::tests::a_truncated_jbig2_file_header_is_an_error`, `jbig2::decode::tests::segments_after_a_jbig2_file_header_count_with_the_globals` (pdfcraft-filters), `raster::tests::a_jbig2_image_with_a_file_header_draws` (pdfcraft-render) |
-| lopdf | 0.45.0 | MIT | (1) PNG predictor rows longer than the data are refused before their buffers are allocated (a fuzzed `/Columns 4294967295` allocated two 4 GiB rows), and empty frames return without row buffers; (2) predictor row widths use saturating arithmetic or reject overflow; (3) sub-byte TIFF Predictor 2 scratch is bounded by the samples present in the input instead of the declared `/Colors`, aligned with [lopdf#589](https://github.com/J-F-Liu/lopdf/pull/589); (4) the object lookup keeps its cycle history through compressed objects, requires an ordinary in-file container, and caps the chain of indirect lookups at 16 (a chain of new objects, each a `/Length` compressed in a container whose own `/Length` names the next, or a stream whose `/Length` names the next stream, overflowed the stack: a dev build's 2 MiB thread within 800 hops); (5) object-stream members are parsed within their own extent (up to the next distinct offset), an entry whose offset repeats an earlier entry's is skipped (so a repeated object number can resolve to its earlier entry), and offsets are processed in index order; (6) `find_latest_trailer`: a rebuild takes a `/Type /XRef` stream dictionary as the trailer when the file has no `trailer` keyword (the latest in the file wins, as a later `trailer` would), so a concatenated or truncated file keeps its /Info and /ID instead of failing to load; a candidate whose /Root is the catalog beats one whose /Root is another dictionary, and an in-file /Root must match its generation (#2365) | (1) `inspect::tests::png_predictor_rows_longer_than_the_data_are_refused_before_allocating`, `inspect::tests::empty_png_predictor_frames_do_not_allocate_rows`; (2) `inspect::tests::tiff_subbyte_predictor_row_width_overflow_is_refused`; (3) `inspect::tests::tiff_subbyte_predictor_scratch_is_bounded_by_available_samples`, `inspect::tests::tiff_subbyte_predictors_keep_components_rows_and_padding`; (4) `inspect::tests::compressed_object_self_container_does_not_recurse`, `inspect::tests::compressed_object_mutual_containers_do_not_recurse`, `inspect::tests::object_stream_length_cycle_does_not_recurse`, `inspect::tests::compressed_object_container_chain_does_not_recurse`, `inspect::tests::compressed_length_chain_does_not_recurse`, `inspect::tests::plain_stream_length_chain_does_not_recurse`, `inspect::tests::compressed_objects_and_indirect_stream_length_still_load`, `inspect::tests::compressed_length_in_a_container_with_an_indirect_length_still_loads`; (5) `inspect::tests::object_stream_member_extents_bound_owned_strings`, `inspect::tests::object_stream_member_extents_preserve_index_order_and_whitespace`; (6) `inspect::tests::rebuilt_file_keeps_the_info_of_its_cross_reference_stream`, `inspect::tests::rebuilt_file_prefers_a_trailer_whose_root_is_the_catalog` |
+| lopdf | 0.45.0 | MIT | (1) PNG predictor rows longer than the data are refused before their buffers are allocated (a fuzzed `/Columns 4294967295` allocated two 4 GiB rows), and empty frames return without row buffers; (2) predictor row widths use saturating arithmetic or reject overflow; (3) sub-byte TIFF Predictor 2 scratch is bounded by the samples present in the input instead of the declared `/Colors`, aligned with [lopdf#589](https://github.com/J-F-Liu/lopdf/pull/589); (4) the object lookup keeps its cycle history through compressed objects, requires an ordinary in-file container, and caps the chain of indirect lookups at 16 (a chain of new objects, each a `/Length` compressed in a container whose own `/Length` names the next, or a stream whose `/Length` names the next stream, overflowed the stack: a dev build's 2 MiB thread within 800 hops); (5) object-stream members are parsed within their own extent (up to the next distinct offset), an entry whose offset repeats an earlier entry's is skipped (so a repeated object number can resolve to its earlier entry), and offsets are processed in index order; (6) `find_latest_trailer`: a rebuild takes a `/Type /XRef` stream dictionary as the trailer when the file has no `trailer` keyword (the latest in the file wins, as a later `trailer` would), so a concatenated or truncated file keeps its /Info and /ID instead of failing to load; a candidate whose /Root is the catalog beats one whose /Root is another dictionary, and an in-file /Root must match its generation (#2365); (7) object parsing builds at most 4,194,304 objects (every array element and dictionary value at any depth, `parser::MAX_OBJECT_NODES`, the same cap as `pdfcraft_cos`) per top-level object, an object stream reads at most 1,000,000 index entries (cos's `/N` clamp), and one load builds at most 8,388,608 objects from all of its object streams together, shared across rayon workers (a decoded stream of `0 0 0 ...` inside the 256 MiB decompression limit built ~120M objects, 10+ GB, and aborted). A lookup parses only the member it wants, so it isn't skipped behind a large member, and a load parses only the members it would add: none its cross-reference table places in another stream (stale copies) and none already loaded as an ordinary object or from an earlier stream. Members the table doesn't list at all are still parsed (a rebuilt table lists no compressed objects) and share the budget, so they can spend it before listed members of the same stream; a load expands its object streams one at a time in object-number order, a stream's members in parallel only when the budget holds all of them and otherwise in index order, so a spent budget skips the same members on every load (#5083) | (1) `inspect::tests::png_predictor_rows_longer_than_the_data_are_refused_before_allocating`, `inspect::tests::empty_png_predictor_frames_do_not_allocate_rows`; (2) `inspect::tests::tiff_subbyte_predictor_row_width_overflow_is_refused`; (3) `inspect::tests::tiff_subbyte_predictor_scratch_is_bounded_by_available_samples`, `inspect::tests::tiff_subbyte_predictors_keep_components_rows_and_padding`; (4) `inspect::tests::compressed_object_self_container_does_not_recurse`, `inspect::tests::compressed_object_mutual_containers_do_not_recurse`, `inspect::tests::object_stream_length_cycle_does_not_recurse`, `inspect::tests::compressed_object_container_chain_does_not_recurse`, `inspect::tests::compressed_length_chain_does_not_recurse`, `inspect::tests::plain_stream_length_chain_does_not_recurse`, `inspect::tests::compressed_objects_and_indirect_stream_length_still_load`, `inspect::tests::compressed_length_in_a_container_with_an_indirect_length_still_loads`; (5) `inspect::tests::object_stream_member_extents_bound_owned_strings`, `inspect::tests::object_stream_member_extents_preserve_index_order_and_whitespace`; (6) `inspect::tests::rebuilt_file_keeps_the_info_of_its_cross_reference_stream`, `inspect::tests::rebuilt_file_prefers_a_trailer_whose_root_is_the_catalog`; (7) `inspect::tests::{object_stream_members_over_the_node_cap_are_skipped, object_stream_index_entries_past_the_clamp_are_ignored, object_streams_of_one_load_share_their_node_budget, object_streams_loaded_in_parallel_share_their_node_budget, a_malformed_object_stream_member_refunds_its_reservation, a_tight_budget_builds_object_stream_members_in_index_order, a_lookup_in_an_object_stream_parses_only_the_member_it_wants}` (pdfcraft-render; `NodeBudget` and `ObjectStream::new_within` are public so these can use a small budget) |
 | hayro-syntax | 0.7.2 | Apache-2.0 OR MIT | (1) Page-tree cycle guard in `resolve_pages` (visited set + depth cap): a `/Kids` loop among compressed objects overflowed the stack and aborted the process; (2) `ccitt_size_ok`: CCITT images wider than 2^20 columns or over 2^28 pixels are not decoded (a fuzzed `/Columns 4294967295` allocated 4 GiB); (3) Flate/LZW predictor row widths are saturating `usize`, a zero width is refused and a row longer than the data is not allocated (a fuzzed `/Columns 9223372036854775807` wrapped to a 2^61-byte allocation and aborted); (4) the inline-image end-of-data check (`EI`) doesn't nest inside its own look-ahead and examines at most 256 candidates and steps (50 images with "EI" in their data ran for over ten minutes); an EI followed by a delimiter (EI%..., EI[...) ends the image like one followed by white space; only a regular character after EI skips the candidate; (5) a stream whose `/Length` is wrong is recovered only when `stream` is the next token — scanning ahead to a later object's `stream` made an indirect appearance-state dictionary (Quartz checkboxes: `/AP /N` → `<< /Yes … /Off … >>`) render as a non-form, so the widget was skipped; (6) JPX rescaling uses an exact integer sample range for 1–32-bit components (32 shifted past u32, and floating-point maxima at 25–31 bits wrapped to zero), and refuses zero-sized rows; (7) `decode_limit`: Flate (through flate2 and the fallback inflater), LZW, RunLength and ASCII85 never write past `MAX_DECODED_STREAM` (256 MiB), or, for the last filter of an image of known size, past twice its pixel bytes (a predictor tag byte per byte), at most 1 GiB; `Stream::decoded_within` for budgeted callers; a page's `/Contents` array shares one `MAX_DECODED_STREAM` (a 2 MB page whose content stream or 8 × 8 image inflated to 2 GB took the renderer past 3 GB in under a second; naming the stream twenty times in `/Contents`, 5 GB); (8) high-precision numbers (jsPDF MediaBox coordinates with over 19 digits) parse without overflowing the u64 mantissa: fractional digits past it are dropped, integer digits past it scale the value (a real, kept finite); (9) large dictionary indexes are built on first use and shared across repeated reads within each PDF (#307); the validated-byte cache is bounded, reader contexts remain separate, repairs and inline/content dictionaries bypass sharing, and small dictionaries stay eager; (10) decoded object-stream slots publish once under contention, cold loading rejects recursive dependencies, and xref repair serializes without holding recursive read guards; this permits one parser per native render pool with private worker caches; (11) `sync.rs`: a poisoned lock is recovered instead of unwrapped (a worker panic no longer cascades into every reader of the same PDF), and xref repair takes a blocking write lock instead of asserting a non-blocking one; (12) `SegmentList` (`util.rs`) returns `None` for an out-of-range index instead of panicking; (13) a page's `/UserUnit` scales `render_dimensions` and `initial_transform`, so the page and everything on it are sized in points, as Acrobat shows them; it is read as Acrobat reads it (the page's own entry, not inherited; a number from 1 up, at most 75,000; anything else counts as 1), and a page without it keeps exactly the transform it had; (14) revision 2–4 passwords are tried as given and then in PDFDocEncoding (`legacy_passwords` in `crypto/mod.rs`, which resolves the upstream `TODO: Convert to PDFDocEncoding`): passwords arrive as UTF-8 text, so a password with characters outside ASCII (`Çok güzel`, `ılık€`) written in PDFDocEncoding, as ISO 32000-2 §7.6.4.3.2 asks and qpdf and Acrobat write it, was always wrong; (15) page content is read a piece at a time (`page::ContentReader`, `Page::content_reader`): plain streams and Flate streams without a predictor are decoded as they are read, with a budget of 64 times their compressed size and never less than `MAX_DECODED_STREAM` (a stream that expands past it is cut and reported); other streams are decoded whole, as before, and share `MAX_DECODED_STREAM`. The content tokenizer reads a window at a time (`UntypedIter::new_window`, `TypedIter::needs_more`, `TypedIter::committed`): an instruction that runs past the window is not decided until more data follows, which `Reader` records by flagging reads and `at_end` past the end of the data, including through the clones the parser makes. The Flate decoder keeps its own 32 KiB history, so it pauses at any output size. `ContentReader::new` reuses raw/decrypted stream bytes for budget accounting and piece creation, and `decoded_raw_within` applies the existing Whole-stream filters and limits to those bytes without decrypting twice; (16) revision 5–6 (AES-256) passwords are tried in their SASLprep form (RFC 4013, then UTF-8, at most 127 bytes, as ISO 32000-2 §7.6.4.3.3 Algorithm 2.A asks and pdfcraft-crypt writes them) and then, if that differs, as given (`aes256_passwords` in `crypto/mod.rs`, which resolves the upstream `TODO: Do the above.`; `stringprep`, already in the tree through pdfcraft-crypt, is an optional dependency enabled by `std`, and without `std` passwords are used as given): the renderer used the password as typed, so one that SASLprep changes (a decomposed `café`, a no-break space, the fullwidth `ａｂ` a Japanese IME types in full-width mode) was wrong, although pdfcraft-cos accepted it: protecting a document with such an open password was rolled back ("the password is incorrect"), and a file with such a password did not open with it.; (17) CCITT `/Rows 0` means the height is not predetermined (ISO 32000-2 Table 11), not zero rows: scanned Group 4 pages written that way rendered blank; (18) The streaming Flate decoder (`lzw_flate::flate::fallback`) copies a back-reference in runs of up to its distance (`extend_from_within`), not byte by byte. The copy reads only bytes already in the output, and a copy whose source does not exist still writes nothing, so the bytes are those a byte-by-byte copy writes. Inflating the A1 sample's content stream (278.6 MB) takes about 14% less time (0.66 s to 0.56 s); the output is identical; (19) CCITT `/Rows` below the image's `/Height` decodes to the height: a plotter driver wrote `/Rows` equal to `/Columns`, so only the first rows were decoded and the rest drawn black (#3308) (20) `stream` followed by spaces or tabs and then the line break (`stream \r\n`, as Microsoft Reporting Services writes it) starts the data after the line break; the content stream was taken to start at the space and the page rendered blank.; (21) a JP2 colour specification naming an enumerated colour space the decoder refuses (CIEJab in a veraPDF fixture, YCbCr, PhotoYCC, YPbPr, bilevel…) no longer fails the image: it is decoded again from a copy whose `colr` names the space the decoder assumes without one, greyscale, sRGB or CMYK by component count, as MuPDF and Poppler draw it (`without_refused_enumerated_colour`; the page drew blank, #3306); (22) an object stream's index of `objnum offset` pairs is parsed once per stream and kept beside its decoded data (`ObjectStreamIndexes`, `XRef::with_object_stream_indexes`), and an offset past `usize` is malformed instead of wrapping: `XRef::get_with` parsed the whole index again for every object it fetched from the stream, so reading all of a stream of N objects took N² steps (a Firefox page whose 65,542 objects share one stream took 37 s to draw and 40 s to extract its text); (23) the inline-image end-of-data look-ahead no longer rejects a candidate `EI` because a byte above 0x7F lies between it and the next one: when the candidate is the end, those bytes are the content stream that follows the image, and its strings carry such bytes (WinAnsi `(Grüße) Tj`, the two-byte codes of any Type 0 font), so the operator check that follows decides alone, bounded as in (4) (a scanned page whose OCR text held an accented word and a later capital "EI" — EINGANG, BEI, KLEIN — drew and extracted nothing after the image: 40 of 275 pages across five real documents); (24) `xref::prev_offset`: a trailer `/Prev` written as a reference `N G R` is read as the offset that object holds when the section's own entries place it (iText's `indirectPrev.pdf`; each section's entries are read before its `Prev` is followed), and otherwise as offset N (tiff2pdf; JHOVE's PDF-HUL-157 files, #2366), as `pdfcraft-cos` and other readers take it, so the earlier sections' pages are seen instead of one; (25) direct arrays and dictionaries share a reader-local nesting cap of 128, counted while skipping and while parsing a dictionary (its lenient repair reads, rather than skips, an object found where a key belongs, so `<< << …` recursed through that read); deeper objects return `None` instead of overflowing the stack (including unused trailer values, trailer entries, content operands and marked-content properties); a chain of 65 direct stitching functions now stops at this cap, before the 64-function guard; (26) an xref stream subsection must be backed by its decoded data: all-zero `/W` widths (an entry reads no bytes) and a declared count longer than the data are refused before any entry is inserted, where a tiny stream with a large `/Size` or `/Index` count inserted that many entries (from storytold/craft-libs#239); a subsection running past object number `i32::MAX` is refused instead of overflowing or turning negative; (27) an xref stream's type field is read big-endian at its full `/W[0]` width, where only its first byte was read and wider fields shifted every later entry, and `/W[0]` over 8 bytes is refused like `/W[1]` (from storytold/craft-libs#241); (28) a content instruction keeps up to 256 operands (`MAX_OPERANDS`) instead of 10, and past that drops the oldest instead of ending the content stream: the eleventh operand of a twelve-ink DeviceN `scn` (ISO 32000-2 §8.6.6.5 allows any number of components) blanked the rest of the page (#4260); (29) a `/JBIG2Globals` stream that is itself JBIG2 isn't decoded: globals are raw segments, and a chain of 16,000 such streams overflowed the stack, which aborts the process; (30) a stream's own crypt filter: `/Crypt` in its chain read as the filter it names, `/Identity` without one, instead of the document's filter and then a filter that can't be decoded, which left such a stream unreadable in any spelling (ISO 32000-2 §7.4.10); (31) `set_page_jbig2_work`: the JBIG2 images decoded on a thread spend one allowance, set per page, 2^30 steps (`MAX_PAGE_JBIG2_WORK`), so a page of many images made to reach their own limit stops at one, and what they cost to read counts, whether they decode or not, and `jbig2_limited` says whether the image decoded last on the thread was refused by one of the decoder's limits rather than its data, and `jbig2_limited_by_stream` whether that limit is one the stream reaches by itself rather than its decoding work, which may be the page's; `clear_jbig2_limited` and each new page forget it; unbounded until a page sets it; (32) a group of array items read together (a tuple: an image's `/Decode`, `/W`, `/W2`, and a function's `/Domain`, `/Range`, `/Encode` and `/Decode`) can start with a reference: it was taken for the whole group and lost, which ended the array, so an image with `/Decode [7 0 R 0]` didn't draw and CID widths fell back to `/DW`; (33) an object that holds only a reference stands for what that names, stored on its own or in an object stream, up to 32 references: read as a number it was the reference's own object number, so a `/Decode` or `/W` entry naming such an object took a wrong value, and as anything else it was lost. Past 32, as any cycle goes, it reads as a missing object. An object stream isn't reached that way, as its checks are of the object named; reading its index counts against the 64 nested loads and reads its dictionary alone, as a chain of them, each with a member of the next for its `/N`, `/First` or `/Length`, ran out of stack; and a comment inside a reference counts as white space; (34) a table rebuilt by scanning the file (`fallback_xref_map`) finds an object by its number when its header names another generation, including one no generation may be (`3 18446744073709551616 obj` in `poppler-85140-0.pdf`, #5580): the header is read leniently only in that scan (`read_object_header`), the object is also filed under generation 0 unless a real `N 0 obj` holds that key (a later header for the number moves the stand-in), `XRef::get_with` matches by object number only in a repaired table, and `XRef::objects` yields each location once; (35) PNG predictors (`lzw_flate::unfilter_png`) are undone a byte row at a time on slices, as the PNG filters are defined, instead of through the bit-level readers TIFF predictors need: a 993 × 936 RGB image took about 63 ms to unfilter whatever its row filters, and now takes about 3 ms (Up) to 16 ms (Paeth) in a release build (#5430); a row ending part-way through a pixel (three 4-bit samples, an odd width) keeps its last byte, where the bit-level readers dropped it and each later row started a byte early, shearing the picture; (36) a stream with no `endstream` left after it is the bytes its `/Length` gives, "how many bytes of the PDF file are used for the stream's data" (ISO 32000-2 7.3.8.2), when the file holds that many (`parse_declared`: first, before the search for `endstream`, when the `/Length` ends before a whole `endstream` token, or a whole `endstrea` or `endobj` token after which the object ends too (the end of the data, another object's `N G obj` header, `xref`, `trailer` or `startxref`: not payload such as `endobject` or `endobj more`, ISO 32000-2 7.2.3), or at the end of the data, so the search can't run on into a later object's stream; then after the search finds none; `parse_proper` and the search for `endstream` take only a whole token, not `endstreamer`): a producer that writes `endstrea` after every stream lost every font and page content, and its pages drew blank while other readers draw them; (37) a document that encrypts only its embedded files, authorised when one is opened (`/AuthEvent /EFOpen`, ISO 32000-2 §7.6.6, Table 25: every encrypting crypt filter is EFOpen, `/EFF` names one, `/StmF` and `/StrF` don't), opens without a password with the pass-through decryptor: its strings and streams are in the clear and nothing drawn reads an embedded file; (38) a page box that encloses no area is read as a missing one: a `/MediaBox` without area (`[0 0 0 0]`) as missing (an inherited one with area, else the default page, US Letter since patch 44), and a `/CropBox` without area, or with none in common with the media box, as missing (an inherited one, else the media box; ISO 32000-2 §14.11.2, Table 33); kept, the visible region had no area, so nothing was drawn and no text extracted (pdf.js `boundingBox_invalid`); (40) the last Flate filter of an image whose PNG predictor (`/Predictor` 10–15) its writer declared but never applied gives the image's samples as they are: when the inflated data is exactly `/Height` rows of the predictor's row length with no filter-type byte before each (where predicted rows would need one more byte each, ISO 32000-2 §7.4.4.4), `untagged_png_rows` takes it for unpredicted samples and reports it (`warn!`), as PDFium, MuPDF and Poppler read it; read with the predictor, each row's first sample was taken for a filter type and the image came out a row short and shifted, drawn in fragments (PDFBOX-3932). `Filter::apply` is given the image's rows for its last filter only; any other length is predicted as before; (41) CCITT `/Rows` above the image's `/Height` decodes to the height too, so the decoder is never asked for more rows than the image has (ISO 32000-2 Table 87): a scan with `/Rows 1084975104` on 2,592 columns had the size check refuse every page, and all 17 drew blank (PDFBOX-771); `/Rows` still counts for a stream decoded without an image's height; (42) TIFF predictor 2 on 8- and 16-bit samples (`lzw_flate::undo_tiff_bytes`) is undone a byte row at a time on slices, each sample added to the same component of the pixel to its left, wrapping at the sample's width (16-bit samples big-endian), instead of through the bit-level readers 1-, 2- and 4-bit samples still need; the bytes are those the bit-level path wrote, and a partial last row is still dropped. A page of 45 full-page 2445 × 4724 8-bit grey images so predicted (PDFBOX-1350) took about 23 s to render at 96 dpi and now takes about 4 s, with the same pixels; (43) a last update cut off before its trailer (the last `startxref` more than 4 KiB from the end of the file, as `pdfcraft-cos` judges the footer, with `N G obj` headers after it: `cut_off_update_follows`) is read by rebuilding the table from object headers (`Pdf::new_with_password` calls `fallback` first, after the table the last `startxref` names has refused a wrong password, and takes the rebuilt table only when it is encrypted exactly when that one is), the latest definition of each object winning, as `pdfcraft-cos` reads such a file; the older table the last `startxref` names is read only when the rebuilt table has no page (a file cut short inside the update, whose new page tree names pages that are not there). The renderer had shown the older revision while the document model read the newer one (PDFBOX-3934: 12 pages against 13; ISO 32000-2 §7.5.6). A `startxref` near the end, or one followed only by data that holds no object header, is read as before; (44) a page with no `/MediaBox`, its own or inherited, or one without area (`[0 0 0 0]`, which now counts as missing, so the page is placed and clipped by the region it is sized by and its content shows), is US Letter (`LETTER`, 612 × 792 pt), not A4, and so is the `base_dimensions` fallback for a visible region without area: ISO 32000-2 Table 31 requires the box and gives no default, other readers use Letter, and PdfCraft's page model and inspector already did (PDFBOX-4001); (45) `root_xref`: when the newest cross-reference section names no earlier one (no `/Prev`, ISO 32000-2 §7.5.6, §7.5.8.2; a hybrid section's `/XRefStm` stream belongs to the same update and doesn't count, §7.5.8.4), the file holds another `startxref`, and the catalog's `/Pages` can't be read, the table is rebuilt by scanning the file (`XRef::repair`) before the page tree is read, so the cut-off page tree is found instead of the page dictionaries `Pages::new_brute_force` turns up (the signed files of PDFBOX-2720 and PDFBOX-2942 showed 2 blank pages for 1, 10, 13 and 1754); `Pdf::rebuilt_unlinked_update` says so, and `pdfcraft-cos` rebuilds under the same conditions | (1) `cos/tests/writer.rs::page_tree_loops_in_object_streams_do_not_crash_readers`; (2) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (3) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (4) `raster::tests::inline_images_with_ei_in_their_data_parse_in_linear_time`, `content::tests::inline_image_ei_may_be_followed_by_a_delimiter`; (5) `raster::tests::indirect_appearance_state_dict_is_not_another_stream`; (6) `raster::tests::jpx_stream_bit_depth_boundaries_do_not_panic`, `raster::tests::jpx_32_bit_image_does_not_prevent_other_page_content_from_rendering`, `raster::tests::jpx_gray_rgb_and_alpha_keep_eight_bit_samples`, `raster::tests::jpx_streams_reject_out_of_range_bit_depths`; (7) `raster::tests::decompression_bombs_stop_at_the_stream_limit`, `raster::tests::page_contents_and_nested_forms_share_one_budget`; (8) `inspect::tests::jspdf_high_precision_mediabox_does_not_overflow_dimensions`, `object::number::tests::high_precision_float_does_not_overflow_mantissa` (hayro-syntax); (9) `object::dict::lazy_index_tests`, `raster::tests::large_resource_indexes_preserve_pixels_and_text`; (10) `data::tests`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`, `raster::tests::shared_parser_is_lazy_and_initializes_once_under_contention`; (11) `data::tests::panicking_initializer_wakes_waiters_and_prevents_retries`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`; (12) `util::tests::segment_list_rejects_out_of_range_indices`; (13) `raster::tests::user_unit_scales_the_page_and_everything_on_it`; (14) `crypto::pdfcraft_password_tests`, `pdfcraft-engine` `tests::legacy_passwords_with_turkish_characters_open`; (15) `content::tests::windows_keep_every_instruction_at_every_split`, `content::tests::windows_keep_every_instruction_in_pieces_of_any_size`, `content::tests::windows_match_the_slice_on_random_content`, `content::tests::windows_drop_blanks_and_keep_a_comment_that_may_go_on`, `page::content_reader_tests::content_past_the_cap_is_read_to_the_end`, `page::content_reader_tests::a_stream_that_expands_past_the_budget_is_cut_there`, `page::content_reader_tests::a_small_expansion_under_the_cap_is_not_cut`, `raster::tests::page_content_past_the_old_cap_renders`, `raster::tests::content_reader_returns_the_same_bytes_in_any_pieces`, `raster::tests::content_bombs_stop_at_the_budget_and_say_so`, `page::content_reader_tests::plain_and_whole_pieces_keep_their_bytes`, `page::content_reader_tests::repeated_content_reference_counts_compressed_bytes_once`, `page::content_reader_tests::whole_cap_still_counts_later_unique_streams`; (16) `crypto::pdfcraft_password_tests::aes256_passwords_are_tried_in_their_saslprep_form_then_as_given`, `crypto::pdfcraft_password_tests::aes256_passwords_open_as_typed_and_in_their_saslprep_form`, `pdfcraft-engine` `tests::aes256_open_passwords_that_saslprep_changes_protect_and_reopen_as_typed`, `tests::aes256_files_whose_passwords_saslprep_changes_open_as_typed`; (17) `raster::tests::group4_fax_with_rows_zero_decodes_to_the_image_height`; (18) `filter::lzw_flate::tests::back_reference_longer_than_its_distance_repeats_its_source`, `back_reference_cut_by_the_limit_resumes_in_the_next_call` and `back_reference_reads_bytes_written_by_an_earlier_call`; each fails when the copy returns the wrong remaining count; (19) `raster::tests::group4_fax_with_rows_below_its_height_decodes_to_the_image_height`; (20) `raster::tests::space_before_the_line_break_after_stream_still_renders`; (21) `raster::tests::a_jp2_image_in_a_refused_enumerated_colour_space_is_drawn`, `filter::jpx::tests::refused_enumerated_colour_spaces_become_the_component_counts_default`, `filter::jpx::tests::what_the_decoder_handles_or_cant_be_read_is_left_alone` (`cargo test --manifest-path vendor/hayro-syntax/Cargo.toml`); (22) `raster::tests::objects_in_one_large_object_stream_are_read_in_linear_time`; (23) `text::tests::text_after_an_inline_image_survives_a_non_ascii_byte_before_a_later_ei`, `content::tests::an_inline_image_ends_at_its_own_ei_when_later_text_holds_a_non_ascii_byte` (hayro-syntax); (24) `xref::tests::prev_as_reference_reaches_the_earlier_section`, `xref::tests::prev_as_reference_to_an_object_holding_the_offset_reads_that_offset`, `pdfcraft-cos` `document::tests::a_prev_written_as_a_reference_still_reaches_the_earlier_sections`, `document::tests::a_prev_reference_to_an_object_holding_the_offset_reads_that_offset`; (25) `raster::tests::deeply_nested_direct_objects_do_not_overflow_the_stack`, `raster::tests::dictionaries_nested_without_keys_in_content_do_not_overflow_the_stack`, `raster::tests::dictionaries_nested_without_keys_in_the_trailer_do_not_overflow_the_stack`, `raster::tests::dictionaries_nested_without_keys_as_marked_content_properties_do_not_overflow_the_stack`, `raster::tests::dictionaries_nested_without_keys_are_read_up_to_the_nesting_cap`, `raster::tests::nesting_at_the_cap_fits_a_512_kib_stack` (native only), `raster::tests::function_limits_depth_guard_refuses_a_chain_of_references`; (26) `xref::tests::xref_stream_entries_need_backing_bytes`; (27) `xref::tests::xref_stream_type_field_uses_the_full_w0_width`, `xref::tests::xref_stream_loader_rejects_oversized_w0` (`cargo test --manifest-path vendor/hayro-syntax/Cargo.toml`); (28) `content::ops::tests::scn_with_twelve_components_keeps_them_all`, `content::ops::tests::operands_past_the_cap_keep_the_latest_in_order` (hayro-syntax), `raster::tests::devicen_inks::a_twelve_ink_devicen_colour_paints`, `raster::tests::devicen_inks::a_four_ink_devicen_colour_paints`, `raster::tests::devicen_inks::an_operator_with_hundreds_of_operands_does_not_end_the_content`; (29) `raster::tests::jbig2_globals_that_are_jbig2_themselves_are_not_decoded`, `raster::tests::jbig2_globals_are_read`, `raster::tests::the_jbig2_images_of_a_page_share_one_allowance`, `raster::tests::an_image_that_fails_spends_the_pages_allowance_too`; (31) `jbig2_limited`: `raster::tests::a_picture_whose_jbig2_mask_a_decoder_limit_refuses_is_not_drawn`, `raster::tests::a_limit_refusal_says_nothing_of_the_next_image`, `raster::tests::failed_image_decodes::a_picture_whose_jbig2_mask_is_refused_for_its_work_is_decoded_at_every_draw`; (30) `raster::tests::a_stream_with_a_crypt_filter_of_its_own_is_drawn`; (32) `raster::tests::a_decode_array_with_references_in_it_is_read`, `raster::tests::a_functions_arrays_can_start_with_a_reference` (pdfcraft-render), `font::cid::width_tests::a_width_group_can_start_with_a_reference` (hayro-interpret); (33) `raster::tests::a_reference_to_a_reference_is_what_it_names`, `raster::tests::a_decode_array_with_references_in_it_is_read` (pdfcraft-render), `font::cid::width_tests::a_width_group_can_start_with_a_reference` (hayro-interpret), `xref::tests::an_object_stream_isnt_reached_through_a_reference`, `xref::tests::a_chain_of_object_streams_ends_at_the_limit_of_nested_loads`, `xref::tests::a_chain_of_object_streams_takes_no_more_work_for_two_ways_on`, `xref::tests::a_reference_held_in_either_storage_is_followed`, `xref::tests::a_page_a_reference_is_held_to_is_found_once` (hayro-syntax); (34) `raster::tests::a_rebuilt_table_finds_an_object_whose_header_names_another_generation`, `raster::tests::a_rebuilt_tables_generation_0_stand_in_is_not_a_second_object` (pdfcraft-render), `xref::tests::an_object_stream_and_its_first_member_are_both_enumerated` (hayro-syntax); (35) `filter::lzw_flate::pdfcraft_png_predictor_tests` (hayro-syntax: every filter type at 1–16 bits and 1–4 colours against the PNG specification's byte-by-byte definition, a row ending part-way through a pixel, Average and Paeth over 6-byte pixels), `raster::tests::png_predicted_images::a_four_bit_rgb_image_of_odd_width_with_up_predicted_rows_is_not_sheared`; (36) `raster::tests::a_content_stream_without_endstream_is_drawn_to_its_length`, `raster::tests::a_content_stream_without_endstream_is_not_read_into_a_later_stream`, `raster::tests::hayro_reads_a_stream_without_endstream_to_its_length_before_a_later_one`, `raster::tests::hayro_does_not_end_a_stream_inside_a_longer_word` (pdfcraft-render); (37) `inspect::tests::a_document_encrypting_only_its_embedded_files_opens_without_a_password`; (38) `text::tests::text_on_a_page_whose_box_has_no_area_is_extracted` (pdfcraft-render); (40) `filter::lzw_flate::pdfcraft_png_predictor_tests::an_image_whose_rows_carry_no_png_tags_is_read_as_its_samples`, `an_image_whose_rows_carry_png_tags_still_has_its_predictor_undone`, `data_of_neither_length_decodes_as_it_did`, `rows_of_no_bytes_or_of_more_than_memory_holds_do_not_panic` (hayro-syntax), `raster::tests::png_predicted_images::an_image_and_soft_mask_whose_rows_carry_no_png_tags_draw_their_samples`, `an_image_one_byte_short_of_untagged_rows_still_goes_through_the_predictor`; (41) `raster::tests::group4_fax_with_rows_past_its_height_decodes_to_the_image_height`; (42) `filter::lzw_flate::pdfcraft_tiff_predictor_tests` (hayro-syntax: random 8- and 16-bit rows at 1–7 colours and 1–50 columns against the bit-level path, partial and empty rows, and a row counter showing whole-byte samples skip the bit-level path), `raster::tests::tiff_predicted_images`; (43) `raster::tests::an_update_cut_off_before_its_trailer_shows_its_pages_as_the_model_reads_them`, `raster::tests::a_complete_update_reads_as_before`, `raster::tests::trailing_data_without_objects_reads_as_before`, `raster::tests::a_short_cut_off_update_reads_as_before`, `raster::tests::a_cut_off_update_with_obj_followed_by_a_delimiter_is_rebuilt`, `raster::tests::a_cut_off_update_with_obj_followed_by_a_comment_is_rebuilt`, `raster::tests::trailing_data_with_an_object_header_reads_as_the_model_reads_it`, `raster::tests::an_update_cut_off_before_its_new_pages_keeps_the_older_table`, `raster::tests::an_encrypted_file_with_a_cut_off_update_still_needs_its_password`, `raster::tests::a_rebuild_whose_trailer_lacks_the_encryption_dictionary_is_not_taken` (pdfcraft-render); (44) `raster::tests::a_page_without_a_media_box_is_letter`, `raster::tests::raw_crop_unit_floor_preserves_nearly_zero_fallback` (pdfcraft-render), `pdfcraft-model::tests::{a_page_without_a_media_box_is_letter, a_page_whose_media_box_has_no_area_is_letter}`; (45) `inspect::core::unlinked_update_tests::an_update_without_prev_shows_the_page_tree_and_says_it_was_rebuilt`, `inspect::core::unlinked_update_tests::a_hybrid_update_without_prev_is_rebuilt_as_the_document_model_rebuilds_it` (pdfcraft-render) |
 | winit | 0.30.13 | Apache-2.0 | (1) on Windows 11 (build 22000 and later), `WM_DPICHANGED` applies the rect Windows suggests. It used to nudge the window onto the monitor `MonitorFromWindow` names, which during a drag is still the monitor being left; the nudge sent another `WM_DPICHANGED`, so a window dragged to a monitor with another scale factor grew and stayed on the wrong monitor at the wrong scale (#324). Backport of winit master 488c036a ([winit#4341](https://github.com/rust-windowing/winit/pull/4341)), which no 0.30 release has; Windows 10 keeps the old adjustment, as on winit master. (2) on Wayland, a seat's text input is destroyed when the seat goes away, not whenever it loses a capability: losing any capability (a touch screen or tablet unplugged, a remote-desktop session ending) destroyed it, and only an added capability recreated it, so IME stopped working until restart. Port of [winit#4747](https://github.com/rust-windowing/winit/pull/4747); (3) on Windows, an IME composition reports its cursor from `GCS_CURSORPOS` only when `WM_IME_COMPOSITION` says it is set, and at the end of the composition otherwise: the Microsoft Korean IME never sets it, so the cursor read as 0 (egui then drew no caret while composing; it now draws it after the syllable). Port of [winit#4746](https://github.com/rust-windowing/winit/pull/4746); (4) on Windows, a hidden window is not maximized until it is shown, and a hidden window shown while maximized gets one `ShowWindow(SW_MAXIMIZE)`: `SW_MAXIMIZE` shows a hidden window, so PdfCraft, which eframe keeps hidden until its first frame is drawn, appeared unpainted (white) when it restored a maximized window, and could lose its focus. Port of [winit#4587](https://github.com/rust-windowing/winit/pull/4587) (the later, focus-safe form of [winit#4575](https://github.com/rust-windowing/winit/pull/4575)); (5) on X11, when allowing or disallowing IME replaces the focused window's input context (egui does it each time a text field gains or loses focus), the new context is focused: no focus event follows, so it stayed unfocused until the window lost and regained focus. Port of [winit#4727](https://github.com/rust-windowing/winit/pull/4727); (6) on macOS, `insertText` commits through IME when a composition was started (`pending_commit`, set by `setMarkedText`) rather than when marked text is left: input methods that end a composition with `unmarkText` before `insertText` lost the text, and Apple Korean dropped the key typed after a syllable (`한` then `5` or `;`); other `insertText` calls stay `KeyboardInput`; a commit outside a key press (a candidate clicked with the mouse, dictation) clears the marked text and leaves no key to swallow, as in [winit#4748](https://github.com/rust-windowing/winit/pull/4748) (without it the next key, such as Backspace, was lost). `validAttributesForMarkedText` lists the underline and marked-clause attributes, without which some input methods don't compose. Port of [winit#4650](https://github.com/rust-windowing/winit/pull/4650), the 0.30 backport of [winit#4651](https://github.com/rust-windowing/winit/pull/4651) (merged on winit master), with the underline attribute spelled as AppKit's `NSUnderlineStyleAttributeName` (`NSUnderline`); (7) on macOS, disallowing IME with a composition in progress (focus leaving a text field) tells the input method to discard its marked text (`discardMarkedText`): it kept composing it once IME was allowed again, so the abandoned syllable came back (`하`, then `가` typed in the next field, became `학`, then `하` + `가`; Japanese `か` then `さ` became `傘`). Port of [winit#4745](https://github.com/rust-windowing/winit/pull/4745); (8) on macOS, text inserted outside a key press without a composition (the emoji picker) is reported as `Ime::Commit`; it was dropped. Port of the emoji-picker part of [winit#4749](https://github.com/rust-windowing/winit/pull/4749) (0.30 backport of [winit#4748](https://github.com/rust-windowing/winit/pull/4748)); its `selectedRange` change for dictation is left out because it switches on press-and-hold for every held key (an accent menu instead of key repeat, and the chosen accent added after the repeated letters); (9) on macOS, a key whose text was committed through IME isn't also sent as `KeyboardInput` unless AppKit forwards it as a command (Enter): Apple Korean answers Space with no syllable in progress with `setMarkedText(" ")`, `insertText(" ")`, `setMarkedText("")`, and the last call reset winit's state, so the space arrived twice. Same goal as [winit#4478](https://github.com/rust-windowing/winit/pull/4478), whose changes don't reach this call order (macOS 14); to be proposed upstream there; (10) on macOS, when the first key in a fresh app reaches Apple Korean's `insertText` as a raw compatibility jamo instead of starting a composition, that key is interpreted once more, synchronously, before it is sent as `KeyboardInput` (g k s typed ㅎㅏㄴ instead of 한); only an unmodified, non-repeated first key whose one callback inserts that same jamo, with IME enabled and nothing composed, focus and input source unchanged, is retried (`ime_startup.rs`). Port of [winit#4744](https://github.com/rust-windowing/winit/pull/4744), with its policy tests.; (11) on X11 without `Xft.dpi`, the scale factor comes from the X screen's configured DPI (its size in pixels and millimetres) before the output's physical density from RandR: Xorg can deliberately run a dense panel at 96 DPI, and only winit applications then looked zoomed; `Xft.dpi` still wins, `WINIT_X11_SCALE_FACTOR` still overrides, and a screen reporting no size keeps the RandR fallback. PdfCraft patch (#1150, replacing the launcher pin proposed in #908). (12) on macOS, `WinitView` answers `mouseDownCanMoveWindow` with the window's `movable_by_window_background` attribute (NO unless asked): NSView answers YES for a view that isn't opaque, so with the transparent title bar and full-size content view PdfCraft uses, AppKit moved the window for any drag that began in the 28 pt title-bar band before the app saw it, and document tabs (which live in that band) could not be dragged to reorder them. The empty strip still moves the window through `ViewportCommand::StartDrag`. PdfCraft patch. The published crate's asset files (`docs/res/*.svg`, `examples/data/*.png`) are left out, so its `window` example doesn't build; (13) on Wayland, pixel-only wheel, wheel-tilt and continuous-source scroll events report `Moved` rather than starting an unterminated finger gesture, so egui follows modifier release instead of keeping Ctrl zoom latched (#991). Finger gestures and unknown sources retain their existing phase policy | (1) `pdfcraft` `tests::winit_carries_the_windows_11_monitor_scale_fix` keeps the patch in the build; the drag itself needs two monitors with different scale factors on Windows 11; (2) `pdfcraft` `tests/winit_wayland_text_input.rs`; the capability change itself needs a Wayland session and an input method; (3) `pdfcraft` `tests/winit_windows_ime_cursor.rs`; composing itself needs the Microsoft Korean IME; (4) `pdfcraft` `tests/winit_windows_hidden_maximized.rs`; the start-up itself needs Windows and a window that was closed maximized; (5) `pdfcraft` `tests/winit_x11_ime_focus.rs`; switching fields itself needs an X11 session and an input method (IBus, fcitx5); (6) `pdfcraft` `tests/winit_macos_ime_commit.rs`; composing itself needs macOS and an input method; (7) `pdfcraft` `tests/winit_macos_ime_discard.rs`; composing itself needs macOS and an input method; (8) `pdfcraft` `tests/winit_macos_emoji_picker.rs`; the picker itself needs macOS; (9) `pdfcraft` `tests/winit_macos_korean_space.rs`; composing itself needs macOS and Apple Korean; (10) `pdfcraft` `tests/winit_macos_korean_first_key.rs` and `ime_startup.rs`'s own tests (run them with `rustc --test`); typing itself needs macOS and Apple Korean; (11) `pdfcraft` `tests/winit_x11_dpi.rs` keeps the patch in the build, and `util::randr` tests the policy (run them in the vendored crate); the scale itself needs an X11 session; (12) `pdfcraft` `tests/winit_macos_title_bar_drag.rs` keeps the patch in the build; the drag itself needs macOS and a pointer; (13) `pdfcraft` `tests/winit_wayland_scroll.rs` compiles the production phase policy and exercises modifier release through egui; live COSMIC confirmation remains open |
 | egui-wgpu | 0.36.2 | MIT OR Apache-2.0 | (1) `winit::surface_fit`: a window's surface is configured within the device's `max_texture_dimension_2d`, both sides shrunk by one factor that egui then draws at (`pixels_per_point × render_scale`), so the whole window is drawn into the surface (on DX12 it is stretched over the window and lines up with the pointer; wgpu's GL backend copies it unscaled into a corner); the longer side becomes exactly the limit; the depth and MSAA textures follow, and a recreated surface starts again from the window's own size. egui-wgpu configured the window's size as is, and `Surface::configure` panics beyond the limit: a window restored at another monitor's scale (opening an Outlook attachment on a mixed-DPI laptop asked an 8192-pixel device for 8600 × 3423, #577) or stretched across monitors closed PdfCraft, before its window appeared when it happened at start-up ([emilk/egui#8361](https://github.com/emilk/egui/issues/8361)). The published crate leaves out egui's licence files; `LICENSE-APACHE` and `LICENSE-MIT` are from the 0.36.2 tag; (2) `winit::catch_errors`: a new window's surface is configured inside wgpu error scopes (validation, out of memory, internal), and a failure is returned as `WgpuError::ConfigureSurface` (for the root window at start-up eframe returns it as `Error::Wgpu`, which PdfCraft retries with OpenGL); nothing is kept for the window. wgpu's default handler panicked instead, and eframe configures the root surface before the app is created, so a driver that can't configure one closed PdfCraft at launch (a 2015 Intel GPU through wgpu's GL backend timed out waiting for the GPU to go idle, `GpuWaitTimeout`, #519). Unchanged, so still a panic: an error in a later reconfigure (resize, a lost surface), a device lost during the first configure (wgpu reports it only to a callback), and a window shown at zero size (first configured on resize) | (1) `pdfcraft` `tests::a_window_larger_than_the_gpu_limit_gets_a_surface_within_it`, `tests::surface_fit_never_empties_or_overflows_a_surface`, and `tests::vendor_provenance_egui_wgpu_surface_fit_identity`, which keeps the patch in the build and in the paths that size a surface; (2) `pdfcraft` `tests::a_gpu_error_while_a_window_is_set_up_is_returned_not_a_panic` (a real device: an error inside `catch_errors` is returned, not a panic) and `tests::vendor_provenance_egui_wgpu_catch_errors_identity`, which keeps it around `add_surface`'s configure |
diff --git a/vendor/lopdf/src/lib.rs b/vendor/lopdf/src/lib.rs
index 4c1d845316..ca6d11d753 100644
--- a/vendor/lopdf/src/lib.rs
+++ b/vendor/lopdf/src/lib.rs
@@ -47,7 +47,7 @@ pub use encryption::{EncryptionState, EncryptionVersion, Permissions};
 pub use error::{DecompressError, Error, ParseError, Result};
 pub use incremental_document::IncrementalDocument;
 pub use load_options::{FilterFunc, LoadOptions};
-pub use object_stream::{ObjectStream, ObjectStreamBuilder, ObjectStreamConfig};
+pub use object_stream::{NodeBudget, ObjectStream, ObjectStreamBuilder, ObjectStreamConfig};
 pub use outlines::Outline;
 pub use reader::{PdfMetadata, Reader};
 pub use save_options::{SaveOptions, SaveOptionsBuilder};
diff --git a/vendor/lopdf/src/object_stream.rs b/vendor/lopdf/src/object_stream.rs
index 5a921b4bab..e60a9f5e09 100644
--- a/vendor/lopdf/src/object_stream.rs
+++ b/vendor/lopdf/src/object_stream.rs
@@ -1,13 +1,78 @@
 use crate::parser;
 use crate::{Document, Error, Object, ObjectId, Result, Stream};
+use std::cell::Cell;
 use std::collections::BTreeMap;
 use std::num::TryFromIntError;
 use std::str::FromStr;
+use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
 
 use log::warn;
 #[cfg(feature = "rayon")]
 use rayon::prelude::*;
 
+/// PdfCraft patch: index entries read from one object stream (the same clamp `pdfcraft_cos`
+/// applies to `/N`). Entries past it are ignored, so a huge index block cannot allocate an entry
+/// list or parse a member per entry.
+pub(crate) const MAX_OBJECT_STREAM_MEMBERS: usize = 1_000_000;
+
+/// PdfCraft patch: objects (every member and everything nested in it) one load may build from
+/// all of its object streams together, about one per object of the largest cross-reference
+/// table `pdfcraft_cos` accepts (8,388,607). Each stream is bounded by the decompression limit,
+/// but a file may hold many, and every two decoded bytes can be an object of a hundred bytes or
+/// more; this keeps the worst case near a gigabyte instead of tens.
+pub(crate) const MAX_LOAD_NODES: usize = 1 << 23;
+
+/// PdfCraft patch: the objects parsing may still build, shared by every object stream one load
+/// parses (and by rayon workers, hence atomic). Each member reserves its share before parsing
+/// and refunds what it did not use, so concurrent members cannot overshoot the total. Public so
+/// PdfCraft's tests can load object streams from a small budget.
+///
+/// The loaders parse their object streams one after another in object-number order, and a
+/// stream whose members could run the budget out parses them in index order (see
+/// [`ObjectStream::new_within`]), so the members skipped once it is spent are the same on every
+/// load of a file.
+pub struct NodeBudget(AtomicUsize);
+
+impl NodeBudget {
+    /// A budget of `nodes` objects.
+    pub fn new(nodes: usize) -> Self {
+        Self(AtomicUsize::new(nodes))
+    }
+
+    /// Take up to `want` nodes and return how many were granted (0 once the budget is spent).
+    fn reserve(&self, want: usize) -> usize {
+        // A compare-exchange loop rather than `fetch_update`, which newer toolchains deprecate
+        // in favour of a `try_update` older than this crate's minimum Rust version.
+        let mut left = self.0.load(Ordering::Relaxed);
+        loop {
+            let take = left.min(want);
+            match self
+                .0
+                .compare_exchange_weak(left, left - take, Ordering::Relaxed, Ordering::Relaxed)
+            {
+                Ok(_) => return take,
+                Err(now) => left = now,
+            }
+        }
+    }
+
+    /// Give back nodes [`Self::reserve`] granted and parsing did not use. Refunds never exceed
+    /// what was taken, so the count stays within the starting budget and cannot overflow.
+    fn refund(&self, nodes: usize) {
+        self.0.fetch_add(nodes, Ordering::Relaxed);
+    }
+
+    /// The nodes not yet reserved.
+    fn left(&self) -> usize {
+        self.0.load(Ordering::Relaxed)
+    }
+
+    /// Whether nothing is left to build from.
+    pub fn spent(&self) -> bool {
+        self.left() == 0
+    }
+}
+
 #[derive(Debug)]
 pub struct ObjectStream {
     pub objects: BTreeMap<ObjectId, Object>,
@@ -50,7 +115,33 @@ impl ObjectStream {
     /// Parse an existing object stream without modifying it, rejecting the
     /// decoded content if it would exceed `max_decompressed_size` bytes. `None`
     /// means no limit (the behavior of [`ObjectStream::new`]).
+    ///
+    /// PdfCraft patch: members are built from a budget of `MAX_LOAD_NODES` objects of their own.
     pub fn new_with_limit(stream: &Stream, max_decompressed_size: Option<usize>) -> Result<ObjectStream> {
+        Self::new_within(stream, max_decompressed_size, &NodeBudget::new(MAX_LOAD_NODES))
+    }
+
+    /// PdfCraft patch: [`ObjectStream::new_with_limit`], building members from `budget`, which a
+    /// load shares between all of its object streams. A member that would exceed its share, or
+    /// any member once the budget is spent, is skipped with a warning.
+    ///
+    /// When the budget holds enough for every member, they are parsed in parallel from a share
+    /// reserved for this stream alone, which no member can run out; otherwise they are parsed in
+    /// index order from `budget`. Either way which members are built doesn't depend on the order
+    /// in which rayon's workers reach them.
+    pub fn new_within(
+        stream: &Stream, max_decompressed_size: Option<usize>, budget: &NodeBudget,
+    ) -> Result<ObjectStream> {
+        Self::new_members_within(stream, max_decompressed_size, budget, |_| true)
+    }
+
+    /// PdfCraft patch: [`ObjectStream::new_within`], parsing only the members whose object
+    /// number `keep` accepts. The others are never parsed, so they spend nothing from `budget`:
+    /// a loader passes the members it would add (not placed in another stream by the
+    /// cross-reference table, and not already loaded), and a lookup the one member it wants.
+    pub(crate) fn new_members_within(
+        stream: &Stream, max_decompressed_size: Option<usize>, budget: &NodeBudget, keep: impl Fn(u32) -> bool,
+    ) -> Result<ObjectStream> {
         let content = match max_decompressed_size {
             // Object streams are decoded while the document is loaded, so
             // enforcing the limit here bounds the memory a single stream can use.
@@ -75,8 +166,10 @@ impl ObjectStream {
         let index_block = content.get(..first_offset).ok_or(Error::InvalidOffset(first_offset))?;
 
         let numbers_str = std::str::from_utf8(index_block).map_err(|e| Error::InvalidObjectStream(e.to_string()))?;
+        // PdfCraft patch: read at most `MAX_OBJECT_STREAM_MEMBERS` index entries.
         let numbers: Vec<_> = numbers_str
             .split_whitespace()
+            .take(2 * MAX_OBJECT_STREAM_MEMBERS)
             .map(|number| u32::from_str(number).ok())
             .collect();
         let len = numbers.len() / 2 * 2; // Ensure only pairs.
@@ -85,6 +178,9 @@ impl ObjectStream {
         if numbers.len().try_into().ok() != n.checked_mul(2) {
             warn!("object stream: the object stream dictionary specifies a wrong number of objects")
         }
+        if usize::try_from(n).is_ok_and(|n| n > MAX_OBJECT_STREAM_MEMBERS) {
+            warn!("object stream: /N {n} exceeds {MAX_OBJECT_STREAM_MEMBERS}; later members are ignored")
+        }
 
         // PdfCraft patch: bound members by the next distinct offset and parse each offset
         // only once, so overlapping or duplicate entries cannot amplify decoded content.
@@ -103,44 +199,89 @@ impl ObjectStream {
             end = offset;
         }
 
-        let chunks_filter_map = |(index, chunk): (usize, &[_])| {
-            let id = chunk[0]?;
-            let offset = first_offset.saturating_add(chunk[1]? as usize);
+        // PdfCraft patch: find each member's bytes first, in index order, so the members can be
+        // charged to the budget before any is parsed.
+        let mut members = Vec::new();
+        for (index, chunk) in numbers[..len].chunks(2).enumerate() {
+            let &[Some(id), Some(offset)] = chunk else { continue };
+            let offset = first_offset.saturating_add(offset as usize);
 
             if offset >= content.len() {
                 warn!("out-of-bounds offset in object stream");
-                return None;
+                continue;
             }
-            let &(first_index, extent_end) = extents.get(&offset)?;
+            let Some(&(first_index, extent_end)) = extents.get(&offset) else {
+                continue;
+            };
             if index != first_index {
                 warn!("duplicate offset in object stream");
-                return None;
+                continue;
+            }
+            if !keep(id) {
+                continue;
             }
             // Skip leading whitespace — some PDFs emit newlines before objects in ObjStm
             let mut start = offset;
-            while start < extent_end && content[start].is_ascii_whitespace() {
+            while start < extent_end && content.get(start).is_some_and(u8::is_ascii_whitespace) {
                 start += 1;
             }
             if start >= extent_end {
                 warn!("only whitespace after offset in object stream");
+                continue;
+            }
+            members.push((id, start, extent_end));
+        }
+
+        // PdfCraft patch: each member builds at most `MAX_OBJECT_NODES` objects, reserved from
+        // `from`; once that is spent the remaining members are skipped unparsed. Every object
+        // takes at least one byte, so a member reserves no more than its length.
+        let share = |&(_, start, end): &(u32, usize, usize)| parser::MAX_OBJECT_NODES.min(end - start);
+        let skipped = AtomicBool::new(false);
+        let parse_member = |from: &NodeBudget, member: &(u32, usize, usize)| -> Option<(ObjectId, Object)> {
+            let &(id, start, end) = member;
+            let granted = from.reserve(share(member));
+            if granted == 0 {
+                skipped.store(true, Ordering::Relaxed);
                 return None;
             }
-            let object = parser::direct_object(&content[start..extent_end])?;
-
-            Some(((id, 0), object))
+            let nodes = Cell::new(granted);
+            let object = content
+                .get(start..end)
+                .and_then(|bytes| parser::direct_object_within(bytes, &nodes));
+            from.refund(nodes.get());
+            if object.is_none() && nodes.get() == 0 {
+                warn!("object stream: member {id} exceeds the object budget and was skipped");
+            }
+            Some(((id, 0), object?))
         };
-        #[cfg(feature = "rayon")]
-        let objects = numbers[..len]
-            .par_chunks(2)
-            .enumerate()
-            .filter_map(chunks_filter_map)
-            .collect();
-        #[cfg(not(feature = "rayon"))]
-        let objects = numbers[..len]
-            .chunks(2)
-            .enumerate()
-            .filter_map(chunks_filter_map)
-            .collect();
+
+        let want = members.iter().map(&share).fold(0, usize::saturating_add);
+        let granted = budget.reserve(want);
+        let objects: BTreeMap<ObjectId, Object> = if granted == want {
+            // Every member fits, so they are parsed in parallel from this stream's own share:
+            // its members' reservations add up to it, so none is refused whatever the order.
+            let own = NodeBudget::new(granted);
+            #[cfg(feature = "rayon")]
+            let objects = members
+                .par_iter()
+                .filter_map(|member| parse_member(&own, member))
+                .collect();
+            #[cfg(not(feature = "rayon"))]
+            let objects = members.iter().filter_map(|member| parse_member(&own, member)).collect();
+            budget.refund(own.left());
+            objects
+        } else {
+            // The budget may run out part-way, so the members are parsed in index order and the
+            // ones skipped are the same on every load.
+            budget.refund(granted);
+            members
+                .iter()
+                .filter_map(|member| parse_member(budget, member))
+                .collect()
+        };
+        if skipped.load(Ordering::Relaxed) {
+            warn!("object stream: the object budget is spent; remaining members were skipped");
+        }
 
         Ok(ObjectStream {
             objects,
diff --git a/vendor/lopdf/src/parser/mod.rs b/vendor/lopdf/src/parser/mod.rs
index f0944be526..2cc191419b 100644
--- a/vendor/lopdf/src/parser/mod.rs
+++ b/vendor/lopdf/src/parser/mod.rs
@@ -3,6 +3,7 @@ use crate::Error;
 use crate::content::*;
 use crate::error;
 use crate::xref::*;
+use std::cell::Cell;
 use std::collections::HashSet;
 use std::str::{self, FromStr};
 
@@ -27,6 +28,19 @@ pub(crate) type NomError<'a> = nom::error::Error<ParserInput<'a>>;
 
 pub(crate) type NomResult<'a, O, E = NomError<'a>> = IResult<ParserInput<'a>, O, E>;
 
+/// PdfCraft patch: objects one top-level parse may build, counting every array element and
+/// dictionary value at any depth (the same cap as `pdfcraft_cos`'s `MAX_NODES`). Each object
+/// costs a hundred bytes or more, so a decoded stream of `0 0 0 ...` otherwise built one per
+/// two input bytes: gigabytes from a stream inside the decompression limit. Real arrays (page
+/// trees, parent trees, widths) stay far below.
+pub(crate) const MAX_OBJECT_NODES: usize = 1 << 22;
+
+/// PdfCraft patch: the budget of a container parsed outside `_direct_object` (an indirect
+/// object's body, a content-stream operand, a CMap or inline-image dictionary). Its contents are
+/// charged but the container itself isn't, so it starts one short and the whole object stays
+/// within `MAX_OBJECT_NODES`. (`MAX_OBJECT_NODES` is a nonzero constant, so this can't underflow.)
+const MAX_NESTED_NODES: usize = MAX_OBJECT_NODES - 1;
+
 #[inline]
 fn strip_nom<O>(r: NomResult<O>) -> Option<O> {
     r.ok().map(|(_, o)| o)
@@ -270,33 +284,48 @@ fn boolean(input: ParserInput) -> NomResult<Object> {
     .parse(input)
 }
 
+/// `null`.
 fn null(input: ParserInput) -> NomResult<Object> {
     map(tag(&b"null"[..]), |_| Object::Null).parse(input)
 }
 
-fn array(depth: usize) -> impl Fn(ParserInput) -> NomResult<Vec<Object>> {
+/// An array, nested at most `depth` levels. PdfCraft patch: every element is charged to `nodes`
+/// (see `_direct_object`), which bounds the element count of one array and of all arrays nested
+/// in it.
+fn array(depth: usize, nodes: &Cell<usize>) -> impl Fn(ParserInput) -> NomResult<Vec<Object>> {
     move |input| {
         delimited(
             pair(tag(&b"["[..]), space),
-            many0(_direct_object(depth)),
+            many0(_direct_object(depth, nodes)),
             tag(&b"]"[..]),
         )
         .parse(input)
     }
 }
 
+/// A dictionary, from a node budget of its own (`MAX_NESTED_NODES`).
 pub(crate) fn dictionary(input: ParserInput) -> NomResult<Dictionary> {
-    _dictionary(crate::reader::MAX_NESTING_DEPTH)(input)
+    let nodes = Cell::new(MAX_NESTED_NODES);
+    _dictionary(crate::reader::MAX_NESTING_DEPTH, &nodes)(input)
 }
 
-fn _dictionary(depth: usize) -> impl Fn(ParserInput) -> NomResult<Dictionary> {
-    move |input| delimited(pair(tag(&b"<<"[..]), space), inner_dictionary(depth), tag(&b">>"[..])).parse(input)
+/// `<< ... >>`, nested at most `depth` levels, its values charged to `nodes`.
+fn _dictionary(depth: usize, nodes: &Cell<usize>) -> impl Fn(ParserInput) -> NomResult<Dictionary> {
+    move |input| {
+        delimited(
+            pair(tag(&b"<<"[..]), space),
+            inner_dictionary(depth, nodes),
+            tag(&b">>"[..]),
+        )
+        .parse(input)
+    }
 }
 
-fn inner_dictionary(depth: usize) -> impl Fn(ParserInput) -> NomResult<Dictionary> {
+/// A dictionary's key-value pairs, without its delimiters; each value is charged to `nodes`.
+fn inner_dictionary(depth: usize, nodes: &Cell<usize>) -> impl Fn(ParserInput) -> NomResult<Dictionary> {
     move |input| {
         fold_many0(
-            pair(terminated(name, space), _direct_object(depth)),
+            pair(terminated(name, space), _direct_object(depth, nodes)),
             Dictionary::new,
             |mut dict, (key, value)| {
                 dict.set(key, value);
@@ -307,7 +336,9 @@ fn inner_dictionary(depth: usize) -> impl Fn(ParserInput) -> NomResult<Dictionar
     }
 }
 
+/// A CMap's `N dict dup begin /Key value def ...` dictionary, from a node budget of its own.
 pub(crate) fn dict_dup(input: ParserInput) -> NomResult<Dictionary> {
+    let nodes = Cell::new(MAX_NESTED_NODES);
     delimited(
         (
             digit1,
@@ -323,7 +354,7 @@ pub(crate) fn dict_dup(input: ParserInput) -> NomResult<Dictionary> {
             terminated(
                 pair(
                     terminated(name, space),
-                    _direct_object(crate::reader::MAX_NESTING_DEPTH),
+                    _direct_object(crate::reader::MAX_NESTING_DEPTH, &nodes),
                 ),
                 pair(tag(&b"def"[..]), multispace1),
             ),
@@ -434,7 +465,8 @@ fn reference(input: ParserInput) -> NomResult<Object> {
     map(terminated(object_id, tag(&b"R"[..])), Object::Reference).parse(input)
 }
 
-fn _direct_objects(depth: usize) -> impl Fn(ParserInput) -> NomResult<Object> {
+/// Any direct object, its nested arrays and dictionaries at most `depth` levels deep.
+fn _direct_objects(depth: usize, nodes: &Cell<usize>) -> impl Fn(ParserInput) -> NomResult<Object> {
     move |input| {
         alt((
             null,
@@ -445,34 +477,55 @@ fn _direct_objects(depth: usize) -> impl Fn(ParserInput) -> NomResult<Object> {
             map(name, Object::Name),
             map(literal_string, Object::string_literal),
             hexadecimal_string,
-            map(array(depth), Object::Array),
-            map(_dictionary(depth), Object::Dictionary),
+            map(array(depth, nodes), Object::Array),
+            map(_dictionary(depth, nodes), Object::Dictionary),
         ))
         .parse(input)
     }
 }
 
-fn _direct_object(depth: usize) -> impl Fn(ParserInput) -> NomResult<Object> {
+/// A direct object and the whitespace after it, charged one node once built; a spent budget
+/// or a depth of 0 is a nom `Failure`.
+fn _direct_object(depth: usize, nodes: &Cell<usize>) -> impl Fn(ParserInput) -> NomResult<Object> {
     move |input| {
         if depth == 0 {
             return Err(nom::Err::Failure(NomError::from_error_kind(input, ErrorKind::TooLarge)));
         }
-        terminated(_direct_objects(depth - 1), space).parse(input)
+        let (rest, object) = terminated(_direct_objects(depth - 1, nodes), space).parse(input)?;
+        // PdfCraft patch: charge each object once it is built, so a failed alternative costs
+        // nothing; its children were charged as they were built. A spent budget is a Failure,
+        // which ends the whole parse instead of backtracking into another alternative.
+        let Some(left) = nodes.get().checked_sub(1) else {
+            return Err(nom::Err::Failure(NomError::from_error_kind(input, ErrorKind::TooLarge)));
+        };
+        nodes.set(left);
+        Ok((rest, object))
     }
 }
 
+/// One direct object from a fresh node budget. PdfCraft patch: object streams now parse through
+/// `direct_object_within`; only tests use this.
+#[cfg(test)]
 pub fn direct_object(input: ParserInput) -> Option<Object> {
-    strip_nom(_direct_object(crate::reader::MAX_NESTING_DEPTH)(input))
+    direct_object_within(input, &Cell::new(MAX_OBJECT_NODES))
 }
 
+/// PdfCraft patch: parse one direct object, building at most `nodes` objects (the object itself
+/// and everything nested in it) and leaving the unspent count in `nodes`.
+pub(crate) fn direct_object_within(input: ParserInput, nodes: &Cell<usize>) -> Option<Object> {
+    strip_nom(_direct_object(crate::reader::MAX_NESTING_DEPTH, nodes)(input))
+}
+
+/// An indirect object's body (a stream or a direct object), from a node budget of its own.
 fn object<'a>(
     input: ParserInput<'a>, reader: &Reader, already_seen: &mut HashSet<ObjectId>, recover_stream_length: bool,
     recovery_bound: Option<usize>,
 ) -> NomResult<'a, Object> {
+    let nodes = Cell::new(MAX_NESTED_NODES);
     terminated(
         alt((
             |input| stream(input, reader, already_seen, recover_stream_length, recovery_bound),
-            _direct_objects(crate::reader::MAX_NESTING_DEPTH),
+            _direct_objects(crate::reader::MAX_NESTING_DEPTH, &nodes),
         )),
         space,
     )
@@ -689,7 +742,9 @@ fn operator(input: ParserInput) -> NomResult<String> {
     .parse(input)
 }
 
+/// One content-stream operand, from a node budget of its own.
 fn operand(input: ParserInput) -> NomResult<Object> {
+    let nodes = Cell::new(MAX_NESTED_NODES);
     terminated(
         alt((
             null,
@@ -699,7 +754,7 @@ fn operand(input: ParserInput) -> NomResult<Object> {
             map(name, Object::Name),
             map(literal_string, Object::string_literal),
             hexadecimal_string,
-            map(array(crate::reader::MAX_NESTING_DEPTH), Object::Array),
+            map(array(crate::reader::MAX_NESTING_DEPTH, &nodes), Object::Array),
             map(dictionary, Object::Dictionary),
         )),
         content_space,
@@ -724,8 +779,10 @@ fn inline_image(input: ParserInput) -> NomResult<(Vec<Object>, String)> {
     preceded(pair(tag(&b"BI"[..]), content_space), cut(inline_image_impl)).parse(input)
 }
 
+/// An inline image after `BI`: its dictionary (from a node budget of its own) and data.
 fn inline_image_impl(input: ParserInput) -> NomResult<(Vec<Object>, String)> {
-    let (input, stream_dict) = inner_dictionary(crate::reader::MAX_NESTING_DEPTH).parse(input)?;
+    let nodes = Cell::new(MAX_NESTED_NODES);
+    let (input, stream_dict) = inner_dictionary(crate::reader::MAX_NESTING_DEPTH, &nodes).parse(input)?;
     let (input, _) = pair(tag(&b"ID"[..]), content_space).parse(input)?;
     match image_data_stream(input, stream_dict) {
         Ok((input, stream)) => {
@@ -1299,6 +1356,7 @@ EI";
             .unwrap();
     }
 
+    /// Arrays nested past the depth limit are an error, not a stack overflow.
     #[test]
     fn deeply_nested_array_is_rejected() {
         on_big_stack(|| {
@@ -1306,11 +1364,13 @@ EI";
             let mut input = Vec::with_capacity(depth * 2);
             input.extend(std::iter::repeat_n(b'[', depth));
             input.extend(std::iter::repeat_n(b']', depth));
-            let result = _direct_object(crate::reader::MAX_NESTING_DEPTH)(input.as_slice());
+            let result =
+                _direct_object(crate::reader::MAX_NESTING_DEPTH, &Cell::new(MAX_OBJECT_NODES))(input.as_slice());
             assert!(result.is_err());
         });
     }
 
+    /// Dictionaries nested past the depth limit are an error, not a stack overflow.
     #[test]
     fn deeply_nested_dictionary_is_rejected() {
         on_big_stack(|| {
@@ -1322,15 +1382,17 @@ EI";
             for _ in 0..depth {
                 input.extend_from_slice(b">>");
             }
-            let result = _direct_object(crate::reader::MAX_NESTING_DEPTH)(input.as_slice());
+            let result =
+                _direct_object(crate::reader::MAX_NESTING_DEPTH, &Cell::new(MAX_OBJECT_NODES))(input.as_slice());
             assert!(result.is_err());
         });
     }
 
+    /// Nesting well within the limit still parses.
     #[test]
     fn modestly_nested_array_still_parses() {
         let input = b"[[[[[1]]]]]";
-        let obj = _direct_object(crate::reader::MAX_NESTING_DEPTH)(test_span(input));
+        let obj = _direct_object(crate::reader::MAX_NESTING_DEPTH, &Cell::new(MAX_OBJECT_NODES))(test_span(input));
         assert!(obj.is_ok());
     }
 }
diff --git a/vendor/lopdf/src/reader.rs b/vendor/lopdf/src/reader.rs
index d7e33b7dc4..f4da53e3c1 100644
--- a/vendor/lopdf/src/reader.rs
+++ b/vendor/lopdf/src/reader.rs
@@ -1,13 +1,13 @@
 use log::{error, warn};
 use std::cmp;
-use std::collections::{BTreeMap, HashMap, HashSet};
+use std::collections::{BTreeMap, BTreeSet, HashMap, HashSet};
 use std::convert::TryInto;
 #[cfg(not(feature = "async"))]
 use std::fs::File;
 #[cfg(not(feature = "async"))]
 use std::io::Read;
 use std::path::Path;
-use std::sync::Mutex;
+use std::sync::{Mutex, PoisonError};
 
 #[cfg(feature = "rayon")]
 use rayon::prelude::*;
@@ -22,7 +22,7 @@ use crate::common_data_structures;
 use crate::encryption::{self, EncryptionState};
 use crate::error::{ParseError, XrefError};
 use crate::load_options::{FilterFunc, LoadOptions};
-use crate::object_stream::ObjectStream;
+use crate::object_stream::{MAX_LOAD_NODES, NodeBudget, ObjectStream};
 use crate::parser;
 use crate::xref::{Xref, XrefEntry, XrefType};
 use crate::{Dictionary, Document, Error, IncrementalDocument, Object, ObjectId, Result};
@@ -838,6 +838,8 @@ impl Reader<'_> {
         Ok(self.document)
     }
 
+    /// Load an encrypted document: read every object's raw bytes first, then decrypt and parse
+    /// them, object streams from one shared node budget.
     fn load_encrypted_document(&mut self, _filter_func: Option<FilterFunc>) -> Result<()> {
         // First, extract all raw object bytes without parsing
         let entries: Vec<_> = self
@@ -849,6 +851,8 @@ impl Reader<'_> {
             .collect();
 
         let mut object_streams = Vec::new();
+        // PdfCraft patch: one object budget for every object stream this load parses.
+        let node_budget = NodeBudget::new(MAX_LOAD_NODES);
 
         for (obj_num, entry) in entries {
             match entry {
@@ -894,8 +898,9 @@ impl Reader<'_> {
                 }
             }
 
-            let mut streams_to_process: std::collections::HashMap<u32, Vec<(u32, u16)>> =
-                std::collections::HashMap::new();
+            // PdfCraft patch: object streams in object-number order, so the members a spent node
+            // budget skips are the same on every load.
+            let mut streams_to_process: BTreeMap<u32, Vec<(u32, u16)>> = BTreeMap::new();
             for (obj_num, container_id, index) in object_streams {
                 streams_to_process
                     .entry(container_id)
@@ -907,7 +912,11 @@ impl Reader<'_> {
                 if let Some(container_obj) = self.document.objects.get(&(container_id, 0))
                     && let Ok(stream) = container_obj.as_stream()
                 {
-                    match ObjectStream::new_with_limit(stream, self.max_decompressed_size) {
+                    // PdfCraft patch: parse only the members the table places in this stream, so
+                    // the others spend nothing from the budget.
+                    let listed: BTreeSet<u32> = objects_in_stream.iter().map(|&(obj_num, _)| obj_num).collect();
+                    let keep = |obj_num: u32| listed.contains(&obj_num);
+                    match ObjectStream::new_members_within(stream, self.max_decompressed_size, &node_budget, keep) {
                         Ok(object_stream) => {
                             for (obj_num, _index) in objects_in_stream {
                                 let obj_id = (obj_num, 0);
@@ -960,10 +969,12 @@ impl Reader<'_> {
         self.document.reference_table = xref;
     }
 
+    /// Load every object in the cross-reference table, expanding object streams from one node
+    /// budget shared by the whole load.
     fn load_objects_raw(&mut self, filter_func: Option<FilterFunc>) -> Result<()> {
         let is_encrypted = self.document.trailer.get(b"Encrypt").is_ok();
         let zero_length_streams = Mutex::new(vec![]);
-        let object_streams = Mutex::new(vec![]);
+        let object_stream_ids = Mutex::new(vec![]);
 
         // Build a map of which container each compressed object belongs to
         // according to the xref. This prevents stale ObjStm copies (e.g., from
@@ -1014,36 +1025,10 @@ impl Reader<'_> {
 
                 if let Ok(stream) = object.as_stream() {
                     if stream.dict.has_type(b"ObjStm") && !is_encrypted {
-                        let obj_stream = match ObjectStream::new_with_limit(stream, self.max_decompressed_size) {
-                            Ok(obj_stream) => obj_stream,
-                            // Not an encryption-related loss, so it obeys the same
-                            // strict-mode policy as any other load error.
-                            Err(e) => {
-                                error!("Object stream load error for {object_id:?}: {e:?}");
-                                return if self.strict { Err(e) } else { Ok(None) };
-                            }
-                        };
-                        let container_id = object_id.0;
-                        let mut object_streams = object_streams.lock().unwrap();
-                        if let Some(filter_func) = filter_func {
-                            let objects: BTreeMap<(u32, u16), Object> = obj_stream
-                                .objects
-                                .into_iter()
-                                .filter(|((obj_num, _), _)| {
-                                    compressed_obj_containers
-                                        .get(obj_num)
-                                        .is_none_or(|&c| c == container_id)
-                                })
-                                .filter_map(|(object_id, mut object)| filter_func(object_id, &mut object))
-                                .collect();
-                            object_streams.extend(objects);
-                        } else {
-                            object_streams.extend(obj_stream.objects.into_iter().filter(|((obj_num, _), _)| {
-                                compressed_obj_containers
-                                    .get(obj_num)
-                                    .is_none_or(|&c| c == container_id)
-                            }));
-                        }
+                        // PdfCraft patch: object streams are expanded after this parallel pass,
+                        // one at a time in object-number order (below).
+                        let mut object_stream_ids = object_stream_ids.lock().unwrap_or_else(PoisonError::into_inner);
+                        object_stream_ids.push(object_id);
                     } else if stream.content.is_empty() {
                         let mut zero_length_streams = zero_length_streams.lock().unwrap();
                         zero_length_streams.push(object_id);
@@ -1079,9 +1064,59 @@ impl Reader<'_> {
                 .collect::<Result<BTreeMap<_, _>>>()?;
         }
 
-        // Only add entries, but never replace entries
-        for (id, entry) in object_streams.into_inner().unwrap() {
-            self.document.objects.entry(id).or_insert(entry);
+        // PdfCraft patch: expand the object streams one at a time in object-number order, from one
+        // node budget for the whole load, so many streams, each inside the decompression limit,
+        // cannot together build billions of objects, and the members a spent budget skips are the
+        // same on every load. A stream parses only the members it would add: none the table
+        // places in another stream (stale copies), and none already loaded, as an ordinary object
+        // or from an earlier stream, since a member never replaces an object. Those spend nothing.
+        // Members the table doesn't list at all are still parsed (a rebuilt table lists no
+        // compressed objects) and share the budget.
+        let node_budget = NodeBudget::new(MAX_LOAD_NODES);
+        let mut object_stream_ids = object_stream_ids.into_inner().unwrap_or_else(PoisonError::into_inner);
+        object_stream_ids.sort_unstable();
+        object_stream_ids.dedup();
+        for object_id in object_stream_ids {
+            let container_id = object_id.0;
+            let loaded = &self.document.objects;
+            let keep = |obj_num: u32| {
+                compressed_obj_containers
+                    .get(&obj_num)
+                    .is_none_or(|&c| c == container_id)
+                    && !loaded.contains_key(&(obj_num, 0))
+            };
+            let parsed = match loaded.get(&object_id).map(Object::as_stream) {
+                Some(Ok(stream)) => {
+                    ObjectStream::new_members_within(stream, self.max_decompressed_size, &node_budget, keep)
+                }
+                _ => continue,
+            };
+            match parsed {
+                Ok(obj_stream) => {
+                    let members: BTreeMap<_, _> = match filter_func {
+                        Some(filter_func) => obj_stream
+                            .objects
+                            .into_iter()
+                            .filter_map(|(object_id, mut object)| filter_func(object_id, &mut object))
+                            .collect(),
+                        None => obj_stream.objects,
+                    };
+                    // Only add entries, but never replace entries
+                    for (id, entry) in members {
+                        self.document.objects.entry(id).or_insert(entry);
+                    }
+                }
+                // Not an encryption-related loss, so it obeys the same strict-mode policy as
+                // any other load error; a lenient load drops the stream, as it drops any object
+                // that fails to load.
+                Err(e) => {
+                    error!("Object stream load error for {object_id:?}: {e:?}");
+                    if self.strict {
+                        return Err(e);
+                    }
+                    self.document.objects.remove(&object_id);
+                }
+            }
         }
 
         for object_id in zero_length_streams.into_inner().unwrap() {
@@ -1174,8 +1209,14 @@ impl Reader<'_> {
         let container_id = (container_id, 0);
         let container_obj = self.get_object(container_id, already_seen)?;
         let container_stream = container_obj.as_stream()?;
-        let object_stream = ObjectStream::new_with_limit(container_stream, self.max_decompressed_size)?;
-        object_stream.objects.get(&id).cloned().ok_or(Error::MissingXrefEntry)
+        // PdfCraft patch: a lookup parses only the member it wants, from one object's budget
+        // rather than a load's, so the members before it can't spend that budget first.
+        let budget = NodeBudget::new(parser::MAX_OBJECT_NODES);
+        let mut object_stream =
+            ObjectStream::new_members_within(container_stream, self.max_decompressed_size, &budget, |obj_num| {
+                obj_num == id.0
+            })?;
+        object_stream.objects.remove(&id).ok_or(Error::MissingXrefEntry)
     }
 
     pub fn get_object(&self, id: ObjectId, already_seen: &mut HashSet<ObjectId>) -> Result<Object> {