M7: Reads::decode says what a stage past its limit is charged

The Claims review of the description at b7224cbc9. `Reads::decode` said a
stream past its limit is unread, not refused, "when what is left can pay
for its stages". What `DecodeBudget::decode_stages_within` does, and
`a_stage_past_its_limit_charges_what_came_before_and_the_limit` pins:
with more left than what the stages before the stopped one made and the
limit, it is charged those two; otherwise, with more left than the
stages' total (behind one filter, the limit), it is charged that total;
with no more left than that total, it spends all of it and counts as
refused.

`MAX_THAI_PROGRAMS` also names the second read of a subset's program,
for which of its glyphs have outlines, among what it pays for.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AmsdeUCdTaD72jkDw2pJKY

crates/edit/src/text_regions/styled.rs

@@ -117,9 +117,10 @@ struct LegacyFace {
 }
 
 /// What one edit may decode of its THSarabunPSK subsets' font data: their programs (each at most
-/// 16 MiB), which it keeps, and the CMaps and glyph maps read to adapt their programs' cmaps. A
-/// page may name many of them. The metrics read to find and measure the subsets
-/// (`Metrics::from_dict`) aren't charged to it.
+/// 16 MiB), which it keeps, and what is read to adapt their programs' cmaps: their CMaps and glyph
+/// maps, and a subset's program again, for which of its glyphs have outlines. A page may name many
+/// of them. The metrics read to find and measure the subsets (`Metrics::from_dict`) aren't charged
+/// to it.
 const MAX_THAI_PROGRAMS: usize = 64 << 20;
 
 struct PreparedCharacters {

crates/fonts/src/pdf.rs

@@ -415,9 +415,11 @@ impl<'a> Reads<'a> {
     /// the stages together to `max` for each of them ([`DecodeBudget::decode_stages_within`]): a
     /// map of 65,536 CIDs behind ASCIIHex and Flate, its Flate data smaller than the map, makes
     /// all of `MAX_CID_TO_GID` in its last stage, with the hex stage's output on top. So a stream
-    /// reads here when it reads without an allowance and what is left pays for it. A stream past
-    /// `max` is unread, not refused, when what is left can pay for its stages; when it can't, the
-    /// stream spends it and counts as refused.
+    /// reads here when it reads without an allowance and what is left pays for it. A stream with a
+    /// stage past `max` is unread. When what is left is more than what the stages before that one
+    /// made and `max`, it is charged those two and isn't refused; otherwise, with more left than
+    /// the stages' total (behind one filter, `max`), it is charged that total and isn't refused;
+    /// with no more left than that total, it spends all of it and counts as refused.
     fn decode(&mut self, stream: &Stream, max: usize) -> Option<Vec<u8>> {
         // Once the allowance is spent the decode refuses the stream; refused here, before the
         // parameters are resolved, which is work the allowance doesn't count.