diff --git a/.config/nextest.toml b/.config/nextest.toml
index 2a4cd2cb93..11ec94cc1a 100644
--- a/.config/nextest.toml
+++ b/.config/nextest.toml
@@ -1,3 +1,10 @@
 # Minimum cargo-nextest for this repository: GHSA-vc25-qg58-w57c is fixed in 0.9.150 and CI
 # installs exactly that version, so an older nextest refuses to run (exit 92 REQUIRED_VERSION_NOT_MET).
 nextest-version = "0.9.150"
+
+# These measurements require a quiet runner. Their in-process SERIAL mutex only
+# serializes cargo test; nextest gives each test its own process. Reserve all slots
+# so other tests cannot charge their CPU/render-worker time to a frame budget.
+[[profile.default.overrides]]
+filter = 'package(pdfcraft-ui-egui) & binary(perf)'
+threads-required = "num-test-threads"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a5c2ba7f7f..d8549142f7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -12,6 +12,7 @@ on:
 
 permissions:
   contents: write
+  packages: write
 
 concurrency:
   group: release-${{ github.ref }}
diff --git a/ATTRIBUTION.md b/ATTRIBUTION.md
index 8da4b0a200..fc88e8b664 100644
--- a/ATTRIBUTION.md
+++ b/ATTRIBUTION.md
@@ -36,181 +36,181 @@ Every asset PdfCraft includes, bundles or uses to build its published material,
 | `crates/ui-egui/src/i18n/ko.tsv` | Korean interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Korean UI strings, compiled in by crates/ui-egui/src/i18n.rs |
 | `crates/ui-egui/src/i18n/ro.tsv` | Romanian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels and user-facing messages; AI-assisted and not yet reviewed line by line by a native Romanian speaker; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Romanian UI strings, compiled in by crates/ui-egui/src/i18n.rs |
 | `crates/ui-egui/src/i18n/fi.tsv` | Finnish interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: AI-assisted (Claude Code) clean-room translations of PdfCraft's English UI labels and user-facing messages; not yet proofread by a native Finnish speaker; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 calculation-order, text-format, print, thumbnail, layer, comment-reshape and signature labels (previously English placeholders) are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Finnish UI strings, compiled in by crates/ui-egui/src/i18n.rs |
-| `assets/icons/accessibility.svg` | Lucide icon "accessibility" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/accessibility.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/align-left.svg` | Lucide icon "align-left" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-left.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/align-center.svg` | Lucide icon "align-center" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-center.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/square-terminal.svg` | Lucide icon "square-terminal" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/square-terminal.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-code.svg` | Lucide icon "file-code" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-code.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-spreadsheet.svg` | Lucide icon "file-spreadsheet" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-spreadsheet.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/align-justify.svg` | Lucide icon "align-justify" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-justify.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/align-right.svg` | Lucide icon "align-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/columns-3.svg` | Lucide icon "columns-3" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/columns-3.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/rows-3.svg` | Lucide icon "rows-3" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/rows-3.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/flip-horizontal-2.svg` | Lucide icon "flip-horizontal-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/flip-horizontal-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/flip-vertical-2.svg` | Lucide icon "flip-vertical-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/flip-vertical-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/app-window.svg` | Lucide icon "app-window" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/app-window.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/arrow-left-right.svg` | Lucide icon "arrow-left-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/arrow-left-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/arrow-up-down.svg` | Lucide icon "arrow-up-down" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/arrow-up-down.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/arrow-up-right.svg` | Lucide icon "arrow-up-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/arrow-up-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/badge-check.svg` | Lucide icon "badge-check" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/badge-check.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/bandage.svg` | Lucide icon "bandage" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bandage.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/bell.svg` | Lucide icon "bell" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bell.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/blend.svg` | Lucide icon "blend" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/blend.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/bold.svg` | Lucide icon "bold" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bold.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/book-open.svg` | Lucide icon "book-open" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/book-open.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/bookmark.svg` | Lucide icon "bookmark" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bookmark.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/bookmark-plus.svg` | Lucide icon "bookmark-plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bookmark-plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/braces.svg` | Lucide icon "braces" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/braces.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/brush-cleaning.svg` | Lucide icon "brush-cleaning" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/brush-cleaning.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/brush.svg` | Lucide icon "brush" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/brush.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/camera.svg` | Lucide icon "camera" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/camera.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/check-circle-2.svg` | Lucide icon "check-circle-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/check-circle-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/check.svg` | Lucide icon "check" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/check.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/chevron-down.svg` | Lucide icon "chevron-down" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevron-down.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/chevron-left.svg` | Lucide icon "chevron-left" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevron-left.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/chevron-right.svg` | Lucide icon "chevron-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevron-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/chevron-up.svg` | Lucide icon "chevron-up" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevron-up.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/chevrons-left.svg` | Lucide icon "chevrons-left" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevrons-left.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/chevrons-right.svg` | Lucide icon "chevrons-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevrons-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/circle-check.svg` | Lucide icon "circle-check" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-check.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/circle-dashed.svg` | Lucide icon "circle-dashed" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-dashed.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/circle-dot.svg` | Lucide icon "circle-dot" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-dot.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/circle-help.svg` | Lucide icon "circle-help" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-help.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/circle.svg` | Lucide icon "circle" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/clock-3.svg` | Lucide icon "clock-3" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/clock-3.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/clock.svg` | Lucide icon "clock" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/clock.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/cloud-upload.svg` | Lucide icon "cloud-upload" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/cloud-upload.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/cloud.svg` | Lucide icon "cloud" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/cloud.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/code-xml.svg` | Lucide icon "code-xml" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/code-xml.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/columns-2.svg` | Lucide icon "columns-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/columns-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/compass.svg` | Lucide icon "compass" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/compass.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/contrast.svg` | Lucide icon "contrast" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/contrast.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/copy-plus.svg` | Lucide icon "copy-plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/copy-plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/copy.svg` | Lucide icon "copy" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/copy.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/crop.svg` | Lucide icon "crop" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/crop.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/droplet.svg` | Lucide icon "droplet" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/droplet.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/ellipsis-vertical.svg` | Lucide icon "ellipsis-vertical" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/ellipsis-vertical.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/ellipsis.svg` | Lucide icon "ellipsis" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/ellipsis.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/eraser.svg` | Lucide icon "eraser" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/eraser.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/external-link.svg` | Lucide icon "external-link" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/external-link.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/eye-off.svg` | Lucide icon "eye-off" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/eye-off.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/eye.svg` | Lucide icon "eye" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/eye.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-check.svg` | Lucide icon "file-check" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-check.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-down.svg` | Lucide icon "file-down" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-down.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-input.svg` | Lucide icon "file-input" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-input.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-lock-2.svg` | Lucide icon "file-lock-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-lock-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-minus.svg` | Lucide icon "file-minus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-minus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-output.svg` | Lucide icon "file-output" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-output.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-pen-line.svg` | Lucide icon "file-pen-line" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-pen-line.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-plus-2.svg` | Lucide icon "file-plus-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-plus-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-plus.svg` | Lucide icon "file-plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-scan.svg` | Lucide icon "file-scan" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-scan.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-search.svg` | Lucide icon "file-search" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-search.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-symlink.svg` | Lucide icon "file-symlink" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-symlink.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-text.svg` | Lucide icon "file-text" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-text.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-x.svg` | Lucide icon "file-x" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-x.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/files.svg` | Lucide icon "files" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/files.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/film.svg` | Lucide icon "film" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/film.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/filter.svg` | Lucide icon "filter" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/filter.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/folder-open.svg` | Lucide icon "folder-open" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/folder-open.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/folder-plus.svg` | Lucide icon "folder-plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/folder-plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/folder.svg` | Lucide icon "folder" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/folder.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/gauge.svg` | Lucide icon "gauge" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/gauge.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/git-compare.svg` | Lucide icon "git-compare" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/git-compare.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/globe.svg` | Lucide icon "globe" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/globe.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/grid-3x3.svg` | Lucide icon "grid-3x3" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/grid-3x3.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/hand.svg` | Lucide icon "hand" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/hand.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/hash.svg` | Lucide icon "hash" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/hash.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/heading.svg` | Lucide icon "heading" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/heading.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/highlighter.svg` | Lucide icon "highlighter" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/highlighter.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/house.svg` | Lucide icon "house" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/house.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/image-plus.svg` | Lucide icon "image-plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/image-plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/image.svg` | Lucide icon "image" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/image.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/info.svg` | Lucide icon "info" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/info.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/italic.svg` | Lucide icon "italic" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/italic.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/languages.svg` | Lucide icon "languages" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/languages.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/lasso.svg` | Lucide icon "lasso" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/lasso.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/layers.svg` | Lucide icon "layers" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/layers.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/layout-grid.svg` | Lucide icon "layout-grid" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/layout-grid.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/link-2.svg` | Lucide icon "link-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/link-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/link.svg` | Lucide icon "link" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/link.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/list-checks.svg` | Lucide icon "list-checks" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/list-checks.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/list-ordered.svg` | Lucide icon "list-ordered" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/list-ordered.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/list.svg` | Lucide icon "list" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/list.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/lock-open.svg` | Lucide icon "lock-open" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/lock-open.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/lock.svg` | Lucide icon "lock" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/lock.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/maximize-2.svg` | Lucide icon "maximize-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/maximize-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/maximize.svg` | Lucide icon "maximize" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/maximize.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/message-circle-reply.svg` | Lucide icon "message-circle-reply" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-circle-reply.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/message-square-text.svg` | Lucide icon "message-square-text" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-square-text.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/message-square.svg` | Lucide icon "message-square" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-square.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/messages-square.svg` | Lucide icon "messages-square" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/messages-square.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/mic.svg` | Lucide icon "mic" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/mic.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/minimize.svg` | Lucide icon "minimize" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/minimize.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/minimize-2.svg` | Lucide icon "minimize-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/minimize-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/minus.svg` | Lucide icon "minus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/minus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/moon.svg` | Lucide icon "moon" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/moon.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/mouse-pointer-2.svg` | Lucide icon "mouse-pointer-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/mouse-pointer-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/move.svg` | Lucide icon "move" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/move.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/navigation.svg` | Lucide icon "navigation" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/navigation.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/paint-bucket.svg` | Lucide icon "paint-bucket" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/paint-bucket.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/palette.svg` | Lucide icon "palette" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/palette.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/panel-left.svg` | Lucide icon "panel-left" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/panel-left.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/panel-right.svg` | Lucide icon "panel-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/panel-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/panels-top-left.svg` | Lucide icon "panels-top-left" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/panels-top-left.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/paperclip.svg` | Lucide icon "paperclip" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/paperclip.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/pen-line.svg` | Lucide icon "pen-line" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pen-line.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/pen-tool.svg` | Lucide icon "pen-tool" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pen-tool.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/pencil.svg` | Lucide icon "pencil" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pencil.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/pipette.svg` | Lucide icon "pipette" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pipette.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/plus.svg` | Lucide icon "plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/presentation.svg` | Lucide icon "presentation" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/presentation.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/printer.svg` | Lucide icon "printer" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/printer.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/rectangle-horizontal.svg` | Lucide icon "rectangle-horizontal" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/rectangle-horizontal.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/redo-2.svg` | Lucide icon "redo-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/redo-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/replace.svg` | Lucide icon "replace" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/replace.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/rotate-ccw.svg` | Lucide icon "rotate-ccw" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/rotate-ccw.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/rotate-cw.svg` | Lucide icon "rotate-cw" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/rotate-cw.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/ruler.svg` | Lucide icon "ruler" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/ruler.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/save.svg` | Lucide icon "save" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/save.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/scan-text.svg` | Lucide icon "scan-text" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/scan-text.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/scan.svg` | Lucide icon "scan" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/scan.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/scissors.svg` | Lucide icon "scissors" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/scissors.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/search.svg` | Lucide icon "search" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/search.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/send.svg` | Lucide icon "send" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/send.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/settings-2.svg` | Lucide icon "settings-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/settings-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/settings.svg` | Lucide icon "settings" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/settings.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/share-2.svg` | Lucide icon "share-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/share-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/shield-check.svg` | Lucide icon "shield-check" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/shield-check.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/signature.svg` | Lucide icon "signature" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/signature.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/sliders-horizontal.svg` | Lucide icon "sliders-horizontal" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/sliders-horizontal.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/sparkles.svg` | Lucide icon "sparkles" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/sparkles.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/spline.svg` | Lucide icon "spline" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/spline.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/square-dashed-mouse-pointer.svg` | Lucide icon "square-dashed-mouse-pointer" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/square-dashed-mouse-pointer.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/square-dashed.svg` | Lucide icon "square-dashed" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/square-dashed.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/square.svg` | Lucide icon "square" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/square.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/squares-subtract.svg` | Lucide icon "squares-subtract" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/squares-subtract.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/stamp.svg` | Lucide icon "stamp" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/stamp.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/star.svg` | Lucide icon "star" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/star.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/sticky-note.svg` | Lucide icon "sticky-note" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/sticky-note.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/strikethrough.svg` | Lucide icon "strikethrough" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/strikethrough.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/sun.svg` | Lucide icon "sun" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/sun.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/swatch-book.svg` | Lucide icon "swatch-book" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/swatch-book.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/tag.svg` | Lucide icon "tag" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/tag.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/text-cursor-input.svg` | Lucide icon "text-cursor-input" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/text-cursor-input.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/text-select.svg` | Lucide icon "text-select" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/text-select.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/trash-2.svg` | Lucide icon "trash-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/trash-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/trash.svg` | Lucide icon "trash" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/trash.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/triangle-alert.svg` | Lucide icon "triangle-alert" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/triangle-alert.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/type.svg` | Lucide icon "type" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/type.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/underline.svg` | Lucide icon "underline" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/underline.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/undo-2.svg` | Lucide icon "undo-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/undo-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/user-round.svg` | Lucide icon "user-round" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/user-round.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/wand-sparkles.svg` | Lucide icon "wand-sparkles" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/wand-sparkles.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/wrench.svg` | Lucide icon "wrench" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/wrench.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/x.svg` | Lucide icon "x" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/x.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/zoom-in.svg` | Lucide icon "zoom-in" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/zoom-in.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/zoom-out.svg` | Lucide icon "zoom-out" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/zoom-out.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/accessibility.svg` | Lucide icon "accessibility" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/accessibility.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/align-left.svg` | Lucide icon "align-left" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-left.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/align-center.svg` | Lucide icon "align-center" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-center.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/square-terminal.svg` | Lucide icon "square-terminal" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/square-terminal.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-code.svg` | Lucide icon "file-code" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-code.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-spreadsheet.svg` | Lucide icon "file-spreadsheet" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-spreadsheet.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/align-justify.svg` | Lucide icon "align-justify" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-justify.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/align-right.svg` | Lucide icon "align-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/columns-3.svg` | Lucide icon "columns-3" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/columns-3.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/rows-3.svg` | Lucide icon "rows-3" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/rows-3.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/flip-horizontal-2.svg` | Lucide icon "flip-horizontal-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/flip-horizontal-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/flip-vertical-2.svg` | Lucide icon "flip-vertical-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/flip-vertical-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/app-window.svg` | Lucide icon "app-window" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/app-window.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/arrow-left-right.svg` | Lucide icon "arrow-left-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/arrow-left-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/arrow-up-down.svg` | Lucide icon "arrow-up-down" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/arrow-up-down.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/arrow-up-right.svg` | Lucide icon "arrow-up-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/arrow-up-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/badge-check.svg` | Lucide icon "badge-check" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/badge-check.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/bandage.svg` | Lucide icon "bandage" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bandage.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/bell.svg` | Lucide icon "bell" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bell.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/blend.svg` | Lucide icon "blend" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/blend.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/bold.svg` | Lucide icon "bold" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bold.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/book-open.svg` | Lucide icon "book-open" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/book-open.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/bookmark.svg` | Lucide icon "bookmark" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bookmark.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/bookmark-plus.svg` | Lucide icon "bookmark-plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bookmark-plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/braces.svg` | Lucide icon "braces" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/braces.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/brush-cleaning.svg` | Lucide icon "brush-cleaning" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/brush-cleaning.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/brush.svg` | Lucide icon "brush" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/brush.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/camera.svg` | Lucide icon "camera" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/camera.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/check-circle-2.svg` | Lucide icon "check-circle-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/check-circle-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/check.svg` | Lucide icon "check" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/check.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/chevron-down.svg` | Lucide icon "chevron-down" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevron-down.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/chevron-left.svg` | Lucide icon "chevron-left" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevron-left.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/chevron-right.svg` | Lucide icon "chevron-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevron-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/chevron-up.svg` | Lucide icon "chevron-up" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevron-up.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/chevrons-left.svg` | Lucide icon "chevrons-left" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevrons-left.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/chevrons-right.svg` | Lucide icon "chevrons-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevrons-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/circle-check.svg` | Lucide icon "circle-check" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-check.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/circle-dashed.svg` | Lucide icon "circle-dashed" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-dashed.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/circle-dot.svg` | Lucide icon "circle-dot" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-dot.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/circle-help.svg` | Lucide icon "circle-help" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-help.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/circle.svg` | Lucide icon "circle" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/clock-3.svg` | Lucide icon "clock-3" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/clock-3.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/clock.svg` | Lucide icon "clock" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/clock.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/cloud-upload.svg` | Lucide icon "cloud-upload" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/cloud-upload.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/cloud.svg` | Lucide icon "cloud" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/cloud.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/code-xml.svg` | Lucide icon "code-xml" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/code-xml.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/columns-2.svg` | Lucide icon "columns-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/columns-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/compass.svg` | Lucide icon "compass" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/compass.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/contrast.svg` | Lucide icon "contrast" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/contrast.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/copy-plus.svg` | Lucide icon "copy-plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/copy-plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/copy.svg` | Lucide icon "copy" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/copy.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/crop.svg` | Lucide icon "crop" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/crop.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/droplet.svg` | Lucide icon "droplet" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/droplet.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/ellipsis-vertical.svg` | Lucide icon "ellipsis-vertical" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/ellipsis-vertical.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/ellipsis.svg` | Lucide icon "ellipsis" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/ellipsis.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/eraser.svg` | Lucide icon "eraser" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/eraser.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/external-link.svg` | Lucide icon "external-link" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/external-link.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/eye-off.svg` | Lucide icon "eye-off" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/eye-off.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/eye.svg` | Lucide icon "eye" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/eye.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-check.svg` | Lucide icon "file-check" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-check.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-down.svg` | Lucide icon "file-down" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-down.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-input.svg` | Lucide icon "file-input" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-input.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-lock-2.svg` | Lucide icon "file-lock-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-lock-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-minus.svg` | Lucide icon "file-minus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-minus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-output.svg` | Lucide icon "file-output" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-output.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-pen-line.svg` | Lucide icon "file-pen-line" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-pen-line.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-plus-2.svg` | Lucide icon "file-plus-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-plus-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-plus.svg` | Lucide icon "file-plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-scan.svg` | Lucide icon "file-scan" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-scan.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-search.svg` | Lucide icon "file-search" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-search.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-symlink.svg` | Lucide icon "file-symlink" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-symlink.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-text.svg` | Lucide icon "file-text" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-text.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-x.svg` | Lucide icon "file-x" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-x.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/files.svg` | Lucide icon "files" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/files.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/film.svg` | Lucide icon "film" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/film.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/filter.svg` | Lucide icon "filter" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/filter.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/folder-open.svg` | Lucide icon "folder-open" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/folder-open.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/folder-plus.svg` | Lucide icon "folder-plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/folder-plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/folder.svg` | Lucide icon "folder" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/folder.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/gauge.svg` | Lucide icon "gauge" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/gauge.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/git-compare.svg` | Lucide icon "git-compare" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/git-compare.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/globe.svg` | Lucide icon "globe" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/globe.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/grid-3x3.svg` | Lucide icon "grid-3x3" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/grid-3x3.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/hand.svg` | Lucide icon "hand" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/hand.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/hash.svg` | Lucide icon "hash" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/hash.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/heading.svg` | Lucide icon "heading" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/heading.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/highlighter.svg` | Lucide icon "highlighter" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/highlighter.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/house.svg` | Lucide icon "house" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/house.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/image-plus.svg` | Lucide icon "image-plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/image-plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/image.svg` | Lucide icon "image" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/image.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/info.svg` | Lucide icon "info" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/info.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/italic.svg` | Lucide icon "italic" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/italic.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/languages.svg` | Lucide icon "languages" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/languages.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/lasso.svg` | Lucide icon "lasso" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/lasso.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/layers.svg` | Lucide icon "layers" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/layers.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/layout-grid.svg` | Lucide icon "layout-grid" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/layout-grid.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/link-2.svg` | Lucide icon "link-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/link-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/link.svg` | Lucide icon "link" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/link.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/list-checks.svg` | Lucide icon "list-checks" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/list-checks.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/list-ordered.svg` | Lucide icon "list-ordered" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/list-ordered.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/list.svg` | Lucide icon "list" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/list.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/lock-open.svg` | Lucide icon "lock-open" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/lock-open.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/lock.svg` | Lucide icon "lock" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/lock.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/maximize-2.svg` | Lucide icon "maximize-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/maximize-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/maximize.svg` | Lucide icon "maximize" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/maximize.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/message-circle-reply.svg` | Lucide icon "message-circle-reply" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-circle-reply.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/message-square-text.svg` | Lucide icon "message-square-text" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-square-text.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/message-square.svg` | Lucide icon "message-square" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-square.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/messages-square.svg` | Lucide icon "messages-square" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/messages-square.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/mic.svg` | Lucide icon "mic" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/mic.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/minimize.svg` | Lucide icon "minimize" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/minimize.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/minimize-2.svg` | Lucide icon "minimize-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/minimize-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/minus.svg` | Lucide icon "minus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/minus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/moon.svg` | Lucide icon "moon" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/moon.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/mouse-pointer-2.svg` | Lucide icon "mouse-pointer-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/mouse-pointer-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/move.svg` | Lucide icon "move" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/move.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/navigation.svg` | Lucide icon "navigation" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/navigation.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/paint-bucket.svg` | Lucide icon "paint-bucket" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/paint-bucket.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/palette.svg` | Lucide icon "palette" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/palette.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/panel-left.svg` | Lucide icon "panel-left" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/panel-left.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/panel-right.svg` | Lucide icon "panel-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/panel-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/panels-top-left.svg` | Lucide icon "panels-top-left" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/panels-top-left.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/paperclip.svg` | Lucide icon "paperclip" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/paperclip.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/pen-line.svg` | Lucide icon "pen-line" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pen-line.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/pen-tool.svg` | Lucide icon "pen-tool" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pen-tool.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/pencil.svg` | Lucide icon "pencil" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pencil.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/pipette.svg` | Lucide icon "pipette" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pipette.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/plus.svg` | Lucide icon "plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/presentation.svg` | Lucide icon "presentation" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/presentation.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/printer.svg` | Lucide icon "printer" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/printer.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/rectangle-horizontal.svg` | Lucide icon "rectangle-horizontal" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/rectangle-horizontal.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/redo-2.svg` | Lucide icon "redo-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/redo-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/replace.svg` | Lucide icon "replace" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/replace.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/rotate-ccw.svg` | Lucide icon "rotate-ccw" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/rotate-ccw.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/rotate-cw.svg` | Lucide icon "rotate-cw" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/rotate-cw.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/ruler.svg` | Lucide icon "ruler" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/ruler.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/save.svg` | Lucide icon "save" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/save.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/scan-text.svg` | Lucide icon "scan-text" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/scan-text.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/scan.svg` | Lucide icon "scan" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/scan.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/scissors.svg` | Lucide icon "scissors" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/scissors.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/search.svg` | Lucide icon "search" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/search.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/send.svg` | Lucide icon "send" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/send.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/settings-2.svg` | Lucide icon "settings-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/settings-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/settings.svg` | Lucide icon "settings" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/settings.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/share-2.svg` | Lucide icon "share-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/share-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/shield-check.svg` | Lucide icon "shield-check" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/shield-check.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/signature.svg` | Lucide icon "signature" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/signature.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/sliders-horizontal.svg` | Lucide icon "sliders-horizontal" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/sliders-horizontal.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/sparkles.svg` | Lucide icon "sparkles" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/sparkles.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/spline.svg` | Lucide icon "spline" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/spline.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/square-dashed-mouse-pointer.svg` | Lucide icon "square-dashed-mouse-pointer" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/square-dashed-mouse-pointer.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/square-dashed.svg` | Lucide icon "square-dashed" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/square-dashed.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/square.svg` | Lucide icon "square" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/square.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/squares-subtract.svg` | Lucide icon "squares-subtract" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/squares-subtract.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/stamp.svg` | Lucide icon "stamp" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/stamp.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/star.svg` | Lucide icon "star" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/star.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/sticky-note.svg` | Lucide icon "sticky-note" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/sticky-note.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/strikethrough.svg` | Lucide icon "strikethrough" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/strikethrough.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/sun.svg` | Lucide icon "sun" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/sun.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/swatch-book.svg` | Lucide icon "swatch-book" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/swatch-book.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/tag.svg` | Lucide icon "tag" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/tag.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/text-cursor-input.svg` | Lucide icon "text-cursor-input" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/text-cursor-input.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/text-select.svg` | Lucide icon "text-select" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/text-select.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/trash-2.svg` | Lucide icon "trash-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/trash-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/trash.svg` | Lucide icon "trash" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/trash.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/triangle-alert.svg` | Lucide icon "triangle-alert" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/triangle-alert.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/type.svg` | Lucide icon "type" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/type.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/underline.svg` | Lucide icon "underline" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/underline.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/undo-2.svg` | Lucide icon "undo-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/undo-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/user-round.svg` | Lucide icon "user-round" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/user-round.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/wand-sparkles.svg` | Lucide icon "wand-sparkles" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/wand-sparkles.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/wrench.svg` | Lucide icon "wrench" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/wrench.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/x.svg` | Lucide icon "x" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/x.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/zoom-in.svg` | Lucide icon "zoom-in" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/zoom-in.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/zoom-out.svg` | Lucide icon "zoom-out" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/zoom-out.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
 | `assets/fonts/Inter-Regular.ttf` | Inter Regular | The Inter Project Authors (Rasmus Andersson) | OFL-1.1 | https://github.com/rsms/inter | UI font, embedded in the app; demo PDF labels; slanted fallback glyphs in Fill & Sign typed signatures for characters Dancing Script lacks (Cyrillic, Greek), drawn as filled paths |
 | `assets/fonts/Inter-Medium.ttf` | Inter Medium | The Inter Project Authors (Rasmus Andersson) | OFL-1.1 | https://github.com/rsms/inter | UI font, embedded in the app; demo PDF labels |
 | `assets/fonts/Inter-SemiBold.ttf` | Inter SemiBold | The Inter Project Authors (Rasmus Andersson) | OFL-1.1 | https://github.com/rsms/inter | UI font, embedded in the app; demo PDF labels |
@@ -269,31 +269,31 @@ Every asset PdfCraft includes, bundles or uses to build its published material,
 | `docs/images/pdfcraft-tools.png` | PdfCraft screenshot: All tools | PdfCraft contributors (generated by `cargo xtask screenshots`) | MIT OR Apache-2.0 | this repository | README: tool catalogue. Shows PdfCraft UI, Lucide icons, the showcase PDF built from the [[fetched]] OFL fonts, and the ArtCraft mark (Storyteller trademark from docs/brand/, not covered by this licence) |
 | `docs/images/pdfcraft-twoup.png` | PdfCraft screenshot: Two-up reading | PdfCraft contributors (generated by `cargo xtask screenshots`) | MIT OR Apache-2.0 | this repository | README: layouts. Shows only PdfCraft UI, Lucide icons and the showcase PDF built from the [[fetched]] OFL fonts |
 | `docs/images/pdfcraft-viewer.png` | PdfCraft screenshot: Viewer with comments | PdfCraft contributors (generated by `cargo xtask screenshots`) | MIT OR Apache-2.0 | this repository | README hero. Shows only PdfCraft UI, Lucide icons and the showcase PDF built from the [[fetched]] OFL fonts |
-| `assets/icons/pin.svg` | Lucide icon "pin" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pin.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/move-right.svg` | Lucide icon "move-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/move-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/reply.svg` | Lucide icon "reply" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/reply.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/thumbs-up.svg` | Lucide icon "thumbs-up" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/thumbs-up.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/thumbs-down.svg` | Lucide icon "thumbs-down" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/thumbs-down.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/message-square-plus.svg` | Lucide icon "message-square-plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-square-plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/circle-x.svg` | Lucide icon "circle-x" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-x.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/pin.svg` | Lucide icon "pin" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pin.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/move-right.svg` | Lucide icon "move-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/move-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/reply.svg` | Lucide icon "reply" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/reply.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/thumbs-up.svg` | Lucide icon "thumbs-up" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/thumbs-up.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/thumbs-down.svg` | Lucide icon "thumbs-down" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/thumbs-down.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/message-square-plus.svg` | Lucide icon "message-square-plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-square-plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/circle-x.svg` | Lucide icon "circle-x" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-x.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
 | `crates/ui-egui/tests/data/form.pdf` | One-page AcroForm test fixture (text, check box, radio group, combo box) | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: hand-written PDF objects, no third-party content | Form-filling UI tests (crates/ui-egui/tests/it/forms.rs, commands.rs) |
-| `assets/icons/pentagon.svg` | Lucide icon "pentagon" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pentagon.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/message-square-quote.svg` | Lucide icon "message-square-quote" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-square-quote.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/pentagon.svg` | Lucide icon "pentagon" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pentagon.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/message-square-quote.svg` | Lucide icon "message-square-quote" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-square-quote.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
 | `crates/sign/tests/data/openssl-signed.pdf` | One-page PDF signed with OpenSSL CMS (adbe.pkcs7.detached) by the RSA test key | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: hand-written PDF objects; signature made with `openssl cms -sign` over its byte ranges (see crates/sign/tests/data/README.md) | Signature validation tests (crates/sign/tests/it/pdf.rs): a signature PdfCraft did not make |
-| `assets/icons/clipboard-paste.svg` | Lucide icon "clipboard-paste" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/clipboard-paste.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/clipboard-paste.svg` | Lucide icon "clipboard-paste" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/clipboard-paste.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
 | `assets/fonts/DancingScript.ttf` | Dancing Script (variable) | The Dancing Script Project Authors (Pablo Impallari) | OFL-1.1 | https://github.com/google/fonts/blob/9710da1eacb3be272583c3224dcb70f9da6eadbb/ofl/dancingscript/DancingScript%5Bwght%5D.ttf | Fill & Sign typed signatures and initials: the typed name's glyph outlines, drawn as filled paths (the font file itself is not embedded in PDFs) |
 | `packaging/macos/dmg/background.svg` | PdfCraft macOS DMG window background | @XusBadia | MIT OR Apache-2.0 | Original work for this repository, derived from the PdfCraft app icon (assets/app-icon/pdfcraft.svg, referenced via an SVG image element, not copied) | Finder window of the macOS DMG; rendered to background.tiff by packaging/macos/dmg/generate.py |
 | `packaging/macos/dmg/background.tiff` | PdfCraft macOS DMG window background (rendered) | @XusBadia | MIT OR Apache-2.0 | Rendered from packaging/macos/dmg/background.svg by packaging/macos/dmg/generate.py | 1x + 2x HiDPI 16-colour palette TIFF copied into the macOS DMG by packaging/macos/package.sh; includes the app icon and the free LittleCMS built-in sRGB profile |
 | `crates/sign/tests/data/x509-rsa-sha1.pdf` | One-page PDF with a legacy adbe.x509.rsa_sha1 signature by the RSA test key | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: hand-written PDF objects; signature made with `openssl dgst -sha1 -sign` over its byte ranges (see crates/sign/tests/data/README.md) | Signature validation tests (crates/sign/tests/it/pdf.rs): the legacy adbe.x509.rsa_sha1 format |
-| `assets/icons/monitor.svg` | Lucide icon "monitor" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/monitor.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/monitor.svg` | Lucide icon "monitor" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/monitor.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
 | `crates/ui-egui/src/i18n/vi.tsv` | Vietnamese interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels; PhotoCraft and VectorCraft Vietnamese catalogs used only as translation memory when English source and semantic context matched; original catalog reviewed by a native Vietnamese-speaking contributor; 2026-10-15 coverage additions are AI-assisted and not separately native-reviewed; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 signature-check wordings are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Vietnamese UI strings, compiled in by crates/ui-egui/src/i18n.rs |
 | `crates/ui-egui/src/i18n/sl.tsv` | Slovene interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Slovene UI strings, compiled in by crates/ui-egui/src/i18n.rs |
 | `vendor/vello_common/assets/probe.png` | vello_common probe reference image (rendered from probe.rgba) | Linebender vello contributors | MIT OR Apache-2.0 | vello_common 0.0.8 (crates.io), vendored in vendor/vello_common; regenerated by its vello_sparse_tests regenerate_probe_reference binary | Reference picture of the vendored vello_common probe module, for people only; the build reads probe.rgba, not this file |
 | `crates/ui-egui/src/i18n/nb.tsv` | Norwegian Bokmål interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Norwegian Bokmål UI strings, compiled in by crates/ui-egui/src/i18n.rs |
-| `assets/icons/superscript.svg` | Lucide icon "superscript" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/superscript.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/subscript.svg` | Lucide icon "subscript" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/subscript.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/pilcrow.svg` | Lucide icon "pilcrow" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pilcrow.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/move-horizontal.svg` | Lucide icon "move-horizontal" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/move-horizontal.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/superscript.svg` | Lucide icon "superscript" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/superscript.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/subscript.svg` | Lucide icon "subscript" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/subscript.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/pilcrow.svg` | Lucide icon "pilcrow" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pilcrow.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/move-horizontal.svg` | Lucide icon "move-horizontal" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/move-horizontal.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
 | `crates/ui-egui/src/i18n/sq.tsv` | Albanian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 signature-appearance labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Albanian UI strings, compiled in by crates/ui-egui/src/i18n.rs |
 | `crates/ui-egui/src/i18n/th.tsv` | Thai interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Thai UI strings, compiled in by crates/ui-egui/src/i18n.rs |
 | `crates/ui-egui/src/i18n/ca.tsv` | Catalan interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, written from their meaning; no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Catalan UI strings, compiled in by crates/ui-egui/src/i18n.rs |
diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index 84f71f904e..76f4cf40a8 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -296,7 +296,7 @@ path = "assets/icons/accessibility.svg"
 title = "Lucide icon \"accessibility\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/accessibility.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -307,7 +307,7 @@ path = "assets/icons/align-left.svg"
 title = "Lucide icon \"align-left\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-left.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -318,7 +318,7 @@ path = "assets/icons/align-center.svg"
 title = "Lucide icon \"align-center\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-center.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -329,7 +329,7 @@ path = "assets/icons/square-terminal.svg"
 title = "Lucide icon \"square-terminal\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/square-terminal.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -340,7 +340,7 @@ path = "assets/icons/file-code.svg"
 title = "Lucide icon \"file-code\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-code.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -351,7 +351,7 @@ path = "assets/icons/file-spreadsheet.svg"
 title = "Lucide icon \"file-spreadsheet\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-spreadsheet.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -362,7 +362,7 @@ path = "assets/icons/align-justify.svg"
 title = "Lucide icon \"align-justify\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-justify.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -373,7 +373,7 @@ path = "assets/icons/align-right.svg"
 title = "Lucide icon \"align-right\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-right.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -384,7 +384,7 @@ path = "assets/icons/columns-3.svg"
 title = "Lucide icon \"columns-3\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/columns-3.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -395,7 +395,7 @@ path = "assets/icons/rows-3.svg"
 title = "Lucide icon \"rows-3\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/rows-3.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -406,7 +406,7 @@ path = "assets/icons/flip-horizontal-2.svg"
 title = "Lucide icon \"flip-horizontal-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/flip-horizontal-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -417,7 +417,7 @@ path = "assets/icons/flip-vertical-2.svg"
 title = "Lucide icon \"flip-vertical-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/flip-vertical-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -428,7 +428,7 @@ path = "assets/icons/app-window.svg"
 title = "Lucide icon \"app-window\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/app-window.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -439,7 +439,7 @@ path = "assets/icons/arrow-left-right.svg"
 title = "Lucide icon \"arrow-left-right\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/arrow-left-right.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -450,7 +450,7 @@ path = "assets/icons/arrow-up-down.svg"
 title = "Lucide icon \"arrow-up-down\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/arrow-up-down.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -461,7 +461,7 @@ path = "assets/icons/arrow-up-right.svg"
 title = "Lucide icon \"arrow-up-right\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/arrow-up-right.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -472,7 +472,7 @@ path = "assets/icons/badge-check.svg"
 title = "Lucide icon \"badge-check\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/badge-check.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -483,7 +483,7 @@ path = "assets/icons/bandage.svg"
 title = "Lucide icon \"bandage\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bandage.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -494,7 +494,7 @@ path = "assets/icons/bell.svg"
 title = "Lucide icon \"bell\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bell.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -505,7 +505,7 @@ path = "assets/icons/blend.svg"
 title = "Lucide icon \"blend\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/blend.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -516,7 +516,7 @@ path = "assets/icons/bold.svg"
 title = "Lucide icon \"bold\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bold.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -527,7 +527,7 @@ path = "assets/icons/book-open.svg"
 title = "Lucide icon \"book-open\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/book-open.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -538,7 +538,7 @@ path = "assets/icons/bookmark.svg"
 title = "Lucide icon \"bookmark\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bookmark.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -549,7 +549,7 @@ path = "assets/icons/bookmark-plus.svg"
 title = "Lucide icon \"bookmark-plus\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bookmark-plus.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -560,7 +560,7 @@ path = "assets/icons/braces.svg"
 title = "Lucide icon \"braces\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/braces.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -571,7 +571,7 @@ path = "assets/icons/brush-cleaning.svg"
 title = "Lucide icon \"brush-cleaning\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/brush-cleaning.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -582,7 +582,7 @@ path = "assets/icons/brush.svg"
 title = "Lucide icon \"brush\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/brush.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -593,7 +593,7 @@ path = "assets/icons/camera.svg"
 title = "Lucide icon \"camera\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/camera.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -604,7 +604,7 @@ path = "assets/icons/check-circle-2.svg"
 title = "Lucide icon \"check-circle-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/check-circle-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -615,7 +615,7 @@ path = "assets/icons/check.svg"
 title = "Lucide icon \"check\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/check.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -626,7 +626,7 @@ path = "assets/icons/chevron-down.svg"
 title = "Lucide icon \"chevron-down\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevron-down.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -637,7 +637,7 @@ path = "assets/icons/chevron-left.svg"
 title = "Lucide icon \"chevron-left\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevron-left.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -648,7 +648,7 @@ path = "assets/icons/chevron-right.svg"
 title = "Lucide icon \"chevron-right\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevron-right.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -659,7 +659,7 @@ path = "assets/icons/chevron-up.svg"
 title = "Lucide icon \"chevron-up\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevron-up.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -670,7 +670,7 @@ path = "assets/icons/chevrons-left.svg"
 title = "Lucide icon \"chevrons-left\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevrons-left.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -681,7 +681,7 @@ path = "assets/icons/chevrons-right.svg"
 title = "Lucide icon \"chevrons-right\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevrons-right.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -692,7 +692,7 @@ path = "assets/icons/circle-check.svg"
 title = "Lucide icon \"circle-check\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-check.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -703,7 +703,7 @@ path = "assets/icons/circle-dashed.svg"
 title = "Lucide icon \"circle-dashed\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-dashed.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -714,7 +714,7 @@ path = "assets/icons/circle-dot.svg"
 title = "Lucide icon \"circle-dot\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-dot.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -725,7 +725,7 @@ path = "assets/icons/circle-help.svg"
 title = "Lucide icon \"circle-help\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-help.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -736,7 +736,7 @@ path = "assets/icons/circle.svg"
 title = "Lucide icon \"circle\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -747,7 +747,7 @@ path = "assets/icons/clock-3.svg"
 title = "Lucide icon \"clock-3\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/clock-3.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -758,7 +758,7 @@ path = "assets/icons/clock.svg"
 title = "Lucide icon \"clock\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/clock.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -769,7 +769,7 @@ path = "assets/icons/cloud-upload.svg"
 title = "Lucide icon \"cloud-upload\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/cloud-upload.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -780,7 +780,7 @@ path = "assets/icons/cloud.svg"
 title = "Lucide icon \"cloud\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/cloud.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -791,7 +791,7 @@ path = "assets/icons/code-xml.svg"
 title = "Lucide icon \"code-xml\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/code-xml.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -802,7 +802,7 @@ path = "assets/icons/columns-2.svg"
 title = "Lucide icon \"columns-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/columns-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -813,7 +813,7 @@ path = "assets/icons/compass.svg"
 title = "Lucide icon \"compass\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/compass.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -824,7 +824,7 @@ path = "assets/icons/contrast.svg"
 title = "Lucide icon \"contrast\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/contrast.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -835,7 +835,7 @@ path = "assets/icons/copy-plus.svg"
 title = "Lucide icon \"copy-plus\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/copy-plus.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -846,7 +846,7 @@ path = "assets/icons/copy.svg"
 title = "Lucide icon \"copy\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/copy.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -857,7 +857,7 @@ path = "assets/icons/crop.svg"
 title = "Lucide icon \"crop\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/crop.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -868,7 +868,7 @@ path = "assets/icons/droplet.svg"
 title = "Lucide icon \"droplet\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/droplet.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -879,7 +879,7 @@ path = "assets/icons/ellipsis-vertical.svg"
 title = "Lucide icon \"ellipsis-vertical\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/ellipsis-vertical.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -890,7 +890,7 @@ path = "assets/icons/ellipsis.svg"
 title = "Lucide icon \"ellipsis\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/ellipsis.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -901,7 +901,7 @@ path = "assets/icons/eraser.svg"
 title = "Lucide icon \"eraser\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/eraser.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -912,7 +912,7 @@ path = "assets/icons/external-link.svg"
 title = "Lucide icon \"external-link\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/external-link.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -923,7 +923,7 @@ path = "assets/icons/eye-off.svg"
 title = "Lucide icon \"eye-off\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/eye-off.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -934,7 +934,7 @@ path = "assets/icons/eye.svg"
 title = "Lucide icon \"eye\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/eye.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -945,7 +945,7 @@ path = "assets/icons/file-check.svg"
 title = "Lucide icon \"file-check\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-check.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -956,7 +956,7 @@ path = "assets/icons/file-down.svg"
 title = "Lucide icon \"file-down\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-down.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -967,7 +967,7 @@ path = "assets/icons/file-input.svg"
 title = "Lucide icon \"file-input\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-input.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -978,7 +978,7 @@ path = "assets/icons/file-lock-2.svg"
 title = "Lucide icon \"file-lock-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-lock-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -989,7 +989,7 @@ path = "assets/icons/file-minus.svg"
 title = "Lucide icon \"file-minus\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-minus.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1000,7 +1000,7 @@ path = "assets/icons/file-output.svg"
 title = "Lucide icon \"file-output\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-output.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1011,7 +1011,7 @@ path = "assets/icons/file-pen-line.svg"
 title = "Lucide icon \"file-pen-line\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-pen-line.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1022,7 +1022,7 @@ path = "assets/icons/file-plus-2.svg"
 title = "Lucide icon \"file-plus-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-plus-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1033,7 +1033,7 @@ path = "assets/icons/file-plus.svg"
 title = "Lucide icon \"file-plus\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-plus.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1044,7 +1044,7 @@ path = "assets/icons/file-scan.svg"
 title = "Lucide icon \"file-scan\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-scan.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1055,7 +1055,7 @@ path = "assets/icons/file-search.svg"
 title = "Lucide icon \"file-search\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-search.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1066,7 +1066,7 @@ path = "assets/icons/file-symlink.svg"
 title = "Lucide icon \"file-symlink\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-symlink.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1077,7 +1077,7 @@ path = "assets/icons/file-text.svg"
 title = "Lucide icon \"file-text\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-text.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1088,7 +1088,7 @@ path = "assets/icons/file-x.svg"
 title = "Lucide icon \"file-x\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-x.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1099,7 +1099,7 @@ path = "assets/icons/files.svg"
 title = "Lucide icon \"files\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/files.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1110,7 +1110,7 @@ path = "assets/icons/film.svg"
 title = "Lucide icon \"film\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/film.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1121,7 +1121,7 @@ path = "assets/icons/filter.svg"
 title = "Lucide icon \"filter\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/filter.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1132,7 +1132,7 @@ path = "assets/icons/folder-open.svg"
 title = "Lucide icon \"folder-open\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/folder-open.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1143,7 +1143,7 @@ path = "assets/icons/folder-plus.svg"
 title = "Lucide icon \"folder-plus\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/folder-plus.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1154,7 +1154,7 @@ path = "assets/icons/folder.svg"
 title = "Lucide icon \"folder\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/folder.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1165,7 +1165,7 @@ path = "assets/icons/gauge.svg"
 title = "Lucide icon \"gauge\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/gauge.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1176,7 +1176,7 @@ path = "assets/icons/git-compare.svg"
 title = "Lucide icon \"git-compare\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/git-compare.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1187,7 +1187,7 @@ path = "assets/icons/globe.svg"
 title = "Lucide icon \"globe\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/globe.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1198,7 +1198,7 @@ path = "assets/icons/grid-3x3.svg"
 title = "Lucide icon \"grid-3x3\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/grid-3x3.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1209,7 +1209,7 @@ path = "assets/icons/hand.svg"
 title = "Lucide icon \"hand\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/hand.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1220,7 +1220,7 @@ path = "assets/icons/hash.svg"
 title = "Lucide icon \"hash\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/hash.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1231,7 +1231,7 @@ path = "assets/icons/heading.svg"
 title = "Lucide icon \"heading\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/heading.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1242,7 +1242,7 @@ path = "assets/icons/highlighter.svg"
 title = "Lucide icon \"highlighter\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/highlighter.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1253,7 +1253,7 @@ path = "assets/icons/house.svg"
 title = "Lucide icon \"house\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/house.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1264,7 +1264,7 @@ path = "assets/icons/image-plus.svg"
 title = "Lucide icon \"image-plus\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/image-plus.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1275,7 +1275,7 @@ path = "assets/icons/image.svg"
 title = "Lucide icon \"image\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/image.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1286,7 +1286,7 @@ path = "assets/icons/info.svg"
 title = "Lucide icon \"info\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/info.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1297,7 +1297,7 @@ path = "assets/icons/italic.svg"
 title = "Lucide icon \"italic\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/italic.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1308,7 +1308,7 @@ path = "assets/icons/languages.svg"
 title = "Lucide icon \"languages\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/languages.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1319,7 +1319,7 @@ path = "assets/icons/lasso.svg"
 title = "Lucide icon \"lasso\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/lasso.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1330,7 +1330,7 @@ path = "assets/icons/layers.svg"
 title = "Lucide icon \"layers\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/layers.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1341,7 +1341,7 @@ path = "assets/icons/layout-grid.svg"
 title = "Lucide icon \"layout-grid\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/layout-grid.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1352,7 +1352,7 @@ path = "assets/icons/link-2.svg"
 title = "Lucide icon \"link-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/link-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1363,7 +1363,7 @@ path = "assets/icons/link.svg"
 title = "Lucide icon \"link\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/link.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1374,7 +1374,7 @@ path = "assets/icons/list-checks.svg"
 title = "Lucide icon \"list-checks\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/list-checks.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1385,7 +1385,7 @@ path = "assets/icons/list-ordered.svg"
 title = "Lucide icon \"list-ordered\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/list-ordered.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1396,7 +1396,7 @@ path = "assets/icons/list.svg"
 title = "Lucide icon \"list\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/list.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1407,7 +1407,7 @@ path = "assets/icons/lock-open.svg"
 title = "Lucide icon \"lock-open\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/lock-open.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1418,7 +1418,7 @@ path = "assets/icons/lock.svg"
 title = "Lucide icon \"lock\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/lock.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1429,7 +1429,7 @@ path = "assets/icons/maximize-2.svg"
 title = "Lucide icon \"maximize-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/maximize-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1440,7 +1440,7 @@ path = "assets/icons/maximize.svg"
 title = "Lucide icon \"maximize\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/maximize.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1451,7 +1451,7 @@ path = "assets/icons/message-circle-reply.svg"
 title = "Lucide icon \"message-circle-reply\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-circle-reply.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1462,7 +1462,7 @@ path = "assets/icons/message-square-text.svg"
 title = "Lucide icon \"message-square-text\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-square-text.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1473,7 +1473,7 @@ path = "assets/icons/message-square.svg"
 title = "Lucide icon \"message-square\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-square.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1484,7 +1484,7 @@ path = "assets/icons/messages-square.svg"
 title = "Lucide icon \"messages-square\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/messages-square.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1495,7 +1495,7 @@ path = "assets/icons/mic.svg"
 title = "Lucide icon \"mic\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/mic.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1506,7 +1506,7 @@ path = "assets/icons/minimize.svg"
 title = "Lucide icon \"minimize\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/minimize.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1517,7 +1517,7 @@ path = "assets/icons/minimize-2.svg"
 title = "Lucide icon \"minimize-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/minimize-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1528,7 +1528,7 @@ path = "assets/icons/minus.svg"
 title = "Lucide icon \"minus\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/minus.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1539,7 +1539,7 @@ path = "assets/icons/moon.svg"
 title = "Lucide icon \"moon\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/moon.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1550,7 +1550,7 @@ path = "assets/icons/mouse-pointer-2.svg"
 title = "Lucide icon \"mouse-pointer-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/mouse-pointer-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1561,7 +1561,7 @@ path = "assets/icons/move.svg"
 title = "Lucide icon \"move\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/move.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1572,7 +1572,7 @@ path = "assets/icons/navigation.svg"
 title = "Lucide icon \"navigation\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/navigation.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1583,7 +1583,7 @@ path = "assets/icons/paint-bucket.svg"
 title = "Lucide icon \"paint-bucket\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/paint-bucket.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1594,7 +1594,7 @@ path = "assets/icons/palette.svg"
 title = "Lucide icon \"palette\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/palette.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1605,7 +1605,7 @@ path = "assets/icons/panel-left.svg"
 title = "Lucide icon \"panel-left\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/panel-left.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1616,7 +1616,7 @@ path = "assets/icons/panel-right.svg"
 title = "Lucide icon \"panel-right\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/panel-right.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1627,7 +1627,7 @@ path = "assets/icons/panels-top-left.svg"
 title = "Lucide icon \"panels-top-left\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/panels-top-left.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1638,7 +1638,7 @@ path = "assets/icons/paperclip.svg"
 title = "Lucide icon \"paperclip\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/paperclip.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1649,7 +1649,7 @@ path = "assets/icons/pen-line.svg"
 title = "Lucide icon \"pen-line\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pen-line.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1660,7 +1660,7 @@ path = "assets/icons/pen-tool.svg"
 title = "Lucide icon \"pen-tool\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pen-tool.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1671,7 +1671,7 @@ path = "assets/icons/pencil.svg"
 title = "Lucide icon \"pencil\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pencil.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1682,7 +1682,7 @@ path = "assets/icons/pipette.svg"
 title = "Lucide icon \"pipette\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pipette.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1693,7 +1693,7 @@ path = "assets/icons/plus.svg"
 title = "Lucide icon \"plus\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/plus.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1704,7 +1704,7 @@ path = "assets/icons/presentation.svg"
 title = "Lucide icon \"presentation\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/presentation.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1715,7 +1715,7 @@ path = "assets/icons/printer.svg"
 title = "Lucide icon \"printer\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/printer.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1726,7 +1726,7 @@ path = "assets/icons/rectangle-horizontal.svg"
 title = "Lucide icon \"rectangle-horizontal\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/rectangle-horizontal.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1737,7 +1737,7 @@ path = "assets/icons/redo-2.svg"
 title = "Lucide icon \"redo-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/redo-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1748,7 +1748,7 @@ path = "assets/icons/replace.svg"
 title = "Lucide icon \"replace\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/replace.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1759,7 +1759,7 @@ path = "assets/icons/rotate-ccw.svg"
 title = "Lucide icon \"rotate-ccw\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/rotate-ccw.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1770,7 +1770,7 @@ path = "assets/icons/rotate-cw.svg"
 title = "Lucide icon \"rotate-cw\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/rotate-cw.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1781,7 +1781,7 @@ path = "assets/icons/ruler.svg"
 title = "Lucide icon \"ruler\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/ruler.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1792,7 +1792,7 @@ path = "assets/icons/save.svg"
 title = "Lucide icon \"save\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/save.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1803,7 +1803,7 @@ path = "assets/icons/scan-text.svg"
 title = "Lucide icon \"scan-text\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/scan-text.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1814,7 +1814,7 @@ path = "assets/icons/scan.svg"
 title = "Lucide icon \"scan\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/scan.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1825,7 +1825,7 @@ path = "assets/icons/scissors.svg"
 title = "Lucide icon \"scissors\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/scissors.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1836,7 +1836,7 @@ path = "assets/icons/search.svg"
 title = "Lucide icon \"search\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/search.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1847,7 +1847,7 @@ path = "assets/icons/send.svg"
 title = "Lucide icon \"send\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/send.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1858,7 +1858,7 @@ path = "assets/icons/settings-2.svg"
 title = "Lucide icon \"settings-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/settings-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1869,7 +1869,7 @@ path = "assets/icons/settings.svg"
 title = "Lucide icon \"settings\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/settings.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1880,7 +1880,7 @@ path = "assets/icons/share-2.svg"
 title = "Lucide icon \"share-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/share-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1891,7 +1891,7 @@ path = "assets/icons/shield-check.svg"
 title = "Lucide icon \"shield-check\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/shield-check.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1902,7 +1902,7 @@ path = "assets/icons/signature.svg"
 title = "Lucide icon \"signature\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/signature.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1913,7 +1913,7 @@ path = "assets/icons/sliders-horizontal.svg"
 title = "Lucide icon \"sliders-horizontal\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/sliders-horizontal.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1924,7 +1924,7 @@ path = "assets/icons/sparkles.svg"
 title = "Lucide icon \"sparkles\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/sparkles.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1935,7 +1935,7 @@ path = "assets/icons/spline.svg"
 title = "Lucide icon \"spline\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/spline.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1946,7 +1946,7 @@ path = "assets/icons/square-dashed-mouse-pointer.svg"
 title = "Lucide icon \"square-dashed-mouse-pointer\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/square-dashed-mouse-pointer.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1957,7 +1957,7 @@ path = "assets/icons/square-dashed.svg"
 title = "Lucide icon \"square-dashed\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/square-dashed.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1968,7 +1968,7 @@ path = "assets/icons/square.svg"
 title = "Lucide icon \"square\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/square.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1979,7 +1979,7 @@ path = "assets/icons/squares-subtract.svg"
 title = "Lucide icon \"squares-subtract\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/squares-subtract.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1990,7 +1990,7 @@ path = "assets/icons/stamp.svg"
 title = "Lucide icon \"stamp\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/stamp.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2001,7 +2001,7 @@ path = "assets/icons/star.svg"
 title = "Lucide icon \"star\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/star.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2012,7 +2012,7 @@ path = "assets/icons/sticky-note.svg"
 title = "Lucide icon \"sticky-note\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/sticky-note.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2023,7 +2023,7 @@ path = "assets/icons/strikethrough.svg"
 title = "Lucide icon \"strikethrough\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/strikethrough.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2034,7 +2034,7 @@ path = "assets/icons/sun.svg"
 title = "Lucide icon \"sun\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/sun.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2045,7 +2045,7 @@ path = "assets/icons/swatch-book.svg"
 title = "Lucide icon \"swatch-book\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/swatch-book.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2056,7 +2056,7 @@ path = "assets/icons/tag.svg"
 title = "Lucide icon \"tag\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/tag.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2067,7 +2067,7 @@ path = "assets/icons/text-cursor-input.svg"
 title = "Lucide icon \"text-cursor-input\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/text-cursor-input.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2078,7 +2078,7 @@ path = "assets/icons/text-select.svg"
 title = "Lucide icon \"text-select\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/text-select.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2089,7 +2089,7 @@ path = "assets/icons/trash-2.svg"
 title = "Lucide icon \"trash-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/trash-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2100,7 +2100,7 @@ path = "assets/icons/trash.svg"
 title = "Lucide icon \"trash\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/trash.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2111,7 +2111,7 @@ path = "assets/icons/triangle-alert.svg"
 title = "Lucide icon \"triangle-alert\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/triangle-alert.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2122,7 +2122,7 @@ path = "assets/icons/type.svg"
 title = "Lucide icon \"type\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/type.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2133,7 +2133,7 @@ path = "assets/icons/underline.svg"
 title = "Lucide icon \"underline\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/underline.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2144,7 +2144,7 @@ path = "assets/icons/undo-2.svg"
 title = "Lucide icon \"undo-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/undo-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2155,7 +2155,7 @@ path = "assets/icons/user-round.svg"
 title = "Lucide icon \"user-round\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/user-round.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2166,7 +2166,7 @@ path = "assets/icons/wand-sparkles.svg"
 title = "Lucide icon \"wand-sparkles\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/wand-sparkles.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2177,7 +2177,7 @@ path = "assets/icons/wrench.svg"
 title = "Lucide icon \"wrench\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/wrench.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2188,7 +2188,7 @@ path = "assets/icons/x.svg"
 title = "Lucide icon \"x\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/x.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2199,7 +2199,7 @@ path = "assets/icons/zoom-in.svg"
 title = "Lucide icon \"zoom-in\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/zoom-in.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2210,7 +2210,7 @@ path = "assets/icons/zoom-out.svg"
 title = "Lucide icon \"zoom-out\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/zoom-out.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3194,7 +3194,7 @@ path = "assets/icons/pin.svg"
 title = "Lucide icon \"pin\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pin.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3205,7 +3205,7 @@ path = "assets/icons/move-right.svg"
 title = "Lucide icon \"move-right\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/move-right.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3216,7 +3216,7 @@ path = "assets/icons/reply.svg"
 title = "Lucide icon \"reply\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/reply.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3227,7 +3227,7 @@ path = "assets/icons/thumbs-up.svg"
 title = "Lucide icon \"thumbs-up\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/thumbs-up.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3238,7 +3238,7 @@ path = "assets/icons/thumbs-down.svg"
 title = "Lucide icon \"thumbs-down\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/thumbs-down.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3249,7 +3249,7 @@ path = "assets/icons/message-square-plus.svg"
 title = "Lucide icon \"message-square-plus\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-square-plus.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3260,7 +3260,7 @@ path = "assets/icons/circle-x.svg"
 title = "Lucide icon \"circle-x\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-x.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3282,7 +3282,7 @@ path = "assets/icons/pentagon.svg"
 title = "Lucide icon \"pentagon\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pentagon.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3293,7 +3293,7 @@ path = "assets/icons/message-square-quote.svg"
 title = "Lucide icon \"message-square-quote\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-square-quote.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3315,7 +3315,7 @@ path = "assets/icons/clipboard-paste.svg"
 title = "Lucide icon \"clipboard-paste\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/clipboard-paste.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3408,7 +3408,7 @@ path = "assets/icons/monitor.svg"
 title = "Lucide icon \"monitor\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/monitor.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3461,7 +3461,7 @@ path = "assets/icons/superscript.svg"
 title = "Lucide icon \"superscript\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/superscript.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3472,7 +3472,7 @@ path = "assets/icons/subscript.svg"
 title = "Lucide icon \"subscript\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/subscript.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3483,7 +3483,7 @@ path = "assets/icons/pilcrow.svg"
 title = "Lucide icon \"pilcrow\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pilcrow.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3494,7 +3494,7 @@ path = "assets/icons/move-horizontal.svg"
 title = "Lucide icon \"move-horizontal\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/move-horizontal.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
diff --git a/Cargo.lock b/Cargo.lock
index fd186d995c..c46eac4790 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1178,17 +1178,17 @@ dependencies = [
 [[package]]
 name = "craft-docpath"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
+source = "git+https://github.com/storytold/craft-libs?rev=787a7a0f972fd1d7a7618fdbeca3a5267a0407ff#787a7a0f972fd1d7a7618fdbeca3a5267a0407ff"
 
 [[package]]
 name = "craft-fonts-build"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
+source = "git+https://github.com/storytold/craft-libs?rev=787a7a0f972fd1d7a7618fdbeca3a5267a0407ff#787a7a0f972fd1d7a7618fdbeca3a5267a0407ff"
 
 [[package]]
 name = "craft-i18n"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
+source = "git+https://github.com/storytold/craft-libs?rev=787a7a0f972fd1d7a7618fdbeca3a5267a0407ff#787a7a0f972fd1d7a7618fdbeca3a5267a0407ff"
 dependencies = [
  "fixed_decimal",
  "icu_decimal",
@@ -1211,7 +1211,7 @@ dependencies = [
 [[package]]
 name = "craft-keymap"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
+source = "git+https://github.com/storytold/craft-libs?rev=787a7a0f972fd1d7a7618fdbeca3a5267a0407ff#787a7a0f972fd1d7a7618fdbeca3a5267a0407ff"
 dependencies = [
  "egui",
  "serde",
@@ -1221,7 +1221,7 @@ dependencies = [
 [[package]]
 name = "craft-menu"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
+source = "git+https://github.com/storytold/craft-libs?rev=787a7a0f972fd1d7a7618fdbeca3a5267a0407ff#787a7a0f972fd1d7a7618fdbeca3a5267a0407ff"
 dependencies = [
  "craft-keymap",
  "craft-quit",
@@ -1234,7 +1234,7 @@ dependencies = [
 [[package]]
 name = "craft-print"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
+source = "git+https://github.com/storytold/craft-libs?rev=787a7a0f972fd1d7a7618fdbeca3a5267a0407ff#787a7a0f972fd1d7a7618fdbeca3a5267a0407ff"
 dependencies = [
  "craft-winprint-gdi",
  "log",
@@ -1248,7 +1248,7 @@ dependencies = [
 [[package]]
 name = "craft-quit"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
+source = "git+https://github.com/storytold/craft-libs?rev=787a7a0f972fd1d7a7618fdbeca3a5267a0407ff#787a7a0f972fd1d7a7618fdbeca3a5267a0407ff"
 dependencies = [
  "dispatch2",
  "egui",
@@ -1259,7 +1259,7 @@ dependencies = [
 [[package]]
 name = "craft-ui"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
+source = "git+https://github.com/storytold/craft-libs?rev=787a7a0f972fd1d7a7618fdbeca3a5267a0407ff#787a7a0f972fd1d7a7618fdbeca3a5267a0407ff"
 dependencies = [
  "craft-fonts-build",
  "craft-i18n",
@@ -1280,7 +1280,7 @@ dependencies = [
 [[package]]
 name = "craft-update"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
+source = "git+https://github.com/storytold/craft-libs?rev=787a7a0f972fd1d7a7618fdbeca3a5267a0407ff#787a7a0f972fd1d7a7618fdbeca3a5267a0407ff"
 dependencies = [
  "chrono",
  "dunce",
@@ -4208,7 +4208,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft"
-version = "0.16.1"
+version = "0.18.0"
 dependencies = [
  "chrono",
  "craft-update",
@@ -4232,7 +4232,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-a11y"
-version = "0.16.1"
+version = "0.18.0"
 dependencies = [
  "pdfcraft-content",
  "pdfcraft-cos",
@@ -4244,7 +4244,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-annot"
-version = "0.16.1"
+version = "0.18.0"
 dependencies = [
  "hayro-syntax",
  "pdfcraft-cos",
@@ -4255,7 +4255,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-audit"
-version = "0.16.1"
+version = "0.18.0"
 dependencies = [
  "pdfcraft-content",
  "pdfcraft-cos",
@@ -4266,7 +4266,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-automation"
-version = "0.16.1"
+version = "0.18.0"
 dependencies = [
  "base64 0.23.1",
  "flate2",
@@ -4288,7 +4288,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-cli"
-version = "0.16.1"
+version = "0.18.0"
 dependencies = [
  "base64 0.23.1",
  "pdfcraft-audit",
@@ -4306,11 +4306,11 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-compare"
-version = "0.16.1"
+version = "0.18.0"
 
 [[package]]
 name = "pdfcraft-content"
-version = "0.16.1"
+version = "0.18.0"
 dependencies = [
  "hayro-syntax",
  "pdfcraft-cos",
@@ -4318,7 +4318,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-cos"
-version = "0.16.1"
+version = "0.18.0"
 dependencies = [
  "chrono",
  "hayro-syntax",
@@ -4333,11 +4333,10 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-create"
-version = "0.16.1"
+version = "0.18.0"
 dependencies = [
  "encoding_rs",
  "hayro-ccitt",
- "hayro-jbig2",
  "hayro-syntax",
  "image",
  "pdfcraft-cos",
@@ -4353,7 +4352,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-crypt"
-version = "0.16.1"
+version = "0.18.0"
 dependencies = [
  "aes",
  "md-5",
@@ -4365,7 +4364,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-edit"
-version = "0.16.1"
+version = "0.18.0"
 dependencies = [
  "hayro-syntax",
  "kurbo 0.13.1",
@@ -4374,6 +4373,8 @@ dependencies = [
  "pdfcraft-cos",
  "pdfcraft-fonts",
  "pdfcraft-model",
+ "pdfcraft-render",
+ "proptest",
  "sha2 0.11.1",
  "thiserror 2.0.21",
  "unicode-bidi",
@@ -4381,7 +4382,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-engine"
-version = "0.16.1"
+version = "0.18.0"
 dependencies = [
  "chrono",
  "craft-docpath",
@@ -4393,10 +4394,12 @@ dependencies = [
  "pdfcraft-annot",
  "pdfcraft-audit",
  "pdfcraft-compare",
+ "pdfcraft-content",
  "pdfcraft-cos",
  "pdfcraft-create",
  "pdfcraft-edit",
  "pdfcraft-export",
+ "pdfcraft-filters",
  "pdfcraft-fonts",
  "pdfcraft-forms",
  "pdfcraft-geom",
@@ -4423,14 +4426,14 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-export"
-version = "0.16.1"
+version = "0.18.0"
 dependencies = [
  "flate2",
 ]
 
 [[package]]
 name = "pdfcraft-filters"
-version = "0.16.1"
+version = "0.18.0"
 dependencies = [
  "fax",
  "flate2",
@@ -4443,7 +4446,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-fonts"
-version = "0.16.1"
+version = "0.18.0"
 dependencies = [
  "harfrust",
  "pdfcraft-cos",
@@ -4453,7 +4456,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-forms"
-version = "0.16.1"
+version = "0.18.0"
 dependencies = [
  "hayro-syntax",
  "pdfcraft-content",
@@ -4466,11 +4469,11 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-geom"
-version = "0.16.1"
+version = "0.18.0"
 
 [[package]]
 name = "pdfcraft-js"
-version = "0.16.1"
+version = "0.18.0"
 dependencies = [
  "boa_engine",
  "chrono",
@@ -4478,7 +4481,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-measure"
-version = "0.16.1"
+version = "0.18.0"
 dependencies = [
  "pdfcraft-annot",
  "pdfcraft-content",
@@ -4491,14 +4494,14 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-model"
-version = "0.16.1"
+version = "0.18.0"
 dependencies = [
  "pdfcraft-cos",
 ]
 
 [[package]]
 name = "pdfcraft-ocr"
-version = "0.16.1"
+version = "0.18.0"
 dependencies = [
  "ocrs",
  "pdfcraft-fonts",
@@ -4509,7 +4512,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-optimize"
-version = "0.16.1"
+version = "0.18.0"
 dependencies = [
  "image",
  "pdfcraft-annot",
@@ -4525,11 +4528,11 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-oracle"
-version = "0.16.1"
+version = "0.18.0"
 
 [[package]]
 name = "pdfcraft-organize"
-version = "0.16.1"
+version = "0.18.0"
 dependencies = [
  "hayro-syntax",
  "pdfcraft-content",
@@ -4540,7 +4543,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-platform"
-version = "0.16.1"
+version = "0.18.0"
 dependencies = [
  "async-channel",
  "futures-lite",
@@ -4550,7 +4553,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-preflight"
-version = "0.16.1"
+version = "0.18.0"
 dependencies = [
  "flate2",
  "pdfcraft-content",
@@ -4561,7 +4564,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-print"
-version = "0.16.1"
+version = "0.18.0"
 dependencies = [
  "craft-print",
  "pdfcraft-content",
@@ -4573,7 +4576,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-redact"
-version = "0.16.1"
+version = "0.18.0"
 dependencies = [
  "pdfcraft-annot",
  "pdfcraft-content",
@@ -4590,7 +4593,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-render"
-version = "0.16.1"
+version = "0.18.0"
 dependencies = [
  "bytemuck",
  "flate2",
@@ -4609,7 +4612,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-sign"
-version = "0.16.1"
+version = "0.18.0"
 dependencies = [
  "aes",
  "aws-lc-rs",
@@ -4645,11 +4648,11 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-testkit"
-version = "0.16.1"
+version = "0.18.0"
 
 [[package]]
 name = "pdfcraft-ui-egui"
-version = "0.16.1"
+version = "0.18.0"
 dependencies = [
  "arboard",
  "base64 0.23.1",
@@ -4673,6 +4676,7 @@ dependencies = [
  "objc2 0.6.5",
  "objc2-app-kit 0.3.2",
  "objc2-foundation 0.3.2",
+ "pdfcraft-content",
  "pdfcraft-cos",
  "pdfcraft-engine",
  "pdfcraft-fonts",
@@ -4683,6 +4687,7 @@ dependencies = [
  "plist",
  "png 0.18.1",
  "pollster 1.0.1",
+ "proptest",
  "rfd",
  "rustix 1.1.5",
  "serde",
@@ -4701,7 +4706,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-web"
-version = "0.16.1"
+version = "0.18.0"
 dependencies = [
  "eframe",
  "egui",
@@ -4713,7 +4718,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-xfa"
-version = "0.16.1"
+version = "0.18.0"
 dependencies = [
  "base64 0.23.1",
  "image",
@@ -4727,7 +4732,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-xfdf"
-version = "0.16.1"
+version = "0.18.0"
 dependencies = [
  "pdfcraft-annot",
  "pdfcraft-cos",
diff --git a/Cargo.toml b/Cargo.toml
index 85d02570ba..7be5624db7 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -5,7 +5,7 @@ exclude = ["vendor"]
 default-members = ["crates/*", "apps/pdfcraft", "apps/pdfcraft-cli", "xtask"]
 
 [workspace.package]
-version = "0.16.1"
+version = "0.18.0"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
@@ -13,52 +13,52 @@ repository = "https://github.com/storytold/pdfcraft"
 
 [workspace.dependencies]
 # Shared frontend components; engines remain independent of egui.
-craft-ui = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "c5a1cbfb5f9049f9270955caffb5bee5997aebf7", features = ["serde"] }
+craft-ui = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "787a7a0f972fd1d7a7618fdbeca3a5267a0407ff", features = ["serde"] }
 # Quit the macOS way (#1136): ⌘Q asks about unsaved changes, and closing quits through `terminate:`.
-craft-quit = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "c5a1cbfb5f9049f9270955caffb5bee5997aebf7" }
+craft-quit = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "787a7a0f972fd1d7a7618fdbeca3a5267a0407ff" }
 # One menu definition for the native macOS menu bar and the in-window bar elsewhere.
-craft-menu = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "c5a1cbfb5f9049f9270955caffb5bee5997aebf7" }
-craft-keymap = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "c5a1cbfb5f9049f9270955caffb5bee5997aebf7", default-features = false }
+craft-menu = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "787a7a0f972fd1d7a7618fdbeca3a5267a0407ff" }
+craft-keymap = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "787a7a0f972fd1d7a7618fdbeca3a5267a0407ff", default-features = false }
 # Shared system spooler; document composition remains in pdfcraft-print.
-craft-print = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "c5a1cbfb5f9049f9270955caffb5bee5997aebf7" }
+craft-print = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "787a7a0f972fd1d7a7618fdbeca3a5267a0407ff" }
 # Whether a path stored in a document may be opened (GoToR link targets).
-craft-docpath = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "c5a1cbfb5f9049f9270955caffb5bee5997aebf7" }
+craft-docpath = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "787a7a0f972fd1d7a7618fdbeca3a5267a0407ff" }
 # craft-update: app-specific pretend versions apply to startup and manual checks.
-craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "c5a1cbfb5f9049f9270955caffb5bee5997aebf7", features = ["egui"] }
+craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "787a7a0f972fd1d7a7618fdbeca3a5267a0407ff", features = ["egui"] }
 # internal
-pdfcraft-geom = { path = "crates/geom", version = "0.16.1" }
-pdfcraft-filters = { path = "crates/filters", version = "0.16.1" }
-pdfcraft-cos = { path = "crates/cos", version = "0.16.1" }
-pdfcraft-crypt = { path = "crates/crypt", version = "0.16.1" }
-pdfcraft-organize = { path = "crates/organize", version = "0.16.1" }
-pdfcraft-measure = { path = "crates/measure", version = "0.16.1" }
-pdfcraft-annot = { path = "crates/annot", version = "0.16.1" }
-pdfcraft-audit = { path = "crates/audit", version = "0.16.1" }
-pdfcraft-fonts = { path = "crates/fonts", version = "0.16.1" }
-pdfcraft-model = { path = "crates/model", version = "0.16.1" }
-pdfcraft-content = { path = "crates/content", version = "0.16.1" }
-pdfcraft-redact = { path = "crates/redact", version = "0.16.1" }
-pdfcraft-print = { path = "crates/print", version = "0.16.1" }
-pdfcraft-xfdf = { path = "crates/xfdf", version = "0.16.1" }
-pdfcraft-sign = { path = "crates/sign", version = "0.16.1" }
-pdfcraft-optimize = { path = "crates/optimize", version = "0.16.1" }
-pdfcraft-a11y = { path = "crates/a11y", version = "0.16.1" }
-pdfcraft-oracle = { path = "crates/oracle", version = "0.16.1" }
-pdfcraft-testkit = { path = "crates/testkit", version = "0.16.1" }
-pdfcraft-ocr = { path = "crates/ocr", version = "0.16.1" }
-pdfcraft-js = { path = "crates/js", version = "0.16.1" }
-pdfcraft-compare = { path = "crates/compare", version = "0.16.1" }
-pdfcraft-preflight = { path = "crates/preflight", version = "0.16.1" }
-pdfcraft-export = { path = "crates/export", version = "0.16.1" }
-pdfcraft-edit = { path = "crates/edit", version = "0.16.1" }
-pdfcraft-create = { path = "crates/create", version = "0.16.1" }
-pdfcraft-forms = { path = "crates/forms", version = "0.16.1" }
-pdfcraft-xfa = { path = "crates/xfa", version = "0.16.1" }
-pdfcraft-render = { path = "crates/render", version = "0.16.1" }
-pdfcraft-engine = { path = "crates/engine", version = "0.16.1" }
-pdfcraft-platform = { path = "crates/platform", version = "0.16.1" }
-pdfcraft-ui-egui = { path = "crates/ui-egui", version = "0.16.1" }
-pdfcraft-automation = { path = "crates/automation", version = "0.16.1", default-features = false }
+pdfcraft-geom = { path = "crates/geom", version = "0.18.0" }
+pdfcraft-filters = { path = "crates/filters", version = "0.18.0" }
+pdfcraft-cos = { path = "crates/cos", version = "0.18.0" }
+pdfcraft-crypt = { path = "crates/crypt", version = "0.18.0" }
+pdfcraft-organize = { path = "crates/organize", version = "0.18.0" }
+pdfcraft-measure = { path = "crates/measure", version = "0.18.0" }
+pdfcraft-annot = { path = "crates/annot", version = "0.18.0" }
+pdfcraft-audit = { path = "crates/audit", version = "0.18.0" }
+pdfcraft-fonts = { path = "crates/fonts", version = "0.18.0" }
+pdfcraft-model = { path = "crates/model", version = "0.18.0" }
+pdfcraft-content = { path = "crates/content", version = "0.18.0" }
+pdfcraft-redact = { path = "crates/redact", version = "0.18.0" }
+pdfcraft-print = { path = "crates/print", version = "0.18.0" }
+pdfcraft-xfdf = { path = "crates/xfdf", version = "0.18.0" }
+pdfcraft-sign = { path = "crates/sign", version = "0.18.0" }
+pdfcraft-optimize = { path = "crates/optimize", version = "0.18.0" }
+pdfcraft-a11y = { path = "crates/a11y", version = "0.18.0" }
+pdfcraft-oracle = { path = "crates/oracle", version = "0.18.0" }
+pdfcraft-testkit = { path = "crates/testkit", version = "0.18.0" }
+pdfcraft-ocr = { path = "crates/ocr", version = "0.18.0" }
+pdfcraft-js = { path = "crates/js", version = "0.18.0" }
+pdfcraft-compare = { path = "crates/compare", version = "0.18.0" }
+pdfcraft-preflight = { path = "crates/preflight", version = "0.18.0" }
+pdfcraft-export = { path = "crates/export", version = "0.18.0" }
+pdfcraft-edit = { path = "crates/edit", version = "0.18.0" }
+pdfcraft-create = { path = "crates/create", version = "0.18.0" }
+pdfcraft-forms = { path = "crates/forms", version = "0.18.0" }
+pdfcraft-xfa = { path = "crates/xfa", version = "0.18.0" }
+pdfcraft-render = { path = "crates/render", version = "0.18.0" }
+pdfcraft-engine = { path = "crates/engine", version = "0.18.0" }
+pdfcraft-platform = { path = "crates/platform", version = "0.18.0" }
+pdfcraft-ui-egui = { path = "crates/ui-egui", version = "0.18.0" }
+pdfcraft-automation = { path = "crates/automation", version = "0.18.0", default-features = false }
 
 # pdf
 hayro = "0.7.1"
diff --git a/LICENSES.toml b/LICENSES.toml
new file mode 100644
index 0000000000..d9ceb3180e
--- /dev/null
+++ b/LICENSES.toml
@@ -0,0 +1,159 @@
+# Stage 1 source documents only. Destinations are logical names, not packaging instructions.
+# licences lists audited full-text identifiers; omission grants no bundle applicability.
+
+[[document]]
+source = "LICENSE-APACHE"
+licences = ["Apache-2.0"]
+destination = "LICENSE-APACHE"
+sha256 = "0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594"
+
+[[document]]
+source = "LICENSE-MIT"
+licences = ["MIT"]
+destination = "LICENSE-MIT"
+sha256 = "cd7032ea33b71427f188e34ffb4aee9d6868a57fd196037c5c8b2be03a2a0352"
+
+[[document]]
+source = "NOTICE"
+destination = "NOTICE"
+sha256 = "9f854f730719af962cd840529324d089e05e68a30bd245c50e33f96e009b4314"
+
+[[document]]
+source = "assets/app-icon/LICENSE-document.txt"
+destination = "assets/app-icon/LICENSE-document.txt"
+sha256 = "64a3137e3d5cc41e5b78d2ad8dd9ddddd6588283f9f7b3128aa6a8a50852fb9a"
+
+[[document]]
+source = "assets/app-icon/LICENSE.txt"
+destination = "assets/app-icon/LICENSE.txt"
+sha256 = "b768acafe6cbad8247eedf86b5b5381feefcd4ee0f8c7808b86811bc687cf37b"
+
+[[document]]
+source = "assets/fonts/OFL-DancingScript.txt"
+destination = "assets/fonts/OFL-DancingScript.txt"
+sha256 = "6f090277c00af96651ce6dbcc38ff1591047a3bffef486e80b6a32e8276a8201"
+
+[[document]]
+source = "assets/fonts/OFL-Inter.txt"
+destination = "assets/fonts/OFL-Inter.txt"
+sha256 = "262481e844521b326f5ecd053e59b98c8b2da78c8ee1bdbb6e8174305e54935a"
+
+[[document]]
+source = "assets/fonts/OFL-JetBrainsMono.txt"
+destination = "assets/fonts/OFL-JetBrainsMono.txt"
+sha256 = "a76abf002c49097d146e86740a3105a5d00450b1592e820a1109a8c5680cd697"
+
+[[document]]
+source = "assets/icons/LICENSE-lucide.txt"
+destination = "assets/icons/LICENSE-lucide.txt"
+sha256 = "b495047bd93a9b06913511076f504daba17d5bbeb3e0650f3bb53a4220329c57"
+
+[[document]]
+source = "docs/brand/LICENSE-brand.txt"
+destination = "docs/brand/LICENSE-brand.txt"
+sha256 = "0f33f48e7a96cd359d4e4e5b11424b13cebeb59cc70c77928186695e4173585c"
+
+[[document]]
+source = "licenses/CMap-LICENSE.txt"
+licences = ["BSD-3-Clause"]
+destination = "licenses/CMap-LICENSE.txt"
+sha256 = "742665db9c8e1bc72603c6d319ca3e90b83bd6d95202f0cd4ef11068a07a9c29"
+origin = "https://static.crates.io/crates/hayro-cmap/hayro-cmap-0.1.0.crate#assets/LICENSE.txt"
+
+[[document]]
+source = "licenses/egui-Hack-Regular.txt"
+licences = ["MIT", "Bitstream-Vera"]
+destination = "licenses/egui-Hack-Regular.txt"
+sha256 = "47c0cccbeec7e8614548cc485588b28149e7874188df5f41b36efebcee285c87"
+origin = "https://raw.githubusercontent.com/emilk/egui/0.36.2/crates/epaint_default_fonts/fonts/Hack-Regular.txt"
+
+[[document]]
+source = "licenses/egui-OFL.txt"
+licences = ["OFL-1.1"]
+destination = "licenses/egui-OFL.txt"
+sha256 = "6a73f9541c2de74158c0e7cf6b0a58ef774f5a780bf191f2d7ec9cc53efe2bf2"
+origin = "https://raw.githubusercontent.com/emilk/egui/0.36.2/crates/epaint_default_fonts/fonts/OFL.txt"
+
+[[document]]
+source = "licenses/egui-UFL.txt"
+licences = ["Ubuntu-font-1.0"]
+destination = "licenses/egui-UFL.txt"
+sha256 = "2f0015108d68627bd788d313f529c21ff4da2c2c42a5e1f3883acc83480f9002"
+origin = "https://raw.githubusercontent.com/emilk/egui/0.36.2/crates/epaint_default_fonts/fonts/UFL.txt"
+
+[[document]]
+source = "licenses/egui-emoji-icon-font-mit-license.txt"
+licences = ["MIT"]
+destination = "licenses/egui-emoji-icon-font-mit-license.txt"
+sha256 = "b9d2c1d909aa149996fd4c91dcb92b2362a04431640c1d200959da94caf8cde1"
+origin = "https://raw.githubusercontent.com/emilk/egui/0.36.2/crates/epaint_default_fonts/fonts/emoji-icon-font-mit-license.txt"
+
+[[document]]
+source = "vendor/hayro-interpret/LICENSE-APACHE"
+licences = ["Apache-2.0"]
+destination = "vendor/hayro-interpret/LICENSE-APACHE"
+sha256 = "0cec06e0e55fbc3dc5cee4fca9b607f66cb8f4e4dbcf3b3c013594dd156732e9"
+
+[[document]]
+source = "vendor/hayro-interpret/LICENSE-MIT"
+licences = ["MIT"]
+destination = "vendor/hayro-interpret/LICENSE-MIT"
+sha256 = "51b50e6120c344dcc146bbd6375ca1c78e079d97c8bea76e67a53d6ff0efebac"
+
+[[document]]
+source = "vendor/hayro-interpret/assets/CGATS_LICENSE.txt"
+destination = "vendor/hayro-interpret/assets/CGATS_LICENSE.txt"
+sha256 = "469d87b5fa48f8aaf69e25f4fcac3a309c97dbb7d561b917638abdb640e004d9"
+
+[[document]]
+source = "vendor/hayro-interpret/assets/LICENSE_FOXIT"
+destination = "vendor/hayro-interpret/assets/LICENSE_FOXIT"
+sha256 = "b578cdd2345840ada550bd12519533812320d5f1d21cf4c1c7e1b1b0a31c98b7"
+
+[[document]]
+source = "vendor/hayro-cmap/assets/LICENSE.txt"
+licences = ["BSD-3-Clause"]
+destination = "vendor/hayro-cmap/assets/LICENSE.txt"
+sha256 = "742665db9c8e1bc72603c6d319ca3e90b83bd6d95202f0cd4ef11068a07a9c29"
+
+[[document]]
+source = "vendor/vello_common/LICENSE-MIT"
+licences = ["MIT"]
+destination = "vendor/vello_common/LICENSE-MIT"
+sha256 = "adf157330f722fe7cfd5964a2a6974eff851b718228c6735724a11706e6f4dec"
+
+[[bundled]]
+crate = "epaint_default_fonts"
+path = "fonts/Ubuntu-Light.ttf"
+licence = "Ubuntu-font-1.0"
+documents = ["licenses/egui-UFL.txt"]
+
+[[bundled]]
+crate = "epaint_default_fonts"
+path = "fonts/Hack-Regular.ttf"
+licence = "MIT AND Bitstream-Vera"
+documents = ["licenses/egui-Hack-Regular.txt"]
+
+[[bundled]]
+crate = "epaint_default_fonts"
+path = "fonts/NotoEmoji-Regular.ttf"
+licence = "OFL-1.1"
+documents = ["licenses/egui-OFL.txt"]
+
+[[bundled]]
+crate = "epaint_default_fonts"
+path = "fonts/emoji-icon-font.ttf"
+licence = "MIT"
+documents = ["licenses/egui-emoji-icon-font-mit-license.txt"]
+
+[[bundled]]
+crate = "epaint_default_fonts"
+path = "fonts/egui-icons.ttf"
+licence = "MIT"
+documents = ["licenses/egui-emoji-icon-font-mit-license.txt"]
+
+[[bundled]]
+crate = "hayro-interpret"
+path = "src/font/generated/metrics.rs"
+licence = "MIT OR Apache-2.0"
+documents = ["vendor/hayro-interpret/LICENSE-MIT", "vendor/hayro-interpret/LICENSE-APACHE"]
diff --git a/NOTICE b/NOTICE
index 63a8fe672c..e8f31ade2f 100644
--- a/NOTICE
+++ b/NOTICE
@@ -12,7 +12,7 @@ Third-party material
 This product bundles third-party material under its own licenses, listed below. The per-file
 list (author, source, license) is in ATTRIBUTION.md.
 
-- Lucide icons (assets/icons/*.svg) — ISC License. See assets/icons/LICENSE-lucide.txt.
+- Lucide icons (assets/icons/*.svg) — ISC and MIT licences (Feather-derived icons). See assets/icons/LICENSE-lucide.txt.
   The Windows PDF file icon (assets/app-icon/pdfcraft-document.svg and .ico) adapts Lucide's
   file-text outline and combines it with contributor-original artwork. See
   assets/app-icon/LICENSE-document.txt (ISC AND (MIT OR Apache-2.0)), packaged as
diff --git a/README.md b/README.md
index 9599a54844..3c1b67936a 100644
--- a/README.md
+++ b/README.md
@@ -140,6 +140,8 @@ Search the whole document as you type, step through matches with <kbd>⌘G</kbd>
 
 ## Navigate long documents
 
+Launch with `pdfcraft --two-paged file.pdf` (or `pdfcraft file.pdf --two-paged`) to open each command-line PDF in noncontinuous two-page view. This optional launch override does not change saved default-layout preferences or PDFs restored from the previous session. An explicit `--layout` option takes precedence on the active document regardless of argument order; `--default-layout` retains its existing behavior for subsequently opened documents.
+
 Right-click a PDF tab to close it, reopen the last closed file-backed tab, or reveal its file. Closing still asks about unsaved changes. Reopening reads the saved file from disk; it does not restore discarded edits. Reveal selects the file in Explorer or Finder. On Linux and FreeBSD it requests `org.freedesktop.FileManager1.ShowItems`, falling back to opening the containing directory with `xdg-open` when that service is unavailable. Reopen and Reveal are unavailable on the web; Reveal is also unavailable for pathless documents.
 
 Bookmarks, page thumbnails and the document's own page labels (i, ii, 1, 2…) keep you oriented in long documents. Search bookmark titles in the Bookmarks panel to find nested entries even when their parents are collapsed. Matches keep their ancestors for context; Clear restores the unfiltered tree without changing its expansion state.
@@ -545,9 +547,18 @@ stand on its own.
 | <img src="https://raw.githubusercontent.com/storytold/vectorcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.vectorcraft.png" alt="" width="32" height="32"> | **VectorCraft** | Vector illustration | [GitHub](https://github.com/storytold/vectorcraft) | [Website](https://getartcraft.com/apps/vectorcraft) |
 | <img src="https://raw.githubusercontent.com/storytold/filmcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.filmcraft.png" alt="" width="32" height="32"> | **FilmCraft** | Video editing, color and sound | [GitHub](https://github.com/storytold/filmcraft) | [Website](https://getartcraft.com/apps/filmcraft) |
 | <img src="https://raw.githubusercontent.com/storytold/lightcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.lightcraft.png" alt="" width="32" height="32"> | **LightCraft** | Photo library and raw development | [GitHub](https://github.com/storytold/lightcraft) | [Website](https://getartcraft.com/apps/lightcraft) |
-| <img src="https://raw.githubusercontent.com/storytold/pdfcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.pdfcraft.png" alt="" width="32" height="32"> | **PdfCraft** | **Reading, organizing and protecting PDFs · you are here** | [GitHub](https://github.com/storytold/pdfcraft) | [Website](https://getartcraft.com/apps/pdfcraft) |
+| <img src="https://raw.githubusercontent.com/storytold/pdfcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.pdfcraft.png" alt="" width="32" height="32"> | **PdfCraft** | Reading, organizing and protecting PDFs | [GitHub](https://github.com/storytold/pdfcraft) | [Website](https://getartcraft.com/apps/pdfcraft) |
 | <img src="https://raw.githubusercontent.com/storytold/effectcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.effectcraft.png" alt="" width="32" height="32"> | **EffectCraft** | Motion graphics and visual effects | [GitHub](https://github.com/storytold/effectcraft) | [Website](https://getartcraft.com/apps/effectcraft) |
 | <img src="https://raw.githubusercontent.com/storytold/designcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.designcraft.png" alt="" width="32" height="32"> | **DesignCraft** | Page layout and publishing | [GitHub](https://github.com/storytold/designcraft) | [Website](https://getartcraft.com/apps/designcraft) |
+| <img src="https://raw.githubusercontent.com/storytold/figcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.figcraft.png" alt="" width="32" height="32"> | **FigCraft** | Interface design and prototyping | [GitHub](https://github.com/storytold/figcraft) | [Website](https://getartcraft.com/apps/figcraft) |
+| <img src="https://raw.githubusercontent.com/storytold/wordcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.wordcraft.png" alt="" width="32" height="32"> | **WordCraft** | Word processing and documents | [GitHub](https://github.com/storytold/wordcraft) | [Website](https://getartcraft.com/apps/wordcraft) |
+| <img src="https://raw.githubusercontent.com/storytold/soundcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.soundcraft.png" alt="" width="32" height="32"> | **SoundCraft** | Audio recording and editing | [GitHub](https://github.com/storytold/soundcraft) | [Website](https://getartcraft.com/apps/soundcraft) |
+| <img src="https://raw.githubusercontent.com/storytold/deckcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.deckcraft.png" alt="" width="32" height="32"> | **DeckCraft** | Presentations and slide decks | [GitHub](https://github.com/storytold/deckcraft) | [Website](https://getartcraft.com/apps/deckcraft) |
+| <img src="https://raw.githubusercontent.com/storytold/cadcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.cadcraft.png" alt="" width="32" height="32"> | **CADCraft** | Computer-aided design | [GitHub](https://github.com/storytold/cadcraft) | [Website](https://getartcraft.com/apps/cadcraft) |
+| <img src="https://raw.githubusercontent.com/storytold/gridcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.gridcraft.png" alt="" width="32" height="32"> | **GridCraft** | Spreadsheets and data | [GitHub](https://github.com/storytold/gridcraft) | [Website](https://getartcraft.com/apps/gridcraft) |
+| <img src="https://raw.githubusercontent.com/storytold/texturecraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.texturecraft.png" alt="" width="32" height="32"> | **TextureCraft** | 3D texture painting | [GitHub](https://github.com/storytold/texturecraft) | [Website](https://getartcraft.com/apps/texturecraft) |
+| <img src="https://raw.githubusercontent.com/storytold/craft-anything/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.craft-anything.png" alt="" width="32" height="32"> | **Craft Anything** | See how any software works, then build your own | [GitHub](https://github.com/storytold/craft-anything) | [Website](https://getartcraft.com/apps/craft-anything) |
+| <img src="https://raw.githubusercontent.com/tangency-labs/solidcraft/main/assets/icons/app/linux/exports/hicolor/64x64/apps/io.tangencylabs.solidcraft.png" alt="" width="32" height="32"> | **SolidCraft** | Parametric 3D CAD by Tangency Labs (community app) | [GitHub](https://github.com/tangency-labs/solidcraft) | |
 
 And [**ArtCraft**](https://getartcraft.com/) itself, our AI image and video studio for artists who want real control.
 
diff --git a/ROADMAP.md b/ROADMAP.md
index 56f6237e8d..6da118da92 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -1,5 +1,11 @@
 # PdfCraft roadmap
 
+> **Last reviewed:** 2026-11-01 | **Last updated:** 2026-11-01 | **Change:** patch (M7, PR #2155 further review: inherited drawing/text state, affine image gestures, paste/selection ownership, no-op scripts and menu permissions; estimates unchanged)
+
+> **Last reviewed:** 2026-11-01 | **Last updated:** 2026-11-01 | **Change:** patch (M7, PR #2155 latest comments: explicit image-paste events, mixed-size field refresh, and documented mixed-script normalization with Undo; estimates unchanged)
+
+> **Last reviewed:** 2026-11-01 | **Last updated:** 2026-11-01 | **Change:** patch (M7, PR #2155 review follow-up: preserve image crop/tag/stream ownership, resize in page orientation, harden clipboard and text formatting, and reload installed fonts; estimates unchanged)
+
 > **Last reviewed:** 2026-10-31 | **Last updated:** 2026-10-31 | **Change:** patch (M2, PR #4172: GBK rasters compared with explicit Unicode and independently selected installed faces; wrong-glyph and wrong-family negative controls fail; estimates unchanged)
 > **Last reviewed:** 2026-10-31 | **Last updated:** 2026-10-31 | **Change:** patch (M2, PR #4172: integrate main fa5f9f8c; retain CJK viewer and upstream raster regressions, restore explicit display_config imports; estimates unchanged)
 > **Last reviewed:** 2026-10-28 · **Last updated:** 2026-10-28 · **Change:** patch (M2, PR #4172: integrate main 5af10276; retain both roadmap histories and viewer-only CJK font policy; estimates unchanged)
@@ -213,6 +219,23 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 
 ## Progress log
 
+- **2026-11-03 (M7, #5835):** In image crop mode, a right-click on the image, its crop box or its handles keeps the crop and opens no menu, so the menu no longer switches as the pointer moves. A right-click elsewhere clears the selection and opens the page menu. UI tests cover all four page rotations, overlapping images, a 45° image, and a check that the Done/Cancel/Remove Crop pills at a page edge still keep the crop.
+
+- **2026-11-02 (M10, #5743):** macOS print jobs name their title and owner (`com.apple.print.JobInfo.PMJobName`, `PMJobOwner`), as the system print dialog does, because a Kyocera filter crashes on a job without them. Checked by a test and through `doc_print` against a stand-in `lp`; not yet on a physical printer.
+
+- **2026-11-01 (M7, #5657):** Header/footer, watermark and background additions and replacements stage the complete call before committing. Synthetic later-page failures preserve exact incremental bytes, object count, dirty state and allocation cursor; success controls retain other marks and shared/inherited resources. Estimates unchanged.
+
+- **2026-11-01 (M14, #5572):** Preferences ▸ Documents and view sets how many recent files to keep, from 0 to 50 with 12 by default. At 0 Home has no Recent section and File ▸ Open Recent is disabled. The list is cut when Preferences closes, so the number can pass through 0 on its way to another.
+
+- **2026-11-01 (M5/M14, customizable hotbar, freehand highlight, and moveable navigation rail):** Added Freehand-Highlight (`/Subtype /Ink`, `/IT /FreehandHighlight`, Multiply blending, 100 pt max line width) inside the standard Highlight flyout and headless `comment_add`; added a customizable floating or side-docked hotbar with a full-side chrome strip mode, settings gear icon anchored at the bar end, and 24–64 px sizing; and added Left/Right docking for the navigation rail (`rail_side`). Focused unit and integration tests pass across `annot`, `automation`, and `ui-egui`. Estimates unchanged.
+- 2026-11-01: PR #2155 further review preserves inherited Form text state and soft-mask chronology during Arrange, composes crop-group moves in the proper scope, and uses affine/press-relative image resize plus a shared rotation pivot. No-op script buttons preserve hidden source text; paste coordinates, visible selection ownership, and Snapshot/Export permissions have dedicated regressions. Candidate only; estimates unchanged.
+
+- 2026-11-01: PR #2155 latest follow-up handles explicit image-paste events without release-time guesses, refreshes the font-size field when a selection becomes mixed, and specifies mixed-script normalization with exact Undo restoration. Candidate only; estimates unchanged.
+
+- 2026-11-01: PR #2155 review follow-up preserves editor crops through group moves and keeps arranged artwork outside added-item streams; unsafe nested-tag extraction is refused. Image handles and flips follow page orientation, added images accept general transforms, and clipboard/text/Home/font-discovery edge cases have focused regressions. Candidate only; estimates unchanged.
+- 2026-11-01: PR #2155 maintainer edits remove redundant image/text helpers and add regressions for crop ownership, arrange scope/state fidelity, clipboard precedence, crop-drag bounds, and font scanning. Transform and Unicode-script tools complete the headless paths.
+
+- **2026-10-18 (M3, #1354, local candidate):** Integrated --two-paged with current main, retaining upstream modal/picker ownership and single-tab reuse. Native launch/opening/password regressions, negative checks against the old wrapper, visual inspection, formatting, strict scoped Clippy, layers, assets, parity and scoped WASM compilation pass. Three existing socket tests are unavailable in this workspace; one existing network test remains ignored. No push or GitHub merge; estimates unchanged.
 - **2026-10-31 (M2, PR #4172 review):** Added same-machine pixel oracles for GBK Song, Hei, Kai and FangSong, including all four subset-prefixed Founder aliases. Reference PDFs use explicit Unicode mappings and independently selected installed faces; font data and rasters remain in memory. All eight cases ran; wrong-glyph and wrong-family production mutations each failed the new assertion and were restored. Validation: 422 renderer unit tests, renderer all-target Clippy with -D warnings, formatting, layers/assets/parity and renderer WASM checks passed; existing optional-patch/WASM warnings and parity notes remain. Estimates unchanged.
 
 - **2026-10-31 (M2, PR #4172):** Integrated main fa5f9f8c, retaining both roadmap histories and raster regression groups. Restored display_config and thumbnail_config imports after the upstream explicit-import migration. Validation: 422 renderer unit tests, engine/UI all-target checks, scoped all-target Clippy with -D warnings, formatting, layers, assets, parity and renderer/engine WASM checks passed. Existing optional-patch/WASM warnings and parity notes remain; no full engine/UI runtime test rerun. Display-only font policy and estimates unchanged.
@@ -726,6 +749,7 @@ Newest first: the date, what moved, and the new overall estimate.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-11-01 | patch | M7 #5657: header/footer, watermark and background operations commit all selected pages together; later-page errors preserve marks, content, shared/inherited resources and pending edits; estimates unchanged. |
 | 2026-10-28 | patch | M2, PR #4172: integrate main 5af10276 and retain both roadmap histories; viewer-only CJK and print/output font policies and estimates unchanged. |
 | 2026-10-27 | minor | M10: OCR stages SHA-256-verified ONNX models after the upstream RTEN URL brownout; discovery prefers a complete ONNX pair per directory, falls back to a complete RTEN pair, and never mixes formats or directories; language/web limits and estimates unchanged. |
 | 2026-10-23 | minor | M8, #3205 follow-up: phone-pattern redaction includes the +39 country code on labelled Italian geographic numbers with a slash; dates, protocol identifiers and whole-run guards remain. Estimates unchanged. |
@@ -805,3 +829,5 @@ PR #2133 retains document-local Pages sidebar focus for Ctrl/Cmd+A and Escape af
 ## Button export-value refresh (2026-10-30)
 
 PR #1952 retains per-widget checkbox/radio export-value editing in the split form-authoring and Prepare modules. Caption editing remains supported. Tests cover preserved appearances and selection, invalid/locked refusals, data-format round trips, and Apply/Cancel/Undo. Current-head hosted validation is pending; feature estimates are unchanged.
+
+- **2026-10-31 (#1577):** Reconciled the page-shadow preference with split viewer, organizer, settings and control modules, preserving upstream page-gap shadow suppression. CI validation pending.
diff --git a/apps/pdfcraft/src/main.rs b/apps/pdfcraft/src/main.rs
index 814730f344..5bc5c5c372 100644
--- a/apps/pdfcraft/src/main.rs
+++ b/apps/pdfcraft/src/main.rs
@@ -1,6 +1,8 @@
 //! PdfCraft desktop app.
 //!
 //! Usage: `pdfcraft [options] [files…]` (`-h` / `--help` prints a short version of this, [`USAGE`]).
+//! `--two-paged` opens each command-line PDF in noncontinuous two-page view, without changing defaults.
+//! An explicit `--layout` takes precedence for the active document, regardless of argument order.
 //! `--create-images [images…]` stages the images in one PDF and asks for the page DPI.
 //!
 //! View options (applied after the files open; also the seed of the UI control channel):
@@ -8,7 +10,7 @@
 //!  --theme light|dark|system  --language auto|<code>  --mode all|read|edit|convert|sign  --tool <catalogue id>  --left open|closed
 //!  --organize on  --fields on  --dialog properties|shortcuts|about  --palette <query>  --home on
 //!  --cover on|off  --default-layout single|continuous|two-up|two-page  --default-continuous on|off  --default-zoom fit-width|fit-page|<percent>  --always-default-view on|off
-//!  --page-gaps on|off  --default-page-gaps on|off
+//!  --page-gaps on|off  --default-page-gaps on|off  --recent-files 0..50
 //!  --combine-view grid|list  --combine-zoom 60..200`
 //!
 //! `--new-window` opens a window of its own. Without it, on Windows, a launch that only names files
@@ -40,6 +42,7 @@ mod motion;
 mod reopen;
 mod settings;
 mod single_instance;
+mod startup;
 mod text_scale;
 #[cfg(test)]
 #[path = "windows_manifest.rs"]
@@ -63,6 +66,7 @@ Usage: pdfcraft [options] [files…]
 Opens the files in the PdfCraft desktop app.
 
 Options:
+  --two-paged                 open command-line PDFs in noncontinuous two-page view
   --new-window                open a window of its own instead of passing the files to a running PdfCraft
   --create-images [images…]   put the images in one PDF and ask for the page DPI
   --control <file>            enable the UI control channel (pdfcraft-cli ui --control <file> …)
@@ -218,28 +222,16 @@ fn main() -> eframe::Result {
             let _ = std::io::Write::write_fmt(&mut std::io::stderr(), format_args!("pdfcraft: {report}\n"));
         }
     }));
-    let mut files = Vec::new();
-    let mut options: Vec<(String, String)> = Vec::new();
-    let mut control_file: Option<String> = None;
-    let mut create_images = false;
-    let mut new_window = false;
-    let mut args = std::env::args().skip(1);
-    while let Some(a) = args.next() {
-        match a.as_str() {
-            "--version" => return print_and_exit(&format!("pdfcraft {}", pdfcraft_engine::build_info::version())),
-            // Before any window or log file, so a scripted call returns (#4076).
-            "-h" | "--help" => return print_and_exit(USAGE),
-            "--control" => control_file = args.next(),
-            "--create-images" => create_images = true,
-            "--new-window" => new_window = true,
-            flag if flag.starts_with("--") => {
-                let value = args.next().unwrap_or_default();
-                options.push((flag.trim_start_matches("--").to_string(), value));
-            }
-            _ => files.push(path_from_arg(a)),
-        }
+    let mut startup = startup::Arguments::parse(std::env::args().skip(1));
+    if startup.version {
+        return print_and_exit(&format!("pdfcraft {}", pdfcraft_engine::build_info::version()));
     }
-    let files = rejoin_split_paths(files, |p| std::path::Path::new(p).is_file());
+    if startup.help {
+        return print_and_exit(USAGE);
+    }
+    startup.files = rejoin_split_paths(startup.files, |p| std::path::Path::new(p).is_file());
+    let may_hand_off = startup.may_hand_off();
+    let startup::Arguments { files, options, control_file, create_images, two_paged, .. } = startup;
     let integrated = cfg!(target_os = "macos");
     // GNOME on Wayland leaves the window frame to the app (src/decorations.rs).
     let window_controls = if cfg!(any(target_os = "macos", target_os = "windows")) { None } else { decorations::app_drawn() };
@@ -260,7 +252,6 @@ fn main() -> eframe::Result {
     // Explorer double-click, a file manager or `xdg-open`) hands them to the PdfCraft already
     // running and exits (#282, #317, #1726). Any option means the caller wants this launch's own
     // window.
-    let may_hand_off = !new_window && !files.is_empty() && options.is_empty() && control_file.is_none() && !create_images;
     // Absolute for this instance too: links relative to a document resolve against its folder,
     // never the working directory.
     let files = single_instance::absolute(&files);
@@ -270,7 +261,7 @@ fn main() -> eframe::Result {
         single_instance::Claim::Alone => None,
     };
     let choice = renderer_choice(std::env::var("PDFCRAFT_RENDERER").ok().as_deref());
-    let launch = Launch { files, options, control_file, create_images, integrated, window_controls };
+    let launch = Launch { files, options, control_file, create_images, integrated, window_controls, two_paged };
     // Finder, Open With and the Dock deliver files as Apple events, not arguments; catch the one
     // that launched us as well as later ones. Lives until the event loop returns.
     #[cfg(target_os = "macos")]
@@ -380,6 +371,7 @@ struct Launch {
     integrated: bool,
     /// The window buttons the app draws, when the desktop leaves the frame to it.
     window_controls: Option<pdfcraft_ui_egui::window_controls::Layout>,
+    two_paged: bool,
 }
 
 /// Whether the window is a native Wayland one (not X11 or XWayland).
@@ -400,7 +392,7 @@ fn app_creator<'a>(
     instance: Option<&'a single_instance::Server>,
     #[cfg(target_os = "macos")] apple_events: &'a apple_events::AppleEvents,
 ) -> eframe::AppCreator<'a> {
-    let Launch { files, options, control_file, create_images, integrated, window_controls } = launch;
+    let Launch { files, options, control_file, create_images, integrated, window_controls, two_paged } = launch;
     Box::new(move |cc| {
         started.set(true);
         let mut app = PdfCraftApp::new();
@@ -467,6 +459,7 @@ fn app_creator<'a>(
                 &[("folder", &w.folder.display().to_string()), ("error", &w.error)],
             );
         }
+        let defer_layout = two_paged && !files.is_empty() && !create_images;
         if create_images {
             if let Err(e) = app.begin_image_import_paths(&files) {
                 app.notify(e);
@@ -475,12 +468,11 @@ fn app_creator<'a>(
             // With the preference on, last session's files come back first; files named on
             // the command line open after them, in front (#442).
             app.reopen_last_files(&files);
-            for f in files {
-                app.open_path(&f);
-            }
+            startup::open_files(&mut app, &files, two_paged);
         }
         for (k, v) in options {
-            if let Err(e) = app.set_option(&k, &v) {
+            let result = if defer_layout && k == "layout" { app.set_launch_layout(&v) } else { app.set_option(&k, &v) };
+            if let Err(e) = result {
                 log::warn!("--{k} {v}: {e}");
             }
         }
diff --git a/apps/pdfcraft/src/startup.rs b/apps/pdfcraft/src/startup.rs
new file mode 100644
index 0000000000..be25da45b6
--- /dev/null
+++ b/apps/pdfcraft/src/startup.rs
@@ -0,0 +1,244 @@
+//! Native launch arguments and per-file view overrides (#1354).
+use pdfcraft_ui_egui::PdfCraftApp;
+
+#[derive(Default)]
+pub(super) struct Arguments {
+    pub files: Vec<String>,
+    pub options: Vec<(String, String)>,
+    pub control_file: Option<String>,
+    pub create_images: bool,
+    pub new_window: bool,
+    pub two_paged: bool,
+    pub version: bool,
+    pub help: bool,
+}
+
+impl Arguments {
+    pub fn may_hand_off(&self) -> bool {
+        !self.new_window && !self.files.is_empty() && self.options.is_empty() && self.control_file.is_none() && !self.create_images && !self.two_paged
+    }
+
+    pub fn parse(args: impl IntoIterator<Item = String>) -> Self {
+        let mut parsed = Self::default();
+        let mut args = args.into_iter();
+        while let Some(a) = args.next() {
+            match a.as_str() {
+                "--version" => {
+                    parsed.version = true;
+                    break;
+                }
+                "-h" | "--help" => {
+                    parsed.help = true;
+                    break;
+                }
+                "--control" => parsed.control_file = args.next(),
+                "--create-images" => parsed.create_images = true,
+                "--new-window" => parsed.new_window = true,
+                "--two-paged" => parsed.two_paged = true,
+                flag if flag.starts_with("--two-paged=") => {
+                    // It has no value: do not consume the following filename on malformed use.
+                    log::warn!("{flag}: use --two-paged without a value");
+                }
+                flag if flag.starts_with("--") => {
+                    let value = args.next().unwrap_or_default();
+                    parsed.options.push((flag.trim_start_matches("--").to_string(), value));
+                }
+                _ => parsed.files.push(super::path_from_arg(a)),
+            }
+        }
+        parsed
+    }
+}
+
+pub(super) fn open_files(app: &mut PdfCraftApp, files: &[String], two_paged: bool) {
+    for path in files {
+        if two_paged {
+            // The per-file override wins over initial view without changing saved defaults.
+            app.open_path_with_display(path, pdfcraft_ui_egui::canvas::PageLayout::TwoUp, false);
+        } else {
+            app.open_path(path);
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn parse(args: &[&str]) -> Arguments {
+        Arguments::parse(args.iter().map(|s| s.to_string()))
+    }
+
+    #[test]
+    fn standalone_flag_keeps_files_in_either_position() {
+        for args in
+            [["--two-paged", "first.pdf", "second.pdf"], ["first.pdf", "--two-paged", "second.pdf"], ["first.pdf", "second.pdf", "--two-paged"]]
+        {
+            let parsed = parse(&args);
+            assert!(parsed.two_paged);
+            assert_eq!(parsed.files, ["first.pdf", "second.pdf"]);
+            assert!(parsed.options.is_empty());
+            assert!(!parsed.may_hand_off());
+        }
+        let empty = parse(&["--two-paged"]);
+        assert!(empty.two_paged && empty.files.is_empty());
+        let normal = parse(&["first.pdf", "second.pdf"]);
+        assert!(!normal.two_paged);
+        assert!(normal.may_hand_off());
+        for args in [
+            &["--new-window", "first.pdf"][..],
+            &["--layout", "two-page", "first.pdf"],
+            &["--control", "control.json", "first.pdf"],
+            &["--create-images", "first.png"],
+        ] {
+            assert!(!parse(args).may_hand_off());
+        }
+    }
+
+    #[test]
+    fn existing_layout_options_are_preserved_in_either_order() {
+        for args in [["--two-paged", "--layout", "single", "file.pdf"], ["--layout", "single", "--two-paged", "file.pdf"]] {
+            let parsed = parse(&args);
+            assert!(parsed.two_paged);
+            assert_eq!(parsed.files, ["file.pdf"]);
+            assert_eq!(parsed.options, [("layout".into(), "single".into())]);
+        }
+        let parsed = parse(&["--two-paged", "--default-layout", "two-up", "file.pdf"]);
+        assert_eq!(parsed.options, [("default-layout".into(), "two-up".into())]);
+    }
+
+    #[test]
+    fn newer_options_and_version_are_preserved() {
+        let parsed = parse(&["--two-paged", "--new-window", "--grid-zoom", "150", "--default-mode", "read", "file:///tmp/a%20b.pdf"]);
+        assert!(parsed.two_paged && parsed.new_window);
+        assert_eq!(parsed.files, ["/tmp/a b.pdf"]);
+        assert_eq!(parsed.options, [("grid-zoom".into(), "150".into()), ("default-mode".into(), "read".into())]);
+        assert!(!parsed.may_hand_off());
+        let version = parse(&["--two-paged", "--version", "ignored.pdf"]);
+        assert!(version.version && version.files.is_empty());
+    }
+
+    #[test]
+    fn help_keeps_the_headless_early_exit() {
+        for flag in ["-h", "--help"] {
+            let args = parse(&["--two-paged", flag, "ignored.pdf"]);
+            assert!(args.help && args.files.is_empty());
+        }
+    }
+
+    #[test]
+    fn malformed_boolean_does_not_eat_a_file_or_option() {
+        let args = parse(&["--two-paged=false", "first.pdf", "--layout", "single", "second.pdf"]);
+        assert!(!args.two_paged);
+        assert_eq!(args.files, ["first.pdf", "second.pdf"]);
+        assert_eq!(args.options, [("layout".into(), "single".into())]);
+    }
+
+    #[test]
+    fn startup_override_is_per_file_and_does_not_persist() {
+        use std::io::Write as _;
+        let nonce = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).unwrap().as_nanos();
+        let path = std::env::temp_dir().join(format!("pdfcraft-two-paged-{}-{nonce}.pdf", std::process::id()));
+        let mut file = std::fs::OpenOptions::new().create_new(true).write(true).open(&path).unwrap();
+        file.write_all(include_bytes!("../../../crates/ui-egui/tests/data/form.pdf")).unwrap();
+        drop(file);
+        let second_path = path.with_extension("second.pdf");
+        std::fs::copy(&path, &second_path).unwrap();
+        let text = path.to_str().unwrap();
+        let second = second_path.to_str().unwrap();
+        for enabled in [false, true] {
+            let mut app = PdfCraftApp::new();
+            app.set_option("default-layout", "single").unwrap();
+            app.open_bytes("restored.pdf", None, include_bytes!("../../../crates/ui-egui/tests/data/form.pdf").to_vec()).unwrap();
+            let restored = app.views[0].id;
+            open_files(&mut app, &[text.into(), second.into()], enabled);
+            assert_eq!(app.views.len(), 3);
+            assert_eq!(app.views[0].id, restored);
+            assert_eq!(app.views[0].layout, pdfcraft_ui_egui::canvas::PageLayout::Single);
+            for view in app.views.iter().skip(1) {
+                assert_eq!(
+                    view.layout,
+                    if enabled { pdfcraft_ui_egui::canvas::PageLayout::TwoUp } else { pdfcraft_ui_egui::canvas::PageLayout::Single }
+                );
+                assert!(!view.continuous());
+            }
+            let persisted: serde_json::Value = serde_json::from_str(&app.persist()).unwrap();
+            assert_eq!(persisted["default_layout"], "single");
+            assert!(persisted.get("two_paged").is_none());
+            // Existing --layout applies after the flag to the active document only.
+            if enabled {
+                app.set_launch_layout("continuous").unwrap();
+            } else {
+                app.set_option("layout", "continuous").unwrap();
+            }
+            assert_eq!(app.views[2].layout, pdfcraft_ui_egui::canvas::PageLayout::Single);
+            assert!(app.views[2].continuous());
+            app.set_option("default-layout", "two-up").unwrap();
+            assert_eq!(app.view_defaults.layout, pdfcraft_ui_egui::canvas::PageLayout::TwoUp);
+            assert!(app.view_defaults.continuous);
+            open_files(&mut app, &[], enabled);
+            assert_eq!(app.views.len(), 3);
+        }
+        std::fs::remove_file(path).unwrap();
+        std::fs::remove_file(second_path).unwrap();
+    }
+
+    #[test]
+    fn explicit_launch_layout_preserves_argument_order_and_active_file() {
+        use pdfcraft_ui_egui::canvas::PageLayout;
+        let path = std::env::temp_dir().join(format!("pdfcraft-explicit-layout-{}.pdf", std::process::id()));
+        std::fs::write(&path, include_bytes!("../../../crates/ui-egui/tests/data/form.pdf")).unwrap();
+        let second_path = path.with_extension("second.pdf");
+        std::fs::copy(&path, &second_path).unwrap();
+        let names = [path.to_str().unwrap(), second_path.to_str().unwrap()];
+        for prefix in [["--two-paged", "--layout", "single"], ["--layout", "single", "--two-paged"]] {
+            for count in [1, 2] {
+                let args = Arguments::parse(prefix.into_iter().chain(names.iter().take(count).copied()).map(str::to_owned));
+                let mut app = PdfCraftApp::new();
+                app.set_option("default-layout", "continuous").unwrap();
+                app.open_bytes("restored.pdf", None, include_bytes!("../../../crates/ui-egui/tests/data/form.pdf").to_vec()).unwrap();
+                open_files(&mut app, &args.files, args.two_paged);
+                for (key, value) in args.options {
+                    assert_eq!(key, "layout");
+                    app.set_launch_layout(&value).unwrap();
+                }
+                assert_eq!(app.active, Some(count));
+                assert!(app.views[0].continuous());
+                for view in app.views.iter().skip(1).take(count - 1) {
+                    assert_eq!(view.layout, PageLayout::TwoUp);
+                }
+                assert_eq!(app.views[count].layout, PageLayout::Single);
+                assert!(!app.views[count].continuous());
+                assert!(app.view_defaults.continuous);
+            }
+        }
+        std::fs::remove_file(path).unwrap();
+        std::fs::remove_file(second_path).unwrap();
+    }
+}
+
+#[cfg(test)]
+mod repeated_file_tests {
+    use super::*;
+
+    #[test]
+    fn a_repeated_file_reuses_its_tab_and_receives_the_launch_override() {
+        use pdfcraft_ui_egui::canvas::PageLayout;
+        let path = std::env::temp_dir().join(format!("pdfcraft-repeated-startup-{}.pdf", std::process::id()));
+        std::fs::write(&path, include_bytes!("../../../crates/ui-egui/tests/data/form.pdf")).unwrap();
+        let name = path.to_str().unwrap().to_string();
+        let mut app = PdfCraftApp::new();
+        app.set_option("default-layout", "continuous").unwrap();
+        app.open_path(&name);
+        let original = app.views[0].id;
+        open_files(&mut app, &[name.clone(), name], true);
+        assert_eq!(app.views.len(), 1);
+        assert_eq!(app.views[0].id, original);
+        assert_eq!(app.views[0].layout, PageLayout::TwoUp);
+        assert!(!app.views[0].continuous());
+        app.set_launch_layout("single").unwrap();
+        assert_eq!(app.views[0].layout, PageLayout::Single);
+        assert!(app.view_defaults.continuous);
+        std::fs::remove_file(path).unwrap();
+    }
+}
diff --git a/contributors/people.toml b/contributors/people.toml
index a5a47f5c52..fecfb68c90 100644
--- a/contributors/people.toml
+++ b/contributors/people.toml
@@ -180,3 +180,6 @@ sync_github_name = true
 
 [people.dylanmtaylor]
 sync_github_name = true
+
+[people.Combiler01]
+sync_github_name = true
diff --git a/crates/a11y/src/alt.rs b/crates/a11y/src/alt.rs
index 720b8a6a1e..fde1048e47 100644
--- a/crates/a11y/src/alt.rs
+++ b/crates/a11y/src/alt.rs
@@ -125,9 +125,9 @@ pub(crate) fn elements(doc: &Document) -> Vec<Element> {
 }
 
 /// The marked-content ids an element owns directly.
-fn mcids(d: &Dict) -> Vec<i64> {
+fn mcids(doc: &Document, d: &Dict) -> Vec<i64> {
     let mut out = Vec::new();
-    let mut push = |o: &Object| match o {
+    let mut push = |o: &Object| match &*doc.resolve(o) {
         Object::Int(n) => out.push(*n),
         Object::Dict(m) if m.name(b"Type") == Some(b"MCR") => {
             if let Some(n) = m.get(b"MCID").and_then(Object::as_int) {
@@ -323,7 +323,7 @@ pub fn figures(doc: &Document) -> Vec<Figure> {
     let mut wanted: HashMap<usize, HashSet<i64>> = HashMap::new();
     for (e, page) in &figures {
         if let Some(p) = page {
-            wanted.entry(*p).or_default().extend(mcids(&e.dict));
+            wanted.entry(*p).or_default().extend(mcids(doc, &e.dict));
         }
     }
     let bounds: HashMap<usize, HashMap<i64, [f64; 4]>> =
@@ -333,7 +333,7 @@ pub fn figures(doc: &Document) -> Vec<Figure> {
         .map(|(e, page)| {
             let alt = e.dict.get(b"Alt").map(|o| doc.resolve(o)).and_then(|o| o.as_string().map(|s| s.to_text()));
             let on_page = page.and_then(|p| bounds.get(&p));
-            let bbox = on_page.and_then(|b| mcids(&e.dict).iter().filter_map(|id| b.get(id)).fold(None, |acc, b| Some(union(acc, *b))));
+            let bbox = on_page.and_then(|b| mcids(doc, &e.dict).iter().filter_map(|id| b.get(id)).fold(None, |acc, b| Some(union(acc, *b))));
             Figure { obj: e.object, page, alt, bbox }
         })
         .collect()
@@ -363,52 +363,73 @@ pub fn set_alt(doc: &mut Document, obj: ObjRef, alt: Option<&str>) -> Result<(),
 }
 
 /// The page's content entries: one stream, or the elements of a contents array.
-fn content_entries(doc: &Document, page: &Dict) -> Option<Vec<Object>> {
-    let c = page.get(b"Contents")?;
-    Some(match &*doc.resolve(c) {
+fn content_entries(doc: &Document, page: &Dict) -> Vec<Object> {
+    let Some(c) = page.get(b"Contents") else { return Vec::new() };
+    match &*doc.resolve(c) {
         Object::Array(a) => a.clone(),
         Object::Stream(_) => vec![c.clone()],
-        _ => return None,
-    })
+        _ => Vec::new(),
+    }
 }
 
-fn marked(doc: &Document, props: &Dict, op: &pdfcraft_content::Op, ids: &HashSet<i64>) -> bool {
-    op.op == b"BDC" && bdc_mcid(doc, props, op).is_some_and(|n| ids.contains(&n))
-}
+type DecodedStream = (Object, Option<(Stream, Vec<u8>)>);
 
-/// Turn the figure's marked-content blocks into artifacts, rewriting only the streams that
-/// contain them. Other content streams, and unknown entries on a rewritten stream, stay.
-fn artifact_marked_content(doc: &mut Document, page: &pdfcraft_model::Page, ids: &HashSet<i64>) -> Result<bool, AltError> {
-    let Some(entries) = content_entries(doc, &page.dict) else { return Ok(false) };
-    let props = page_properties(doc, &page.dict);
-    let mut streams: Vec<Option<(Stream, Vec<u8>)>> = Vec::with_capacity(entries.len());
+/// Decode the page's content streams within the page decode budget. `None` when a stream is
+/// rejected because the budget is exhausted.
+fn decode_page_streams(doc: &Document, page: &Dict) -> Option<Vec<DecodedStream>> {
+    let entries = content_entries(doc, page);
+    let mut streams = Vec::with_capacity(entries.len());
     let mut budget = DecodeBudget::page();
-    for entry in &entries {
-        match &*doc.resolve(entry) {
+    for entry in entries {
+        let decoded = match &*doc.resolve(&entry) {
             Object::Stream(s) => {
                 let data = match budget.decode(s) {
                     Ok(data) => data,
-                    // Content past the budget may hold more of the figure: editing the rest
-                    // would leave that part marked as a figure the tree no longer has.
-                    Err(_) if budget.exhausted() => return Err(AltError::TooLarge),
+                    // Content past the budget may hold more of the tag: editing the rest
+                    // would leave that part marked as a tag the tree no longer has.
+                    Err(_) if budget.exhausted() => return None,
                     Err(_) => Vec::new(),
                 };
-                streams.push(Some((s.clone(), data)));
+                Some((s.clone(), data))
             }
-            _ => streams.push(None),
+            _ => None,
+        };
+        streams.push((entry, decoded));
+    }
+    Some(streams)
+}
+
+fn marked_id(doc: &Document, props: &Dict, op: &pdfcraft_content::Op, ids: &HashSet<i64>) -> Option<i64> {
+    (op.op == b"BDC").then(|| bdc_mcid(doc, props, op)).flatten().filter(|n| ids.contains(n))
+}
+
+/// Turn the tag's marked-content blocks into artifacts, rewriting only the streams that
+/// contain them. Other content streams, and unknown entries on a rewritten stream, stay.
+/// With `require_all`, every id in `ids` must appear on the page before any stream is rewritten.
+fn artifact_marked_content(
+    doc: &mut Document,
+    page: &pdfcraft_model::Page,
+    streams: Vec<DecodedStream>,
+    ids: &HashSet<i64>,
+    require_all: bool,
+) -> Result<bool, pdfcraft_cos::CosError> {
+    let props = page_properties(doc, &page.dict);
+    let decoded: Vec<&[u8]> = streams.iter().filter_map(|(_, s)| s.as_ref().map(|(_, bytes)| bytes.as_slice())).collect();
+    let pieces = pdfcraft_content::Pieces::join(&decoded);
+    let mut found = HashSet::new();
+    let mut edits = Vec::new();
+    for op in pieces.parse().ops {
+        if let Some(id) = marked_id(doc, &props, &op, ids) {
+            found.insert(id);
+            edits.push((op.span, b"/Artifact BMC".to_vec()));
         }
     }
-    let decoded: Vec<&[u8]> = streams.iter().flatten().map(|(_, bytes)| bytes.as_slice()).collect();
-    let pieces = pdfcraft_content::Pieces::join(&decoded);
-    let edits: Vec<_> =
-        pieces.parse().ops.into_iter().filter(|op| marked(doc, &props, op, ids)).map(|op| (op.span, b"/Artifact BMC".to_vec())).collect();
-    if edits.is_empty() {
+    if if require_all { found != *ids } else { found.is_empty() } {
         return Ok(false);
     }
     let mut spliced = pieces.splice(edits).into_iter();
-    let mut next = Vec::with_capacity(entries.len());
-    let mut changed = false;
-    for (entry, stream) in entries.into_iter().zip(streams) {
+    let mut next = Vec::with_capacity(streams.len());
+    for (entry, stream) in streams {
         let Some((stream, old)) = stream else {
             next.push(entry);
             continue;
@@ -421,7 +442,6 @@ fn artifact_marked_content(doc: &mut Document, page: &pdfcraft_model::Page, ids:
             next.push(entry);
             continue;
         }
-        changed = true;
         let mut dict = stream.dict;
         dict.remove(b"Length");
         dict.remove(b"Filter");
@@ -431,28 +451,27 @@ fn artifact_marked_content(doc: &mut Document, page: &pdfcraft_model::Page, ids:
         // appear elsewhere in this array or on another page, where it must stay unchanged.
         next.push(Object::Ref(doc.add(stream)));
     }
-    if changed {
-        let contents = match next.as_slice() {
-            [one] => one.clone(),
-            _ => Object::Array(next),
-        };
-        doc.update_dict(page.obj, |p| p.set(b"Contents".to_vec(), contents))?;
-    }
-    Ok(changed)
+    let contents = match next.as_slice() {
+        [one] => one.clone(),
+        _ => Object::Array(next),
+    };
+    doc.update_dict(page.obj, |p| p.set(b"Contents".to_vec(), contents))?;
+    Ok(true)
 }
 
 /// Decorative figure: its marked content on the page becomes an artifact, and the element
 /// leaves the structure tree (and the parent tree).
 pub fn mark_decorative(doc: &mut Document, obj: ObjRef) -> Result<(), AltError> {
     let d = check_figure(doc, obj)?;
-    let ids: HashSet<i64> = mcids(&d).into_iter().collect();
+    let ids: HashSet<i64> = mcids(doc, &d).into_iter().collect();
     let pages = pdfcraft_model::pages(doc);
     let pg = d.get(b"Pg").and_then(Object::as_ref).or_else(|| elements(doc).into_iter().find(|e| e.object == obj).and_then(|e| e.page));
-    if let Some(page) = pg.and_then(|p| pages.iter().find(|x| x.obj == p)).filter(|_| !ids.is_empty())
-        && artifact_marked_content(doc, page, &ids)?
-    {
+    if let Some(page) = pg.and_then(|p| pages.iter().find(|x| x.obj == p)).filter(|_| !ids.is_empty()) {
+        let streams = decode_page_streams(doc, &page.dict).ok_or(AltError::TooLarge)?;
         // The parent tree no longer points those ids at the figure.
-        if let Some(key) = page.dict.get(b"StructParents").and_then(Object::as_int) {
+        if artifact_marked_content(doc, page, streams, &ids, false)?
+            && let Some(key) = page.dict.get(b"StructParents").and_then(Object::as_int)
+        {
             clear_parent_tree(doc, key, obj)?;
         }
     }
@@ -484,54 +503,23 @@ pub fn mark_tag_artifact(doc: &mut Document, obj: ObjRef) -> Result<(), Artifact
     if has_child_structure(doc, &element.dict) {
         return Err(ArtifactError::HasChildren);
     }
-    let ids: HashSet<i64> = mcids(&element.dict).into_iter().collect();
+    let ids: HashSet<i64> = mcids(doc, &element.dict).into_iter().collect();
     if ids.is_empty() {
         return Err(ArtifactError::NoMarkedContent);
     }
     let pages = pdfcraft_model::pages(doc);
     let page_ref = element.page.ok_or(ArtifactError::NoPage)?;
     let page = pages.iter().find(|page| page.obj == page_ref).ok_or(ArtifactError::NoPage)?;
-    let mut content = Vec::new();
-    if let Some(c) = page.dict.get(b"Contents") {
-        let mut budget = DecodeBudget::page();
-        for data in budget.decode_contents(doc, c) {
-            match data {
-                Ok(data) => {
-                    content.extend_from_slice(&data);
-                    content.push(b' ');
-                }
-                // The page's /Contents is replaced with what was decoded: content past the
-                // budget would be dropped from the page.
-                Err(_) if budget.exhausted() => return Err(ArtifactError::TooLarge),
-                Err(_) => {}
-            }
-        }
-    }
-    let mut ops = pdfcraft_content::parse(&content).ops;
-    let mut found = HashSet::new();
-    for op in &mut ops {
-        let id = (op.op == b"BDC")
-            .then(|| match op.operands.get(1) {
-                Some(Object::Dict(mark)) => mark.get(b"MCID").and_then(Object::as_int),
-                _ => None,
-            })
-            .flatten()
-            .filter(|id| ids.contains(id));
-        if let Some(id) = id {
-            *op = pdfcraft_content::Op::new("BMC", vec![Object::name("Artifact")]);
-            found.insert(id);
-        }
-    }
-    if found != ids {
+    let parent = element.dict.get(b"P").and_then(Object::as_ref).ok_or(ArtifactError::NoParent)?;
+    let replacement = replacement_kids(doc, parent, obj)?;
+    let streams = decode_page_streams(doc, &page.dict).ok_or(ArtifactError::TooLarge)?;
+    if !artifact_marked_content(doc, page, streams, &ids, true)? {
         return Err(ArtifactError::ContentNotFound);
     }
-    let stream = doc.add(Object::Stream(Stream::flate(Dict::new(), &pdfcraft_content::serialize_ops(&ops))));
-    doc.update_dict(page.obj, |p| p.set(b"Contents".to_vec(), Object::Ref(stream)))?;
     if let Some(key) = page.dict.get(b"StructParents").and_then(Object::as_int) {
         clear_parent_tree(doc, key, obj).map_err(|e| ArtifactError::ParentTree(e.to_string()))?;
     }
-    let parent = element.dict.get(b"P").and_then(Object::as_ref).ok_or(ArtifactError::NoParent)?;
-    remove_from_parent(doc, parent, obj)?;
+    doc.update_dict(parent, |p| p.set(b"K".to_vec(), replacement))?;
     // Keep the retired object valid if another object holds an out-of-tree reference to it.
     doc.update_dict(obj, |d| {
         d.remove(b"P");
@@ -551,20 +539,18 @@ fn has_child_structure(doc: &Document, tag: &Dict) -> bool {
     tag.get(b"K").is_some_and(|items| child(doc, items))
 }
 
-fn remove_from_parent(doc: &mut Document, parent: ObjRef, obj: ObjRef) -> Result<(), ArtifactError> {
+fn replacement_kids(doc: &Document, parent: ObjRef, obj: ObjRef) -> Result<Object, ArtifactError> {
     let kids = doc.get(parent).as_dict().and_then(|p| p.get(b"K").cloned()).ok_or(ArtifactError::NoParent)?;
-    let replacement = match kids {
+    match kids {
         Object::Array(items) => {
             if items.iter().filter(|item| item.as_ref() == Some(obj)).count() != 1 {
                 return Err(ArtifactError::AmbiguousParent);
             }
-            Object::Array(items.into_iter().filter(|item| item.as_ref() != Some(obj)).collect())
+            Ok(Object::Array(items.into_iter().filter(|item| item.as_ref() != Some(obj)).collect()))
         }
-        Object::Ref(r) if r == obj => Object::Array(Vec::new()),
-        _ => return Err(ArtifactError::NoParent),
-    };
-    doc.update_dict(parent, |p| p.set(b"K".to_vec(), replacement))?;
-    Ok(())
+        Object::Ref(r) if r == obj => Ok(Object::Array(Vec::new())),
+        _ => Err(ArtifactError::NoParent),
+    }
 }
 
 /// Replace `obj` by null in the page's parent-tree array (`key`), in a flat /Nums tree.
diff --git a/crates/a11y/src/tests.rs b/crates/a11y/src/tests.rs
index a70ffbf385..3024319ec3 100644
--- a/crates/a11y/src/tests.rs
+++ b/crates/a11y/src/tests.rs
@@ -1017,6 +1017,76 @@ fn named_property_lists_are_found_and_marked_decorative_like_inline_ones() {
     assert!(props.contains(b"P0") && props.contains(b"P1") && props.contains(b"Other"), "resources are left as they were");
 }
 
+#[test]
+fn mark_tag_artifact_finds_named_property_lists_and_indirect_mcrs() {
+    use pdfcraft_cos::{Dict, ObjRef, Object};
+    let mut doc = named_figures_doc();
+    let mcr = doc.add(Object::Dict([(b"Type".to_vec(), Object::name("MCR")), (b"MCID".to_vec(), Object::Int(0))].into_iter().collect::<Dict>()));
+    doc.update_dict(ObjRef::new(7, 0), |d| d.set(b"K".to_vec(), Object::Ref(mcr))).unwrap();
+    assert_eq!(figures(&doc)[0].bbox, Some([10.0, 150.0, 50.0, 170.0]), "indirect MCR is resolved for figure bounds");
+
+    for (tag, gone) in [(ObjRef::new(7, 0), "/P0"), (ObjRef::new(8, 0), "/P1")] {
+        mark_tag_artifact(&mut doc, tag).unwrap();
+        let pages = pdfcraft_model::pages(&doc);
+        let c = doc.resolve(pages[0].dict.get(b"Contents").unwrap());
+        let Object::Stream(c) = &*c else { panic!("one content stream") };
+        let text = String::from_utf8(c.decoded().unwrap()).unwrap();
+        assert!(text.contains("/Artifact BMC") && !text.contains(gone), "{text}");
+    }
+    assert_eq!(tags(&doc).into_iter().map(|t| t.object.num).collect::<Vec<_>>(), [6]);
+    let nums = doc.get(ObjRef::new(9, 0)).as_dict().and_then(|d| d.get(b"Nums").cloned());
+    assert_eq!(nums, Some(Object::Array(vec![Object::Int(0), Object::Array(vec![Object::Null, Object::Null])])));
+    let r = check(&doc, &Options { rules: [Rule::FiguresAltText, Rule::TaggedContent].into(), pages: None });
+    assert_eq!(failed(&r), Vec::<Rule>::new(), "{:?}", r.results);
+}
+
+#[test]
+fn mark_tag_artifact_validates_parent_and_all_mcids_before_mutating_document() {
+    use pdfcraft_cos::{ObjRef, Object};
+
+    // Missing /P on the tag must fail before touching /Contents or /ParentTree.
+    let mut no_parent = figures_doc();
+    let before_contents = no_parent.get(ObjRef::new(3, 0)).as_dict().unwrap().get(b"Contents").cloned();
+    let before_pt = no_parent.get(ObjRef::new(9, 0)).as_ref().clone();
+    no_parent
+        .update_dict(ObjRef::new(7, 0), |d| {
+            d.remove(b"P");
+        })
+        .unwrap();
+    assert_eq!(mark_tag_artifact(&mut no_parent, ObjRef::new(7, 0)), Err(ArtifactError::NoParent));
+    assert_eq!(no_parent.get(ObjRef::new(3, 0)).as_dict().unwrap().get(b"Contents").cloned(), before_contents);
+    assert_eq!(*no_parent.get(ObjRef::new(9, 0)), before_pt);
+
+    // Duplicate entry in parent's /K must fail with AmbiguousParent before touching /Contents or /ParentTree.
+    let mut dup_parent = figures_doc();
+    dup_parent
+        .update_dict(ObjRef::new(6, 0), |d| {
+            d.set(b"K".to_vec(), Object::Array(vec![Object::Ref(ObjRef::new(7, 0)), Object::Ref(ObjRef::new(8, 0)), Object::Ref(ObjRef::new(7, 0))]));
+        })
+        .unwrap();
+    assert_eq!(mark_tag_artifact(&mut dup_parent, ObjRef::new(7, 0)), Err(ArtifactError::AmbiguousParent));
+    assert_eq!(dup_parent.get(ObjRef::new(3, 0)).as_dict().unwrap().get(b"Contents").cloned(), before_contents);
+    assert_eq!(*dup_parent.get(ObjRef::new(9, 0)), before_pt);
+
+    // Partial MCID match (MCID 0 present, MCID 99 absent) must fail with ContentNotFound in
+    // mark_tag_artifact without mutating /Contents, while mark_decorative still converts MCID 0.
+    let mut partial = figures_doc();
+    partial.update_dict(ObjRef::new(7, 0), |d| d.set(b"K".to_vec(), Object::Array(vec![Object::Int(0), Object::Int(99)]))).unwrap();
+    assert_eq!(mark_tag_artifact(&mut partial, ObjRef::new(7, 0)), Err(ArtifactError::ContentNotFound));
+    assert_eq!(partial.get(ObjRef::new(3, 0)).as_dict().unwrap().get(b"Contents").cloned(), before_contents);
+    assert_eq!(*partial.get(ObjRef::new(9, 0)), before_pt);
+    mark_decorative(&mut partial, ObjRef::new(7, 0)).unwrap();
+    assert_ne!(partial.get(ObjRef::new(3, 0)).as_dict().unwrap().get(b"Contents").cloned(), before_contents);
+    assert_ne!(*partial.get(ObjRef::new(9, 0)), before_pt);
+
+    // When none of a figure's MCIDs appear on the page, mark_decorative leaves /Contents and /ParentTree untouched.
+    let mut absent = figures_doc();
+    absent.update_dict(ObjRef::new(7, 0), |d| d.set(b"K".to_vec(), Object::Int(99))).unwrap();
+    mark_decorative(&mut absent, ObjRef::new(7, 0)).unwrap();
+    assert_eq!(absent.get(ObjRef::new(3, 0)).as_dict().unwrap().get(b"Contents").cloned(), before_contents);
+    assert_eq!(*absent.get(ObjRef::new(9, 0)), before_pt);
+}
+
 fn ref_(n: u32) -> Option<pdfcraft_cos::ObjRef> {
     Some(pdfcraft_cos::ObjRef::new(n, 0))
 }
diff --git a/crates/a11y/tests/cross_stream.rs b/crates/a11y/tests/cross_stream.rs
index ad613a2939..d0a2f48204 100644
--- a/crates/a11y/tests/cross_stream.rs
+++ b/crates/a11y/tests/cross_stream.rs
@@ -99,14 +99,20 @@ fn shown_strings(ops: &[Op]) -> Vec<String> {
 
 #[test]
 fn mark_decorative_leaves_the_other_stream_untouched() {
-    let mut doc = tagged_figure_two_streams("0 0 1 rg 300 600 100 50 re f", "BT /F1 12 Tf 72 500 Td (After) Tj ET");
-    let before = doc.get(ObjRef::new(11, 0)).clone();
-    mark_decorative(&mut doc, ObjRef::new(8, 0)).expect("mark decorative succeeds");
-    assert!(figures(&doc).is_empty());
-    assert_eq!(*doc.get(ObjRef::new(11, 0)), *before, "the second stream holds no figure and keeps its object");
-    let page = doc.get(ObjRef::new(3, 0));
-    let contents = page.as_dict().unwrap().get(b"Contents").unwrap().as_array().unwrap();
-    assert_eq!(contents[1].as_ref(), Some(ObjRef::new(11, 0)), "the untouched stream must not be replaced by a re-encoded copy");
+    for use_artifact in [false, true] {
+        let mut doc = tagged_figure_two_streams("0 0 1 rg 300 600 100 50 re f", "BT /F1 12 Tf 72 500 Td (After) Tj ET");
+        let before = doc.get(ObjRef::new(11, 0)).clone();
+        if use_artifact {
+            mark_tag_artifact(&mut doc, ObjRef::new(8, 0)).expect("mark tag artifact succeeds");
+        } else {
+            mark_decorative(&mut doc, ObjRef::new(8, 0)).expect("mark decorative succeeds");
+        }
+        assert!(figures(&doc).is_empty());
+        assert_eq!(*doc.get(ObjRef::new(11, 0)), *before, "the second stream holds no figure and keeps its object");
+        let page = doc.get(ObjRef::new(3, 0));
+        let contents = page.as_dict().unwrap().get(b"Contents").unwrap().as_array().unwrap();
+        assert_eq!(contents[1].as_ref(), Some(ObjRef::new(11, 0)), "the untouched stream must not be replaced by a re-encoded copy");
+    }
 }
 
 /// A and B supply different operands to R's BDC. Reusing R must not let the first
diff --git a/crates/annot/src/appearance.rs b/crates/annot/src/appearance.rs
index abc746c0dd..909250ef26 100644
--- a/crates/annot/src/appearance.rs
+++ b/crates/annot/src/appearance.rs
@@ -392,9 +392,13 @@ struct AppearanceDrawing {
 }
 
 impl AppearanceDrawing {
+    /// Initialize an appearance drawing buffer and configure its graphics state for opacity and blend mode.
     fn new(context: &AppearanceContext<'_>) -> Self {
         let mut drawing = Self::default();
-        if let Some(gs) = ext_gstate(context.opacity, context.subtype == b"Highlight") {
+        if let Some(gs) = ext_gstate(
+            context.opacity,
+            context.subtype == b"Highlight" || (context.subtype == b"Ink" && context.dict.name(b"IT") == Some(b"FreehandHighlight")),
+        ) {
             drawing.resources.set(b"ExtGState".to_vec(), Object::Dict(gs));
             drawing.content.push_str("/GS0 gs\n");
         }
diff --git a/crates/annot/src/create.rs b/crates/annot/src/create.rs
index a6db5b940b..1904745e95 100644
--- a/crates/annot/src/create.rs
+++ b/crates/annot/src/create.rs
@@ -33,6 +33,16 @@ pub(crate) fn grow(r: [f64; 4], by: f64) -> [f64; 4] {
     [r[0] - by, r[1] - by, r[2] + by, r[3] + by]
 }
 
+/// Tight bounding box of ink strokes, including Bezier control points for strokes with three or
+/// more points (matching [`appearance::smooth_segments`]).
+pub(crate) fn ink_bounds(strokes: &[Vec<[f64; 2]>]) -> Option<[f64; 4]> {
+    let controls = strokes.iter().filter(|s| s.len() > 2).flat_map(|s| {
+        let pts: Vec<(f64, f64)> = s.iter().map(|p| (p[0], p[1])).collect();
+        appearance::smooth_segments(&pts).into_iter().flat_map(|[a, b, _]| [[a.0, a.1], [b.0, b.1]])
+    });
+    bounds(strokes.iter().flatten().copied().chain(controls))
+}
+
 pub(crate) fn ending_draws(ending: LineEnding) -> bool {
     ending != LineEnding::None
 }
@@ -87,17 +97,11 @@ pub(crate) fn rect_for(shape: &Shape, style: &Style) -> Result<[f64; 4], AnnotEr
             let pad = half + if ending_draws(*start) || ending_draws(*end) { appearance::arrow_size(style.width) } else { 0.0 };
             grow(bounds([*from, *to].into_iter()).unwrap_or_default(), pad + 1.0)
         }
-        Shape::Ink { strokes } | Shape::Signature { strokes } => {
+        Shape::Ink { strokes } | Shape::FreehandHighlight { strokes } | Shape::Signature { strokes } => {
             if strokes.iter().all(Vec::is_empty) || !strokes.iter().flatten().all(|p| finite(p)) {
                 return Err(bad("drawing (no points)"));
             }
-            // Strokes of three or more points are drawn as curves, which stay within their
-            // points and control points.
-            let controls = strokes.iter().filter(|s| s.len() > 2).flat_map(|s| {
-                let pts: Vec<(f64, f64)> = s.iter().map(|p| (p[0], p[1])).collect();
-                appearance::smooth_segments(&pts).into_iter().flat_map(|[a, b, _]| [[a.0, a.1], [b.0, b.1]])
-            });
-            grow(bounds(strokes.iter().flatten().copied().chain(controls)).unwrap_or_default(), half + 1.0)
+            grow(ink_bounds(strokes).unwrap_or_default(), half + 1.0)
         }
         Shape::Polygon { vertices, cloud } => {
             let b = bounds(vertices.iter().copied())
@@ -164,6 +168,7 @@ fn subject(shape: &Shape) -> &'static str {
         Shape::Oval { .. } => "Oval",
         Shape::Line { start: LineEnding::None, end: LineEnding::OpenArrow, .. } => "Arrow",
         Shape::Line { .. } => "Line",
+        Shape::FreehandHighlight { .. } => "Freehand Highlight",
         Shape::Ink { .. } => "Pencil",
         Shape::TextBox { .. } => "Text Box",
         Shape::Typewriter { .. } => "Typewriter",
@@ -292,10 +297,13 @@ pub fn add_annotation(doc: &mut Document, new: &NewAnnotation, meta: &Meta) -> R
                 }
             }
         }
-        Shape::Ink { strokes } | Shape::Signature { strokes } => {
+        Shape::Ink { strokes } | Shape::FreehandHighlight { strokes } | Shape::Signature { strokes } => {
             d.set(b"C".to_vec(), rgb(style.color));
             let list = strokes.iter().filter(|s| !s.is_empty()).map(|s| num_array(&s.concat())).collect();
             d.set(b"InkList".to_vec(), Object::Array(list));
+            if matches!(&new.shape, Shape::FreehandHighlight { .. }) {
+                d.set(b"IT".to_vec(), Object::name("FreehandHighlight"));
+            }
             border(&mut d);
         }
         Shape::Polygon { vertices, cloud } => {
diff --git a/crates/annot/src/modify.rs b/crates/annot/src/modify.rs
index 2e3ae0b7d0..a615b8e013 100644
--- a/crates/annot/src/modify.rs
+++ b/crates/annot/src/modify.rs
@@ -1,5 +1,5 @@
 use super::create::{
-    add_annotation, base_dict, bounds, callout_attach, ending_draws, ending_pair, finite, grow, normalize, num_array, rect_for, rgb,
+    add_annotation, base_dict, bounds, callout_attach, ending_draws, ending_pair, finite, grow, ink_bounds, normalize, num_array, rect_for, rgb,
 };
 use super::draw::{draw_appearance, redraw_or_restore, set_appearance};
 use super::info::{line_endings_of, text_value};
@@ -529,7 +529,33 @@ fn apply_text_box(doc: &mut Document, r: ObjRef, rect: [f64; 4], meta: &Meta, ne
 }
 
 fn border_width_of(d: &Dict) -> f64 {
-    d.get(b"BS").and_then(|b| b.as_dict()).and_then(|b| b.get(b"W")).and_then(|w| w.as_f64()).unwrap_or(1.0).max(0.0)
+    appearance::border_width(d)
+}
+
+/// Recompute `/Rect` for an `Ink` annotation when its stroke width changes from `old_w` to `w`.
+/// Preserves any baseline margin beyond `old_w / 2.0` (at least `1.0` pt) without accumulating
+/// padding across repeated width increases and decreases.
+fn ink_rect_for_width(d: &Dict, old_w: f64, w: f64) -> Option<[f64; 4]> {
+    let list = d.get(b"InkList")?.as_array()?;
+    let mut strokes: Vec<Vec<[f64; 2]>> = Vec::with_capacity(list.len());
+    for s in list {
+        let pts: Vec<f64> = s.as_array()?.iter().map(Object::as_f64).collect::<Option<_>>()?;
+        strokes.push(pts.as_chunks::<2>().0.iter().map(|p| [p[0], p[1]]).collect());
+    }
+    let inner = ink_bounds(&strokes)?;
+    let vals: Vec<f64> = d.get(b"Rect").and_then(Object::as_array).map(|a| a.iter().filter_map(Object::as_f64).collect()).unwrap_or_default();
+    let Some(old_rect) = four(&vals).map(normalize) else {
+        return Some(grow(inner, w / 2.0 + 1.0));
+    };
+    let old_half = old_w / 2.0;
+    let new_half = w / 2.0;
+    let base = [
+        (inner[0] - old_rect[0] - old_half).max(1.0),
+        (inner[1] - old_rect[1] - old_half).max(1.0),
+        (old_rect[2] - inner[2] - old_half).max(1.0),
+        (old_rect[3] - inner[3] - old_half).max(1.0),
+    ];
+    Some([inner[0] - base[0] - new_half, inner[1] - base[1] - new_half, inner[2] + base[2] + new_half, inner[3] + base[3] + new_half])
 }
 
 /// Change a comment's colour, opacity, line width and/or line endings, and redraw it.
@@ -576,10 +602,17 @@ pub fn set_style(doc: &mut Document, page: usize, index: usize, change: StyleCha
             }
         }
         if let Some(w) = width {
+            let old_w = border_width_of(d);
+            let w = w.max(0.0);
             let mut bs = d.get(b"BS").and_then(|b| b.as_dict()).cloned().unwrap_or_default();
-            bs.set(b"W".to_vec(), Object::Real(w.max(0.0)));
+            bs.set(b"W".to_vec(), Object::Real(w));
             d.set(b"BS".to_vec(), Object::Dict(bs));
             d.remove(b"Border");
+            if d.name(b"Subtype") == Some(b"Ink")
+                && let Some(rect) = ink_rect_for_width(d, old_w, w)
+            {
+                d.set(b"Rect".to_vec(), num_array(&rect));
+            }
         }
         if let Some(ends) = endings {
             if ends.len() == 1 {
diff --git a/crates/annot/src/tests.rs b/crates/annot/src/tests.rs
index a3dc14e262..cf800fa98a 100644
--- a/crates/annot/src/tests.rs
+++ b/crates/annot/src/tests.rs
@@ -2194,3 +2194,59 @@ fn degenerate_and_absurd_leader_and_caption_values_do_not_panic() {
     assert!(long.contains(&format!("({}) Tj", "w".repeat(256))), "cut to 256");
     assert!(!long.contains(&"w".repeat(257)));
 }
+
+#[test]
+fn freehand_highlight_is_compatible_ink_with_marker_blending() {
+    let shape = Shape::FreehandHighlight { strokes: vec![vec![[20.0, 100.0], [120.0, 100.0]]] };
+    let mut annotation = new(0, shape.clone());
+    annotation.style = Style::default_for(&shape);
+    let mut doc = fixture();
+    let index = add_annotation(&mut doc, &annotation, &meta("marker")).unwrap();
+    let doc = reopen(&doc);
+    let ink = &list(&doc, 0)[index];
+
+    assert_eq!(ink.name(b"Subtype"), Some(&b"Ink"[..]));
+    assert_eq!(ink.name(b"IT"), Some(&b"FreehandHighlight"[..]));
+    assert_eq!(ink.get(b"CA").and_then(Object::as_f64), Some(0.35));
+    let ap = ink.get(b"AP").unwrap().as_dict().unwrap().reference(b"N").unwrap();
+    let resources = doc.get(ap).as_dict().unwrap().get(b"Resources").cloned().unwrap();
+    let blend = resources.as_dict().unwrap().get(b"ExtGState").unwrap().as_dict().unwrap().get(b"GS0").unwrap().as_dict().unwrap();
+    assert_eq!(blend.name(b"BM"), Some(&b"Multiply"[..]));
+
+    let mut doc = doc;
+    let rect_of = |doc: &Document, idx: usize| -> Vec<f64> {
+        list(doc, 0)[idx].get(b"Rect").unwrap().as_array().unwrap().iter().filter_map(Object::as_f64).collect()
+    };
+    let rect_before = rect_of(&doc, index);
+    set_style(&mut doc, 0, index, StyleChange { color: None, opacity: None, width: Some(34.0), endings: None }, &meta("wider")).unwrap();
+    let rect_after = rect_of(&doc, index);
+    assert!((rect_after[0] - (rect_before[0] - 10.0)).abs() < 1e-4);
+    assert!((rect_after[2] - (rect_before[2] + 10.0)).abs() < 1e-4);
+
+    // Repeated increase/decrease cycles must keep bounds stable and never accumulate padding.
+    set_style(&mut doc, 0, index, StyleChange { color: None, opacity: None, width: Some(14.0), endings: None }, &meta("narrower")).unwrap();
+    let rect_restored = rect_of(&doc, index);
+    for (a, b) in rect_restored.iter().zip(rect_before.iter()) {
+        assert!((a - b).abs() < 1e-4, "expected {rect_before:?}, got {rect_restored:?}");
+    }
+    set_style(&mut doc, 0, index, StyleChange { color: None, opacity: None, width: Some(34.0), endings: None }, &meta("wider-again")).unwrap();
+    let rect_second_wide = rect_of(&doc, index);
+    for (a, b) in rect_second_wide.iter().zip(rect_after.iter()) {
+        assert!((a - b).abs() < 1e-4, "expected {rect_after:?}, got {rect_second_wide:?}");
+    }
+
+    // Imported ink whose width is specified only by `/Border [0 0 20]` must use 20 pt as its
+    // previous width (shrinking by 5 pt on a decrease to 10 pt rather than expanding as if 1 pt).
+    let (_, r) = lookup::annot_ref(&mut doc, 0, index).unwrap();
+    doc.update_dict(r, |d| {
+        d.remove(b"BS");
+        d.set(b"Border".to_vec(), Object::Array(vec![Object::Real(0.0), Object::Real(0.0), Object::Real(20.0)]));
+        d.set(b"Rect".to_vec(), create::num_array(&[5.0, 85.0, 135.0, 115.0]));
+    })
+    .unwrap();
+    set_style(&mut doc, 0, index, StyleChange { color: None, opacity: None, width: Some(10.0), endings: None }, &meta("border-shrink")).unwrap();
+    let rect_from_border = rect_of(&doc, index);
+    for (a, b) in rect_from_border.iter().zip([10.0, 90.0, 130.0, 110.0]) {
+        assert!((a - b).abs() < 1e-4, "expected [10, 90, 130, 110], got {rect_from_border:?}");
+    }
+}
diff --git a/crates/annot/src/types.rs b/crates/annot/src/types.rs
index bd3409b5ae..522995b9f9 100644
--- a/crates/annot/src/types.rs
+++ b/crates/annot/src/types.rs
@@ -355,6 +355,10 @@ pub enum Shape {
         start: LineEnding,
         end: LineEnding,
     },
+    /// Translucent freehand highlighting, stored as ink with a distinct intent.
+    FreehandHighlight {
+        strokes: Vec<Vec<[f64; 2]>>,
+    },
     /// Freehand strokes (Draw tool).
     Ink {
         strokes: Vec<Vec<[f64; 2]>>,
@@ -474,6 +478,7 @@ pub fn rect_quad(r: [f64; 4]) -> [f64; 8] {
 }
 
 impl Shape {
+    /// Return the PDF `/Subtype` name for this annotation shape.
     pub fn subtype(&self) -> &'static str {
         match self {
             Shape::Note { .. } => "Text",
@@ -481,7 +486,7 @@ impl Shape {
             Shape::Rectangle { .. } => "Square",
             Shape::Oval { .. } => "Circle",
             Shape::Line { .. } => "Line",
-            Shape::Ink { .. } | Shape::Signature { .. } => "Ink",
+            Shape::Ink { .. } | Shape::FreehandHighlight { .. } | Shape::Signature { .. } => "Ink",
             Shape::TextBox { .. } | Shape::Typewriter { .. } | Shape::Callout { .. } => "FreeText",
             Shape::Mark { .. } | Shape::Stamp { .. } | Shape::CustomStamp { .. } | Shape::TypedSignature { .. } => "Stamp",
             Shape::Redact { .. } => "Redact",
@@ -610,6 +615,7 @@ impl Style {
             }
             Shape::Callout { .. } => ([0.0, 0.0, 0.0], 1.0),
             Shape::Caret { .. } | Shape::Attachment { .. } => ([0.0, 0.47, 0.84], 1.0),
+            Shape::FreehandHighlight { .. } => return Self { color: [1.0, 0.94, 0.0], opacity: 0.35, width: 14.0, fill: None },
             Shape::Ink { .. } => ([0.0, 0.4, 0.87], 2.0),
             Shape::TextBox { .. } | Shape::Typewriter { .. } => ([0.0, 0.0, 0.0], 0.0),
             Shape::Mark { .. } => ([0.0, 0.0, 0.0], 1.5),
diff --git a/crates/automation/README.md b/crates/automation/README.md
index 176946c175..92fd2775c9 100644
--- a/crates/automation/README.md
+++ b/crates/automation/README.md
@@ -21,6 +21,9 @@ them with the image's current orientation. Full turns retain its appearance, rec
 and flips. Angles that are not multiples of 90 are refused without changing the document or
 its undo/redo history.
 
+`page_add_text`, `content_update` and `text_edit` take per-line `aligns`. An `"inherit"` entry
+follows the box-level `align`; legacy `null` entries remain accepted with the same meaning.
+
 `Content` is `Json(Value)` or `Png { data, width, height }`. Errors are `UnknownTool`, `InvalidArgs` (the call didn't match the schema) or `Failed` (a readable message for the agent).
 
 ## Conventions
@@ -199,6 +202,19 @@ undoable and survive saving/reopening. `image_hit` shares the UI's curve and hol
 The bounds, limits and font requirements are in [existing-text editing](../../docs/editing-existing-text.md)
 and [image editing](../../docs/editing-images.md).
 
+### Superscript and subscript normalization
+
+`text_script` changes characters to their Unicode superscript or subscript forms; it does not
+change the font size or baseline. For characters that have such forms, uniformly plain text
+toggles to the requested script, and uniformly scripted text toggles back to plain text.
+Characters without a matching form stay unchanged and do not determine the selection's state.
+
+A selection mixing plain and target-script characters normalizes to the requested script.
+For example, subscript changes `H₂2` to `H₂₂`, then to `H22` on the next call; superscript
+changes `Q²2` to `Q²²`, then to `Q22`. A second toggle does not reconstruct the original
+mixture. Each call is one undoable text edit: `edit_undo` restores the exact prior text,
+including its original mixture. Save/reopen preserves the resulting normalized characters.
+
 ## Opening local GoToR links
 
 `link_open {doc, page, index, password?}` follows a local PDF link using `link_list`
diff --git a/crates/automation/src/a11y/documents.rs b/crates/automation/src/a11y/documents.rs
index e52768d535..295502215a 100644
--- a/crates/automation/src/a11y/documents.rs
+++ b/crates/automation/src/a11y/documents.rs
@@ -15,7 +15,7 @@ impl Automation {
         if !export.truncated_pages.is_empty() {
             use pdfcraft_engine::compare::{MAX_FORM_DEPTH, MAX_FORM_VISITS};
             out["warnings"] = json!([format!(
-                "forms nested more than {MAX_FORM_DEPTH} deep, or past the first {MAX_FORM_VISITS} forms of a page (forms the page draws itself count too), were left out on the pages in truncated_pages: their text and images are missing from the export, although the viewer may still show them"
+                "pictures past what one export may hold or decode, or forms nested more than {MAX_FORM_DEPTH} deep, or past the first {MAX_FORM_VISITS} forms of a page (forms the page draws itself count too), were left out on the pages in truncated_pages: their text and images are missing from the export, although the viewer may still show them"
             )]);
         }
         Ok(out)
diff --git a/crates/automation/src/comments.rs b/crates/automation/src/comments.rs
index f87fd0b58e..5dbd5b8542 100644
--- a/crates/automation/src/comments.rs
+++ b/crates/automation/src/comments.rs
@@ -183,6 +183,7 @@ impl Automation {
                 "page": c.page + 1,
                 "index": c.index + 1,
                 "type": c.subtype,
+                "intent": c.intent,
                 "author": c.author,
                 "contents": c.contents,
                 "modified": c.modified,
@@ -328,7 +329,7 @@ impl Automation {
                     let [start, end] = ending_pair(kind, endings.as_deref())?;
                     Shape::Line { from: to_user(&info, f[0], f[1]), to: to_user(&info, t[0], t[1]), start, end }
                 }
-                "ink" => {
+                "ink" | "freehand_highlight" => {
                     let wrong = || ToolError::InvalidArgs("strokes must be an array of arrays of [x, y] points".into());
                     let strokes = a.get("strokes").ok_or_else(|| ToolError::InvalidArgs("ink needs `strokes`".into()))?;
                     let strokes = strokes
@@ -346,7 +347,7 @@ impl Automation {
                                 .collect::<Result<Vec<_>>>()
                         })
                         .collect::<Result<Vec<_>>>()?;
-                    Shape::Ink { strokes }
+                    if kind == "freehand_highlight" { Shape::FreehandHighlight { strokes } } else { Shape::Ink { strokes } }
                 }
                 "polygon" | "cloud" | "polyline" => {
                     let wrong = || ToolError::InvalidArgs(format!("{kind} needs `points`: an array of [x, y] points"));
diff --git a/crates/automation/src/content.rs b/crates/automation/src/content.rs
index 7518072d1c..6b25c31f61 100644
--- a/crates/automation/src/content.rs
+++ b/crates/automation/src/content.rs
@@ -83,10 +83,10 @@ pub(crate) fn parse_align(al: &str) -> Result<TextAlign> {
 /// Most entries `aligns` takes: one per paragraph, and no text has this many.
 const MAX_ALIGNS: usize = 4096;
 
-/// `aligns`: each paragraph's (line's) own alignment, or null where it follows `align`.
+/// `aligns`: each paragraph's (line's) own alignment, or inherit/null where it follows `align`.
 pub(crate) fn opt_aligns(a: &Args) -> Result<Option<Vec<Option<TextAlign>>>> {
     let Some(v) = a.get("aligns") else { return Ok(None) };
-    let items = v.as_array().ok_or_else(|| bad("aligns must be an array of left, center, right, justify or null"))?;
+    let items = v.as_array().ok_or_else(|| bad("aligns must be an array of left, center, right, justify, inherit or null"))?;
     if items.len() > MAX_ALIGNS {
         return Err(bad(format!("aligns takes at most {MAX_ALIGNS} entries")));
     }
@@ -94,8 +94,9 @@ pub(crate) fn opt_aligns(a: &Args) -> Result<Option<Vec<Option<TextAlign>>>> {
         .iter()
         .map(|v| match v {
             Value::Null => Ok(None),
+            Value::String(s) if s == "inherit" => Ok(None),
             Value::String(s) => parse_align(s).map(Some),
-            _ => Err(bad("each entry of aligns is left, center, right, justify or null")),
+            _ => Err(bad("each entry of aligns is left, center, right, justify, inherit or null")),
         })
         .collect::<Result<Vec<_>>>()
         .map(Some)
diff --git a/crates/automation/src/dispatch.rs b/crates/automation/src/dispatch.rs
index 36e0d00454..49d4e6fd4d 100644
--- a/crates/automation/src/dispatch.rs
+++ b/crates/automation/src/dispatch.rs
@@ -12,6 +12,35 @@ pub enum Content {
     Png { data: Vec<u8>, width: u32, height: u32 },
 }
 
+/// `image_edit` `transform`: a matrix `[a b c d e f]` acting on top-left-origin points (a point
+/// moves to `(a·x + c·y + e, b·x + d·y + f)`) → the same motion in PDF user space, which is
+/// what `ImageEdit::Transform` applies after the image's placement. Both spaces are related by
+/// an affine map, so three corners of the crop box pin the result down.
+fn view_transform_to_user(info: &pdfcraft_render::PageInfo, m: [f64; 6]) -> Result<[f64; 6]> {
+    let [a, b, c, d, e, f] = m;
+    let det = a * d - b * c;
+    if !m.iter().all(|v| v.is_finite()) || !det.is_finite() || det.abs() < 1e-9 {
+        return Err(ToolError::InvalidArgs("transform needs a finite matrix that keeps an area (a·d − b·c must not be 0)".into()));
+    }
+    let moved = |x: f32, y: f32| {
+        let [vx, vy] = info.user_to_view(x, y).map(f64::from);
+        info.view_to_user((a * vx + c * vy + e) as f32, (b * vx + d * vy + f) as f32).map(f64::from)
+    };
+    let [x0, y0, x1, y1] = info.crop;
+    let (w, h) = (f64::from(x1 - x0), f64::from(y1 - y0));
+    if w.abs() < 1e-3 || h.abs() < 1e-3 {
+        return Err(ToolError::InvalidArgs("the page has no area to transform in".into()));
+    }
+    let (o, px, py) = (moved(x0, y0), moved(x1, y0), moved(x0, y1));
+    let (ua, ub, uc, ud) = ((px[0] - o[0]) / w, (px[1] - o[1]) / w, (py[0] - o[0]) / h, (py[1] - o[1]) / h);
+    let (x0, y0) = (f64::from(x0), f64::from(y0));
+    let user = [ua, ub, uc, ud, o[0] - ua * x0 - uc * y0, o[1] - ub * x0 - ud * y0];
+    if !user.iter().all(|v| v.is_finite()) {
+        return Err(ToolError::InvalidArgs("the transform moves the image too far".into()));
+    }
+    Ok(user)
+}
+
 impl Automation {
     /// Run the tool `name` with JSON `args` (an object; `null` means no arguments).
     pub fn call(&mut self, name: &str, args: &Value) -> Result<Vec<Content>> {
@@ -294,13 +323,13 @@ impl Automation {
                 let id = self.doc(&a)?.id;
                 let before = self.doc(&a)?.bytes.len();
                 let path = self.resolve(a.str("path")?, true)?;
-                let (bytes, merged) = self.session.reduced_bytes(id).map_err(failed)?;
+                let (bytes, merged, images_refused) = self.session.reduced_bytes(id).map_err(failed)?;
                 // As in the app, a copy that isn't smaller is not written (#490).
                 let written = bytes.len() < before;
                 if written {
                     write_atomic(&path, &bytes)?;
                 }
-                json!({ "path": path.to_string_lossy(), "written": written, "bytes_before": before, "bytes_after": bytes.len(), "merged_objects": merged })
+                json!({ "path": path.to_string_lossy(), "written": written, "bytes_before": before, "bytes_after": bytes.len(), "merged_objects": merged, "images_refused": images_refused })
             }
             "doc_optimize" => self.doc_optimize(&a)?,
             "doc_initial_view" => self.doc_initial_view(&a)?,
@@ -357,7 +386,7 @@ impl Automation {
                             let (u, v) = (info.user_to_view(rect[0] as f32, rect[1] as f32), info.user_to_view(rect[2] as f32, rect[3] as f32));
                             [r(u[0].min(v[0])), r(u[1].min(v[1])), r(u[0].max(v[0])), r(u[1].max(v[1]))]
                         });
-                        json!({ "visible_rect": visible, "image": i + 1, "rect": [r(u[0].min(v[0])), r(u[1].min(v[1])), r(u[0].max(v[0])), r(u[1].max(v[1]))], "pixels": [im.width, im.height], "name": im.name, "kind": if im.is_form { "form" } else { "image" } })
+                        json!({ "visible_rect": visible, "has_editor_crop": im.has_editor_crop(), "image": i + 1, "rect": [r(u[0].min(v[0])), r(u[1].min(v[1])), r(u[0].max(v[0])), r(u[1].max(v[1]))], "pixels": [im.width, im.height], "name": im.name, "kind": if im.is_form { "form" } else { "image" } })
                     })
                     .collect();
                 json!({ "page": page + 1, "count": list.len(), "images": list })
@@ -395,6 +424,16 @@ impl Automation {
                             let (u0, u1) = (info.view_to_user(r[0] as f32, r[1] as f32), info.view_to_user(r[2] as f32, r[3] as f32));
                             ImageEdit::Move([u0[0].min(u1[0]) as f64, u0[1].min(u1[1]) as f64, u0[0].max(u1[0]) as f64, u0[1].max(u1[1]) as f64])
                         }
+                        "transform" => {
+                            let m: Vec<f64> = a
+                                .get("matrix")
+                                .and_then(Value::as_array)
+                                .and_then(|x| x.iter().map(Value::as_f64).collect())
+                                .ok_or_else(|| ToolError::InvalidArgs("transform needs matrix: 6 numbers [a, b, c, d, e, f]".into()))?;
+                            let m = <[f64; 6]>::try_from(m)
+                                .map_err(|_| ToolError::InvalidArgs("transform needs matrix: 6 numbers [a, b, c, d, e, f]".into()))?;
+                            ImageEdit::Transform(view_transform_to_user(&self.doc(&a)?.info.pages[page], m)?)
+                        }
                         "rotate_by" => ImageEdit::RotateBy(
                             a.get("degrees")
                                 .and_then(Value::as_f64)
@@ -410,9 +449,18 @@ impl Automation {
                             let (u0, u1) = (info.view_to_user(r[0] as f32, r[1] as f32), info.view_to_user(r[2] as f32, r[3] as f32));
                             ImageEdit::Crop([u0[0].min(u1[0]) as f64, u0[1].min(u1[1]) as f64, u0[0].max(u1[0]) as f64, u0[1].max(u1[1]) as f64])
                         }
-                        "flip_horizontal" => ImageEdit::Flip { horizontal: true },
-                        "flip_vertical" => ImageEdit::Flip { horizontal: false },
+                        action @ ("flip_horizontal" | "flip_vertical") => {
+                            let horizontal = action == "flip_horizontal";
+                            let info = self.doc(&a)?.info.pages.get(page).ok_or_else(|| ToolError::InvalidArgs("the page does not exist".into()))?;
+                            // The tool names displayed axes; the engine names PDF user-space axes.
+                            ImageEdit::Flip { horizontal: horizontal ^ (info.rotation % 180 == 90) }
+                        }
                         "delete" => ImageEdit::Delete,
+                        "bring_to_front" => ImageEdit::Arrange(pdfcraft_engine::ArrangeOrder::BringToFront),
+                        "send_to_back" => ImageEdit::Arrange(pdfcraft_engine::ArrangeOrder::SendToBack),
+                        "bring_forward" => ImageEdit::Arrange(pdfcraft_engine::ArrangeOrder::BringForward),
+                        "send_backward" => ImageEdit::Arrange(pdfcraft_engine::ArrangeOrder::SendBackward),
+                        "remove_crop" => ImageEdit::RemoveCrop,
                         "replace" => {
                             let path = self.resolve(a.str("path")?, false)?;
                             let bytes = read_input(&path)?;
@@ -624,6 +672,7 @@ impl Automation {
                 }
                 out
             }
+            "text_script" => self.text_script(&a)?,
             "doc_audit_space" => {
                 let rows: Vec<Value> = self
                     .doc(&a)?
@@ -815,4 +864,52 @@ impl Automation {
         };
         Ok(vec![Content::Json(out)])
     }
+
+    /// `text_script`: Format text ▸ Superscript or Subscript on a paragraph, or on a byte range
+    /// of its editor text, written as `text_edit` writes the paragraph.
+    fn text_script(&mut self, a: &Args) -> Result<Value> {
+        use pdfcraft_engine::text_script::{Script, toggle};
+        let name = a.str("script")?;
+        let script = match name {
+            "superscript" => Script::Super,
+            "subscript" => Script::Sub,
+            other => return Err(ToolError::InvalidArgs(format!("unknown script {other:?} (superscript, subscript)"))),
+        };
+        let page = self.page(a)?;
+        let k = a.int("paragraph")?;
+        let text = {
+            let doc = self.doc(a)?;
+            let blocks = doc.text_blocks(page);
+            let index = self.paragraph_index(doc.id, page, k, &blocks)?;
+            blocks.get(index).map(|b| b.editor_text.clone()).ok_or_else(|| ToolError::InvalidArgs(format!("paragraph {k} is out of range")))?
+        };
+        let range = match a.opt_ints("range")? {
+            None => None,
+            Some(r) => {
+                let bounds = match r.as_slice() {
+                    [start, end] => usize::try_from(*start).ok().zip(usize::try_from(*end).ok()),
+                    _ => None,
+                };
+                let range = bounds
+                    .map(|(start, end)| start..end)
+                    .filter(|r| r.start < r.end && r.end <= text.len() && text.is_char_boundary(r.start) && text.is_char_boundary(r.end));
+                let Some(range) = range else {
+                    return Err(ToolError::InvalidArgs(format!(
+                        "range must be [start, end]: UTF-8 byte offsets of the paragraph's editor_text (from text_paragraphs) with start < end <= {}, on character boundaries",
+                        text.len()
+                    )));
+                };
+                Some(range)
+            }
+        };
+        let (toggled, _) = toggle(&text, range.as_ref(), script)
+            .ok_or_else(|| ToolError::InvalidArgs(format!("nothing to change: no character of the text has a {name} form")))?;
+        let args = json!({ "doc": a.get("doc"), "page": a.get("page"), "paragraph": k, "text": toggled });
+        let mut out = match self.call("text_edit", &args)?.into_iter().next() {
+            Some(Content::Json(out)) => out,
+            _ => json!({}),
+        };
+        out["script"] = json!(name);
+        Ok(out)
+    }
 }
diff --git a/crates/automation/src/documents.rs b/crates/automation/src/documents.rs
index 859c92da48..979b041a73 100644
--- a/crates/automation/src/documents.rs
+++ b/crates/automation/src/documents.rs
@@ -410,6 +410,7 @@ impl Automation {
             "images": o.images,
             "images_resampled": o.images_resampled,
             "images_recompressed": o.images_recompressed,
+            "images_refused": o.images_refused,
             "image_bytes_before": o.image_bytes_before,
             "image_bytes_after": o.image_bytes_after,
             "thumbnails": o.thumbnails,
diff --git a/crates/automation/src/redact.rs b/crates/automation/src/redact.rs
index e662bcac19..a146f3f8ff 100644
--- a/crates/automation/src/redact.rs
+++ b/crates/automation/src/redact.rs
@@ -201,8 +201,8 @@ impl Automation {
     }
 
     pub(crate) fn doc_remove_hidden(&mut self, a: &Args) -> Result<Value> {
-        let edit = match a.get("categories") {
-            None => Edit::Sanitize,
+        let which = match a.get("categories") {
+            None => None,
             Some(_) => {
                 let which = a
                     .strs("categories")?
@@ -212,10 +212,24 @@ impl Automation {
                 if which.is_empty() {
                     return Err(ToolError::InvalidArgs("categories is empty".into()));
                 }
+                Some(which)
+            }
+        };
+        // One scan, for this check and for what was removed. The removal refuses when it counts
+        // every listed category as 0 (an AcroForm with no fields counts 1), with an error about
+        // redaction marks; this reads the same scan, so it refuses exactly then. A document that
+        // can't be edited has no scan: `apply` says why.
+        let info = self.doc(a)?.hidden_info();
+        let edit = match which {
+            None => Edit::Sanitize,
+            Some(which) => {
+                if !info.is_empty() && which.iter().all(|h| info.iter().find(|c| c.0 == *h).is_none_or(|c| c.1 == 0)) {
+                    return Err(failed("nothing to remove: the listed categories hold nothing (see doc_hidden_info)"));
+                }
                 Edit::RemoveHidden { which }
             }
         };
-        let before: usize = self.doc(a)?.hidden_info().iter().map(|c| c.1).sum();
+        let before: usize = info.iter().map(|c| c.1).sum();
         let mut out = self.apply(a, edit)?;
         let after: usize = self.doc(a)?.hidden_info().iter().map(|c| c.1).sum();
         out["removed"] = json!(before.saturating_sub(after));
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index c6c200cece..ba5892a451 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -175,7 +175,7 @@ pub fn tools() -> Vec<ToolDef> {
             }), &["doc", "page"])),
         t("object_list", "List editable objects", "List existing paragraphs, Image/Form artwork and added content once, with source kind/index references, displayed rectangles and document generation. Indexes change when content changes; use generation in object_move to reject stale references.")
             .ro().with(schema(json!({"doc":doc(),"page":{"type":"integer","minimum":1}}), &["doc","page"])),
-        t("object_move", "Move objects together", "Atomically translate 1–1000 mixed references from object_list by [dx, dy] in displayed points (right/down). Preserves glyph codes, fonts, image data and relative spacing; success is one undo step. Clipping and vertical text are refused. A bad/stale reference refuses the entire move.")
+        t("object_move", "Move objects together", "Atomically translate 1–1000 mixed references from object_list by [dx, dy] in displayed points (right/down). Preserves glyph codes, fonts, image data and relative spacing; success is one undo step. Text used as a clipping path and vertical text are refused. A bad/stale reference refuses the entire move.")
             .with(schema(json!({"doc":doc(),"page":{"type":"integer","minimum":1},
                 "objects":{"type":"array","minItems":1,"maxItems":1000,"uniqueItems":true,"items":{
                     "type":"object","properties":{"kind":{"type":"string","enum":["added","text","image"]},"index":{"type":"integer","minimum":1}},"required":["kind","index"],"additionalProperties":false}},
@@ -562,7 +562,7 @@ pub fn tools() -> Vec<ToolDef> {
         t(
             "doc_remove_hidden",
             "Remove hidden information / Sanitize",
-            "Remove the listed categories (see doc_hidden_info), or every category when none are listed (Sanitize Document). Form fields are flattened so their values stay visible. The next save rewrites the whole file. Undoable until saved.",
+            "Remove the listed categories (see doc_hidden_info), or every category when none are listed (Sanitize Document). Fails when the listed categories hold nothing. Form fields are flattened so their values stay visible. The next save rewrites the whole file. Undoable until saved.",
         )
         .destructive()
         .with(schema(
@@ -637,7 +637,7 @@ pub fn tools() -> Vec<ToolDef> {
                 "font": { "type": "string", "enum": ["helvetica", "times", "courier"] }, "size": { "type": "number", "minimum": 1, "maximum": 500 },
                 "bold": { "type": "boolean" }, "italic": { "type": "boolean" }, "color": { "type": "string" },
                 "align": { "type": "string", "enum": ["left", "center", "right", "justify"] },
-                "aligns": { "type": "array", "maxItems": 4096, "items": { "enum": ["left", "center", "right", "justify", null] }, "description": "Each paragraph's (line's) own alignment, by index; null follows align." },
+                "aligns": { "type": "array", "maxItems": 4096, "items": { "type": "string", "enum": ["left", "center", "right", "justify", "inherit"] }, "description": "Each paragraph's (line's) own alignment, by index; inherit (or legacy null) follows align." },
                 "char_spacing": { "type": "number", "minimum": -500, "maximum": 500, "description": "Points after each character." },
             }),
             &["doc", "page", "text"],
@@ -660,7 +660,7 @@ pub fn tools() -> Vec<ToolDef> {
                     "font": { "type": "string", "enum": ["helvetica", "times", "courier"] }, "size": { "type": "number", "minimum": 1, "maximum": 500 },
                     "bold": { "type": "boolean" }, "italic": { "type": "boolean" }, "color": { "type": "string" },
                     "align": { "type": "string", "enum": ["left", "center", "right", "justify"] },
-                    "aligns": { "type": "array", "maxItems": 4096, "items": { "enum": ["left", "center", "right", "justify", null] }, "description": "Each paragraph's (line's) own alignment, by index; null follows align." },
+                    "aligns": { "type": "array", "maxItems": 4096, "items": { "type": "string", "enum": ["left", "center", "right", "justify", "inherit"] }, "description": "Each paragraph's (line's) own alignment, by index; inherit (or legacy null) follows align." },
                     "char_spacing": { "type": "number", "minimum": -500, "maximum": 500, "description": "Points after each character." },
                     "rotate": { "type": "integer" }, "flip_h": { "type": "boolean" }, "flip_v": { "type": "boolean" },
                     "crop": { "type": "array", "items": { "type": "number", "minimum": 0, "maximum": 0.95 }, "minItems": 4, "maxItems": 4, "description": "Fractions trimmed: left, bottom, right, top. Left and right together, and bottom and top together, trim at most 0.95." },
@@ -754,7 +754,7 @@ pub fn tools() -> Vec<ToolDef> {
             json!({
                 "doc": doc(),
                 "page": { "type": "integer", "minimum": 1 },
-                "type": { "type": "string", "enum": ["note", "highlight", "underline", "strikeout", "squiggly", "replace", "rectangle", "oval", "line", "arrow", "ink", "textbox", "stamp", "polygon", "cloud", "polyline", "callout", "caret", "attachment"] },
+                "type": { "type": "string", "enum": ["note", "highlight", "underline", "strikeout", "squiggly", "replace", "rectangle", "oval", "line", "arrow", "ink", "freehand_highlight", "textbox", "stamp", "polygon", "cloud", "polyline", "callout", "caret", "attachment"] },
                 "path": { "type": "string", "description": "attachment: the file to attach." },
                 "points": { "type": "array", "items": point(), "minItems": 2 },
                 "knee": point(),
@@ -1194,7 +1194,7 @@ pub fn tools() -> Vec<ToolDef> {
                 json!({ "doc": doc(), "field": { "type": "string" }, "event": { "type": "string", "enum": ["keystroke", "format", "validate", "calculate", "mouse_up"] }, "script": { "type": "string" } }),
                 &["doc", "field", "event"],
             )),
-        t("doc_export_office", "Export to Word, PowerPoint, HTML, RTF or Markdown", "Export a PDF ▸ Word (.docx), PowerPoint (.pptx, one slide per page), HTML (.html, one file with images inline), RTF (.rtf) or Markdown (.md or .markdown: pipe tables, images left out), chosen by path's extension: text, headings, bold and italic. Word uses borderless inferred tables and positioned editable shapes on pages with artwork, rotated or large text; each source page retains its size. Font matching and vector graphics remain limited. Export reads forms 50 deep and up to 50 000 a page, counting forms the page draws itself. Pages that go past either limit are listed in truncated_pages, with a warning; the text and images of the forms left out are missing.")
+        t("doc_export_office", "Export to Word, PowerPoint, HTML, RTF or Markdown", "Export a PDF ▸ Word (.docx), PowerPoint (.pptx, one slide per page), HTML (.html, one file with images inline), RTF (.rtf) or Markdown (.md or .markdown: pipe tables, images left out), chosen by path's extension: text, headings, bold and italic. Word uses borderless inferred tables and positioned editable shapes on pages with artwork, rotated or large text; each source page retains its size. Font matching and vector graphics remain limited. Export reads forms 50 deep and up to 50 000 a page, counting forms the page draws itself. Pages that go past either limit, or that have pictures past what one export may hold or decode, are listed in truncated_pages, with a warning; what was left out is missing.")
             .cmd("export.docx")
             .with(schema(json!({ "doc": doc(), "path": { "type": "string" } }), &["doc", "path"])),
         t("pdfa_verify", "Verify PDF/A", "Standards ▸ Verify PDF/A compliance: the PDF/A-2b or 3b rules the document breaks (ISO 19005 clause, message, page, whether Save as PDF/A can fix it), plus what it declares.")
@@ -1281,7 +1281,7 @@ pub fn tools() -> Vec<ToolDef> {
             .ro()
             .cmd("ocr.recognize")
             .with(schema(json!({}), &[])),
-        t("doc_export_all_images", "Export all images", "Write the images that pages use into a folder (`<name>_Page_<n>_Image_<k>.jpg|png`, n zero-padded to the page count's digits), each once: JPEG images unchanged, others as PNG with their soft mask as alpha. min_size skips images with fewer pixels on their shorter side. Images that can't be decoded yet (JPEG 2000, JBIG2 inside other filters, separations) are listed under skipped. Includes unsaved edits.")
+        t("doc_export_all_images", "Export all images", "Write the images that pages use into a folder (`<name>_Page_<n>_Image_<k>.jpg|png`, n zero-padded to the page count's digits), each once: JPEG images unchanged, others as PNG with their soft mask as alpha. min_size skips images with fewer pixels on their shorter side. Images that can't be decoded yet (JPEG 2000, separations), or past what one export may decode or hold, are listed under skipped, with the reason. Includes unsaved edits.")
             .cmd("export.all_images")
             .with(schema(
                 json!({
@@ -1340,7 +1340,7 @@ pub fn tools() -> Vec<ToolDef> {
             }),
             &["from"],
         )),
-        t("doc_reduce", "Reduce file size", "Write a smaller copy of the document to `path` with Acrobat's Reduce File Size choices: colour and grey images above 225 ppi downsampled to 150 ppi and JPEG-compressed (medium quality), black-and-white images averaged down to 300 ppi above 450 ppi and each stored as CCITT Group 4 (or 1-bit Flate, once resampled or packed from more bits) whenever that is smaller, thumbnails dropped, identical fonts and images merged, unused objects dropped, compressed object streams. If the copy wouldn't be smaller, nothing is written and `written` is false. The open document is unchanged.")
+        t("doc_reduce", "Reduce file size", "Write a smaller copy of the document to `path` with Acrobat's Reduce File Size choices: colour and grey images above 225 ppi downsampled to 150 ppi and JPEG-compressed (medium quality), black-and-white images averaged down to 300 ppi above 450 ppi and each stored as CCITT Group 4 (or 1-bit Flate, once resampled or packed from more bits) whenever that is smaller, thumbnails dropped, identical fonts and images merged, unused objects dropped, compressed object streams. If the copy wouldn't be smaller, nothing is written and `written` is false. Images past what one run may decode stay as they are, counted in images_refused; streams it only stores with Flate past that stay LZW, uncounted. The open document is unchanged.")
             .cmd("optimize.reduce")
             .with(schema(json!({ "doc": doc(), "path": { "type": "string" } }), &["doc", "path"])),
         t("doc_initial_view", "Initial view", "Read or change how the document opens (Document Properties ▸ Initial View) and its reading options: navigation (page, bookmarks, pages, attachments, layers), layout (default, single, continuous, two_up, two_up_continuous, two_up_cover, two_up_continuous_cover), magnification (default, actual, fit_page, fit_width, fit_height, fit_visible, or a percentage), page, window options (fit_window, center_window, full_screen, display_title), interface options (hide_menubar, hide_toolbar, hide_window_ui), language and binding (left, right). Only the given ones change; returns the result. Undoable.").with(schema(
@@ -1378,17 +1378,18 @@ pub fn tools() -> Vec<ToolDef> {
             .ro()
             .cmd("edit.edit_text")
             .with(schema(json!({ "doc": doc(), "page": { "type": "integer", "minimum": 1 } }), &["doc", "page"])),
-        t("image_edit", "Edit an image", "Change one of a page's images (number from page_images): action move (rect: new full placement box in top-left-origin points, based on page_images.rect), crop (rect: the part to keep, top-left-origin points; the pixels stay in place and page_images.visible_rect shows the result; a later move carries the crop along), rotate (quarters clockwise, default 1), rotate_by (degrees: any angle clockwise about the visible centre; the box in page_images then becomes the turned image's bounding box), flip_horizontal, flip_vertical, replace (path: an image file, drawn in the same place) or delete. Undoable. The selected image crop transforms with its pixels, isolating shared path scopes while retaining neighboring painting. Text-outline clips return a clear error. Rotation/flip use the visible centre. Form artwork supports move/resize/rotate/flip/delete as a group; replace and image_save only support raster images.")
+        t("image_edit", "Edit an image", "Change one of a page's images (number from page_images): action move (rect: new full placement box in top-left-origin points, based on page_images.rect), crop (rect: the part to keep, top-left-origin points; the pixels stay in place and page_images.visible_rect shows the result; a later move carries the crop along), remove_crop (remove a crop created by PdfCraft while preserving clipping paths from the original document), rotate (quarters clockwise, default 1), rotate_by (degrees: any angle clockwise about the visible centre; the box in page_images then becomes the turned image's bounding box), transform (matrix: 6 numbers [a, b, c, d, e, f] in top-left-origin points, applied after the current placement so a point (x, y) of the image moves to (a·x + c·y + e, b·x + d·y + f); finite, with a·d − b·c not 0; the box in page_images becomes the transformed image's bounding box), flip_horizontal (reflect left/right on the displayed page), flip_vertical (reflect top/bottom on the displayed page; both flip actions follow the page rotation), replace (path: an image file, drawn in the same place), delete, or arrange: bring_to_front, send_to_back, bring_forward, send_backward (reorder stacking order among content on the page; errors when the image is already at the requested limit; arranging an added image converts it into an ordinary page image). Undoable. The selected image crop transforms with its pixels, isolating shared path scopes while retaining neighboring painting. Text-outline clips return a clear error. Rotation/flip use the visible centre. Form artwork supports move/resize/rotate/flip/delete as a group; replace and image_save only support raster images.")
             .cmd("edit.edit_text")
             .with(schema(
                 json!({
                     "doc": doc(),
                     "page": { "type": "integer", "minimum": 1 },
                     "image": { "type": "integer", "minimum": 1 },
-                    "action": { "type": "string", "enum": ["move", "crop", "rotate", "rotate_by", "flip_horizontal", "flip_vertical", "replace", "delete"] },
+                    "action": { "type": "string", "enum": ["move", "crop", "rotate", "rotate_by", "transform", "flip_horizontal", "flip_vertical", "replace", "delete", "bring_to_front", "send_to_back", "bring_forward", "send_backward", "remove_crop"] },
                     "rect": { "type": "array", "items": { "type": "number" }, "minItems": 4, "maxItems": 4 },
                     "quarters": { "type": "integer" },
                     "degrees": { "type": "number" },
+                    "matrix": { "type": "array", "items": { "type": "number" }, "minItems": 6, "maxItems": 6 },
                     "path": { "type": "string" },
                 }),
                 &["doc", "page", "image", "action"],
@@ -1428,7 +1429,7 @@ pub fn tools() -> Vec<ToolDef> {
                     "size": { "type": "number", "exclusiveMinimum": 0 },
                     "color": { "type": "string", "description": "#rrggbb" },
                     "align": { "type": "string", "enum": ["left", "center", "right", "justify"] },
-                    "aligns": { "type": "array", "maxItems": 4096, "items": { "enum": ["left", "center", "right", "justify", null] }, "description": "Each paragraph's (line's) own alignment, by index; null follows align." },
+                    "aligns": { "type": "array", "maxItems": 4096, "items": { "type": "string", "enum": ["left", "center", "right", "justify", "inherit"] }, "description": "Each paragraph's (line's) own alignment, by index; inherit (or legacy null) follows align." },
                     "underline": { "type": "boolean" },
                     "line_spacing": { "type": "number", "description": "Multiple of the font size (1.2 is ordinary)." },
                     "dx": { "type": "number", "description": "Paragraph only: move right by this many points (negative: left)." },
@@ -1438,11 +1439,19 @@ pub fn tools() -> Vec<ToolDef> {
                     "scale": { "type": "number", "description": "Horizontal scale in percent." } }),
                 &["doc", "page"],
             )),
+        t("text_script", "Superscript or subscript", "Format text ▸ Superscript or Subscript on one paragraph (paragraph, from text_paragraphs), or on range [start, end): UTF-8 byte offsets of its editor_text. The characters take the Unicode superscript or subscript forms (2 → ², 2 → ₂; the font must have those glyphs, and extracted text contains them); text already in that script goes back to plain characters. Characters Unicode has no such form for (q, a space) stay unchanged and do not determine the selection's script state. Mixed plain and target-script characters normalize to that script, then to plain text on the next call (H₂2 → H₂₂ → H22); a second toggle does not reconstruct the original mixture. Use Undo to restore the exact prior text. The paragraph is then rewritten as text_edit rewrites it, with the same result fields. Refused when no character would change. Undoable. Mathematical minus U+2212 has its own script mapping; ASCII hyphen-minus stays unchanged.")
+            .cmd("edit.edit_text")
+            .with(schema(
+                json!({ "doc": doc(), "page": { "type": "integer", "minimum": 1 }, "paragraph": { "type": "integer", "minimum": 1 },
+                    "script": { "type": "string", "enum": ["superscript", "subscript"] },
+                    "range": { "type": "array", "items": { "type": "integer", "minimum": 0 }, "minItems": 2, "maxItems": 2, "description": "UTF-8 byte offsets [start, end) of the paragraph's editor_text; the whole paragraph when omitted." } }),
+                &["doc", "page", "paragraph", "script"],
+            )),
         t("doc_revisions", "List revisions", "List the document's saved revisions (oldest first): each incremental update is one. Returns revision number, where it ends in the file and its size, and which signatures sign exactly that revision.")
             .with(schema(json!({ "doc": doc() }), &["doc"])),
         t("doc_open_revision", "Open a revision", "Open saved revision `revision` (1 = the oldest) of a document as a new, unsaved document, to see the file as it was then.")
             .with(schema(json!({ "doc": doc(), "revision": { "type": "integer", "minimum": 1 } }), &["doc", "revision"])),
-        t("doc_optimize", "Optimize PDF", "Write an optimized copy to `path` (Acrobat's PDF Optimizer). preset: standard (default; Reduce File Size's choices) or mobile (images to 96 ppi above 144, JPEG high quality); the options below change it. compatibility: retain (default; keeps the document's version, or 1.5 when object streams are written), 1.4, 1.5, 1.6, 1.7 or 2.0. merge_fragments (default true) first puts a page picture drawn as many stacked image strips (as some PDF printers write it) back together into one image, so it can be resampled (merged_images, fragments_merged). color / gray: { downsample, ppi, above_ppi, compression: jpeg|zip|retain, quality 1–100 } (defaults: downsample to 150 ppi above 225, JPEG 60). mono: { downsample, ppi, above_ppi, compression: ccitt_g4|jbig2|retain } for black-and-white images and image masks (default: averaged down to 300 ppi above 450 ppi, counted in images_resampled; stored losslessly as CCITT Group 4 or JBIG2 (or 1-bit Flate, once resampled or packed from more bits) when that is smaller, Group 3 fax images, black-and-white RGB and indexed images using only palette entries 0 and 1 among them, counted in images_recompressed; retain resamples only, a CCITT image staying CCITT and any other becoming Flate). Images are measured where pages draw them and replaced only when smaller. discard_*: thumbnails (default true), alternate_images (true), tags, print_settings; flate_unencoded (true); object_streams (default true; always off for 1.4); lzw_to_flate (true) decodes LZW streams and stores them with Flate instead, leaving any it cannot decode unchanged (lzw_streams counts the streams converted); remove_invalid_links and remove_unreferenced_dests (true); images and forms the pages list but never draw are always dropped (unused_xobjects). discard: Remove Hidden Information categories (metadata, attachments, comments, form-fields, hidden-text, hidden-layers, bookmarks, links-actions-scripts, private-data). Signed documents are refused. The open document is unchanged.")
+        t("doc_optimize", "Optimize PDF", "Write an optimized copy to `path` (Acrobat's PDF Optimizer). preset: standard (default; Reduce File Size's choices) or mobile (images to 96 ppi above 144, JPEG high quality); the options below change it. compatibility: retain (default; keeps the document's version, or 1.5 when object streams are written), 1.4, 1.5, 1.6, 1.7 or 2.0. merge_fragments (default true) first puts a page picture drawn as many stacked image strips (as some PDF printers write it) back together into one image, so it can be resampled (merged_images, fragments_merged). color / gray: { downsample, ppi, above_ppi, compression: jpeg|zip|retain, quality 1–100 } (defaults: downsample to 150 ppi above 225, JPEG 60). mono: { downsample, ppi, above_ppi, compression: ccitt_g4|jbig2|retain } for black-and-white images and image masks (default: averaged down to 300 ppi above 450 ppi, counted in images_resampled; stored losslessly as CCITT Group 4 or JBIG2 (or 1-bit Flate, once resampled or packed from more bits) when that is smaller, Group 3 fax images, JBIG2 images, black-and-white RGB and indexed images using only palette entries 0 and 1 among them, counted in images_recompressed; retain resamples only, a CCITT image staying CCITT, a JBIG2 image JBIG2 and any other becoming Flate). Images past what one run may decode stay as they are, counted in images_refused; streams it only stores with Flate past that stay LZW, uncounted. Images are measured where pages draw them and replaced only when smaller. discard_*: thumbnails (default true), alternate_images (true), tags, print_settings; flate_unencoded (true); object_streams (default true; always off for 1.4); lzw_to_flate (true) decodes LZW streams and stores them with Flate instead, leaving any it cannot decode unchanged (lzw_streams counts the streams converted); remove_invalid_links and remove_unreferenced_dests (true); images and forms the pages list but never draw are always dropped (unused_xobjects). discard: Remove Hidden Information categories (metadata, attachments, comments, form-fields, hidden-text, hidden-layers, bookmarks, links-actions-scripts, private-data). Signed documents are refused. The open document is unchanged.")
             .cmd("optimize.advanced")
             .with(schema(
                 json!({
diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index 6a5765b911..c9b50755e8 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -664,6 +664,44 @@ fn tool_table_is_well_formed() {
     }
 }
 
+fn assert_homogeneous_enums(schema: &Value, path: &str) {
+    fn json_kind(value: &Value) -> &'static str {
+        match value {
+            Value::Null => "null",
+            Value::Bool(_) => "boolean",
+            Value::Number(_) => "number",
+            Value::String(_) => "string",
+            Value::Array(_) => "array",
+            Value::Object(_) => "object",
+        }
+    }
+
+    if let Some(values) = schema.get("enum").and_then(Value::as_array) {
+        let first = values.first().map(json_kind);
+        assert!(values.iter().map(json_kind).all(|kind| Some(kind) == first), "mixed enum types at {path}: {values:?}");
+    }
+    match schema {
+        Value::Object(object) => {
+            for (key, child) in object {
+                assert_homogeneous_enums(child, &format!("{path}.{key}"));
+            }
+        }
+        Value::Array(array) => {
+            for (index, child) in array.iter().enumerate() {
+                assert_homogeneous_enums(child, &format!("{path}[{index}]"));
+            }
+        }
+        _ => {}
+    }
+}
+
+#[test]
+fn tool_schema_enums_have_one_json_type() {
+    for tool in tools() {
+        assert_homogeneous_enums(&tool.input_schema, tool.name);
+    }
+}
+
 #[test]
 fn explicit_font_and_disjoint_ranges_save_reopen_through_tools() {
     let dir = workdir("font-ranges");
@@ -2111,6 +2149,27 @@ fn comments_through_tools() {
     save_and_reopen_comments(&dir, &mut a, doc);
 }
 
+#[test]
+fn freehand_highlight_through_tools() {
+    let dir = workdir("freehand-highlight");
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+    ok(
+        &mut a,
+        "comment_add",
+        json!({ "doc": doc, "page": 1, "type": "freehand_highlight", "width": 100,
+        "strokes": [[[20, 100], [120, 100]]] }),
+    );
+    let list = ok(&mut a, "comment_list", json!({ "doc": doc }));
+    assert_eq!(list["count"], 1);
+    assert_eq!(list["comments"][0]["type"], "Ink");
+    assert_eq!(list["comments"][0]["intent"], "FreehandHighlight");
+    assert_eq!(list["comments"][0]["color"], "#FFF000");
+    let undone = ok(&mut a, "edit_undo", json!({ "doc": doc }));
+    assert_eq!(undone["undone"], "Add freehand highlight");
+    assert_eq!(ok(&mut a, "comment_list", json!({ "doc": doc }))["count"], 0);
+}
+
 fn add_comment_examples(a: &mut Automation, doc: u64) -> String {
     // "Page 2" sits at y = 150 (user space) = 150 from the top of the 300 pt page.
     let hl = ok(a, "comment_add", json!({ "doc": doc, "page": 2, "type": "highlight", "find": "page 2", "contents": "check", "author": "Ada" }));
@@ -3286,6 +3345,39 @@ fn editing_existing_text_through_tools() {
     assert_eq!(p["lines"].as_array().map(Vec::len), Some(2), "{p}");
 }
 
+/// Format text ▸ Superscript and Subscript without the GUI: a range, then back again over a space
+/// (which has no superscript form), each one undo step; refusals change nothing.
+#[test]
+fn superscript_and_subscript_through_tools() {
+    let dir = workdir("text-script");
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+    let paragraph =
+        |a: &mut Automation| ok(a, "text_paragraphs", json!({ "doc": doc, "page": 2 }))["paragraphs"][0]["text"].as_str().unwrap().to_string();
+    let script = |script: &str, range: Value| json!({ "doc": doc, "page": 2, "paragraph": 1, "script": script, "range": range });
+    // "Page 2": the 2 is byte 5.
+    let r = ok(&mut a, "text_script", script("superscript", json!([5, 6])));
+    assert_eq!((r["script"].as_str(), r["paragraph"]["text"].as_str()), (Some("superscript"), Some("Page ²")), "{r}");
+    assert_eq!(page_text(&mut a, doc)[1], "Page ²");
+    // " ²": the space has no superscript form, and the range still toggles back.
+    ok(&mut a, "text_script", script("superscript", json!([4, 7])));
+    assert_eq!(paragraph(&mut a), "Page 2");
+    assert_eq!(ok(&mut a, "edit_undo", json!({ "doc": doc }))["undone"], "Edit text");
+    assert_eq!(paragraph(&mut a), "Page ²");
+    // Refused, changing nothing: a range that splits ², one past the end, an empty one, a range
+    // with nothing that has a subscript form, an unknown script.
+    for (name, range) in [
+        ("superscript", json!([5, 6])),
+        ("superscript", json!([0, 99])),
+        ("superscript", json!([3, 3])),
+        ("subscript", json!([4, 5])),
+        ("italic", json!([0, 1])),
+    ] {
+        assert!(matches!(a.call("text_script", &script(name, range.clone())), Err(ToolError::InvalidArgs(_))), "{name} {range}");
+    }
+    assert_eq!(paragraph(&mut a), "Page ²");
+}
+
 #[test]
 fn styled_cyrillic_fallback_is_batched_through_tools_and_reopen() {
     if pdfcraft_fonts::document_japanese_font().is_none() {
@@ -3453,6 +3545,13 @@ fn editing_page_images_through_tools() {
     assert_eq!(cropped["visible_rect"], json!([10.0, 10.0, 25.0, 30.0]));
     ok(&mut a, "image_edit", json!({ "doc": made, "page": 1, "image": 1, "action": "rotate" }));
     ok(&mut a, "image_edit", json!({ "doc": made, "page": 1, "image": 1, "action": "flip_horizontal" }));
+    // A single image is already in front and at the back; no-op arrange is refused without dirtying undo.
+    assert!(a.call("image_edit", &json!({ "doc": made, "page": 1, "image": 1, "action": "bring_to_front" })).is_err());
+    assert!(a.call("image_edit", &json!({ "doc": made, "page": 1, "image": 1, "action": "send_to_back" })).is_err());
+    assert!(a.call("image_edit", &json!({ "doc": made, "page": 1, "image": 1, "action": "bring_forward" })).is_err());
+    assert!(a.call("image_edit", &json!({ "doc": made, "page": 1, "image": 1, "action": "send_backward" })).is_err());
+    let r = ok(&mut a, "image_edit", json!({ "doc": made, "page": 1, "image": 1, "action": "remove_crop" }));
+    assert_eq!(r["undo"], "Remove crop");
     // Any angle: the box grows to the turned picture's bounds, and it undoes like a quarter turn.
     let before = ok(&mut a, "page_images", json!({ "doc": made, "page": 1 }))["images"][0]["rect"].clone();
     let r = ok(&mut a, "image_edit", json!({ "doc": made, "page": 1, "image": 1, "action": "rotate_by", "degrees": 30.5 }));
@@ -3472,6 +3571,80 @@ fn editing_page_images_through_tools() {
     assert!(matches!(a.call("image_edit", &json!({ "doc": made, "page": 1, "image": 1, "action": "delete" })), Err(ToolError::InvalidArgs(_))));
 }
 
+#[test]
+fn arranging_page_images_through_tools() {
+    let dir = workdir("arrange-page-images");
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+    ok(&mut a, "doc_export_images", json!({ "doc": doc, "folder": "src", "dpi": 18, "pages": [1, 2] }));
+    let made = ok(&mut a, "doc_create", json!({ "from": "images", "paths": ["src/a_page_1.png"] }))["doc"].as_u64().unwrap();
+    ok(&mut a, "page_add_image", json!({ "doc": made, "page": 1, "path": "src/a_page_2.png", "rect": [50, 50, 100, 100] }));
+    assert_eq!(ok(&mut a, "page_images", json!({ "doc": made, "page": 1 }))["count"], 2);
+    let r = ok(&mut a, "image_edit", json!({ "doc": made, "page": 1, "image": 1, "action": "bring_to_front" }));
+    assert_eq!(r["undo"], "Bring to front");
+    let r = ok(&mut a, "image_edit", json!({ "doc": made, "page": 1, "image": 2, "action": "send_to_back" }));
+    assert_eq!(r["undo"], "Send to back");
+    ok(&mut a, "doc_save", json!({ "doc": made, "path": "arranged.pdf" }));
+    let reopened = ok(&mut a, "doc_open", json!({ "path": "arranged.pdf" }))["doc"].as_u64().unwrap();
+    let after_reopen = ok(&mut a, "page_images", json!({ "doc": reopened, "page": 1 }));
+    assert_eq!(after_reopen["count"], 2);
+    assert_eq!(after_reopen["images"][0]["rect"], json!([0.0, 0.0, 50.0, 75.0]));
+    assert_eq!(after_reopen["images"][1]["rect"], json!([50.0, 50.0, 100.0, 100.0]));
+}
+
+/// The transform a rotated-image resize sends (`ImageEdit::Transform`) is reachable headlessly,
+/// in the same top-left-origin points as the other image tools, also on a turned page.
+#[test]
+fn transforming_page_images_through_tools() {
+    let dir = workdir("transform-page-images");
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+    ok(&mut a, "doc_export_images", json!({ "doc": doc, "folder": "src", "dpi": 18, "pages": [1] }));
+    let made = ok(&mut a, "doc_create", json!({ "from": "images", "paths": ["src/a_page_1.png"] }))["doc"].as_u64().unwrap();
+    let rect = |a: &mut Automation| ok(a, "page_images", json!({ "doc": made, "page": 1 }))["images"][0]["rect"].clone();
+    let transform =
+        |a: &mut Automation, m: Value| ok(a, "image_edit", json!({ "doc": made, "page": 1, "image": 1, "action": "transform", "matrix": m }));
+    ok(&mut a, "image_edit", json!({ "doc": made, "page": 1, "image": 1, "action": "move", "rect": [5, 5, 25, 35] }));
+
+    // Right 10, down 20.
+    assert_eq!(transform(&mut a, json!([1, 0, 0, 1, 10, 20]))["undo"], "Transform image");
+    assert_eq!(rect(&mut a), json!([15.0, 25.0, 35.0, 55.0]));
+    // Twice the size about the top-left corner of the page.
+    transform(&mut a, json!([2, 0, 0, 2, 0, 0]));
+    assert_eq!(rect(&mut a), json!([30.0, 50.0, 70.0, 110.0]));
+    // A quarter turn, (x, y) → (200 − y, x): the box turns with it, and it undoes in one step.
+    transform(&mut a, json!([0, 1, -1, 0, 200, 0]));
+    assert_eq!(rect(&mut a), json!([90.0, 30.0, 150.0, 70.0]));
+    ok(&mut a, "edit_undo", json!({ "doc": made }));
+    assert_eq!(rect(&mut a), json!([30.0, 50.0, 70.0, 110.0]));
+
+    // On a turned page "right" is still right on screen.
+    ok(&mut a, "page_rotate", json!({ "doc": made, "pages": [1], "degrees": 90 }));
+    let numbers = |v: Value| [0, 1, 2, 3].map(|i| v[i].as_f64().unwrap());
+    let [x0, y0, x1, y1] = numbers(rect(&mut a));
+    transform(&mut a, json!([1, 0, 0, 1, 10, 0]));
+    let after = numbers(rect(&mut a));
+    for (got, want) in after.into_iter().zip([x0 + 10.0, y0, x1 + 10.0, y1]) {
+        assert!((got - want).abs() < 0.015, "{after:?} is not ({x0}, {y0}, {x1}, {y1}) moved right by 10");
+    }
+
+    // Flat, non-finite, short and missing matrices are refused before anything changes.
+    let before = rect(&mut a);
+    for bad in [
+        json!([1, 2, 2, 4, 0, 0]),
+        json!([0, 0, 0, 0, 0, 0]),
+        json!([1e300, 0, 0, 1e300, 0, 0]),
+        json!([1, 0, 0, 1]),
+        json!([1, 0, "invalid", 0, 1, 10, 0]),
+        json!([1, 0, null, 0, 1, 10, 0]),
+    ] {
+        let r = a.call("image_edit", &json!({ "doc": made, "page": 1, "image": 1, "action": "transform", "matrix": bad }));
+        assert!(matches!(r, Err(ToolError::InvalidArgs(_))), "{bad}: {r:?}");
+    }
+    assert!(matches!(a.call("image_edit", &json!({ "doc": made, "page": 1, "image": 1, "action": "transform" })), Err(ToolError::InvalidArgs(_))));
+    assert_eq!(rect(&mut a), before);
+}
+
 #[test]
 fn enhance_camera_image_through_tools() {
     let dir = workdir("enhance-camera");
@@ -4497,12 +4670,23 @@ fn removing_hidden_information_through_tools() {
     assert_eq!(r["undo"], "Remove hidden information");
     assert_eq!(ok(&mut a, "comment_list", json!({ "doc": doc }))["count"], 0);
     assert!(count(&ok(&mut a, "doc_hidden_info", json!({ "doc": doc })), "metadata") >= 1, "only comments went");
+    // With none left, removing them again says so, and Optimize discarding them still runs.
+    let again = a.call("doc_remove_hidden", &json!({ "doc": doc, "categories": ["comments"] }));
+    assert!(matches!(&again, Err(ToolError::Failed(m)) if m.starts_with("nothing to remove")), "{again:?}");
+    let optimized = ok(&mut a, "doc_optimize", json!({ "doc": doc, "path": "optimized.pdf", "discard": ["comments", "bookmarks"] }));
+    assert_eq!(optimized["discarded"], json!([]), "{optimized}");
     let r = ok(&mut a, "doc_remove_hidden", json!({ "doc": doc }));
     assert_eq!(r["undo"], "Sanitize document");
     ok(&mut a, "doc_save", json!({ "doc": doc, "path": "clean.pdf" }));
     let bytes = std::fs::read(dir.join("clean.pdf")).unwrap();
     assert!(!bytes.windows(11).any(|w| w == b"Secret plan"), "the old revision is gone");
     assert!(matches!(a.call("doc_remove_hidden", &json!({ "doc": doc, "categories": ["nonsense"] })), Err(ToolError::InvalidArgs(_))));
+    // A document that can't be edited has no scan: the refusal says why, not that nothing is there.
+    let junk = [vec![b'x'; 5000], std::fs::read(dir.join("a.pdf")).unwrap()].concat();
+    std::fs::write(dir.join("junk.pdf"), junk).unwrap();
+    let read_only = ok(&mut a, "doc_open", json!({ "path": "junk.pdf" }))["doc"].as_u64().unwrap();
+    let refused = a.call("doc_remove_hidden", &json!({ "doc": read_only, "categories": ["comments"] }));
+    assert!(matches!(&refused, Err(ToolError::Failed(m)) if m.contains("can't be edited")), "{refused:?}");
 }
 
 /// A one-page PDF whose text "TOP SECRET" sits under an opaque black rectangle.
@@ -6478,10 +6662,12 @@ fn optimizing_through_tools() {
     let reduced = ok(&mut a, "doc_reduce", json!({ "doc": doc, "path": "reduced.pdf" }));
     assert!(reduced["bytes_after"].as_u64().unwrap() < reduced["bytes_before"].as_u64().unwrap());
     assert_eq!(reduced["written"], true);
+    assert_eq!(reduced["images_refused"], 0);
     assert_eq!(std::fs::metadata(dir.join("reduced.pdf")).unwrap().len(), reduced["bytes_after"].as_u64().unwrap());
 
     // Target PDF 1.4 (disables object streams) and PDF 2.0 (with object_streams toggled off).
     let v14 = ok(&mut a, "doc_optimize", json!({ "doc": doc, "path": "v14.pdf", "compatibility": "1.4" }));
+    assert_eq!(v14["images_refused"], 0);
     assert_eq!((v14["pdf_version"].as_str(), v14["object_streams"].as_bool()), (Some("1.4"), Some(false)), "{v14}");
     let v14_bytes = std::fs::read(dir.join("v14.pdf")).unwrap();
     assert!(v14_bytes.starts_with(b"%PDF-1.4\n") && !v14_bytes.windows(7).any(|w| w == b"/ObjStm"));
@@ -9764,7 +9950,11 @@ fn added_text_lines_take_their_own_alignments() {
     let dir = workdir("paragraph-aligns");
     let mut a = auto(&dir);
     let id = ok(&mut a, "doc_create", json!({"from":"blank","width":600,"height":400}))["doc"].as_u64().unwrap();
-    ok(&mut a, "page_add_text", json!({"doc":id,"page":1,"text":"Left line\nRight line","at":[40,50],"width":500,"size":12,"aligns":[null,"right"]}));
+    ok(
+        &mut a,
+        "page_add_text",
+        json!({"doc":id,"page":1,"text":"Left line\nRight line\nInherited line","at":[40,50],"width":500,"size":12,"aligns":[null,"right","inherit"]}),
+    );
     let rect = |a: &mut Automation, text: &str| -> Vec<f64> {
         let lines = ok(a, "text_lines", json!({"doc":id,"page":1}));
         let line = lines["lines"].as_array().unwrap().iter().find(|l| l["text"] == text).cloned().unwrap();
@@ -9772,10 +9962,13 @@ fn added_text_lines_take_their_own_alignments() {
     };
     assert!((rect(&mut a, "Left line")[0] - 40.0).abs() < 1.0);
     assert!((rect(&mut a, "Right line")[2] - 540.0).abs() < 1.0, "{:?}", rect(&mut a, "Right line"));
+    assert!((rect(&mut a, "Inherited line")[0] - 40.0).abs() < 1.0);
     // The whole box centred: the right-aligned line goes with it.
     ok(&mut a, "content_update", json!({"doc":id,"page":1,"index":1,"align":"center"}));
     let right = rect(&mut a, "Right line");
     assert!(((right[0] + right[2]) / 2.0 - 290.0).abs() < 1.0, "{right:?}");
+    let inherited = rect(&mut a, "Inherited line");
+    assert!(((inherited[0] + inherited[2]) / 2.0 - 290.0).abs() < 1.0, "{inherited:?}");
     assert!(a.call("content_update", &json!({"doc":id,"page":1,"index":1,"aligns":["sideways"]})).is_err());
     assert!(a.call("content_update", &json!({"doc":id,"page":1,"index":1,"aligns":"right"})).is_err());
 }
@@ -10190,3 +10383,154 @@ fn simple_rule_scan_drawn(content: &[u8]) -> Vec<u8> {
     }
     write_full(&doc, &SaveOptions::default()).unwrap()
 }
+
+#[test]
+fn editor_crop_group_move_and_arrange_survive_added_item_deletion_through_tools() {
+    let dir = workdir("editor-crop-group-arrange");
+    let mut a = auto(&dir);
+    let source = ok(&mut a, "doc_open", json!({"path":"a.pdf"}))["doc"].as_u64().unwrap();
+    ok(&mut a, "doc_export_images", json!({"doc":source,"folder":"src","dpi":18,"pages":[1]}));
+    let doc = ok(&mut a, "doc_create", json!({"from":"images","paths":["src/a_page_1.png"]}))["doc"].as_u64().unwrap();
+    ok(&mut a, "image_edit", json!({"doc":doc,"page":1,"image":1,"action":"move","rect":[5,5,25,35]}));
+    ok(&mut a, "image_edit", json!({"doc":doc,"page":1,"image":1,"action":"crop","rect":[10,10,20,30]}));
+    ok(&mut a, "page_add_text", json!({"doc":doc,"page":1,"text":"Movable label","rect":[2,40,45,55],"size":6}));
+    let inventory = ok(&mut a, "object_list", json!({"doc":doc,"page":1}));
+    let objects: Vec<_> = inventory["objects"].as_array().unwrap().iter().map(|o| json!({"kind":o["kind"],"index":o["index"]})).collect();
+    assert_eq!(objects.len(), 2);
+    let moved = ok(&mut a, "object_move", json!({"doc":doc,"page":1,"objects":objects,"offset":[3,4]}));
+    assert_eq!(moved["moved"], 2);
+    let picture = ok(&mut a, "page_images", json!({"doc":doc,"page":1}))["images"][0].clone();
+    assert_eq!(picture["rect"], json!([8.0, 9.0, 28.0, 39.0]));
+    assert_eq!(picture["visible_rect"], json!([13.0, 14.0, 23.0, 34.0]));
+    assert!(page_text(&mut a, doc)[0].contains("Movable label"));
+    ok(&mut a, "edit_undo", json!({"doc":doc}));
+    assert_eq!(ok(&mut a, "page_images", json!({"doc":doc,"page":1}))["images"][0]["visible_rect"], json!([10.0, 10.0, 20.0, 30.0]));
+    ok(&mut a, "edit_redo", json!({"doc":doc}));
+    ok(&mut a, "doc_save", json!({"doc":doc,"path":"grouped.pdf"}));
+    let reopened = ok(&mut a, "doc_open", json!({"path":"grouped.pdf"}))["doc"].as_u64().unwrap();
+    assert_eq!(ok(&mut a, "page_images", json!({"doc":reopened,"page":1}))["images"][0]["visible_rect"], picture["visible_rect"]);
+    ok(&mut a, "image_edit", json!({"doc":reopened,"page":1,"image":1,"action":"bring_to_front"}));
+    assert_eq!(ok(&mut a, "content_list", json!({"doc":reopened}))["count"], 1);
+    ok(&mut a, "content_delete", json!({"doc":reopened,"page":1,"index":1}));
+    ok(&mut a, "doc_save", json!({"doc":reopened,"path":"independent.pdf"}));
+    let saved = ok(&mut a, "doc_open", json!({"path":"independent.pdf"}))["doc"].as_u64().unwrap();
+    let after = ok(&mut a, "page_images", json!({"doc":saved,"page":1}));
+    assert_eq!(after["count"], 1);
+    assert_eq!(after["images"][0]["rect"], picture["rect"]);
+    assert_eq!(after["images"][0]["visible_rect"], picture["visible_rect"]);
+    let rendered = a.call("page_render", &json!({"doc":saved,"page":1,"dpi":72})).unwrap();
+    assert!(rendered.iter().any(|c| matches!(c, Content::Png {data,width,height} if !data.is_empty() && *width > 0 && *height > 0)));
+}
+
+#[test]
+fn image_flip_tools_follow_displayed_axes_on_every_page_rotation() {
+    fn corners(a: &Automation, id: u64) -> [[f64; 2]; 4] {
+        let doc = a.session().get(pdfcraft_engine::DocId(id)).unwrap();
+        let [aa, b, c, d, e, f] = doc.page_images(0)[0].matrix;
+        [(0.0, 0.0), (1.0, 0.0), (0.0, 1.0), (1.0, 1.0)]
+            .map(|(x, y)| doc.info.pages[0].user_to_view((aa * x + c * y + e) as f32, (b * x + d * y + f) as f32).map(f64::from))
+    }
+    fn raster(a: &mut Automation, id: u64) -> (usize, usize, Vec<u8>) {
+        let rendered = a.call("page_render", &json!({"doc":id,"page":1,"dpi":72})).unwrap();
+        let Content::Png { data, .. } = &rendered[0] else { panic!("expected PNG") };
+        let mut reader = png::Decoder::new(std::io::Cursor::new(data)).read_info().unwrap();
+        let mut bytes = vec![0; reader.output_buffer_size().unwrap()];
+        let frame = reader.next_frame(&mut bytes).unwrap();
+        bytes.truncate(frame.buffer_size());
+        if frame.color_type == png::ColorType::Rgb {
+            bytes = bytes.as_chunks::<3>().0.iter().flat_map(|&[r, g, b]| [r, g, b, 255]).collect();
+        } else {
+            assert_eq!(frame.color_type, png::ColorType::Rgba);
+        }
+        (frame.width as usize, frame.height as usize, bytes)
+    }
+    let dir = workdir("displayed-image-flip");
+    let mut png_bytes = Vec::new();
+    {
+        let mut encoder = png::Encoder::new(&mut png_bytes, 8, 4);
+        encoder.set_color(png::ColorType::Rgb);
+        let colors = [[240, 20, 30], [20, 230, 40], [30, 40, 220], [220, 210, 20]];
+        let pixels: Vec<u8> = (0..4).flat_map(|y| (0..8).flat_map(move |x| colors[usize::from(x >= 4) + 2 * usize::from(y >= 2)])).collect();
+        encoder.write_header().unwrap().write_image_data(&pixels).unwrap();
+    }
+    std::fs::write(dir.join("quadrants.png"), png_bytes).unwrap();
+    let mut a = auto(&dir);
+    let mut failures = Vec::new();
+    for rotation in [0, 90, 180, 270] {
+        let doc = ok(&mut a, "doc_create", json!({"from":"images","paths":["quadrants.png"]}))["doc"].as_u64().unwrap();
+        if rotation != 0 {
+            ok(&mut a, "page_rotate", json!({"doc":doc,"pages":[1],"degrees":rotation}));
+        }
+        let before = corners(&a, doc);
+        let (width, height, pixels) = raster(&mut a, doc);
+        let xmin = before.iter().map(|p| p[0]).fold(f64::INFINITY, f64::min);
+        let xmax = before.iter().map(|p| p[0]).fold(f64::NEG_INFINITY, f64::max);
+        let ymin = before.iter().map(|p| p[1]).fold(f64::INFINITY, f64::min);
+        let ymax = before.iter().map(|p| p[1]).fold(f64::NEG_INFINITY, f64::max);
+        for (action, horizontal) in [("flip_horizontal", true), ("flip_vertical", false)] {
+            ok(&mut a, "image_edit", json!({"doc":doc,"page":1,"image":1,"action":action}));
+            let after = corners(&a, doc);
+            for (old, new) in before.into_iter().zip(after) {
+                let expected = if horizontal { [xmin + xmax - old[0], old[1]] } else { [old[0], ymin + ymax - old[1]] };
+                if new.into_iter().zip(expected).any(|(actual, want)| (actual - want).abs() > 0.001) {
+                    failures.push(format!("rotation {rotation} {action}: corner {old:?} became {new:?}, expected {expected:?}"));
+                    break;
+                }
+            }
+            let (new_width, new_height, actual_pixels) = raster(&mut a, doc);
+            assert_eq!((new_width, new_height), (width, height));
+            let mut expected_pixels = Vec::new();
+            for y in 0..height {
+                for x in 0..width {
+                    let source = if horizontal { (y * width + width - 1 - x) * 4 } else { ((height - 1 - y) * width + x) * 4 };
+                    expected_pixels.extend_from_slice(&pixels[source..source + 4]);
+                }
+            }
+            if actual_pixels.iter().zip(&expected_pixels).any(|(actual, want)| actual.abs_diff(*want) > 1) {
+                failures.push(format!("rotation {rotation} {action}: raster flipped the wrong displayed axis"));
+            }
+            assert_ne!(actual_pixels, pixels, "the asymmetric image makes both flip axes observable");
+            ok(&mut a, "edit_undo", json!({"doc":doc}));
+            assert_eq!(corners(&a, doc), before, "one undo restores the original placement");
+        }
+    }
+    assert!(failures.is_empty(), "{}", failures.join("\n"));
+}
+
+#[test]
+fn mixed_script_tools_normalize_but_undo_restores_the_exact_mixture() {
+    let dir = workdir("mixed-script-policy");
+    let mut a = auto(&dir);
+    for (script, mixed, uniform, plain) in [("superscript", "Q²2", "Q²²", "Q22"), ("subscript", "H₂2", "H₂₂", "H22")] {
+        let doc = ok(&mut a, "doc_open", json!({"path":"a.pdf"}))["doc"].as_u64().unwrap();
+        ok(&mut a, "text_edit", json!({"doc":doc,"page":1,"paragraph":1,"text":mixed,"size":14,"width":160}));
+        let paragraph =
+            |a: &mut Automation| ok(a, "text_paragraphs", json!({"doc":doc,"page":1}))["paragraphs"][0]["editor_text"].as_str().unwrap().to_owned();
+        assert_eq!(paragraph(&mut a), mixed);
+        let before = a.session().get(pdfcraft_engine::DocId(doc)).unwrap().bytes.clone();
+        let args = json!({"doc":doc,"page":1,"paragraph":1,"script":script});
+        let once = ok(&mut a, "text_script", args.clone());
+        assert_eq!(once["paragraph"]["text"], uniform);
+        assert_eq!(paragraph(&mut a), uniform);
+        ok(&mut a, "text_script", args);
+        assert_eq!(paragraph(&mut a), plain);
+        assert_ne!(plain, mixed, "normalization does not promise to recreate the original mixture");
+        ok(&mut a, "edit_undo", json!({"doc":doc}));
+        assert_eq!(paragraph(&mut a), uniform, "one Undo restores the preceding scripted text");
+        ok(&mut a, "edit_undo", json!({"doc":doc}));
+        assert_eq!(paragraph(&mut a), mixed, "Undo restores the exact initial Unicode mixture");
+        assert_eq!(
+            a.session().get(pdfcraft_engine::DocId(doc)).unwrap().bytes.as_ref(),
+            before.as_ref(),
+            "Undo also restores the exact prior document bytes"
+        );
+        ok(&mut a, "edit_redo", json!({"doc":doc}));
+        assert_eq!(paragraph(&mut a), uniform);
+        ok(&mut a, "edit_redo", json!({"doc":doc}));
+        assert_eq!(paragraph(&mut a), plain);
+        let path = format!("mixed-{script}.pdf");
+        ok(&mut a, "doc_save", json!({"doc":doc,"path":path}));
+        let reopened = ok(&mut a, "doc_open", json!({"path":path}))["doc"].as_u64().unwrap();
+        assert_eq!(page_text(&mut a, reopened)[0], plain);
+    }
+}
diff --git a/crates/content/src/lib.rs b/crates/content/src/lib.rs
index c52916d332..4957f86861 100644
--- a/crates/content/src/lib.rs
+++ b/crates/content/src/lib.rs
@@ -730,11 +730,14 @@ impl Matrix {
     pub fn invert(&self) -> Option<Matrix> {
         let [a, b, c, d, e, f] = self.0;
         let det = a * d - b * c;
-        if det.abs() < 1e-12 || !det.is_finite() {
+        if det == 0.0 || !det.is_finite() || det.abs() <= 1e-12 * ((a * d).abs() + (b * c).abs()) {
             return None;
         }
         let (ia, ib, ic, id) = (d / det, -b / det, -c / det, a / det);
-        Some(Matrix([ia, ib, ic, id, -(e * ia + f * ic), -(e * ib + f * id)]))
+        let inverse = [ia, ib, ic, id, -(e * ia + f * ic), -(e * ib + f * id)];
+        // A determinant that underflows toward zero can still pass the relative check above,
+        // and dividing by it overflows: such a matrix has no usable inverse.
+        inverse.iter().all(|v| v.is_finite()).then_some(Matrix(inverse))
     }
 
     /// The bounding box of a rectangle `[x0 y0 x1 y1]` after this transform.
diff --git a/crates/content/src/tests.rs b/crates/content/src/tests.rs
index c5c7a3aaac..9ac9297cd2 100644
--- a/crates/content/src/tests.rs
+++ b/crates/content/src/tests.rs
@@ -552,3 +552,17 @@ fn inline_images_end_where_the_renderer_ends_them() {
         assert_eq!((parsed.skipped, parsed.ambiguous_images), (0, 0), "{}", String::from_utf8_lossy(data));
     }
 }
+
+#[test]
+fn invert_accepts_small_scale_and_rejects_singular() {
+    let m = Matrix([1e-7, 0., 0., 1e-7, 0., 0.]);
+    let inv = m.invert().expect("a uniform 1e-7 scale is invertible");
+    let id = m.then(&inv).0;
+    for (got, want) in id.iter().zip(Matrix::IDENTITY.0) {
+        assert!((got - want).abs() < 1e-9, "{id:?}");
+    }
+    assert!(Matrix([1., 2., 2., 4., 0., 0.]).invert().is_none());
+    assert!(Matrix([f64::NAN, 0., 0., 1., 0., 0.]).invert().is_none());
+    // A subnormal scale passes the relative check but its inverse overflows (CodeRabbit on #5703).
+    assert!(Matrix([1e-310, 0., 0., 1., 0., 0.]).invert().is_none());
+}
diff --git a/crates/cos/README.md b/crates/cos/README.md
index 2cf3342954..7b576f293f 100644
--- a/crates/cos/README.md
+++ b/crates/cos/README.md
@@ -90,6 +90,11 @@ recognisable in a diff and byte-stable when re-serialized.
 - Linearized output, Fast Web View (`core.linearization`, M11).
 - Structural validation against the Arlington model (`core.arlington-validation`), which will live
   in the reserved `arlington` crate.
-- Image codecs. `pdfcraft-filters` carries the non-image filters and CCITT fax decoding
-  (`Document::decoded_image`); DCT, JPX and JBIG2 are still decoded through the bootstrap renderer
-  (`core.image-filters`, M2.6).
+- Image codecs. `pdfcraft-filters` carries the non-image filters and CCITT fax and JBIG2 decoding
+  (`Document::decoded_image`, a JBIG2 image's `/JBIG2Globals` within `MAX_JBIG2_GLOBALS`, 32 MiB,
+  their filters undone once a document for the images that share them, up to 64 MiB kept, while
+  their segments are decoded for every image, and `ImageBudget` for an operation over many images,
+  which share one allowance of decoding, filters, decoders and pixels alike, and are refused past
+  it: `IMAGE_WORK`, 2^34 steps, or 2 to 5 minutes of JBIG2 and about 1,000 pages scanned at
+  300 dpi, plus `IMAGE_WORK_PER_BYTE`, 2^13 steps for each byte of the file);
+  DCT and JPX are still decoded through the bootstrap renderer (`core.image-filters`, M2.6).
diff --git a/crates/cos/src/budget.rs b/crates/cos/src/budget.rs
index 1ddd42eaf5..376b108be3 100644
--- a/crates/cos/src/budget.rs
+++ b/crates/cos/src/budget.rs
@@ -6,16 +6,218 @@ use pdfcraft_filters::FilterError;
 
 use crate::{CosError, Document, ObjRef, Object, Stream};
 
+/// The steps of decoding an operation over a document's images may take whatever the file's size.
+/// A step of JBIG2 decoding ([`hayro_jbig2::Image::decode_within`]) is about a pixel, and takes 6 to
+/// 16 ns, so this is 2 to 5 minutes, and about as long again for what an operation does with the
+/// pixels. A page scanned at 300 dpi takes about 17 million, 8.4 for its pixels and that again to
+/// decode them, so this alone reads about 1,000 of them. A byte into or out of a filter is a step
+/// too, and takes less: 3 ns at most, or up to 19 ns through a predictor on samples of a bit.
+const IMAGE_WORK: u64 = 1 << 34;
+/// The steps each byte of the file adds to [`IMAGE_WORK`], so that a long scan is read whole: such a
+/// page pays for itself with about 2 KB of the file, about the smallest a page of text is stored
+/// in, and a stream of any filter this reads can be decoded about 8 times at Flate's best, 1,032 to
+/// one. So what a hostile file can ask for grows with its length, by about 14 minutes for 10 MB.
+const IMAGE_WORK_PER_BYTE: u64 = 1 << 13;
+
 /// Decoded bytes one page's content walk may produce in all: its `/Contents` streams and every
 /// form XObject it enters, each occurrence counted again.
 pub const MAX_PAGE_DECODED: usize = 256 << 20;
 /// Form XObjects one page's content walk may enter, each entry counted again.
 pub const MAX_PAGE_FORMS: usize = 50_000;
 
+/// The steps a sample of a JPEG costs: a few bytes can hold a page of one grey, and decoding,
+/// resampling and storing it took about 20 to 45 ns a sample.
+const JPEG_WORK: u64 = 2;
+/// The steps a byte of a JPEG costs to read: its tables took 24 ns a byte before a size was known,
+/// and images can share one, so reading it again for each has to count.
+const JPEG_READ_WORK: u64 = 4;
+
 /// A stream decode within a byte bound, with the bytes its filter stages decoded: the data or
 /// the error, each with that count.
 type Decoder = fn(&Stream, usize) -> Result<(Vec<u8>, usize), (FilterError, usize)>;
 
+/// What one operation over a document's images may still spend decoding them: exporting them,
+/// optimizing them, and storing LZW streams with Flate as it does, clearing them for redaction.
+///
+/// An image has its own limit, which doesn't bound a file of thousands of images made to reach it:
+/// a few hundred bytes of JBIG2 can ask for seconds of decoding, 4 KB of Flate inside Flate for a
+/// gigabyte, and an image that shares `/JBIG2Globals` decodes them again. So images share this
+/// allowance, whatever they do with what they decode and whether or not it works, and past it they
+/// aren't decoded. A caller then treats them as it does an image it can't read, and
+/// [`ImageBudget::refused`] says how many there were.
+///
+/// An image also pays for its pixels once decoded, as what reads it goes through them one by one
+/// however few bytes coded them: blank rows of fax or Flate take almost none. It pays for no more
+/// than its data holds, a bit a pixel at least, so an image declaring a size its data doesn't fill
+/// costs what a smaller one would, not the run's allowance. A JPEG pays for its samples when
+/// it is decoded ([`ImageBudget::pay_jpeg`]), and is otherwise not charged, as JPEG 2000 isn't:
+/// their decoders don't run here.
+#[derive(Debug)]
+pub struct ImageBudget {
+    work: u64,
+    refused: usize,
+}
+
+impl ImageBudget {
+    /// The allowance for an operation on `doc`, which a longer file makes larger. The streams made
+    /// or changed since it was opened count as the file's bytes do, so a document built in memory
+    /// (combined, created, or given pages of scans) gets what it would once saved and opened again.
+    pub fn new(doc: &Document) -> Self {
+        let length = |n: usize| u64::try_from(n).unwrap_or(u64::MAX);
+        let edited = doc
+            .scan_objects_subset(doc.modified_objects())
+            .filter_map(|(_, object)| match &*object.ok()? {
+                Object::Stream(s) => Some(length(s.raw.len())),
+                _ => None,
+            })
+            .fold(0u64, u64::saturating_add);
+        let bytes = length(doc.bytes().len()).saturating_add(edited);
+        Self::with_work(IMAGE_WORK.saturating_add(bytes.saturating_mul(IMAGE_WORK_PER_BYTE)))
+    }
+
+    /// An allowance of `work` steps of decoding.
+    pub fn with_work(work: u64) -> Self {
+        Self { work, refused: 0 }
+    }
+
+    /// The samples of image `s`, decoded and charged to the allowance: the one way to decode an
+    /// image outside the renderer, so that an operation over many images can't decode them without
+    /// one.
+    ///
+    /// They go through its filters ([`Stream::decoded`]), or, for a CCITT fax or JBIG2 image (its
+    /// last filter), through the filters before it and then [`pdfcraft_filters::decode_ccitt_within`]
+    /// with its [`Document::fax_params`], or [`pdfcraft_filters::decode_jbig2_within`] with its
+    /// `/JBIG2Globals`, as `CCITTFaxDecode` and `JBIG2Decode` give them (ISO 32000-2 §7.4.6,
+    /// §7.4.7). Parameters given by reference count, for every filter
+    /// ([`Document::with_direct_parms`]). A fax image's `/Columns` has to be its `/Width`, and a
+    /// JBIG2 image's page its `/Width` × `/Height`: PdfCraft's renderer draws the whole page into
+    /// the image. Up to its `/Height` rows are decoded, whatever a fax image's `/Rows` says; damaged
+    /// fax data gives fewer, so a caller checks it has the rows it needs. Damaged JBIG2 data, and
+    /// globals that can't be read (within [`MAX_JBIG2_GLOBALS`](crate::MAX_JBIG2_GLOBALS)), are an
+    /// error.
+    ///
+    /// No stage, the filters before a fax or JBIG2 decoder included, may produce more than `max`
+    /// bytes, nor more than [`MAX_DECODED`](crate::MAX_DECODED). A JBIG2 image's `/JBIG2Globals`
+    /// are another stream, shared between images, and are decoded within `MAX_JBIG2_GLOBALS`
+    /// whatever `max` is. Each filter as it runs, the globals when they have to be read, and the fax
+    /// or JBIG2 decoder spend from the allowance, and the image then pays for its pixels; with
+    /// nothing left an image is refused before anything is read, its globals included.
+    ///
+    /// ```
+    /// # let doc = pdfcraft_cos::Document::new_empty();
+    /// # let s = pdfcraft_cos::Stream::from_raw(pdfcraft_cos::Dict::new(), Vec::new());
+    /// let samples = pdfcraft_cos::ImageBudget::new(&doc).decode(&doc, &s, 1 << 20);
+    /// assert_eq!(samples.unwrap(), b"");
+    /// ```
+    ///
+    /// `Document` has no way of its own to decode an image:
+    ///
+    /// ```compile_fail
+    /// # let doc = pdfcraft_cos::Document::new_empty();
+    /// # let s = pdfcraft_cos::Stream::from_raw(pdfcraft_cos::Dict::new(), Vec::new());
+    /// let _ = doc.decoded_image(&s);
+    /// ```
+    ///
+    /// ```compile_fail
+    /// # let doc = pdfcraft_cos::Document::new_empty();
+    /// # let s = pdfcraft_cos::Stream::from_raw(pdfcraft_cos::Dict::new(), Vec::new());
+    /// let _ = doc.decoded_image_within(&s, 1 << 20);
+    /// ```
+    pub fn decode(&mut self, doc: &Document, s: &Stream, max: usize) -> Result<Vec<u8>, CosError> {
+        let decoded = doc.decoded_image_spending(s, max, &mut self.work);
+        self.count_refused(s, &decoded);
+        self.pay_size(s, decoded?)
+    }
+
+    /// Image `s` through its filters alone, charged to the allowance: [`Stream::decoded_within`]
+    /// with its `/DecodeParms` given by reference read too ([`Document::with_direct_parms`]), for an
+    /// image that has no fax or JBIG2 decoder to go through.
+    pub fn decode_filters(&mut self, doc: &Document, s: &Stream, max: usize) -> Result<Vec<u8>, CosError> {
+        let decoded = doc.with_direct_parms(s).decoded_spending(max, &mut self.work);
+        self.count_refused(s, &decoded);
+        let decoded = decoded?;
+        if s.filters().iter().all(|(f, _)| f.is_decodable()) { self.pay_size(s, decoded) } else { Ok(decoded) }
+    }
+
+    /// `data` through `chain`, any corruption being an error ([`pdfcraft_filters::decode_within`]),
+    /// for a stream a run rewrites rather than an image it reads, charged to the allowance.
+    pub fn decode_chain(
+        &mut self,
+        chain: &[(pdfcraft_filters::Filter, pdfcraft_filters::Params)],
+        data: &[u8],
+        max: usize,
+    ) -> Result<Vec<u8>, FilterError> {
+        pdfcraft_filters::decode_within(chain, data, max, &mut self.work)
+    }
+
+    /// Pays `steps` of other work on decoded data, or spends all there is and says so.
+    pub fn spend(&mut self, steps: u64) -> bool {
+        let left = self.work.checked_sub(steps);
+        self.work = left.unwrap_or(0);
+        left.is_some()
+    }
+
+    /// Pays for `pixels` a decode goes on to work through, or spends all there is, and the image
+    /// is refused.
+    pub fn pay_pixels(&mut self, pixels: u64) -> bool {
+        let paid = self.spend(pixels);
+        self.refused += usize::from(!paid);
+        paid
+    }
+
+    /// Pays for reading JPEG `data` and decoding its `samples`, as [`ImageBudget::pay_pixels`] does.
+    /// A caller pays before its tables are parsed, which can be most of the file.
+    pub fn pay_jpeg(&mut self, samples: u64, data: &[u8]) -> bool {
+        let reading = (data.len() as u64).saturating_mul(JPEG_READ_WORK);
+        self.pay_pixels(samples.saturating_mul(JPEG_WORK).saturating_add(reading))
+    }
+
+    /// Pays for the pixels of image `s` that its `decoded` data holds, those of its `/Width` and
+    /// `/Height` but no more than a bit of the data each, unless it is JBIG2, whose decoder pays for
+    /// its page, or isn't decoded here. What can't be paid for refuses the image.
+    fn pay_size(&mut self, s: &Stream, decoded: Vec<u8>) -> Result<Vec<u8>, CosError> {
+        if !charged(s) || matches!(s.filters().last(), Some((pdfcraft_filters::Filter::Jbig2, _))) {
+            return Ok(decoded);
+        }
+        let side = |key: &[u8]| s.dict.int(key).and_then(|v| u64::try_from(v).ok()).unwrap_or(0);
+        let held = u64::try_from(decoded.len()).unwrap_or(u64::MAX).saturating_mul(8);
+        if self.pay_pixels(side(b"Width").saturating_mul(side(b"Height")).min(held)) {
+            Ok(decoded)
+        } else {
+            Err(CosError::Filter(FilterError::Spent.to_string()))
+        }
+    }
+
+    /// An image that failed with nothing left was refused, unless it has a filter that costs
+    /// nothing here, which fails whatever is left.
+    fn count_refused(&mut self, s: &Stream, decoded: &Result<Vec<u8>, CosError>) {
+        if decoded.is_err() && self.work == 0 && charged(s) {
+            self.refused += 1;
+        }
+    }
+
+    /// The decodes refused for lack of allowance: an image read twice over is counted twice.
+    pub fn refused(&self) -> usize {
+        self.refused
+    }
+
+    /// The steps of decoding still allowed.
+    pub fn work_left(&self) -> u64 {
+        self.work
+    }
+}
+
+/// Whether `s` can be decoded here and so charged: general filters, a fax or JBIG2 decoder last at
+/// most. Those decoders anywhere else can't run.
+fn charged(s: &Stream) -> bool {
+    use pdfcraft_filters::Filter;
+    s.readable_filters().is_ok_and(|chain| {
+        chain.split_last().is_none_or(|((last, _), before)| {
+            (last.is_decodable() || matches!(last, Filter::Jbig2 | Filter::CcittFax)) && before.iter().all(|(f, _)| f.is_decodable())
+        })
+    })
+}
+
 /// What one operation may still decode and enter across all the streams it reads.
 ///
 /// [`MAX_DECODED`](crate::MAX_DECODED) bounds one decode. It does not bound a page whose
@@ -143,6 +345,401 @@ impl DecodeBudget {
     }
 }
 
+#[cfg(test)]
+mod image_tests {
+    use super::*;
+    use crate::Dict;
+
+    fn jbig2(parms: Option<Object>) -> Stream {
+        let mut dict = Dict::new();
+        dict.set(b"Width".to_vec(), Object::Int(16));
+        dict.set(b"Height".to_vec(), Object::Int(2));
+        dict.set(b"Filter".to_vec(), Object::name("JBIG2Decode"));
+        if let Some(parms) = parms {
+            dict.set(b"DecodeParms".to_vec(), parms);
+        }
+        Stream::from_raw(dict, pdfcraft_filters::encode_jbig2_generic(&[0xFF; 4], 16, 2).unwrap())
+    }
+
+    /// Each image spends what it took from one allowance, and those past it are refused and
+    /// counted, whatever their filters. What can't be decoded here costs nothing, and fails
+    /// without being one of these.
+    #[test]
+    fn the_images_of_an_operation_share_its_allowance() {
+        let doc = Document::new_empty();
+        let image = jbig2(None);
+        let mut budget = ImageBudget::with_work(u64::MAX);
+        let samples = budget.decode(&doc, &image, 1 << 20).unwrap();
+        let cost = u64::MAX - budget.work_left();
+        assert!(cost > 0);
+        let mut budget = ImageBudget::with_work(3 * cost);
+        for left in [2, 1, 0] {
+            assert_eq!(budget.decode(&doc, &image, 1 << 20).unwrap(), samples);
+            assert_eq!(budget.work_left(), left * cost);
+        }
+        assert_eq!(budget.refused(), 0, "the allowance held exactly three");
+        for refused in [1, 2] {
+            assert!(budget.decode(&doc, &image, 1 << 20).is_err());
+            assert_eq!(budget.refused(), refused);
+        }
+        assert!(budget.decode(&doc, &Stream::flate(Dict::new(), b"samples"), 1 << 20).is_err());
+        assert!(budget.decode(&doc, &Stream::from_raw(Dict::new(), b"samples".to_vec()), 1 << 20).is_err());
+        assert_eq!(budget.refused(), 4, "other images share it");
+        for name in ["NoSuchFilter", "DCTDecode", "JPXDecode"] {
+            let mut dict = Dict::new();
+            dict.set(b"Filter".to_vec(), Object::name(name));
+            assert!(budget.decode(&doc, &Stream::from_raw(dict, b"data".to_vec()), 1 << 20).is_err());
+            assert_eq!(budget.refused(), 4, "{name} isn't one of these");
+        }
+        let mut dict = Dict::new();
+        dict.set(b"Filter".to_vec(), Object::Int(5));
+        assert!(budget.decode(&doc, &Stream::from_raw(dict, b"data".to_vec()), 1 << 20).is_err());
+        assert_eq!(budget.refused(), 4, "a /Filter that can't be read isn't either");
+    }
+
+    /// What a file of images each inflating a megabyte asks for: 4 KB of Flate inside Flate can ask
+    /// for a gigabyte, and these aren't JBIG2, so without the allowance nothing would stop them.
+    #[test]
+    fn filter_bombs_stop_at_the_allowance() {
+        let doc = Document::new_empty();
+        let samples = vec![0; 1 << 20];
+        let inner = pdfcraft_filters::encode_flate(&samples);
+        let mut dict = Dict::new();
+        dict.set(b"Filter".to_vec(), Object::Array(vec![Object::name("FlateDecode"), Object::name("FlateDecode")]));
+        let bomb = Stream::from_raw(dict, pdfcraft_filters::encode_flate(&inner));
+        let cost = (bomb.raw.len() + inner.len() + samples.len()) as u64;
+        let mut budget = ImageBudget::with_work(2 * cost + 1);
+        for left in [cost + 1, 1] {
+            assert_eq!(budget.decode(&doc, &bomb, 1 << 20).unwrap(), samples);
+            assert_eq!(budget.work_left(), left);
+        }
+        assert!(budget.decode(&doc, &bomb, 1 << 20).is_err());
+        assert_eq!((budget.work_left(), budget.refused()), (0, 1), "the first it can't pay for ends it");
+    }
+
+    /// Filters in front of a JBIG2 decoder pay as they run, on top of what the decoder takes, and
+    /// one that fails has still paid: nothing about the JBIG2 data is known by then, and each image
+    /// of a file can do this.
+    #[test]
+    fn filters_in_front_of_jbig2_pay_whether_or_not_they_work() {
+        let doc = Document::new_empty();
+        let alone = jbig2(None);
+        let mut budget = ImageBudget::with_work(u64::MAX);
+        let samples = budget.decode(&doc, &alone, 1 << 20).unwrap();
+        let decoding = u64::MAX - budget.work_left();
+        let behind = |raw: Vec<u8>| {
+            let mut dict = alone.dict.clone();
+            dict.set(b"Filter".to_vec(), Object::Array(vec![Object::name("FlateDecode"), Object::name("JBIG2Decode")]));
+            Stream::from_raw(dict, raw)
+        };
+
+        let image = behind(pdfcraft_filters::encode_flate(&alone.raw));
+        let mut budget = ImageBudget::with_work(u64::MAX);
+        assert_eq!(budget.decode(&doc, &image, 1 << 20).unwrap(), samples);
+        assert_eq!(u64::MAX - budget.work_left(), decoding + (image.raw.len() + alone.raw.len()) as u64);
+
+        // Past this image's limit: an error, with what finding out took paid and the rest left.
+        let bomb = behind(pdfcraft_filters::encode_flate(&vec![0; 1 << 16]));
+        let mut budget = ImageBudget::with_work(u64::MAX);
+        assert!(budget.decode(&doc, &bomb, 1000).is_err());
+        assert_eq!(u64::MAX - budget.work_left(), bomb.raw.len() as u64 + 1000);
+        assert_eq!(budget.refused(), 0, "that image's limit isn't the run's");
+
+        // A small allowance is a limit too: it stops there, and the image is refused.
+        let mut budget = ImageBudget::with_work(bomb.raw.len() as u64 + 10);
+        assert!(budget.decode(&doc, &bomb, 1 << 20).is_err());
+        assert_eq!((budget.work_left(), budget.refused()), (0, 1));
+    }
+
+    /// Globals that are read again for every image pay every time, and fail having paid. Kept
+    /// ones have no filters left to undo, so they pay for being read and nothing more.
+    #[test]
+    fn globals_pay_for_their_filters_each_time_they_are_decoded() {
+        let skipped = [0, 0, 0, 0, 0x3E, 0, 0, 0, 0, 0, 4, 0, 0, 0, 1];
+        let raw = pdfcraft_filters::encode_flate(&skipped);
+        let stream = |doc: &Document, r: ObjRef| match &*doc.get(r) {
+            Object::Stream(s) => s.clone(),
+            _ => panic!("not a stream"),
+        };
+        let spent = |doc: &Document, s: &Stream| {
+            let mut budget = ImageBudget::with_work(u64::MAX);
+            budget.decode(doc, s, 1 << 20).unwrap();
+            u64::MAX - budget.work_left()
+        };
+        let mut doc = Document::new_empty();
+        let mut dict = Dict::new();
+        dict.set(b"Filter".to_vec(), Object::name("FlateDecode"));
+        let globals = doc.add(Object::Stream(Stream::from_raw(dict, raw.clone())));
+        let mut parms = Dict::new();
+        parms.set(b"JBIG2Globals".to_vec(), Object::Ref(globals));
+        let image = doc.add(Object::Stream(jbig2(Some(Object::Dict(parms)))));
+        let root = doc.root().unwrap();
+        doc.update_dict(root, |c| c.set(b"Image".to_vec(), Object::Ref(image))).unwrap();
+
+        // Added in memory, so not kept: the filters are undone for each read.
+        let s = stream(&doc, image);
+        let first = spent(&doc, &s);
+        assert_eq!(spent(&doc, &s), first, "not kept, so paid for again");
+
+        // Read from a file, so kept: the second read has no filters to undo.
+        let file = crate::write_full(&doc, &crate::SaveOptions::default()).unwrap();
+        let doc = Document::open(std::sync::Arc::new(file)).unwrap();
+        let image = doc.get(doc.root().unwrap()).as_dict().unwrap().reference(b"Image").unwrap();
+        let s = stream(&doc, image);
+        let filters = (raw.len() + skipped.len()) as u64;
+        assert_eq!(spent(&doc, &s), first, "the first read undoes them");
+        assert_eq!(spent(&doc, &s), first - filters, "kept");
+
+        // Globals that fail pay too, with the image not refused: these go past their own limit.
+        let over = pdfcraft_filters::encode_flate(&vec![0; crate::MAX_JBIG2_GLOBALS + 1]);
+        let mut doc = Document::new_empty();
+        let mut dict = Dict::new();
+        dict.set(b"Filter".to_vec(), Object::name("FlateDecode"));
+        let globals = doc.add(Object::Stream(Stream::from_raw(dict, over.clone())));
+        let mut parms = Dict::new();
+        parms.set(b"JBIG2Globals".to_vec(), Object::Ref(globals));
+        let image = jbig2(Some(Object::Dict(parms)));
+        let mut budget = ImageBudget::with_work(u64::MAX);
+        assert!(budget.decode(&doc, &image, 1 << 20).unwrap_err().to_string().contains("globals"));
+        assert_eq!(u64::MAX - budget.work_left(), (over.len() + crate::MAX_JBIG2_GLOBALS) as u64);
+        assert_eq!(budget.refused(), 0);
+    }
+
+    /// A fax image pays for what comes before its decoder and for the rows it asks for, and past
+    /// the allowance it is refused like any other.
+    #[test]
+    fn fax_images_share_the_allowance() {
+        let doc = Document::new_empty();
+        let (w, h) = (4096u32, 64u32);
+        let coded = pdfcraft_filters::encode_g4(&vec![0xFF; 512 * h as usize], w, h).unwrap();
+        let mut parms = Dict::new();
+        parms.set(b"K".to_vec(), Object::Int(-1));
+        parms.set(b"Columns".to_vec(), Object::Int(i64::from(w)));
+        let mut dict = Dict::new();
+        dict.set(b"Width".to_vec(), Object::Int(i64::from(w)));
+        dict.set(b"Height".to_vec(), Object::Int(i64::from(h)));
+        dict.set(b"Filter".to_vec(), Object::Array(vec![Object::name("FlateDecode"), Object::name("CCITTFaxDecode")]));
+        dict.set(b"DecodeParms".to_vec(), Object::Array(vec![Object::Null, Object::Dict(parms)]));
+        let image = Stream::from_raw(dict, pdfcraft_filters::encode_flate(&coded));
+        let pixels = u64::from(w) * u64::from(h);
+        let cost = (image.raw.len() + coded.len() + 4 * coded.len() + 512 * h as usize) as u64 + pixels;
+        let mut budget = ImageBudget::with_work(cost);
+        assert_eq!(budget.decode(&doc, &image, 1 << 20).unwrap().len(), 512 * h as usize);
+        assert_eq!(budget.work_left(), 0, "exactly that");
+        assert!(budget.decode(&doc, &image, 1 << 20).is_err());
+        assert_eq!(budget.refused(), 1);
+    }
+
+    /// An image pays for its pixels however few bytes hold them, or a blank page of fax or Flate
+    /// would cost a run a second for a few bytes' worth of allowance; a JBIG2 image doesn't pay
+    /// twice, and one this doesn't decode pays nothing. Past what is left it isn't read.
+    #[test]
+    fn an_image_pays_for_its_pixels() {
+        let doc = Document::new_empty();
+        let blank = |filter: Option<&str>, data: Vec<u8>| {
+            let mut dict = Dict::new();
+            dict.set(b"Width".to_vec(), Object::Int(4096));
+            dict.set(b"Height".to_vec(), Object::Int(1024));
+            if let Some(filter) = filter {
+                dict.set(b"Filter".to_vec(), Object::name(filter));
+            }
+            Stream::from_raw(dict, data)
+        };
+        let rows = vec![0xFFu8; 512 * 1024];
+        let flate = blank(Some("FlateDecode"), pdfcraft_filters::encode_flate(&rows));
+        let cost = (flate.raw.len() + rows.len()) as u64 + 4096 * 1024;
+        let mut budget = ImageBudget::with_work(cost);
+        assert_eq!(budget.decode(&doc, &flate, 1 << 24).unwrap(), rows);
+        assert_eq!((budget.work_left(), budget.refused()), (0, 0), "exactly that");
+        // Its filters alone pay the same.
+        let mut budget = ImageBudget::with_work(cost);
+        assert_eq!(budget.decode_filters(&doc, &flate, 1 << 24).unwrap(), rows);
+        assert_eq!(budget.work_left(), 0);
+        // Short of its pixels it is refused, having paid for its filters.
+        let mut budget = ImageBudget::with_work(4096 * 1024 - 1);
+        assert!(budget.decode(&doc, &flate, 1 << 24).unwrap_err().to_string().contains("more image decoding than"));
+        assert_eq!((budget.work_left(), budget.refused()), (0, 1));
+        let mut budget = ImageBudget::with_work(4096 * 1024 - 1);
+        assert!(budget.decode_filters(&doc, &flate, 1 << 24).is_err());
+        assert_eq!((budget.work_left(), budget.refused()), (0, 1));
+        // What isn't decoded here pays for nothing, and fails as it would.
+        let mut budget = ImageBudget::with_work(10);
+        assert!(budget.decode(&doc, &blank(Some("DCTDecode"), b"data".to_vec()), 1 << 24).is_err());
+        assert_eq!((budget.work_left(), budget.refused()), (10, 0));
+        // Unfiltered data pays too, and a size that isn't one is no size.
+        let mut budget = ImageBudget::with_work(u64::MAX);
+        budget.decode(&doc, &blank(None, rows.clone()), 1 << 24).unwrap();
+        assert_eq!(u64::MAX - budget.work_left(), rows.len() as u64 + 4096 * 1024);
+        let mut odd = Dict::new();
+        odd.set(b"Width".to_vec(), Object::Int(-4));
+        odd.set(b"Height".to_vec(), Object::Int(9));
+        let mut budget = ImageBudget::with_work(u64::MAX);
+        budget.decode(&doc, &Stream::from_raw(odd, vec![1, 2]), 1 << 24).unwrap();
+        assert_eq!(u64::MAX - budget.work_left(), 2);
+        // A JPEG pays twice over for each sample, and four times for each byte it is read from.
+        let mut budget = ImageBudget::with_work(30);
+        assert!(budget.pay_jpeg(9, b"ab"));
+        assert_eq!((budget.work_left(), budget.refused()), (4, 0));
+        assert!(!budget.pay_jpeg(0, b"ab"));
+        assert_eq!((budget.work_left(), budget.refused()), (0, 1));
+    }
+
+    /// An image pays for the pixels its data holds, not those its size declares: one claiming
+    /// 131072 by 131072 pixels with a few bytes of Flate costs what those bytes give, and the
+    /// images after it are decoded as they would be without it.
+    #[test]
+    fn an_image_pays_for_no_more_pixels_than_its_data_holds() {
+        let doc = Document::new_empty();
+        let sized = |side: i64, data: &[u8]| {
+            let mut dict = Dict::new();
+            dict.set(b"Width".to_vec(), Object::Int(side));
+            dict.set(b"Height".to_vec(), Object::Int(side));
+            Stream::flate(dict, data)
+        };
+        let claims = sized(131_072, &[0; 16]);
+        let image = sized(64, &[7; 64 * 64]);
+        let cost = |s: &Stream| {
+            let mut budget = ImageBudget::with_work(u64::MAX);
+            budget.decode(&doc, s, 1 << 24).unwrap();
+            u64::MAX - budget.work_left()
+        };
+        assert_eq!(cost(&claims), (claims.raw.len() + 16 + 16 * 8) as u64, "its bytes, and a pixel a bit of them");
+        assert_eq!(cost(&image), (image.raw.len() + 64 * 64) as u64 + 64 * 64, "its bytes, and its pixels");
+        for decode in [ImageBudget::decode, ImageBudget::decode_filters] {
+            let mut budget = ImageBudget::with_work(cost(&claims) + cost(&image));
+            assert_eq!(decode(&mut budget, &doc, &claims, 1 << 24).unwrap(), [0; 16]);
+            assert_eq!(decode(&mut budget, &doc, &image, 1 << 24).unwrap(), [7; 64 * 64], "the image after it is decoded");
+            assert_eq!((budget.work_left(), budget.refused()), (0, 0));
+        }
+    }
+
+    /// A stream a run rewrites is read strictly and charged, and what the caller does with it after
+    /// comes out of the same allowance: what can't be paid for spends all of it.
+    #[test]
+    fn a_rewritten_stream_shares_the_allowance() {
+        use pdfcraft_filters::{Filter, FilterError, Params};
+        let samples = vec![7u8; 1000];
+        let raw = pdfcraft_filters::encode_flate(&samples);
+        let chain = [(Filter::Flate, Params::default())];
+        let cost = (raw.len() + samples.len()) as u64;
+        let mut budget = ImageBudget::with_work(cost + 10);
+        assert_eq!(budget.decode_chain(&chain, &raw, 1 << 20).unwrap(), samples);
+        assert_eq!(budget.work_left(), 10);
+        assert!(budget.spend(4));
+        assert_eq!(budget.work_left(), 6);
+        assert!(budget.spend(6), "exactly what is left");
+        assert_eq!(budget.work_left(), 0);
+        assert!(budget.spend(0));
+        let mut budget = ImageBudget::with_work(5);
+        assert!(!budget.spend(6));
+        assert_eq!(budget.work_left(), 0, "spends all of it");
+        assert!(matches!(budget.decode_chain(&chain, &raw, 1 << 20), Err(FilterError::Spent)));
+        let cut = raw.get(..raw.len() / 2).unwrap();
+        assert!(matches!(ImageBudget::with_work(u64::MAX).decode_chain(&chain, cut, 1 << 20), Err(FilterError::Corrupt { .. })), "strictly");
+    }
+
+    /// An image read through its filters alone reads parameters given by reference, is charged, and
+    /// is refused like the others. It isn't given to a decoder.
+    #[test]
+    fn filters_alone_are_charged_too() {
+        let mut doc = Document::new_empty();
+        let p = pdfcraft_filters::Params { predictor: 12, columns: 4, ..pdfcraft_filters::Params::default() };
+        let rows = vec![7u8; 400];
+        let mut parms = Dict::new();
+        parms.set(b"Predictor".to_vec(), Object::Int(12));
+        parms.set(b"Columns".to_vec(), Object::Int(4));
+        let parms = doc.add(Object::Dict(parms));
+        let mut dict = Dict::new();
+        dict.set(b"Filter".to_vec(), Object::name("FlateDecode"));
+        dict.set(b"DecodeParms".to_vec(), Object::Ref(parms));
+        let raw = pdfcraft_filters::encode(&pdfcraft_filters::Filter::Flate, &p, &rows).unwrap();
+        let image = Stream::from_raw(dict, raw);
+        let mut budget = ImageBudget::with_work(u64::MAX);
+        assert_eq!(budget.decode_filters(&doc, &image, 1 << 20).unwrap(), rows);
+        let cost = u64::MAX - budget.work_left();
+        // The tag byte of each of its 100 rows counts, which the predictor takes off.
+        assert_eq!(cost, (image.raw.len() + rows.len() + 100) as u64);
+        let mut budget = ImageBudget::with_work(cost - 1);
+        assert!(budget.decode_filters(&doc, &image, 1 << 20).is_err());
+        assert_eq!((budget.work_left(), budget.refused()), (0, 1));
+        let mut budget = ImageBudget::with_work(u64::MAX);
+        assert!(budget.decode_filters(&doc, &jbig2(None), 1 << 20).is_err());
+        assert_eq!(budget.work_left(), u64::MAX, "no decoder here, so nothing was read");
+        // Nor for a fax image, nor for a decoder that isn't last, however large they say they are.
+        for chain in [vec!["CCITTFaxDecode"], vec!["CCITTFaxDecode", "FlateDecode"], vec!["JBIG2Decode", "FlateDecode"]] {
+            let mut dict = Dict::new();
+            dict.set(b"Width".to_vec(), Object::Int(1000));
+            dict.set(b"Height".to_vec(), Object::Int(1000));
+            dict.set(b"Filter".to_vec(), Object::Array(chain.iter().map(|f| Object::name(f)).collect()));
+            let image = Stream::from_raw(dict, b"data".to_vec());
+            let mut budget = ImageBudget::with_work(u64::MAX);
+            assert!(budget.decode_filters(&doc, &image, 1 << 20).is_err());
+            assert_eq!(budget.work_left(), u64::MAX, "{chain:?}");
+        }
+        // Through `decode` a decoder that isn't last pays nothing either; one that is does.
+        let mut dict = Dict::new();
+        dict.set(b"Width".to_vec(), Object::Int(1000));
+        dict.set(b"Height".to_vec(), Object::Int(1000));
+        dict.set(b"Filter".to_vec(), Object::Array(vec![Object::name("JBIG2Decode"), Object::name("FlateDecode")]));
+        let mut budget = ImageBudget::with_work(u64::MAX);
+        assert!(budget.decode(&doc, &Stream::from_raw(dict, b"data".to_vec()), 1 << 20).is_err());
+        assert_eq!(budget.work_left(), u64::MAX);
+    }
+
+    /// The images of a file share its globals, so an image refused doesn't read them: this one's
+    /// can't be read, which is how to tell.
+    #[test]
+    fn an_image_past_the_allowance_does_not_read_its_globals() {
+        let mut doc = Document::new_empty();
+        let mut unreadable = Dict::new();
+        unreadable.set(b"Filter".to_vec(), Object::name("NoSuchFilter"));
+        let globals = doc.add(Object::Stream(Stream::from_raw(unreadable, b"data".to_vec())));
+        let mut parms = Dict::new();
+        parms.set(b"JBIG2Globals".to_vec(), Object::Ref(globals));
+        let image = jbig2(Some(Object::Dict(parms)));
+        let read = ImageBudget::with_work(u64::MAX).decode(&doc, &image, 1 << 20).unwrap_err().to_string();
+        assert!(read.contains("globals"), "{read}");
+        let refused = ImageBudget::with_work(0).decode(&doc, &image, 1 << 20).unwrap_err().to_string();
+        assert!(refused.contains("more image decoding than"), "{refused}");
+    }
+
+    /// A longer file gets more, by its length, and an empty one the fixed part.
+    #[test]
+    fn a_longer_file_allows_more_decoding() {
+        assert_eq!(ImageBudget::new(&Document::new_empty()).work_left(), IMAGE_WORK);
+        let pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog >> endobj\ntrailer << /Root 1 0 R >>\n%%EOF".to_vec();
+        let len = pdf.len() as u64;
+        let doc = Document::open(std::sync::Arc::new(pdf)).unwrap();
+        assert_eq!(ImageBudget::new(&doc).work_left(), IMAGE_WORK + len * IMAGE_WORK_PER_BYTE);
+    }
+
+    /// A document made in memory, as Combine, Create and inserted scans make one, gets for the
+    /// streams it was given what it would get for them once saved: what isn't a stream adds nothing.
+    #[test]
+    fn streams_made_in_memory_allow_more_decoding_too() {
+        let mut doc = Document::new_empty();
+        doc.add(Object::Stream(Stream::from_raw(Dict::new(), vec![0; 3000])));
+        doc.add(Object::Dict(Dict::new()));
+        doc.add(Object::Stream(Stream::flate(Dict::new(), &[1; 100])));
+        let flate = pdfcraft_filters::encode_flate(&[1; 100]).len() as u64;
+        assert_eq!(ImageBudget::new(&doc).work_left(), IMAGE_WORK + (3000 + flate) * IMAGE_WORK_PER_BYTE);
+        // A stream of an opened file changed in memory counts with the file.
+        let pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog >> endobj\ntrailer << /Root 1 0 R >>\n%%EOF".to_vec();
+        let len = pdf.len() as u64;
+        let mut doc = Document::open(std::sync::Arc::new(pdf)).unwrap();
+        doc.add(Object::Stream(Stream::from_raw(Dict::new(), vec![0; 500])));
+        assert_eq!(ImageBudget::new(&doc).work_left(), IMAGE_WORK + (len + 500) * IMAGE_WORK_PER_BYTE);
+    }
+
+    // What the constants' comments promise, for a page scanned at 300 dpi: about 1,000 of them
+    // whatever the file's size, and a page paying for itself with 2 KB of the file.
+    const PAGE: u64 = 17_000_000;
+    const _: () = assert!(IMAGE_WORK >= 1_000 * PAGE);
+    const _: () = assert!(IMAGE_WORK_PER_BYTE * 2_100 >= PAGE);
+    // And that a stream can be decoded about 8 times at Flate's best, 1,032 to one, and the byte in.
+    const _: () = assert!(IMAGE_WORK_PER_BYTE >= 7 * 1_033);
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -198,6 +795,21 @@ mod tests {
         assert_eq!(budget.remaining(), (10 << 20) - partial);
     }
 
+    /// A stream that fails its reading as zlib, and then as raw deflate after decoding all of it,
+    /// gives nothing back, and each reference still pays for what it decoded.
+    #[test]
+    fn a_decode_that_gives_nothing_back_still_pays() {
+        let mut data = vec![0x78, 0x01, 0x06, 0xFE, 0xF9];
+        data.extend(vec![0u8; 0x0601]);
+        data.push(0x07);
+        let mut dict = Dict::new();
+        dict.set(b"Filter".to_vec(), Object::name("FlateDecode"));
+        let stream = Stream::from_raw(dict, data);
+        let mut budget = DecodeBudget::new(10 * 0x0601, 1);
+        assert!(budget.decode(&stream).unwrap().is_empty());
+        assert_eq!(budget.remaining(), 9 * 0x0601);
+    }
+
     /// A chain whose later stage shrinks the data pays for every stage's output: a Flate stage
     /// that inflates to hex text, which ASCIIHex then halves, charges both.
     #[test]
diff --git a/crates/cos/src/document.rs b/crates/cos/src/document.rs
index 0d9b84b749..082d1910d1 100644
--- a/crates/cos/src/document.rs
+++ b/crates/cos/src/document.rs
@@ -10,7 +10,7 @@ use std::collections::{BTreeMap, HashMap, HashSet};
 use std::sync::{Arc, Mutex, Weak};
 
 use crate::CosError;
-use crate::object::{Dict, MAX_DECODED, ObjRef, Object, Stream};
+use crate::object::{Dict, MAX_DECODED, MAX_JBIG2_GLOBALS, ObjRef, Object, Stream};
 use crate::parser::{EndstreamIndex, Lexer, is_whitespace, parse_indirect, parse_indirect_shared};
 
 mod objects;
@@ -49,6 +49,9 @@ pub struct Document {
     repair_log: Arc<Vec<String>>,
     cache: Arc<Mutex<HashMap<u32, Arc<Object>>>>,
     objstms: Arc<Mutex<HashMap<u32, Arc<ObjStm>>>>,
+    /// What `/JBIG2Globals` streams of the file decode to, by object number: the images of a scan
+    /// share them, and each would otherwise decode them again (see `Document::jbig2_globals`).
+    jbig2_globals: Arc<Mutex<HashMap<u32, Arc<Vec<u8>>>>>,
     stream_limit: usize,
     overlay: BTreeMap<u32, Slot>,
     next_num: u32,
diff --git a/crates/cos/src/document/objects.rs b/crates/cos/src/document/objects.rs
index 4f05d03ae0..2ac18cff03 100644
--- a/crates/cos/src/document/objects.rs
+++ b/crates/cos/src/document/objects.rs
@@ -1,7 +1,13 @@
 use super::reader::find;
 use super::state::{LENGTHS, LoadGuard, ObjStm, ObjectReader, ReadState, Slot, SourceIdentity, objstm_member, owned_bytes};
 use super::xref::{Revision, XrefEntry};
-use super::{Arc, CosError, Cow, Dict, Document, Lexer, MAX_DECODED, ObjRef, Object, Stream, is_whitespace, parse_indirect_shared};
+use super::{
+    Arc, CosError, Cow, Dict, Document, Lexer, MAX_DECODED, MAX_JBIG2_GLOBALS, ObjRef, Object, Stream, is_whitespace, parse_indirect_shared,
+};
+
+/// The most decoded `/JBIG2Globals` a document keeps for its images to share (see
+/// `Document::jbig2_globals`): two streams at [`MAX_JBIG2_GLOBALS`].
+const JBIG2_GLOBALS_HELD: usize = 2 * MAX_JBIG2_GLOBALS;
 
 impl Document {
     pub fn bytes(&self) -> &Arc<Vec<u8>> {
@@ -233,18 +239,7 @@ impl Document {
         if !matches!(chain.last(), Some((pdfcraft_filters::Filter::CcittFax, _))) {
             return None;
         }
-        // Its place in /Filter, /Crypt included, pairs it with its /DecodeParms entry (§7.4.1): the
-        // last filter but a /Crypt, which `filters` leaves out wherever it stands.
-        let index = match s.dict.get(b"Filter") {
-            Some(Object::Array(a)) => a.iter().rposition(|f| f.as_name() != Some(b"Crypt".as_slice())).unwrap_or(0),
-            _ => 0,
-        };
-        let parms = match s.dict.get(b"DecodeParms").map(|p| self.resolve(p)).as_deref() {
-            Some(Object::Array(a)) => a.get(index).and_then(|p| self.dict(p)),
-            Some(p) if index == 0 => p.as_dict().cloned(),
-            _ => None,
-        }
-        .unwrap_or_default();
+        let parms = self.last_filter_parms(s);
         let int = |key: &[u8], default: i64| parms.get(key).and_then(|v| self.resolve(v).as_int()).unwrap_or(default);
         let flag = |key: &[u8], default: bool| match parms.get(key).map(|v| self.resolve(v)).as_deref() {
             Some(Object::Bool(b)) => *b,
@@ -262,42 +257,129 @@ impl Document {
         })
     }
 
-    /// The samples of image `s`, decoded: through its filters ([`Stream::decoded`]), or, for a
-    /// CCITT fax image (its last filter), through the filters before it and then
-    /// [`pdfcraft_filters::decode_ccitt`] with its [`Document::fax_params`], as `CCITTFaxDecode`
-    /// gives them (ISO 32000-2 §7.4.6). Parameters given by reference count, for every filter
-    /// ([`Document::with_direct_parms`]). A fax image's `/Columns` has to be its `/Width`. Up to
-    /// its `/Height` rows are decoded, whatever `/Rows` says, within [`MAX_DECODED`] bytes; damaged
-    /// data gives fewer, so a caller checks it has the rows it needs.
-    pub fn decoded_image(&self, s: &Stream) -> Result<Vec<u8>, CosError> {
+    /// The `/DecodeParms` dictionary of stream `s`'s last filter, resolved: that of a lone filter,
+    /// or its entry in an array. Empty when there is none.
+    fn last_filter_parms(&self, s: &Stream) -> Dict {
+        // Its place in /Filter, /Crypt included, pairs it with its /DecodeParms entry (§7.4.1): the
+        // last filter but a /Crypt, which `filters` leaves out wherever it stands.
+        let index = match s.dict.get(b"Filter") {
+            Some(Object::Array(a)) => a.iter().rposition(|f| f.as_name() != Some(b"Crypt".as_slice())).unwrap_or(0),
+            _ => 0,
+        };
+        match s.dict.get(b"DecodeParms").map(|p| self.resolve(p)).as_deref() {
+            Some(Object::Array(a)) => a.get(index).and_then(|p| self.dict(p)),
+            Some(p) if index == 0 => p.as_dict().cloned(),
+            _ => None,
+        }
+        .unwrap_or_default()
+    }
+
+    /// [`Document::decoded_image_spending`] with no limit on the work, for tests of what an image
+    /// decodes to: everything else decodes images through an [`ImageBudget`](crate::ImageBudget).
+    #[cfg(test)]
+    pub(crate) fn decoded_image(&self, s: &Stream) -> Result<Vec<u8>, CosError> {
         self.decoded_image_within(s, MAX_DECODED)
     }
 
-    /// [`Document::decoded_image`] for an image whose decoding has a tighter bound than
-    /// [`MAX_DECODED`]: no stage, the filters before a fax decoder included, may produce more than
-    /// `max` bytes.
-    pub fn decoded_image_within(&self, s: &Stream, max: usize) -> Result<Vec<u8>, CosError> {
+    /// [`Document::decoded_image`] within `max` bytes.
+    #[cfg(test)]
+    pub(crate) fn decoded_image_within(&self, s: &Stream, max: usize) -> Result<Vec<u8>, CosError> {
+        let mut unbounded = u64::MAX;
+        self.decoded_image_spending(s, max, &mut unbounded)
+    }
+
+    /// The samples of image `s`, decoded within `max` bytes ([`MAX_DECODED`] at most), spending from
+    /// `work`: see [`ImageBudget::decode`](crate::ImageBudget::decode), the way in from outside this
+    /// crate, which says what this decodes and how.
+    pub(crate) fn decoded_image_spending(&self, s: &Stream, max: usize, work: &mut u64) -> Result<Vec<u8>, CosError> {
         let max = max.min(MAX_DECODED);
         let s = &*self.with_direct_parms(s);
-        let Some(p) = self.fax_params(s) else { return s.decoded_within(max) };
+        let filter = |e: pdfcraft_filters::FilterError| CosError::Filter(e.to_string());
+        let chain = s.readable_filters().map_err(filter)?;
+        // The filters before the image codec, such as ASCII85Decode, are undone first.
+        let undo = |before: &[(pdfcraft_filters::Filter, pdfcraft_filters::Params)], work: &mut u64| match before {
+            [] => Ok(Cow::Borrowed(&s.raw[..])),
+            _ => pdfcraft_filters::decode_tolerant_within(before, &s.raw, max, work).map(Cow::Owned).map_err(filter),
+        };
+        // `/Width` and `/Height` are read as given directly, as every caller reads them first: one
+        // given by reference has the image refused there, before it gets here.
+        let height = s.dict.int(b"Height").and_then(|h| u32::try_from(h).ok());
+        if let Some(((pdfcraft_filters::Filter::Jbig2, _), before)) = chain.split_last() {
+            let (Some(columns), Some(height)) = (s.dict.int(b"Width").and_then(|w| u32::try_from(w).ok()), height) else {
+                return Err(CosError::Filter("a JBIG2 image's /Width or /Height isn't a size".into()));
+            };
+            // Nothing to read for what can't be decoded: the images of a file share its globals.
+            let globals = if *work == 0 { None } else { self.jbig2_globals(s, work)? };
+            let data = if *work == 0 { Cow::Borrowed(&[][..]) } else { undo(before, work)? };
+            return pdfcraft_filters::decode_jbig2_within(&data, globals.as_deref().map(Vec::as_slice), columns, height, max, work).map_err(filter);
+        }
+        let Some(p) = self.fax_params(s) else { return s.decoded_spending(max, work) };
         // As many rows as the image has: a /Rows below /Height would cut the picture short, and
         // rows past /Height aren't drawn.
         let p = pdfcraft_filters::CcittParams { rows: 0, ..p };
         if s.dict.int(b"Width") != Some(p.columns) {
             return Err(CosError::Filter("a fax image's /Columns aren't its /Width".into()));
         }
-        let height = s.dict.int(b"Height").and_then(|h| u32::try_from(h).ok()).unwrap_or(0);
         let stride = usize::try_from(p.columns).unwrap_or(usize::MAX).div_ceil(8).max(1);
-        let rows = u32::try_from(max / stride).unwrap_or(u32::MAX).min(height);
-        // The filters before it, such as ASCII85Decode, are undone first.
-        let chain = s.readable_filters().map_err(|e| CosError::Filter(e.to_string()))?;
-        let data = match chain.split_last() {
-            Some((_, before)) if !before.is_empty() => {
-                Cow::Owned(pdfcraft_filters::decode_tolerant(before, &s.raw, max).map_err(|e| CosError::Filter(e.to_string()))?.0)
-            }
-            _ => Cow::Borrowed(&s.raw[..]),
+        let rows = u32::try_from(max / stride).unwrap_or(u32::MAX).min(height.unwrap_or(0));
+        let data = undo(chain.split_last().map_or(&[][..], |(_, before)| before), work)?;
+        pdfcraft_filters::decode_ccitt_within(&data, &p, rows, work).map_err(filter)
+    }
+
+    /// The `/JBIG2Globals` stream a JBIG2 image `s` names by reference in its last filter's
+    /// `/DecodeParms`: `None` for a stream whose last filter isn't `JBIG2Decode`, or one without
+    /// globals. Redaction finds with it the other images that share a redacted image's globals.
+    pub fn jbig2_globals_ref(&self, s: &Stream) -> Option<ObjRef> {
+        let chain = s.readable_filters().ok()?;
+        if !matches!(chain.last(), Some((pdfcraft_filters::Filter::Jbig2, _))) {
+            return None;
+        }
+        self.last_filter_parms(s).get(b"JBIG2Globals").and_then(Object::as_ref)
+    }
+
+    /// What the `/JBIG2Globals` stream of JBIG2 image `s` (in its last filter's `/DecodeParms`)
+    /// decodes to, within [`MAX_JBIG2_GLOBALS`]; `None` without one (a reference to no object is
+    /// one to null, ISO 32000-2 §7.3.10, which is an absent entry, §7.3.7). The image is then read
+    /// without them, as the renderer draws it, so an image that needed them mostly fails to decode
+    /// and can decode to other pixels. A stream that is there and can't be read is an error, rather
+    /// than the image decoded without it.
+    ///
+    /// The images of a scan share one globals stream, so a stream of the file, not edited since
+    /// it was read (the same in every clone) and with its `/DecodeParms` direct (by reference they
+    /// are another object, which can change while this one doesn't), has its filters undone once a
+    /// document and is kept, up to [`JBIG2_GLOBALS_HELD`] in all; others are read each time. That
+    /// saves the filters only: the segments it holds are decoded again for every image. Undoing
+    /// the filters spends from `work`, so globals read for every image pay every time.
+    fn jbig2_globals(&self, s: &Stream, work: &mut u64) -> Result<Option<Arc<Vec<u8>>>, CosError> {
+        let Some(entry) = self.last_filter_parms(s).get(b"JBIG2Globals").cloned() else { return Ok(None) };
+        let held = match entry {
+            Object::Ref(r) if !self.overlay.contains_key(&r.num) => Some(r.num),
+            _ => None,
         };
-        pdfcraft_filters::decode_ccitt(&data, &p, rows).map_err(|e| CosError::Filter(e.to_string()))
+        if let Some(hit) = held.and_then(|num| self.jbig2_globals.lock().ok()?.get(&num).cloned()) {
+            return Ok(Some(hit));
+        }
+        let Object::Stream(g) = &*self.resolve(&entry) else { return Ok(None) };
+        let readable = self.with_direct_parms(g);
+        let held = held.filter(|_| matches!(readable, Cow::Borrowed(_)));
+        let mut data = readable.decoded_spending(MAX_JBIG2_GLOBALS, work).map_err(|e| {
+            let detail = match e {
+                CosError::Filter(detail) => detail,
+                e => e.to_string(),
+            };
+            CosError::Filter(format!("the JBIG2 globals can't be read: {detail}"))
+        })?;
+        // What is kept counts by its length, so that's all it may hold on to.
+        data.shrink_to_fit();
+        let data = Arc::new(data);
+        // A poisoned lock only means nothing is kept.
+        if let (Some(num), Ok(mut kept)) = (held, self.jbig2_globals.lock()) {
+            let total = kept.values().map(|g| g.len()).fold(data.len(), usize::saturating_add);
+            if total <= JBIG2_GLOBALS_HELD {
+                kept.insert(num, data.clone());
+            }
+        }
+        Ok(Some(data))
     }
 
     pub fn try_get(&self, num: u32) -> Result<Arc<Object>, CosError> {
diff --git a/crates/cos/src/document/open.rs b/crates/cos/src/document/open.rs
index 57d697ed66..395424b771 100644
--- a/crates/cos/src/document/open.rs
+++ b/crates/cos/src/document/open.rs
@@ -19,6 +19,7 @@ impl Document {
             repair_log: Arc::new(Vec::new()),
             cache: Arc::default(),
             objstms: Arc::default(),
+            jbig2_globals: Arc::default(),
             stream_limit: crate::object::MAX_DECODED,
             overlay: BTreeMap::new(),
             next_num: 1,
@@ -102,6 +103,7 @@ impl Document {
             repair_log: Arc::new(Vec::new()),
             cache: Arc::default(),
             objstms: Arc::default(),
+            jbig2_globals: Arc::default(),
             stream_limit: stream_limit.min(crate::object::MAX_DECODED),
             overlay: BTreeMap::new(),
             next_num: 1,
diff --git a/crates/cos/src/document/tests.rs b/crates/cos/src/document/tests.rs
index f5e36f9c83..cca4b87326 100644
--- a/crates/cos/src/document/tests.rs
+++ b/crates/cos/src/document/tests.rs
@@ -173,6 +173,217 @@ fn fax_images_decode_with_their_parameters() {
     assert!(behind(&[Object::Int(5), fax], &[null, own], coded.clone()).is_err(), "a /Filter entry that isn't a name");
 }
 
+/// Images that share a `/JBIG2Globals` stream of the file decode it once a document: it is kept
+/// for the next, in every clone. A globals stream edited since is read afresh (the kept one is the
+/// file's), and objects added in memory aren't kept.
+#[test]
+fn shared_jbig2_globals_are_read_once() {
+    let bits = [0b1111_1000, 0, 0b1111_1000, 0, 0b1111_1000, 0];
+    let coded = pdfcraft_filters::encode_jbig2_generic(&bits, 10, 3).unwrap();
+    let mut doc = Document::new_empty();
+    let mut d = Dict::new();
+    d.set(b"Filter".to_vec(), Object::name("FlateDecode"));
+    let skipped = [0, 0, 0, 0, 0x3E, 0, 0, 0, 0, 0, 4, 0, 0, 0, 1];
+    let globals = doc.add(Object::Stream(Stream::from_raw(d, pdfcraft_filters::encode_flate(&skipped))));
+    let image = |doc: &mut Document| {
+        let mut d = Dict::new();
+        d.set(b"Width".to_vec(), Object::Int(10));
+        d.set(b"Height".to_vec(), Object::Int(3));
+        d.set(b"Filter".to_vec(), Object::name("JBIG2Decode"));
+        let mut parms = Dict::new();
+        parms.set(b"JBIG2Globals".to_vec(), Object::Ref(globals));
+        d.set(b"DecodeParms".to_vec(), Object::Dict(parms));
+        doc.add(Object::Stream(Stream::from_raw(d, coded.clone())))
+    };
+    let (a, b) = (image(&mut doc), image(&mut doc));
+    let stream = |doc: &Document, r: ObjRef| match &*doc.get(r) {
+        Object::Stream(s) => s.clone(),
+        _ => panic!("not a stream"),
+    };
+    assert_eq!(doc.decoded_image(&stream(&doc, a)).unwrap(), bits);
+    assert!(doc.jbig2_globals.lock().unwrap().is_empty(), "an object added in memory isn't kept");
+
+    // The same objects read from a file, the catalog holding on to the images (a full save may
+    // number them anew).
+    let root = doc.root().unwrap();
+    doc.update_dict(root, |c| c.set(b"Images".to_vec(), Object::Array(vec![Object::Ref(a), Object::Ref(b)]))).unwrap();
+    let file = crate::write_full(&doc, &crate::SaveOptions::default()).unwrap();
+    let mut doc = Document::open(Arc::new(file)).unwrap();
+    let images = doc.get(doc.root().unwrap()).as_dict().unwrap().get(b"Images").unwrap().as_array().unwrap().clone();
+    let (a, b) = (images[0].as_ref().unwrap(), images[1].as_ref().unwrap());
+    let parms = stream(&doc, a).dict.get(b"DecodeParms").unwrap().as_dict().unwrap().clone();
+    let globals = parms.reference(b"JBIG2Globals").unwrap();
+    let clone = doc.clone();
+    assert_eq!(doc.decoded_image(&stream(&doc, a)).unwrap(), bits);
+    assert_eq!(doc.jbig2_globals.lock().unwrap().len(), 1, "kept");
+    let kept = doc.jbig2_globals.lock().unwrap()[&globals.num].clone();
+    assert_eq!(clone.decoded_image(&stream(&clone, b)).unwrap(), bits, "the clone's other image");
+    let shared = clone.jbig2_globals.lock().unwrap()[&globals.num].clone();
+    assert!(Arc::ptr_eq(&kept, &shared), "the clone uses the one kept, not a second decode");
+    doc.set(globals, Object::Stream(Stream::from_raw(Dict::new(), b"not JBIG2".to_vec())));
+    assert!(doc.decoded_image(&stream(&doc, b)).is_err(), "the edited globals are read afresh");
+    assert_eq!(clone.decoded_image(&stream(&clone, b)).unwrap(), bits, "the clone keeps the file's");
+}
+
+/// A JBIG2 image's size is read as given directly, as every caller reads it first, and an image
+/// with neither is an error, not an image of no rows.
+#[test]
+fn a_jbig2_image_needs_its_size_given_directly() {
+    let coded = pdfcraft_filters::encode_jbig2_generic(&[0xFF, 0xFF], 8, 2).unwrap();
+    let mut doc = Document::new_empty();
+    let size = doc.add(Object::Int(2));
+    let image = |width: Object, height: Object| {
+        let mut d = Dict::new();
+        d.set(b"Width".to_vec(), width);
+        d.set(b"Height".to_vec(), height);
+        d.set(b"Filter".to_vec(), Object::name("JBIG2Decode"));
+        doc.decoded_image(&Stream::from_raw(d, coded.clone()))
+    };
+    assert!(image(Object::Int(8), Object::Int(2)).is_ok());
+    assert!(image(Object::Ref(size), Object::Int(2)).is_err(), "/Width by reference");
+    assert!(image(Object::Int(8), Object::Ref(size)).is_err(), "/Height by reference");
+}
+
+/// A document that kept globals of 64 MiB keeps no more, and the images past that still read:
+/// three streams of 22 MiB, shared by three images, are two kept and one decoded each time.
+#[test]
+fn kept_jbig2_globals_are_bounded_in_total() {
+    let bits = [0b1111_1000, 0, 0b1111_1000, 0, 0b1111_1000, 0];
+    let coded = pdfcraft_filters::encode_jbig2_generic(&bits, 10, 3).unwrap();
+    let length = 22 * 1024 * 1024;
+    let mut skipped = vec![0, 0, 0, 0, 0x3E, 0, 0];
+    skipped.extend_from_slice(&u32::try_from(4 + length).unwrap().to_be_bytes());
+    skipped.extend_from_slice(&[0, 0, 0, 1]);
+    skipped.resize(skipped.len() + length, 0);
+    let mut doc = Document::new_empty();
+    let mut images = Vec::new();
+    for _ in 0..3 {
+        let mut d = Dict::new();
+        d.set(b"Filter".to_vec(), Object::name("FlateDecode"));
+        let globals = doc.add(Object::Stream(Stream::from_raw(d, pdfcraft_filters::encode_flate(&skipped))));
+        let mut d = Dict::new();
+        d.set(b"Width".to_vec(), Object::Int(10));
+        d.set(b"Height".to_vec(), Object::Int(3));
+        d.set(b"Filter".to_vec(), Object::name("JBIG2Decode"));
+        let mut parms = Dict::new();
+        parms.set(b"JBIG2Globals".to_vec(), Object::Ref(globals));
+        d.set(b"DecodeParms".to_vec(), Object::Dict(parms));
+        images.push(Object::Ref(doc.add(Object::Stream(Stream::from_raw(d, coded.clone())))));
+    }
+    let root = doc.root().unwrap();
+    doc.update_dict(root, |c| c.set(b"Images".to_vec(), Object::Array(images))).unwrap();
+    let doc = Document::open(Arc::new(crate::write_full(&doc, &crate::SaveOptions::default()).unwrap())).unwrap();
+    let images = doc.get(doc.root().unwrap()).as_dict().unwrap().get(b"Images").unwrap().as_array().unwrap().clone();
+    for image in &images {
+        let Object::Stream(s) = &*doc.get(image.as_ref().unwrap()) else { panic!("not a stream") };
+        assert_eq!(doc.decoded_image(s).unwrap(), bits, "every image reads");
+    }
+    let kept = doc.jbig2_globals.lock().unwrap();
+    assert_eq!(kept.len(), 2, "two fit in 64 MiB, a third doesn't");
+    assert!(kept.values().all(|g| g.capacity() == g.len()), "what is kept holds no more than it counts");
+}
+
+/// Globals whose `/DecodeParms` are given by reference aren't kept: that's another object, so
+/// editing it changes what they decode to while the stream itself, the key kept by, stays the same.
+#[test]
+fn jbig2_globals_with_parameters_by_reference_are_read_afresh() {
+    let bits = [0b1111_1000, 0, 0b1111_1000, 0, 0b1111_1000, 0];
+    let coded = pdfcraft_filters::encode_jbig2_generic(&bits, 10, 3).unwrap();
+    let skipped = [0, 0, 0, 0, 0x3E, 0, 0, 0, 0, 0, 4, 0, 0, 0, 1];
+    let params = pdfcraft_filters::Params { predictor: 12, colors: 1, bits_per_component: 8, columns: 15, early_change: 1 };
+    let mut doc = Document::new_empty();
+    let mut parms = Dict::new();
+    parms.set(b"Predictor".to_vec(), Object::Int(12));
+    parms.set(b"Columns".to_vec(), Object::Int(15));
+    let parms = doc.add(Object::Dict(parms));
+    let mut d = Dict::new();
+    d.set(b"Filter".to_vec(), Object::name("FlateDecode"));
+    d.set(b"DecodeParms".to_vec(), Object::Ref(parms));
+    let predicted = pdfcraft_filters::encode(&pdfcraft_filters::Filter::Flate, &params, &skipped).unwrap();
+    let globals = doc.add(Object::Stream(Stream::from_raw(d, predicted)));
+    let mut d = Dict::new();
+    d.set(b"Width".to_vec(), Object::Int(10));
+    d.set(b"Height".to_vec(), Object::Int(3));
+    d.set(b"Filter".to_vec(), Object::name("JBIG2Decode"));
+    let mut image_parms = Dict::new();
+    image_parms.set(b"JBIG2Globals".to_vec(), Object::Ref(globals));
+    d.set(b"DecodeParms".to_vec(), Object::Dict(image_parms));
+    let image = doc.add(Object::Stream(Stream::from_raw(d, coded)));
+    let root = doc.root().unwrap();
+    doc.update_dict(root, |c| c.set(b"Image".to_vec(), Object::Ref(image))).unwrap();
+    let mut doc = Document::open(Arc::new(crate::write_full(&doc, &crate::SaveOptions::default()).unwrap())).unwrap();
+    let image = doc.get(doc.root().unwrap()).as_dict().unwrap().reference(b"Image").unwrap();
+    let stream = |doc: &Document| match &*doc.get(image) {
+        Object::Stream(s) => s.clone(),
+        _ => panic!("not a stream"),
+    };
+    assert_eq!(doc.decoded_image(&stream(&doc)).unwrap(), bits);
+    assert!(doc.jbig2_globals.lock().unwrap().is_empty(), "not kept");
+    let globals = stream(&doc).dict.get(b"DecodeParms").unwrap().as_dict().unwrap().reference(b"JBIG2Globals").unwrap();
+    let Object::Stream(g) = &*doc.get(globals) else { panic!("not a stream") };
+    let parms = g.dict.reference(b"DecodeParms").unwrap();
+    doc.set(parms, Object::Dict(Dict::new()));
+    assert!(doc.decoded_image(&stream(&doc)).is_err(), "without the predictor they read otherwise");
+}
+
+/// A JBIG2 image reads through its decoder, behind other filters too, with the `/JBIG2Globals` of
+/// its own `/DecodeParms` (a dictionary or its place in an array, /Crypt counting, by reference
+/// too): globals that can't be read are an error, and ones at another filter's place aren't its
+/// own, nor are those of a lone dictionary when other filters come first. Its page has to be its
+/// /Width × /Height, and fit the bound.
+#[test]
+fn jbig2_images_decode_with_their_globals() {
+    // 10 × 3: the first five samples of each row white, the rest black.
+    let bits = [0b1111_1000, 0, 0b1111_1000, 0, 0b1111_1000, 0];
+    let coded = pdfcraft_filters::encode_jbig2_generic(&bits, 10, 3).unwrap();
+    let hex = coded.iter().map(|b| format!("{b:02x}")).chain([">".to_string()]).collect::<String>().into_bytes();
+    let mut doc = Document::new_empty();
+    // An extension segment (ISO/IEC 14492 7.4.14), which a decoder skips, Flate-encoded; and data
+    // that isn't JBIG2.
+    let globals = |doc: &mut Document, data: &[u8]| {
+        let mut d = Dict::new();
+        d.set(b"Filter".to_vec(), Object::name("FlateDecode"));
+        let globals = doc.add(Object::Stream(Stream::from_raw(d, pdfcraft_filters::encode_flate(data))));
+        let mut parms = Dict::new();
+        parms.set(b"JBIG2Globals".to_vec(), Object::Ref(globals));
+        Object::Dict(parms)
+    };
+    let (good, bad) = (globals(&mut doc, &[0, 0, 0, 0, 0x3E, 0, 0, 0, 0, 0, 4, 0, 0, 0, 1]), globals(&mut doc, b"not JBIG2"));
+    let indirect = Object::Ref(doc.add(bad.clone()));
+    let image = |filters: &[&str], parms: Option<Object>, data: &[u8], (width, height): (i64, i64), max: usize| {
+        let mut d = Dict::new();
+        d.set(b"Width".to_vec(), Object::Int(width));
+        d.set(b"Height".to_vec(), Object::Int(height));
+        d.set(b"Filter".to_vec(), Object::Array(filters.iter().map(|f| Object::name(f)).collect()));
+        if let Some(p) = parms {
+            d.set(b"DecodeParms".to_vec(), p);
+        }
+        doc.decoded_image_within(&Stream::from_raw(d, data.to_vec()), max)
+    };
+    let jbig2 = ["JBIG2Decode"];
+    let full = (10, 3);
+    assert_eq!(image(&jbig2, None, &coded, full, MAX_DECODED).unwrap(), bits);
+    assert_eq!(image(&jbig2, Some(good.clone()), &coded, full, MAX_DECODED).unwrap(), bits, "globals it skips");
+    for parms in [bad.clone(), Object::Array(vec![bad.clone()]), indirect.clone(), Object::Array(vec![indirect])] {
+        let e = image(&jbig2, Some(parms.clone()), &coded, full, MAX_DECODED).unwrap_err();
+        assert!(e.to_string().contains("JBIG2"), "{parms:?}: {e}");
+    }
+    let behind = ["ASCIIHexDecode", "JBIG2Decode"];
+    assert_eq!(image(&behind, None, &hex, full, MAX_DECODED).unwrap(), bits, "behind ASCIIHexDecode");
+    assert!(image(&behind, Some(Object::Array(vec![Object::Null, bad.clone()])), &hex, full, MAX_DECODED).is_err(), "its own globals");
+    assert_eq!(image(&behind, Some(Object::Array(vec![bad.clone(), Object::Null])), &hex, full, MAX_DECODED).unwrap(), bits, "another's");
+    assert_eq!(image(&behind, Some(bad.clone()), &hex, full, MAX_DECODED).unwrap(), bits, "a lone dictionary, the first filter's");
+    let after_crypt = ["Crypt", "JBIG2Decode"];
+    assert!(image(&after_crypt, Some(Object::Array(vec![Object::Null, bad.clone()])), &coded, full, MAX_DECODED).is_err(), "after /Crypt");
+    assert_eq!(image(&after_crypt, Some(Object::Array(vec![bad, Object::Null])), &coded, full, MAX_DECODED).unwrap(), bits, "/Crypt's");
+
+    for size in [(11, 3), (9, 3), (10, 2), (10, 4)] {
+        assert!(image(&jbig2, None, &coded, size, MAX_DECODED).is_err(), "a page other than {size:?}");
+    }
+    assert_eq!(image(&jbig2, None, &coded, full, 6).unwrap(), bits, "the page within the bound");
+    assert!(image(&jbig2, None, &coded, full, 5).is_err(), "the page past the bound");
+}
+
 #[test]
 fn a_missing_file_id_is_derived_from_the_encryption_seed() {
     let mut doc = Document::new_empty();
diff --git a/crates/cos/src/lib.rs b/crates/cos/src/lib.rs
index f3be66b9a1..6187acb846 100644
--- a/crates/cos/src/lib.rs
+++ b/crates/cos/src/lib.rs
@@ -22,10 +22,10 @@ mod parser;
 mod security;
 mod writer;
 
-pub use budget::{DecodeBudget, MAX_PAGE_DECODED, MAX_PAGE_FORMS};
+pub use budget::{DecodeBudget, ImageBudget, MAX_PAGE_DECODED, MAX_PAGE_FORMS};
 pub use bytes::Bytes;
 pub use document::{Document, ReadState, Revision, SourceIdentity, XrefEntry};
-pub use object::{Dict, MAX_DECODED, Name, ObjRef, Object, PdfString, Stream};
+pub use object::{Dict, MAX_DECODED, MAX_JBIG2_GLOBALS, Name, ObjRef, Object, PdfString, Stream};
 pub use parser::{Lexer, is_whitespace, parse_indirect};
 pub use pdfcraft_crypt::{
     Algorithm, Auth, Method as CryptMethod, NewEncryption, Permissions, SecurityHandler, effective_password, pdfdoc_byte, pdfdoc_char,
diff --git a/crates/cos/src/object.rs b/crates/cos/src/object.rs
index 17ee7844cf..5d437faa82 100644
--- a/crates/cos/src/object.rs
+++ b/crates/cos/src/object.rs
@@ -213,6 +213,12 @@ pub struct Stream {
 /// Upper bound for a single decoded stream (decompression-bomb defence).
 pub const MAX_DECODED: usize = 1 << 30;
 
+/// The most an image's `/JBIG2Globals` stream may decode to: the symbol and pattern dictionaries an
+/// encoder shares between pages, themselves coded, so far less than any stream may decode to
+/// ([`MAX_DECODED`]). They are decoded before the image's JBIG2 page is read, so the page's size
+/// can't bound them: they have a limit of their own.
+pub const MAX_JBIG2_GLOBALS: usize = 32 << 20;
+
 impl Stream {
     /// A new stream from already-encoded bytes (`/Length` is set at write time).
     pub fn from_raw(dict: Dict, raw: Vec<u8>) -> Self {
@@ -300,6 +306,14 @@ impl Stream {
         self.decode_chain(max, decode)
     }
 
+    /// [`Stream::decoded_within`] spending from `work`, what an operation may still do across a
+    /// document's images ([`pdfcraft_filters::decode_tolerant_within`]).
+    pub(crate) fn decoded_spending(&self, max: usize, work: &mut u64) -> Result<Vec<u8>, CosError> {
+        let filter = |e: pdfcraft_filters::FilterError| CosError::Filter(e.to_string());
+        let chain = self.readable_filters().map_err(filter)?;
+        pdfcraft_filters::decode_tolerant_within(&chain, &self.raw, max.min(MAX_DECODED), work).map_err(filter)
+    }
+
     /// The stream decoded through its filters by `decode`, or copied when it has none, within
     /// `max` and [`MAX_DECODED`].
     fn decode_chain(
diff --git a/crates/cos/src/writer.rs b/crates/cos/src/writer.rs
index 627f716495..cd0137f452 100644
--- a/crates/cos/src/writer.rs
+++ b/crates/cos/src/writer.rs
@@ -245,7 +245,7 @@ pub fn write_incremental(doc: &Document, opts: &SaveOptions) -> Result<Vec<u8>,
     if let Some(p) = prev {
         trailer.set(b"Prev".to_vec(), Object::Int(p as i64));
     }
-    let size = doc.next_num().max(trailer.int(b"Size").unwrap_or(0) as u32);
+    let size = doc.next_num().max(trailer.int(b"Size").map_or(0, |n| n.clamp(0, i64::from(u32::MAX)) as u32));
     if as_stream {
         let rows = offsets.iter().map(|(n, (o, g, used))| (*n, if *used { Row::InFile(*o, *g) } else { Row::Free(*g) })).collect();
         write_xref_stream(&mut out, base, &mut trailer, rows, size);
diff --git a/crates/cos/tests/it/writer.rs b/crates/cos/tests/it/writer.rs
index 1b98664255..eb03523189 100644
--- a/crates/cos/tests/it/writer.rs
+++ b/crates/cos/tests/it/writer.rs
@@ -228,6 +228,16 @@ fn incremental_save_keeps_a_trailer_only_edit() {
     assert_qpdf_clean(&saved);
 }
 
+#[test]
+fn incremental_save_ignores_a_negative_trailer_size() {
+    let mut doc = Document::open(Arc::new(classic_table())).unwrap();
+    doc.trailer_mut().set(b"Size".to_vec(), Object::Int(-1));
+    let next = doc.add(Object::Int(5)).num + 1;
+    let saved = write_incremental(&doc, &SaveOptions::default()).unwrap();
+    let back = Document::open(Arc::new(saved)).unwrap();
+    assert_eq!(back.trailer().int(b"Size"), Some(i64::from(next)));
+}
+
 /// What one edit added and a later one unlinked (a deleted comment, a cleared redaction mark) is
 /// not written: the file never held it, and writing it would keep what was removed. Additions the
 /// update still refers to, from the trailer or a changed object and through other additions, are.
diff --git a/crates/create/Cargo.toml b/crates/create/Cargo.toml
index b41caa2b88..51eca668d0 100644
--- a/crates/create/Cargo.toml
+++ b/crates/create/Cargo.toml
@@ -15,8 +15,6 @@ pdfcraft-model = { workspace = true }
 pdfcraft-fonts = { workspace = true }
 # For `image::bmp_with_pixel_offset`, shared with XFA pictures.
 pdfcraft-xfa = { workspace = true }
-# Already in the graph through hayro: decodes JBIG2 images for Export ▸ Images.
-hayro-jbig2.workspace = true
 png = "0.18"
 tiff = "0.11"
 image = { version = "0.25", default-features = false, features = ["bmp", "gif", "jpeg"] }
diff --git a/crates/create/README.md b/crates/create/README.md
index d359eed9ae..f72f70aa26 100644
--- a/crates/create/README.md
+++ b/crates/create/README.md
@@ -27,11 +27,14 @@ Layer L4. Create a PDF (Acrobat's Create a PDF tool), execution plan M10.2:
 Every function returns a `pdfcraft_cos::Document`; the caller writes it.
 
 Image export and Save Image As apply each lossless image's Decode pair before converting its color components.
-JBIG2 images and masks (JBIG2 as their only filter) are decoded with `hayro-jbig2`, their `/JBIG2Globals` included,
-as `JBIG2Decode` gives them: black as 0. An image whose JBIG2 page has another width than the image, or more
-pixels than an exported image may have, or whose globals decode to more than 32 MiB (they are decoded before the
-page's size is known, so they have a limit of their own), is skipped; such a mask is left out and the image
-exported opaque, as JPX and CCITT masks are.
+JBIG2 images and masks are decoded through `pdfcraft_cos::ImageBudget` (`pdfcraft_filters::decode_jbig2_within`), behind
+other filters too, with the `/JBIG2Globals` of their own `/DecodeParms` entry, as `JBIG2Decode` gives them: black as 0. An image
+whose JBIG2 page isn't its size (PdfCraft's renderer draws the whole page into the image; the page is refused before it is decoded),
+or whose globals can't be read or decode to more than 32 MiB (they are decoded before the page's size is known, so they have a
+limit of their own), is skipped, and such a mask is left out and the image exported opaque, as JPX and CCITT masks are.
+Past what one export may decode, which its images share, filters, decoders and pixels alike (`ImageBudget`; a JPEG when it has to be
+decoded, as a mask, to apply one, or to undo a CMYK file's inversion, and not when it is written as it is), an image is skipped, and so is one whose mask is past it, which would otherwise come out showing what the mask hides. An export also stops at 2 GiB of files held, or twice the document if that
+is more, since they stay in memory until it ends.
 Indexed Decode values select palette entries after rounding and clipping. Color-key masks compare the original samples.
 Missing, null or malformed Decode arrays keep the default mapping.
 Soft-mask Decode intervals map samples to opacity before the mask is resized, including reversed ranges and indirect entries.
@@ -43,4 +46,4 @@ CCITT fax images (Group 3 and 4) are decoded for export through `pdfcraft_cos::D
 `ASCII85Decode` too. Byte-aligned Group 3 rows are read by their end-of-line codes, whether the fill starts each code on a byte or
 ends it on one, when the data starts with one (T.4 sends one before the first row), and on bytes otherwise, whatever `/EndOfLine`
 says; data that comes up short is reported. Data with codes but none before the first row is read on bytes, and is reported or,
-at `/K 0`, may come out wrong. JPEG 2000 and JBIG2 images are still reported, not exported.
+at `/K 0`, may come out wrong. JPEG 2000 images are still reported, not exported.
diff --git a/crates/create/src/extract.rs b/crates/create/src/extract.rs
index b12bd50ec2..d5103071e6 100644
--- a/crates/create/src/extract.rs
+++ b/crates/create/src/extract.rs
@@ -6,7 +6,8 @@
 
 use std::collections::HashSet;
 
-use pdfcraft_cos::{Dict, Document, ObjRef, Object, Stream};
+use pdfcraft_cos::{Dict, Document, ImageBudget, MAX_DECODED, ObjRef, Object, Stream};
+use pdfcraft_filters::FilterError;
 
 /// One image, ready to write.
 #[derive(Clone, Debug, PartialEq)]
@@ -31,12 +32,29 @@ pub struct ImageExport {
 /// Images larger than this many pixels are skipped (memory).
 const MAX_PIXELS: u64 = 100_000_000;
 
+/// What one export may hold of the files it makes: they are all in memory until it ends, and a file
+/// of a few KB can make gigabytes of PNG. Images past it are left out, with the reason.
+const MAX_EXPORT_BYTES: usize = 2 << 30;
+
+/// What an export of a file of `file_bytes` may hold: twice the file if that is more than
+/// [`MAX_EXPORT_BYTES`], so that a file of large images is exported whole.
+pub(crate) fn export_bytes(file_bytes: usize) -> usize {
+    MAX_EXPORT_BYTES.max(file_bytes.saturating_mul(2))
+}
+
 /// The images of `pages` (0-based; each image once, on the first page using it), skipping
 /// those with fewer than `min_side` pixels on their shorter side.
 pub fn extract_images(doc: &Document, pages: &[usize], min_side: u32) -> ImageExport {
+    extract_images_within(doc, pages, min_side, &mut ImageBudget::new(doc), export_bytes(doc.bytes().len()))
+}
+
+/// [`extract_images`] within `budget`, and holding `max_bytes` of files. An image past either is
+/// left out, with the reason.
+pub(crate) fn extract_images_within(doc: &Document, pages: &[usize], min_side: u32, budget: &mut ImageBudget, max_bytes: usize) -> ImageExport {
     let all = pdfcraft_model::pages(doc);
     let mut out = ImageExport::default();
     let mut seen = HashSet::new();
+    let mut held = 0usize;
     for &p in pages {
         let Some(page) = all.get(p) else { continue };
         let mut refs = Vec::new();
@@ -53,8 +71,15 @@ pub fn extract_images(doc: &Document, pages: &[usize], min_side: u32) -> ImageEx
             if w <= 0 || h <= 0 || (w.min(h) as u64) < min_side as u64 {
                 continue;
             }
-            match image(doc, s) {
-                Ok((extension, data)) => out.images.push(ExtractedImage { page: p, object: r, width: w as u32, height: h as u32, extension, data }),
+            if held >= max_bytes {
+                out.skipped.push((p, r, "more images than one export can hold".into()));
+                continue;
+            }
+            match image(doc, s, budget) {
+                Ok((extension, data)) => {
+                    held = held.saturating_add(data.len());
+                    out.images.push(ExtractedImage { page: p, object: r, width: w as u32, height: h as u32, extension, data });
+                }
                 Err(why) => out.skipped.push((p, r, why)),
             }
         }
@@ -64,8 +89,13 @@ pub fn extract_images(doc: &Document, pages: &[usize], min_side: u32) -> ImageEx
 
 /// One image XObject as a file: JPEG as is, else PNG ("Save image as").
 pub fn image_file(doc: &Document, image: ObjRef) -> Result<(&'static str, Vec<u8>), String> {
+    image_file_within(doc, image, &mut ImageBudget::new(doc))
+}
+
+/// [`image_file`] within `budget`, for a caller making a file of many images.
+pub fn image_file_within(doc: &Document, image: ObjRef, budget: &mut ImageBudget) -> Result<(&'static str, Vec<u8>), String> {
     match &*doc.get(image) {
-        Object::Stream(s) if s.dict.name(b"Subtype") == Some(b"Image") => self::image(doc, s),
+        Object::Stream(s) if s.dict.name(b"Subtype") == Some(b"Image") => self::image(doc, s, budget),
         _ => Err("not an image".into()),
     }
 }
@@ -100,125 +130,24 @@ fn filters(s: &Stream) -> Vec<Vec<u8>> {
     }
 }
 
-/// The samples of image `s`, decoded: through its filters, with a `/DecodeParms` dictionary given
-/// by reference, or as an array's entry, or with numbers inside by reference, read too (a predictor
-/// given so would otherwise be lost), or, for a JBIG2 image
-/// (its only filter), through a JBIG2 decoder with its `/JBIG2Globals`, as rows of one-bit samples
-/// each starting on a byte, with black as 0, as `JBIG2Decode` gives them (ISO 32000-2 §7.4.7).
-fn decoded(doc: &Document, s: &Stream) -> Result<Vec<u8>, String> {
-    match filters(s).as_slice() {
-        [f] if f == b"JBIG2Decode" => jbig2(doc, s),
-        _ => doc.decoded_image(s).map_err(|e| e.to_string()),
-    }
-}
-
-/// The `/DecodeParms` of a stream with one filter: a dictionary, or the one in an array (7.4.2).
-fn decode_parms(doc: &Document, s: &Stream) -> Dict {
-    let Some(p) = s.dict.get(b"DecodeParms").map(|p| doc.resolve(p)) else { return Dict::default() };
-    let p = match &*p {
-        Object::Array(a) => match a.first() {
-            Some(first) => doc.resolve(first),
-            None => return Dict::default(),
-        },
-        _ => p,
-    };
-    p.as_dict().cloned().unwrap_or_default()
-}
-
-/// The most an image's `/JBIG2Globals` decode to: the symbol and pattern dictionaries an encoder
-/// shares between pages, themselves coded, so far less than any stream may decode to
-/// ([`pdfcraft_cos::MAX_DECODED`], 1 GiB). Globals past it refuse the image.
-const MAX_GLOBALS: usize = 32 << 20;
-
-/// [`decoded`] for a JBIG2 image. Its JBIG2 page has to be the image's width, which the caller
-/// checked against the export's size limit, and within that limit itself: the decoder decodes the
-/// whole page, rows past the image's height too, so a small `/Height` over a far taller page
-/// would cost more than the limit allows. Rows past the image's height are dropped, and too few
-/// rows are refused by the caller. Globals that can't be read refuse the image, rather than
-/// decoding it without them. They are decoded before the page's size is known, so the page's
-/// limit can't bound them; they have [`MAX_GLOBALS`] of their own.
-fn jbig2(doc: &Document, s: &Stream) -> Result<Vec<u8>, String> {
-    let globals = match decode_parms(doc, s).get(b"JBIG2Globals").map(|g| doc.resolve(g)).as_deref() {
-        Some(Object::Stream(g)) => {
-            Some(doc.with_direct_parms(g).decoded_within(MAX_GLOBALS).map_err(|e| format!("the JBIG2 globals can't be read: {e}"))?)
-        }
-        _ => None,
-    };
-    let image = hayro_jbig2::Image::new_embedded(&s.raw, globals.as_deref()).map_err(|e| format!("the JBIG2 image can't be read: {e}"))?;
-    if s.dict.int(b"Width") != Some(i64::from(image.width())) {
-        return Err("the JBIG2 image's width isn't the image's width".into());
-    }
-    if u64::from(image.width()).saturating_mul(u64::from(image.height())) > MAX_PIXELS {
-        return Err(format!("the JBIG2 page, {} × {}, is too large to export", image.width(), image.height()));
-    }
-    let height = s.dict.int(b"Height").and_then(|h| usize::try_from(h).ok()).unwrap_or(0);
-    let mut rows = Rows::new(image.width() as usize, height);
-    image.decode(&mut rows).map_err(|e| format!("the JBIG2 image can't be decoded: {e}"))?;
-    Ok(rows.out)
-}
-
-/// Rows of one-bit samples, each starting on a byte, filled from a decoder's pixels: `columns`
-/// a row and at most `rows` rows. Pixels past a row's end and rows past the last are dropped, so
-/// the output is bounded by the size the caller gave.
-struct Rows {
-    out: Vec<u8>,
-    row: Vec<u8>,
-    x: usize,
-    columns: usize,
-    rows: usize,
-    done: usize,
-}
-
-impl Rows {
-    fn new(columns: usize, rows: usize) -> Self {
-        Rows { out: Vec::new(), row: vec![0; columns.div_ceil(8)], x: 0, columns, rows, done: 0 }
-    }
-
-    /// `count` pixels, as 1 samples when `one`.
-    fn push(&mut self, one: bool, count: usize) {
-        let end = self.x.saturating_add(count);
-        if one {
-            for x in self.x..end.min(self.columns) {
-                if let Some(b) = self.row.get_mut(x / 8) {
-                    *b |= 0x80 >> (x % 8);
-                }
-            }
-        }
-        self.x = end;
-    }
-
-    fn end_row(&mut self) {
-        if self.done < self.rows {
-            self.out.extend_from_slice(&self.row);
-            self.done += 1;
-        }
-        self.row.fill(0);
-        self.x = 0;
-    }
-}
-
-/// JBIG2 codes black as 1, which `JBIG2Decode` gives as 0.
-impl hayro_jbig2::Decoder for Rows {
-    fn push_pixel(&mut self, black: bool) {
-        self.push(!black, 1);
-    }
-    fn push_pixel_chunk(&mut self, black: bool, chunks: u32) {
-        self.push(!black, (chunks as usize).saturating_mul(8));
-    }
-    fn next_line(&mut self) {
-        self.end_row();
-    }
+/// The samples of image `s`, decoded ([`ImageBudget::decode`]): through its filters, with a
+/// `/DecodeParms` dictionary given by reference, or as an array's entry, or with numbers inside by
+/// reference, read too (a predictor given so would otherwise be lost); a CCITT fax or JBIG2 image
+/// through its decoder too, behind other filters as well, a JBIG2 image with its `/JBIG2Globals`.
+/// A JBIG2 page has to be the image's size, which the caller checked against the export's limit,
+/// before the page is decoded.
+fn decoded(doc: &Document, s: &Stream, budget: &mut ImageBudget) -> Result<Vec<u8>, String> {
+    budget.decode(doc, s, MAX_DECODED).map_err(|e| e.to_string())
 }
 
 /// The file for one image: its JPEG data as is, or a PNG. An image with transparency (a soft
 /// mask, a stencil `/Mask` or a colour-key `/Mask`) is always a PNG with that transparency as
 /// alpha, JPEG images included, so cut-out images keep their transparent background.
-fn image(doc: &Document, s: &Stream) -> Result<(&'static str, Vec<u8>), String> {
+fn image(doc: &Document, s: &Stream, budget: &mut ImageBudget) -> Result<(&'static str, Vec<u8>), String> {
     let f = filters(s);
     let jpeg = matches!(f.last().map(Vec::as_slice), Some(b"DCTDecode" | b"DCT")) && f.len() == 1;
     match f.last().map(Vec::as_slice) {
         Some(b"JPXDecode") => return Err("JPEG 2000 images can't be exported yet".into()),
-        Some(b"JBIG2Decode") if f.len() > 1 => return Err("JBIG2 images inside other filters can't be exported yet".into()),
         Some(b"DCTDecode" | b"DCT") if !jpeg => return Err("JPEG images inside other filters can't be exported yet".into()),
         _ => {}
     }
@@ -233,14 +162,24 @@ fn image(doc: &Document, s: &Stream) -> Result<(&'static str, Vec<u8>), String>
     };
     let mask = s.dict.get(b"ImageMask").is_some_and(|m| matches!(&*doc.resolve(m), Object::Bool(true)));
     // A stencil mask (`ImageMask true`) has no /SMask or /Mask of its own (8.9.6.2).
-    let mut alpha = if mask { None } else { soft_mask(doc, s, w, h).or_else(|| stencil_mask(doc, s, w, h)) };
+    let refused = budget.refused();
+    let mut alpha = if mask { None } else { soft_mask(doc, s, w, h, budget).or_else(|| stencil_mask(doc, s, w, h, budget)) };
+    // Without its mask the image would come out opaque, showing what the mask hides.
+    if budget.refused() > refused {
+        return Err(FilterError::Spent.to_string());
+    }
     let key = if mask { None } else { colour_key(doc, s) };
     // Keep the existing JPEG and stencil-mask Decode handling separate from lossless colour images.
+    let endpoint = |value: Option<&Object>| value.map(|v| doc.resolve(v)).and_then(|v| v.as_f64()).filter(|v| v.is_finite());
     let inverted = (jpeg || mask)
         && s.dict
             .get(b"Decode")
             .map(|d| doc.resolve(d))
-            .and_then(|d| d.as_array().map(|a| a.first().and_then(Object::as_f64) > a.get(1).and_then(Object::as_f64)))
+            // Both ends have to be finite numbers, as for lossless images, or the default mapping stands.
+            .and_then(|d| {
+                let a = d.as_array()?;
+                Some(endpoint(a.first())? > endpoint(a.get(1))?)
+            })
             .unwrap_or(false);
     // In a PDF a CMYK JPEG's samples are ink amounts unless /Decode inverts them, while image
     // viewers read a CMYK JPEG file as inverted (Adobe's convention): as is, it would show as
@@ -251,13 +190,16 @@ fn image(doc: &Document, s: &Stream) -> Result<(&'static str, Vec<u8>), String>
     }
     let mut space = if mask { Space::Gray } else { space(doc, s.dict.get(b"ColorSpace"))? };
     let (samples, bpc) = if jpeg {
+        if !budget.pay_jpeg((w as u64).saturating_mul(h as u64).saturating_mul(space.components() as u64), &s.raw) {
+            return Err(FilterError::Spent.to_string());
+        }
         // Grey, RGB or CMYK samples (YCCK is converted); a JPEG that doesn't decode, or an
         // indexed one (not valid), is written as is, without its transparency.
         let Some((samples, decoded)) = jpeg_samples(&s.raw, &space, w, h) else { return as_is() };
         space = decoded;
         (samples, 8)
     } else {
-        let data = decoded(doc, s)?;
+        let data = decoded(doc, s, budget)?;
         let bpc = if mask { 1 } else { s.dict.int(b"BitsPerComponent").unwrap_or(8) };
         let bpc = match bpc {
             1 => 1,
@@ -348,6 +290,32 @@ fn size(w: i64, h: i64) -> Option<(usize, usize)> {
     (w > 0 && h > 0 && pixels <= MAX_PIXELS).then_some((w, h))
 }
 
+#[cfg(test)]
+thread_local! {
+    /// JPEGs decoded whole, for the tests that keep one from being decoded for nothing.
+    pub(crate) static JPEGS_DECODED: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
+}
+
+/// The size a JPEG's header gives, which is what decoding it goes by, whatever its dictionary
+/// says: an image of one pixel can hold a header of 500 megapixels.
+fn jpeg_size(data: &[u8]) -> Option<(usize, usize)> {
+    use zune_jpeg::zune_core::{bytestream::ZCursor, options::DecoderOptions};
+    let options = DecoderOptions::default().set_strict_mode(false).set_max_width(usize::from(u16::MAX)).set_max_height(usize::from(u16::MAX));
+    let mut dec = zune_jpeg::JpegDecoder::new_with_options(ZCursor::new(data), options);
+    dec.decode_headers().ok()?;
+    dec.dimensions()
+}
+
+/// JPEG `data`, decoded, if its header says it is `w` × `h`.
+fn jpeg_of_size(data: &[u8], w: usize, h: usize) -> Option<image::DynamicImage> {
+    if jpeg_size(data)? != (w, h) {
+        return None;
+    }
+    #[cfg(test)]
+    JPEGS_DECODED.with(|n| n.set(n.get() + 1));
+    image::load_from_memory_with_format(data, image::ImageFormat::Jpeg).ok()
+}
+
 /// A JPEG's samples (8 bits): grey for a grey image, CMYK as stored for a CMYK one, else RGB,
 /// with the space they are in.
 fn jpeg_samples(data: &[u8], space: &Space, w: usize, h: usize) -> Option<(Vec<u8>, Space)> {
@@ -356,10 +324,7 @@ fn jpeg_samples(data: &[u8], space: &Space, w: usize, h: usize) -> Option<(Vec<u
         Space::Cmyk => return cmyk_jpeg_samples(data, w, h).map(|px| (px, Space::Cmyk)),
         _ => {}
     }
-    let img = image::load_from_memory_with_format(data, image::ImageFormat::Jpeg).ok()?;
-    if img.width() as usize != w || img.height() as usize != h {
-        return None;
-    }
+    let img = jpeg_of_size(data, w, h)?;
     Some(match space {
         Space::Gray => (img.into_luma8().into_raw(), Space::Gray),
         _ => (img.into_rgb8().into_raw(), Space::Rgb),
@@ -560,32 +525,35 @@ fn cmyk(c: u8, m: u8, y: u8, k: u8) -> [u8; 3] {
 }
 
 /// The soft mask (`/SMask`) as 8-bit alpha, scaled to the image's size when it has another.
-fn soft_mask(doc: &Document, s: &Stream, w: usize, h: usize) -> Option<Vec<u8>> {
+fn soft_mask(doc: &Document, s: &Stream, w: usize, h: usize, budget: &mut ImageBudget) -> Option<Vec<u8>> {
     let r = s.dict.get(b"SMask")?.as_ref()?;
     let obj = doc.get(r);
     let Object::Stream(m) = &*obj else { return None };
-    gray_plane(doc, m, w, h)
+    gray_plane(doc, m, w, h, budget)
 }
 
 /// A stencil `/Mask` (an image mask stream, 8.9.6.3) as 8-bit alpha: its 1 samples (0 with
 /// `/Decode [1 0]`) hide the image.
-fn stencil_mask(doc: &Document, s: &Stream, w: usize, h: usize) -> Option<Vec<u8>> {
+fn stencil_mask(doc: &Document, s: &Stream, w: usize, h: usize, budget: &mut ImageBudget) -> Option<Vec<u8>> {
     let r = s.dict.get(b"Mask")?.as_ref()?;
     let obj = doc.get(r);
     let Object::Stream(m) = &*obj else { return None };
-    Some(gray_plane(doc, m, w, h)?.into_iter().map(|v| 255 - v).collect())
+    Some(gray_plane(doc, m, w, h, budget)?.into_iter().map(|v| 255 - v).collect())
 }
 
 /// A one-component mask image as 8-bit values (its `/Decode` interval applied), scaled to
 /// `w` × `h`. `None` when it can't be decoded (JPEG 2000 masks).
-fn gray_plane(doc: &Document, m: &Stream, w: usize, h: usize) -> Option<Vec<u8>> {
+fn gray_plane(doc: &Document, m: &Stream, w: usize, h: usize, budget: &mut ImageBudget) -> Option<Vec<u8>> {
     let (mw, mh) = size(m.dict.int(b"Width")?, m.dict.int(b"Height")?)?;
     let stencil = m.dict.get(b"ImageMask").is_some_and(|v| matches!(&*doc.resolve(v), Object::Bool(true)));
     let f = filters(m);
     let mut px = match f.last().map(Vec::as_slice) {
         Some(b"DCTDecode" | b"DCT") if f.len() == 1 => {
-            let img = image::load_from_memory_with_format(&m.raw, image::ImageFormat::Jpeg).ok()?.into_luma8();
-            (img.width() as usize == mw && img.height() as usize == mh).then(|| img.into_raw())?
+            // Past the allowance the image goes too: `image` sees this one refused.
+            if !budget.pay_jpeg((mw as u64).saturating_mul(mh as u64), &m.raw) {
+                return None;
+            }
+            jpeg_of_size(&m.raw, mw, mh)?.into_luma8().into_raw()
         }
         Some(b"DCTDecode" | b"DCT" | b"JPXDecode") => return None,
         _ => {
@@ -599,7 +567,7 @@ fn gray_plane(doc: &Document, m: &Stream, w: usize, h: usize) -> Option<Vec<u8>>
                 _ => return None,
             };
             let max = (1u32 << bpc.min(8)) - 1;
-            unpack(&decoded(doc, m).ok()?, mw, mh, 1, bpc)?.into_iter().map(|v| (v as u32 * 255 / max) as u8).collect()
+            unpack(&decoded(doc, m, budget).ok()?, mw, mh, 1, bpc)?.into_iter().map(|v| (v as u32 * 255 / max) as u8).collect()
         }
     };
     if let Some([lo, hi]) = decode(doc, m, 1).and_then(|pairs| pairs.first().copied()) {
@@ -612,7 +580,23 @@ fn gray_plane(doc: &Document, m: &Stream, w: usize, h: usize) -> Option<Vec<u8>>
         return Some(px);
     }
     let img = image::GrayImage::from_raw(mw as u32, mh as u32, px)?;
-    Some(image::imageops::resize(&img, w as u32, h as u32, image::imageops::FilterType::Triangle).into_raw())
+    Some(scaled(&img, w as u32, h as u32).into_raw())
+}
+
+/// `img` scaled to `w` × `h`. Scaling goes down first, through a buffer of `img`'s width by `h` at
+/// 16 bytes a pixel, which a mask of other proportions than its image can make larger than any
+/// machine: 100,000 × 1 on an image of 1 × 100,000 asks for 160 GB, and that aborts the process.
+/// Such a mask is scaled across first, which holds no more pixels than one of the two has. Past a
+/// quarter over the larger of them, so that rounding leaves a mask of its image's shape as it was.
+pub(crate) fn scaled(img: &image::GrayImage, w: u32, h: u32) -> image::GrayImage {
+    use image::imageops::{FilterType, resize};
+    let (mw, mh) = (u64::from(img.width()), u64::from(img.height()));
+    let largest = (mw * mh).max(u64::from(w) * u64::from(h));
+    if (mw * u64::from(h)).saturating_mul(4) > largest.saturating_mul(5) {
+        resize(&resize(img, w, img.height(), FilterType::Triangle), w, h, FilterType::Triangle)
+    } else {
+        resize(img, w, h, FilterType::Triangle)
+    }
 }
 
 fn png(w: u32, h: u32, rgb: &[u8], alpha: Option<&[u8]>) -> Result<Vec<u8>, String> {
diff --git a/crates/create/src/lib.rs b/crates/create/src/lib.rs
index 36b52d4211..6346e85120 100644
--- a/crates/create/src/lib.rs
+++ b/crates/create/src/lib.rs
@@ -6,7 +6,7 @@ use pdfcraft_cos::{Dict, Document, ObjRef, Object, PdfString, Stream, serialize}
 
 mod extract;
 mod upright_image;
-pub use extract::{ExtractedImage, ImageExport, extract_images, image_file};
+pub use extract::{ExtractedImage, ImageExport, extract_images, image_file, image_file_within};
 use pdfcraft_fonts::{literal, win_ansi, wrap};
 
 #[derive(Debug, thiserror::Error, PartialEq)]
@@ -23,29 +23,48 @@ pub const LETTER: (f64, f64) = (612.0, 792.0);
 /// The largest page side PDF allows (ISO 32000-2 Annex C: 14 400 units).
 const MAX_SIDE: f64 = 14_400.0;
 
-fn add_page(doc: &mut Document, w: f64, h: f64, resources: Dict, content: Option<Vec<u8>>) -> Result<ObjRef, CreateError> {
-    // `Document::new_empty` always has a page tree.
-    let pages = doc
-        .root()
-        .and_then(|r| doc.get(r).as_dict().and_then(|d| d.reference(b"Pages")))
-        .ok_or_else(|| CreateError::Invalid("the new document has no page tree".into()))?;
-    let mut page = Dict::new();
-    page.set(b"Type".to_vec(), Object::name("Page"));
-    page.set(b"Parent".to_vec(), Object::Ref(pages));
-    page.set(b"MediaBox".to_vec(), Object::Array(vec![0.into(), 0.into(), Object::Real(w), Object::Real(h)]));
-    page.set(b"Resources".to_vec(), Object::Dict(resources));
-    if let Some(c) = content {
-        let s = doc.add(Object::Stream(Stream::flate(Dict::new(), &c)));
-        page.set(b"Contents".to_vec(), Object::Ref(s));
+/// The page tree of a document being made, with the pages added to it so far: its `/Kids` are
+/// written once, by [`Pages::finish`]. Adding each page to the tree in the document would copy every
+/// page before it, which a text of a million form feeds makes quadratic.
+struct Pages {
+    tree: ObjRef,
+    kids: Vec<Object>,
+}
+
+impl Pages {
+    /// The page tree of `doc`, with the pages it has.
+    fn of(doc: &Document) -> Result<Self, CreateError> {
+        // `Document::new_empty` always has a page tree.
+        let tree = doc
+            .root()
+            .and_then(|r| doc.get(r).as_dict().and_then(|d| d.reference(b"Pages")))
+            .ok_or_else(|| CreateError::Invalid("the new document has no page tree".into()))?;
+        let kids = doc.get(tree).as_dict().and_then(|d| d.get(b"Kids")).and_then(|k| k.as_array().cloned()).unwrap_or_default();
+        Ok(Self { tree, kids })
+    }
+
+    fn add(&mut self, doc: &mut Document, w: f64, h: f64, resources: Dict, content: Option<Vec<u8>>) {
+        let mut page = Dict::new();
+        page.set(b"Type".to_vec(), Object::name("Page"));
+        page.set(b"Parent".to_vec(), Object::Ref(self.tree));
+        page.set(b"MediaBox".to_vec(), Object::Array(vec![0.into(), 0.into(), Object::Real(w), Object::Real(h)]));
+        page.set(b"Resources".to_vec(), Object::Dict(resources));
+        if let Some(c) = content {
+            let s = doc.add(Object::Stream(Stream::flate(Dict::new(), &c)));
+            page.set(b"Contents".to_vec(), Object::Ref(s));
+        }
+        self.kids.push(Object::Ref(doc.add(page)));
+    }
+
+    /// Writes the pages added into the tree.
+    fn finish(self, doc: &mut Document) -> Result<(), CreateError> {
+        let count = i64::try_from(self.kids.len()).map_err(|_| CreateError::Invalid("too many pages".into()))?;
+        doc.update_dict(self.tree, |d| {
+            d.set(b"Count".to_vec(), Object::Int(count));
+            d.set(b"Kids".to_vec(), Object::Array(self.kids));
+        })
+        .map_err(|e| CreateError::Invalid(e.to_string()))
     }
-    let r = doc.add(page);
-    let _ = doc.update_dict(pages, |d| {
-        let mut kids = d.get(b"Kids").and_then(|k| k.as_array().cloned()).unwrap_or_default();
-        kids.push(Object::Ref(r));
-        d.set(b"Count".to_vec(), Object::Int(kids.len() as i64));
-        d.set(b"Kids".to_vec(), Object::Array(kids));
-    });
-    Ok(r)
 }
 
 fn set_title(doc: &mut Document, title: &str) {
@@ -65,9 +84,11 @@ pub fn blank(width: f64, height: f64, pages: usize) -> Result<Document, CreateEr
         return Err(CreateError::Invalid("invalid page size or count".into()));
     }
     let mut doc = Document::new_empty();
+    let mut tree = Pages::of(&doc)?;
     for _ in 0..pages {
-        add_page(&mut doc, width, height, Dict::new(), None)?;
+        tree.add(&mut doc, width, height, Dict::new(), None);
     }
+    tree.finish(&mut doc)?;
     Ok(doc)
 }
 
@@ -675,6 +696,7 @@ pub fn from_images_with_resolution(images: &[(String, Vec<u8>)], resolution: Ima
         return Err(CreateError::Invalid("no images".into()));
     }
     let mut doc = Document::new_empty();
+    let mut tree = Pages::of(&doc)?;
     let mut profiles = Vec::new();
     for img in images.iter().map(|(name, bytes)| embed(name, bytes, usize::MAX)).collect::<Result<Vec<_>, _>>()?.into_iter().flatten() {
         let dpi = match resolution {
@@ -692,8 +714,9 @@ pub fn from_images_with_resolution(images: &[(String, Vec<u8>)], resolution: Ima
         let mut res = Dict::new();
         res.set(b"XObject".to_vec(), Object::Dict(xobj));
         let content = format!("q {w:.3} 0 0 {h:.3} 0 0 cm /Im0 Do Q\n").into_bytes();
-        add_page(&mut doc, w, h, res, Some(content))?;
+        tree.add(&mut doc, w, h, res, Some(content));
     }
+    tree.finish(&mut doc)?;
     if let Some((name, _)) = images.first() {
         set_title(&mut doc, name.rsplit_once('.').map_or(name.as_str(), |(s, _)| s));
     }
@@ -787,6 +810,7 @@ fn set_text(title: &str, text: &str, page: (f64, f64), font_size: f64) -> Result
     font.set(b"BaseFont".to_vec(), Object::name("Helvetica"));
     font.set(b"Encoding".to_vec(), Object::name("WinAnsiEncoding"));
     let fr = doc.add(font);
+    let mut tree = Pages::of(&doc)?;
     let mut page_lines: Vec<Vec<String>> = vec![Vec::new()];
     for l in lines.iter().take(lines.len().saturating_sub(1)) {
         if l == "\u{c}" || page_lines.last().is_some_and(|p| p.len() >= per_page) {
@@ -810,8 +834,9 @@ fn set_text(title: &str, text: &str, page: (f64, f64), font_size: f64) -> Result
         fonts.set(b"F1".to_vec(), Object::Ref(fr));
         let mut res = Dict::new();
         res.set(b"Font".to_vec(), Object::Dict(fonts));
-        add_page(&mut doc, w, h, res, Some(c))?;
+        tree.add(&mut doc, w, h, res, Some(c));
     }
+    tree.finish(&mut doc)?;
     set_title(&mut doc, title);
     Ok(doc)
 }
diff --git a/crates/create/src/tests.rs b/crates/create/src/tests.rs
index 03c93d4a51..9e620c19c3 100644
--- a/crates/create/src/tests.rs
+++ b/crates/create/src/tests.rs
@@ -124,6 +124,27 @@ fn text_is_wrapped_and_paginated() {
     assert!(content(p.last().unwrap()).contains("(After a form feed) Tj"), "a form feed starts a page");
 }
 
+#[test]
+fn text_of_many_form_feeds_makes_its_pages_in_linear_time() {
+    // Each form feed starts a page: adding each to the page tree copied all the pages before it,
+    // which made forty thousand of them take over a minute in a debug build, against about two
+    // seconds when the tree is written once.
+    let text = "x\u{c}".repeat(40_000);
+    let start = std::time::Instant::now();
+    let doc = from_text("many", &text, LETTER, 11.0).unwrap();
+    let took = start.elapsed();
+    let tree = doc.get(doc.get(doc.root().unwrap()).as_dict().unwrap().reference(b"Pages").unwrap());
+    let tree = tree.as_dict().unwrap();
+    assert_eq!(tree.get(b"Kids").and_then(|k| k.as_array()).map(|a| a.len()), Some(40_001));
+    assert_eq!(tree.int(b"Count"), Some(40_001));
+    assert!(took < std::time::Duration::from_secs(30), "{took:?}");
+    // Blank documents and pages made from images keep their pages, in order.
+    let doc = reopen(&blank(200.0, 300.0, 3).unwrap());
+    assert_eq!(pages(&doc).len(), 3);
+    let doc = reopen(&from_images(&[("a.png".into(), png_bytes(false)), ("b.png".into(), png_bytes(true))]).unwrap());
+    assert_eq!(pages(&doc).len(), 2);
+}
+
 #[test]
 fn text_keeps_leading_spaces_and_tabs() {
     let doc = reopen(&from_text("t", "    indented\n\ttabbed\nplain", LETTER, 11.0).unwrap());
@@ -2054,10 +2075,10 @@ fn symbol_coded_jbig2_images_export_as_their_picture() {
 
 /// Export ▸ Images reads JBIG2 images (ISO 32000-2 §7.4.7), JBIG2 black as 0: as the image, and as
 /// a stencil `/Mask` of another. Their `/JBIG2Globals` are read, from a dictionary or the one in
-/// an array, so globals that can't be read skip the image rather than being ignored. Rows past the
-/// image's height are left out; a JBIG2 page of another width, or with fewer rows than the image,
-/// or larger than an exported image may be (however small the image's `/Height`), or data that
-/// isn't JBIG2, skips the image.
+/// an array, so globals that can't be read skip the image rather than being ignored. A JBIG2 page
+/// of another size than the image (a taller one too: PdfCraft's renderer draws the whole page into
+/// the image), refused before it is decoded however large, or data that isn't JBIG2, skips the
+/// image.
 #[test]
 fn jbig2_images_export_as_their_picture() {
     let (w, h) = (203i64, 41i64);
@@ -2118,33 +2139,24 @@ fn jbig2_images_export_as_their_picture() {
     for in_array in [false, true] {
         assert!(skipped(&page(w, h, &jbig2, Some((&b"not JBIG2"[..], in_array)), false)), "unreadable globals, in an array: {in_array}");
     }
-    assert_eq!(exported_rgba(&page(w, h - 5, &jbig2, None, false)).1, picture(h - 5), "rows past the height");
-    for (width, height, data) in [(w + 8, h, &jbig2[..]), (w - 1, h, &jbig2[..]), (w, h + 1, &jbig2[..]), (w, h, &b"not JBIG2"[..])] {
+    for (width, height, data) in
+        [(w + 8, h, &jbig2[..]), (w - 1, h, &jbig2[..]), (w, h + 1, &jbig2[..]), (w, h - 5, &jbig2[..]), (w, h, &b"not JBIG2"[..])]
+    {
         assert!(skipped(&page(width, height, data, None, false)), "{width} × {height}, {} bytes", data.len());
     }
     // The same stream with its page information (the first segment's data, after its 11-byte
-    // header: width, then height) claiming a 20,000 × 10,000 page: 200 million pixels, over the
-    // export's 100 million, behind an image of 20,000 × 4. The decoder would decode the whole page
-    // (it takes pages of up to about 2^28 pixels), so it is refused first.
+    // header: width, then height) claiming a 20,000 × 10,000 page, behind an image of 20,000 × 4:
+    // the decoder would decode the whole page, so it is refused first.
     let mut large = jbig2.clone();
     large[11..15].copy_from_slice(&20_000u32.to_be_bytes());
     large[15..19].copy_from_slice(&10_000u32.to_be_bytes());
-    assert!(skipped(&page(20_000, 4, &large, None, false)), "a page over the export's size");
+    assert!(skipped(&page(20_000, 4, &large, None, false)), "a page far taller than the image");
     // Refused the same ways as a stencil /Mask, it is left out: the image exports opaque.
     for (width, height, mask) in [(w + 8, h, &jbig2), (20_000, 4, &large)] {
         let rgba = exported_rgba(&page(width, height, mask, None, true)).1;
         assert_eq!(rgba.len() as i64, width * height * 4, "a {width}-wide mask");
         assert!(alphas(&rgba).iter().all(|a| *a == 255), "a refused {width}-wide mask is left out");
     }
-    // A page of exactly the budget, 20,000 × 5,000, is decoded; one row more is refused.
-    for (rows, refused) in [(5_000u32, false), (5_001, true)] {
-        large[15..19].copy_from_slice(&rows.to_be_bytes());
-        let doc = page(20_000, 4, &large, None, false);
-        assert_eq!(skipped(&doc), refused, "a page of 20,000 × {rows}");
-        if !refused {
-            assert_eq!(exported_rgba(&doc).1.len(), 20_000 * 4 * 4);
-        }
-    }
     // Damaged data never panics.
     for end in [0, 1, 10, 20, 30, jbig2.len() / 2] {
         let _ = extract_images(&page(w, h, &jbig2[..end], None, false), &[0], 0);
@@ -2155,6 +2167,38 @@ fn jbig2_images_export_as_their_picture() {
     assert_eq!(alphas(&exported_rgba(&page(w, h, &jbig2, None, true)).1), alpha);
 }
 
+/// A JBIG2 image behind another filter (ASCIIHexDecode) exports as its picture, as a fax image does,
+/// with the `/JBIG2Globals` at its own place in a `/DecodeParms` array: globals that can't be read
+/// there skip the image, and ones at the other filter's place aren't the image's.
+#[test]
+fn jbig2_images_behind_another_filter_export_as_their_picture() {
+    let bits = [0xF0u8, 0x0F, 0xAA, 0x55];
+    let jbig2 = pdfcraft_filters::encode_jbig2_generic(&bits, 16, 2).unwrap();
+    let hex: Vec<u8> = jbig2.iter().flat_map(|b| format!("{b:02x}").into_bytes()).chain(*b">").collect();
+    let picture: Vec<u8> = (0..32).flat_map(|i| if bits[i / 8] & (0x80 >> (i % 8)) != 0 { [255; 4] } else { [0, 0, 0, 255] }).collect();
+    // With unreadable globals at place `at` of its /DecodeParms.
+    let page = |at: Option<usize>| {
+        let mut doc = from_images(&[("flat.png".into(), png_bytes(false))]).unwrap();
+        with_image(&mut doc, |doc| {
+            let mut d = image_dict(16, 2, "DeviceGray", 1);
+            d.set(b"Filter".to_vec(), Object::Array(vec![Object::name("ASCIIHexDecode"), Object::name("JBIG2Decode")]));
+            if let Some(at) = at {
+                let mut parms = Dict::new();
+                parms.set(b"JBIG2Globals".to_vec(), Object::Ref(doc.add(Object::Stream(Stream::from_raw(Dict::new(), b"not JBIG2".to_vec())))));
+                let mut entries = vec![Object::Null, Object::Null];
+                entries[at] = Object::Dict(parms);
+                d.set(b"DecodeParms".to_vec(), Object::Array(entries));
+            }
+            Stream::from_raw(d, hex.clone())
+        });
+        doc
+    };
+    assert_eq!(exported_rgba(&page(None)), ("png", picture.clone()));
+    assert_eq!(exported_rgba(&page(Some(0))).1, picture, "globals at ASCIIHexDecode's place");
+    let out = extract_images(&page(Some(1)), &[0], 0);
+    assert!(out.images.is_empty() && out.skipped.len() == 1, "unreadable globals at its own place");
+}
+
 /// A JBIG2 image's `/JBIG2Globals` are decoded before its JBIG2 page's size is known, so they have
 /// a limit of their own, 32 MiB, far below the 1 GiB of any stream: globals that Flate-decode to
 /// one byte more skip the image, with the limit in the reason, though they take a few kilobytes
@@ -2162,7 +2206,8 @@ fn jbig2_images_export_as_their_picture() {
 /// indirect `/DecodeParms`, in an array or not.
 #[test]
 fn jbig2_globals_are_decoded_within_a_limit_of_their_own() {
-    const LIMIT: usize = 32 << 20;
+    const LIMIT: usize = pdfcraft_cos::MAX_JBIG2_GLOBALS;
+    assert_eq!(LIMIT, 32 << 20);
     let bits = [0xF0u8, 0x0F, 0xAA, 0x55];
     let jbig2 = pdfcraft_filters::encode_jbig2_generic(&bits, 16, 2).unwrap();
     let picture: Vec<u8> = (0..32).flat_map(|i| if bits[i / 8] & (0x80 >> (i % 8)) != 0 { [255; 4] } else { [0, 0, 0, 255] }).collect();
@@ -2206,6 +2251,372 @@ fn jbig2_globals_are_decoded_within_a_limit_of_their_own() {
         let out = extract_images(&page(&over, form), &[0], 0);
         assert!(out.images.is_empty(), "globals over the limit, form {form}");
         let why = &out.skipped.first().expect("the image is skipped").2;
-        assert!(why.starts_with("the JBIG2 globals can't be read") && why.contains(&format!("limit of {LIMIT} bytes")), "{why}");
+        assert!(why.contains("the JBIG2 globals can't be read") && why.contains(&format!("limit of {LIMIT} bytes")), "{why}");
     }
 }
+
+/// One allowance for all the images of an export: an image past it is left out, saying so.
+#[test]
+fn jbig2_images_past_the_exports_allowance_are_left_out_with_the_reason() {
+    use pdfcraft_cos::{Dict, Document, ImageBudget, Object, Stream};
+    let mut dict = Dict::new();
+    dict.set(b"Subtype".to_vec(), Object::name("Image"));
+    dict.set(b"Width".to_vec(), Object::Int(16));
+    dict.set(b"Height".to_vec(), Object::Int(2));
+    dict.set(b"BitsPerComponent".to_vec(), Object::Int(1));
+    dict.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+    dict.set(b"Filter".to_vec(), Object::name("JBIG2Decode"));
+    let image = Stream::from_raw(dict, pdfcraft_filters::encode_jbig2_generic(&[0xFF; 4], 16, 2).unwrap());
+    let mut cost = ImageBudget::with_work(u64::MAX);
+    cost.decode(&Document::new_empty(), &image, 1 << 20).unwrap();
+    let cost = u64::MAX - cost.work_left();
+
+    let pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] >> endobj\ntrailer << /Root 1 0 R >>\n%%EOF".to_vec();
+    let mut doc = Document::open(std::sync::Arc::new(pdf)).unwrap();
+    let (a, b) = (doc.add(Object::Stream(image.clone())), doc.add(Object::Stream(image)));
+    let mut xobjects = Dict::new();
+    xobjects.set(b"A".to_vec(), Object::Ref(a));
+    xobjects.set(b"B".to_vec(), Object::Ref(b));
+    let mut resources = Dict::new();
+    resources.set(b"XObject".to_vec(), Object::Dict(xobjects));
+    let page = pdfcraft_model::pages(&doc).swap_remove(0).obj;
+    doc.update_dict(page, |p| p.set(b"Resources".to_vec(), Object::Dict(resources))).unwrap();
+
+    let export = crate::extract::extract_images_within(&doc, &[0], 1, &mut ImageBudget::with_work(cost), usize::MAX);
+    assert_eq!(export.images.len(), 1);
+    assert_eq!(export.skipped.len(), 1);
+    assert!(export.skipped[0].2.contains("more image decoding than"), "{:?}", export.skipped);
+    // What an export holds is bounded too: the files are all in memory until it ends.
+    let export = crate::extract::extract_images_within(&doc, &[0], 1, &mut ImageBudget::with_work(u64::MAX), 1);
+    assert_eq!(export.images.len(), 1, "the first goes past it");
+    assert_eq!(export.skipped.len(), 1);
+    assert!(export.skipped[0].2.contains("than one export can hold"), "{:?}", export.skipped);
+    // A file of many images shares one allowance too, image by image.
+    let mut budget = ImageBudget::with_work(cost);
+    assert!(crate::extract::image_file_within(&doc, a, &mut budget).is_ok());
+    assert!(crate::extract::image_file_within(&doc, b, &mut budget).is_err());
+}
+
+/// An image that isn't JBIG2 shares the allowance too: a file of filter bombs would hold an export
+/// as long as one of JBIG2. What isn't decoded here, a JPEG, is still exported.
+#[test]
+fn flate_images_past_the_exports_allowance_are_left_out_with_the_reason() {
+    use pdfcraft_cos::{Dict, Document, ImageBudget, Object, Stream};
+    let image = |filter: &str, raw: Vec<u8>| {
+        let mut dict = Dict::new();
+        dict.set(b"Subtype".to_vec(), Object::name("Image"));
+        dict.set(b"Width".to_vec(), Object::Int(2));
+        dict.set(b"Height".to_vec(), Object::Int(2));
+        dict.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+        dict.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+        dict.set(b"Filter".to_vec(), Object::name(filter));
+        Stream::from_raw(dict, raw)
+    };
+    let flate = image("FlateDecode", pdfcraft_filters::encode_flate(&[0x80; 4]));
+    let mut cost = ImageBudget::with_work(u64::MAX);
+    cost.decode(&Document::new_empty(), &flate, 1 << 20).unwrap();
+    let cost = u64::MAX - cost.work_left();
+
+    let mut doc = Document::new_empty();
+    let (a, b) = (doc.add(Object::Stream(flate.clone())), doc.add(Object::Stream(flate)));
+    let mut budget = ImageBudget::with_work(cost);
+    assert!(crate::extract::image_file_within(&doc, a, &mut budget).is_ok());
+    let refused = crate::extract::image_file_within(&doc, b, &mut budget).unwrap_err();
+    assert!(refused.contains("more image decoding than"), "{refused}");
+    assert_eq!(budget.refused(), 1);
+
+    let jpeg = image::RgbImage::from_pixel(2, 2, image::Rgb([9, 9, 9]));
+    let mut bytes = Vec::new();
+    jpeg.write_to(&mut std::io::Cursor::new(&mut bytes), image::ImageFormat::Jpeg).unwrap();
+    let jpeg = doc.add(Object::Stream(image("DCTDecode", bytes)));
+    assert!(crate::extract::image_file_within(&doc, jpeg, &mut budget).is_ok(), "nothing charged");
+    assert_eq!(budget.refused(), 1);
+}
+
+/// A JPEG is written as it is, at no cost, unless something means decoding it, here a mask: that
+/// pays for its samples, and past the allowance the image goes, with the reason, as it would come out without
+/// its transparency otherwise.
+#[test]
+fn a_jpeg_that_has_to_be_decoded_shares_the_allowance() {
+    use pdfcraft_cos::{Dict, Document, ImageBudget, Object, Stream};
+    let mut jpeg = Vec::new();
+    image::RgbImage::from_pixel(4, 4, image::Rgb([9, 9, 9])).write_to(&mut std::io::Cursor::new(&mut jpeg), image::ImageFormat::Jpeg).unwrap();
+    let image_dict = |extra: Option<(&[u8], Object)>| {
+        let mut d = Dict::new();
+        d.set(b"Subtype".to_vec(), Object::name("Image"));
+        d.set(b"Width".to_vec(), Object::Int(4));
+        d.set(b"Height".to_vec(), Object::Int(4));
+        d.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+        d.set(b"ColorSpace".to_vec(), Object::name("DeviceRGB"));
+        d.set(b"Filter".to_vec(), Object::name("DCTDecode"));
+        if let Some((key, value)) = extra {
+            d.set(key.to_vec(), value);
+        }
+        d
+    };
+    let mut doc = Document::new_empty();
+    let mut mask = Dict::new();
+    mask.set(b"Subtype".to_vec(), Object::name("Image"));
+    mask.set(b"Width".to_vec(), Object::Int(4));
+    mask.set(b"Height".to_vec(), Object::Int(4));
+    mask.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+    mask.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+    let mask = doc.add(Object::Stream(Stream::from_raw(mask, vec![0x80; 16])));
+    let doc_jpeg_len = jpeg.len();
+    let masked = doc.add(Object::Stream(Stream::from_raw(image_dict(Some((b"SMask", Object::Ref(mask)))), jpeg.clone())));
+    let plain = doc.add(Object::Stream(Stream::from_raw(image_dict(None), jpeg)));
+
+    let mut budget = ImageBudget::with_work(0);
+    assert!(crate::extract::image_file_within(&doc, plain, &mut budget).is_ok(), "written as it is");
+    assert_eq!(budget.refused(), 0);
+    let mut budget = ImageBudget::with_work(u64::MAX);
+    assert!(crate::extract::image_file_within(&doc, masked, &mut budget).is_ok());
+    let cost = u64::MAX - budget.work_left();
+    let read = 4 * doc_jpeg_len as u64;
+    assert_eq!(cost, 16 + 16 + 2 * 4 * 4 * 3 + read, "the mask's bytes and pixels, the JPEG's samples twice and its reading");
+    let mut budget = ImageBudget::with_work(cost - 1);
+    let refused = crate::extract::image_file_within(&doc, masked, &mut budget).unwrap_err();
+    assert!(refused.contains("more image decoding than"), "{refused}");
+    assert_eq!(budget.refused(), 1);
+}
+
+/// A JPEG that is itself a mask pays for its samples, each time an image reads it: images can
+/// share one, and only the images are ever seen once.
+#[test]
+fn a_jpeg_mask_pays_for_its_samples() {
+    use pdfcraft_cos::{Dict, Document, ImageBudget, Object, Stream};
+    let mut jpeg = Vec::new();
+    image::GrayImage::from_pixel(4, 4, image::Luma([90])).write_to(&mut std::io::Cursor::new(&mut jpeg), image::ImageFormat::Jpeg).unwrap();
+    let mut mask = Dict::new();
+    mask.set(b"Subtype".to_vec(), Object::name("Image"));
+    mask.set(b"Width".to_vec(), Object::Int(4));
+    mask.set(b"Height".to_vec(), Object::Int(4));
+    mask.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+    mask.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+    mask.set(b"Filter".to_vec(), Object::name("DCTDecode"));
+    let mut doc = Document::new_empty();
+    let read = 4 * jpeg.len() as u64;
+    let mask = doc.add(Object::Stream(Stream::from_raw(mask, jpeg)));
+    let mut image = Dict::new();
+    image.set(b"Subtype".to_vec(), Object::name("Image"));
+    image.set(b"Width".to_vec(), Object::Int(1));
+    image.set(b"Height".to_vec(), Object::Int(1));
+    image.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+    image.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+    image.set(b"SMask".to_vec(), Object::Ref(mask));
+    let image = doc.add(Object::Stream(Stream::from_raw(image, vec![0x80])));
+    let mut budget = ImageBudget::with_work(u64::MAX);
+    assert!(crate::extract::image_file_within(&doc, image, &mut budget).is_ok());
+    assert_eq!(u64::MAX - budget.work_left(), 2 * 4 * 4 + read + 2, "its samples twice, its reading, and the image's byte and pixel");
+    // Just short of what the mask costs: it isn't decoded, and takes the image with it.
+    let mut budget = ImageBudget::with_work(2 * 4 * 4 + read - 1);
+    let refused = crate::extract::image_file_within(&doc, image, &mut budget).unwrap_err();
+    assert!(refused.contains("more image decoding than"), "{refused}");
+    assert_eq!((budget.work_left(), budget.refused()), (0, 1));
+}
+
+/// What decoding a JPEG takes goes by its header, so that is what has to agree with the
+/// dictionary before it is decoded: one image of a pixel can hold a page of 500 megapixels. The
+/// file comes out as it is either way, so what shows is whether it was decoded.
+#[test]
+fn a_jpeg_larger_than_its_dictionary_says_isnt_decoded() {
+    use pdfcraft_cos::{Dict, Document, ImageBudget, Object, Stream};
+    let mut jpeg = Vec::new();
+    image::RgbImage::from_pixel(4, 4, image::Rgb([9, 9, 9])).write_to(&mut std::io::Cursor::new(&mut jpeg), image::ImageFormat::Jpeg).unwrap();
+    // A colour key means decoding it, to find the pixels it hides.
+    let keyed = |side: i64| {
+        let mut d = Dict::new();
+        d.set(b"Subtype".to_vec(), Object::name("Image"));
+        d.set(b"Width".to_vec(), Object::Int(side));
+        d.set(b"Height".to_vec(), Object::Int(side));
+        d.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+        d.set(b"ColorSpace".to_vec(), Object::name("DeviceRGB"));
+        d.set(b"Filter".to_vec(), Object::name("DCTDecode"));
+        d.set(b"Mask".to_vec(), Object::Array(vec![Object::Int(0); 6]));
+        Stream::from_raw(d, jpeg.clone())
+    };
+    let decodes = |doc: &Document, image: pdfcraft_cos::ObjRef| {
+        crate::extract::JPEGS_DECODED.with(|n| n.set(0));
+        assert!(crate::extract::image_file_within(doc, image, &mut ImageBudget::with_work(u64::MAX)).is_ok());
+        crate::extract::JPEGS_DECODED.with(std::cell::Cell::get)
+    };
+    let mut doc = Document::new_empty();
+    let (honest, lying) = (doc.add(Object::Stream(keyed(4))), doc.add(Object::Stream(keyed(1))));
+    assert_eq!(decodes(&doc, honest), 1);
+    assert_eq!(decodes(&doc, lying), 0);
+    // The same as a mask: read as none, without being decoded.
+    let mut mask = keyed(1);
+    mask.dict.remove(b"Mask");
+    let mask = doc.add(Object::Stream(mask));
+    let mut image = Dict::new();
+    image.set(b"Subtype".to_vec(), Object::name("Image"));
+    image.set(b"Width".to_vec(), Object::Int(1));
+    image.set(b"Height".to_vec(), Object::Int(1));
+    image.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+    image.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+    image.set(b"SMask".to_vec(), Object::Ref(mask));
+    let image = doc.add(Object::Stream(Stream::from_raw(image, vec![0x80])));
+    assert_eq!(decodes(&doc, image), 0);
+    // Reading the header to find that out is paid for: a mask can be mostly tables, shared by
+    // every image of a file, and with nothing left it isn't read.
+    let mut budget = ImageBudget::with_work(u64::MAX);
+    assert!(crate::extract::image_file_within(&doc, image, &mut budget).is_ok());
+    assert_eq!(u64::MAX - budget.work_left(), 2 + 4 * jpeg.len() as u64 + 2, "its one declared sample twice, its bytes, the image's byte and pixel");
+    let mut budget = ImageBudget::with_work(0);
+    assert!(crate::extract::image_file_within(&doc, image, &mut budget).is_err());
+    assert_eq!(budget.refused(), 1, "the image goes, with its mask unread");
+}
+
+/// A mask past the allowance can't be left out as an unreadable one is, or the image comes out
+/// opaque, showing what the mask hides: the image goes, with the reason.
+#[test]
+fn an_image_whose_jbig2_mask_is_past_the_allowance_is_left_out() {
+    use pdfcraft_cos::{Dict, Document, ImageBudget, Object, Stream};
+    let mut mask = Dict::new();
+    mask.set(b"Subtype".to_vec(), Object::name("Image"));
+    mask.set(b"Width".to_vec(), Object::Int(16));
+    mask.set(b"Height".to_vec(), Object::Int(2));
+    mask.set(b"BitsPerComponent".to_vec(), Object::Int(1));
+    mask.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+    mask.set(b"Filter".to_vec(), Object::name("JBIG2Decode"));
+    let mut doc = Document::new_empty();
+    let mask = doc.add(Object::Stream(Stream::from_raw(mask, pdfcraft_filters::encode_jbig2_generic(&[0xFF; 4], 16, 2).unwrap())));
+    // A JPEG, read for nothing until its mask is, so only the mask can be what stops it.
+    let mut jpeg = Vec::new();
+    image::RgbImage::from_pixel(1, 1, image::Rgb([9, 9, 9])).write_to(&mut std::io::Cursor::new(&mut jpeg), image::ImageFormat::Jpeg).unwrap();
+    let mut image = Dict::new();
+    image.set(b"Subtype".to_vec(), Object::name("Image"));
+    image.set(b"Width".to_vec(), Object::Int(1));
+    image.set(b"Height".to_vec(), Object::Int(1));
+    image.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+    image.set(b"ColorSpace".to_vec(), Object::name("DeviceRGB"));
+    image.set(b"Filter".to_vec(), Object::name("DCTDecode"));
+    image.set(b"SMask".to_vec(), Object::Ref(mask));
+    let image = doc.add(Object::Stream(Stream::from_raw(image, jpeg)));
+    assert!(crate::extract::image_file_within(&doc, image, &mut ImageBudget::with_work(u64::MAX)).is_ok());
+    let refused = crate::extract::image_file_within(&doc, image, &mut ImageBudget::with_work(0)).unwrap_err();
+    assert!(refused.contains("more image decoding than"), "{refused}");
+}
+
+/// A large honest file keeps its images: what an export may hold grows with the file past the fixed
+/// part, and a file too long to double doesn't wrap round to nothing.
+#[test]
+fn an_export_may_hold_twice_a_large_file() {
+    let fixed = crate::extract::export_bytes(0);
+    assert_eq!(fixed, 2 << 30);
+    assert_eq!(crate::extract::export_bytes(fixed / 2), fixed);
+    assert_eq!(crate::extract::export_bytes(fixed / 2 + 1), fixed + 2);
+    assert_eq!(crate::extract::export_bytes(usize::MAX), usize::MAX);
+}
+
+/// `/Decode` says which way round a stencil mask is, and its numbers can be given by reference. Read
+/// as absent, they gave the wrong answer, so the file came out a negative of what the page draws.
+#[test]
+fn a_stencil_masks_decode_array_can_hold_references() {
+    use pdfcraft_cos::Document;
+    let export = |decode: &str| {
+        let pdf = format!(
+            "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Resources << /XObject << /Im 4 0 R >> >> >> endobj\n\
+             4 0 obj << /Subtype /Image /ImageMask true /Width 8 /Height 1 /BitsPerComponent 1 /Decode {decode} /Filter /ASCIIHexDecode /Length 3 >> stream\nF0>\nendstream endobj\n\
+             5 0 obj 1 endobj\n6 0 obj 0 endobj\n7 0 obj 7 0 R endobj\n8 0 obj 9 0 R endobj\n9 0 obj 8 0 R endobj\n\
+             trailer << /Root 1 0 R >>\n%%EOF"
+        );
+        let doc = Document::open(std::sync::Arc::new(pdf.into_bytes())).unwrap();
+        let mut export = crate::extract::extract_images(&doc, &[0], 1);
+        assert_eq!(export.images.len(), 1, "{decode}: {:?}", export.skipped);
+        export.images.remove(0).data
+    };
+    let (inverted, identity) = (export("[1 0]"), export("[0 1]"));
+    assert_ne!(inverted, identity, "the two ways round differ");
+    for decode in ["[5 0 R 0]", "[1 6 0 R]", "[5 0 R 6 0 R]"] {
+        assert_eq!(export(decode), inverted, "{decode}");
+    }
+    for decode in ["[0 5 0 R]", "[6 0 R 1]", "[6 0 R 5 0 R]"] {
+        assert_eq!(export(decode), identity, "{decode}");
+    }
+    // A reference that only leads back to itself holds no number, and an end that is missing or isn't
+    // a number leaves the default mapping, whichever end it is.
+    for decode in ["[7 0 R 0]", "[1 7 0 R]", "[8 0 R 0]", "[1 8 0 R]", "[7 0 R 8 0 R]", "[1]", "[1 /Name]", "[/Name 0]"] {
+        assert_eq!(export(decode), identity, "{decode}");
+    }
+    // Equal ends aren't the two ways round either, and a number too long to hold reads as infinite.
+    assert_eq!(export("[1 1]"), identity);
+    assert_eq!(export(&format!("[{} 0]", "9".repeat(400))), identity);
+}
+
+/// A mask of other proportions than its image is scaled to it, however far apart they are: the
+/// first two shapes asked for 160 GB on the way, in a file of a kilobyte, and that aborted the
+/// process. The third would ask for 10 GB if it went across first, which is why the way round
+/// depends on the shapes. The value comes through, and masks of ordinary proportions, of the
+/// image's size and larger than it, are scaled as they always were.
+#[test]
+fn a_mask_of_other_proportions_than_its_image_is_scaled_without_the_memory_of_both() {
+    use pdfcraft_cos::{Dict, Document, Object, Stream};
+    let gray = |w: i64, h: i64, data: &[u8]| {
+        let mut d = Dict::new();
+        d.set(b"Subtype".to_vec(), Object::name("Image"));
+        d.set(b"Width".to_vec(), Object::Int(w));
+        d.set(b"Height".to_vec(), Object::Int(h));
+        d.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+        d.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+        d.set(b"Filter".to_vec(), Object::name("FlateDecode"));
+        Stream::from_raw(d, pdfcraft_filters::encode_flate(data))
+    };
+    let shapes = [
+        (100_000usize, 1usize, 1usize, 100_000usize),
+        (100_000, 64, 64, 100_000),
+        (1, 100_000, 100_000, 1),
+        (64, 1, 1, 64),
+        (3, 2, 6, 4),
+        (3, 2, 3, 2),
+        (6, 4, 3, 2),
+    ];
+    for (mask_w, mask_h, w, h) in shapes {
+        let mut doc = Document::new_empty();
+        let mask = doc.add(Object::Stream(gray(mask_w as i64, mask_h as i64, &vec![0x80; mask_w * mask_h])));
+        let mut image = gray(w as i64, h as i64, &vec![0x40; w * h]);
+        image.dict.set(b"SMask".to_vec(), Object::Ref(mask));
+        let image = doc.add(Object::Stream(image));
+        let (name, png) = crate::image_file(&doc, image).unwrap_or_else(|e| panic!("{mask_w} × {mask_h} on {w} × {h}: {e}"));
+        assert_eq!(name, "png");
+        let mut reader = ::png::Decoder::new(std::io::Cursor::new(&png)).read_info().unwrap();
+        let mut rgba = vec![0; reader.output_buffer_size().unwrap()];
+        let info = reader.next_frame(&mut rgba).unwrap();
+        assert_eq!((info.width as usize, info.height as usize, info.color_type), (w, h, ::png::ColorType::Rgba));
+        assert!(rgba.as_chunks::<4>().0.iter().all(|p| p[3].abs_diff(0x80) <= 1), "{mask_w} × {mask_h} on {w} × {h}");
+    }
+}
+
+/// The long way round is for proportions far apart: up to a quarter over the larger image the
+/// buffer is no danger, and such a mask scales as it always did, to the byte. Noise, as a flat mask comes
+/// out the same either way.
+#[test]
+fn proportions_up_to_the_limit_scale_as_they_did() {
+    let noise = |w: u32, h: u32| {
+        let mut seed = 0x2545_F491_4F6C_DD1Du64;
+        let px = (0..w * h)
+            .map(|_| {
+                seed ^= seed << 13;
+                seed ^= seed >> 7;
+                seed ^= seed << 17;
+                seed as u8
+            })
+            .collect();
+        image::GrayImage::from_raw(w, h, px).unwrap()
+    };
+    // Each exactly a quarter over the larger: the source's size, then the target's.
+    for (mw, mh, w, h) in [(25, 16, 10, 20), (20, 5, 16, 25)] {
+        let mask = noise(mw, mh);
+        let direct = image::imageops::resize(&mask, w, h, image::imageops::FilterType::Triangle);
+        assert_eq!(crate::extract::scaled(&mask, w, h), direct, "{mw} × {mh} to {w} × {h}");
+    }
+    // A step past it goes the long way, which is how to tell.
+    let mask = noise(25, 15);
+    let direct = image::imageops::resize(&mask, 10, 20, image::imageops::FilterType::Triangle);
+    assert_ne!(crate::extract::scaled(&mask, 10, 20), direct);
+    // A mask of its image's size comes through as it is.
+    let mask = noise(20, 10);
+    assert_eq!(crate::extract::scaled(&mask, 20, 10), mask);
+}
diff --git a/crates/edit/Cargo.toml b/crates/edit/Cargo.toml
index 89d9387989..2cd33a275d 100644
--- a/crates/edit/Cargo.toml
+++ b/crates/edit/Cargo.toml
@@ -24,3 +24,5 @@ unicode-bidi = "0.3"
 
 [dev-dependencies]
 hayro-syntax = { workspace = true }
+pdfcraft-render = { workspace = true }
+proptest = { workspace = true }
diff --git a/crates/edit/src/apply.rs b/crates/edit/src/apply.rs
index ff570d5483..0d0213904b 100644
--- a/crates/edit/src/apply.rs
+++ b/crates/edit/src/apply.rs
@@ -7,9 +7,25 @@ use super::place::{
 };
 use super::{Document, EditError, Object, added, backdrop, helvetica_width};
 
+/// Commit one complete mark operation only after every selected page succeeds. The snapshot
+/// shares original bytes, cross-references, caches and unchanged objects; only the overlay table
+/// and document metadata are copied. Dropping a failed stage also drops removed marks, changed
+/// page/resources/backdrop dictionaries and new objects, including the allocation cursor.
+fn apply_mark_transaction(doc: &mut Document, apply: impl FnOnce(&mut Document) -> Result<(), EditError>) -> Result<(), EditError> {
+    let mut staged = doc.clone();
+    apply(&mut staged)?;
+    *doc = staged;
+    Ok(())
+}
+
 /// Add a header and footer to `pages` (0-based). With `replace`, existing headers and footers on
-/// those pages are removed first (Acrobat's Replace Existing).
+/// those pages are removed first (Acrobat's Replace Existing). The whole call is atomic:
+/// on error, the document (including earlier selected pages) is unchanged.
 pub fn add_header_footer(doc: &mut Document, pages: &[usize], hf: &HeaderFooter, replace: bool, cx: &Context) -> Result<(), EditError> {
+    apply_mark_transaction(doc, |staged| add_header_footer_in_place(staged, pages, hf, replace, cx))
+}
+
+fn add_header_footer_in_place(doc: &mut Document, pages: &[usize], hf: &HeaderFooter, replace: bool, cx: &Context) -> Result<(), EditError> {
     let all = page_list(doc);
     check(pages, all.len())?;
     if hf.text.iter().all(|t| t.trim().is_empty()) {
@@ -121,8 +137,13 @@ pub fn add_header_footer(doc: &mut Document, pages: &[usize], hf: &HeaderFooter,
     Ok(())
 }
 
-/// Add a text watermark to `pages`.
+/// Add a text or picture watermark to `pages`. All selected pages, including mark replacement,
+/// form one transaction; on error, the document is unchanged.
 pub fn add_watermark(doc: &mut Document, pages: &[usize], wm: &Watermark, replace: bool) -> Result<(), EditError> {
+    apply_mark_transaction(doc, |staged| add_watermark_in_place(staged, pages, wm, replace))
+}
+
+fn add_watermark_in_place(doc: &mut Document, pages: &[usize], wm: &Watermark, replace: bool) -> Result<(), EditError> {
     let all = page_list(doc);
     check(pages, all.len())?;
     let text = wm.text.trim();
@@ -201,8 +222,13 @@ pub fn add_watermark(doc: &mut Document, pages: &[usize], wm: &Watermark, replac
 
 /// Add a solid-colour background behind the content of `pages`. With `bg.replace_backdrop`, a
 /// white backdrop a page paints itself is replaced first, so the background shows (see
-/// [`backdrop`]); a picture backdrop (a scan) still hides it.
+/// [`backdrop`]); a picture backdrop (a scan) still hides it. All selected pages, including
+/// replacement and backdrop edits, form one transaction; on error, the document is unchanged.
 pub fn add_background(doc: &mut Document, pages: &[usize], bg: &Background, replace: bool) -> Result<(), EditError> {
+    apply_mark_transaction(doc, |staged| add_background_in_place(staged, pages, bg, replace))
+}
+
+fn add_background_in_place(doc: &mut Document, pages: &[usize], bg: &Background, replace: bool) -> Result<(), EditError> {
     let all = page_list(doc);
     check(pages, all.len())?;
     if replace {
diff --git a/crates/edit/src/background.rs b/crates/edit/src/background.rs
index 7d745c0c10..376cb5a165 100644
--- a/crates/edit/src/background.rs
+++ b/crates/edit/src/background.rs
@@ -98,8 +98,13 @@ pub fn page_background(doc: &Document, page: usize) -> Result<Option<Rgb>, EditE
             }
             b"sc" | b"scn" => st.fill = colour(st.space, op),
             b"gs" => {
-                if let Some(g) = op.name(0).and_then(|n| gstates.get(n)).map(|g| doc.resolve(g)).and_then(|g| g.as_dict().cloned()) {
-                    apply_gstate(doc, &g, &mut st);
+                let mut held = None;
+                let gstate = match op.name(0).and_then(|n| gstates.get(n)) {
+                    Some(g) => crate::text::dict_in_place(doc, g, &mut held),
+                    None => None,
+                };
+                if let Some(g) = gstate {
+                    apply_gstate(doc, g, &mut st);
                 }
             }
             b"re" => match op.nums::<4>() {
diff --git a/crates/edit/src/images.rs b/crates/edit/src/images.rs
index f66e7f24ee..f4680bcc5c 100644
--- a/crates/edit/src/images.rs
+++ b/crates/edit/src/images.rs
@@ -4,13 +4,28 @@
 //! or delete. Only the stream that draws it is rewritten, as a new object.
 
 use kurbo::{BezPath, Point, Shape};
-use pdfcraft_content::{Matrix, Op, Pieces, parse};
+use pdfcraft_content::{Matrix, Op, Pieces, parse, serialize_ops};
 use pdfcraft_cos::{Dict, Document, ObjRef, Object};
 use std::sync::Arc;
 
 use crate::EditError;
 use crate::text::content_streams;
 
+/// The identity of a soft mask (`/SMask`) in the PDF graphics state.
+#[derive(Clone, Debug)]
+pub(crate) struct MaskIdentity {
+    // Share the owning ExtGState instead of copying an arbitrarily large inline mask on q/Q.
+    // Its complete SMask value retains S, TR, BC and every other mask parameter, not just G.
+    definition: Arc<Object>,
+    ctm: Matrix,
+}
+
+impl PartialEq for MaskIdentity {
+    fn eq(&self, other: &Self) -> bool {
+        self.ctm == other.ctm && self.definition.as_dict().and_then(|d| d.get(b"SMask")) == other.definition.as_dict().and_then(|d| d.get(b"SMask"))
+    }
+}
+
 /// An image drawn on a page.
 #[derive(Clone, Debug, PartialEq)]
 pub struct PageImage {
@@ -33,7 +48,7 @@ pub struct PageImage {
     pub height: u32,
     /// The content stream its `Do` (its first token) is in, and the `Do`'s index among the
     /// operators of the page's streams joined ([`Pieces`]).
-    stream: usize,
+    pub stream: usize,
     op: usize,
     /// CTM before `Do`, excluding a Form's own Matrix.
     draw_matrix: [f64; 6],
@@ -41,6 +56,11 @@ pub struct PageImage {
 }
 
 impl PageImage {
+    /// Whether an active clip was written by PdfCraft's image crop tool.
+    pub fn has_editor_crop(&self) -> bool {
+        self.clips.iter().any(|clip| clip.app_crop)
+    }
+
     /// Whether a user-space point belongs to the placed artwork and every active clip.
     pub fn contains(&self, point: [f64; 2]) -> bool {
         if !point.iter().all(|v| v.is_finite()) {
@@ -72,6 +92,7 @@ impl PageImage {
 struct ClipPath {
     path: Arc<BezPath>,
     even_odd: bool,
+    app_crop: bool,
 }
 
 /// Image draws one page's inventory lists at most: a form drawn many times from other forms
@@ -115,17 +136,39 @@ struct ImageState {
     placement: Placement,
     stack: Vec<Placement>,
     path: BezPath,
+    subpath_start: Option<Point>,
     pending_clip: Option<bool>,
+    app_crop: bool,
 }
 
 impl ImageState {
     fn new(matrix: Matrix, clip: [f64; 4], clips: Vec<ClipPath>) -> Self {
-        Self { placement: Placement { matrix, clip, clips }, stack: Vec::new(), path: BezPath::new(), pending_clip: None }
+        Self {
+            placement: Placement { matrix, clip, clips },
+            stack: Vec::new(),
+            path: BezPath::new(),
+            subpath_start: None,
+            pending_clip: None,
+            app_crop: false,
+        }
     }
 
-    fn point(&self, x: f64, y: f64) -> Point {
+    fn current_point(&self) -> Option<Point> {
+        match self.path.elements().last() {
+            Some(kurbo::PathEl::MoveTo(p) | kurbo::PathEl::LineTo(p)) => Some(*p),
+            Some(kurbo::PathEl::QuadTo(_, p2) | kurbo::PathEl::CurveTo(_, _, p2)) => Some(*p2),
+            Some(kurbo::PathEl::ClosePath) => self.subpath_start,
+            None => None,
+        }
+    }
+
+    fn has_current_point(&self) -> bool {
+        self.current_point().is_some()
+    }
+
+    fn point(&self, x: f64, y: f64) -> Option<Point> {
         let (x, y) = self.placement.matrix.apply(x, y);
-        Point::new(x, y)
+        if x.is_finite() && y.is_finite() { Some(Point::new(x, y)) } else { None }
     }
 
     fn apply(&mut self, op: &Op) -> Result<(), EditError> {
@@ -146,12 +189,18 @@ impl ImageState {
             }
             b"cm" => {
                 if let Some(m) = op.nums::<6>() {
-                    self.placement.matrix = Matrix(m).then(&self.placement.matrix);
+                    let next_mat = Matrix(m).then(&self.placement.matrix);
+                    if next_mat.0.iter().all(|v| v.is_finite()) {
+                        self.placement.matrix = next_mat;
+                    }
                 }
             }
             b"m" => {
-                if let Some([x, y]) = op.nums::<2>() {
-                    self.path.move_to(self.point(x, y));
+                if let Some([x, y]) = op.nums::<2>()
+                    && let Some(p) = self.point(x, y)
+                {
+                    self.subpath_start = Some(p);
+                    self.path.move_to(p);
                 }
             }
             b"l" => {
@@ -159,46 +208,57 @@ impl ImageState {
                 // friends panic on an empty path by contract, so the segment is skipped, as the
                 // renderer, MuPDF and pdftotext do (#3581).
                 if let Some([x, y]) = op.nums::<2>()
-                    && self.path.elements().last().is_some()
+                    && self.has_current_point()
+                    && let Some(p) = self.point(x, y)
                 {
-                    self.path.line_to(self.point(x, y));
+                    self.path.line_to(p);
                 }
             }
             b"c" => {
                 if let Some([x1, y1, x2, y2, x3, y3]) = op.nums::<6>()
-                    && self.path.elements().last().is_some()
+                    && self.has_current_point()
+                    && let (Some(p1), Some(p2), Some(p3)) = (self.point(x1, y1), self.point(x2, y2), self.point(x3, y3))
                 {
-                    self.path.curve_to(self.point(x1, y1), self.point(x2, y2), self.point(x3, y3));
+                    self.path.curve_to(p1, p2, p3);
                 }
             }
             b"v" => {
                 if let Some([x1, y1, x2, y2]) = op.nums::<4>()
-                    && let Some(current) = self.path.elements().last().and_then(|e| e.end_point())
+                    && self.has_current_point()
+                    && let (Some(p1), Some(p2)) = (self.point(x1, y1), self.point(x2, y2))
+                    && let Some(current) = self.current_point()
                 {
-                    self.path.curve_to(current, self.point(x1, y1), self.point(x2, y2));
+                    self.path.curve_to(current, p1, p2);
                 }
             }
             b"y" => {
                 if let Some([x1, y1, x2, y2]) = op.nums::<4>()
-                    && self.path.elements().last().is_some()
+                    && self.has_current_point()
+                    && let (Some(p1), Some(end)) = (self.point(x1, y1), self.point(x2, y2))
                 {
-                    let end = self.point(x2, y2);
-                    self.path.curve_to(self.point(x1, y1), end, end);
+                    self.path.curve_to(p1, end, end);
                 }
             }
-            // ClosePath with no subpath panics by the same contract (#3581).
-            b"h" if self.path.elements().last().is_some() => {
-                self.path.close_path();
-            }
-            b"re" => {
-                if let Some([x, y, w, h]) = op.nums::<4>() {
-                    self.path.move_to(self.point(x, y));
-                    self.path.line_to(self.point(x + w, y));
-                    self.path.line_to(self.point(x + w, y + h));
-                    self.path.line_to(self.point(x, y + h));
+            b"h" => {
+                // ClosePath with no subpath panics by the same contract (#3581).
+                if self.has_current_point() {
                     self.path.close_path();
                 }
             }
+            b"re" => {
+                if let Some([x, y, w, h]) = op.nums::<4>()
+                    && let (Some(p0), Some(p1), Some(p2), Some(p3)) =
+                        (self.point(x, y), self.point(x + w, y), self.point(x + w, y + h), self.point(x, y + h))
+                {
+                    self.subpath_start = Some(p0);
+                    self.path.move_to(p0);
+                    self.path.line_to(p1);
+                    self.path.line_to(p2);
+                    self.path.line_to(p3);
+                    self.path.close_path();
+                }
+            }
+            b"MP" if op.name(0) == Some(b"PdfCraftImageCrop") => self.app_crop = true,
             b"W" => self.pending_clip = Some(false),
             b"W*" => self.pending_clip = Some(true),
             b"n" | b"S" | b"s" | b"f" | b"F" | b"f*" | b"B" | b"B*" | b"b" | b"b*" => {
@@ -207,9 +267,11 @@ impl ImageState {
                     // follows the same rule, and its bounds use cubic extrema, not controls.
                     let bounds = self.path.bounding_box();
                     self.placement.clip = intersection(self.placement.clip, [bounds.x0, bounds.y0, bounds.x1, bounds.y1]).unwrap_or([0.0; 4]);
-                    self.placement.clips.push(ClipPath { path: Arc::new(std::mem::take(&mut self.path)), even_odd });
+                    self.placement.clips.push(ClipPath { path: Arc::new(std::mem::take(&mut self.path)), even_odd, app_crop: self.app_crop });
                 }
                 self.path = BezPath::new();
+                self.subpath_start = None;
+                self.app_crop = false;
             }
             _ => {}
         }
@@ -264,6 +326,7 @@ pub fn page_images(doc: &Document, page: usize) -> Result<Vec<PageImage>, EditEr
             } else {
                 continue;
             };
+
             let rect = matrix.bbox(bounds);
             if !bounds.iter().chain(matrix.0.iter()).chain(rect.iter()).all(|v| v.is_finite())
                 || bounds[2] <= bounds[0]
@@ -316,34 +379,34 @@ pub fn reading_images(doc: &Document, page: usize) -> Result<Vec<PageImage>, Edi
         forms: &mut Forms,
         out: &mut Vec<PageImage>,
     ) -> Result<(), EditError> {
-        let xo = resources.get(b"XObject").map(|x| doc.resolve(x)).and_then(|x| x.as_dict().cloned()).unwrap_or_default();
+        let mut held = None;
+        let xo = crate::text::resource_dict(doc, resources, b"XObject", &mut held);
         for (i, op) in ops.iter().enumerate() {
             st.apply(op)?;
             let ctm = st.placement.matrix;
             if op.is("Do") {
                 let Some(name) = op.name(0) else { continue };
+                let drawn = xo.and_then(|xo| xo.get(name));
                 if let Some(form) = crate::text::form_call(doc, resources, name, ctm, &forms.path, &mut forms.budget) {
                     if let Some(r) = form.obj {
                         forms.path.push(r);
                     }
                     let bounds =
-                        xo.get(name).map(|o| doc.resolve(o)).and_then(|o| o.as_dict().and_then(|d| d.get(b"BBox")).map(|b| doc.resolve(b))).and_then(
-                            |b| {
-                                let a = b.as_array()?;
-                                let [x0, y0, x1, y1] = a.as_slice() else { return None };
-                                Some(form.ctm.bbox([x0.as_f64()?, y0.as_f64()?, x1.as_f64()?, y1.as_f64()?]))
-                            },
-                        );
+                        drawn.map(|o| doc.resolve(o)).and_then(|o| o.as_dict().and_then(|d| d.get(b"BBox")).map(|b| doc.resolve(b))).and_then(|b| {
+                            let a = b.as_array()?;
+                            let [x0, y0, x1, y1] = a.as_slice() else { return None };
+                            Some(form.ctm.bbox([x0.as_f64()?, y0.as_f64()?, x1.as_f64()?, y1.as_f64()?]))
+                        });
                     let clip = bounds.map_or(st.placement.clip, |b| intersection(st.placement.clip, b).unwrap_or([0.0; 4]));
                     let mut inner = ImageState::new(form.ctm, clip, st.placement.clips.clone());
                     let piece = stream(op);
-                    walk(doc, &parse(&form.data).ops, &form.resources, &mut inner, &|_| piece, forms, out)?;
+                    walk(doc, &parse(&form.data).ops, form.resources(resources), &mut inner, &|_| piece, forms, out)?;
                     if form.obj.is_some() {
                         forms.path.pop();
                     }
                     continue;
                 }
-                let Some(r) = xo.get(name).and_then(Object::as_ref) else { continue };
+                let Some(r) = drawn.and_then(Object::as_ref) else { continue };
                 let obj = doc.get(r);
                 let Object::Stream(s) = &*obj else { continue };
                 if s.dict.name(b"Subtype") != Some(b"Image") {
@@ -382,6 +445,15 @@ pub fn reading_images(doc: &Document, page: usize) -> Result<Vec<PageImage>, Edi
     Ok(out)
 }
 
+/// The four stacking order arrangements.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum ArrangeOrder {
+    BringToFront,
+    SendToBack,
+    BringForward,
+    SendBackward,
+}
+
 /// What to do with an image.
 #[derive(Clone, Debug, PartialEq)]
 pub enum ImageChange {
@@ -394,6 +466,10 @@ pub enum ImageChange {
     /// Draw this image XObject instead, in the same place.
     Replace(ObjRef),
     Delete,
+    /// Change the stacking order.
+    Arrange(ArrangeOrder),
+    /// Remove any private crop on the image.
+    RemoveCrop,
 }
 
 /// The user-space transform that maps box `from` onto box `to` (move and resize).
@@ -473,6 +549,1081 @@ fn clip_matrix(draw: Matrix, cm: Matrix, t: Matrix) -> Option<Matrix> {
     Some(outer.then(&t).then(&outer.invert()?))
 }
 
+pub(crate) fn is_entire_page_wrapped(ops: &[Op]) -> bool {
+    if ops.len() < 2 || !ops.first().is_some_and(|o| o.is("q")) || !ops.last().is_some_and(|o| o.is("Q")) {
+        return false;
+    }
+    let mut depth: usize = 0;
+    for (i, op) in ops.iter().enumerate() {
+        if op.is("q") {
+            depth = depth.saturating_add(1);
+        } else if op.is("Q") {
+            if depth == 1 && i < ops.len().saturating_sub(1) {
+                return false;
+            }
+            depth = depth.saturating_sub(1);
+        }
+    }
+    depth == 0
+}
+
+/// The end (exclusive) of the sequence opened at `i`: just past the `close` that matches it,
+/// counting the nested `opens`, or `end` when it never closes.
+fn sequence_end(ops: &[Op], i: usize, end: usize, opens: &[&str], close: &str) -> usize {
+    let mut depth: usize = 1;
+    for (j, op) in ops.iter().enumerate().take(end).skip(i.saturating_add(1)) {
+        if opens.iter().any(|o| op.is(o)) {
+            depth = depth.saturating_add(1);
+        } else if op.is(close) {
+            depth = depth.saturating_sub(1);
+            if depth == 0 {
+                return j.saturating_add(1);
+            }
+        }
+    }
+    end
+}
+
+/// The stacking units of `ops[scan_start..scan_end]` that Arrange moves past one another, in
+/// paint order: a `q … Q`, `BT … ET` or marked-content sequence up to its matching close (or the
+/// end of the scan), a single `Do`, `sh` or inline image, or a run of other operators that ends
+/// at a path-painting operator or before the next unit. Units that paint nothing are left out.
+pub(crate) fn content_units(ops: &[Op], scan_start: usize, scan_end: usize) -> Vec<std::ops::Range<usize>> {
+    let mut units = Vec::new();
+    let mut i = scan_start;
+    while i < scan_end {
+        let Some(op) = ops.get(i) else { break };
+        let j = if op.is("BDC") || op.is("BMC") {
+            // A marked-content sequence is one unit up to its matching EMC (#3145), so Arrange moves
+            // it whole and never inserts into another one: its content belongs to its tag (ISO 32000-2
+            // § 14.6). An unbalanced sequence runs to the end of the scan.
+            sequence_end(ops, i, scan_end, &["BDC", "BMC"], "EMC")
+        } else if op.is("q") {
+            sequence_end(ops, i, scan_end, &["q"], "Q")
+        } else if op.is("BT") {
+            sequence_end(ops, i, scan_end, &[], "ET")
+        } else if op.is("BI") || op.is("Do") || op.is("sh") {
+            // The parser emits a whole inline image (`BI` … `ID` … `EI`) as one `BI` op, so it is a
+            // unit of its own (#3146).
+            i.saturating_add(1)
+        } else {
+            let mut j = i;
+            let mut found_end = false;
+            while j < scan_end {
+                let Some(next) = ops.get(j) else { break };
+                if matches!(next.op.as_slice(), b"S" | b"s" | b"f" | b"F" | b"f*" | b"B" | b"B*" | b"b" | b"b*" | b"n") {
+                    j = j.saturating_add(1);
+                    found_end = true;
+                    break;
+                } else if j > i
+                    && matches!(
+                        next.op.as_slice(),
+                        b"q" | b"Q" | b"BT" | b"BI" | b"Do" | b"sh" | b"BDC" | b"BMC" | b"EMC" | b"Tj" | b"TJ" | b"'" | b"\""
+                    )
+                {
+                    found_end = true;
+                    break;
+                }
+                j = j.saturating_add(1);
+            }
+            if found_end { j } else { scan_end.max(i.saturating_add(1)) }
+        };
+        units.push(i..j);
+        i = j;
+    }
+    units.retain(|u| {
+        ops.get(u.clone()).is_some_and(|slice| {
+            slice.iter().any(|op| {
+                matches!(
+                    op.op.as_slice(),
+                    b"Do" | b"sh" | b"BI" | b"S" | b"s" | b"f" | b"F" | b"f*" | b"B" | b"B*" | b"b" | b"b*" | b"Tj" | b"TJ" | b"'" | b"\""
+                )
+            })
+        })
+    });
+    units
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct ExtractedScopeState {
+    pub clip_ops: Vec<Op>,
+    pub state_ops: Vec<Op>,
+    pub do_op: Op,
+}
+
+#[derive(Clone, Debug, Default, PartialEq)]
+pub(crate) struct EffectiveGState {
+    pub(crate) ca: Option<f64>,
+    pub(crate) ca_stroke: Option<f64>,
+    pub(crate) bm: Option<Vec<u8>>,
+    pub(crate) smask: Option<MaskIdentity>,
+    // Printing parameters cannot generally be reset by a content-stream operator. Retain their
+    // exact values so Arrange refuses a destination whose state it cannot reconstruct.
+    print_params: std::collections::BTreeMap<Vec<u8>, std::rc::Rc<Object>>,
+    rendering_intent: Option<Vec<u8>>,
+}
+
+impl EffectiveGState {
+    pub(crate) fn visually_differs(&self, other: &EffectiveGState) -> bool {
+        (self.ca.unwrap_or(1.0) - other.ca.unwrap_or(1.0)).abs() > 1e-4
+            || (self.ca_stroke.unwrap_or(1.0) - other.ca_stroke.unwrap_or(1.0)).abs() > 1e-4
+            || self.bm.as_deref().unwrap_or(b"Normal") != other.bm.as_deref().unwrap_or(b"Normal")
+            || self.smask != other.smask
+            || self.print_params != other.print_params
+    }
+
+    #[cfg(test)]
+    pub(crate) fn merge_dict(&mut self, dict: &Dict, doc: &Document, ctm: Matrix) {
+        self.merge_shared(&Arc::new(Object::Dict(dict.clone())), doc, ctm);
+    }
+
+    fn merge_shared(&mut self, definition: &Arc<Object>, doc: &Document, ctm: Matrix) {
+        let Some(dict) = definition.as_dict() else { return };
+        for key in [b"TR".as_slice(), b"TR2", b"OP", b"op", b"OPM", b"BG", b"BG2", b"UCR", b"UCR2", b"HT"] {
+            if let Some(value) = dict.get(key) {
+                self.print_params.insert(key.to_vec(), std::rc::Rc::new(value.clone()));
+            }
+        }
+        if let Some(intent) = dict.get(b"RI").map(|v| doc.resolve(v)).and_then(|v| v.as_name().map(<[u8]>::to_vec)) {
+            self.rendering_intent = Some(intent);
+        }
+        if let Some(val) = dict.get(b"ca").map(|v| doc.resolve(v)).and_then(|v| v.as_f64()) {
+            self.ca = Some(val);
+        }
+        if let Some(val) = dict.get(b"CA").map(|v| doc.resolve(v)).and_then(|v| v.as_f64()) {
+            self.ca_stroke = Some(val);
+        }
+        if let Some(bm_obj) = dict.get(b"BM").map(|v| doc.resolve(v)) {
+            if let Some(name) = bm_obj.as_name() {
+                self.bm = Some(name.to_vec());
+            } else if let Some(arr) = bm_obj.as_array()
+                && let Some(first_name) = arr.first().map(|v| doc.resolve(v)).and_then(|v| v.as_name().map(|n| n.to_vec()))
+            {
+                self.bm = Some(first_name);
+            }
+        }
+        if let Some(raw_smask) = dict.get(b"SMask") {
+            let disabled = raw_smask.as_name() == Some(b"None") || raw_smask.as_ref().is_some_and(|r| doc.get(r).as_name() == Some(b"None"));
+            self.smask = (!disabled).then(|| MaskIdentity { definition: Arc::clone(definition), ctm });
+        }
+    }
+}
+
+const MAX_ACTIVE_GS_OPS: usize = 128;
+
+type ActiveGsOp = (Vec<u8>, Op, Matrix);
+type ActiveGsOps = std::rc::Rc<Vec<ActiveGsOp>>;
+
+#[derive(Clone, Default)]
+struct ExtendedGStateTracker {
+    stack: Vec<(EffectiveGState, ActiveGsOps)>,
+    current_state: EffectiveGState,
+    active_gs_ops: ActiveGsOps,
+    definitions: std::collections::HashMap<Vec<u8>, Arc<Object>>,
+}
+
+impl ExtendedGStateTracker {
+    fn step(&mut self, op: &Op, ext_gstates: &Dict, doc: &Document, ctm: Matrix) -> Result<(), EditError> {
+        match op.op.as_slice() {
+            b"ri" => self.current_state.rendering_intent = op.name(0).map(<[u8]>::to_vec),
+            b"q" => {
+                if self.stack.len() >= 4096 {
+                    return Err(EditError::Invalid("the image graphics state is too deeply nested".into()));
+                }
+                self.stack.push((self.current_state.clone(), std::rc::Rc::clone(&self.active_gs_ops)));
+            }
+            b"Q" => {
+                if let Some((prev_state, prev_ops)) = self.stack.pop() {
+                    self.current_state = prev_state;
+                    self.active_gs_ops = prev_ops;
+                }
+            }
+            b"gs" => {
+                let valid_gs = op.name(0).and_then(|name| {
+                    let definition = self.definitions.get(name).cloned().or_else(|| {
+                        let definition = doc.resolve(ext_gstates.get(name)?);
+                        definition.as_dict()?;
+                        self.definitions.insert(name.to_vec(), Arc::clone(&definition));
+                        Some(definition)
+                    })?;
+                    Some((name, definition))
+                });
+                if let Some((name, definition)) = valid_gs {
+                    self.current_state.merge_shared(&definition, doc, ctm);
+                    let mut next = (*self.active_gs_ops).clone();
+                    if let Some(pos) = next.iter().position(|(k, _, _)| k.as_slice() == name) {
+                        next.remove(pos);
+                    }
+                    if next.len() < MAX_ACTIVE_GS_OPS {
+                        next.push((name.to_vec(), op.clone(), ctm));
+                    }
+                    self.active_gs_ops = std::rc::Rc::new(next);
+                }
+            }
+            _ => {}
+        }
+        Ok(())
+    }
+}
+
+/// The drawing-state operators besides colour that a moved unit restores, in the order it writes them.
+const DRAWING_PARAMS: [&str; 14] = ["w", "J", "j", "M", "d", "ri", "i", "Tc", "Tw", "Tz", "TL", "Tr", "Ts", "Tf"];
+
+#[derive(Clone, Default, Debug, PartialEq)]
+struct DrawingState {
+    non_stroking_color: Option<SharedColorOps>,
+    stroking_color: Option<SharedColorOps>,
+    /// The last operator of each of [`DRAWING_PARAMS`].
+    params: [Option<std::rc::Rc<Op>>; DRAWING_PARAMS.len()],
+}
+
+// Save/restore shares operand storage, including when only the current colour changes under q.
+type SharedColorOps = std::rc::Rc<Vec<std::rc::Rc<Op>>>;
+
+/// Keep the explicit or implicit colour-space selector before `sc`/`scn` (or `SC`/`SCN`).
+fn set_color(slot: &mut Option<SharedColorOps>, op: &Op, space: &str) {
+    match slot {
+        Some(ops) if ops.first().is_some_and(|o| o.is(space) || matches!(o.op.as_slice(), b"g" | b"rg" | b"k" | b"G" | b"RG" | b"K")) => {
+            let ops = std::rc::Rc::make_mut(ops);
+            ops.truncate(1);
+            ops.push(std::rc::Rc::new(op.clone()));
+        }
+        _ => *slot = Some(std::rc::Rc::new(vec![std::rc::Rc::new(op.clone())])),
+    }
+}
+
+#[derive(Clone, Default, Debug)]
+struct DrawingStateTracker {
+    stack: Vec<DrawingState>,
+    current: DrawingState,
+}
+
+impl DrawingStateTracker {
+    fn step(&mut self, op: &Op) -> Result<(), EditError> {
+        match op.op.as_slice() {
+            b"q" => {
+                if self.stack.len() >= 4096 {
+                    return Err(EditError::Invalid("the image graphics state is too deeply nested".into()));
+                }
+                self.stack.push(self.current.clone());
+            }
+            b"Q" => {
+                if let Some(prev) = self.stack.pop() {
+                    self.current = prev;
+                }
+            }
+            b"g" | b"rg" | b"k" | b"cs" => self.current.non_stroking_color = Some(std::rc::Rc::new(vec![std::rc::Rc::new(op.clone())])),
+            b"sc" | b"scn" => set_color(&mut self.current.non_stroking_color, op, "cs"),
+            b"G" | b"RG" | b"K" | b"CS" => self.current.stroking_color = Some(std::rc::Rc::new(vec![std::rc::Rc::new(op.clone())])),
+            b"SC" | b"SCN" => set_color(&mut self.current.stroking_color, op, "CS"),
+            _ => {
+                if let Some(slot) = DRAWING_PARAMS.iter().position(|p| op.is(p)).and_then(|k| self.current.params.get_mut(k)) {
+                    *slot = Some(std::rc::Rc::new(op.clone()));
+                }
+            }
+        }
+        Ok(())
+    }
+}
+
+/// Initial line style, rendering intent and text-state parameters.
+fn initial_param(name: &str) -> Option<Op> {
+    use pdfcraft_content::num;
+    let operands = match name {
+        "w" => vec![num(1.0)],
+        "J" | "j" => vec![num(0.0)],
+        "M" => vec![num(10.0)],
+        "d" => vec![Object::Array(vec![]), num(0.0)],
+        "ri" => vec![Object::name("RelativeColorimetric")],
+        "Tc" | "Tw" | "TL" | "Tr" | "Ts" => vec![num(0.0)],
+        "Tz" => vec![num(100.0)],
+        _ => return None,
+    };
+    Some(Op::new(name, operands))
+}
+
+/// The drawing state the image had at `source` that differs at `dest`, unless the moved unit's own
+/// state operators (`extracted_state_ops`) set it.
+fn compute_inherited_drawing_ops(source: &DrawingState, dest: &DrawingState, extracted_state_ops: &[Op]) -> Vec<Op> {
+    let sets = |names: &[&str]| extracted_state_ops.iter().any(|o| names.iter().any(|n| o.is(n)));
+    let mut ops = Vec::new();
+    for (own, source, dest, black) in [
+        (sets(&["g", "rg", "k", "cs"]), &source.non_stroking_color, &dest.non_stroking_color, "g"),
+        (sets(&["G", "RG", "K", "CS"]), &source.stroking_color, &dest.stroking_color, "G"),
+    ] {
+        match (own, source, dest) {
+            (true, _, _) | (false, None, None) => {}
+            (false, Some(color), _) => ops.extend(color.iter().map(|op| (**op).clone())),
+            (false, None, Some(_)) => ops.push(Op::new(black, vec![pdfcraft_content::num(0.0)])),
+        }
+    }
+    let mut text_ops = Vec::new();
+    for ((name, source), dest) in DRAWING_PARAMS.iter().zip(&source.params).zip(&dest.params) {
+        let output = if matches!(*name, "Tc" | "Tw" | "Tz" | "TL" | "Tr" | "Ts" | "Tf") { &mut text_ops } else { &mut ops };
+        match (sets(&[name]), source, dest) {
+            (true, _, _) | (false, None, None) => {}
+            (false, Some(op), _) => output.push((**op).clone()),
+            (false, None, Some(_)) => output.extend(initial_param(name)),
+        }
+    }
+    if !text_ops.is_empty() {
+        // Forms inherit text state, even though each BT resets its text matrices.
+        ops.push(Op::new("BT", vec![]));
+        ops.extend(text_ops);
+        ops.push(Op::new("ET", vec![]));
+    }
+    ops
+}
+
+/// The operators that set `clip` again, in user space. [`ImageState`] builds clips only from
+/// finite points with `m`, `l`, `c` and `h`, so `None` (a quadratic segment) does not happen.
+fn clip_path_to_ops(clip: &ClipPath) -> Option<Vec<Op>> {
+    let mut ops = Vec::new();
+    if clip.app_crop {
+        ops.push(crop_marker());
+    }
+    for el in clip.path.elements() {
+        let (name, points) = match el {
+            kurbo::PathEl::MoveTo(p) => ("m", vec![*p]),
+            kurbo::PathEl::LineTo(p) => ("l", vec![*p]),
+            kurbo::PathEl::CurveTo(p1, p2, p3) => ("c", vec![*p1, *p2, *p3]),
+            kurbo::PathEl::ClosePath => ("h", Vec::new()),
+            kurbo::PathEl::QuadTo(..) => return None,
+        };
+        ops.push(Op::new(name, points.iter().flat_map(|p| [pdfcraft_content::num(p.x), pdfcraft_content::num(p.y)]).collect()));
+    }
+    if !ops.is_empty() {
+        ops.push(Op::new(if clip.even_odd { "W*" } else { "W" }, vec![]));
+        ops.push(Op::new("n", vec![]));
+    }
+    Some(ops)
+}
+
+pub(crate) fn extract_scope_state(ops: &[Op], start: usize, target: usize, initial_ctm: Matrix) -> Result<Option<ExtractedScopeState>, EditError> {
+    if target >= ops.len() || start > target {
+        return Ok(None);
+    }
+    let target_op = ops.get(target).cloned().ok_or_else(|| EditError::Invalid("the image operation is missing".into()))?;
+    if start == target {
+        return Ok(Some(ExtractedScopeState { clip_ops: Vec::new(), state_ops: Vec::new(), do_op: target_op }));
+    }
+    let mut clip_ops = Vec::new();
+    let mut state_ops = Vec::new();
+    let mut pending_path: Vec<Op> = Vec::new();
+    let mut pending_clip = false;
+    let mut active_path = false;
+    let mut depth: usize = 0;
+    let mut matrix = initial_ctm;
+    let mut matrix_at_clip = None;
+
+    let scan_start = if ops.get(start).is_some_and(|o| o.is("q")) { start.saturating_add(1) } else { start };
+
+    for i in scan_start..target {
+        let Some(op) = ops.get(i) else {
+            return Ok(None);
+        };
+        match op.op.as_slice() {
+            b"q" => {
+                if depth >= 4096 {
+                    return Err(EditError::Invalid("the image graphics state is too deeply nested".into()));
+                }
+                depth = depth.saturating_add(1);
+            }
+            b"Q" => {
+                if depth == 0 {
+                    return Ok(None);
+                }
+                depth = depth.saturating_sub(1);
+            }
+            _ if depth > 0 => {}
+            b"cm" => {
+                if active_path {
+                    return Ok(None);
+                }
+                if let Some(m) = op.nums::<6>() {
+                    matrix = Matrix(m).then(&matrix);
+                }
+            }
+            b"m" | b"l" | b"c" | b"v" | b"y" | b"re" | b"h" => {
+                active_path = true;
+                pending_path.push(op.clone());
+            }
+            b"W" | b"W*" => {
+                if !active_path {
+                    return Ok(None);
+                }
+                pending_clip = true;
+                pending_path.push(op.clone());
+            }
+            b"n" => {
+                if pending_clip {
+                    if matrix_at_clip.is_none() {
+                        matrix_at_clip = Some(matrix);
+                    } else if matrix_at_clip != Some(matrix) {
+                        return Ok(None);
+                    }
+                    clip_ops.extend(std::mem::take(&mut pending_path));
+                    clip_ops.push(op.clone());
+                    pending_clip = false;
+                    active_path = false;
+                } else {
+                    pending_path.clear();
+                    active_path = false;
+                }
+            }
+            b"S" | b"s" | b"f" | b"F" | b"f*" | b"B" | b"B*" | b"b" | b"b*" => {
+                if pending_clip {
+                    return Ok(None);
+                }
+                pending_path.clear();
+                active_path = false;
+            }
+            b"gs" | b"CS" | b"cs" | b"SC" | b"sc" | b"SCN" | b"scn" | b"G" | b"g" | b"RG" | b"rg" | b"K" | b"k" | b"ri" | b"i" => {
+                state_ops.push(op.clone());
+            }
+            b"BT" => {
+                return Ok(None);
+            }
+            _ => {}
+        }
+    }
+
+    if depth != 0 || active_path || pending_clip {
+        return Ok(None);
+    }
+
+    if !clip_ops.is_empty() && matrix_at_clip != Some(Matrix::IDENTITY) {
+        return Ok(None);
+    }
+
+    Ok(Some(ExtractedScopeState { clip_ops, state_ops, do_op: target_op }))
+}
+
+/// The unit `order` puts the image's unit `target_idx` next to, and whether after it. An image that
+/// shares its unit with other paint at the limit moves within that unit, past or behind the paint.
+fn target_destination_unit<'a>(
+    units: &'a [std::ops::Range<usize>],
+    target_idx: usize,
+    target_unit: &'a std::ops::Range<usize>,
+    order: ArrangeOrder,
+    has_other_paint: bool,
+) -> Result<(&'a std::ops::Range<usize>, bool), EditError> {
+    let forward = matches!(order, ArrangeOrder::BringToFront | ArrangeOrder::BringForward);
+    let refused = || EditError::Invalid(if forward { "the image is already in front" } else { "the image is already at the back" }.into());
+    let at_limit = if forward { target_idx.saturating_add(1) >= units.len() } else { target_idx == 0 };
+    if at_limit {
+        return if has_other_paint { Ok((target_unit, forward)) } else { Err(refused()) };
+    }
+    let dest = match order {
+        ArrangeOrder::BringToFront => units.last(),
+        ArrangeOrder::SendToBack => units.first(),
+        ArrangeOrder::BringForward => units.get(target_idx.saturating_add(1)),
+        ArrangeOrder::SendBackward => target_idx.checked_sub(1).and_then(|i| units.get(i)),
+    };
+    dest.map(|u| (u, forward)).ok_or_else(refused)
+}
+
+/// A moved unit must not borrow a graphics or marked-content boundary from its neighbours.
+fn balanced_arrange_span(ops: &[Op], range: std::ops::Range<usize>) -> bool {
+    let Some(slice) = ops.get(range) else { return false };
+    let (mut graphics, mut marked) = (0usize, 0usize);
+    for op in slice {
+        let depth = match op.op.as_slice() {
+            b"q" => {
+                graphics = graphics.saturating_add(1);
+                continue;
+            }
+            b"BDC" | b"BMC" => {
+                marked = marked.saturating_add(1);
+                continue;
+            }
+            b"Q" => &mut graphics,
+            b"EMC" => &mut marked,
+            _ => continue,
+        };
+        let Some(next) = depth.checked_sub(1) else { return false };
+        *depth = next;
+    }
+    graphics == 0 && marked == 0
+}
+
+/// What Arrange takes out: the byte span, the op where the image's own scope state starts, and the
+/// ops `start..end` removed. That is the image's own `q … Q` scope inside its unit, else the `Do`
+/// alone when the unit paints something else too, else the whole unit.
+fn determine_arrange_spans(
+    ops: &[Op],
+    target: usize,
+    target_unit: &std::ops::Range<usize>,
+    has_other_paint: bool,
+    marked_unit: bool,
+) -> Result<(std::ops::Range<usize>, usize, usize, usize), EditError> {
+    let scope = image_scopes(ops, target, "arranged")
+        .ok()
+        .and_then(|s| s.isolated)
+        .filter(|&(start, end, _)| start >= target_unit.start && end < target_unit.end);
+    let unit_last = target_unit.end.saturating_sub(1);
+    let (first, scope_start, last) = match scope {
+        Some((start, end, _)) if has_other_paint || !marked_unit => (start, start, end),
+        _ if has_other_paint => (target, target, target),
+        // A marked-content unit holding only this image moves whole, with its BDC…EMC.
+        // The whole sequence is removed; the image's state is rebuilt from the ops inside it.
+        _ if marked_unit => (target_unit.start, target_unit.start.saturating_add(1).min(target), unit_last),
+        _ => (target_unit.start, target_unit.start, unit_last),
+    };
+    if !balanced_arrange_span(ops, first..last.saturating_add(1)) {
+        return Err(EditError::Invalid("cannot arrange an image across graphics or marked-content boundaries".into()));
+    }
+    let missing = || EditError::Invalid("the image content unit could not be located".into());
+    let start = ops.get(first).ok_or_else(missing)?.span.start;
+    let end = ops.get(last).ok_or_else(missing)?.span.end;
+    Ok((start..end, scope_start, first, last.saturating_add(1)))
+}
+
+fn scan_leaking_ops(ops: &[Op], rem_start: usize, rem_end: usize) -> (Vec<Op>, bool) {
+    let mut q_depth = 0usize;
+    let mut leaking_ops = Vec::new();
+    let mut pending_clip_path: Vec<Op> = Vec::new();
+    let mut pending_clip = false;
+    let mut has_leaking_clip = false;
+    for op in ops.get(rem_start..rem_end).unwrap_or_default() {
+        match op.op.as_slice() {
+            b"q" => q_depth = q_depth.saturating_add(1),
+            b"Q" => q_depth = q_depth.saturating_sub(1),
+            b"m" | b"l" | b"c" | b"v" | b"y" | b"re" | b"h" if q_depth == 0 => {
+                pending_clip_path.push(op.clone());
+            }
+            b"W" | b"W*" if q_depth == 0 => {
+                if !pending_clip_path.is_empty() {
+                    pending_clip = true;
+                    pending_clip_path.push(op.clone());
+                }
+            }
+            b"n" if q_depth == 0 => {
+                if pending_clip {
+                    pending_clip_path.push(op.clone());
+                    leaking_ops.extend(std::mem::take(&mut pending_clip_path));
+                    has_leaking_clip = true;
+                    pending_clip = false;
+                } else {
+                    pending_clip_path.clear();
+                }
+            }
+            b"rg" | b"RG" | b"g" | b"G" | b"k" | b"K" | b"cs" | b"CS" | b"sc" | b"scn" | b"SC" | b"SCN" | b"w" | b"J" | b"j" | b"M" | b"d"
+            | b"ri" | b"i" | b"gs" | b"Tf" | b"Tc" | b"Tw" | b"Tz" | b"TL" | b"Tr" | b"Ts"
+                if q_depth == 0 =>
+            {
+                leaking_ops.push(op.clone());
+            }
+            b"cm" if q_depth == 0 => {
+                leaking_ops.push(op.clone());
+            }
+            _ => {
+                if q_depth == 0 && !op.is("BDC") && !op.is("BMC") && !op.is("EMC") && !pending_clip {
+                    pending_clip_path.clear();
+                }
+            }
+        }
+    }
+    (leaking_ops, has_leaking_clip)
+}
+
+fn build_relocated_unit_ops(
+    marked_open: Option<&Op>,
+    source_gs_ops: &[(Op, Matrix)],
+    inherited_drawing_ops: &[Op],
+    extracted: ExtractedScopeState,
+    dest_ctm: Matrix,
+    draw_matrix: [f64; 6],
+    has_closing_emc: bool,
+) -> Result<Vec<Op>, EditError> {
+    let mut unit_ops = Vec::new();
+    if let Some(open) = marked_open {
+        unit_ops.push(open.clone());
+    }
+    unit_ops.push(Op::new("q", vec![]));
+    let mut current_ctm = dest_ctm;
+
+    for (gs_op, target_ctm) in source_gs_ops {
+        if *target_ctm != current_ctm {
+            let current_inv = current_ctm.invert().ok_or_else(|| EditError::Invalid("unsupported graphics state: non-invertible CTM".into()))?;
+            let delta = target_ctm.then(&current_inv);
+            if !delta.0.iter().all(|v| v.is_finite()) {
+                return Err(EditError::Invalid("unsupported graphics state: invalid transform coordinates".into()));
+            }
+            if delta != Matrix::IDENTITY {
+                unit_ops.push(Op::new("cm", delta.0.map(pdfcraft_content::num).to_vec()));
+                current_ctm = *target_ctm;
+            }
+        }
+        unit_ops.push(gs_op.clone());
+    }
+
+    unit_ops.extend(inherited_drawing_ops.iter().cloned());
+
+    let non_gs_ops = extracted.state_ops.into_iter().filter(|o| !o.is("gs"));
+    unit_ops.extend(non_gs_ops);
+
+    if !extracted.clip_ops.is_empty() {
+        if current_ctm != Matrix::IDENTITY {
+            let current_inv = current_ctm.invert().ok_or_else(|| EditError::Invalid("unsupported graphics state: non-invertible CTM".into()))?;
+            unit_ops.push(Op::new("cm", current_inv.0.map(pdfcraft_content::num).to_vec()));
+        }
+        unit_ops.extend(extracted.clip_ops);
+        if Matrix(draw_matrix) != Matrix::IDENTITY {
+            unit_ops.push(Op::new("cm", draw_matrix.map(pdfcraft_content::num).to_vec()));
+        }
+    } else if Matrix(draw_matrix) != current_ctm {
+        let current_inv = current_ctm.invert().ok_or_else(|| EditError::Invalid("unsupported graphics state: non-invertible CTM".into()))?;
+        let delta = Matrix(draw_matrix).then(&current_inv);
+        if !delta.0.iter().all(|v| v.is_finite()) {
+            return Err(EditError::Invalid("unsupported graphics state: invalid transform coordinates".into()));
+        }
+        if delta != Matrix::IDENTITY {
+            unit_ops.push(Op::new("cm", delta.0.map(pdfcraft_content::num).to_vec()));
+        }
+    }
+    unit_ops.push(extracted.do_op);
+    unit_ops.push(Op::new("Q", vec![]));
+    if has_closing_emc {
+        unit_ops.push(Op::new("EMC", vec![]));
+    }
+    Ok(unit_ops)
+}
+
+/// Change the stacking order of `img`, drawn on page `p` by its content streams `all`.
+fn arrange_image(
+    doc: &mut Document,
+    p: &pdfcraft_model::Page,
+    all: &[(Object, Vec<u8>)],
+    img: &PageImage,
+    order: ArrangeOrder,
+) -> Result<(), EditError> {
+    let pieces = joined(all);
+    let ops = pieces.parse().ops;
+    let target = img.op;
+    let target_op = ops.get(target).filter(|op| op.is("Do")).ok_or_else(|| EditError::Invalid("the image operation could not be located".into()))?;
+
+    let is_wrapped = is_entire_page_wrapped(&ops);
+    let (scan_start, scan_end) = if is_wrapped { (1, ops.len().saturating_sub(1)) } else { (0, ops.len()) };
+    let units = content_units(&ops, scan_start, scan_end);
+    let Some((target_idx, target_unit)) = units.iter().enumerate().find(|(_, u)| u.contains(&target)) else {
+        return Err(EditError::Invalid("the image content unit could not be located".into()));
+    };
+    let has_other_paint = ops.iter().enumerate().any(|(i, op)| {
+        i >= target_unit.start
+            && i < target_unit.end
+            && i != target
+            && matches!(
+                op.op.as_slice(),
+                b"Do" | b"Tj" | b"TJ" | b"'" | b"\"" | b"sh" | b"BI" | b"S" | b"s" | b"f" | b"F" | b"f*" | b"B" | b"B*" | b"b" | b"b*"
+            )
+    });
+    if units.len() <= 1 && !has_other_paint {
+        return Err(EditError::Invalid("the page has only one content unit to arrange".into()));
+    }
+
+    let (dest_unit, insert_after) = target_destination_unit(&units, target_idx, target_unit, order, has_other_paint)?;
+    if !balanced_arrange_span(&ops, target_unit.clone()) || !balanced_arrange_span(&ops, dest_unit.clone()) {
+        return Err(EditError::Invalid("cannot arrange an image across graphics or marked-content boundaries".into()));
+    }
+
+    // A marked-content sequence that holds other content cannot be split without generating
+    // a new structure element and MCID, so we refuse to rearrange it to avoid leaving the image untagged.
+    // If the sequence holds only this image, the whole marked unit is moved intact.
+    let marked_unit = ops.get(target_unit.start).is_some_and(|o| o.is("BDC") || o.is("BMC"));
+    let marked_depth = ops.iter().take(target).fold(0usize, |depth, op| {
+        if op.is("BDC") || op.is("BMC") {
+            depth.saturating_add(1)
+        } else if op.is("EMC") {
+            depth.saturating_sub(1)
+        } else {
+            depth
+        }
+    });
+    if marked_depth > usize::from(marked_unit) {
+        return Err(EditError::Invalid("cannot rearrange an image out of a nested marked-content sequence".into()));
+    }
+    if marked_unit && has_other_paint {
+        return Err(EditError::Invalid("cannot rearrange an image that shares a marked-content sequence with other content".into()));
+    }
+
+    let (mut target_span, scope_start, rem_start, rem_end) = determine_arrange_spans(&ops, target, target_unit, has_other_paint, marked_unit)?;
+
+    let missing = || EditError::Invalid("the destination content unit could not be located".into());
+    let (dest_pos, scan_target) = if insert_after {
+        (dest_unit.end.checked_sub(1).and_then(|i| ops.get(i)).ok_or_else(missing)?.span.end, dest_unit.end)
+    } else {
+        (ops.get(dest_unit.start).ok_or_else(missing)?.span.start, dest_unit.start)
+    };
+
+    // An added item owns its entire stream: editing or deleting it replaces that stream.
+    // Insert ordinary artwork next to the complete owned unit in a separate stream instead.
+    let destination_piece = if insert_after {
+        dest_unit.end.checked_sub(1).and_then(|i| ops.get(i)).map(|op| pieces.piece_of(op.span.end.saturating_sub(1)))
+    } else {
+        ops.get(dest_unit.start).map(|op| pieces.piece_of(op.span.start))
+    };
+    let owned_destination = destination_piece
+        .filter(|piece| all.get(*piece).is_some_and(|(obj, _)| doc.resolve(obj).as_dict().is_some_and(|d| d.get(b"PCAdded").is_some())));
+    if let Some(piece) = owned_destination {
+        let whole_unit = ops.iter().enumerate().all(|(index, op)| {
+            let (first, last) = pieces.pieces_of(op);
+            if dest_unit.contains(&index) { first == piece && last == piece } else { piece < first || piece > last }
+        });
+        if !whole_unit || img.stream == piece {
+            return Err(EditError::Invalid("cannot arrange an image inside an added item's content stream".into()));
+        }
+    }
+
+    let (leaking_ops, has_leaking_clip) = scan_leaking_ops(&ops, rem_start, rem_end);
+
+    let res = p.dict.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned()).unwrap_or_default();
+    let ext_gstates = res.get(b"ExtGState").map(|g| doc.resolve(g)).and_then(|g| g.as_dict().cloned()).unwrap_or_default();
+
+    let mut state = ImageState::new(Matrix::IDENTITY, p.crop(doc), Vec::new());
+    let mut tracker = ExtendedGStateTracker::default();
+    let mut drawing_tracker = DrawingStateTracker::default();
+    let mut source_effective_state = EffectiveGState::default();
+    let mut source_gs_ops = Vec::new();
+    let mut source_drawing_state = DrawingState::default();
+    let mut dest_effective_state = EffectiveGState::default();
+    let mut dest_drawing_state = DrawingState::default();
+    let mut dest_ctm = Matrix::IDENTITY;
+    let mut scope_start_ctm = Matrix::IDENTITY;
+    let mut outer_clips = Vec::new();
+    let mut dest_clips = Vec::new();
+    let mut ctm_before_removal = Matrix::IDENTITY;
+    let mut ctm_after_removal = Matrix::IDENTITY;
+
+    let max_scan = scan_target.max(target.saturating_add(1)).max(scope_start.saturating_add(1)).max(rem_end);
+    for (i, op) in ops.iter().enumerate() {
+        if i == rem_start {
+            ctm_before_removal = state.placement.matrix;
+        }
+        if i == scope_start {
+            scope_start_ctm = state.placement.matrix;
+            outer_clips = state.placement.clips.clone();
+        }
+        if i == target {
+            source_effective_state = tracker.current_state.clone();
+            source_gs_ops = tracker.active_gs_ops.iter().map(|(_, op, ctm)| (op.clone(), *ctm)).collect();
+            source_drawing_state = drawing_tracker.current.clone();
+        }
+        if i == scan_target {
+            dest_effective_state = tracker.current_state.clone();
+            dest_drawing_state = drawing_tracker.current.clone();
+            dest_ctm = state.placement.matrix;
+            dest_clips = state.placement.clips.clone();
+        }
+        if i >= max_scan {
+            break;
+        }
+        state.apply(op)?;
+        tracker.step(op, &ext_gstates, doc, state.placement.matrix)?;
+        drawing_tracker.step(op)?;
+        if op.is("gs")
+            && op.name(0).and_then(|name| tracker.definitions.get(name)).and_then(|gs| gs.as_dict()).is_some_and(|gs| gs.get(b"Font").is_some())
+            && let Some(font) = DRAWING_PARAMS.iter().position(|name| *name == "Tf").and_then(|index| drawing_tracker.current.params.get_mut(index))
+        {
+            // The replayed gs selects its font; do not overwrite it with an older direct Tf.
+            *font = None;
+        }
+        if op.is("gs")
+            && let Some(intent) = &tracker.current_state.rendering_intent
+        {
+            drawing_tracker.step(&Op::new("ri", vec![Object::Name(intent.clone())]))?;
+        }
+        if i == rem_end.saturating_sub(1) {
+            ctm_after_removal = state.placement.matrix;
+        }
+    }
+    if scan_target >= ops.len() {
+        dest_effective_state = tracker.current_state.clone();
+        dest_drawing_state = drawing_tracker.current.clone();
+        dest_ctm = state.placement.matrix;
+        dest_clips = state.placement.clips.clone();
+    }
+    if dest_ctm.invert().is_none() {
+        return Err(EditError::Invalid("unsupported graphics state: non-invertible CTM".into()));
+    }
+
+    let owned_crop = ops.get(scope_start..target).unwrap_or_default().iter().any(|op| op.is("MP") && op.name(0) == Some(b"PdfCraftImageCrop"));
+    let extracted_scope = if owned_crop { None } else { extract_scope_state(&ops, scope_start, target, scope_start_ctm)? };
+    let mut extracted = match extracted_scope {
+        Some(ext) => ext,
+        None if scope_start != target => {
+            if !marked_unit || has_other_paint {
+                target_span = target_op.span.clone();
+            }
+            extract_scope_state(&ops, target, target, Matrix(img.draw_matrix))?
+                .ok_or_else(|| EditError::Invalid("unsupported graphics state: unable to cleanly extract image scope state".into()))?
+        }
+        None => {
+            return Err(EditError::Invalid("unsupported graphics state: unable to cleanly extract image scope state".into()));
+        }
+    };
+
+    // The clips the moved unit draws itself: all of the image's when they are rebuilt from
+    // `img.clips`, else those its own scope set after the clips around it.
+    let all_clips = extracted.clip_ops.is_empty();
+    let reemitted = if all_clips {
+        img.clips.as_slice()
+    } else if img.clips.starts_with(&outer_clips) {
+        img.clips.get(outer_clips.len()..).unwrap_or_default()
+    } else {
+        return Err(EditError::Invalid("unsupported graphics state: the image clipping path cannot be cleanly preserved".into()));
+    };
+    // At the destination it is clipped by the clips there and the ones it draws. Moving past a
+    // clip the image isn't under (or out from under one it is) would change what part shows.
+    if !dest_clips.iter().all(|c| img.clips.contains(c)) || !img.clips.iter().all(|c| dest_clips.contains(c) || reemitted.contains(c)) {
+        return Err(EditError::Invalid(
+            "unsupported graphics state: moving the image past a clipping path would change what part of it shows".into(),
+        ));
+    }
+
+    if all_clips {
+        for clip in &img.clips {
+            let ops = clip_path_to_ops(clip)
+                .ok_or_else(|| EditError::Invalid("unsupported graphics state: the image clipping path cannot be cleanly preserved".into()))?;
+            extracted.clip_ops.extend(ops);
+        }
+    }
+
+    let has_inherited_clip = !img.clips.is_empty() && extracted.clip_ops.is_empty();
+    if has_inherited_clip {
+        return Err(EditError::Invalid("unsupported graphics state: inherited clipping path cannot be cleanly preserved".into()));
+    }
+
+    let mut reconstructed_state = dest_effective_state.clone();
+    for (op, ctm) in &source_gs_ops {
+        if let Some(name) = op.name(0)
+            && let Some(definition) = tracker.definitions.get(name)
+        {
+            reconstructed_state.merge_shared(definition, doc, *ctm);
+        }
+    }
+
+    if reconstructed_state.visually_differs(&source_effective_state) {
+        return Err(EditError::Invalid(
+            "unsupported graphics state: moving the image would alter opacity, blend mode, soft mask, or printing parameters".into(),
+        ));
+    }
+
+    let marked_open = if marked_unit && !has_other_paint { ops.get(target_unit.start) } else { None };
+    let has_closing_emc = marked_open.is_some() && target_unit.end.checked_sub(1).and_then(|i| ops.get(i)).is_some_and(|o| o.is("EMC"));
+    let inherited_drawing_ops = compute_inherited_drawing_ops(&source_drawing_state, &dest_drawing_state, &extracted.state_ops);
+    let unit_ops =
+        build_relocated_unit_ops(marked_open, &source_gs_ops, &inherited_drawing_ops, extracted, dest_ctm, img.draw_matrix, has_closing_emc)?;
+
+    let mut serialized = Vec::new();
+    serialized.push(b'\n');
+    serialized.extend_from_slice(&serialize_ops(&unit_ops));
+    serialized.push(b'\n');
+
+    let leaking = if let Some(inv) = ctm_before_removal.invert() { ctm_after_removal.then(&inv) } else { Matrix::IDENTITY };
+    if leaking != Matrix::IDENTITY && has_leaking_clip {
+        return Err(EditError::Invalid("unsupported graphics state: moving the image would alter clipping path transform".into()));
+    }
+    let mut leak_ops = leaking_ops;
+    if leaking != Matrix::IDENTITY && leak_ops.iter().all(|o| !o.is("cm")) {
+        leak_ops.insert(0, Op::new("cm", leaking.0.map(pdfcraft_content::num).to_vec()));
+    }
+    let removal_replacement = if !leak_ops.is_empty() {
+        let mut s = Vec::new();
+        s.push(b'\n');
+        s.extend_from_slice(&serialize_ops(&leak_ops));
+        s.push(b'\n');
+        s
+    } else {
+        Vec::new()
+    };
+
+    if let Some(piece) = owned_destination {
+        let changed = pieces.splice([(target_span, removal_replacement)]);
+        let contents = crate::text::rewritten_contents(doc, all, changed);
+        let mut list = match contents {
+            Object::Array(list) => list,
+            one => vec![one],
+        };
+        let insertion = piece.saturating_add(usize::from(insert_after));
+        if insertion > list.len() {
+            return Err(EditError::Invalid("the destination content stream is missing".into()));
+        }
+        let relocated = doc.add(Object::Stream(pdfcraft_cos::Stream::flate(Dict::new(), &serialized)));
+        list.insert(insertion, Object::Ref(relocated));
+        doc.update_dict(p.obj, |d| d.set(b"Contents".to_vec(), Object::Array(list)))?;
+        return Ok(());
+    }
+
+    let mut edits = Vec::new();
+    if dest_pos >= target_span.end {
+        edits.push((target_span, removal_replacement));
+        edits.push((dest_pos..dest_pos, serialized));
+    } else if dest_pos <= target_span.start {
+        edits.push((dest_pos..dest_pos, serialized));
+        edits.push((target_span, removal_replacement));
+    } else {
+        return Err(EditError::Invalid("cannot arrange image into overlapping content range".into()));
+    }
+
+    let changed = pieces.splice(edits);
+    let contents = crate::text::rewritten_contents(doc, all, changed);
+    doc.update_dict(p.obj, |d| d.set(b"Contents".to_vec(), contents))?;
+    Ok(())
+}
+
+/// The saved graphics-state scopes (`q … Q`) around the `Do` at `target` that paint nothing else,
+/// each as `(q, Q, CTM before the q)`.
+struct ImageScopes {
+    /// The innermost one inside which every clip on the image is set.
+    isolated: Option<(usize, usize, Matrix)>,
+    /// The outermost one. It holds all of the image's private clips, but not a clip set outside it.
+    outermost: Option<(usize, usize, Matrix)>,
+    /// The CTM at the `Do`, and whether a clip applies there.
+    placement: Matrix,
+    clipped: bool,
+}
+
+impl ImageScopes {
+    /// The saved graphics-state scope containing just this image and its crop, or the `Do` alone
+    /// when nothing clips it. Applying a transform before that scope moves the actual clipping path
+    /// as well as the pixels. A shared clip must never be moved along with unrelated artwork or text.
+    ///
+    /// Under a clip set outside every scope that holds only this image (a report or table drawing
+    /// each picture as `q re W n cm Do Q` inside a section's clip), no scope contains every active
+    /// clip. The outermost scope holding only the image is used then: it contains all of the
+    /// image's private clips, which move with it, while the outer clip is shared and stays.
+    fn transform_scope(&self, target: usize) -> Option<(usize, usize, Matrix)> {
+        if !self.clipped {
+            return Some((target, target, self.placement));
+        }
+        self.isolated.or(self.outermost)
+    }
+}
+
+/// [`ImageScopes`] of the `Do` at `target`. An image inside a text object cannot be `done`.
+fn image_scopes(ops: &[Op], target: usize, done: &str) -> Result<ImageScopes, EditError> {
+    struct Scope {
+        start: usize,
+        matrix: Matrix,
+        inherited_clip: bool,
+        inherited_path: bool,
+        selected: bool,
+        other_paint: bool,
+    }
+    let mut stack: Vec<Scope> = Vec::new();
+    let mut matrix = Matrix::IDENTITY;
+    let mut clipped = false;
+    let mut path = false;
+    let mut pending_clip = false;
+    let mut text = false;
+    let mut at_image = None;
+    let mut isolated = None;
+    let mut outermost = None;
+    for (index, op) in ops.iter().enumerate() {
+        match op.op.as_slice() {
+            b"q" => {
+                if stack.len() >= 256 {
+                    return Err(EditError::Invalid("the image graphics state is too deeply nested".into()));
+                }
+                stack.push(Scope { start: index, matrix, inherited_clip: clipped, inherited_path: path, selected: false, other_paint: false });
+            }
+            b"Q" => {
+                if let Some(scope) = stack.pop() {
+                    if scope.selected && !scope.other_paint && !scope.inherited_path {
+                        let found = (scope.start, index, scope.matrix);
+                        if !scope.inherited_clip {
+                            isolated.get_or_insert(found);
+                        }
+                        // Scopes close inner first, so the last one recorded is the outermost.
+                        outermost = Some(found);
+                    }
+                    matrix = scope.matrix;
+                    clipped = scope.inherited_clip;
+                    path = scope.inherited_path;
+                    pending_clip = false;
+                }
+            }
+            b"cm" => {
+                if let Some(m) = op.nums::<6>() {
+                    matrix = Matrix(m).then(&matrix);
+                }
+            }
+            b"BT" => text = true,
+            b"ET" => text = false,
+            b"m" | b"l" | b"c" | b"v" | b"y" | b"re" | b"h" => path = true,
+            b"W" | b"W*" => pending_clip = true,
+            _ => {}
+        }
+        if index == target {
+            if text {
+                return Err(EditError::Invalid(format!("an image inside a text object cannot be {done}")));
+            }
+            at_image = Some((matrix, clipped));
+            for scope in &mut stack {
+                scope.selected = true;
+            }
+        } else if matches!(
+            op.op.as_slice(),
+            b"Do" | b"Tj" | b"TJ" | b"'" | b"\"" | b"sh" | b"BI" | b"S" | b"s" | b"f" | b"F" | b"f*" | b"B" | b"B*" | b"b" | b"b*"
+        ) {
+            for scope in &mut stack {
+                scope.other_paint = true;
+            }
+        }
+        if matches!(op.op.as_slice(), b"n" | b"S" | b"s" | b"f" | b"F" | b"f*" | b"B" | b"B*" | b"b" | b"b*") {
+            clipped |= pending_clip;
+            pending_clip = false;
+            path = false;
+        }
+    }
+    let (placement, clipped) = at_image.ok_or_else(|| EditError::Invalid("the image operation is missing".into()))?;
+    Ok(ImageScopes { isolated, outermost, placement, clipped })
+}
+
+/// A marked-content point identifies only the clipping path written by this editor.
+/// It does not open a marked-content sequence or change the document's structure tags.
+fn crop_marker() -> Op {
+    Op::new("MP", vec![Object::Name(b"PdfCraftImageCrop".to_vec())])
+}
+
+fn app_crop_ranges(ops: &[Op], start: usize, target: usize) -> Vec<std::ops::Range<usize>> {
+    let mut ranges = Vec::new();
+    for (index, op) in ops.iter().enumerate().take(target).skip(start) {
+        if !op.is("MP") || op.name(0) != Some(b"PdfCraftImageCrop") {
+            continue;
+        }
+        let path_start = index.saturating_add(1);
+        let mut end = path_start;
+        while end < target && ops.get(end).is_some_and(|o| matches!(o.op.as_slice(), b"m" | b"l" | b"c" | b"v" | b"y" | b"h" | b"re")) {
+            end = end.saturating_add(1);
+        }
+        if end > path_start && ops.get(end).is_some_and(|o| o.is("W") || o.is("W*")) && ops.get(end.saturating_add(1)).is_some_and(|o| o.is("n")) {
+            ranges.push(index..end.saturating_add(2));
+        }
+    }
+    ranges
+}
+
+/// Remove only crops written by PdfCraft, preserving the document author's clipping paths.
+fn remove_image_crop(doc: &mut Document, p: &pdfcraft_model::Page, all: &[(Object, Vec<u8>)], img: &PageImage) -> Result<(), EditError> {
+    let pieces = joined(all);
+    let ops = pieces.parse().ops;
+    let target = img.op;
+    let scope = image_scopes(&ops, target, "cropped")?;
+    let Some((start, _, _)) = scope.transform_scope(target) else {
+        return Err(EditError::Invalid("the image has no PdfCraft crop to remove".into()));
+    };
+    let crops = app_crop_ranges(&ops, start, target);
+    if crops.is_empty() {
+        return Err(EditError::Invalid("the image has no PdfCraft crop to remove".into()));
+    }
+    let changed = crate::text::splice(&pieces, &ops, |index| (Vec::new(), !crops.iter().any(|r| r.contains(&index))));
+    let contents = crate::text::rewritten_contents(doc, all, changed);
+    doc.update_dict(p.obj, |d| d.set(b"Contents".to_vec(), contents))?;
+    Ok(())
+}
+
 /// Change image `index` (from [`page_images`]) on `page`.
 pub fn change_image(doc: &mut Document, page: usize, index: usize, change: &ImageChange) -> Result<(), EditError> {
     let images = page_images(doc, page)?;
@@ -490,8 +1641,14 @@ pub fn change_image(doc: &mut Document, page: usize, index: usize, change: &Imag
         ImageChange::Transform(t) => {
             return transform_image(doc, &p, &all, &img, *t);
         }
+        ImageChange::Arrange(order) => {
+            return arrange_image(doc, &p, &all, &img, *order);
+        }
+        ImageChange::RemoveCrop => {
+            return remove_image_crop(doc, &p, &all, &img);
+        }
         ImageChange::Crop(keep) => {
-            return crop_image(doc, &p, &all, &img, *keep);
+            return crop_image_impl(doc, &p, &all, &img, *keep);
         }
         ImageChange::Replace(r) => {
             if img.is_form {
@@ -534,94 +1691,6 @@ pub(crate) fn selectable_images(
         .collect())
 }
 
-/// Find the saved graphics-state scope containing just this image and its crop. Applying
-/// the transform before that scope moves the actual clipping path as well as the pixels.
-/// A shared clip must never be moved along with unrelated artwork or text.
-///
-/// Under a clip set outside every scope that holds only this image (a report or table drawing
-/// each picture as `q re W n cm Do Q` inside a section's clip), no scope contains every active
-/// clip. The outermost scope holding only the image is used then: it contains all of the
-/// image's private clips, which move with it, while the outer clip is shared and stays.
-fn image_transform_scope(ops: &[Op], target: usize) -> Result<Option<(usize, usize, Matrix)>, EditError> {
-    struct Scope {
-        start: usize,
-        matrix: Matrix,
-        inherited_clip: bool,
-        inherited_path: bool,
-        selected: bool,
-        other_paint: bool,
-    }
-    let mut stack: Vec<Scope> = Vec::new();
-    let mut matrix = Matrix::IDENTITY;
-    let mut clipped = false;
-    let mut path = false;
-    let mut pending_clip = false;
-    let mut text = false;
-    let mut at_image = None;
-    let mut isolated = None;
-    let mut outermost = None;
-    for (index, op) in ops.iter().enumerate() {
-        match op.op.as_slice() {
-            b"q" => {
-                if stack.len() >= 256 {
-                    return Err(EditError::Invalid("the image graphics state is too deeply nested to transform".into()));
-                }
-                stack.push(Scope { start: index, matrix, inherited_clip: clipped, inherited_path: path, selected: false, other_paint: false });
-            }
-            b"Q" => {
-                if let Some(scope) = stack.pop() {
-                    if scope.selected && !scope.other_paint && !scope.inherited_path {
-                        if !scope.inherited_clip {
-                            // Prefer the innermost scope that contains every active clipping path.
-                            isolated.get_or_insert((scope.start, index, scope.matrix));
-                        }
-                        // Scopes close inner first, so the last one recorded is the outermost.
-                        outermost = Some((scope.start, index, scope.matrix));
-                    }
-                    matrix = scope.matrix;
-                    clipped = scope.inherited_clip;
-                }
-            }
-            b"cm" => {
-                if let Some(m) = op.nums::<6>() {
-                    matrix = Matrix(m).then(&matrix);
-                }
-            }
-            b"BT" => text = true,
-            b"ET" => text = false,
-            b"m" | b"l" | b"c" | b"v" | b"y" | b"re" => path = true,
-            b"W" | b"W*" => pending_clip = true,
-            _ => {}
-        }
-        if index == target {
-            if text {
-                return Err(EditError::Invalid("an image inside a text object cannot be transformed".into()));
-            }
-            at_image = Some((matrix, clipped));
-            for scope in &mut stack {
-                scope.selected = true;
-            }
-        } else if matches!(
-            op.op.as_slice(),
-            b"Do" | b"Tj" | b"TJ" | b"'" | b"\"" | b"sh" | b"BI" | b"S" | b"s" | b"f" | b"F" | b"f*" | b"B" | b"B*" | b"b" | b"b*"
-        ) {
-            for scope in &mut stack {
-                scope.other_paint = true;
-            }
-        }
-        if matches!(op.op.as_slice(), b"n" | b"S" | b"s" | b"f" | b"F" | b"f*" | b"B" | b"B*" | b"b" | b"b*") {
-            clipped |= pending_clip;
-            pending_clip = false;
-            path = false;
-        }
-    }
-    let (placement, clipped) = at_image.ok_or_else(|| EditError::Invalid("the image operation is missing".into()))?;
-    if !clipped {
-        return Ok(Some((target, target, placement)));
-    }
-    Ok(isolated.or(outermost))
-}
-
 fn transform_image(
     doc: &mut Document,
     page: &pdfcraft_model::Page,
@@ -640,12 +1709,14 @@ fn transform_image(
     }
     // A private path crop moves with its image regardless of intervening state operators.
     // Shared crops retain the existing fixed-clip behavior, preserving neighbouring paint.
-    let (start, end, placement) = image_transform_scope(&ops, target)?.unwrap_or((target, target, Matrix(image.draw_matrix)));
+    let (start, end, placement) =
+        image_scopes(&ops, target, "transformed")?.transform_scope(target).unwrap_or((target, target, Matrix(image.draw_matrix)));
     let inverse = placement.invert().ok_or_else(|| EditError::Invalid("the image has no area".into()))?;
     let local = placement.then(&Matrix(transform)).then(&inverse);
     if !local.0.iter().all(|v| v.is_finite() && v.abs() <= 1e12) {
         return Err(EditError::Invalid("the image transform is too large".into()));
     }
+
     // Already alone in a `q cm … Q` (its own placement, or the wrapper an earlier edit added):
     // change that `cm` in place. The CTM inside is `local · cm · outer` either way.
     if let Some((at, cm)) = enclosing_transform(&ops, start, end) {
@@ -686,13 +1757,16 @@ fn transform_image(
 /// that holds the image and its private crop (or a new `q … Q` around the `Do`), written in
 /// that scope's coordinates as the box's four corners, so a turned image crops to an upright
 /// box too and a later transform of the scope moves the crop with the pixels.
-fn crop_image(
+fn crop_image_impl(
     doc: &mut Document,
     page: &pdfcraft_model::Page,
     streams: &[(Object, Vec<u8>)],
     image: &PageImage,
     keep: [f64; 4],
 ) -> Result<(), EditError> {
+    if image.is_form {
+        return Err(EditError::Invalid("cropping grouped Form artwork is not supported".into()));
+    }
     if !keep.iter().all(|v| v.is_finite() && v.abs() <= 1e12) {
         return Err(EditError::Invalid("the crop box must be finite and no larger than 1e12".into()));
     }
@@ -700,36 +1774,53 @@ fn crop_image(
     if x1 - x0 < 1e-6 || y1 - y0 < 1e-6 {
         return Err(EditError::Invalid("the crop box has no area".into()));
     }
+    if intersection(image.rect, [x0, y0, x1, y1]).is_none() {
+        return Err(EditError::Invalid("the crop box does not intersect the image".into()));
+    }
+
     let pieces = joined(streams);
     let ops = pieces.parse().ops;
     let target = image.op;
     if !ops.get(target).is_some_and(|op| op.is("Do")) {
         return Err(EditError::Invalid("the image operation could not be located".into()));
     }
-    let (start, end, placement) = image_transform_scope(&ops, target)?.unwrap_or((target, target, Matrix(image.draw_matrix)));
+    let (start, end, placement) =
+        image_scopes(&ops, target, "cropped")?.transform_scope(target).unwrap_or((target, target, Matrix(image.draw_matrix)));
     let inverse = placement.invert().ok_or_else(|| EditError::Invalid("the image has no area".into()))?;
     let corners = [(x0, y0), (x1, y0), (x1, y1), (x0, y1)].map(|(x, y)| inverse.apply(x, y));
     if !corners.iter().all(|(x, y)| x.is_finite() && y.is_finite() && x.abs() <= 1e12 && y.abs() <= 1e12) {
         return Err(EditError::Invalid("the crop box is too large for the image's placement".into()));
     }
-    let clip: Vec<Op> = corners
-        .iter()
-        .enumerate()
-        .map(|(i, (x, y))| Op::new(if i == 0 { "m" } else { "l" }, vec![Object::Real(*x), Object::Real(*y)]))
-        .chain([Op::new("h", vec![]), Op::new("W", vec![]), Op::new("n", vec![])])
-        .collect();
-    // The image's own earlier crop (a clipping path right after the scope's `q`) gives way to
-    // the new one, so a crop can grow again as well as shrink.
-    let old_clip: Option<std::ops::Range<usize>> = (start != end)
-        .then(|| {
-            let mut k = start + 1;
-            while ops.get(k).is_some_and(|o| matches!(o.op.as_slice(), b"m" | b"l" | b"c" | b"v" | b"y" | b"h" | b"re")) {
-                k += 1;
-            }
-            (k > start + 1 && ops.get(k).is_some_and(|o| matches!(o.op.as_slice(), b"W" | b"W*")) && ops.get(k + 1).is_some_and(|o| o.is("n")))
-                .then_some(start + 1..k + 2)
-        })
-        .flatten();
+    let is_axis_aligned = ((corners[0].1 - corners[1].1).abs() < 1e-4
+        && (corners[1].0 - corners[2].0).abs() < 1e-4
+        && (corners[2].1 - corners[3].1).abs() < 1e-4
+        && (corners[3].0 - corners[0].0).abs() < 1e-4)
+        || ((corners[0].0 - corners[1].0).abs() < 1e-4
+            && (corners[1].1 - corners[2].1).abs() < 1e-4
+            && (corners[2].0 - corners[3].0).abs() < 1e-4
+            && (corners[3].1 - corners[0].1).abs() < 1e-4);
+    let mut clip: Vec<Op> = if is_axis_aligned {
+        let min_x = corners.iter().map(|(x, _)| *x).fold(f64::INFINITY, f64::min);
+        let max_x = corners.iter().map(|(x, _)| *x).fold(f64::NEG_INFINITY, f64::max);
+        let min_y = corners.iter().map(|(_, y)| *y).fold(f64::INFINITY, f64::min);
+        let max_y = corners.iter().map(|(_, y)| *y).fold(f64::NEG_INFINITY, f64::max);
+        vec![
+            Op::new("re", vec![Object::Real(min_x), Object::Real(min_y), Object::Real(max_x - min_x), Object::Real(max_y - min_y)]),
+            Op::new("W", vec![]),
+            Op::new("n", vec![]),
+        ]
+    } else {
+        corners
+            .iter()
+            .enumerate()
+            .map(|(i, (x, y))| Op::new(if i == 0 { "m" } else { "l" }, vec![Object::Real(*x), Object::Real(*y)]))
+            .chain([Op::new("h", vec![]), Op::new("W", vec![]), Op::new("n", vec![])])
+            .collect()
+    };
+    clip.insert(0, crop_marker());
+    // Replace only our identified crop; an author's path must remain intact.
+    let old_crops = app_crop_ranges(&ops, start, target);
+    let insert_at = start.saturating_add(1);
     let changed = crate::text::splice(&pieces, &ops, |index| {
         if start == end && index == target {
             // No scope of its own yet: one around the drawing, with the crop inside.
@@ -738,10 +1829,10 @@ fn crop_image(
             out.extend(ops.get(index).cloned());
             out.push(Op::new("Q", vec![]));
             (out, false)
-        } else if start != end && index == start + 1 {
+        } else if start != end && index == insert_at {
             // Inside the scope's `q`, before whatever it draws (in place of its old crop).
-            (clip.clone(), old_clip.is_none())
-        } else if old_clip.as_ref().is_some_and(|r| r.contains(&index)) {
+            (clip.clone(), !old_crops.iter().any(|r| r.contains(&index)))
+        } else if old_crops.iter().any(|r| r.contains(&index)) {
             (Vec::new(), false)
         } else {
             (Vec::new(), true)
@@ -787,6 +1878,42 @@ pub(crate) fn translate_images(doc: &mut Document, page: usize, indexes: &[usize
     }
     // Images alone in their own `q re W n cm Do Q` take the clip with them.
     let mut clips = std::collections::BTreeMap::new();
+    let mut crop_starts = std::collections::BTreeMap::new();
+    let mut crop_ends = std::collections::BTreeSet::new();
+    let mut folds = std::collections::BTreeMap::new();
+    for image in images.iter().filter(|image| image.has_editor_crop()) {
+        let Some(&(_, _, offset)) = plans.get(&image.op) else { continue };
+        let Some((start, end, placement)) = image_scopes(&ops, image.op, "moved")?.transform_scope(image.op) else {
+            return Err(EditError::Invalid("the image crop cannot be moved independently".into()));
+        };
+        let inverse = placement.invert().ok_or_else(|| EditError::Invalid("a selected image has no area".into()))?;
+        let local = placement.then(&Matrix::translate(offset[0], offset[1])).then(&inverse);
+        if !local.0.iter().all(|v| v.is_finite() && v.abs() <= 1e12) {
+            return Err(EditError::Invalid("the image move is too large".into()));
+        }
+        let leading_transform = || {
+            let at = start.checked_add(1)?;
+            if start >= end || !ops.get(start)?.is("q") || !ops.get(at)?.is("cm") {
+                return None;
+            }
+            ops.get(at)?.nums::<6>().map(|m| (at, Matrix(m)))
+        };
+        // An enclosing cm is before the captured placement; an inside-scope cm is after it.
+        // Their multiplication orders differ when that cm scales or shears a translation.
+        let folded = enclosing_transform(&ops, start, end)
+            .map(|(at, cm)| (at, local.then(&cm)))
+            .or_else(|| leading_transform().map(|(at, cm)| (at, cm.then(&local))));
+        if let Some((at, folded)) = folded {
+            if !folded.0.iter().all(|v| v.is_finite() && v.abs() <= 1e12) {
+                return Err(EditError::Invalid("the image move is too large".into()));
+            }
+            folds.insert(at, folded);
+        } else {
+            crop_starts.insert(start, local);
+            crop_ends.insert(end);
+        }
+        plans.remove(&image.op);
+    }
     for index in 0..ops.len() {
         let Some(&(_, placement, offset)) = plans.get(&index) else { continue };
         let Some((at, cm)) = exclusive_clip(&ops, index) else { continue };
@@ -807,7 +1934,6 @@ pub(crate) fn translate_images(doc: &mut Document, page: usize, indexes: &[usize
         };
     }
     // An image already alone in `q cm Do Q` moves by changing that `cm`, not by nesting another.
-    let mut folds = std::collections::BTreeMap::new();
     for index in 0..ops.len() {
         let Some(&(movement, _, _)) = plans.get(&index) else { continue };
         let Some((at, cm)) = enclosing_transform(&ops, index, index) else { continue };
@@ -822,6 +1948,14 @@ pub(crate) fn translate_images(doc: &mut Document, page: usize, indexes: &[usize
         return Err(EditError::Invalid("a selected image operation is missing".into()));
     }
     let data = crate::text::splice(&pieces, &ops, |index| {
+        if let Some(matrix) = crop_starts.remove(&index) {
+            return (vec![Op::new("q", vec![]), Op::new("cm", matrix.0.map(Object::Real).to_vec())], true);
+        }
+        if crop_ends.remove(&index) {
+            let mut out: Vec<_> = ops.get(index).cloned().into_iter().collect();
+            out.push(Op::new("Q", vec![]));
+            return (out, false);
+        }
         if let Some((c, keep)) = clips.remove(&index) {
             return (vec![Op::new("cm", c.0.map(Object::Real).to_vec())], keep);
         }
@@ -841,3 +1975,44 @@ pub(crate) fn translate_images(doc: &mut Document, page: usize, indexes: &[usize
     doc.update_dict(p.obj, |d| d.set(b"Contents".to_vec(), contents))?;
     Ok(())
 }
+
+#[cfg(test)]
+mod allocation_tests {
+    use super::*;
+
+    #[test]
+    fn saved_drawing_states_share_large_operand_storage() {
+        let mut tracker = DrawingStateTracker::default();
+        let parsed = parse(b"[1 2 3 4 5 6 7 8] 0 d /Pattern cs 1 2 3 4 5 6 /P scn q q q");
+        for op in &parsed.ops {
+            tracker.step(op).unwrap();
+        }
+        for state in &tracker.stack {
+            let dash = state.params[4].as_ref().unwrap();
+            let current_dash = tracker.current.params[4].as_ref().unwrap();
+            assert!(std::ptr::eq(dash.operands.as_ptr(), current_dash.operands.as_ptr()), "q must share the dash operands instead of cloning them");
+            let color = state.non_stroking_color.as_ref().unwrap().last().unwrap();
+            let current_color = tracker.current.non_stroking_color.as_ref().unwrap().last().unwrap();
+            assert!(std::ptr::eq(color.operands.as_ptr(), current_color.operands.as_ptr()), "q must share scn operands instead of cloning them");
+        }
+        let saved = tracker.current.clone();
+        for op in &parse(b"[9 10] 0 d 4 5 6 /Other scn Q").ops {
+            tracker.step(op).unwrap();
+        }
+        assert_eq!(tracker.current, saved, "changing shared operands must preserve the saved state");
+    }
+
+    #[test]
+    fn review_soft_mask_identity_includes_establishment_matrix() {
+        let doc = Document::new_empty();
+        let mask = Dict::from_iter([(b"S".to_vec(), Object::name("Alpha")), (b"G".to_vec(), Object::Ref(ObjRef::new(8, 0)))]);
+        let definition = Dict::from_iter([(b"SMask".to_vec(), Object::Dict(mask))]);
+        let states = Dict::from_iter([(b"A".to_vec(), Object::Dict(definition))]);
+        let mut tracker = ExtendedGStateTracker::default();
+        let op = Op::new("gs", vec![Object::name("A")]);
+        tracker.step(&op, &states, &doc, Matrix::IDENTITY).unwrap();
+        let before = tracker.current_state.clone();
+        tracker.step(&op, &states, &doc, Matrix::translate(50.0, 0.0)).unwrap();
+        assert!(before.visually_differs(&tracker.current_state), "the same mask established under a different CTM is a different effective mask");
+    }
+}
diff --git a/crates/edit/src/lib.rs b/crates/edit/src/lib.rs
index 193f7d8424..44a6730acc 100644
--- a/crates/edit/src/lib.rs
+++ b/crates/edit/src/lib.rs
@@ -1,6 +1,11 @@
 //! pdfcraft-edit — page content editing (L4). Today: page marks, Acrobat's Header & footer,
 //! Watermark, Background and Bates numbering (execution plan M7.6).
 //!
+//! **Atomic page-mark operations.** Adding or replacing headers/footers, watermarks and backgrounds
+//! stages the whole call on a document snapshot and commits only after every selected page succeeds.
+//! An error preserves existing marks, content, resources, pending edits and allocated objects. The
+//! snapshot shares original PDF bytes and unchanged objects; it copies the overlay table and metadata.
+//!
 //! **How marks are stored.** Each mark is one content stream appended to (or, for content behind
 //! the page, inserted after the backgrounds at the start of) the page's `/Contents`, drawn in
 //! display space (after `/Rotate`) and wrapped in a marked-content artifact (§14.8.2.2) so
@@ -35,6 +40,7 @@ pub type Rgb = [f64; 3];
 
 pub mod backdrop;
 pub use backdrop::{Backdrop, backdrops_left_off, page_backdrop, page_backdrops};
+pub use text::strip_subset_tag;
 mod background;
 pub use background::page_background;
 pub mod objects;
@@ -43,7 +49,7 @@ pub use objects::{EditableObject, MAX_MOVE_OBJECTS, ObjectKind, ObjectTarget, ed
 mod flatten;
 pub use flatten::{flatten, flatten_fill_sign};
 pub mod images;
-pub use images::{ImageChange, PageImage, change_image, page_images, reading_images, rect_to_rect, turn_about_centre, turn_by_degrees};
+pub use images::{ArrangeOrder, ImageChange, PageImage, change_image, page_images, reading_images, rect_to_rect, turn_about_centre, turn_by_degrees};
 pub mod bidi;
 pub mod indic;
 mod linebreak;
diff --git a/crates/edit/src/mark_transaction_tests.rs b/crates/edit/src/mark_transaction_tests.rs
new file mode 100644
index 0000000000..2623da88ba
--- /dev/null
+++ b/crates/edit/src/mark_transaction_tests.rs
@@ -0,0 +1,211 @@
+//! The public mark APIs either commit the complete operation or leave the document untouched.
+use super::{cx, fixture, reopen, streams};
+use crate::place::MARK_PLACEMENT_FAILURE;
+use crate::*;
+use pdfcraft_cos::{ObjRef, SaveOptions, write_incremental};
+
+const SELECTED: &[usize] = &[0, 1, 2];
+
+struct PlacementFailure;
+
+impl PlacementFailure {
+    fn after_two_pages(kind: MarkKind) -> Self {
+        MARK_PLACEMENT_FAILURE.with(|failure| {
+            assert!(failure.get().is_none());
+            failure.set(Some((kind, 2, 0)));
+        });
+        Self
+    }
+
+    fn completed(&self) -> usize {
+        MARK_PLACEMENT_FAILURE.with(|failure| failure.get().unwrap().2)
+    }
+}
+
+impl Drop for PlacementFailure {
+    fn drop(&mut self) {
+        MARK_PLACEMENT_FAILURE.with(|failure| failure.set(None));
+    }
+}
+
+/// Four pages share an original stream and resources, both inherited and directly referenced.
+/// All have all three existing marks, including a picture background with a replaced white fill.
+fn marked_document() -> (Document, MarkSource) {
+    let mut doc = fixture();
+    let parent = ObjRef::new(2, 0);
+    let extra = doc.add(Object::Dict(Dict::from_iter([
+        (b"Type".to_vec(), Object::name("Page")),
+        (b"Parent".to_vec(), Object::Ref(parent)),
+        (b"Contents".to_vec(), Object::Ref(ObjRef::new(7, 0))),
+    ])));
+    doc.update_dict(parent, |d| {
+        d.set(b"Kids".to_vec(), Object::Array([3, 4, 5].map(|n| Object::Ref(ObjRef::new(n, 0))).into_iter().chain([Object::Ref(extra)]).collect()));
+        d.set(b"Count".to_vec(), Object::Int(4));
+    })
+    .unwrap();
+    doc.set(ObjRef::new(7, 0), Object::Stream(Stream::from_raw(Dict::new(), b"1 g 0 0 600 800 re f 0 g BT /F1 9 Tf (Original page) Tj ET".to_vec())));
+    let picture = |doc: &mut Document, gray| {
+        let image = doc.add(Object::Stream(Stream::from_raw(
+            Dict::from_iter([
+                (b"Type".to_vec(), Object::name("XObject")),
+                (b"Subtype".to_vec(), Object::name("Image")),
+                (b"Width".to_vec(), Object::Int(1)),
+                (b"Height".to_vec(), Object::Int(1)),
+                (b"ColorSpace".to_vec(), Object::name("DeviceGray")),
+                (b"BitsPerComponent".to_vec(), Object::Int(8)),
+            ]),
+            vec![gray],
+        )));
+        MarkSource { xobject: image, size: (1.0, 1.0), image: true }
+    };
+    let old_picture = picture(&mut doc, 170);
+    let replacement_picture = picture(&mut doc, 80);
+    let all = [0, 1, 2, 3];
+    let hf = HeaderFooter {
+        text: ["Old header".into(), String::new(), String::new(), String::new(), String::new(), String::new()],
+        font: added::Family::Times,
+        ..Default::default()
+    };
+    add_header_footer(&mut doc, &all, &hf, false, &cx()).unwrap();
+    add_watermark(&mut doc, &all, &Watermark { text: "Old watermark".into(), opacity: 0.45, ..Default::default() }, false).unwrap();
+    add_background(&mut doc, &all, &Background { source: Some(old_picture), opacity: 0.6, replace_backdrop: true, ..Default::default() }, false)
+        .unwrap();
+    let pages = page_list(&doc);
+    let shared = ObjRef::new(6, 0);
+    let resources = (*doc.resolve(pages[0].dict.get(b"Resources").unwrap())).clone();
+    doc.set(shared, resources);
+    for (i, page) in pages.iter().enumerate() {
+        doc.update_dict(page.obj, |d| {
+            if i % 2 == 0 {
+                d.set(b"Resources".to_vec(), Object::Ref(shared));
+            } else {
+                d.remove(b"Resources");
+            }
+        })
+        .unwrap();
+    }
+    let doc = reopen(&doc);
+    assert!(!doc.is_modified());
+    let pages = page_list(&doc);
+    assert_eq!(pages.len(), 4);
+    assert!(doc.get(pages[1].obj).as_dict().unwrap().get(b"Resources").is_none(), "a selected page inherits its resources");
+    assert_eq!(pages[0].dict.get(b"Resources").and_then(Object::as_ref), Some(shared));
+    assert_eq!(pages[2].dict.get(b"Resources").and_then(Object::as_ref), Some(shared));
+    for i in 0..4 {
+        for kind in [MarkKind::HeaderFooter, MarkKind::Watermark, MarkKind::Background] {
+            assert_eq!(mark_streams(&doc, i, kind).len(), 1, "page {i} has existing {kind:?}");
+        }
+    }
+    (doc, replacement_picture)
+}
+
+fn mark_streams(doc: &Document, page: usize, kind: MarkKind) -> Vec<String> {
+    streams(doc, page).into_iter().filter(|s| s.contains(&format!("/PCMark /{}", kind.tag()))).collect()
+}
+
+fn apply_replacement(doc: &mut Document, kind: MarkKind, source: MarkSource, replace: bool) -> Result<(), EditError> {
+    match kind {
+        MarkKind::HeaderFooter => add_header_footer(
+            doc,
+            SELECTED,
+            &HeaderFooter {
+                text: ["New header".into(), String::new(), String::new(), String::new(), String::new(), String::new()],
+                font: added::Family::Courier,
+                shrink: true,
+                ..Default::default()
+            },
+            replace,
+            &cx(),
+        ),
+        MarkKind::Watermark => add_watermark(doc, SELECTED, &Watermark { source: Some(source), opacity: 0.25, ..Default::default() }, replace),
+        MarkKind::Background => {
+            add_background(doc, SELECTED, &Background { color: [0.1, 0.3, 0.7], replace_backdrop: true, ..Default::default() }, replace)
+        }
+    }
+}
+
+fn unchanged_after_later_page_failure(kind: MarkKind) {
+    // Replacement and addition share the same operation boundary; exercise replacement first.
+    for (replace, pending_edit) in [(true, false), (true, true), (false, false), (false, true)] {
+        let (mut doc, source) = marked_document();
+        if pending_edit {
+            let pending = doc.add(Object::String(pdfcraft_cos::PdfString::literal(b"unsaved caller edit".to_vec())));
+            doc.update_dict(page_list(&doc)[0].obj, |d| d.set(b"CallerEdit".to_vec(), Object::Ref(pending))).unwrap();
+        }
+        let modified = doc.is_modified();
+        let before = write_incremental(&doc, &SaveOptions::default()).unwrap();
+        let objects = doc.object_numbers().len();
+        let mut allocation_probe = doc.clone();
+        let next_object = allocation_probe.add(Object::Null);
+        let failure = PlacementFailure::after_two_pages(kind);
+        let result = apply_replacement(&mut doc, kind, source, replace);
+        assert_eq!(result, Err(EditError::Invalid("injected mark placement failure".into())));
+        assert_eq!(failure.completed(), 2, "the error followed two real page placements");
+        assert_eq!(doc.object_numbers().len(), objects, "{kind:?}, replace={replace}: no allocated objects remain");
+        assert_eq!(doc.is_modified(), modified, "{kind:?}, replace={replace}: the dirty state is preserved");
+        assert!(write_incremental(&doc, &SaveOptions::default()).unwrap() == before, "{kind:?}, replace={replace}: every byte stays unchanged");
+        assert_eq!(doc.add(Object::Null), next_object, "the allocation cursor is unchanged too");
+    }
+}
+
+#[test]
+fn header_footer_changes_are_atomic_after_a_later_page_failure() {
+    unchanged_after_later_page_failure(MarkKind::HeaderFooter);
+}
+
+#[test]
+fn watermark_changes_are_atomic_after_a_later_page_failure() {
+    unchanged_after_later_page_failure(MarkKind::Watermark);
+}
+
+#[test]
+fn background_changes_are_atomic_after_a_later_page_failure() {
+    unchanged_after_later_page_failure(MarkKind::Background);
+}
+
+#[test]
+fn replacements_commit_all_selected_pages_and_preserve_other_marks_and_shared_resources() {
+    for kind in [MarkKind::HeaderFooter, MarkKind::Watermark, MarkKind::Background] {
+        let (mut doc, source) = marked_document();
+        let before = doc.clone();
+        let expected = match kind {
+            MarkKind::HeaderFooter => "(New header)".to_string(),
+            MarkKind::Watermark => format!("/PCPic{} Do", source.xobject.num),
+            MarkKind::Background => "0.1 0.3 0.7 rg".to_string(),
+        };
+        apply_replacement(&mut doc, kind, source, true).unwrap();
+        let doc = reopen(&doc);
+        assert_eq!(streams(&doc, 3), streams(&before, 3), "the unselected page keeps its content");
+        let unselected = page_list(&before)[3].obj;
+        assert_eq!(doc.get(unselected), before.get(unselected), "the unselected page keeps its resources and entries");
+        for reference in [ObjRef::new(6, 0), ObjRef::new(7, 0)] {
+            assert_eq!(
+                format!("{:?}", doc.get(reference)),
+                format!("{:?}", before.get(reference)),
+                "shared resources and original content stay unchanged"
+            );
+        }
+        for page in SELECTED {
+            let marks = mark_streams(&doc, *page, kind);
+            assert_eq!(marks.len(), 1, "one replacement on selected page {page}");
+            assert!(marks[0].contains(&expected), "the new mark is present: {}", marks[0]);
+            let old_page = &page_list(&before)[*page];
+            let new_page = &page_list(&doc)[*page];
+            let old_resources = before.resolve(old_page.dict.get(b"Resources").unwrap());
+            let new_resources = doc.resolve(new_page.dict.get(b"Resources").unwrap());
+            for category in [&b"Font"[..], &b"ExtGState"[..], &b"XObject"[..]] {
+                let old = before.resolve(old_resources.as_dict().unwrap().get(category).unwrap());
+                let new = doc.resolve(new_resources.as_dict().unwrap().get(category).unwrap());
+                for (name, value) in old.as_dict().unwrap().iter() {
+                    assert_eq!(new.as_dict().unwrap().get(name), Some(value), "old resources remain usable on page {page}");
+                    assert_eq!(doc.resolve(value), before.resolve(value), "referenced resource contents are unchanged on page {page}");
+                }
+            }
+            for other in [MarkKind::HeaderFooter, MarkKind::Watermark, MarkKind::Background] {
+                if other != kind {
+                    assert_eq!(mark_streams(&doc, *page, other), mark_streams(&before, *page, other), "unrelated {other:?} on page {page}");
+                }
+            }
+        }
+    }
+}
diff --git a/crates/edit/src/marks.rs b/crates/edit/src/marks.rs
index d936955184..344c76250f 100644
--- a/crates/edit/src/marks.rs
+++ b/crates/edit/src/marks.rs
@@ -286,7 +286,12 @@ pub fn expand(template: &str, page_number: u32, count: usize, bates: u64, cx: &C
                 let digits = parts.get(1).and_then(|d| d.parse::<usize>().ok()).unwrap_or(6).clamp(1, 15);
                 format!("{}{:0digits$}{}", parts.get(3).unwrap_or(&""), bates, parts.get(4).unwrap_or(&""))
             }
-            _ => format!("<<{token}>>"),
+            _ => {
+                // Not a token: emit one `<` and retry, so a later token is still found.
+                out.push('<');
+                rest = &rest[start + 1..];
+                continue;
+            }
         };
         out.push_str(&value);
         rest = &after[end + 2..];
@@ -302,3 +307,16 @@ pub(crate) fn bates_start(template: &str) -> Option<u64> {
     let t = &t[..t.find(">>")?];
     t.split('#').nth(2).and_then(|s| s.parse().ok()).or(Some(1))
 }
+
+#[cfg(test)]
+mod expand_tests {
+    use super::*;
+
+    #[test]
+    fn expand_token_after_extra_angle_brackets() {
+        let cx = Context::default();
+        assert_eq!(expand("<<<1>>>", 3, 9, 1, &cx), "<3>");
+        assert_eq!(expand("<< <<1>>", 3, 9, 1, &cx), "<< 3");
+        assert_eq!(expand("<<x>> <<1>>", 3, 9, 1, &cx), "<<x>> 3");
+    }
+}
diff --git a/crates/edit/src/place.rs b/crates/edit/src/place.rs
index 2f2c24c862..b535d60563 100644
--- a/crates/edit/src/place.rs
+++ b/crates/edit/src/place.rs
@@ -294,7 +294,32 @@ pub(crate) fn isolation(doc: &Document, list: &[Object]) -> Isolation {
 /// Put a mark's content on a page: behind (with the behind-marks at the start) or on top
 /// (appended, after wrapping the original content in q/Q).
 pub(crate) fn place(doc: &mut Document, page: &pdfcraft_model::Page, kind: MarkKind, content: Vec<u8>, behind: bool) -> Result<(), EditError> {
-    place_tagged(doc, page, kind.tag(), content, behind).map(drop)
+    place_tagged(doc, page, kind.tag(), content, behind)?;
+    #[cfg(test)]
+    fail_after_mark_placement(kind)?;
+    Ok(())
+}
+
+#[cfg(test)]
+thread_local! {
+    /// Force an error after N completed placements of one kind, on this test thread only.
+    pub(crate) static MARK_PLACEMENT_FAILURE: std::cell::Cell<Option<(MarkKind, usize, usize)>> = const { std::cell::Cell::new(None) };
+}
+
+#[cfg(test)]
+fn fail_after_mark_placement(kind: MarkKind) -> Result<(), EditError> {
+    MARK_PLACEMENT_FAILURE.with(|failure| {
+        if let Some((target, after, completed)) = failure.get()
+            && target == kind
+        {
+            let completed = completed.saturating_add(1);
+            failure.set(Some((target, after, completed)));
+            if completed == after {
+                return Err(EditError::Invalid("injected mark placement failure".into()));
+            }
+        }
+        Ok(())
+    })
 }
 
 /// Put content on a page, tagged `tag` (see [`place`]). On top, whatever graphics state the
diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index d45e983a2e..e78da842b8 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -4,6 +4,9 @@ use pdfcraft_cos::{Document, SaveOptions, write_full, write_incremental};
 
 use super::*;
 
+#[path = "mark_transaction_tests.rs"]
+mod mark_transactions;
+
 /// Three pages: an upright page with content that leaves the graphics state changed (an
 /// unbalanced `cm`), a page rotated 90° and one with inherited, shared resources.
 fn fixture() -> Document {
@@ -3516,11 +3519,24 @@ fn image_page() -> Document {
     image_page_with("q 200 0 0 100 100 100 cm /Im0 Do Q BT /F1 12 Tf 72 700 Td (Caption) Tj ET")
 }
 
+/// Arrange, Crop and Remove crop as the engine asks for them, through [`images::change_image`].
+fn arrange(doc: &mut Document, page: usize, index: usize, order: images::ArrangeOrder) -> Result<(), EditError> {
+    images::change_image(doc, page, index, &images::ImageChange::Arrange(order))
+}
+
+fn crop(doc: &mut Document, page: usize, index: usize, keep: [f64; 4]) -> Result<(), EditError> {
+    images::change_image(doc, page, index, &images::ImageChange::Crop(keep))
+}
+
+fn remove_crop(doc: &mut Document, page: usize, index: usize) -> Result<(), EditError> {
+    images::change_image(doc, page, index, &images::ImageChange::RemoveCrop)
+}
+
 fn image_page_with(content: &str) -> Document {
     let objs: Vec<String> = vec![
         "<< /Type /Catalog /Pages 2 0 R >>".into(),
         "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
-        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 600 800] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> /XObject << /Im0 6 0 R >> >> >>".into(),
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 600 800] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> /XObject << /Im0 6 0 R >> /ExtGState << /GS0 << /Type /ExtGState /ca 0.5 /CA 0.5 >> /GSalpha << /Type /ExtGState /ca 0.6 >> /GSblend << /Type /ExtGState /BM /Multiply >> /GS_translucent << /Type /ExtGState /ca 0.5 >> >> >> >>".into(),
         format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len()),
         "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".into(),
         "<< /Type /XObject /Subtype /Image /Width 4 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 8 /Length 8 >>\nstream\n\u{0}\u{0}\u{0}\u{0}\u{0}\u{0}\u{0}\u{0}\nendstream".into(),
@@ -3540,6 +3556,57 @@ fn image_page_with(content: &str) -> Document {
     Document::open(Arc::new(out)).unwrap()
 }
 
+fn stencil_page_with(content: &str) -> Document {
+    let objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R >>".into(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 600 800] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> /XObject << /Im0 6 0 R >> >> >>"
+            .into(),
+        format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len()),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".into(),
+        "<< /Type /XObject /Subtype /Image /Width 2 /Height 2 /ImageMask true /Filter /ASCIIHexDecode /Length 5 >>\nstream\n0000>\nendstream".into(),
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offs = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offs.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let x = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offs {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{x}\n%%EOF\n", objs.len() + 1).as_bytes());
+    Document::open(Arc::new(out)).unwrap()
+}
+
+fn form_page_with(content: &str) -> Document {
+    let form_content = "0 0 100 100 re f";
+    let objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R >>".into(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 600 800] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> /XObject << /Fm0 6 0 R >> >> >>"
+            .into(),
+        format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len()),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".into(),
+        format!("<< /Type /XObject /Subtype /Form /BBox [0 0 100 100] /Length {} >>\nstream\n{form_content}\nendstream", form_content.len()),
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offs = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offs.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let x = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offs {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{x}\n%%EOF\n", objs.len() + 1).as_bytes());
+    Document::open(Arc::new(out)).unwrap()
+}
+
 /// A path segment operator before any `m` (or `re`) has no subpath to extend: the image scan used
 /// to call `BezPath`'s `line_to`/`curve_to`/`close_path` on an empty path, which panics by contract,
 /// taking `object_list`, `page_images` and the Office export's image walk down with it (#3581).
@@ -3728,6 +3795,880 @@ fn page_images_move_turn_replace_and_delete() {
     assert!(images::change_image(&mut doc, 0, 0, &images::ImageChange::Delete).is_err());
 }
 
+#[test]
+fn image_arrange_stacking_order_and_remove_crop() {
+    let content = "q 100 0 0 100 100 100 cm /Im0 Do Q BT /F1 12 Tf 72 700 Td (Middle Text) Tj ET q 150 0 0 150 200 200 cm /Im0 Do Q";
+    let mut doc = image_page_with(content);
+    let initial_images = images::page_images(&doc, 0).unwrap();
+    assert_eq!(initial_images.len(), 2);
+    assert!(close(initial_images[0].rect, [100.0, 100.0, 200.0, 200.0]));
+    assert!(close(initial_images[1].rect, [200.0, 200.0, 350.0, 350.0]));
+
+    // Boundary case: image 0 is already at the back; SendToBack and SendBackward report an error.
+    assert!(arrange(&mut doc, 0, 0, images::ArrangeOrder::SendToBack).is_err());
+    assert!(arrange(&mut doc, 0, 0, images::ArrangeOrder::SendBackward).is_err());
+    let imgs = images::page_images(&doc, 0).unwrap();
+    assert_eq!(imgs.len(), 2);
+    assert!(close(imgs[0].rect, initial_images[0].rect));
+
+    // Bring forward image 0: moves it past the middle text, but it is still behind image 1.
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringForward).unwrap();
+    let doc = reopen(&doc);
+    let bytes = page_content_bytes(&doc, 0);
+    let str_content = String::from_utf8_lossy(&bytes);
+    // Middle text should now precede image 0's Do in the content stream!
+    let text_pos = str_content.find("Middle Text").unwrap();
+    let first_do = str_content.find("/Im0 Do").unwrap();
+    assert!(text_pos < first_do, "text should now precede image 0");
+
+    // Bring to front on image 0: moves it past image 1 to the front!
+    let mut doc = doc;
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+    let doc = reopen(&doc);
+    let imgs_after_front = images::page_images(&doc, 0).unwrap();
+    assert_eq!(imgs_after_front.len(), 2);
+    // In drawing order, the image that was at [100, 100, 200, 200] is now drawn LAST (index 1)!
+    assert!(close(imgs_after_front[0].rect, [200.0, 200.0, 350.0, 350.0]));
+    assert!(close(imgs_after_front[1].rect, [100.0, 100.0, 200.0, 200.0]));
+
+    // Send to back on the front image (index 1) restores it to the back.
+    let mut doc = doc;
+    arrange(&mut doc, 0, 1, images::ArrangeOrder::SendToBack).unwrap();
+    let imgs_after_back = images::page_images(&doc, 0).unwrap();
+    assert!(close(imgs_after_back[0].rect, [100.0, 100.0, 200.0, 200.0]));
+    assert!(close(imgs_after_back[1].rect, [200.0, 200.0, 350.0, 350.0]));
+
+    // Test remove crop
+    let cropped_content = "q 200 0 0 100 100 100 cm /Im0 Do Q";
+    let mut doc = image_page_with(cropped_content);
+    crop(&mut doc, 0, 0, [100.0, 100.0, 150.0, 150.0]).unwrap();
+    let img_before = &images::page_images(&doc, 0).unwrap()[0];
+    assert_ne!(img_before.visible_rect, Some(img_before.rect));
+    remove_crop(&mut doc, 0, 0).unwrap();
+    let doc = reopen(&doc);
+    let img_after = &images::page_images(&doc, 0).unwrap()[0];
+    assert_eq!(img_after.visible_rect, Some(img_after.rect));
+    // Removing crop again when there is no crop is refused.
+    let mut doc = doc;
+    assert!(remove_crop(&mut doc, 0, 0).is_err());
+
+    // Test crop
+    let uncropped_content = "q 200 0 0 100 100 100 cm /Im0 Do Q";
+    let mut doc = image_page_with(uncropped_content);
+    let img_before = &images::page_images(&doc, 0).unwrap()[0];
+    assert_eq!(img_before.visible_rect, Some(img_before.rect));
+    crop(&mut doc, 0, 0, [120.0, 110.0, 250.0, 180.0]).unwrap();
+    let doc = reopen(&doc);
+    let img_cropped = &images::page_images(&doc, 0).unwrap()[0];
+    assert!(close(img_cropped.visible_rect.unwrap(), [120.0, 110.0, 250.0, 180.0]));
+    // And remove_crop works on it:
+    let mut doc = doc;
+    remove_crop(&mut doc, 0, 0).unwrap();
+    let doc = reopen(&doc);
+    let img_restored = &images::page_images(&doc, 0).unwrap()[0];
+    assert_eq!(img_restored.visible_rect, Some(img_restored.rect));
+
+    // Test cropping an image that was moved (has an outer transform)
+    let mut doc = image_page_with("q 200 0 0 100 100 100 cm /Im0 Do Q");
+    let move_transform = [1.0, 0.0, 0.0, 1.0, 50.0, 40.0];
+    images::change_image(&mut doc, 0, 0, &images::ImageChange::Transform(move_transform)).unwrap();
+    let doc = reopen(&doc);
+    let img_moved = &images::page_images(&doc, 0).unwrap()[0];
+    assert_eq!(img_moved.rect, [150.0, 140.0, 350.0, 240.0]);
+    let mut doc = doc;
+    crop(&mut doc, 0, 0, [170.0, 150.0, 300.0, 220.0]).unwrap();
+    let doc = reopen(&doc);
+    let img_crop_moved = &images::page_images(&doc, 0).unwrap()[0];
+    assert!(img_crop_moved.visible_rect.is_some(), "cropped image must not be deleted");
+    assert!(close(img_crop_moved.visible_rect.unwrap(), [170.0, 150.0, 300.0, 220.0]));
+    // Adjust crop (re-crop)
+    let mut doc = doc;
+    crop(&mut doc, 0, 0, [180.0, 160.0, 280.0, 210.0]).unwrap();
+    let doc = reopen(&doc);
+    let img_recropped = &images::page_images(&doc, 0).unwrap()[0];
+    assert!(close(img_recropped.visible_rect.unwrap(), [180.0, 160.0, 280.0, 210.0]));
+    // Remove crop from moved image
+    let mut doc = doc;
+    remove_crop(&mut doc, 0, 0).unwrap();
+    let doc = reopen(&doc);
+    let img_restored_moved = &images::page_images(&doc, 0).unwrap()[0];
+    assert_eq!(img_restored_moved.visible_rect, Some(img_restored_moved.rect));
+}
+
+#[test]
+fn crop_rotated_image_preserves_angle_and_in_place_geometry() {
+    let content = "q 173.20508 100 -50 86.60254 100 100 cm /Im0 Do Q";
+    let mut doc = image_page_with(content);
+    let img_before = &images::page_images(&doc, 0).unwrap()[0];
+    let m_before = img_before.matrix;
+    assert!((m_before[1] - 100.0).abs() < 1e-3);
+    assert!((m_before[2] - (-50.0)).abs() < 1e-3);
+
+    crop(&mut doc, 0, 0, [140.0, 170.0, 180.0, 210.0]).unwrap();
+    let doc = reopen(&doc);
+    let img_cropped = &images::page_images(&doc, 0).unwrap()[0];
+
+    let m_after = img_cropped.matrix;
+    assert!((m_after[0] - m_before[0]).abs() < 1e-3);
+    assert!((m_after[1] - m_before[1]).abs() < 1e-3);
+    assert!((m_after[2] - m_before[2]).abs() < 1e-3);
+    assert!((m_after[3] - m_before[3]).abs() < 1e-3);
+    assert!((m_after[4] - m_before[4]).abs() < 1e-3);
+    assert!((m_after[5] - m_before[5]).abs() < 1e-3);
+
+    let bytes = page_content_bytes(&doc, 0);
+    let str_content = String::from_utf8_lossy(&bytes);
+    assert!(
+        (str_content.contains("re") || (str_content.contains("m\n") && str_content.contains("l\n"))) && str_content.contains("W\nn"),
+        "{str_content}"
+    );
+    assert!(str_content.contains("/Im0 Do"), "{str_content}");
+
+    let mut doc = doc;
+    remove_crop(&mut doc, 0, 0).unwrap();
+    let doc = reopen(&doc);
+    let img_restored = &images::page_images(&doc, 0).unwrap()[0];
+    assert_eq!(img_restored.matrix, m_before);
+}
+
+#[test]
+fn image_arrange_preserves_shared_group_drawings() {
+    let content = "q 100 0 0 100 100 100 cm /Im0 Do /Im0 Do Q BT /F1 12 Tf 72 700 Td (End Text) Tj ET";
+    let mut doc = image_page_with(content);
+    let initial = images::page_images(&doc, 0).unwrap();
+    assert_eq!(initial.len(), 2, "both images initially present in shared group");
+
+    // Bring image 0 to front: it must not delete image 1 that shares the same q...Q group!
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+    let doc = reopen(&doc);
+    let after = images::page_images(&doc, 0).unwrap();
+    assert_eq!(after.len(), 2, "both images must be preserved after BringToFront");
+    let bytes = page_content_bytes(&doc, 0);
+    let str_content = String::from_utf8_lossy(&bytes);
+    assert!(str_content.contains("End Text"), "text in page must be preserved");
+}
+
+/// The marked-content sequence that `mcid` opens (`/MCID n >> BDC` … its `EMC`), as content text.
+fn marked_sequence(content: &str, mcid: u32) -> &str {
+    let tag = format!("/MCID {mcid}");
+    let start = content.find(&tag).unwrap_or_else(|| panic!("no {tag} in {content}"));
+    let end = content[start..].find("EMC").map(|e| start + e).unwrap_or_else(|| panic!("{tag} has no EMC in {content}"));
+    &content[start..end]
+}
+
+/// #3145: Arrange treated marked-content boundaries as if they weren't there, so Bring to Front put
+/// the image inside the text's `BDC`…`EMC` (tagged as the text) and left its own sequence empty.
+#[test]
+fn image_arrange_keeps_marked_content_sequences_whole() {
+    let content = "/P <</MCID 0>> BDC q 100 0 0 100 50 50 cm /Im0 Do Q EMC /P <</MCID 1>> BDC BT /F1 12 Tf 72 700 Td (Text) Tj ET EMC";
+    let mut doc = image_page_with(content);
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+    let doc = reopen(&doc);
+    let bytes = page_content_bytes(&doc, 0);
+    let s = String::from_utf8_lossy(&bytes);
+    assert!(marked_sequence(&s, 0).contains("/Im0 Do"), "the image stays in its own sequence: {s}");
+    assert!(!marked_sequence(&s, 1).contains("/Im0 Do"), "the text's sequence holds no image: {s}");
+    assert!(marked_sequence(&s, 1).contains("(Text)"), "{s}");
+    assert!(s.find("/MCID 1").unwrap() < s.find("/MCID 0").unwrap(), "the image's sequence now comes after the text's: {s}");
+    assert_eq!(images::page_images(&doc, 0).unwrap().len(), 1);
+}
+
+/// A `BMC` sequence (here an artifact) moves as a whole too.
+#[test]
+fn image_arrange_moves_a_bmc_sequence_as_a_whole() {
+    let content = "/Artifact BMC q 100 0 0 100 50 50 cm /Im0 Do Q EMC BT /F1 12 Tf 72 700 Td (Body) Tj ET";
+    let mut doc = image_page_with(content);
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+    let doc = reopen(&doc);
+    let s = String::from_utf8_lossy(&page_content_bytes(&doc, 0)).into_owned();
+    let (art, emc, body, img) = (s.find("/Artifact BMC").unwrap(), s.rfind("EMC").unwrap(), s.find("(Body)").unwrap(), s.find("/Im0 Do").unwrap());
+    assert!(body < art && art < img && img < emc, "text first, then the whole artifact sequence: {s}");
+}
+
+/// An image sharing a marked-content sequence with other content must not end up untagged.
+/// Either the arrange call is refused with Err, or every image paint remains inside a marked-content sequence.
+#[test]
+fn arrange_image_in_shared_tagged_block_refuses_or_keeps_tagged() {
+    let content =
+        "/Figure <</MCID 0>> BDC q 100 0 0 100 50 50 cm /Im0 Do Q BT /F1 9 Tf 50 40 Td (Caption) Tj ET EMC BT /F1 12 Tf 72 700 Td (Body) Tj ET";
+    let mut doc = image_page_with(content);
+    let res = arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront);
+    match res {
+        Err(_) => {
+            // Refusing is the expected safe behavior when moving out of a shared tagged unit.
+        }
+        Ok(()) => {
+            let doc = reopen(&doc);
+            let bytes = page_content_bytes(&doc, 0);
+            let ops = pdfcraft_content::parse(&bytes).ops;
+            let mut mc_depth = 0usize;
+            for op in ops {
+                if op.is("BDC") || op.is("BMC") {
+                    mc_depth += 1;
+                } else if op.is("EMC") {
+                    mc_depth = mc_depth.saturating_sub(1);
+                } else if op.is("Do") {
+                    assert!(mc_depth > 0, "every image paint must be inside a marked-content sequence: {}", String::from_utf8_lossy(&bytes));
+                }
+            }
+        }
+    }
+}
+
+/// An image that shares its marked-content sequence with other content cannot be rearranged
+/// without leaving the image untagged or duplicating MCIDs, so it is refused.
+#[test]
+fn image_arrange_splits_a_shared_marked_sequence_into_own_tag() {
+    let content =
+        "/Figure <</MCID 0>> BDC q 100 0 0 100 50 50 cm /Im0 Do Q BT /F1 9 Tf 50 40 Td (Caption) Tj ET EMC BT /F1 12 Tf 72 700 Td (Body) Tj ET";
+    let mut doc = image_page_with(content);
+    assert!(arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).is_err());
+}
+
+/// Send backward also refuses to rearrange an image when it shares its sequence with other content.
+#[test]
+fn image_arrange_send_backward_splits_shared_marked_sequence() {
+    let content =
+        "BT /F1 12 Tf 72 700 Td (Header) Tj ET /Table <</MCID 0>> BDC q 100 0 0 100 50 50 cm /Im0 Do Q BT /F1 9 Tf 50 40 Td (Cell) Tj ET EMC";
+    let mut doc = image_page_with(content);
+    assert!(arrange(&mut doc, 0, 0, images::ArrangeOrder::SendBackward).is_err());
+}
+
+#[test]
+fn arrange_preserves_color_leaking_out_of_marked_content() {
+    let content = "/Figure <</MCID 0>> BDC 1 0 0 rg q 100 0 0 100 0 0 cm /Im0 Do Q EMC BT /F1 12 Tf 72 700 Td (Text) Tj ET";
+    let mut doc = image_page_with(content);
+    let res = arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront);
+    if res.is_ok() {
+        let bytes = page_content_bytes(&doc, 0);
+        let s = String::from_utf8_lossy(&bytes);
+        let text_pos = s.find("(Text) Tj").unwrap();
+        assert!(s[..text_pos].contains("1 0 0 rg") || s[..text_pos].contains("1 0 0 RG"));
+    }
+}
+
+#[test]
+fn arrange_shared_tagged_does_not_duplicate_mcid() {
+    let content = "/Figure <</MCID 0>> BDC q 100 0 0 100 0 0 cm /Im0 Do Q 0 0 m 10 10 l S EMC";
+    let mut doc = image_page_with(content);
+    assert!(arrange(&mut doc, 0, 0, images::ArrangeOrder::SendToBack).is_err());
+}
+
+#[test]
+fn image_crop_preserves_outer_cm_for_subsequent_drawings() {
+    let content = "100 0 0 100 50 50 cm /Im0 Do /Im0 Do";
+    let mut doc = image_page_with(content);
+    let initial = images::page_images(&doc, 0).unwrap();
+    assert_eq!(initial.len(), 2);
+    assert_eq!(initial[0].rect, [50.0, 50.0, 150.0, 150.0]);
+    assert_eq!(initial[1].rect, [50.0, 50.0, 150.0, 150.0]);
+
+    // Crop image 0
+    crop(&mut doc, 0, 0, [60.0, 60.0, 120.0, 120.0]).unwrap();
+    let doc = reopen(&doc);
+    let after = images::page_images(&doc, 0).unwrap();
+    assert_eq!(after.len(), 2, "both images must remain");
+    // Image 0 is cropped:
+    assert!(close(after[0].visible_rect.unwrap(), [60.0, 60.0, 120.0, 120.0]));
+    // Crucial: Image 1 must still have its rect at [50, 50, 150, 150], proving outer cm was not destroyed!
+    assert_eq!(after[1].rect, [50.0, 50.0, 150.0, 150.0], "subsequent image must retain global cm");
+}
+
+#[test]
+fn image_arrange_preserves_position_under_active_ctm() {
+    let content = "100 0 0 100 50 50 cm /Im0 Do /Im0 Do";
+    let mut doc = image_page_with(content);
+    let initial = images::page_images(&doc, 0).unwrap();
+    assert_eq!(initial.len(), 2);
+    assert_eq!(initial[0].rect, [50.0, 50.0, 150.0, 150.0]);
+    assert_eq!(initial[1].rect, [50.0, 50.0, 150.0, 150.0]);
+
+    // Move first image to front: must not apply destination CTM twice!
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+    let doc = reopen(&doc);
+
+    // 1. Position: check order of operators in the content stream
+    let bytes = page_content_bytes(&doc, 0);
+    let str_content = String::from_utf8_lossy(&bytes);
+    let first_do = str_content.find("/Im0 Do").unwrap();
+    let last_do = str_content.rfind("/Im0 Do").unwrap();
+    assert!(first_do < last_do, "Position: multiple image Do calls exist and order was updated");
+
+    // 2. Appearance: both images' positions and sizes are preserved
+    let after = images::page_images(&doc, 0).unwrap();
+    assert_eq!(after.len(), 2);
+    assert_eq!(after[0].rect, [50.0, 50.0, 150.0, 150.0], "Appearance: first image position preserved");
+    assert_eq!(after[1].rect, [50.0, 50.0, 150.0, 150.0], "Appearance: second image position preserved");
+
+    // 3. Preservation: outer CTM is preserved
+    assert!(str_content.contains("100 0 0 100 50 50 cm"), "Preservation: initial CTM preserved");
+}
+
+#[test]
+fn image_arrange_preserves_shared_group_clipping_bounds() {
+    let content = "q 120 120 40 40 re W n 100 0 0 100 100 100 cm /Im0 Do /Im0 Do Q BT /F1 12 Tf 72 700 Td (External Text) Tj ET";
+    let mut doc = image_page_with(content);
+    let initial = images::page_images(&doc, 0).unwrap();
+    assert_eq!(initial.len(), 2);
+    assert_eq!(initial[0].rect, [100.0, 100.0, 200.0, 200.0]);
+    assert_eq!(initial[0].visible_rect, Some([120.0, 120.0, 160.0, 160.0]));
+    assert_eq!(initial[1].rect, [100.0, 100.0, 200.0, 200.0]);
+    assert_eq!(initial[1].visible_rect, Some([120.0, 120.0, 160.0, 160.0]));
+
+    // Bring image 0 to front: moves it past the external text while preserving clipping bounds
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+    let doc = reopen(&doc);
+
+    // 1. Position: moved image Do now follows External Text in AST
+    let bytes = page_content_bytes(&doc, 0);
+    let str_content = String::from_utf8_lossy(&bytes);
+    let text_pos = str_content.find("External Text").unwrap();
+    let moved_do_pos = str_content.rfind("/Im0 Do").unwrap();
+    assert!(text_pos < moved_do_pos, "Position: moved image Do follows External Text");
+
+    // 2. Appearance: both images retain exact clipping bounds and geometry
+    let after = images::page_images(&doc, 0).unwrap();
+    assert_eq!(after.len(), 2, "both images preserved");
+    assert_eq!(after[0].visible_rect, Some([120.0, 120.0, 160.0, 160.0]), "Appearance: image 0 retains clip");
+    assert_eq!(after[1].visible_rect, Some([120.0, 120.0, 160.0, 160.0]), "Appearance: image 1 retains clip");
+
+    // 3. Preservation: External Text and original group drawing preserved
+    assert!(str_content.contains("External Text"), "Preservation: external text preserved");
+    assert!(str_content.contains("120 120 40 40 re W n"), "Preservation: clipping path operators preserved");
+}
+
+#[test]
+fn image_arrange_preserves_extended_graphics_state_opacity() {
+    let content = "q /GS0 gs 100 0 0 100 50 50 cm /Im0 Do Q BT /F1 12 Tf 72 700 Td (External Text) Tj ET";
+    let mut doc = image_page_with(content);
+    let initial = images::page_images(&doc, 0).unwrap();
+    assert_eq!(initial.len(), 1);
+    assert_eq!(initial[0].rect, [50.0, 50.0, 150.0, 150.0]);
+
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+    let doc = reopen(&doc);
+
+    // 1. Position: /Im0 Do moved past External Text
+    let bytes = page_content_bytes(&doc, 0);
+    let str_content = String::from_utf8_lossy(&bytes);
+    let text_pos = str_content.find("External Text").unwrap();
+    let do_pos = str_content.rfind("/Im0 Do").unwrap();
+    assert!(text_pos < do_pos, "Position: /Im0 Do moved past External Text");
+
+    // 2. Appearance: /GS0 gs is retained and directly precedes /Im0 Do
+    let gs_pos = str_content.rfind("/GS0 gs").unwrap();
+    assert!(text_pos < gs_pos, "Appearance: /GS0 gs is in the new moved unit");
+    assert!(gs_pos < do_pos, "Appearance: /GS0 gs directly precedes /Im0 Do");
+    let after = images::page_images(&doc, 0).unwrap();
+    assert_eq!(after.len(), 1, "image preserved");
+    assert_eq!(after[0].rect, [50.0, 50.0, 150.0, 150.0], "Appearance: rect preserved");
+
+    // 3. Preservation: External Text is preserved
+    assert!(str_content.contains("BT /F1 12 Tf 72 700 Td (External Text) Tj ET"), "Preservation: text preserved");
+}
+
+#[test]
+fn image_arrange_preserves_exact_non_rectangular_clipping_path() {
+    let content = "q 120 120 m 160 120 l 140 160 l h W* n 100 0 0 100 100 100 cm /Im0 Do /Im0 Do Q BT /F1 12 Tf 72 700 Td (External Text) Tj ET";
+    let mut doc = image_page_with(content);
+    let initial = images::page_images(&doc, 0).unwrap();
+    assert_eq!(initial.len(), 2);
+
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+    let doc = reopen(&doc);
+
+    // 1. Position: moved image follows External Text in AST
+    let bytes = page_content_bytes(&doc, 0);
+    let str_content = String::from_utf8_lossy(&bytes);
+    let text_pos = str_content.find("External Text").unwrap();
+    let last_do = str_content.rfind("/Im0 Do").unwrap();
+    assert!(text_pos < last_do, "Position: moved image follows External Text");
+
+    // 2. Appearance: polygon geometry and even-odd rule are preserved
+    assert!(str_content.contains("W*"), "Appearance: even-odd W* fill rule preserved");
+    // The original group still clips the image left behind, so the moved copy must carry its own.
+    let flat = str_content.split_whitespace().collect::<Vec<_>>().join(" ");
+    assert_eq!(flat.matches("120 120 m 160 120 l 140 160 l h W* n").count(), 2, "Appearance: exact polygon clip preserved in both units");
+    let after = images::page_images(&doc, 0).unwrap();
+    assert_eq!(after.len(), 2, "both images preserved");
+    for image in &after {
+        assert!(image.contains([140.0, 130.0]), "Appearance: inside the triangle shows");
+        assert!(!image.contains([125.0, 155.0]), "Appearance: inside its box but outside the triangle stays clipped");
+    }
+
+    // 3. Preservation: External Text and remaining original group content preserved
+    assert!(str_content.contains("External Text"), "Preservation: external text preserved");
+}
+
+#[test]
+fn image_remove_crop_after_arrange_keeps_position_under_outer_transform() {
+    // Arrange writes `cm inverse`, the clip, then the absolute placement; Remove Crop used to drop
+    // only the first, which drew the image under the outer translation twice.
+    let content = "1 0 0 1 50 50 cm q 100 0 0 100 0 0 cm /Im0 Do Q BT /F1 12 Tf 72 700 Td (External Text) Tj ET";
+    let mut doc = image_page_with(content);
+    crop(&mut doc, 0, 0, [50.0, 50.0, 100.0, 100.0]).unwrap();
+    assert_eq!(images::page_images(&doc, 0).unwrap()[0].rect, [50.0, 50.0, 150.0, 150.0]);
+
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+    let mut doc = reopen(&doc);
+    let moved = images::page_images(&doc, 0).unwrap();
+    assert_eq!(moved[0].rect, [50.0, 50.0, 150.0, 150.0]);
+    assert_eq!(moved[0].visible_rect, Some([50.0, 50.0, 100.0, 100.0]));
+
+    remove_crop(&mut doc, 0, 0).unwrap();
+    let doc = reopen(&doc);
+    let after = images::page_images(&doc, 0).unwrap();
+    assert_eq!(after.len(), 1);
+    assert_eq!(after[0].rect, [50.0, 50.0, 150.0, 150.0], "the image stays where it was");
+    assert_eq!(after[0].visible_rect, Some([50.0, 50.0, 150.0, 150.0]), "the crop is gone");
+}
+
+#[test]
+fn image_arrange_refuses_to_move_past_a_clip_it_is_not_under() {
+    // The text after the image is drawn under a top-level clip; moving the image after it would
+    // crop the image to that clip.
+    let content = "q 100 0 0 100 50 50 cm /Im0 Do Q 0 0 60 60 re W n BT /F1 12 Tf 72 700 Td (External Text) Tj ET";
+    let mut doc = image_page_with(content);
+    let before = page_content_bytes(&doc, 0);
+    assert_eq!(images::page_images(&doc, 0).unwrap()[0].visible_rect, Some([50.0, 50.0, 150.0, 150.0]));
+
+    for order in [images::ArrangeOrder::BringToFront, images::ArrangeOrder::BringForward] {
+        let err = arrange(&mut doc, 0, 0, order).unwrap_err();
+        assert!(err.to_string().contains("clipping path"), "{err}");
+    }
+    assert_eq!(page_content_bytes(&doc, 0), before, "nothing changes");
+}
+
+#[test]
+fn image_arrange_send_to_back_keeps_a_shared_clip() {
+    // The image after the text is clipped by a top-level clip set before both; behind the text it
+    // is no longer under that clip, so the moved unit has to draw it itself.
+    let content = "BT /F1 12 Tf 72 700 Td (External Text) Tj ET 0 0 60 60 re W n q 100 0 0 100 50 50 cm /Im0 Do Q";
+    let mut doc = image_page_with(content);
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::SendToBack).unwrap();
+    let doc = reopen(&doc);
+    let bytes = page_content_bytes(&doc, 0);
+    let str_content = String::from_utf8_lossy(&bytes);
+    assert!(str_content.rfind("/Im0 Do").unwrap() < str_content.find("External Text").unwrap(), "the image moved behind the text");
+    assert_eq!(images::page_images(&doc, 0).unwrap()[0].visible_rect, Some([50.0, 50.0, 60.0, 60.0]), "still cropped to the clip");
+}
+
+#[test]
+fn unwrapped_image_moves_successfully() {
+    let content = "100 0 0 100 50 50 cm /Im0 Do BT /F1 12 Tf 72 700 Td (Middle Text) Tj ET";
+    let mut doc = image_page_with(content);
+    let initial = images::page_images(&doc, 0).unwrap();
+    assert_eq!(initial.len(), 1);
+    assert_eq!(initial[0].rect, [50.0, 50.0, 150.0, 150.0]);
+
+    // Initial order: /Im0 Do precedes Middle Text
+    let initial_bytes = page_content_bytes(&doc, 0);
+    let initial_str = String::from_utf8_lossy(&initial_bytes);
+    let init_do = initial_str.find("/Im0 Do").unwrap();
+    let init_text = initial_str.find("Middle Text").unwrap();
+    assert!(init_do < init_text, "/Im0 Do initially precedes Middle Text");
+
+    // Move unwrapped image to front (past Middle Text)
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+    let doc = reopen(&doc);
+
+    // 1. Position: /Im0 Do now follows Middle Text in the content stream AST
+    let bytes = page_content_bytes(&doc, 0);
+    let str_content = String::from_utf8_lossy(&bytes);
+    let after_text = str_content.find("Middle Text").unwrap();
+    let after_do = str_content.rfind("/Im0 Do").unwrap();
+    assert!(after_text < after_do, "Position: /Im0 Do actually moved after Middle Text");
+
+    // 2. Appearance: image rect and visibility are unchanged
+    let after = images::page_images(&doc, 0).unwrap();
+    assert_eq!(after.len(), 1);
+    assert_eq!(after[0].rect, [50.0, 50.0, 150.0, 150.0], "Appearance: image coordinates preserved");
+    assert_eq!(after[0].visible_rect, Some([50.0, 50.0, 150.0, 150.0]));
+
+    // 3. Preservation: Middle Text and CTM remain intact
+    assert!(str_content.contains("BT /F1 12 Tf 72 700 Td (Middle Text) Tj ET"), "Preservation: text operation preserved");
+    assert!(str_content.contains("100 0 0 100 50 50 cm"), "Preservation: original cm preserved");
+}
+
+#[test]
+fn test_arrange_unwrapped_image_extraction() {
+    let content = b"100 0 0 100 100 100 cm /Im0 Do /Im1 Do";
+    let ops = pdfcraft_content::parse(content).ops;
+    let target = ops.iter().position(|op| op.is("Do") && op.name(0) == Some(b"Im0")).expect("target /Im0 not found");
+
+    // Scope start for unwrapped image matches target because content_units isolates Do
+    let scope_start = target;
+
+    // Accumulate effective CTM prior to the image operation
+    let mut initial_ctm = pdfcraft_content::Matrix::IDENTITY;
+    for op in &ops[..target] {
+        if op.is("cm")
+            && let Some(m) = op.nums::<6>()
+        {
+            initial_ctm = pdfcraft_content::Matrix(m).then(&initial_ctm);
+        }
+    }
+    assert_eq!(initial_ctm, pdfcraft_content::Matrix([100.0, 0.0, 0.0, 100.0, 100.0, 100.0]));
+
+    let extracted = images::extract_scope_state(&ops, scope_start, target, initial_ctm)
+        .expect("extraction must not return Err")
+        .expect("extraction must return Some rather than None");
+
+    assert_eq!(extracted.do_op.op.as_slice(), b"Do");
+    assert_eq!(extracted.do_op.name(0), Some(b"Im0".as_slice()));
+}
+
+#[test]
+fn arrange_unwrapped_image_in_mixed_scope_succeeds() {
+    // Content unit contains text and an unwrapped image; scope extraction of unit fails on BT,
+    // so it safely falls back to extracting target Do directly.
+    let content = "q BT /F1 12 Tf 72 700 Td (Preceding Text) Tj ET 100 0 0 100 50 50 cm /Im0 Do Q BT /F1 12 Tf 72 500 Td (External Text) Tj ET";
+    let mut doc = image_page_with(content);
+    let initial = images::page_images(&doc, 0).unwrap();
+    assert_eq!(initial.len(), 1);
+
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+    let doc = reopen(&doc);
+
+    let bytes = page_content_bytes(&doc, 0);
+    let str_content = String::from_utf8_lossy(&bytes);
+    let text_pos = str_content.find("External Text").unwrap();
+    let do_pos = str_content.rfind("/Im0 Do").unwrap();
+    assert!(text_pos < do_pos, "moved image follows External Text");
+
+    let after = images::page_images(&doc, 0).unwrap();
+    assert_eq!(after.len(), 1);
+    assert_eq!(after[0].rect, [50.0, 50.0, 150.0, 150.0]);
+}
+
+#[test]
+fn image_arrange_with_transformed_clipping_path_succeeds() {
+    // Nested graphics state: outer scope establishes a scaled clipping path (cm + path + W n),
+    // inner scope draws the image.
+    let content = "q 0.5 0 0 0.5 0 0 cm 100 100 m 300 100 l 300 300 l 100 300 l h W n q 100 0 0 100 50 50 cm /Im0 Do Q Q BT /F1 12 Tf 72 700 Td (External Text) Tj ET";
+    let mut doc = image_page_with(content);
+    let before = images::page_images(&doc, 0).unwrap();
+    assert_eq!(before.len(), 1);
+    assert!(before[0].visible_rect.is_some());
+    let rect_before = before[0].rect;
+    let clip_before = before[0].visible_rect;
+
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+    let doc = reopen(&doc);
+    let after = images::page_images(&doc, 0).unwrap();
+    assert_eq!(after.len(), 1);
+    assert_eq!(after[0].rect, rect_before);
+    assert_eq!(after[0].visible_rect, clip_before);
+
+    let bytes = page_content_bytes(&doc, 0);
+    let str_content = String::from_utf8_lossy(&bytes);
+    let text_pos = str_content.find("External Text").unwrap();
+    let do_pos = str_content.rfind("/Im0 Do").unwrap();
+    assert!(text_pos < do_pos, "image moved after text: {str_content}");
+}
+
+#[test]
+fn inherited_source_opacity_is_preserved() {
+    // Outer q sets /GS0 gs; inner q draws /Im0 Do; outer Q restores state before External Text
+    let content = "q /GS0 gs q 100 0 0 100 50 50 cm /Im0 Do Q Q BT /F1 12 Tf 72 700 Td (External Text) Tj ET";
+    let mut doc = image_page_with(content);
+    let initial = images::page_images(&doc, 0).unwrap();
+    assert_eq!(initial.len(), 1);
+    assert_eq!(initial[0].rect, [50.0, 50.0, 150.0, 150.0]);
+
+    // Initial order: /Im0 Do precedes External Text
+    let initial_bytes = page_content_bytes(&doc, 0);
+    let initial_str = String::from_utf8_lossy(&initial_bytes);
+    let init_do = initial_str.find("/Im0 Do").unwrap();
+    let init_text = initial_str.find("External Text").unwrap();
+    assert!(init_do < init_text, "/Im0 Do initially precedes External Text");
+
+    // Move image to front (past External Text, outside its original outer q...Q scope)
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+    let doc = reopen(&doc);
+
+    // 1. Position: /Im0 Do now follows External Text in the AST
+    let bytes = page_content_bytes(&doc, 0);
+    let str_content = String::from_utf8_lossy(&bytes);
+    let after_text = str_content.find("External Text").unwrap();
+    let after_do = str_content.rfind("/Im0 Do").unwrap();
+    assert!(after_text < after_do, "Position: /Im0 Do moved past External Text");
+
+    // 2. Appearance: effective appearance state (/GS0 gs) is injected and precedes /Im0 Do in the new unit
+    let after_gs = str_content.rfind("/GS0 gs").unwrap();
+    assert!(after_text < after_gs, "Appearance: /GS0 gs injected into the new unit at destination");
+    assert!(after_gs < after_do, "Appearance: /GS0 gs directly precedes /Im0 Do in the moved unit");
+    let after = images::page_images(&doc, 0).unwrap();
+    assert_eq!(after.len(), 1);
+    assert_eq!(after[0].rect, [50.0, 50.0, 150.0, 150.0], "Appearance: rect preserved");
+
+    // 3. Preservation: External Text and original outer scope structure are preserved
+    assert!(str_content.contains("BT /F1 12 Tf 72 700 Td (External Text) Tj ET"), "Preservation: external text preserved");
+}
+
+#[test]
+fn destination_opacity_pollution_is_prevented() {
+    // /Im0 Do is fully opaque at the start; destination has active top-level /GS_translucent gs
+    let content = "100 0 0 100 50 50 cm /Im0 Do /GS_translucent gs BT /F1 12 Tf 72 700 Td (Translucent Text) Tj ET";
+    let mut doc = image_page_with(content);
+    let initial_bytes = page_content_bytes(&doc, 0);
+
+    // Attempting to move opaque image 0 to front into active transparency scope must safely bail out with Err
+    let res = arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront);
+    assert!(res.is_err(), "must return an explicit Err rather than silently corrupting opacity");
+    let err_msg = res.unwrap_err().to_string();
+    assert!(err_msg.contains("unsupported graphics state"), "error describes unsupported graphics state: {err_msg}");
+
+    // Preservation: the document contents are completely unmodified
+    let doc = reopen(&doc);
+    let after_bytes = page_content_bytes(&doc, 0);
+    assert_eq!(initial_bytes, after_bytes, "Preservation: content stream remained completely unmodified");
+}
+
+#[test]
+fn sequential_gs_operators_merging_properties_are_preserved() {
+    // Sequential gs calls: /GSalpha sets ca=0.6, /GSblend sets BM=/Multiply (without touching ca).
+    let content = "q /GSalpha gs /GSblend gs q 100 0 0 100 50 50 cm /Im0 Do Q Q BT /F1 12 Tf 72 700 Td (External Text) Tj ET";
+    let mut doc = image_page_with(content);
+    let initial = images::page_images(&doc, 0).unwrap();
+    assert_eq!(initial.len(), 1);
+    assert_eq!(initial[0].rect, [50.0, 50.0, 150.0, 150.0]);
+
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+    let doc = reopen(&doc);
+
+    // 1. Position: /Im0 Do now follows External Text in the AST
+    let bytes = page_content_bytes(&doc, 0);
+    let str_content = String::from_utf8_lossy(&bytes);
+    let after_text = str_content.find("External Text").unwrap();
+    let after_do = str_content.rfind("/Im0 Do").unwrap();
+    assert!(after_text < after_do, "Position: /Im0 Do moved past External Text");
+
+    // 2. Appearance: Both merged state operators (/GSalpha and /GSblend) are preserved and precede /Im0 Do
+    let after_alpha = str_content.rfind("/GSalpha gs").unwrap();
+    let after_blend = str_content.rfind("/GSblend gs").unwrap();
+    assert!(after_text < after_alpha, "Appearance: /GSalpha gs injected into moved unit");
+    assert!(after_text < after_blend, "Appearance: /GSblend gs injected into moved unit");
+    assert!(after_alpha < after_do, "Appearance: /GSalpha gs precedes /Im0 Do");
+    assert!(after_blend < after_do, "Appearance: /GSblend gs precedes /Im0 Do");
+
+    let after = images::page_images(&doc, 0).unwrap();
+    assert_eq!(after.len(), 1);
+    assert_eq!(after[0].rect, [50.0, 50.0, 150.0, 150.0], "Appearance: rect preserved");
+
+    // 3. Preservation: External Text is intact
+    assert!(str_content.contains("BT /F1 12 Tf 72 700 Td (External Text) Tj ET"), "Preservation: external text preserved");
+}
+
+#[test]
+fn destination_differing_blend_mode_pollution_is_prevented() {
+    // /Im0 Do has default Normal blend mode; destination has active top-level /GSblend gs (BM = /Multiply)
+    let content = "100 0 0 100 50 50 cm /Im0 Do /GSblend gs BT /F1 12 Tf 72 700 Td (Blended Section) Tj ET";
+    let mut doc = image_page_with(content);
+    let initial_bytes = page_content_bytes(&doc, 0);
+
+    // Attempting to move Normal-blend image to front into active Multiply-blend scope must safely bail out with Err
+    let res = arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront);
+    assert!(res.is_err(), "must return an explicit Err rather than silently altering blend mode");
+    let err_msg = res.unwrap_err().to_string();
+    assert!(err_msg.contains("unsupported graphics state"), "error describes unsupported graphics state: {err_msg}");
+
+    // Preservation: document contents are completely unmodified
+    let doc = reopen(&doc);
+    let after_bytes = page_content_bytes(&doc, 0);
+    assert_eq!(initial_bytes, after_bytes, "Preservation: content stream remained completely unmodified");
+}
+
+fn nested_soft_mask_page(content: &str) -> Document {
+    let objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R >>".into(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> /XObject << /Im0 6 0 R /GroupA 9 0 R /GroupB 10 0 R >> /ExtGState << /GSA 7 0 R /GSB 8 0 R >> >> >>".into(),
+        format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len()),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".into(),
+        "<< /Type /XObject /Subtype /Image /Width 2 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 8 /Length 4 >>\nstream\n\u{0}\u{0}\u{0}\u{0}\nendstream".into(),
+        "<< /Type /ExtGState /SMask << /Type /Mask /S /Alpha /G 9 0 R >> >>".into(),
+        "<< /Type /ExtGState /SMask << /Type /Mask /S /Alpha /G 10 0 R >> >>".into(),
+        "<< /Type /XObject /Subtype /Form /BBox [0 0 100 100] /Group << /S /Transparency /I true >> /Length 20 >>\nstream\n0 g 0 0 100 50 re f\nendstream".into(),
+        "<< /Type /XObject /Subtype /Form /BBox [0 0 100 100] /Group << /S /Transparency /I true >> /Length 20 >>\nstream\n0 g 0 0 50 100 re f\nendstream".into(),
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offs = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offs.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let x = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offs {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{x}\n%%EOF\n", objs.len() + 1).as_bytes());
+    Document::open(Arc::new(out)).unwrap()
+}
+
+#[test]
+fn nested_soft_masks_replay_in_correct_order_and_effective_mask_is_rendered() {
+    let content = "q /GSA gs q /GSB gs 100 0 0 100 0 0 cm /Im0 Do Q Q BT /F1 12 Tf 10 90 Td (External Text) Tj ET";
+    let mut doc = nested_soft_mask_page(content);
+    let initial = images::page_images(&doc, 0).unwrap();
+    assert_eq!(initial.len(), 1);
+
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+
+    let content_bytes = page_content_bytes(&doc, 0);
+    let str_content = String::from_utf8_lossy(&content_bytes);
+
+    // 1. Assert emitted stream order: outer /GSA gs must precede inner /GSB gs, which precedes /Im0 Do
+    let after_text = str_content.find("External Text").unwrap();
+    let after_a = str_content.rfind("/GSA gs").unwrap();
+    let after_b = str_content.rfind("/GSB gs").unwrap();
+    let after_do = str_content.rfind("/Im0 Do").unwrap();
+    assert!(after_text < after_a, "Position: /GSA gs relocated past external text");
+    assert!(after_a < after_b, "Order: outer /GSA gs must be replayed before inner /GSB gs");
+    assert!(after_b < after_do, "Order: inner /GSB gs must immediately precede /Im0 Do");
+
+    // 2. The image survives saving and reopening.
+    assert_eq!(images::page_images(&reopen(&doc), 0).unwrap().len(), 1);
+
+    // 3. Rendered-pixel assertion: render output and verify Mask B (left 50x100) is effective, not Mask A (bottom 100x50)
+    let pdf_bytes = write_incremental(&doc, &SaveOptions::default()).unwrap();
+    let mut renderer = pdfcraft_render::PageRenderer::new(Arc::new(pdf_bytes), pdfcraft_render::RenderConfig::default());
+    let page =
+        renderer.render(pdfcraft_render::RenderRequest { page: 0, kind: pdfcraft_render::RequestKind::Pixels, scale: 1.0, ..Default::default() });
+    let px = |x: u32, y: u32| {
+        let idx = ((y * page.width + x) * 4) as usize;
+        page.rgba[idx..idx + 4].to_vec()
+    };
+    // Left half (inside Mask B): image is rendered black
+    assert_eq!(px(25, 25), vec![0, 0, 0, 255], "point (25, 25) is inside Mask B: image rendered");
+    assert_eq!(px(25, 75), vec![0, 0, 0, 255], "point (25, 75) is inside Mask B: image rendered");
+    // Right half (outside Mask B): masked out to white page background
+    assert_eq!(px(75, 25), vec![255, 255, 255, 255], "point (75, 25) is outside Mask B: masked out to white");
+    assert_eq!(px(75, 75), vec![255, 255, 255, 255], "point (75, 75) is outside Mask B: masked out to white");
+}
+
+#[test]
+fn destination_differing_mask_pollution_is_prevented() {
+    // /Im0 Do has no mask; destination has active top-level /GSA gs (Mask A)
+    let content = "100 0 0 100 0 0 cm /Im0 Do /GSA gs BT /F1 12 Tf 10 90 Td (Masked Section) Tj ET";
+    let mut doc = nested_soft_mask_page(content);
+    let initial_bytes = page_content_bytes(&doc, 0);
+
+    let res = arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront);
+    assert!(res.is_err(), "must return an explicit Err rather than corrupting mask state");
+    let err_msg = res.unwrap_err().to_string();
+    assert!(err_msg.contains("unsupported graphics state"), "error describes unsupported graphics state: {err_msg}");
+
+    // Preservation: document contents are completely unmodified
+    let doc = reopen(&doc);
+    let after_bytes = page_content_bytes(&doc, 0);
+    assert_eq!(initial_bytes, after_bytes, "Preservation: content stream remained completely unmodified");
+}
+
+fn soft_mask_with_alpha_page(content: &str) -> Document {
+    let objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R >>".into(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> /XObject << /Im0 6 0 R /GroupA 9 0 R >> /ExtGState << /GSA 7 0 R >> >> >>".into(),
+        format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len()),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".into(),
+        "<< /Type /XObject /Subtype /Image /Width 2 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 8 /Length 4 >>\nstream\n\u{0}\u{0}\u{0}\u{0}\nendstream".into(),
+        "<< /Type /ExtGState /ca 0.25 /SMask << /Type /Mask /S /Alpha /G 9 0 R >> >>".into(),
+        "<< /Type /ExtGState /SMask /None >>".into(),
+        "<< /Type /XObject /Subtype /Form /BBox [0 0 100 100] /Group << /S /Transparency /I true >> /Length 20 >>\nstream\n0 g 0 0 100 50 re f\nendstream".into(),
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offs = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offs.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let x = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offs {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{x}\n%%EOF\n", objs.len() + 1).as_bytes());
+    Document::open(Arc::new(out)).unwrap()
+}
+
+#[test]
+fn non_identity_cm_before_gs_preserves_mask_coordinates_and_rendering() {
+    let content = "q 2 0 0 2 10 10 cm /GSA gs 50 0 0 50 0 0 cm /Im0 Do Q BT /F1 12 Tf 10 180 Td (External Text) Tj ET";
+    let mut doc = soft_mask_with_alpha_page(content);
+
+    // Initial state: image bounds are [10, 10, 110, 110]
+    let initial_images = images::page_images(&doc, 0).unwrap();
+    assert_eq!(initial_images.len(), 1);
+    assert!(close(initial_images[0].rect, [10.0, 10.0, 110.0, 110.0]));
+
+    // Render baseline before reordering
+    let pdf_bytes_before = write_incremental(&doc, &SaveOptions::default()).unwrap();
+    let mut renderer_before = pdfcraft_render::PageRenderer::new(Arc::new(pdf_bytes_before), pdfcraft_render::RenderConfig::default());
+    let page_before = renderer_before.render(pdfcraft_render::RenderRequest {
+        page: 0,
+        kind: pdfcraft_render::RequestKind::Pixels,
+        scale: 1.0,
+        ..Default::default()
+    });
+    let px_before = |x: u32, y: u32| {
+        let idx = ((y * page_before.width + x) * 4) as usize;
+        page_before.rgba[idx..idx + 4].to_vec()
+    };
+
+    // Arrange image: BringToFront
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+
+    let content_bytes = page_content_bytes(&doc, 0);
+    let str_content = String::from_utf8_lossy(&content_bytes);
+
+    // 1. Assert AST reordering succeeds and interleaves cm before gs
+    let text_pos = str_content.find("External Text").unwrap();
+    let cm_mask_pos = str_content.rfind("2 0 0 2 10 10 cm").unwrap();
+    let gs_pos = str_content.rfind("/GSA gs").unwrap();
+    let cm_img_pos = str_content.rfind("50 0 0 50 0 0 cm").unwrap();
+    let do_pos = str_content.rfind("/Im0 Do").unwrap();
+
+    assert!(text_pos < cm_mask_pos, "Image relocated after external text");
+    assert!(cm_mask_pos < gs_pos, "CTM for soft mask established before /GSA gs");
+    assert!(gs_pos < cm_img_pos, "/GSA gs executed before image cm");
+    assert!(cm_img_pos < do_pos, "image cm executed before /Im0 Do");
+
+    // 2. Assert image bounds remain unchanged after saving and reopening
+    let reopened_doc = reopen(&doc);
+    let reopened_images = images::page_images(&reopened_doc, 0).unwrap();
+    assert_eq!(reopened_images.len(), 1);
+    assert!(close(reopened_images[0].rect, [10.0, 10.0, 110.0, 110.0]), "Image bounds preserved: {:?}", reopened_images[0].rect);
+
+    // 3. Render reopened document and assert non-overlapping pixels remain unchanged
+    let pdf_bytes_after = write_incremental(&reopened_doc, &SaveOptions::default()).unwrap();
+    let mut renderer_after = pdfcraft_render::PageRenderer::new(Arc::new(pdf_bytes_after), pdfcraft_render::RenderConfig::default());
+    let page_after = renderer_after.render(pdfcraft_render::RenderRequest {
+        page: 0,
+        kind: pdfcraft_render::RequestKind::Pixels,
+        scale: 1.0,
+        ..Default::default()
+    });
+    let px_after = |x: u32, y: u32| {
+        let idx = ((y * page_after.width + x) * 4) as usize;
+        page_after.rgba[idx..idx + 4].to_vec()
+    };
+
+    // A point inside the masked image (e.g. at x=50, inside the image and bottom half of mask)
+    // Non-overlapping with text (text is at y=180).
+    // The pixel renders at [191, 191, 191, 255] (25% black over 100% white).
+    // In raster coordinates, raster y for PDF y=50 in a 200-high page is y=150.
+    let rendered_pixel_before = px_before(50, 150);
+    let rendered_pixel_after = px_after(50, 150);
+    assert_eq!(rendered_pixel_before, vec![191, 191, 191, 255], "baseline pixel rendered with 25% opacity mask");
+    assert_eq!(rendered_pixel_after, rendered_pixel_before, "rendered non-overlapping pixels remain unchanged");
+
+    // Outside the image: pure white background
+    assert_eq!(px_after(5, 5), vec![255, 255, 255, 255]);
+    assert_eq!(px_after(5, 5), px_before(5, 5));
+}
+
 #[test]
 fn form_artwork_edits_only_the_selected_placement() {
     let mut doc = fixture(); // three pages share resources; pages 0 and 1 also share contents
@@ -4179,6 +5120,56 @@ fn the_graphics_state_carries_over_between_content_streams() {
     assert!(close(l.rect[0], 100.0) && close(l.size, 10.0), "{l:?}");
 }
 
+fn two_stream_image_page(first: &str, second: &str) -> Document {
+    let objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R >>".into(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 600 800] /Contents [4 0 R 5 0 R] /Resources << /Font << /F1 6 0 R >> /XObject << /Im0 7 0 R /Im1 7 0 R >> >> >>".into(),
+        format!("<< /Length {} >>\nstream\n{first}\nendstream", first.len()),
+        format!("<< /Length {} >>\nstream\n{second}\nendstream", second.len()),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".into(),
+        "<< /Type /XObject /Subtype /Image /Width 4 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 8 /Length 8 >>\nstream\n\0\0\0\0\0\0\0\0\nendstream".into(),
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offs = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offs.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let x = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offs {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{x}\n%%EOF\n", objs.len() + 1).as_bytes());
+    Document::open(Arc::new(out)).unwrap()
+}
+
+#[test]
+fn arrange_and_crop_image_in_second_content_stream_succeeds() {
+    let first = "q 100 0 0 100 50 50 cm /Im0 Do Q";
+    let second = "q 100 0 0 100 200 200 cm /Im1 Do Q";
+    let mut doc = two_stream_image_page(first, second);
+    let before = images::page_images(&doc, 0).unwrap();
+    assert_eq!(before.len(), 2);
+    assert_eq!(before[0].name, "Im0");
+    assert_eq!(before[1].name, "Im1");
+
+    // Arrange second image (located in the second content stream)
+    arrange(&mut doc, 0, 1, images::ArrangeOrder::SendToBack).unwrap();
+    let after_arrange = images::page_images(&reopen(&doc), 0).unwrap();
+    assert_eq!(after_arrange.len(), 2);
+
+    // Crop image in second stream
+    crop(&mut doc, 0, 0, [210.0, 210.0, 290.0, 290.0]).unwrap();
+    let after_crop = images::page_images(&reopen(&doc), 0).unwrap();
+    assert_eq!(after_crop.len(), 2);
+    assert_eq!(after_crop[0].name, "Im1");
+    assert!(close(after_crop[0].visible_rect.unwrap(), [210.0, 210.0, 290.0, 290.0]));
+    assert_eq!(after_crop[1].name, "Im0");
+    assert_eq!(after_crop[1].visible_rect, Some(after_crop[1].rect));
+}
+
 /// One page whose font draws a few Hebrew letters (ToUnicode): A ב, B ד, C י, D ו, E ק, F ש,
 /// G ל, H ם. Content streams draw Hebrew in visual order, so "בדיוק" is `(EDCBA)`.
 fn hebrew_page(content: &str) -> Document {
@@ -4584,6 +5575,41 @@ fn reading_follows_form_xobjects() {
     assert!(own[0].is_form && own[0].object == Some(pdfcraft_cos::ObjRef::new(6, 0)), "{own:?}");
 }
 
+/// A page's `/XObject` and a form's `/Resources` are read wherever they are stored, and a form with
+/// none of its own, or with something else there, uses the ones it was drawn with (PDF 1.1 files).
+/// Each of these pages shows one line of text and one picture through one form.
+#[test]
+fn reading_follows_forms_however_their_resources_are_stored() {
+    let body = "BT /F1 12 Tf 72 700 Td (In the form) Tj ET q 20 0 0 10 5 5 cm /Im Do Q";
+    let (font, direct) = ("/Font << /F1 5 0 R >>", "/XObject << /Fm 6 0 R /Im 7 0 R >>");
+    for (page, form) in [
+        (format!("<< {font} {direct} >>"), ""),
+        (format!("<< {font} /XObject 9 0 R >>"), ""),
+        (format!("<< /Font 10 0 R {direct} >>"), ""),
+        (format!("<< {font} {direct} >>"), "/Resources 99 0 R"),
+        (format!("<< {font} {direct} >>"), "/Resources 12"),
+        ("<< /XObject << /Fm 6 0 R >> >>".to_string(), "/Resources 8 0 R"),
+        ("<< /XObject 9 0 R >>".to_string(), "/Resources << /Font << /F1 5 0 R >> /XObject 9 0 R >>"),
+    ] {
+        let doc = build(&[
+            "<< /Type /Catalog /Pages 2 0 R >>",
+            "<< /Type /Pages /Kids [3 0 R] /Count 1 >>",
+            &format!("<< /Type /Page /Parent 2 0 R /MediaBox [0 0 600 800] /Resources {page} /Contents 4 0 R >>"),
+            &stream("", "/Fm Do"),
+            "<< /Type /Font /Subtype /Type1 /BaseFont /Courier >>",
+            &stream(&format!("/Type /XObject /Subtype /Form /BBox [0 0 600 800] {form}"), body),
+            &stream("/Type /XObject /Subtype /Image /Width 1 /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8", "A"),
+            "<< /Font << /F1 5 0 R >> /XObject 9 0 R >>",
+            "<< /Fm 6 0 R /Im 7 0 R >>",
+            "<< /F1 5 0 R >>",
+        ]);
+        let blocks = text::reading_blocks(&doc, 0).unwrap();
+        let texts: Vec<(&str, &str)> = blocks.iter().map(|b| (b.text.as_str(), b.base_font.as_str())).collect();
+        assert_eq!(texts, [("In the form", "Courier")], "{page} {form}");
+        assert_eq!(images::reading_images(&doc, 0).unwrap().len(), 1, "{page} {form}");
+    }
+}
+
 /// A chain of forms, each drawing the next twenty times, twelve deep: within the depth cap but
 /// 20^11 visits without a budget. Reading stops at the page's visit budget instead of hanging.
 #[test]
@@ -7495,6 +8521,155 @@ fn reading_keeps_dotted_leader_entries_whole_and_in_order() {
     );
 }
 
+#[cfg(test)]
+mod proptests {
+    use super::*;
+    use proptest::prelude::*;
+
+    proptest! {
+
+        #[test]
+        fn prop_is_entire_page_wrapped_arbitrary_bytes(bytes in proptest::collection::vec(any::<u8>(), 0..2048)) {
+            let pieces = pdfcraft_content::Pieces::join(&[&bytes]);
+            let ops = pieces.parse().ops;
+            let _ = images::is_entire_page_wrapped(&ops);
+        }
+
+        #[test]
+        fn prop_content_units_arbitrary_bytes(
+            bytes in proptest::collection::vec(any::<u8>(), 0..2048),
+            start in 0usize..50,
+            end in 0usize..50,
+        ) {
+            let pieces = pdfcraft_content::Pieces::join(&[&bytes]);
+            let ops = pieces.parse().ops;
+            let scan_start = start.min(ops.len());
+            let scan_end = end.min(ops.len()).max(scan_start);
+            let units = images::content_units(&ops, scan_start, scan_end);
+            for u in units {
+                prop_assert!(u.start <= u.end);
+                prop_assert!(u.end <= ops.len());
+            }
+        }
+
+        #[test]
+        fn prop_arrange_image_arbitrary_malformed(
+            index in 0usize..10,
+            order_idx in 0u8..4,
+            bytes in proptest::collection::vec(any::<u8>(), 0..1024),
+        ) {
+            let order = match order_idx {
+                0 => images::ArrangeOrder::BringToFront,
+                1 => images::ArrangeOrder::SendToBack,
+                2 => images::ArrangeOrder::BringForward,
+                _ => images::ArrangeOrder::SendBackward,
+            };
+            let mut doc = image_page_with(&String::from_utf8_lossy(&bytes));
+            let _ = arrange(&mut doc, 0, index, order);
+        }
+
+        #[test]
+        fn prop_crop_image_malformed_inputs(
+            x1 in -500.0f64..500.0,
+            y1 in -500.0f64..500.0,
+            x2 in -500.0f64..500.0,
+            y2 in -500.0f64..500.0,
+            bytes in proptest::collection::vec(any::<u8>(), 0..1024),
+        ) {
+            let mut doc = image_page_with(&String::from_utf8_lossy(&bytes));
+            let _ = crop(&mut doc, 0, 0, [x1, y1, x2, y2]);
+            let _ = remove_crop(&mut doc, 0, 0);
+        }
+    }
+}
+
+/// One 600×800 page: Im0 (4×2 gray image), Fm0 (200×100 Form), ExtGState GSone (ca 1).
+fn regression_page(content: &str) -> Document {
+    let form = "0 g 0 0 200 100 re f";
+    let objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R >>".into(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 600 800] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> /XObject << /Im0 6 0 R /Fm0 7 0 R >> /ExtGState << /GSone << /Type /ExtGState /ca 1 >> >> >> >>".into(),
+        format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len()),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".into(),
+        "<< /Type /XObject /Subtype /Image /Width 4 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 8 /Length 8 >>\nstream\n\u{0}\u{0}\u{0}\u{0}\u{0}\u{0}\u{0}\u{0}\nendstream".into(),
+        format!("<< /Type /XObject /Subtype /Form /BBox [0 0 200 100] /Length {} >>\nstream\n{form}\nendstream", form.len()),
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offs = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offs.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let x = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offs {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{x}\n%%EOF\n", objs.len() + 1).as_bytes());
+    Document::open(Arc::new(out)).unwrap()
+}
+
+fn regression_rects(doc: &Document) -> Vec<[i64; 4]> {
+    let mut v: Vec<[i64; 4]> = images::page_images(doc, 0).unwrap().iter().map(|i| i.rect.map(|x| x.round() as i64)).collect();
+    v.sort();
+    v
+}
+
+/// A `cm` inside a BDC…EMC unit applies to later content; arranging the unit must not shift anything.
+#[test]
+fn arrange_keeps_cm_leaking_out_of_marked_content() {
+    let mut doc = regression_page("/Figure <</MCID 0>> BDC 1 0 0 1 50 50 cm q 100 0 0 100 0 0 cm /Im0 Do Q EMC q 10 0 0 10 200 200 cm /Im0 Do Q");
+    let before = regression_rects(&doc);
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+    assert_eq!(before, regression_rects(&reopen(&doc)), "other content moved");
+}
+
+/// Cropping a Form XObject to 100×100 keeps a 100×100 visible area (or is refused) — never 1×1.
+#[test]
+fn crop_form_xobject_keeps_requested_area() {
+    let mut doc = regression_page("q 1 0 0 1 100 100 cm /Fm0 Do Q");
+    if crop(&mut doc, 0, 0, [100.0, 100.0, 200.0, 200.0]).is_err() {
+        return; // refusing to crop vector art is also acceptable
+    }
+    let after = images::page_images(&reopen(&doc), 0).unwrap()[0].clone();
+    let v = after.visible_rect.unwrap_or(after.rect);
+    assert!((v[2] - v[0] - 100.0).abs() < 1.0 && (v[3] - v[1] - 100.0).abs() < 1.0, "expected 100x100 visible, got {v:?}");
+}
+
+/// A gs naming a missing ExtGState must not be read as 50% opacity and block the reorder.
+#[test]
+fn arrange_tolerates_missing_extgstate() {
+    let mut doc = regression_page("q /GSmissing gs 100 0 0 100 50 50 cm /Im0 Do Q /GSone gs q 10 0 0 10 200 200 cm /Im0 Do Q");
+    let r = arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront);
+    assert!(r.is_ok(), "{r:?}");
+}
+
+/// Bring to front on the image already in front must not report a change it didn't make.
+#[test]
+fn noop_arrange_is_not_ok_without_change() {
+    let mut doc = regression_page("q 10 0 0 10 200 200 cm /Im0 Do Q q 100 0 0 100 50 50 cm /Im0 Do Q");
+    let before = write_incremental(&doc, &SaveOptions::default()).unwrap();
+    let r = arrange(&mut doc, 0, 1, images::ArrangeOrder::BringToFront);
+    let after = write_incremental(&doc, &SaveOptions::default()).unwrap();
+    assert!(r.is_err() || before != after, "Ok with no change");
+}
+
+/// Cropping a turned image keeps the requested upright box in user space, rather than expanding
+/// to the bounding box of the turned image coordinates.
+#[test]
+fn crop_turned_image_preserves_requested_area() {
+    let mut doc = regression_page("q 70.71 70.71 -70.71 70.71 300 100 cm /Im0 Do Q");
+    let req = [270.0, 150.0, 330.0, 200.0];
+    crop(&mut doc, 0, 0, req).expect("crop succeeds");
+    let after = &images::page_images(&reopen(&doc), 0).unwrap()[0];
+    let v = after.visible_rect.expect("visible rect exists");
+    assert!((v[0] - req[0]).abs() < 1.0, "x0: expected {}, got {}", req[0], v[0]);
+    assert!((v[1] - req[1]).abs() < 1.0, "y0: expected {}, got {}", req[1], v[1]);
+    assert!((v[2] - req[2]).abs() < 1.0, "x1: expected {}, got {}", req[2], v[2]);
+    assert!((v[3] - req[3]).abs() < 1.0, "y1: expected {}, got {}", req[3], v[3]);
+}
+
 /// Text set larger than the widest page PDF allows (14 400 pt) panicked when its paragraph was given
 /// a width: the width is clamped between the font size and 14 400 pt, and `f64::clamp` panics when
 /// its minimum is the larger. The width is now capped at 14 400 pt whatever the font size: from the
@@ -7758,6 +8933,122 @@ fn a_flatten_refused_on_a_later_page_changes_nothing() {
     assert_eq!((*doc.get(first)).clone(), before, "the first page keeps its comment and content");
 }
 
+#[test]
+fn arrange_preserves_clip_leaked_out_of_marked_unit() {
+    let content = "/Figure <</MCID 0>> BDC 0 0 300 300 re W n q 10 0 0 10 50 50 cm /Im0 Do Q EMC q 10 0 0 10 400 400 cm /Im0 Do Q";
+    let mut doc = image_page_with(content);
+    let initial = images::page_images(&doc, 0).unwrap();
+    assert_eq!(initial.len(), 2);
+    assert!(initial[0].visible_rect.is_some());
+    assert!(initial[1].visible_rect.is_none(), "second image is fully clipped initially");
+
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+    let doc = reopen(&doc);
+    let after = images::page_images(&doc, 0).unwrap();
+    assert_eq!(after.len(), 2);
+    let img1 = after.iter().find(|img| (img.rect[0] - 400.0).abs() < 1e-3).expect("second image exists");
+    assert!(img1.visible_rect.is_none(), "second image must stay clipped after BringToFront");
+
+    // Conflicting leaking transform with leaking clip must be refused
+    let content_cm_clip =
+        "/Figure <</MCID 0>> BDC 2 0 0 2 0 0 cm 0 0 300 300 re W n q 10 0 0 10 50 50 cm /Im0 Do Q EMC q 10 0 0 10 400 400 cm /Im0 Do Q";
+    let mut doc3 = image_page_with(content_cm_clip);
+    let res3 = arrange(&mut doc3, 0, 0, images::ArrangeOrder::BringToFront);
+    assert!(res3.is_err(), "moving marked unit with both leaking cm and leaking clip must be refused");
+}
+
+#[test]
+fn arrange_preserves_leaked_color_and_text_state() {
+    let content = "/Figure <</MCID 0>> BDC /DeviceRGB cs 1 0 0 sc /F1 14 Tf 2 Tc q 10 0 0 10 50 50 cm /Im0 Do Q EMC 0 0 10 10 re f q 10 0 0 10 200 200 cm /Im0 Do Q";
+    let mut doc = image_page_with(content);
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+    let doc = reopen(&doc);
+    let bytes = page_content_bytes(&doc, 0);
+    let s = String::from_utf8_lossy(&bytes);
+    assert!(s.contains("1 0 0 sc"), "sc must be preserved in content stream: {s}");
+    assert!(s.contains("/F1 14 Tf"), "Tf must be preserved in content stream: {s}");
+    assert!(s.contains("2 Tc"), "Tc must be preserved in content stream: {s}");
+
+    // Pixel test: 0 0 10 10 re f still fills red [255, 0, 0] after arrange
+    let pdf_bytes = write_incremental(&doc, &SaveOptions::default()).unwrap();
+    let mut renderer = pdfcraft_render::PageRenderer::new(Arc::new(pdf_bytes), pdfcraft_render::RenderConfig::default());
+    let page =
+        renderer.render(pdfcraft_render::RenderRequest { page: 0, kind: pdfcraft_render::RequestKind::Pixels, scale: 1.0, ..Default::default() });
+    let idx = (((page.height - 5) * page.width + 5) * 4) as usize;
+    assert_eq!(page.rgba[idx..idx + 3], [255, 0, 0], "point (5, 5 from bottom) inside 10x10 rect fills red");
+}
+
+#[test]
+fn arrange_preserves_inherited_drawing_state_for_stencil_and_form() {
+    // 1. Stencil mask test:
+    // Page has: q 1 0 0 rg q 100 0 0 100 50 50 cm /Im0 Do Q Q BT /F1 12 Tf 20 700 Td (Text) Tj ET
+    // Non-overlapping stencil and text.
+    let content = "q 1 0 0 rg q 100 0 0 100 50 50 cm /Im0 Do Q Q BT /F1 12 Tf 20 700 Td (Text) Tj ET";
+    let mut doc = stencil_page_with(content);
+
+    // Render before move:
+    let pdf_before = write_incremental(&doc, &SaveOptions::default()).unwrap();
+    let mut renderer_before = pdfcraft_render::PageRenderer::new(Arc::new(pdf_before), pdfcraft_render::RenderConfig::default());
+    let page_before = renderer_before.render(pdfcraft_render::RenderRequest {
+        page: 0,
+        kind: pdfcraft_render::RequestKind::Pixels,
+        scale: 1.0,
+        ..Default::default()
+    });
+    let stencil_pixel_idx = (((page_before.height - 75) * page_before.width + 75) * 4) as usize;
+    assert_eq!(page_before.rgba[stencil_pixel_idx..stencil_pixel_idx + 3], [255, 0, 0], "stencil starts red");
+
+    // Bring to front
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+
+    // Save and reopen
+    let doc = reopen(&doc);
+
+    // Verify content stream has inherited color
+    let bytes = page_content_bytes(&doc, 0);
+    let s = String::from_utf8_lossy(&bytes);
+    assert!(s.contains("1 0 0 rg"), "inherited 1 0 0 rg must be replayed in moved unit: {s}");
+
+    // Render after reopen and verify stencil remains red:
+    let pdf_after = write_incremental(&doc, &SaveOptions::default()).unwrap();
+    let mut renderer_after = pdfcraft_render::PageRenderer::new(Arc::new(pdf_after), pdfcraft_render::RenderConfig::default());
+    let page_after = renderer_after.render(pdfcraft_render::RenderRequest {
+        page: 0,
+        kind: pdfcraft_render::RequestKind::Pixels,
+        scale: 1.0,
+        ..Default::default()
+    });
+    assert_eq!(page_after.rgba[stencil_pixel_idx..stencil_pixel_idx + 3], [255, 0, 0], "stencil stays red after BringToFront and reopen");
+
+    // 2. Form XObject test:
+    // Page has: q 0 1 0 rg q 1 0 0 1 50 50 cm /Fm0 Do Q Q BT /F1 12 Tf 20 700 Td (Text) Tj ET
+    let form_content = "q 0 1 0 rg q 1 0 0 1 50 50 cm /Fm0 Do Q Q BT /F1 12 Tf 20 700 Td (Text) Tj ET";
+    let mut form_doc = form_page_with(form_content);
+
+    let form_pdf_before = write_incremental(&form_doc, &SaveOptions::default()).unwrap();
+    let mut form_renderer_before = pdfcraft_render::PageRenderer::new(Arc::new(form_pdf_before), pdfcraft_render::RenderConfig::default());
+    let form_page_before = form_renderer_before.render(pdfcraft_render::RenderRequest {
+        page: 0,
+        kind: pdfcraft_render::RequestKind::Pixels,
+        scale: 1.0,
+        ..Default::default()
+    });
+    let form_pixel_idx = (((form_page_before.height - 75) * form_page_before.width + 75) * 4) as usize;
+    assert_eq!(form_page_before.rgba[form_pixel_idx..form_pixel_idx + 3], [0, 255, 0], "form starts green");
+
+    arrange(&mut form_doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+    let form_doc = reopen(&form_doc);
+
+    let form_pdf_after = write_incremental(&form_doc, &SaveOptions::default()).unwrap();
+    let mut form_renderer_after = pdfcraft_render::PageRenderer::new(Arc::new(form_pdf_after), pdfcraft_render::RenderConfig::default());
+    let form_page_after = form_renderer_after.render(pdfcraft_render::RenderRequest {
+        page: 0,
+        kind: pdfcraft_render::RequestKind::Pixels,
+        scale: 1.0,
+        ..Default::default()
+    });
+    assert_eq!(form_page_after.rgba[form_pixel_idx..form_pixel_idx + 3], [0, 255, 0], "form stays green after BringToFront and reopen");
+}
 /// Existing-row alignment is explicitly refused without mutating the paragraph.
 #[test]
 fn one_row_of_a_paragraph_takes_its_own_alignment_is_refused_without_changing_the_document() {
@@ -8500,6 +9791,247 @@ fn a_run_of_spaces_in_a_subset_without_a_space_glyph_keeps_its_width() {
     assert_eq!(content.matches("[-330] TJ").count(), 5, "{content}");
 }
 
+#[test]
+fn image_exclusive_scope_resets_path_on_scope_exit() {
+    // An earlier scope has a path operation closed by Q (with 'h' closepath).
+    // The subsequent image in its own scope must cleanly extract and allow crop removal.
+    let content = "q 0 0 m 10 10 l h Q q 200 0 0 100 100 100 cm /Im0 Do Q";
+    let mut doc = image_page_with(content);
+    crop(&mut doc, 0, 0, [100.0, 100.0, 250.0, 180.0]).unwrap();
+    let before = images::page_images(&doc, 0).unwrap();
+    assert_eq!(before.len(), 1);
+    remove_crop(&mut doc, 0, 0).unwrap();
+}
+
+#[test]
+fn content_units_does_not_swallow_subsequent_units_on_standalone_gs() {
+    // /GS0 gs followed by Q and subsequent images must isolate each Do unit properly
+    let content = "q /GS0 gs Q q 200 0 0 100 100 100 cm /Im0 Do Q q 10 0 0 10 300 300 cm /Im0 Do Q";
+    let pieces = pdfcraft_content::Pieces::join(&[content.as_bytes()]);
+    let ops = pieces.parse().ops;
+    let units = images::content_units(&ops, 0, ops.len());
+    assert_eq!(units.len(), 2);
+}
+
+/// A 1 × 1 grey inline image whose one sample is `data`.
+fn inline_image(data: char) -> String {
+    format!("BI /W 1 /H 1 /CS /G /BPC 8 ID {data} EI")
+}
+
+/// What page 0 paints, in order: `BI x` for an inline image with sample `x`, `Do x,y` for an
+/// XObject placed by a `cm` translating to x,y, and `Tj` for text. A `cm` lasts until its `Q`, so an
+/// XObject moved out of its `q`/`Q` wrapper shows as a bare `Do `.
+fn painted(doc: &Document) -> Vec<String> {
+    let mut at = vec![String::new()];
+    pdfcraft_content::parse(&page_content_bytes(doc, 0))
+        .ops
+        .iter()
+        .filter_map(|op| match op.op.as_slice() {
+            b"q" => {
+                at.push(at.last().unwrap().clone());
+                None
+            }
+            b"Q" => {
+                at.pop();
+                None
+            }
+            b"cm" => {
+                let m = op.nums::<6>().unwrap();
+                *at.last_mut().unwrap() = format!("{},{}", m[4], m[5]);
+                None
+            }
+            b"Do" => Some(format!("Do {}", at.last().unwrap())),
+            b"BI" => Some(format!("BI {}", String::from_utf8_lossy(&op.inline.as_ref().unwrap().1))),
+            b"Tj" => Some("Tj".into()),
+            _ => None,
+        })
+        .collect()
+}
+
+/// The index in [`images::page_images`] of the image whose box starts at `x`,`y`.
+fn image_at(doc: &Document, x: f64, y: f64) -> usize {
+    images::page_images(doc, 0).unwrap().iter().position(|i| (i.rect[0] - x).abs() < 1e-6 && (i.rect[1] - y).abs() < 1e-6).unwrap()
+}
+
+#[test]
+fn content_units_keep_each_top_level_inline_image_to_itself() {
+    // The parser emits a whole inline image as one `BI` op; its unit must not run on to the end
+    // (#3146). Inline images at the start, side by side and at the end are one unit each.
+    let content = format!(
+        "{} q 200 0 0 100 100 100 cm /Im0 Do Q {} {} q 10 0 0 10 300 300 cm /Im0 Do Q {}",
+        inline_image('a'),
+        inline_image('b'),
+        inline_image('c'),
+        inline_image('d')
+    );
+    let ops = pdfcraft_content::parse(content.as_bytes()).ops;
+    let units = images::content_units(&ops, 0, ops.len());
+    assert_eq!(units, [0..1, 1..5, 5..6, 6..7, 7..11, 11..12]);
+}
+
+#[test]
+fn content_units_keep_a_nested_inline_image_inside_its_enclosing_unit() {
+    // A `BI` inside `q`/`Q` or a marked-content sequence stays part of that sequence's unit.
+    let content = format!("q {} Q /Span << /MCID 0 >> BDC {} EMC {}", inline_image('a'), inline_image('b'), inline_image('c'));
+    let ops = pdfcraft_content::parse(content.as_bytes()).ops;
+    let units = images::content_units(&ops, 0, ops.len());
+    assert_eq!(units, [0..3, 3..6, 6..7]);
+}
+
+#[test]
+fn send_backward_after_a_top_level_inline_image_moves_one_step() {
+    // Before #3146 the inline image's unit swallowed everything after it, so SendBackward on a later
+    // image acted like SendToBack: it must step behind the text only.
+    let content = format!(
+        "{} q 100 0 0 100 100 100 cm /Im0 Do Q BT /F1 12 Tf 72 700 Td (Middle Text) Tj ET q 150 0 0 150 200 200 cm /Im0 Do Q",
+        inline_image('x')
+    );
+    let mut doc = image_page_with(&content);
+    let front = image_at(&doc, 200.0, 200.0);
+    arrange(&mut doc, 0, front, images::ArrangeOrder::SendBackward).unwrap();
+    let doc = reopen(&doc);
+    assert_eq!(painted(&doc), ["BI x", "Do 100,100", "Do 200,200", "Tj"]);
+}
+
+#[test]
+fn arrange_steps_an_image_past_one_inline_image_at_a_time() {
+    // Before #3146 BringForward on B, inside the first inline image's unit, put it in front of
+    // everything. One step forward is past the next inline image only, and one step back again
+    // is behind that inline image only.
+    let content = format!(
+        "q 100 0 0 100 100 100 cm /Im0 Do Q {} q 150 0 0 150 200 200 cm /Im0 Do Q {} BT /F1 12 Tf 72 700 Td (Text) Tj ET q 50 0 0 50 300 300 cm /Im0 Do Q",
+        inline_image('a'),
+        inline_image('b')
+    );
+    let mut doc = image_page_with(&content);
+    let b = image_at(&doc, 200.0, 200.0);
+    arrange(&mut doc, 0, b, images::ArrangeOrder::BringForward).unwrap();
+    let mut doc = reopen(&doc);
+    assert_eq!(painted(&doc), ["Do 100,100", "BI a", "BI b", "Do 200,200", "Tj", "Do 300,300"]);
+    let b = image_at(&doc, 200.0, 200.0);
+    arrange(&mut doc, 0, b, images::ArrangeOrder::SendBackward).unwrap();
+    let doc = reopen(&doc);
+    assert_eq!(painted(&doc), ["Do 100,100", "BI a", "Do 200,200", "BI b", "Tj", "Do 300,300"]);
+}
+
+#[test]
+fn arrange_around_inline_images_at_the_ends_of_the_stream() {
+    // Before #3146 BringToFront on the last image after an inline image "succeeded" without moving
+    // it. It is already in front, so it is refused and nothing changes.
+    let content =
+        format!("{} q 100 0 0 100 100 100 cm /Im0 Do Q BT /F1 12 Tf 72 700 Td (Text) Tj ET q 150 0 0 150 200 200 cm /Im0 Do Q", inline_image('a'));
+    let mut doc = image_page_with(&content);
+    let before = page_content_bytes(&doc, 0);
+    let front = image_at(&doc, 200.0, 200.0);
+    assert!(arrange(&mut doc, 0, front, images::ArrangeOrder::BringToFront).is_err());
+    assert!(arrange(&mut doc, 0, front, images::ArrangeOrder::BringForward).is_err());
+    assert_eq!(page_content_bytes(&doc, 0), before);
+    // Send to back goes behind the inline image that starts the stream.
+    arrange(&mut doc, 0, front, images::ArrangeOrder::SendToBack).unwrap();
+    let doc = reopen(&doc);
+    assert_eq!(painted(&doc), ["Do 200,200", "BI a", "Do 100,100", "Tj"]);
+
+    // Bring to front goes past the inline image that ends the stream.
+    let content = format!("q 100 0 0 100 100 100 cm /Im0 Do Q BT /F1 12 Tf 72 700 Td (Text) Tj ET {}", inline_image('z'));
+    let mut doc = image_page_with(&content);
+    let back = image_at(&doc, 100.0, 100.0);
+    arrange(&mut doc, 0, back, images::ArrangeOrder::BringToFront).unwrap();
+    let doc = reopen(&doc);
+    assert_eq!(painted(&doc), ["Tj", "BI z", "Do 100,100"]);
+}
+
+#[test]
+fn different_inline_soft_masks_have_distinct_identities() {
+    let doc = Document::new_empty();
+    let mut dict1 = Dict::default();
+    let mut mask1 = Dict::default();
+    mask1.set(b"Type".to_vec(), Object::Name(b"Mask1".to_vec()));
+    dict1.set(b"SMask".to_vec(), Object::Dict(mask1));
+
+    let mut dict2 = Dict::default();
+    let mut mask2 = Dict::default();
+    mask2.set(b"Type".to_vec(), Object::Name(b"Mask2".to_vec()));
+    dict2.set(b"SMask".to_vec(), Object::Dict(mask2));
+
+    let mut state1 = images::EffectiveGState::default();
+    state1.merge_dict(&dict1, &doc, pdfcraft_content::Matrix::IDENTITY);
+
+    let mut state2 = images::EffectiveGState::default();
+    state2.merge_dict(&dict2, &doc, pdfcraft_content::Matrix::IDENTITY);
+
+    assert!(state1.visually_differs(&state2), "two different inline soft masks must visually differ");
+}
+
+#[test]
+fn is_entire_page_wrapped_with_nested_scopes() {
+    let wrapped = "q 1 0 0 1 0 0 cm q 0 0 10 10 re f Q 200 0 0 100 100 100 cm /Im0 Do Q";
+    let pieces = pdfcraft_content::Pieces::join(&[wrapped.as_bytes()]);
+    let ops = pieces.parse().ops;
+    assert!(images::is_entire_page_wrapped(&ops), "page wrapped in outer q...Q with inner nested q...Q is wrapped");
+
+    let unwrapped = "q 1 0 0 1 0 0 cm Q q 200 0 0 100 100 100 cm /Im0 Do Q";
+    let pieces2 = pdfcraft_content::Pieces::join(&[unwrapped.as_bytes()]);
+    let ops2 = pieces2.parse().ops;
+    assert!(!images::is_entire_page_wrapped(&ops2), "page with two separate top-level q...Q scopes is not wrapped");
+}
+
+#[test]
+fn hostile_page_with_many_gs_and_nested_q_does_not_hang_or_oom() {
+    use std::fmt::Write as _;
+    let mut stream = String::new();
+    for i in 0..10_000 {
+        let _ = write!(stream, "/G{i} gs ");
+    }
+    for _ in 0..500 {
+        stream.push_str("q ");
+    }
+    stream.push_str("100 0 0 100 0 0 cm /Im0 Do ");
+    for _ in 0..500 {
+        stream.push_str("Q ");
+    }
+    let doc = image_page_with(&stream);
+    let start = std::time::Instant::now();
+    let imgs = images::page_images(&doc, 0).unwrap();
+    assert_eq!(imgs.len(), 1);
+    assert!(start.elapsed().as_secs() < 5, "page_images on hostile 10k gs must finish in under 5s, took {:?}", start.elapsed());
+}
+
+#[test]
+fn crop_image_with_leading_cm_in_scope_places_clip_before_internal_cm() {
+    let content = "q 10 0 0 10 50 50 cm /Im0 Do Q";
+    let mut doc = image_page_with(content);
+    let before = images::page_images(&doc, 0).unwrap();
+    assert_eq!(before.len(), 1);
+    crop(&mut doc, 0, 0, [50.0, 50.0, 55.0, 55.0]).unwrap();
+    let doc = reopen(&doc);
+    let after = images::page_images(&doc, 0).unwrap();
+    assert_eq!(after.len(), 1);
+    assert!(after[0].visible_rect.is_some());
+    let (v0, v1, v2, v3) =
+        (after[0].visible_rect.unwrap()[0], after[0].visible_rect.unwrap()[1], after[0].visible_rect.unwrap()[2], after[0].visible_rect.unwrap()[3]);
+    assert!((v0 - 50.0).abs() < 1e-3 && (v2 - 55.0).abs() < 1e-3, "visible rect must match crop coordinates: {:?}", after[0].visible_rect);
+    assert!((v1 - 50.0).abs() < 1e-3 && (v3 - 55.0).abs() < 1e-3, "visible rect must match crop coordinates: {:?}", after[0].visible_rect);
+}
+
+#[test]
+fn remove_crop_preserves_cm_before_extgstate() {
+    let content = "q 2 0 0 2 0 0 cm /GS0 gs 0 0 100 100 re W n 10 0 0 10 50 50 cm /Im0 Do Q";
+    let mut doc = image_page_with(content);
+    let before = images::page_images(&doc, 0).unwrap();
+    assert_eq!(before.len(), 1);
+    crop(&mut doc, 0, 0, [100.0, 100.0, 110.0, 110.0]).unwrap();
+    remove_crop(&mut doc, 0, 0).unwrap();
+    let doc = reopen(&doc);
+    let bytes = page_content_bytes(&doc, 0);
+    let s = String::from_utf8_lossy(&bytes);
+    assert!(s.contains("W n"), "the author clipping path must remain: {s}");
+    assert!(!s.contains("PdfCraftImageCrop"), "the editor crop must be removed: {s}");
+    // Verify that the initial cm appears before /GS0 gs
+    let cm_pos = s.find("2 0 0 2 0 0 cm").expect("cm must be preserved");
+    let gs_pos = s.find("/GS0 gs").expect("gs must be preserved");
+    assert!(cm_pos < gs_pos, "cm must precede /GS0 gs so soft mask space is preserved: {s}");
+}
+
 /// Inside a text object `q`/`Q` save and restore the text and text line matrices (ISO 32000-2
 /// §9.4.1, as corrected by the PDF Association's errata, issue 368), as the renderer does: the
 /// text after `Q` is found, and stays, where it is drawn.
@@ -8576,3 +10108,363 @@ fn styled_existing_justification_is_refused_instead_of_silently_left_aligning()
     assert_eq!(page_content_bytes(&doc, 0), before);
     assert_eq!(page_content_bytes(&reopen(&doc), 0), before);
 }
+
+#[test]
+fn image_arrange_refuses_crossed_scope_boundaries_without_changes() {
+    for content in ["/P <</MCID 0>> BDC q 10 0 0 10 0 0 cm /Im0 Do EMC Q /Im0 Do", "q /P <</MCID 0>> BDC /Im0 Do Q EMC /Im0 Do"] {
+        let mut doc = image_page_with(content);
+        let before = page_content_bytes(&doc, 0);
+        assert!(arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).is_err(), "{content}");
+        assert_eq!(page_content_bytes(&doc, 0), before);
+    }
+}
+
+#[test]
+fn removing_a_crop_preserves_author_clips_and_works_under_outer_clip() {
+    for content in ["0 0 300 300 re W n q 10 0 0 10 50 50 cm /Im0 Do Q", "q 50 50 8 8 re W n 10 0 0 10 50 50 cm /Im0 Do Q"] {
+        let mut doc = image_page_with(content);
+        let original = images::page_images(&doc, 0).unwrap()[0].clone();
+        crop(&mut doc, 0, 0, [52.0, 52.0, 55.0, 55.0]).unwrap();
+        let mut doc = reopen(&doc);
+        remove_crop(&mut doc, 0, 0).unwrap();
+        let mut doc = reopen(&doc);
+        let restored = images::page_images(&doc, 0).unwrap()[0].clone();
+        assert_eq!(restored.rect, original.rect);
+        assert_eq!(restored.visible_rect, original.visible_rect);
+        assert_eq!(restored.contains([59.0, 59.0]), original.contains([59.0, 59.0]));
+        assert!(remove_crop(&mut doc, 0, 0).is_err());
+    }
+}
+
+#[test]
+fn remove_crop_refuses_an_unmarked_author_clip_without_changes() {
+    let mut doc = image_page_with("q 50 50 8 8 re W n 10 0 0 10 50 50 cm /Im0 Do Q");
+    let before = page_content_bytes(&doc, 0);
+    assert!(remove_crop(&mut doc, 0, 0).is_err());
+    assert_eq!(page_content_bytes(&doc, 0), before);
+}
+
+#[test]
+fn arrange_refuses_unrestorable_extended_print_state() {
+    let mut unexpectedly_moved = Vec::new();
+    for (key, value) in [
+        ("TR", Object::name("Identity")),
+        ("TR2", Object::name("Default")),
+        ("OP", Object::Bool(true)),
+        ("op", Object::Bool(true)),
+        ("OPM", Object::Int(1)),
+        ("BG", Object::name("Default")),
+        ("BG2", Object::name("Default")),
+        ("UCR", Object::name("Default")),
+        ("UCR2", Object::name("Default")),
+        ("HT", Object::name("Default")),
+    ] {
+        let mut doc = image_page_with("q 100 0 0 100 50 50 cm /Im0 Do Q /Print gs BT /F1 12 Tf 20 700 Td (Text) Tj ET");
+        let page = pdfcraft_model::pages(&doc)[0].clone();
+        let mut resources = doc.resolve(page.dict.get(b"Resources").unwrap()).as_dict().unwrap().clone();
+        resources.set(
+            b"ExtGState".to_vec(),
+            Object::Dict(Dict::from_iter([(b"Print".to_vec(), Object::Dict(Dict::from_iter([(key.as_bytes().to_vec(), value)])))])),
+        );
+        doc.update_dict(page.obj, |d| d.set(b"Resources".to_vec(), Object::Dict(resources))).unwrap();
+        let before = page_content_bytes(&doc, 0);
+        match arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront) {
+            Ok(()) => unexpectedly_moved.push(key),
+            Err(error) => {
+                assert!(error.to_string().contains("graphics state"), "{key}: {error}");
+                assert_eq!(page_content_bytes(&doc, 0), before, "{key} refusal changes nothing");
+            }
+        }
+    }
+    assert!(unexpectedly_moved.is_empty(), "unrestorable destination state was accepted: {unexpectedly_moved:?}");
+}
+
+#[test]
+fn arrange_keeps_implicit_device_spaces_before_sc_and_scn() {
+    for (select, color) in [("0 g", "0.5 sc"), ("0 0 0 rg", "1 0 0 sc"), ("0 0 0 1 k", "0 1 1 0 scn")] {
+        for stroke in [false, true] {
+            let (select, color) = if stroke { (select.to_uppercase(), color.to_uppercase()) } else { (select.into(), color.into()) };
+            for content in [
+                format!("q {select} {color} q 100 0 0 100 50 50 cm /Im0 Do Q Q BT /F1 12 Tf 20 700 Td (Text) Tj ET"),
+                format!("q {select} q {color} 100 0 0 100 50 50 cm /Im0 Do Q Q BT /F1 12 Tf 20 700 Td (Text) Tj ET"),
+            ] {
+                let mut doc = stencil_page_with(&content);
+                arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+                let doc = reopen(&doc);
+                let bytes = page_content_bytes(&doc, 0);
+                let ops = pdfcraft_content::parse(&bytes).ops;
+                let do_index = ops.iter().rposition(|op| op.is("Do")).unwrap();
+                let start = ops[..do_index].iter().rposition(|op| op.is("q")).unwrap();
+                let relocated = &ops[start..do_index];
+                let selector = select.split_whitespace().last().unwrap();
+                let color_op = color.split_whitespace().last().unwrap();
+                let space_index = relocated.iter().position(|op| op.is(selector));
+                let color_index = relocated.iter().position(|op| op.is(color_op));
+                assert!(
+                    space_index.is_some() && space_index < color_index,
+                    "{select} must select its device space before {color}: {}",
+                    String::from_utf8_lossy(&bytes)
+                );
+            }
+        }
+    }
+}
+
+#[test]
+fn arrange_restores_initial_rendering_intent_from_ri_and_gs() {
+    for selection in ["/Saturation ri", "/Print gs"] {
+        let mut doc = image_page_with(&format!("q 100 0 0 100 50 50 cm /Im0 Do Q {selection} BT /F1 12 Tf 20 700 Td (Text) Tj ET"));
+        let page = pdfcraft_model::pages(&doc)[0].clone();
+        let mut resources = doc.resolve(page.dict.get(b"Resources").unwrap()).as_dict().unwrap().clone();
+        resources.set(
+            b"ExtGState".to_vec(),
+            Object::Dict(Dict::from_iter([(b"Print".to_vec(), Object::Dict(Dict::from_iter([(b"RI".to_vec(), Object::name("Saturation"))])))])),
+        );
+        doc.update_dict(page.obj, |d| d.set(b"Resources".to_vec(), Object::Dict(resources))).unwrap();
+        arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+        let doc = reopen(&doc);
+        let bytes = page_content_bytes(&doc, 0);
+        assert!(
+            String::from_utf8_lossy(&bytes).contains("/RelativeColorimetric ri"),
+            "default rendering intent must be restored after {selection}: {}",
+            String::from_utf8_lossy(&bytes)
+        );
+    }
+}
+
+#[test]
+fn editor_crop_moves_with_repeated_group_translation() {
+    let mut doc = image_page();
+    let caption_rect = text::text_lines(&doc, 0).unwrap()[0].rect;
+    crop(&mut doc, 0, 0, [150.0, 120.0, 250.0, 170.0]).unwrap();
+    let start = images::page_images(&doc, 0).unwrap()[0].clone();
+    let mut count = 0;
+    for iteration in 0..20 {
+        images::translate_images(&mut doc, 0, &[0], [1.0, -2.0]).unwrap();
+        let ops = pdfcraft_content::parse(&page_content_bytes(&doc, 0)).ops;
+        if iteration == 0 {
+            count = ops.len();
+        }
+        assert_eq!(ops.len(), count, "repeated moves fold the same transform");
+    }
+    let shifted = |r: [f64; 4]| [r[0] + 20.0, r[1] - 40.0, r[2] + 20.0, r[3] - 40.0];
+    let doc = reopen(&doc);
+    let after = &images::page_images(&doc, 0).unwrap()[0];
+    assert!(close(after.rect, shifted(start.rect)));
+    assert!(
+        close(after.visible_rect.unwrap(), shifted(start.visible_rect.unwrap())),
+        "the editor crop moves with its pixels: {:?}",
+        after.visible_rect
+    );
+    assert_eq!(text::text_lines(&doc, 0).unwrap()[0].text, "Caption");
+    assert_eq!(text::text_lines(&doc, 0).unwrap()[0].rect, caption_rect);
+}
+
+#[test]
+fn arranging_original_image_keeps_it_independent_of_added_items() {
+    for update in [false, true] {
+        let mut doc = image_page();
+        let caption_rect = text::text_lines(&doc, 0).unwrap()[0].rect;
+        add_content(
+            &mut doc,
+            0,
+            &Content::Text(AddedText { rect: [20.0, 250.0, 250.0, 290.0], text: "Added caption".into(), ..AddedText::default() }),
+        )
+        .unwrap();
+        arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+        let mut doc = reopen(&doc);
+        assert_eq!(list_added(&doc).len(), 1, "the added item stays editable");
+        if update {
+            update_content(
+                &mut doc,
+                0,
+                0,
+                &Content::Text(AddedText { rect: [20.0, 250.0, 250.0, 290.0], text: "Updated caption".into(), ..AddedText::default() }),
+            )
+            .unwrap();
+        } else {
+            delete_content(&mut doc, 0, 0).unwrap();
+        }
+        let doc = reopen(&doc);
+        assert_eq!(images::page_images(&doc, 0).unwrap().len(), 1, "editing/deleting an added item must preserve arranged original artwork");
+        assert_eq!(images::page_images(&doc, 0).unwrap()[0].rect, [100.0, 100.0, 300.0, 200.0]);
+        let text = text::text_lines(&doc, 0).unwrap().into_iter().map(|line| line.text).collect::<Vec<_>>();
+        assert!(text.iter().any(|line| line == "Caption"), "the original caption survives");
+        assert_eq!(text.iter().any(|line| line == "Updated caption"), update);
+        assert_eq!(text::text_lines(&doc, 0).unwrap().iter().find(|line| line.text == "Caption").unwrap().rect, caption_rect);
+    }
+}
+
+#[test]
+fn arranging_nested_marked_image_refuses_without_losing_tags() {
+    for marked in ["/Figure <</MCID 3>> BDC", "/Figure BMC"] {
+        let mut doc = image_page_with(&format!(
+            "q {marked} 100 0 0 100 50 50 cm /Im0 Do EMC BT /F1 12 Tf 20 700 Td (Text) Tj ET Q BT /F1 12 Tf 20 720 Td (Outside) Tj ET"
+        ));
+        let before = page_content_bytes(&doc, 0);
+        let error = arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap_err();
+        assert!(error.to_string().contains("marked-content"), "{error}");
+        assert_eq!(page_content_bytes(&doc, 0), before);
+        assert_eq!(page_content_bytes(&reopen(&doc), 0), before);
+    }
+}
+
+#[test]
+fn editor_crop_group_move_keeps_an_outer_author_clip_fixed() {
+    let mut doc = image_page_with("0 0 220 300 re W n q 200 0 0 100 100 100 cm /Im0 Do Q BT /F1 12 Tf 10 250 Td (Caption) Tj ET");
+    crop(&mut doc, 0, 0, [150.0, 120.0, 210.0, 170.0]).unwrap();
+    let mut operators = 0;
+    for i in 0..20 {
+        images::translate_images(&mut doc, 0, &[0], [1.0, -2.0]).unwrap();
+        let count = pdfcraft_content::parse(&page_content_bytes(&doc, 0)).ops.len();
+        if i == 0 {
+            operators = count;
+        }
+        assert_eq!(count, operators, "moves under an inherited clip must fold their transform");
+    }
+    let doc = reopen(&doc);
+    let image = &images::page_images(&doc, 0).unwrap()[0];
+    assert!(close(image.rect, [120.0, 60.0, 320.0, 160.0]));
+    assert!(
+        close(image.visible_rect.unwrap(), [170.0, 80.0, 220.0, 130.0]),
+        "the editor crop moves but its author's outer clip stays fixed: {:?}",
+        image.visible_rect
+    );
+    let bytes = page_content_bytes(&doc, 0);
+    assert!(String::from_utf8_lossy(&bytes).starts_with("0 0 220 300 re W n"));
+    assert_eq!(text::text_lines(&doc, 0).unwrap()[0].text, "Caption");
+}
+
+fn review_state_raster(doc: &Document) -> Vec<u8> {
+    let bytes = write_full(doc, &SaveOptions::default()).unwrap();
+    let mut renderer = pdfcraft_render::PageRenderer::new(Arc::new(bytes), Default::default());
+    renderer.render(pdfcraft_render::RenderRequest { page: 0, scale: 1.0, ..Default::default() }).rgba.to_vec()
+}
+
+#[test]
+fn review_arrange_form_keeps_inherited_text_spacing() {
+    for (spacing, later_spacing) in [(0, false), (12, false), (0, true)] {
+        let initial = if later_spacing { String::new() } else { format!("BT {spacing} Tc ET") };
+        let later = if later_spacing { "BT 12 Tc ET" } else { "" };
+        let content = format!("q {initial} q 1 0 0 1 20 20 cm /Fm0 Do Q Q {later} q 0 0 1 rg 200 200 5 5 re f Q");
+        let mut doc = form_page_with(&content);
+        let form = pdfcraft_cos::ObjRef::new(6, 0);
+        let dict = doc.get(form).as_dict().unwrap().clone();
+        doc.set(form, Object::Stream(pdfcraft_cos::Stream::from_raw(dict, b"BT /F1 20 Tf 0 15 Td (ABC) Tj ET".to_vec())));
+        let doc_before = reopen(&doc);
+        let before = review_state_raster(&doc_before);
+        assert!(before.as_chunks::<4>().0.iter().any(|p| p[0] == 0 && p[1] == 0 && p[2] == 0), "the Form actually paints text");
+        arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+        let saved = reopen(&doc);
+        assert_eq!(images::page_images(&saved, 0).unwrap()[0].rect, images::page_images(&doc_before, 0).unwrap()[0].rect);
+        assert_eq!(review_state_raster(&saved), before, "inherited {spacing} Tc must survive arranging the Form and reopening");
+    }
+}
+
+fn review_shared_mask_page(states: &str, luminosity_b: bool, mask_paint: &str) -> Document {
+    let content = format!("q {states} q 100 0 0 100 20 20 cm /Im0 Do Q Q q 0 0 1 rg 200 200 5 5 re f Q");
+    let stream = format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len());
+    let subtype = if luminosity_b { "Luminosity" } else { "Alpha" };
+    let mask_b = format!("<< /Type /ExtGState /SMask << /S /{subtype} /G 8 0 R >> >>");
+    let group = format!(
+        "<< /Type /XObject /Subtype /Form /BBox [0 0 300 300] /Group << /S /Transparency /I true /CS /DeviceGray >> /Length {} >>\nstream\n{mask_paint}\nendstream",
+        mask_paint.len()
+    );
+    build(&[
+        "<< /Type /Catalog /Pages 2 0 R >>",
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>",
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 4 0 R /Resources << /XObject << /Im0 5 0 R >> /ExtGState << /A 6 0 R /B 7 0 R >> >> >>",
+        &stream,
+        "<< /Type /XObject /Subtype /Image /Width 2 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 8 /Length 4 >>\nstream\n\0\0\0\0\nendstream",
+        "<< /Type /ExtGState /SMask << /S /Alpha /G 8 0 R >> >>",
+        &mask_b,
+        &group,
+    ])
+}
+
+#[test]
+fn review_repeated_gs_keeps_alpha_vs_luminosity_mask_chronology() {
+    for states in ["/A gs", "/A gs /B gs", "/A gs /B gs /A gs"] {
+        let mut doc = review_shared_mask_page(states, true, "0.25 g 0 0 300 300 re f");
+        let before = review_state_raster(&reopen(&doc));
+        assert!(before.as_chunks::<4>().0.iter().any(|p| p[0] == p[1] && p[1] == p[2] && p[0] < 230), "the masked image is visible");
+        arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+        assert_eq!(review_state_raster(&reopen(&doc)), before, "mask application order must survive: {states}");
+    }
+}
+
+#[test]
+fn review_repeated_gs_keeps_last_mask_establishment_ctm() {
+    for states in [
+        "1 0 0 1 50 0 cm /A gs 1 0 0 1 -50 0 cm",
+        "/A gs 1 0 0 1 50 0 cm /B gs 1 0 0 1 -50 0 cm",
+        "/A gs 1 0 0 1 50 0 cm /B gs 1 0 0 1 -50 0 cm /A gs",
+    ] {
+        let mut doc = review_shared_mask_page(states, false, "0.25 g 0 0 60 300 re f");
+        let before = review_state_raster(&reopen(&doc));
+        arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+        assert_eq!(review_state_raster(&reopen(&doc)), before, "mask CTM must survive: {states}");
+    }
+}
+
+#[test]
+fn review_soft_masks_sharing_a_group_keep_distinct_configurations() {
+    let doc = Document::new_empty();
+    let mask = |subtype: &str| {
+        Dict::from_iter([(
+            b"SMask".to_vec(),
+            Object::Dict(Dict::from_iter([(b"S".to_vec(), Object::name(subtype)), (b"G".to_vec(), Object::Ref(pdfcraft_cos::ObjRef::new(8, 0)))])),
+        )])
+    };
+    let mut alpha = images::EffectiveGState::default();
+    let mut luminosity = images::EffectiveGState::default();
+    alpha.merge_dict(&mask("Alpha"), &doc, pdfcraft_content::Matrix::IDENTITY);
+    luminosity.merge_dict(&mask("Luminosity"), &doc, pdfcraft_content::Matrix::IDENTITY);
+    assert!(alpha.visually_differs(&luminosity), "a shared group does not make Alpha and Luminosity the same mask");
+    for (key, value) in [
+        (b"BC".to_vec(), Object::Array(vec![Object::Real(0.5)])),
+        (
+            b"TR".to_vec(),
+            Object::Dict(Dict::from_iter([
+                (b"FunctionType".to_vec(), Object::Int(2)),
+                (b"Domain".to_vec(), Object::Array(vec![Object::Int(0), Object::Int(1)])),
+                (b"N".to_vec(), Object::Int(2)),
+            ])),
+        ),
+    ] {
+        let mut changed = mask("Luminosity");
+        let Object::Dict(definition) = changed.get_mut(b"SMask").unwrap() else { panic!("mask dictionary") };
+        definition.set(key, value);
+        let mut state = images::EffectiveGState::default();
+        state.merge_dict(&changed, &doc, pdfcraft_content::Matrix::IDENTITY);
+        assert!(state.visually_differs(&luminosity), "mask backdrop and transfer function belong to its definition");
+    }
+}
+
+#[test]
+fn review_inside_scope_group_move_matches_direct_transform_under_outer_scale() {
+    for scale in [1, 2] {
+        let content = format!("{scale} 0 0 {scale} 0 0 cm q 40 0 0 40 10 10 cm /Im0 Do Q q 0 0 1 rg 75 75 5 5 re f Q");
+        let mut cropped = image_page_with(&content);
+        let keep = if scale == 2 { [30.0, 30.0, 70.0, 70.0] } else { [15.0, 15.0, 35.0, 35.0] };
+        crop(&mut cropped, 0, 0, keep).unwrap();
+        arrange(&mut cropped, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+        for offset in [[10.0, 0.0], [0.0, 10.0], [-10.0, 3.0]] {
+            let mut grouped = reopen(&cropped);
+            let mut direct = reopen(&cropped);
+            let before = images::page_images(&grouped, 0).unwrap()[0].clone();
+            images::translate_images(&mut grouped, 0, &[0], offset).unwrap();
+            images::change_image(&mut direct, 0, 0, &images::ImageChange::Transform([1.0, 0.0, 0.0, 1.0, offset[0], offset[1]])).unwrap();
+            let moved = |r: [f64; 4]| [r[0] + offset[0], r[1] + offset[1], r[2] + offset[0], r[3] + offset[1]];
+            let saved = reopen(&grouped);
+            let image = &images::page_images(&saved, 0).unwrap()[0];
+            assert!(close(image.rect, moved(before.rect)), "scale {scale} offset {offset:?}: {:?}", image.rect);
+            assert!(close(image.visible_rect.unwrap(), moved(before.visible_rect.unwrap())), "the crop follows the complete displacement");
+            assert_eq!(
+                review_state_raster(&saved),
+                review_state_raster(&reopen(&direct)),
+                "group and direct transforms must agree, preserving other artwork"
+            );
+        }
+    }
+}
diff --git a/crates/edit/src/text.rs b/crates/edit/src/text.rs
index 98824c7694..0fb00324b6 100644
--- a/crates/edit/src/text.rs
+++ b/crates/edit/src/text.rs
@@ -24,6 +24,7 @@ use crate::EditError;
 mod regions;
 #[path = "text_session.rs"]
 mod session;
+pub use fallback::strip_subset_tag;
 use regions::{alignment_frame, group_blocks, is_centred, rewrite_styled_block};
 pub use session::TextSession;
 
@@ -47,13 +48,13 @@ pub use editor::{TextEditLayout, TextEditorFont, register_text_font, text_edit_l
 pub(crate) use fallback::SOURCE_SPACE_CALLS;
 use fallback::{
     MAX_TYPE3_GLYPHS, Type3Glyph, fallback_face, needs_type3, no_fallback_font, no_glyph_for, same_base_font, same_font, source_encodes,
-    source_family, source_program, source_show, source_space, source_width, strip_subset_tag, type3_faces, type3_glyph, write_type3_glyphs,
+    source_family, source_program, source_show, source_space, source_width, type3_faces, type3_glyph, write_type3_glyphs,
 };
 #[cfg(test)]
 use fallback::{add_type3_font, is_type3_fallback};
 use interp::{Origin, Paint, union};
 use lines::page_dict;
-pub(crate) use lines::{FormBudget, content_streams, content_streams_within, form_call, rewritten_contents, splice};
+pub(crate) use lines::{FormBudget, content_streams, content_streams_within, dict_in_place, form_call, resource_dict, rewritten_contents, splice};
 pub use lines::{MAX_FORM_DEPTH, MAX_FORM_VISITS, glyph_text_lines, text_lines};
 pub use rewrite::{LineEdit, replace_line, rewrite_block};
 use rewrite::{coincident_ops, rewrite_block_from};
diff --git a/crates/edit/src/text/fallback.rs b/crates/edit/src/text/fallback.rs
index b8f45a221f..78f9014a20 100644
--- a/crates/edit/src/text/fallback.rs
+++ b/crates/edit/src/text/fallback.rs
@@ -163,7 +163,7 @@ pub(crate) fn same_base_font(a: &str, b: &str) -> bool {
 }
 
 /// `ABCDEF+Arial` → `Arial`. A name without a subset tag is returned unchanged.
-pub(crate) fn strip_subset_tag(name: &str) -> &str {
+pub fn strip_subset_tag(name: &str) -> &str {
     let bytes = name.as_bytes();
     let is_tag = bytes.get(6) == Some(&b'+') && bytes.get(..6).is_some_and(|tag| tag.iter().all(u8::is_ascii_uppercase));
     if is_tag { name.get(7..).unwrap_or(name) } else { name }
diff --git a/crates/edit/src/text/interp.rs b/crates/edit/src/text/interp.rs
index 2b55e51ef8..2a9f6da61a 100644
--- a/crates/edit/src/text/interp.rs
+++ b/crates/edit/src/text/interp.rs
@@ -773,8 +773,9 @@ pub(super) fn interpret(
     // `Some(properties)`: read `/ActualText`, looking named property lists up in `properties`.
     logical_text: Option<&Dict>,
 ) -> Result<Vec<Shown>, EditError> {
-    let fonts_res = resources.get(b"Font").map(|f| doc.resolve(f)).and_then(|f| f.as_dict().cloned()).unwrap_or_default();
-    let states = resources.get(b"ExtGState").map(|g| doc.resolve(g)).and_then(|g| g.as_dict().cloned()).unwrap_or_default();
+    let (mut held_fonts, mut held_states, none) = (None, None, Dict::new());
+    let fonts_res = super::resource_dict(doc, resources, b"Font", &mut held_fonts).unwrap_or(&none);
+    let states = super::resource_dict(doc, resources, b"ExtGState", &mut held_states).unwrap_or(&none);
     let mut out: Vec<Shown> = Vec::new();
     let mut ts = carry.ts.clone();
     let mut at_bt = (0usize, ts.clone());
@@ -881,8 +882,12 @@ pub(super) fn interpret(
                 if let Some(name) = op.name(0) {
                     select_gs(&mut ts.ext_gstate, name);
                 }
-                let params = op.name(0).and_then(|name| states.get(name)).map(|p| doc.resolve(p));
-                if let Some(params) = params.as_deref().and_then(Object::as_dict) {
+                let mut held = None;
+                let params = match op.name(0).and_then(|name| states.get(name)) {
+                    Some(p) => super::dict_in_place(doc, p, &mut held),
+                    None => None,
+                };
+                if let Some(params) = params {
                     ts.gs.apply(doc, params);
                     // `/LW` sets the line width as `w` does (ISO 32000-2 §8.4.5).
                     let lw = params.get(b"LW").and_then(|w| doc.resolve(w).as_f64()).filter(|w| w.is_finite());
diff --git a/crates/edit/src/text/lines.rs b/crates/edit/src/text/lines.rs
index f811f34ea6..85209a5472 100644
--- a/crates/edit/src/text/lines.rs
+++ b/crates/edit/src/text/lines.rs
@@ -1,3 +1,5 @@
+use std::sync::Arc;
+
 use super::fallback::{same_font, same_paint};
 use super::interp::{Carry, Origin, Pen, Shown, TextState, Ts, direction, interpret, to_frame, union};
 use super::{DecodeBudget, Dict, Document, EditError, HashMap, Matrix, Object, Op, Pieces, Stream, TextLine, parse, serialize_ops};
@@ -452,10 +454,41 @@ impl FormBudget {
 pub(crate) struct FormCall {
     pub(crate) obj: Option<pdfcraft_cos::ObjRef>,
     pub(crate) data: Vec<u8>,
-    pub(crate) resources: Dict,
+    /// The form, and its `/Resources` when they are an object of their own, which is what
+    /// [`FormCall::resources`] reads.
+    form: Arc<Object>,
+    own: Option<Arc<Object>>,
     pub(crate) ctm: Matrix,
 }
 
+impl FormCall {
+    /// The resources its content is read with: its own, or if it has none, `drawn_with`, the ones
+    /// it was drawn with (PDF 1.1 files). Read in place, as a page can draw a form thousands of times:
+    /// a copy for each took time in the square of them.
+    pub(crate) fn resources<'a>(&'a self, drawn_with: &'a Dict) -> &'a Dict {
+        let direct = || match &*self.form {
+            Object::Stream(s) => s.dict.get(b"Resources").and_then(Object::as_dict),
+            _ => None,
+        };
+        self.own.as_deref().and_then(Object::as_dict).or_else(direct).unwrap_or(drawn_with)
+    }
+}
+
+/// `o` as a dictionary, read in place for the same reason as [`FormCall::resources`]. `held` keeps it
+/// when it is an object of its own. Nothing else is one, and [`Document::resolve`] would copy it.
+pub(crate) fn dict_in_place<'a>(doc: &Document, o: &'a Object, held: &'a mut Option<Arc<Object>>) -> Option<&'a Dict> {
+    match o {
+        Object::Dict(dict) => Some(dict),
+        Object::Ref(_) => held.insert(doc.resolve(o)).as_dict(),
+        _ => None,
+    }
+}
+
+/// The dictionary at `key` of `resources`, `/XObject` or `/Font`, say, as each form reads these.
+pub(crate) fn resource_dict<'a>(doc: &Document, resources: &'a Dict, key: &[u8], held: &'a mut Option<Arc<Object>>) -> Option<&'a Dict> {
+    dict_in_place(doc, resources.get(key)?, held)
+}
+
 /// The form XObject `name` in `resources`, drawn with `ctm`. `None` for images, missing names
 /// and forms already being read (`path`), and for forms nested too deep or past the page's
 /// budget, which `budget` records as truncated; each form entered counts one visit.
@@ -472,13 +505,15 @@ pub(crate) fn form_call(
     if limited && budget.truncated {
         return None;
     }
-    let xobjects = resources.get(b"XObject").map(|x| doc.resolve(x)).and_then(|x| x.as_dict().cloned())?;
-    let o = xobjects.get(name)?;
-    let obj = o.as_ref();
+    let mut held = None;
+    let o = resource_dict(doc, resources, b"XObject", &mut held)?.get(name)?;
+    // Only a reference can name a stream, so nothing else needs reading, or copying.
+    let obj = Some(o.as_ref()?);
     if obj.is_some_and(|r| path.contains(&r)) {
         return None;
     }
-    let Object::Stream(s) = &*doc.resolve(o) else { return None };
+    let form = doc.resolve(o);
+    let Object::Stream(s) = &*form else { return None };
     if s.dict.name(b"Subtype") != Some(b"Form") {
         return None;
     }
@@ -492,8 +527,7 @@ pub(crate) fn form_call(
         let v: Vec<f64> = a.iter().filter_map(|x| doc.resolve(x).as_f64()).collect();
         <[f64; 6]>::try_from(v).ok().filter(|v| v.iter().all(|x| x.is_finite()))
     });
-    // A form without its own resources uses the ones it was drawn with (PDF 1.1 files).
-    let own = s.dict.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned());
+    let own = s.dict.get(b"Resources").filter(|r| matches!(r, Object::Ref(_))).map(|r| doc.resolve(r));
     let data = match budget.decode.decode(s) {
         Ok(data) => data,
         Err(_) if budget.decode.remaining() == 0 => {
@@ -503,7 +537,7 @@ pub(crate) fn form_call(
         Err(_) => Vec::new(),
     };
     budget.visits = budget.visits.saturating_add(1);
-    Some(FormCall { obj, data, resources: own.unwrap_or_else(|| resources.clone()), ctm: m.map_or(ctm, |m| Matrix(m).then(&ctm)) })
+    Some(FormCall { obj, data, form, own, ctm: m.map_or(ctm, |m| Matrix(m).then(&ctm)) })
 }
 
 /// The lines a page shows as it reads, including text drawn by form XObjects (which
@@ -522,8 +556,9 @@ pub(super) fn reading_lines(doc: &Document, page: usize) -> Result<(Vec<TextLine
     fn walk(w: &mut Walk, ops: &[Op], resources: &Dict, carry: &mut Carry, stream: &dyn Fn(usize) -> usize) -> Result<(), EditError> {
         let mut cache = HashMap::new();
         let mut invoked = Vec::new();
-        let properties = resources.get(b"Properties").and_then(|o| w.doc.dict(o)).unwrap_or_default();
-        let shown = interpret(w.doc, ops, resources, &mut cache, carry, Some(&mut invoked), Some(&properties))?;
+        let (mut held, none) = (None, Dict::new());
+        let properties = resource_dict(w.doc, resources, b"Properties", &mut held).unwrap_or(&none);
+        let shown = interpret(w.doc, ops, resources, &mut cache, carry, Some(&mut invoked), Some(properties))?;
         let mut last = None;
         let mut last_stream = None;
         let mut forms = invoked.into_iter().peekable();
@@ -556,7 +591,7 @@ pub(super) fn reading_lines(doc: &Document, page: usize) -> Result<(Vec<TextLine
         if let Some(r) = form.obj {
             w.path.push(r);
         }
-        walk(w, &ops, &form.resources, &mut carry, &|_| stream)?;
+        walk(w, &ops, form.resources(resources), &mut carry, &|_| stream)?;
         *text_left = carry.text_left;
         if form.obj.is_some() {
             w.path.pop();
diff --git a/crates/engine/Cargo.toml b/crates/engine/Cargo.toml
index 6dae6adf0a..f5b924c921 100644
--- a/crates/engine/Cargo.toml
+++ b/crates/engine/Cargo.toml
@@ -19,6 +19,7 @@ pdfcraft-annot = { workspace = true }
 pdfcraft-forms = { workspace = true }
 pdfcraft-xfa = { workspace = true }
 pdfcraft-edit = { workspace = true }
+pdfcraft-content = { workspace = true }
 pdfcraft-audit = { workspace = true }
 pdfcraft-redact = { workspace = true }
 pdfcraft-print = { workspace = true }
@@ -58,3 +59,5 @@ getrandom = { version = "0.4", features = ["wasm_js"] }
 
 [dev-dependencies]
 pdfcraft-testkit = { workspace = true }
+# JBIG2 fixtures (`encode_jbig2_generic`).
+pdfcraft-filters = { workspace = true }
diff --git a/crates/engine/src/actions.rs b/crates/engine/src/actions.rs
index f7d11d47ed..3e942f6a2f 100644
--- a/crates/engine/src/actions.rs
+++ b/crates/engine/src/actions.rs
@@ -146,6 +146,11 @@ pub struct FileResult {
     pub log: Vec<String>,
 }
 
+/// What an action's log says of the images a Reduce File Size step left, if there are any.
+fn images_refused_note(images: usize) -> Option<String> {
+    (images > 0).then(|| format!("Reduce file size: {images} image(s) stayed as they were, past what one run may decode"))
+}
+
 fn apply_step(s: &mut Session, id: DocId, step: &Step, log: &mut Vec<String>) -> Result<Option<DocId>, EditError> {
     let pages = s.get(id).map_or(0, |d| d.info.pages.len());
     let all: Vec<usize> = (0..pages).collect();
@@ -156,9 +161,10 @@ fn apply_step(s: &mut Session, id: DocId, step: &Step, log: &mut Vec<String>) ->
             return Ok(None);
         }
         Step::ReduceFileSize => {
-            let (bytes, _) = s.optimized_bytes(id, &crate::optimize::Settings::default(), &[])?;
+            let (bytes, report) = s.optimized_bytes(id, &crate::optimize::Settings::default(), &[])?;
             let before = s.get(id).map_or(0, |d| d.bytes.len());
             log.push(format!("Reduce file size: {} → {} bytes", before, bytes.len()));
+            log.extend(images_refused_note(report.optimize.images_refused));
             let name = s.get(id).map(|d| d.name.clone()).unwrap_or_default();
             s.close(id);
             let new = s.open(name, None, bytes, None).map_err(|e| EditError::Reopen(e.to_string()))?;
@@ -222,3 +228,16 @@ pub fn run_on(action: &Action, name: &str, bytes: Arc<Vec<u8>>, mut progress: im
     let bytes = if d.is_signed() { s.save_bytes(id) } else { s.save_full_bytes(id) }.map_err(|e| e.to_string())?;
     Ok(FileResult { name: name.to_string(), bytes, log })
 }
+
+#[cfg(test)]
+mod tests {
+    use super::images_refused_note;
+
+    /// A log line only for images that stayed, saying how many.
+    #[test]
+    fn the_log_says_when_images_stayed_as_they_were() {
+        assert_eq!(images_refused_note(0), None);
+        assert!(images_refused_note(1).is_some_and(|note| note.contains("1 image(s)")));
+        assert!(images_refused_note(3).is_some_and(|note| note.contains("3 image(s)")));
+    }
+}
diff --git a/crates/engine/src/commands.rs b/crates/engine/src/commands.rs
index 6bfe9fa826..0647726452 100644
--- a/crates/engine/src/commands.rs
+++ b/crates/engine/src/commands.rs
@@ -163,6 +163,8 @@ const HELP: Option<&str> = Some("Help");
 
 /// Every command, in menu order.
 pub const COMMANDS: &[CommandSpec] = &[
+    c("view.select_tool", "Select", None, None, Document, "mouse-pointer-2"),
+    c("view.hand_tool", "Hand", None, None, Document, "hand"),
     c("file.open", "Open…", FILE, Some(Shortcut::cmd("O")), Nothing, "folder-open"),
     c("file.open_recent", "Open Recent", FILE, None, Nothing, "clock"),
     // Shown at the foot of File ▸ Open Recent and on Home, not as its own File menu item.
@@ -259,6 +261,7 @@ pub const COMMANDS: &[CommandSpec] = &[
     c("comment.underline", "Underline text", None, None, Annotate, "underline"),
     c("comment.strikeout", "Strikethrough text", None, None, Annotate, "strikethrough"),
     c("comment.squiggly", "Squiggly underline text", None, None, Annotate, "spline"),
+    c("comment.freehand_highlight", "Freehand-Highlight", None, None, Annotate, "highlighter"),
     c("comment.ink", "Draw freehand", None, None, Annotate, "pencil"),
     c("comment.line", "Draw a line", None, None, Annotate, "minus"),
     c("comment.arrow", "Draw an arrow", None, None, Annotate, "move-right"),
diff --git a/crates/engine/src/comments.rs b/crates/engine/src/comments.rs
index eee799ed2f..c8262a7241 100644
--- a/crates/engine/src/comments.rs
+++ b/crates/engine/src/comments.rs
@@ -82,6 +82,7 @@ pub fn comment_type_name(subtype: &str) -> &str {
 /// [`comment_type_name`], telling callouts, clouds and typewriter text apart by `/IT`.
 pub fn comment_kind(a: &pdfcraft_render::Annotation) -> &str {
     match a.intent.as_deref() {
+        Some("FreehandHighlight") if a.subtype == "Ink" => "Freehand Highlight",
         Some("FreeTextCallout") => "Callout",
         Some("PolygonCloud") => "Cloud",
         Some("FreeTextTypeWriter") => "Typewriter",
diff --git a/crates/engine/src/compare.rs b/crates/engine/src/compare.rs
index dca1e24af5..24512b566b 100644
--- a/crates/engine/src/compare.rs
+++ b/crates/engine/src/compare.rs
@@ -173,14 +173,15 @@ pub struct OfficeExport {
     /// The exported file.
     pub bytes: Vec<u8>,
     /// Pages (0-based) that draw forms nested deeper than [`MAX_FORM_DEPTH`] or more of them
-    /// than [`MAX_FORM_VISITS`], or pictures past [`MAX_EXPORT_IMAGE_BYTES`]: export stops
-    /// reading there to stay bounded on hostile files, so the text and images of those forms, or
+    /// than [`MAX_FORM_VISITS`], or pictures past [`MAX_EXPORT_IMAGE_BYTES`] or past what one export
+    /// may decode: export stops reading there to stay bounded on hostile files, so the text and images of those forms, or
     /// those pictures, are missing from `bytes`.
     pub truncated_pages: Vec<usize>,
 }
 
 /// An image object prepared for Office export: its file extension and encoded bytes, or why it is
-/// left out (`Err(true)`: past [`MAX_EXPORT_IMAGE_BYTES`]; `Err(false)`: it can't be encoded).
+/// left out (`Err(true)`: past [`MAX_EXPORT_IMAGE_BYTES`], or what the export may decode;
+/// `Err(false)`: it can't be encoded).
 type PreparedImage = Result<(&'static str, Arc<[u8]>), bool>;
 
 impl crate::Document {
@@ -194,6 +195,18 @@ impl crate::Document {
     /// pictures went past `image_budget` bytes ([`OfficeExport::truncated_pages`]). Without
     /// `images` no picture is prepared.
     pub(crate) fn export_pages_checked(&self, images: bool, image_budget: usize) -> (Vec<pdfcraft_export::Page>, Vec<usize>) {
+        let Some(editor) = self.editor.as_ref() else { return (Vec::new(), Vec::new()) };
+        self.export_pages_within(images, image_budget, &mut pdfcraft_cos::ImageBudget::new(&editor.cos))
+    }
+
+    /// [`Self::export_pages_checked`], its pictures decoded within `image_work`, which is shared
+    /// by the whole export: a picture past it is left out like one past `image_budget`.
+    pub(crate) fn export_pages_within(
+        &self,
+        images: bool,
+        image_budget: usize,
+        image_work: &mut pdfcraft_cos::ImageBudget,
+    ) -> (Vec<pdfcraft_export::Page>, Vec<usize>) {
         let Some(cos) = self.editor.as_ref().map(|e| &e.cos) else { return (Vec::new(), Vec::new()) };
         let mut truncated = Vec::new();
         // Each image object is encoded once and shared by every place that draws it.
@@ -244,7 +257,9 @@ impl crate::Document {
                     .filter_map(|im| {
                         let object = im.object?;
                         let prepared = encoded.entry(object).or_insert_with(|| {
-                            let (ext, bytes) = pdfcraft_create::image_file(cos, object).map_err(|_| false)?;
+                            let refused = image_work.refused();
+                            let (ext, bytes) =
+                                pdfcraft_create::image_file_within(cos, object, &mut *image_work).map_err(|_| image_work.refused() > refused)?;
                             image_bytes = image_bytes.checked_sub(bytes.len()).ok_or(true)?;
                             Ok((if ext == "jpg" { "jpg" } else { "png" }, Arc::from(bytes)))
                         });
diff --git a/crates/engine/src/copy_image.rs b/crates/engine/src/copy_image.rs
index b377903ee4..53b890f27c 100644
--- a/crates/engine/src/copy_image.rs
+++ b/crates/engine/src/copy_image.rs
@@ -18,9 +18,8 @@ impl Document {
     /// [`Document::page_images`]: a raster image, or Form artwork that holds one.
     pub fn page_image_at(&self, page: usize, at: [f64; 2]) -> Option<usize> {
         let editor = self.editor.as_ref()?;
-        let inside = |r: &[f64; 4]| (r[0]..=r[2]).contains(&at[0]) && (r[1]..=r[3]).contains(&at[1]);
         self.page_images(page).iter().rposition(|i| {
-            inside(&i.rect)
+            i.contains(at)
                 && match (i.is_form, i.object) {
                     (false, Some(_)) => true,
                     (true, Some(form)) => picture_in_form(&editor.cos, form).is_some(),
diff --git a/crates/engine/src/doc_state.rs b/crates/engine/src/doc_state.rs
index d28429de6f..91b33ad017 100644
--- a/crates/engine/src/doc_state.rs
+++ b/crates/engine/src/doc_state.rs
@@ -1,4 +1,4 @@
-use super::{Arc, EditError, Hidden, SignatureInfo, TrustStore, optimize};
+use super::{Arc, ArrangeOrder, EditError, Hidden, SignatureInfo, TrustStore, optimize};
 
 /// A change to an existing page image.
 #[derive(Clone, Debug, PartialEq)]
@@ -20,6 +20,12 @@ pub enum ImageEdit {
         bytes: Arc<Vec<u8>>,
     },
     Delete,
+    /// Affine transform [a, b, c, d, e, f] applied to the image's matrix.
+    Transform([f64; 6]),
+    /// Change the stacking order.
+    Arrange(ArrangeOrder),
+    /// Remove any private crop on the image.
+    RemoveCrop,
 }
 
 /// Forms ▸ Merge data files into spreadsheet: the field values of each file (FDF, XFDF or a
diff --git a/crates/engine/src/edit/labels.rs b/crates/engine/src/edit/labels.rs
index c3339453af..5343804ef3 100644
--- a/crates/engine/src/edit/labels.rs
+++ b/crates/engine/src/edit/labels.rs
@@ -111,10 +111,17 @@ pub const EDIT_LABELS: &[&str] = &[
     "Move object",
     "Move objects",
     "Move image",
+    "Transform image",
     "Rotate image",
+    "Crop image",
     "Flip image",
     "Replace image",
     "Delete image",
+    "Bring to front",
+    "Bring forward",
+    "Send backward",
+    "Send to back",
+    "Remove crop",
     "Add header & footer",
     "Update header & footer",
     "Add watermark",
@@ -254,11 +261,19 @@ impl Edit {
             Edit::MoveObjects { objects, .. } => plural("Move object", "Move objects", objects.len()),
             Edit::EditPageImage { change, .. } => Label::of(match change {
                 ImageEdit::Move(_) => "Move image",
+                ImageEdit::Transform(_) => "Transform image",
                 ImageEdit::Rotate(_) | ImageEdit::RotateBy(_) => "Rotate image",
                 ImageEdit::Crop(_) => "Crop image",
                 ImageEdit::Flip { .. } => "Flip image",
                 ImageEdit::Replace { .. } => "Replace image",
                 ImageEdit::Delete => "Delete image",
+                ImageEdit::Arrange(ord) => match ord {
+                    pdfcraft_edit::ArrangeOrder::BringToFront => "Bring to front",
+                    pdfcraft_edit::ArrangeOrder::BringForward => "Bring forward",
+                    pdfcraft_edit::ArrangeOrder::SendBackward => "Send backward",
+                    pdfcraft_edit::ArrangeOrder::SendToBack => "Send to back",
+                },
+                ImageEdit::RemoveCrop => "Remove crop",
             }),
             Edit::AddHeaderFooter { replace: false, .. } => Label::of("Add header & footer"),
             Edit::AddHeaderFooter { .. } => Label::of("Update header & footer"),
@@ -312,6 +327,7 @@ fn add_annotation(s: &Shape) -> &'static str {
         Shape::Oval { .. } => "Add oval",
         Shape::Line { start: LineEnding::None, end: LineEnding::OpenArrow, .. } => "Add arrow",
         Shape::Line { .. } => "Add line",
+        Shape::FreehandHighlight { .. } => "Add freehand highlight",
         Shape::Ink { .. } => "Add drawing",
         Shape::TextBox { .. } => "Add text box",
         Shape::Typewriter { .. } => "Add text",
diff --git a/crates/engine/src/edit/run.rs b/crates/engine/src/edit/run.rs
index c6b1a7438b..5ed70aed7a 100644
--- a/crates/engine/src/edit/run.rs
+++ b/crates/engine/src/edit/run.rs
@@ -4,6 +4,7 @@ use super::{
 };
 use crate::SourceProblem;
 use crate::sources::{comment_source, import_pdf_comments};
+use pdfcraft_content::Matrix;
 
 /// Whether the opening password allows an edit (§7.6.4.2, Table 22).
 pub(crate) fn check_permission(edit: &Edit, p: &pdfcraft_cos::Permissions) -> Result<(), EditError> {
@@ -250,6 +251,169 @@ impl EditCtx {
     }
 }
 
+fn run_edit_page_image(doc: &mut pdfcraft_cos::Document, page: usize, index: usize, change: &ImageEdit) -> Result<(), EditError> {
+    match change {
+        ImageEdit::Move(to) if !to.iter().all(|v| v.is_finite()) => {
+            return Err(EditError::Edit(pdfcraft_edit::EditError::Invalid("invalid position".into())));
+        }
+        ImageEdit::Transform(t) => {
+            let [a, b, c, d, _, _] = *t;
+            let determinant = a * d - b * c;
+            if !t.iter().all(|v| v.is_finite()) || !determinant.is_finite() || determinant.abs() < 1e-9 {
+                return Err(EditError::Edit(pdfcraft_edit::EditError::Invalid("the image transform must be finite and nonsingular".into())));
+            }
+        }
+        ImageEdit::Crop(keep) if !keep.iter().all(|v| v.is_finite()) => {
+            return Err(EditError::Edit(pdfcraft_edit::EditError::Invalid("invalid crop".into())));
+        }
+        _ => {}
+    }
+    let img = pdfcraft_edit::page_images(doc, page)?
+        .into_iter()
+        .nth(index)
+        .ok_or_else(|| EditError::Edit(pdfcraft_edit::EditError::Invalid(format!("page {} has no image {}", page + 1, index + 1))))?;
+    let c = match change {
+        ImageEdit::Move(to) => pdfcraft_edit::ImageChange::Transform(pdfcraft_edit::rect_to_rect(img.rect, *to)),
+        ImageEdit::Transform(t) => pdfcraft_edit::ImageChange::Transform(*t),
+        ImageEdit::Rotate(q) => {
+            pdfcraft_edit::ImageChange::Transform(pdfcraft_edit::turn_about_centre(img.visible_rect.unwrap_or(img.rect), *q, false, false))
+        }
+        ImageEdit::RotateBy(degrees) => {
+            let t = pdfcraft_edit::turn_by_degrees(img.visible_rect.unwrap_or(img.rect), *degrees)
+                .ok_or_else(|| EditError::Edit(pdfcraft_edit::EditError::Invalid("the rotation angle must be a finite number".into())))?;
+            pdfcraft_edit::ImageChange::Transform(t)
+        }
+        ImageEdit::Flip { horizontal } => pdfcraft_edit::ImageChange::Transform(pdfcraft_edit::turn_about_centre(
+            img.visible_rect.unwrap_or(img.rect),
+            0,
+            *horizontal,
+            !*horizontal,
+        )),
+        ImageEdit::Replace { name, bytes } => {
+            if img.is_form {
+                return Err(EditError::Edit(pdfcraft_edit::EditError::Invalid("grouped Form artwork cannot be replaced with a bitmap".into())));
+            }
+            pdfcraft_edit::ImageChange::Replace(embed_image(doc, name, bytes)?.0)
+        }
+        ImageEdit::Crop(keep) => pdfcraft_edit::ImageChange::Crop(*keep),
+        ImageEdit::Delete => pdfcraft_edit::ImageChange::Delete,
+        ImageEdit::Arrange(order) => pdfcraft_edit::ImageChange::Arrange(*order),
+        ImageEdit::RemoveCrop => pdfcraft_edit::ImageChange::RemoveCrop,
+    };
+    let page_model = pdfcraft_model::pages(doc)
+        .into_iter()
+        .nth(page)
+        .ok_or_else(|| EditError::Edit(pdfcraft_edit::EditError::Invalid(format!("page {} not found", page + 1))))?;
+    let target_stream_obj = match page_model.dict.get(b"Contents") {
+        None => None,
+        Some(c) => match &*doc.resolve(c) {
+            pdfcraft_cos::Object::Array(a) => a.get(img.stream).and_then(|o| o.as_ref()),
+            _ if img.stream == 0 => c.as_ref(),
+            _ => None,
+        },
+    };
+
+    let added_items: Vec<(usize, pdfcraft_edit::Added)> = pdfcraft_edit::list_added(doc).into_iter().filter(|a| a.page == page).enumerate().collect();
+    // Ownership belongs to the drawing stream, not the XObject: original and added images may
+    // show the same resource without sharing an editable item.
+    let shows_image = |a: &pdfcraft_edit::Added| img.object.is_some_and(|t| matches!(&a.content, AddedContent::Image(ai) if ai.image == t));
+    let matched_added = added_items.iter().find(|(_, a)| target_stream_obj == Some(a.obj) && (img.object.is_none() || shows_image(a)));
+
+    let mut ai_to_update = None;
+    if let Some((added_idx, added_item)) = matched_added
+        && let AddedContent::Image(ai) = added_item.content.clone()
+    {
+        let has_active_crop = ai.crop.iter().any(|v| v.abs() > 1e-6)
+            || img.visible_rect.is_some_and(|v| {
+                (v[0] - img.rect[0]).abs() > 1e-4
+                    || (v[1] - img.rect[1]).abs() > 1e-4
+                    || (v[2] - img.rect[2]).abs() > 1e-4
+                    || (v[3] - img.rect[3]).abs() > 1e-4
+            });
+        let non_axis_transform = matches!(change, ImageEdit::Transform([a, b, c, d, _, _])
+            if !((b.abs() < 1e-5 && c.abs() < 1e-5) || (a.abs() < 1e-5 && d.abs() < 1e-5)));
+        let should_promote = has_active_crop
+            || non_axis_transform
+            || matches!(change, ImageEdit::Crop(_) | ImageEdit::RemoveCrop | ImageEdit::RotateBy(_) | ImageEdit::Arrange(_) | ImageEdit::Delete);
+
+        if should_promote {
+            doc.update_dict(added_item.obj, |d| {
+                d.remove(b"PCAdded");
+                d.remove(b"PCMark");
+            })
+            .map_err(|e| EditError::Edit(pdfcraft_edit::EditError::Invalid(e.to_string())))?;
+        } else {
+            ai_to_update = Some((*added_idx, ai));
+        }
+    }
+
+    if let Some((added_idx, mut ai)) = ai_to_update {
+        let view = Matrix(page_model.view_matrix(doc));
+        let to_display = view.invert().ok_or_else(|| EditError::Edit(pdfcraft_edit::EditError::Invalid("invalid page transform".into())))?;
+
+        match change {
+            ImageEdit::Move(to) => {
+                ai.rect = to_display.bbox(*to);
+                pdfcraft_edit::update_content(doc, page, added_idx, &AddedContent::Image(ai))?;
+            }
+            ImageEdit::Transform(_) | ImageEdit::Flip { .. } => {
+                let pdfcraft_edit::ImageChange::Transform(t) = c else {
+                    return Err(EditError::Edit(pdfcraft_edit::EditError::Invalid("expected transform".into())));
+                };
+                let t_display = view.then(&Matrix(t)).then(&to_display);
+                let [ta, tb, tc, td, _, _] = t_display.0;
+                let is_parallel = tb.abs() < 1e-5 && tc.abs() < 1e-5;
+                let is_perpendicular = ta.abs() < 1e-5 && td.abs() < 1e-5;
+
+                let (quarters_ccw, disp_flip_h, disp_flip_v) = if is_parallel {
+                    (0, ta < 0.0, td < 0.0)
+                } else if is_perpendicular {
+                    match (tb > 0.0, tc > 0.0) {
+                        (true, false) => (1, false, false),
+                        (false, true) => (3, false, false),
+                        (true, true) => (1, false, true),
+                        (false, false) => (1, true, false),
+                    }
+                } else {
+                    return Err(EditError::Edit(pdfcraft_edit::EditError::Invalid(
+                        "non-axis-aligned transforms are not supported for added images".into(),
+                    )));
+                };
+                let (toggle_h, toggle_v) = if ai.rotation % 2 == 1 { (disp_flip_v, disp_flip_h) } else { (disp_flip_h, disp_flip_v) };
+                ai.flip_h ^= toggle_h;
+                ai.flip_v ^= toggle_v;
+                ai.rotation = (ai.rotation + quarters_ccw) % 4;
+                ai.rect = t_display.bbox(ai.rect);
+                pdfcraft_edit::update_content(doc, page, added_idx, &AddedContent::Image(ai))?;
+            }
+            ImageEdit::Rotate(q) => {
+                let k = ((4 - q.rem_euclid(4)) % 4) as u8;
+                ai.rotation = (ai.rotation + k) % 4;
+                let r = ai.rect;
+                let (cx, cy) = ((r[0] + r[2]) / 2.0, (r[1] + r[3]) / 2.0);
+                if k % 2 == 1 {
+                    let (w, h) = (r[2] - r[0], r[3] - r[1]);
+                    ai.rect = [cx - h / 2.0, cy - w / 2.0, cx + h / 2.0, cy + w / 2.0];
+                }
+                pdfcraft_edit::update_content(doc, page, added_idx, &AddedContent::Image(ai))?;
+            }
+            ImageEdit::Replace { .. } => {
+                let pdfcraft_edit::ImageChange::Replace(new_image) = c else {
+                    return Err(EditError::Edit(pdfcraft_edit::EditError::Invalid("expected replace".into())));
+                };
+                ai.image = new_image;
+                pdfcraft_edit::update_content(doc, page, added_idx, &AddedContent::Image(ai))?;
+            }
+            ImageEdit::Crop(_) | ImageEdit::RemoveCrop | ImageEdit::RotateBy(_) | ImageEdit::Arrange(_) | ImageEdit::Delete => {
+                pdfcraft_edit::change_image(doc, page, index, &c)?;
+            }
+        }
+    } else {
+        pdfcraft_edit::change_image(doc, page, index, &c)?;
+    }
+    Ok(())
+}
+
 /// Perform an edit on a working copy (the caller discards it on error).
 pub(crate) fn run_edit(doc: &mut pdfcraft_cos::Document, edit: &Edit, cx: &mut EditCtx) -> Result<(), EditError> {
     match edit {
@@ -525,40 +689,7 @@ pub(crate) fn run_edit(doc: &mut pdfcraft_cos::Document, edit: &Edit, cx: &mut E
         Edit::AddOcrText { page, words } => {
             pdfcraft_edit::stamp(doc, *page, "OCR", pdfcraft_ocr::text_layer(words))?;
         }
-        Edit::EditPageImage { page, index, change } => {
-            let img = pdfcraft_edit::page_images(doc, *page)?
-                .into_iter()
-                .nth(*index)
-                .ok_or_else(|| EditError::Edit(pdfcraft_edit::EditError::Invalid(format!("page {} has no image {}", page + 1, index + 1))))?;
-            let c = match change {
-                ImageEdit::Move(to) => pdfcraft_edit::ImageChange::Transform(pdfcraft_edit::rect_to_rect(img.rect, *to)),
-                ImageEdit::Rotate(q) => {
-                    pdfcraft_edit::ImageChange::Transform(pdfcraft_edit::turn_about_centre(img.visible_rect.unwrap_or(img.rect), *q, false, false))
-                }
-                ImageEdit::RotateBy(degrees) => {
-                    let t = pdfcraft_edit::turn_by_degrees(img.visible_rect.unwrap_or(img.rect), *degrees)
-                        .ok_or_else(|| EditError::Edit(pdfcraft_edit::EditError::Invalid("the rotation angle must be a finite number".into())))?;
-                    pdfcraft_edit::ImageChange::Transform(t)
-                }
-                ImageEdit::Flip { horizontal } => pdfcraft_edit::ImageChange::Transform(pdfcraft_edit::turn_about_centre(
-                    img.visible_rect.unwrap_or(img.rect),
-                    0,
-                    *horizontal,
-                    !*horizontal,
-                )),
-                ImageEdit::Replace { name, bytes } => {
-                    if img.is_form {
-                        return Err(EditError::Edit(pdfcraft_edit::EditError::Invalid(
-                            "grouped Form artwork cannot be replaced with a bitmap".into(),
-                        )));
-                    }
-                    pdfcraft_edit::ImageChange::Replace(embed_image(doc, name, bytes)?.0)
-                }
-                ImageEdit::Crop(keep) => pdfcraft_edit::ImageChange::Crop(*keep),
-                ImageEdit::Delete => pdfcraft_edit::ImageChange::Delete,
-            };
-            pdfcraft_edit::change_image(doc, *page, *index, &c)?;
-        }
+        Edit::EditPageImage { page, index, change } => run_edit_page_image(doc, *page, *index, change)?,
         Edit::MoveObjects { page, objects, offset } => pdfcraft_edit::move_objects(doc, *page, objects, *offset)?,
         Edit::EditTextBlock { page, block, text, style } => {
             pdfcraft_edit::rewrite_block(doc, *page, *block, Some(text), style)?;
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index 0b49cfd4e1..fe139164be 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -54,6 +54,7 @@ mod stamp_preview;
 mod test_hooks;
 pub mod text_fonts;
 mod text_preview;
+pub mod text_script;
 pub mod text_style_bookmarks;
 pub mod word_count;
 pub mod xfa;
@@ -64,6 +65,7 @@ use std::sync::Arc;
 pub use links::{
     MAX_REMOTE_DOCUMENT_BYTES, RemoteDocumentPathError, read_remote_document, remote_document_path_is_absolute, resolve_remote_document_path,
 };
+pub use pdfcraft_edit::strip_subset_tag;
 pub use signature_image::{ImageSignaturePreview, SignatureImage};
 pub use signature_scan::{PhotoRect, ScanError, SignaturePhoto, Turn};
 pub use stamp_preview::{CommentLayer, StampPreview};
@@ -137,7 +139,7 @@ pub use history::Label;
 use layers::{apply_layer_state, set_default_layer_state, use_layer_choices};
 pub use open::{OpenContext, PreparedDocument};
 pub use page_filter::{PageOrientation, PageParity, filter_pages};
-pub use pictures::MarkFile;
+pub use pictures::{MarkFile, image_dimensions};
 use pictures::{embed_image, fit_picture, mark_source};
 use protection::unrestricted;
 pub use protection::{Changes, Printing, Protection, SecuritySummary};
@@ -154,6 +156,8 @@ use xfa_form::{
 mod clock;
 mod doc_state;
 
+pub use pdfcraft_edit::ArrangeOrder;
+
 use clock::{local_utc_offset, parse_ymd};
 pub use doc_state::{DocId, ImageEdit, OptimizeReport, RecoverySnapshot, SplitPart, guard, merge_data_files};
 use doc_state::{LOW_RESOLUTION_PRINT_DPI, render_threads, renderer_password, signatures_of, writable};
diff --git a/crates/engine/src/optimizer.rs b/crates/engine/src/optimizer.rs
index 42af737bab..30a14c5695 100644
--- a/crates/engine/src/optimizer.rs
+++ b/crates/engine/src/optimizer.rs
@@ -92,7 +92,24 @@ impl OptimizeJob {
         pdfcraft_xfa::clear_password_values(&mut cos).map_err(|e| EditError::Write(e.to_string()))?;
         let mut step = |stage| if progress(stage) { Ok(()) } else { Err(EditError::Cancelled) };
         step(OptimizeStage::Discarding)?;
-        let discarded = if discard.is_empty() { Vec::new() } else { pdfcraft_redact::sanitize::remove_hidden(&mut cos, &discard)? };
+        let discarded = if discard.is_empty() {
+            Vec::new()
+        } else {
+            // Every ticked category, as `remove_hidden` decides between them: with form fields
+            // ticked, discarding hidden text also takes the hidden text the flattened appearances
+            // bring onto the page, which no scan before flattening counts. It refuses when its scan
+            // counts every one as 0, which would end the whole optimization, and may have changed
+            // the copy by then (an empty outline root goes with bookmarks), so the copy from before
+            // is kept instead: nothing is discarded.
+            let before = cos.clone();
+            match pdfcraft_redact::sanitize::remove_hidden(&mut cos, &discard) {
+                Err(pdfcraft_redact::RedactError::NothingToApply) => {
+                    cos = before;
+                    Vec::new()
+                }
+                r => r?,
+            }
+        };
         let report = optimize::optimize_with_progress(&mut cos, &settings, &mut |s| {
             step(match s {
                 optimize::Stage::Fragments => OptimizeStage::Fragments,
diff --git a/crates/engine/src/pictures.rs b/crates/engine/src/pictures.rs
index b29941720a..49d76f07c0 100644
--- a/crates/engine/src/pictures.rs
+++ b/crates/engine/src/pictures.rs
@@ -2,6 +2,8 @@
 
 use std::sync::Arc;
 
+use image::ImageDecoder;
+
 use crate::EditError;
 
 /// A picture for a watermark or background (Acrobat: Source ▸ File): an image, or `page`
@@ -57,3 +59,69 @@ pub(crate) fn mark_source(doc: &mut pdfcraft_cos::Document, f: &MarkFile) -> Res
         Ok(pdfcraft_edit::MarkSource { xobject, size, image: true })
     }
 }
+
+/// The dimensions of an image from its bytes (JPEG, PNG, TIFF), without decoding the full raster.
+pub fn image_dimensions(bytes: &[u8]) -> Option<(u32, u32)> {
+    let format = image::guess_format(bytes).ok()?;
+    let mut reader = image::ImageReader::with_format(std::io::Cursor::new(bytes), format);
+    let mut limits = image::Limits::default();
+    limits.max_alloc = Some(64_000_000 * 4);
+    reader.limits(limits);
+    let mut decoder = reader.into_decoder().ok()?;
+    let (mut w, mut h) = image::ImageDecoder::dimensions(&decoder);
+    if w == 0 || h == 0 {
+        return None;
+    }
+    if format == image::ImageFormat::Jpeg
+        && u64::from(w) * u64::from(h) <= (64 << 20)
+        && let Ok(orientation) = decoder.orientation()
+        && matches!(
+            orientation,
+            image::metadata::Orientation::Rotate90
+                | image::metadata::Orientation::Rotate270
+                | image::metadata::Orientation::Rotate90FlipH
+                | image::metadata::Orientation::Rotate270FlipH
+        )
+    {
+        std::mem::swap(&mut w, &mut h);
+    }
+    Some((w, h))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn phone_jpeg(w: u32, h: u32, orientation: u8) -> Vec<u8> {
+        use image::codecs::jpeg::JpegEncoder;
+        let mut jpeg = Vec::new();
+        let mut encoder = JpegEncoder::new(&mut jpeg);
+        encoder.encode_image(&image::RgbImage::from_pixel(w, h, image::Rgb([20, 20, 20]))).expect("valid jpeg");
+        let mut exif = b"Exif\0\0II\x2a\0\x08\0\0\0\x01\0\x12\x01\x03\0\x01\0\0\0".to_vec();
+        exif.extend_from_slice(&[orientation, 0, 0, 0, 0, 0, 0, 0]);
+        let mut out = jpeg[..2].to_vec();
+        out.extend_from_slice(&[0xff, 0xe1]);
+        out.extend_from_slice(&((exif.len() + 2) as u16).to_be_bytes());
+        out.extend_from_slice(&exif);
+        out.extend_from_slice(&jpeg[2..]);
+        out
+    }
+
+    #[test]
+    fn jpeg_exif_orientation_swaps_dimensions_for_quarter_turns() {
+        let turned_6 = phone_jpeg(60, 20, 6);
+        assert_eq!(image_dimensions(&turned_6), Some((20, 60)));
+
+        let turned_8 = phone_jpeg(60, 20, 8);
+        assert_eq!(image_dimensions(&turned_8), Some((20, 60)));
+
+        let upright_1 = phone_jpeg(60, 20, 1);
+        assert_eq!(image_dimensions(&upright_1), Some((60, 20)));
+    }
+
+    #[test]
+    fn invalid_inputs_return_none() {
+        assert_eq!(image_dimensions(&[]), None);
+        assert_eq!(image_dimensions(b"not an image"), None);
+    }
+}
diff --git a/crates/engine/src/session/editing.rs b/crates/engine/src/session/editing.rs
index 7758dc7c85..be7fd5aca5 100644
--- a/crates/engine/src/session/editing.rs
+++ b/crates/engine/src/session/editing.rs
@@ -8,6 +8,15 @@ use super::{
 };
 use crate::{EditNotice, MarkKind};
 
+/// Whether the edit, or any edit inside a batch, deletes pages.
+fn deletes_pages(edit: &Edit) -> bool {
+    match edit {
+        Edit::DeletePages { .. } => true,
+        Edit::Batch { edits, .. } => edits.iter().any(deletes_pages),
+        _ => false,
+    }
+}
+
 impl Session {
     /// Apply an edit. On success the previous state is undoable and the view data is refreshed.
     pub fn apply(&mut self, id: DocId, edit: Edit) -> Result<(), EditError> {
@@ -163,6 +172,11 @@ impl Session {
         // Signed documents are only ever saved incrementally: an edit that needs a full rewrite
         // (applying redactions, changing security, sanitizing) would invalidate the signatures.
         // So does any edit to a file rebuilt from object headers: it has no chain to append to.
+        // Deleted pages remain in earlier incremental revisions (#3407), so rewrite
+        // unsigned files in full. Signed files must retain their signed bytes.
+        if !signed && deletes_pages(&edit) {
+            next.require_full_save();
+        }
         let rewrites = |c: &pdfcraft_cos::Document| c.full_save_required() || c.encryption_changed();
         if signed && ((rewrites(&next) && !rewrites(&editor.cos)) || (next.is_modified() && next.revisions().is_empty())) {
             return Err(EditError::SignedRewrite(edit.label().to_string()));
@@ -399,6 +413,7 @@ impl Session {
                     | Edit::DeleteContent { .. }
                     | Edit::ReplaceImage { .. }
                     | Edit::PasteContent { .. }
+                    | Edit::EditPageImage { .. }
             ) || matches!(e, Edit::MoveObjects { objects, .. } if objects.iter().any(|o| o.kind == ObjectKind::Added))
         });
         let touches_marks = edit.is_none_or(|e| {
diff --git a/crates/engine/src/session/files.rs b/crates/engine/src/session/files.rs
index 34d75e5c82..553ddd6aa3 100644
--- a/crates/engine/src/session/files.rs
+++ b/crates/engine/src/session/files.rs
@@ -71,12 +71,12 @@ impl Session {
     /// Reduce File Size: Acrobat's defaults (colour and grey images above 225 ppi to 150 ppi,
     /// JPEG medium quality; black-and-white averaged down to 300 ppi above 450 ppi, and stored as
     /// CCITT Group 4 whenever smaller; thumbnails dropped), identical resources merged, unused
-    /// objects dropped, objects packed into compressed object streams. Returns the bytes and how
-    /// many objects were merged. The open document is not changed (Acrobat saves the reduced copy
-    /// as a new file).
-    pub fn reduced_bytes(&self, id: DocId) -> Result<(Arc<Vec<u8>>, usize), EditError> {
+    /// objects dropped, objects packed into compressed object streams. Returns the bytes, how
+    /// many objects were merged and how many images stayed as they were, past what one run may
+    /// decode. The open document is not changed (Acrobat saves the reduced copy as a new file).
+    pub fn reduced_bytes(&self, id: DocId) -> Result<(Arc<Vec<u8>>, usize, usize), EditError> {
         let (bytes, report) = self.optimized_bytes(id, &optimize::Settings::default(), &[])?;
-        Ok((bytes, report.merged))
+        Ok((bytes, report.merged, report.optimize.images_refused))
     }
 
     /// Optimize PDF ▸ Advanced optimization: `settings` for images and objects, plus Remove
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index 333d0fd498..d60ed04d66 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -33,6 +33,39 @@ pub(crate) fn fixture(n: usize) -> Vec<u8> {
     out
 }
 
+fn fixture_with_rotation_and_user_unit(rotate: i64, user_unit: f64) -> Vec<u8> {
+    let mut objs: Vec<Vec<u8>> = vec![b"<< /Type /Catalog /Pages 2 0 R >>".to_vec()];
+    objs.push(b"<< /Type /Pages /Kids [4 0 R] /Count 1 /MediaBox [0 0 200 300] >>".to_vec());
+    objs.push(b"<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".to_vec());
+    let mut page_dict = String::from("<< /Type /Page /Parent 2 0 R /Contents 5 0 R /Resources << /Font << /F1 3 0 R >> >>");
+    if rotate != 0 {
+        page_dict.push_str(&format!(" /Rotate {rotate}"));
+    }
+    if (user_unit - 1.0).abs() > 1e-6 {
+        page_dict.push_str(&format!(" /UserUnit {user_unit}"));
+    }
+    page_dict.push_str(" >>");
+    objs.push(page_dict.into_bytes());
+    let body = "BT /F1 24 Tf 20 150 Td (Page 1) Tj ET";
+    objs.push(format!("<< /Length {} >>\nstream\n{body}\nendstream", body.len()).into_bytes());
+
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n", i + 1).as_bytes());
+        out.extend_from_slice(o);
+        out.extend_from_slice(b"\nendobj\n");
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    out
+}
+
 fn session_with(n: usize) -> (Session, DocId) {
     let mut s = Session::new().with_clock(|| 1_700_000_000);
     let id = s.open("fixture.pdf", None, Arc::new(fixture(n)), None).expect("opens");
@@ -934,9 +967,10 @@ fn revert_preserves_the_saved_pages_after_undo() {
 #[test]
 fn full_save_is_readable_and_smaller_after_deletes() {
     let (mut s, id) = session_with(5);
+    let original = s.save_bytes(id).unwrap();
     s.apply(id, Edit::DeletePages { pages: vec![0, 1, 2] }).unwrap();
     let full = s.save_full_bytes(id).unwrap();
-    assert!(full.len() < s.save_bytes(id).unwrap().len());
+    assert!(full.len() < original.len());
     let mut s2 = Session::new();
     let id2 = s2.open("full.pdf", None, full, None).unwrap();
     assert_eq!(page_texts(&s2, id2), ["Page 4", "Page 5"]);
@@ -3569,13 +3603,73 @@ fn create_and_reduce() {
     )
     .unwrap();
     let full = s2.save_full_bytes(id2).unwrap();
-    let (reduced, _) = s2.reduced_bytes(id2).unwrap();
+    let (reduced, ..) = s2.reduced_bytes(id2).unwrap();
     assert!(reduced.len() <= full.len(), "{} > {}", reduced.len(), full.len());
     let mut s3 = Session::new();
     let r = s3.open("r.pdf", None, reduced, None).unwrap();
     assert_eq!(page_texts(&s3, r), ["Page 1", "Page 1"]);
 }
 
+/// Discarding a category that holds nothing discards nothing; it used to end the whole
+/// optimization with an error about redaction marks.
+#[test]
+fn optimize_discarding_an_empty_category_still_runs() {
+    let (s, id) = session_with(2);
+    let (bytes, report) = s.optimized_bytes(id, &optimize::Settings::default(), &[crate::Hidden::Bookmarks, crate::Hidden::Comments]).unwrap();
+    assert!(bytes.starts_with(b"%PDF-"));
+    assert!(report.discarded.is_empty(), "{:?}", report.discarded);
+    // An outline root with no entries is no bookmarks: it stays, as Remove Hidden Information,
+    // which refuses then, leaves it.
+    let outline = pdfcraft_testkit::Pdf::new()
+        .obj("<< /Type /Catalog /Pages 2 0 R /Outlines 4 0 R /PageMode /UseOutlines >>")
+        .obj("<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 612 792] >>")
+        .obj("<< /Type /Page /Parent 2 0 R >>")
+        .obj("<< /Type /Outlines /Count 0 >>")
+        .build();
+    let mut s = Session::new();
+    let id = s.open("outline.pdf", None, Arc::new(outline), None).unwrap();
+    let (bytes, report) = s.optimized_bytes(id, &optimize::Settings::default(), &[crate::Hidden::Bookmarks]).unwrap();
+    assert!(report.discarded.is_empty(), "{:?}", report.discarded);
+    let saved = pdfcraft_cos::Document::open(bytes).unwrap();
+    let catalog = saved.get(saved.root().unwrap()).as_dict().cloned().unwrap();
+    assert!(catalog.contains(b"Outlines") && catalog.contains(b"PageMode"), "{catalog:?}");
+    // Beside an empty tick, one that holds something is discarded, and only that one.
+    let noted = pdfcraft_testkit::Pdf::new()
+        .obj("<< /Type /Catalog /Pages 2 0 R >>")
+        .obj("<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 612 792] >>")
+        .obj("<< /Type /Page /Parent 2 0 R /Annots [4 0 R] >>")
+        .obj("<< /Type /Annot /Subtype /Text /Rect [20 20 40 40] /Contents (internal note) >>")
+        .build();
+    let mut s = Session::new();
+    let id = s.open("noted.pdf", None, Arc::new(noted), None).unwrap();
+    let (_, report) = s.optimized_bytes(id, &optimize::Settings::default(), &[crate::Hidden::Bookmarks, crate::Hidden::Comments]).unwrap();
+    assert_eq!(report.discarded, vec![(crate::Hidden::Comments, 1)]);
+    // A field whose appearance draws text invisibly: flattening it brings that text onto the page,
+    // which no scan before counts as hidden, and discarding hidden text takes it too.
+    let form = pdfcraft_testkit::Pdf::new()
+        .obj("<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R] /DA (/F1 0 Tf 0 g) >> >>")
+        .obj("<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 612 792] >>")
+        .obj("<< /Type /Page /Parent 2 0 R /Annots [4 0 R] /Resources << /Font << /F1 6 0 R >> >> /Contents 7 0 R >>")
+        .obj("<< /Type /Annot /Subtype /Widget /FT /Tx /T (name) /V (shown) /Rect [100 100 300 130] /P 3 0 R /F 4 /AP << /N 5 0 R >> >>")
+        .stream(
+            "/Type /XObject /Subtype /Form /BBox [0 0 200 30] /Resources << /Font << /F1 6 0 R >> >>",
+            "/Tx BMC BT /F1 12 Tf 2 10 Td (shown) Tj ET BT /F1 12 Tf 3 Tr 2 20 Td (HIDDENSECRET) Tj ET EMC",
+        )
+        .obj("<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>")
+        .stream("", "BT /F1 12 Tf 72 700 Td (Page text) Tj ET")
+        .build();
+    let mut s = Session::new();
+    let id = s.open("form.pdf", None, Arc::new(form), None).unwrap();
+    let (bytes, _) = s.optimized_bytes(id, &optimize::Settings::default(), &[crate::Hidden::FormFields, crate::Hidden::HiddenText]).unwrap();
+    let saved = pdfcraft_cos::Document::open(bytes).unwrap();
+    for (r, object) in saved.scan_objects() {
+        if let pdfcraft_cos::Object::Stream(st) = &*object {
+            let data = st.decoded().unwrap_or_default();
+            assert!(!data.windows(12).any(|w| w == b"HIDDENSECRET"), "the hidden text stays in {r:?}");
+        }
+    }
+}
+
 #[test]
 fn an_optimize_job_reports_its_stages_and_can_be_cancelled() {
     use crate::optimizer::OptimizeStage;
@@ -6158,24 +6252,27 @@ fn a_static_xfa_form_takes_many_data_values_as_one_by_one() {
 /// Opening a static XFA form whose datasets fill thousands of fields took minutes: each value
 /// read the whole form again (twice), so the time grew with the square of the fields. Eight
 /// times the fields now takes at most about eight times as long (it took about fifty).
+///
+/// Each round opens the small form and then the large one, so a busy spell on a shared machine
+/// slows both, and the best round's ratio is checked. Timing every small opening before the
+/// large ones let such a spell fall on the large ones alone.
 #[test]
 fn opening_a_static_xfa_form_grows_linearly_with_its_data_values() {
-    let time = |n: usize| {
-        let bytes = Arc::new(pdfcraft_xfa::fixtures::static_shell_many(n));
-        (0..3)
-            .map(|_| {
-                let mut s = Session::new();
-                let start = std::time::Instant::now();
-                s.open("many.pdf", None, bytes.clone(), None).expect("opens");
-                start.elapsed()
-            })
-            .min()
-            .unwrap_or_default()
+    let small = Arc::new(pdfcraft_xfa::fixtures::static_shell_many(100));
+    let large = Arc::new(pdfcraft_xfa::fixtures::static_shell_many(800));
+    let time = |bytes: &Arc<Vec<u8>>| {
+        let mut s = Session::new();
+        let start = std::time::Instant::now();
+        s.open("many.pdf", None, bytes.clone(), None).expect("opens");
+        start.elapsed()
     };
-    let small = time(100);
-    let large = time(800);
-    let ratio = large.as_secs_f64() / small.as_secs_f64().max(1e-6);
-    assert!(ratio < 16.0, "100 fields: {small:?}, 800 fields: {large:?} ({ratio:.1}x)");
+    // The first openings also pay for what the process sets up once.
+    time(&small);
+    time(&large);
+    let rounds: Vec<_> = (0..5).map(|_| (time(&small), time(&large))).collect();
+    let ratio = |(s, l): &(std::time::Duration, std::time::Duration)| l.as_secs_f64() / s.as_secs_f64().max(1e-6);
+    let best = rounds.iter().map(ratio).fold(f64::INFINITY, f64::min);
+    assert!(best < 16.0, "100 and 800 fields, by round: {rounds:?} (best {best:.1}x)");
 }
 
 /// A date goes into the XFA data in the field's data picture (`<bind><picture>`), as other
@@ -8101,6 +8198,13 @@ fn copy_image_finds_the_image_under_a_point_and_decodes_it_at_full_size() {
     assert_eq!((w, h), (3, 2));
     assert_eq!(rgba, px.into_raw());
     assert!(d.page_image_rgba(0, 1).is_err());
+
+    // When the image is cropped, page_image_at only hit-tests the visible cropped region:
+    let crop_keep = [r[0] + (r[2] - r[0]) * 0.25, r[1] + (r[3] - r[1]) * 0.25, r[0] + (r[2] - r[0]) * 0.75, r[1] + (r[3] - r[1]) * 0.75];
+    s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Crop(crop_keep) }).unwrap();
+    let d = s.get(id).unwrap();
+    assert_eq!(d.page_image_at(0, [(r[0] + r[2]) / 2.0, (r[1] + r[3]) / 2.0]), Some(0));
+    assert_eq!(d.page_image_at(0, [r[0] + 0.1, r[1] + 0.1]), None, "cropped-away corner must not hit-test positive");
 }
 
 /// Copy Image: a JPEG drawn through grouped Form artwork (as Word, InDesign and scanners write
@@ -8153,6 +8257,130 @@ fn copy_image_finds_a_picture_inside_form_artwork_under_text() {
     assert!(d.page_image_copy_file(0, 1).is_err());
 }
 
+/// Copy Image reads a JBIG2 image's `/JBIG2Globals`: here they hold the page information, and the
+/// image's own stream only an extension segment decoders skip, so it has a picture only through
+/// them. Its default pixel is black.
+#[test]
+fn copy_image_reads_the_globals_of_a_jbig2_picture() {
+    let mut globals = vec![0, 0, 0, 0, 48, 0, 1, 0, 0, 0, 19];
+    globals.extend_from_slice(&16u32.to_be_bytes());
+    globals.extend_from_slice(&2u32.to_be_bytes());
+    globals.extend_from_slice(&[0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0]); // resolution, flags, striping
+    let image = [0, 0, 0, 1, 62, 0, 1, 0, 0, 0, 0];
+    let stream = |dict: &str, data: &[u8]| {
+        let mut o = format!("<< {dict} /Length {} >>\nstream\n", data.len()).into_bytes();
+        o.extend_from_slice(data);
+        o.extend_from_slice(b"\nendstream");
+        o
+    };
+    let objs: Vec<Vec<u8>> = vec![
+        b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 300] >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /Contents 4 0 R /Resources << /XObject << /Im1 5 0 R >> >> >>".to_vec(),
+        stream("", b"q 160 0 0 20 20 100 cm /Im1 Do Q"),
+        stream(
+            "/Type /XObject /Subtype /Image /Width 16 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 1 /Filter /JBIG2Decode /DecodeParms << /JBIG2Globals 6 0 R >>",
+            &image,
+        ),
+        stream("", &globals),
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n", i + 1).as_bytes());
+        out.extend_from_slice(o);
+        out.extend_from_slice(b"\nendobj\n");
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    let mut s = Session::new();
+    let id = s.open("scan.pdf", None, Arc::new(out), None).unwrap();
+    let d = s.get(id).unwrap();
+    let (w, h, rgba) = d.page_image_rgba(0, 0).unwrap();
+    assert_eq!((w, h), (16, 2));
+    assert!(rgba.chunks(4).all(|p| p == [0, 0, 0, 255]), "the page's default pixel, from the globals");
+    // An Office export shares one allowance across its pictures. One past it is left out, and the
+    // export says the page is missing something, as for a picture past its bytes.
+    let (pages, truncated) = d.export_pages_within(true, 1 << 20, &mut pdfcraft_cos::ImageBudget::with_work(u64::MAX));
+    assert_eq!((pages[0].images.len(), truncated.len()), (1, 0));
+    let (pages, truncated) = d.export_pages_within(true, 1 << 20, &mut pdfcraft_cos::ImageBudget::with_work(0));
+    assert!(pages[0].images.is_empty());
+    assert_eq!(truncated, [0]);
+}
+
+/// An Office export leaves out a picture it can't encode, as it did. That isn't a page cut short:
+/// only a picture past what the export may do is reported as one.
+#[test]
+fn an_office_export_doesnt_call_an_unreadable_picture_truncated() {
+    let pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+        2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 300] >> endobj\n\
+        3 0 obj << /Type /Page /Parent 2 0 R /Contents 4 0 R /Resources << /XObject << /Im1 5 0 R >> >> >> endobj\n\
+        4 0 obj << /Length 31 >> stream\nq 160 0 0 20 20 100 cm /Im1 Do Q\nendstream endobj\n\
+        5 0 obj << /Type /XObject /Subtype /Image /Width 2 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 8 /Filter /JPXDecode /Length 4 >> stream\nnone\nendstream endobj\n\
+        trailer << /Root 1 0 R >>\n%%EOF"
+        .to_vec();
+    let mut s = Session::new();
+    let id = s.open("picture.pdf", None, Arc::new(pdf), None).unwrap();
+    let (pages, truncated) = s.get(id).unwrap().export_pages_within(true, 1 << 20, &mut pdfcraft_cos::ImageBudget::with_work(u64::MAX));
+    assert!(pages[0].images.is_empty());
+    assert_eq!(truncated, Vec::<usize>::new());
+}
+
+/// Copy Image takes a JBIG2 picture as its pixels and as a PNG file, behind another filter
+/// (ASCIIHexDecode) too: Export's decoding, through `ImageBudget::decode`.
+#[test]
+fn copy_image_copies_a_jbig2_picture_behind_another_filter() {
+    // 16 × 2: the left half of the top row black, the rest white.
+    let bits = [0x00, 0xFF, 0xFF, 0xFF];
+    let coded = pdfcraft_filters::encode_jbig2_generic(&bits, 16, 2).unwrap();
+    let hex: Vec<u8> = coded.iter().flat_map(|b| format!("{b:02x}").into_bytes()).chain(*b">").collect();
+    let stream = |dict: &str, data: &[u8]| {
+        let mut o = format!("<< {dict} /Length {} >>\nstream\n", data.len()).into_bytes();
+        o.extend_from_slice(data);
+        o.extend_from_slice(b"\nendstream");
+        o
+    };
+    let objs: Vec<Vec<u8>> = vec![
+        b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 300] >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /Contents 4 0 R /Resources << /XObject << /Im1 5 0 R >> >> >>".to_vec(),
+        stream("", b"q 160 0 0 20 20 100 cm /Im1 Do Q"),
+        stream(
+            "/Type /XObject /Subtype /Image /Width 16 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 1 /Filter [/ASCIIHexDecode /JBIG2Decode]",
+            &hex,
+        ),
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n", i + 1).as_bytes());
+        out.extend_from_slice(o);
+        out.extend_from_slice(b"\nendobj\n");
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    let mut s = Session::new();
+    let id = s.open("scan.pdf", None, Arc::new(out), None).unwrap();
+    let d = s.get(id).unwrap();
+    assert_eq!(d.page_image_at(0, [30.0, 115.0]), Some(0));
+    assert_eq!(d.page_image_copy_file(0, 0).unwrap().0, "png");
+    let (w, h, rgba) = d.page_image_rgba(0, 0).unwrap();
+    assert_eq!((w, h), (16, 2));
+    let grey: Vec<u8> = rgba.chunks(4).map(|px| px[0]).collect();
+    let expected: Vec<u8> = (0..32).map(|i| if i < 8 { 0 } else { 255 }).collect();
+    assert_eq!(grey, expected, "the picture, black as 0");
+}
+
 /// `fixture(2)` with the catalog pointing at a page tree object the file does not have (#1656).
 fn fixture_without_page_tree() -> Vec<u8> {
     let bytes = fixture(2);
@@ -9072,6 +9300,61 @@ fn a_fields_own_script_may_not_save_as_or_show_a_panel() {
     assert_eq!(o.requests, [js::Request::SaveAs]);
 }
 
+/// A page of `count` pictures of one flat grey, `side` pixels square, each an object of its own.
+fn page_of_pictures(count: usize, side: usize) -> Vec<u8> {
+    let data = pdfcraft_filters::encode_flate(&vec![0x80; side * side]);
+    let names: String = (0..count).map(|i| format!("/Im{i} {} 0 R ", 5 + i)).collect();
+    let content: String = (0..count).map(|i| format!("q 10 0 0 10 0 0 cm /Im{i} Do Q\n")).collect();
+    let mut pdf = format!(
+        "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+         2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 300] >> endobj\n\
+         3 0 obj << /Type /Page /Parent 2 0 R /Contents 4 0 R /Resources << /XObject << {names}>> >> >> endobj\n\
+         4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n",
+        content.len()
+    )
+    .into_bytes();
+    for i in 0..count {
+        let dict = format!(
+            "{} 0 obj << /Type /XObject /Subtype /Image /Width {side} /Height {side} /ColorSpace /DeviceGray /BitsPerComponent 8 /Filter /FlateDecode /Length {} >> stream\n",
+            5 + i,
+            data.len()
+        );
+        pdf.extend_from_slice(dict.as_bytes());
+        pdf.extend_from_slice(&data);
+        pdf.extend_from_slice(b"\nendstream endobj\n");
+    }
+    pdf.extend_from_slice(b"trailer << /Root 1 0 R >>\n%%EOF");
+    pdf
+}
+
+/// The allowance is the export's, not each picture's: a page of many small pictures stops where it
+/// runs out, the rest are left out and counted, and the page is listed, which is what the export's
+/// warning goes by. A few large pictures are well within it, and all come through.
+#[test]
+fn a_page_of_many_pictures_stops_at_the_exports_allowance() {
+    let export = |pdf: Vec<u8>, work: &mut pdfcraft_cos::ImageBudget| {
+        let mut s = Session::new();
+        let id = s.open("pictures.pdf", None, Arc::new(pdf), None).unwrap();
+        s.get(id).unwrap().export_pages_within(true, 1 << 30, work)
+    };
+    let mut one = pdfcraft_cos::ImageBudget::with_work(u64::MAX);
+    export(page_of_pictures(1, 2), &mut one);
+    let cost = u64::MAX - one.work_left();
+    assert!(cost > 0);
+
+    let mut work = pdfcraft_cos::ImageBudget::with_work(100 * cost);
+    let (pages, truncated) = export(page_of_pictures(10_000, 2), &mut work);
+    assert_eq!(pages[0].images.len(), 100);
+    assert_eq!(truncated, vec![0]);
+    assert_eq!(work.refused(), 9_900);
+
+    let mut s = Session::new();
+    let id = s.open("large.pdf", None, Arc::new(page_of_pictures(3, 1_000)), None).unwrap();
+    let (pages, truncated) = s.get(id).unwrap().export_pages_checked(true, 1 << 30);
+    assert_eq!(pages[0].images.len(), 3);
+    assert_eq!(truncated, Vec::<usize>::new());
+}
+
 /// A page whose forms go past the reading limit and whose picture goes past the image budget is
 /// listed once among the truncated pages.
 #[test]
@@ -9118,6 +9401,474 @@ fn a_page_truncated_for_forms_and_pictures_is_listed_once() {
     assert_eq!(truncated, [0]);
 }
 
+/// Moving an added image, then rotating it, must keep the moved position.
+#[test]
+fn added_image_move_then_rotate_keeps_position() {
+    let mut png = Vec::new();
+    {
+        let mut enc = png::Encoder::new(&mut png, 2, 2);
+        enc.set_color(png::ColorType::Rgb);
+        enc.write_header().unwrap().write_image_data(&[255u8; 12]).unwrap();
+    }
+    let (mut s, id) = session_with(1);
+    s.apply(id, Edit::AddImage { page: 0, rect: Some([20.0, 20.0, 60.0, 60.0]), name: "p.png".into(), bytes: Arc::new(png) }).unwrap();
+    let rect = |s: &Session| s.get(id).unwrap().page_images(0)[0].rect;
+    s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Move([120.0, 120.0, 160.0, 160.0]) }).unwrap();
+    let moved = rect(&s);
+    s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Rotate(1) }).unwrap();
+    let rotated = rect(&s);
+    let c = |r: [f64; 4]| ((r[0] + r[2]) / 2.0, (r[1] + r[3]) / 2.0);
+    let (a, b) = (c(moved), c(rotated));
+    assert!((a.0 - b.0).abs() < 1.0 && (a.1 - b.1).abs() < 1.0, "rotate moved the centre from {a:?} to {b:?}");
+}
+
+/// Transforming an added image, then rotating it, must keep the moved position.
+#[test]
+fn added_image_transform_then_rotate_keeps_position() {
+    let mut png = Vec::new();
+    {
+        let mut enc = png::Encoder::new(&mut png, 2, 2);
+        enc.set_color(png::ColorType::Rgb);
+        enc.write_header().unwrap().write_image_data(&[255u8; 12]).unwrap();
+    }
+    let (mut s, id) = session_with(1);
+    s.apply(id, Edit::AddImage { page: 0, rect: Some([20.0, 20.0, 60.0, 60.0]), name: "p.png".into(), bytes: Arc::new(png) }).unwrap();
+    let rect = |s: &Session| s.get(id).unwrap().page_images(0)[0].rect;
+    // Translate by (100, 100): matrix [1, 0, 0, 1, 100, 100]
+    s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Transform([1.0, 0.0, 0.0, 1.0, 100.0, 100.0]) }).unwrap();
+    let transformed = rect(&s);
+    s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Rotate(1) }).unwrap();
+    let rotated = rect(&s);
+    let c = |r: [f64; 4]| ((r[0] + r[2]) / 2.0, (r[1] + r[3]) / 2.0);
+    let (a, b) = (c(transformed), c(rotated));
+    assert!((a.0 - b.0).abs() < 1.0 && (a.1 - b.1).abs() < 1.0, "rotate moved the centre from {a:?} to {b:?}");
+}
+
+/// Moving an added image, then rotating by degrees, must keep the moved position.
+#[test]
+fn added_image_move_then_rotate_by_keeps_position() {
+    let mut png = Vec::new();
+    {
+        let mut enc = png::Encoder::new(&mut png, 2, 2);
+        enc.set_color(png::ColorType::Rgb);
+        enc.write_header().unwrap().write_image_data(&[255u8; 12]).unwrap();
+    }
+    let (mut s, id) = session_with(1);
+    s.apply(id, Edit::AddImage { page: 0, rect: Some([20.0, 20.0, 60.0, 60.0]), name: "p.png".into(), bytes: Arc::new(png) }).unwrap();
+    let rect = |s: &Session| s.get(id).unwrap().page_images(0)[0].rect;
+    s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Move([120.0, 120.0, 160.0, 160.0]) }).unwrap();
+    let moved = rect(&s);
+    s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::RotateBy(90.0) }).unwrap();
+    let rotated = rect(&s);
+    let c = |r: [f64; 4]| ((r[0] + r[2]) / 2.0, (r[1] + r[3]) / 2.0);
+    let (a, b) = (c(moved), c(rotated));
+    assert!((a.0 - b.0).abs() < 1.0 && (a.1 - b.1).abs() < 1.0, "rotate_by moved the centre from {a:?} to {b:?}");
+}
+
+/// Arranging an added image moves it into the document stream and converts it to an ordinary
+/// page image (dropping the PCAdded marker), so no empty shell remains in list_added.
+#[test]
+fn added_image_arrange_converts_to_ordinary_image() {
+    let mut png = Vec::new();
+    {
+        let mut enc = png::Encoder::new(&mut png, 2, 2);
+        enc.set_color(png::ColorType::Rgb);
+        enc.write_header().unwrap().write_image_data(&[255u8; 12]).unwrap();
+    }
+    let (mut s, id) = session_with(1);
+    s.apply(id, Edit::AddImage { page: 0, rect: Some([20.0, 20.0, 60.0, 60.0]), name: "p1.png".into(), bytes: Arc::new(png.clone()) }).unwrap();
+    s.apply(id, Edit::AddImage { page: 0, rect: Some([100.0, 100.0, 200.0, 200.0]), name: "p2.png".into(), bytes: Arc::new(png) }).unwrap();
+    assert_eq!(s.get(id).unwrap().page_images(0).len(), 2);
+    assert_eq!(s.get(id).unwrap().added().len(), 2);
+    s.apply(id, Edit::EditPageImage { page: 0, index: 1, change: ImageEdit::Arrange(ArrangeOrder::SendToBack) }).unwrap();
+    assert_eq!(s.get(id).unwrap().page_images(0).len(), 2);
+    assert_eq!(s.get(id).unwrap().added().len(), 1, "arranged image is converted and no longer an added-item shell");
+}
+
+#[test]
+fn added_image_crop_then_move_keeps_crop() {
+    let mut png = Vec::new();
+    {
+        let mut enc = png::Encoder::new(&mut png, 2, 2);
+        enc.set_color(png::ColorType::Rgb);
+        enc.write_header().unwrap().write_image_data(&[255u8; 12]).unwrap();
+    }
+    let (mut s, id) = session_with(1);
+    s.apply(id, Edit::AddImage { page: 0, rect: Some([20.0, 20.0, 100.0, 100.0]), name: "p.png".into(), bytes: Arc::new(png) }).unwrap();
+    s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Crop([30.0, 30.0, 70.0, 70.0]) }).unwrap();
+    s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Move([50.0, 50.0, 130.0, 130.0]) }).unwrap();
+    let img = s.get(id).unwrap().page_images(0)[0].clone();
+    assert_eq!(img.visible_rect, Some([60.0, 60.0, 100.0, 100.0]));
+}
+
+#[test]
+fn added_image_move_and_transform_on_rotated_and_user_unit_pages() {
+    let mut png = Vec::new();
+    {
+        let mut enc = png::Encoder::new(&mut png, 2, 2);
+        enc.set_color(png::ColorType::Rgb);
+        enc.write_header().unwrap().write_image_data(&[255u8; 12]).unwrap();
+    }
+    let png_bytes = Arc::new(png);
+
+    let cases = [(90, 1.0), (180, 1.0), (270, 1.0), (0, 2.0), (90, 2.0)];
+
+    for (rotate, user_unit) in cases {
+        let pdf = fixture_with_rotation_and_user_unit(rotate, user_unit);
+        let mut s = Session::new().with_clock(|| 1_700_000_000);
+        let id = s.open("test.pdf", None, Arc::new(pdf), None).expect("opens");
+
+        s.apply(id, Edit::AddImage { page: 0, rect: Some([10.0, 10.0, 50.0, 50.0]), name: "img.png".into(), bytes: png_bytes.clone() }).unwrap();
+
+        // Target user-space rectangle R
+        let r = [30.0, 40.0, 80.0, 90.0];
+        s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Move(r) }).unwrap();
+
+        let painted = s.get(id).unwrap().page_images(0)[0].rect;
+        for i in 0..4 {
+            assert!(
+                (painted[i] - r[i]).abs() < 1e-3,
+                "Move: rotate={rotate}, user_unit={user_unit}: painted[{i}] = {}, expected {}",
+                painted[i],
+                r[i]
+            );
+        }
+
+        let cos = pdfcraft_cos::Document::open(s.get(id).unwrap().bytes.clone()).unwrap();
+        let added = pdfcraft_edit::list_added(&cos);
+        assert_eq!(added.len(), 1);
+        let stream_obj = match &*cos.get(added[0].obj) {
+            pdfcraft_cos::Object::Stream(s) => s.clone(),
+            other => panic!("expected stream, got {other:?}"),
+        };
+        let pc_rect = stream_obj
+            .dict
+            .get(b"PCAdded")
+            .and_then(|o| cos.resolve(o).as_dict().cloned())
+            .and_then(|d| d.get(b"Rect").cloned())
+            .and_then(|o| cos.resolve(&o).as_array().cloned())
+            .unwrap();
+        let pc_box: [f64; 4] =
+            [pc_rect[0].as_f64().unwrap(), pc_rect[1].as_f64().unwrap(), pc_rect[2].as_f64().unwrap(), pc_rect[3].as_f64().unwrap()];
+        let content = String::from_utf8(stream_obj.decoded().unwrap()).unwrap();
+        let re_idx = content.find(" re W n").expect("re W n in content stream");
+        let prefix = &content[..re_idx];
+        let nums: Vec<f64> =
+            prefix.split_whitespace().rev().take(4).collect::<Vec<_>>().into_iter().rev().map(|val| val.parse::<f64>().unwrap()).collect();
+        assert_eq!(nums.len(), 4);
+        let (rx, ry, rw, rh) = (nums[0], nums[1], nums[2], nums[3]);
+        assert!((rx - pc_box[0]).abs() < 1e-3, "re x {rx} != pc_box[0] {}", pc_box[0]);
+        assert!((ry - pc_box[1]).abs() < 1e-3, "re y {ry} != pc_box[1] {}", pc_box[1]);
+        assert!((rw - (pc_box[2] - pc_box[0])).abs() < 1e-3, "re w {rw} != {}", pc_box[2] - pc_box[0]);
+        assert!((rh - (pc_box[3] - pc_box[1])).abs() < 1e-3, "re h {rh} != {}", pc_box[3] - pc_box[1]);
+
+        // Transform test: user-space translation by (10, 10)
+        s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Transform([1.0, 0.0, 0.0, 1.0, 10.0, 10.0]) }).unwrap();
+
+        let expected_transformed = [r[0] + 10.0, r[1] + 10.0, r[2] + 10.0, r[3] + 10.0];
+        let painted_transformed = s.get(id).unwrap().page_images(0)[0].rect;
+        for i in 0..4 {
+            assert!(
+                (painted_transformed[i] - expected_transformed[i]).abs() < 1e-3,
+                "Transform: rotate={rotate}, user_unit={user_unit}: painted[{i}] = {}, expected {}",
+                painted_transformed[i],
+                expected_transformed[i]
+            );
+        }
+    }
+}
+
+#[test]
+fn replace_on_added_image_replaces_xobject_and_undo_restores() {
+    let make_png = |rgb: [u8; 3]| {
+        let mut png = Vec::new();
+        {
+            let mut enc = png::Encoder::new(&mut png, 2, 2);
+            enc.set_color(png::ColorType::Rgb);
+            let data = [rgb[0], rgb[1], rgb[2], rgb[0], rgb[1], rgb[2], rgb[0], rgb[1], rgb[2], rgb[0], rgb[1], rgb[2]];
+            enc.write_header().unwrap().write_image_data(&data).unwrap();
+        }
+        Arc::new(png)
+    };
+    let png1 = make_png([255, 0, 0]);
+    let png2 = make_png([0, 0, 255]);
+
+    let (mut s, id) = session_with(1);
+    s.apply(id, Edit::AddImage { page: 0, rect: Some([20.0, 20.0, 60.0, 60.0]), name: "img1.png".into(), bytes: png1 }).unwrap();
+
+    let old_obj = s.get(id).unwrap().page_images(0)[0].object.expect("initial image object ref");
+
+    s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Replace { name: "img2.png".into(), bytes: png2 } }).unwrap();
+
+    let new_obj = s.get(id).unwrap().page_images(0)[0].object.expect("new image object ref");
+    assert_ne!(new_obj, old_obj, "after Replace the page references the new XObject");
+
+    s.undo(id).unwrap();
+
+    let restored_obj = s.get(id).unwrap().page_images(0)[0].object.expect("restored image object ref");
+    assert_eq!(restored_obj, old_obj, "undo restores the old XObject");
+
+    // Also test replacement on an image with active crop (promoted path)
+    let png3 = make_png([0, 255, 0]);
+    s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Crop([25.0, 25.0, 55.0, 55.0]) }).unwrap();
+    let crop_obj = s.get(id).unwrap().page_images(0)[0].object.expect("crop image object ref");
+    assert_eq!(crop_obj, old_obj);
+    s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Replace { name: "img3.png".into(), bytes: png3 } }).unwrap();
+    let promoted_new_obj = s.get(id).unwrap().page_images(0)[0].object.expect("promoted replace object ref");
+    assert_ne!(promoted_new_obj, crop_obj);
+    s.undo(id).unwrap();
+    assert_eq!(s.get(id).unwrap().page_images(0)[0].object.expect("undo promoted replace"), crop_obj);
+}
+
+#[test]
+fn mirroring_transform_on_added_image_flips_and_non_finite_is_refused() {
+    let make_png = |rgb: [u8; 3]| {
+        let mut png = Vec::new();
+        {
+            let mut enc = png::Encoder::new(&mut png, 2, 2);
+            enc.set_color(png::ColorType::Rgb);
+            let data = [rgb[0], rgb[1], rgb[2], rgb[0], rgb[1], rgb[2], rgb[0], rgb[1], rgb[2], rgb[0], rgb[1], rgb[2]];
+            enc.write_header().unwrap().write_image_data(&data).unwrap();
+        }
+        Arc::new(png)
+    };
+    let png1 = make_png([255, 0, 0]);
+
+    let (mut s, id) = session_with(1);
+    s.apply(id, Edit::AddImage { page: 0, rect: Some([0.0, 0.0, 80.0, 40.0]), name: "img1.png".into(), bytes: png1 }).unwrap();
+
+    let initial_img = s.get(id).unwrap().page_images(0)[0].clone();
+    assert_eq!(initial_img.rect, [0.0, 0.0, 80.0, 40.0]);
+    assert!(initial_img.matrix[0] > 0.0, "initially unflipped");
+
+    // Mirroring transform: [-1.0, 0.0, 0.0, 1.0, 80.0, 0.0]
+    s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Transform([-1.0, 0.0, 0.0, 1.0, 80.0, 0.0]) }).unwrap();
+
+    let flipped_img = s.get(id).unwrap().page_images(0)[0].clone();
+    assert!(flipped_img.matrix[0] < 0.0, "horizontal mirror flips matrix x-axis, got matrix: {:?}", flipped_img.matrix);
+
+    let cos = pdfcraft_cos::Document::open(s.get(id).unwrap().bytes.clone()).unwrap();
+    let added = pdfcraft_edit::list_added(&cos);
+    assert_eq!(added.len(), 1);
+    let AddedContent::Image(ai) = &added[0].content else { panic!("expected added image") };
+    assert!(ai.flip_h, "PCAdded record must have flip_h = true");
+
+    // Mirroring horizontally again flips it back
+    s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Transform([-1.0, 0.0, 0.0, 1.0, 80.0, 0.0]) }).unwrap();
+    let unflipped_img = s.get(id).unwrap().page_images(0)[0].clone();
+    assert!(unflipped_img.matrix[0] > 0.0, "double horizontal mirror restores positive x-axis");
+    let cos2 = pdfcraft_cos::Document::open(s.get(id).unwrap().bytes.clone()).unwrap();
+    let AddedContent::Image(ai2) = &pdfcraft_edit::list_added(&cos2)[0].content else { panic!("expected added image") };
+    assert!(!ai2.flip_h, "PCAdded record must have flip_h = false");
+
+    // Mirroring vertically: [1.0, 0.0, 0.0, -1.0, 0.0, 40.0]
+    s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Transform([1.0, 0.0, 0.0, -1.0, 0.0, 40.0]) }).unwrap();
+    let v_flipped_img = s.get(id).unwrap().page_images(0)[0].clone();
+    assert!(v_flipped_img.matrix[3] < 0.0, "vertical mirror flips matrix y-axis, got matrix: {:?}", v_flipped_img.matrix);
+    let cos3 = pdfcraft_cos::Document::open(s.get(id).unwrap().bytes.clone()).unwrap();
+    let AddedContent::Image(ai3) = &pdfcraft_edit::list_added(&cos3)[0].content else { panic!("expected added image") };
+    assert!(ai3.flip_v, "PCAdded record must have flip_v = true");
+
+    // Non-finite transform must be refused with error
+    let res = s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Transform([f64::NAN, 0.0, 0.0, 1.0, 0.0, 0.0]) });
+    assert!(res.is_err(), "NaN transform must be refused");
+
+    let res_inf = s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Transform([1.0, 0.0, 0.0, f64::INFINITY, 0.0, 0.0]) });
+    assert!(res_inf.is_err(), "infinite transform must be refused");
+
+    let res_move = s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Move([f64::NAN, 20.0, 100.0, 60.0]) });
+    assert!(res_move.is_err(), "NaN position must be refused");
+}
+
+#[test]
+fn transform_on_added_image_folds_quarter_turns_and_promotes_non_axis_aligned() {
+    let make_png = |rgb: [u8; 3]| {
+        let mut png = Vec::new();
+        {
+            let mut enc = png::Encoder::new(&mut png, 2, 2);
+            enc.set_color(png::ColorType::Rgb);
+            let data = [rgb[0], rgb[1], rgb[2], rgb[0], rgb[1], rgb[2], rgb[0], rgb[1], rgb[2], rgb[0], rgb[1], rgb[2]];
+            enc.write_header().unwrap().write_image_data(&data).unwrap();
+        }
+        Arc::new(png)
+    };
+    let png1 = make_png([0, 128, 255]);
+
+    let (mut s, id) = session_with(1);
+    s.apply(id, Edit::AddImage { page: 0, rect: Some([100.0, 100.0, 200.0, 150.0]), name: "img.png".into(), bytes: png1 }).unwrap();
+
+    // 1. A pure 90° clockwise rotation matrix about the image centre:
+    let rot_90_cw = pdfcraft_edit::turn_about_centre([100.0, 100.0, 200.0, 150.0], 1, false, false);
+    s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Transform(rot_90_cw) }).unwrap();
+
+    let cos = pdfcraft_cos::Document::open(s.get(id).unwrap().bytes.clone()).unwrap();
+    let added = pdfcraft_edit::list_added(&cos);
+    assert_eq!(added.len(), 1, "stays as PCAdded image");
+    let AddedContent::Image(ai) = &added[0].content else { panic!("expected added image") };
+    assert_eq!(ai.rotation, 3, "quarter turn clockwise folds into ai.rotation = 3 (270° CCW)");
+    // Centre is (150, 125); rotated width=50, height=100 -> [125, 75, 175, 175]
+    assert!((ai.rect[0] - 125.0).abs() < 1e-4);
+    assert!((ai.rect[1] - 75.0).abs() < 1e-4);
+    assert!((ai.rect[2] - 175.0).abs() < 1e-4);
+    assert!((ai.rect[3] - 175.0).abs() < 1e-4);
+
+    // 2. A pure 90° counter-clockwise rotation matrix:
+    let rot_90_ccw = pdfcraft_edit::turn_about_centre(ai.rect, 3, false, false);
+    s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Transform(rot_90_ccw) }).unwrap();
+
+    let cos2 = pdfcraft_cos::Document::open(s.get(id).unwrap().bytes.clone()).unwrap();
+    let AddedContent::Image(ai2) = &pdfcraft_edit::list_added(&cos2)[0].content else { panic!("expected added image") };
+    assert_eq!(ai2.rotation, 0, "quarter turn counter-clockwise restores ai.rotation = 0");
+    assert!((ai2.rect[0] - 100.0).abs() < 1e-4);
+    assert!((ai2.rect[1] - 100.0).abs() < 1e-4);
+    assert!((ai2.rect[2] - 200.0).abs() < 1e-4);
+    assert!((ai2.rect[3] - 150.0).abs() < 1e-4);
+
+    // Arbitrary transforms promote the added image, just like RotateBy.
+    let initial_matrix = s.get(id).unwrap().page_images(0)[0].matrix;
+    let rot_45 = pdfcraft_edit::turn_by_degrees([100.0, 100.0, 200.0, 150.0], 45.0).unwrap();
+    s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Transform(rot_45) }).unwrap();
+    let cos = pdfcraft_cos::Document::open(s.get(id).unwrap().bytes.clone()).unwrap();
+    assert!(pdfcraft_edit::list_added(&cos).is_empty(), "arbitrary transform promotes the image");
+    assert_eq!(s.get(id).unwrap().page_images(0).len(), 1);
+    let expected = pdfcraft_content::Matrix(initial_matrix).then(&pdfcraft_content::Matrix(rot_45)).0;
+    let actual = s.get(id).unwrap().page_images(0)[0].matrix;
+    assert!(actual.into_iter().zip(expected).all(|(a, b)| (a - b).abs() < 1e-3), "{actual:?} != {expected:?}");
+    s.undo(id).unwrap();
+    let cos = pdfcraft_cos::Document::open(s.get(id).unwrap().bytes.clone()).unwrap();
+    assert_eq!(pdfcraft_edit::list_added(&cos).len(), 1, "undo restores added-image editability");
+    s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Transform([1.0, 0.5, 0.0, 1.0, 0.0, 0.0]) }).unwrap();
+    assert_eq!(s.get(id).unwrap().page_images(0).len(), 1);
+}
+
+#[test]
+fn test_added_image_transform_reflections_with_rotation() {
+    let make_asymmetric_png = || {
+        let mut px = Vec::with_capacity(20 * 20 * 3);
+        for y in 0..20 {
+            for x in 0..20 {
+                let color = match (x < 10, y < 10) {
+                    (true, true) => [255, 0, 0],     // TL: Red
+                    (false, true) => [0, 255, 0],    // TR: Green
+                    (true, false) => [0, 0, 255],    // BL: Blue
+                    (false, false) => [255, 255, 0], // BR: Yellow
+                };
+                px.extend_from_slice(&color);
+            }
+        }
+        let mut png = Vec::new();
+        {
+            let mut enc = png::Encoder::new(&mut png, 20, 20);
+            enc.set_color(png::ColorType::Rgb);
+            enc.write_header().unwrap().write_image_data(&px).unwrap();
+        }
+        Arc::new(png)
+    };
+
+    let colour_at = |s: &Session, id: DocId, x: u32, y_from_top: u32| -> [u8; 3] {
+        let doc = s.get(id).unwrap();
+        let mut r = pdfcraft_render::PageRenderer::new(doc.bytes.clone(), Default::default());
+        let out = r.render(pdfcraft_render::RenderRequest { page: 0, scale: 1.0, ..Default::default() });
+        let i = ((y_from_top * out.width + x) * 4) as usize;
+        [out.rgba[i], out.rgba[i + 1], out.rgba[i + 2]]
+    };
+
+    let is_red = |c: [u8; 3]| c[0] > 200 && c[1] < 50 && c[2] < 50;
+    let is_green = |c: [u8; 3]| c[0] < 50 && c[1] > 200 && c[2] < 50;
+    let is_blue = |c: [u8; 3]| c[0] < 50 && c[1] < 50 && c[2] > 200;
+    let is_yellow = |c: [u8; 3]| c[0] > 200 && c[1] > 200 && c[2] < 50;
+
+    let check_quadrants =
+        |s: &Session, id: DocId, tl: fn([u8; 3]) -> bool, tr: fn([u8; 3]) -> bool, bl: fn([u8; 3]) -> bool, br: fn([u8; 3]) -> bool, label: &str| {
+            let c_tl = colour_at(s, id, 75, 125);
+            let c_tr = colour_at(s, id, 125, 125);
+            let c_bl = colour_at(s, id, 75, 175);
+            let c_br = colour_at(s, id, 125, 175);
+            assert!(tl(c_tl), "{label} TL mismatch: got {:?}", c_tl);
+            assert!(tr(c_tr), "{label} TR mismatch: got {:?}", c_tr);
+            assert!(bl(c_bl), "{label} BL mismatch: got {:?}", c_bl);
+            assert!(br(c_br), "{label} BR mismatch: got {:?}", c_br);
+        };
+
+    // --- CASE 1: 90° clockwise rotation (ImageEdit::Rotate(1), ai.rotation = 3) ---
+    // Unrotated: TL=Red, TR=Green, BL=Blue, BR=Yellow.
+    // After 90° CW: TL=Blue, TR=Red, BL=Yellow, BR=Green.
+    {
+        // 1a: Flip Horizontal after 90° rotation
+        let (mut s, id) = session_with(1);
+        s.apply(id, Edit::AddImage { page: 0, rect: Some([50.0, 100.0, 150.0, 200.0]), name: "img.png".into(), bytes: make_asymmetric_png() })
+            .unwrap();
+        check_quadrants(&s, id, is_red, is_green, is_blue, is_yellow, "initial");
+
+        s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Rotate(1) }).unwrap();
+        check_quadrants(&s, id, is_blue, is_red, is_yellow, is_green, "90° CW");
+
+        s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Flip { horizontal: true } }).unwrap();
+        let cos = pdfcraft_cos::Document::open(s.get(id).unwrap().bytes.clone()).unwrap();
+        let AddedContent::Image(ai) = &pdfcraft_edit::list_added(&cos)[0].content else { panic!() };
+        assert_eq!(ai.rotation, 3);
+        assert!(!ai.flip_h, "at 90° rotation, horizontal flip toggles flip_v, not flip_h");
+        assert!(ai.flip_v, "at 90° rotation, horizontal flip toggles flip_v");
+        // Flipping horizontally on screen swaps left & right columns: TL=Red, TR=Blue, BL=Green, BR=Yellow
+        check_quadrants(&s, id, is_red, is_blue, is_green, is_yellow, "90° CW + flip horizontal");
+    }
+
+    {
+        // 1b: Flip Vertical after 90° rotation
+        let (mut s, id) = session_with(1);
+        s.apply(id, Edit::AddImage { page: 0, rect: Some([50.0, 100.0, 150.0, 200.0]), name: "img.png".into(), bytes: make_asymmetric_png() })
+            .unwrap();
+        s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Rotate(1) }).unwrap();
+
+        s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Flip { horizontal: false } }).unwrap();
+        let cos = pdfcraft_cos::Document::open(s.get(id).unwrap().bytes.clone()).unwrap();
+        let AddedContent::Image(ai) = &pdfcraft_edit::list_added(&cos)[0].content else { panic!() };
+        assert_eq!(ai.rotation, 3);
+        assert!(ai.flip_h, "at 90° rotation, vertical flip toggles flip_h");
+        assert!(!ai.flip_v, "at 90° rotation, vertical flip toggles flip_h, not flip_v");
+        // Flipping vertically on screen swaps top & bottom rows: TL=Yellow, TR=Green, BL=Blue, BR=Red
+        check_quadrants(&s, id, is_yellow, is_green, is_blue, is_red, "90° CW + flip vertical");
+    }
+
+    // --- CASE 2: 270° clockwise rotation (ImageEdit::Rotate(3), ai.rotation = 1) ---
+    // Unrotated: TL=Red, TR=Green, BL=Blue, BR=Yellow.
+    // After 270° CW: TL=Green, TR=Yellow, BL=Red, BR=Blue.
+    {
+        // 2a: Flip Horizontal after 270° rotation
+        let (mut s, id) = session_with(1);
+        s.apply(id, Edit::AddImage { page: 0, rect: Some([50.0, 100.0, 150.0, 200.0]), name: "img.png".into(), bytes: make_asymmetric_png() })
+            .unwrap();
+        s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Rotate(3) }).unwrap();
+        check_quadrants(&s, id, is_green, is_yellow, is_red, is_blue, "270° CW");
+
+        s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Flip { horizontal: true } }).unwrap();
+        let cos = pdfcraft_cos::Document::open(s.get(id).unwrap().bytes.clone()).unwrap();
+        let AddedContent::Image(ai) = &pdfcraft_edit::list_added(&cos)[0].content else { panic!() };
+        assert_eq!(ai.rotation, 1);
+        assert!(!ai.flip_h, "at 270° rotation, horizontal flip toggles flip_v, not flip_h");
+        assert!(ai.flip_v, "at 270° rotation, horizontal flip toggles flip_v");
+        // Flipping horizontally on screen swaps left & right columns: TL=Yellow, TR=Green, BL=Blue, BR=Red
+        check_quadrants(&s, id, is_yellow, is_green, is_blue, is_red, "270° CW + flip horizontal");
+    }
+
+    {
+        // 2b: Flip Vertical after 270° rotation
+        let (mut s, id) = session_with(1);
+        s.apply(id, Edit::AddImage { page: 0, rect: Some([50.0, 100.0, 150.0, 200.0]), name: "img.png".into(), bytes: make_asymmetric_png() })
+            .unwrap();
+        s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Rotate(3) }).unwrap();
+
+        s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Flip { horizontal: false } }).unwrap();
+        let cos = pdfcraft_cos::Document::open(s.get(id).unwrap().bytes.clone()).unwrap();
+        let AddedContent::Image(ai) = &pdfcraft_edit::list_added(&cos)[0].content else { panic!() };
+        assert_eq!(ai.rotation, 1);
+        assert!(ai.flip_h, "at 270° rotation, vertical flip toggles flip_h");
+        assert!(!ai.flip_v, "at 270° rotation, vertical flip toggles flip_h, not flip_v");
+        // Flipping vertically on screen swaps top & bottom rows: TL=Red, TR=Blue, BL=Green, BR=Yellow
+        check_quadrants(&s, id, is_red, is_blue, is_green, is_yellow, "270° CW + flip vertical");
+    }
+}
+
 /// ISO 32000-2 Table 192, 12.7.5.2.3 and Table 228 (Comb): a check box, a push button, a comb
 /// field the file leaves to the viewer. The page as displayed and printed as an image shows the
 /// check box's caption symbol in its text colour, the button's grey face and the comb's cells in
@@ -9409,3 +10160,94 @@ fn repeated_backdrop_artwork_survives_background_undo_redo_and_both_save_modes()
     s.apply(rewritten, Edit::RemoveMarks { kind: MarkKind::Background }).unwrap();
     black(&s, rewritten);
 }
+
+fn contains(haystack: &[u8], needle: &[u8]) -> bool {
+    haystack.windows(needle.len()).any(|w| w == needle)
+}
+
+#[test]
+fn saving_after_deleting_pages_rewrites_the_file_without_them() {
+    let (mut s, id) = session_with(6);
+    let original = s.save_bytes(id).unwrap();
+    s.apply(id, Edit::DeletePages { pages: vec![1, 2, 3, 4] }).unwrap();
+    let saved = s.save_bytes(id).unwrap();
+    assert!(saved.len() < original.len(), "the file shrank: {} -> {}", original.len(), saved.len());
+    assert!(!saved.starts_with(original.as_slice()), "a full rewrite, not an update appended to the old file");
+    assert!(!contains(&saved, b"Page 3"), "a deleted page's text is not left in an earlier revision");
+    let mut again = Session::new();
+    let id2 = again.open("saved.pdf", None, saved, None).unwrap();
+    assert_eq!(page_texts(&again, id2), ["Page 1", "Page 6"]);
+}
+
+#[test]
+fn saving_after_deleting_pages_from_a_signed_file_stays_incremental() {
+    let p12 = std::fs::read(concat!(env!("CARGO_MANIFEST_DIR"), "/../sign/tests/data/ec-p256.p12")).unwrap();
+    let digital_id = sign::pkcs12::open(&p12, "test").unwrap();
+    let mut s = Session::new().with_clock(|| 1_800_000_000);
+    let id = s.open("fixture.pdf", None, Arc::new(fixture(3)), None).unwrap();
+    let opts = SignOptions { page: 0, rect: Some([20.0, 20.0, 160.0, 50.0]), ..SignOptions::default() };
+    let signed = s.sign(id, &digital_id, opts).unwrap();
+    s.mark_signed(id, signed.clone(), None).unwrap();
+    s.apply(id, Edit::DeletePages { pages: vec![2] }).unwrap();
+    let saved = s.save_bytes(id).unwrap();
+    assert!(saved.starts_with(signed.as_ref()), "the signed bytes stay an incremental update");
+    assert!(s.get(id).unwrap().is_signed());
+}
+
+#[test]
+fn saving_after_a_batch_that_deletes_pages_rewrites_the_file() {
+    let (mut s, id) = session_with(6);
+    let original = s.save_bytes(id).unwrap();
+    let batch = Edit::Batch {
+        label: "Delete and rotate".into(),
+        edits: vec![
+            Edit::Batch { label: "Delete pages".into(), edits: vec![Edit::DeletePages { pages: vec![1, 2, 3, 4] }] },
+            Edit::RotatePages { pages: vec![0], degrees: 90 },
+        ],
+    };
+    s.apply(id, batch).unwrap();
+    let saved = s.save_bytes(id).unwrap();
+    assert!(!saved.starts_with(original.as_slice()), "a full rewrite, not an update appended to the old file");
+    assert!(!contains(&saved, b"Page 3"), "a deleted page's text is not left in an earlier revision");
+}
+
+#[test]
+fn saving_without_deleting_pages_stays_incremental() {
+    let (mut s, id) = session_with(3);
+    let original = s.save_bytes(id).unwrap();
+    s.apply(id, Edit::RotatePages { pages: vec![0], degrees: 90 }).unwrap();
+    let saved = s.save_bytes(id).unwrap();
+    assert!(saved.starts_with(original.as_slice()), "an edit that deletes nothing is still appended");
+}
+
+#[test]
+fn original_image_edit_does_not_match_an_added_sibling_of_the_same_xobject() {
+    let mut document = pdfcraft_cos::Document::open(Arc::new(jpeg_cover_pdf(650))).unwrap();
+    let original = pdfcraft_edit::page_images(&document, 0).unwrap()[0].clone();
+    let added = AddedImage::new([20.0, 30.0, 80.0, 90.0], original.object.unwrap());
+    pdfcraft_edit::add_content(&mut document, 0, &AddedContent::Image(added.clone())).unwrap();
+    let bytes = pdfcraft_cos::write_full(&document, &pdfcraft_cos::SaveOptions::default()).unwrap();
+    let mut session = Session::new();
+    let id = session.open("shared-image.pdf", None, Arc::new(bytes), None).unwrap();
+    let before_added = session.get(id).unwrap().added()[0].content.clone();
+    session.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Move([40.0, 50.0, 140.0, 150.0]) }).unwrap();
+    let doc = session.get(id).unwrap();
+    assert_eq!(doc.added()[0].content, before_added, "matching an original Do must not select the added sibling's metadata");
+    assert_eq!(doc.page_images(0)[0].rect, [40.0, 50.0, 140.0, 150.0]);
+}
+
+#[test]
+fn image_transform_engine_refuses_singular_matrices_without_mutation() {
+    let mut png = Vec::new();
+    let mut enc = png::Encoder::new(&mut png, 1, 1);
+    enc.set_color(png::ColorType::Rgb);
+    enc.write_header().unwrap().write_image_data(&[100, 150, 200]).unwrap();
+    let mut s = Session::new();
+    let bytes = s.create_from_images(&[("pixel.png".into(), png)]).unwrap();
+    let id = s.open("image.pdf", None, bytes, None).unwrap();
+    for matrix in [[0.0, 0.0, 0.0, 1.0, 0.0, 0.0], [1.0, 1.0, 1.0, 1.0 + 1e-12, 0.0, 0.0], [1e308, 0.0, 0.0, 1e308, 0.0, 0.0]] {
+        let before = s.get(id).unwrap().bytes.clone();
+        assert!(s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Transform(matrix) }).is_err());
+        assert_eq!(s.get(id).unwrap().bytes, before);
+    }
+}
diff --git a/crates/engine/src/text_fonts.rs b/crates/engine/src/text_fonts.rs
index 859bc1a6f8..e2b413d88d 100644
--- a/crates/engine/src/text_fonts.rs
+++ b/crates/engine/src/text_fonts.rs
@@ -32,17 +32,29 @@ pub fn installed_directories() -> Vec<PathBuf> {
     }
 }
 
-/// Bounded, symlink-free scan. Only standalone, openly licensed, embeddable faces are listed.
+/// Bounded scan with resolved roots and no descendant symlinks.
+/// Only standalone, openly licensed, embeddable faces are listed.
 /// The caller controls roots (automation resolves confinement before calling this).
 pub fn discover(roots: &[PathBuf]) -> Vec<FontFile> {
+    discover_budgeted(roots, 64u64 << 20)
+}
+
+/// Bounded scan with resolved roots and no descendant symlinks. `budget` caps the total
+/// size of the fonts listed: a rejected file (unreadable, not openly licensed, a duplicate)
+/// does not spend it. Every file read
+/// counts against four times the budget, so a folder of unusable fonts cannot stall the scan.
+pub fn discover_budgeted(roots: &[PathBuf], mut budget: u64) -> Vec<FontFile> {
     use std::io::Read;
-    let mut pending: Vec<_> = roots.iter().take(16).map(|r| (r.clone(), 0usize)).collect();
+    // User font directories themselves are often links. Resolve only the explicitly
+    // supplied roots; links found below them must not escape an automation read root.
+    let mut pending: Vec<_> = roots.iter().take(16).filter_map(|r| r.canonicalize().ok()).map(|r| (r, 0usize)).collect();
     let mut files = Vec::new();
     let mut entries = 0usize;
-    let mut budget = 64u64 << 20;
+    let mut read_allowance = budget.saturating_mul(4);
     let mut seen = std::collections::HashSet::new();
+    let mut seen_face_content = std::collections::HashSet::new();
     while let Some((path, depth)) = pending.pop() {
-        if entries >= 4096 || budget == 0 {
+        if entries >= 4096 || budget == 0 || read_allowance == 0 {
             break;
         }
         entries += 1;
@@ -53,26 +65,194 @@ pub fn discover(roots: &[PathBuf]) -> Vec<FontFile> {
         if meta.is_dir() && depth < 4 {
             if let Ok(children) = std::fs::read_dir(&path) {
                 let remaining = 4096usize.saturating_sub(entries.saturating_add(pending.len()));
-                pending.extend(children.take(remaining).filter_map(Result::ok).map(|p| (p.path(), depth + 1)));
+                // Best effort: unreadable entries are skipped and do not count against the entry allowance.
+                let mut sorted_children: Vec<_> = children.filter_map(Result::ok).take(remaining).map(|p| p.path()).collect();
+                sorted_children.sort();
+                pending.extend(sorted_children.into_iter().rev().map(|p| (p, depth + 1)));
             }
         } else if meta.is_file() && meta.len() <= (16 << 20) && font_extension(&path) {
-            if meta.len() > budget {
+            if meta.len() > budget || meta.len() > read_allowance {
                 continue;
             }
-            budget = budget.saturating_sub(meta.len());
+            read_allowance = read_allowance.saturating_sub(meta.len());
             let mut bytes = Vec::new();
-            let read = std::fs::File::open(&path).and_then(|f| f.take((16 << 20) + 1).read_to_end(&mut bytes));
-            if read.is_err() || pdfcraft_fonts::embedding::validate_document_input(&bytes).is_err() {
+            let read = std::fs::File::open(&path).and_then(|f| f.take(meta.len().saturating_add(1)).read_to_end(&mut bytes));
+            if read.is_err() || bytes.len() != meta.len() as usize {
+                continue;
+            }
+            if pdfcraft_fonts::embedding::validate_document_input(&bytes).is_err() {
                 continue;
             }
             if let Ok((family, face)) = pdfcraft_fonts::embedding::names(&bytes) {
-                files.push(FontFile { path, family, face });
+                let key = font_content_key(&bytes);
+                if seen_face_content.insert((face.clone(), key)) {
+                    budget = budget.saturating_sub(meta.len());
+                    files.push(FontFile { path, family, face });
+                }
             }
         }
     }
     files.sort_by(|a, b| a.face.cmp(&b.face).then(a.path.cmp(&b.path)));
     files
 }
+
+fn font_content_key(bytes: &[u8]) -> (usize, u64) {
+    use std::hash::{DefaultHasher, Hasher};
+    let mut h = DefaultHasher::new();
+    h.write(bytes);
+    (bytes.len(), h.finish())
+}
 fn font_extension(path: &Path) -> bool {
     path.extension().and_then(std::ffi::OsStr::to_str).is_some_and(|e| e.eq_ignore_ascii_case("ttf") || e.eq_ignore_ascii_case("otf"))
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[cfg(unix)]
+    #[test]
+    fn a_linked_font_root_is_scanned_but_descendant_links_are_not() {
+        let root = std::env::temp_dir().join(format!("pdfcraft-font-links-{}", std::process::id()));
+        let real = root.join("real");
+        std::fs::create_dir_all(&real).unwrap();
+        let source = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../assets/fonts/Inter-Regular.ttf");
+        std::fs::copy(&source, real.join("regular.ttf")).unwrap();
+        let link = root.join("linked");
+        std::os::unix::fs::symlink(&real, &link).unwrap();
+        std::os::unix::fs::symlink(&real, real.join("cycle")).unwrap();
+        std::os::unix::fs::symlink(source.with_file_name("Inter-Medium.ttf"), real.join("escape.ttf")).unwrap();
+        let found = discover(&[link]);
+        let expected = real.canonicalize().unwrap().join("regular.ttf");
+        std::fs::remove_dir_all(&root).unwrap();
+        assert_eq!(found.len(), 1);
+        assert_eq!(found.first().unwrap().face, "Inter-Regular");
+        assert_eq!(found.first().unwrap().path, expected);
+    }
+
+    #[test]
+    fn discovery_keeps_all_valid_faces_within_its_scan_budget() {
+        let root = std::env::temp_dir().join(format!("pdfcraft-font-count-{}", std::process::id()));
+        std::fs::create_dir_all(&root).unwrap();
+        let source = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../assets/fonts/Inter-Regular.ttf");
+        let bytes = std::fs::read(source).unwrap();
+        for id in 0..501u32 {
+            let mut font = bytes.clone();
+            // Valid standalone fonts with distinct bytes: an unreferenced trailer
+            // does not change their tables or embedding licence.
+            font.extend_from_slice(&id.to_le_bytes());
+            std::fs::write(root.join(format!("font-{id:03}.ttf")), font).unwrap();
+        }
+        let found = discover_budgeted(std::slice::from_ref(&root), (bytes.len() as u64 + 4) * 501);
+        std::fs::remove_dir_all(&root).unwrap();
+        assert_eq!(found.len(), 501, "do not silently discard accepted fonts after sorting");
+    }
+
+    #[test]
+    fn test_installed_directories() {
+        let dirs = installed_directories();
+        assert!(!dirs.is_empty());
+    }
+
+    #[test]
+    fn test_font_extension() {
+        assert!(font_extension(Path::new("Arial.ttf")));
+        assert!(font_extension(Path::new("Noto.otf")));
+        assert!(font_extension(Path::new("CUSTOM.TTF")));
+        assert!(font_extension(Path::new("ROBOTO.OTF")));
+        assert!(!font_extension(Path::new("document.pdf")));
+        assert!(!font_extension(Path::new("font.woff")));
+        assert!(!font_extension(Path::new("font.woff2")));
+        assert!(!font_extension(Path::new("no_extension")));
+    }
+
+    #[test]
+    fn test_font_content_key() {
+        let empty = font_content_key(&[]);
+        assert_eq!(empty.0, 0);
+
+        let a = font_content_key(b"TrueType font sample data bytes");
+        let b = font_content_key(b"TrueType font sample data bytes");
+        let c = font_content_key(b"Different font sample data bytes");
+
+        assert_eq!(a, b, "identical bytes must produce identical keys");
+        assert_ne!(a, c, "differing bytes must produce distinct keys");
+        assert_eq!(a.0, b"TrueType font sample data bytes".len());
+    }
+
+    #[test]
+    fn test_discover_empty_and_nonexistent_roots() {
+        let empty = discover(&[]);
+        assert!(empty.is_empty());
+
+        let nonexistent = discover(&[PathBuf::from("Z:\\nonexistent_font_path_xyz_12345")]);
+        assert!(nonexistent.is_empty());
+    }
+
+    #[test]
+    fn test_discover_deduplicates_non_adjacent_same_content() {
+        let root = std::env::temp_dir().join(format!("pdfcraft-font-dedup-test-{}", std::process::id()));
+        let dir_a = root.join("a");
+        let dir_b = root.join("b");
+        let dir_c = root.join("c");
+        let _ = std::fs::create_dir_all(&dir_a);
+        let _ = std::fs::create_dir_all(&dir_b);
+        let _ = std::fs::create_dir_all(&dir_c);
+
+        let inter_reg = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../assets/fonts/Inter-Regular.ttf");
+        let inter_med = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../assets/fonts/Inter-Medium.ttf");
+
+        if inter_reg.exists() && inter_med.exists() {
+            let _ = std::fs::copy(&inter_reg, dir_a.join("FontA.ttf"));
+            let _ = std::fs::copy(&inter_med, dir_b.join("FontB.ttf"));
+            let _ = std::fs::copy(&inter_reg, dir_c.join("FontC.ttf"));
+
+            let discovered = discover(std::slice::from_ref(&root));
+            let _ = std::fs::remove_dir_all(&root);
+
+            assert_eq!(discovered.len(), 2, "identical content in non-adjacent paths is deduplicated");
+            let faces: Vec<&str> = discovered.iter().map(|f| f.face.as_str()).collect();
+            assert!(faces.contains(&"Inter-Regular"));
+            assert!(faces.contains(&"Inter-Medium"));
+        } else {
+            let _ = std::fs::remove_dir_all(&root);
+        }
+    }
+
+    #[test]
+    fn rejected_fonts_do_not_spend_the_budget_and_the_order_is_deterministic() {
+        let root = std::env::temp_dir().join(format!("pdfcraft-font-budget-test-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&root);
+        std::fs::create_dir_all(&root).unwrap();
+
+        let fonts = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../assets/fonts");
+        let reg_len = std::fs::metadata(fonts.join("Inter-Regular.ttf")).unwrap().len();
+        let med_len = std::fs::metadata(fonts.join("Inter-Medium.ttf")).unwrap().len();
+
+        // An unusable candidate, scanned first (sorted before the real fonts).
+        std::fs::write(root.join("00_candidate_invalid.ttf"), vec![0u8; 400_000]).unwrap();
+        std::fs::copy(fonts.join("Inter-Regular.ttf"), root.join("01_Inter-Regular.ttf")).unwrap();
+
+        // The budget fits Inter-Regular alone; the rejected file must not use it up first.
+        let run1 = discover_budgeted(std::slice::from_ref(&root), reg_len + 10);
+        let run2 = discover_budgeted(std::slice::from_ref(&root), reg_len + 10);
+        let faces = |run: &[FontFile]| run.iter().map(|f| (f.face.clone(), f.path.clone())).collect::<Vec<_>>();
+        assert_eq!(run1.iter().map(|f| f.face.as_str()).collect::<Vec<_>>(), ["Inter-Regular"], "a rejected file spends no budget");
+        assert_eq!(faces(&run1), faces(&run2));
+
+        // Accepted fonts do spend it: Inter-Medium no longer fits after Inter-Regular.
+        std::fs::copy(fonts.join("Inter-Medium.ttf"), root.join("02_Inter-Medium.ttf")).unwrap();
+        let one = discover_budgeted(std::slice::from_ref(&root), reg_len + 10);
+        assert_eq!(one.iter().map(|f| f.face.as_str()).collect::<Vec<_>>(), ["Inter-Regular"]);
+        let both = discover_budgeted(std::slice::from_ref(&root), reg_len + med_len);
+        assert_eq!(both.len(), 2);
+
+        // Reading stops at four times the budget, whatever was rejected.
+        for i in 0..4 {
+            std::fs::write(root.join(format!("00_unusable_{i}.ttf")), vec![0u8; reg_len as usize]).unwrap();
+        }
+        let capped = discover_budgeted(std::slice::from_ref(&root), reg_len + 10);
+        let _ = std::fs::remove_dir_all(&root);
+        assert!(capped.is_empty(), "the read allowance ends the scan before the real fonts");
+    }
+}
diff --git a/crates/engine/src/text_script.rs b/crates/engine/src/text_script.rs
new file mode 100644
index 0000000000..04866eda60
--- /dev/null
+++ b/crates/engine/src/text_script.rs
@@ -0,0 +1,272 @@
+//! Superscript and subscript as Unicode characters (Edit a PDF ▸ Format text): `2` ↔ `²` and
+//! `2` ↔ `₂`.
+//!
+//! The text keeps its font, size and baseline; its characters change to the forms Unicode encodes
+//! for raised and lowered text, so the font must have those glyphs, and extracted text contains
+//! them. Characters Unicode has no such form for are left as they are.
+//!
+//! A selection mixing plain and target-script characters is normalized: `H₂2` becomes `H₂₂`,
+//! then `H22` on the next subscript toggle; superscript follows the same policy. Two toggles
+//! restore uniformly plain or uniformly scripted input, but do not reconstruct an original
+//! mixture. Restoring that exact prior text requires the caller's edit history (Undo).
+
+use std::ops::Range;
+
+/// Raised or lowered text.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Script {
+    Super,
+    Sub,
+}
+
+/// Each character Unicode raises, and its superscript form.
+const SUPERSCRIPT: &[(char, char)] = &[
+    ('0', '⁰'),
+    ('1', '¹'),
+    ('2', '²'),
+    ('3', '³'),
+    ('4', '⁴'),
+    ('5', '⁵'),
+    ('6', '⁶'),
+    ('7', '⁷'),
+    ('8', '⁸'),
+    ('9', '⁹'),
+    ('+', '⁺'),
+    ('−', '⁻'),
+    ('=', '⁼'),
+    ('(', '⁽'),
+    (')', '⁾'),
+    ('a', 'ᵃ'),
+    ('b', 'ᵇ'),
+    ('c', 'ᶜ'),
+    ('d', 'ᵈ'),
+    ('e', 'ᵉ'),
+    ('f', 'ᶠ'),
+    ('g', 'ᵍ'),
+    ('h', 'ʰ'),
+    ('i', 'ⁱ'),
+    ('j', 'ʲ'),
+    ('k', 'ᵏ'),
+    ('l', 'ˡ'),
+    ('m', 'ᵐ'),
+    ('n', 'ⁿ'),
+    ('o', 'ᵒ'),
+    ('p', 'ᵖ'),
+    ('r', 'ʳ'),
+    ('s', 'ˢ'),
+    ('t', 'ᵗ'),
+    ('u', 'ᵘ'),
+    ('v', 'ᵛ'),
+    ('w', 'ʷ'),
+    ('x', 'ˣ'),
+    ('y', 'ʸ'),
+    ('z', 'ᶻ'),
+    ('A', 'ᴬ'),
+    ('B', 'ᴮ'),
+    ('D', 'ᴰ'),
+    ('E', 'ᴱ'),
+    ('G', 'ᴳ'),
+    ('H', 'ᴴ'),
+    ('I', 'ᴵ'),
+    ('J', 'ᴶ'),
+    ('K', 'ᴷ'),
+    ('L', 'ᴸ'),
+    ('M', 'ᴹ'),
+    ('N', 'ᴺ'),
+    ('O', 'ᴼ'),
+    ('P', 'ᴾ'),
+    ('R', 'ᴿ'),
+    ('T', 'ᵀ'),
+    ('U', 'ᵁ'),
+    ('V', 'ⱽ'),
+    ('W', 'ᵂ'),
+];
+
+/// Each character Unicode lowers, and its subscript form.
+const SUBSCRIPT: &[(char, char)] = &[
+    ('0', '₀'),
+    ('1', '₁'),
+    ('2', '₂'),
+    ('3', '₃'),
+    ('4', '₄'),
+    ('5', '₅'),
+    ('6', '₆'),
+    ('7', '₇'),
+    ('8', '₈'),
+    ('9', '₉'),
+    ('+', '₊'),
+    ('−', '₋'),
+    ('=', '₌'),
+    ('(', '₍'),
+    (')', '₎'),
+    ('a', 'ₐ'),
+    ('e', 'ₑ'),
+    ('h', 'ₕ'),
+    ('i', 'ᵢ'),
+    ('j', 'ⱼ'),
+    ('k', 'ₖ'),
+    ('l', 'ₗ'),
+    ('m', 'ₘ'),
+    ('n', 'ₙ'),
+    ('o', 'ₒ'),
+    ('p', 'ₚ'),
+    ('r', 'ᵣ'),
+    ('s', 'ₛ'),
+    ('t', 'ₜ'),
+    ('u', 'ᵤ'),
+    ('v', 'ᵥ'),
+    ('x', 'ₓ'),
+];
+
+impl Script {
+    fn pairs(self) -> &'static [(char, char)] {
+        match self {
+            Script::Super => SUPERSCRIPT,
+            Script::Sub => SUBSCRIPT,
+        }
+    }
+
+    /// `c` raised or lowered, or `None` when Unicode has no distinct reversible form for it.
+    /// Mathematical minus U+2212 has a form; ASCII hyphen-minus stays unchanged to avoid a lossy collision.
+    pub fn form(self, c: char) -> Option<char> {
+        self.pairs().iter().find(|(plain, _)| *plain == c).map(|&(_, form)| form)
+    }
+
+    /// The character `c` is the raised or lowered form of, or `None` when it is no such form.
+    pub fn plain(self, c: char) -> Option<char> {
+        self.pairs().iter().find(|(_, form)| *form == c).map(|&(plain, _)| plain)
+    }
+}
+
+/// `range` (UTF-8 bytes of `text`) clamped to it and widened to whole characters, or all of `text`
+/// when there is none.
+fn span(text: &str, range: Option<&Range<usize>>) -> Range<usize> {
+    let Some(range) = range else { return 0..text.len() };
+    let mut start = range.start.min(text.len());
+    while !text.is_char_boundary(start) {
+        start = start.saturating_sub(1);
+    }
+    let mut end = range.end.min(text.len());
+    while !text.is_char_boundary(end) {
+        end = end.saturating_add(1);
+    }
+    start..end
+}
+
+/// Whether the characters of `text` in `range` (UTF-8 bytes; all of it when `None`) are already in
+/// `script`: at least one of them is, and none of the others could be. Characters Unicode has no
+/// form for (a space, a `q`) don't count toward that state.
+pub fn is_in(text: &str, range: Option<&Range<usize>>, script: Script) -> bool {
+    let target = text.get(span(text, range)).unwrap_or_default();
+    target.chars().any(|c| script.plain(c).is_some()) && target.chars().all(|c| script.plain(c).is_some() || script.form(c).is_none())
+}
+
+/// Superscript or Subscript on the characters of `text` in `range` (UTF-8 bytes; all of it when
+/// `None`): back to plain characters when they are already in `script` ([`is_in`]), and otherwise
+/// each character that has a form takes it. Returns the new text and the range the converted
+/// characters now take, or `None` when nothing changes.
+///
+/// Mixed plain/scripted input normalizes to the target script and then to plain text; for
+/// example, `H₂2` → `H₂₂` → `H22`. This stateless conversion does not remember the original
+/// mixture. Use edit history to restore it, rather than treating a second toggle as Undo.
+pub fn toggle(text: &str, range: Option<&Range<usize>>, script: Script) -> Option<(String, Range<usize>)> {
+    let span = span(text, range);
+    let target = text.get(span.clone()).filter(|t| !t.is_empty())?;
+    let converted: String = if is_in(text, Some(&span), script) {
+        target.chars().map(|c| script.plain(c).unwrap_or(c)).collect()
+    } else {
+        target.chars().map(|c| script.form(c).unwrap_or(c)).collect()
+    };
+    if converted == target {
+        return None;
+    }
+    let mut out = String::with_capacity(text.len().saturating_add(converted.len()));
+    out.push_str(text.get(..span.start).unwrap_or_default());
+    out.push_str(&converted);
+    out.push_str(text.get(span.end..).unwrap_or_default());
+    let end = span.start.saturating_add(converted.len());
+    Some((out, span.start..end))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn every_form_toggles_back_to_its_character() {
+        for script in [Script::Super, Script::Sub] {
+            for &(plain, form) in script.pairs() {
+                let s = plain.to_string();
+                let (raised, range) = toggle(&s, None, script).unwrap();
+                assert_eq!(raised, form.to_string());
+                assert_eq!(range, 0..raised.len());
+                assert_eq!(toggle(&raised, None, script).unwrap().0, s, "{script:?} {plain}");
+            }
+        }
+        assert_eq!(toggle("-", None, Script::Super), None);
+        assert_eq!(toggle("-", None, Script::Sub), None);
+    }
+
+    #[test]
+    fn review_script_round_trips_preserve_both_minus_characters() {
+        for script in [Script::Super, Script::Sub] {
+            let text = "−2 -3";
+            let once = toggle(text, None, script).unwrap().0;
+            assert_eq!(toggle(&once, None, script).unwrap().0, text);
+        }
+    }
+
+    #[test]
+    fn text_with_characters_unicode_cannot_raise_toggles_back() {
+        // q has no superscript form and Q no subscript one; the space neither.
+        for (script, text, toggled) in [(Script::Super, "x2 q", "ˣ² q"), (Script::Sub, "CO2 Q", "CO₂ Q")] {
+            let (once, _) = toggle(text, None, script).unwrap();
+            assert_eq!(once, toggled);
+            assert!(is_in(&once, None, script));
+            assert_eq!(toggle(&once, None, script).unwrap().0, text, "{script:?}");
+        }
+        // Nothing to raise: nothing changes.
+        assert_eq!(toggle("q Q", None, Script::Super), None);
+        assert!(!is_in("q Q", None, Script::Super));
+    }
+
+    #[test]
+    fn a_range_converts_only_its_characters_and_follows_them() {
+        let (text, range) = toggle("E = mc2", Some(&(6..7)), Script::Super).unwrap();
+        assert_eq!((text.as_str(), range.clone()), ("E = mc²", 6..8));
+        assert_eq!(toggle(&text, Some(&range), Script::Super).unwrap(), ("E = mc2".to_string(), 6..7));
+        // A mixed range takes the form throughout.
+        assert_eq!(toggle("H₂2", None, Script::Sub).unwrap().0, "H₂₂");
+        assert!(!is_in("H₂2", None, Script::Sub));
+    }
+
+    #[test]
+    fn mixed_plain_and_scripted_text_normalizes_instead_of_round_tripping() {
+        for (script, mixed, uniform, plain) in [(Script::Super, "Q²2", "Q²²", "Q22"), (Script::Sub, "H₂2", "H₂₂", "H22")] {
+            assert!(!is_in(mixed, None, script));
+            let (once, range) = toggle(mixed, None, script).unwrap();
+            assert_eq!(once, uniform);
+            assert_eq!(range, 0..uniform.len());
+            assert!(is_in(&once, None, script));
+            let (twice, range) = toggle(&once, None, script).unwrap();
+            assert_eq!(twice, plain);
+            assert_eq!(range, 0..plain.len());
+            assert_ne!(twice, mixed, "a second toggle normalizes the original mixture");
+            assert_eq!(toggle(&twice, None, script).unwrap().0, uniform);
+        }
+    }
+
+    #[test]
+    fn hostile_ranges_are_clamped_to_whole_characters() {
+        // Byte 1 is inside ²: widened to the whole character on each side.
+        assert_eq!(toggle("²x", Some(&(1..1)), Script::Super).unwrap(), ("2x".to_string(), 0..1));
+        assert_eq!(toggle("²x", Some(&(2..2)), Script::Super), None);
+        assert_eq!(toggle("x2", Some(&(1..usize::MAX)), Script::Super).unwrap(), ("x²".to_string(), 1..3));
+        assert_eq!(toggle("x2", Some(&(5..9)), Script::Super), None);
+        #[allow(clippy::reversed_empty_ranges)]
+        let backwards = 2..1;
+        assert_eq!(toggle("x2", Some(&backwards), Script::Super), None);
+        assert_eq!(toggle("", None, Script::Sub), None);
+        assert!(!is_in("", None, Script::Sub));
+    }
+}
diff --git a/crates/filters/Cargo.toml b/crates/filters/Cargo.toml
index aa8aaa0c4d..bfb930fe5f 100644
--- a/crates/filters/Cargo.toml
+++ b/crates/filters/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "pdfcraft-filters"
-description = "PDF stream filters (ISO 32000-2 §7.4): Flate, LZW, predictors, ASCII85, ASCIIHex, RunLength, CCITT Group 4 encoding and Group 3 and 4 decoding"
+description = "PDF stream filters (ISO 32000-2 §7.4): Flate, LZW, predictors, ASCII85, ASCIIHex, RunLength, CCITT Group 4 encoding and Group 3 and 4 decoding, JBIG2 encoding and decoding"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
@@ -12,13 +12,12 @@ workspace = true
 
 [dependencies]
 fax.workspace = true
-# CCITT fax decoding (`decode_ccitt`); already in the tree through hayro.
+# CCITT fax and JBIG2 decoding (`decode_ccitt`, `decode_jbig2`); already in the tree through hayro.
 hayro-ccitt.workspace = true
+hayro-jbig2.workspace = true
 flate2.workspace = true
 thiserror.workspace = true
 
 [dev-dependencies]
-hayro-ccitt.workspace = true
-hayro-jbig2.workspace = true
 proptest.workspace = true
 weezl.workspace = true
diff --git a/crates/filters/README.md b/crates/filters/README.md
index 0c34857c43..90e1485177 100644
--- a/crates/filters/README.md
+++ b/crates/filters/README.md
@@ -3,7 +3,7 @@
 PDF stream filters: the decoders and encoders behind `/Filter` and `/DecodeParms`.
 
 - **Layer:** L0, standalone. No dependency on any other PdfCraft crate. `cos` depends on it (architecture §3 rule 3).
-- **Licence:** MIT OR Apache-2.0. Clean-room: written from ISO 32000-2 §7.4, RFC 1950/1951 (through `flate2` with the pure-Rust `miniz_oxide` backend), TIFF 6.0 §14 (predictor 2) and RFC 2083 §6 (PNG filters). CCITT Group 4 encoding (ITU-T T.6) is the `fax` crate's (MIT, already in the tree through `tiff`), checked here by round trips through an independent decoder; CCITT decoding (T.4 and T.6) is the `hayro-ccitt` crate's (MIT OR Apache-2.0, already in the tree through hayro), bounded here. JBIG2 generic region encoding is written from the public ISO/IEC 14492 Final Committee Draft (WG1 N1359, 1999); Annex H.2 checks the arithmetic coder byte for byte.
+- **Licence:** MIT OR Apache-2.0. Clean-room: written from ISO 32000-2 §7.4, RFC 1950/1951 (through `flate2` with the pure-Rust `miniz_oxide` backend), TIFF 6.0 §14 (predictor 2) and RFC 2083 §6 (PNG filters). CCITT Group 4 encoding (ITU-T T.6) is the `fax` crate's (MIT, already in the tree through `tiff`), checked here by round trips through an independent decoder; CCITT decoding (T.4 and T.6) is the `hayro-ccitt` crate's, and JBIG2 decoding the `hayro-jbig2` crate's (both MIT OR Apache-2.0, already in the tree through hayro), bounded here. JBIG2 generic region encoding is written from the public ISO/IEC 14492 Final Committee Draft (WG1 N1359, 1999); Annex H.2 checks the arithmetic coder byte for byte.
 
 - `#![forbid(unsafe_code)]`. Builds for `wasm32-unknown-unknown`.
 
@@ -15,17 +15,20 @@ Filter::from_name(b"FlateDecode" | b"Fl" | ...) -> Filter   // full names and in
 Filter::name(&self) -> &str; Filter::is_image_codec(&self) -> bool
 
 pub struct Params { predictor, colors, bits_per_component, columns, early_change }  // i64s; Default = 1, 1, 8, 1, 1
-pub enum FilterError { Corrupt { filter, detail }, LimitExceeded(usize), Unsupported(String) }
+pub enum FilterError { Corrupt { filter, detail }, LimitExceeded(usize), Unsupported(String), Spent }
 
 decode(chain, data, max_output) -> Result<Vec<u8>, FilterError>
 decode_counted(chain, data, max_output) -> Result<(Vec<u8>, usize /*decoded*/), (FilterError, usize /*decoded*/)>
 decode_tolerant(chain, data, max_output) -> Result<(Vec<u8>, bool /*partial*/), FilterError>
 decode_tolerant_counted(chain, data, max_output) -> Result<(Vec<u8>, bool /*partial*/, usize /*decoded*/), (FilterError, usize /*decoded*/)>
+decode_tolerant_within(chain, data, max_output, work: &mut u64) -> Result<Vec<u8>, FilterError>
+decode_within(chain, data, max_output, work: &mut u64) -> Result<Vec<u8>, FilterError>
 encode(filter, params, data) -> Result<Vec<u8>, FilterError>
 encode_flate(data) -> Vec<u8>   // zlib, level 6
 encode_g4(data, columns, rows) -> Result<Vec<u8>, FilterError>   // 1-bit rows as CCITT Group 4; columns <= MAX_G4_COLUMNS
 pub struct CcittParams { k, columns, rows, end_of_line, encoded_byte_align, end_of_block, black_is_1 }  // Table 11; Default = its defaults
 decode_ccitt(data, &params, max_rows) -> Result<Vec<u8>, FilterError>   // CCITT fax as CCITTFaxDecode gives it; columns <= MAX_CCITT_COLUMNS
+decode_jbig2(data, globals, columns, rows, max) -> Result<Vec<u8>, FilterError>   // JBIG2 as JBIG2Decode gives it; a page of columns × rows, within max and MAX_JBIG2_PIXELS
 encode_jbig2_generic(data, columns, rows) -> Result<Vec<u8>, FilterError>   // 1-bit rows as lossless JBIG2 for JBIG2Decode; columns <= MAX_JBIG2_COLUMNS
 encode_jbig2(data, columns, rows) -> Result<Vec<u8>, FilterError>   // 1-bit rows as lossless JBIG2 for JBIG2Decode, symbol coded when that is smaller; columns <= MAX_JBIG2_COLUMNS
 ```
@@ -34,6 +37,7 @@ encode_jbig2(data, columns, rows) -> Result<Vec<u8>, FilterError>   // 1-bit row
 - Image codecs (DCT, JPX, JBIG2, CCITT), `Crypt` and unknown filters anywhere in a chain give `Unsupported`: callers keep such data encoded. So does a chain longer than `MAX_CHAIN` (8) filters, before any stage runs. Decryption belongs to `crypt`.
 - `max_output` bounds every intermediate buffer (including the pre-predictor buffer) and gives `LimitExceeded(max_output)`. This also holds when Flate retries raw deflate after a misleading zlib header, in both strict and tolerant decoding.
 - `decode_counted` and `decode_tolerant_counted` are for a caller charging a budget (`pdfcraft_cos::DecodeBudget`). `max_output` bounds all stages together (each stage gets what the earlier ones left), and they give the bytes every stage that ran decoded, on success and on failure. A stage's output counts as its decoder produced it, before a predictor or a later stage shrinks it, and a failed decode pays for what it decoded first.
+- `decode_tolerant_within` is for a run of images (`pdfcraft_cos::ImageBudget`), as `decode_within` (its strict form), `decode_jbig2_within` and `decode_ccitt_within` are, all spending from one `work`, in the JBIG2 decoder's steps. `max_output` bounds each stage, as in `decode_tolerant`, and no stage decodes past what `work` has left. It pays a step a byte of `data` first and a step a byte each stage decodes, so a chain that fails has paid for what it did: 0.2 to 3 ns a byte in or out, up to 19 ns through a predictor on samples of a bit, against the 6 to 16 ns of a JBIG2 step. What `work` can't pay for spends all of it, and gives `Spent`; with nothing left nothing is read. A chain that can't be decoded at all costs nothing and gives its usual error.
 - `decode_tolerant` turns `Corrupt` into "what was decoded so far" plus `partial = true`, then runs the rest of the chain on it (predictors are applied to partial output too). `LimitExceeded` and `Unsupported` are still errors.
 
 ## Behaviour
@@ -47,7 +51,7 @@ encode_jbig2(data, columns, rows) -> Result<Vec<u8>, FilterError>   // 1-bit row
 | ASCII85Decode | `<~` prefix, `z`, white space, `~>` (or bare `~`, or none) EOD, final partial group; `z` inside a group, a 1-char final group, overflow or bad characters → Corrupt | `z` for zero groups, newline every 75 characters, `~>` |
 | RunLengthDecode | 0–127 literal, 129–255 repeat, 128 EOD (optional); truncated run → Corrupt | runs of ≥2 repeat, literals up to 128, 128 |
 | CCITTFaxDecode | not in a chain (`Unsupported`); `decode_ccitt` decodes Group 3 and Group 4 on its own, as rows of 1-bit samples each on a new byte, black 0 unless `black_is_1`, at most `max_rows` rows (fewer with `/Rows`), the rows before any damage, up to 1,048,576 samples a row; Group 3 rows on bytes are read by their end-of-line codes when the data starts with one and on bytes otherwise, whatever `end_of_line` says, so data with codes but none before the first row (not as T.4 sends them) is read on bytes, as the renderer draws it, and at `k` 0 may come out as other rows (`pdfcraft_cos::Document::decoded_image` calls it for a fax image, after the filters before it) | `encode_g4`: Group 4 (`/K -1`) with an end-of-block mark, 0 bits coded black so `/BlackIs1 false` decodes the same bits; rows packed MSB first, each on a new byte, padding bits and trailing bytes ignored; up to 32,767 samples a row (the encoder counts positions in 16 bits); no rows or columns, or too wide → Unsupported, too few bytes → Corrupt |
-| JBIG2Decode | not here (`Unsupported`; the renderer and image export decode it with `hayro-jbig2`) | `encode_jbig2_generic`: the embedded organisation (D.3) with a page information segment and an immediate lossless generic region (7.4.6), no `/JBIG2Globals`; template 0 with its nominal AT pixels and typical prediction (6.2.5), coded with the MQ arithmetic coder (Annex E, Table E.1) and ended by its 0xFF 0xAC marker. A 0 sample is coded as a JBIG2 1 (black), since `JBIG2Decode` gives black as 0, so the stream decodes to the same bits; rows packed MSB first, each on a new byte, padding bits and trailing bytes ignored; up to 1,048,576 samples a row; no rows or columns, or too wide → Unsupported, too few bytes → Corrupt. `encode_jbig2`: the smaller of that and symbol coding (`jbig2/symbols.rs`): each distinct mark (8-connected black pixels, at most 256 a side) stored once in a symbol dictionary (7.4.2; arithmetic coded, each bitmap a template 0 generic region without typical prediction, the bitmaps sharing their contexts) and placed by immediate lossless text regions referring to it (7.4.3; bottom-left reference corner, strips of 1, 2, 4 or 8 rows, whichever is smallest), each of at most 10,000 instances over a band of rows, as the decoder PdfCraft renders with (`hayro-jbig2`) takes no more in one region, with larger marks, and in a second plan marks that occur once, in a generic region over their box. Only exact copies share a symbol (no refinement), so the stream decodes to the same bits; fewer than two symbols, more than 2^20 black runs, 65,536 distinct marks or 16 MiB of their pixels, or more than 2^24 rows, and the generic coding is used; a plan of more than 32,767 symbols (that decoder refuses more) isn't made |
+| JBIG2Decode | not in a chain (`Unsupported`); `decode_jbig2` decodes it on its own with `hayro-jbig2`, given what its `/JBIG2Globals` decode to, as rows of 1-bit samples each on a new byte, black 0; the page has to be `columns` × `rows` (PdfCraft's renderer draws the whole page into the image), within `max` bytes as such rows and 2^28 pixels (`MAX_JBIG2_PIXELS`, about the most the decoder takes), checked before it is decoded; regions inside it are bounded by the decoder alone (a region may claim more pixels than its page); damaged data, or globals that don't decode, are `Corrupt` (`pdfcraft_cos::Document::decoded_image` calls it for a JBIG2 image, after the filters before it) | `encode_jbig2_generic`: the embedded organisation (D.3) with a page information segment and an immediate lossless generic region (7.4.6), no `/JBIG2Globals`; template 0 with its nominal AT pixels and typical prediction (6.2.5), coded with the MQ arithmetic coder (Annex E, Table E.1) and ended by its 0xFF 0xAC marker. A 0 sample is coded as a JBIG2 1 (black), since `JBIG2Decode` gives black as 0, so the stream decodes to the same bits; rows packed MSB first, each on a new byte, padding bits and trailing bytes ignored; up to 1,048,576 samples a row; no rows or columns, or too wide → Unsupported, too few bytes → Corrupt. `encode_jbig2`: the smaller of that and symbol coding (`jbig2/symbols.rs`): each distinct mark (8-connected black pixels, at most 256 a side) stored once in a symbol dictionary (7.4.2; arithmetic coded, each bitmap a template 0 generic region without typical prediction, the bitmaps sharing their contexts) and placed by immediate lossless text regions referring to it (7.4.3; bottom-left reference corner, strips of 1, 2, 4 or 8 rows, whichever is smallest), each of at most 10,000 instances over a band of rows, as the decoder PdfCraft renders with (`hayro-jbig2`) takes no more in one region, with larger marks, and in a second plan marks that occur once, in a generic region over their box. Only exact copies share a symbol (no refinement), so the stream decodes to the same bits; fewer than two symbols, more than 2^20 black runs, 65,536 distinct marks or 16 MiB of their pixels, or more than 2^24 rows, and the generic coding is used; a plan of more than 32,767 symbols (that decoder refuses more) isn't made |
 
 ## Tests
 
@@ -57,12 +61,13 @@ encode_jbig2(data, columns, rows) -> Result<Vec<u8>, FilterError>   // 1-bit row
 - `ccitt.rs`: `decode_ccitt` gives back the rows `encode_g4` was given (with `/BlackIs1`, `/Rows` and a row limit), refuses bad widths, and bounds its output for any input; byte-aligned Group 3 in each layout, over 32 seeded pictures, decodes to its picture, and a byte short to fewer rows. Group 4 output decoded by `hayro-ccitt` (an independent decoder) matches the input bits: a text-like page, padding bits, the widest row, and property tests over bitmaps of noise and of runs; any input returns rather than panics.
 - `mq.rs`: the arithmetic coder reproduces Annex H.2's 30 bytes from its 256 decisions.
 - `jbig2.rs`: output decoded by `hayro-jbig2` (dev-dependency, an independent decoder) matches the input bits: a text-like page (smaller than Group 4), edges, padding, all-white and all-black regions (typical rows), and property tests over bitmaps of noise and of runs; any input returns rather than panics.
+- `jbig2/decode.rs`: `decode_jbig2` gives back the rows of both codings, padding bits 0; refuses a page of another width or height, past `max` or past `MAX_JBIG2_PIXELS` before decoding it (2^28 pixels take about 34 MB, a bit each), globals that aren't JBIG2 and damaged data, and returns rather than panics on every prefix of a stream.
 - `jbig2/symbols.rs`: the integer coders against Annex A's example and Table A.1; symbol-coded output decoded by `hayro-jbig2` matches the input bits for every plan and strip size: text whose letters repeat (under half the generic coding's size, the dictionary retained and referred to), large and lone marks left to a generic region, marks on the edges, touching at corners and inside each other's boxes, and property tests over glyphs scattered over each other and the edges with stray pixels (never larger than the generic coding); one shape, a blank page and noise are coded generically; marks joined at a corner, either way, are one mark, and 256 pixels a side is a symbol while 257 wide or tall is left out; black padding bits are ignored; coordinates past 4,435 use Annex A's 32-bit range and PREV stays below 512; past 2^20 runs, 2^24 rows, 65,536 distinct marks or 2^24 symbol pixels the image is coded generically, and at each cap it is still looked at; a plan codes at most 32,767 symbols, which decode, and past that the second plan still codes the repeated ones; more than 10,000 marks are placed by several text regions, numbered in turn, the dictionary retained for each but the last; any input returns rather than panics.
 - `fuzz/`: a detached cargo-fuzz crate (`cargo +nightly fuzz run decode`, run from `crates/filters/`).
 
 ## Status
 
-M1.1/M1.2 for the general-purpose filters are done. Not yet here: the image decoders (DCT via zune-jpeg, JPX via hayro-jpeg2000, JBIG2), DCT encoding, CCITT Group 3 encoding and Flate encode levels other than 6.
+M1.1/M1.2 for the general-purpose filters are done. Not yet here: the DCT and JPX decoders (DCT via zune-jpeg, JPX via hayro-jpeg2000), DCT encoding, CCITT Group 3 encoding and Flate encode levels other than 6.
 
 
 Lossless symbol coding is also implemented: exact-copy dictionaries/text regions, bounded by the encoder; no approximate or lossy symbol substitution.
diff --git a/crates/filters/src/ccitt.rs b/crates/filters/src/ccitt.rs
index e87a82fe16..2a038568ee 100644
--- a/crates/filters/src/ccitt.rs
+++ b/crates/filters/src/ccitt.rs
@@ -50,7 +50,7 @@ pub fn encode_g4(data: &[u8], columns: u32, rows: u32) -> Result<Vec<u8>, Filter
     }
 }
 
-/// The widest row [`decode_ccitt`] decodes: its row buffer stays within 128 KiB.
+/// The widest row [`decode_ccitt_within`] decodes: its row buffer stays within 128 KiB.
 pub const MAX_CCITT_COLUMNS: u32 = 1 << 20;
 
 /// A `CCITTFaxDecode` stream's `/DecodeParms` (ISO 32000-2 Table 11). [`Default`] gives the
@@ -74,22 +74,8 @@ impl Default for CcittParams {
     }
 }
 
-/// CCITT fax `data` decoded as `CCITTFaxDecode` gives it: rows of `columns` 1-bit samples, most
-/// significant bit first, each starting on a new byte, with black as 0 (as 1 with `black_is_1`).
-///
-/// At most `max_rows` rows are decoded (fewer when `rows` says so), so the output is bounded by
-/// the caller. Damaged data gives the rows decoded before the damage, as viewers show them: a
-/// caller that needs a number of rows checks it got them.
-///
-/// Group 3 rows on bytes (`k` from 0, `encoded_byte_align`) are read by their end-of-line codes,
-/// whether the fill starts each code on a byte or ends it on one, when `data` starts with one (T.4
-/// sends one before the first row when it sends them at all), and on bytes otherwise, whatever
-/// `end_of_line` says. Group 4 is read as its parameters say. Data with codes but none before the
-/// first row is read on bytes, as PdfCraft's renderer draws it; with `k` 0 and the fill ending each
-/// code on a byte, that may be other rows than were coded.
-///
-/// Errors: `columns` that aren't from 1 to [`MAX_CCITT_COLUMNS`] ([`FilterError::Unsupported`]).
-pub fn decode_ccitt(data: &[u8], p: &CcittParams, max_rows: u32) -> Result<Vec<u8>, FilterError> {
+/// What [`decode_ccitt_within`] decodes once it is paid for.
+fn decode_ccitt(data: &[u8], p: &CcittParams, max_rows: u32) -> Result<Vec<u8>, FilterError> {
     let columns = u32::try_from(p.columns)
         .ok()
         .filter(|c| (1..=MAX_CCITT_COLUMNS).contains(c))
@@ -123,6 +109,39 @@ pub fn decode_ccitt(data: &[u8], p: &CcittParams, max_rows: u32) -> Result<Vec<u
     Ok(out.out)
 }
 
+/// The steps of reading a byte of fax code ([`decode_ccitt_within`]): noise takes 114 ns a byte of
+/// rows and about two bytes of code to a byte of rows, so that and a step a byte of rows is about
+/// what a step of JBIG2 decoding takes.
+const CODE_WORK: u64 = 4;
+
+/// CCITT fax `data` decoded as `CCITTFaxDecode` gives it: rows of `columns` 1-bit samples, most
+/// significant bit first, each starting on a new byte, with black as 0 (as 1 with `black_is_1`).
+///
+/// At most `max_rows` rows are decoded (fewer when `rows` says so), so the output is bounded by
+/// the caller. Damaged data gives the rows decoded before the damage, as viewers show them: a
+/// caller that needs a number of rows checks it got them.
+///
+/// Group 3 rows on bytes (`k` from 0, `encoded_byte_align`) are read by their end-of-line codes,
+/// whether the fill starts each code on a byte or ends it on one, when `data` starts with one (T.4
+/// sends one before the first row when it sends them at all), and on bytes otherwise, whatever
+/// `end_of_line` says. Group 4 is read as its parameters say. Data with codes but none before the
+/// first row is read on bytes, as PdfCraft's renderer draws it; with `k` 0 and the fill ending each
+/// code on a byte, that may be other rows than were coded.
+///
+/// Errors: `columns` that aren't from 1 to [`MAX_CCITT_COLUMNS`] ([`FilterError::Unsupported`]).
+///
+/// Decoding spends from `work`, what decoding may still cost across a run of images, and there is
+/// no way in without it: a
+/// byte of rows a step, whether or not the data holds them, and [`CODE_WORK`] a byte of `data`.
+/// A blank row takes a bit of code, so the rows are what a few bytes can ask for. It is all paid
+/// before anything is decoded, and what `work` can't pay for spends all of it.
+pub fn decode_ccitt_within(data: &[u8], p: &CcittParams, max_rows: u32, work: &mut u64) -> Result<Vec<u8>, FilterError> {
+    let rows = u32::try_from(p.rows).ok().filter(|r| *r > 0).map_or(max_rows, |r| r.min(max_rows));
+    let stride = u64::try_from(p.columns).unwrap_or(0).div_ceil(8);
+    crate::pay(work, stride.saturating_mul(u64::from(rows)).saturating_add((data.len() as u64).saturating_mul(CODE_WORK)))?;
+    decode_ccitt(data, p, max_rows)
+}
+
 /// Whether CCITT fax `data` starts with an end-of-line code: a 1 after 11 zeros or more, fill
 /// included. T.4 sends one before the first row when it sends them at all, and no other code starts
 /// with more than eight zeros.
@@ -132,9 +151,10 @@ fn starts_with_end_of_line(data: &[u8]) -> bool {
 }
 
 /// Rows of 1-bit samples filled from a decoder's pixels: `columns` a row, each row on a new byte, at
-/// most `rows` rows. Pixels past a row's end and rows past the last are dropped.
-struct Rows {
-    out: Vec<u8>,
+/// most `rows` rows. Pixels past a row's end and rows past the last are dropped. The JBIG2 decoder
+/// ([`crate::decode_jbig2_within`]) fills them too.
+pub(crate) struct Rows {
+    pub(crate) out: Vec<u8>,
     row: Vec<u8>,
     x: usize,
     columns: usize,
@@ -144,12 +164,12 @@ struct Rows {
 }
 
 impl Rows {
-    fn new(columns: usize, rows: usize, black_is_1: bool) -> Self {
+    pub(crate) fn new(columns: usize, rows: usize, black_is_1: bool) -> Self {
         Rows { out: Vec::new(), row: vec![0; columns.div_ceil(8)], x: 0, columns, rows, done: 0, black_is_1 }
     }
 
     /// `count` pixels, white or black.
-    fn push(&mut self, white: bool, count: usize) {
+    pub(crate) fn push(&mut self, white: bool, count: usize) {
         let end = self.x.saturating_add(count);
         if white != self.black_is_1 {
             for x in self.x..end.min(self.columns) {
@@ -160,6 +180,16 @@ impl Rows {
         }
         self.x = end;
     }
+
+    /// The row filled so far kept, if fewer than `rows` are, and the next one begun.
+    pub(crate) fn end_row(&mut self) {
+        if self.done < self.rows {
+            self.out.extend_from_slice(&self.row);
+            self.done += 1;
+        }
+        self.row.fill(0);
+        self.x = 0;
+    }
 }
 
 impl hayro_ccitt::Decoder for Rows {
@@ -170,12 +200,7 @@ impl hayro_ccitt::Decoder for Rows {
         self.push(white, (chunks as usize).saturating_mul(8));
     }
     fn next_line(&mut self) {
-        if self.done < self.rows {
-            self.out.extend_from_slice(&self.row);
-            self.done += 1;
-        }
-        self.row.fill(0);
-        self.x = 0;
+        self.end_row();
     }
 }
 
@@ -183,6 +208,42 @@ impl hayro_ccitt::Decoder for Rows {
 mod tests {
     use super::*;
 
+    /// A run pays for the rows an image asks for and the code it reads, before any of it is
+    /// decoded: rows the data doesn't hold are paid for too, as a few bytes can ask for any number.
+    #[test]
+    fn a_run_of_images_pays_for_the_rows_it_asks_for() {
+        let (w, h) = (4096u32, 64u32);
+        let stride = (w as usize).div_ceil(8);
+        let data = encode_g4(&vec![0xFF; stride * h as usize], w, h).unwrap();
+        let p = CcittParams { k: -1, columns: i64::from(w), ..CcittParams::default() };
+        let whole = decode_ccitt(&data, &p, h).unwrap();
+        let cost = (whole.len() + 4 * data.len()) as u64;
+        let mut work = cost;
+        assert_eq!(decode_ccitt_within(&data, &p, h, &mut work).unwrap(), whole, "exactly enough");
+        assert_eq!(work, 0);
+        let mut work = cost + 7;
+        decode_ccitt_within(&data, &p, h, &mut work).unwrap();
+        assert_eq!(work, 7, "only what it took");
+        let mut work = cost - 1;
+        let refused = decode_ccitt_within(&data, &p, h, &mut work).unwrap_err();
+        assert!(matches!(refused, FilterError::Spent), "a step short: {refused}");
+        assert_eq!(work, 0, "spends all that was left");
+        // Nothing left: not read at all, so bad columns aren't reported as bad columns.
+        let bad = CcittParams { columns: 0, ..p };
+        assert!(decode_ccitt_within(&data, &bad, h, &mut 0).is_err_and(|e| matches!(e, FilterError::Spent)));
+        // No code at all, for the same rows.
+        let mut work = u64::MAX;
+        decode_ccitt_within(&[], &p, h, &mut work).unwrap();
+        assert_eq!(u64::MAX - work, whole.len() as u64);
+        // `/Rows` below what is asked for, and no rows.
+        let mut work = u64::MAX;
+        decode_ccitt_within(&data, &CcittParams { rows: 3, ..p }, h, &mut work).unwrap();
+        assert_eq!(u64::MAX - work, (3 * stride + 4 * data.len()) as u64);
+        let mut work = u64::MAX;
+        decode_ccitt_within(&data, &p, 0, &mut work).unwrap();
+        assert_eq!(u64::MAX - work, 4 * data.len() as u64);
+    }
+
     /// The rows decoded by an independent decoder (`hayro-ccitt`), as 1 for white and 0 for black.
     pub(crate) fn decode(data: &[u8], columns: u32, rows: u32) -> Vec<Vec<bool>> {
         struct Rows(Vec<Vec<bool>>, Vec<bool>, usize);
diff --git a/crates/filters/src/flate.rs b/crates/filters/src/flate.rs
index dac0851e07..1c38f72a53 100644
--- a/crates/filters/src/flate.rs
+++ b/crates/filters/src/flate.rs
@@ -28,8 +28,9 @@ pub(crate) fn decode(data: &[u8], max: usize) -> Step {
             // A header that only looked valid: retry the whole input as raw deflate.
             Err(f) if f.partial.is_empty() && matches!(f.error, crate::FilterError::Corrupt { .. }) => match inflate_raw(data, max) {
                 // Keep the original corruption diagnostic only if the retry is corrupt
-                // too. A limit error must remain fatal even for tolerant decoding.
-                Err(retry) if matches!(retry.error, crate::FilterError::Corrupt { .. }) => Err(f),
+                // too. A limit error must remain fatal even for tolerant decoding. What the
+                // retry decoded isn't kept, but a caller charging for work has to hear of it.
+                Err(retry) if matches!(retry.error, crate::FilterError::Corrupt { .. }) => Err(Failure { discarded: retry.partial.len(), ..f }),
                 retry => retry,
             },
             r => r,
diff --git a/crates/filters/src/jbig2.rs b/crates/filters/src/jbig2.rs
index 343fbbd27d..1b705b0c72 100644
--- a/crates/filters/src/jbig2.rs
+++ b/crates/filters/src/jbig2.rs
@@ -2,10 +2,13 @@
 //! a generic region, template 0 with its nominal adaptive pixels, typical prediction on, MQ
 //! arithmetic coding ([`crate::mq`]); or the image's marks as symbols ([`symbols`]). Written from
 //! the standard's 6.2.5 (coding a generic region), 7.2 (segment headers), 7.4.1, 7.4.6 and 7.4.8
-//! (the segments) and D.3 (the embedded organisation PDF uses).
+//! (the segments) and D.3 (the embedded organisation PDF uses). Decoding is in [`decode`].
 
+mod decode;
 mod symbols;
 
+pub use decode::{MAX_JBIG2_PIXELS, decode_jbig2_within};
+
 use crate::FilterError;
 use crate::mq::{Context, MqEncoder};
 
diff --git a/crates/filters/src/jbig2/decode.rs b/crates/filters/src/jbig2/decode.rs
new file mode 100644
index 0000000000..a018e75937
--- /dev/null
+++ b/crates/filters/src/jbig2/decode.rs
@@ -0,0 +1,216 @@
+//! JBIG2 decoding for `JBIG2Decode` (ISO 32000-2 §7.4.7), through `hayro-jbig2`.
+
+use crate::FilterError;
+use crate::ccitt::Rows;
+
+/// The largest JBIG2 page [`decode_jbig2_within`] decodes, in pixels. The decoder decodes a page whole,
+/// and takes pages of up to about this many (20,000 × 10,000 decodes).
+pub const MAX_JBIG2_PIXELS: u64 = 1 << 28;
+
+/// A `JBIG2Decode` stream's `data`, with what its `/JBIG2Globals` stream decodes to, decoded as the
+/// filter gives it: `rows` rows of `columns` 1-bit samples, most significant bit first, each
+/// starting on a new byte, with black as 0 (JBIG2 codes black as 1).
+///
+/// The JBIG2 page has to be the image's size, `columns` × `rows`: PdfCraft's renderer draws the
+/// whole page into the image, so the rows of a page of another height wouldn't be the image's. The
+/// decoder decodes the page whole, so it is checked before it is decoded, and has to fit in `max`
+/// bytes as such rows and have at most [`MAX_JBIG2_PIXELS`]. Regions inside it are bounded by the
+/// decoder alone: a region may claim more pixels than its page, and is decoded before it is cut to
+/// the page. With no rows asked for, nothing is decoded.
+///
+/// Errors: `data` or `globals` that don't decode, or a page of another size
+/// ([`FilterError::Corrupt`]); a page past `max` ([`FilterError::LimitExceeded`]) or
+/// [`MAX_JBIG2_PIXELS`] ([`FilterError::Unsupported`], or `Corrupt` from the decoder, which has the
+/// same cap and can refuse the page first).
+///
+/// Decoding spends from `work`: what decoding may still cost across a run of images, in the
+/// decoder's count of steps. There is no way in without it, so a run of images can't decode them
+/// without sharing an allowance. Reading `data` and `globals` is charged first
+/// ([`hayro_jbig2::charge_reading`]), so an image that turns out not to decode has paid for that,
+/// then what decoding takes ([`hayro_jbig2::Image::decode_within`]). An image takes at most what
+/// one decode may on top of its reading and its page, whatever `work` allows, and one that `work`
+/// can't pay for spends all of it. With nothing left an image isn't read at all, so the images after
+/// that one cost nothing but this check, however large their globals.
+pub fn decode_jbig2_within(data: &[u8], globals: Option<&[u8]>, columns: u32, rows: u32, max: usize, work: &mut u64) -> Result<Vec<u8>, FilterError> {
+    if rows == 0 {
+        return Ok(Vec::new());
+    }
+    if *work == 0 {
+        return Err(FilterError::Spent);
+    }
+    hayro_jbig2::charge_reading(work, data.len().saturating_add(globals.map_or(0, <[u8]>::len))).map_err(|_| FilterError::Spent)?;
+    let corrupt = |detail: String| FilterError::Corrupt { filter: "JBIG2Decode", detail };
+    let image = hayro_jbig2::Image::new_embedded(data, globals).map_err(|e| corrupt(e.to_string()))?;
+    let (width, height) = (image.width(), image.height());
+    if (width, height) != (columns, rows) {
+        return Err(corrupt(format!("a page of {width} × {height} pixels for an image of {columns} × {rows}")));
+    }
+    if u64::from(width) * u64::from(height) > MAX_JBIG2_PIXELS {
+        return Err(FilterError::Unsupported(format!("JBIG2 pages of {width} × {height} pixels")));
+    }
+    // u32 to usize: wasm32 and up have at least 32-bit usize.
+    let (width, height) = (width as usize, height as usize);
+    if width.div_ceil(8).checked_mul(height).is_none_or(|bytes| bytes > max) {
+        return Err(FilterError::LimitExceeded(max));
+    }
+    let mut out = Rows::new(width, height, false);
+    // Stopped by what was left, it isn't a damaged image, whatever the decoder calls it.
+    image.decode_within(&mut out, work).map_err(|e| if *work == 0 { FilterError::Spent } else { corrupt(e.to_string()) })?;
+    Ok(out.out)
+}
+
+/// JBIG2 codes black as 1, which `JBIG2Decode` gives as 0.
+impl hayro_jbig2::Decoder for Rows {
+    fn push_pixel(&mut self, black: bool) {
+        self.push(!black, 1);
+    }
+    fn push_pixel_chunk(&mut self, black: bool, chunks: u32) {
+        self.push(!black, (chunks as usize).saturating_mul(8));
+    }
+    fn next_line(&mut self) {
+        self.end_row();
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::{encode_jbig2, encode_jbig2_generic};
+
+    /// [`decode_jbig2_within`] with no limit on the work.
+    fn decode_jbig2(data: &[u8], globals: Option<&[u8]>, columns: u32, rows: u32, max: usize) -> Result<Vec<u8>, FilterError> {
+        let mut unbounded = u64::MAX;
+        decode_jbig2_within(data, globals, columns, rows, max, &mut unbounded)
+    }
+
+    /// `rows` rows of `columns` samples of noise, the bits that pad each row to a byte 0.
+    fn noise(columns: u32, rows: u32) -> Vec<u8> {
+        let stride = (columns as usize).div_ceil(8);
+        let mut seed = 0x2545_F491_4F6C_DD1Du64;
+        let mut data: Vec<u8> = (0..stride * rows as usize)
+            .map(|_| {
+                seed ^= seed << 13;
+                seed ^= seed >> 7;
+                seed ^= seed << 17;
+                seed as u8
+            })
+            .collect();
+        let pad = (stride * 8 - columns as usize) as u32;
+        data.chunks_mut(stride).for_each(|row| *row.last_mut().unwrap() &= 0xFFu8.checked_shl(pad).unwrap_or(0));
+        data
+    }
+
+    /// The same stream with its page information (the first segment's data, after its 11-byte
+    /// header: width, then height) claiming a page of `width` × `height`.
+    fn page_of(data: &[u8], width: u32, height: u32) -> Vec<u8> {
+        let mut data = data.to_vec();
+        data[11..15].copy_from_slice(&width.to_be_bytes());
+        data[15..19].copy_from_slice(&height.to_be_bytes());
+        data
+    }
+
+    /// Either coding decodes to its samples, black as 0, the bits that pad each row 0: a generic
+    /// region of noise, and symbols for letters repeated across the page. With no rows asked for,
+    /// nothing is decoded.
+    #[test]
+    fn both_codings_decode_to_their_samples() {
+        let (w, h) = (203u32, 41u32);
+        let bits = noise(w, h);
+        let generic = encode_jbig2_generic(&bits, w, h).unwrap();
+        assert_eq!(decode_jbig2(&generic, None, w, h, usize::MAX).unwrap(), bits);
+        assert_eq!(decode_jbig2(b"not JBIG2", None, w, 0, usize::MAX).unwrap(), b"", "no rows asked for");
+
+        // Four lines of three letters, black on white.
+        const LETTERS: [[&str; 7]; 3] = [
+            ["#####", "#....", "####.", "#....", "#....", "#....", "#####"],
+            [".###.", "#...#", "#....", "#....", "#....", "#...#", ".###."],
+            ["#...#", "#...#", "#####", "#...#", "#...#", "#...#", "#...#"],
+        ];
+        let (w, h) = (400u32, 40u32);
+        let stride = (w as usize).div_ceil(8);
+        let mut marks = vec![0xFFu8; stride * h as usize];
+        for (line, top) in [2usize, 12, 22, 32].into_iter().enumerate() {
+            for (k, x) in (3..w as usize - 6).step_by(7).enumerate() {
+                for (dy, row) in LETTERS[(k + line) % 3].iter().enumerate() {
+                    for (dx, _) in row.bytes().enumerate().filter(|(_, c)| *c == b'#') {
+                        marks[(top + dy) * stride + (x + dx) / 8] &= !(0x80 >> ((x + dx) % 8));
+                    }
+                }
+            }
+        }
+        let symbols = encode_jbig2(&marks, w, h).unwrap();
+        assert!(symbols.len() < encode_jbig2_generic(&marks, w, h).unwrap().len(), "symbol coded");
+        assert_eq!(decode_jbig2(&symbols, None, w, h, usize::MAX).unwrap(), marks);
+    }
+
+    /// What a page costs is the same however much a run has left. Given exactly that it decodes,
+    /// and less stops it: spending all that's left, and what comes after isn't read. A page that
+    /// fails still spends what it took.
+    #[test]
+    fn a_run_of_images_spends_its_allowance_down_to_the_step() {
+        let (w, h) = (203u32, 41u32);
+        let data = encode_jbig2_generic(&noise(w, h), w, h).unwrap();
+        let whole = decode_jbig2(&data, None, w, h, usize::MAX).unwrap();
+        let mut work = u64::MAX;
+        assert_eq!(decode_jbig2_within(&data, None, w, h, usize::MAX, &mut work).unwrap(), whole);
+        let cost = u64::MAX - work;
+        assert!(cost >= u64::from(w) * u64::from(h), "a pixel at a time: {cost}");
+        let mut work = cost;
+        assert_eq!(decode_jbig2_within(&data, None, w, h, usize::MAX, &mut work).unwrap(), whole, "exactly enough");
+        assert_eq!(work, 0);
+        let mut work = cost + 7;
+        decode_jbig2_within(&data, None, w, h, usize::MAX, &mut work).unwrap();
+        assert_eq!(work, 7, "only what it took");
+        let mut work = cost - 1;
+        assert!(matches!(decode_jbig2_within(&data, None, w, h, usize::MAX, &mut work), Err(FilterError::Spent)), "a step short");
+        assert_eq!(work, 0, "spends all that was left");
+        // Nothing left: not read at all, so this garbage isn't reported as garbage.
+        assert!(matches!(decode_jbig2_within(b"garbage", None, w, h, usize::MAX, &mut work), Err(FilterError::Spent)));
+        // Too little even for its page.
+        let mut work = 3;
+        assert!(decode_jbig2_within(&data, None, w, h, usize::MAX, &mut work).is_err());
+        assert_eq!(work, 0);
+        // A region that can't be read after the one that can: the page fails having spent the
+        // first, and the segment it fails on, and that isn't being out of allowance.
+        let bad_region = [0, 0, 0, 9, 38, 0, 1, 0, 0, 0, 1, 0xFF];
+        let mut work = u64::MAX;
+        assert!(decode_jbig2_within(&[&data[..], &bad_region].concat(), None, w, h, usize::MAX, &mut work).is_err());
+        assert_eq!(u64::MAX - work, cost + 1 + 4 * bad_region.len() as u64, "the first region, a segment more, and reading it");
+        // Not a stream at all: it pays for being read, and globals count with it.
+        let mut work = u64::MAX;
+        assert!(matches!(decode_jbig2_within(b"garbage", Some(b"globals"), w, h, usize::MAX, &mut work), Err(FilterError::Corrupt { .. })));
+        assert_eq!(u64::MAX - work, 4 * 14);
+    }
+
+    /// The page has to be the image's size, and is bounded before it is decoded, being decoded
+    /// whole: within `max` as rows of one bit, and within [`MAX_JBIG2_PIXELS`]. Globals are given
+    /// to the decoder: ones it skips decode, ones that aren't JBIG2 are an error, as is damaged
+    /// data, which never panics.
+    #[test]
+    fn what_it_cannot_decode_is_an_error() {
+        let (w, h) = (203u32, 41u32);
+        let data = encode_jbig2_generic(&noise(w, h), w, h).unwrap();
+        for (columns, rows) in [(w - 1, h), (w + 1, h), (w, h - 1), (w, h + 1)] {
+            let e = decode_jbig2(&data, None, columns, rows, usize::MAX).unwrap_err();
+            assert!(matches!(e, FilterError::Corrupt { .. }), "{columns} × {rows}: {e}");
+        }
+        let page = 26 * h as usize;
+        assert!(matches!(decode_jbig2(&data, None, w, h, page - 1), Err(FilterError::LimitExceeded(m)) if m == page - 1), "a byte short");
+        assert_eq!(decode_jbig2(&data, None, w, h, page).unwrap().len(), page, "the page within max");
+        // 16,384 × 16,384 is 2^28 pixels, which decodes; a row more is past the cap, here or in the
+        // decoder, which has the same one and can refuse it first.
+        let large = |rows| decode_jbig2(&page_of(&data, 16_384, rows), None, 16_384, rows, usize::MAX);
+        assert!(matches!(large(16_385), Err(FilterError::Unsupported(_) | FilterError::Corrupt { .. })), "{:?}", large(16_385));
+        assert!(large(16_384).is_ok(), "{:?}", large(16_384).map(|page| page.len()));
+
+        // An extension segment (ISO/IEC 14492 7.4.14), which a decoder skips: its 11-byte header
+        // gives the length of the data after it.
+        let skipped = [0, 0, 0, 0, 0x3E, 0, 0, 0, 0, 0, 4, 0, 0, 0, 1];
+        let generic = decode_jbig2(&data, None, w, h, usize::MAX).unwrap();
+        assert_eq!(decode_jbig2(&data, Some(&skipped), w, h, usize::MAX).unwrap(), generic);
+        assert!(matches!(decode_jbig2(&data, Some(b"not JBIG2"), w, h, usize::MAX), Err(FilterError::Corrupt { .. })));
+        for end in 0..data.len() {
+            let _ = decode_jbig2(&data[..end], None, w, h, usize::MAX);
+        }
+    }
+}
diff --git a/crates/filters/src/lib.rs b/crates/filters/src/lib.rs
index 7eac1a83e1..181f96ab66 100644
--- a/crates/filters/src/lib.rs
+++ b/crates/filters/src/lib.rs
@@ -6,8 +6,28 @@
 //! TIFF/PNG predictors, `ASCIIHexDecode`, `ASCII85Decode`, `RunLengthDecode`).
 //! Image codecs (`DCTDecode`, `JPXDecode`, `JBIG2Decode`, `CCITTFaxDecode`),
 //! `Crypt` and unknown filters are reported as [`FilterError::Unsupported`] so
-//! callers keep such data encoded. 1-bit samples can be encoded as CCITT Group 4
-//! ([`encode_g4`]) or lossless JBIG2 ([`encode_jbig2`]).
+//! callers keep such data encoded. CCITT fax and JBIG2 images decode on their own
+//! ([`decode_ccitt_within`], [`decode_jbig2_within`]), each spending from an allowance its caller
+//! shares across a run of images, as `pdfcraft_cos::ImageBudget::decode` does after the filters
+//! before them. Neither decodes without one:
+//!
+//! ```compile_fail
+//! let _ = pdfcraft_filters::decode_jbig2(&[], None, 1, 1, 1 << 20);
+//! ```
+//!
+//! ```compile_fail
+//! let _ = pdfcraft_filters::decode_ccitt(&[], &pdfcraft_filters::CcittParams::default(), 1);
+//! ```
+//!
+//! ```
+//! let mut work = 1 << 20;
+//! assert!(pdfcraft_filters::decode_jbig2_within(&[], None, 1, 1, 1 << 20, &mut work).is_err());
+//! let p = pdfcraft_filters::CcittParams { columns: 8, ..Default::default() };
+//! assert!(pdfcraft_filters::decode_ccitt_within(&[], &p, 1, &mut work).is_ok());
+//! ```
+//!
+//! 1-bit samples can be encoded as CCITT Group 4 ([`encode_g4`]) or lossless JBIG2
+//! ([`encode_jbig2`]).
 //!
 //! Every decoder is bounded by a caller-supplied `max_output` (decompression-bomb
 //! defence) and never panics on malformed input.
@@ -26,8 +46,8 @@ mod runlength;
 
 use std::borrow::Cow;
 
-pub use ccitt::{CcittParams, MAX_CCITT_COLUMNS, MAX_G4_COLUMNS, decode_ccitt, encode_g4};
-pub use jbig2::{MAX_JBIG2_COLUMNS, encode_jbig2, encode_jbig2_generic};
+pub use ccitt::{CcittParams, MAX_CCITT_COLUMNS, MAX_G4_COLUMNS, decode_ccitt_within, encode_g4};
+pub use jbig2::{MAX_JBIG2_COLUMNS, MAX_JBIG2_PIXELS, decode_jbig2_within, encode_jbig2, encode_jbig2_generic};
 
 /// A PDF stream filter, identified by its `/Filter` name.
 #[derive(Clone, Debug, PartialEq, Eq, Hash)]
@@ -89,7 +109,8 @@ impl Filter {
         matches!(self, Filter::Dct | Filter::Jpx | Filter::Jbig2 | Filter::CcittFax)
     }
 
-    fn is_decodable(&self) -> bool {
+    /// True for the general-purpose filters, which a chain can hold ([`decode`]).
+    pub fn is_decodable(&self) -> bool {
         matches!(self, Filter::Flate | Filter::Lzw | Filter::AsciiHex | Filter::Ascii85 | Filter::RunLength)
     }
 }
@@ -121,33 +142,53 @@ pub enum FilterError {
     LimitExceeded(usize),
     #[error("unsupported filter: {0}")]
     Unsupported(String),
+    /// A run of images has nothing left to spend ([`decode_tolerant_within`]).
+    #[error("more image decoding than one operation may do")]
+    Spent,
 }
 
 /// A decoder failure carrying whatever was decoded before the error.
 pub(crate) struct Failure {
     pub(crate) error: FilterError,
     pub(crate) partial: Vec<u8>,
+    /// Bytes decoded on the way that `partial` doesn't hold: they took as long.
+    pub(crate) discarded: usize,
 }
 
 impl Failure {
     pub(crate) fn corrupt(filter: &'static str, detail: impl Into<String>, partial: Vec<u8>) -> Self {
-        Failure { error: FilterError::Corrupt { filter, detail: detail.into() }, partial }
+        Failure { error: FilterError::Corrupt { filter, detail: detail.into() }, partial, discarded: 0 }
     }
 
     pub(crate) fn limit(max: usize) -> Self {
-        Failure { error: FilterError::LimitExceeded(max), partial: Vec::new() }
+        Failure { error: FilterError::LimitExceeded(max), partial: Vec::new(), discarded: 0 }
     }
 }
 
 pub(crate) type Step = Result<Vec<u8>, Failure>;
 
+/// Takes `steps` from `work`, what a run of images may still cost. What it can't pay for spends
+/// all of it.
+pub(crate) fn pay(work: &mut u64, steps: u64) -> Result<(), FilterError> {
+    match work.checked_sub(steps) {
+        Some(left) => {
+            *work = left;
+            Ok(())
+        }
+        None => {
+            *work = 0;
+            Err(FilterError::Spent)
+        }
+    }
+}
+
 /// Decodes `data` through `chain` (first element applied first).
 ///
 /// Image codecs, `Crypt` and unknown filters anywhere in the chain give
 /// [`FilterError::Unsupported`] (callers keep such data encoded), as does a chain longer than
 /// [`MAX_CHAIN`]. `max_output` bounds every intermediate buffer.
 pub fn decode(chain: &[(Filter, Params)], data: &[u8], max_output: usize) -> Result<Vec<u8>, FilterError> {
-    run(chain, data, max_output, true, false).map(|(v, _, _)| v).map_err(|(e, _)| e)
+    run(chain, data, max_output, None, true).map(|(v, _, _)| v).map_err(|(e, _)| e)
 }
 
 /// Like [`decode`] for a caller charging an allowance: `max_output` bounds the bytes all stages
@@ -155,47 +196,98 @@ pub fn decode(chain: &[(Filter, Params)], data: &[u8], max_output: usize) -> Res
 /// bytes, on success and on failure. A stage's output counts even when a later stage or its
 /// predictor shrinks it.
 pub fn decode_counted(chain: &[(Filter, Params)], data: &[u8], max_output: usize) -> Result<(Vec<u8>, usize), (FilterError, usize)> {
-    run(chain, data, max_output, true, true).map(|(v, _, spent)| (v, spent))
+    run(chain, data, max_output, Some(max_output), true).map(|(v, _, spent)| (v, spent))
 }
 
 /// Like [`decode`], but on corrupt data returns what was decoded before the error and
 /// reports `partial = true` (the behaviour viewers expect). The remaining filters of the
 /// chain still run on the partial data. Limit and unsupported errors are still errors.
 pub fn decode_tolerant(chain: &[(Filter, Params)], data: &[u8], max_output: usize) -> Result<(Vec<u8>, bool), FilterError> {
-    run(chain, data, max_output, false, false).map(|(v, partial, _)| (v, partial)).map_err(|(e, _)| e)
+    run(chain, data, max_output, None, false).map(|(v, partial, _)| (v, partial)).map_err(|(e, _)| e)
 }
 
 /// [`decode_tolerant`] bounded and counted as [`decode_counted`] is.
 pub fn decode_tolerant_counted(chain: &[(Filter, Params)], data: &[u8], max_output: usize) -> Result<(Vec<u8>, bool, usize), (FilterError, usize)> {
-    run(chain, data, max_output, false, true)
+    run(chain, data, max_output, Some(max_output), false)
+}
+
+/// [`decode_tolerant`], spending from `work`, what decoding may still cost across a run of images:
+/// a step for each byte of `data`, paid before anything is decoded, and one for each byte a stage
+/// decodes, so a chain that fails, or a stage that goes past `max_output`, has paid for what it did.
+/// No stage decodes past what is left: a chain that `work` can't pay for spends all of it and stops
+/// there, so with nothing left nothing is read. A chain that can't be decoded at all costs nothing,
+/// whatever is left, so what an image's filters are is known from the error.
+///
+/// Unlike [`decode_tolerant`], no filters at all gives `data` itself, within `max_output`.
+pub fn decode_tolerant_within(chain: &[(Filter, Params)], data: &[u8], max_output: usize, work: &mut u64) -> Result<Vec<u8>, FilterError> {
+    spending(chain, data, max_output, work, false)
+}
+
+/// [`decode`], spending from `work` as [`decode_tolerant_within`] does: corrupt data is an error,
+/// having paid for what was decoded before it.
+pub fn decode_within(chain: &[(Filter, Params)], data: &[u8], max_output: usize, work: &mut u64) -> Result<Vec<u8>, FilterError> {
+    spending(chain, data, max_output, work, true)
+}
+
+fn spending(chain: &[(Filter, Params)], data: &[u8], max_output: usize, work: &mut u64, strict: bool) -> Result<Vec<u8>, FilterError> {
+    decodable(chain)?;
+    pay(work, data.len() as u64)?;
+    if chain.is_empty() {
+        return if data.len() > max_output { Err(FilterError::LimitExceeded(max_output)) } else { Ok(data.to_vec()) };
+    }
+    let left = usize::try_from(*work).unwrap_or(usize::MAX);
+    match run(chain, data, max_output, Some(left), strict) {
+        Ok((out, _, decoded)) => pay(work, decoded as u64).map(|()| out),
+        // The stage stopped at the lower of the two, which took as much to find out.
+        Err((FilterError::LimitExceeded(_), decoded)) if left.saturating_sub(decoded) > max_output => {
+            pay(work, (decoded as u64).saturating_add(max_output as u64))?;
+            Err(FilterError::LimitExceeded(max_output))
+        }
+        Err((FilterError::LimitExceeded(_), _)) => {
+            *work = 0;
+            Err(FilterError::Spent)
+        }
+        Err((e, decoded)) => pay(work, decoded as u64).and(Err(e)),
+    }
 }
 
 /// Longest filter chain decoded. Real streams use one to three filters; every stage may produce
 /// up to the output limit, so the chain length multiplies the work.
 pub const MAX_CHAIN: usize = 8;
 
-/// The decoded data, whether it is partial and the bytes all stages decoded, or the error and
-/// the bytes decoded before it. `max` bounds each stage, or with `cumulative` all of them
-/// together.
-fn run(chain: &[(Filter, Params)], data: &[u8], max: usize, strict: bool, cumulative: bool) -> Result<(Vec<u8>, bool, usize), (FilterError, usize)> {
+/// Whether a chain is one [`run`] takes, and if not, the error.
+fn decodable(chain: &[(Filter, Params)]) -> Result<(), FilterError> {
     if chain.len() > MAX_CHAIN {
-        return Err((FilterError::Unsupported(format!("a chain of {} filters", chain.len())), 0));
+        return Err(FilterError::Unsupported(format!("a chain of {} filters", chain.len())));
     }
-    if let Some((f, _)) = chain.iter().find(|(f, _)| !f.is_decodable()) {
-        return Err((FilterError::Unsupported(f.name().to_owned()), 0));
+    match chain.iter().find(|(f, _)| !f.is_decodable()) {
+        Some((f, _)) => Err(FilterError::Unsupported(f.name().to_owned())),
+        None => Ok(()),
     }
+}
+
+/// The decoded data, whether it is partial and the bytes all stages decoded, or the error and
+/// the bytes decoded before it. `max` bounds each stage, and `total` all of them together.
+fn run(
+    chain: &[(Filter, Params)],
+    data: &[u8],
+    max: usize,
+    total: Option<usize>,
+    strict: bool,
+) -> Result<(Vec<u8>, bool, usize), (FilterError, usize)> {
+    decodable(chain).map_err(|e| (e, 0))?;
     let mut cur: Cow<[u8]> = Cow::Borrowed(data);
     let mut partial = false;
     let mut spent = 0usize;
     for (filter, params) in chain {
         #[cfg(test)]
         STAGE_BYTES.with(|c| c.set(c.get() + cur.len()));
-        let limit = if cumulative { max.saturating_sub(spent) } else { max };
+        let limit = total.map_or(max, |total| max.min(total.saturating_sub(spent)));
         let (step, work) = decode_one(filter, params, &cur, limit);
         spent = spent.saturating_add(work);
         cur = Cow::Owned(match step {
             Ok(v) => v,
-            Err(Failure { error: FilterError::Corrupt { .. }, partial: out }) if !strict => {
+            Err(Failure { error: FilterError::Corrupt { .. }, partial: out, .. }) if !strict => {
                 partial = true;
                 out
             }
@@ -214,15 +306,15 @@ fn decode_one(filter: &Filter, params: &Params, data: &[u8], max: usize) -> (Ste
         Filter::AsciiHex => counted(asciihex::decode(data, max)),
         Filter::Ascii85 => counted(ascii85::decode(data, max)),
         Filter::RunLength => counted(runlength::decode(data, max)),
-        other => (Err(Failure { error: FilterError::Unsupported(other.name().to_owned()), partial: Vec::new() }), 0),
+        other => (Err(Failure { error: FilterError::Unsupported(other.name().to_owned()), partial: Vec::new(), discarded: 0 }), 0),
     }
 }
 
-/// A step with the bytes it produced, its output or its partial output.
+/// A step with the bytes it produced: its output, or its partial output and what it threw away.
 fn counted(step: Step) -> (Step, usize) {
     let n = match &step {
         Ok(v) => v.len(),
-        Err(f) => f.partial.len(),
+        Err(f) => f.partial.len().saturating_add(f.discarded),
     };
     (step, n)
 }
@@ -234,12 +326,12 @@ fn with_predictor(step: Step, params: &Params, name: &'static str) -> (Step, usi
     let (step, n) = counted(step);
     let step = match step {
         Ok(v) => predictor::decode(params, v, name),
-        Err(Failure { error, partial }) => {
+        Err(Failure { error, partial, discarded }) => {
             let partial = match predictor::decode(params, partial, name) {
                 Ok(v) => v,
                 Err(f) => f.partial,
             };
-            Err(Failure { error, partial })
+            Err(Failure { error, partial, discarded })
         }
     };
     (step, n)
@@ -426,6 +518,9 @@ mod tests {
         assert_eq!(decode(&chain, &data, max).map(|d| d.len()).ok(), Some(1 << 19));
         assert!(matches!(decode_counted(&chain, &data, max), Err((FilterError::LimitExceeded(m), _)) if m == max));
         assert_eq!(decode_counted(&chain, &data, 2 << 20).map(|(_, spent)| spent).ok(), Some((1 << 20) + (1 << 19)));
+        let tolerant = decode_tolerant_counted(&chain, &data, 2 << 20).map(|(out, partial, spent)| (out.len(), partial, spent));
+        assert_eq!(tolerant.ok(), Some((1 << 19, false, (1 << 20) + (1 << 19))));
+        assert!(matches!(decode_tolerant_counted(&chain, &data, max), Err((FilterError::LimitExceeded(m), _)) if m == max));
     }
 
     /// A PNG predictor drops a tag byte per row, but Flate produced it: the count includes it,
@@ -444,4 +539,157 @@ mod tests {
         assert!(matches!(e, FilterError::Corrupt { .. }), "{e}");
         assert_eq!(spent, bad.len());
     }
+
+    fn refused(e: &FilterError) -> bool {
+        matches!(e, FilterError::Spent)
+    }
+
+    /// A chain pays for what it reads and what each stage decodes, down to the byte: Flate inflates
+    /// hex that ASCIIHex halves, so a stage counts when a later one shrinks it.
+    #[test]
+    fn a_chain_spends_down_to_the_byte() {
+        let hex = b"ab".repeat(1 << 10);
+        let data = encode_flate(&hex);
+        let chain = [(Filter::Flate, Params::default()), (Filter::AsciiHex, Params::default())];
+        let whole = decode(&chain, &data, 1 << 20).unwrap();
+        let cost = (data.len() + hex.len() + whole.len()) as u64;
+        let mut work = u64::MAX;
+        assert_eq!(decode_tolerant_within(&chain, &data, 1 << 20, &mut work).unwrap(), whole);
+        assert_eq!(u64::MAX - work, cost);
+        let mut work = cost;
+        assert_eq!(decode_tolerant_within(&chain, &data, 1 << 20, &mut work).unwrap(), whole, "exactly enough");
+        assert_eq!(work, 0);
+        let mut work = cost + 7;
+        decode_tolerant_within(&chain, &data, 1 << 20, &mut work).unwrap();
+        assert_eq!(work, 7, "only what it took");
+        let mut work = cost - 1;
+        assert!(refused(&decode_tolerant_within(&chain, &data, 1 << 20, &mut work).unwrap_err()), "a step short");
+        assert_eq!(work, 0, "spends all that was left");
+        // Each stage has `max_output` to itself, as in a plain decode: together they are past it.
+        let mut work = u64::MAX;
+        assert_eq!(decode_tolerant_within(&chain, &data, hex.len(), &mut work).unwrap(), whole);
+    }
+
+    /// No stage runs past what is left: the first stage of this bomb stops there, so the second
+    /// isn't given anything to read, and with too little to read it nothing runs at all.
+    #[test]
+    fn a_chain_stops_at_what_is_left() {
+        let inner = encode_flate(&vec![0; 1 << 20]);
+        let bomb = encode_flate(&inner);
+        let chain = [(Filter::Flate, Params::default()), (Filter::Flate, Params::default())];
+        let read = |work: u64| {
+            super::STAGE_BYTES.with(|c| c.set(0));
+            let mut work = work;
+            assert!(refused(&decode_tolerant_within(&chain, &bomb, usize::MAX, &mut work).unwrap_err()));
+            assert_eq!(work, 0);
+            super::STAGE_BYTES.with(|c| c.get())
+        };
+        assert_eq!(read((bomb.len() + inner.len()) as u64 + 10), bomb.len() + inner.len(), "the second stage stops");
+        assert_eq!(read(bomb.len() as u64 + 10), bomb.len(), "the first stops, and the second never runs");
+        assert_eq!(read(bomb.len() as u64 - 1), 0, "it can't pay to be read");
+    }
+
+    /// Past `max_output` the chain has failed, and hasn't run out of anything: it pays what it took
+    /// to find out, and what is left stays. Whichever limit a stage stops at is the one reported.
+    #[test]
+    fn a_stage_past_its_limit_pays_for_finding_out() {
+        let data = encode_flate(&vec![0; 1 << 16]);
+        let chain = [(Filter::Flate, Params::default())];
+        let mut work = u64::MAX;
+        assert!(matches!(decode_tolerant_within(&chain, &data, 1000, &mut work), Err(FilterError::LimitExceeded(1000))));
+        assert_eq!(u64::MAX - work, data.len() as u64 + 1000);
+        // The later stage of two, which pays for the first as well.
+        let bomb = encode_flate(&data);
+        let two = [(Filter::Flate, Params::default()), (Filter::Flate, Params::default())];
+        let mut work = u64::MAX;
+        assert!(matches!(decode_tolerant_within(&two, &bomb, data.len(), &mut work), Err(FilterError::LimitExceeded(_))));
+        assert_eq!(u64::MAX - work, (bomb.len() + 2 * data.len()) as u64);
+        // Both limits at once: a run that can't go on is what a caller needs to hear.
+        let mut work = data.len() as u64 + 1000;
+        assert!(refused(&decode_tolerant_within(&chain, &data, 1000, &mut work).unwrap_err()));
+        assert_eq!(work, 0);
+        let mut work = data.len() as u64 + 1001;
+        assert!(matches!(decode_tolerant_within(&chain, &data, 1000, &mut work), Err(FilterError::LimitExceeded(1000))));
+        assert_eq!(work, 1, "the image's limit, with a step to spare");
+    }
+
+    /// What a damaged stream decoded is paid for, however the decode ends.
+    #[test]
+    fn a_chain_that_fails_has_paid_for_what_it_did() {
+        let data: Vec<u8> = (0..20_000u32).map(|i| (i % 97) as u8 ^ (i / 300) as u8).collect();
+        let mut cut = encode_flate(&data);
+        cut.truncate(cut.len() / 2);
+        let chain = [(Filter::Flate, Params::default())];
+        let (partial, _) = decode_tolerant(&chain, &cut, 1 << 20).unwrap();
+        assert!(!partial.is_empty());
+        let mut work = u64::MAX;
+        assert_eq!(decode_tolerant_within(&chain, &cut, 1 << 20, &mut work).unwrap(), partial);
+        assert_eq!(u64::MAX - work, (cut.len() + partial.len()) as u64);
+        // Read strictly it is an error, for the same work.
+        let mut work = u64::MAX;
+        assert!(matches!(decode_within(&chain, &cut, 1 << 20, &mut work), Err(FilterError::Corrupt { .. })));
+        assert_eq!(u64::MAX - work, (cut.len() + partial.len()) as u64);
+        let whole = encode_flate(&data);
+        let mut work = u64::MAX;
+        assert_eq!(decode_within(&chain, &whole, 1 << 20, &mut work).unwrap(), data);
+        assert_eq!(u64::MAX - work, (whole.len() + data.len()) as u64);
+        // A predictor that comes to nothing, after all of this was inflated for it.
+        let p = Params { predictor: 99, ..Params::default() };
+        let data = encode_flate(&vec![0; 1 << 16]);
+        let mut work = u64::MAX;
+        assert!(decode_tolerant_within(&[(Filter::Flate, p)], &data, 1 << 20, &mut work).unwrap().is_empty());
+        assert_eq!(u64::MAX - work, data.len() as u64 + (1 << 16));
+    }
+
+    /// A stream that reads as zlib only until it fails, and as raw deflate until that fails too,
+    /// gives back no data, and has still decoded everything the retry did.
+    #[test]
+    fn a_retry_that_fails_pays_for_what_it_decoded() {
+        // Stored as raw deflate: this many bytes, then a block of a reserved type. As zlib: the
+        // same reserved type at once, so the first reading fails with nothing.
+        let mut data = vec![0x78, 0x01, 0x06, 0xFE, 0xF9];
+        data.extend(vec![0u8; 0x0601]);
+        data.push(0x07);
+        let chain = [(Filter::Flate, Params::default())];
+        let (out, partial) = decode_tolerant(&chain, &data, 1 << 20).unwrap();
+        assert!(out.is_empty() && partial, "what is read stays as it was");
+        let (_, _, spent) = decode_tolerant_counted(&chain, &data, 1 << 20).unwrap();
+        assert_eq!(spent, 0x0601);
+        let (e, spent) = decode_counted(&chain, &data, 1 << 20).unwrap_err();
+        assert!(matches!(e, FilterError::Corrupt { .. }), "{e}");
+        assert_eq!(spent, 0x0601);
+        let mut work = u64::MAX;
+        assert!(decode_tolerant_within(&chain, &data, 1 << 20, &mut work).unwrap().is_empty());
+        assert_eq!(u64::MAX - work, (data.len() + 0x0601) as u64);
+        // Through a predictor, which would otherwise lose the count.
+        let p = Params { predictor: 12, columns: 4, ..Params::default() };
+        let (_, _, spent) = decode_tolerant_counted(&[(Filter::Flate, p)], &data, 1 << 20).unwrap();
+        assert_eq!(spent, 0x0601);
+    }
+
+    /// With nothing left nothing is read. What can't be decoded at all never costs anything, and
+    /// says so whatever is left. Without filters, what is read is the data.
+    #[test]
+    fn what_a_chain_is_shows_whatever_is_left() {
+        let flate = [(Filter::Flate, Params::default())];
+        let mut work = 0;
+        assert!(refused(&decode_tolerant_within(&flate, b"garbage", 1 << 20, &mut work).unwrap_err()));
+        let long = vec![(Filter::Flate, Params::default()); MAX_CHAIN + 1];
+        for chain in [vec![(Filter::Dct, Params::default())], vec![(Filter::Jbig2, Params::default())], long] {
+            for left in [0, 100] {
+                let mut work = left;
+                let e = decode_tolerant_within(&chain, b"data", 1 << 20, &mut work).unwrap_err();
+                assert!(matches!(e, FilterError::Unsupported(_)) && !refused(&e), "{e}");
+                assert_eq!(work, left);
+            }
+        }
+        let mut work = 100;
+        assert_eq!(decode_tolerant_within(&[], b"data", 4, &mut work).unwrap(), b"data");
+        assert_eq!(work, 96);
+        assert!(matches!(decode_tolerant_within(&[], b"data", 3, &mut work), Err(FilterError::LimitExceeded(3))));
+        assert_eq!(work, 92);
+        let mut work = 3;
+        assert!(refused(&decode_tolerant_within(&[], b"data", 4, &mut work).unwrap_err()));
+        assert_eq!(work, 0);
+    }
 }
diff --git a/crates/js/src/formcalc.rs b/crates/js/src/formcalc.rs
index 3e68ce081d..cfad619938 100644
--- a/crates/js/src/formcalc.rs
+++ b/crates/js/src/formcalc.rs
@@ -227,4 +227,22 @@ mod tests {
         assert_eq!(parse_num("12abc"), Some(12.0));
         assert_eq!(parse_num("abc"), None);
     }
+
+    /// A number prints to at most fifteen significant digits, so the binary noise of a value
+    /// with six digits before the point (279893.88 is 279893.880000000004656… as a double) stays
+    /// hidden, while small values keep their twelve decimals.
+    #[test]
+    fn num_text_prints_at_most_fifteen_significant_digits() {
+        assert_eq!(num_text(279_893.88), "279893.88");
+        assert_eq!(num_text(-279_893.88), "-279893.88");
+        assert_eq!(num_text(279_893.88 + 291_774.12 + 304_171.06 + 317_107.44 + 273_970.85), "1466917.35");
+        assert_eq!(num_text(1_000_000.0 / 3.0), "333333.333333333");
+        assert_eq!(num_text(1.0 / 3.0), "0.333333333333");
+        assert_eq!(num_text(0.3 - 0.1 - 0.2), "0", "noise below twelve decimals is zero");
+        // Past fifteen digits before the point no decimals are left, and the integer keeps its zeros.
+        assert_eq!(num_text(1e15 + 0.5), "1000000000000000");
+        assert_eq!(num_text(1e20), "100000000000000000000");
+        assert_eq!(num_text(-1e20), "-100000000000000000000");
+        assert_eq!(num_text(f64::MAX).len(), 309);
+    }
 }
diff --git a/crates/js/src/formcalc/value.rs b/crates/js/src/formcalc/value.rs
index 16705e67ec..5ea9d4c089 100644
--- a/crates/js/src/formcalc/value.rs
+++ b/crates/js/src/formcalc/value.rs
@@ -21,7 +21,11 @@ pub(super) enum Val {
     Sink,
 }
 
-/// A number as FormCalc prints it: integers without a fraction, otherwise up to 15 digits.
+/// A number as FormCalc prints it: integers without a fraction, otherwise to at most 12
+/// decimals and 15 significant digits, without trailing zeros. 15 digits is the most a double
+/// holds for every value, so a value typed with up to 15 digits prints back as typed
+/// (`279893.88 * 1` is `279893.88`, not `279893.880000000005`), and the binary noise past
+/// them never shows. The 12 decimals hide noise left by sums that should be zero.
 pub(super) fn num_text(n: f64) -> String {
     if !n.is_finite() {
         return if n.is_nan() {
@@ -35,8 +39,12 @@ pub(super) fn num_text(n: f64) -> String {
     if n.fract() == 0.0 && n.abs() < 1e15 {
         return format!("{}", n as i64);
     }
-    let s = format!("{n:.12}");
-    let s = s.trim_end_matches('0').trim_end_matches('.');
+    // Digits before the point (at most 309 for a finite double); 1 for |n| < 1.
+    let int_digits = format!("{:.0}", n.abs().trunc()).len();
+    let decimals = 15usize.saturating_sub(int_digits).min(12);
+    let s = format!("{n:.decimals$}");
+    // Only a fraction loses its trailing zeros: with no decimals left they belong to the integer.
+    let s = if s.contains('.') { s.trim_end_matches('0').trim_end_matches('.') } else { s.as_str() };
     if s.is_empty() || s == "-0" { "0".into() } else { s.to_string() }
 }
 
diff --git a/crates/js/src/tests.rs b/crates/js/src/tests.rs
index 2d3877efe3..b61649b729 100644
--- a/crates/js/src/tests.rs
+++ b/crates/js/src/tests.rs
@@ -1026,6 +1026,20 @@ mod formcalc {
         assert_eq!(calc(r#"Format("9.9", -1.5)"#), "-1.5");
     }
 
+    /// A calculated amount shows the number it is, not the binary noise past a double's 15
+    /// significant digits: 279893.88 is stored as 279893.880000000004656…, which twelve fixed
+    /// decimals printed as `279893.880000000005`. Small values keep their twelve decimals.
+    #[test]
+    fn calculated_numbers_print_at_most_fifteen_significant_digits() {
+        assert_eq!(calc("1 * 279893.88"), "279893.88");
+        assert_eq!(calc("1 * 291774.12"), "291774.12");
+        assert_eq!(calc("279893.88 + 291774.12 + 304171.06 + 317107.44 + 273970.85"), "1466917.35");
+        assert_eq!(calc("1000000 / 3"), "333333.333333333");
+        assert_eq!(calc("1000 / 3"), "333.333333333333");
+        assert_eq!(calc("1 / 3"), "0.333333333333");
+        assert_eq!(calc("0.1 + 0.2"), "0.3");
+    }
+
     /// Assigning one long value to many fields at once stops at the run's byte budget and is
     /// charged per copy, and a reset list names each field once.
     #[test]
diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index 9f96b17218..2a6c664e6a 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -28,10 +28,11 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   If a use can't be
   measured (forms nested deeper, or drawn too many times), no image is resampled. Colour and grayscale images above a
   threshold are resampled with a bicubic (Catmull-Rom) filter to a target resolution and
-  stored as JPEG (Acrobat's quality steps) or ZIP; soft masks are resampled with their image.
+  stored as JPEG (Acrobat's quality steps) or ZIP; soft masks are resampled with their image. A
+  stencil `/Mask` has its own resolution, so the picture changes under it and it stays as it is.
   An image is replaced only if the result is smaller. Left alone by these colour and grey
-  settings: CMYK and other colour spaces, image masks, decode arrays, more than 8 bits, JPEG 2000,
-  JBIG2 and CCITT (black-and-white images, CCITT among them, are below). A JPEG is read with
+  settings: CMYK and other colour spaces, image masks, colour-key masks, decode arrays, more than 8 bits, JPEG 2000,
+  JBIG2 and CCITT (black-and-white images, CCITT and JBIG2 among them, are below). A JPEG is read with
   its colour transform (an Adobe marker's, else `/ColorTransform`, ISO 32000-2 §7.4.8), so one
   stored untransformed keeps its colours; one whose marker and `/ColorTransform` disagree is left
   alone, since readers differ on which wins. Samples are read with `/DecodeParms` given by
@@ -40,7 +41,7 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
 - **Monochrome images** (`Settings::mono`, `MonoSettings::REDUCE` by default: to 300 ppi above
   450 ppi, CCITT Group 4). Black-and-white images are a 1-bit image with one colour component
   (grey, indexed, a separation) or an image mask, stored with no filter, with general-purpose ones
-  or with CCITT fax after any of those (decoded by `Document::decoded_image_within`, no further
+  or with CCITT fax or JBIG2 after any of those (decoded by `Document::decoded_image_within`, no further
   than its rows can need; byte-aligned Group 3 with end-of-line codes but none before the first
   row, not as T.4 sends them, is read as PdfCraft draws it, which at `/K 0` may be other rows than
   were coded, and an image stored again keeps them). Packed to one bit first, unless a colour-key `/Mask` is in the image's
@@ -59,24 +60,38 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   downsampling it to JPEG.
   - **Downsampling:** one whose effective resolution is above `above_ppi` is averaged down to
     `target_ppi`: each new pixel takes the sample covering more of its area, and the dark one on a
-    tie, so a dark line half a new pixel wide stays: black in grey and the painted part of an image
-    mask (a 0, or a 1 with an inverting decode array), full ink in a separation (a 1, or a 0), and
-    entry 0 of an indexed image, whatever colour its palette gives it (the palette isn't read yet).
-    Not one with a soft mask, whose own size would have to follow; not a halftone or a dither,
-    most of whose new pixels would cover both black and white, so that taking the sample covering
-    more would turn its tones solid (a 50% screen black, a 25% one white); and not one wider than
-    a fax row (`pdfcraft_filters::MAX_CCITT_COLUMNS`), as the averaging keeps a counter for each
-    column. On a 600 ppi text page, Group 4 at 300 ppi is half the size.
+    tie, so a dark line half a new pixel wide stays: black in grey, the painted part of an image
+    mask (a 0, or a 1 with an inverting decode array), and the darker of an indexed image's two
+    palette entries. Only images whose dark sample is known so are averaged: `DeviceGray` (grey and
+    RGB packed to one bit among them), image masks, and indexed images over `DeviceGray` or
+    `DeviceRGB`, whose palette is read (Rec. 601 luma for RGB; a table of at most 4 KiB), with no
+    decode array or one of two different numbers, and not drawn or listed where `/DefaultGray` or
+    `/DefaultRGB` is or may be in force (an indexed image referred to from beyond the page and form
+    resources read, as an annotation's appearance, may be). Not one with a colour key, which can
+    hide the dark sample a tie would go to. Not a separation or a DeviceN, whose tint transform isn't read, calibrated or ICC
+    grey, or an indexed image over another base or whose two entries look alike. Not one with a soft mask, whose own size would have to
+    follow; not a halftone or a dither, most of whose new pixels would cover both black and white,
+    so that taking the sample covering more would turn its tones solid (a 50% screen black, a 25%
+    one white), nor one with a square of four new pixels that each would, as a small screened
+    picture on a white page has: ragged scanned text has such squares along its strokes too, and
+    is then left at its resolution. And not one wider than a fax row
+    (`pdfcraft_filters::MAX_CCITT_COLUMNS`), as the averaging keeps a counter for each column. On a
+    600 ppi page of text that is averaged, Group 4 at 300 ppi is about half the size.
   - **Compression:** CCITT Group 4 (`pdfcraft_filters::encode_g4`), or 1-bit Flate when that is
     smaller, which only a resampled image or one packed from more bits may be: a 1-bit image that
-    is only stored again becomes Group 4 or stays. Group 4 alone is only decoded to be resampled;
+    is only stored again becomes Group 4 or stays. Group 4 alone is only decoded to be resampled, and so is JBIG2 alone when Group 4 is asked for;
     Group 3, or Group 4 inside another filter such as `ASCII85Decode`, is stored again as Group 4
     alone when that is smaller. Damaged Group 3 with end-of-line codes is stored as the decoder
     recovers it, a bad row picked up again at the next code, as it reports no damage there; without
-    them, damage stops the decoding and the image is left alone. With Retain, a resampled image
-    keeps its kind of compression (CCITT, or Flate) and nothing else changes; an image of more bits
-    is then left to the grey or colour settings. Every change is kept only when it is smaller as
-    stored.
+    them, damage stops the decoding and the image is left alone. JBIG2 inside another filter, or
+    alone when JBIG2 is asked for, is stored again as the compression asks when that is smaller (as JBIG2 symbols where
+    its own coding is a generic region, say); a symbol-coded scan, averaged, loses its exact
+    repeats and often comes out larger, and then stays as it is. A JBIG2 image stored again refers to no
+    `/JBIG2Globals`, and one whose page isn't its size (PdfCraft's
+    renderer draws the whole page into the image) is left alone. With Retain, a resampled image
+    keeps its kind of compression (CCITT, JBIG2, or Flate) and nothing else changes; an image of
+    more bits is then left to the grey or colour settings. Every change is kept only when it is
+    smaller as stored.
   - Apart from the downsampling it is lossless: the samples keep their meaning, so the colour
     space, decode array and `/Mask` stay, but for packed RGB, which becomes grey with one decode
     pair. Group 4 wins on scans, whose ragged edges defeat Flate; on clean computer-drawn 1-bit
@@ -85,14 +100,20 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
     samples.
 
   - Lossless JBIG2 uses bounded generic-region encoding or exact-copy symbol dictionaries when
-    smaller. No lossy symbol substitution is used. Export reads embedded images and bounded
-    shared globals.
+    smaller. No lossy symbol substitution is used. Export, redaction and this step read JBIG2
+    images, with bounded shared globals. All of a run's images share one allowance of decoding
+    (`pdfcraft_cos::ImageBudget`), filters, decoders and pixels alike, JPEG samples and merged
+    pictures too: about
+    1,000 scanned pages' worth, plus more for each byte of the file, enough to decode a stream
+    about 8 times at Flate's best. Images past it stay as they are, and `Report::images_refused`
+    counts those the image step read. Streams it only stores with Flate (below) aren't counted.
 - **Discard objects:** thumbnails, alternate images, document tags, print settings.
 - **Clean up:** Flate for streams with no filter; for streams with an outer ASCII85 or ASCIIHex
   layer, that layer is removed when the result is smaller (the inner filters keep their encoded
   bytes; streams with `/DecodeParms`, images and object streams keep their ASCII layer. LZW-compressed
   streams, content and images alike, are decoded and stored with Flate instead (Acrobat's "In
-  streams that use LZW encoding, use Flate instead"): a predictor carries over to Flate without
+  streams that use LZW encoding, use Flate instead"), from the run's allowance, past which they
+  stay LZW: a predictor carries over to Flate without
   `EarlyChange`, filters applied before the LZW one go with it and those after it keep their
   bytes. A stream whose LZW data doesn't decode cleanly is left as it is. Not yet: inline images.
 
diff --git a/crates/optimize/src/fragments.rs b/crates/optimize/src/fragments.rs
index c069de2f95..f74b091984 100644
--- a/crates/optimize/src/fragments.rs
+++ b/crates/optimize/src/fragments.rs
@@ -18,7 +18,7 @@
 //! drops them.
 
 use pdfcraft_content::{Matrix, Op, parse, serialize_ops};
-use pdfcraft_cos::{DecodeBudget, Dict, Document, ObjRef, Object, Stream};
+use pdfcraft_cos::{DecodeBudget, Dict, Document, ImageBudget, ObjRef, Object, Stream};
 
 use crate::images::{components, content_bytes, decodable, page_resources, pixels, resample};
 use crate::{OptimizeError, Report, Stage};
@@ -152,7 +152,7 @@ fn run_end(ops: &[Op], i: usize, count: usize) -> usize {
 }
 
 /// The run's pixels as one image, top row first: `(pixels, width, height)`.
-fn merge(doc: &Document, run: &[Fragment], n: usize) -> Option<(Vec<u8>, u32, u32)> {
+fn merge(doc: &Document, run: &[Fragment], n: usize, budget: &mut ImageBudget) -> Option<(Vec<u8>, u32, u32)> {
     let (top, bottom) = (run.first()?.rect[3], run.last()?.rect[1]);
     let width = run.iter().map(|f| f.width).max()?;
     // Pixel rows per unit of height: the finest fragment's.
@@ -167,7 +167,12 @@ fn merge(doc: &Document, run: &[Fragment], n: usize) -> Option<(Vec<u8>, u32, u3
         return None;
     }
     let row = (width as usize).checked_mul(n)?;
-    let mut out = vec![255u8; row.checked_mul(height as usize)?];
+    // What this builds isn't what its strips cost to read: four small ones can ask for all of it.
+    let bytes = row.checked_mul(height as usize)?;
+    if !budget.pay_pixels(u64::try_from(bytes).ok()?) {
+        return None;
+    }
+    let mut out = vec![255u8; bytes];
     for f in run {
         let r0 = (((top - f.rect[3]) * density).round().max(0.0) as u32).min(height);
         let r1 = (((top - f.rect[1]) * density).round().max(0.0) as u32).min(height);
@@ -176,7 +181,7 @@ fn merge(doc: &Document, run: &[Fragment], n: usize) -> Option<(Vec<u8>, u32, u3
         }
         let obj = doc.get(f.image);
         let Object::Stream(s) = &*obj else { return None };
-        let px = pixels(doc, s, n)?;
+        let px = pixels(doc, s, n, budget)?;
         let px = if (f.width, f.height) == (width, r1 - r0) { px } else { resample(&px, n, f.width, f.height, width, r1 - r0)? };
         out.get_mut(r0 as usize * row..r1 as usize * row)?.copy_from_slice(px.get(..(r1 - r0) as usize * row)?);
     }
@@ -230,7 +235,13 @@ fn add_xobject(doc: &mut Document, page: ObjRef, name: &[u8], image: ObjRef) ->
 }
 
 /// Merge the fragment runs of one page; returns how many fragments were merged.
-fn merge_page(doc: &mut Document, page: ObjRef, report: &mut Report, progress: &mut dyn FnMut(Stage) -> bool) -> Result<usize, OptimizeError> {
+fn merge_page(
+    doc: &mut Document,
+    page: ObjRef,
+    report: &mut Report,
+    progress: &mut dyn FnMut(Stage) -> bool,
+    images: &mut ImageBudget,
+) -> Result<usize, OptimizeError> {
     let Some(contents) = doc.get(page).as_dict().and_then(|d| d.get(b"Contents").cloned()) else { return Ok(0) };
     // A page whose content isn't all known is left alone: rewriting it would drop the rest.
     let Some(data) = content_bytes(doc, &contents, &mut DecodeBudget::page()) else { return Ok(0) };
@@ -286,7 +297,7 @@ fn merge_page(doc: &mut Document, page: ObjRef, report: &mut Report, progress: &
         if !progress(Stage::Fragments) {
             return Err(OptimizeError::Cancelled);
         }
-        let Some((px, w, h)) = merge(doc, &run, n) else {
+        let Some((px, w, h)) = merge(doc, &run, n, images) else {
             out.extend(ops.get(i..j).unwrap_or_default().iter().cloned());
             i = j;
             continue;
@@ -320,9 +331,15 @@ fn merge_page(doc: &mut Document, page: ObjRef, report: &mut Report, progress: &
     Ok(merged)
 }
 
-pub(crate) fn run(doc: &mut Document, pages: &[ObjRef], report: &mut Report, progress: &mut dyn FnMut(Stage) -> bool) -> Result<(), OptimizeError> {
+pub(crate) fn run(
+    doc: &mut Document,
+    pages: &[ObjRef],
+    report: &mut Report,
+    progress: &mut dyn FnMut(Stage) -> bool,
+    budget: &mut ImageBudget,
+) -> Result<(), OptimizeError> {
     for p in pages {
-        report.fragments_merged += merge_page(doc, *p, report, progress)?;
+        report.fragments_merged += merge_page(doc, *p, report, progress, budget)?;
     }
     Ok(())
 }
@@ -343,7 +360,49 @@ mod tests {
             Fragment { image, rect: [0.0, edge, 1.0, 1.0], width: 1 << 16, height: 1 },
             Fragment { image, rect: [0.0, 0.0, 1.0, edge], width: 1 << 16, height: 1 },
         ];
-        assert!(merge(&Document::new_empty(), &run, 3).is_none());
+        assert!(merge(&Document::new_empty(), &run, 3, &mut ImageBudget::with_work(u64::MAX)).is_none());
+    }
+
+    /// Merging reads the images the pass after it reads, from the same allowance: with nothing
+    /// left the strips stay as they are, and the budget shows the read it refused.
+    #[test]
+    fn merging_spends_the_runs_allowance() {
+        let mut doc = Document::new_empty();
+        let mut image = Dict::new();
+        for (k, v) in
+            [("Subtype", Object::name("Image")), ("Width", Object::Int(8)), ("Height", Object::Int(1)), ("BitsPerComponent", Object::Int(8))]
+        {
+            image.set(k.as_bytes().to_vec(), v);
+        }
+        image.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+        let (mut xobjects, mut drawn, mut raw) = (Dict::new(), String::new(), 0);
+        for row in 0..8 {
+            let strip = Stream::flate(image.clone(), &[row * 30; 8]);
+            raw += strip.raw.len() as u64;
+            let r = doc.add(Object::Stream(strip));
+            xobjects.set(format!("I{row}").into_bytes(), Object::Ref(r));
+            drawn.push_str(&format!("q 80 0 0 10 0 {} cm /I{row} Do Q\n", 70 - 10 * i32::from(row)));
+        }
+        let content = doc.add(Object::Stream(Stream::flate(Dict::new(), drawn.as_bytes())));
+        let mut resources = Dict::new();
+        resources.set(b"XObject".to_vec(), Object::Dict(xobjects));
+        let mut page = Dict::new();
+        page.set(b"Type".to_vec(), Object::name("Page"));
+        page.set(b"Resources".to_vec(), Object::Dict(resources));
+        page.set(b"Contents".to_vec(), Object::Ref(content));
+        let page = doc.add(Object::Dict(page));
+        let mut budget = ImageBudget::with_work(0);
+        assert_eq!(merge_page(&mut doc.clone(), page, &mut Report::default(), &mut |_| true, &mut budget).unwrap(), 0);
+        assert_eq!(budget.refused(), 1);
+        // Reading each strip, and building the picture of 8 rows of 8 they make.
+        let cost = raw + 8 * (8 + 8) + 8 * 8;
+        let mut budget = ImageBudget::with_work(u64::MAX);
+        assert_eq!(merge_page(&mut doc.clone(), page, &mut Report::default(), &mut |_| true, &mut budget).unwrap(), 8);
+        assert_eq!(u64::MAX - budget.work_left(), cost);
+        // Enough for the strips and not for the picture: nothing is built.
+        let mut budget = ImageBudget::with_work(cost - 1);
+        assert_eq!(merge_page(&mut doc, page, &mut Report::default(), &mut |_| true, &mut budget).unwrap(), 0);
+        assert_eq!(budget.refused(), 1);
     }
 
     /// Many images drawn on top of each other are not one picture; looking for runs among them reads
@@ -370,7 +429,7 @@ mod tests {
         page.set(b"Resources".to_vec(), Object::Dict(resources));
         let page = doc.add(Object::Dict(page));
         GROUP_READS.with(|c| c.set(0));
-        let merged = merge_page(&mut doc, page, &mut Report::default(), &mut |_| true);
+        let merged = merge_page(&mut doc, page, &mut Report::default(), &mut |_| true, &mut ImageBudget::with_work(u64::MAX));
         assert_eq!(merged.ok(), Some(0));
         let reads = GROUP_READS.with(|c| c.get());
         assert!(reads <= 40 * 4 * groups, "{reads} group reads");
diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index 9338061978..efff394a6f 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -1,9 +1,10 @@
 //! Image resampling and recompression.
 
 use std::collections::{HashMap, HashSet};
+use std::sync::Arc;
 
 use pdfcraft_content::{Matrix, Pieces};
-use pdfcraft_cos::{DecodeBudget, Dict, Document, ObjRef, Object, Stream};
+use pdfcraft_cos::{DecodeBudget, Dict, Document, ImageBudget, ObjRef, Object, Stream};
 
 use crate::{Compression, ImageSettings, MonoCompression, MonoSettings, OptimizeError, Report, Settings, Stage};
 
@@ -300,6 +301,19 @@ fn device_rgb(doc: &Document, r: ObjRef) -> bool {
         && cs.as_deref().and_then(Object::as_name).is_some_and(|n| matches!(n, b"DeviceRGB" | b"RGB"))
 }
 
+/// Whether image `r` is indexed: its palette says which of its samples is dark ([`dark_is_one`]),
+/// which default colour spaces in force where it is drawn may change.
+fn indexed(doc: &Document, r: ObjRef) -> bool {
+    let Object::Stream(s) = &*doc.get(r) else { return false };
+    let cs = s.dict.get(b"ColorSpace").map(|cs| doc.resolve(cs));
+    matches!(cs.as_deref(), Some(Object::Array(a)) if matches!(family(doc, a).as_deref().and_then(Object::as_name), Some(b"Indexed")))
+}
+
+/// The first entry of colour space array `a`, its family, read through a reference.
+fn family(doc: &Document, a: &[Object]) -> Option<Arc<Object>> {
+    a.first().map(|f| doc.resolve(f))
+}
+
 /// Call `f` with every reference in `o`, a dictionary's or array's included, a stream's dictionary
 /// too, but not those in objects referred to.
 fn each_ref(o: &Object, mut f: impl FnMut(ObjRef)) {
@@ -449,7 +463,7 @@ fn is_dct(s: &Stream) -> Option<bool> {
 
 #[cfg(test)]
 thread_local! {
-    /// Pixels decoded from JPEG data, for the test that keeps a mismatched JPEG from decoding.
+    /// Pixels decoded, for the tests that keep an image from being decoded for nothing.
     static DECODED_PIXELS: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
 }
 
@@ -465,7 +479,7 @@ fn count_decoded(_n: u64) {
 /// every row, and the image would be written back wrong. `None` for a JPEG whose colour transform
 /// readers may disagree about ([`ycc_encoded`]), and for data that decodes past what the samples
 /// can need ([`allowance`]).
-pub(crate) fn pixels(doc: &Document, s: &Stream, n: usize) -> Option<Vec<u8>> {
+pub(crate) fn pixels(doc: &Document, s: &Stream, n: usize, budget: &mut ImageBudget) -> Option<Vec<u8>> {
     let (w, h) = (u32::try_from(s.dict.int(b"Width")?).ok()?, u32::try_from(s.dict.int(b"Height")?).ok()?);
     if w == 0 || h == 0 || u64::from(w) * u64::from(h) > MAX_PIXELS {
         return None;
@@ -476,11 +490,14 @@ pub(crate) fn pixels(doc: &Document, s: &Stream, n: usize) -> Option<Vec<u8>> {
         // never get here: the colour space check excludes them. The JPEG's own size must be the
         // dictionary's: `jpeg_samples` refuses another from its header, before any pixels.
         let ycc = n == 3 && ycc_encoded(doc, s)?;
+        if !budget.pay_jpeg(u64::try_from(bytes).ok()?, &s.raw) {
+            return None;
+        }
         let v = jpeg_samples(&s.raw, usize::try_from(w).ok()?, usize::try_from(h).ok()?, n, ycc)?;
         count_decoded(u64::from(w) * u64::from(h));
         (v.len() == bytes).then_some(v)
     } else {
-        let v = doc.with_direct_parms(s).decoded_within(allowance(bytes, h)?).ok()?;
+        let v = budget.decode_filters(doc, s, allowance(bytes, h)?).ok()?;
         Some(v.get(..bytes)?.to_vec())
     }
 }
@@ -618,13 +635,29 @@ fn jpeg_samples(data: &[u8], w: usize, h: usize, n: usize, ycc: bool) -> Option<
 }
 
 pub(crate) fn resample(px: &[u8], n: usize, w: u32, h: u32, nw: u32, nh: u32) -> Option<Vec<u8>> {
-    use image::imageops::{FilterType, resize};
     Some(match n {
-        1 => resize(&image::GrayImage::from_raw(w, h, px.to_vec())?, nw, nh, FilterType::CatmullRom).into_raw(),
-        _ => resize(&image::RgbImage::from_raw(w, h, px.to_vec())?, nw, nh, FilterType::CatmullRom).into_raw(),
+        1 => scaled(&image::GrayImage::from_raw(w, h, px.to_vec())?, nw, nh).into_raw(),
+        _ => scaled(&image::RgbImage::from_raw(w, h, px.to_vec())?, nw, nh).into_raw(),
     })
 }
 
+/// `img` scaled to `w` × `h`. Scaling goes down first, through a buffer of `img`'s width by `h` at
+/// 16 bytes a pixel, which a soft mask of other proportions than its image can make larger than
+/// any machine: 1,000,000 × 1 resampled to 4 × 100,000 asks for 1.6 TB, and that aborts the
+/// process. Such a one is scaled across first, which holds no more pixels than one of the two has.
+/// Past a quarter over the larger of them, so that rounding leaves a picture of the same shape as
+/// it was.
+fn scaled<P: image::Pixel<Subpixel = u8> + 'static>(img: &image::ImageBuffer<P, Vec<u8>>, w: u32, h: u32) -> image::ImageBuffer<P, Vec<u8>> {
+    use image::imageops::{FilterType, resize};
+    let (iw, ih) = (u64::from(img.width()), u64::from(img.height()));
+    let largest = (iw * ih).max(u64::from(w) * u64::from(h));
+    if (iw * u64::from(h)).saturating_mul(4) > largest.saturating_mul(5) {
+        resize(&resize(img, w, img.height(), FilterType::CatmullRom), w, h, FilterType::CatmullRom)
+    } else {
+        resize(img, w, h, FilterType::CatmullRom)
+    }
+}
+
 fn jpeg(px: &[u8], n: usize, w: u32, h: u32, quality: u8) -> Option<Vec<u8>> {
     let mut out = Vec::new();
     let mut enc = image::codecs::jpeg::JpegEncoder::new_with_quality(&mut out, quality.clamp(1, 100));
@@ -684,12 +717,27 @@ fn image_stream(old: &Dict, px: &[u8], n: usize, w: u32, h: u32, compression: Co
     }
 }
 
+/// Whether a `/Mask` value is a stencil mask: an image that says `/ImageMask true`.
+fn is_stencil(doc: &Document, mask: &Object) -> bool {
+    matches!(&*doc.resolve(mask), Object::Stream(s) if matches!(s.dict.get(b"ImageMask"), Some(Object::Bool(true))))
+}
+
 /// One image: resample and/or recompress per `settings`; `ppi` is its effective resolution.
 /// Returns the new image and its new soft mask, if the result is smaller.
-fn process(doc: &Document, s: &Stream, ppi: f64, settings: &ImageSettings, n: usize) -> Option<(Stream, Option<(ObjRef, Stream)>)> {
+fn process(
+    doc: &Document,
+    s: &Stream,
+    ppi: f64,
+    settings: &ImageSettings,
+    n: usize,
+    budget: &mut ImageBudget,
+) -> Option<(Stream, Option<(ObjRef, Stream)>)> {
     let d = &s.dict;
+    // A colour-key mask names sample values, which resampling and JPEG would change. A stencil mask
+    // is an image of its own, with its own resolution (ISO 32000-2 §8.9.6.3): the picture can change
+    // under it and its edges stay as they are.
     if d.get(b"Decode").is_some_and(|a| !is_identity_decode(doc, a, n))
-        || d.contains(b"Mask")
+        || d.get(b"Mask").is_some_and(|m| !is_stencil(doc, m))
         || d.name(b"ImageMask").is_some()
         || matches!(d.get(b"ImageMask"), Some(Object::Bool(true)))
     {
@@ -718,7 +766,7 @@ fn process(doc: &Document, s: &Stream, ppi: f64, settings: &ImageSettings, n: us
     } else {
         (w, h)
     };
-    let px = pixels(doc, s, n)?;
+    let px = pixels(doc, s, n, budget)?;
     let px = if (nw, nh) != (w, h) { resample(&px, n, w, h, nw, nh)? } else { px };
     let new = image_stream(d, &px, n, nw, nh, settings.compression, was_dct)?;
     // A soft mask must keep the image's dimensions: resample it with the image (lossless).
@@ -731,7 +779,7 @@ fn process(doc: &Document, s: &Stream, ppi: f64, settings: &ImageSettings, n: us
                 return None;
             }
             let (mw, mh) = (u32::try_from(m.dict.int(b"Width")?).ok()?, u32::try_from(m.dict.int(b"Height")?).ok()?);
-            let mpx = pixels(doc, m, 1)?;
+            let mpx = pixels(doc, m, 1, budget)?;
             let mpx = resample(&mpx, 1, mw, mh, nw, nh)?;
             smask = Some((mr, image_stream(&m.dict, &mpx, 1, nw, nh, Compression::Flate, false)?));
         }
@@ -754,7 +802,7 @@ fn one_component(doc: &Document, cs: &Object) -> bool {
     let cs = doc.resolve(cs);
     match &*cs {
         Object::Name(n) => matches!(n.as_slice(), b"DeviceGray" | b"G"),
-        Object::Array(a) => match a.first().and_then(Object::as_name) {
+        Object::Array(a) => match family(doc, a).as_deref().and_then(Object::as_name) {
             Some(b"CalGray" | b"Separation" | b"Indexed" | b"I") => true,
             Some(b"ICCBased") => a.get(1).is_some_and(|icc| matches!(&*doc.resolve(icc), Object::Stream(s) if s.dict.int(b"N") == Some(1))),
             Some(b"DeviceN") => a.get(1).is_some_and(|names| doc.resolve(names).as_array().is_some_and(|n| n.len() == 1)),
@@ -771,7 +819,7 @@ type Pixel = fn(&[u8]) -> Option<bool>;
 /// with its width and height, and, when they were packed from more bits, its dictionary as a 1-bit
 /// image. These count:
 /// - one bit per pixel in one colour component, or an image mask, stored with no filter, with
-///   general-purpose ones, or with CCITT fax last ([`Document::decoded_image_within`], no further
+///   general-purpose ones, or with CCITT fax or JBIG2 last ([`ImageBudget::decode`], no further
 ///   than its rows can need);
 /// - with `pack`, and with no colour-key `/Mask` (its ranges are in the image's own values):
 ///   - eight-bit grey (one component, not indexed) whose every sample is 0 or 255. A decode array
@@ -785,7 +833,7 @@ type Pixel = fn(&[u8]) -> Option<bool>;
 ///   - an indexed image of 2, 4 or 8 bits that uses only palette entries 0 and 1, which stay 0 and
 ///     1 at one bit, whatever their colours, so the colour space stays. A decode array other than
 ///     the default stops it: in index units it would mean something else at one bit.
-fn one_bit(doc: &Document, s: &Stream, pack: bool, defaults: bool) -> Option<(Vec<u8>, u32, u32, Option<Dict>)> {
+fn one_bit(doc: &Document, s: &Stream, pack: bool, defaults: bool, budget: &mut ImageBudget) -> Option<(Vec<u8>, u32, u32, Option<Dict>)> {
     let d = &s.dict;
     // Through u32 first, as everywhere here, so the product can't overflow.
     let (w, h) = (u32::try_from(d.int(b"Width")?).ok()?, u32::try_from(d.int(b"Height")?).ok()?);
@@ -802,9 +850,11 @@ fn one_bit(doc: &Document, s: &Stream, pack: bool, defaults: bool) -> Option<(Ve
         let len = stride.checked_mul(hu)?;
         let max = match s.filters().last() {
             Some((pdfcraft_filters::Filter::CcittFax, _)) => wu.checked_mul(hu)?.checked_add(hu.checked_mul(4)?)?.checked_add(4096)?,
+            // A JBIG2 page, which has to be the image's size, is `len` bytes as rows of a bit.
             _ => allowance(len, h)?,
         };
-        let mut data = doc.decoded_image_within(s, max).ok()?;
+        count_decoded(u64::from(w) * u64::from(h));
+        let mut data = budget.decode(doc, s, max).ok()?;
         if data.len() < len {
             return None;
         }
@@ -827,7 +877,7 @@ fn one_bit(doc: &Document, s: &Stream, pack: bool, defaults: bool) -> Option<(Ve
     packed.set(b"BitsPerComponent".to_vec(), Object::Int(1));
     // Components a pixel, bits a component, and a pixel's samples as 1 or 0.
     let (n, bpc, white): (usize, usize, Pixel) = match &*doc.resolve(cs) {
-        Object::Array(a) if matches!(a.first().and_then(Object::as_name), Some(b"Indexed" | b"I")) => {
+        Object::Array(a) if matches!(family(doc, a).as_deref().and_then(Object::as_name), Some(b"Indexed" | b"I")) => {
             let bpc = bits.filter(|b| matches!(b, 2 | 4 | 8))?;
             match decode.as_deref() {
                 None => {}
@@ -872,7 +922,7 @@ fn one_bit(doc: &Document, s: &Stream, pack: bool, defaults: bool) -> Option<(Ve
     let row_len = wu.checked_mul(n)?.checked_mul(bpc)?.div_ceil(8);
     // Through its parameters given by reference too: without a PNG predictor's tag bytes taken
     // off, rows of 0 and 255 (or palette entries 0 and 1) would still pass below, each shifted.
-    let samples = doc.with_direct_parms(s).decoded_within(allowance(row_len.checked_mul(hu)?, h)?).ok()?;
+    let samples = budget.decode_filters(doc, s, allowance(row_len.checked_mul(hu)?, h)?).ok()?;
     Some((packed_rows(&samples, row_len, wu, hu, (n, bpc, white))?, w, h, Some(packed)))
 }
 
@@ -908,8 +958,12 @@ fn packed_rows(samples: &[u8], row_len: usize, w: usize, h: usize, (n, bpc, whit
     Some(out)
 }
 
-/// Resolve polarity only for explicitly understood samples. Indexed palettes and custom
-/// colour spaces stay at their original resolution rather than guessing which entry is dark.
+/// Whether sample 1 is the dark one of the 1-bit image `d` describes, after its decode array
+/// (`[0 1]` when it has none; another must be two different numbers): black in grey is a 0, and so
+/// is the painted part of an image mask. An indexed image's samples pick palette entries (its
+/// decode array maps them to entries, rounded and clipped to the table, ISO 32000-2 §8.9.5.2), and
+/// the palette says which is darker ([`lightness`]). `None` for anything else: separations and
+/// DeviceN, whose tint transforms aren't read, other colour spaces, and two entries alike.
 fn dark_is_one(doc: &Document, d: &Dict) -> Option<bool> {
     let number = |v: Option<&Object>| v.and_then(|v| doc.resolve(v).as_f64()).filter(|v| v.is_finite());
     let (d0, d1) = match d.get(b"Decode").map(|v| doc.resolve(v)).as_deref() {
@@ -923,12 +977,62 @@ fn dark_is_one(doc: &Document, d: &Dict) -> Option<bool> {
     if matches!(d.get(b"ImageMask"), Some(Object::Bool(true))) {
         return Some(d1 < d0);
     }
+    // A colour key can hide the dark sample, and a tie going to it would lose a thin rule of the
+    // sample that shows.
+    if matches!(d.get(b"Mask").map(|m| doc.resolve(m)).as_deref(), Some(Object::Array(_))) {
+        return None;
+    }
     match d.get(b"ColorSpace").map(|cs| doc.resolve(cs)).as_deref() {
         Some(Object::Name(n)) if matches!(n.as_slice(), b"DeviceGray" | b"G") => Some(d1 < d0),
+        Some(Object::Array(a)) if matches!(family(doc, a).as_deref().and_then(Object::as_name), Some(b"Indexed")) => {
+            let hival = a.get(2).and_then(|v| match &*doc.resolve(v) {
+                Object::Int(h) if (0..=255).contains(h) => Some(*h),
+                _ => None,
+            })?;
+            // `hival` is 0 to 255, and the rounded value is clipped to it: the cast can't wrap.
+            let entry = |v: f64| v.round().clamp(0.0, hival as f64) as usize;
+            let (l0, l1) = (lightness(doc, a, entry(d0))?, lightness(doc, a, entry(d1))?);
+            (l0 != l1).then_some(l1 < l0)
+        }
         _ => None,
     }
 }
 
+/// The most bytes a palette is read to (see [`lightness`]).
+const MAX_PALETTE: usize = 4096;
+
+/// How light entry `i` of the palette of indexed colour space `a` (`[/Indexed base hival lookup]`)
+/// is, from 0 (black) to 255,000 (white): its grey, or its luma (Rec. 601) over `DeviceRGB`. Only
+/// those two bases count, where the palette's values are the colour: under `/DefaultGray` or
+/// `/DefaultRGB` they aren't, and the caller asks for no polarity there; `None` for another base
+/// (calibrated, CMYK, an ICC profile, a resource name), and for an entry the table doesn't hold.
+fn lightness(doc: &Document, a: &[Object], i: usize) -> Option<u32> {
+    // A device space is its name, or that name alone in an array.
+    let base = doc.resolve(a.get(1)?);
+    let base = match &*base {
+        Object::Array(b) if b.len() == 1 => doc.resolve(b.first()?),
+        _ => base,
+    };
+    let n = match base.as_name()? {
+        b"DeviceGray" => 1,
+        b"DeviceRGB" => 3,
+        _ => return None,
+    };
+    // At most 256 entries of three components: more is no palette. Images share a table, and this
+    // is read for each of them, so a large one is refused before it's copied or decoded.
+    let table = match &*doc.resolve(a.get(3)?) {
+        Object::String(s) if s.bytes.len() <= MAX_PALETTE => s.bytes.clone(),
+        Object::Stream(s) if s.raw.len() <= 4 * MAX_PALETTE => doc.with_direct_parms(s).decoded_within(MAX_PALETTE).ok()?,
+        _ => return None,
+    };
+    let c: Vec<u32> = table.get(i.checked_mul(n)?..i.checked_mul(n)?.checked_add(n)?)?.iter().map(|v| u32::from(*v)).collect();
+    Some(match c.as_slice() {
+        [v] => v * 1000,
+        [r, g, b] => 299 * r + 587 * g + 114 * b,
+        _ => return None,
+    })
+}
+
 /// `w` × `h` 1-bit rows (each starting on a new byte) averaged down to `nw` × `nh`, no larger:
 /// each new pixel takes the sample that covers more of its area, and the dark one when the two tie
 /// (1 if `dark_is_one`, see [`dark_is_one`]), so a dark line half a new pixel wide stays. `None`
@@ -1000,33 +1104,45 @@ fn downsample_bits_checked(data: &[u8], w: u32, h: u32, nw: u32, nh: u32, dark_i
 /// `/DefaultGray` or `/DefaultRGB` is or may be in force. Also says whether it was resampled.
 ///
 /// - **Resampled** ([`downsample_bits_checked`]) when its resolution is above `above_ppi`, to `target_ppi`,
-///   unless it has a soft mask, whose own size would then have to follow, or is a halftone or a
-///   dither: most of its new pixels would cover both black and white, and taking the sample that
-///   covers more would turn its tones solid (a 50% screen black, a 25% one white).
-/// - **Stored** as CCITT Group 4 with `CcittG4`, or as 1-bit Flate when that is smaller, which only
-///   a resampled image or one packed from more bits may be: a 1-bit image that is only stored again
-///   becomes Group 4 or stays. Group 4 alone is only decoded to be resampled; Group 3 is stored
-///   again like any other. With `Retain`, a resampled image keeps its kind of compression
-///   (CCITT, or Flate), and nothing else changes: an image of more bits stays as it is, for the
-///   grey or colour settings.
+///   if its dark sample is known ([`dark_is_one`]: grey, an image mask, or an indexed image whose
+///   palette says which entry is darker, not under `defaults`), unless it has a soft mask, whose
+///   own size would then have to follow, or is a halftone or a dither: most of its new pixels would
+///   cover both black and white, and taking the sample that covers more would turn its tones solid
+///   (a 50% screen black, a 25% one white). So would a square of four new pixels that each cover
+///   both, as a small screened picture on a white page has (and ragged scanned text, which is then
+///   left at its resolution too).
+/// - **Stored** as CCITT Group 4 with `CcittG4`, or JBIG2 with `Jbig2`, or as 1-bit Flate when that
+///   is smaller, which only a resampled image or one packed from more bits may be: a 1-bit image
+///   that is only stored again becomes Group 4 or JBIG2, or stays. Group 4 alone is only decoded
+///   to be resampled, and so is JBIG2 alone when Group 4 is asked for; Group 3, Group 4 inside
+///   another filter, and JBIG2 otherwise are stored again like any other. With `Retain`, a resampled image keeps its kind of compression (CCITT, JBIG2, or
+///   Flate), and nothing else changes: an image of more bits stays as it is, for the grey or
+///   colour settings. A JBIG2 image stored again refers to no `/JBIG2Globals`.
 ///
 /// The samples keep their meaning, so the colour space, decode array and `/Mask` stay, but for
 /// black-and-white RGB, which becomes grey with one decode pair, and an indexed image's default
 /// decode array, which goes as the default at one bit.
-fn mono(doc: &Document, s: &Stream, ppi: f64, defaults: bool, settings: &MonoSettings) -> Option<(Stream, bool)> {
+fn mono(doc: &Document, s: &Stream, ppi: f64, defaults: bool, settings: &MonoSettings, budget: &mut ImageBudget) -> Option<(Stream, bool)> {
     let d = &s.dict;
     let downsample = settings.downsample && ppi.is_finite() && ppi > settings.above_ppi && settings.target_ppi > 0.0 && !d.contains(b"SMask");
     let retain = settings.compression == MonoCompression::Retain;
     let fax = doc.fax_params(s);
     // Its kind of compression, which Retain keeps, behind any other filters.
     let ccitt = fax.is_some();
-    // Group 4 alone is only worth decoding to resample it. Group 3, or Group 4 behind
-    // ASCII85Decode, say, can be smaller stored again as Group 4 alone.
-    let g4_alone = fax.is_some_and(|p| p.k < 0) && s.filters().len() == 1;
-    if (retain || (g4_alone && settings.compression == MonoCompression::CcittG4)) && !downsample {
+    let jbig2 = matches!(s.filters().last(), Some((pdfcraft_filters::Filter::Jbig2, _)));
+    // Group 4 alone is only worth decoding to resample it, and so is JBIG2 alone when Group 4 is what
+    // it would be stored as: that output is rarely smaller, and decoding an ordinary scan costs a
+    // quarter of a second a page. Group 3, Group 4 behind ASCII85Decode, say, and JBIG2 stored as
+    // JBIG2 (whose symbols may be smaller than its own coding) can be smaller stored again alone.
+    let alone_to_g4 = s.filters().len() == 1 && settings.compression == MonoCompression::CcittG4;
+    let only_to_resample = retain || (alone_to_g4 && (jbig2 || fax.is_some_and(|p| p.k < 0)));
+    // What can't be averaged, whatever it holds, comes to the same `None` below, after a decode that
+    // would spend the run's allowance on it.
+    let too_wide = d.int(b"Width").is_some_and(|w| w > i64::from(pdfcraft_filters::MAX_CCITT_COLUMNS));
+    if only_to_resample && (!downsample || defaults || too_wide || settings.target_ppi >= ppi || (jbig2 && dark_is_one(doc, d).is_none())) {
         return None;
     }
-    let (data, w, h, packed) = one_bit(doc, s, !retain, defaults)?;
+    let (data, w, h, packed) = one_bit(doc, s, !retain, defaults, budget)?;
     let packed_from_more = packed.is_some();
     let k = settings.target_ppi / ppi;
     // `downsample_bits` keeps a counter for each column: no more columns than a fax row may have,
@@ -1038,8 +1154,8 @@ fn mono(doc: &Document, s: &Stream, ppi: f64, defaults: bool, settings: &MonoSet
     } else {
         (w, h)
     };
-    let polarity = if defaults { None } else { dark_is_one(doc, packed.as_ref().unwrap_or(d)) };
-    let averaged = if (nw, nh) != (w, h) && polarity.is_some() {
+    let polarity = if defaults || (nw, nh) == (w, h) { None } else { dark_is_one(doc, packed.as_ref().unwrap_or(d)) };
+    let averaged = if polarity.is_some() {
         // The dark sample of the image as it ends up: packed RGB is grey, with grey's decode pair.
         let (out, mixed, local_tone) = downsample_bits_checked(&data, w, h, nw, nh, polarity?)?;
         // A halftone or dither: most new pixels cover both samples. Text covers both only along
@@ -1055,7 +1171,7 @@ fn mono(doc: &Document, s: &Stream, ppi: f64, defaults: bool, settings: &MonoSet
         Some(out) => (out, nw, nh),
         None => (data, w, h),
     };
-    if (retain || (g4_alone && settings.compression == MonoCompression::CcittG4)) && !resampled {
+    if only_to_resample && !resampled {
         return None;
     }
     let mut dict = packed.unwrap_or_else(|| d.clone());
@@ -1078,7 +1194,7 @@ fn mono(doc: &Document, s: &Stream, ppi: f64, defaults: bool, settings: &MonoSet
     } else {
         None
     };
-    let jbig = if settings.compression == MonoCompression::Jbig2 {
+    let jbig = if settings.compression == MonoCompression::Jbig2 || (retain && jbig2) {
         pdfcraft_filters::encode_jbig2(&data, nw, nh).ok().map(|coded| {
             let mut dict = dict.clone();
             dict.set(b"Filter".to_vec(), Object::name("JBIG2Decode"));
@@ -1087,25 +1203,30 @@ fn mono(doc: &Document, s: &Stream, ppi: f64, defaults: bool, settings: &MonoSet
     } else {
         None
     };
-    let flate = ((resampled || packed_from_more) && !(retain && ccitt)).then(|| Stream::flate(dict, &data));
+    let flate = ((resampled || packed_from_more) && !(retain && (ccitt || jbig2))).then(|| Stream::flate(dict, &data));
     // Smaller as stored, counting the dictionary: a tiny image can lose by Group 4's parameters.
     let best = [g4, jbig, flate].into_iter().flatten().filter_map(|c| Some((crate::stored_len(&c)?, c))).min_by_key(|(len, _)| *len)?;
     (best.0 < crate::stored_len(s)?).then_some((best.1, resampled))
 }
 
+/// One pass over the document's images, within `budget`. An image past it stays as it is, and is
+/// counted in the report.
 pub(crate) fn run(
     doc: &mut Document,
     pages: &[ObjRef],
     settings: &Settings,
     report: &mut Report,
     progress: &mut dyn FnMut(Stage) -> bool,
+    budget: &mut ImageBudget,
 ) -> Result<(), OptimizeError> {
     let (ppi, mut defaults, read) = walk_pages(doc, pages);
-    // Black-and-white RGB becomes grey, which default colour spaces would draw otherwise: one used
-    // where the walk didn't look may be drawn so.
+    // Black-and-white RGB becomes grey, which default colour spaces would draw otherwise, and an
+    // indexed image's palette says which of its samples a resampled one keeps, which they may
+    // change: one used where the walk didn't look may be drawn so.
     let packs = settings.mono.compression != MonoCompression::Retain;
-    let rgb: HashSet<u32> = ppi.keys().filter(|r| packs && device_rgb(doc, **r)).map(|r| r.num).collect();
-    defaults.extend(used_elsewhere(doc, &rgb, &read));
+    let checked: HashSet<u32> =
+        ppi.keys().filter(|r| (packs && device_rgb(doc, **r)) || (settings.mono.downsample && indexed(doc, **r))).map(|r| r.num).collect();
+    defaults.extend(used_elsewhere(doc, &checked, &read));
     // Soft masks are processed with their image, not on their own.
     let masks: HashSet<ObjRef> = ppi
         .keys()
@@ -1125,10 +1246,11 @@ pub(crate) fn run(
         let obj = doc.get(r);
         let Object::Stream(s) = &*obj else { continue };
         report.images += 1;
+        let refused = budget.refused();
         // Packed from more bits a sample, it is lossless at one bit, but the grey or colour
         // settings can make it smaller still (below).
         let packed_from_more = s.dict.int(b"BitsPerComponent").is_some_and(|b| b > 1);
-        let (packed, mono) = match mono(doc, s, ppi, defaults.contains(&r.num), &settings.mono) {
+        let (packed, mono) = match mono(doc, s, ppi, defaults.contains(&r.num), &settings.mono, budget) {
             Some(m) if packed_from_more => (Some(m), None),
             m => (None, m),
         };
@@ -1145,7 +1267,7 @@ pub(crate) fn run(
             continue;
         }
         let n = s.dict.get(b"ColorSpace").and_then(|cs| components(doc, cs));
-        let processed = n.and_then(|n| process(doc, s, ppi, if n == 1 { &settings.gray } else { &settings.color }, n));
+        let processed = n.and_then(|n| process(doc, s, ppi, if n == 1 { &settings.gray } else { &settings.color }, n, budget));
         // A dithered scan, say, downsampled and JPEG-compressed: the smaller wins, counting a soft
         // mask resampled with it.
         let smask_len = |smask: Option<&(ObjRef, Stream)>| match smask {
@@ -1171,7 +1293,11 @@ pub(crate) fn run(
             doc.set(r, Object::Stream(new));
             continue;
         }
-        let Some((new, smask)) = processed else { continue };
+        let Some((new, smask)) = processed else {
+            // Read to be packed and again to be resampled, it is still one image, and it stayed.
+            report.images_refused += usize::from(budget.refused() > refused);
+            continue;
+        };
         let resized = new.dict.int(b"Width") != s.dict.int(b"Width") || new.dict.int(b"Height") != s.dict.int(b"Height");
         report.image_bytes_before += s.raw.len();
         report.image_bytes_after += new.raw.len();
@@ -1219,13 +1345,321 @@ mod dimension_tests {
             dict.set(b"Width".to_vec(), Object::Int(width));
             dict.set(b"Height".to_vec(), Object::Int(height));
             let stream = Stream::from_raw(dict, vec![0; 4]);
-            assert!(pixels(&Document::new_empty(), &stream, channels).is_none(), "{width} x {height} x {channels}");
+            assert!(
+                pixels(&Document::new_empty(), &stream, channels, &mut ImageBudget::with_work(u64::MAX)).is_none(),
+                "{width} x {height} x {channels}"
+            );
         }
         let mut dict = Dict::new();
         dict.set(b"Width".to_vec(), Object::Int(2));
         dict.set(b"Height".to_vec(), Object::Int(2));
         let stream = Stream::from_raw(dict, vec![1, 2, 3, 4, 5]);
-        assert_eq!(pixels(&Document::new_empty(), &stream, 1), Some(vec![1, 2, 3, 4]));
+        assert_eq!(pixels(&Document::new_empty(), &stream, 1, &mut ImageBudget::with_work(u64::MAX)), Some(vec![1, 2, 3, 4]));
+    }
+
+    /// JBIG2 alone, with Group 4 asked for, is decoded only to be resampled. A cost guard: dropped,
+    /// no output changes, and an ordinary scan pays a quarter of a second a page for nothing. Behind
+    /// another filter it can still be stored again, as Group 4 can.
+    #[test]
+    fn a_jbig2_image_alone_is_not_decoded_for_group_4_unless_it_is_resampled() {
+        let coded = pdfcraft_filters::encode_jbig2_generic(&[0xFF; 4], 16, 2).unwrap();
+        let hex: Vec<u8> = coded.iter().flat_map(|b| format!("{b:02x}").into_bytes()).chain(*b">").collect();
+        let image = |filter: Object, data: Vec<u8>| {
+            let mut dict = Dict::new();
+            dict.set(b"Width".to_vec(), Object::Int(16));
+            dict.set(b"Height".to_vec(), Object::Int(2));
+            dict.set(b"BitsPerComponent".to_vec(), Object::Int(1));
+            dict.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+            dict.set(b"Filter".to_vec(), filter);
+            Stream::from_raw(dict, data)
+        };
+        let settings = MonoSettings { compression: MonoCompression::CcittG4, ..MonoSettings::REDUCE };
+        let decoded = |s: &Stream, settings: &MonoSettings| {
+            DECODED_PIXELS.with(|c| c.set(0));
+            mono(&Document::new_empty(), s, 300.0, false, settings, &mut ImageBudget::with_work(u64::MAX));
+            DECODED_PIXELS.with(|c| c.get())
+        };
+        let alone = image(Object::name("JBIG2Decode"), coded.clone());
+        assert_eq!(decoded(&alone, &settings), 0, "alone, for Group 4, below the threshold");
+        let behind = image(Object::Array(vec![Object::name("ASCIIHexDecode"), Object::name("JBIG2Decode")]), hex);
+        assert!(decoded(&behind, &settings) > 0, "behind another filter it can be stored again");
+        let jbig2 = MonoSettings { compression: MonoCompression::Jbig2, ..MonoSettings::REDUCE };
+        assert!(decoded(&alone, &jbig2) > 0, "stored as JBIG2 its symbols may come out smaller");
+    }
+
+    /// A run has one allowance for all its JBIG2 images. Those past it stay as they are, and the
+    /// report says how many: a file of thousands of them can't hold a run for hours.
+    #[test]
+    fn jbig2_images_past_the_runs_allowance_stay_as_they_are() {
+        let coded = pdfcraft_filters::encode_jbig2_generic(&[0xF0; 4], 16, 2).unwrap();
+        let mut dict = Dict::new();
+        dict.set(b"Type".to_vec(), Object::name("XObject"));
+        dict.set(b"Subtype".to_vec(), Object::name("Image"));
+        dict.set(b"Width".to_vec(), Object::Int(16));
+        dict.set(b"Height".to_vec(), Object::Int(2));
+        dict.set(b"BitsPerComponent".to_vec(), Object::Int(1));
+        dict.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+        dict.set(b"Filter".to_vec(), Object::name("JBIG2Decode"));
+        let image = Stream::from_raw(dict, coded);
+        let mut cost = ImageBudget::with_work(u64::MAX);
+        cost.decode(&Document::new_empty(), &image, 1 << 20).unwrap();
+        let cost = u64::MAX - cost.work_left();
+
+        let mut doc = Document::new_empty();
+        let refs = [doc.add(Object::Stream(image.clone())), doc.add(Object::Stream(image.clone())), doc.add(Object::Stream(image.clone()))];
+        let mut xobjects = Dict::new();
+        for (i, r) in refs.iter().enumerate() {
+            xobjects.set(format!("I{i}").into_bytes(), Object::Ref(*r));
+        }
+        let mut resources = Dict::new();
+        resources.set(b"XObject".to_vec(), Object::Dict(xobjects));
+        // Drawn small enough, at 720 ppi, for the settings to resample all three.
+        let content = doc.add(Object::Stream(Stream::flate(Dict::new(), b"q 1.6 0 0 .2 0 0 cm /I0 Do /I1 Do /I2 Do Q")));
+        let mut page = Dict::new();
+        page.set(b"Type".to_vec(), Object::name("Page"));
+        page.set(b"Resources".to_vec(), Object::Dict(resources));
+        page.set(b"Contents".to_vec(), Object::Ref(content));
+        let page = doc.add(Object::Dict(page));
+
+        let settings = Settings { mono: MonoSettings { compression: MonoCompression::CcittG4, ..MonoSettings::REDUCE }, ..Settings::default() };
+        let mut report = Report::default();
+        let mut budget = ImageBudget::with_work(2 * cost);
+        run(&mut doc, &[page], &settings, &mut report, &mut |_| true, &mut budget).unwrap();
+        assert_eq!(report.images_refused, 1);
+        assert_eq!(budget.work_left(), 0, "two decoded and the third refused");
+        assert_eq!(report.images_resampled, 2);
+        let changed = refs.iter().filter(|r| matches!(&*doc.get(**r), Object::Stream(s) if *s != image)).count();
+        assert_eq!(changed, 2, "the third is as it was");
+    }
+
+    /// Images that aren't JBIG2 share the run's allowance too, both on the way to being resampled
+    /// and on the way to being packed to a bit a sample: a file of filter bombs would hold a run
+    /// as long as one of JBIG2, and those past it stay as they are.
+    #[test]
+    fn flate_images_past_the_runs_allowance_stay_as_they_are() {
+        // Noise, resampled, or black and white, packed.
+        let mut seed = 0x2545_F491_4F6C_DD1Du64;
+        let noise: Vec<u8> = (0..256 * 256)
+            .map(|_| {
+                seed ^= seed << 13;
+                seed ^= seed >> 7;
+                seed ^= seed << 17;
+                seed as u8
+            })
+            .collect();
+        let black_and_white: Vec<u8> = noise.iter().map(|v| if v & 1 == 0 { 0 } else { 255 }).collect();
+        for (name, samples, settings) in [
+            ("resampled", &noise, Settings::default()),
+            (
+                "packed",
+                &black_and_white,
+                Settings { mono: MonoSettings { compression: MonoCompression::CcittG4, ..MonoSettings::REDUCE }, ..Settings::default() },
+            ),
+        ] {
+            let page_of = |images: usize| {
+                let mut doc = Document::new_empty();
+                let mut dict = Dict::new();
+                dict.set(b"Subtype".to_vec(), Object::name("Image"));
+                dict.set(b"Width".to_vec(), Object::Int(256));
+                dict.set(b"Height".to_vec(), Object::Int(256));
+                dict.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+                dict.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+                let image = Stream::flate(dict, samples);
+                let refs: Vec<ObjRef> = (0..images).map(|_| doc.add(Object::Stream(image.clone()))).collect();
+                let mut xobjects = Dict::new();
+                let mut drawn = String::from("q 10 0 0 10 0 0 cm ");
+                for (i, r) in refs.iter().enumerate() {
+                    xobjects.set(format!("I{i}").into_bytes(), Object::Ref(*r));
+                    drawn.push_str(&format!("/I{i} Do "));
+                }
+                drawn.push('Q');
+                let mut resources = Dict::new();
+                resources.set(b"XObject".to_vec(), Object::Dict(xobjects));
+                let content = doc.add(Object::Stream(Stream::flate(Dict::new(), drawn.as_bytes())));
+                let mut page = Dict::new();
+                page.set(b"Type".to_vec(), Object::name("Page"));
+                page.set(b"Resources".to_vec(), Object::Dict(resources));
+                page.set(b"Contents".to_vec(), Object::Ref(content));
+                let page = doc.add(Object::Dict(page));
+                (doc, page, refs, image)
+            };
+            let (mut doc, page, ..) = page_of(1);
+            let mut budget = ImageBudget::with_work(u64::MAX);
+            let mut report = Report::default();
+            run(&mut doc, &[page], &settings, &mut report, &mut |_| true, &mut budget).unwrap();
+            let cost = u64::MAX - budget.work_left();
+            assert!(cost > 0, "{name}");
+            assert_eq!(report.images_refused, 0, "{name}");
+
+            let (mut doc, page, refs, image) = page_of(3);
+            let mut budget = ImageBudget::with_work(2 * cost);
+            let mut report = Report::default();
+            run(&mut doc, &[page], &settings, &mut report, &mut |_| true, &mut budget).unwrap();
+            assert_eq!(report.images_refused, 1, "{name}: {report:?}");
+            assert_eq!(budget.work_left(), 0, "{name}");
+            let changed = refs.iter().filter(|r| matches!(&*doc.get(**r), Object::Stream(s) if *s != image)).count();
+            assert_eq!(changed, 2, "{name}: the third is as it was");
+        }
+    }
+
+    /// An image the allowance ran out on between being packed and being resampled is rewritten,
+    /// as the packed one, so it isn't one that stayed as it was.
+    #[test]
+    fn a_packed_image_isnt_counted_as_refused() {
+        let mut seed = 0x2545_F491_4F6C_DD1Du64;
+        let samples: Vec<u8> = (0..256 * 256)
+            .map(|_| {
+                seed ^= seed << 13;
+                seed ^= seed >> 7;
+                seed ^= seed << 17;
+                if seed & 1 == 0 { 0 } else { 255 }
+            })
+            .collect();
+        let mut doc = Document::new_empty();
+        let mut dict = Dict::new();
+        dict.set(b"Subtype".to_vec(), Object::name("Image"));
+        dict.set(b"Width".to_vec(), Object::Int(256));
+        dict.set(b"Height".to_vec(), Object::Int(256));
+        dict.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+        dict.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+        let image = Stream::flate(dict, &samples);
+        let read = (image.raw.len() + samples.len()) as u64 + 256 * 256;
+        let original = doc.add(Object::Stream(image.clone()));
+        let mut xobjects = Dict::new();
+        xobjects.set(b"I0".to_vec(), Object::Ref(original));
+        let mut resources = Dict::new();
+        resources.set(b"XObject".to_vec(), Object::Dict(xobjects));
+        let content = doc.add(Object::Stream(Stream::flate(Dict::new(), b"q 10 0 0 10 0 0 cm /I0 Do Q")));
+        let mut page = Dict::new();
+        page.set(b"Type".to_vec(), Object::name("Page"));
+        page.set(b"Resources".to_vec(), Object::Dict(resources));
+        page.set(b"Contents".to_vec(), Object::Ref(content));
+        let page = doc.add(Object::Dict(page));
+        let settings = Settings { mono: MonoSettings { compression: MonoCompression::CcittG4, ..MonoSettings::REDUCE }, ..Settings::default() };
+        let mut report = Report::default();
+        let mut budget = ImageBudget::with_work(read);
+        run(&mut doc, &[page], &settings, &mut report, &mut |_| true, &mut budget).unwrap();
+        assert_eq!(budget.refused(), 1, "its second read was refused");
+        assert_eq!(report.images_refused, 0, "{report:?}");
+        assert_eq!(report.images_recompressed + report.images_resampled, 1, "{report:?}");
+        assert!(matches!(&*doc.get(original), Object::Stream(s) if *s != image));
+    }
+
+    /// An image the run has no use for stayed as it was too, but nothing refused it: this one is
+    /// too small to compress and drawn at no more than its size.
+    #[test]
+    fn an_image_left_alone_isnt_counted_as_refused() {
+        let mut doc = Document::new_empty();
+        let mut dict = Dict::new();
+        dict.set(b"Subtype".to_vec(), Object::name("Image"));
+        dict.set(b"Width".to_vec(), Object::Int(8));
+        dict.set(b"Height".to_vec(), Object::Int(8));
+        dict.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+        dict.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+        let image = doc.add(Object::Stream(Stream::flate(dict, &[0x80; 64])));
+        let mut xobjects = Dict::new();
+        xobjects.set(b"I0".to_vec(), Object::Ref(image));
+        let mut resources = Dict::new();
+        resources.set(b"XObject".to_vec(), Object::Dict(xobjects));
+        let content = doc.add(Object::Stream(Stream::flate(Dict::new(), b"q 72 0 0 72 0 0 cm /I0 Do Q")));
+        let mut page = Dict::new();
+        page.set(b"Type".to_vec(), Object::name("Page"));
+        page.set(b"Resources".to_vec(), Object::Dict(resources));
+        page.set(b"Contents".to_vec(), Object::Ref(content));
+        let page = doc.add(Object::Dict(page));
+        let mut report = Report::default();
+        run(&mut doc, &[page], &Settings::default(), &mut report, &mut |_| true, &mut ImageBudget::with_work(u64::MAX)).unwrap();
+        assert_eq!((report.images, report.images_refused), (1, 0), "{report:?}");
+    }
+
+    /// A JPEG pays for its samples before it is decoded, however few bytes it takes: past what is
+    /// left it isn't, and counts as refused.
+    #[test]
+    fn a_jpeg_pays_for_its_samples() {
+        let mut dict = Dict::new();
+        dict.set(b"Width".to_vec(), Object::Int(16));
+        dict.set(b"Height".to_vec(), Object::Int(8));
+        dict.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+        dict.set(b"ColorSpace".to_vec(), Object::name("DeviceRGB"));
+        let jpeg = image_stream(&dict, &[120; 16 * 8 * 3], 3, 16, 8, Compression::Jpeg(60), false).expect("a JPEG");
+        let doc = Document::new_empty();
+        let cost = 2 * 16 * 8 * 3 + 4 * jpeg.raw.len() as u64;
+        let mut budget = ImageBudget::with_work(cost);
+        assert_eq!(pixels(&doc, &jpeg, 3, &mut budget).map(|p| p.len()), Some(16 * 8 * 3));
+        assert_eq!((budget.work_left(), budget.refused()), (0, 0), "exactly that");
+        let mut budget = ImageBudget::with_work(cost - 1);
+        assert!(pixels(&doc, &jpeg, 3, &mut budget).is_none());
+        assert_eq!((budget.work_left(), budget.refused()), (0, 1));
+    }
+
+    /// A soft mask resampled with its image is read from the same allowance as the image.
+    #[test]
+    fn a_soft_mask_resampled_with_its_image_spends_the_allowance() {
+        let mut seed = 0x2545_F491_4F6C_DD1Du64;
+        let noise: Vec<u8> = (0..256 * 256)
+            .map(|_| {
+                seed ^= seed << 13;
+                seed ^= seed >> 7;
+                seed ^= seed << 17;
+                seed as u8
+            })
+            .collect();
+        let image = |space: &str| {
+            let mut dict = Dict::new();
+            dict.set(b"Subtype".to_vec(), Object::name("Image"));
+            dict.set(b"Width".to_vec(), Object::Int(256));
+            dict.set(b"Height".to_vec(), Object::Int(256));
+            dict.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+            dict.set(b"ColorSpace".to_vec(), Object::name(space));
+            Stream::flate(dict, &noise)
+        };
+        let mut doc = Document::new_empty();
+        let mask = image("DeviceGray");
+        let cost = (mask.raw.len() + noise.len()) as u64 + 256 * 256;
+        let masked = doc.add(Object::Stream(mask));
+        let mut with_mask = image("DeviceGray");
+        with_mask.dict.set(b"SMask".to_vec(), Object::Ref(masked));
+        let spent = |s: &Stream| {
+            let mut budget = ImageBudget::with_work(u64::MAX);
+            process(&doc, s, 720.0, &Settings::default().gray, 1, &mut budget).expect("resampled, and smaller");
+            u64::MAX - budget.work_left()
+        };
+        assert_eq!(spent(&with_mask), spent(&image("DeviceGray")) + cost);
+    }
+
+    /// Decoded only to be resampled, what can't be averaged whatever it holds isn't decoded, so it
+    /// takes nothing from the images that can be, and isn't counted as refused past the allowance.
+    #[test]
+    fn a_jbig2_image_that_cant_be_averaged_spends_nothing() {
+        let image = |edit: &dyn Fn(&mut Dict)| {
+            let mut dict = Dict::new();
+            dict.set(b"Subtype".to_vec(), Object::name("Image"));
+            dict.set(b"Width".to_vec(), Object::Int(16));
+            dict.set(b"Height".to_vec(), Object::Int(2));
+            dict.set(b"BitsPerComponent".to_vec(), Object::Int(1));
+            dict.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+            dict.set(b"Filter".to_vec(), Object::name("JBIG2Decode"));
+            edit(&mut dict);
+            Stream::from_raw(dict, pdfcraft_filters::encode_jbig2_generic(&[0xF0; 4], 16, 2).unwrap())
+        };
+        let spent_at = |target_ppi: f64, s: &Stream, defaults: bool| {
+            let settings = MonoSettings { compression: MonoCompression::Retain, above_ppi: 100.0, target_ppi, ..MonoSettings::REDUCE };
+            let mut budget = ImageBudget::with_work(u64::MAX);
+            let _ = mono(&Document::new_empty(), s, 720.0, defaults, &settings, &mut budget);
+            u64::MAX - budget.work_left()
+        };
+        let spent = |s: &Stream, defaults: bool| spent_at(300.0, s, defaults);
+        let plain = image(&|_| {});
+        assert_eq!(spent_at(720.0, &plain, false), 0, "already at the target");
+        assert!(spent_at(719.0, &plain, false) > 0, "just above it");
+        assert!(spent(&plain, false) > 0, "one that can be averaged is decoded");
+        assert_eq!(spent(&plain, true), 0, "drawn where a device colour space is remapped");
+        let width = |w: i64| image(&move |d| d.set(b"Width".to_vec(), Object::Int(w)));
+        let widest = i64::from(pdfcraft_filters::MAX_CCITT_COLUMNS);
+        assert!(spent(&width(widest), false) > 0, "the widest that can be averaged is decoded");
+        assert_eq!(spent(&width(widest + 1), false), 0, "too wide to average");
+        let tinted = image(&|d| d.set(b"ColorSpace".to_vec(), Object::Array(vec![Object::name("CalGray"), Object::Dict(Dict::new())])));
+        assert_eq!(spent(&tinted, false), 0, "no way to tell which sample is dark");
     }
 
     /// A JPEG larger than its dictionary says is refused from its header, before its pixels are decoded.
@@ -1240,9 +1674,69 @@ mod dimension_tests {
             Stream::from_raw(dict, data.clone())
         };
         DECODED_PIXELS.with(|c| c.set(0));
-        assert!(pixels(&Document::new_empty(), &stream(10, 10), 1).is_none());
+        assert!(pixels(&Document::new_empty(), &stream(10, 10), 1, &mut ImageBudget::with_work(u64::MAX)).is_none());
         assert_eq!(DECODED_PIXELS.with(|c| c.get()), 0, "pixels decoded");
-        assert_eq!(pixels(&Document::new_empty(), &stream(1000, 1000), 1).map(|p| p.len()), Some(1000 * 1000));
+        assert_eq!(pixels(&Document::new_empty(), &stream(1000, 1000), 1, &mut ImageBudget::with_work(u64::MAX)).map(|p| p.len()), Some(1000 * 1000));
+    }
+
+    /// Resampling goes through no more than one of the two sizes holds, whatever their proportions:
+    /// the first three shapes asked for 160 GB and more on the way, and that aborted the process.
+    /// The last two would ask for 10 GB and 30 GB if they went across first, which is why the way
+    /// round depends on the shapes. A flat picture stays flat, and pictures of ordinary proportions
+    /// resample as they always did.
+    #[test]
+    fn resampling_across_proportions_takes_the_memory_of_neither_product() {
+        let shapes = [
+            (100_000u32, 1u32, 1u32, 100_000u32, 1usize),
+            (1_000_000, 1, 4, 100_000, 1),
+            (100_000, 1, 1, 100_000, 3),
+            (1, 100_000, 100_000, 1, 1),
+            (1, 100_000, 100_000, 1, 3),
+        ];
+        for (w, h, nw, nh, n) in shapes {
+            let px = vec![0x60; (w * h) as usize * n];
+            let out = resample(&px, n, w, h, nw, nh).unwrap();
+            assert_eq!(out.len(), (nw * nh) as usize * n);
+            assert!(out.iter().all(|v| v.abs_diff(0x60) <= 1), "{w} × {h} to {nw} × {nh}");
+        }
+        let (w, h, nw, nh) = (40u32, 30u32, 20u32, 15u32);
+        let px: Vec<u8> = (0..w * h).map(|i| (i * 7 % 251) as u8).collect();
+        let image = image::GrayImage::from_raw(w, h, px.clone()).unwrap();
+        let direct = image::imageops::resize(&image, nw, nh, image::imageops::FilterType::CatmullRom).into_raw();
+        assert_eq!(resample(&px, 1, w, h, nw, nh).unwrap(), direct, "as it was");
+    }
+
+    /// The long way round is for proportions far apart: up to a quarter over the larger picture the
+    /// buffer is no danger, and that scales as it always did, to the byte. Noise, as a flat picture comes
+    /// out the same either way.
+    #[test]
+    fn proportions_up_to_the_limit_resample_as_they_did() {
+        let noise = |w: u32, h: u32| -> Vec<u8> {
+            let mut seed = 0x2545_F491_4F6C_DD1Du64;
+            (0..w * h)
+                .map(|_| {
+                    seed ^= seed << 13;
+                    seed ^= seed >> 7;
+                    seed ^= seed << 17;
+                    seed as u8
+                })
+                .collect()
+        };
+        let direct = |px: &[u8], w, h, nw, nh| {
+            let image = image::GrayImage::from_raw(w, h, px.to_vec()).unwrap();
+            image::imageops::resize(&image, nw, nh, image::imageops::FilterType::CatmullRom).into_raw()
+        };
+        // Each exactly a quarter over the larger: the source's size, then the target's.
+        for (w, h, nw, nh) in [(25, 16, 10, 20), (20, 5, 16, 25)] {
+            let px = noise(w, h);
+            assert_eq!(resample(&px, 1, w, h, nw, nh).unwrap(), direct(&px, w, h, nw, nh), "{w} × {h} to {nw} × {nh}");
+        }
+        // A step past it goes the long way, which is how to tell.
+        let px = noise(25, 15);
+        assert_ne!(resample(&px, 1, 25, 15, 10, 20).unwrap(), direct(&px, 25, 15, 10, 20));
+        // A picture of the size asked for comes through as it is.
+        let px = noise(20, 10);
+        assert_eq!(resample(&px, 1, 20, 10, 20, 10).unwrap(), px);
     }
 }
 
@@ -1307,8 +1801,9 @@ mod downsample_tests {
         assert_eq!(downsample_bits(&[0b1100_0000], 3, 1, 2, 1, false).map(|(out, _)| out), Some(vec![0b1000_0000]));
     }
 
-    /// The dark sample: 0 in grey and of an image mask, 1 in a separation, each the other way round
-    /// with an inverting decode array; 0 for an indexed image, whatever its decode array.
+    /// The dark sample: 0 in grey and of an image mask, the other way round with an inverting decode
+    /// array; none known for a separation, nor for an indexed image without a palette (see the next
+    /// test), nor with a decode array that isn't two numbers.
     #[test]
     fn the_dark_sample_follows_the_colour_space_and_decode_array() {
         let doc = Document::new_empty();
@@ -1332,6 +1827,7 @@ mod downsample_tests {
             (vec![mask, inverted.clone()], Some(true)),
             (vec![separation.clone()], None),
             (vec![separation, inverted.clone()], None),
+            // A palette that isn't there says nothing.
             (vec![indexed.clone()], None),
             (vec![indexed, inverted], None),
             (vec![("ColorSpace", Object::name("DeviceGray")), ("Decode", Object::Array(vec![Object::name("x"), 0.into()]))], None),
@@ -1340,6 +1836,54 @@ mod downsample_tests {
         }
     }
 
+    /// An indexed image's dark sample is the one picking the darker palette entry, after its decode
+    /// array: over DeviceGray and DeviceRGB (by luma, each weight checked), with the table a string
+    /// or a stream, directly or by reference. Another base (CMYK, calibrated, an ICC profile, a
+    /// resource name), two entries alike, an entry the table doesn't hold, and a `hival` past 255
+    /// say nothing.
+    #[test]
+    fn an_indexed_images_palette_says_which_sample_is_dark() {
+        let mut doc = Document::new_empty();
+        let string = |bytes: &[u8]| Object::String(pdfcraft_cos::PdfString::literal(bytes.to_vec()));
+        let referenced = doc.add(string(&[255, 0]));
+        let stream = doc.add(Object::Stream(pdfcraft_cos::Stream::flate(Dict::new(), &[0, 0, 0, 255, 255, 255])));
+        let cal = |name: &str| Object::Array(vec![Object::name(name), Object::Dict(Dict::new())]);
+        let indexed = |base: Object, hival: i64, table: Object| {
+            let mut d = Dict::new();
+            d.set(b"ColorSpace".to_vec(), Object::Array(vec![Object::name("Indexed"), base, hival.into(), table]));
+            d
+        };
+        let inverted = |mut d: Dict| {
+            d.set(b"Decode".to_vec(), Object::Array(vec![1.into(), 0.into()]));
+            d
+        };
+        for (d, dark_one, what) in [
+            (indexed(Object::name("DeviceGray"), 1, string(&[0, 255])), Some(false), "grey, black first"),
+            (indexed(Object::name("DeviceGray"), 1, string(&[255, 0])), Some(true), "grey, white first"),
+            (indexed(Object::name("DeviceGray"), 1, string(&[90, 89])), Some(true), "two greys a step apart"),
+            (inverted(indexed(Object::name("DeviceGray"), 1, string(&[255, 0]))), Some(false), "white first, inverted"),
+            (indexed(Object::name("DeviceGray"), 1, Object::Ref(referenced)), Some(true), "the table by reference"),
+            (indexed(Object::name("DeviceRGB"), 1, Object::Ref(stream)), Some(false), "RGB in a stream"),
+            (indexed(Object::name("DeviceRGB"), 1, string(&[255, 255, 0, 0, 0, 255])), Some(true), "yellow, then blue"),
+            // Pure red (76,245) is lighter than pure blue (29,070), and darker than green (149,685).
+            (indexed(Object::name("DeviceRGB"), 1, string(&[255, 0, 0, 0, 0, 255])), Some(true), "red, then blue"),
+            (indexed(Object::name("DeviceRGB"), 1, string(&[255, 0, 0, 0, 255, 0])), Some(false), "red, then green"),
+            (indexed(Object::name("DeviceRGB"), 1, string(&[0, 0, 255, 0, 255, 0])), Some(false), "blue, then green"),
+            // Blue (29,070) is lighter than grey 20 (20,000): the blue weight decides it.
+            (indexed(Object::name("DeviceRGB"), 1, string(&[0, 0, 255, 20, 20, 20])), Some(true), "blue, then dark grey"),
+            (indexed(Object::name("DeviceCMYK"), 1, string(&[0, 0, 0, 0, 0, 0, 0, 255])), None, "CMYK"),
+            (indexed(cal("CalGray"), 1, string(&[200, 20])), None, "calibrated grey"),
+            (indexed(cal("ICCBased"), 1, string(&[0, 255])), None, "an ICC profile"),
+            (indexed(Object::name("CS0"), 1, string(&[0, 255])), None, "a resource name"),
+            (indexed(Object::name("DeviceGray"), 1, string(&[7, 7])), None, "two entries alike"),
+            (indexed(Object::name("DeviceGray"), 1, string(&[0])), None, "a table of one entry"),
+            (indexed(Object::name("DeviceGray"), 0, string(&[0, 255])), None, "hival 0: both samples pick entry 0"),
+            (indexed(Object::name("DeviceGray"), 256, string(&[0, 255])), None, "hival past 255"),
+        ] {
+            assert_eq!(dark_is_one(&doc, &d), dark_one, "{what}");
+        }
+    }
+
     #[test]
     fn what_it_cannot_resample_is_none() {
         assert_eq!(downsample_bits(&[0; 2], 4, 2, 5, 1, false).map(|(out, _)| out), None, "wider");
diff --git a/crates/optimize/src/lib.rs b/crates/optimize/src/lib.rs
index 76e30da7ac..e70aa5e71d 100644
--- a/crates/optimize/src/lib.rs
+++ b/crates/optimize/src/lib.rs
@@ -10,10 +10,11 @@
 //!   A new image replaces the old one only if it is smaller. The colour and grey settings leave
 //!   alone images they can't decode faithfully (CMYK and other colour spaces, masks, decode arrays
 //!   other than the default, JPEG 2000, JBIG2, CCITT, other than 8 bits, JPEGs whose Adobe marker
-//!   and `/ColorTransform` disagree). Black-and-white images (1-bit, image masks and CCITT fax,
+//!   and `/ColorTransform` disagree). Black-and-white images (1-bit, image masks, CCITT fax and JBIG2,
 //!   Group 3 among them; and eight-bit grey and RGB of only black and white, and indexed images
 //!   that use only palette entries 0 and 1, packed to one bit) above a threshold are averaged down to a
-//!   target resolution, halftones and dithers aside, and are stored as CCITT Group 4 or lossless JBIG2, or 1-bit
+//!   target resolution when grey, image masks or indexed, halftones and dithers aside (see the README), and
+//!   are stored as CCITT Group 4 or lossless JBIG2, or 1-bit
 //!   Flate once resampled or packed, when that is smaller.
 //! - **Discard objects:** page thumbnails, alternate images, document tags (structure tree),
 //!   print settings.
@@ -35,7 +36,7 @@ mod unused;
 
 pub use audit::{SpaceCategory, SpaceUse, audit_space};
 
-use pdfcraft_cos::{Dict, Document, MAX_PAGE_DECODED, ObjRef, Object, Stream, serialize};
+use pdfcraft_cos::{Dict, Document, ImageBudget, MAX_PAGE_DECODED, ObjRef, Object, Stream, serialize};
 use pdfcraft_filters::{Filter, Params};
 
 pub use images::effective_resolutions;
@@ -278,6 +279,8 @@ pub struct Report {
     pub images: usize,
     pub images_resampled: usize,
     pub images_recompressed: usize,
+    /// Images left as they are: decoding them all would take more than one run may spend.
+    pub images_refused: usize,
     /// Encoded image bytes before and after (images that changed).
     pub image_bytes_before: usize,
     pub image_bytes_after: usize,
@@ -328,10 +331,12 @@ pub fn optimize_with_progress(doc: &mut Document, settings: &Settings, progress:
     }
     let mut report = Report::default();
     let pages = pdfcraft_annot::page_refs(doc).map_err(|_| OptimizeError::NoPages)?;
+    // Merging fragments, the image pass and the LZW pass read the same images, so they share it.
+    let mut budget = ImageBudget::new(doc);
     if settings.merge_fragments {
-        fragments::run(doc, &pages, &mut report, progress)?;
+        fragments::run(doc, &pages, &mut report, progress, &mut budget)?;
     }
-    images::run(doc, &pages, settings, &mut report, progress)?;
+    images::run(doc, &pages, settings, &mut report, progress, &mut budget)?;
     if !progress(Stage::CleanUp) {
         return Err(OptimizeError::Cancelled);
     }
@@ -427,7 +432,11 @@ pub fn optimize_with_progress(doc: &mut Document, settings: &Settings, progress:
             let r = ObjRef { num, generation: doc.generation(num) };
             let obj = doc.get(r);
             let Object::Stream(s) = &*obj else { continue };
-            if let Some(replacement) = lzw_to_flate(s, MAX_LZW_DECODED) {
+            // Each can take a second or more, of a pass that has no other way to stop.
+            if s.filters().iter().any(|(f, _)| *f == Filter::Lzw) && !progress(Stage::CleanUp) {
+                return Err(OptimizeError::Cancelled);
+            }
+            if let Some(replacement) = lzw_to_flate(s, MAX_LZW_DECODED, &mut budget) {
                 doc.set(r, Object::Stream(replacement));
                 report.lzw_streams += 1;
             }
@@ -462,14 +471,17 @@ pub fn optimize_with_progress(doc: &mut Document, settings: &Settings, progress:
 /// Largest decoded LZW stream converted, as for a page's content: the data and its check are
 /// held together, so a few hundred kilobytes of hostile LZW can't ask for gigabytes.
 const MAX_LZW_DECODED: usize = MAX_PAGE_DECODED;
+/// The steps of a run's allowance a decoded byte costs to store with Flate and read back: up to
+/// 78 ns a byte to encode and 4 to check, at the 6 to 16 ns of a step.
+const LZW_REWRITE_WORK: u64 = 8;
 
 /// `s` with its LZW compression replaced by Flate (Acrobat's "In streams that use LZW encoding,
 /// use Flate instead"). The filters up to the last LZW one are decoded, strictly and with its
 /// predictor; the result is Flate-encoded under the same predictor, without `EarlyChange`, and
 /// the filters after it keep their encoded bytes. A stream that doesn't decode cleanly, or
-/// whose filters or parameters can't be read for certain, or that decodes past `max` bytes, is
-/// left as it is.
-fn lzw_to_flate(s: &Stream, max: usize) -> Option<Stream> {
+/// whose filters or parameters can't be read for certain, or that decodes past `max` bytes or
+/// what `budget` has left, is left as it is.
+fn lzw_to_flate(s: &Stream, max: usize, budget: &mut ImageBudget) -> Option<Stream> {
     // An external file's data isn't in `raw`; cross-reference and object streams are rewritten
     // on save, so converting them would change nothing in the file.
     if s.dict.contains(b"F") || matches!(s.dict.name(b"Type"), Some(b"XRef" | b"ObjStm")) {
@@ -512,7 +524,10 @@ fn lzw_to_flate(s: &Stream, max: usize) -> Option<Stream> {
     if !parms.get(..=lzw)?.iter().all(direct) {
         return None;
     }
-    let data = pdfcraft_filters::decode(stages, &s.raw, max).ok()?;
+    let data = budget.decode_chain(stages, &s.raw, max).ok()?;
+    if !budget.spend((data.len() as u64).saturating_mul(LZW_REWRITE_WORK)) {
+        return None;
+    }
     let flate = Params { early_change: 1, ..params.clone() };
     let raw = pdfcraft_filters::encode(&Filter::Flate, &flate, &data).ok()?;
     // The predictor's encoder must give back exactly what its decoder read (a short last row,
@@ -596,8 +611,31 @@ mod tests {
         let mut dict = Dict::new();
         dict.set(b"Filter".to_vec(), Object::name("LZWDecode"));
         let s = Stream::from_raw(dict, raw);
-        assert!(lzw_to_flate(&s, data.len() - 1).is_none());
-        let converted = lzw_to_flate(&s, data.len()).unwrap();
+        let mut budget = ImageBudget::with_work(u64::MAX);
+        assert!(lzw_to_flate(&s, data.len() - 1, &mut budget).is_none());
+        let converted = lzw_to_flate(&s, data.len(), &mut budget).unwrap();
         assert_eq!(converted.decoded_strict().unwrap(), data);
     }
+
+    /// Rewriting a stream spends the run's allowance: reading it, decoding it, and storing and
+    /// checking what it decoded. One the allowance can't pay for stays LZW, and ends the rewriting.
+    #[test]
+    fn lzw_streams_spend_the_runs_allowance() {
+        let data = b"0 0 m 612 792 l S\n".repeat(64);
+        let raw = pdfcraft_filters::encode(&Filter::Lzw, &Params::default(), &data).unwrap();
+        let mut dict = Dict::new();
+        dict.set(b"Filter".to_vec(), Object::name("LZWDecode"));
+        let s = Stream::from_raw(dict, raw);
+        let cost = (s.raw.len() + data.len()) as u64 + data.len() as u64 * LZW_REWRITE_WORK;
+        let mut budget = ImageBudget::with_work(cost + 7);
+        assert!(lzw_to_flate(&s, data.len(), &mut budget).is_some());
+        assert_eq!(budget.work_left(), 7);
+        let mut budget = ImageBudget::with_work(cost);
+        assert!(lzw_to_flate(&s, data.len(), &mut budget).is_some(), "exactly enough");
+        assert_eq!(budget.work_left(), 0);
+        let mut budget = ImageBudget::with_work(cost - 1);
+        assert!(lzw_to_flate(&s, data.len(), &mut budget).is_none(), "a step short");
+        assert_eq!(budget.work_left(), 0, "and the next stream isn't read");
+        assert!(lzw_to_flate(&s, data.len(), &mut budget).is_none());
+    }
 }
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index 2e3ea2d42f..ad710f3097 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -9,6 +9,12 @@ use pdfcraft_optimize::{
     effective_resolutions, optimize,
 };
 
+/// What image `s` decodes to, its fax or JBIG2 data included, with no limit on the work: the
+/// samples an operation would read through its `ImageBudget`.
+fn decoded_image(doc: &Document, s: &Stream) -> Result<Vec<u8>, pdfcraft_cos::CosError> {
+    pdfcraft_cos::ImageBudget::with_work(u64::MAX).decode(doc, s, pdfcraft_cos::MAX_DECODED)
+}
+
 fn image(doc: &mut Document, w: u32, h: u32, n: usize, jpeg: bool, smask: Option<ObjRef>) -> ObjRef {
     // A smooth gradient with a little texture (photo-like).
     let mut px = Vec::with_capacity((w * h) as usize * n);
@@ -910,7 +916,7 @@ fn rgb_and_two_colour_indexed_black_and_white_images_become_one_bit() {
             (Some(1), Some(&b"CCITTFaxDecode"[..]), Some(&cs)),
             "{i:?}"
         );
-        assert_eq!(doc.decoded_image(&s).unwrap(), text, "{i:?}");
+        assert_eq!(decoded_image(&doc, &s).unwrap(), text, "{i:?}");
         let decode = if i == rgb_inverted { Some(Object::Array(vec![1.into(), 0.into()])) } else { None };
         assert_eq!(s.dict.get(b"Decode").cloned(), decode, "{i:?}");
     }
@@ -1066,7 +1072,7 @@ fn retain_keeps_a_group_3_halftone_as_it_is() {
     let fax = doc.add(Object::Stream(Stream::from_raw(d, g3.clone())));
     // 7.68 pt for 64 samples is 600 ppi.
     page(&mut doc, &[("A", fax)], "q 7.68 0 0 7.68 100 600 cm /A Do Q");
-    assert_eq!(doc.decoded_image(&stream(&doc, fax)).unwrap().len(), 64 * 8, "the fixture decodes");
+    assert_eq!(decoded_image(&doc, &stream(&doc, fax)).unwrap().len(), 64 * 8, "the fixture decodes");
     let r = optimize(&mut doc, &Settings { mono: RETAIN, ..Settings::default() }).unwrap();
     assert_eq!((r.images_resampled, r.images_recompressed), (0, 0), "{r:?}");
     assert_eq!(stream(&doc, fax).raw[..], g3[..]);
@@ -1564,7 +1570,7 @@ fn ambiguous_monochrome_text_is_recompressed_without_lossy_reduction() {
     }
     assert_eq!(raw(&kept, hex_at_400), raw(&doc, hex_at_400), "and nothing else changes");
     for i in [flate, fax, hex_fax] {
-        assert_eq!((size(&kept, i), kept.decoded_image(&stream(&kept, i)).unwrap()), ((1200, 480), text.clone()), "{i:?}");
+        assert_eq!((size(&kept, i), decoded_image(&kept, &stream(&kept, i)).unwrap()), ((1200, 480), text.clone()), "{i:?}");
     }
     let bits = [eight, rgb, rgb_inverted].map(|i| stream(&kept, i).dict.int(b"BitsPerComponent"));
     assert_eq!(bits, [Some(8); 3], "Retain leaves eight bits to the grey and colour settings");
@@ -1578,7 +1584,7 @@ fn ambiguous_monochrome_text_is_recompressed_without_lossy_reduction() {
         let s = stream(&doc, i);
         assert_eq!((size(&doc, i), s.dict.int(b"BitsPerComponent")), ((1200, 480), if i == mask { None } else { Some(1) }));
         assert!(matches!(s.filters().as_slice(), [(Filter::CcittFax | Filter::Flate, _)]), "{i:?}");
-        assert_eq!(doc.decoded_image(&s).unwrap(), text.clone(), "{i:?}");
+        assert_eq!(decoded_image(&doc, &s).unwrap(), text.clone(), "{i:?}");
     }
     assert_eq!(stream(&doc, mask).dict.get(b"Decode"), Some(&decode), "the decode array stays");
     // Grey now, with grey's decode pair, which makes 1 black: its ties are black too.
@@ -1588,12 +1594,12 @@ fn ambiguous_monochrome_text_is_recompressed_without_lossy_reduction() {
         (size(&doc, rgb_inverted), s.dict.get(b"ColorSpace"), s.dict.get(b"Decode")),
         ((1200, 480), Some(&Object::name("DeviceGray")), Some(&inverting))
     );
-    assert_eq!(doc.decoded_image(&s).unwrap(), text.iter().map(|b| !b).collect::<Vec<u8>>(), "the same picture, ties black");
+    assert_eq!(decoded_image(&doc, &s).unwrap(), text.iter().map(|b| !b).collect::<Vec<u8>>(), "the same picture, ties black");
     for i in [at_400, soft, hex_at_400] {
         assert_eq!((size(&doc, i), stream(&doc, i).dict.name(b"Filter")), ((1200, 480), Some(&b"CCITTFaxDecode"[..])), "{i:?}");
     }
     assert!(raw(&doc, hex_at_400).len() < hex_len, "the ASCIIHexDecode is dropped");
-    assert_eq!(doc.decoded_image(&stream(&doc, hex_at_400)).unwrap(), text, "and the picture kept");
+    assert_eq!(decoded_image(&doc, &stream(&doc, hex_at_400)).unwrap(), text, "and the picture kept");
     assert_eq!([fax_at_400].map(|r| raw(&doc, r)), untouched);
     let after = render(&doc);
     assert_eq!(after, before, "conservative retention preserves the rendered page exactly");
@@ -1681,7 +1687,7 @@ fn a_fax_image_behind_a_decompression_bomb_is_left_alone() {
         let r = optimize(&mut doc, &Settings::default()).unwrap();
         if padding == 0 {
             assert_eq!(r.images_resampled, 0, "ambiguous local tones are retained: {r:?}");
-            assert_eq!(doc.decoded_image(&stream(&doc, img)).unwrap(), bilevel(w, h, false));
+            assert_eq!(decoded_image(&doc, &stream(&doc, img)).unwrap(), bilevel(w, h, false));
         } else {
             assert_eq!((r.images_resampled, r.images_recompressed), (0, 0), "{r:?}");
             assert_eq!(stream(&doc, img).raw, before);
@@ -1775,7 +1781,8 @@ fn monochrome_images_keep_what_they_should() {
     optimize(&mut doc, &Settings::default()).unwrap();
     assert_eq!([alone, deep].map(|r| raw(&doc, r)), before, "a Group 4 halftone alone, and sixteen-bit grey");
     assert_eq!(filters(&doc, wrapped), 1, "a wrapped Group 4 halftone is stored again alone by default");
-    assert_eq!(stream(&doc, scan).dict.name(b"Filter"), Some(&b"CCITTFaxDecode"[..]), "the scan: Group 4 is smaller");
+    assert!(matches!(stream(&doc, scan).filters().as_slice(), [(Filter::CcittFax | Filter::Flate, _)]), "the scan: Group 4 or Flate");
+    assert_eq!(decoded_image(&doc, &stream(&doc, scan)).unwrap(), ragged, "the scan preserves every sample");
     assert_eq!((stream(&doc, fax).dict.name(b"Filter"), filters(&doc, fax)), (Some(&b"CCITTFaxDecode"[..]), 1), "the busy fax image");
 
     let (mut doc, [_, wrapped, scan, _, _]) = build();
@@ -1784,7 +1791,7 @@ fn monochrome_images_keep_what_they_should() {
     assert_eq!(raw(&doc, wrapped), before, "Retain: a wrapped Group 4 halftone stays as it is");
     let s = stream(&doc, scan);
     assert_eq!((s.dict.int(b"Width"), s.dict.name(b"Filter")), (Some(1200), Some(&b"FlateDecode"[..])), "Retain: {r:?}");
-    assert_eq!(doc.decoded_image(&s).unwrap(), ragged, "Retain preserves every sample");
+    assert_eq!(decoded_image(&doc, &s).unwrap(), ragged, "Retain preserves every sample");
 }
 
 /// `rows` coded as CCITT Group 3, one-dimensional (`/K 0`): each row its runs in turn, white first,
@@ -1852,7 +1859,12 @@ fn group_3_fax_images_become_group_4() {
         let g3 = group_3(&runs, k > 0, on_bytes);
         let (end_of_line, encoded_byte_align) = (k > 0 && on_bytes.is_none(), on_bytes.is_some());
         let p = pdfcraft_filters::CcittParams { k, columns: w.into(), end_of_line, encoded_byte_align, ..Default::default() };
-        assert_eq!(pdfcraft_filters::decode_ccitt(&g3, &p, h).unwrap(), bits, "/K {k}, on bytes {on_bytes:?}: the Group 3 data is the picture");
+        let mut work = u64::MAX;
+        assert_eq!(
+            pdfcraft_filters::decode_ccitt_within(&g3, &p, h, &mut work).unwrap(),
+            bits,
+            "/K {k}, on bytes {on_bytes:?}: the Group 3 data is the picture"
+        );
 
         let mut doc = Document::new_empty();
         let mut d = Dict::new();
@@ -1885,7 +1897,7 @@ fn group_3_fax_images_become_group_4() {
         let s = stream(&doc, fax);
         assert_eq!(doc.fax_params(&s).map(|p| p.k), Some(-1), "/K {k}, on bytes {on_bytes:?}: Group 4");
         assert!(s.raw.len() < g3.len(), "{} bytes, from {}", s.raw.len(), g3.len());
-        assert_eq!(doc.decoded_image(&s).unwrap(), bits, "/K {k}, on bytes {on_bytes:?}: the same picture");
+        assert_eq!(decoded_image(&doc, &s).unwrap(), bits, "/K {k}, on bytes {on_bytes:?}: the same picture");
         assert!(render(&doc) == render(&control), "/K {k}, on bytes {on_bytes:?}: the page looks as the picture does");
     }
 }
@@ -2044,6 +2056,127 @@ fn rendered_text_becomes_jbig2_symbols() {
     assert!(render(&doc) == before, "the page looks the same");
 }
 
+/// A JBIG2 scan goes through Monochrome Images like any black-and-white image. Above 450 ppi it
+/// is averaged as its Flate copy is, to the same samples, and stored as each compression asks:
+/// Group 4 or JBIG2, or Flate when that is smaller, or under Retain JBIG2 again; alone or behind another
+/// filter, and with `/JBIG2Globals`, which the new image doesn't refer to. Below 450 ppi it is
+/// stored again only when that is smaller: a generic region of text stays under Group 4, which
+/// is larger, and under Retain, and becomes symbols with JBIG2 asked for; behind ASCIIHex it is
+/// stored again alone, as Group 4 where the hex is spaced out. A JBIG2 page taller than the image
+/// is left alone.
+#[test]
+fn jbig2_scans_are_averaged_and_stored_again() {
+    // Black squares 16 samples a side on even rows and columns: at 600 ppi, halving leaves no new
+    // pixel covering both samples, so nothing keeps the picture at its resolution.
+    let (w, h) = (1200u32, 480u32);
+    let stride = (w as usize).div_ceil(8);
+    let mut squares = vec![0xFFu8; stride * h as usize];
+    for (top, left) in (0..h as usize / 32).flat_map(|r| (0..w as usize / 32).map(move |c| (r * 32 + 8, c * 32 + 8))) {
+        for y in top..top + 16 {
+            for x in left..left + 16 {
+                squares[y * stride + x / 8] &= !(0x80 >> (x % 8));
+            }
+        }
+    }
+    let grey = [("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceGray"))];
+    let hex = |coded: &[u8]| -> Vec<u8> { coded.iter().flat_map(|b| format!("{b:02x}").into_bytes()).chain(*b">").collect() };
+    // An image of `coded` behind `filters`, with globals a decoder skips when `globals`, drawn at
+    // `width` × `height` pt.
+    let jbig2_page = |coded: &[u8], filters: &[&str], globals: bool, (iw, ih): (u32, u32), (width, height): (f64, f64)| {
+        let mut doc = Document::new_empty();
+        let mut d = Dict::new();
+        d.set(b"Subtype".to_vec(), Object::name("Image"));
+        d.set(b"Width".to_vec(), Object::Int(iw.into()));
+        d.set(b"Height".to_vec(), Object::Int(ih.into()));
+        for (k, v) in &grey {
+            d.set(k.as_bytes().to_vec(), v.clone());
+        }
+        d.set(b"Filter".to_vec(), Object::Array(filters.iter().map(|f| Object::name(f)).collect()));
+        if globals {
+            let g = doc.add(Object::Stream(Stream::from_raw(Dict::new(), vec![0, 0, 0, 0, 0x3E, 0, 0, 0, 0, 0, 4, 0, 0, 0, 1])));
+            let mut parms = Dict::new();
+            parms.set(b"JBIG2Globals".to_vec(), Object::Ref(g));
+            let entries = filters.iter().map(|f| if *f == "JBIG2Decode" { Object::Dict(parms.clone()) } else { Object::Null }).collect();
+            d.set(b"DecodeParms".to_vec(), Object::Array(entries));
+        }
+        let data = if filters.len() > 1 { hex(coded) } else { coded.to_vec() };
+        let im = doc.add(Object::Stream(Stream::from_raw(d, data)));
+        page(&mut doc, &[("Im", im)], &format!("q {width} 0 0 {height} 20 600 cm /Im Do Q"));
+        (doc, im)
+    };
+    let coded = pdfcraft_filters::encode_jbig2_generic(&squares, w, h).unwrap();
+    // 144 × 57.6 pt is 600 ppi.
+    let at_600 = (144.0, 57.6);
+    for compression in [MonoCompression::CcittG4, MonoCompression::Jbig2, MonoCompression::Retain] {
+        let settings = Settings { mono: MonoSettings { compression, ..MonoSettings::REDUCE }, ..Settings::default() };
+        let mut doc = Document::new_empty();
+        let im = mono_image(&mut doc, w, h, &squares, None, &grey);
+        page(&mut doc, &[("Im", im)], "q 144 0 0 57.6 20 600 cm /Im Do Q");
+        assert_eq!(optimize(&mut doc, &settings).unwrap().images_resampled, 1, "Flate, {compression:?}");
+        let averaged = decoded_image(&doc, &stream(&doc, im)).unwrap();
+        for (filters, globals) in [(&["JBIG2Decode"][..], false), (&["ASCIIHexDecode", "JBIG2Decode"][..], false), (&["JBIG2Decode"][..], true)] {
+            let (mut doc, im) = jbig2_page(&coded, filters, globals, (w, h), at_600);
+            let r = optimize(&mut doc, &settings).unwrap();
+            let s = stream(&doc, im);
+            let what = format!("{filters:?}, globals {globals}, {compression:?}: {r:?}");
+            assert_eq!((r.images_resampled, s.dict.int(b"Width"), s.dict.int(b"Height")), (1, Some(600), Some(240)), "{what}");
+            assert_eq!(decoded_image(&doc, &s).unwrap(), averaged, "{what}");
+            assert!(!s.dict.contains(b"DecodeParms") || s.dict.name(b"Filter") == Some(&b"CCITTFaxDecode"[..]), "{what}");
+            let filter = s.dict.name(b"Filter").map(<[u8]>::to_vec);
+            // The smallest of what each compression may store; under Retain, JBIG2 again.
+            let allowed: &[&[u8]] = match compression {
+                MonoCompression::CcittG4 => &[b"CCITTFaxDecode", b"FlateDecode"],
+                MonoCompression::Jbig2 => &[b"JBIG2Decode", b"FlateDecode"],
+                MonoCompression::Retain => &[b"JBIG2Decode"],
+            };
+            assert!(filter.as_deref().is_some_and(|f| allowed.contains(&f)), "{what}: {:?}", filter.map(String::from_utf8));
+        }
+    }
+
+    // At 300 ppi, below 450: rendered text, whose letters repeat, coded as one generic region.
+    let (tw, th) = (600u32, 480u32);
+    let text = rendered_text(tw, th);
+    let generic = pdfcraft_filters::encode_jbig2_generic(&text, tw, th).unwrap();
+    let at_300 = (144.0, 115.2);
+    for compression in [MonoCompression::CcittG4, MonoCompression::Retain] {
+        let settings = Settings { mono: MonoSettings { compression, ..MonoSettings::REDUCE }, ..Settings::default() };
+        let (mut doc, im) = jbig2_page(&generic, &["JBIG2Decode"], false, (tw, th), at_300);
+        let before = stream(&doc, im);
+        optimize(&mut doc, &settings).unwrap();
+        assert_eq!(stream(&doc, im), before, "JBIG2 below 450 ppi, {compression:?}");
+    }
+    let jbig2_asked = Settings { mono: MonoSettings { compression: MonoCompression::Jbig2, ..MonoSettings::REDUCE }, ..Settings::default() };
+    let (mut doc, im) = jbig2_page(&generic, &["JBIG2Decode"], false, (tw, th), at_300);
+    let r = optimize(&mut doc, &jbig2_asked).unwrap();
+    let s = stream(&doc, im);
+    assert_eq!((r.images_resampled, r.images_recompressed, s.dict.name(b"Filter")), (0, 1, Some(&b"JBIG2Decode"[..])), "{r:?}");
+    assert!(s.raw.len() * 2 < generic.len(), "symbols {} bytes, the generic region {}", s.raw.len(), generic.len());
+    assert_eq!(decoded_image(&doc, &s).unwrap(), text);
+    // Behind ASCIIHex it is stored again alone, being smaller so.
+    let (mut doc, im) = jbig2_page(&generic, &["ASCIIHexDecode", "JBIG2Decode"], false, (tw, th), at_300);
+    optimize(&mut doc, &jbig2_asked).unwrap();
+    let s = stream(&doc, im);
+    assert_eq!((s.filters().len(), s.dict.name(b"Filter")), (1, Some(&b"JBIG2Decode"[..])));
+    assert_eq!(decoded_image(&doc, &s).unwrap(), text);
+    // So it is as Group 4 when that is smaller: here the hex digits are spaced out, as ASCIIHex
+    // allows, so that the stream is many times the code.
+    let (mut doc, im) = jbig2_page(&generic, &["ASCIIHexDecode", "JBIG2Decode"], false, (tw, th), at_300);
+    let mut padded = stream(&doc, im);
+    padded.raw = generic.iter().flat_map(|b| format!("{b:02x}{}", " ".repeat(30)).into_bytes()).chain(*b">").collect::<Vec<u8>>().into();
+    doc.set(im, Object::Stream(padded));
+    optimize(&mut doc, &Settings::default()).unwrap();
+    let s = stream(&doc, im);
+    assert_eq!((s.filters().len(), s.dict.name(b"Filter")), (1, Some(&b"CCITTFaxDecode"[..])), "Group 4 alone");
+    assert_eq!(decoded_image(&doc, &s).unwrap(), text);
+
+    // A JBIG2 page taller than the image: the renderer draws the whole page into it, so it isn't
+    // read, and stays as it is.
+    let (mut doc, im) = jbig2_page(&coded, &["JBIG2Decode"], false, (w, h - 8), at_600);
+    let before = stream(&doc, im);
+    optimize(&mut doc, &Settings::default()).unwrap();
+    assert_eq!(stream(&doc, im), before, "a taller page");
+}
+
 /// A whole 300 dpi letter page of rendered text, more marks than one JBIG2 text region of the
 /// decoder PdfCraft renders with takes, still looks the same as JBIG2 symbols.
 #[test]
@@ -3277,6 +3410,42 @@ fn lzw_streams_become_flate_and_decode_to_the_same_bytes() {
     assert!(!stream(&doc, c_late).dict.contains(b"DecodeParms"), "nothing left to say for the content stream");
 }
 
+/// A stream can take a second or more to store again, so a cancel lands between any two of them,
+/// and nothing runs after it.
+#[test]
+fn a_cancel_lands_during_the_lzw_pass() {
+    use pdfcraft_optimize::{OptimizeError, Stage, optimize_with_progress};
+    let build = |streams: usize| {
+        let mut doc = Document::new_empty();
+        let mut d = Dict::new();
+        d.set(b"Filter".to_vec(), Object::name("LZWDecode"));
+        for _ in 0..streams {
+            doc.add(Object::Stream(Stream::from_raw(d.clone(), lzw(&lzw_ops(), &Params::default()))));
+        }
+        page(&mut doc, &[], "0 0 1 1 re f");
+        doc
+    };
+    let asked = |streams: usize| {
+        let mut asked = 0;
+        optimize_with_progress(&mut build(streams), &Settings::default(), &mut |s| {
+            asked += usize::from(s == Stage::CleanUp);
+            true
+        })
+        .unwrap();
+        asked
+    };
+    let none = asked(0);
+    assert_eq!(asked(3), none + 3, "once a stream");
+    let mut left = none + 1;
+    let mut doc = build(3);
+    let r = optimize_with_progress(&mut doc, &Settings::default(), &mut |s| {
+        left -= usize::from(s == Stage::CleanUp);
+        left > 0
+    });
+    assert!(matches!(r, Err(OptimizeError::Cancelled)), "{r:?}");
+    assert_eq!(left, 0, "nothing runs after it");
+}
+
 #[test]
 fn a_page_drawn_from_lzw_streams_renders_the_same_after_conversion() {
     let png = Params { predictor: 12, colors: 3, columns: 64, early_change: 0, ..Params::default() };
@@ -3393,10 +3562,12 @@ fn lzw_streams_that_cannot_be_read_or_are_not_asked_for_stay_unchanged() {
     assert_eq!(stream(&doc, c).decoded_strict().unwrap(), ops);
 }
 
-/// Unknown palette polarity is never guessed. Both palette orders and Decode directions
-/// retain the original thin rule and exact samples through a full save and render.
+/// An indexed image's palette says which sample is dark, so a thin rule survives averaging as it does
+/// in grey: with the palette either way round, and the decode array either way, the averaged image
+/// holds the averaged DeviceGray one's samples (flipped where its samples are), and looks the same
+/// through a full save and render.
 #[test]
-fn indexed_thin_rules_keep_their_samples_for_both_palette_orders_and_decodes() {
+fn indexed_thin_rules_survive_averaging_for_both_palette_orders_and_decodes() {
     let (w, h) = (1200u32, 480u32);
     let stride = (w as usize).div_ceil(8);
     let mut gray_data = vec![0xFF; stride * h as usize];
@@ -3408,8 +3579,9 @@ fn indexed_thin_rules_keep_their_samples_for_both_palette_orders_and_decodes() {
     page(&mut gray, &[("Im", gray_image)], "q 144 0 0 57.6 20 600 cm /Im Do Q");
     let gray_render = render(&gray);
     optimize(&mut gray, &Settings::default()).unwrap();
+    let gray_after = render(&Document::open(Arc::new(write_full(&gray, &SaveOptions::default()).unwrap())).unwrap());
     let gray_stream = stream(&gray, gray_image);
-    let gray_samples = gray.decoded_image(&gray_stream).unwrap();
+    let gray_samples = decoded_image(&gray, &gray_stream).unwrap();
     assert_eq!((gray_stream.dict.int(b"Width"), gray_stream.dict.int(b"Height")), (Some(600), Some(240)));
     assert!(gray_samples.iter().any(|b| *b != 0xFF), "the DeviceGray thin rule survives");
     for white_first in [false, true] {
@@ -3439,14 +3611,153 @@ fn indexed_thin_rules_keep_their_samples_for_both_palette_orders_and_decodes() {
             assert_eq!(before, gray_render, "the palette image is visually identical to DeviceGray");
             optimize(&mut doc, &Settings::default()).unwrap();
             let s = stream(&doc, image);
-            assert_eq!((s.dict.int(b"Width"), s.dict.int(b"Height")), (Some(w.into()), Some(h.into())));
-            assert_eq!(doc.decoded_image(&s).unwrap(), data);
+            assert_eq!((s.dict.int(b"Width"), s.dict.int(b"Height")), (Some(600), Some(240)), "white-first={white_first}, inverted={inverted}");
+            // The rows are 600 samples, whole bytes: flipping each byte flips each sample.
+            let expected: Vec<u8> = gray_samples.iter().map(|b| if white_first != inverted { !b } else { *b }).collect();
+            assert_eq!(decoded_image(&doc, &s).unwrap(), expected, "white-first={white_first}, inverted={inverted}: the rule is dark");
             let saved = Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap();
-            assert_eq!(render(&saved), before, "palette white-first={white_first}, inverted={inverted}");
+            assert!(render(&saved) == gray_after, "palette white-first={white_first}, inverted={inverted}");
         }
     }
 }
 
+/// An indexed image also drawn where the optimizer doesn't read (an annotation's appearance, where
+/// other default colour spaces may be in force and change which palette entry is darker) keeps its
+/// resolution, as black-and-white RGB keeps its colour space; drawn only on the page, it is
+/// averaged. A grey image is averaged either way: sample 0 stays dark in a grey space, and only an
+/// indexed image's palette depends on what's in force where it is drawn.
+#[test]
+fn an_indexed_image_used_beyond_the_page_content_read_is_not_averaged() {
+    let (w, h) = (1200u32, 480u32);
+    let stride = (w as usize).div_ceil(8);
+    let mut data = vec![0xFF; stride * h as usize];
+    for y in 0..h as usize {
+        data[y * stride + 101 / 8] &= !(0x80 >> (101 % 8));
+    }
+    let palette = Object::String(pdfcraft_cos::PdfString::literal(vec![0, 0, 0, 255, 255, 255]));
+    let indexed = Object::Array(vec![Object::name("Indexed"), Object::name("DeviceRGB"), 1.into(), palette]);
+    let cases = [(&indexed, false, 600), (&indexed, true, 1200), (&Object::name("DeviceGray"), false, 600), (&Object::name("DeviceGray"), true, 600)];
+    for (cs, in_annotation, width) in cases {
+        let mut doc = Document::new_empty();
+        let image = mono_image(&mut doc, w, h, &data, None, &[("BitsPerComponent", 1.into()), ("ColorSpace", cs.clone())]);
+        // 144 × 57.6 pt is 600 ppi.
+        let p = page(&mut doc, &[("Im", image)], "q 144 0 0 57.6 20 600 cm /Im Do Q");
+        if in_annotation {
+            let resources = Object::Dict({
+                let mut r = Dict::new();
+                r.set(b"XObject".to_vec(), Object::Dict(xobject_dict(&[("Im", image)])));
+                r
+            });
+            let appearance = drawing(&mut doc, Some(resources), &form_entries());
+            annotate(&mut doc, p, appearance);
+        }
+        optimize(&mut doc, &Settings::default()).unwrap();
+        assert_eq!(stream(&doc, image).dict.int(b"Width"), Some(width), "{cs:?}, in an annotation: {in_annotation}");
+    }
+}
+
+/// Which palette entry is darker comes from the colours, weighted as luma, and blue is darker than
+/// red whichever comes first. An array shaped like an indexed colour space and named otherwise has
+/// no palette, so its samples aren't averaged.
+#[test]
+fn an_indexed_palette_is_read_by_the_luma_of_its_colours() {
+    let (w, h) = (1200u32, 480u32);
+    let stride = (w as usize).div_ceil(8);
+    let mut data = vec![0xFF; stride * h as usize];
+    for y in 0..h as usize {
+        data[y * stride + 101 / 8] &= !(0x80 >> (101 % 8));
+    }
+    let palette = Object::String(pdfcraft_cos::PdfString::literal(vec![0, 0, 255, 255, 0, 0]));
+    let optimized = |space: &str| {
+        let cs = Object::Array(vec![Object::name(space), Object::name("DeviceRGB"), 1.into(), palette.clone()]);
+        let mut doc = Document::new_empty();
+        let image = mono_image(&mut doc, w, h, &data, None, &[("BitsPerComponent", 1.into()), ("ColorSpace", cs)]);
+        page(&mut doc, &[("Im", image)], "q 144 0 0 57.6 20 600 cm /Im Do Q");
+        optimize(&mut doc, &Settings::default()).unwrap();
+        let s = stream(&doc, image);
+        (s.dict.int(b"Width"), decoded_image(&doc, &s).unwrap())
+    };
+    let (width, samples) = optimized("Indexed");
+    assert_eq!(width, Some(600));
+    assert!(samples.iter().any(|b| *b != 0xFF), "the blue line, half a new pixel wide, stays as the dark sample");
+    assert_eq!(optimized("NotIndexed").0, Some(1200));
+}
+
+/// What is averaged, by how the image is spelled. A family or a base by reference, or a device base
+/// alone in an array, is the same colour space. `/I`, an inline abbreviation, and a real `hival`
+/// aren't one, and neither is a table too large to be a palette, which images share and which
+/// would be read for each. A colour key can hide the dark sample a tie goes to, so a thin rule of
+/// the other would be lost, in grey too; a stencil `/Mask` doesn't.
+#[test]
+fn an_indexed_image_is_averaged_only_in_a_spelling_it_can_read() {
+    let (w, h) = (1200u32, 480u32);
+    let stride = (w as usize).div_ceil(8);
+    let mut data = vec![0xFF; stride * h as usize];
+    for y in 0..h as usize {
+        data[y * stride + 101 / 8] &= !(0x80 >> (101 % 8));
+    }
+    let table = || Object::String(pdfcraft_cos::PdfString::literal(vec![0, 0, 0, 255, 255, 255]));
+    let indexed = |family: Object, base: Object, hival: Object, table: Object| Object::Array(vec![family, base, hival, table]);
+    let rgb = || Object::name("DeviceRGB");
+    let plain = || indexed(Object::name("Indexed"), rgb(), 1.into(), table());
+    let width = |make: &dyn Fn(&mut Document) -> Vec<(&'static str, Object)>| {
+        let mut doc = Document::new_empty();
+        let mut entries = vec![("BitsPerComponent", Object::Int(1))];
+        entries.extend(make(&mut doc));
+        let image = mono_image(&mut doc, w, h, &data, None, &entries);
+        page(&mut doc, &[("Im", image)], "q 144 0 0 57.6 20 600 cm /Im Do Q");
+        optimize(&mut doc, &Settings::default()).unwrap();
+        stream(&doc, image).dict.int(b"Width")
+    };
+    let averaged = Some(600);
+    let kept = Some(1200);
+    assert_eq!(width(&|_| vec![("ColorSpace", plain())]), averaged, "direct");
+    assert_eq!(
+        width(&|doc: &mut Document| {
+            let family = doc.add(Object::name("Indexed"));
+            vec![("ColorSpace", indexed(Object::Ref(family), rgb(), 1.into(), table()))]
+        }),
+        averaged,
+        "the family by reference"
+    );
+    let base = Object::Array(vec![rgb()]);
+    assert_eq!(width(&|_| vec![("ColorSpace", indexed(Object::name("Indexed"), base.clone(), 1.into(), table()))]), averaged, "the base in an array");
+    assert_eq!(width(&|_| vec![("ColorSpace", indexed(Object::name("I"), rgb(), 1.into(), table()))]), kept, "an inline abbreviation");
+    assert_eq!(width(&|_| vec![("ColorSpace", indexed(Object::name("Indexed"), rgb(), Object::Real(1.0), table()))]), kept, "a real hival");
+    let long = Object::String(pdfcraft_cos::PdfString::literal([vec![0, 0, 0, 255, 255, 255], vec![0; 4097]].concat()));
+    assert_eq!(width(&|_| vec![("ColorSpace", indexed(Object::name("Indexed"), rgb(), 1.into(), long.clone()))]), kept, "a string past a palette");
+    // 16 KiB of raw data is all a table may take, whatever it decodes to.
+    let mut d = Dict::new();
+    d.set(b"Filter".to_vec(), Object::name("ASCIIHexDecode"));
+    let table_of = |raw: usize| {
+        let d = d.clone();
+        let hex: Vec<u8> = b"000000FFFFFF".iter().copied().chain(std::iter::repeat_n(b' ', raw - 13)).chain(*b">").collect();
+        move |doc: &mut Document| doc.add(Object::Stream(pdfcraft_cos::Stream::from_raw(d.clone(), hex.clone())))
+    };
+    for (raw, expected) in [(16384, averaged), (16385, kept)] {
+        let add = table_of(raw);
+        assert_eq!(
+            width(&|doc: &mut Document| {
+                let table = add(doc);
+                vec![("ColorSpace", indexed(Object::name("Indexed"), rgb(), 1.into(), Object::Ref(table)))]
+            }),
+            expected,
+            "a stream of {raw} bytes"
+        );
+    }
+    let key = || Object::Array(vec![0.into(), 0.into()]);
+    assert_eq!(width(&|_| vec![("ColorSpace", plain()), ("Mask", key())]), kept, "a colour key, indexed");
+    assert_eq!(width(&|_| vec![("ColorSpace", Object::name("DeviceGray")), ("Mask", key())]), kept, "a colour key, grey");
+    assert_eq!(
+        width(&|doc: &mut Document| {
+            let key = doc.add(key());
+            vec![("ColorSpace", plain()), ("Mask", Object::Ref(key))]
+        }),
+        kept,
+        "a colour key by reference"
+    );
+}
+
 /// White margins must not hide a small screened photograph from the tone guard.
 #[test]
 fn mixed_text_and_small_halftone_regions_keep_their_tones_with_wide_white_margins() {
@@ -3472,8 +3783,107 @@ fn mixed_text_and_small_halftone_regions_keep_their_tones_with_wide_white_margin
         optimize(&mut doc, &Settings::default()).unwrap();
         let s = stream(&doc, image);
         assert_eq!((s.dict.int(b"Width"), s.dict.int(b"Height")), (Some(w.into()), Some(h.into())));
-        assert_eq!(doc.decoded_image(&s).unwrap(), data, "screened samples survive, not a solid patch");
+        assert_eq!(decoded_image(&doc, &s).unwrap(), data, "screened samples survive, not a solid patch");
         let saved = Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap();
         assert_eq!(render(&saved), before, "local halftone {side}x{side}");
     }
 }
+
+/// A one-bit stencil of `w` × `h`, solid but for a hole in its middle.
+fn stencil(doc: &mut Document, w: u32, h: u32) -> ObjRef {
+    let row = (w as usize).div_ceil(8);
+    let mut bits = vec![0u8; row * h as usize];
+    for y in (h as usize / 3)..(2 * h as usize / 3) {
+        for x in (w as usize / 3)..(2 * w as usize / 3) {
+            bits[y * row + x / 8] |= 0x80 >> (x % 8);
+        }
+    }
+    let mut d = Dict::new();
+    d.set(b"Type".to_vec(), Object::name("XObject"));
+    d.set(b"Subtype".to_vec(), Object::name("Image"));
+    d.set(b"ImageMask".to_vec(), Object::Bool(true));
+    d.set(b"Width".to_vec(), Object::Int(i64::from(w)));
+    d.set(b"Height".to_vec(), Object::Int(i64::from(h)));
+    d.set(b"BitsPerComponent".to_vec(), Object::Int(1));
+    doc.add(Object::Stream(Stream::flate(d, &bits)))
+}
+
+/// A picture with a stencil mask is made smaller like any other: the mask has a resolution of its
+/// own, so it stays exactly as it was and the hole it cuts stays where it was.
+#[test]
+fn a_picture_with_a_stencil_mask_is_downsampled_under_its_mask() {
+    let mut doc = Document::new_empty();
+    let mask = stencil(&mut doc, 1200, 1200);
+    let img = image(&mut doc, 1200, 1200, 3, true, None);
+    let mut s = stream(&doc, img);
+    s.dict.set(b"Mask".to_vec(), Object::Ref(mask));
+    doc.set(img, Object::Stream(s));
+    let mask_before = stream(&doc, mask);
+    // 1200 pixels over two inches: 600 ppi.
+    page(&mut doc, &[("Im0", img)], "0 0 1 rg 0 0 612 792 re f q 144 0 0 144 100 100 cm /Im0 Do Q");
+    let before = render(&doc);
+    let report = optimize(&mut doc, &Settings::default()).unwrap();
+    assert_eq!(report.images_resampled, 1, "{report:?}");
+    let after = stream(&doc, img);
+    assert_eq!(after.dict.int(b"Width"), Some(300), "150 ppi");
+    assert_eq!(after.dict.reference(b"Mask"), Some(mask), "the mask stays on it");
+    assert_eq!(stream(&doc, mask), mask_before, "and doesn't change");
+    let rendered = render(&doc);
+    assert_eq!(rendered.len(), before.len());
+    let changed = before.iter().zip(&rendered).filter(|(a, b)| a.abs_diff(**b) > 96).count();
+    assert!(changed * 200 < before.len(), "the masked picture looks the same: {changed} of {} samples far off", before.len());
+    // The hole, the middle third of the picture on the 612 by 792 page, still shows what's behind it.
+    // Its first pixel all round is left out: the coarser picture blends into that a little.
+    for y in 597..643 {
+        for x in 149..195 {
+            let i = (y * 612 + x) * 4;
+            assert_eq!(rendered[i..i + 4], before[i..i + 4], "hole pixel ({x}, {y})");
+        }
+    }
+}
+
+/// A colour-key mask names sample values: resampling or JPEG would make holes where there were none
+/// and fill those there were, so the picture stays as it is, however the array is written. A mask
+/// that can't be read as a stencil is no reason to change the picture either.
+#[test]
+fn a_picture_whose_mask_is_not_a_stencil_is_left_alone() {
+    type Mask = fn(&mut Document) -> Object;
+    fn key() -> Object {
+        Object::Array([250, 255, 250, 255, 250, 255].map(Object::Int).to_vec())
+    }
+    fn not_a_stencil(doc: &mut Document, change: fn(&mut Dict)) -> Object {
+        let mask = stencil(doc, 1200, 1200);
+        let mut s = stream(doc, mask);
+        change(&mut s.dict);
+        doc.set(mask, Object::Stream(s));
+        Object::Ref(mask)
+    }
+    let masks: [(&str, Mask); 5] = [
+        ("direct array", |_| key()),
+        ("array by reference", |doc| Object::Ref(doc.add(key()))),
+        ("nothing there", |doc| Object::Ref(doc.add(Object::Null))),
+        ("an image that says it isn't a stencil", |doc| {
+            not_a_stencil(doc, |d| {
+                d.set(b"ImageMask".to_vec(), Object::Bool(false));
+            })
+        }),
+        ("an image that doesn't say it is one", |doc| {
+            not_a_stencil(doc, |d| {
+                d.remove(b"ImageMask");
+            })
+        }),
+    ];
+    for (what, mask) in masks {
+        let mut doc = Document::new_empty();
+        let img = image(&mut doc, 1200, 1200, 3, true, None);
+        let mut s = stream(&doc, img);
+        let mask = mask(&mut doc);
+        s.dict.set(b"Mask".to_vec(), mask);
+        doc.set(img, Object::Stream(s));
+        let before = stream(&doc, img);
+        page(&mut doc, &[("Im0", img)], "q 144 0 0 144 100 100 cm /Im0 Do Q");
+        let report = optimize(&mut doc, &Settings::default()).unwrap();
+        assert_eq!(report.images_resampled + report.images_recompressed, 0, "{what}: {report:?}");
+        assert_eq!(stream(&doc, img), before, "{what}");
+    }
+}
diff --git a/crates/print/README.md b/crates/print/README.md
index 1379be2b42..5db83312ca 100644
--- a/crates/print/README.md
+++ b/crates/print/README.md
@@ -46,7 +46,9 @@ Headless `doc_print` defaults are unchanged.
 `spool` delegates discovery, driver options, preferences and submission to
 [`craft-print`](https://github.com/storytold/craft-libs/tree/main/crates/print).
 PdfCraft retains page selection, imposition, annotations and print-permission checks.
-CUPS jobs stream through stdin with `fit-to-page=false`. Windows renders sheets through
+CUPS jobs stream through stdin with `fit-to-page=false`; on macOS they also carry the job
+name and owner (`com.apple.print.JobInfo.PMJobName`, `PMJobOwner`) as the system print dialog
+sends them, which some vendors' filters need (#5743). Windows renders sheets through
 `Windows.Data.Pdf` and spools them at their physical PDF size with per-page paper and
 orientation, zero added margins and hardware-edge clipping. Long-edge and short-edge duplex
 use the corresponding Windows binding edges. Random, exclusively created Windows job files
diff --git a/crates/print/src/spool.rs b/crates/print/src/spool.rs
index 23a77bdd2f..b16f57026d 100644
--- a/crates/print/src/spool.rs
+++ b/crates/print/src/spool.rs
@@ -196,11 +196,59 @@ pub(crate) fn printer_options_via_within(
     options
 }
 
+/// The keys the macOS print dialog names a job's title and owner under.
+#[cfg_attr(not(target_os = "macos"), allow(dead_code))]
+const JOB_NAME_KEY: &str = "com.apple.print.JobInfo.PMJobName";
+#[cfg_attr(not(target_os = "macos"), allow(dead_code))]
+const JOB_OWNER_KEY: &str = "com.apple.print.JobInfo.PMJobOwner";
+
+/// `text` as a job option's value: `lp_args` passes on only printable ASCII, up to 64 bytes,
+/// without `/ : = "`, and CUPS would take `'` and `\` as quoting and `{` as the start of a
+/// collection, so all of these become `_`. Text with nothing left of it, such as a title in
+/// another script, takes `fallback`: the job must still name something. So does a bare `true` or
+/// `false`, which CUPS would send as a boolean, not the name a filter reads.
+#[cfg_attr(not(target_os = "macos"), allow(dead_code))]
+fn job_option_value(text: &str, fallback: &str) -> String {
+    let kept = |c: char| c.is_ascii_graphic() && !matches!(c, '/' | ':' | '=' | '"' | '\'' | '\\' | '{');
+    let value: String = text.chars().take(64).map(|c| if kept(c) { c } else { '_' }).collect();
+    if !text.chars().any(kept) || value.eq_ignore_ascii_case("true") || value.eq_ignore_ascii_case("false") {
+        return fallback.to_string();
+    }
+    value
+}
+
+/// `job` naming its title and `owner` as a job from the macOS print dialog does. `lp` sends
+/// neither, and a driver's filter can depend on them: Kyocera's crashes without them, so nothing
+/// prints, while the same file sent with both does (#5743). A value the caller set stands: the
+/// last of a repeated option wins in CUPS, which compares their names without case.
+#[cfg_attr(not(target_os = "macos"), allow(dead_code))]
+pub(crate) fn with_job_info(job: &Job, owner: Option<&str>) -> Job {
+    let mut named = job.clone();
+    for (key, value) in [(JOB_NAME_KEY, job.title.as_str()), (JOB_OWNER_KEY, owner.unwrap_or_default())] {
+        if !job.options.iter().any(|(k, _)| k.eq_ignore_ascii_case(key)) {
+            named.options.push((key.to_string(), job_option_value(value, "PdfCraft")));
+        }
+    }
+    named
+}
+
+/// The job as the system spooler takes it.
+fn spooled(job: &Job) -> Job {
+    #[cfg(target_os = "macos")]
+    {
+        with_job_info(job, std::env::var("USER").ok().as_deref())
+    }
+    #[cfg(not(target_os = "macos"))]
+    {
+        job.clone()
+    }
+}
+
 pub fn submit(pdf: &[u8], job: &Job) -> Result<String, crate::PrintError> {
     if let Some(dll) = missing_print_dll() {
         return Err(unavailable(dll));
     }
-    craft_print::submit(pdf, job).map_err(|e| crate::PrintError::Spool(e.to_string()))
+    craft_print::submit(pdf, &spooled(job)).map_err(|e| crate::PrintError::Spool(e.to_string()))
 }
 
 /// [`submit`], told `(sent, sheets)` as each sheet reaches the spooler (Windows; CUPS takes the
@@ -209,7 +257,7 @@ pub fn submit_with_progress(pdf: &[u8], job: &Job, progress: &mut dyn FnMut(usiz
     if let Some(dll) = missing_print_dll() {
         return Err(unavailable(dll));
     }
-    craft_print::submit_with_progress(pdf, job, progress).map_err(|e| crate::PrintError::Spool(e.to_string()))
+    craft_print::submit_with_progress(pdf, &spooled(job), progress).map_err(|e| crate::PrintError::Spool(e.to_string()))
 }
 
 pub fn open_printer_preferences(printer: &str) -> Result<(), crate::PrintError> {
diff --git a/crates/print/src/tests.rs b/crates/print/src/tests.rs
index 9d8a469cdc..3256374b31 100644
--- a/crates/print/src/tests.rs
+++ b/crates/print/src/tests.rs
@@ -305,6 +305,107 @@ fn spooler_arguments_and_printer_list() {
     assert_eq!(lp_args(&Job::default())[0], "-n", "no -d: the default printer");
 }
 
+/// The job name and owner, read from the `lp` arguments, since `lp_args` drops a value it can't
+/// pass on: the job must reach the spooler named, whatever its title holds (#5743).
+#[test]
+fn a_job_names_its_title_and_owner_to_the_spooler() {
+    let args_for = |title: &str, owner: Option<&str>| {
+        let job = Job { title: title.into(), ..Job::default() };
+        lp_args(&spool::with_job_info(&job, owner))
+    };
+    let option = |args: &[String], key: &str| {
+        let prefix = format!("com.apple.print.JobInfo.{key}=");
+        args.iter().find_map(|a| a.strip_prefix(prefix.as_str()).map(str::to_string))
+    };
+    let args = args_for("memo.pdf", Some("sam"));
+    assert_eq!(option(&args, "PMJobName").as_deref(), Some("memo.pdf"), "{args:?}");
+    assert_eq!(option(&args, "PMJobOwner").as_deref(), Some("sam"), "{args:?}");
+    // The title keeps its place as `-t`, in full.
+    assert!(args_for("Q3 report: a/b=\"c\".pdf", None).windows(2).any(|w| w[0] == "-t" && w[1] == "Q3 report: a/b=\"c\".pdf"));
+
+    let named = args_for("Q3 report: a/b=\"c\".pdf", None);
+    assert_eq!(option(&named, "PMJobName").as_deref(), Some("Q3_report__a_b__c_.pdf"), "what lp can't be given becomes _");
+    assert_eq!(option(&named, "PMJobOwner").as_deref(), Some("PdfCraft"), "no owner known: the filter still gets one");
+
+    for nothing_left in ["", "   ", "見積書", "/:=\""] {
+        assert_eq!(option(&args_for(nothing_left, Some("")), "PMJobName").as_deref(), Some("PdfCraft"), "{nothing_left:?}");
+    }
+    assert_eq!(option(&args_for("見積書2.pdf", None), "PMJobName").as_deref(), Some("___2.pdf"), "a part of it is kept");
+    let long = option(&args_for(&format!("a{}", "é".repeat(200)), None), "PMJobName").unwrap_or_default();
+    assert_eq!(long.len(), 64, "cut to what lp_args takes, on a multi-byte title too: {long}");
+
+    // What CUPS would quote away or send as another type, as this Mac's libcups does.
+    for (title, name) in [("it's.pdf", "it_s.pdf"), (r"a\b.pdf", "a_b.pdf"), ("{draft}.pdf", "_draft}.pdf"), ("a{b", "a_b")] {
+        assert_eq!(option(&args_for(title, None), "PMJobName").as_deref(), Some(name), "{title:?}");
+    }
+    for boolean in ["true", "TRUE", "false", "False"] {
+        assert_eq!(option(&args_for(boolean, Some(boolean)), "PMJobName").as_deref(), Some("PdfCraft"), "{boolean:?}");
+        assert_eq!(option(&args_for(boolean, Some(boolean)), "PMJobOwner").as_deref(), Some("PdfCraft"), "{boolean:?}");
+    }
+    assert_eq!(option(&args_for("true.pdf", None), "PMJobName").as_deref(), Some("true.pdf"), "only the bare word is a boolean");
+}
+
+/// A job's own values stand: CUPS keeps the last of a repeated option, ignoring the case of its
+/// name, so a default after them would replace what a `doc_print` caller set (#5743).
+#[test]
+fn a_job_keeps_the_title_and_owner_it_already_sets() {
+    let values = |job: &Job, key: &str| -> Vec<String> {
+        let found = spool::with_job_info(job, Some("sam")).options;
+        found.into_iter().filter(|(k, _)| k.eq_ignore_ascii_case(key)).map(|(_, v)| v).collect()
+    };
+    let (name, owner) = ("com.apple.print.JobInfo.PMJobName", "com.apple.print.JobInfo.PMJobOwner");
+    let job = Job { title: "memo.pdf".into(), options: vec![(name.to_string(), "Mine".to_string())], ..Job::default() };
+    assert_eq!(values(&job, name), ["Mine"]);
+    assert_eq!(values(&job, owner), ["sam"], "the one it left out still gets its default");
+
+    let job = Job { title: "memo.pdf".into(), options: vec![(owner.to_ascii_uppercase(), "Theirs".to_string())], ..Job::default() };
+    assert_eq!(values(&job, owner), ["Theirs"]);
+    assert_eq!(values(&job, name), ["memo.pdf"]);
+}
+
+/// Both ways to submit reach `lp` with the job named. `lp` comes from `PATH`, which only a child
+/// process can change here, so the test runs itself again with a stand-in that records its
+/// arguments; no job reaches a real spooler (#5743).
+#[cfg(target_os = "macos")]
+#[test]
+fn a_submitted_job_reaches_lp_named() {
+    const TEST: &str = "tests::a_submitted_job_reaches_lp_named";
+    if let Ok(way) = std::env::var("PDFCRAFT_SUBMIT_TO_STAND_IN") {
+        let job = Job { title: "memo.pdf".into(), ..Job::default() };
+        let sent = match way.as_str() {
+            "submit" => spool::submit(b"%PDF-1.7", &job),
+            _ => spool::submit_with_progress(b"%PDF-1.7", &job, &mut |_, _| {}),
+        };
+        assert!(sent.is_ok(), "{sent:?}");
+        return;
+    }
+    use std::os::unix::fs::PermissionsExt as _;
+    let dir = std::env::temp_dir().join(format!("pdfcraft-lp-stand-in-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).expect("temp dir");
+    let lp = dir.join("lp");
+    let recorded = dir.join("args");
+    let script =
+        format!("#!/bin/sh\nprintf '%s\\n' \"$@\" > '{}'\n/bin/cat > /dev/null\necho 'request id is stand-in-1 (1 file(s))'\n", recorded.display());
+    std::fs::write(&lp, script).expect("stand-in");
+    std::fs::set_permissions(&lp, std::fs::Permissions::from_mode(0o700)).expect("executable");
+    for way in ["submit", "submit_with_progress"] {
+        let _ = std::fs::remove_file(&recorded);
+        let this = std::env::current_exe().expect("this test binary");
+        let child = std::process::Command::new(this)
+            .args(["--exact", TEST, "--nocapture"])
+            .env("PDFCRAFT_SUBMIT_TO_STAND_IN", way)
+            .env("PATH", &dir)
+            .env("USER", "sam")
+            .output()
+            .expect("run the test again");
+        assert!(child.status.success(), "{way}: {}", String::from_utf8_lossy(&child.stdout));
+        let args = std::fs::read_to_string(&recorded).expect("lp was run");
+        assert!(args.lines().any(|a| a == "com.apple.print.JobInfo.PMJobName=memo.pdf"), "{way}: {args}");
+        assert!(args.lines().any(|a| a == "com.apple.print.JobInfo.PMJobOwner=sam"), "{way}: {args}");
+    }
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
 #[test]
 fn lpstat_output_is_untranslated() {
     // A localized lpstat (here Polish) is unreadable to parse_lpstat...
diff --git a/crates/redact/Cargo.toml b/crates/redact/Cargo.toml
index 8d1515d8a4..fe21d13b32 100644
--- a/crates/redact/Cargo.toml
+++ b/crates/redact/Cargo.toml
@@ -17,8 +17,9 @@ pdfcraft-forms = { workspace = true }
 pdfcraft-edit = { workspace = true }
 pdfcraft-annot = { workspace = true }
 pdfcraft-xfa = { workspace = true }
+# CCITT Group 4 and JBIG2 encoding for cleared one-bit images.
+pdfcraft-filters = { workspace = true }
 thiserror = { workspace = true }
 
 [dev-dependencies]
-pdfcraft-filters = { workspace = true }
 pdfcraft-testkit = { workspace = true }
diff --git a/crates/redact/README.md b/crates/redact/README.md
index 8383f0119f..db9f46b8c9 100644
--- a/crates/redact/README.md
+++ b/crates/redact/README.md
@@ -18,16 +18,29 @@ clear_marks(&mut doc, None)?;                        // remove marks without app
   more than a fifth of its size (or a point) both ways; zero-size text goes when its origin is
   inside;
 - **images**: fully covered → removed; partly covered → a copy with the covered pixels cleared
-  (8/16-bit and 1/2/4-bit images, image masks; Flate/LZW/RL/A85/AHx, and CCITT fax as the last
-  filter, decoded through `Document::decoded_image_within`; `/DecodeParms` given by reference,
-  numbers inside included, count). Codecs redaction doesn't decode (DCT, JPX, JBIG2) are removed
-  whole (fail-closed), and so is Group 3 on bytes (`/K` 0 or more, `/EncodedByteAlign`): PdfCraft's
+  (8/16-bit and 1/2/4-bit images, image masks; Flate/LZW/RL/A85/AHx, and CCITT fax or JBIG2 as
+  the last filter, decoded through `Document::decoded_image_within`, a JBIG2 image with its
+  `/JBIG2Globals`; `/DecodeParms` given by reference, numbers inside included, count). The copy
+  is Flate, or for a one-bit image of one component (a scan as a rule) CCITT Group 4, or JBIG2
+  when it was JBIG2, whichever is smallest as stored, coded from the cleared samples; it refers to
+  no globals. Globals hold the shapes of every image that shares them (a scan's pages, often),
+  those of marks under the area included, so every other image that uses the globals of a removed
+  or replaced image is decoded and stored again in place without them, as a copy is (Flate,
+  Group 4 or JBIG2, whichever is smallest; `Report::images_restored`), and they leave the file on the full rewrite; one that can't be
+  decoded for certain refuses the redaction (`RedactError::SharedJbig2Globals`). Codecs redaction doesn't decode (DCT, JPX) are
+  removed whole (fail-closed), and so is a JBIG2 image whose page isn't its size (the renderer
+  draws the whole page into the image, so the rows cleared wouldn't be the ones shown) or of more
+  than one bit or component, and Group 3 on bytes (`/K` 0 or more, `/EncodedByteAlign`): PdfCraft's
   renderer draws some of its layouts (the fill ending each end-of-line code on a byte) as other
   rows than the decoder reads, so a mark over what is shown needn't cover what is cleared; inline images under an area are removed. Images with separate `/SMask`
   or `/Mask` data, and images whose data decodes to more than three times their declared raster
   and a byte per row, plus 4 KiB (ASCIIHex text broken into lines under Flate is a little over
   twice; for a fax image's code, about a byte per pixel), are removed whole;
   cleared copies drop `/Alternates` so alternate pixels cannot survive;
+  A run that would decode more of its images than one redaction may (`pdfcraft_cos::ImageBudget`,
+  filters, decoders and pixels alike) is refused
+  and changes nothing: such an image can't be cleared, and removing it whole would take what no mark
+  covers with it.
 - **vectors**: covered paths are removed; partly covered paths and shadings are clipped so
   nothing paints inside the areas;
 - **form XObjects**: rewritten recursively into new objects (pages sharing the original keep it);
@@ -103,5 +116,5 @@ Patterns are heuristic: dates, protocol identifiers and longer number runs are r
 `CodeSet::from_id("foia")?.overlay(&["(b)(6)"])` gives the overlay text for the picked codes.
 Custom code sets aren't supported yet.
 
-Not yet: pattern locales, struct-tree/alt-text cleanup, metadata and hidden-information
-sanitising (M8.4), re-encoding of DCT images (they are removed instead).
+Not yet: pattern locales, struct-tree/alt-text cleanup, re-encoding of DCT images (they are removed
+instead).
diff --git a/crates/redact/src/image.rs b/crates/redact/src/image.rs
index f662849c12..2e737e2baf 100644
--- a/crates/redact/src/image.rs
+++ b/crates/redact/src/image.rs
@@ -1,13 +1,14 @@
 //! Clearing the pixels of an image under redaction regions. The image is decoded, every pixel
 //! whose footprint intersects a region is set to zero (no ink for image masks), and the result is
-//! written as a new Flate image; the original object is untouched (other pages may use it).
-//! CCITT fax images decode through `Document::decoded_image_within`, but for Group 3 on bytes,
-//! which PdfCraft's renderer may draw as other rows. Images whose codec PdfCraft can't decode
-//! (DCT, JPX, JBIG2), and Group 3 on bytes, return `None`, and the caller removes the whole image
-//! instead; that is fail-closed.
+//! written as a new image, Flate, or for a one-bit image of one component Group 4, or JBIG2 when it
+//! was JBIG2, whichever is smallest; the original object is untouched (other pages may use it).
+//! CCITT fax and JBIG2 images decode through `ImageBudget::decode`, but for Group 3 on
+//! bytes, which PdfCraft's renderer may draw as other rows, and a JBIG2 page of other rows than the
+//! image's. Images whose codec PdfCraft can't decode (DCT, JPX), and those, return `None`, and the
+//! caller removes the whole image instead; that is fail-closed.
 
 use pdfcraft_content::{Matrix, overlaps};
-use pdfcraft_cos::{Document, Object, Stream};
+use pdfcraft_cos::{Dict, Document, ImageBudget, Object, Stream};
 
 /// Most pixels an image may have to be cleared in place (larger ones are removed).
 const MAX_PIXELS: u64 = 64 << 20;
@@ -38,11 +39,11 @@ fn components(doc: &Document, s: &Stream) -> Option<usize> {
 /// `Ok(Some(copy))` with the covered pixels cleared, `Ok(None)` when no pixel intersects,
 /// `Err(())` when the image can't be cleared (the caller removes it).
 #[allow(clippy::result_unit_err)]
-pub(crate) fn clear(doc: &Document, s: &Stream, ctm: &Matrix, rects: &[[f64; 4]]) -> Result<Option<Stream>, ()> {
-    decode_and_clear(doc, s, ctm, rects).ok_or(())
+pub(crate) fn clear(doc: &Document, s: &Stream, ctm: &Matrix, rects: &[[f64; 4]], budget: &mut ImageBudget) -> Result<Option<Stream>, ()> {
+    decode_and_clear(doc, s, ctm, rects, budget).ok_or(())
 }
 
-fn decode_and_clear(doc: &Document, s: &Stream, ctm: &Matrix, rects: &[[f64; 4]]) -> Option<Option<Stream>> {
+fn decode_and_clear(doc: &Document, s: &Stream, ctm: &Matrix, rects: &[[f64; 4]], budget: &mut ImageBudget) -> Option<Option<Stream>> {
     // Separate masks can retain the original image data.
     if s.dict.contains(b"SMask") || s.dict.contains(b"Mask") {
         return None;
@@ -53,18 +54,26 @@ fn decode_and_clear(doc: &Document, s: &Stream, ctm: &Matrix, rects: &[[f64; 4]]
             b"FlateDecode" | b"Fl" | b"LZWDecode" | b"LZW" | b"ASCII85Decode" | b"A85" | b"ASCIIHexDecode" | b"AHx" | b"RunLengthDecode" | b"RL"
         )
     };
-    // A CCITT fax image (its last filter) decodes through `Document::decoded_image_within`, after the
-    // filters before it, so a scan stored as Group 4 is cleared like any other image.
+    // A CCITT fax or JBIG2 image (its last filter) decodes through `ImageBudget::decode`,
+    // after the filters before it, so a scan stored as Group 4 or JBIG2 is cleared like any other
+    // image.
     let fax = |f: &Object| f.as_name().is_some_and(|n| matches!(n, b"CCITTFaxDecode" | b"CCF"));
+    let jbig2 = |f: &Object| f.as_name() == Some(b"JBIG2Decode".as_slice());
     let readable = |f: &Object| f.as_name().is_some_and(supported);
-    let (ok, is_fax) = match s.dict.get(b"Filter") {
-        None => (true, false),
-        Some(f @ Object::Name(_)) => (readable(f) || fax(f), fax(f)),
-        Some(Object::Array(a)) => match a.split_last() {
-            Some((last, before)) if fax(last) => (before.iter().all(readable), true),
-            _ => (a.iter().all(readable), false),
-        },
-        _ => (false, false),
+    // `/Crypt` was undone when the object was loaded (ISO 32000-2 §7.4.10), and decoding leaves it
+    // out wherever it stands.
+    let crypt = |f: &Object| f.as_name() == Some(b"Crypt".as_slice());
+    let (ok, is_fax, is_jbig2) = match s.dict.get(b"Filter") {
+        None => (true, false, false),
+        Some(f @ Object::Name(_)) => (readable(f) || crypt(f) || fax(f) || jbig2(f), fax(f), jbig2(f)),
+        Some(Object::Array(a)) => {
+            let chain: Vec<&Object> = a.iter().filter(|f| !crypt(f)).collect();
+            match chain.split_last() {
+                Some((last, before)) if fax(last) || jbig2(last) => (before.iter().all(|f| readable(f)), fax(last), jbig2(last)),
+                _ => (chain.iter().all(|f| readable(f)), false, false),
+            }
+        }
+        _ => (false, false, false),
     };
     if !ok {
         return None;
@@ -83,7 +92,8 @@ fn decode_and_clear(doc: &Document, s: &Stream, ctm: &Matrix, rects: &[[f64; 4]]
     let (w, h) = (w as usize, h as usize);
     let mask = matches!(s.dict.get(b"ImageMask"), Some(Object::Bool(true)));
     let (ncomp, bpc) = if mask { (1, 1) } else { (components(doc, s)?, s.dict.int(b"BitsPerComponent")? as usize) };
-    if !matches!(bpc, 1 | 2 | 4 | 8 | 16) {
+    // JBIG2 codes one-bit images of one component (ISO 32000-2 §7.4.7).
+    if !matches!(bpc, 1 | 2 | 4 | 8 | 16) || (is_jbig2 && (ncomp, bpc) != (1, 1)) {
         return None;
     }
     // Every size comes from the file: multiply checked, so an overflowing product refuses the image
@@ -105,8 +115,10 @@ fn decode_and_clear(doc: &Document, s: &Stream, ctm: &Matrix, rects: &[[f64; 4]]
         bytes.checked_add(h)?.checked_mul(3)?.checked_add(4096)?
     };
     // Through the document, which reads `/DecodeParms` given by reference (`Stream::decoded*`
-    // alone would skip such a predictor, and the cleared bytes would then miss the covered pixels).
-    let mut data = doc.decoded_image_within(s, allowance).ok()?;
+    // alone would skip such a predictor, and the cleared bytes would then miss the covered pixels),
+    // and refuses a JBIG2 page of another size than the image: the renderer draws the whole page
+    // into the image, so the rows cleared wouldn't be the ones a mark covers on screen.
+    let mut data = budget.decode(doc, s, allowance).ok()?;
     if data.len() < bytes {
         return None;
     }
@@ -160,5 +172,74 @@ fn decode_and_clear(doc: &Document, s: &Stream, ctm: &Matrix, rects: &[[f64; 4]]
     dict.remove(b"Length");
     dict.remove(b"DecodeParms");
     dict.remove(b"Alternates");
-    Some(Some(Stream::flate(dict, &data)))
+    Some(Some(smallest(dict, &data, w, h, ncomp == 1 && bpc == 1, is_jbig2)))
+}
+
+/// The cleared samples `data` of a `w` × `h` image as a stream with `dict`: Flate, or, for one bit
+/// of one component (`bilevel`, a scan as a rule, which Flate stores several times larger), CCITT
+/// Group 4, or JBIG2 when the image was JBIG2 (`jbig2`; JBIG2 is PDF 1.4, which such a file already
+/// is), whichever is smallest as stored, dictionary included (a tiny image can lose by Group 4's
+/// parameters). Both decode to `data`, cleared before it is coded, so nothing of the original's
+/// code is carried over; Group 4 or JBIG2 that can't code the rows (too wide) is left out.
+fn smallest(dict: Dict, data: &[u8], w: usize, h: usize, bilevel: bool, jbig2: bool) -> Stream {
+    let flate = Stream::flate(dict.clone(), data);
+    let Some((columns, rows)) = u32::try_from(w).ok().zip(u32::try_from(h).ok()).filter(|_| bilevel) else { return flate };
+    let g4 = pdfcraft_filters::encode_g4(data, columns, rows).ok().map(|coded| {
+        let mut dict = dict.clone();
+        let mut parms = Dict::new();
+        parms.set(b"K".to_vec(), Object::Int(-1));
+        parms.set(b"Columns".to_vec(), Object::Int(i64::from(columns)));
+        parms.set(b"Rows".to_vec(), Object::Int(i64::from(rows)));
+        dict.set(b"Filter".to_vec(), Object::name("CCITTFaxDecode"));
+        dict.set(b"DecodeParms".to_vec(), Object::Dict(parms));
+        Stream::from_raw(dict, coded)
+    });
+    let jbig = jbig2.then(|| pdfcraft_filters::encode_jbig2(data, columns, rows).ok()).flatten().map(|coded| {
+        let mut dict = dict.clone();
+        dict.set(b"Filter".to_vec(), Object::name("JBIG2Decode"));
+        Stream::from_raw(dict, coded)
+    });
+    [g4, jbig].into_iter().flatten().fold(flate, |best, s| if stored_len(&s) < stored_len(&best) { s } else { best })
+}
+
+/// The bytes stream `s` takes in a file: its data and its dictionary as written.
+fn stored_len(s: &Stream) -> usize {
+    let mut dict = Vec::new();
+    pdfcraft_cos::serialize(&Object::Dict(s.dict.clone()), &mut dict);
+    dict.len().saturating_add(s.raw.len())
+}
+
+/// JBIG2 image `s` stored again without its `/JBIG2Globals`: decoded through them, as it is drawn,
+/// and written as the same samples, Flate, Group 4 or JBIG2 coded alone, whichever is smallest
+/// (`smallest`), its other entries kept. `None` when it can't be decoded for certain (too large,
+/// past what is left of `budget`, data that doesn't decode, a JBIG2 page of another size than the
+/// image, or not a one-bit image of one component). Redaction does this to every image that
+/// shares a redacted image's globals, since their symbol dictionary holds the shapes of marks drawn
+/// under the area too.
+pub(crate) fn without_globals(doc: &Document, s: &Stream, budget: &mut ImageBudget) -> Option<Stream> {
+    let (w, h) = (s.dict.int(b"Width")?, s.dict.int(b"Height")?);
+    if w <= 0 || h <= 0 || (w as u64) * (h as u64) > MAX_PIXELS {
+        return None;
+    }
+    let (w, h) = (w as usize, h as usize);
+    let mask = matches!(s.dict.get(b"ImageMask"), Some(Object::Bool(true)));
+    // JBIG2 codes one-bit images of one component (ISO 32000-2 §7.4.7).
+    if !mask && (components(doc, s)?, s.dict.int(b"BitsPerComponent")?) != (1, 1) {
+        return None;
+    }
+    let bytes = w.div_ceil(8).checked_mul(h)?;
+    // As for `clear`: the filters before the JBIG2 decoder may give up to three bytes for each one
+    // of the raster and a byte a row.
+    let allowance = bytes.checked_add(h)?.checked_mul(3)?.checked_add(4096)?;
+    let mut data = budget.decode(doc, s, allowance).ok()?;
+    if data.len() < bytes {
+        return None;
+    }
+    data.truncate(bytes);
+    let mut dict = s.dict.clone();
+    dict.remove(b"Length");
+    // The globals are named in the parameters; the copy is coded alone, as `clear`'s are.
+    dict.remove(b"DecodeParms");
+    dict.remove(b"Alternates");
+    Some(smallest(dict, &data, w, h, true, true))
 }
diff --git a/crates/redact/src/interp.rs b/crates/redact/src/interp.rs
index ac69c73acb..460085a320 100644
--- a/crates/redact/src/interp.rs
+++ b/crates/redact/src/interp.rs
@@ -21,7 +21,7 @@ use std::collections::{HashMap, HashSet};
 use std::rc::Rc;
 
 use pdfcraft_content::{Matrix, Op, Pieces, contains, num, overlaps, serialize_ops, string};
-use pdfcraft_cos::{CosError, DecodeBudget, Dict, Document, MAX_PAGE_FORMS, ObjRef, Object, Stream};
+use pdfcraft_cos::{CosError, DecodeBudget, Dict, Document, ImageBudget, MAX_PAGE_FORMS, ObjRef, Object, Stream};
 
 use crate::{RedactError, Report, image, page_streams, tags};
 use pdfcraft_fonts::pdf::Metrics;
@@ -105,6 +105,8 @@ pub(crate) struct Scope<'a> {
     pub rects: &'a [[f64; 4]],
     pub mode: Mode,
     pub report: &'a mut Report,
+    /// What the images it clears may spend, shared by all the pages of a run.
+    pub images: &'a mut ImageBudget,
     /// Sanitize: remove hidden text (invisible render modes, or wholly outside this page box).
     pub hidden_text: Option<[f64; 4]>,
     /// Sanitize: optional content groups that are off; content marked with them is removed.
@@ -134,11 +136,12 @@ pub(crate) struct Scope<'a> {
 impl<'a> Scope<'a> {
     /// A scope whose form walk spends `budget`, what is left of the page's allowance after its
     /// content streams were decoded.
-    pub fn new(rects: &'a [[f64; 4]], mode: Mode, report: &'a mut Report, budget: DecodeBudget) -> Self {
+    pub fn new(rects: &'a [[f64; 4]], mode: Mode, report: &'a mut Report, budget: DecodeBudget, images: &'a mut ImageBudget) -> Self {
         Scope {
             rects,
             mode,
             report,
+            images,
             hidden_text: None,
             hidden_layers: HashSet::new(),
             layers_enabled: false,
@@ -750,7 +753,7 @@ fn xobject(
                 out.doomed.push(r);
                 return Some(None);
             }
-            match image::clear(doc, s, &gs.ctm, scope.rects) {
+            match image::clear(doc, s, &gs.ctm, scope.rects, &mut *scope.images) {
                 Ok(None) => None,
                 Ok(Some(new)) => {
                     let nr = doc.add(Object::Stream(new));
@@ -858,6 +861,11 @@ fn xobject(
             }
             let mut dict = s.dict.clone();
             dict.remove(b"Length");
+            if new_data.is_some() {
+                // As for page content streams: the source text of an added item (Edit ▸ Add
+                // content) would keep what the rewrite removed.
+                dict.remove(b"PCAdded");
+            }
             let mut cleaned_res = res.clone();
             // Install rewritten nested forms before finding live property names: a new form may
             // still inherit its caller's resources, and its new Do name must resolve here.
diff --git a/crates/redact/src/lib.rs b/crates/redact/src/lib.rs
index de9dafe7db..41ac47357e 100644
--- a/crates/redact/src/lib.rs
+++ b/crates/redact/src/lib.rs
@@ -70,6 +70,16 @@ pub enum RedactError {
     /// could not be shown complete.
     #[error("the document's objects nest too deeply to remove hidden information completely; the operation was refused")]
     TooDeep,
+    /// Past what one redaction may decode an image can't be cleared, and removing it whole would
+    /// take what no mark covers with it, unreported.
+    #[error("the images under these marks are more than one redaction can decode, so nothing was changed; redact fewer pages at a time")]
+    ImagesPastAllowance,
+    /// A JBIG2 image shares its `/JBIG2Globals` with a redacted one and can't be stored again
+    /// without them, so the shapes they hold, those of marks under the area included, would stay.
+    #[error(
+        "{0} JBIG2 image(s) share their symbol data with a redacted image and can't be decoded to be stored without it, so that data, which can show what is under the marks, would stay in the file; nothing was redacted"
+    )]
+    SharedJbig2Globals(usize),
     #[error(transparent)]
     Edit(#[from] pdfcraft_edit::EditError),
     #[error(transparent)]
@@ -132,6 +142,9 @@ pub struct Report {
     pub glyphs: usize,
     pub images_removed: usize,
     pub images_cleared: usize,
+    /// JBIG2 images, anywhere in the document, stored again (as a cleared copy is) without the
+    /// `/JBIG2Globals` they shared with a redacted image, so those globals leave the file.
+    pub images_restored: usize,
     pub paths_removed: usize,
     pub paths_clipped: usize,
     pub forms_rewritten: usize,
@@ -377,6 +390,12 @@ pub fn apply(doc: &mut Document, pages: Option<&[usize]>) -> Result<Report, Reda
 
 /// [`apply`] without the copy: an error can leave `doc` part redacted.
 fn apply_to(doc: &mut Document, pages: Option<&[usize]>) -> Result<Report, RedactError> {
+    let images = pdfcraft_cos::ImageBudget::new(doc);
+    apply_within(doc, pages, images)
+}
+
+/// [`apply_to`], its images decoded within `images`.
+fn apply_within(doc: &mut Document, pages: Option<&[usize]>, images: pdfcraft_cos::ImageBudget) -> Result<Report, RedactError> {
     let (all_marks, unreadable) = marks_checked(doc);
     // A mark with no readable area is not applied, and applying the others would look complete:
     // refuse before anything changes. Only the pages being applied count.
@@ -419,6 +438,7 @@ fn apply_to(doc: &mut Document, pages: Option<&[usize]>) -> Result<Report, Redac
         retired_properties: Vec::new(),
         widget_owner,
         removed_everywhere: HashSet::new(),
+        images,
     };
     for &(pi, page_marks) in &groups {
         let page = pdfcraft_model::pages(doc).swap_remove(pi);
@@ -426,7 +446,10 @@ fn apply_to(doc: &mut Document, pages: Option<&[usize]>) -> Result<Report, Redac
         redact_page_content(doc, &mut applying, pi, &page, &rects)?;
         remove_page_annotations(doc, &mut applying, &page, &rects, page_marks)?;
     }
-    let Applying { mut report, doomed_fields, doomed_xobjects, retired_properties, mut removed_everywhere, .. } = applying;
+    if applying.images.refused() > 0 {
+        return Err(RedactError::ImagesPastAllowance);
+    }
+    let Applying { mut report, doomed_fields, doomed_xobjects, retired_properties, mut removed_everywhere, mut images, .. } = applying;
 
     // 2b. Replies and pop-ups of a removed annotation can be listed on another page than their
     // parent: their `/IRT` or `/Parent` would keep the removed comment reachable.
@@ -509,6 +532,7 @@ fn apply_to(doc: &mut Document, pages: Option<&[usize]>) -> Result<Report, Redac
     // A removed image or form must not stay reachable through another resource dictionary (an
     // inherited or shared /Resources): a full save keeps whatever is still referenced.
     interp::unlink_doomed(doc, &doomed_xobjects, &retired_properties)?;
+    report.images_restored = restore_shared_jbig2(doc, &doomed_xobjects, &mut images)?;
 
     // 5. Verify: nothing readable may remain under a region.
     let mut residue = 0;
@@ -522,7 +546,9 @@ fn apply_to(doc: &mut Document, pages: Option<&[usize]>) -> Result<Report, Redac
             list.iter().zip(data).filter(|(o, _)| !o.as_ref().is_some_and(|r| report.overlays.contains(&r))).map(|(_, d)| d).collect();
         let resources = page.dict.get(b"Resources").and_then(|r| doc.resolve(r).as_dict().cloned()).unwrap_or_default();
         let mut scratch = Report::default();
-        let mut scope = Scope::new(&rects, Mode::Verify, &mut scratch, budget);
+        // Verifying doesn't decode images: what clearing left is read as the page draws it.
+        let mut images = pdfcraft_cos::ImageBudget::with_work(0);
+        let mut scope = Scope::new(&rects, Mode::Verify, &mut scratch, budget, &mut images);
         residue += process(doc, &mut scope, &original, &resources, pdfcraft_content::Matrix::IDENTITY).residue;
     }
     if residue > 0 {
@@ -533,6 +559,76 @@ fn apply_to(doc: &mut Document, pages: Option<&[usize]>) -> Result<Report, Redac
     Ok(report)
 }
 
+/// Most XObjects followed down from the removed and replaced ones to find their JBIG2 images.
+const MAX_JBIG2_WALK: usize = 100_000;
+
+/// The `/JBIG2Globals` of a redacted JBIG2 image hold the symbol dictionary of every image that
+/// shares them (`jbig2enc -s` and most scanners give one to all the pages of a scan): the bitmaps
+/// of marks drawn only under the area too. The image itself is replaced or removed, but the globals
+/// would stay for as long as another image uses them. So every image that uses the globals of a
+/// removed or replaced image (`doomed`), or of one drawn in a removed or replaced form, is decoded
+/// and stored again in place without them, as a cleared copy is, and a full save then leaves them
+/// out. An image that can't be stored again refuses the redaction (nothing changes, as `apply`
+/// works on a copy), but for a removed or replaced one, which is either unlinked or still drawn
+/// whole on another page. They are decoded within what is left of the run's allowance (`images`);
+/// past it the redaction is refused as one clearing too many images is. Returns how many images
+/// that weren't removed or replaced were stored again.
+fn restore_shared_jbig2(doc: &mut Document, doomed: &[ObjRef], images: &mut pdfcraft_cos::ImageBudget) -> Result<usize, RedactError> {
+    let mut globals = HashSet::new();
+    let mut seen = HashSet::new();
+    let mut stack: Vec<ObjRef> = doomed.to_vec();
+    while let Some(r) = stack.pop() {
+        if !seen.insert(r) || seen.len() > MAX_JBIG2_WALK {
+            continue;
+        }
+        let object = doc.get(r);
+        let Object::Stream(s) = &*object else { continue };
+        if let Some(g) = doc.jbig2_globals_ref(s) {
+            globals.insert(g);
+        }
+        // A form's images, and its forms' (an image's /SMask is a stream of its own, found below).
+        let resources = s.dict.get(b"Resources").map(|r| doc.resolve(r));
+        let xobjects = resources.as_deref().and_then(Object::as_dict).and_then(|d| d.get(b"XObject")).map(|x| doc.resolve(x));
+        if let Some(x) = xobjects.as_deref().and_then(Object::as_dict) {
+            stack.extend(x.iter().filter_map(|(_, v)| v.as_ref()));
+        }
+        if let Some(m) = s.dict.get(b"SMask").and_then(Object::as_ref) {
+            stack.push(m);
+        }
+    }
+    if globals.is_empty() {
+        return Ok(0);
+    }
+    let sharing: Vec<ObjRef> = doc
+        .scan_objects()
+        .filter(|(_, o)| matches!(&**o, Object::Stream(s) if doc.jbig2_globals_ref(s).is_some_and(|g| globals.contains(&g))))
+        .map(|(r, _)| r)
+        .collect();
+    let doomed: HashSet<ObjRef> = doomed.iter().copied().collect();
+    let (mut restored, mut stuck, mut past_allowance) = (0, 0, false);
+    for r in sharing {
+        let object = doc.get(r);
+        let Object::Stream(s) = &*object else { continue };
+        let refused = images.refused();
+        match image::without_globals(doc, s, images) {
+            Some(new) => {
+                doc.set(r, Object::Stream(new));
+                restored += usize::from(!doomed.contains(&r));
+            }
+            None if doomed.contains(&r) => {}
+            None if images.refused() > refused => past_allowance = true,
+            None => stuck += 1,
+        }
+    }
+    if past_allowance {
+        return Err(RedactError::ImagesPastAllowance);
+    }
+    if stuck > 0 {
+        return Err(RedactError::SharedJbig2Globals(stuck));
+    }
+    Ok(restored)
+}
+
 /// What applying the marks collects across pages.
 struct Applying {
     report: Report,
@@ -542,6 +638,8 @@ struct Applying {
     retired_properties: Vec<Object>,
     widget_owner: Vec<(ObjRef, ObjRef)>,
     removed_everywhere: HashSet<ObjRef>,
+    /// What clearing images may spend, across the run's pages.
+    images: pdfcraft_cos::ImageBudget,
 }
 
 /// Step 1 for one page: rewrites its content so nothing readable stays under a mark, and cleans the tags it no longer shows.
@@ -552,13 +650,13 @@ fn redact_page_content(
     page: &pdfcraft_model::Page,
     rects: &[[f64; 4]],
 ) -> Result<(), RedactError> {
-    let Applying { report, doomed_xobjects, retired_properties, .. } = applying;
+    let Applying { report, doomed_xobjects, retired_properties, images, .. } = applying;
     // 1. Content.
     let mut budget = pdfcraft_cos::DecodeBudget::page();
     let (list, data) = page_streams_within(doc, &page.dict, pi, &mut budget)?;
     let resources = page.dict.get(b"Resources").and_then(|r| doc.resolve(r).as_dict().cloned()).unwrap_or_default();
     let out = {
-        let mut scope = Scope::new(rects, Mode::Apply, report, budget);
+        let mut scope = Scope::new(rects, Mode::Apply, report, budget, images);
         process(doc, &mut scope, &data, &resources, pdfcraft_content::Matrix::IDENTITY)
     };
     // Fail closed: the interpreter lays vertical-writing text out horizontally, so it cannot
diff --git a/crates/redact/src/sanitize.rs b/crates/redact/src/sanitize.rs
index 98703dfbf2..6fd4354300 100644
--- a/crates/redact/src/sanitize.rs
+++ b/crates/redact/src/sanitize.rs
@@ -369,7 +369,8 @@ fn content_pass(doc: &mut Document, text: bool, layers: bool, write: bool) -> Re
         let resources = page.dict.get(b"Resources").and_then(|r| doc.resolve(r).as_dict().cloned()).unwrap_or_default();
         let mut report = Report::default();
         let mode = if write { Mode::Apply } else { Mode::Verify };
-        let mut scope = Scope::new(&[], mode, &mut report, budget);
+        let mut images = pdfcraft_cos::ImageBudget::new(doc);
+        let mut scope = Scope::new(&[], mode, &mut report, budget, &mut images);
         if text {
             let c = page.crop(doc);
             scope.hidden_text = Some([c[0].min(c[2]), c[1].min(c[3]), c[0].max(c[2]), c[1].max(c[3])]);
diff --git a/crates/redact/src/tags.rs b/crates/redact/src/tags.rs
index 961f016e94..648c0c29e5 100644
--- a/crates/redact/src/tags.rs
+++ b/crates/redact/src/tags.rs
@@ -2,7 +2,7 @@
 //!
 //! Marked content (MCIDs) that applying redactions changed is found by comparing each MCID's
 //! operators before and after. Elements owning such content lose their alternate text, actual
-//! text and expansion (which may spell out the removed words);
+//! text, title and expansion (which may spell out the removed words), as do their ancestors;
 //! references to marked content that is now empty are dropped from the element.
 
 use std::collections::{HashMap, HashSet};
@@ -281,7 +281,7 @@ pub(crate) fn clean_within(
         }
         doc.update_dict(r, |e| {
             if sensitive {
-                for key in [&b"Alt"[..], b"ActualText", b"E"] {
+                for key in DESCRIPTIONS {
                     e.remove(key);
                 }
             }
@@ -321,8 +321,10 @@ impl Above {
     }
 }
 
-/// The keys of an element that describe its content.
-const DESCRIPTIONS: [&[u8]; 3] = [b"Alt", b"ActualText", b"E"];
+/// The keys of an element that describe its content, and so may repeat what was removed: one
+/// policy for the element that owned it, the elements above it and elements written in place.
+/// The title (`/T`) is included, as producers often fill it with the element's text.
+const DESCRIPTIONS: [&[u8]; 4] = [b"Alt", b"ActualText", b"T", b"E"];
 
 /// Each element's parents as the walk found them: through `/K`, which `/P` may not agree with.
 struct Parents(HashMap<ObjRef, Vec<Above>>);
@@ -539,7 +541,7 @@ pub(crate) fn drop_object_refs_within(doc: &mut Document, gone: &HashSet<ObjRef>
             // An element that lost an annotation keeps no text describing it, even with other
             // kids left: a link's alternate text often repeats the URL, an annotation's its
             // comment. Elements above it may describe it too.
-            for key in [&b"Alt"[..], b"ActualText", b"T", b"E"] {
+            for key in DESCRIPTIONS {
                 e.remove(key);
             }
         })?;
diff --git a/crates/redact/src/tests.rs b/crates/redact/src/tests.rs
index 125f00fc5c..3c170aba20 100644
--- a/crates/redact/src/tests.rs
+++ b/crates/redact/src/tests.rs
@@ -52,7 +52,8 @@ fn under(doc: &mut Document, page: usize, rects: &[[f64; 4]]) -> usize {
     let (_, data) = page_streams_within(doc, &p.dict, page, &mut budget).unwrap();
     let res = p.dict.get(b"Resources").and_then(|r| doc.resolve(r).as_dict().cloned()).unwrap_or_default();
     let mut rep = Report::default();
-    let mut scope = Scope::new(rects, Mode::Verify, &mut rep, budget);
+    let mut images = pdfcraft_cos::ImageBudget::with_work(0);
+    let mut scope = Scope::new(rects, Mode::Verify, &mut rep, budget, &mut images);
     process(doc, &mut scope, &data, &res, pdfcraft_content::Matrix::IDENTITY).residue
 }
 
@@ -519,13 +520,25 @@ fn two_pages_one_resource_dictionary(inherited: bool, again: bool) -> Document {
     ])
 }
 
-/// The samples of the image a page's (possibly inherited) resources name `name`.
+/// What image `s` decodes to, its fax or JBIG2 data included, with no limit on the work: the
+/// samples an operation would read through its `ImageBudget`.
+fn decoded_image(doc: &Document, s: &pdfcraft_cos::Stream) -> Result<Vec<u8>, pdfcraft_cos::CosError> {
+    pdfcraft_cos::ImageBudget::with_work(u64::MAX).decode(doc, s, pdfcraft_cos::MAX_DECODED)
+}
+
+/// The samples of the image a page's (possibly inherited) resources name `name`, decoded through
+/// its image codec too ([`decoded_image`]).
 fn named_image(doc: &Document, page: usize, name: &[u8]) -> Option<Vec<u8>> {
+    named_stream(doc, page, name).and_then(|s| decoded_image(doc, &s).ok())
+}
+
+/// The image a page's (possibly inherited) resources name `name`.
+fn named_stream(doc: &Document, page: usize, name: &[u8]) -> Option<Stream> {
     let p = pdfcraft_model::pages(doc).swap_remove(page);
     let res = doc.resolve(p.dict.get(b"Resources")?).as_dict().cloned()?;
     let xo = doc.resolve(res.get(b"XObject")?).as_dict().cloned()?;
     match &*doc.get(xo.get(name)?.as_ref()?) {
-        Object::Stream(s) => s.decoded().ok(),
+        Object::Stream(s) => Some(s.clone()),
         _ => None,
     }
 }
@@ -701,7 +714,8 @@ fn group_3_on_bytes_is_removed_whole_and_other_fax_images_cleared() {
         (-1, true, "<< /K -1 /Columns 16 /EncodedByteAlign true >>", vec![0x80, 0x80], vec![], false),
     ] {
         let p = pdfcraft_filters::CcittParams { k, columns: 16, encoded_byte_align: on_bytes, ..Default::default() };
-        assert_eq!(pdfcraft_filters::decode_ccitt(&data, &p, 2).unwrap(), [0xFF; 4], "{parms}: the picture is white");
+        let mut work = u64::MAX;
+        assert_eq!(pdfcraft_filters::decode_ccitt_within(&data, &p, 2, &mut work).unwrap(), [0xFF; 4], "{parms}: the picture is white");
         let dict = format!("{image} /DecodeParms {parms}");
         let mut objs = vec![stream(&dict, data)];
         objs.extend(extra);
@@ -736,6 +750,577 @@ fn a_busy_fax_image_behind_another_filter_is_cleared() {
     assert_eq!((report.images_cleared, report.images_removed), (1, 0));
 }
 
+/// After a save no stream holds the pixels under a mark, read as it would be shown, JBIG2 included,
+/// on a scan coded with symbols and on one coded as a generic region. `COVERED` and `KEPT` are pixels
+/// found nowhere else in the image, one lot under the mark and one beside it, so the search is seen
+/// to find what stays. The one letter over and over, lower down, is what makes symbols worth coding.
+/// The picture saved is the one with every pixel under the mark cleared and no other changed, so a
+/// search that one cleared byte would blind isn't all that holds this.
+#[test]
+fn no_stream_holds_the_pixels_under_a_mark_on_a_jbig2_scan() {
+    const COVERED: [u8; 8] = [0x0F, 0x3C, 0x5A, 0xC3, 0x96, 0x69, 0xA5, 0x1E];
+    const KEPT: [u8; 8] = [0x87, 0x2D, 0x4B, 0xE1, 0x78, 0xD2, 0xB4, 0x1F];
+    const LETTER: [&str; 7] = ["#####", "#....", "####.", "#....", "#....", "#....", "#####"];
+    let (w, h) = (512usize, 64usize);
+    let stride = w / 8;
+    let mut bits = vec![0xFFu8; stride * h];
+    bits[stride * 2..stride * 2 + 8].copy_from_slice(&COVERED);
+    bits[stride * 2 + 16..stride * 2 + 24].copy_from_slice(&KEPT);
+    for top in (16..h - 8).step_by(10) {
+        for x in (4..w - 8).step_by(8) {
+            for (dy, row) in LETTER.iter().enumerate() {
+                for (dx, _) in row.bytes().enumerate().filter(|(_, c)| *c == b'#') {
+                    bits[(top + dy) * stride + (x + dx) / 8] &= !(0x80 >> ((x + dx) % 8));
+                }
+            }
+        }
+    }
+    let holds = |doc: &Document, pixels: &[u8]| {
+        doc.scan_objects().any(|(_, object)| match &*object {
+            Object::Stream(s) => decoded_image(doc, s).is_ok_and(|d| d.windows(pixels.len()).any(|w| w == pixels)),
+            _ => false,
+        })
+    };
+    // Columns 0 to 99 of rows 0 to 7.
+    let mut cleared = bits.clone();
+    for row in cleared.chunks_mut(stride).take(8) {
+        row[..12].fill(0);
+        row[12] &= 0x0F;
+    }
+    let symbols = pdfcraft_filters::encode_jbig2(&bits, w as u32, h as u32).unwrap();
+    let generic = pdfcraft_filters::encode_jbig2_generic(&bits, w as u32, h as u32).unwrap();
+    assert!(symbols.len() < generic.len(), "symbol coding has to be what this tests");
+    for coded in [symbols, generic] {
+        let dict = format!("/Type /XObject /Subtype /Image /Width {w} /Height {h} /BitsPerComponent 1 /ColorSpace /DeviceGray /Filter /JBIG2Decode");
+        // Half a point a pixel, its top row at y 132.
+        let mut doc = one_page(b"q 256 0 0 32 0 100 cm /Im Do Q", "/XObject << /Im 7 0 R >>", vec![stream(&dict, coded)]);
+        assert!(holds(&doc, &COVERED) && holds(&doc, &KEPT), "the pixels are there to be found");
+        mark(&mut doc, 0, &[[0.25, 128.25, 49.75, 132.0]], "");
+        assert_eq!(apply(&mut doc, None).unwrap().images_cleared, 1);
+        let saved = Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap();
+        assert!(!holds(&saved, &COVERED), "the covered pixels stayed in the file");
+        assert!(holds(&saved, &KEPT), "the pixels beside them stay");
+        assert!(holds(&saved, &cleared), "every pixel under the mark is cleared, and no other changed");
+    }
+}
+
+/// `/JBIG2Globals` data a decoder skips: one extension segment (ISO/IEC 14492 7.4.14) of a type it
+/// needn't read, holding `secret`; its 11-byte header gives the length of the data after it.
+fn jbig2_globals(secret: &[u8]) -> Vec<u8> {
+    let mut g = vec![0, 0, 0, 0, 0x3E, 0, 0];
+    g.extend_from_slice(&u32::try_from(4 + secret.len()).unwrap().to_be_bytes());
+    g.extend_from_slice(&[0, 0, 0, 1]);
+    g.extend_from_slice(secret);
+    g
+}
+
+/// An image the run's allowance can't decode can't be cleared. Removed whole, like an image that
+/// can't be read, it would take what no mark covers with it without a word, so the run stops there,
+/// and [`apply`] leaves the document as it was.
+#[test]
+fn a_jbig2_image_past_the_runs_allowance_stops_the_run() {
+    let mut dict = Dict::new();
+    dict.set(b"Width".to_vec(), Object::Int(16));
+    dict.set(b"Height".to_vec(), Object::Int(2));
+    dict.set(b"BitsPerComponent".to_vec(), Object::Int(1));
+    dict.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+    dict.set(b"Filter".to_vec(), Object::name("JBIG2Decode"));
+    let image = Stream::from_raw(dict, pdfcraft_filters::encode_jbig2_generic(&[0xFF; 4], 16, 2).unwrap());
+    let doc = Document::new_empty();
+    let half = [[0.0, 0.0, 0.5, 1.0]];
+    let clear = |work| crate::image::clear(&doc, &image, &pdfcraft_content::Matrix::IDENTITY, &half, &mut pdfcraft_cos::ImageBudget::with_work(work));
+    assert!(matches!(clear(u64::MAX), Ok(Some(_))), "cleared in a copy");
+    assert!(matches!(clear(0), Err(())), "it can't be cleared");
+
+    let coded = pdfcraft_filters::encode_jbig2_generic(&[0xFF; 4], 16, 2).unwrap();
+    let dict = "/Type /XObject /Subtype /Image /Width 16 /Height 2 /BitsPerComponent 1 /ColorSpace /DeviceGray /Filter /JBIG2Decode";
+    let mut doc = one_page(b"q 160 0 0 20 0 0 cm /Im Do Q", "/XObject << /Im 7 0 R >>", vec![stream(dict, coded)]);
+    mark(&mut doc, 0, &[[0.0, 12.0, 75.0, 18.0]], "");
+    let refused = crate::apply_within(&mut doc, None, pdfcraft_cos::ImageBudget::with_work(0));
+    assert!(matches!(refused, Err(crate::RedactError::ImagesPastAllowance)), "{refused:?}");
+    let mut doc = one_page(
+        b"q 160 0 0 20 0 0 cm /Im Do Q",
+        "/XObject << /Im 7 0 R >>",
+        vec![stream(dict, pdfcraft_filters::encode_jbig2_generic(&[0xFF; 4], 16, 2).unwrap())],
+    );
+    mark(&mut doc, 0, &[[0.0, 12.0, 75.0, 18.0]], "");
+    assert!(crate::apply_within(&mut doc, None, pdfcraft_cos::ImageBudget::with_work(u64::MAX)).is_ok());
+}
+
+/// A Flate image past the run's allowance stops the run as a JBIG2 image does: removed whole, it
+/// would take what no mark covers with it, unreported. A JPEG, which clearing doesn't read, is
+/// removed whole as it always was, and spends nothing.
+#[test]
+fn a_flate_image_past_the_runs_allowance_stops_the_run() {
+    let dict = "/Type /XObject /Subtype /Image /Width 2 /Height 2 /BitsPerComponent 8 /ColorSpace /DeviceGray /Filter /FlateDecode";
+    let page = || one_page(b"q 160 0 0 20 0 0 cm /Im Do Q", "/XObject << /Im 7 0 R >>", vec![stream(dict, pdfcraft_filters::encode_flate(&[9; 4]))]);
+    let mut doc = page();
+    mark(&mut doc, 0, &[[0.0, 12.0, 75.0, 18.0]], "");
+    let refused = crate::apply_within(&mut doc, None, pdfcraft_cos::ImageBudget::with_work(0));
+    assert!(matches!(refused, Err(crate::RedactError::ImagesPastAllowance)), "{refused:?}");
+    let mut doc = page();
+    mark(&mut doc, 0, &[[0.0, 12.0, 75.0, 18.0]], "");
+    assert!(crate::apply_within(&mut doc, None, pdfcraft_cos::ImageBudget::with_work(u64::MAX)).is_ok());
+
+    let dict = "/Type /XObject /Subtype /Image /Width 2 /Height 2 /BitsPerComponent 8 /ColorSpace /DeviceGray /Filter /DCTDecode";
+    let mut doc = one_page(b"q 160 0 0 20 0 0 cm /Im Do Q", "/XObject << /Im 7 0 R >>", vec![stream(dict, b"not read")]);
+    mark(&mut doc, 0, &[[0.0, 12.0, 75.0, 18.0]], "");
+    let report = crate::apply_within(&mut doc, None, pdfcraft_cos::ImageBudget::with_work(0)).unwrap();
+    assert_eq!(report.images_removed, 1);
+}
+
+/// A JBIG2 image (a scan the optimizer stored as JBIG2) has its covered pixels cleared in a copy,
+/// like a fax image, instead of being removed whole: with `/JBIG2Globals`, its `/DecodeParms` by
+/// reference, behind another filter with its globals at its own place, or as a mask, its decode
+/// array inverting it or not.
+#[test]
+fn a_jbig2_image_has_its_covered_pixels_cleared_instead_of_being_removed() {
+    // 16 × 2, all 1 bits (white), or all 0 bits (a mask painting everywhere); the left half of
+    // the top row is covered.
+    let white = pdfcraft_filters::encode_jbig2_generic(&[0xFF; 4], 16, 2).unwrap();
+    let painted = pdfcraft_filters::encode_jbig2_generic(&[0x00; 4], 16, 2).unwrap();
+    let hex: Vec<u8> = white.iter().map(|b| format!("{b:02x}")).collect::<String>().bytes().chain(*b">").collect();
+    let globals = stream("", jbig2_globals(b"shared"));
+    let image = "/Type /XObject /Subtype /Image /Width 16 /Height 2 /BitsPerComponent 1";
+    for (dict, data, extra, cleared) in [
+        (format!("{image} /ColorSpace /DeviceGray /Filter /JBIG2Decode"), white.clone(), vec![], [0x00, 0xFF, 0xFF, 0xFF]),
+        (
+            format!("{image} /ColorSpace /DeviceGray /Filter /JBIG2Decode /DecodeParms 8 0 R"),
+            white.clone(),
+            vec![b"<< /JBIG2Globals 9 0 R >>".to_vec(), globals.clone()],
+            [0x00, 0xFF, 0xFF, 0xFF],
+        ),
+        (
+            format!("{image} /ColorSpace /DeviceGray /Filter [/ASCIIHexDecode /JBIG2Decode] /DecodeParms [null << /JBIG2Globals 8 0 R >>]"),
+            hex,
+            vec![globals.clone()],
+            [0x00, 0xFF, 0xFF, 0xFF],
+        ),
+        // `/Crypt` was undone on load, and takes a place in the parameters.
+        (
+            format!("{image} /ColorSpace /DeviceGray /Filter [/Crypt /JBIG2Decode] /DecodeParms [null << /JBIG2Globals 8 0 R >>]"),
+            white.clone(),
+            vec![globals],
+            [0x00, 0xFF, 0xFF, 0xFF],
+        ),
+        // A mask's 0 bits paint: cleared bits are set to 1, which paints nothing.
+        (format!("{image} /ImageMask true /Filter /JBIG2Decode"), painted, vec![], [0xFF, 0x00, 0x00, 0x00]),
+        // With /Decode [1 0] a mask's 1 bits paint, and cleared bits are 0.
+        (format!("{image} /ImageMask true /Decode [1 0] /Filter /JBIG2Decode"), white, vec![], [0x00, 0xFF, 0xFF, 0xFF]),
+    ] {
+        let mut objs = vec![stream(&dict, data)];
+        objs.extend(extra);
+        let mut doc = one_page(b"q 160 0 0 20 0 0 cm /Im Do Q", "/XObject << /Im 7 0 R >>", objs);
+        mark(&mut doc, 0, &[[0.0, 12.0, 75.0, 18.0]], "");
+        let report = apply(&mut doc, None).unwrap();
+        assert_eq!((report.images_cleared, report.images_removed), (1, 0), "{dict}");
+        let saved = Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap();
+        assert_eq!(named_image(&saved, 0, b"PCRedacted1").as_deref(), Some(&cleared[..]), "{dict}");
+    }
+}
+
+/// A JBIG2 image is removed whole when its covered pixels can't be cleared for certain: a JBIG2
+/// page taller than the image (the renderer draws the whole page into the image, so the rows cleared
+/// wouldn't be the ones shown)
+/// or shorter, or of another width; globals that can't be read; data cut short; an image of more
+/// than one bit or component, which JBIG2 doesn't code, even when its rows take as many bytes; and
+/// a page far past the image's raster, which isn't decoded.
+#[test]
+fn a_jbig2_image_that_cannot_be_cleared_for_certain_is_removed_whole() {
+    let white = |rows: u32| pdfcraft_filters::encode_jbig2_generic(&vec![0xFF; 2 * rows as usize], 16, rows).unwrap();
+    // The page information (the first segment's data, after its 11-byte header) claiming 20,000
+    // rows of 16.
+    let mut tall = white(2);
+    tall[15..19].copy_from_slice(&20_000u32.to_be_bytes());
+    let image = |size: &str, more: &str| {
+        format!("/Type /XObject /Subtype /Image {size} /BitsPerComponent 1 /ColorSpace /DeviceGray /Filter /JBIG2Decode {more}")
+    };
+    let size = "/Width 16 /Height 2";
+    for (dict, data, extra) in [
+        (image(size, ""), white(3), vec![]),
+        (image("/Width 16 /Height 3", ""), white(2), vec![]),
+        (image("/Width 15 /Height 2", ""), white(2), vec![]),
+        (image(size, "/DecodeParms << /JBIG2Globals 8 0 R >>"), white(2), vec![stream("", b"not JBIG2")]),
+        (image(size, ""), white(2)[..20].to_vec(), vec![]),
+        (image(size, "").replace("/BitsPerComponent 1", "/BitsPerComponent 8"), white(2), vec![]),
+        (image(size, "").replace("/DeviceGray", "/DeviceRGB"), white(2), vec![]),
+        // Two pixels of RGB at a bit take a byte a row, as JBIG2's rows do.
+        (
+            image("/Width 2 /Height 2", "").replace("/DeviceGray", "/DeviceRGB"),
+            pdfcraft_filters::encode_jbig2_generic(&[0xFF; 2], 2, 2).unwrap(),
+            vec![],
+        ),
+        (image(size, ""), tall, vec![]),
+    ] {
+        let mut objs = vec![stream(&dict, data)];
+        objs.extend(extra);
+        let mut doc = one_page(b"q 160 0 0 20 0 0 cm /Im Do Q", "/XObject << /Im 7 0 R >>", objs);
+        mark(&mut doc, 0, &[[0.0, 12.0, 75.0, 18.0]], "");
+        let report = apply(&mut doc, None).unwrap();
+        assert_eq!((report.images_cleared, report.images_removed), (0, 1), "{dict}");
+    }
+}
+
+/// A scan stored as JBIG2 symbols, with globals, keeps every pixel outside the area once it is
+/// redacted and saved, and the pixels under it are cleared; neither its JBIG2 code nor its globals,
+/// which no other image uses, stay in the file. The cleared copy is coded afresh as JBIG2, smaller
+/// than Flate, and refers to no globals.
+#[test]
+fn a_redacted_jbig2_scan_keeps_neither_its_code_nor_its_globals() {
+    const LETTERS: [[&str; 7]; 3] = [
+        ["#####", "#....", "####.", "#....", "#....", "#....", "#####"],
+        [".###.", "#...#", "#....", "#....", "#....", "#...#", ".###."],
+        ["#...#", "#...#", "#####", "#...#", "#...#", "#...#", "#...#"],
+    ];
+    let (w, h) = (400usize, 40usize);
+    let stride = w.div_ceil(8);
+    let mut bits = vec![0xFFu8; stride * h];
+    for (line, top) in [2usize, 12, 22, 32].into_iter().enumerate() {
+        for (k, x) in (3..w - 6).step_by(7).enumerate() {
+            for (dy, row) in LETTERS[(k + line) % 3].iter().enumerate() {
+                for (dx, _) in row.bytes().enumerate().filter(|(_, c)| *c == b'#') {
+                    bits[(top + dy) * stride + (x + dx) / 8] &= !(0x80 >> ((x + dx) % 8));
+                }
+            }
+        }
+    }
+    let coded = pdfcraft_filters::encode_jbig2(&bits, w as u32, h as u32).unwrap();
+    let original = coded.clone();
+    assert!(coded.len() < pdfcraft_filters::encode_jbig2_generic(&bits, w as u32, h as u32).unwrap().len(), "symbol coded");
+    let dict = format!(
+        "/Type /XObject /Subtype /Image /Width {w} /Height {h} /BitsPerComponent 1 /ColorSpace /DeviceGray /Filter /JBIG2Decode /DecodeParms << /JBIG2Globals 8 0 R >>"
+    );
+    // Half a point a pixel, its top row at y 120.
+    let mut doc = one_page(
+        b"q 200 0 0 20 0 100 cm /Im Do Q",
+        "/XObject << /Im 7 0 R >>",
+        vec![stream(&dict, coded), stream("", jbig2_globals(b"LEAK_GLOBALS"))],
+    );
+    // Columns 0 to 99 of rows 0 to 12.
+    mark(&mut doc, 0, &[[0.25, 113.75, 49.75, 120.0]], "");
+    let report = apply(&mut doc, None).unwrap();
+    assert_eq!((report.images_cleared, report.images_removed), (1, 0));
+    let mut cleared = bits.clone();
+    for y in 0..=12 {
+        for x in 0..=99 {
+            cleared[y * stride + x / 8] &= !(0x80 >> (x % 8));
+        }
+    }
+    let saved = Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap();
+    assert_eq!(named_image(&saved, 0, b"PCRedacted1"), Some(cleared));
+    assert_no_secret(&doc, b"LEAK_GLOBALS");
+    let copy = named_stream(&saved, 0, b"PCRedacted1").unwrap();
+    assert_eq!(copy.dict.name(b"Filter"), Some(&b"JBIG2Decode"[..]));
+    assert!(!copy.dict.contains(b"DecodeParms"), "the copy refers to no globals");
+    let flate = pdfcraft_filters::encode_flate(&named_image(&saved, 0, b"PCRedacted1").unwrap());
+    assert!(copy.raw.len() < flate.len(), "JBIG2 {} bytes, Flate {}", copy.raw.len(), flate.len());
+    for (r, object) in saved.scan_objects() {
+        if let Object::Stream(s) = &*object {
+            assert_ne!(&s.raw[..], &original[..], "the original JBIG2 code stays as {r:?}");
+        }
+    }
+}
+
+/// `w` × `h` rows, `w` a multiple of 8: lines of word-sized dark blocks 14 rows tall, their edges
+/// ragged by a sample from row to row, as a scan's are; Group 4 codes such rows from the row above.
+fn ragged_scan(w: usize, h: usize) -> Vec<u8> {
+    let stride = w / 8;
+    let mut seed = 0x9E37_79B9_7F4A_7C15u64;
+    let mut next = move || {
+        seed ^= seed << 13;
+        seed ^= seed >> 7;
+        seed ^= seed << 17;
+        seed
+    };
+    let mut bits = vec![0xFFu8; stride * h];
+    for top in (3..h - 14).step_by(20) {
+        let mut x = 4;
+        while x + 70 < w {
+            let len = 20 + (next() % 40) as usize;
+            for y in top..top + 14 {
+                let (left, right) = (x + (next() % 2) as usize, x + len - (next() % 2) as usize);
+                for xx in left..right {
+                    bits[y * stride + xx / 8] &= !(0x80 >> (xx % 8));
+                }
+            }
+            x += len + 6 + (next() % 6) as usize;
+        }
+    }
+    bits
+}
+
+/// A cleared one-bit image of one component, a scan as a rule, is stored as CCITT Group 4 when
+/// that is smaller than Flate, whatever it was stored as (Flate here), and never as JBIG2 unless it
+/// was JBIG2; an eight-bit image stays Flate. The copy decodes to the cleared samples.
+#[test]
+fn a_cleared_black_and_white_scan_is_stored_as_group_4() {
+    let (w, h) = (800usize, 200usize);
+    let stride = w / 8;
+    let bits = ragged_scan(w, h);
+    let g4 = pdfcraft_filters::encode_g4(&bits, w as u32, h as u32).unwrap();
+    assert!(g4.len() < pdfcraft_filters::encode_flate(&bits).len(), "Group 4 is smaller than Flate here");
+    let grey: Vec<u8> = (0..w * h).map(|i| (i % 251) as u8).collect();
+    for (dict, data, filter) in [
+        (
+            format!("/Type /XObject /Subtype /Image /Width {w} /Height {h} /BitsPerComponent 1 /ColorSpace /DeviceGray /Filter /FlateDecode"),
+            pdfcraft_filters::encode_flate(&bits),
+            &b"CCITTFaxDecode"[..],
+        ),
+        (
+            format!("/Type /XObject /Subtype /Image /Width {w} /Height {h} /BitsPerComponent 8 /ColorSpace /DeviceGray /Filter /FlateDecode"),
+            pdfcraft_filters::encode_flate(&grey),
+            &b"FlateDecode"[..],
+        ),
+    ] {
+        let mut doc = one_page(b"q 200 0 0 50 0 100 cm /Im Do Q", "/XObject << /Im 7 0 R >>", vec![stream(&dict, data)]);
+        // The left quarter of the top half.
+        mark(&mut doc, 0, &[[0.0, 125.0, 50.0, 150.0]], "");
+        assert_eq!(apply(&mut doc, None).unwrap().images_cleared, 1, "{dict}");
+        let saved = Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap();
+        let copy = named_stream(&saved, 0, b"PCRedacted1").unwrap();
+        assert_eq!(copy.dict.name(b"Filter"), Some(filter), "{dict}");
+        // Covered: rows 0 to 99 (y 150 down to 125, a quarter point a row), samples 0 to 199.
+        let mut expected = if filter == b"FlateDecode" { grey.clone() } else { bits.clone() };
+        for y in 0..100 {
+            for x in 0..200 {
+                if filter == b"FlateDecode" {
+                    expected[y * w + x] = 0;
+                } else {
+                    expected[y * stride + x / 8] &= !(0x80 >> (x % 8));
+                }
+            }
+        }
+        assert_eq!(named_image(&saved, 0, b"PCRedacted1").unwrap(), expected, "{dict}");
+    }
+}
+
+/// A cleared one-bit image is stored as the smallest stream, its dictionary counted: a tiny one,
+/// whose Group 4 code is shorter than Flate's but whose `/DecodeParms` aren't, stays Flate. Rows
+/// wider than Group 4 codes (`MAX_G4_COLUMNS`) stay Flate too, and still clear.
+#[test]
+fn a_cleared_image_group_4_wouldnt_shrink_stays_flate() {
+    let wide = pdfcraft_filters::MAX_G4_COLUMNS as usize + 1;
+    for (w, h) in [(3usize, 2usize), (wide, 2)] {
+        let stride = w.div_ceil(8);
+        assert_eq!(pdfcraft_filters::encode_g4(&vec![0xFF; stride * h], w as u32, h as u32).is_ok(), w != wide, "{w} × {h}");
+        let dict = format!("/Type /XObject /Subtype /Image /Width {w} /Height {h} /BitsPerComponent 1 /ColorSpace /DeviceGray /Filter /FlateDecode");
+        let mut doc = one_page(
+            b"q 200 0 0 20 0 100 cm /Im Do Q",
+            "/XObject << /Im 7 0 R >>",
+            vec![stream(&dict, pdfcraft_filters::encode_flate(&vec![0xFF; stride * h]))],
+        );
+        // The top row's left half.
+        mark(&mut doc, 0, &[[0.0, 112.0, 99.0, 118.0]], "");
+        assert_eq!(apply(&mut doc, None).unwrap().images_cleared, 1, "{w} × {h}");
+        let saved = Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap();
+        assert_eq!(named_stream(&saved, 0, b"PCRedacted1").unwrap().dict.name(b"Filter"), Some(&b"FlateDecode"[..]), "{w} × {h}");
+        let samples = named_image(&saved, 0, b"PCRedacted1").unwrap();
+        let sample = |x: usize| samples.get(x / 8).is_some_and(|b| b & (0x80 >> (x % 8)) != 0);
+        assert!(!sample(0) && sample(w - 1), "{w} × {h}: the top row's first sample is cleared and its last kept");
+        assert!(samples.get(stride..).is_some_and(|row| row.iter().all(|b| *b == 0xFF)), "{w} × {h}: the bottom row is kept");
+    }
+}
+
+/// Only one bit of one component goes to Group 4 or JBIG2. An 8-bit grey image here starts as white
+/// as a bilevel scan and goes on as noise Flate can't shrink, so Group 4, which would read only the
+/// first rows' worth of bytes, would look far smaller while losing the picture.
+#[test]
+fn a_cleared_image_of_more_than_one_bit_stays_flate() {
+    let (w, h) = (256usize, 256usize);
+    let mut data = vec![0xFF; w * h];
+    let mut state = 0x1234_5678u32;
+    for b in data.iter_mut().skip(w * h / 8) {
+        state ^= state << 13;
+        state ^= state >> 17;
+        state ^= state << 5;
+        *b = state.to_le_bytes()[0];
+    }
+    let dict = format!("/Type /XObject /Subtype /Image /Width {w} /Height {h} /BitsPerComponent 8 /ColorSpace /DeviceGray /Filter /FlateDecode");
+    let mut doc = one_page(b"q 200 0 0 20 0 100 cm /Im Do Q", "/XObject << /Im 7 0 R >>", vec![stream(&dict, pdfcraft_filters::encode_flate(&data))]);
+    mark(&mut doc, 0, &[[0.0, 112.0, 99.0, 118.0]], "");
+    assert_eq!(apply(&mut doc, None).unwrap().images_cleared, 1);
+    let saved = Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap();
+    assert_eq!(named_stream(&saved, 0, b"PCRedacted1").unwrap().dict.name(b"Filter"), Some(&b"FlateDecode"[..]));
+    assert_eq!(named_image(&saved, 0, b"PCRedacted1").unwrap().get(h * w / 2..), data.get(h * w / 2..), "the rows below the mark are kept");
+}
+
+/// A copy stored as Group 4 or JBIG2 is read like any image: a second redaction, across a save,
+/// clears it again rather than removing it whole, keeps what the first cleared, and stores it
+/// smaller than Flate again.
+#[test]
+fn a_cleared_copy_stored_as_group_4_or_jbig2_can_be_redacted_again() {
+    let (w, h) = (800usize, 200usize);
+    let stride = w / 8;
+    let bits = ragged_scan(w, h);
+    let image = format!("/Type /XObject /Subtype /Image /Width {w} /Height {h} /BitsPerComponent 1 /ColorSpace /DeviceGray");
+    for (filter, data, wanted) in [
+        ("/FlateDecode", pdfcraft_filters::encode_flate(&bits), &b"CCITTFaxDecode"[..]),
+        ("/JBIG2Decode", pdfcraft_filters::encode_jbig2(&bits, w as u32, h as u32).unwrap(), &b"JBIG2Decode"[..]),
+    ] {
+        let dict = format!("{image} /Filter {filter}");
+        let mut doc = one_page(b"q 200 0 0 50 0 100 cm /Im Do Q", "/XObject << /Im 7 0 R >>", vec![stream(&dict, data)]);
+        mark(&mut doc, 0, &[[0.0, 125.0, 50.0, 150.0]], "");
+        assert_eq!(apply(&mut doc, None).unwrap().images_cleared, 1, "{filter}");
+        let mut saved = Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap();
+        assert_eq!(named_stream(&saved, 0, b"PCRedacted1").unwrap().dict.name(b"Filter"), Some(wanted), "{filter}");
+        mark(&mut saved, 0, &[[150.0, 100.0, 200.0, 125.0]], "");
+        let report = apply(&mut saved, None).unwrap();
+        assert_eq!((report.images_cleared, report.images_removed), (1, 0), "{filter}: cleared again, not removed");
+        let again = Document::open(Arc::new(write_full(&saved, &SaveOptions::default()).unwrap())).unwrap();
+        // Rows 0 to 99 of the left quarter, then 100 to 199 of the right.
+        let mut expected = bits.clone();
+        for (rows, columns) in [(0..100, 0..200), (100..200, 600..800)] {
+            for y in rows {
+                for x in columns.clone() {
+                    expected[y * stride + x / 8] &= !(0x80 >> (x % 8));
+                }
+            }
+        }
+        let names: Vec<Vec<u8>> = (1..4).map(|n| format!("PCRedacted{n}").into_bytes()).collect();
+        let stored = names.iter().find_map(|n| named_image(&again, 0, n));
+        assert_eq!(stored, Some(expected), "{filter}");
+    }
+}
+
+/// The segments of a JBIG2 stream `encode_jbig2` wrote, each with its header: a header is the
+/// segment's number (4 bytes), type, flags whose top three bits count the segments it refers to,
+/// those (a byte each), its page (a byte) and its data's length (4 bytes; ISO/IEC 14492 7.2).
+fn jbig2_segments(mut coded: &[u8]) -> Vec<Vec<u8>> {
+    let mut segments = Vec::new();
+    while !coded.is_empty() {
+        let refers = usize::from(coded[5] >> 5);
+        let header = 4 + 1 + 1 + refers + 1 + 4;
+        let length = u32::from_be_bytes(coded[header - 4..header].try_into().unwrap()) as usize;
+        segments.push(coded[..header + length].to_vec());
+        coded = &coded[header + length..];
+    }
+    segments
+}
+
+/// Two pages of a scan share one `/JBIG2Globals` stream holding the symbol dictionary, as
+/// `jbig2enc -s` and most scanners write them, and the first has a mark found nowhere else (a
+/// signature, say) under the area. The dictionary holds that mark's bitmap, so once the first page
+/// is redacted the second page's image is stored again without the globals, and neither the
+/// dictionary nor any stream naming globals stays in the saved file; both pages keep every pixel
+/// outside the area.
+#[test]
+fn globals_a_redacted_jbig2_image_shares_with_another_page_leave_the_file() {
+    const LETTER: [&str; 7] = ["#####", "#....", "####.", "#....", "#....", "#....", "#####"];
+    const SIGNATURE: [&str; 7] = ["#..#.##", ".##.#..", "#.#..##", "..##.#.", "##..#.#", ".#.##..", "#..#..#"];
+    let (w, h) = (400usize, 40usize);
+    let stride = w.div_ceil(8);
+    let draw = |bits: &mut [u8], shape: &[&str], top: usize, left: usize| {
+        for (dy, row) in shape.iter().enumerate() {
+            for (dx, _) in row.bytes().enumerate().filter(|(_, c)| *c == b'#') {
+                bits[(top + dy) * stride + (left + dx) / 8] &= !(0x80 >> ((left + dx) % 8));
+            }
+        }
+    };
+    // The letter over and over lower down, and the signature once, top left, under the mark.
+    let mut first = vec![0xFFu8; stride * h];
+    for top in [14usize, 24, 32] {
+        for x in (3..w - 6).step_by(7) {
+            draw(&mut first, &LETTER, top, x);
+        }
+    }
+    draw(&mut first, &SIGNATURE, 2, 10);
+    // The second page is a scan's ragged text, which Group 4 or JBIG2 stores smaller than Flate.
+    let second = ragged_scan(w, h);
+    // The first page's symbol dictionary (its second segment) goes to the globals, on no page; the
+    // second page's segments are numbered past it.
+    let mut segments = jbig2_segments(&pdfcraft_filters::encode_jbig2(&first, w as u32, h as u32).unwrap());
+    assert_eq!(segments[1][4], 0, "the second segment is the symbol dictionary");
+    let mut dictionary = segments.remove(1);
+    dictionary[6] = 0;
+    let page_one: Vec<u8> = segments.concat();
+    let page_two: Vec<u8> = jbig2_segments(&pdfcraft_filters::encode_jbig2_generic(&second, w as u32, h as u32).unwrap())
+        .into_iter()
+        .enumerate()
+        .flat_map(|(k, mut s)| {
+            s[..4].copy_from_slice(&(100 + k as u32).to_be_bytes());
+            s
+        })
+        .collect();
+    let image = format!(
+        "/Type /XObject /Subtype /Image /Width {w} /Height {h} /BitsPerComponent 1 /ColorSpace /DeviceGray /Filter /JBIG2Decode /DecodeParms << /JBIG2Globals 9 0 R >>"
+    );
+    // Half a point a pixel, the image's top row at y 120.
+    let page = |content: u32, im: u32| {
+        format!("<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents {content} 0 R /Resources << /XObject << /Im {im} 0 R >> >> >>")
+            .into_bytes()
+    };
+    let build = |second_image: &str| {
+        pdf(vec![
+            b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+            b"<< /Type /Pages /Kids [3 0 R 4 0 R] /Count 2 >>".to_vec(),
+            page(5, 7),
+            page(6, 8),
+            stream("", b"q 200 0 0 20 0 100 cm /Im Do Q".as_slice()),
+            stream("", b"q 200 0 0 20 0 100 cm /Im Do Q".as_slice()),
+            stream(&image, page_one.clone()),
+            stream(second_image, page_two.clone()),
+            stream("", dictionary.clone()),
+        ])
+    };
+    let mut doc = build(&image);
+    // A page's picture as it is drawn, JBIG2 read with its globals.
+    let picture = |doc: &Document, page: usize, name: &[u8]| {
+        let p = pdfcraft_model::pages(doc).swap_remove(page);
+        let res = doc.resolve(p.dict.get(b"Resources")?).as_dict().cloned()?;
+        let xo = doc.resolve(res.get(b"XObject")?).as_dict().cloned()?;
+        match &*doc.get(xo.get(name)?.as_ref()?) {
+            Object::Stream(s) => decoded_image(doc, s).ok(),
+            _ => None,
+        }
+    };
+    assert_eq!(picture(&doc, 0, b"Im"), Some(first.clone()), "the first page reads its symbols from the globals");
+    assert_eq!(picture(&doc, 1, b"Im"), Some(second.clone()));
+    // Columns 0 to 99 of rows 0 to 12.
+    mark(&mut doc, 0, &[[0.25, 113.75, 49.75, 120.0]], "");
+    let report = apply(&mut doc, None).unwrap();
+    assert_eq!((report.images_cleared, report.images_removed, report.images_restored), (1, 0, 1));
+    let mut cleared = first.clone();
+    for y in 0..=12 {
+        for x in 0..=99 {
+            cleared[y * stride + x / 8] &= !(0x80 >> (x % 8));
+        }
+    }
+    let saved = reopen(&doc);
+    assert_eq!(picture(&saved, 0, b"PCRedacted1"), Some(cleared));
+    assert_eq!(picture(&saved, 1, b"Im"), Some(second.clone()), "the second page keeps its picture");
+    // Stored again as a scan is: Group 4 or JBIG2 when smaller than Flate.
+    let restored = named_stream(&saved, 1, b"Im").unwrap();
+    let flate = pdfcraft_filters::encode_flate(&second);
+    assert_ne!(restored.dict.name(b"Filter"), Some(&b"FlateDecode"[..]));
+    assert!(restored.raw.len() < flate.len(), "{:?} {} bytes, Flate {}", restored.dict.name(b"Filter"), restored.raw.len(), flate.len());
+    // The dictionary's data (after its 11-byte header) codes the signature's bitmap.
+    let coded = &dictionary[11..];
+    for (r, object) in saved.scan_objects() {
+        let mut bytes = Vec::new();
+        pdfcraft_cos::serialize(&object, &mut bytes);
+        assert!(!bytes.windows(b"JBIG2Globals".len()).any(|w| w == b"JBIG2Globals"), "{r:?} still names globals");
+        let data = match &*object {
+            Object::Stream(s) => s.decoded().unwrap_or_default(),
+            _ => Vec::new(),
+        };
+        assert!(!bytes.windows(coded.len()).chain(data.windows(coded.len())).any(|w| w == coded), "the symbol dictionary stays as {r:?}");
+    }
+    // The second page's image can't be read for certain (its JBIG2 page is shorter than the
+    // image), so it can't be stored without the globals: the redaction is refused.
+    let mut doc = build(&image.replace(&format!("/Height {h}"), &format!("/Height {}", h + 1)));
+    mark(&mut doc, 0, &[[0.25, 113.75, 49.75, 120.0]], "");
+    assert!(matches!(apply(&mut doc, None), Err(RedactError::SharedJbig2Globals(1))));
+    // Storing the second page's image again decodes it, within what is left of the run's
+    // allowance: with nothing left the redaction is refused as one past the allowance, not
+    // reported as an image that can't be read.
+    let mut doc = build(&image);
+    let first_image = [ObjRef::new(7, 0)];
+    let refused = crate::restore_shared_jbig2(&mut doc, &first_image, &mut pdfcraft_cos::ImageBudget::with_work(0));
+    assert!(matches!(refused, Err(RedactError::ImagesPastAllowance)), "{refused:?}");
+    let restored = crate::restore_shared_jbig2(&mut doc, &first_image, &mut pdfcraft_cos::ImageBudget::with_work(u64::MAX));
+    assert_eq!(restored.ok(), Some(1));
+}
+
 /// Apply Redactions gives the page its own pruned /Resources, but the dictionary it drew through
 /// before (inherited from the /Pages node, or shared with another page) still named the removed
 /// image and form, so a full-rewrite save kept them.
@@ -2377,7 +2962,8 @@ fn assert_no_secret(doc: &Document, secret: &[u8]) {
         pdfcraft_cos::serialize(&object, &mut bytes);
         assert!(!bytes.windows(secret.len()).any(|w| w == secret), "secret remains in object {r:?}");
         if let Object::Stream(s) = &*object {
-            let data = s.decoded().unwrap();
+            // Image codecs, a cleared scan coded as Group 4 or JBIG2, decode through the document.
+            let data = s.decoded().or_else(|_| decoded_image(&saved, s)).unwrap();
             assert!(!data.windows(secret.len()).any(|w| w == secret), "secret remains in stream {r:?}");
         }
     }
@@ -3285,3 +3871,29 @@ fn a_reply_on_another_page_to_a_removed_popup_goes_too() {
         assert!(!bytes.windows(gone.len()).any(|w| w == gone), "{} survived", String::from_utf8_lossy(gone));
     }
 }
+
+#[test]
+fn a_rewritten_form_xobject_drops_the_source_text_of_added_content() {
+    // A form drawing invisible text whose dictionary repeats it in /PCAdded.
+    let form = stream(
+        "/Type /XObject /Subtype /Form /BBox [0 0 300 300] /Resources << /Font << /F1 5 0 R >> >> /PCMark /Added /PCAdded << /Kind /Text /Text (LEAK_FORM_SOURCE) >>",
+        b"BT /F1 10 Tf 3 Tr 10 100 Td (HIDDEN) Tj ET BT /F1 10 Tf 10 200 Td (Shown) Tj ET",
+    );
+    let mut doc = one_page(b"/X Do", "/XObject << /X 7 0 R >>", vec![form]);
+    sanitize::remove_hidden(&mut doc, &[sanitize::Hidden::HiddenText]).unwrap();
+    let bytes = write_full(&doc, &SaveOptions { object_streams: false, ..SaveOptions::default() }).unwrap();
+    assert!(!bytes.windows(16).any(|w| w == b"LEAK_FORM_SOURCE"), "the form's added-content source text survived");
+}
+
+#[test]
+fn a_redacted_form_xobject_drops_the_source_text_of_added_content() {
+    let form = stream(
+        "/Type /XObject /Subtype /Form /BBox [0 0 300 300] /Resources << /Font << /F1 5 0 R >> >> /PCMark /Added /PCAdded << /Kind /Text /Text (AB1234CD) >>",
+        b"BT /F1 10 Tf 10 100 Td (AB1234CD) Tj ET",
+    );
+    let mut doc = one_page(b"/X Do", "/XObject << /X 7 0 R >>", vec![form]);
+    mark(&mut doc, 0, &[[20.0, 95.0, 40.0, 110.0]], "");
+    apply(&mut doc, None).unwrap();
+    let bytes = write_full(&doc, &SaveOptions { object_streams: false, ..SaveOptions::default() }).unwrap();
+    assert!(!bytes.windows(4).any(|w| w == b"1234"), "redacted text left in the saved file");
+}
diff --git a/crates/redact/src/tests/descriptions.rs b/crates/redact/src/tests/descriptions.rs
index df6b8555dc..0495dd1f70 100644
--- a/crates/redact/src/tests/descriptions.rs
+++ b/crates/redact/src/tests/descriptions.rs
@@ -62,3 +62,61 @@ fn a_link_element_that_keeps_its_text_loses_the_description_of_its_removed_annot
     let link = doc.get(ObjRef::new(11, 0)).as_dict().cloned().unwrap();
     assert_eq!(link.get(b"K"), Some(&Object::Array(vec![Object::Int(0)])), "the element keeps its text");
 }
+
+/// [`sectioned`], with titles that repeat the secret on the paragraph that owns it, on its section
+/// and on the document element above both.
+fn titled() -> Document {
+    let mut doc = sectioned("11 0 R");
+    let title = |t: &str| Object::String(pdfcraft_cos::PdfString::literal(t.as_bytes().to_vec()));
+    for (n, t) in [(8, "LEAK_DOC_TITLE"), (9, "LEAK_OWN_TITLE"), (11, "LEAK_SECT_TITLE"), (10, "Public title")] {
+        doc.update_dict(ObjRef::new(n, 0), |d| d.set(b"T".to_vec(), title(t))).unwrap();
+    }
+    doc
+}
+
+#[test]
+fn titles_repeating_redacted_content_go_from_the_owner_and_its_ancestors() {
+    let mut doc = titled();
+    mark(&mut doc, 0, &[[5.0, 195.0, 60.0, 212.0]], "");
+    apply(&mut doc, None).unwrap();
+    assert!(!full_save_holds(&doc, b"LEAK_"), "a structure title repeating the redacted word survived");
+    let public = doc.get(ObjRef::new(10, 0)).as_dict().cloned().unwrap();
+    assert!(public.contains(b"T"), "an element beside it keeps its own title");
+}
+
+#[test]
+fn titles_repeating_hidden_text_go_from_the_owner_and_its_ancestors() {
+    use crate::sanitize::{Hidden, remove_hidden};
+    let mut doc = titled();
+    let hidden =
+        b"/P <</MCID 0>> BDC BT /F1 10 Tf 3 Tr 10 200 Td (SECRET) Tj ET EMC /P <</MCID 1>> BDC BT /F1 10 Tf 0 Tr 10 100 Td (Public) Tj ET EMC";
+    doc.set(ObjRef::new(4, 0), Object::Stream(Stream::from_raw(Dict::new(), hidden.to_vec())));
+    remove_hidden(&mut doc, &[Hidden::HiddenText]).unwrap();
+    assert!(!full_save_holds(&doc, b"SECRET"), "the hidden text survived");
+    assert!(!full_save_holds(&doc, b"LEAK_"), "a structure title repeating the hidden text survived");
+    let public = doc.get(ObjRef::new(10, 0)).as_dict().cloned().unwrap();
+    assert!(public.contains(b"T"), "an element beside it keeps its own title");
+}
+
+#[test]
+fn an_ancestor_title_describing_a_removed_annotation_goes() {
+    use crate::sanitize::{Hidden, remove_hidden};
+    let mut doc = pdf(vec![
+        b"<< /Type /Catalog /Pages 2 0 R /MarkInfo << /Marked true >> /StructTreeRoot 8 0 R >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> /Annots [6 0 R] /StructParents 0 >>"
+            .to_vec(),
+        stream("", b"/Link << /MCID 0 >> BDC BT /F1 10 Tf 10 230 Td (See the site) Tj ET EMC"),
+        FONT.replace("95 0 R", "12 0 R").into_bytes(),
+        b"<< /Type /Annot /Subtype /Link /Rect [10 228 80 240] /StructParent 1 /A << /S /URI /URI (https://example.org/) >> >>".to_vec(),
+        b"null".to_vec(),
+        b"<< /Type /StructTreeRoot /K 9 0 R /ParentTree << /Nums [0 [11 0 R] 1 11 0 R] >> /ParentTreeNextKey 2 >>".to_vec(),
+        b"<< /Type /StructElem /S /Document /P 8 0 R /K 10 0 R >>".to_vec(),
+        // Only a title above the link element repeats the address.
+        b"<< /Type /StructElem /S /P /P 9 0 R /T (LEAK_PARENT_TITLE) /K 11 0 R >>".to_vec(),
+        b"<< /Type /StructElem /S /Link /P 10 0 R /Pg 3 0 R /K [0 << /Type /OBJR /Obj 6 0 R /Pg 3 0 R >>] >>".to_vec(),
+        widths(),
+    ]);
+    remove_hidden(&mut doc, &[Hidden::LinksActionsScripts]).unwrap();
+    assert!(!full_save_holds(&doc, b"LEAK_"), "an ancestor's title describing the removed link survived");
+}
diff --git a/crates/render/src/raster.rs b/crates/render/src/raster.rs
index f973851d26..9331c82ea7 100644
--- a/crates/render/src/raster.rs
+++ b/crates/render/src/raster.rs
@@ -83,6 +83,10 @@ pub struct RenderConfig {
     /// viewer and preview rasters: exports, printing and OCR render without it, so nothing drawn with an
     /// installed font is saved or printed (AGENTS.md §1.2, §1.4).
     pub system_fonts: bool,
+    /// Steps of JBIG2 decoding a render may take across the page's images, instead of the usual
+    /// `hayro_syntax::MAX_PAGE_JBIG2_WORK`. Those past it aren't drawn, like an image that can't
+    /// be decoded.
+    pub jbig2_work: Option<u64>,
 }
 
 impl RenderConfig {
@@ -100,7 +104,8 @@ impl RenderConfig {
     /// Passwords belong to parser construction; request-specific preview overrides are applied
     /// by `render_page`, which also preserves the caller's warning and cancellation hooks.
     fn settings(&self) -> InterpreterSettings {
-        let standard = InterpreterSettings::default().font_resolver;
+        let defaults = InterpreterSettings::default();
+        let standard = defaults.font_resolver.clone();
         let system_fonts = self.system_fonts;
         InterpreterSettings {
             ocg_overrides: self.layers.clone(),
@@ -108,7 +113,8 @@ impl RenderConfig {
             font_resolver: Arc::new(move |query| {
                 japanese_fallback(query).or_else(|| system_fonts.then(|| system_fallback(query)).flatten()).or_else(|| standard(query))
             }),
-            ..InterpreterSettings::default()
+            jbig2_work: self.jbig2_work.unwrap_or(defaults.jbig2_work),
+            ..defaults
         }
     }
 }
diff --git a/crates/render/src/raster/tests.rs b/crates/render/src/raster/tests.rs
index df6896b980..a3adbf1ecb 100644
--- a/crates/render/src/raster/tests.rs
+++ b/crates/render/src/raster/tests.rs
@@ -802,6 +802,472 @@ fn indexed_palettes_over_lab_keep_their_colours() {
     }
     assert!(indexed[0] > 180, "the palette red must not render near black: {indexed:?}");
 }
+
+/// A Pattern space's underlying space is any other, named or by reference as well as a direct array
+/// (ISO 32000-2 §8.7.3.3). It was skipped when it was a name or a reference, so an uncoloured tiling
+/// pattern took its components as RGB: a CMYK cyan drew red, and a grey of 0.5 dark red. Each is
+/// compared with the same colour painted without the pattern.
+#[test]
+fn an_uncoloured_pattern_uses_its_underlying_space_in_every_form() {
+    use super::*;
+    let render = |space: &str, content: &str| -> [u8; 4] {
+        let pattern = "0 0 10 10 re f";
+        let bytes = format!(
+            "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+                 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+                 3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Resources << /ColorSpace << /C {space} >> /Pattern << /P 5 0 R >> >> /Contents 4 0 R >> endobj\n\
+                 4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+                 5 0 obj << /Type /Pattern /PatternType 1 /PaintType 2 /TilingType 1 /BBox [0 0 10 10] /XStep 10 /YStep 10 /Resources << >> /Length {} >> stream\n{pattern}\nendstream endobj\n\
+                 6 0 obj /DeviceCMYK endobj\n\
+                 7 0 obj /DeviceGray endobj\n\
+                 8 0 obj [/Indexed /DeviceRGB 1 <00FF00FF0000>] endobj\n\
+                 9 0 obj [/Pattern /DeviceCMYK] endobj\n\
+                 trailer << /Root 1 0 R >>\n%%EOF",
+            content.len(),
+            pattern.len()
+        )
+        .into_bytes();
+        let page = PageRenderer::new(Arc::new(bytes), RenderConfig::default()).render(RenderRequest {
+            page: 0,
+            kind: RequestKind::Pixels,
+            tile: None,
+            scale: 1.0,
+            tag: 0,
+            preview: false,
+        });
+        assert!(page.error.is_none(), "{space}: {:?}", page.error);
+        let start = (100 * page.width as usize + 100) * 4;
+        let mut pixel = [0; 4];
+        pixel.copy_from_slice(page.rgba.get(start..start + 4).expect("centre pixel"));
+        pixel
+    };
+    let fill = "0 0 200 200 re f";
+    let cyan = render("/DeviceCMYK", &format!("/DeviceCMYK cs 1 0 0 0 sc {fill}"));
+    let grey = render("/DeviceGray", &format!("/DeviceGray cs 0.5 sc {fill}"));
+    let green = render("8 0 R", &format!("/C cs 0 sc {fill}"));
+    assert_ne!(cyan[0], 255, "cyan has no red");
+    for (space, colour, want) in [
+        ("[/Pattern /DeviceCMYK]", "1 0 0 0", cyan),
+        ("[/Pattern 6 0 R]", "1 0 0 0", cyan),
+        ("9 0 R", "1 0 0 0", cyan),
+        ("[/Pattern /DeviceGray]", ".5", grey),
+        ("[/Pattern 7 0 R]", ".5", grey),
+        ("[/Pattern 8 0 R]", "0", green),
+        ("[/Pattern [/Indexed /DeviceRGB 1 <00FF00FF0000>]]", "0", green),
+    ] {
+        assert_eq!(render(space, &format!("/C cs {colour} /P scn {fill}")), want, "{space}");
+    }
+}
+
+/// A colour space's parts can refer back to the space, now that a Pattern's underlying space is
+/// followed as an Indexed space's base always was. A file made so ends as a space that can't be
+/// read, and the page draws what it can.
+#[test]
+fn a_colour_space_that_refers_to_itself_ends() {
+    use super::*;
+    let content = "1 0 0 rg 0 0 100 100 re f /C cs 0 sc 100 100 100 100 re f";
+    for (space, objects) in [
+        ("5 0 R", "5 0 obj [/Pattern 5 0 R] endobj"),
+        ("5 0 R", "5 0 obj [/Pattern 6 0 R] endobj 6 0 obj [/Pattern 5 0 R] endobj"),
+        ("5 0 R", "5 0 obj [/Pattern 6 0 R] endobj 6 0 obj [/Indexed 5 0 R 1 <0011>] endobj"),
+        ("5 0 R", "5 0 obj [/Indexed 5 0 R 1 <0011>] endobj"),
+    ] {
+        let bytes = format!(
+            "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+                 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+                 3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Resources << /ColorSpace << /C {space} >> >> /Contents 4 0 R >> endobj\n\
+                 4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+                 {objects}\n\
+                 trailer << /Root 1 0 R >>\n%%EOF",
+            content.len()
+        )
+        .into_bytes();
+        let page = PageRenderer::new(Arc::new(bytes), RenderConfig::default()).render(RenderRequest {
+            page: 0,
+            kind: RequestKind::Pixels,
+            tile: None,
+            scale: 1.0,
+            tag: 0,
+            preview: false,
+        });
+        assert!(page.error.is_none(), "{objects}: {:?}", page.error);
+        let start = ((150 * page.width as usize) + 50) * 4;
+        assert_eq!(page.rgba.get(start..start + 4), Some(&[255, 0, 0, 255][..]), "{objects}: what comes before it drew");
+    }
+}
+
+/// A chain of colour spaces repeats no object, so what ends a cycle lets it through. Each way one
+/// space names another ends, at a depth that leaves room on the stack, and the page draws what it
+/// can.
+#[test]
+fn a_chain_of_colour_spaces_ends() {
+    use super::*;
+    const LINKS: u32 = 20_000;
+    let content = "1 0 0 rg 0 0 100 100 re f /C cs 0 sc 100 100 100 100 re f";
+    let link: [(&str, &dyn Fn(u32) -> String); 5] = [
+        ("[/Pattern 10 0 R]", &|next| format!("[/Pattern {next} 0 R]")),
+        ("10 0 R", &|next| format!("[/Indexed {next} 0 R 1 <0011>]")),
+        ("10 0 R", &|next| format!("[/Separation /A {next} 0 R 5 0 R]")),
+        ("10 0 R", &|next| format!("[/DeviceN [/A] {next} 0 R 5 0 R]")),
+        ("[/ICCBased 10 0 R]", &|next| format!("<< /N 1 /Alternate [/ICCBased {next} 0 R] /Length 1 >> stream\nx\nendstream")),
+    ];
+    for (space, link) in link {
+        let objects: String = (0..LINKS).map(|i| format!("{} 0 obj {} endobj\n", 10 + i, link(11 + i))).collect();
+        let bytes = format!(
+            "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+                 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+                 3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Resources << /ColorSpace << /C {space} >> >> /Contents 4 0 R >> endobj\n\
+                 4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+                 5 0 obj << /FunctionType 2 /Domain [0 1] /N 1 /C0 [0] /C1 [1] >> endobj\n\
+                 {objects}{} 0 obj /DeviceGray endobj\n\
+                 trailer << /Root 1 0 R >>\n%%EOF",
+            content.len(),
+            10 + LINKS
+        )
+        .into_bytes();
+        let page = PageRenderer::new(Arc::new(bytes), RenderConfig::default()).render(RenderRequest {
+            page: 0,
+            kind: RequestKind::Pixels,
+            tile: None,
+            scale: 1.0,
+            tag: 0,
+            preview: false,
+        });
+        assert!(page.error.is_none(), "{}: {:?}", link(11), page.error);
+        let start = ((150 * page.width as usize) + 50) * 4;
+        assert_eq!(page.rgba.get(start..start + 4), Some(&[255, 0, 0, 255][..]), "{}: what comes before it drew", link(11));
+    }
+}
+
+/// A file nests colour spaces five levels at most, and the limit is well past that: 31 spaces over
+/// a device space are read and draw their colour, and with one more the space isn't read.
+#[test]
+fn colour_spaces_are_read_to_the_limit_of_their_nesting() {
+    use super::*;
+    let content = "/C cs 1 scn 0 0 200 200 re f";
+    let green = |levels: u32| {
+        let objects: String = (0..levels - 1).map(|i| format!("{} 0 obj [/Separation /A {} 0 R 5 0 R] endobj\n", 10 + i, 11 + i)).collect();
+        let bytes = format!(
+            "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+                 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+                 3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Resources << /ColorSpace << /C 10 0 R >> >> /Contents 4 0 R >> endobj\n\
+                 4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+                 5 0 obj << /FunctionType 2 /Domain [0 1] /N 1 /C0 [0] /C1 [1] >> endobj\n\
+                 6 0 obj << /FunctionType 2 /Domain [0 1] /N 1 /C0 [1 1 1] /C1 [0 1 0] >> endobj\n\
+                 {objects}{} 0 obj [/Separation /A /DeviceRGB 6 0 R] endobj\n\
+                 trailer << /Root 1 0 R >>\n%%EOF",
+            content.len(),
+            10 + levels - 1
+        )
+        .into_bytes();
+        let page = PageRenderer::new(Arc::new(bytes), RenderConfig::default()).render(RenderRequest {
+            page: 0,
+            kind: RequestKind::Pixels,
+            tile: None,
+            scale: 1.0,
+            tag: 0,
+            preview: false,
+        });
+        assert!(page.error.is_none(), "{levels}: {:?}", page.error);
+        page.rgba.get(..4) == Some(&[0, 255, 0, 255][..])
+    };
+    assert!(green(1), "a space on its own");
+    assert!(green(5), "as deep as a legal file goes");
+    assert!(green(31), "the deepest that is read");
+    assert!(!green(32), "one past it");
+}
+
+/// A page with the colour space resources `spaces` and the other objects `objects`, drawn with
+/// `content`. Objects 5 and 6 are tint transforms: the tint itself, and paper to green.
+fn page_with_colour_spaces(spaces: &str, objects: &str, content: &str) -> super::RenderedPage {
+    use super::*;
+    let bytes = format!(
+        "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Resources << /ColorSpace << {spaces} >> >> /Contents 4 0 R >> endobj\n\
+             4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+             5 0 obj << /FunctionType 2 /Domain [0 1] /N 1 /C0 [0] /C1 [1] >> endobj\n\
+             6 0 obj << /FunctionType 2 /Domain [0 1] /N 1 /C0 [1 1 1] /C1 [0 1 0] >> endobj\n\
+             {objects}\n\
+             trailer << /Root 1 0 R >>\n%%EOF",
+        content.len()
+    )
+    .into_bytes();
+    PageRenderer::new(Arc::new(bytes), RenderConfig::default()).render(RenderRequest {
+        page: 0,
+        kind: RequestKind::Pixels,
+        tile: None,
+        scale: 1.0,
+        tag: 0,
+        preview: false,
+    })
+}
+
+/// What an ICC profile reads as is kept. If what it falls back to were kept with it, a page
+/// selecting the last of a chain first would build each space on the one before, and no read
+/// would be deep: 20,000 levels past the limit, for whatever walks the space to paint with it.
+#[test]
+fn a_chain_built_on_spaces_already_read_ends() {
+    const LINKS: u32 = 20_000;
+    let selected: String = (0..LINKS).rev().map(|i| format!("/C{i} cs\n")).collect();
+    let content = format!("1 0 0 rg 0 0 100 100 re f\n{selected}0 sc 100 100 100 100 re f");
+    let spaces: String = (0..LINKS).map(|i| format!("/C{i} [/ICCBased {} 0 R] ", 10 + i)).collect();
+    let around: [&dyn Fn(&str) -> String; 4] = [
+        &|next| format!("[/Pattern {next}]"),
+        &|next| format!("[/Indexed {next} 1 <0011>]"),
+        &|next| format!("[/Separation /A {next} 5 0 R]"),
+        &|next| format!("[/DeviceN [/A] {next} 5 0 R]"),
+    ];
+    for around in around {
+        let mut objects: String = (0..LINKS)
+            .map(|i| {
+                let alternate = around(&format!("[/ICCBased {} 0 R]", 11 + i));
+                format!("{} 0 obj << /N 1 /Alternate {alternate} /Length 1 >> stream\nx\nendstream endobj\n", 10 + i)
+            })
+            .collect();
+        objects.push_str(&format!("{} 0 obj << /N 1 /Length 1 >> stream\nx\nendstream endobj\n", 10 + LINKS));
+        let page = page_with_colour_spaces(&spaces, &objects, &content);
+        assert!(page.error.is_none(), "{}: {:?}", around("next"), page.error);
+        let start = ((150 * page.width as usize) + 50) * 4;
+        assert_eq!(page.rgba.get(start..start + 4), Some(&[255, 0, 0, 255][..]), "{}: what comes before it drew", around("next"));
+    }
+}
+
+/// A profile met at the limit can't read its alternate there, which says nothing of a read nearer
+/// the top: the space kept from the first read isn't what the second gets.
+#[test]
+fn a_profile_read_at_the_limit_keeps_its_alternate_for_a_read_nearer_the_top() {
+    let chain: String = (0..31).map(|i| format!("{} 0 obj [/Separation /A {} 0 R 5 0 R] endobj\n", 10 + i, 11 + i)).collect();
+    let objects = format!(
+        "{chain}41 0 obj [/ICCBased 7 0 R] endobj\n\
+         7 0 obj << /N 1 /Alternate [/Separation /A /DeviceRGB 6 0 R] /Length 1 >> stream\nx\nendstream endobj\n"
+    );
+    let page = page_with_colour_spaces("/Deep 10 0 R /Near 41 0 R", &objects, "/Deep cs /Near cs 1 scn 0 0 200 200 re f");
+    assert!(page.error.is_none(), "{:?}", page.error);
+    assert_eq!(page.rgba.get(..4), Some(&[0, 255, 0, 255][..]));
+}
+
+/// An image's `/Decode` pairs can have a reference at the start of a pair. Its read took that for
+/// the whole pair, found no pair there, and ended the array, so the image didn't draw at all.
+#[test]
+fn a_decode_array_with_references_in_it_is_read() {
+    use super::*;
+    let render = |width_of: &str, decode: &str, space: &str, data: &str| -> [u8; 4] {
+        let content = "1 0 0 rg 0 0 200 200 re f q 200 0 0 200 0 0 cm /Im Do Q";
+        let bytes = format!(
+            "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+                 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+                 3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Resources << /XObject << /Im 5 0 R >> >> /Contents 4 0 R >> endobj\n\
+                 4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+                 5 0 obj << /Type /XObject /Subtype /Image /Width {width_of} /Height 1 /BitsPerComponent 8 /ColorSpace {space} /Decode {decode} /Filter /ASCIIHexDecode /Length {} >> stream\n{data}\nendstream endobj\n\
+                 6 0 obj 1 endobj\n\
+                 7 0 obj 0 endobj\n\
+                 8 0 obj 8 0 R endobj\n\
+                 9 0 obj 10 0 R endobj\n\
+                 10 0 obj 9 0 R endobj\n\
+                 trailer << /Root 1 0 R >>\n%%EOF",
+            content.len(),
+            data.len()
+        )
+        .into_bytes();
+        let page = PageRenderer::new(Arc::new(bytes), RenderConfig::default()).render(RenderRequest {
+            page: 0,
+            kind: RequestKind::Pixels,
+            tile: None,
+            scale: 1.0,
+            tag: 0,
+            preview: false,
+        });
+        assert!(page.error.is_none(), "{decode}: {:?}", page.error);
+        let start = (100 * page.width as usize + 100) * 4;
+        let mut pixel = [0; 4];
+        pixel.copy_from_slice(page.rgba.get(start..start + 4).expect("centre pixel"));
+        pixel
+    };
+    let grey = render("1", "[1 0]", "/DeviceGray", "40>");
+    assert_eq!(grey, [191, 191, 191, 255], "the direct form inverts the sample");
+    for decode in ["[6 0 R 0]", "[1 7 0 R]", "[6 0 R 7 0 R]"] {
+        assert_eq!(render("1", decode, "/DeviceGray", "40>"), grey, "{decode}");
+    }
+    let rgb = render("1", "[1 0 1 0 1 0]", "/DeviceRGB", "204060>");
+    for decode in ["[6 0 R 0 1 0 1 0]", "[1 0 6 0 R 0 1 0]", "[1 0 1 0 6 0 R 0]", "[6 0 R 7 0 R 6 0 R 7 0 R 6 0 R 7 0 R]"] {
+        assert_eq!(render("1", decode, "/DeviceRGB", "204060>"), rgb, "{decode}");
+    }
+    // A reference that only leads back to itself holds no number, and reads as one that names
+    // nothing does.
+    let missing = render("1", "[99 0 R 0]", "/DeviceGray", "40>");
+    for decode in ["[8 0 R 0]", "[1 8 0 R]", "[9 0 R 0]", "[1 9 0 R]", "[8 0 R 9 0 R]"] {
+        assert_eq!(render("1", decode, "/DeviceGray", "40>"), missing, "{decode}");
+    }
+}
+
+/// An object that holds only a reference stands for what that names, stored on its own or in an
+/// object stream. Read as a number it was the reference's own object number: here 8 names 7, 7
+/// names 6 and 6 holds 1, and that read as 7, which drew white. A chain past the limit, and so a
+/// cycle, reads as a missing object does.
+#[test]
+fn a_reference_to_a_reference_is_what_it_names() {
+    use super::*;
+    let file = |decode: &str, objects: &str| -> Vec<u8> {
+        let content = "1 0 0 rg 0 0 200 200 re f q 200 0 0 200 0 0 cm /Im Do Q";
+        format!(
+            "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+                 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+                 3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Resources << /XObject << /Im 5 0 R >> >> /Contents 4 0 R >> endobj\n\
+                 4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+                 5 0 obj << /Type /XObject /Subtype /Image /Width 1 /Height 1 /BitsPerComponent 8 /ColorSpace /DeviceGray /Decode {decode} /Filter /ASCIIHexDecode /Length 3 >> stream\n40>\nendstream endobj\n\
+                 {objects}\n\
+                 trailer << /Root 1 0 R >>\n%%EOF",
+            content.len()
+        )
+        .into_bytes()
+    };
+    let draw = |bytes: Vec<u8>| -> [u8; 4] {
+        let page = PageRenderer::new(Arc::new(bytes), RenderConfig::default()).render(RenderRequest {
+            page: 0,
+            kind: RequestKind::Pixels,
+            tile: None,
+            scale: 1.0,
+            tag: 0,
+            preview: false,
+        });
+        assert!(page.error.is_none(), "{:?}", page.error);
+        let start = (100 * page.width as usize + 100) * 4;
+        let mut pixel = [0; 4];
+        pixel.copy_from_slice(page.rgba.get(start..start + 4).expect("centre pixel"));
+        pixel
+    };
+    let grey = draw(file("[1 0]", ""));
+    assert_eq!(grey, [191, 191, 191, 255]);
+
+    let chain = "6 0 obj 1 endobj 7 0 obj 6 0 R endobj 8 0 obj 7 0 R endobj";
+    assert_eq!(draw(file("[8 0 R 0]", chain)), grey, "stored on their own");
+    let doc = pdfcraft_cos::Document::open(Arc::new(file("[8 0 R 0]", chain))).unwrap();
+    let packed = pdfcraft_cos::write_full(&doc, &pdfcraft_cos::SaveOptions::default()).unwrap();
+    assert!(packed.windows(7).any(|w| w == b"/ObjStm"), "the save packs them");
+    assert_eq!(draw(packed), grey, "stored in an object stream");
+    assert_eq!(draw(file("9 0 R", "9 0 obj 10 0 R endobj 10 0 obj [1 0] endobj")), grey, "not only numbers");
+    let commented = "6 0 obj 1 endobj 7 0 obj 6 %c\n0 R endobj 8 0 obj 7 0 %c\nR endobj";
+    assert_eq!(draw(file("[8 %c\n0 R 0]", commented)), grey, "a comment counts as white space");
+
+    let links = |n: usize| -> String {
+        let links: String = (0..n).map(|i| format!("{} 0 obj {} 0 R endobj\n", 10 + i, 11 + i)).collect();
+        format!("{links}{} 0 obj 1 endobj", 10 + n)
+    };
+    let missing = draw(file("[99 0 R 0]", ""));
+    assert_ne!(missing, grey);
+    assert_eq!(draw(file("[10 0 R 0]", &links(32))), grey, "32 references are followed");
+    assert_eq!(draw(file("[10 0 R 0]", &links(33))), missing, "33 aren't");
+    assert_eq!(draw(file("[6 0 R 0]", "6 0 obj 6 0 R endobj")), missing, "nor is a cycle");
+}
+
+/// A function's `/Encode`, `/Decode`, `/Domain` and `/Range` are read a pair at a time too, so they
+/// lost a reference at the start of a pair the same way, and the array with it. Each form is compared
+/// with the direct one, which differs from the identity so the array is shown to count.
+#[test]
+fn a_functions_arrays_can_start_with_a_reference() {
+    use super::*;
+    let render = |function: String| -> [u8; 4] {
+        let content = "/C cs 0.25 sc 0 0 200 200 re f";
+        let bytes = format!(
+            "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+                 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+                 3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Resources << /ColorSpace << /C [/Separation /X /DeviceRGB 9 0 R] >> >> /Contents 4 0 R >> endobj\n\
+                 4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+                 5 0 obj 1 endobj\n6 0 obj 0 endobj\n\
+                 7 0 obj << /FunctionType 2 /Domain [0 1] /C0 [0 0 0] /C1 [1 0 0] /N 1 >> endobj\n\
+                 8 0 obj << /FunctionType 2 /Domain [0 1] /C0 [0 1 0] /C1 [0 0 1] /N 1 >> endobj\n\
+                 9 0 obj {function} endobj\n\
+                 trailer << /Root 1 0 R >>\n%%EOF",
+            content.len()
+        )
+        .into_bytes();
+        let page = PageRenderer::new(Arc::new(bytes), RenderConfig::default()).render(RenderRequest {
+            page: 0,
+            kind: RequestKind::Pixels,
+            tile: None,
+            scale: 1.0,
+            tag: 0,
+            preview: false,
+        });
+        assert!(page.error.is_none(), "{function}: {:?}", page.error);
+        let start = (100 * page.width as usize + 100) * 4;
+        let mut pixel = [0; 4];
+        pixel.copy_from_slice(page.rgba.get(start..start + 4).expect("centre pixel"));
+        pixel
+    };
+    let sampled = |encode: &str| {
+        format!(
+            "<< /FunctionType 0 /Size [2] /BitsPerSample 8 /Domain [0 1] /Range [0 1 0 1 0 1] /Encode {encode} /Filter /ASCIIHexDecode /Length 13 >> stream\n000000FF8040>\nendstream"
+        )
+    };
+    let stitched = |encode: &str| format!("<< /FunctionType 3 /Domain [0 1] /Functions [7 0 R 8 0 R] /Bounds [.5] /Encode {encode} >>");
+    assert_ne!(render(sampled("[1 0]")), render(sampled("[0 1]")), "/Encode counts");
+    assert_eq!(render(sampled("[5 0 R 0]")), render(sampled("[1 0]")), "a sampled function");
+    assert_ne!(render(stitched("[1 0 0 1]")), render(stitched("[0 1 0 1]")), "/Encode counts");
+    assert_eq!(render(stitched("[5 0 R 0 0 1]")), render(stitched("[1 0 0 1]")), "a stitching function");
+}
+
+/// The lookup table of an `/Indexed` space is a string or a stream, and any part of the space can
+/// be indirect (ISO 32000-2 §8.6.6.3, §7.3.10). A table in an indirect string was lost: reading it
+/// as a stream used up the reference, so the space couldn't be read and drew in grey.
+#[test]
+fn an_indexed_lookup_table_is_read_in_every_legal_form() {
+    use super::*;
+    let render = |space: &str, content: &str, extra: &str| -> [u8; 4] {
+        let bytes = format!(
+            "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+                 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+                 3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Resources << /ColorSpace << /I {space} >> /XObject << /Im 9 0 R >> >> /Contents 4 0 R >> endobj\n\
+                 4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+                 5 0 obj <000000FF0000> endobj\n\
+                 6 0 obj << /Filter /ASCIIHexDecode /Length 13 >> stream\n000000FF0000>\nendstream endobj\n\
+                 7 0 obj /DeviceRGB endobj\n\
+                 8 0 obj 1 endobj\n\
+                 {extra}\n\
+                 trailer << /Root 1 0 R >>\n%%EOF",
+            content.len()
+        )
+        .into_bytes();
+        let page = PageRenderer::new(Arc::new(bytes), RenderConfig::default()).render(RenderRequest {
+            page: 0,
+            kind: RequestKind::Pixels,
+            tile: None,
+            scale: 1.0,
+            tag: 0,
+            preview: false,
+        });
+        assert!(page.error.is_none(), "{space}: {:?}", page.error);
+        let start = (100 * page.width as usize + 100) * 4;
+        let mut pixel = [0; 4];
+        pixel.copy_from_slice(page.rgba.get(start..start + 4).expect("centre pixel"));
+        pixel
+    };
+    let paint = "/I cs 1 sc 0 0 200 200 re f";
+    // One byte of index 1, as an image in the same space: the image path reads it too.
+    let image = "9 0 obj << /Type /XObject /Subtype /Image /Width 1 /Height 1 /BitsPerComponent 8 /ColorSpace [/Indexed /DeviceRGB 1 5 0 R] /Filter /ASCIIHexDecode /Length 3 >> stream\n01>\nendstream endobj";
+    for space in [
+        "[/Indexed /DeviceRGB 1 <000000FF0000>]",
+        "[/Indexed /DeviceRGB 1 5 0 R]",
+        "[/Indexed /DeviceRGB 1 6 0 R]",
+        "[/Indexed 7 0 R 8 0 R 5 0 R]",
+        "[/I /DeviceRGB 1 5 0 R]",
+    ] {
+        assert_eq!(render(space, paint, ""), [255, 0, 0, 255], "{space}");
+    }
+    let indirect = "10 0 obj [/Indexed /DeviceRGB 1 5 0 R] endobj";
+    assert_eq!(render("10 0 R", paint, indirect), [255, 0, 0, 255], "the whole space by reference");
+    assert_eq!(render("/DeviceRGB", "q 200 0 0 200 0 0 cm /Im Do Q", image), [255, 0, 0, 255], "an image's table by reference");
+    // What's neither table form leaves the space unreadable, as a missing table does.
+    for space in ["[/Indexed /DeviceRGB 1 8 0 R]", "[/Indexed /DeviceRGB 1 99 0 R]", "[/Indexed /DeviceRGB 1]"] {
+        let _ = render(space, paint, "");
+    }
+    // So does a table that only leads back to itself, and the read of it ends.
+    let cycle = "11 0 obj 11 0 R endobj 12 0 obj 13 0 R endobj 13 0 obj 12 0 R endobj";
+    for space in ["[/Indexed /DeviceRGB 1 11 0 R]", "[/Indexed /DeviceRGB 1 12 0 R]"] {
+        let _ = render(space, paint, cycle);
+    }
+}
 #[test]
 fn watchdog_skips_a_stuck_page_and_keeps_rendering() {
     use super::*;
@@ -3527,6 +3993,1086 @@ fn jbig2_regions_of_billions_of_pixels_are_refused() {
     assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "the rest of the page draws");
 }
 
+/// One embedded JBIG2 segment (ISO 14492 §7.2) of page 1. More than four references take the long
+/// form, whose retention flags are left clear.
+fn jbig2_segment(out: &mut Vec<u8>, number: u32, kind: u8, refs: &[u8], data: &[u8]) {
+    out.extend_from_slice(&number.to_be_bytes());
+    out.push(kind);
+    if refs.len() <= 4 {
+        out.push(u8::try_from(refs.len()).unwrap() << 5);
+    } else {
+        out.extend_from_slice(&(0xE000_0000u32 | u32::try_from(refs.len()).unwrap()).to_be_bytes());
+        out.extend(std::iter::repeat_n(0u8, (refs.len() + 1).div_ceil(8)));
+    }
+    out.extend_from_slice(refs);
+    out.push(1);
+    out.extend_from_slice(&u32::try_from(data.len()).unwrap().to_be_bytes());
+    out.extend_from_slice(data);
+}
+
+/// The page information of a 16 × 2 JBIG2 page whose default pixel is black, so that the image, if
+/// it decodes, draws black whatever its other segments hold.
+fn black_jbig2_page() -> Vec<u8> {
+    let mut page = Vec::new();
+    page.extend_from_slice(&16u32.to_be_bytes());
+    page.extend_from_slice(&2u32.to_be_bytes());
+    page.extend_from_slice(&[0; 8]); // resolution
+    page.extend_from_slice(&[4, 0, 0]); // flags (default pixel black), striping
+    let mut stream = Vec::new();
+    jbig2_segment(&mut stream, 0, 48, &[], &page);
+    stream
+}
+
+/// A region's information field, at the page's corner.
+fn jbig2_region_info(width: u32, height: u32) -> Vec<u8> {
+    let mut region = Vec::new();
+    region.extend_from_slice(&width.to_be_bytes());
+    region.extend_from_slice(&height.to_be_bytes());
+    region.extend_from_slice(&[0; 9]); // x, y, combination operator
+    region
+}
+
+/// Whether a 16 × 2 JBIG2 image decodes: drawn at 5..25 both ways, it draws black, and refused it
+/// leaves the page white. The red square beside it shows the rest of the page drew either way.
+fn jbig2_image_draws(stream: &[u8]) -> bool {
+    jbig2_image_draws_in(stream, "/DeviceGray")
+}
+
+/// [`jbig2_image_draws`], for an image in colour space `space`.
+fn jbig2_image_draws_in(stream: &[u8], space: &str) -> bool {
+    jbig2_image_draws_with(stream, space, "", b"")
+}
+
+/// [`jbig2_image_draws_in`], with entries for the image's dictionary and more objects, from 6 up.
+fn jbig2_image_draws_with(stream: &[u8], space: &str, entries: &str, objects: &[u8]) -> bool {
+    let content = b"q 20 0 0 20 5 5 cm /Im1 Do Q 1 0 0 rg 0 0 4 4 re f";
+    let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /XObject << /Im1 5 0 R >> >> >> endobj\n".to_vec();
+    pdf.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n", content.len()).as_bytes());
+    pdf.extend_from_slice(content);
+    pdf.extend_from_slice(b"\nendstream endobj\n");
+    pdf.extend_from_slice(
+        format!("5 0 obj << /Type /XObject /Subtype /Image /Width 16 /Height 2 /BitsPerComponent 1 /ColorSpace {space} {entries} /Filter /JBIG2Decode /Length {} >> stream\n", stream.len())
+            .as_bytes(),
+    );
+    pdf.extend_from_slice(stream);
+    pdf.extend_from_slice(b"\nendstream endobj\n");
+    pdf.extend_from_slice(objects);
+    pdf.extend_from_slice(b"trailer << /Root 1 0 R >>\n%%EOF\n");
+    // What one image may take, which the page's allowance, tested on its own, would otherwise reach
+    // first: it is the same size, and the page itself comes out of it.
+    let config = RenderConfig { jbig2_work: Some(u64::MAX), ..RenderConfig::default() };
+    let mut r = PageRenderer::new(Arc::new(pdf), config);
+    let page = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+    assert!(page.error.is_none(), "{:?}", page.error);
+    assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "the rest of the page draws");
+    // Inside the image: top-down rows 15..35.
+    match &page.rgba[((25 * 40 + 15) * 4)..][..4] {
+        [0, 0, 0, 255] => true,
+        [255, 255, 255, 255] => false,
+        other => panic!("neither the image nor the page: {other:?}"),
+    }
+}
+
+/// The JBIG2 images of a page share one allowance, down to the step, and the next page starts with
+/// its own. The images differ by an extension segment: one image decoded again isn't decoded twice.
+#[test]
+fn the_jbig2_images_of_a_page_share_one_allowance() {
+    let image = |number: u8, id: u8| {
+        let mut stream = black_jbig2_page();
+        jbig2_segment(&mut stream, 1, 62, &[], &[0, 0, 0, 0, id]);
+        let mut object = format!(
+            "{number} 0 obj << /Type /XObject /Subtype /Image /Width 16 /Height 2 /BitsPerComponent 1 /ColorSpace /DeviceGray /Filter /JBIG2Decode /Length {} >> stream\n",
+            stream.len()
+        )
+        .into_bytes();
+        object.extend_from_slice(&stream);
+        object.extend_from_slice(b"\nendstream endobj\n");
+        object
+    };
+    let page = |number: u8, content: u8, xobjects: &str| {
+        format!("{number} 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents {content} 0 R /Resources << /XObject << {xobjects} >> >> >> endobj\n").into_bytes()
+    };
+    let content = |number: u8, text: &str| format!("{number} 0 obj << /Length {} >> stream\n{text}\nendstream endobj\n", text.len()).into_bytes();
+    let mut pdf =
+        b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R 4 0 R] /Count 2 >> endobj\n".to_vec();
+    pdf.extend(page(3, 5, "/A 7 0 R /B 8 0 R"));
+    pdf.extend(page(4, 6, "/C 9 0 R"));
+    pdf.extend(content(5, "q 20 0 0 40 0 0 cm /A Do Q q 20 0 0 40 20 0 cm /B Do Q"));
+    pdf.extend(content(6, "q 20 0 0 40 0 0 cm /C Do Q"));
+    pdf.extend(image(7, 1));
+    pdf.extend(image(8, 2));
+    pdf.extend(image(9, 3));
+    pdf.extend_from_slice(b"trailer << /Root 1 0 R >>\n%%EOF\n");
+    let pdf = Arc::new(pdf);
+    let black = |page: &RenderedPage, x: usize| match &page.rgba[((20 * 40 + x) * 4)..][..4] {
+        [0, 0, 0, 255] => true,
+        [255, 255, 255, 255] => false,
+        other => panic!("neither an image nor the page: {other:?}"),
+    };
+    let pages = |work: u64| {
+        let mut renderer = PageRenderer::new(pdf.clone(), RenderConfig { jbig2_work: Some(work), ..RenderConfig::default() });
+        [0, 1].map(|page| renderer.render(RenderRequest { page, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() }))
+    };
+    let drawn = |work: u64| {
+        let [first, _] = pages(work);
+        assert!(first.error.is_none(), "{:?}", first.error);
+        (black(&first, 10), black(&first, 30))
+    };
+    let one = (1..1_000).find(|work| drawn(*work).0).expect("a small image is cheap");
+    assert_eq!(drawn(one - 1), (false, false), "a step short of the first");
+    assert_eq!(drawn(one), (true, false), "enough for one");
+    assert_eq!(drawn(2 * one - 1), (true, false), "a step short of both");
+    assert_eq!(drawn(2 * one), (true, true), "enough for both");
+    let [first, second] = pages(one);
+    assert!(first.warnings.contains(&RenderWarning::ContentTruncated), "the page says it left something out: {:?}", first.warnings);
+    assert!(pages(2 * one)[0].warnings.is_empty(), "and only then");
+    assert!(black(&second, 10), "the next page has its own allowance, though this one spent all of it");
+    let usual = PageRenderer::new(pdf.clone(), RenderConfig::default()).render(RenderRequest {
+        page: 0,
+        kind: RequestKind::Pixels,
+        tile: None,
+        scale: 1.0,
+        tag: 0,
+        ..Default::default()
+    });
+    assert!(black(&usual, 10) && black(&usual, 30), "the usual allowance is far above a page like this");
+}
+
+/// Without its mask a picture would show what the mask hides, so a JBIG2 mask past the page's
+/// allowance takes the picture with it, and the page says so. A mask that can't be read for any
+/// other reason leaves the picture, as it did.
+#[test]
+fn a_picture_whose_jbig2_mask_is_past_the_pages_allowance_is_not_drawn() {
+    let draw = |entry: &str, filter: &str, mask: &[u8], work: u64| {
+        let content = b"q 20 0 0 20 5 5 cm /Im1 Do Q";
+        let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /XObject << /Im1 5 0 R >> >> >> endobj\n".to_vec();
+        pdf.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n", content.len()).as_bytes());
+        pdf.extend_from_slice(content);
+        pdf.extend_from_slice(b"\nendstream endobj\n");
+        pdf.extend_from_slice(
+            format!("5 0 obj << /Type /XObject /Subtype /Image /Width 1 /Height 1 /BitsPerComponent 8 /ColorSpace /DeviceGray {entry} 6 0 R /Length 1 >> stream\n\0\nendstream endobj\n").as_bytes(),
+        );
+        let kind = if entry == "/Mask" { "/ImageMask true" } else { "/ColorSpace /DeviceGray" };
+        pdf.extend_from_slice(
+            format!(
+                "6 0 obj << /Type /XObject /Subtype /Image /Width 16 /Height 2 /BitsPerComponent 1 {kind} /Filter {filter} /Length {} >> stream\n",
+                mask.len()
+            )
+            .as_bytes(),
+        );
+        pdf.extend_from_slice(mask);
+        pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
+        let config = RenderConfig { jbig2_work: Some(work), ..RenderConfig::default() };
+        let page = PageRenderer::new(Arc::new(pdf), config).render(RenderRequest {
+            page: 0,
+            kind: RequestKind::Pixels,
+            tile: None,
+            scale: 1.0,
+            tag: 0,
+            ..Default::default()
+        });
+        assert!(page.error.is_none(), "{:?}", page.error);
+        let shown = match &page.rgba[((25 * 40 + 15) * 4)..][..4] {
+            [0, 0, 0, 255] => true,
+            [255, 255, 255, 255] => false,
+            other => panic!("neither the picture nor the page: {other:?}"),
+        };
+        (shown, page.warnings.contains(&RenderWarning::ContentTruncated))
+    };
+    let mask = black_jbig2_page();
+    let jbig2 = "/JBIG2Decode";
+    assert_eq!(draw("/SMask", jbig2, &mask, u64::MAX), (false, false), "the mask hides all of it");
+    assert_eq!(draw("/SMask", jbig2, &mask, 0), (false, true), "past the allowance a soft mask hides it too");
+    assert_eq!(draw("/Mask", jbig2, &mask, 0), (false, true), "and so does a stencil mask");
+    assert_eq!(draw("/SMask", jbig2, b"no JBIG2 here", 1 << 20), (true, false), "any other bad mask is no mask");
+    let other = draw("/SMask", "/DCTDecode", b"no JPEG here", 0);
+    assert_eq!(other, (true, false), "and a page with nothing left says nothing of a mask that isn't JBIG2");
+}
+
+/// A page's allowance ends with it, so what decodes on its thread afterwards has no page to run out
+/// on, and a `Context` used again starts afresh.
+#[test]
+fn a_pages_jbig2_allowance_ends_with_the_page() {
+    use hayro::hayro_interpret::font::Glyph;
+    use hayro::hayro_interpret::hayro_syntax::Pdf;
+    use hayro::hayro_interpret::{
+        BlendMode, ClipPath, Context, Device, GlyphDrawMode, Image, InterpreterCache, InterpreterSettings, Paint, PathDrawMode, SoftMask,
+        TransformExt, interpret_page,
+    };
+    use hayro_syntax::page_jbig2_work_spent;
+    use kurbo::{Affine, BezPath, Rect};
+
+    /// Notes at each path whether the page has run out.
+    struct Spent(Vec<bool>);
+    impl<'a> Device<'a> for Spent {
+        fn set_soft_mask(&mut self, _: Option<SoftMask<'a>>) {}
+        fn set_blend_mode(&mut self, _: BlendMode) {}
+        fn draw_path(&mut self, _: &BezPath, _: Affine, _: &Paint<'a>, _: &PathDrawMode) {
+            self.0.push(page_jbig2_work_spent());
+        }
+        fn push_clip_path(&mut self, _: &ClipPath) {}
+        fn push_transparency_group(&mut self, _: f32, _: Option<SoftMask<'a>>, _: BlendMode) {}
+        fn draw_glyph(&mut self, _: &Glyph<'a>, _: Affine, _: Affine, _: &Paint<'a>, _: &GlyphDrawMode) {}
+        fn draw_image(&mut self, _: Image<'a, '_>, _: Affine) {}
+        fn pop_clip_path(&mut self) {}
+        fn pop_transparency_group(&mut self) {}
+    }
+
+    let content = "0 0 4 4 re f";
+    let bytes = format!(
+        "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R >> endobj\n4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n",
+        content.len()
+    );
+    let pdf = Pdf::new(Arc::new(bytes.into_bytes())).expect("parses");
+    let page = &pdf.pages()[0];
+    let cache = InterpreterCache::new();
+    let settings = InterpreterSettings { jbig2_work: 0, ..InterpreterSettings::default() };
+    let mut ctx = Context::new(page.initial_transform(true).to_kurbo(), Rect::new(0.0, 0.0, 40.0, 40.0), &cache, page.xref(), settings);
+    let mut device = Spent(Vec::new());
+    for _ in 0..2 {
+        interpret_page(page, &mut ctx, &mut device);
+        assert!(!page_jbig2_work_spent(), "no page is being drawn");
+    }
+    assert_eq!(device.0, [true, true], "each time, the page has what its settings give it");
+}
+
+/// An image that can't be decoded has still cost its reading, which a page repeats for each time
+/// it draws one, since such an image isn't kept. So what it reads comes out of the page's allowance,
+/// and an image after it has less. Allowed exactly what the good one takes, it isn't drawn behind
+/// the bad one, and is drawn alone.
+#[test]
+fn an_image_that_fails_spends_the_pages_allowance_too() {
+    let image = |number: u8, stream: &[u8]| {
+        let mut object = format!(
+            "{number} 0 obj << /Type /XObject /Subtype /Image /Width 16 /Height 2 /BitsPerComponent 1 /ColorSpace /DeviceGray /Filter /JBIG2Decode /Length {} >> stream\n",
+            stream.len()
+        )
+        .into_bytes();
+        object.extend_from_slice(stream);
+        object.extend_from_slice(b"\nendstream endobj\n");
+        object
+    };
+    let pdf = |content: &str| {
+        let mut pdf = format!(
+            "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /XObject << /Bad 5 0 R /Good 6 0 R >> >> >> endobj\n\
+             4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n",
+            content.len()
+        )
+        .into_bytes();
+        pdf.extend(image(5, &[0xFF; 64]));
+        pdf.extend(image(6, &black_jbig2_page()));
+        pdf.extend_from_slice(b"trailer << /Root 1 0 R >>\n%%EOF\n");
+        Arc::new(pdf)
+    };
+    let good = "q 40 0 0 40 0 0 cm /Good Do Q";
+    let drawn = |content: &str, work: u64| {
+        let config = RenderConfig { jbig2_work: Some(work), ..RenderConfig::default() };
+        let page = PageRenderer::new(pdf(content), config).render(RenderRequest {
+            page: 0,
+            kind: RequestKind::Pixels,
+            tile: None,
+            scale: 1.0,
+            tag: 0,
+            ..Default::default()
+        });
+        assert!(page.error.is_none(), "{:?}", page.error);
+        page.rgba[((20 * 40 + 20) * 4)..][..4] == [0, 0, 0, 255]
+    };
+    let cost = (1..2_000).find(|work| drawn(good, *work)).expect("a small image is cheap");
+    assert!(!drawn(&format!("q 1 0 0 1 0 0 cm /Bad Do Q {good}"), cost), "the bad one spent some of it");
+    assert!(drawn(&format!("q 1 0 0 1 0 0 cm /Bad Do Q {good}"), cost + 4 * 64), "and what it spent is its reading");
+}
+
+/// Bits written from the top of each byte, as JBIG2's Huffman-coded data is.
+#[derive(Default)]
+struct Bits {
+    bytes: Vec<u8>,
+    used: u32,
+}
+
+impl Bits {
+    fn put(&mut self, value: u32, count: u32) {
+        for i in (0..count).rev() {
+            if self.used.is_multiple_of(8) {
+                self.bytes.push(0);
+            }
+            if (value >> i) & 1 != 0 {
+                *self.bytes.last_mut().unwrap() |= 0x80 >> (self.used % 8);
+            }
+            self.used += 1;
+        }
+    }
+
+    fn align(&mut self) {
+        self.used = self.used.div_ceil(8) * 8;
+    }
+
+    /// `value` in table B.1 (ISO 14492 Annex B).
+    fn table_b1(&mut self, value: u32) {
+        match value {
+            0..=15 => {
+                self.put(0, 1);
+                self.put(value, 4);
+            }
+            16..=271 => {
+                self.put(0b10, 2);
+                self.put(value - 16, 8);
+            }
+            272..=65807 => {
+                self.put(0b110, 3);
+                self.put(value - 272, 16);
+            }
+            _ => {
+                self.put(0b111, 3);
+                self.put(value - 65808, 32);
+            }
+        }
+    }
+}
+
+/// A Huffman-coded symbol dictionary of `symbols` symbols of width 0 and height 1, exported or not:
+/// each holds no pixels, and costs a bitmap's header all the same.
+fn zero_width_jbig2_dictionary(symbols: u32, exported: bool) -> Vec<u8> {
+    let mut dictionary = vec![0x00, 0x01]; // Huffman, tables B.4, B.2, B.1, B.1
+    dictionary.extend_from_slice(&(if exported { symbols } else { 0 }).to_be_bytes());
+    dictionary.extend_from_slice(&symbols.to_be_bytes()); // new
+    let mut bits = Bits::default();
+    bits.put(0, 1); // height class delta 1 (B.4)
+    for _ in 0..symbols {
+        bits.put(0, 1); // width delta 0 (B.2)
+    }
+    bits.put(0b111111, 6); // end of the class (B.2)
+    bits.put(0, 5); // BMSIZE 0, uncompressed (B.1)
+    bits.align();
+    if exported {
+        bits.table_b1(0); // the first export run isn't exported
+    }
+    bits.table_b1(symbols);
+    dictionary.extend_from_slice(&bits.bytes);
+    dictionary
+}
+
+/// A Huffman-coded symbol dictionary of `symbols` symbols of width 1 and no rows, none exported.
+/// Only table B.5 has a negative height class delta, so it gets to no rows from one.
+fn no_row_jbig2_dictionary(symbols: u32) -> Vec<u8> {
+    let mut bits = Bits::default();
+    bits.put(0, 1); // height class delta 1 (B.5), a class of no symbols
+    bits.put(0b111111, 6); // end of the class (B.2)
+    bits.put(0, 5); // BMSIZE 0, uncompressed (B.1)
+    bits.align();
+    bits.put(0b1111110, 7); // height class delta -1 (B.5): -255 and 254
+    bits.put(254, 8);
+    bits.put(0b10, 2); // width delta 1 (B.2)
+    for _ in 1..symbols {
+        bits.put(0, 1); // width delta 0 (B.2)
+    }
+    bits.put(0b111111, 6); // end of the class (B.2)
+    bits.put(0, 5); // BMSIZE 0, uncompressed (B.1)
+    bits.align();
+    bits.table_b1(symbols); // the first export run, not exported, is all of them
+    let mut dictionary = vec![0x00, 0x05]; // Huffman, tables B.5, B.2, B.1, B.1
+    dictionary.extend_from_slice(&0u32.to_be_bytes()); // exported
+    dictionary.extend_from_slice(&symbols.to_be_bytes()); // new
+    dictionary.extend_from_slice(&bits.bytes);
+    dictionary
+}
+
+/// A Huffman-coded symbol dictionary that climbs to `height`, stays about there for `classes`
+/// classes of no symbols, each with a byte of MMR bitmap, and drops to one row for its one symbol,
+/// not exported.
+fn empty_class_jbig2_dictionary(classes: u32, height: u32) -> Vec<u8> {
+    let mut bits = Bits::default();
+    bits.put(0b111110, 6); // height class delta, the upper line of table B.5
+    bits.put(height - 76, 32);
+    let mut at = height;
+    for class in 0..classes {
+        // Table B.5 has no delta of 0, so it goes down one and up one.
+        if class % 2 == 1 {
+            bits.put(0b1111110, 7); // height class delta -1 (B.5): -255 and 254
+            bits.put(254, 8);
+            at -= 1;
+        } else if class > 0 {
+            bits.put(0, 1); // height class delta 1 (B.5)
+            at += 1;
+        }
+        bits.put(0b111111, 6); // end of the class (B.2)
+        bits.put(1, 5); // BMSIZE 1 (B.1)
+        bits.align();
+        bits.put(0xFF, 8);
+    }
+    bits.put(0b1111111, 7); // height class delta, the lower line of table B.5
+    bits.put(at - 1 - 256, 32);
+    bits.put(0b10, 2); // width delta 1 (B.2)
+    bits.put(0b111111, 6); // end of the class (B.2)
+    bits.put(0, 5); // BMSIZE 0, uncompressed (B.1)
+    bits.align();
+    bits.put(0, 8); // its row
+    bits.table_b1(1); // the first export run, not exported, is all of them
+    let mut dictionary = vec![0x00, 0x05]; // Huffman, tables B.5, B.2, B.1, B.1
+    dictionary.extend_from_slice(&0u32.to_be_bytes()); // exported
+    dictionary.extend_from_slice(&1u32.to_be_bytes()); // new
+    dictionary.extend_from_slice(&bits.bytes);
+    dictionary
+}
+
+/// A Huffman-coded symbol dictionary of `symbols` white symbols of width 1 and `height` rows, none
+/// exported, for `height` from 76 up.
+fn narrow_jbig2_dictionary(symbols: u32, height: u32) -> Vec<u8> {
+    let mut bits = Bits::default();
+    bits.put(0b11111, 5); // height class delta, the upper line of table B.4
+    bits.put(height - 76, 32);
+    bits.put(0b10, 2); // width delta 1 (B.2)
+    for _ in 1..symbols {
+        bits.put(0, 1); // width delta 0 (B.2)
+    }
+    bits.put(0b111111, 6); // end of the class (B.2)
+    let rows = height.div_ceil(8) + 1; // an MMR-coded white bitmap: one bit a row
+    bits.table_b1(rows); // BMSIZE (B.1)
+    bits.align();
+    for _ in 0..rows {
+        bits.put(0xFF, 8);
+    }
+    bits.table_b1(symbols); // the first export run, not exported, is all of them
+    let mut dictionary = vec![0x00, 0x01]; // Huffman, tables B.4, B.2, B.1, B.1
+    dictionary.extend_from_slice(&0u32.to_be_bytes()); // exported
+    dictionary.extend_from_slice(&symbols.to_be_bytes()); // new
+    dictionary.extend_from_slice(&bits.bytes);
+    dictionary
+}
+
+/// An intermediate generic region, white, every row typical: it decodes in a few bytes however
+/// large it is.
+fn jbig2_white_region(width: u32, height: u32) -> Vec<u8> {
+    let mut region = jbig2_region_info(width, height);
+    region.push(0x08); // arithmetic coding, template 0, typical prediction
+    region.extend_from_slice(&[3, 0xff, 0xfd, 0xff, 2, 0xfe, 0xfe, 0xfe]); // AT pixels
+    // Every row typical, the first white: pdfcraft-filters' coding of a white 16,384 square.
+    region.extend_from_slice(&[0xb6, 0xc2, 0x1f, 0xff, 0x7f, 0xff, 0xac]);
+    region
+}
+
+/// A pattern dictionary of `patterns` patterns of width 1 and `height` rows, with nothing coded.
+fn jbig2_pattern_dictionary(height: u8, patterns: u32) -> Vec<u8> {
+    let mut dictionary = vec![0, 1, height];
+    dictionary.extend_from_slice(&(patterns - 1).to_be_bytes());
+    dictionary
+}
+
+/// A 1 × 1 halftone region over a grid of `width` × `height` cells, all at the region's corner,
+/// coded by MMR or arithmetically.
+fn jbig2_halftone(width: u32, height: u32, mmr: bool) -> Vec<u8> {
+    jbig2_halftone_of(1, width, height, mmr)
+}
+
+/// [`jbig2_halftone`] for a square region of `side` pixels.
+fn jbig2_halftone_of(side: u32, width: u32, height: u32, mmr: bool) -> Vec<u8> {
+    let mut halftone = jbig2_region_info(side, side);
+    halftone.push(u8::from(mmr)); // template 0
+    halftone.extend_from_slice(&width.to_be_bytes());
+    halftone.extend_from_slice(&height.to_be_bytes());
+    halftone.extend_from_slice(&[0; 12]); // grid offset and vector
+    halftone
+}
+
+/// Each JBIG2 segment's bitmaps are bounded, but nothing bounded what a page's segments hold for
+/// later ones: a stream of a few dozen bytes an intermediate region (16,384 samples a side, every
+/// row typical) held 33 MB each, so a few kilobytes could exhaust memory. Vendored hayro-jbig2
+/// patch: what regions, dictionaries and tables hold is at most 64 MiB (`MAX_RETAINED_WORDS`), two
+/// such squares, which are exactly the bound.
+#[test]
+fn jbig2_regions_held_past_a_pages_bound_are_refused() {
+    let stream = |regions: u32| {
+        let mut stream = black_jbig2_page();
+        for number in 1..=regions {
+            jbig2_segment(&mut stream, number, 36, &[], &jbig2_white_region(16384, 16384));
+        }
+        stream
+    };
+    assert!(jbig2_image_draws(&stream(2)), "two such squares fit");
+    assert!(!jbig2_image_draws(&stream(3)), "a third doesn't");
+}
+
+/// A symbol of width 0 holds no pixels, and still costs a bitmap's header: 5 KB of dictionaries of
+/// them held 781 MB, with the bound counting pixels only.
+#[test]
+fn jbig2_symbols_without_pixels_count_towards_a_pages_bound() {
+    let stream = |dictionaries: u32| {
+        let mut stream = black_jbig2_page();
+        let dictionary = zero_width_jbig2_dictionary(32767, true);
+        for number in 1..=dictionaries {
+            jbig2_segment(&mut stream, number, 0, &[], &dictionary);
+        }
+        stream
+    };
+    assert!(jbig2_image_draws(&stream(1)), "one dictionary fits");
+    assert!(!jbig2_image_draws(&stream(44)), "44 × 32,767 headers are past the bound");
+}
+
+/// A symbol dictionary may retain its coding contexts for a later one, 73,728 bytes each time, and
+/// 1.1 MB of dictionaries with no symbols, 103 KB behind Flate, held 2.89 GB.
+#[test]
+fn jbig2_retained_contexts_count_towards_a_pages_bound() {
+    let stream = |dictionaries: u32| {
+        let mut dictionary = vec![0x02, 0x00]; // arithmetic coding, contexts retained
+        dictionary.extend_from_slice(&[3, 0xff, 0xfd, 0xff, 2, 0xfe, 0xfe, 0xfe]); // AT pixels
+        dictionary.extend_from_slice(&[0; 8]); // exported, new
+        let mut stream = black_jbig2_page();
+        for number in 1..=dictionaries {
+            jbig2_segment(&mut stream, number, 0, &[], &dictionary);
+        }
+        stream
+    };
+    assert!(jbig2_image_draws(&stream(1)), "one dictionary fits");
+    assert!(!jbig2_image_draws(&stream(1000)), "a thousand don't");
+}
+
+/// Huffman tables are held for later segments too, each taking some 586 bytes however small it
+/// is, so 200,000 of them are past the bound, and they were held to it at 4 times that.
+#[test]
+fn jbig2_huffman_tables_count_towards_a_pages_bound() {
+    let stream = |tables: u32| {
+        // One-bit prefix and range lengths, values 0 to 1: a table line, then the lower range.
+        let mut table = vec![0];
+        table.extend_from_slice(&0i32.to_be_bytes());
+        table.extend_from_slice(&1i32.to_be_bytes());
+        table.push(0b1010_0000);
+        let mut stream = black_jbig2_page();
+        for number in 1..=tables {
+            jbig2_segment(&mut stream, number, 53, &[], &table);
+        }
+        stream
+    };
+    assert!(jbig2_image_draws(&stream(1)), "one table fits");
+    assert!(!jbig2_image_draws(&stream(200_000)), "200,000 don't");
+}
+
+/// New symbols count as they are decoded, whatever the dictionary exports: rows take a word at
+/// least, so symbols of one column held 270 MiB within the bound on a dictionary's pixels, and
+/// exporting none of them they were never counted at all.
+#[test]
+fn jbig2_new_symbols_count_towards_a_pages_bound() {
+    let stream = |height: u32| {
+        let mut stream = black_jbig2_page();
+        jbig2_segment(&mut stream, 1, 0, &[], &narrow_jbig2_dictionary(65534, height));
+        stream
+    };
+    assert!(jbig2_image_draws(&stream(100)), "65,534 symbols of 100 rows fit");
+    assert!(!jbig2_image_draws(&stream(300)), "of 300 rows they don't");
+}
+
+/// New symbols are held to what the page has left, headers included, not to the whole bound. These
+/// two regions leave it 512 words, and the dictionary after them exports nothing, so only that
+/// check can refuse it.
+#[test]
+fn jbig2_new_symbols_are_held_to_what_a_page_has_left() {
+    let stream = |dictionary: &[u8]| {
+        let mut stream = black_jbig2_page();
+        jbig2_segment(&mut stream, 1, 36, &[], &jbig2_white_region(16384, 16384));
+        jbig2_segment(&mut stream, 2, 36, &[], &jbig2_white_region(16384, 16383));
+        jbig2_segment(&mut stream, 3, 0, &[], dictionary);
+        stream
+    };
+    assert!(jbig2_image_draws(&stream(&narrow_jbig2_dictionary(1, 100))), "100 rows fit");
+    assert!(!jbig2_image_draws(&stream(&narrow_jbig2_dictionary(1, 1000))), "1,000 rows don't");
+    assert!(jbig2_image_draws(&stream(&zero_width_jbig2_dictionary(10, false))), "10 headers fit");
+    assert!(!jbig2_image_draws(&stream(&zero_width_jbig2_dictionary(100, false))), "100 headers don't");
+}
+
+/// Pattern dictionaries count towards the bound, with no shifted copies to do it for them: at 44
+/// words a pattern, 6 of these are past it.
+#[test]
+fn jbig2_pattern_dictionaries_count_towards_a_pages_bound() {
+    let stream = |dictionaries: u32| {
+        let mut stream = black_jbig2_page();
+        for number in 1..=dictionaries {
+            jbig2_segment(&mut stream, number, 16, &[], &jbig2_pattern_dictionary(32, 65535));
+        }
+        stream
+    };
+    assert!(jbig2_image_draws(&stream(5)), "5 fit");
+    assert!(!jbig2_image_draws(&stream(6)), "6 don't");
+}
+
+/// Shifted copies are only a speed-up, so they are never what gets an image refused: each of these
+/// tables is within its own limit, and the fourth won't fit what the page has left, so it is left
+/// out, where counting it refused the image.
+#[test]
+fn jbig2_shifted_patterns_never_refuse_an_image() {
+    let mut stream = black_jbig2_page();
+    for number in 1..=4 {
+        jbig2_segment(&mut stream, number, 16, &[], &jbig2_pattern_dictionary(32, 2048));
+    }
+    assert!(jbig2_image_draws(&stream));
+}
+
+/// Ordinary globals still reach the decoder, with a filter on them or without: here they hold the
+/// page information, so the image draws only if they are read.
+#[test]
+fn jbig2_globals_are_read() {
+    let globals = black_jbig2_page();
+    let hex: String = globals.iter().map(|b| format!("{b:02x}")).collect();
+    let mut stream = Vec::new();
+    jbig2_segment(&mut stream, 1, 62, &[], &[]); // an extension, which decoders skip
+    for (filter, data) in [("", globals.clone()), ("/Filter /ASCIIHexDecode", hex.into_bytes())] {
+        let mut objects = format!("6 0 obj << {filter} /Length {} >> stream\n", data.len()).into_bytes();
+        objects.extend_from_slice(&data);
+        objects.extend_from_slice(b"\nendstream endobj\n");
+        assert!(jbig2_image_draws_with(&stream, "/DeviceGray", "/DecodeParms << /JBIG2Globals 6 0 R >>", &objects), "{filter}");
+    }
+}
+
+/// Globals are raw segments, but a `/JBIG2Globals` stream could itself be JBIG2, naming the next
+/// such stream, and each read decoded the next: 4,000 of them, here on a test thread's 2 MiB stack,
+/// overflowed it, which aborts the process. Vendored hayro-syntax patch: such a stream reads as
+/// globals that can't be decoded, so the image decodes without them.
+#[test]
+fn jbig2_globals_that_are_jbig2_themselves_are_not_decoded() {
+    let links = 4000;
+    let mut objects = Vec::new();
+    for number in 0..links {
+        let link = 6 + number;
+        let next = link + 1;
+        let parms = if number + 1 < links { format!("/DecodeParms << /JBIG2Globals {next} 0 R >>") } else { String::new() };
+        objects.extend_from_slice(format!("{link} 0 obj << /Filter /JBIG2Decode {parms} /Length 0 >> stream\n\nendstream endobj\n").as_bytes());
+    }
+    assert!(jbig2_image_draws_with(&black_jbig2_page(), "/DeviceGray", "/DecodeParms << /JBIG2Globals 6 0 R >>", &objects));
+}
+
+/// A Huffman-coded symbol dictionary of one white symbol, `side` from 76 up, exported or not.
+fn square_jbig2_dictionary(side: u32, exported: bool) -> Vec<u8> {
+    let mut bits = Bits::default();
+    bits.put(0b11111, 5); // height class delta, the upper line of table B.4
+    bits.put(side - 76, 32);
+    bits.put(0b111110, 6); // width delta, the upper line of table B.2
+    bits.put(side - 75, 32);
+    bits.put(0b111111, 6); // end of the class (B.2)
+    let bytes = side.div_ceil(8) + 1; // an MMR-coded white bitmap: one bit a row
+    bits.table_b1(bytes); // BMSIZE (B.1)
+    bits.align();
+    for _ in 0..bytes {
+        bits.put(0xFF, 8);
+    }
+    if exported {
+        bits.table_b1(0);
+    }
+    bits.table_b1(1);
+    let mut dictionary = vec![0x00, 0x01]; // Huffman, tables B.4, B.2, B.1, B.1
+    dictionary.extend_from_slice(&u32::from(exported).to_be_bytes());
+    dictionary.extend_from_slice(&1u32.to_be_bytes()); // new
+    dictionary.extend_from_slice(&bits.bytes);
+    dictionary
+}
+
+/// A text region of `width` × `height` placing symbol 0 of one, Huffman-coded, `instances` of 0 or 1.
+fn jbig2_text_region(width: u32, height: u32, instances: u32) -> Vec<u8> {
+    let mut text = jbig2_region_info(width, height);
+    text.extend_from_slice(&[0x00, 0x11, 0, 0]); // Huffman, top left; tables B.6, B.8, B.11
+    text.extend_from_slice(&instances.to_be_bytes());
+    let mut bits = Bits::default();
+    for code in 0..35 {
+        bits.put(u32::from(code == 1), 4); // only run code 1, one bit long
+    }
+    bits.put(0, 1); // symbol 0 is one bit long
+    bits.align();
+    bits.put(0, 1); // the first strip's T (B.11)
+    if instances > 0 {
+        bits.put(0, 1); // delta T 1 (B.11)
+        bits.put(0, 9); // first S 0 (B.6)
+        bits.put(0, 1); // symbol 0
+        bits.put(0b01, 2); // end of the strip (B.8)
+    }
+    text.extend_from_slice(&bits.bytes);
+    text
+}
+
+/// A 1 × 1 text region placing one instance of symbol 0 of one, refined, Huffman-coded.
+fn jbig2_refined_text_region() -> Vec<u8> {
+    let mut text = jbig2_region_info(1, 1);
+    text.extend_from_slice(&[0x80, 0x13, 0, 0]); // Huffman, refined by template 1, top left
+    text.extend_from_slice(&1u32.to_be_bytes());
+    let mut bits = Bits::default();
+    for code in 0..35 {
+        bits.put(u32::from(code == 1), 4); // only run code 1, one bit long
+    }
+    bits.put(0, 1); // symbol 0 is one bit long
+    bits.align();
+    bits.put(0, 1); // the first strip's T (B.11)
+    bits.put(0, 1); // delta T 1 (B.11)
+    bits.put(0, 9); // first S 0 (B.6)
+    bits.put(0, 1); // symbol 0
+    bits.put(1, 1); // refined
+    bits.put(0, 4); // no change of width, height or offset (B.14)
+    bits.table_b1(0); // no refinement data (B.1)
+    bits.align();
+    bits.put(0b01, 2); // end of the strip (B.8)
+    text.extend_from_slice(&bits.bytes);
+    text
+}
+
+/// A generic refinement region of 1 × 1, with whatever its data decodes to.
+fn jbig2_refinement_region() -> Vec<u8> {
+    let mut region = jbig2_region_info(1, 1);
+    region.push(1); // template 1, no typical prediction
+    region.extend_from_slice(&[0; 4]);
+    region
+}
+
+/// A class of no symbols has nothing to cut from its bitmap, and rows are charged by the symbol, so
+/// decoding one would be rows for nothing: a thousand classes of 65,000 rows take a second, from a
+/// dictionary of 4 KB. It isn't decoded, however many there are, and the symbol after them shows that
+/// its bytes are stepped over.
+#[test]
+fn jbig2_classes_of_no_symbols_decode_no_bitmap() {
+    let mut stream = black_jbig2_page();
+    for number in 0..1_000 {
+        jbig2_segment(&mut stream, number + 1, 0, &[], &empty_class_jbig2_dictionary(1024, 65_000));
+    }
+    let (done, finished) = std::sync::mpsc::channel();
+    std::thread::spawn(move || {
+        let _ = done.send(jbig2_image_draws(&stream));
+    });
+    // This takes milliseconds now and took a quarter of an hour, so a margin this wide can't fail on
+    // a busy machine.
+    assert_eq!(finished.recv_timeout(std::time::Duration::from_secs(120)), Ok(true));
+}
+
+/// Each item a JBIG2 stream decodes costs its work, and the stream may ask for 2^30: four of the
+/// largest pages, some 6 s to 17 s. Each bitmap is bounded on its own, but nothing bounded how many
+/// there were, so 1,140 bytes of generic regions took over 40 s, and a 795-byte PDF's one halftone
+/// 265 s. Vendored hayro-jbig2 patch: `MAX_WORK`. A row costs 4 pixels, even in a bitmap of no
+/// width, and a copy goes by the word and the row, so a tall thin one costs its rows. Here regions
+/// of typical rows, cheap to decode though charged like any, spend all but exactly what the item
+/// costs, so it draws with that left and is refused with one less, for each item at its own cost.
+#[test]
+fn jbig2_decoding_work_is_counted_item_by_item() {
+    struct Item {
+        what: &'static str,
+        /// What comes first, and what it costs.
+        before: Vec<(u8, Vec<u8>)>,
+        spent: u64,
+        kind: u8,
+        refs: &'static [u8],
+        data: Vec<u8>,
+        cost: u64,
+    }
+    let stream = |item: &Item, left: u64| {
+        let mut stream = black_jbig2_page();
+        let mut number = 0;
+        for (kind, data) in &item.before {
+            number += 1;
+            jbig2_segment(&mut stream, number, *kind, &[], data);
+        }
+        // A square costs 16,384 rows of 16,388, and a single row what it has and 4 more.
+        let work = (1u64 << 30) - item.spent - left;
+        let (row, square) = (16388u64, 16384 * 16388u64);
+        let mut squares = work / square;
+        let mut rest = work % square;
+        if rest > 0 && rest < 5 {
+            squares -= 1;
+            rest += square;
+        }
+        let mut rows = rest / row;
+        let mut last = rest % row;
+        if last > 0 && last < 5 {
+            rows -= 1;
+            last += row;
+        }
+        let regions = std::iter::repeat_n((16384, 16384), usize::try_from(squares).unwrap())
+            .chain((rows > 0).then_some((16384, rows)))
+            .chain((last > 0).then_some((last - 4, 1)));
+        for (width, height) in regions {
+            number += 1;
+            let region = jbig2_white_region(u32::try_from(width).unwrap(), u32::try_from(height).unwrap());
+            jbig2_segment(&mut stream, number, 38, &[], &region); // immediate generic region
+        }
+        jbig2_segment(&mut stream, number + 1, item.kind, item.refs, &item.data);
+        stream
+    };
+    let symbol = || vec![(0, zero_width_jbig2_dictionary(1, true))];
+    let patterns = || vec![(16, jbig2_pattern_dictionary(1, 2))];
+    let exporting_none = {
+        let mut dictionary = vec![0x00, 0x01];
+        dictionary.extend_from_slice(&[0; 8]); // exported, new
+        let mut bits = Bits::default();
+        bits.table_b1(1); // the first export run, not exported, is the one it refers to
+        dictionary.extend_from_slice(&bits.bytes);
+        dictionary
+    };
+    let zero = |height: u32| {
+        let mut bits = Bits::default();
+        bits.put(0b11111, 5); // height class delta, the upper line of table B.4
+        bits.put(height - 76, 32);
+        bits.put(0, 1); // width delta 0 (B.2)
+        bits.put(0b111111, 6); // end of the class (B.2)
+        bits.table_b1(0); // BMSIZE 0, stored (B.1)
+        bits.align();
+        bits.table_b1(1); // the first export run, not exported, is the symbol
+        let mut dictionary = vec![0x00, 0x01];
+        dictionary.extend_from_slice(&0u32.to_be_bytes()); // exported
+        dictionary.extend_from_slice(&1u32.to_be_bytes()); // new
+        dictionary.extend_from_slice(&bits.bytes);
+        dictionary
+    };
+    // The cost of a pattern dictionary of two patterns: rows of them side by side, then each taken out.
+    let two_patterns = |width: u64, height: u64| height * (2 * width + 4) + 2 * height * (width.div_ceil(32) + 1);
+    let thin_region = |side: u32| {
+        let mut region = jbig2_white_region(1, 1);
+        region.splice(0..8, [0u32.to_be_bytes(), side.to_be_bytes()].concat());
+        region
+    };
+    let items = vec![
+        Item { what: "immediate generic", before: vec![], spent: 0, kind: 38, refs: &[], data: jbig2_white_region(1, 1), cost: 5 },
+        Item { what: "intermediate generic", before: vec![], spent: 0, kind: 36, refs: &[], data: jbig2_white_region(1, 1), cost: 5 },
+        Item { what: "a region of no width", before: vec![], spent: 0, kind: 38, refs: &[], data: thin_region(1000), cost: 4000 },
+        Item { what: "immediate refinement", before: vec![], spent: 0, kind: 42, refs: &[], data: jbig2_refinement_region(), cost: 5 },
+        Item { what: "intermediate refinement", before: vec![], spent: 0, kind: 40, refs: &[], data: jbig2_refinement_region(), cost: 5 },
+        Item {
+            what: "pattern dictionary",
+            before: vec![],
+            spent: 0,
+            kind: 16,
+            refs: &[],
+            data: jbig2_pattern_dictionary(1, 2),
+            cost: two_patterns(1, 1),
+        },
+        Item {
+            what: "tall patterns",
+            before: vec![],
+            spent: 0,
+            kind: 16,
+            refs: &[],
+            data: jbig2_pattern_dictionary(32, 2),
+            cost: two_patterns(1, 32),
+        },
+        // What an item reads counts, at 38 an integer: two classes, five widths and an export run.
+        Item { what: "symbols of no rows", before: vec![], spent: 0, kind: 0, refs: &[], data: no_row_jbig2_dictionary(5), cost: 304 },
+        // Rows cost in a symbol of no pixels too, on top of a class, three widths and an export run.
+        Item { what: "symbols without pixels", before: vec![], spent: 0, kind: 0, refs: &[], data: zero_width_jbig2_dictionary(3, false), cost: 202 },
+        Item { what: "a tall symbol of no width", before: vec![], spent: 0, kind: 0, refs: &[], data: zero(1000), cost: 4114 },
+        Item { what: "new symbols", before: vec![], spent: 0, kind: 0, refs: &[], data: square_jbig2_dictionary(80, false), cost: 6834 },
+        Item { what: "referred symbols", before: symbol(), spent: 156, kind: 0, refs: &[1], data: exporting_none, cost: 39 },
+        // Its symbol, and its one row and word; Huffman-coded, a table line for the symbol.
+        Item { what: "immediate text", before: symbol(), spent: 156, kind: 6, refs: &[1], data: jbig2_text_region(1, 1, 0), cost: 13 },
+        Item { what: "intermediate text", before: symbol(), spent: 156, kind: 4, refs: &[1], data: jbig2_text_region(1, 1, 0), cost: 13 },
+        Item { what: "a text region's pixels", before: symbol(), spent: 156, kind: 6, refs: &[1], data: jbig2_text_region(32, 32, 0), cost: 75 },
+        Item {
+            what: "an intermediate text region's pixels",
+            before: symbol(),
+            spent: 156,
+            kind: 4,
+            refs: &[1],
+            data: jbig2_text_region(32, 32, 0),
+            cost: 75,
+        },
+        // The region's 13, a copy of the symbol's row, and the instance's 4 integers.
+        Item { what: "an instance", before: symbol(), spent: 156, kind: 6, refs: &[1], data: jbig2_text_region(1, 1, 1), cost: 166 },
+        // The region's 13, 80 rows of 4 words copied, and the instance's 4 integers.
+        Item {
+            what: "an instance of a large symbol",
+            before: vec![(0, square_jbig2_dictionary(80, true))],
+            spent: 6872,
+            kind: 6,
+            refs: &[1],
+            data: jbig2_text_region(1, 1, 1),
+            cost: 485,
+        },
+        // And decoded as well as copied, with the 4 integers that gave its size.
+        Item {
+            what: "a refined instance",
+            before: vec![(0, square_jbig2_dictionary(80, true))],
+            spent: 6872,
+            kind: 6,
+            refs: &[1],
+            data: jbig2_refined_text_region(),
+            cost: 7357,
+        },
+        // A bit plane, a cell's copy and the region's.
+        Item {
+            what: "immediate halftone",
+            before: patterns(),
+            spent: two_patterns(1, 1),
+            kind: 22,
+            refs: &[1],
+            data: jbig2_halftone(1, 1, false),
+            cost: 9,
+        },
+        Item {
+            what: "intermediate halftone",
+            before: patterns(),
+            spent: two_patterns(1, 1),
+            kind: 20,
+            refs: &[1],
+            data: jbig2_halftone(1, 1, false),
+            cost: 9,
+        },
+        // A plane of 2 cells, each a copy of 32 rows of 2 words' cost, and the region's.
+        Item {
+            what: "a halftone's cells",
+            before: vec![(16, jbig2_pattern_dictionary(32, 2))],
+            spent: two_patterns(1, 32),
+            kind: 22,
+            refs: &[1],
+            data: jbig2_halftone(2, 1, false),
+            cost: 136,
+        },
+        Item {
+            what: "a grid of no width",
+            before: patterns(),
+            spent: two_patterns(1, 1),
+            kind: 22,
+            refs: &[1],
+            data: jbig2_halftone(0, 1000, false),
+            cost: 4002,
+        },
+        Item {
+            what: "a halftone's pixels",
+            before: patterns(),
+            spent: two_patterns(1, 1),
+            kind: 22,
+            refs: &[1],
+            data: jbig2_halftone_of(32, 1, 1, false),
+            cost: 71,
+        },
+    ];
+    for item in &items {
+        assert!(jbig2_image_draws(&stream(item, item.cost)), "{}: with its cost left it draws", item.what);
+        assert!(!jbig2_image_draws(&stream(item, item.cost - 1)), "{}: with one less it's refused", item.what);
+    }
+}
+
+/// An image's page header can claim any size, and the Indexed path reserves its output from it
+/// before the page bitmap is sized: a 743-byte PDF asked for 137 GB, which aborts the process.
+/// Vendored hayro-jbig2 patch: a page past the bounds is refused when the stream is opened.
+#[test]
+fn jbig2_pages_past_the_bounds_are_refused_before_anything_is_sized_from_them() {
+    let indexed = "[/Indexed /DeviceGray 1 <00FF>]";
+    assert!(jbig2_image_draws_in(&black_jbig2_page(), indexed), "a page within the bounds");
+    let mut page = Vec::new();
+    page.extend_from_slice(&(1u32 << 20).to_be_bytes());
+    page.extend_from_slice(&(1u32 << 20).to_be_bytes());
+    page.extend_from_slice(&[0; 11]); // resolution, flags, striping
+    let mut stream = Vec::new();
+    jbig2_segment(&mut stream, 0, 48, &[], &page);
+    assert!(!jbig2_image_draws_in(&stream, indexed), "the page draws without it");
+}
+
+/// One custom Huffman table could grow without bound as it was read, before anything counted it:
+/// a line takes 2 bits of input and 8 bytes here, so 250 MiB behind nested Flate, in a 1,297-byte
+/// PDF, was killed at 8 GiB. Vendored hayro-jbig2 patch: at most 2^16 lines.
+#[test]
+fn jbig2_huffman_tables_of_too_many_lines_are_refused() {
+    let stream = |lines: i32| {
+        // One-bit prefix and range lengths, all zero: a line per value.
+        let mut table = vec![0];
+        table.extend_from_slice(&0i32.to_be_bytes());
+        table.extend_from_slice(&lines.to_be_bytes());
+        table.resize(table.len() + usize::try_from(lines).unwrap().div_ceil(4) + 1, 0);
+        let mut stream = black_jbig2_page();
+        jbig2_segment(&mut stream, 1, 53, &[], &table);
+        stream
+    };
+    assert!(jbig2_image_draws(&stream(1 << 16)), "2^16 lines are allowed");
+    assert!(!jbig2_image_draws(&stream((1 << 16) + 1)), "one more isn't");
+}
+
+/// A stream's segments are all parsed and sorted before the first is decoded: 11 bytes of input took
+/// 64 here, so behind nested Flate a 4,765-byte PDF reached 5 GB, and failed only afterwards.
+/// Vendored hayro-jbig2 patch: at most 2^20 segments.
+#[test]
+fn jbig2_streams_of_too_many_segments_are_refused() {
+    let stream = |segments: u32| {
+        let mut stream = black_jbig2_page();
+        for number in 1..segments {
+            jbig2_segment(&mut stream, number, 62, &[], &[]); // an extension, which decoders skip
+        }
+        stream
+    };
+    assert!(jbig2_image_draws(&stream(1 << 20)), "2^20 segments are allowed");
+    assert!(!jbig2_image_draws(&stream((1 << 20) + 1)), "one more isn't");
+}
+
+/// References take 4 bytes each for 1 of input, a stream's total as much as a segment's.
+/// Vendored hayro-jbig2 patch: at most 2^22 in a stream, which is 64 × 65,535 + 64.
+#[test]
+fn jbig2_streams_of_too_many_references_are_refused() {
+    let stream = |last: usize| {
+        let mut stream = black_jbig2_page();
+        for number in 1..=64 {
+            jbig2_segment(&mut stream, number, 62, &vec![0u8; 65535], &[]);
+        }
+        jbig2_segment(&mut stream, 65, 62, &vec![0u8; last], &[]);
+        stream
+    };
+    assert!(jbig2_image_draws(&stream(64)), "2^22 references are allowed");
+    assert!(!jbig2_image_draws(&stream(65)), "one more isn't");
+}
+
+/// One segment may refer to the same dictionary again and again, and collecting its symbols took a
+/// pointer each: 65,535 references to a dictionary of 32,767 symbols, in a 78 KB stream, asked for
+/// 17 GB. Vendored hayro-jbig2 patch: at most 2^20 symbols per segment, and 32 × 32,767 + 32 is
+/// exactly that. All three segment kinds that take symbols are held to it: the text regions, whether
+/// immediate or intermediate, and a dictionary that refers to others.
+#[test]
+fn jbig2_segments_referring_to_too_many_symbols_are_refused() {
+    let mut text = jbig2_region_info(1, 1);
+    text.extend_from_slice(&[0, 0]); // arithmetic coding, no refinement
+    text.extend_from_slice(&[0; 4]); // no instances
+    // A dictionary of no symbols of its own, exporting none of those it refers to.
+    let dictionary = |symbols: u32| {
+        let mut dictionary = vec![0x00, 0x01]; // Huffman, tables B.4, B.2, B.1, B.1
+        dictionary.extend_from_slice(&[0; 8]); // exported, new
+        let mut bits = Bits::default();
+        bits.table_b1(symbols); // the first export run, not exported, is all of them
+        dictionary.extend_from_slice(&bits.bytes);
+        dictionary
+    };
+    let stream = |kind: u8, small: usize, data: &[u8]| {
+        let mut stream = black_jbig2_page();
+        jbig2_segment(&mut stream, 1, 0, &[], &zero_width_jbig2_dictionary(32767, true));
+        jbig2_segment(&mut stream, 2, 0, &[], &zero_width_jbig2_dictionary(32, true));
+        let mut refs = vec![1u8; 32];
+        refs.extend(std::iter::repeat_n(2u8, small));
+        jbig2_segment(&mut stream, 3, kind, &refs, data);
+        stream
+    };
+    let limit = 1 << 20;
+    for (what, kind, allowed, past) in [
+        ("immediate text region", 6, text.clone(), text.clone()),
+        ("intermediate text region", 4, text.clone(), text.clone()),
+        ("symbol dictionary", 0, dictionary(limit), dictionary(limit + 32)),
+    ] {
+        assert!(jbig2_image_draws(&stream(kind, 1, &allowed)), "{what}: 2^20 symbols are allowed");
+        assert!(!jbig2_image_draws(&stream(kind, 2, &past)), "{what}: 32 more aren't");
+    }
+}
+
+/// A halftone grid takes a 4-byte value per cell while it decodes, so the bound of 2^28 cells let a
+/// 98-byte segment take 1 GiB. Vendored hayro-jbig2 patch: at most 2^25 cells, however it's coded.
+#[test]
+fn jbig2_halftone_grids_past_their_bound_are_refused() {
+    let stream = |width: u32, height: u32, mmr: bool| {
+        let mut stream = black_jbig2_page();
+        jbig2_segment(&mut stream, 1, 16, &[], &jbig2_pattern_dictionary(1, 2));
+        jbig2_segment(&mut stream, 2, 22, &[1], &jbig2_halftone(width, height, mmr));
+        stream
+    };
+    assert!(jbig2_image_draws(&stream(8192, 4096, false)), "2^25 cells are allowed");
+    assert!(!jbig2_image_draws(&stream(8193, 4096, false)), "one more column isn't");
+    assert!(!jbig2_image_draws(&stream(8193, 4096, true)), "nor when it is MMR-coded");
+}
+
+/// A pattern dictionary's shifted copies only speed up drawing, and 48 bytes could ask for 539 MB
+/// of them, past what a page may hold. Vendored hayro-jbig2 patch: past 16 MiB they are left out,
+/// so such a dictionary is drawn the slow way rather than refused.
+#[test]
+fn jbig2_pattern_dictionaries_too_large_to_shift_still_draw() {
+    let mut stream = black_jbig2_page();
+    jbig2_segment(&mut stream, 1, 16, &[], &jbig2_pattern_dictionary(32, 65535));
+    jbig2_segment(&mut stream, 2, 22, &[1], &jbig2_halftone(1, 1, false));
+    assert!(jbig2_image_draws(&stream));
+}
+
 /// From `cargo xtask fuzz`: one changed byte in a symbol dictionary's arithmetic-coded data
 /// hung the renderer. Two of its loops can stop advancing: an export run of length 0, and a
 /// height class whose first width is already the end-of-class marker. Past the end of its
@@ -3591,6 +5137,86 @@ fn jbig2_symbol_dictionaries_that_never_advance_terminate() {
     }
 }
 
+/// A JBIG2 stream can put a region, a reference or a symbol at the very end of what an `i32` holds,
+/// where adding to it overflowed: a panic wherever overflow is checked, a build's own tests included.
+/// A region or a symbol out there is off the page, so nothing draws. Vendored hayro-jbig2 patch: the arithmetic wraps, as
+/// a release build's did, or in `Bitmap::combine` saturates, which comes to the same. Three of the text
+/// streams are arithmetic-coded: one symbol on a strip of -2^31 + 1, with its bottom left as the corner
+/// placed, one on a strip of -2^31, and one refined by an offset of `i32::MIN`, which reads nothing of
+/// the old symbol and still draws. Two are Huffman-coded, each with its first S at an offset of
+/// 0x7FFFFFFF on a table's 32-bit range line, past what an `i32` holds, and are refused further on.
+#[test]
+fn jbig2_placements_at_the_end_of_an_i32_draw_nothing() {
+    const FAR_CORNER: &str = "0000000030000100000013000000100000000c0000000000000000420000000000010000010000001e000003fffdff02fefefe00000001000000014fdc3ce0205df55c36bfffac00000002062001010000001f000000100000000c000000000000000004000000000001969747cbe88bffac";
+    const STRIP: &str = "0000000030000100000013000000100000000c0000000000000000420000000000010000010000001e000003fffdff02fefefe00000001000000014fdda25e46956d3e0d3fffac00000002062001010000001f000000100000000c000000000000000004001000000001969747cbe5dbffac";
+    const UPPER_LINE: &str = "0000000030000100000013000000100000000c0000000000000000420000000000010000010000001d000003fffdff02fefefe00000001000000014fdaea38c99641e0c8ffac000000020620010100000038000000100000000c00000000000000000400110000000000010100000000000000000000000000000000003f7fffffff0000000000000000";
+    const LOWER_LINE: &str = "0000000030000100000013000000100000000c0000000000000000420000000000010000010000001d000003fffdff02fefefe00000001000000014fdaea38c99641e0c8ffac000000020620010100000038000000100000000c00000000000000000400110000000000010100000000000000000000000000000000003e7fffffff0000000000000000";
+    const OFFSET: &str = "0000000030000100000013000000100000000c0000000000000000420000000000010000010000001e000003fffdff02fefefe00000001000000014fdda9172f614a037ddfffac0000000206200101000000260000000800000006000000000000000004801200000001a9695690b3e5f44a2f105e30d3ffac";
+    let segment = |number: u32, kind: u8, data: &[u8]| {
+        let mut out = number.to_be_bytes().to_vec();
+        out.extend_from_slice(&[kind, 0, 1]);
+        out.extend_from_slice(&u32::try_from(data.len()).unwrap().to_be_bytes());
+        out.extend_from_slice(data);
+        out
+    };
+    let side = 8u32.to_be_bytes();
+    let page = |width: u32| {
+        let mut page = [width.to_be_bytes(), side].concat();
+        page.extend_from_slice(&[0; 8]); // resolution
+        page.extend_from_slice(&[0, 0, 0]); // flags, striping
+        segment(0, 48, &page)
+    };
+    let region = |width: u32, kind: u8, x: u32, y: u32, header: &[u8]| {
+        let mut region = [width.to_be_bytes(), side, x.to_be_bytes(), y.to_be_bytes()].concat();
+        region.push(0); // combination operator
+        region.extend_from_slice(header);
+        region.extend_from_slice(&[0x5a; 64]);
+        [page(width), segment(1, kind, &region)].concat()
+    };
+    let generic = |x, y| region(8, 38, x, y, &[0, 3, 0xff, 0xfd, 0xff, 2, 0xfe, 0xfe, 0xfe]); // template 0, AT pixels
+    // Immediate refinements of the page: template 0 with its usual AT pixels, with others, with typical
+    // prediction, and template 1.
+    let refined = |width, x, y, form: usize| {
+        region(width, 42, x, y, [&[0, 0xff, 0xff, 0xff, 0xff][..], &[0, 0xff, 0xff, 127, 127], &[2, 0xff, 0xff, 0xff, 0xff], &[1]][form])
+    };
+    let hex = |text: &str| (0..text.len() / 2).map(|i| u8::from_str_radix(&text[i * 2..i * 2 + 2], 16).unwrap()).collect::<Vec<u8>>();
+    let ink = |jbig2: Vec<u8>, width: u32, height: u32| {
+        let content = b"q 20 0 0 20 5 5 cm /Im1 Do Q";
+        let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /XObject << /Im1 5 0 R >> >> >> endobj\n".to_vec();
+        pdf.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n", content.len()).as_bytes());
+        pdf.extend_from_slice(content);
+        pdf.extend_from_slice(b"\nendstream endobj\n");
+        pdf.extend_from_slice(
+            format!("5 0 obj << /Type /XObject /Subtype /Image /Width {width} /Height {height} /BitsPerComponent 1 /ColorSpace /DeviceGray /Filter /JBIG2Decode /Length {} >> stream\n", jbig2.len())
+                .as_bytes(),
+        );
+        pdf.extend_from_slice(&jbig2);
+        pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
+        let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+        let page = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+        assert!(page.error.is_none(), "{:?}", page.error);
+        page.rgba.as_chunks::<4>().0.iter().filter(|p| p[0] < 128).count()
+    };
+    assert!(ink(generic(2, 0), 8, 8) > 0, "a region on the page draws");
+    for form in 0..4 {
+        assert!(ink(refined(8, 0, 0, form), 8, 8) > 0, "a refinement on the page draws: {form}");
+    }
+    let end = 0x7FFF_FFFFu32;
+    for (x, y) in [(end, 0), (0, end), (end - 7, 0), (0, end - 7), (end - 129, 0), (0, end - 129)] {
+        assert_eq!(ink(generic(x, y), 8, 8), 0, "generic at {x:#x}, {y:#x}");
+        for form in 0..4 {
+            assert_eq!(ink(refined(8, x, y, form), 8, 8), 0, "refinement {form} at {x:#x}, {y:#x}");
+        }
+    }
+    // Past a 32-bit word of the row, where the reference is read again.
+    assert_eq!(ink(refined(64, 0, end, 0), 64, 8), 0, "a wide refinement");
+    assert_eq!(ink(hex(FAR_CORNER), 16, 12), 0, "a symbol's far side past the end");
+    assert_eq!(ink(hex(STRIP), 16, 12), 0, "a strip of -2^31");
+    assert!(ink(hex(OFFSET), 16, 12) > 0, "a symbol refined by an offset of i32::MIN");
+    assert_eq!(ink(hex(UPPER_LINE), 16, 12), 0, "an upper range line past an i32");
+    assert_eq!(ink(hex(LOWER_LINE), 16, 12), 0, "a lower range line past an i32");
+}
+
 /// Item 1 of storytold/pdfcraft#623: a page's content used to be cut at `MAX_DECODED_STREAM`,
 /// so everything after the cut was lost (the text and the title block of the A1 sample). Content
 /// that expands by a few times over is read to its end, however large it is.
@@ -4864,6 +6490,77 @@ fn interpolated_minified_image_edges_snap_to_whole_pixels() {
     }
 }
 
+/// #5530: an image placed turned or mirrored (by its own matrix or the page's `/Rotate`) snaps to
+/// whole pixels just as an upright one does. Before, only upright images were snapped, so a turned
+/// scan was resampled twice and every edge was a blended, soft pixel. This checks the edges, and
+/// which way a mirrored image faces; `rotated_image_snap` in the integration tests checks which
+/// way a turned page's image faces (`/Rotate` only turns, it never mirrors).
+#[test]
+fn a_turned_or_mirrored_minified_image_snaps_to_whole_pixels() {
+    let black = vec![0u8; 40 * 40];
+    let image = hex(&black);
+    // Each matrix maps the image onto the user box 0.6..10.6 × 0.4..10.4, a different way round.
+    for matrix in [
+        "0 10 -10 0 10.6 0.4",   // a quarter turn
+        "-10 0 0 -10 10.6 10.4", // a half turn
+        "0 -10 10 0 0.6 10.4",   // three quarters
+        "-10 0 0 10 10.6 0.4",   // mirrored left to right
+    ] {
+        let content = format!("q {matrix} cm /Im0 Do Q");
+        let pdf = format!(
+            "%PDF-1.4\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+                 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+                 3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 11 11] /Contents 4 0 R /Resources << /XObject << /Im0 5 0 R >> >> >> endobj\n\
+                 4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+                 5 0 obj << /Type /XObject /Subtype /Image /Width 40 /Height 40 /ColorSpace /DeviceGray /BitsPerComponent 8 /Interpolate true /Filter /ASCIIHexDecode /Length {} >> stream\n{image}>\nendstream endobj\n\
+                 trailer << /Root 1 0 R >>\n%%EOF\n",
+            content.len(),
+            image.len() + 1
+        );
+        let mut renderer = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+        let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, scale: 1.0, ..Default::default() });
+        assert!(page.error.is_none(), "{matrix}: {:?}", page.error);
+        assert_eq!((page.width, page.height), (11, 11));
+        let gray = |x: usize, y: usize| page.rgba[(y * 11 + x) * 4];
+        // Device box 0.6..10.6 × 0.6..10.6 snaps to columns 1..11 and rows 1..11: no soft edge.
+        for y in 0..11 {
+            for x in 0..11 {
+                let inside = (1..11).contains(&x) && (1..11).contains(&y);
+                assert_eq!(gray(x, y), if inside { 0 } else { 255 }, "{matrix}: pixel ({x}, {y})");
+            }
+        }
+    }
+
+    // A uniform image looks the same mirrored, so mirror one whose left half (source columns
+    // 0..20) is black: drawn left to right reversed, the black half is on the right.
+    let halves: Vec<u8> = (0..40).flat_map(|_| (0..40).map(|x| if x < 20 { 0 } else { 255 })).collect();
+    let halves = hex(&halves);
+    let content = "q -10 0 0 10 10.6 0.4 cm /Im0 Do Q";
+    let pdf = format!(
+        "%PDF-1.4\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 11 11] /Contents 4 0 R /Resources << /XObject << /Im0 5 0 R >> >> >> endobj\n\
+             4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+             5 0 obj << /Type /XObject /Subtype /Image /Width 40 /Height 40 /ColorSpace /DeviceGray /BitsPerComponent 8 /Interpolate true /Filter /ASCIIHexDecode /Length {} >> stream\n{halves}>\nendstream endobj\n\
+             trailer << /Root 1 0 R >>\n%%EOF\n",
+        content.len(),
+        halves.len() + 1
+    );
+    let mut renderer = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+    let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, scale: 1.0, ..Default::default() });
+    assert!(page.error.is_none(), "{:?}", page.error);
+    let gray = |x: usize, y: usize| page.rgba[(y * 11 + x) * 4];
+    // The snapped box is columns 1..11; columns 1..3 and 8..11 are well clear of the change at 6.
+    for y in 2..10 {
+        for x in 1..4 {
+            assert_eq!(gray(x, y), 255, "mirrored: the left of the box shows the image's right (white) half, pixel ({x}, {y})");
+        }
+        for x in 8..11 {
+            assert_eq!(gray(x, y), 0, "mirrored: the right of the box shows the image's left (black) half, pixel ({x}, {y})");
+        }
+    }
+}
+
 #[test]
 fn non_interpolated_gray_images_are_not_smoothed_when_minified() {
     let levels = [0u8, 255, 85, 170, 40, 200, 120, 230];
@@ -7008,6 +8705,99 @@ mod devicen_inks;
 // patch 27).
 mod isolated_cmyk_groups;
 
+/// The generation-0 stand-in a rebuilt table files an object under must not make the object a
+/// second object: enumeration yielded it once per key, so a document recovered without a readable
+/// page tree reported the page twice (noted in review of #5580).
+///
+/// And a later header for the same object number replaces the stand-in, so `N 0 R` cannot be left
+/// pointing at a body the exact key no longer names.
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+fn a_rebuilt_tables_generation_0_stand_in_is_not_a_second_object() {
+    // No table, no `startxref`, and no readable page tree: the pages are recovered by looking for
+    // objects that are pages, which is where a doubled object shows up as a doubled page.
+    let pdf = "%PDF-1.4\n\
+               1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+               3 99999 obj << /Type /Page /MediaBox [0 0 200 100] /Contents 4 0 R >> endobj\n\
+               4 0 obj << /Length 0 >> stream\n\nendstream endobj\n\
+               trailer << /Root 1 0 R >>\n\
+               %%EOF\n";
+    let mut r = PageRenderer::new(Arc::new(pdf.to_string().into_bytes()), RenderConfig::default());
+    let first = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, preview: false });
+    assert!(first.error.is_none(), "the page is recovered: {:?}", first.error);
+    let second = r.render(RenderRequest { page: 1, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, preview: false });
+    assert!(second.error.is_some(), "and it is one page, not two: page 2 must not exist");
+
+    // Two headers for object 3, the second the one the exact key names: the stand-in follows it.
+    // `(B)` is drawn by the later body, so the page that comes back says which one was read.
+    let twice = "%PDF-1.4\n\
+                 1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+                 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+                 3 1 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 100] /Contents 5 0 R >> endobj\n\
+                 3 1 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 150] /Contents 5 0 R >> endobj\n\
+                 5 0 obj << /Length 0 >> stream\n\nendstream endobj\n\
+                 trailer << /Root 1 0 R >>\n\
+                 %%EOF\n";
+    let mut r = PageRenderer::new(Arc::new(twice.to_string().into_bytes()), RenderConfig::default());
+    let page = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, preview: false });
+    assert!(page.error.is_none(), "the page is found: {:?}", page.error);
+    assert_eq!((page.width, page.height), (300, 150), "`3 0 R` reads the later body, as `3 1` does");
+}
+
+/// A file whose cross-reference table has to be rebuilt keeps an object whose header names a
+/// generation the reference does not.
+///
+/// `poppler-85140-0.pdf` is 340 bytes with no table at all, and its one page's header reads
+/// `3 18446744073709551616 obj` while the page tree points at `3 0 R`. Before #427 the digits
+/// wrapped, and 2^64 wrapped to exactly 0, so the header read as `3 0 obj` and the file opened by
+/// accident; once an overflowing integer became a real the object was unreachable and the file
+/// stopped opening at all, which `cargo xtask check` reports as a regression (#5580).
+///
+/// A rebuilt table has no revision history to tell two generations of an object apart -- the scan
+/// already files objects found in object streams under generation 0 -- so the object number is
+/// what identifies one. A readable generation that simply is not the one referenced
+/// (`3 99999 obj`) was lost the same way, and is covered here too.
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+fn a_rebuilt_table_finds_an_object_whose_header_names_another_generation() {
+    for generation in [
+        // The generation the reference names, which always worked.
+        "0",
+        // One that reads as an integer but is not the one referenced.
+        "99999",
+        // And one no generation may be: 2^64, which is what the reported file carries. A
+        // generation number is at most 65,535 (ISO 32000-2 §7.5.4).
+        "18446744073709551616",
+    ] {
+        // No table and no `startxref`, so the objects are recovered by scanning the file.
+        let pdf = format!(
+            "%PDF-1.4\n\
+             1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+             3 {generation} obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 100] >> endobj\n\
+             trailer << /Root 1 0 R >>\n\
+             %%EOF\n"
+        );
+        let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+        let page = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, preview: false });
+        assert!(page.error.is_none(), "generation {generation}: the page is found: {:?}", page.error);
+        assert_eq!((page.width, page.height), (200, 100), "generation {generation}: and it is the page's own size");
+    }
+
+    // A stray number before a header (`42 3 0 obj`) is not a header, and must not cost the one
+    // after it: the lenient read leaves the scan where it was when it fails (noted in review).
+    let pdf = "%PDF-1.4\n\
+               1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+               2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+               42 3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 100] >> endobj\n\
+               trailer << /Root 1 0 R >>\n\
+               %%EOF\n";
+    let mut r = PageRenderer::new(Arc::new(pdf.to_string().into_bytes()), RenderConfig::default());
+    let page = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, preview: false });
+    assert!(page.error.is_none(), "the header after a stray number is found: {:?}", page.error);
+    assert_eq!((page.width, page.height), (200, 100));
+}
+
 /// #3109 / #3116: clipping-only text (`7 Tr`) installs a clip for subsequent painting
 /// but draws no pixels itself.
 #[test]
diff --git a/crates/render/tests/it/main.rs b/crates/render/tests/it/main.rs
index 5323279ca1..7e8307d908 100644
--- a/crates/render/tests/it/main.rs
+++ b/crates/render/tests/it/main.rs
@@ -8,6 +8,7 @@ mod luminosity_group_space;
 mod named_form_properties;
 mod nonseparable_gray;
 mod open_type_cff_simple_font;
+mod rotated_image_snap;
 mod search;
 mod separation_all;
 mod stray_q_in_a_form;
diff --git a/crates/render/tests/it/rotated_image_snap.rs b/crates/render/tests/it/rotated_image_snap.rs
new file mode 100644
index 0000000000..fcb5181d00
--- /dev/null
+++ b/crates/render/tests/it/rotated_image_snap.rs
@@ -0,0 +1,163 @@
+//! Contributor-original synthetic pages (#5530): a shrunk image on a page turned by `/Rotate` is
+//! drawn exactly as on the upright page, turned. The crop box and scale put every page edge on a
+//! whole device pixel, so a turn is a pure permutation of pixels and the turned render, turned
+//! back, must match the upright one. The image itself sits at fractional coordinates: an upright
+//! image there is snapped to whole pixels and shrunk once, and before the fix a turned one was
+//! not, so it was shrunk to a rounded-up size and resampled a second time at a fractional scale
+//! and offset (most of its pixels off, by up to 217 levels).
+//!
+//! Every kind of image that reaches the snap is drawn: an 8-bit and a 1-bit grey image, a stencil
+//! mask (a CCITT scan is often one), and images with a soft mask of their own size and of another
+//! size. The last needs no `/Interpolate`: a shrunk soft mask of another size is filtered, and so
+//! snapped, whatever the image asks (hayro patch 15). The other kinds without `/Interpolate` are
+//! not snapped upright or turned, and were already the same both ways; they stay in the test as a
+//! guard.
+use pdfcraft_render::{PageRenderer, RenderConfig, RenderRequest, RenderedPage};
+use std::sync::Arc;
+
+/// A PDF of the given objects (object 1 the catalog), with a cross-reference table.
+fn pdf(objects: &[Vec<u8>]) -> Vec<u8> {
+    let mut bytes = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, object) in objects.iter().enumerate() {
+        offsets.push(bytes.len());
+        bytes.extend_from_slice(format!("{} 0 obj\n", i + 1).as_bytes());
+        bytes.extend_from_slice(object);
+        bytes.extend_from_slice(b"\nendobj\n");
+    }
+    let xref = bytes.len();
+    bytes.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objects.len() + 1).as_bytes());
+    for offset in offsets {
+        bytes.extend_from_slice(format!("{offset:010} 00000 n \n").as_bytes());
+    }
+    bytes.extend_from_slice(format!("trailer << /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objects.len() + 1).as_bytes());
+    bytes
+}
+
+fn stream(dict: &str, data: &[u8]) -> Vec<u8> {
+    let mut bytes = format!("<< {dict} /Length {} >>\nstream\n", data.len()).into_bytes();
+    bytes.extend_from_slice(data);
+    bytes.extend_from_slice(b"\nendstream");
+    bytes
+}
+
+/// Image size in samples.
+const W: usize = 400;
+const H: usize = 500;
+
+/// A busy grey pattern with edges both ways, as a scan has.
+fn grey_samples() -> Vec<u8> {
+    (0..H).flat_map(|y| (0..W).map(move |x| ((x * 7 + y * 13) % 256) as u8 ^ if (x / 3 + y / 5) % 2 == 0 { 0 } else { 0x80 })).collect()
+}
+
+/// One bit a sample, rows padded to whole bytes: a text-like pattern of thin strokes.
+fn bit_samples() -> Vec<u8> {
+    let row = W.div_ceil(8);
+    let mut out = vec![0u8; row * H];
+    for y in 0..H {
+        for x in 0..W {
+            if (x / 2 + y / 3) % 3 == 0 || (x * 5 + y * 3) % 11 < 3 {
+                out[y * row + x / 8] |= 0x80 >> (x % 8);
+            }
+        }
+    }
+    out
+}
+
+fn alpha_samples(w: usize, h: usize) -> Vec<u8> {
+    (0..h).flat_map(|y| (0..w).map(move |x| ((x * 3 + y * 5) % 256) as u8)).collect()
+}
+
+/// The kinds of image drawn.
+const KINDS: [&str; 5] = ["8-bit grey", "1-bit grey", "stencil mask", "soft mask", "smaller soft mask"];
+
+/// The image of `kind` as objects 5 (and 6, its soft mask).
+fn image(kind: &str, interpolate: bool) -> Vec<Vec<u8>> {
+    let image = |depth: u8, extra: &str, data: &[u8]| {
+        let dict = format!(
+            "/Type /XObject /Subtype /Image /Width {W} /Height {H} /ColorSpace /DeviceGray /BitsPerComponent {depth} /Interpolate {interpolate}{extra}"
+        );
+        stream(&dict, data)
+    };
+    let mask = |w: usize, h: usize| {
+        let dict =
+            format!("/Type /XObject /Subtype /Image /Width {w} /Height {h} /ColorSpace /DeviceGray /BitsPerComponent 8 /Interpolate {interpolate}");
+        stream(&dict, &alpha_samples(w, h))
+    };
+    match kind {
+        "8-bit grey" => vec![image(8, "", &grey_samples())],
+        "1-bit grey" => vec![image(1, "", &bit_samples())],
+        "stencil mask" => vec![stream(
+            &format!("/Type /XObject /Subtype /Image /Width {W} /Height {H} /ImageMask true /BitsPerComponent 1 /Interpolate {interpolate}"),
+            &bit_samples(),
+        )],
+        "soft mask" => vec![image(8, " /SMask 6 0 R", &grey_samples()), mask(W, H)],
+        _ => vec![image(8, " /SMask 6 0 R", &grey_samples()), mask(300, 350)],
+    }
+}
+
+/// A page whose crop box sits inside a larger media box, as in the report, with the image drawn
+/// at fractional coordinates inside it, in a colour (a stencil mask paints it).
+fn page(rotate: u32, kind: &str, interpolate: bool) -> Vec<u8> {
+    let mut objects = vec![
+        b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
+        format!(
+            "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 794 1224] /CropBox [114 510 680 1210] /Rotate {rotate} /Contents 4 0 R /Resources << /XObject << /Im 5 0 R >> >> >>"
+        )
+        .into_bytes(),
+        stream("", b"0.1 0.2 0.6 rg q 500.3 0 0 600.7 150.15 560.45 cm /Im Do Q"),
+    ];
+    objects.extend(image(kind, interpolate));
+    pdf(&objects)
+}
+
+/// At half a pixel per point every crop-box edge, upright or turned, is a whole device pixel,
+/// and the 400 × 500 image is shrunk to about 250 × 300 pixels.
+fn render(rotate: u32, kind: &str, interpolate: bool) -> RenderedPage {
+    let mut renderer = PageRenderer::new(Arc::new(page(rotate, kind, interpolate)), RenderConfig::default());
+    let out = renderer.render(RenderRequest { page: 0, scale: 0.5, ..Default::default() });
+    assert!(out.error.is_none(), "{kind}: {:?}", out.error);
+    out
+}
+
+fn rgb(out: &RenderedPage, x: u32, y: u32) -> [u8; 3] {
+    let i = ((y * out.width + x) * 4) as usize;
+    [out.rgba[i], out.rgba[i + 1], out.rgba[i + 2]]
+}
+
+/// The largest channel difference between the turned render and the upright one turned the same
+/// way.
+fn turned_difference(rotate: u32, kind: &str, interpolate: bool) -> u8 {
+    let upright = render(0, kind, interpolate);
+    let turned = render(rotate, kind, interpolate);
+    let (w, h) = (upright.width, upright.height);
+    // `/Rotate` turns the page clockwise.
+    let expected = |x: u32, y: u32| match rotate {
+        90 => rgb(&upright, y, h - 1 - x),
+        180 => rgb(&upright, w - 1 - x, h - 1 - y),
+        _ => rgb(&upright, w - 1 - y, x),
+    };
+    let (tw, th) = if rotate == 180 { (w, h) } else { (h, w) };
+    assert_eq!((turned.width, turned.height), (tw, th), "{kind}, /Rotate {rotate}");
+    let mut worst = 0;
+    for y in 0..th {
+        for x in 0..tw {
+            let (got, want) = (rgb(&turned, x, y), expected(x, y));
+            worst = (0..3).map(|c| got[c].abs_diff(want[c])).fold(worst, u8::max);
+        }
+    }
+    worst
+}
+
+#[test]
+fn a_shrunk_image_on_a_turned_page_is_the_upright_render_turned() {
+    for kind in KINDS {
+        for interpolate in [true, false] {
+            for rotate in [90, 180, 270] {
+                let worst = turned_difference(rotate, kind, interpolate);
+                assert!(worst <= 1, "{kind}, /Rotate {rotate}, /Interpolate {interpolate}: off by up to {worst} levels");
+            }
+        }
+    }
+}
diff --git a/crates/sign/src/der.rs b/crates/sign/src/der.rs
index 6248c1e9e1..0cac252c33 100644
--- a/crates/sign/src/der.rs
+++ b/crates/sign/src/der.rs
@@ -465,7 +465,12 @@ pub fn oid(dotted: &str) -> Vec<u8> {
 /// Encode a dotted OID supplied by a caller. Unlike [`oid`], this validates every arc and
 /// never panics on malformed input.
 pub fn try_oid(dotted: &str) -> Result<Vec<u8>, SignError> {
-    let mut arcs = dotted.split('.').map(|a| a.parse::<u64>().map_err(|_| bad("invalid OID arc")));
+    let mut arcs = dotted.split('.').map(|a| {
+        if a.is_empty() || !a.bytes().all(|c| c.is_ascii_digit()) {
+            return Err(bad("invalid OID arc"));
+        }
+        a.parse::<u64>().map_err(|_| bad("invalid OID arc"))
+    });
     let first = arcs.next().ok_or_else(|| bad("empty OID"))??;
     let second = arcs.next().ok_or_else(|| bad("OID needs two arcs"))??;
     if first > 2 || (first < 2 && second >= 40) {
@@ -549,6 +554,14 @@ pub fn algorithm(oid_s: &str, params: Option<&[u8]>) -> Vec<u8> {
 mod tests {
     use super::*;
 
+    #[test]
+    fn try_oid_rejects_signs_and_empty_arcs() {
+        for bad in ["+1.2.840", "1.+2", "1.2.-3", "1..2"] {
+            assert!(try_oid(bad).is_err(), "accepted {bad}");
+        }
+        assert_eq!(try_oid("1.2.840.113549").unwrap(), oid("1.2.840.113549"));
+    }
+
     #[test]
     fn round_trips() {
         let o = oid("1.2.840.113549.1.7.2");
diff --git a/crates/ui-egui/Cargo.toml b/crates/ui-egui/Cargo.toml
index 804b5ea22a..7f164991d5 100644
--- a/crates/ui-egui/Cargo.toml
+++ b/crates/ui-egui/Cargo.toml
@@ -20,6 +20,7 @@ craft-quit = { workspace = true, features = ["egui"] }
 pdfcraft-fonts = { workspace = true }
 pdfcraft-engine = { workspace = true }
 pdfcraft-cos = { workspace = true }
+pdfcraft-content = { workspace = true }
 pdfcraft-render = { workspace = true }
 pdfcraft-model = { workspace = true }
 pdfcraft-platform = { workspace = true }
@@ -96,6 +97,7 @@ egui = { workspace = true, features = ["default_fonts", "monochrome_emoji_fonts"
 image = { version = "0.25", default-features = false, features = ["png"] }
 # Glyph-coverage test of the interface fonts; the same skrifa pdfcraft-fonts already uses.
 skrifa = "0.44"
+proptest = { workspace = true }
 
 [build-dependencies]
 serde_json = { workspace = true }
diff --git a/crates/ui-egui/src/app.rs b/crates/ui-egui/src/app.rs
index 425c2e26ce..6ac8ea8783 100644
--- a/crates/ui-egui/src/app.rs
+++ b/crates/ui-egui/src/app.rs
@@ -73,6 +73,7 @@ impl PdfCraftApp {
             default_mode: Mode::AllTools,
             view_defaults: Default::default(),
             units: Default::default(),
+            blank_paper: crate::paper::Paper::system(),
             date_format_draft: None,
             mode_override: None,
             left: LeftPanel::AllTools,
@@ -87,15 +88,18 @@ impl PdfCraftApp {
             space_hand: None,
             full_screen_tool: None,
             comment_prefs: Default::default(),
+            hotbar: Default::default(),
             theme: ThemeKind::Light,
             // A fresh install follows the desktop's appearance (#1248); saved settings override.
             theme_preference: ThemePreference::System,
             reading_colors: Default::default(),
+            show_page_edge_shadows: true,
             #[cfg(target_os = "linux")]
             desktop_theme: None,
             #[cfg(target_os = "linux")]
             desktop_theme_enabled: false,
             scroll_speed: scroll_speed::ScrollSpeed::default(),
+            invert_middle_drag: false,
             animation_effects: motion::AnimationEffects::default(),
             motion: motion::Motion::default(),
             language: i18n::AUTO.to_string(),
@@ -117,6 +121,7 @@ impl PdfCraftApp {
             all_tools_query: String::new(),
             all_tools_tab: (None, false),
             recent: Vec::new(),
+            recent_limit: crate::RECENT_FILES_DEFAULT,
             reopen_last_session: false,
             restore_last_view: true,
             last_views: Vec::new(),
@@ -133,9 +138,16 @@ impl PdfCraftApp {
             pending_opens: Vec::new(),
             #[cfg(not(target_arch = "wasm32"))]
             next_open_token: 0,
+            #[cfg(not(target_arch = "wasm32"))]
+            launch_layout: None,
+            #[cfg(not(target_arch = "wasm32"))]
+            launch_display_target: None,
             #[cfg(all(test, not(target_arch = "wasm32")))]
             open_prepare_gate: None,
             pinned: Default::default(),
+            recent_check: Default::default(),
+            pinned_tools: Vec::new(),
+            pin_tool_search: String::new(),
             toast: None,
             toast_script: None,
             script_messages: std::collections::VecDeque::new(),
@@ -223,7 +235,6 @@ impl PdfCraftApp {
             last_copied_file: None,
             system_clipboard: true,
             clipboard_override: None,
-            v_pressed: false,
             attach_override: None,
             duplicate_draft: None,
             page_props_draft: None,
@@ -353,6 +364,46 @@ impl PdfCraftApp {
     pub fn render_pending(&self) -> bool {
         self.views.iter().any(|v| v.render_pending())
     }
+
+    /// Check whether a tool group is pinned to Home.
+    pub fn is_tool_pinned(&self, id: &str) -> bool {
+        self.pinned_tools.iter().any(|t| t == id)
+    }
+
+    /// Pin a tool group to Home. Returns true if newly pinned.
+    pub fn pin_tool(&mut self, id: &str) -> bool {
+        if pdfcraft_engine::catalog::group(id).is_none() {
+            return false;
+        }
+        if !self.is_tool_pinned(id) {
+            self.pinned_tools.push(id.to_string());
+            if let Some(g) = pdfcraft_engine::catalog::group(id) {
+                self.notify_fmt("Pinned {tool} to Home", &[("tool", tl!(g.label))]);
+            }
+            return true;
+        }
+        false
+    }
+
+    /// Unpin a tool group from Home.
+    pub fn unpin_tool(&mut self, id: &str) {
+        if let Some(pos) = self.pinned_tools.iter().position(|t| t == id) {
+            self.pinned_tools.remove(pos);
+            if let Some(g) = pdfcraft_engine::catalog::group(id) {
+                self.notify_fmt("Unpinned {tool} from Home", &[("tool", tl!(g.label))]);
+            }
+        }
+    }
+
+    /// Toggle a tool group's pinned state on Home. Returns whether it is now pinned.
+    pub fn toggle_pin_tool(&mut self, id: &str) -> bool {
+        if self.is_tool_pinned(id) {
+            self.unpin_tool(id);
+            false
+        } else {
+            self.pin_tool(id)
+        }
+    }
 }
 
 impl eframe::App for PdfCraftApp {
@@ -362,6 +413,10 @@ impl eframe::App for PdfCraftApp {
     fn raw_input_hook(&mut self, ctx: &egui::Context, raw: &mut egui::RawInput) {
         // The button's release a window move or resize kept from egui.
         window_controls::release_after_desktop_grab(ctx, raw);
+        // The wheel after Alt+Tab back, before the mouse has moved (#1518).
+        let known = ctx.input(|i| i.pointer.latest_pos().is_some());
+        let size = ctx.input(|i| i.viewport().inner_rect).map_or(egui::Vec2::ZERO, |r| r.size());
+        drag_pointer::locate_wheel(raw, known, size, || drag_pointer::in_window(ctx));
         self.prepare_raw_input(ctx, raw);
         if raw.hovered_files.is_empty() && raw.dropped_files.is_empty() {
             return;
@@ -399,6 +454,7 @@ impl eframe::App for PdfCraftApp {
             }
             self.poll_pending_opens();
         }
+        self.check_restored_recent();
         // Chinese wants its own faces before the Japanese ones (one baseline per line).
         let cjk = theme::CjkPreference::for_language(lang.code());
         if !self.styled {
diff --git a/crates/ui-egui/src/app/clipboard.rs b/crates/ui-egui/src/app/clipboard.rs
index 6641d93a86..9319368d29 100644
--- a/crates/ui-egui/src/app/clipboard.rs
+++ b/crates/ui-egui/src/app/clipboard.rs
@@ -10,6 +10,11 @@ pub(crate) fn print_refused() -> &'static str {
     tl!("The document's security settings don't allow printing")
 }
 
+enum ClipboardPaste {
+    Text,
+    Image(std::sync::Arc<egui::ColorImage>),
+}
+
 impl PdfCraftApp {
     /// Whether text and images may be copied out of document `id`; says why not when they may
     /// not. Reading aloud and accessibility tools don't ask (assistive technology may read
@@ -22,14 +27,83 @@ impl PdfCraftApp {
         false
     }
 
-    /// ⌘C copies the selected text, unless a text field has the keyboard (it copies its own).
-    pub(super) fn copy_key(&mut self, i: usize, ctx: &egui::Context) {
-        // ⌘C arrives as a Copy event on most platforms.
-        let copy = ctx.input(|input| input.events.iter().any(|e| matches!(e, egui::Event::Copy)));
-        if !copy || ctx.egui_wants_keyboard_input() {
+    /// ⌘C / ⌘X / ⌘V copy, cut and paste text or images on canvas (unless a text field has focus).
+    pub(super) fn clipboard_keys(&mut self, i: usize, ctx: &egui::Context) {
+        use egui::{Key, KeyboardShortcut, Modifiers};
+        let pastes: Vec<_> = ctx.input(|input| {
+            input
+                .events
+                .iter()
+                .filter_map(|event| match event {
+                    egui::Event::Paste(_) => Some(ClipboardPaste::Text),
+                    egui::Event::PasteImage(image) => Some(ClipboardPaste::Image(image.clone())),
+                    _ => None,
+                })
+                .collect()
+        });
+        let free = self.dialog.is_none() && !self.palette_open && !ctx.egui_wants_keyboard_input() && !self.is_preparing();
+        if !free || self.views.get(i).is_some_and(|v| v.forms.focus.is_some() || v.organize) {
+            self.receive_pastes(i, pastes, false);
             return;
         }
-        self.copy_selected_text(i, ctx);
+        let copy = ctx.input(|input| input.events.iter().any(|e| matches!(e, egui::Event::Copy)))
+            || ctx.input_mut(|input| input.consume_shortcut(&KeyboardShortcut::new(Modifiers::COMMAND, Key::C)));
+        let cut = ctx.input(|input| input.events.iter().any(|e| matches!(e, egui::Event::Cut)))
+            || ctx.input_mut(|input| input.consume_shortcut(&KeyboardShortcut::new(Modifiers::COMMAND, Key::X)));
+        let paste = ctx.input_mut(|input| input.consume_shortcut(&KeyboardShortcut::new(Modifiers::COMMAND, Key::V)));
+
+        if copy
+            && !self.copy_selected_text(i, ctx)
+            && let Some(sel) = self.views.get(i).and_then(|v| v.image_selection.clone())
+            && let Some(id) = self.views.get(i).map(|v| v.id)
+            && self.may_copy(id)
+        {
+            self.copy_page_image(sel.page, sel.index);
+        }
+        if cut
+            && let Some(sel) = self.views.get(i).and_then(|v| v.image_selection.clone())
+            && let Some(id) = self.views.get(i).map(|v| v.id)
+            && self.may_copy(id)
+        {
+            self.cut_page_image(sel.page, sel.index);
+        }
+        if !pastes.is_empty() {
+            self.receive_pastes(i, pastes, true);
+            return;
+        }
+        if paste {
+            let has_override_image = matches!(self.clipboard_override, Some(crate::create_ui::Clip::Image { .. }));
+            #[cfg(not(target_arch = "wasm32"))]
+            let system_has_text = if !has_override_image && self.system_clipboard { crate::os_clipboard::has_text() } else { false };
+            #[cfg(target_arch = "wasm32")]
+            let system_has_text = false;
+
+            if !has_override_image && system_has_text {
+                self.last_copied_image = None;
+                self.last_copied_file = None;
+                return;
+            }
+
+            let page = self.views.get(i).map_or(0, |v| v.current);
+            self.paste_image(page, None);
+        }
+    }
+
+    fn receive_pastes(&mut self, view: usize, pastes: Vec<ClipboardPaste>, images_allowed: bool) {
+        let page = self.views.get(view).map_or(0, |view| view.current);
+        for paste in pastes {
+            match paste {
+                ClipboardPaste::Text => {
+                    // Text fields may own the paste; the canvas cache still observes its contents.
+                    self.last_copied_image = None;
+                    self.last_copied_file = None;
+                }
+                ClipboardPaste::Image(image) if images_allowed => {
+                    self.paste_received_image(page, &image);
+                }
+                ClipboardPaste::Image(_) => {}
+            }
+        }
     }
 
     /// Shared permission gate for copying selected page text from menus and keyboard events.
@@ -79,3 +153,222 @@ impl PdfCraftApp {
         }
     }
 }
+
+#[cfg(test)]
+mod review_tests {
+    use super::*;
+    fn delivered() -> egui::Event {
+        egui::Event::PasteImage(std::sync::Arc::new(egui::ColorImage::filled([1, 1], egui::Color32::GREEN)))
+    }
+
+    fn key(pressed: bool, modifiers: egui::Modifiers) -> egui::Event {
+        egui::Event::Key { key: egui::Key::V, physical_key: None, pressed, repeat: false, modifiers }
+    }
+
+    fn image_app() -> PdfCraftApp {
+        let mut app = PdfCraftApp::new();
+        app.system_clipboard = false;
+        app.create_blank();
+        app.clipboard_override = Some(crate::create_ui::Clip::Image { width: 1, height: 1, rgba: vec![255, 0, 0, 255] });
+        app
+    }
+
+    fn frame(app: &mut PdfCraftApp, ctx: &egui::Context, time: f64, events: Vec<egui::Event>) -> usize {
+        ctx.run_ui(egui::RawInput { time: Some(time), events, ..Default::default() }, |ui| app.clipboard_keys(0, ui.ctx()))
+            .drop_without_applying_deltas();
+        app.session.get(app.views[0].id).unwrap().page_images(0).len()
+    }
+
+    #[test]
+    fn delivered_image_pastes_for_either_modifier_release_order() {
+        for command_first in [true, false] {
+            let mut app = image_app();
+            let ctx = egui::Context::default();
+            frame(&mut app, &ctx, 1.0, vec![egui::Event::ModifiersChanged(egui::Modifiers::COMMAND)]);
+            let releases = if command_first {
+                vec![egui::Event::ModifiersChanged(egui::Modifiers::NONE), key(false, egui::Modifiers::NONE)]
+            } else {
+                vec![key(false, egui::Modifiers::COMMAND), egui::Event::ModifiersChanged(egui::Modifiers::NONE)]
+            };
+            assert_eq!(frame(&mut app, &ctx, 1.1, releases), 0, "key release is not a delivered paste");
+            assert_eq!(frame(&mut app, &ctx, 1.2, vec![delivered()]), 1, "asynchronous pixels identify the actual paste");
+            assert_eq!(frame(&mut app, &ctx, 1.25, vec![key(false, egui::Modifiers::NONE)]), 1);
+        }
+    }
+
+    #[test]
+    fn clipboard_history_after_a_completed_paste_does_not_paste_on_open() {
+        for explicit_press in [false, true] {
+            let mut app = image_app();
+            let ctx = egui::Context::default();
+            let mut first = vec![egui::Event::ModifiersChanged(egui::Modifiers::COMMAND), delivered()];
+            if explicit_press {
+                first.push(key(true, egui::Modifiers::COMMAND));
+            }
+            first.push(key(false, egui::Modifiers::COMMAND));
+            assert_eq!(frame(&mut app, &ctx, 1.0, first), 1);
+            // The integration drops Windows-key identity; Win+V can leave only this release.
+            assert_eq!(
+                frame(&mut app, &ctx, 1.1, vec![egui::Event::ModifiersChanged(egui::Modifiers::NONE), key(false, egui::Modifiers::NONE)]),
+                1,
+                "opening history must not paste"
+            );
+            assert_eq!(
+                frame(&mut app, &ctx, 1.2, vec![delivered(), key(true, egui::Modifiers::COMMAND), key(false, egui::Modifiers::COMMAND)]),
+                2,
+                "choosing an item produces exactly one intentional paste"
+            );
+        }
+    }
+
+    #[test]
+    fn clipboard_history_and_plain_v_after_an_unrelated_shortcut_do_nothing() {
+        let mut app = image_app();
+        let ctx = egui::Context::default();
+        let copy = egui::Event::Key { key: egui::Key::C, physical_key: None, pressed: true, repeat: false, modifiers: egui::Modifiers::COMMAND };
+        frame(&mut app, &ctx, 1.0, vec![egui::Event::ModifiersChanged(egui::Modifiers::COMMAND), copy]);
+        assert_eq!(frame(&mut app, &ctx, 1.1, vec![egui::Event::ModifiersChanged(egui::Modifiers::NONE), key(false, egui::Modifiers::NONE)]), 0);
+        assert_eq!(frame(&mut app, &ctx, 1.2, vec![key(true, egui::Modifiers::NONE), key(false, egui::Modifiers::NONE)]), 0);
+        assert_eq!(frame(&mut app, &ctx, 10.0, vec![key(false, egui::Modifiers::NONE)]), 0);
+    }
+
+    #[test]
+    fn delivered_image_is_authoritative_and_not_duplicated_by_keys() {
+        let mut app = image_app();
+        app.system_clipboard = true;
+        app.clipboard_override = Some(crate::create_ui::Clip::Text("newer OS contents".into()));
+        let ctx = egui::Context::default();
+        assert_eq!(frame(&mut app, &ctx, 1.0, vec![delivered(), key(true, egui::Modifiers::COMMAND), key(false, egui::Modifiers::COMMAND)]), 1);
+        assert_eq!(app.last_copied_image.as_ref().unwrap().2, vec![0, 255, 0, 255]);
+    }
+
+    #[test]
+    fn text_then_image_batch_pastes_image_and_keeps_its_cache() {
+        let mut app = image_app();
+        let ctx = egui::Context::default();
+        assert_eq!(frame(&mut app, &ctx, 1.0, vec![egui::Event::Paste("text".into()), delivered()]), 1);
+        assert_eq!(app.last_copied_image.unwrap().2, vec![0, 255, 0, 255]);
+    }
+
+    #[test]
+    fn image_then_text_batch_pastes_image_and_leaves_text_authoritative() {
+        let mut app = image_app();
+        let ctx = egui::Context::default();
+        assert_eq!(frame(&mut app, &ctx, 1.0, vec![delivered(), egui::Event::Paste("text".into())]), 1);
+        assert!(app.last_copied_image.is_none());
+        assert!(app.last_copied_file.is_none());
+    }
+
+    #[test]
+    fn separate_delivered_images_in_one_batch_each_paste_once() {
+        let mut app = image_app();
+        let ctx = egui::Context::default();
+        assert_eq!(
+            frame(&mut app, &ctx, 1.0, vec![delivered(), delivered(), key(true, egui::Modifiers::COMMAND), key(false, egui::Modifiers::COMMAND)]),
+            2
+        );
+    }
+
+    #[test]
+    fn explicit_control_shortcut_still_pastes_once_without_an_image_event() {
+        let mut app = image_app();
+        let ctx = egui::Context::default();
+        assert_eq!(frame(&mut app, &ctx, 1.0, vec![key(true, egui::Modifiers::COMMAND)]), 1);
+        assert_eq!(frame(&mut app, &ctx, 1.1, vec![key(false, egui::Modifiers::COMMAND)]), 1);
+    }
+
+    #[test]
+    fn delivered_image_obeys_focus_modal_and_permission_guards() {
+        let ctx = egui::Context::default();
+        let mut app = image_app();
+        app.palette_open = true;
+        assert_eq!(frame(&mut app, &ctx, 1.0, vec![delivered()]), 0);
+        app.palette_open = false;
+        app.views[0].organize = true;
+        assert_eq!(frame(&mut app, &ctx, 2.0, vec![delivered()]), 0);
+        app.views[0].organize = false;
+        app.apply_edit(pdfcraft_engine::Edit::Protect(pdfcraft_engine::Protection {
+            permissions_password: Some("owner".into()),
+            ..Default::default()
+        }));
+        let bytes = app.session.save_bytes(app.views[0].id).unwrap();
+        let mut restricted = PdfCraftApp::new();
+        restricted.open_bytes("restricted.pdf", None, bytes.as_ref().clone()).unwrap();
+        assert!(!restricted.session.get(restricted.views[0].id).unwrap().allows_modification());
+        assert_eq!(frame(&mut restricted, &ctx, 3.0, vec![delivered()]), 0);
+    }
+
+    #[test]
+    fn review_an_image_less_release_is_silent_but_explicit_paste_explains() {
+        let mut app = PdfCraftApp::new();
+        app.system_clipboard = false;
+        app.create_blank();
+        app.toast = None;
+        let ctx = egui::Context::default();
+        ctx.run_ui(
+            egui::RawInput {
+                events: vec![egui::Event::Key {
+                    key: egui::Key::V,
+                    physical_key: None,
+                    pressed: false,
+                    repeat: false,
+                    modifiers: egui::Modifiers::NONE,
+                }],
+                ..Default::default()
+            },
+            |ui| app.clipboard_keys(0, ui.ctx()),
+        )
+        .drop_without_applying_deltas();
+        assert!(app.toast.is_none());
+        assert!(!app.paste_image(0, None));
+        assert!(app.toast.is_some(), "an explicit menu action still explains why there is no image");
+    }
+
+    #[test]
+    fn review_text_paste_release_is_silent_and_later_image_paste_still_works() {
+        let mut app = PdfCraftApp::new();
+        app.system_clipboard = false;
+        app.create_blank();
+        app.last_copied_image = Some((1, 1, vec![255, 0, 0, 255]));
+        app.palette_open = true; // A text field owns the first event.
+        let ctx = egui::Context::default();
+        ctx.run_ui(egui::RawInput { events: vec![egui::Event::Paste("text".into())], ..Default::default() }, |ui| app.clipboard_keys(0, ui.ctx()))
+            .drop_without_applying_deltas();
+        assert!(app.last_copied_image.is_none());
+        app.palette_open = false;
+        app.toast = None;
+        ctx.run_ui(
+            egui::RawInput {
+                events: vec![egui::Event::Key {
+                    key: egui::Key::V,
+                    physical_key: None,
+                    pressed: false,
+                    repeat: false,
+                    modifiers: egui::Modifiers::NONE,
+                }],
+                ..Default::default()
+            },
+            |ui| app.clipboard_keys(0, ui.ctx()),
+        )
+        .drop_without_applying_deltas();
+        assert!(app.toast.is_none(), "the text gesture's key release must be silent");
+        app.clipboard_override = None;
+        let delivered = egui::Event::PasteImage(std::sync::Arc::new(egui::ColorImage::filled([1, 1], egui::Color32::GREEN)));
+        ctx.run_ui(egui::RawInput { events: vec![delivered], ..Default::default() }, |ui| app.clipboard_keys(0, ui.ctx()))
+            .drop_without_applying_deltas();
+        let id = app.active_ids().unwrap().1;
+        assert_eq!(app.session.get(id).unwrap().page_images(0).len(), 1, "a later real image shortcut still works");
+    }
+
+    #[test]
+    fn review_failed_keyboard_cut_keeps_the_image_selection() {
+        let mut app = PdfCraftApp::new();
+        app.system_clipboard = false;
+        app.create_blank();
+        app.views[0].image_selection = Some(crate::edit_text_ui::ImageSelection::at(0, 0));
+        let ctx = egui::Context::default();
+        ctx.run_ui(egui::RawInput { events: vec![egui::Event::Cut], ..Default::default() }, |ui| app.clipboard_keys(0, ui.ctx()))
+            .drop_without_applying_deltas();
+        assert!(app.views[0].image_selection.is_some());
+    }
+}
diff --git a/crates/ui-egui/src/app/control.rs b/crates/ui-egui/src/app/control.rs
index 79bd2fa258..0309042bf1 100644
--- a/crates/ui-egui/src/app/control.rs
+++ b/crates/ui-egui/src/app/control.rs
@@ -16,6 +16,18 @@ impl PdfCraftApp {
     pub fn set_option(&mut self, key: &str, value: &str) -> Result<(), String> {
         let view = self.active.and_then(|i| self.views.get_mut(i));
         match (key, view) {
+            ("hotbar-size", _) => {
+                let size: f32 = value.parse().map_err(|_| "hotbar-size must be 24–64 pixels")?;
+                if !size.is_finite() || !(24.0..=64.0).contains(&size) {
+                    return Err("hotbar-size must be 24–64 pixels".into());
+                }
+                self.hotbar.button_size = size;
+            }
+            ("hotbar-full-side", _) => {
+                self.hotbar.full_side = value.parse().map_err(|_| "hotbar-full-side must be true or false")?;
+            }
+            ("hotbar-tools", _) => self.hotbar.set_tools(value)?,
+            ("hotbar-side", _) => self.hotbar.place(value)?,
             ("language", _) => {
                 let language = i18n::normalize_pref(value).ok_or_else(|| {
                     let codes: Vec<&str> = std::iter::once(i18n::AUTO).chain(i18n::Lang::all().map(i18n::Lang::code)).collect();
@@ -32,9 +44,15 @@ impl PdfCraftApp {
                 };
                 self.set_theme_preference(preference);
             }
+            ("show_page_edge_shadows", _) => {
+                self.show_page_edge_shadows = value.parse::<bool>().map_err(|_| "show_page_edge_shadows must be true or false")?;
+            }
             ("scroll_speed", _) => {
                 self.scroll_speed = scroll_speed::ScrollSpeed::parse(value).ok_or("scroll_speed must be slow, normal, or fast")?;
             }
+            ("invert_middle_drag", _) => {
+                self.invert_middle_drag = value.parse::<bool>().map_err(|_| "invert_middle_drag must be true or false")?;
+            }
             ("animation_effects", _) => {
                 self.animation_effects = motion::AnimationEffects::parse(value).ok_or("animation_effects must be system, on, or off")?;
             }
@@ -167,6 +185,12 @@ impl PdfCraftApp {
                     _ => return Err("default-page-gaps must be on or off".into()),
                 };
             }
+            ("recent-files", _) => {
+                let max = crate::RECENT_FILES_MAX;
+                let limit = value.parse().ok().filter(|n| *n <= max).ok_or_else(|| format!("recent-files must be between 0 and {max}"))?;
+                self.recent_limit = limit;
+                self.recent.truncate(limit);
+            }
             ("cover", Some(v)) => {
                 let on = match value {
                     "on" => true,
@@ -208,6 +232,13 @@ impl PdfCraftApp {
                     _ => return Err("tools-side must be left or right".into()),
                 }
             }
+            ("rail-side", _) => {
+                self.side_panels.rail_side = match value {
+                    "left" => side_panels::ToolsSide::Left,
+                    "right" => side_panels::ToolsSide::Right,
+                    _ => return Err("rail-side must be left or right".into()),
+                }
+            }
             ("organize", Some(v)) => {
                 if value == "off" {
                     v.organize = false;
diff --git a/crates/ui-egui/src/app/files.rs b/crates/ui-egui/src/app/files.rs
index 3c68dc5619..9991047077 100644
--- a/crates/ui-egui/src/app/files.rs
+++ b/crates/ui-egui/src/app/files.rs
@@ -117,6 +117,7 @@ impl PdfCraftApp {
             after_open: request.after_open,
             recovered: request.recovered,
             then: request.then,
+            display_override: None,
         });
         Ok(token)
     }
@@ -147,6 +148,7 @@ impl PdfCraftApp {
         // earlier waiting replies, without consuming a blocked receiver's result.
         waiting.append(&mut self.pending_opens);
         self.pending_opens = waiting;
+        self.settle_launch_layout();
     }
 
     #[cfg(not(target_arch = "wasm32"))]
@@ -182,6 +184,12 @@ impl PdfCraftApp {
                         if let Some(destination) = pending.after_open {
                             self.apply_remote_destination(destination);
                         }
+                        if let Some((layout, continuous)) = pending.display_override
+                            && let Some(view) = self.views.iter_mut().find(|view| view.id == id)
+                        {
+                            view.set_display(layout, continuous);
+                            self.launch_display_target = Some(id);
+                        }
                         if let Some(meta) = &pending.recovered {
                             self.finish_recovery(meta);
                         }
@@ -205,6 +213,7 @@ impl PdfCraftApp {
                         recovered: pending.recovered,
                         then: pending.then,
                         after_open: pending.after_open,
+                        display_override: pending.display_override,
                     });
                 }
                 Err(error) => self.notify_fmt("Couldn't open {name}: {e}", &[("name", &pending.name), ("e", &error.to_string())]),
@@ -239,6 +248,7 @@ impl PdfCraftApp {
                     recovered: None,
                     then: None,
                     after_open: None,
+                    display_override: None,
                 });
                 return Ok(());
             }
@@ -322,8 +332,9 @@ impl PdfCraftApp {
             #[cfg(target_os = "macos")]
             macos_association::repair(std::path::Path::new(&p));
             self.recent.retain(|r| r.path != p);
+            self.recent_check.opened(&p);
             self.recent.insert(0, RecentFile { name: name.to_string(), path: p, pages, size });
-            self.recent.truncate(12);
+            self.recent.truncate(self.recent_limit);
         }
         // What the form's scripts said while it opened (messages, errors) shows now, not with
         // the next edit.
@@ -416,6 +427,8 @@ impl PdfCraftApp {
             if let Some(meta) = p.recovered {
                 self.recoverable.push(meta);
             }
+            #[cfg(not(target_arch = "wasm32"))]
+            self.settle_launch_layout();
             return;
         };
         #[cfg(not(target_arch = "wasm32"))]
@@ -431,6 +444,11 @@ impl PdfCraftApp {
                 recovered: p.recovered.clone(),
                 then: p.then,
             });
+            if let Ok(token) = &result
+                && let Some(pending) = self.pending_opens.iter_mut().find(|pending| pending.token == *token)
+            {
+                pending.display_override = p.display_override;
+            }
             if let Err(error) = result {
                 let mut prompt = p;
                 prompt.error = Some(error);
@@ -458,6 +476,15 @@ impl PdfCraftApp {
                 if let Some(destination) = after_open {
                     self.apply_remote_destination(destination);
                 }
+                if let Some((layout, continuous)) = p.display_override
+                    && let Some(view) = self.views.last_mut()
+                {
+                    view.set_display(layout, continuous);
+                    #[cfg(not(target_arch = "wasm32"))]
+                    {
+                        self.launch_display_target = Some(view.id);
+                    }
+                }
                 if let Some(meta) = &p.recovered {
                     self.finish_recovery(meta);
                 }
@@ -472,9 +499,12 @@ impl PdfCraftApp {
                     prompt.recovered = p.recovered;
                     prompt.then = p.then;
                     prompt.after_open = after_open;
+                    prompt.display_override = p.display_override;
                 }
             }
         }
+        #[cfg(not(target_arch = "wasm32"))]
+        self.settle_launch_layout();
     }
 
     /// Ask for the active document's permissions password, then run `then` (if any).
@@ -533,17 +563,37 @@ impl PdfCraftApp {
     /// the file opened, focused its tab, was handed to the background worker, or failed.
     #[cfg(not(target_arch = "wasm32"))]
     pub(crate) fn open_path_then(&mut self, path: &str, then: Option<&'static str>) -> OpenOutcome {
+        self.open_path_request(path, then, None)
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    fn open_path_request(&mut self, path: &str, then: Option<&'static str>, display_override: Option<(canvas::PageLayout, bool)>) -> OpenOutcome {
         // One file, one tab (#2166): a file that is open already comes to the front instead,
         // and the tool it was opened for runs on it. One still being opened is left to that.
         if let Some(i) = self.tab_showing(path) {
             self.startup_superseded = true;
             self.active = Some(i);
+            if let Some((layout, continuous)) = display_override
+                && let Some(view) = self.views.get_mut(i)
+            {
+                view.set_display(layout, continuous);
+                self.launch_display_target = Some(view.id);
+            }
             if let Some(command) = then {
                 self.execute(command);
             }
             return OpenOutcome::Focused;
         }
-        if self.pending_opens.iter().any(|p| p.path.as_deref().is_some_and(|p| same_file(p, path))) {
+        if let Some(pending) = self.pending_opens.iter_mut().find(|p| p.path.as_deref().is_some_and(|p| same_file(p, path))) {
+            if display_override.is_some() {
+                pending.display_override = display_override;
+            }
+            return OpenOutcome::Pending;
+        }
+        if display_override.is_some()
+            && let Some(prompt) = self.password_prompt.as_mut().filter(|p| p.path.as_deref().is_some_and(|p| same_file(p, path)))
+        {
+            prompt.display_override = display_override;
             return OpenOutcome::Pending;
         }
         let name = std::path::Path::new(path).file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_else(|| path.to_string());
@@ -552,18 +602,29 @@ impl PdfCraftApp {
         // Before the first frame there is no interaction to keep responsive; this also preserves
         // deterministic inline startup and test flows. Once live, reading and preparation use
         // the bounded worker and commit on the UI thread.
-        if self.ctx.is_none() || self.run_inline {
+        // Keep flagged launch files behind an existing password prompt or picker.
+        if (self.ctx.is_none() || self.run_inline) && !(display_override.is_some() && (self.modal_open() || self.pickers.pending())) {
             match std::fs::read(path) {
                 Ok(bytes) => {
                     let before = self.views.len();
+                    let previous_prompt = self.password_prompt.as_ref().map(|p| p.bytes.clone());
                     if let Err(error) = self.open_bytes(&name, Some(path.to_string()), bytes) {
                         self.notify_fmt("Couldn't open {name}: {e}", &[("name", &name), ("e", &error)]);
                         return OpenOutcome::Failed;
                     }
-                    if let Some(prompt) = self.password_prompt.as_mut().filter(|p| p.path.as_deref() == Some(path)) {
+                    if let Some(prompt) = self.password_prompt.as_mut().filter(|p| {
+                        p.path.as_deref() == Some(path) && previous_prompt.as_ref().is_none_or(|bytes| !std::sync::Arc::ptr_eq(bytes, &p.bytes))
+                    }) {
                         // Encrypted: the tool runs once the password is in.
                         prompt.then = then;
+                        prompt.display_override = display_override;
                     } else if self.views.len() > before {
+                        if let Some((layout, continuous)) = display_override
+                            && let Some(view) = self.views.last_mut()
+                        {
+                            view.set_display(layout, continuous);
+                            self.launch_display_target = Some(view.id);
+                        }
                         if let Some(doc) = self.views.last().map(|view| view.id) {
                             self.watch.known_as(doc, stamp);
                         }
@@ -595,7 +656,12 @@ impl PdfCraftApp {
                 recovered: None,
                 then,
             }) {
-                Ok(_) => OpenOutcome::Pending,
+                Ok(token) => {
+                    if let Some(pending) = self.pending_opens.iter_mut().find(|pending| pending.token == token) {
+                        pending.display_override = display_override;
+                    }
+                    OpenOutcome::Pending
+                }
                 Err(error) => {
                     self.notify_fmt("Couldn't open {name}: {e}", &[("name", &name), ("e", &error)]);
                     OpenOutcome::Failed
@@ -604,6 +670,38 @@ impl PdfCraftApp {
         }
     }
 
+    /// Apply an explicit launch layout after the command-line display overrides settle.
+    #[cfg(not(target_arch = "wasm32"))]
+    pub fn set_launch_layout(&mut self, value: &str) -> Result<(), String> {
+        let (layout, continuous) = canvas::parse_display_token(value).ok_or("layout must be single, continuous, two-up or two-page")?;
+        self.launch_layout = Some((layout, continuous));
+        self.settle_launch_layout();
+        Ok(())
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    fn settle_launch_layout(&mut self) {
+        if self.pending_opens.iter().any(|open| open.display_override.is_some())
+            || self.password_prompt.as_ref().is_some_and(|prompt| prompt.display_override.is_some())
+        {
+            return;
+        }
+        // Follow the existing completion/activation order, not a guessed tab index or path.
+        // Failed or cancelled opens cannot cause the layout to land on a restored document.
+        if let Some((layout, continuous)) = self.launch_layout.take()
+            && let Some(id) = self.launch_display_target
+            && let Some(view) = self.views.iter_mut().find(|view| view.id == id)
+        {
+            view.set_display(layout, continuous);
+        }
+    }
+
+    /// Open one native file with a transient display override, including after a password prompt.
+    #[cfg(not(target_arch = "wasm32"))]
+    pub fn open_path_with_display(&mut self, path: &str, layout: canvas::PageLayout, continuous: bool) {
+        self.open_path_request(path, None, Some((layout, continuous)));
+    }
+
     /// The File ▸ Open picker: PDFs, and images and text that become PDFs.
     #[cfg(not(target_arch = "wasm32"))]
     pub(super) fn open_picker() -> rfd::AsyncFileDialog {
diff --git a/crates/ui-egui/src/app/keys.rs b/crates/ui-egui/src/app/keys.rs
index 6021af64d8..c014453806 100644
--- a/crates/ui-egui/src/app/keys.rs
+++ b/crates/ui-egui/src/app/keys.rs
@@ -3,7 +3,6 @@ use super::*;
 impl PdfCraftApp {
     pub(super) fn shortcuts(&mut self, ctx: &egui::Context) {
         use egui::Key;
-        let pasted = self.paste_key_released(ctx);
         // "Save changes?" is modal: its keys are its own (⌘D is Don't save there, not Document
         // properties; Escape cancels it rather than clearing a selection), and nothing may run
         // underneath it. They are read here, before the canvas can consume them.
@@ -78,8 +77,7 @@ impl PdfCraftApp {
                 prepare::nudge_keys(ctx, &mut self.views[i], doc);
             }
             canvas::shortcuts(&mut self.views[i], ctx, self.scroll_speed);
-            self.copy_key(i, ctx);
-            self.paste_image_key(i, ctx, pasted);
+            self.clipboard_keys(i, ctx);
             self.image_pick_keys(i, ctx);
         }
     }
diff --git a/crates/ui-egui/src/app/prefs.rs b/crates/ui-egui/src/app/prefs.rs
index e5eaae5863..08a20afb45 100644
--- a/crates/ui-egui/src/app/prefs.rs
+++ b/crates/ui-egui/src/app/prefs.rs
@@ -78,7 +78,7 @@ impl PdfCraftApp {
         let mut v = serde_json::json!({
             "side_panels": self.side_panels.to_json(self.left_open),
             "docking_right": self.right,
-            "recent": self.recent,
+            "recent": self.recent.iter().take(self.recent_limit).collect::<Vec<_>>(),
             "reopen_last_session": self.reopen_last_session,
             "restore_last_view": self.restore_last_view,
             "last_views": self.last_views_to_save(),
@@ -89,6 +89,7 @@ impl PdfCraftApp {
             "pinned_folders": self.pinned.folders,
             "theme": self.theme_preference,
             "scroll_speed": self.scroll_speed,
+            "invert_middle_drag": self.invert_middle_drag,
             "animation_effects": self.animation_effects,
             "default_mode": self.default_mode,
             "default_layout": canvas::display_token(self.view_defaults.layout, self.view_defaults.continuous),
@@ -139,10 +140,14 @@ impl PdfCraftApp {
         });
         // Set apart: one more key inside the macro above passes serde_json's recursion limit.
         v["default_page_gaps"] = serde_json::Value::Bool(self.view_defaults.show_page_gaps);
+        v["recent_limit"] = serde_json::json!(self.recent_limit);
         v["fill_text_color"] = serde_json::json!(self.fill_text_color);
         v["redact_prefs"] = self.redact_defaults.to_json();
+        v["pinned_tools"] = serde_json::json!(self.pinned_tools);
         // Set outside json! above, which is at serde_json's macro recursion limit.
         v["hide_empty_highlight_hover"] = serde_json::Value::Bool(self.comment_prefs.hide_empty_highlight_hover);
+        v["show_page_edge_shadows"] = self.show_page_edge_shadows.into();
+        v["hotbar"] = serde_json::to_value(&self.hotbar).unwrap_or_default();
         v["comment_tool_pinned"] = serde_json::Value::Bool(self.comment_prefs.pinned);
         v["show_secured_notice"] = serde_json::Value::Bool(self.show_secured_notice);
         v["organize_zoom"] = serde_json::json!(self.organize_zoom);
@@ -154,6 +159,13 @@ impl PdfCraftApp {
     /// Restore state written by `persist`. Unknown or malformed data is ignored.
     pub fn restore(&mut self, json: &str) {
         let Ok(v) = serde_json::from_str::<serde_json::Value>(json) else { return };
+        if let Ok(mut bar) = serde_json::from_value::<crate::hotbar::Hotbar>(v["hotbar"].clone()) {
+            if v["hotbar"].get("placed").is_none() {
+                bar.adopt_legacy();
+            }
+            bar.normalize();
+            self.hotbar = bar;
+        }
         let panels = side_panels::restore(&v);
         self.side_panels = panels.panels;
         if let Some(open) = panels.tools_open {
@@ -174,11 +186,16 @@ impl PdfCraftApp {
             self.organize_zoom = zoom.clamp(*canvas::GRID_ZOOM_RANGE.start(), *canvas::GRID_ZOOM_RANGE.end());
         }
         if let Ok(r) = serde_json::from_value::<Vec<RecentFile>>(v["recent"].clone()) {
-            // Only keep entries whose files still exist.
-            #[cfg(not(target_arch = "wasm32"))]
-            let r: Vec<RecentFile> = r.into_iter().filter(|f| std::path::Path::new(&f.path).exists()).collect();
+            // Entries whose files are gone leave once the window is up: asking here could block
+            // startup on a mount that has stopped answering (#5682).
+            self.recent_check.restored(r.iter().map(|f| f.path.clone()).collect());
             self.recent = r;
         }
+        // Nonsense keeps the limit it had; settings from before the limit have none.
+        if let Some(limit) = v["recent_limit"].as_u64() {
+            self.recent_limit = usize::try_from(limit).map_or(crate::RECENT_FILES_MAX, |n| n.min(crate::RECENT_FILES_MAX));
+        }
+        self.recent.truncate(self.recent_limit);
         self.restore_layout_prefs(&v);
         self.restore_behavior_prefs(&v);
         self.restore_view_prefs(&v);
@@ -206,12 +223,27 @@ impl PdfCraftApp {
             self.show_secured_notice = on;
         }
         self.pinned.restore(&v["pinned_folders"]);
+        if let Some(items) = v.get("pinned_tools").and_then(serde_json::Value::as_array) {
+            let mut tools = Vec::new();
+            for item in items {
+                if let Some(id) = item.as_str()
+                    && pdfcraft_engine::catalog::group(id).is_some()
+                    && !tools.iter().any(|t| t == id)
+                {
+                    tools.push(id.to_string());
+                }
+            }
+            self.pinned_tools = tools;
+        }
         if let Ok(preference) = serde_json::from_value::<ThemePreference>(v["theme"].clone()) {
             self.set_theme_preference(preference);
         }
         if let Ok(speed) = serde_json::from_value::<scroll_speed::ScrollSpeed>(v["scroll_speed"].clone()) {
             self.scroll_speed = speed;
         }
+        if let Some(invert) = v["invert_middle_drag"].as_bool() {
+            self.invert_middle_drag = invert;
+        }
         if let Ok(effects) = serde_json::from_value::<motion::AnimationEffects>(v["animation_effects"].clone()) {
             self.animation_effects = effects;
         }
@@ -267,6 +299,9 @@ impl PdfCraftApp {
         {
             self.fill_text_color = color;
         }
+        if let Some(show) = v["show_page_edge_shadows"].as_bool() {
+            self.show_page_edge_shadows = show;
+        }
         if let Some(prefs) = RedactPrefs::from_json(&v["redact_prefs"]) {
             self.redact_prefs = prefs.clone();
             self.redact_defaults = prefs;
diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 8b280ba75d..49d2c44b03 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -18,8 +18,8 @@ use crate::theme::{self, Tokens};
 use crate::{PdfCraftApp, QuickTool, RightPanel, comments, icons, widgets};
 
 mod area;
-pub(super) mod autoscroll;
-mod bars;
+pub(crate) mod autoscroll;
+pub(crate) mod bars;
 mod cache;
 pub(super) mod crop;
 mod find;
@@ -84,6 +84,191 @@ pub enum Fit {
     None,
 }
 
+use crate::edit_text_ui::ImageHandle;
+
+/// Extension trait on `egui::Painter` to draw polygons.
+pub trait PainterExt {
+    fn polygon(&self, points: Vec<Pos2>, fill: Color32, stroke: Stroke) -> egui::layers::ShapeIdx;
+}
+
+impl PainterExt for egui::Painter {
+    fn polygon(&self, points: Vec<Pos2>, fill: Color32, stroke: Stroke) -> egui::layers::ShapeIdx {
+        self.add(egui::Shape::convex_polygon(points, fill, stroke))
+    }
+}
+
+/// User-space selectable bounding box for an image object.
+/// If the image object has an active clipping path applied to it (the crop box),
+/// this is the mathematical intersection of the full CTM-derived rect and the clipping path's rect.
+pub fn image_selectable_bounds(im: &pdfcraft_engine::PageImage) -> [f64; 4] {
+    if let Some(clip) = im.clip_rect {
+        let r = [im.rect[0].max(clip[0]), im.rect[1].max(clip[1]), im.rect[2].min(clip[2]), im.rect[3].min(clip[3])];
+        if r.iter().all(|v| v.is_finite()) && r[2] > r[0] && r[3] > r[1] {
+            return r;
+        }
+    }
+    im.visible_rect.unwrap_or(im.rect)
+}
+
+/// Screen-space selectable bounding box for an image object.
+/// If the image object has an active clipping path applied to it (the crop box),
+/// the final selectable `egui::Rect` is the mathematical intersection of the image's
+/// full CTM-derived rect and the clipping path's rect.
+pub fn image_screen_rect(im: &pdfcraft_engine::PageImage, xf: &PageXform, info: &DocInfo, page: usize) -> Rect {
+    let full = xf.user_rect_f64(info, page, im.rect);
+    if let Some(clip) = im.clip_rect {
+        let clip_r = xf.user_rect_f64(info, page, clip);
+        let inter = full.intersect(clip_r);
+        if inter.is_positive() {
+            return inter;
+        }
+    }
+    if let Some(vr) = im.visible_rect {
+        let r = xf.user_rect_f64(info, page, vr);
+        if r.is_positive() {
+            return r;
+        }
+    }
+    full
+}
+
+/// An Oriented Bounding Box (OBB) representing a rotated rectangle in screen space,
+/// with 8 resize handles and rotated local axes.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct ImageObb {
+    pub s00: Pos2,
+    pub s10: Pos2,
+    pub s11: Pos2,
+    pub s01: Pos2,
+    pub s_bc: Pos2,
+    pub s_rc: Pos2,
+    pub s_tc: Pos2,
+    pub s_lc: Pos2,
+    pub s_rot: Pos2,
+    pub screen_center: Pos2,
+    pub u_axis: (f64, f64),
+    pub v_axis: (f64, f64),
+    pub is_rotated: bool,
+}
+
+impl ImageObb {
+    pub(crate) fn handle_cursor(&self, handle: ImageHandle) -> egui::CursorIcon {
+        let direction = self.handle_pos(handle) - self.screen_center;
+        match handle {
+            ImageHandle::TopLeft | ImageHandle::TopRight | ImageHandle::BottomLeft | ImageHandle::BottomRight => {
+                if direction.x * direction.y > 0.0 {
+                    egui::CursorIcon::ResizeNwSe
+                } else {
+                    egui::CursorIcon::ResizeNeSw
+                }
+            }
+            _ if direction.x.abs() > direction.y.abs() => egui::CursorIcon::ResizeHorizontal,
+            _ => egui::CursorIcon::ResizeVertical,
+        }
+    }
+
+    pub(crate) fn contains(&self, visible: Rect, p: Pos2) -> bool {
+        (visible.is_positive() && visible.contains(p)) || crate::edit_text_ui::quad_contains(self.corners(), p)
+    }
+
+    pub fn from_matrix(matrix: [f64; 6], xf: &PageXform, info: &DocInfo, page: usize) -> Self {
+        let m = crate::edit_text_ui::Matrix(matrix);
+        let p00 = m.apply(0.0, 0.0);
+        let p10 = m.apply(1.0, 0.0);
+        let p11 = m.apply(1.0, 1.0);
+        let p01 = m.apply(0.0, 1.0);
+
+        let s00 = crate::edit_text_ui::user_to_screen(xf, info, page, p00.0, p00.1);
+        let s10 = crate::edit_text_ui::user_to_screen(xf, info, page, p10.0, p10.1);
+        let s11 = crate::edit_text_ui::user_to_screen(xf, info, page, p11.0, p11.1);
+        let s01 = crate::edit_text_ui::user_to_screen(xf, info, page, p01.0, p01.1);
+
+        let s_bc = Pos2::new((s00.x + s10.x) * 0.5, (s00.y + s10.y) * 0.5);
+        let s_rc = Pos2::new((s10.x + s11.x) * 0.5, (s10.y + s11.y) * 0.5);
+        let s_tc = Pos2::new((s01.x + s11.x) * 0.5, (s01.y + s11.y) * 0.5);
+        let s_lc = Pos2::new((s00.x + s01.x) * 0.5, (s00.y + s01.y) * 0.5);
+
+        let screen_center = Pos2::new((s00.x + s10.x + s11.x + s01.x) * 0.25, (s00.y + s10.y + s11.y + s01.y) * 0.25);
+        let out_dir = s_tc - screen_center;
+        let out_len = out_dir.length().max(1e-4);
+        let out_norm = out_dir / out_len;
+        let s_rot = s_tc + out_norm * 24.0;
+
+        let [a, b, c, d, ..] = matrix;
+        let w_u = (a * a + b * b).sqrt().max(1e-6);
+        let h_v = (c * c + d * d).sqrt().max(1e-6);
+        let u_axis = (a / w_u, b / w_u);
+        let v_axis = (c / h_v, d / h_v);
+        // The fast rectangle path interprets labels in screen space. Use matrix
+        // resizing whenever the image's user-space axes are turned or reflected
+        // on screen, including page /Rotate and View > Rotate View.
+        let u = s10 - s00;
+        let v = s01 - s00;
+        let is_rotated = u.y.abs() > 1e-4 || v.x.abs() > 1e-4 || u.x < 0.0 || v.y > 0.0;
+
+        Self { s00, s10, s11, s01, s_bc, s_rc, s_tc, s_lc, s_rot, screen_center, u_axis, v_axis, is_rotated }
+    }
+
+    pub fn from_image(im: &pdfcraft_engine::PageImage, xf: &PageXform, info: &DocInfo, page: usize) -> Self {
+        let [a, b, c, d, ..] = im.matrix;
+        let is_rot = b.abs() > 1e-4 || c.abs() > 1e-4 || a < 0.0 || d < 0.0;
+        let bounds = image_selectable_bounds(im);
+        let matrix = if !is_rot && bounds[2] > bounds[0] && bounds[3] > bounds[1] {
+            [bounds[2] - bounds[0], 0.0, 0.0, bounds[3] - bounds[1], bounds[0], bounds[1]]
+        } else {
+            im.matrix
+        };
+        Self::from_matrix(matrix, xf, info, page)
+    }
+
+    pub fn handles(&self) -> [(ImageHandle, Pos2); 8] {
+        [
+            ImageHandle::TopLeft,
+            ImageHandle::TopCenter,
+            ImageHandle::TopRight,
+            ImageHandle::RightCenter,
+            ImageHandle::BottomRight,
+            ImageHandle::BottomCenter,
+            ImageHandle::BottomLeft,
+            ImageHandle::LeftCenter,
+        ]
+        .map(|h| (h, self.handle_pos(h)))
+    }
+
+    pub fn handle_pos(&self, handle: ImageHandle) -> Pos2 {
+        match handle {
+            ImageHandle::TopLeft => self.s01,
+            ImageHandle::TopCenter => self.s_tc,
+            ImageHandle::TopRight => self.s11,
+            ImageHandle::RightCenter => self.s_rc,
+            ImageHandle::BottomRight => self.s10,
+            ImageHandle::BottomCenter => self.s_bc,
+            ImageHandle::BottomLeft => self.s00,
+            ImageHandle::LeftCenter => self.s_lc,
+        }
+    }
+
+    pub fn corners(&self) -> [Pos2; 4] {
+        [self.s00, self.s10, self.s11, self.s01]
+    }
+}
+
+/// Whether pointer `p` is on an image being cropped, its crop box or its handles (#5835).
+pub(crate) fn crop_contains_point(
+    img: &pdfcraft_engine::PageImage,
+    crop: &crate::edit_text_ui::CropMode,
+    xf: &PageXform,
+    info: &DocInfo,
+    page: usize,
+    p: Pos2,
+) -> bool {
+    let obb = ImageObb::from_image(img, xf, info, page);
+    let full_obb = ImageObb::from_matrix(img.matrix, xf, info, page);
+    crate::edit_text_ui::quad_contains(obb.corners(), p)
+        || crate::edit_text_ui::quad_contains(full_obb.corners(), p)
+        || crate::edit_text_ui::crop_controls_contain(img, crop, xf, info, page, p)
+}
+
 /// The page display as it was before full screen, put back on leaving it
 /// ([`DocView::enter_presentation`]).
 #[derive(Clone, Copy, Debug, PartialEq)]
@@ -382,6 +567,8 @@ pub struct DocView {
     /// Screen rects of the pages drawn last frame (hit-testing, tests, automation).
     screen_rects: Vec<(usize, Rect)>,
     screen_xforms: Vec<(usize, PageXform)>,
+    /// Pixels per point last frame, for telling a rounding sliver of a page from a visible one.
+    screen_ppp: f32,
     /// The scroll viewport on screen last frame.
     viewport_screen: Rect,
     /// Pending zoom anchor: page, fractional position (also in gutters), and viewport offset.
@@ -569,6 +756,104 @@ pub enum ViewAction {
     CameraNext(&'static str),
 }
 
+/// Default page right-click menu actions.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) enum PageMenuAction {
+    RotateCCW,
+    RotateCW,
+    Print,
+    SelectTool,
+    HandTool,
+    MarqueeZoom,
+    Copy,
+    Paste(usize, [f64; 2]),
+    AddComment(usize, [f64; 2]),
+    AddBookmark,
+    TakeSnapshot,
+    EditPdf,
+    AddText,
+    AddImage,
+    DeletePage(usize),
+    ExportPdf,
+    Find,
+    DocProperties,
+    FlattenComments,
+}
+
+pub(crate) struct PageMenuPerms {
+    pub can_modify: bool,
+    pub can_assemble: bool,
+    pub can_annotate: bool,
+    pub can_print: bool,
+    pub can_copy: bool,
+    pub can_copy_items: bool,
+    pub can_paste: bool,
+    pub has_annotations: bool,
+}
+
+pub(crate) fn default_page_context_menu(ui: &mut egui::Ui, page: usize, at: [f64; 2], perms: PageMenuPerms, action: &mut Option<PageMenuAction>) {
+    use PageMenuAction as A;
+    // Takes `choice` when `entry` was clicked, and closes the menu.
+    let mut pick = |entry: egui::Response, ui: &mut egui::Ui, choice: PageMenuAction| {
+        if entry.clicked() {
+            *action = Some(choice);
+            ui.close();
+        }
+    };
+    let icon = |ui: &mut egui::Ui, name: &str, tip: &str| crate::icons::button(ui, name, 24.0, false, tip);
+    // Top horizontal icon bar: Rotate CCW, Print, Select tool, Hand tool, Marquee Zoom
+    ui.horizontal(|ui| {
+        ui.spacing_mut().item_spacing.x = 4.0;
+        pick(icon(ui, "rotate-ccw", tl!("Rotate view counterclockwise")), ui, A::RotateCCW);
+        ui.add_enabled_ui(perms.can_print, |ui| pick(icon(ui, "printer", tl!("Print")), ui, A::Print));
+        pick(icon(ui, "mouse-pointer-2", tl!("Select Tool")), ui, A::SelectTool);
+        pick(icon(ui, "hand", tl!("Hand Tool")), ui, A::HandTool);
+        pick(icon(ui, "zoom-in", tl!("Marquee Zoom")), ui, A::MarqueeZoom);
+    });
+
+    ui.separator();
+
+    pick(
+        ui.add_enabled(
+            perms.can_copy_items,
+            egui::Button::new(tl!("Copy")).shortcut_text(crate::commands::shortcut_label(ui.ctx(), crate::commands::COPY)),
+        ),
+        ui,
+        A::Copy,
+    );
+    pick(
+        ui.add_enabled(
+            perms.can_paste,
+            egui::Button::new(tl!("Paste")).shortcut_text(crate::commands::shortcut_label(ui.ctx(), pdfcraft_engine::commands::Shortcut::cmd("V"))),
+        ),
+        ui,
+        A::Paste(page, at),
+    );
+
+    ui.separator();
+
+    pick(ui.add_enabled(perms.can_annotate, egui::Button::new(tl!("Add comment"))), ui, A::AddComment(page, at));
+    if perms.has_annotations {
+        pick(ui.add_enabled(perms.can_modify, egui::Button::new(tl!("Flatten comments"))), ui, A::FlattenComments);
+    }
+    pick(ui.add_enabled(perms.can_assemble, egui::Button::new(tl!("Add bookmark"))), ui, A::AddBookmark);
+    pick(ui.add_enabled(perms.can_copy, egui::Button::new(tl!("Take a snapshot"))), ui, A::TakeSnapshot);
+
+    ui.separator();
+
+    pick(ui.add_enabled(perms.can_modify, egui::Button::new(egui::RichText::new(tl!("Edit this PDF")).strong())), ui, A::EditPdf);
+    pick(ui.add_enabled(perms.can_modify, egui::Button::new(tl!("Add text"))), ui, A::AddText);
+    pick(ui.add_enabled(perms.can_modify, egui::Button::new(tl!("Add image"))), ui, A::AddImage);
+    pick(ui.add_enabled(perms.can_assemble, egui::Button::new(tl!("Delete page"))), ui, A::DeletePage(page));
+    pick(ui.add_enabled(perms.can_copy, egui::Button::new(tl!("Export this PDF"))), ui, A::ExportPdf);
+
+    ui.separator();
+
+    pick(ui.button(tl!("Find text or tools")), ui, A::Find);
+    pick(ui.button(tl!("Rotate view clockwise")), ui, A::RotateCW);
+    pick(ui.button(tl!("Document properties…")), ui, A::DocProperties);
+}
+
 impl DocView {
     /// Whether a middle-button scrolling gesture is active (tests and automation).
     pub fn auto_scrolling(&self) -> bool {
@@ -669,6 +954,7 @@ impl DocView {
             page_heights: info.pages.iter().map(|p| p.height).collect(),
             screen_rects: Vec::new(),
             screen_xforms: Vec::new(),
+            screen_ppp: 1.0,
             viewport_screen: Rect::NOTHING,
             zoom_anchor: None,
             shown: false,
@@ -862,6 +1148,7 @@ struct PageEnv<'a> {
     modal: bool,
     navigation_enabled: bool,
     paper: Color32,
+    show_page_edge_shadows: bool,
     ppp: f32,
     precise_scroll: Vec2,
     prefs: &'a comments::CommentPrefs,
@@ -885,6 +1172,7 @@ struct PageEnv<'a> {
     fill_text_size: f64,
     fill_text_color: [f64; 3],
     today: (i64, u32, u32),
+    can_paste_image: bool,
 }
 
 /// What the page-scroll closure produces for the rest of the frame.
@@ -902,6 +1190,7 @@ struct PageOut {
     open_initials: bool,
     open_signature: bool,
     open_table: Option<(usize, [f64; 4])>,
+    page_action: Option<PageMenuAction>,
     primary_down: bool,
     refused: Option<String>,
     stamp_placed: bool,
@@ -945,6 +1234,70 @@ struct PageSlot {
 
 /// Paints the page's paper, shadow and raster (or why it can't be shown), and asks for the renders
 /// it wants.
+#[allow(clippy::too_many_arguments)]
+fn paint_image_suppressed(
+    xf: &PageXform,
+    painter: &egui::Painter,
+    tex: egui::TextureId,
+    u0: f32,
+    v0: f32,
+    u1: f32,
+    v1: f32,
+    suppress: Option<[f32; 4]>,
+    is_full_page_tex: bool,
+) {
+    let Some([su0, sv0, su1, sv1]) = suppress else {
+        if is_full_page_tex {
+            xf.paint_page_texture_rect(painter, tex, u0, v0, u1, v1);
+        } else {
+            xf.paint_image(painter, tex, u0, v0, u1, v1);
+        }
+        return;
+    };
+    let iu0 = u0.max(su0);
+    let iu1 = u1.min(su1);
+    let iv0 = v0.max(sv0);
+    let iv1 = v1.min(sv1);
+    if iu0 >= iu1 || iv0 >= iv1 {
+        if is_full_page_tex {
+            xf.paint_page_texture_rect(painter, tex, u0, v0, u1, v1);
+        } else {
+            xf.paint_image(painter, tex, u0, v0, u1, v1);
+        }
+        return;
+    }
+    let map_uv = |pu: f32, pv: f32| -> (f32, f32) {
+        if is_full_page_tex {
+            (pu, pv)
+        } else {
+            let du = (u1 - u0).max(1e-6);
+            let dv = (v1 - v0).max(1e-6);
+            ((pu - u0) / du, (pv - v0) / dv)
+        }
+    };
+    let draw_strip = |pu0: f32, pv0: f32, pu1: f32, pv1: f32| {
+        if pu1 <= pu0 || pv1 <= pv0 {
+            return;
+        }
+        let (tu0, tv0) = map_uv(pu0, pv0);
+        let (tu1, tv1) = map_uv(pu1, pv1);
+        xf.paint_image_region(painter, tex, pu0, pv0, pu1, pv1, tu0, tv0, tu1, tv1);
+    };
+
+    if iv0 > v0 {
+        draw_strip(u0, v0, u1, iv0);
+    }
+    if v1 > iv1 {
+        draw_strip(u0, iv1, u1, v1);
+    }
+    if iu0 > u0 {
+        draw_strip(u0, iv0, iu0, iv1);
+    }
+    if u1 > iu1 {
+        draw_strip(iu1, iv0, u1, iv1);
+    }
+}
+
 fn paint_page_surface(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<'_>, slot: &PageSlot) {
     let PageEnv { paper, ppp, scale, t, tag, .. } = frame.env;
     let PageSlot { i, r, xf } = *slot;
@@ -952,7 +1305,7 @@ fn paint_page_surface(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFra
     let info = frame.env.info;
     let painter = ui.painter();
     // Shadows would darken the preceding page when pages touch.
-    if view.show_page_gaps {
+    if view.show_page_gaps && frame.env.show_page_edge_shadows {
         painter.add(egui::epaint::Shadow { offset: [0, 3], blur: 14, spread: 0, color: t.page_shadow }.as_shape(r, CornerRadius::ZERO));
     }
     painter.rect_filled(r, CornerRadius::ZERO, paper);
@@ -987,13 +1340,33 @@ fn paint_page_surface(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFra
             Some(p) => frame.wanted.push((i, tag_scale(p.tag), p.tag, None)),
             None => frame.wanted.push((i, want_scale, want_tag, None)),
         }
+        let doc = frame.env.doc;
+        let active_drag_suppress = if let Some(sel) = view.image_selection.clone()
+            && sel.page == i
+            && sel.drag.is_some()
+        {
+            let images = cached_edit_images(view, doc, i);
+            if let Some(img) = images.get(sel.index) {
+                let obb = ImageObb::from_image(img, &xf, info, i);
+                let uvs = obb.corners().map(|c| xf.screen_to_norm(c));
+                let u0 = uvs.iter().map(|(u, _)| *u).fold(1.0f32, f32::min).clamp(0.0, 1.0);
+                let u1 = uvs.iter().map(|(u, _)| *u).fold(0.0f32, f32::max).clamp(0.0, 1.0);
+                let v0 = uvs.iter().map(|(_, v)| *v).fold(1.0f32, f32::min).clamp(0.0, 1.0);
+                let v1 = uvs.iter().map(|(_, v)| *v).fold(0.0f32, f32::max).clamp(0.0, 1.0);
+                if u1 > u0 && v1 > v0 { Some([u0, v0, u1, v1]) } else { None }
+            } else {
+                None
+            }
+        } else {
+            None
+        };
         match view.pages.get(&i) {
             Some(p) => {
                 if !tiled && p.tag == want_tag {
-                    xf.texel_aligned(p.tex.size(), ppp).paint_image(painter, p.tex.id(), 0.0, 0.0, 1.0, 1.0);
+                    paint_image_suppressed(&xf.texel_aligned(p.tex.size(), ppp), painter, p.tex.id(), 0.0, 0.0, 1.0, 1.0, active_drag_suppress, true);
                 } else {
                     // A backdrop, or a raster at an older scale until the new one arrives.
-                    xf.paint_image(painter, p.tex.id(), 0.0, 0.0, 1.0, 1.0);
+                    paint_image_suppressed(&xf, painter, p.tex.id(), 0.0, 0.0, 1.0, 1.0, active_drag_suppress, true);
                 }
             }
             None => {
@@ -1004,14 +1377,21 @@ fn paint_page_surface(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFra
             }
         }
         if tiled && r.intersects(visible) {
-            paint_page_tiles(ui, view, frame, slot, (pw_pt, ph_pt, max_side));
+            paint_page_tiles(ui, view, frame, slot, (pw_pt, ph_pt, max_side), active_drag_suppress);
         }
     }
 }
 
 /// Paints the tiles of a page too big to draw whole: the tiles of earlier zooms first, stretched,
 /// then the visible tiles of this one, nearest the viewport centre first, asking for those missing.
-fn paint_page_tiles(ui: &egui::Ui, view: &mut DocView, frame: &mut PageFrame<'_>, slot: &PageSlot, (pw_pt, ph_pt, max_side): (f32, f32, f32)) {
+fn paint_page_tiles(
+    ui: &egui::Ui,
+    view: &mut DocView,
+    frame: &mut PageFrame<'_>,
+    slot: &PageSlot,
+    (pw_pt, ph_pt, max_side): (f32, f32, f32),
+    active_drag_suppress: Option<[f32; 4]>,
+) {
     let PageEnv { ppp, scale, tag, .. } = frame.env;
     let PageSlot { i, r, xf } = *slot;
     let visible = frame.visible;
@@ -1040,7 +1420,7 @@ fn paint_page_tiles(ui: &egui::Ui, view: &mut DocView, frame: &mut PageFrame<'_>
         let (ow, oh) = (device_pixels(pw_pt, s) as f32, device_pixels(ph_pt, s) as f32);
         let [w, h] = tex.size();
         let (x, y) = (ox as f32, oy as f32);
-        xf.paint_image(painter, tex.id(), x / ow, y / oh, (x + w as f32) / ow, (y + h as f32) / oh);
+        paint_image_suppressed(&xf, painter, tex.id(), x / ow, y / oh, (x + w as f32) / ow, (y + h as f32) / oh, active_drag_suppress, false);
     }
     // Visible tiles, nearest the viewport centre first: each tile costs a full
     // page interpret, so the workers sharpen what is looked at before the edges.
@@ -1065,13 +1445,16 @@ fn paint_page_tiles(ui: &egui::Ui, view: &mut DocView, frame: &mut PageFrame<'_>
         frame.wanted.push((i, scale, tag, Some(Tile { x, y, w, h })));
         if let Some(tex) = view.tiles.get(&(i, tag, x, y)) {
             let (fw, fh) = (dw as f32, dh as f32);
-            xf.texel_aligned([dw as usize, dh as usize], ppp).paint_image(
+            paint_image_suppressed(
+                &xf.texel_aligned([dw as usize, dh as usize], ppp),
                 painter,
                 tex.id(),
                 x as f32 / fw,
                 y as f32 / fh,
                 (x + w) as f32 / fw,
                 (y + h) as f32 / fh,
+                active_drag_suppress,
+                false,
             );
         }
     }
@@ -1326,9 +1709,18 @@ fn page_tool_input(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<
             info,
             allow_interaction: !others_own_pointer && (matches!(view.router.owner(i), Some(crate::page_router::Owner::Picture { .. })) || !text_used),
         };
-        let image_used = crate::edit_text_ui::image_input(&image_cx, &images, view, &mut frame.out.image_action);
+        let image_used = crate::edit_text_ui::image_input(&image_cx, &images, view);
         !others_own_pointer && (text_used || image_used)
     };
+    if tool == QuickTool::EditText {
+        if others_own_pointer {
+            if ptr.pressed().is_some() || resp.clicked() || resp.secondary_clicked() {
+                view.image_selection = None;
+            }
+        } else {
+            crate::content_ui::sync_image_selection(view, i, &images, added);
+        }
+    }
     let on_link = tool == QuickTool::Link && can_modify && crate::link_ui::page_input(cx, doc_links, view);
     if tool == QuickTool::Select
         && resp.secondary_clicked()
@@ -1366,17 +1758,20 @@ fn edit_inventory(
             l
         }
     };
-    let images = match view.edit_images.get(&i) {
-        Some((g, l)) if *g == generation => l.clone(),
-        _ => {
-            let l = doc.page_images(i);
-            view.edit_images.insert(i, (generation, l.clone()));
-            l
-        }
-    };
+    let images = cached_edit_images(view, doc, i).to_vec();
     (lines, images)
 }
 
+/// Images parsed once per page and document edit generation, shared by painting and menus.
+fn cached_edit_images<'a>(view: &'a mut DocView, doc: &pdfcraft_engine::Document, page: usize) -> &'a [pdfcraft_engine::PageImage] {
+    let generation = doc.edit_generation();
+    let entry = view.edit_images.entry(page).or_insert_with(|| (generation, doc.page_images(page)));
+    if entry.0 != generation {
+        *entry = (generation, doc.page_images(page));
+    }
+    &entry.1
+}
+
 /// What the page modules have under a point on one page, for the page router.
 struct PageHits<'a> {
     page: usize,
@@ -1425,6 +1820,19 @@ impl PageHits<'_> {
             images,
             clip,
         } = *self;
+        // Crop mode owns presses on its page, including the controls beside its
+        // frame. Underlying paragraphs and the empty-page marquee must not take
+        // a crop button's press before the image module receives it.
+        if tool == QuickTool::EditText
+            && can_modify
+            && let Some(selection) = view.image_selection.as_ref().filter(|s| s.page == page && s.crop.is_some())
+        {
+            return vec![crate::page_router::Hit::new(
+                crate::page_router::Owner::Picture { index: selection.index, part: crate::page_router::PicturePart::Body },
+                crate::page_cursor::Layer::Handle,
+                egui::CursorIcon::Default,
+            )];
+        }
         let fields = if preparing {
             crate::prepare::hit(xf, info, page, form, field_tool, prepare_allowed, &view.prepare, p)
         } else if tool == QuickTool::Select {
@@ -1934,6 +2342,7 @@ fn cancel_on_escape(ctx: &egui::Context, view: &mut DocView, ptr: &PagePointer)
     }
 }
 
+#[allow(clippy::cognitive_complexity)]
 fn draw_pages(
     ui: &mut egui::Ui,
     viewport: Rect,
@@ -1967,6 +2376,8 @@ fn draw_pages(
         prefs,
         preparing,
         selection_wheel,
+        ppp,
+        rects,
         single_paging,
         tool,
         unobstructed,
@@ -2009,6 +2420,7 @@ fn draw_pages(
     let origin = resp_rect.min - vec2(0.0, y_shift);
     let visible = viewport.translate(resp_rect.min.to_vec2());
     view.screen_rects.clear();
+    view.screen_ppp = ui.ctx().pixels_per_point();
     view.screen_xforms.clear();
     // The pointer as the pages see it: nothing over them (a dialog from the frame it opens),
     // or a press they hold. The page modules read it rather than egui's raw pointer state.
@@ -2033,6 +2445,51 @@ fn draw_pages(
     if resp.secondary_clicked() {
         // Set again below when the right-click lands on a link.
         view.links.context = None;
+        let mut over_image = false;
+        if tool == QuickTool::EditText {
+            let pointer_pos = ptr.pos;
+            if let Some(p) = pointer_pos {
+                for &page_idx in visible_pages {
+                    let r = snap_to_pixels(rects[page_idx].translate(origin.to_vec2()), ppp);
+                    if !r.intersects(visible) {
+                        continue;
+                    }
+                    let xf =
+                        PageXform { rect: r, rot: view.rotation, pw: info.pages[page_idx].width.max(1.0), ph: info.pages[page_idx].height.max(1.0) };
+                    let images = cached_edit_images(view, doc, page_idx).to_vec();
+                    // Crop controls own the click even when another image overlaps them.
+                    if view.image_selection.as_ref().is_some_and(|s| {
+                        s.page == page_idx
+                            && s.crop
+                                .as_ref()
+                                .zip(images.get(s.index))
+                                .is_some_and(|(crop, img)| crop_contains_point(img, crop, &xf, info, page_idx, p))
+                    }) {
+                        over_image = true;
+                        break;
+                    }
+                    for (idx, img) in images.iter().enumerate().rev() {
+                        let obb = ImageObb::from_image(img, &xf, info, page_idx);
+                        let b = image_screen_rect(img, &xf, info, page_idx);
+                        let selected_crop = view.image_selection.as_ref().is_some_and(|s| s.page == page_idx && s.index == idx && s.crop.is_some());
+                        let hit = if selected_crop { crate::edit_text_ui::quad_contains(obb.corners(), p) } else { obb.contains(b, p) };
+                        if hit {
+                            over_image = true;
+                            if view.image_selection.as_ref().is_none_or(|s| s.page != page_idx || s.index != idx) {
+                                view.image_selection = Some(crate::edit_text_ui::ImageSelection::at(page_idx, idx));
+                            }
+                            break;
+                        }
+                    }
+                    if over_image {
+                        break;
+                    }
+                }
+            }
+        }
+        if !over_image && tool == QuickTool::EditText {
+            view.image_selection = None;
+        }
     }
     let mut frame = PageFrame {
         env: *env,
@@ -2062,20 +2519,22 @@ fn draw_pages(
     let PageOut {
         mut canvas_action,
         clicked_link,
-        mut copy_selected,
+        copy_selected,
         mut field_menu,
         field_placed,
         field_props,
         hover_text: _,
-        image_action,
+        mut image_action,
         open_boxes,
         open_initials,
         open_signature,
         open_table,
+        page_action: _,
         primary_down: _,
         refused,
         stamp_placed,
     } = page_out;
+    let mut page_action: Option<PageMenuAction> = None;
     let painter = ui.painter();
     if calc_order {
         view.calc_order.set_hover_page(calc_hover);
@@ -2127,6 +2586,22 @@ fn draw_pages(
         view.current = current;
     }
     resp.context_menu(|ui| {
+        let is_crop_over_image = tool == QuickTool::EditText
+            && view.image_selection.clone().is_some_and(|sel| {
+                let Some(ref crop) = sel.crop else { return false };
+                let pointer_pos = ptr.pos;
+                let Some(p) = pointer_pos else { return false };
+                let Some((_, xf)) = view.screen_xforms.iter().find(|(page_idx, _)| *page_idx == sel.page).cloned() else { return false };
+                let images = cached_edit_images(view, doc, sel.page).to_vec();
+                let Some(img) = images.get(sel.index) else { return false };
+                crop_contains_point(img, crop, &xf, info, sel.page, p)
+            });
+        if is_crop_over_image {
+            ui.ctx().data_mut(|d| d.insert_temp(crate::edit_text_ui::image_menu_id(), false));
+            egui::Popup::close_all(ui.ctx());
+            ui.close();
+            return;
+        }
         // Preparing a form: the selected field's menu.
         if preparing && let Some((name, wi)) = view.prepare.selected.clone() {
             // Several fields: Align, Center, Distribute, Set Fields to Same Size.
@@ -2195,20 +2670,33 @@ fn draw_pages(
             }
             return;
         }
-        if view.comments.selected.is_none() {
-            let selected = view.selected_text().is_some_and(|t| !t.is_empty());
-            let key = crate::commands::shortcut_label(ui.ctx(), crate::commands::COPY);
-            if ui.add_enabled(can_copy && selected, egui::Button::new(tl!("Copy")).shortcut_text(key)).clicked() {
-                copy_selected = true;
-                ui.close();
-            }
-            ui.separator();
+        let can_paste_image = env.can_paste_image;
+        let is_image_menu = tool == QuickTool::EditText
+            && (ui.ctx().data_mut(|d| d.get_temp::<bool>(crate::edit_text_ui::image_menu_id())).unwrap_or(false)
+                || view.image_selection.clone().is_some_and(|sel| {
+                    let pointer_pos = ptr.pos;
+                    let Some(p) = pointer_pos else { return false };
+                    let Some((_, xf)) = view.screen_xforms.iter().find(|(page_idx, _)| *page_idx == sel.page).cloned() else { return false };
+                    let images = cached_edit_images(view, doc, sel.page).to_vec();
+                    let Some(img) = images.get(sel.index) else { return false };
+                    let obb = ImageObb::from_image(img, &xf, info, sel.page);
+                    let b = image_screen_rect(img, &xf, info, sel.page);
+                    obb.contains(b, p)
+                }));
+        if is_image_menu && let Some(sel) = view.image_selection.clone() {
+            let images = cached_edit_images(view, doc, sel.page).to_vec();
+            let at = view.comments.context_at.map(|(_, at)| at);
+            let rotation = (view.rotation % 360 + info.pages.get(sel.page).map_or(0, |p| p.rotation % 360)) % 360;
+            crate::edit_text_ui::image_context_menu(ui, view, &images, sel.page, sel.index, can_paste_image, &mut image_action, at, rotation);
+            return;
+        }
+        if view.comments.selected.is_some() {
+            canvas_action = comments::context_menu(ui, view, info, &|page, index| doc.annotation_deletable(page, index), prefs, allowed, can_modify);
+            return;
         }
         // Over a picture (and no comment): Copy Image, as in Acrobat's page menu.
         let mut copy_image = None;
-        if view.comments.selected.is_none()
-            && let Some((page, at)) = view.comments.context_at
-        {
+        if let Some((page, at)) = view.comments.context_at {
             // The page's content is parsed once per right-click, not on every frame the menu is open.
             let key = egui::Id::unique("copy-image-under-menu");
             let cached = ui.data(|d| d.get_temp::<(usize, [f64; 2], Option<usize>)>(key)).filter(|c| c.0 == page && c.1 == at);
@@ -2232,9 +2720,28 @@ fn draw_pages(
                 ui.separator();
             }
         }
-        canvas_action =
-            comments::context_menu(ui, view, info, &|page, index| doc.annotation_deletable(page, index), prefs, allowed, can_modify).or(copy_image);
+        let has_copy_image = copy_image.is_some();
+        if copy_image.is_some() {
+            canvas_action = copy_image;
+        }
+        let (page, at) = view.comments.context_at.unwrap_or((view.current, [0.0, 0.0]));
+        let can_copy_items = can_copy && (view.image_selection.is_some() || view.selected_text().is_some() || has_copy_image);
+        let can_paste = can_paste_image && can_modify;
+        let perms = PageMenuPerms {
+            can_modify,
+            can_assemble: doc.allows_assembly(),
+            can_annotate: allowed,
+            can_print: doc.allows_printing(),
+            can_copy,
+            can_copy_items,
+            can_paste,
+            has_annotations: !info.annotations.is_empty(),
+        };
+        default_page_context_menu(ui, page, at, perms, &mut page_action);
     });
+    if !resp.context_menu_opened() {
+        ui.ctx().data_mut(|d| d.insert_temp(crate::edit_text_ui::image_menu_id(), false));
+    }
     *out = PageOut {
         canvas_action,
         clicked_link,
@@ -2248,6 +2755,7 @@ fn draw_pages(
         open_initials,
         open_signature,
         open_table,
+        page_action,
         primary_down: ptr.primary_down,
         refused,
         stamp_placed,
@@ -2358,6 +2866,7 @@ fn read_wheel(ui: &mut egui::Ui, view: &mut DocView, avail: Rect, single_paging:
         // The turn leaves egui's eased copy of the notch to decay for a few frames; it must not
         // scroll the page just shown away from its top (or bottom).
         view.precise_scroll_until = now + 0.25;
+        view.fling.stop();
     }
     // Paging owns the vertical axis in single-page view; leave it to the pager.
     // The rest of a gesture that turned the page is swallowed too, or it would pan the new page
@@ -2874,9 +3383,9 @@ fn pinch_zoom(ui: &egui::Ui, view: &mut DocView, zoom_delta: f32, navigation_rec
 /// The middle-button auto-scroll's delta, and the edge scroll a drawing in progress asks for: the
 /// pointer in a band along any edge (or just past it) scrolls the view that way, so a point
 /// beyond what is shown can be reached without letting go of the tool.
-fn auto_scroll_deltas(ui: &egui::Ui, view: &mut DocView, avail: Rect, unobstructed: bool) -> (Vec2, Vec2) {
+fn auto_scroll_deltas(ui: &egui::Ui, view: &mut DocView, avail: Rect, unobstructed: bool, invert: bool) -> (Vec2, Vec2) {
     let auto_delta = if unobstructed {
-        view.auto_scroll.update(ui, avail, false)
+        view.auto_scroll.update(ui, avail, false, invert)
     } else {
         view.auto_scroll.cancel();
         Vec2::ZERO
@@ -2991,6 +3500,14 @@ fn refine_goto_point(mut scroll: egui::ScrollArea, view: &mut DocView, geometry:
 /// scroll area with this frame's zoom, scrolling, tool input, overlays and render requests.
 pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
     let t = Tokens::get(ui.ctx());
+    let can_paste_key = egui::Id::unique("can-paste-image");
+    let can_paste_image = if ui.input(|i| i.pointer.secondary_pressed()) {
+        let can = app.can_paste_image();
+        ui.data_mut(|d| d.insert_temp(can_paste_key, can));
+        can
+    } else {
+        ui.data(|d| d.get_temp(can_paste_key)).unwrap_or(false)
+    };
     // Keyboard scrolling applies to this frame's page view only, never later.
     let key_scroll = std::mem::take(&mut app.views[index].key_scroll);
     if key_scroll != 0.0 {
@@ -3045,11 +3562,12 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
     let modal = app.modal_open();
     let unobstructed = !modal && !app.palette_open;
     let organize_zoom = app.organize_zoom;
+    let invert_middle = app.invert_middle_drag;
     let view = &mut app.views[index];
     if view.organize {
         // One remembered grid size for every document, kept in the settings.
         view.set_grid_zoom(organize_zoom);
-        organize_grid(view, info, doc.allows_assembly(), doc.dirty, unobstructed, ui, &t);
+        organize_grid(view, doc, unobstructed, app.show_page_edge_shadows, invert_middle, ui, &t);
         app.organize_zoom = view.grid_zoom();
         return;
     }
@@ -3069,7 +3587,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
     let present = presentation_click_state(ui, view, navigation_rect, navigation_enabled && app.quick_tool == QuickTool::Select);
     pinch_zoom(ui, view, zoom_delta, navigation_rect, navigation_enabled);
     view.viewport_screen = avail;
-    let (auto_delta, edge_delta) = auto_scroll_deltas(ui, view, avail, unobstructed);
+    let (auto_delta, edge_delta) = auto_scroll_deltas(ui, view, avail, unobstructed, invert_middle);
 
     let content_w = view.content_width(info, avail.width());
     let rects = view.layout(info, content_w, ui.ctx().pixels_per_point());
@@ -3204,6 +3722,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         modal,
         navigation_enabled,
         paper,
+        show_page_edge_shadows: app.show_page_edge_shadows,
         ppp,
         precise_scroll,
         prefs,
@@ -3227,9 +3746,10 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         fill_text_size: app.fill_text_size,
         fill_text_color: app.fill_text_color,
         today,
+        can_paste_image,
     };
     let mut page_out = PageOut::default();
-    let out = page_scroll(ui, scroll, egui::Id::unique(("page-view-scope", view.id)), |ui, viewport| {
+    let out = page_scroll(ui, scroll, egui::Id::unique(("page-view-scope", view.id)), app.show_page_edge_shadows, |ui, viewport| {
         draw_pages(ui, viewport, view, &env, &mut page_out, &mut app.signature_preview)
     });
     let PageOut {
@@ -3245,6 +3765,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         open_initials,
         open_signature,
         open_table,
+        page_action,
         primary_down,
         mut refused,
         stamp_placed,
@@ -3284,8 +3805,12 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
     if preparing {
         crate::prepare::keys(ui.ctx(), view);
     }
+    if tool != QuickTool::EditText {
+        view.image_selection = None;
+        crate::content_ui::release_image_selection(view, &added);
+    }
     if editing_content {
-        crate::content_ui::keys(ui.ctx(), view);
+        crate::content_ui::keys(ui.ctx(), view, tool == QuickTool::EditText);
     }
     if tool == QuickTool::Link {
         crate::link_ui::keys(ui.ctx(), view);
@@ -3331,6 +3856,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         field_props,
         field_menu,
         image_action,
+        page_action,
         refused,
         open_signature,
         open_initials,
@@ -3352,6 +3878,7 @@ struct FrameRequests {
     field_props: Option<(String, usize)>,
     field_menu: Option<FieldMenu>,
     image_action: Option<crate::edit_text_ui::ImageAction>,
+    page_action: Option<PageMenuAction>,
     refused: Option<String>,
     open_signature: bool,
     open_initials: bool,
@@ -3366,12 +3893,14 @@ struct FrameRequests {
 }
 
 /// Opens the dialogs and runs the app commands the frame asked for.
+#[allow(clippy::cognitive_complexity)]
 fn apply_frame_requests(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui, requests: FrameRequests) {
     let FrameRequests {
         open_props,
         field_props,
         field_menu,
         image_action,
+        page_action,
         refused,
         open_signature,
         open_initials,
@@ -3435,12 +3964,109 @@ fn apply_frame_requests(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui,
         }
         Some(crate::edit_text_ui::ImageAction::CopyFile(page, index)) => app.copy_page_image_file(page, index),
         Some(crate::edit_text_ui::ImageAction::Cut(page, image)) => {
-            app.views[index].image_selection = None;
             app.cut_page_image(page, image);
         }
+        Some(crate::edit_text_ui::ImageAction::Paste(page, at)) => {
+            if let Some(pt) = at {
+                app.paste_image_at(page, pt);
+            } else {
+                app.paste_image(page, None);
+            }
+        }
+        Some(crate::edit_text_ui::ImageAction::DrawFreehand) => {
+            app.quick_tool = crate::QuickTool::Comment(crate::comments::CommentTool::Ink);
+        }
         Some(crate::edit_text_ui::ImageAction::Redact(page, index)) => app.redact_page_image(page, index),
         Some(crate::edit_text_ui::ImageAction::Link(page, index)) => app.link_page_image(page, index),
         Some(crate::edit_text_ui::ImageAction::Recognize(page)) => app.recognize_text_on_page(page),
+        Some(crate::edit_text_ui::ImageAction::AddComment(page, i)) => {
+            if let Some(d) = app.session.get(app.views[index].id) {
+                let images = d.page_images(page);
+                if let Some(img) = images.get(i) {
+                    let r = img.visible_rect.unwrap_or(img.rect);
+                    let center = [(r[0] + r[2]) / 2.0, (r[1] + r[3]) / 2.0];
+                    app.views[index].comments.context_at = Some((page, center));
+                    app.views[index].comments.composer = Some(crate::comments::Composer {
+                        page,
+                        at: center,
+                        kind: crate::comments::ComposerKind::Note,
+                        text: String::new(),
+                        focus: true,
+                    });
+                }
+            }
+        }
+        None => {}
+    }
+    match page_action {
+        Some(PageMenuAction::Copy) => {
+            if let Some(sel) = app.views[index].image_selection.clone() {
+                app.copy_page_image(sel.page, sel.index);
+            } else if app.views[index].selected_text().is_some() {
+                app.execute("edit.copy");
+            } else if let Some((page, at)) = app.views[index].comments.context_at
+                && let Some(doc) = app.session.get(app.views[index].id)
+                && let Some(image) = doc.page_image_at(page, at)
+            {
+                app.copy_page_image(page, image);
+            }
+        }
+        Some(PageMenuAction::Paste(page, at)) => {
+            app.paste_image_at(page, at);
+        }
+        Some(PageMenuAction::RotateCCW) => {
+            app.views[index].rotate_view(false);
+        }
+        Some(PageMenuAction::RotateCW) => {
+            app.views[index].rotate_view(true);
+        }
+        Some(PageMenuAction::Print) => {
+            app.open_print();
+        }
+        Some(PageMenuAction::SelectTool) => {
+            app.quick_tool = QuickTool::Select;
+        }
+        Some(PageMenuAction::HandTool) => {
+            app.quick_tool = QuickTool::Hand;
+        }
+        Some(PageMenuAction::MarqueeZoom) => {
+            app.quick_tool = QuickTool::MarqueeZoom;
+        }
+        Some(PageMenuAction::AddComment(page, at)) => {
+            app.views[index].comments.composer =
+                Some(crate::comments::Composer { page, at, kind: crate::comments::ComposerKind::Note, text: String::new(), focus: true });
+        }
+        Some(PageMenuAction::FlattenComments) => {
+            app.views[index].comments.selected = None;
+            app.views[index].pending_edit = Some(pdfcraft_engine::Edit::Flatten { comments: true, fields: false });
+        }
+        Some(PageMenuAction::AddBookmark) => {
+            app.bookmark_action(crate::panels::BmAction::New);
+        }
+        Some(PageMenuAction::TakeSnapshot) => {
+            app.quick_tool = QuickTool::Snapshot;
+        }
+        Some(PageMenuAction::EditPdf) => {
+            app.quick_tool = QuickTool::EditText;
+        }
+        Some(PageMenuAction::AddText) => {
+            app.quick_tool = QuickTool::AddText;
+        }
+        Some(PageMenuAction::AddImage) => {
+            app.add_image_dialog();
+        }
+        Some(PageMenuAction::DeletePage(page)) => {
+            app.views[index].pending_edit = Some(pdfcraft_engine::Edit::DeletePages { pages: vec![page] });
+        }
+        Some(PageMenuAction::ExportPdf) => {
+            app.select_tool("export");
+        }
+        Some(PageMenuAction::Find) => {
+            app.views[index].open_find();
+        }
+        Some(PageMenuAction::DocProperties) => {
+            app.dialog = Some(crate::Dialog::Properties(crate::PropsTab::Description));
+        }
         None => {}
     }
     if let Some(why) = refused {
@@ -3479,7 +4105,9 @@ fn apply_frame_requests(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui,
     // Read mode hides the tools (#2646), and full screen is the page and nothing else (#1459);
     // the quick tools come back with the window.
     if app.mode != crate::Mode::Read && !app.full_screen {
-        quick_bar(app, avail, ui);
+        // The page nearest the left edge, whose margin the bar sits in.
+        let page_left = app.views[index].screen_rects.iter().map(|(_, r)| r.left()).reduce(f32::min);
+        quick_bar(app, avail, page_left, ui);
     }
     if let Some((source, file, destination)) = remote_open {
         app.open_remote_link(source, file, destination);
diff --git a/crates/ui-egui/src/canvas/area.rs b/crates/ui-egui/src/canvas/area.rs
index 068661ea5f..0d934dc8c9 100644
--- a/crates/ui-egui/src/canvas/area.rs
+++ b/crates/ui-egui/src/canvas/area.rs
@@ -32,14 +32,22 @@ pub(super) const SUPPRESS_SECS: f64 = 0.25;
 /// Short rolling extension while egui still has an unprocessed wheel tail.
 pub(super) const SUPPRESS_TAIL_SECS: f64 = 0.05;
 
-// Keep the viewer's scroll identity tied to the document instead of its parent UI.
+// Keep the viewer's scroll identity tied to the document instead of its parent UI. Without
+// `fades` (Show Page Edge Shadows off) the viewport-edge gradients are off for this area only.
 pub(super) fn page_scroll<R>(
     ui: &mut egui::Ui,
     scroll: egui::ScrollArea,
     id: egui::Id,
+    fades: bool,
     draw: impl FnOnce(&mut egui::Ui, egui::Rect) -> R,
 ) -> egui::scroll_area::ScrollAreaOutput<R> {
-    ui.scope_builder(egui::UiBuilder::new().scope_id(id), |ui| scroll.show_viewport(ui, draw)).inner
+    let strength = ui.spacing().scroll.fade.strength;
+    if !fades {
+        ui.spacing_mut().scroll.fade.strength = 0.0;
+    }
+    let out = ui.scope_builder(egui::UiBuilder::new().scope_id(id), |ui| scroll.show_viewport(ui, draw)).inner;
+    ui.spacing_mut().scroll.fade.strength = strength;
+    out
 }
 
 /// Run a push button's action (the ones that need no JavaScript engine).
diff --git a/crates/ui-egui/src/canvas/autoscroll.rs b/crates/ui-egui/src/canvas/autoscroll.rs
index 14751ffc5c..1f4cd62c5d 100644
--- a/crates/ui-egui/src/canvas/autoscroll.rs
+++ b/crates/ui-egui/src/canvas/autoscroll.rs
@@ -46,15 +46,18 @@ impl AutoScroll {
     }
 
     /// Run before the document's widgets. Starting is restricted to the unobstructed viewport;
-    /// once started, moving outside that viewport still controls the speed.
-    pub(crate) fn update(&mut self, ui: &egui::Ui, viewport: egui::Rect, organize: bool) -> Vec2 {
-        self.update_for_platform(ui, viewport, organize, cfg!(target_os = "linux"))
+    /// once started, moving outside that viewport still controls the speed. `invert` is
+    /// Preferences ▸ Invert middle-button drag: the returned delta scrolls the other way.
+    pub(crate) fn update(&mut self, ui: &egui::Ui, viewport: egui::Rect, organize: bool, invert: bool) -> Vec2 {
+        self.update_for_platform(ui, viewport, organize, cfg!(target_os = "linux"), invert)
     }
 
-    fn update_for_platform(&mut self, ui: &egui::Ui, viewport: egui::Rect, organize: bool, supported: bool) -> Vec2 {
-        if !supported {
-            return self.update_drag(ui, viewport);
-        }
+    fn update_for_platform(&mut self, ui: &egui::Ui, viewport: egui::Rect, organize: bool, supported: bool, invert: bool) -> Vec2 {
+        let delta = if supported { self.update_latched(ui, viewport, organize) } else { self.update_drag(ui, viewport) };
+        oriented(delta, invert)
+    }
+
+    fn update_latched(&mut self, ui: &egui::Ui, viewport: egui::Rect, organize: bool) -> Vec2 {
         let ctx = ui.ctx();
         let (pointer, middle_press, middle_down, middle_released, cancel, cancel_button, dt) = ctx.input(|i| {
             let cancel_button = [PointerButton::Primary, PointerButton::Secondary, PointerButton::Extra1, PointerButton::Extra2]
@@ -237,6 +240,11 @@ pub(crate) fn edge_delta(y: f32, viewport: egui::Rect, dt: f32) -> f32 {
     -distance.clamp(-MAX_DISPLACEMENT, MAX_DISPLACEMENT) * EDGE_SPEED * dt.clamp(0.0, 0.05)
 }
 
+/// The middle button's delta, reversed when the user inverted it.
+fn oriented(delta: Vec2, invert: bool) -> Vec2 {
+    if invert { -delta } else { delta }
+}
+
 fn scroll_delta(displacement: f32, dt: f32) -> f32 {
     if !displacement.is_finite() || !dt.is_finite() {
         return 0.0;
@@ -261,10 +269,15 @@ mod tests {
 
     /// Run one frame of the non-Linux path; `check` sees the pan delta inside the frame.
     fn drag_frame(ctx: &Context, scroll: &mut AutoScroll, events: Vec<Event>, focused: bool, check: impl Fn(&AutoScroll, Vec2)) {
+        frame(ctx, scroll, events, focused, (false, false), check);
+    }
+
+    /// Run one frame; `mode` is (latched auto-scroll supported, inverted).
+    fn frame(ctx: &Context, scroll: &mut AutoScroll, events: Vec<Event>, focused: bool, mode: (bool, bool), check: impl Fn(&AutoScroll, Vec2)) {
         let mut output = ctx.run_ui(
             egui::RawInput { screen_rect: Some(egui::Rect::from_min_size(Pos2::ZERO, vec2(400.0, 400.0))), events, focused, ..Default::default() },
             |ui| {
-                let delta = scroll.update_for_platform(ui, ui.max_rect(), false, false);
+                let delta = scroll.update_for_platform(ui, ui.max_rect(), false, mode.0, mode.1);
                 check(scroll, delta);
             },
         );
@@ -272,6 +285,40 @@ mod tests {
         output.textures_delta.clear();
     }
 
+    /// The pan delta after pressing at `p` and moving the pointer by `by`.
+    fn pan_by(by: Vec2, invert: bool) -> Vec2 {
+        let (ctx, mut scroll, p) = (Context::default(), AutoScroll::default(), egui::pos2(100.0, 100.0));
+        frame(&ctx, &mut scroll, vec![], true, (false, invert), |_, _| {});
+        frame(&ctx, &mut scroll, vec![Event::PointerMoved(p), middle(p, true)], true, (false, invert), |_, _| {});
+        let moved = std::cell::Cell::new(Vec2::ZERO);
+        frame(&ctx, &mut scroll, vec![Event::PointerMoved(p + by)], true, (false, invert), |_, d| moved.set(d));
+        moved.get()
+    }
+
+    /// The auto-scroll delta in the frame after latching at `p`, with the pointer `dy` below it.
+    fn latched_by(dy: f32, invert: bool) -> Vec2 {
+        let (ctx, mut scroll, p) = (Context::default(), AutoScroll::default(), egui::pos2(100.0, 100.0));
+        frame(&ctx, &mut scroll, vec![], true, (true, invert), |_, _| {});
+        frame(&ctx, &mut scroll, vec![Event::PointerMoved(p), middle(p, true), middle(p, false)], true, (true, invert), |_, _| {});
+        let moved = std::cell::Cell::new(Vec2::ZERO);
+        frame(&ctx, &mut scroll, vec![Event::PointerMoved(p + vec2(0.0, dy))], true, (true, invert), |s, d| {
+            assert!(s.active(), "the click latched auto-scroll");
+            moved.set(d);
+        });
+        moved.get()
+    }
+
+    #[test]
+    fn inverting_the_middle_button_reverses_the_pan_and_the_auto_scroll() {
+        let by = vec2(-30.0, 40.0);
+        assert_eq!(pan_by(by, false), by, "by default the page follows the pointer");
+        assert_eq!(pan_by(by, true), -by, "inverted, the view moves the way the pointer goes");
+        let (normal, inverted) = (latched_by(60.0, false), latched_by(60.0, true));
+        assert!(normal.y < 0.0, "by default, below the anchor scrolls down: {normal:?}");
+        assert_eq!(inverted, -normal, "inverted, the same distance scrolls the other way");
+        assert_eq!(latched_by(10.0, true), Vec2::ZERO, "the dead zone still holds still");
+    }
+
     #[test]
     fn middle_drag_pans_one_to_one_and_owns_the_button_until_release() {
         let ctx = Context::default();
diff --git a/crates/ui-egui/src/canvas/bars.rs b/crates/ui-egui/src/canvas/bars.rs
index 2472366672..dd3fe8c498 100644
--- a/crates/ui-egui/src/canvas/bars.rs
+++ b/crates/ui-egui/src/canvas/bars.rs
@@ -1,7 +1,4 @@
-use super::{
-    Color32, CornerRadius, DocInfo, DocView, Edit, PdfCraftApp, Pos2, QuickTool, Rect, Sense, SnapshotKind, Stroke, Tokens, comments, icons, theme,
-    vec2,
-};
+use super::{Color32, CornerRadius, DocInfo, DocView, PdfCraftApp, Pos2, Rect, Sense, SnapshotKind, Stroke, Tokens, icons, vec2};
 
 /// Whether `p` lies in the bottom-left quadrant of `area`, where the page size shows (#1855).
 pub(super) fn in_size_hint_zone(area: Rect, p: Pos2) -> bool {
@@ -276,223 +273,57 @@ fn notice_bar(ui: &mut egui::Ui, t: &Tokens, icon: &str, icon_color: Color32, te
     });
 }
 
-/// The floating quick-action bar at the left edge of the document area.
-pub(super) fn quick_bar(app: &mut PdfCraftApp, area: Rect, ui: &mut egui::Ui) {
-    let t = Tokens::get(ui.ctx());
-    let pos = area.left_top() + vec2(14.0, 14.0);
-    egui::Area::new(egui::Id::unique("quick-bar")).order(egui::Order::Middle).fixed_pos(pos).show(ui.ctx(), |ui| {
-        egui::Frame::NONE
-            .fill(t.card)
-            .stroke(Stroke::new(1.0, t.border))
-            .corner_radius(CornerRadius::same(12))
-            .shadow(egui::Shadow { offset: [0, 4], blur: 16, spread: 0, color: Color32::from_black_alpha(if t.dark() { 100 } else { 28 }) })
-            .inner_margin(egui::Margin::same(6))
-            .show(ui, |ui| {
-                ui.spacing_mut().item_spacing.y = 2.0;
-                ui.vertical(|ui| {
-                    if icons::button(ui, "mouse-pointer-2", 32.0, app.quick_tool == QuickTool::Select, tl!("Select (V)")).clicked() {
-                        app.quick_tool = QuickTool::Select;
-                    }
-                    if icons::button(ui, "hand", 32.0, app.quick_tool == QuickTool::Hand, tl!("Hand (H)")).clicked() {
-                        app.quick_tool = QuickTool::Hand;
-                    }
-                    // Comment ▸, Highlight ▸, Draw ▸ (Acrobat's comment toolbar groups). Clicking a
-                    // group selects its last-used tool; clicking it again opens the flyout.
-                    for g in 0..comments::GROUPS.len() {
-                        let current = app.comment_prefs.group_tool[g];
-                        let active = matches!(app.quick_tool, QuickTool::Comment(t) if t.group() == g);
-                        let resp = icons::button(ui, current.icon(), 32.0, active, tl!(current.label()));
-                        // A small corner triangle marks the flyout.
-                        let r = resp.rect;
-                        let tri = [r.right_bottom() + vec2(-4.0, -4.0), r.right_bottom() + vec2(-9.0, -4.0), r.right_bottom() + vec2(-4.0, -9.0)];
-                        ui.painter().add(egui::Shape::convex_polygon(tri.to_vec(), if active { t.accent } else { t.text_faint }, Stroke::NONE));
-                        let open = (resp.clicked() && active) || resp.secondary_clicked();
-                        if resp.clicked() && !active {
-                            app.execute(current.command());
-                        }
-                        egui::Popup::menu(&resp)
-                            .open_memory(open.then_some(egui::SetOpenCommand::Toggle))
-                            .align(egui::RectAlign::RIGHT_START)
-                            .gap(6.0)
-                            .show(|ui| {
-                                for tool in comments::GROUPS[g] {
-                                    let on = app.quick_tool == QuickTool::Comment(*tool);
-                                    let (row, click) = ui.allocate_exact_size(vec2(180.0, 28.0), Sense::click());
-                                    let press = theme::Press::track(ui, &click);
-                                    press.wash(ui, row, 4, on);
-                                    let body = row.translate(press.offset());
-                                    icons::paint(ui, Rect::from_min_size(body.min + vec2(8.0, 6.0), vec2(16.0, 16.0)), tool.icon(), 16.0, t.text);
-                                    let reserve = if on { 28.0 } else { 8.0 };
-                                    crate::widgets::paint_left(
-                                        ui,
-                                        body.left_center() + vec2(34.0, 0.0),
-                                        tl!(tool.label()),
-                                        theme::regular(13.0),
-                                        t.text,
-                                        (row.width() - 34.0 - reserve).max(0.0),
-                                    );
-                                    if on {
-                                        icons::paint(
-                                            ui,
-                                            Rect::from_min_size(body.right_top() + vec2(-24.0, 7.0), vec2(14.0, 14.0)),
-                                            "check",
-                                            14.0,
-                                            t.accent,
-                                        );
-                                    }
-                                    let click = theme::hand(click);
-                                    let info = tl!(tool.label()).to_string();
-                                    click.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, on, info.clone()));
-                                    if click.clicked() {
-                                        app.execute(tool.command());
-                                        ui.close();
-                                    }
-                                }
-                            });
-                    }
-                    // Edit text & images, while the Edit workspace is open (Acrobat's Edit toolbar)
-                    // or the tool is in use.
-                    if app.mode == crate::Mode::Edit || app.quick_tool == QuickTool::EditText {
-                        let on = app.quick_tool == QuickTool::EditText;
-                        if icons::button(ui, "text-cursor-input", 32.0, on, tl!("Edit text & images")).clicked() {
-                            if on {
-                                app.put_down_edit_text();
-                            } else {
-                                app.quick_tool = QuickTool::EditText;
-                            }
-                        }
-                    }
-                    // Fill & Sign ▸ (text, marks, date, signature).
-                    let current_fill = match app.quick_tool {
-                        QuickTool::Fill(f) => Some(f),
-                        _ => None,
-                    };
-                    let shown = current_fill.unwrap_or(crate::fill_sign::FillTool::Text);
-                    let resp = icons::button(
-                        ui,
-                        if current_fill.is_some() { shown.icon() } else { "pen-line" },
-                        32.0,
-                        current_fill.is_some(),
-                        tl!("Fill & Sign"),
-                    );
-                    let r = resp.rect;
-                    let tri = [r.right_bottom() + vec2(-4.0, -4.0), r.right_bottom() + vec2(-9.0, -4.0), r.right_bottom() + vec2(-4.0, -9.0)];
-                    ui.painter().add(egui::Shape::convex_polygon(
-                        tri.to_vec(),
-                        if current_fill.is_some() { t.accent } else { t.text_faint },
-                        Stroke::NONE,
-                    ));
-                    if resp.clicked() && current_fill.is_none() {
-                        app.execute(shown.command());
-                    }
-                    let open = (resp.clicked() && current_fill.is_some()) || resp.secondary_clicked();
-                    egui::Popup::menu(&resp)
-                        .open_memory(open.then_some(egui::SetOpenCommand::Toggle))
-                        .align(egui::RectAlign::RIGHT_START)
-                        .gap(6.0)
-                        .show(|ui| {
-                            for tool in crate::fill_sign::FILL_TOOLS {
-                                if matches!(tool, crate::fill_sign::FillTool::Signature | crate::fill_sign::FillTool::Initials) {
-                                    continue;
-                                }
-                                let on = current_fill == Some(tool);
-                                let (row, click) = ui.allocate_exact_size(vec2(180.0, 28.0), Sense::click());
-                                let press = theme::Press::track(ui, &click);
-                                press.wash(ui, row, 4, on);
-                                let body = row.translate(press.offset());
-                                icons::paint(ui, Rect::from_min_size(body.min + vec2(8.0, 6.0), vec2(16.0, 16.0)), tool.icon(), 16.0, t.text);
-                                let reserve = if on { 28.0 } else { 8.0 };
-                                crate::widgets::paint_left(
-                                    ui,
-                                    body.left_center() + vec2(34.0, 0.0),
-                                    tl!(tool.label()),
-                                    theme::regular(13.0),
-                                    t.text,
-                                    (row.width() - 34.0 - reserve).max(0.0),
-                                );
-                                if on {
-                                    icons::paint(
-                                        ui,
-                                        Rect::from_min_size(body.right_top() + vec2(-24.0, 7.0), vec2(14.0, 14.0)),
-                                        "check",
-                                        14.0,
-                                        t.accent,
-                                    );
-                                }
-                                let click = theme::hand(click);
-                                let info = tl!(tool.label()).to_string();
-                                click.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, on, info.clone()));
-                                if click.clicked() {
-                                    app.execute(tool.command());
-                                    ui.close();
-                                }
-                            }
-                            ui.separator();
-                            if let Some(command) = crate::fill_sign::signature_entries(ui, app, &t) {
-                                app.execute(command);
-                                ui.close();
-                            }
-                        });
-                    if matches!(current_fill, Some(crate::fill_sign::FillTool::Text | crate::fill_sign::FillTool::Date)) {
-                        ui.label(tl!("Font size:"));
-                        let size = ui.add(
-                            egui::DragValue::new(&mut app.fill_text_size)
-                                .range(crate::fill_sign::MIN_TEXT_SIZE..=crate::fill_sign::MAX_TEXT_SIZE)
-                                .speed(0.25)
-                                .suffix(" pt"),
-                        );
-                        // #1274: the size also applies to the Fill & Sign text that is selected,
-                        // once per change (a typed value, or the end of a drag), so a drag adds
-                        // one undo step and not one per frame.
-                        if ((size.changed() && !size.dragged()) || size.drag_stopped())
-                            && let Some((index, id)) = app.active_ids()
-                            && let Some((page, annotation)) = app.views.get(index).and_then(|view| view.comments.selected)
-                            && app.session.get(id).is_some_and(|doc| {
-                                doc.allows_annotation()
-                                    && doc
-                                        .info
-                                        .annotations
-                                        .iter()
-                                        .any(|a| a.page == page && a.index == annotation && a.fill_sign && a.subtype == "FreeText" && !a.locked)
-                            })
-                        {
-                            app.apply_edit(Edit::FontSizeAnnotation { page, index: annotation, size: app.fill_text_size });
-                        }
-                    }
-                    if matches!(current_fill, Some(crate::fill_sign::FillTool::Text | crate::fill_sign::FillTool::Date)) {
-                        ui.menu_button(tl!("Colour"), |ui| {
-                            if let Some(color) = comments::swatch_grid(ui, Some(app.fill_text_color)) {
-                                app.fill_text_color = color;
-                                ui.close();
-                            }
-                        });
-                    }
-                    if let QuickTool::Comment(tool) = app.quick_tool {
-                        let (r, _) = ui.allocate_exact_size(vec2(32.0, 9.0), Sense::hover());
-                        ui.painter().hline(r.x_range().shrink(6.0), r.center().y, Stroke::new(1.0, t.divider));
-                        if let Some(color) = comments::quick_bar_controls(ui, tool, &mut app.comment_prefs)
-                            && let Some((index, id)) = app.active_ids()
-                            && let Some((page, annotation)) = app.views.get(index).and_then(|view| view.comments.selected)
-                            && app.session.get(id).is_some_and(|doc| {
-                                doc.allows_annotation()
-                                    && doc
-                                        .info
-                                        .annotations
-                                        .iter()
-                                        .any(|a| a.page == page && a.index == annotation && !a.is_reply() && comments::made_by(a, tool))
-                            })
-                        {
-                            app.apply_edit(Edit::StyleAnnotation {
-                                page,
-                                index: annotation,
-                                color: Some(color),
-                                opacity: None,
-                                width: None,
-                                endings: None,
-                            });
-                        }
-                    }
-                });
-            });
-    });
+/// The bar's narrowest form: one 32 pt button, 6 pt margins and a 1 pt border each side.
+pub(crate) const QUICK_BAR_WIDTH: f32 = 46.0;
+pub(crate) const QUICK_BAR_EDGE: f32 = 14.0;
+
+/// How far from the side panel the quick-action bar stands, given the width of the margin between
+/// the panel and the page and the bar's own width: centred in the margin when it holds the bar,
+/// else 14 pt in (a page filling the width). With no page on screen the caller passes a margin of 0,
+/// which is 14 pt too.
+pub(crate) fn quick_bar_offset(margin: f32, width: f32) -> f32 {
+    // shortcut: centred in at most 100 pt of margin, so a wide margin keeps the bar by the panel.
+    // `f32::min` returns the other operand for NaN, which would pass the fit check below.
+    let margin = if margin.is_nan() { 0.0 } else { margin.min(100.0) };
+    if margin >= width + 2.0 * 8.0 { (margin - width) / 2.0 } else { QUICK_BAR_EDGE }
+}
+
+/// The unified quick-action bar and hotbar in the margin or docked to an edge.
+pub(super) fn quick_bar(app: &mut PdfCraftApp, area: Rect, page_left: Option<f32>, ui: &mut egui::Ui) {
+    crate::hotbar::show(app, area, page_left, ui);
+}
+
+#[cfg(test)]
+mod tests {
+    use super::quick_bar_offset;
+
+    #[test]
+    fn the_quick_bar_centres_in_the_margin_that_holds_it() {
+        assert_eq!(quick_bar_offset(72.0, 46.0), 13.0);
+        assert_eq!(quick_bar_offset(62.0, 46.0), 8.0);
+        // A wide margin centres in its first 100 pt, not all of it.
+        assert_eq!(quick_bar_offset(400.0, 46.0), 27.0);
+    }
+
+    #[test]
+    fn the_margin_that_just_holds_the_bar_centres_and_a_point_less_does_not() {
+        // 46 pt of bar and 8 pt to spare each side: 62 pt.
+        assert_eq!(quick_bar_offset(62.0, 46.0), 8.0);
+        assert_eq!(quick_bar_offset(61.0, 46.0), 14.0);
+        assert_eq!(quick_bar_offset(1000.0, 46.0), 27.0);
+    }
+
+    #[test]
+    fn a_wider_quick_bar_centres_by_its_own_width_and_needs_a_wider_margin() {
+        // Fill & Sign's Text tool widens the bar to 70 pt: it centres by that, and 72 pt no longer holds it.
+        assert_eq!(quick_bar_offset(120.0, 70.0), 15.0);
+        assert_eq!(quick_bar_offset(72.0, 70.0), 14.0);
+    }
+
+    #[test]
+    fn the_quick_bar_keeps_14_pt_in_when_the_margin_cannot_hold_it() {
+        for margin in [61.9, 30.0, 0.0, -50.0, f32::NEG_INFINITY, f32::NAN] {
+            assert_eq!(quick_bar_offset(margin, 46.0), 14.0, "{margin}");
+        }
+    }
 }
diff --git a/crates/ui-egui/src/canvas/cache.rs b/crates/ui-egui/src/canvas/cache.rs
index a0ad8fb335..4b6f6c2e42 100644
--- a/crates/ui-egui/src/canvas/cache.rs
+++ b/crates/ui-egui/src/canvas/cache.rs
@@ -239,6 +239,12 @@ impl DocView {
         self.texts.get(&page).cloned()
     }
 
+    /// Whether `page`'s text layer has arrived from the renderer. Selecting text, the I-beam and
+    /// find matches on a page all wait for it (tests and automation).
+    pub fn has_page_text(&self, page: usize) -> bool {
+        self.texts.contains_key(&page)
+    }
+
     pub fn thumb(&self, page: usize) -> Option<&TextureHandle> {
         self.thumbs.get(&page).map(|t| &t.tex)
     }
diff --git a/crates/ui-egui/src/canvas/image_pick.rs b/crates/ui-egui/src/canvas/image_pick.rs
index 403e9836c0..cc938170da 100644
--- a/crates/ui-egui/src/canvas/image_pick.rs
+++ b/crates/ui-egui/src/canvas/image_pick.rs
@@ -46,8 +46,16 @@ pub(crate) fn page_input(
     let u = info_page.view_to_user(vx, vy);
     let at = [f64::from(u[0]), f64::from(u[1])];
     let generation = doc.edit_generation();
-    view.picked_image =
-        doc.page_image_at(page, at).and_then(|index| doc.page_images(page).get(index).map(|i| PickedImage { page, index, rect: i.rect, generation }));
+    view.picked_image = doc.page_image_at(page, at).and_then(|index| {
+        doc.page_images(page).get(index).and_then(|i| {
+            let screen_rect = crate::canvas::image_screen_rect(i, xf, info, page);
+            if screen_rect.is_positive() && screen_rect.contains(p) {
+                Some(PickedImage { page, index, rect: crate::canvas::image_selectable_bounds(i), generation })
+            } else {
+                None
+            }
+        })
+    });
 }
 
 /// Forget the selected picture once the document has been edited since it was picked: Edit text &
@@ -71,7 +79,7 @@ pub(crate) fn paint(painter: &egui::Painter, xf: &PageXform, page: usize, info:
 }
 
 /// A file name without characters file systems refuse.
-fn safe_name(s: &str) -> String {
+pub(crate) fn safe_name(s: &str) -> String {
     let cleaned: String = s.chars().map(|c| if c.is_control() || r#"/\:*?"<>|"#.contains(c) { '_' } else { c }).take(80).collect();
     let cleaned = cleaned.trim().trim_matches('.').to_string();
     if cleaned.is_empty() { "PdfCraft".into() } else { cleaned }
@@ -171,7 +179,8 @@ impl PdfCraftApp {
             return;
         }
         // The document may have changed since the click: the same picture must still be there.
-        let current = self.session.get(self.views[i].id).and_then(|d| d.page_images(picked.page).get(picked.index).map(|im| im.rect));
+        let current =
+            self.session.get(self.views[i].id).and_then(|d| d.page_images(picked.page).get(picked.index).map(crate::canvas::image_selectable_bounds));
         if current == Some(picked.rect) {
             self.copy_page_image_file(picked.page, picked.index);
         } else {
@@ -195,6 +204,7 @@ impl PdfCraftApp {
         let copied = file.and_then(|(ext, bytes)| {
             let name = format!("{stem} p{} img{}.{ext}", page.saturating_add(1), index.saturating_add(1));
             self.put_file_on_clipboard(&name, &bytes)?;
+            self.last_copied_image = None;
             self.last_copied_file = Some((name, bytes));
             Ok(ext)
         });
@@ -213,7 +223,7 @@ impl PdfCraftApp {
         }
         let dir = clipboard_dir().ok_or("there is no folder for the copied file")?;
         let path = write_clipboard_file(&dir, name, bytes)?;
-        arboard::Clipboard::new().and_then(|mut c| c.set().file_list(&[path])).map_err(|e| e.to_string())
+        crate::os_clipboard::with(|c| c.set().file_list(&[path])).map_err(|e| e.to_string())
     }
 
     #[cfg(target_arch = "wasm32")]
diff --git a/crates/ui-egui/src/canvas/navigation.rs b/crates/ui-egui/src/canvas/navigation.rs
index 731b2c2586..bc98a243fa 100644
--- a/crates/ui-egui/src/canvas/navigation.rs
+++ b/crates/ui-egui/src/canvas/navigation.rs
@@ -9,6 +9,11 @@ impl DocView {
     /// zoom are kept). `None` before the first frame has laid pages out, when the bookmark just
     /// goes to the current page.
     pub(crate) fn bookmark_position(&self, info: &DocInfo) -> Option<(usize, [Option<f32>; 2])> {
+        // The page grid moves the viewport without refreshing where the pages are on screen, so
+        // there is no position to read: the bookmark goes to the current page.
+        if self.organize {
+            return None;
+        }
         if let Some(sel) = self.selection
             && let Some(text) = self.texts.get(&sel.page)
             && let Some(p) = info.pages.get(sel.page)
@@ -32,11 +37,17 @@ impl DocView {
         // of pages of different heights, whose shorter page can start below it), else the
         // nearest one below.
         let top = self.viewport_screen.top();
-        let showing = || self.screen_xforms.iter().filter(|(_, xf)| xf.rect.bottom() > top);
-        let (page, xf) = showing()
-            .filter(|(_, xf)| xf.rect.top() <= top)
-            .min_by_key(|(p, _)| *p)
-            .or_else(|| showing().min_by(|a, b| a.1.rect.top().total_cmp(&b.1.rect.top()).then(a.0.cmp(&b.0))))?;
+        // A page showing less than a pixel is rounding, not what the reader is looking at: a jump
+        // to the next page leaves the previous one's bottom edge within a pixel of the top. Such a
+        // sliver still counts when nothing else shows (the last page at the very end).
+        let pick = |slack: f32| {
+            let showing = || self.screen_xforms.iter().filter(move |(_, xf)| xf.rect.bottom() > top + slack);
+            showing()
+                .filter(|(_, xf)| xf.rect.top() <= top)
+                .min_by_key(|(p, _)| *p)
+                .or_else(|| showing().min_by(|a, b| a.1.rect.top().total_cmp(&b.1.rect.top()).then(a.0.cmp(&b.0))))
+        };
+        let (page, xf) = pick(sliver(self.screen_ppp)).or_else(|| pick(0.0))?;
         let p = info.pages.get(*page)?;
         // Above the page (in the gap before it) is the page's own top. The window's vertical is
         // the view's y, or its x when the view is turned a quarter.
@@ -268,7 +279,11 @@ impl DocView {
         let Some(forward) = self.wheel.feed(unit, dy, phase, now, can_turn) else { return false };
         let before = self.current;
         self.step_page(forward);
-        self.current != before
+        if self.current == before {
+            self.wheel.unturn();
+            return false;
+        }
+        true
     }
 
     /// One wheel event in a non-continuous view whose page is taller than the window, where the
@@ -288,6 +303,7 @@ impl DocView {
         let before = self.current;
         self.step_page(forward);
         if self.current == before {
+            self.wheel.unturn();
             return false;
         }
         if !forward {
@@ -454,3 +470,23 @@ pub fn shortcuts(view: &mut DocView, ctx: &egui::Context, speed: crate::scroll_s
 /// How far ↓ / ↑ scroll at Normal speed (Scroll speed halves or doubles it). Page Down / Page Up
 /// keep this much of the previous screen in view.
 const KEY_SCROLL_LINE: f32 = 40.0;
+/// How much of a page must show at the window's top edge to count as the page there, in points: one
+/// physical pixel, since page rectangles snap to whole pixels and less is rounding.
+fn sliver(pixels_per_point: f32) -> f32 {
+    if pixels_per_point.is_finite() && pixels_per_point > 0.0 { 1.0 / pixels_per_point } else { 1.0 }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::sliver;
+
+    #[test]
+    fn a_sliver_is_one_physical_pixel() {
+        assert_eq!(sliver(1.0), 1.0);
+        assert_eq!(sliver(2.0), 0.5);
+        assert_eq!(sliver(0.5), 2.0);
+        for bad in [0.0, -1.0, f32::NAN, f32::INFINITY] {
+            assert_eq!(sliver(bad), 1.0, "{bad}");
+        }
+    }
+}
diff --git a/crates/ui-egui/src/canvas/organize.rs b/crates/ui-egui/src/canvas/organize.rs
index 7f333b3e46..25c99543e4 100644
--- a/crates/ui-egui/src/canvas/organize.rs
+++ b/crates/ui-egui/src/canvas/organize.rs
@@ -267,7 +267,18 @@ fn request_sharper(
     }
 }
 
-pub(super) fn organize_grid(view: &mut DocView, info: &DocInfo, editable: bool, dirty: bool, unobstructed: bool, ui: &mut egui::Ui, t: &Tokens) {
+pub(super) fn organize_grid(
+    view: &mut DocView,
+    doc: &pdfcraft_engine::Document,
+    unobstructed: bool,
+    show_page_edge_shadows: bool,
+    invert_middle: bool,
+    ui: &mut egui::Ui,
+    t: &Tokens,
+) {
+    let info = &doc.info;
+    let editable = doc.allows_assembly();
+    let dirty = doc.dirty;
     let ppp = ui.ctx().pixels_per_point();
     // The page image scales with the zoom; the padding and the page number don't.
     let cell = vec2(146.0 * view.grid_zoom + 44.0, 194.0 * view.grid_zoom + 88.0);
@@ -278,7 +289,7 @@ pub(super) fn organize_grid(view: &mut DocView, info: &DocInfo, editable: bool,
     let viewport = ui.available_rect_before_wrap();
     view.viewport_screen = viewport;
     let auto_delta = if unobstructed {
-        view.auto_scroll.update(ui, viewport, true)
+        view.auto_scroll.update(ui, viewport, true, invert_middle)
     } else {
         view.auto_scroll.cancel();
         Vec2::ZERO
@@ -290,6 +301,10 @@ pub(super) fn organize_grid(view: &mut DocView, info: &DocInfo, editable: bool,
     let (mut in_view, mut sharper): (Vec<(usize, f32)>, Vec<RenderRequest>) = (Vec::new(), Vec::new());
     // The source cell can scroll out of the virtualized rows during a drag.
     let mut drop = view.org_drag.is_some() && ui.input(|i| i.pointer.primary_released());
+    let fade_strength = ui.spacing().scroll.fade.strength;
+    if !show_page_edge_shadows {
+        ui.spacing_mut().scroll.fade.strength = 0.0;
+    }
     egui::ScrollArea::vertical().auto_shrink([false, false]).show_viewport(ui, |ui, clip| {
         apply_auto_scroll(ui, middle_gesture, auto_delta);
         ui.add_space(20.0);
@@ -329,7 +344,9 @@ pub(super) fn organize_grid(view: &mut DocView, info: &DocInfo, editable: bool,
                 if view.selected.contains(&i) {
                     ui.painter().rect_stroke(c.shrink(6.0), CornerRadius::same(8), Stroke::new(1.5, t.accent), egui::StrokeKind::Inside);
                 }
-                ui.painter().rect_filled(pr.translate(vec2(0.0, 1.5)), CornerRadius::same(1), t.page_shadow);
+                if show_page_edge_shadows {
+                    ui.painter().rect_filled(pr.translate(vec2(0.0, 1.5)), CornerRadius::same(1), t.page_shadow);
+                }
                 ui.painter().rect_filled(pr, CornerRadius::ZERO, Color32::WHITE);
                 // A page drawn larger than its thumbnail gets a render at the size drawn, while
                 // it is in view; until that arrives the thumbnail stands in.
@@ -507,6 +524,7 @@ pub(super) fn organize_grid(view: &mut DocView, info: &DocInfo, editable: bool,
             view.org_drag = None;
         }
     });
+    ui.spacing_mut().scroll.fade.strength = fade_strength;
     // Files dragged in from outside go to the gap under the pointer. Some platforms don't say
     // where the pointer is until the files are dropped; then the whole grid is the target.
     let pointer = ui.input(|i| i.pointer.hover_pos()).filter(|p| viewport.contains(*p));
diff --git a/crates/ui-egui/src/canvas/page_pointer.rs b/crates/ui-egui/src/canvas/page_pointer.rs
index f0df1d92f1..02cb2208ed 100644
--- a/crates/ui-egui/src/canvas/page_pointer.rs
+++ b/crates/ui-egui/src/canvas/page_pointer.rs
@@ -56,18 +56,17 @@ impl PagePointer {
         // pointer is outside the window. With a dialog open only a drag counts, up to the frame
         // it stops: on the frame one opens egui still gives the pages a press that lands under
         // it, and its click.
-        let held = resp.dragged() || resp.drag_stopped() || (!modal && resp.interact_pointer_pos().is_some());
-        // `contains_pointer` alone also holds a few points under the edge of an Area over the
-        // pages (egui's interact radius), so the top layer there must be the pages' own. A
-        // dialog covers them from the frame it opens, before egui knows its layer.
         let layer = ui.layer_id();
         let on_top =
             |p: &Pos2| !modal && !dragged_elsewhere(ui, resp) && resp.contains_pointer() && ui.ctx().layer_id_at(*p).is_none_or(|l| l == layer);
+        let press_origin = origin.or_else(|| first_press(&edges));
+        let held =
+            resp.dragged() || resp.drag_stopped() || (!modal && (resp.interact_pointer_pos().is_some() || press_origin.is_some_and(|p| on_top(&p))));
         let pos = at.filter(|p| held || on_top(p));
         if !held {
             return Self { pos, origin: None, edges: Vec::new(), primary_down, any_down };
         }
-        Self { pos, origin: origin.or_else(|| first_press(&edges)), edges, primary_down, any_down }
+        Self { pos, origin: press_origin, edges, primary_down, any_down }
     }
 
     /// Where the pointer is, when it is inside `r`.
diff --git a/crates/ui-egui/src/canvas/page_router.rs b/crates/ui-egui/src/canvas/page_router.rs
index 06d3c48568..8b91cc865c 100644
--- a/crates/ui-egui/src/canvas/page_router.rs
+++ b/crates/ui-egui/src/canvas/page_router.rs
@@ -42,8 +42,7 @@ pub(crate) enum Owner {
 pub(crate) enum PicturePart {
     /// The picture: a click selects it, a drag moves the selected one.
     Body,
-    /// A corner of the selected picture (left top, right top, left bottom, right bottom): a drag
-    /// resizes it.
+    /// A resize grip in `ImageObb::handles` order (four corners and four edge midpoints).
     Corner(usize),
     /// The selected picture's rotate knob: a drag turns it.
     Knob,
diff --git a/crates/ui-egui/src/canvas/tests.rs b/crates/ui-egui/src/canvas/tests.rs
index 634a885111..4761584735 100644
--- a/crates/ui-egui/src/canvas/tests.rs
+++ b/crates/ui-egui/src/canvas/tests.rs
@@ -2002,3 +2002,38 @@ fn a_moved_picture_is_drawn_from_the_fresh_raster_while_a_tile_is_still_stale()
     h.state_mut().views[0].stale_tiles.clear();
     h.state_mut().views[0].tiles.clear();
 }
+
+#[test]
+fn image_handles_account_for_document_and_view_rotation() {
+    for page_rotation in [0, 90, 180, 270] {
+        for view_rotation in [0, 90, 180, 270] {
+            let (width, height) = if page_rotation % 180 == 0 { (300.0, 400.0) } else { (400.0, 300.0) };
+            let info = DocInfo {
+                pages: vec![pdfcraft_render::PageInfo {
+                    width,
+                    height,
+                    label: String::new(),
+                    crop: [0.0, 0.0, 300.0, 400.0],
+                    rotation: page_rotation,
+                }],
+                ..Default::default()
+            };
+            let size = if view_rotation % 180 == 0 { vec2(width, height) } else { vec2(height, width) };
+            let xf = PageXform { rect: Rect::from_min_size(pos2(10.0, 20.0), size), rot: view_rotation, pw: width, ph: height };
+            let obb = ImageObb::from_matrix([100.0, 0.0, 0.0, 50.0, 50.0, 70.0], &xf, &info, 0);
+            let total = (page_rotation + view_rotation) % 360;
+            assert_eq!(obb.is_rotated, total != 0, "page={page_rotation} view={view_rotation}: user-labelled grips need matrix resize when turned");
+            for (handle, point) in obb.handles() {
+                let direction = point - obb.screen_center;
+                let cursor = match handle {
+                    ImageHandle::TopLeft | ImageHandle::TopRight | ImageHandle::BottomLeft | ImageHandle::BottomRight => {
+                        if direction.x * direction.y > 0.0 { egui::CursorIcon::ResizeNwSe } else { egui::CursorIcon::ResizeNeSw }
+                    }
+                    _ if direction.x.abs() > direction.y.abs() => egui::CursorIcon::ResizeHorizontal,
+                    _ => egui::CursorIcon::ResizeVertical,
+                };
+                assert_eq!(obb.handle_cursor(handle), cursor, "page={page_rotation} view={view_rotation} handle={handle:?}");
+            }
+        }
+    }
+}
diff --git a/crates/ui-egui/src/canvas/wheel_pager.rs b/crates/ui-egui/src/canvas/wheel_pager.rs
index d12c445a8a..c8ce69c57d 100644
--- a/crates/ui-egui/src/canvas/wheel_pager.rs
+++ b/crates/ui-egui/src/canvas/wheel_pager.rs
@@ -73,6 +73,11 @@ impl WheelPager {
         self.accum = 0.0;
     }
 
+    /// Reset any turned state when a turn did not happen (e.g. at document boundary).
+    pub(crate) fn unturn(&mut self) {
+        self.turned = None;
+    }
+
     /// Whether the current gesture already turned a page: the rest of it must not pan the page
     /// just shown away from its top (or bottom).
     pub(crate) fn gesture_turned(&self) -> bool {
@@ -144,6 +149,9 @@ impl WheelPager {
             };
         if notch {
             if !can_turn {
+                // A notch is a gesture of its own, so one that only pans ends the gesture a
+                // previous notch turned; otherwise `gesture_turned` keeps swallowing the wheel (#5713).
+                self.turned = None;
                 return None;
             }
             // Every notch turns a page; a smooth tail of the same gesture won't add another.
diff --git a/crates/ui-egui/src/canvas/xform.rs b/crates/ui-egui/src/canvas/xform.rs
index 91a3739d62..0f6249c8a8 100644
--- a/crates/ui-egui/src/canvas/xform.rs
+++ b/crates/ui-egui/src/canvas/xform.rs
@@ -17,7 +17,7 @@ impl DocView {
     }
 
     /// Where `page` is drawn this frame, with its coordinate mapping.
-    pub(crate) fn page_xform(&self, page: usize) -> Option<PageXform> {
+    pub fn page_xform(&self, page: usize) -> Option<PageXform> {
         self.screen_xforms.iter().find(|(p, _)| *p == page).map(|(_, xf)| *xf)
     }
 }
@@ -128,6 +128,10 @@ impl PageXform {
         Rect::from_two_pos(self.norm_to_screen(a.0, a.1), self.norm_to_screen(b.0, b.1))
     }
 
+    pub fn user_rect_f64(&self, info: &DocInfo, page: usize, r: [f64; 4]) -> Rect {
+        self.user_rect(info, page, r.map(|v| v as f32))
+    }
+
     /// This transform resized to a raster of `px` device pixels (width, height before the view
     /// rotation), so each of its texels covers one screen pixel. The rectangle's corner must
     /// already be on a whole pixel ([`snap_to_pixels`]).
@@ -148,4 +152,34 @@ impl PageXform {
         mesh.add_triangle(0, 2, 3);
         painter.add(egui::Shape::mesh(mesh));
     }
+
+    /// Draw a sub-rectangle of a whole-page raster texture with specific texture UVs covering the normalised page region.
+    #[allow(clippy::too_many_arguments)]
+    pub fn paint_image_region(
+        &self,
+        painter: &egui::Painter,
+        tex: egui::TextureId,
+        pu0: f32,
+        pv0: f32,
+        pu1: f32,
+        pv1: f32,
+        tu0: f32,
+        tv0: f32,
+        tu1: f32,
+        tv1: f32,
+    ) {
+        let mut mesh = egui::Mesh::with_texture(tex);
+        let corners = [(pu0, pv0, tu0, tv0), (pu1, pv0, tu1, tv0), (pu1, pv1, tu1, tv1), (pu0, pv1, tu0, tv1)];
+        for (u, v, tu, tv) in corners {
+            mesh.vertices.push(egui::epaint::Vertex { pos: self.norm_to_screen(u, v), uv: pos2(tu, tv), color: Color32::WHITE });
+        }
+        mesh.add_triangle(0, 1, 2);
+        mesh.add_triangle(0, 2, 3);
+        painter.add(egui::Shape::mesh(mesh));
+    }
+
+    /// Draw a sub-rectangle of a whole-page raster texture, where UV space matches page normalized space.
+    pub fn paint_page_texture_rect(&self, painter: &egui::Painter, tex: egui::TextureId, u0: f32, v0: f32, u1: f32, v1: f32) {
+        self.paint_image_region(painter, tex, u0, v0, u1, v1, u0, v0, u1, v1);
+    }
 }
diff --git a/crates/ui-egui/src/canvas/zoom_snap.rs b/crates/ui-egui/src/canvas/zoom_snap.rs
index 5a0dcf6733..159adf2b7e 100644
--- a/crates/ui-egui/src/canvas/zoom_snap.rs
+++ b/crates/ui-egui/src/canvas/zoom_snap.rs
@@ -145,7 +145,7 @@ impl PdfCraftApp {
         #[cfg(not(target_arch = "wasm32"))]
         if self.system_clipboard {
             let img = arboard::ImageData { width: w as usize, height: h as usize, bytes: std::borrow::Cow::Borrowed(&out.rgba) };
-            arboard::Clipboard::new().and_then(|mut c| c.set_image(img)).map_err(|e| e.to_string())?;
+            crate::os_clipboard::with(|c| c.set_image(img)).map_err(|e| e.to_string())?;
         }
         self.last_snapshot = Some((w, h, out.rgba));
         Ok((w, h))
diff --git a/crates/ui-egui/src/chrome.rs b/crates/ui-egui/src/chrome.rs
index aa6233c133..56125d5709 100644
--- a/crates/ui-egui/src/chrome.rs
+++ b/crates/ui-egui/src/chrome.rs
@@ -1,6 +1,6 @@
 //! Window chrome: tab strip (with the integrated macOS title bar), mode bar, right rail.
 
-use craft_ui::panes::{Edge, Rail, RailItem, RailRequest};
+use craft_ui::panes::{Rail, RailItem, RailRequest};
 use egui::{Align, Color32, CornerRadius, Layout, Rect, Sense, Stroke, vec2};
 
 use crate::canvas::{DocView, Fit, PageLayout};
@@ -531,6 +531,26 @@ pub fn mode_bar(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
         });
 }
 
+/// The size of the rail's page and zoom fields: wide enough for "6400%", the largest zoom, in the
+/// 12 pt font, and inside the 45 pt the rail leaves.
+const RAIL_FIELD_SIZE: [f32; 2] = [42.0, 22.0];
+/// Padding inside the rail's page and zoom fields.
+const RAIL_FIELD_MARGIN: egui::Vec2 = egui::vec2(1.0, 4.0);
+
+/// A field the rail can type in: boxed, and the same size whatever it holds, so the page and zoom
+/// fields match and fit the rail's width. Sized outright: a text field is at least a control wide.
+fn rail_field(ui: &mut egui::Ui, t: &Tokens, edit: egui::TextEdit<'_>) -> egui::Response {
+    egui::Frame::NONE
+        .fill(t.field)
+        .stroke(Stroke::new(1.0, t.border))
+        .corner_radius(CornerRadius::same(5))
+        .show(ui, |ui| {
+            ui.spacing_mut().interact_size.x = 0.0;
+            ui.add_sized(RAIL_FIELD_SIZE, edit)
+        })
+        .inner
+}
+
 /// Draw the right tool rail with page navigation, history, zoom, rotation and page-display controls for the
 /// active view.
 pub fn right_rail(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
@@ -572,20 +592,18 @@ pub fn right_rail(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
     let view = &mut app.views[index];
     let mut page_display = None;
     let rail = Rail::new(egui::Id::unique("rail"))
-        .edge(Edge::End)
-        .frame(egui::Frame::NONE.fill(t.chrome).inner_margin(egui::Margin::symmetric(6, 8)).stroke(Stroke::new(1.0, t.divider)))
+        .edge(app.side_panels.rail_edge())
+        .width(49.0)
+        .frame(egui::Frame::NONE.fill(t.chrome).inner_margin(egui::Margin::symmetric(1, 8)).stroke(Stroke::new(1.0, t.divider)))
         .show(ui, &items, app.right.as_ref(), |ui| {
             // Page navigation cluster at the bottom, a panel of its own so that in a short
             // window the buttons above scroll instead of running into it (#3282).
             ui.with_layout(Layout::bottom_up(Align::Center), |ui| {
                 ui.spacing_mut().item_spacing.y = 2.0;
-                let tip = crate::commands::key_tip(ui.ctx(), tl!("Zoom out ({key})"), crate::commands::ZOOM_OUT);
-                if icons::button(ui, "zoom-out", 32.0, false, &tip).clicked() {
-                    view.zoom_step(false);
-                }
-                let tip = crate::commands::key_tip(ui.ctx(), tl!("Zoom in ({key})"), crate::commands::ZOOM_IN);
-                if icons::button(ui, "zoom-in", 32.0, false, &tip).clicked() {
-                    view.zoom_step(true);
+                let right = app.side_panels.rail_on_right();
+                let dock_tip = if right { tl!("Dock navigation rail on Left") } else { tl!("Dock navigation rail on Right") };
+                if icons::button(ui, if right { "panel-left" } else { "panel-right" }, 32.0, false, dock_tip).clicked() {
+                    app.side_panels.rail_side = if right { crate::side_panels::ToolsSide::Left } else { crate::side_panels::ToolsSide::Right };
                 }
                 // Between rotate and zoom, as in Acrobat. Its command runs once `view` is free.
                 let tip = crate::i18n::fmt(tl!("Page display: {layout}"), &[("layout", tl!(view.layout.label()))]);
@@ -606,18 +624,31 @@ pub fn right_rail(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                     view.fit = if view.fit == Fit::Width { Fit::Page } else { Fit::Width };
                     view.goto = Some((view.current, 0.0));
                 }
+                // Out and in side by side right under the zoom field, so they are found with it.
+                ui.horizontal(|ui| {
+                    ui.spacing_mut().item_spacing.x = 0.0;
+                    // Two buttons across the rail, each leaving a pixel to the rail's edge.
+                    let side = (ui.available_width() / 2.0).floor();
+                    let tip = crate::commands::key_tip(ui.ctx(), tl!("Zoom out ({key})"), crate::commands::ZOOM_OUT);
+                    if icons::button(ui, "zoom-out", side, false, &tip).clicked() {
+                        view.zoom_step(false);
+                    }
+                    let tip = crate::commands::key_tip(ui.ctx(), tl!("Zoom in ({key})"), crate::commands::ZOOM_IN);
+                    if icons::button(ui, "zoom-in", side, false, &tip).clicked() {
+                        view.zoom_step(true);
+                    }
+                });
                 let id = egui::Id::unique("zoom-input");
                 let draft = id.with("draft");
                 let mut typed = ui.data(|d| d.get_temp::<String>(draft)).unwrap_or_else(|| format!("{:.0}%", view.zoom * 100.0));
                 let edit = egui::TextEdit::singleline(&mut typed)
                     .id(id)
-                    .desired_width(40.0)
-                    .align(egui::Align2::CENTER_TOP)
-                    .font(theme::medium(11.0))
-                    .text_color(t.text_muted)
+                    .align(egui::Align2::CENTER_CENTER)
+                    .font(theme::medium(12.0))
+                    .text_color(t.text)
                     .frame(egui::Frame::NONE)
-                    .margin(vec2(2.0, 2.0));
-                let r = ui.add(edit).on_hover_text(tl!("Zoom — type a percentage and press Enter"));
+                    .margin(RAIL_FIELD_MARGIN);
+                let r = rail_field(ui, &t, edit).on_hover_text(tl!("Zoom — type a percentage and press Enter"));
                 ui.ctx().accesskit_node_builder(id, |node| node.set_label(tl!("Zoom")));
                 if r.gained_focus() {
                     let mut state = egui::TextEdit::load_state(ui.ctx(), id).unwrap_or_default();
@@ -677,16 +708,11 @@ pub fn right_rail(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                 }
                 let edit = egui::TextEdit::singleline(&mut view.page_input)
                     .id(page_input_id)
-                    .desired_width(34.0)
-                    .align(egui::Align2::CENTER_TOP)
+                    .align(egui::Align2::CENTER_CENTER)
                     .font(theme::medium(12.0))
-                    .margin(vec2(2.0, 4.0));
-                let r = egui::Frame::NONE
-                    .fill(t.field)
-                    .stroke(Stroke::new(1.0, t.border))
-                    .corner_radius(CornerRadius::same(5))
-                    .show(ui, |ui| ui.add(edit))
-                    .inner
+                    .frame(egui::Frame::NONE)
+                    .margin(RAIL_FIELD_MARGIN);
+                let r = rail_field(ui, &t, edit)
                     .on_hover_text(tl!("Current page — type a page number or label (such as iv) and press Enter"))
                     .accessible_name(tl!("Current page"));
                 if r.lost_focus() {
diff --git a/crates/ui-egui/src/commands.rs b/crates/ui-egui/src/commands.rs
index 08d2040e23..f072b7febe 100644
--- a/crates/ui-egui/src/commands.rs
+++ b/crates/ui-egui/src/commands.rs
@@ -259,6 +259,8 @@ impl PdfCraftApp {
                     self.notify(error);
                 }
             }
+            "view.select_tool" => self.quick_tool = crate::QuickTool::Select,
+            "view.hand_tool" => self.quick_tool = crate::QuickTool::Hand,
             "view.side_panel" => self.toggle_side_panel(),
             "view.tools_pane" => self.left_open = !self.left_open,
             "view.focus_page_input" => {
diff --git a/crates/ui-egui/src/control.rs b/crates/ui-egui/src/control.rs
index 43c41889e5..44e5481a11 100644
--- a/crates/ui-egui/src/control.rs
+++ b/crates/ui-egui/src/control.rs
@@ -28,6 +28,8 @@
 //!   comments, selecting text, moving comments). `ui.state` reports `pages_on_screen` to aim at.
 //! - `ui.type {text}`, `ui.key {key, modifiers?}`: keyboard input to the focused widget / app.
 //! - `ui.command {id}`: run a registry command (as the menu would). `ui.commands` lists them.
+//! - `ui.set {key: "show_page_edge_shadows", value: "true"|"false"}` controls page
+//!   decoration app-wide; `ui.state.show_page_edge_shadows` reports the saved preference.
 //! - `ui.set {key, value}`: view options (`--page`, `--zoom`, …), plus persistent preferences.
 //!   `select` accepts physical page numbers and ranges such as `1,12,16-18`; blank clears the
 //!   explicit selection. This is the same bounded parser as the Organize Pages field; invalid
@@ -37,6 +39,11 @@
 //!   `theme=light|dark|system` changes the saved theme preference; `ui.state.theme_preference`
 //!   reports the choice and `ui.state.theme` reports the resolved light/dark colours.
 //!   `comment-tool-pinned=true|false` remembers the annotation quick bar's pin across restarts;
+//!   `hotbar-tools` accepts comma-separated command IDs (empty clears the bar), and
+//!   `hotbar-side=float|left|right|top|bottom` floats or docks the customizable hotbar;
+//!   `hotbar-full-side=true|false` extends a docked bar along the entire side.
+//!   `hotbar-size=24..64` controls its button size in logical pixels; `ui.state.hotbar`
+//!   reports its tools, relative position, orientation and strip preference. These options persist across restarts.
 //!   `ui.state.comment_tool_pinned` reports the same preference.
 //! - `ui.open {path}`: open a file. A file whose tab is already open focuses it
 //!   (`"focused": true`) instead of adding a tab; native opens report `pending: true` until
diff --git a/crates/ui-egui/src/control/host.rs b/crates/ui-egui/src/control/host.rs
index 1166c0e7ec..b803f2738c 100644
--- a/crates/ui-egui/src/control/host.rs
+++ b/crates/ui-egui/src/control/host.rs
@@ -133,14 +133,17 @@ impl Host for crate::PdfCraftApp {
             "home": self.active.is_none(),
             "mode": format!("{:?}", self.mode),
             "default_mode": self.default_mode,
+            "hotbar": self.hotbar,
             "comment_tool_pinned": self.comment_prefs.pinned,
             "left_panel": if self.left_open { json!(format!("{:?}", self.left)) } else { Value::Null },
             "tools_side": if self.side_panels.tools_on_right() { "right" } else { "left" },
+            "rail_side": if self.side_panels.rail_on_right() { "right" } else { "left" },
             "right_panel": self.right.map(|r| format!("{r:?}")),
             "dialog": self.dialog.map(|d| format!("{d:?}")),
             "palette_open": self.palette_open,
             "theme": format!("{:?}", self.theme),
             "theme_preference": self.theme_preference,
+            "show_page_edge_shadows": self.show_page_edge_shadows,
             "language": self.language,
             "notice": self.toast.as_ref().map(|t| t.0.clone()),
             "progress": self.progress_notice.as_ref().map(|p| json!({ "label": p.label, "fraction": p.fraction })),
diff --git a/crates/ui-egui/src/dialogs.rs b/crates/ui-egui/src/dialogs.rs
index bfb0da686a..048d519222 100644
--- a/crates/ui-egui/src/dialogs.rs
+++ b/crates/ui-egui/src/dialogs.rs
@@ -14,6 +14,7 @@ pub(super) mod credits;
 pub(super) mod marks_ui;
 pub(super) mod pageboxes;
 pub(super) mod palette;
+pub(super) mod preferences;
 mod prompts;
 pub(super) mod protect;
 pub(super) mod standards_ui;
@@ -127,7 +128,9 @@ fn dialogs(app: &mut PdfCraftApp, ctx: &egui::Context) {
             Dialog::Properties(_) => 640.0,
             Dialog::Print => 820.0,
             Dialog::FieldProps | Dialog::BulkFieldProps => 600.0,
+            Dialog::Preferences => 610.0,
             Dialog::About => 780.0,
+            Dialog::PinTool => 540.0,
             _ => 520.0,
         });
         if dialog_body(ui, app, dialog, &mut req) {
@@ -446,6 +449,11 @@ fn dialog_body(ui: &mut egui::Ui, app: &mut PdfCraftApp, dialog: Dialog, req: &m
                 return false;
             }
         }
+        Dialog::PinTool => {
+            if !dialog_pin_tool(ui, app, req) {
+                return false;
+            }
+        }
     }
     true
 }
@@ -1080,6 +1088,7 @@ fn dialog_rotate_pages(ui: &mut egui::Ui, app: &mut PdfCraftApp, req: &mut Pendi
     use pdfcraft_engine::{PageOrientation as O, PageParity as P};
     let n = app.active_ids().and_then(|(_, id)| app.session.get(id)).map_or(1, |d| d.info.pages.len());
     let d = &mut app.rotate_draft;
+    let mut typing_to = false;
     ui.label(egui::RichText::new(tl!("Rotate Pages")).font(theme::semibold(18.0)));
     ui.add_space(8.0);
     egui::Grid::new("rotate-pages").num_columns(2).spacing([12.0, 8.0]).show(ui, |ui| {
@@ -1101,10 +1110,11 @@ fn dialog_rotate_pages(ui: &mut egui::Ui, app: &mut PdfCraftApp, req: &mut Pendi
             widgets::radio_value(ui, &mut d.which, 0, tl!("All"));
             widgets::radio_value(ui, &mut d.which, 1, tl!("Selection"));
             ui.horizontal(|ui| {
-                widgets::radio_value(ui, &mut d.which, 2, tl!("From"));
-                ui.add_enabled(d.which == 2, egui::DragValue::new(&mut d.from).range(1..=n));
-                ui.label(tl!("to"));
-                ui.add_enabled(d.which == 2, egui::DragValue::new(&mut d.to).range(1..=n));
+                let from_label = widgets::radio_value(ui, &mut d.which, 2, tl!("From"));
+                ui.add_enabled(d.which == 2, egui::DragValue::new(&mut d.from).range(1..=n)).labelled_by(from_label.id);
+                let to_label = ui.label(tl!("to"));
+                typing_to =
+                    widgets::typing_into(&ui.add_enabled(d.which == 2, egui::DragValue::new(&mut d.to).range(1..=n)).labelled_by(to_label.id));
                 ui.label(crate::i18n::fmt(tl!("of {name}"), &[("name", &n.to_string())]));
             });
         });
@@ -1136,10 +1146,12 @@ fn dialog_rotate_pages(ui: &mut egui::Ui, app: &mut PdfCraftApp, req: &mut Pendi
             });
         ui.end_row();
     });
-    d.to = d.to.max(d.from);
+    widgets::keep_range_ordered(d.from, &mut d.to, typing_to);
     ui.add_space(12.0);
     ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
         if widgets::pill_button(ui, tl!("OK"), true).clicked() {
+            // OK while the end is still being typed (a screen reader can press it).
+            widgets::keep_range_ordered(d.from, &mut d.to, false);
             req.rotate_now = true;
             req.close = true;
         }
@@ -1161,17 +1173,21 @@ fn dialog_duplicate_field(ui: &mut egui::Ui, app: &mut PdfCraftApp, req: &mut Pe
     ui.add_space(8.0);
     ui.label(crate::i18n::fmt(tl!("Duplicate \"{name}\" onto:"), &[("name", &d.name)]));
     widgets::radio_value(ui, &mut d.all, true, tl!("All pages"));
-    ui.horizontal(|ui| {
-        widgets::radio_value(ui, &mut d.all, false, tl!("From"));
-        ui.add_enabled(!d.all, egui::DragValue::new(&mut d.from).range(1..=n));
-        ui.label(tl!("to"));
-        ui.add_enabled(!d.all, egui::DragValue::new(&mut d.to).range(1..=n));
-        ui.label(crate::i18n::fmt(tl!("of {name}"), &[("name", &n.to_string())]));
-    });
-    d.to = d.to.max(d.from);
+    let typing_to = ui
+        .horizontal(|ui| {
+            widgets::radio_value(ui, &mut d.all, false, tl!("From"));
+            ui.add_enabled(!d.all, egui::DragValue::new(&mut d.from).range(1..=n));
+            ui.label(tl!("to"));
+            let typing_to = widgets::typing_into(&ui.add_enabled(!d.all, egui::DragValue::new(&mut d.to).range(1..=n)));
+            ui.label(crate::i18n::fmt(tl!("of {name}"), &[("name", &n.to_string())]));
+            typing_to
+        })
+        .inner;
+    widgets::keep_range_ordered(d.from, &mut d.to, typing_to);
     ui.add_space(12.0);
     ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
         if widgets::pill_button(ui, tl!("OK"), true).clicked() {
+            widgets::keep_range_ordered(d.from, &mut d.to, false);
             let pages: Vec<usize> = if d.all { (0..n).collect() } else { (d.from - 1..d.to.min(n)).collect() };
             req.duplicate_now = Some(Edit::DuplicateField { name: d.name.clone(), pages });
             req.close = true;
@@ -1342,10 +1358,13 @@ fn dialog_signature(ui: &mut egui::Ui, app: &mut PdfCraftApp, req: &mut Pending)
 
 /// `Dialog::Preferences` content. Returns `false` when it has its own buttons and no footer is wanted.
 fn dialog_preferences(ui: &mut egui::Ui, app: &mut PdfCraftApp, req: &mut Pending) -> bool {
+    ui.set_width(610.0);
     let t = Tokens::get(ui.ctx());
+    preferences::preferences_header(ui, &t);
+    ui.add_space(10.0);
     // The settings outgrow a short window: scroll them rather than run off the screen.
     // The OK row stays below the scroll, in reach however far the settings are scrolled.
-    let max = (ui.ctx().content_rect().height() - 120.0 - crate::js_ui::PREFERENCES_BUTTON_ROW).max(crate::js_ui::PREFERENCES_MIN_SCROLL);
+    let max = (ui.ctx().content_rect().height() - 120.0 - preferences::PREFERENCES_BUTTON_ROW - 40.0).max(preferences::PREFERENCES_MIN_SCROLL);
     // A scroll area starts from the room the dialog offers it, and a modal offers more
     // each frame for the first few, so with OK outside the scroll the dialog would grow
     // over those frames. Asking for the full height as the least it may scroll in
@@ -1354,9 +1373,17 @@ fn dialog_preferences(ui: &mut egui::Ui, app: &mut PdfCraftApp, req: &mut Pendin
     // cards and other full-width rows (#3557).
     ui.scope(|ui| {
         ui.spacing_mut().scroll.floating = false;
-        egui::ScrollArea::vertical().max_height(max).min_scrolled_height(max).show(ui, |ui| crate::js_ui::preferences_body(ui, app, &t));
+        ui.spacing_mut().scroll.bar_inner_margin = 14.0;
+        ui.spacing_mut().scroll.bar_outer_margin = 2.0;
+        ui.style_mut().scroll_animation = egui::style::ScrollAnimation::duration(0.25);
+        egui::ScrollArea::vertical()
+            .id_salt("preferences-dialog-scroll")
+            .max_height(max)
+            .min_scrolled_height(max)
+            .animated(true)
+            .show(ui, |ui| preferences::preferences_body(ui, app, &t));
     });
-    req.close = crate::js_ui::preferences_buttons(ui);
+    req.close = preferences::preferences_buttons(ui);
     false
 }
 
@@ -1370,13 +1397,14 @@ fn dialog_number_pages(ui: &mut egui::Ui, app: &mut PdfCraftApp, req: &mut Pendi
     let n = app.session.get(id).map(|d| d.info.pages.len()).unwrap_or(1).max(1);
     let d = &mut app.number_draft;
     d.to = d.to.clamp(1, n);
-    d.from = d.from.clamp(1, d.to);
+    d.from = d.from.clamp(1, n);
+    let mut typing_to = false;
     egui::Grid::new("number_pages").num_columns(2).spacing([12.0, 8.0]).show(ui, |ui| {
         ui.label(tl!("Pages"));
         ui.horizontal(|ui| {
             ui.add(egui::DragValue::new(&mut d.from).range(1..=n));
             ui.label(tl!("to"));
-            ui.add(egui::DragValue::new(&mut d.to).range(1..=n));
+            typing_to = widgets::typing_into(&ui.add(egui::DragValue::new(&mut d.to).range(1..=n)));
             ui.label(egui::RichText::new(crate::i18n::fmt(tl!("of {name}"), &[("name", &n.to_string())])).color(t.text_muted));
         });
         ui.end_row();
@@ -1403,18 +1431,20 @@ fn dialog_number_pages(ui: &mut egui::Ui, app: &mut PdfCraftApp, req: &mut Pendi
         ui.add(egui::DragValue::new(&mut d.start).range(1..=99_999));
         ui.end_row();
     });
-    d.to = d.to.max(d.from);
+    widgets::keep_range_ordered(d.from, &mut d.to, typing_to);
     let label = |k: u32| format!("{}{}", d.prefix, d.style.format(k));
     ui.add_space(8.0);
-    let preview = if d.from == d.to {
+    // `to` can be below `from` while it is being typed.
+    let preview = if d.to <= d.from {
         label(d.start)
     } else {
-        format!("{}, {} … {}", label(d.start), label(d.start + 1), label(d.start + (d.to - d.from) as u32))
+        format!("{}, {} … {}", label(d.start), label(d.start + 1), label(d.start.saturating_add(u32::try_from(d.to - d.from).unwrap_or(u32::MAX))))
     };
     ui.label(
         egui::RichText::new(crate::i18n::fmt(tl!("Labels: {preview}. Later pages keep their labels."), &[("preview", &preview)])).color(t.text_muted),
     );
-    req.number_now = Some(Edit::NumberPages { from: d.from - 1, to: d.to - 1, style: d.style, prefix: d.prefix.clone(), first: d.start });
+    // Ordered here too: the footer's OK can be pressed while the end is still being typed.
+    req.number_now = Some(Edit::NumberPages { from: d.from - 1, to: d.to.max(d.from) - 1, style: d.style, prefix: d.prefix.clone(), first: d.start });
     true
 }
 
@@ -1553,6 +1583,91 @@ fn dialog_about(ui: &mut egui::Ui, req: &mut Pending) -> bool {
     true
 }
 
+fn dialog_pin_tool(ui: &mut egui::Ui, app: &mut PdfCraftApp, req: &mut Pending) -> bool {
+    let t = Tokens::get(ui.ctx());
+    ui.horizontal(|ui| {
+        ui.label(egui::RichText::new(tl!("Pin tools to Home")).font(theme::semibold(18.0)));
+        ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
+            if widgets::ghost_button(ui, "x", tl!("Close")).clicked() {
+                req.close = true;
+            }
+        });
+    });
+    ui.add_space(4.0);
+    ui.label(egui::RichText::new(tl!("Select tools to display on your Home page for quick access.")).color(t.text_muted));
+    ui.add_space(10.0);
+
+    ui.horizontal(|ui| {
+        let (icon_rect, _) = ui.allocate_exact_size(egui::vec2(18.0, 18.0), egui::Sense::hover());
+        crate::icons::paint(ui, icon_rect, "search", 16.0, t.text_muted);
+        let search_resp =
+            ui.add(egui::TextEdit::singleline(&mut app.pin_tool_search).hint_text(tl!("Search tools…")).desired_width(ui.available_width() - 32.0));
+        search_resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::TextInput, ui.is_enabled(), tl!("Search tools…")));
+        if !app.pin_tool_search.is_empty() && widgets::ghost_button(ui, "x", tl!("Clear search")).clicked() {
+            app.pin_tool_search.clear();
+        }
+    });
+    ui.add_space(8.0);
+    ui.separator();
+    ui.add_space(6.0);
+
+    let query = app.pin_tool_search.trim().to_lowercase();
+    egui::ScrollArea::vertical().max_height(380.0).auto_shrink([false, true]).show(ui, |ui| {
+        let mut toggle = None;
+        for g in pdfcraft_engine::catalog::TOOL_GROUPS {
+            let label = tl!(g.label);
+            let blurb = g.sections.first().map(|s| s.items.iter().take(4).map(|i| tl!(i.label)).collect::<Vec<_>>().join(" • ")).unwrap_or_default();
+            if !query.is_empty()
+                && !label.to_lowercase().contains(&query)
+                && !blurb.to_lowercase().contains(&query)
+                && !g.id.to_lowercase().contains(&query)
+            {
+                continue;
+            }
+
+            let pinned = app.is_tool_pinned(g.id);
+            let (rect, resp) = ui.allocate_exact_size(egui::vec2(ui.available_width(), 44.0), egui::Sense::click());
+            resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, label));
+            let press = theme::Press::track(ui, &resp);
+            press.wash(ui, rect, 6, false);
+            let body = rect.translate(press.offset());
+
+            let color = egui::Color32::from_rgb(g.hue[0], g.hue[1], g.hue[2]);
+            crate::icons::paint(ui, egui::Rect::from_min_size(body.min + egui::vec2(8.0, 11.0), egui::vec2(22.0, 22.0)), g.icon, 20.0, color);
+
+            let btn_w = 78.0;
+            let btn_rect = egui::Rect::from_center_size(body.right_center() - egui::vec2(btn_w / 2.0 + 8.0, 0.0), egui::vec2(btn_w, 26.0));
+            let btn_resp = ui.interact(btn_rect, ui.scope_id().with(("pin_modal_btn", g.id)), egui::Sense::click());
+            let btn_hovered = btn_resp.hovered();
+
+            let (btn_fill, btn_stroke, text_color, btn_label) = if pinned {
+                (t.accent, egui::Stroke::NONE, egui::Color32::WHITE, tl!("Pinned"))
+            } else if btn_hovered {
+                (t.hover, egui::Stroke::new(1.0, t.border), t.text, tl!("Pin"))
+            } else {
+                (egui::Color32::TRANSPARENT, egui::Stroke::new(1.0, t.border), t.text_muted, tl!("Pin"))
+            };
+            let tip = if pinned { tl!("Unpin from Home") } else { tl!("Pin to Home") };
+            btn_resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, pinned, format!("{tip}: {label}")));
+
+            ui.painter().rect(btn_rect, egui::CornerRadius::same(6), btn_fill, btn_stroke, egui::StrokeKind::Inside);
+            ui.painter().text(btn_rect.center(), egui::Align2::CENTER_CENTER, btn_label, theme::medium(12.0), text_color);
+
+            let max_w = (btn_rect.left() - body.left() - 44.0).max(10.0);
+            widgets::row_text(ui, body.min + egui::vec2(38.0, 6.0), label, theme::semibold(13.5), t.text, max_w);
+            widgets::row_text(ui, body.min + egui::vec2(38.0, 24.0), &blurb, theme::regular(11.0), t.text_muted, max_w);
+
+            if btn_resp.clicked() || resp.clicked() {
+                toggle = Some(g.id);
+            }
+        }
+        if let Some(id) = toggle {
+            app.toggle_pin_tool(id);
+        }
+    });
+    true
+}
+
 fn dialog_footer(ui: &mut egui::Ui, app: &mut PdfCraftApp, dialog: Dialog, req: &mut Pending) {
     ui.add_space(16.0);
     let changed = draft_changes(app).is_some_and(|c| !c.is_empty());
@@ -1569,6 +1684,10 @@ fn dialog_footer(ui: &mut egui::Ui, app: &mut PdfCraftApp, dialog: Dialog, req:
                     req.recover = Some(false);
                     req.close = true;
                 }
+            } else if dialog == Dialog::PinTool {
+                if widgets::pill_button(ui, tl!("Done"), true).clicked() {
+                    req.close = true;
+                }
             } else if dialog == Dialog::NumberPages {
                 if widgets::pill_button(ui, tl!("OK"), true).clicked() {
                     req.apply_number = true;
@@ -1836,6 +1955,8 @@ fn finish_close(app: &mut PdfCraftApp, dialog: Dialog, modal_closed: bool, req:
     // Protect / Remove security replace the Properties dialog.
     let replaces = req.link_command.is_some_and(|c| c.starts_with("protect.")) || req.open_revision.is_some();
     if modal_closed || req.close || replaces {
+        // Only now: the number in Preferences can pass through 0 on its way to the one wanted.
+        app.recent.truncate(app.recent_limit);
         app.dialog = None;
         app.props_draft = None;
         app.view_draft = None;
diff --git a/crates/ui-egui/src/dialogs/appearance.rs b/crates/ui-egui/src/dialogs/appearance.rs
index 48ad0cb31c..2b1b35400f 100644
--- a/crates/ui-egui/src/dialogs/appearance.rs
+++ b/crates/ui-egui/src/dialogs/appearance.rs
@@ -1,11 +1,10 @@
 //! Preferences › Appearance: the appearance mode (follow the system, light or dark) above a light
 //! and a dark theme card, each with a small picture of PdfCraft in that theme.
 
-use egui::{Rect, RichText, pos2, vec2};
+use egui::{CornerRadius, Rect, RichText, Stroke, pos2, vec2};
 
 use crate::PdfCraftApp;
 use crate::theme::{self, ThemeKind, ThemePreference, Tokens};
-use crate::widgets;
 
 /// The themes each card offers. One of each today; a new theme is one more row here.
 pub const LIGHT_THEMES: &[(ThemeKind, &str)] = &[(ThemeKind::Light, "Light gray")];
@@ -82,43 +81,70 @@ fn preview(ui: &mut egui::Ui, kind: ThemeKind, width: f32) {
     }
 }
 
-/// One theme card: its title, Active when it is what shows now, a preview of the chosen theme
-/// and a radio row per theme. Returns true when the card or one of its radio rows was clicked.
-fn card(ui: &mut egui::Ui, t: &Tokens, title: &str, active: bool, themes: &[(ThemeKind, &str)]) -> bool {
-    let inner = egui::Frame::new()
-        .fill(t.card)
-        .stroke(egui::Stroke::new(1.0, if active { t.accent } else { t.border }))
-        .corner_radius(6.0)
-        .inner_margin(egui::Margin::same(8))
-        .show(ui, |ui| {
-            ui.set_width(ui.available_width());
-            ui.horizontal(|ui| {
-                ui.label(RichText::new(title).font(theme::semibold(12.5)).color(t.text));
-                if active {
-                    ui.label(RichText::new(tl!("Active")).color(t.accent_text).small());
-                }
-            });
-            ui.add_space(4.0);
-            let shown = themes.first().map_or(ThemeKind::Light, |(kind, _)| *kind);
-            preview(ui, shown, ui.available_width());
-            ui.add_space(4.0);
-            let mut clicked = false;
-            for (kind, label) in themes {
-                // One theme per card today, so it is always the chosen one.
-                clicked |= ui.add(widgets::radio(*kind == shown, tl!(label))).clicked();
-            }
-            clicked
-        });
-    // The whole card picks its theme, not just the radio row.
-    let whole = inner.response.interact(egui::Sense::click()).on_hover_cursor(egui::CursorIcon::PointingHand);
-    inner.inner || whole.clicked()
+/// One theme card: its title, Active when it is what shows now, and a preview of the chosen theme.
+/// Returns whether the card was clicked and the control's Response.
+fn card(ui: &mut egui::Ui, t: &Tokens, title: &str, active: bool, themes: &[(ThemeKind, &str)], query: &str) -> (bool, egui::Response) {
+    let mut card_clicked = false;
+    let frame_stroke = if active { Stroke::new(1.5, t.accent) } else { Stroke::new(1.0, t.border) };
+    let scope_res = ui.scope_builder(egui::UiBuilder::new().id_salt(title).sense(egui::Sense::click()), |ui| {
+        egui::Frame::new().fill(t.card).stroke(frame_stroke).corner_radius(CornerRadius::same(6)).inner_margin(egui::Margin::same(8)).show(
+            ui,
+            |ui| {
+                ui.set_width(ui.available_width());
+                ui.horizontal(|ui| {
+                    let font = theme::semibold(12.5);
+                    let ranges = crate::dialogs::preferences::find_match_ranges(title, query);
+                    let galley = if ranges.is_empty() {
+                        crate::bidi::layout_ui(ui, title.to_owned(), font, t.text)
+                    } else {
+                        let (job, _) = crate::dialogs::preferences::create_highlight_job(title, &ranges, font, t.text);
+                        ui.painter().layout_job(job)
+                    };
+                    let (title_rect, _) = ui.allocate_exact_size(galley.size(), egui::Sense::hover());
+                    ui.painter().galley(title_rect.min, galley, t.text);
+                    if active {
+                        ui.label(RichText::new(tl!("Active")).color(t.accent_text).small());
+                    }
+                });
+                ui.add_space(4.0);
+                let shown = themes.first().map_or(ThemeKind::Light, |(kind, _)| *kind);
+                preview(ui, shown, ui.available_width());
+            },
+        );
+    });
+
+    let resp = scope_res.response;
+    resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::RadioButton, true, active, title));
+
+    if resp.has_focus() {
+        ui.painter().rect_stroke(resp.rect, CornerRadius::same(6), Stroke::new(2.0, t.accent_text), egui::StrokeKind::Outside);
+    }
+
+    let resp = theme::hand(resp);
+    let key_select = resp.has_focus() && ui.input(|i| i.key_pressed(egui::Key::Space) || i.key_pressed(egui::Key::Enter));
+    if resp.clicked() || key_select {
+        card_clicked = true;
+    }
+    (card_clicked, resp)
 }
 
 /// The Appearance section of Preferences.
+#[cfg_attr(not(test), expect(dead_code, reason = "called by unit tests"))]
 pub fn preferences_section(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) {
-    ui.label(RichText::new(tl_ctx!("theme", "Appearance")).font(theme::semibold(13.0)));
+    let mut ctx = crate::dialogs::preferences::PrefSearchContext::new("", false);
+    preferences_section_with_context(ui, app, t, &mut ctx);
+}
+
+/// The Appearance section of Preferences with live search highlighting and scrolling context.
+pub(crate) fn preferences_section_with_context(
+    ui: &mut egui::Ui,
+    app: &mut PdfCraftApp,
+    t: &Tokens,
+    ctx: &mut crate::dialogs::preferences::PrefSearchContext,
+) {
+    ctx.label(ui, tl_ctx!("theme", "Appearance"), theme::semibold(13.0), t.text);
     ui.horizontal(|ui| {
-        let label = ui.label(tl!("Appearance mode"));
+        let label = ctx.label(ui, tl!("Appearance mode"), theme::regular(13.0), t.text);
         let combo = craft_ui::ComboBox::from_id_salt("appearance-mode").selected_text(tl!(mode_label(app.theme_preference))).show_ui(ui, |ui| {
             for preference in [ThemePreference::System, ThemePreference::Light, ThemePreference::Dark] {
                 if ui.selectable_label(app.theme_preference == preference, tl!(mode_label(preference))).clicked() {
@@ -132,18 +158,29 @@ pub fn preferences_section(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens)
     });
     ui.add_space(4.0);
     let light_active = app.theme == ThemeKind::Light;
+    let light_title = tl!("Light theme");
+    let dark_title = tl!("Dark theme");
+    let light_matches = crate::dialogs::preferences::find_match_ranges(light_title, ctx.query).len();
+    let dark_matches = crate::dialogs::preferences::find_match_ranges(dark_title, ctx.query).len();
+    ctx.total_matches += light_matches + dark_matches;
+
     ui.columns(2, |cols| {
         let [light, dark] = cols else { return };
-        if card(light, t, tl!("Light theme"), light_active, LIGHT_THEMES) {
+        let (light_clicked, light_resp) = card(light, t, light_title, light_active, LIGHT_THEMES, ctx.query);
+        if light_clicked {
             app.execute(mode_command(ThemePreference::Light));
         }
-        if card(dark, t, tl!("Dark theme"), !light_active, DARK_THEMES) {
+        ctx.scroll_if_first_match(&light_resp, light_matches);
+
+        let (dark_clicked, dark_resp) = card(dark, t, dark_title, !light_active, DARK_THEMES, ctx.query);
+        if dark_clicked {
             app.execute(mode_command(ThemePreference::Dark));
         }
+        ctx.scroll_if_first_match(&dark_resp, dark_matches);
     });
     ui.add_space(4.0);
     // Acrobat's "Highlight existing fields": shared with the toggle in the form bar.
-    ui.add(crate::widgets::checkbox(&mut app.view_defaults.highlight_fields, tl!("Highlight fields")));
+    ctx.checkbox(ui, &mut app.view_defaults.highlight_fields, tl!("Highlight fields"), t);
 }
 
 #[cfg(test)]
@@ -175,7 +212,6 @@ mod tests {
         );
         h.run();
         assert!(h.query_by_label("Light theme").is_some() && h.query_by_label("Dark theme").is_some());
-        assert!(h.query_by_label("Light gray").is_some() && h.query_by_label("Dark gray").is_some());
         assert_eq!(h.query_all_by_label("Active").count(), 1);
         if let Ok(path) = std::env::var("PDFCRAFT_APPEARANCE_SHOT") {
             h.render().unwrap().save(path).unwrap();
@@ -200,7 +236,7 @@ mod tests {
         assert_eq!(h.state().theme_preference, ThemePreference::System);
     }
 
-    /// Clicking a theme card, or its radio row, picks that theme, not only the mode combo box.
+    /// Clicking a theme card picks that theme, not only the mode combo box.
     #[test]
     fn clicking_a_theme_card_picks_that_theme() {
         let mut app = PdfCraftApp::new();
@@ -219,10 +255,9 @@ mod tests {
             app,
         );
         h.run();
-        h.get_by_label("Dark gray").click();
+        h.get_by_label("Dark theme").click();
         h.run();
         assert_eq!((h.state().theme_preference, h.state().theme), (ThemePreference::Dark, ThemeKind::Dark));
-        // The card's title is not a widget of its own: the click lands on the card.
         h.get_by_label("Light theme").click();
         h.run();
         assert_eq!((h.state().theme_preference, h.state().theme), (ThemePreference::Light, ThemeKind::Light));
diff --git a/crates/ui-egui/src/dialogs/comment_props.rs b/crates/ui-egui/src/dialogs/comment_props.rs
index 4702e63f9e..35ce510ae7 100644
--- a/crates/ui-egui/src/dialogs/comment_props.rs
+++ b/crates/ui-egui/src/dialogs/comment_props.rs
@@ -240,7 +240,7 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> (boo
                     let min_width = if e.font_size.is_some() { 0.0 } else { 0.5 };
                     if let Some(w) = e.width.as_mut() {
                         ui.label(tl!("Thickness"));
-                        ui.add(egui::Slider::new(w, min_width..=12.0).step_by(0.5).suffix(" pt"));
+                        ui.add(egui::Slider::new(w, min_width..=crate::comments::MAX_LINE_WIDTH).step_by(0.5).suffix(" pt"));
                         ui.end_row();
                     }
                     if let Some(ends) = e.endings.as_mut() {
diff --git a/crates/ui-egui/src/dialogs/preferences.rs b/crates/ui-egui/src/dialogs/preferences.rs
new file mode 100644
index 0000000000..9e3182e416
--- /dev/null
+++ b/crates/ui-egui/src/dialogs/preferences.rs
@@ -0,0 +1,1031 @@
+//! Preferences dialog: card-based settings interface organized into clean, modular cards
+//! with segmented pill controls and real-time search filtering.
+
+use egui::{Color32, CornerRadius, Margin, Rect, RichText, Sense, Stroke, pos2, vec2};
+
+use crate::PdfCraftApp;
+use crate::canvas::{Fit, PageLayout};
+use crate::motion::AnimationEffects;
+use crate::scroll_speed::ScrollSpeed;
+use crate::side_panels::ToolsSide;
+use crate::theme::{self, ThemeKind, Tokens};
+use crate::units::Unit;
+use crate::widgets::{self, icons};
+
+/// The height the Preferences dialog keeps below its scrolling settings for the buttons row.
+pub(crate) const PREFERENCES_BUTTON_ROW: f32 = 52.0;
+
+/// The least height the scrolling settings are given in very small windows.
+pub(crate) const PREFERENCES_MIN_SCROLL: f32 = 60.0;
+
+/// A segmented pill control for mutually exclusive choices.
+///
+/// Draws a rounded container with options inside. The active option is highlighted
+/// with the accent colour. Emits AccessKit RadioButton widget info with the option's label.
+pub fn segmented_pill_choice<T: PartialEq + Copy>(ui: &mut egui::Ui, t: &Tokens, current: &mut T, options: &[(T, &str)]) -> bool {
+    let with_a11y: Vec<(T, &str, &str)> = options.iter().map(|&(v, l)| (v, l, l)).collect();
+    segmented_pill_choice_a11y(ui, t, current, &with_a11y)
+}
+
+/// A segmented pill selection bar with separate accessibility labels.
+pub fn segmented_pill_choice_a11y<T: PartialEq + Copy>(ui: &mut egui::Ui, t: &Tokens, current: &mut T, options: &[(T, &str, &str)]) -> bool {
+    segmented_pill_choice_a11y_query(ui, t, current, options, "").0
+}
+
+/// A segmented pill selection bar with separate accessibility labels and optional query highlighting.
+/// Returns whether the selection changed and the Response of the first matching option, if any.
+pub fn segmented_pill_choice_a11y_query<T: PartialEq + Copy>(
+    ui: &mut egui::Ui,
+    t: &Tokens,
+    current: &mut T,
+    options: &[(T, &str, &str)],
+    query: &str,
+) -> (bool, Option<egui::Response>) {
+    let mut changed = false;
+    let mut first_match_resp: Option<egui::Response> = None;
+    egui::Frame::new()
+        .fill(t.field)
+        .stroke(Stroke::new(1.0, t.border))
+        .corner_radius(CornerRadius::same(14))
+        .inner_margin(Margin::symmetric(2, 2))
+        .show(ui, |ui| {
+            ui.spacing_mut().item_spacing.x = 2.0;
+            ui.horizontal(|ui| {
+                for &(value, label, a11y_label) in options {
+                    let is_active = *current == value;
+                    let font = theme::medium(12.0);
+                    let text_color = if is_active { Color32::WHITE } else { t.text };
+                    let label_galley = layout_pill_label(ui, label, query, font, text_color);
+                    let w = label_galley.size().x;
+                    let (rect, resp) = ui.allocate_exact_size(vec2(w + 18.0, 24.0), Sense::click());
+                    resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::RadioButton, true, is_active, a11y_label));
+
+                    if first_match_resp.is_none() && !find_match_ranges(label, query).is_empty() {
+                        first_match_resp = Some(resp.clone());
+                    }
+
+                    if is_active {
+                        ui.painter().rect(rect, CornerRadius::same(12), t.accent, Stroke::NONE, egui::StrokeKind::Inside);
+                    } else {
+                        let press = theme::Press::track(ui, &resp);
+                        let fill = press.fill(Color32::TRANSPARENT, t.hover, t.pressed);
+                        ui.painter().rect(rect, CornerRadius::same(12), fill, Stroke::NONE, egui::StrokeKind::Inside);
+                    }
+                    ui.painter().galley(rect.center() - label_galley.size() / 2.0, label_galley, text_color);
+
+                    if resp.has_focus() {
+                        ui.painter().rect_stroke(
+                            rect.expand(1.0),
+                            CornerRadius::same(13),
+                            Stroke::new(2.0, t.accent_text),
+                            egui::StrokeKind::Outside,
+                        );
+                    }
+
+                    let resp = theme::hand(resp);
+                    let key_select = resp.has_focus() && ui.input(|i| i.key_pressed(egui::Key::Space) || i.key_pressed(egui::Key::Enter));
+                    if (resp.clicked() || key_select) && *current != value {
+                        *current = value;
+                        changed = true;
+                    }
+                }
+            });
+        });
+    (changed, first_match_resp)
+}
+
+/// An independent toggle pill button with optional query highlighting.
+/// Returns whether the active state changed and the control's Response.
+pub fn toggle_pill_query(ui: &mut egui::Ui, t: &Tokens, active: &mut bool, label: &str, query: &str) -> (bool, egui::Response) {
+    let mut changed = false;
+    let is_active = *active;
+    let font = theme::medium(12.0);
+    let text_color = if is_active { Color32::WHITE } else { t.text };
+    let label_galley = layout_pill_label(ui, label, query, font, text_color);
+    let w = label_galley.size().x;
+    let (rect, resp) = ui.allocate_exact_size(vec2(w + 20.0, 26.0), Sense::click());
+    resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::CheckBox, true, is_active, label));
+
+    let (fill, stroke) = if is_active {
+        (t.accent, Stroke::NONE)
+    } else {
+        let press = theme::Press::track(ui, &resp);
+        (press.fill(t.field, t.hover, t.pressed), Stroke::new(1.0, t.border))
+    };
+    ui.painter().rect(rect, CornerRadius::same(13), fill, stroke, egui::StrokeKind::Inside);
+    ui.painter().galley(rect.center() - label_galley.size() / 2.0, label_galley, text_color);
+
+    if resp.has_focus() {
+        ui.painter().rect_stroke(rect.expand(1.0), CornerRadius::same(14), Stroke::new(2.0, t.accent_text), egui::StrokeKind::Outside);
+    }
+
+    let resp = theme::hand(resp);
+    let key_select = resp.has_focus() && ui.input(|i| i.key_pressed(egui::Key::Space) || i.key_pressed(egui::Key::Enter));
+    if resp.clicked() || key_select {
+        *active = !*active;
+        changed = true;
+    }
+    (changed, resp)
+}
+
+fn layout_pill_label(ui: &egui::Ui, label: &str, query: &str, font: egui::FontId, normal_color: Color32) -> std::sync::Arc<egui::Galley> {
+    let ranges = find_match_ranges(label, query);
+    if ranges.is_empty() {
+        crate::bidi::layout_ui(ui, label.to_owned(), font, normal_color)
+    } else {
+        let (job, _) = create_highlight_job(label, &ranges, font, normal_color);
+        ui.painter().layout_job(job)
+    }
+}
+
+/// A standard card container for a Preferences section.
+/// Groups related settings with clean margins, subtle border and rounded corners.
+pub fn preference_card<R>(
+    ui: &mut egui::Ui,
+    t: &Tokens,
+    title: &str,
+    icon: Option<&str>,
+    ctx: &mut PrefSearchContext,
+    content: impl FnOnce(&mut egui::Ui, &mut PrefSearchContext) -> R,
+) -> R {
+    let card_fill = if t.kind == ThemeKind::Light { Color32::from_rgb(0xF7, 0xF8, 0xFA) } else { Color32::from_rgb(0x24, 0x24, 0x28) };
+    egui::Frame::new()
+        .fill(card_fill)
+        .stroke(Stroke::new(1.0, t.border))
+        .corner_radius(CornerRadius::same(8))
+        .inner_margin(Margin::symmetric(14, 12))
+        .show(ui, |ui| {
+            ui.set_width(ui.available_width());
+            ui.horizontal(|ui| {
+                ui.spacing_mut().item_spacing.x = 6.0;
+                if let Some(ic) = icon {
+                    ui.add(icons::image(ic, 16.0, t.accent));
+                }
+                ctx.card_title(ui, title, t);
+            });
+            ui.add_space(8.0);
+            content(ui, ctx)
+        })
+        .inner
+}
+
+/// Folds a character for case-insensitive search, folding dotted/dotless i variants
+/// ('I', 'i', 'İ', 'ı') to 'i', Greek sigmas to 'σ', and otherwise following `char::to_lowercase`.
+fn fold_search_char(c: char, mut f: impl FnMut(char)) {
+    match c {
+        'I' | 'i' | '\u{130}' | '\u{131}' => f('i'),
+        'Σ' | 'σ' | 'ς' => f('σ'),
+        _ => {
+            for lc in c.to_lowercase() {
+                f(lc);
+            }
+        }
+    }
+}
+
+/// Finds non-overlapping (start_byte, end_byte) slices in `text` matching `query` case-insensitively.
+/// All byte indices are guaranteed to align to valid char boundaries.
+pub fn find_match_ranges(text: &str, query: &str) -> Vec<(usize, usize)> {
+    let q = query.trim();
+    if q.is_empty() {
+        return Vec::new();
+    }
+    let mut q_chars = Vec::new();
+    for c in q.chars() {
+        fold_search_char(c, |ch| q_chars.push(ch));
+    }
+    if q_chars.is_empty() {
+        return Vec::new();
+    }
+    let char_indices: Vec<(usize, char)> = text.char_indices().collect();
+    let mut ranges = Vec::new();
+    let mut i = 0;
+    while i < char_indices.len() {
+        let mut matched = true;
+        let mut text_char_count = 0;
+        let mut q_idx = 0;
+
+        while q_idx < q_chars.len() {
+            if i + text_char_count >= char_indices.len() {
+                matched = false;
+                break;
+            }
+            let c = char_indices.get(i + text_char_count).map(|(_, ch)| *ch).unwrap_or('\0');
+            let mut c_folded = ['\0'; 4];
+            let mut len = 0;
+            fold_search_char(c, |lc| {
+                if len < c_folded.len() {
+                    c_folded[len] = lc;
+                    len += 1;
+                }
+            });
+            if len == 0 || q_idx + len > q_chars.len() || q_chars.get(q_idx..q_idx + len) != Some(&c_folded[..len]) {
+                matched = false;
+                break;
+            }
+            q_idx += len;
+            text_char_count += 1;
+        }
+
+        if matched
+            && q_idx == q_chars.len()
+            && text_char_count > 0
+            && let Some(start_byte) = char_indices.get(i).map(|(pos, _)| *pos)
+        {
+            let end_byte = if let Some((pos, _)) = char_indices.get(i + text_char_count) { *pos } else { text.len() };
+            ranges.push((start_byte, end_byte));
+            i += text_char_count;
+            continue;
+        }
+        i += 1;
+    }
+    ranges
+}
+
+/// Builds an `egui::text::LayoutJob` with yellow background for matching spans.
+pub fn create_highlight_job(
+    text: &str,
+    ranges: &[(usize, usize)],
+    normal_font: egui::FontId,
+    normal_color: Color32,
+) -> (egui::text::LayoutJob, usize) {
+    let mut job = egui::text::LayoutJob::default();
+    let normal_format = egui::text::TextFormat { font_id: normal_font.clone(), color: normal_color, ..Default::default() };
+    let highlight_format = egui::text::TextFormat {
+        font_id: egui::FontId::new(normal_font.size, egui::FontFamily::Proportional),
+        color: Color32::BLACK,
+        background: Color32::from_rgb(255, 220, 60),
+        ..Default::default()
+    };
+
+    let mut cursor = 0;
+    for &(start, end) in ranges {
+        if start > cursor
+            && let Some(sub) = text.get(cursor..start)
+        {
+            job.append(sub, 0.0, normal_format.clone());
+        }
+        if let Some(matched) = text.get(start..end) {
+            job.append(matched, 0.0, highlight_format.clone());
+        }
+        cursor = end;
+    }
+    if cursor < text.len()
+        && let Some(sub) = text.get(cursor..)
+    {
+        job.append(sub, 0.0, normal_format);
+    }
+    let count = ranges.len();
+    (job, count)
+}
+
+/// Creates a `WidgetText` highlighting `query` in `text` and returning match count.
+pub fn highlight_widget_text(text: &str, query: &str, normal_font: egui::FontId, normal_color: Color32) -> (egui::WidgetText, usize) {
+    let ranges = find_match_ranges(text, query);
+    if ranges.is_empty() {
+        (egui::WidgetText::from(egui::RichText::new(text).font(normal_font).color(normal_color)), 0)
+    } else {
+        let (job, count) = create_highlight_job(text, &ranges, normal_font, normal_color);
+        (egui::WidgetText::from(job), count)
+    }
+}
+
+/// Context for browser-style in-situ text scanning, highlighting, and auto-scrolling in Preferences.
+pub(crate) struct PrefSearchContext<'a> {
+    pub query: &'a str,
+    pub total_matches: usize,
+    pub first_match_scrolled: bool,
+    pub should_scroll: bool,
+}
+
+impl<'a> PrefSearchContext<'a> {
+    pub fn new(query: &'a str, should_scroll: bool) -> Self {
+        Self { query, total_matches: 0, first_match_scrolled: false, should_scroll }
+    }
+
+    pub fn scroll_if_first_match(&mut self, resp: &egui::Response, count: usize) {
+        if count > 0 && self.should_scroll && !self.first_match_scrolled {
+            resp.scroll_to_me(Some(egui::Align::Center));
+            self.first_match_scrolled = true;
+        }
+    }
+
+    pub fn checkbox(&mut self, ui: &mut egui::Ui, checked: &mut bool, label: &str, t: &Tokens) -> egui::Response {
+        let (widget_text, count) = highlight_widget_text(label, self.query, theme::regular(13.0), t.text);
+        self.total_matches += count;
+        let resp = ui.add(widgets::checkbox(checked, widget_text));
+        self.scroll_if_first_match(&resp, count);
+        resp
+    }
+
+    pub fn label(&mut self, ui: &mut egui::Ui, text: &str, font: egui::FontId, color: Color32) -> egui::Response {
+        let (widget_text, count) = highlight_widget_text(text, self.query, font, color);
+        self.total_matches += count;
+        let resp = ui.label(widget_text);
+        self.scroll_if_first_match(&resp, count);
+        resp
+    }
+
+    pub fn label_primary(&mut self, ui: &mut egui::Ui, text: &str, t: &Tokens) -> egui::Response {
+        self.label(ui, text, theme::regular(13.0), t.text)
+    }
+
+    pub fn label_secondary(&mut self, ui: &mut egui::Ui, text: &str, t: &Tokens) -> egui::Response {
+        self.label(ui, text, theme::regular(11.5), t.text_muted)
+    }
+
+    pub fn card_title(&mut self, ui: &mut egui::Ui, title: &str, t: &Tokens) -> egui::Response {
+        self.label(ui, title, theme::semibold(13.5), t.text)
+    }
+
+    pub fn pill_choice<T: PartialEq + Copy>(&mut self, ui: &mut egui::Ui, t: &Tokens, current: &mut T, options: &[(T, &str)]) -> bool {
+        let mut matches = 0;
+        for &(_, label) in options {
+            matches += find_match_ranges(label, self.query).len();
+        }
+        self.total_matches += matches;
+        let with_a11y: Vec<(T, &str, &str)> = options.iter().map(|&(v, l)| (v, l, l)).collect();
+        let (changed, match_resp) = segmented_pill_choice_a11y_query(ui, t, current, &with_a11y, self.query);
+        if let Some(resp) = match_resp {
+            self.scroll_if_first_match(&resp, matches);
+        }
+        changed
+    }
+
+    pub fn pill_choice_a11y<T: PartialEq + Copy>(&mut self, ui: &mut egui::Ui, t: &Tokens, current: &mut T, options: &[(T, &str, &str)]) -> bool {
+        let mut matches = 0;
+        for &(_, label, _) in options {
+            matches += find_match_ranges(label, self.query).len();
+        }
+        self.total_matches += matches;
+        let (changed, match_resp) = segmented_pill_choice_a11y_query(ui, t, current, options, self.query);
+        if let Some(resp) = match_resp {
+            self.scroll_if_first_match(&resp, matches);
+        }
+        changed
+    }
+
+    pub fn toggle_pill(&mut self, ui: &mut egui::Ui, t: &Tokens, active: &mut bool, label: &str) -> bool {
+        let matches = find_match_ranges(label, self.query).len();
+        self.total_matches += matches;
+        let (changed, resp) = toggle_pill_query(ui, t, active, label, self.query);
+        self.scroll_if_first_match(&resp, matches);
+        changed
+    }
+}
+
+/// Whether the interface can draw a language picker's native name.
+fn picker_text_is_drawable(ui: &egui::Ui, text: &str) -> bool {
+    #[cfg(target_arch = "wasm32")]
+    {
+        let _ = (ui, text);
+        true
+    }
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        ui.fonts_mut(|fonts| fonts.has_glyphs(&egui::FontId::proportional(13.0), text))
+    }
+}
+
+/// The date picker's displayed name.
+pub(crate) fn date_language_picker_name(l: &pdfcraft_engine::dates::DateLanguage, drawable: impl FnOnce(&str) -> bool) -> &'static str {
+    match crate::i18n::Lang::from_code(l.code) {
+        Some(language) => language.picker_name(drawable),
+        None => l.name,
+    }
+}
+
+/// Interactive search box widget at the top of Preferences.
+fn preference_search_box_at(ui: &mut egui::Ui, t: &Tokens, query: &mut String, matches_count: Option<usize>, rect: Rect) {
+    let stroke = Stroke::new(1.0, t.border);
+    ui.painter().rect(rect, CornerRadius::same(15), t.field, stroke, egui::StrokeKind::Inside);
+
+    // Magnifying glass icon: 14pt icon centered vertically at (rect.min.x + 16, rect.center().y)
+    let icon_rect = Rect::from_center_size(pos2(rect.min.x + 16.0, rect.center().y), vec2(14.0, 14.0));
+    icons::paint(ui, icon_rect, "search", 14.0, t.text_muted);
+
+    let badge_text = if !query.trim().is_empty() {
+        let count = matches_count.unwrap_or(0);
+        Some(crate::i18n::trn(crate::i18n::current(), count as u64, "{n} match", "{n} matches"))
+    } else {
+        None
+    };
+
+    let mut right_cursor = rect.max.x;
+    let edit_id = ui.auto_id_with("search_input");
+
+    if !query.is_empty() {
+        let clear_rect = Rect::from_center_size(pos2(right_cursor - 14.0, rect.center().y), vec2(16.0, 16.0));
+        let clear_resp = ui.interact(clear_rect, ui.auto_id_with("clear_search"), Sense::click());
+        clear_resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!("Clear search")));
+        icons::paint(ui, clear_rect, "x", 12.0, if clear_resp.hovered() { t.text } else { t.text_muted });
+        if clear_resp.clicked() {
+            query.clear();
+            let state = egui::text_edit::TextEditState::default();
+            state.store(ui.ctx(), edit_id);
+        }
+        right_cursor -= 28.0;
+    }
+
+    if let Some(ref text) = badge_text {
+        let font = theme::medium(11.0);
+        let count = matches_count.unwrap_or(0);
+        let badge_color = if count > 0 { t.accent_text } else { t.text_muted };
+        let galley = crate::bidi::layout_ui(ui, text.clone(), font, badge_color);
+        let bw = galley.size().x;
+        let badge_pos = pos2(right_cursor - bw - 4.0, rect.center().y - galley.size().y / 2.0);
+        ui.painter().galley(badge_pos, galley, badge_color);
+        let badge_rect = Rect::from_min_size(badge_pos, vec2(bw, 16.0));
+        let badge_resp = ui.interact(badge_rect, ui.auto_id_with("search_match_count"), Sense::hover());
+        badge_resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Label, true, text.clone()));
+        right_cursor -= bw + 8.0;
+    }
+
+    let edit_rect = Rect::from_min_max(pos2(rect.min.x + 28.0, rect.min.y), pos2(right_cursor.max(rect.min.x + 30.0), rect.max.y));
+    let mut child_ui = ui.new_child(egui::UiBuilder::new().max_rect(edit_rect).layout(egui::Layout::left_to_right(egui::Align::Center)));
+    let edit = child_ui.add(
+        egui::TextEdit::singleline(query)
+            .id(edit_id)
+            .hint_text(tl!("Search settings…"))
+            .frame(egui::Frame::NONE)
+            .align(egui::Align2::LEFT_CENTER)
+            .desired_width(edit_rect.width()),
+    );
+    edit.widget_info(|| egui::WidgetInfo::labeled(egui::Role::TextInput, true, tl!("Search settings…")));
+
+    if edit.has_focus() && ui.input(|i| i.key_pressed(egui::Key::Escape)) {
+        query.clear();
+        let state = egui::text_edit::TextEditState::default();
+        state.store(ui.ctx(), edit_id);
+    }
+}
+
+/// Top header for Preferences: Title on the left, search box and match count badge on the right.
+pub(crate) fn preferences_header(ui: &mut egui::Ui, t: &Tokens) {
+    let search_id = egui::Id::unique("pdfcraft_preferences_search_query");
+    let mut query: String = ui.data(|d| d.get_temp(search_id)).unwrap_or_default();
+    let matches_id = egui::Id::unique("pdfcraft_preferences_search_matches");
+    let last_matches: usize = ui.data(|d| d.get_temp(matches_id)).unwrap_or(0);
+
+    // Top Header: Title on the left, Search bar on the right.
+    // Allocate the full available width so the search bar aligns flush with the card boxes below.
+    let full_w = ui.available_width();
+    let header_h = 30.0;
+    let (header_rect, _) = ui.allocate_exact_size(vec2(full_w, header_h), Sense::hover());
+
+    // Title on the left, vertically centered in the header row:
+    let title_rect = Rect::from_min_max(header_rect.min, pos2(header_rect.min.x + 240.0, header_rect.max.y));
+    let mut title_ui = ui.new_child(egui::UiBuilder::new().max_rect(title_rect).layout(egui::Layout::left_to_right(egui::Align::Center)));
+    title_ui.label(RichText::new(tl!("Preferences")).font(theme::semibold(18.0)).color(t.text));
+
+    // Search bar on the right, right edge flush with the card box boundary:
+    let search_w = 230.0;
+    let search_rect = Rect::from_min_max(pos2(header_rect.max.x - search_w, header_rect.min.y), header_rect.max);
+    let match_count = (!query.trim().is_empty()).then_some(last_matches);
+    let before = query.clone();
+    preference_search_box_at(ui, t, &mut query, match_count, search_rect);
+    if query != before {
+        ui.data_mut(|d| d.insert_temp(search_id, query));
+        ui.ctx().request_repaint();
+    }
+}
+
+/// The body of the Preferences dialog with card layout and browser-style in-situ text scanning.
+pub(crate) fn preferences_body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) {
+    let search_id = egui::Id::unique("pdfcraft_preferences_search_query");
+    let query: String = ui.data(|d| d.get_temp(search_id)).unwrap_or_default();
+    let matches_id = egui::Id::unique("pdfcraft_preferences_search_matches");
+    let last_matches: usize = ui.data(|d| d.get_temp(matches_id)).unwrap_or(0);
+    let last_scrolled_id = egui::Id::unique("pdfcraft_pref_last_scrolled_query");
+    let last_scrolled_query: String = ui.data(|d| d.get_temp(last_scrolled_id)).unwrap_or_default();
+
+    let should_scroll = !query.trim().is_empty() && query != last_scrolled_query;
+    let mut ctx = PrefSearchContext::new(&query, should_scroll);
+
+    // Card 1: General & Interface
+    let title1 = tl!("General & Interface");
+    preference_card(ui, t, title1, Some("settings"), &mut ctx, |ui, ctx| {
+        card_general(ui, app, t, ctx);
+    });
+    ui.add_space(12.0);
+
+    // Card 2: Appearance & Theme
+    let title2 = tl_ctx!("theme", "Appearance");
+    preference_card(ui, t, title2, Some("sun"), &mut ctx, |ui, ctx| {
+        card_appearance(ui, app, t, ctx);
+    });
+    ui.add_space(12.0);
+
+    // Card 3: Documents and View
+    let title3 = tl!("Documents and view");
+    preference_card(ui, t, title3, Some("file-text"), &mut ctx, |ui, ctx| {
+        card_documents_and_view(ui, app, t, ctx);
+    });
+    ui.add_space(12.0);
+
+    // Card 4: Comment
+    let title4 = tl!("Comment");
+    preference_card(ui, t, title4, Some("message-square-text"), &mut ctx, |ui, ctx| {
+        card_identity(ui, app, t, ctx);
+    });
+    ui.add_space(12.0);
+
+    // Card 5: Fill & Sign
+    let title5 = tl!("Fill & Sign");
+    preference_card(ui, t, title5, Some("pen-tool"), &mut ctx, |ui, ctx| {
+        card_fill_and_sign(ui, app, t, ctx);
+    });
+    ui.add_space(12.0);
+
+    // Card 6: JavaScript
+    let title6 = "JavaScript";
+    preference_card(ui, t, title6, Some("code-xml"), &mut ctx, |ui, ctx| {
+        card_javascript(ui, app, t, ctx);
+    });
+    ui.add_space(12.0);
+
+    if ctx.first_match_scrolled {
+        ui.data_mut(|d| d.insert_temp(last_scrolled_id, query.clone()));
+    } else if query.trim().is_empty() {
+        ui.data_mut(|d| d.insert_temp(last_scrolled_id, String::new()));
+    }
+
+    if ctx.total_matches != last_matches {
+        ui.data_mut(|d| d.insert_temp(matches_id, ctx.total_matches));
+        ui.ctx().request_repaint();
+    }
+}
+
+/// Content for Card 1: General & Interface
+fn card_general(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens, ctx: &mut PrefSearchContext) {
+    ui.horizontal(|ui| {
+        let label = ctx.label_primary(ui, tl!("Interface language"), t);
+        let (selected, picker) = {
+            let drawable = |text: &str| picker_text_is_drawable(ui, text);
+            let selected = crate::i18n::Lang::from_code(&app.language)
+                .map_or_else(|| tl!("Auto").to_owned(), |language| language.picker_name(drawable).to_owned());
+            let picker = crate::i18n::Lang::for_picker_by(|language| language.picker_name(drawable))
+                .into_iter()
+                .map(|language| (language, language.picker_name(drawable)))
+                .collect::<Vec<_>>();
+            (selected, picker)
+        };
+        let before = app.language.clone();
+        craft_ui::ComboBox::from_id_salt("interface-language")
+            .selected_text(selected)
+            .width(160.0)
+            .show_ui(ui, |ui| {
+                if ui.selectable_value(&mut app.language, crate::i18n::AUTO.to_string(), tl!("Auto")).clicked() {
+                    ui.close();
+                }
+                for (language, name) in &picker {
+                    if ui.selectable_value(&mut app.language, language.code().to_string(), *name).clicked() {
+                        ui.close();
+                    }
+                }
+            })
+            .response
+            .labelled_by(label.id);
+        if app.language != before {
+            crate::i18n::set_current(crate::i18n::Lang::from_pref(&app.language));
+        }
+
+        ui.add_space(16.0);
+        use crate::ui_scale;
+        let label_size = ctx.label_primary(ui, tl!("Interface size"), t);
+        let native = ui.ctx().native_pixels_per_point().unwrap_or(1.0);
+        let auto_percent = ui_scale::percent(ui_scale::drawn(None, app.system_text_scale, native));
+        let auto = crate::i18n::fmt(tl!("Auto ({percent}%)"), &[("percent", &auto_percent.to_string())]);
+        let selected = app.ui_scale.map_or_else(|| auto.clone(), |f| format!("{}%", ui_scale::percent(f)));
+        craft_ui::ComboBox::from_id_salt("interface-size")
+            .selected_text(selected)
+            .width(130.0)
+            .show_ui(ui, |ui| {
+                if ui.selectable_value(&mut app.ui_scale, None, auto).clicked() {
+                    ui.close();
+                }
+                for p in ui_scale::PRESETS {
+                    let factor = f32::from(p) / 100.0;
+                    if ui.selectable_label(app.ui_scale.is_some_and(|f| ui_scale::percent(f) == u32::from(p)), format!("{p}%")).clicked() {
+                        app.ui_scale = Some(factor);
+                        ui.close();
+                    }
+                }
+            })
+            .response
+            .labelled_by(label_size.id);
+    });
+    ctx.label_secondary(ui, tl!("Auto follows the system's text size. Pages always render at the display's full resolution."), t);
+    ui.add_space(6.0);
+
+    ui.horizontal(|ui| {
+        ctx.label_primary(ui, tl!("Tools panel side"), t);
+        let right = app.side_panels.tools_on_right();
+        let mut side = if right { ToolsSide::Right } else { ToolsSide::Left };
+        if ctx.pill_choice(ui, t, &mut side, &[(ToolsSide::Left, tl!("Left")), (ToolsSide::Right, tl!("Right"))]) {
+            app.side_panels.tools_side = side;
+        }
+
+        ui.add_space(16.0);
+        ctx.label_primary(ui, tl!("Navigation rail side"), t);
+        let rail_right = app.side_panels.rail_on_right();
+        let mut rside = if rail_right { ToolsSide::Right } else { ToolsSide::Left };
+        let left_a11y = format!("{}: {}", tl!("Navigation rail side"), tl!("Left"));
+        let right_a11y = format!("{}: {}", tl!("Navigation rail side"), tl!("Right"));
+        if ctx.pill_choice_a11y(ui, t, &mut rside, &[(ToolsSide::Left, tl!("Left"), &left_a11y), (ToolsSide::Right, tl!("Right"), &right_a11y)]) {
+            app.side_panels.rail_side = rside;
+        }
+    });
+    ui.add_space(6.0);
+
+    ui.horizontal(|ui| {
+        ctx.label_primary(ui, tl!("Animation effects"), t);
+        ctx.pill_choice(
+            ui,
+            t,
+            &mut app.animation_effects,
+            &[
+                (AnimationEffects::System, tl_ctx!("animation effects", AnimationEffects::System.label())),
+                (AnimationEffects::On, tl_ctx!("animation effects", AnimationEffects::On.label())),
+                (AnimationEffects::Off, tl_ctx!("animation effects", AnimationEffects::Off.label())),
+            ],
+        );
+    });
+    ui.add_space(6.0);
+
+    #[cfg(not(target_arch = "wasm32"))]
+    ctx.checkbox(ui, &mut app.reopen_last_session, tl!("Reopen the files that were open when PdfCraft last closed"), t);
+    #[cfg(not(target_arch = "wasm32"))]
+    ctx.checkbox(ui, &mut app.restore_last_view, tl!("Restore the last view (page, zoom and page display) when a document is opened again"), t);
+    #[cfg(not(target_arch = "wasm32"))]
+    ctx.checkbox(ui, &mut app.reload_changed_files, tl!("Reload documents when their files change on disk"), t);
+    ctx.checkbox(ui, &mut app.show_secured_notice, tl!("Show a notice when a document is secured"), t);
+
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        ui.horizontal(|ui| {
+            let label = ctx.label_primary(ui, tl!("Recent files to keep"), t);
+            ui.add(egui::DragValue::new(&mut app.recent_limit).range(0..=crate::RECENT_FILES_MAX)).labelled_by(label.id);
+        });
+        ctx.label_secondary(ui, tl!("Lowering this forgets the oldest files. At 0 there is no list."), t);
+    }
+
+    if app.window_controls.is_some() {
+        ctx.checkbox(ui, &mut app.system_title_bar, tl!("Use system title bar"), t).on_hover_text(tl!(
+            "Show a basic title bar for the window buttons instead of the tab strip. GNOME doesn't draw title bars for apps, so this one doesn't follow its theme."
+        ));
+    }
+}
+
+/// Content for Card 2: Appearance & Theme
+fn card_appearance(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens, ctx: &mut PrefSearchContext) {
+    if ctx.checkbox(ui, &mut app.show_page_edge_shadows, tl!("Show Page Edge Shadows"), t).changed() {
+        ui.ctx().request_repaint();
+    }
+    ui.add_space(4.0);
+    crate::appearance::preferences_section_with_context(ui, app, t, ctx);
+    ui.add_space(8.0);
+    reading_colours_section(ui, app, t, ctx);
+}
+
+/// Content for Card 3: Documents and View
+fn card_documents_and_view(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens, ctx: &mut PrefSearchContext) {
+    ui.horizontal(|ui| {
+        ctx.label_primary(ui, tl!("Default workspace mode"), t);
+        ctx.pill_choice(
+            ui,
+            t,
+            &mut app.default_mode,
+            &[
+                (crate::Mode::AllTools, tl!("All tools")),
+                (crate::Mode::Read, tl!("Read")),
+                (crate::Mode::Edit, tl!("Edit")),
+                (crate::Mode::Convert, tl!("Convert")),
+                (crate::Mode::Sign, tl!("E-Sign")),
+            ],
+        );
+    });
+    ctx.label_secondary(ui, tl!("Used when opening PDFs. An explicit launch or control mode takes precedence for the session."), t);
+    ui.add_space(6.0);
+
+    let defaults = &mut app.view_defaults;
+    ui.horizontal(|ui| {
+        ctx.label_primary(ui, tl!("Default page display"), t);
+        let mut layout_choice = defaults.layout;
+        if ctx.pill_choice(ui, t, &mut layout_choice, &[(PageLayout::Single, tl!("Single page")), (PageLayout::TwoUp, tl!("Two-page view"))]) {
+            defaults.layout = layout_choice;
+        }
+        let mut continuous = defaults.continuous;
+        if ctx.toggle_pill(ui, t, &mut continuous, tl!("Continuous scrolling")) {
+            defaults.continuous = continuous;
+        }
+    });
+    ctx.checkbox(ui, &mut defaults.show_page_gaps, tl!("Show gaps between pages"), t);
+    ctx.label_secondary(ui, tl!("Hide gaps to join page edges. Margins inside the PDF remain unchanged."), t);
+    ui.add_space(6.0);
+
+    ui.horizontal(|ui| {
+        ctx.label_primary(ui, tl!("Default zoom"), t);
+        ctx.pill_choice(
+            ui,
+            t,
+            &mut defaults.fit,
+            &[(Fit::Width, tl!("Fit to width")), (Fit::Page, tl!("Zoom to page level")), (Fit::None, tl!("Custom"))],
+        );
+        let mut percent = defaults.zoom * 100.0;
+        if ui.add(egui::DragValue::new(&mut percent).range(8.0..=6400.0).max_decimals(0).suffix("%")).changed() {
+            (defaults.fit, defaults.zoom) = (Fit::None, percent / 100.0);
+        }
+    });
+    ctx.label_secondary(ui, tl!("Used when a PDF doesn't ask for a layout or zoom. Continuous scrolling never snaps between pages."), t);
+    ctx.checkbox(ui, &mut app.always_default_view, tl!("Always use my default zoom and page layout"), t);
+    ui.add_space(6.0);
+
+    ui.horizontal(|ui| {
+        ctx.label_primary(ui, tl!("Units"), t);
+        ctx.pill_choice(
+            ui,
+            t,
+            &mut app.units,
+            &[
+                (Unit::Inches, Unit::Inches.label()),
+                (Unit::Millimetres, Unit::Millimetres.label()),
+                (Unit::Centimetres, Unit::Centimetres.label()),
+                (Unit::Points, Unit::Points.label()),
+            ],
+        );
+    });
+    ctx.label_secondary(ui, tl!("For page sizes and margins."), t);
+    ui.add_space(6.0);
+    scrolling(ui, app, t, ctx);
+}
+
+/// The scroll speed and the middle button's direction, in Card 3.
+fn scrolling(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens, ctx: &mut PrefSearchContext) {
+    ui.horizontal(|ui| {
+        ctx.label_primary(ui, tl!("Scroll speed (mouse wheel and arrow keys)"), t);
+        ctx.pill_choice(
+            ui,
+            t,
+            &mut app.scroll_speed,
+            &[
+                (ScrollSpeed::Slow, tl_ctx!("scroll speed", ScrollSpeed::Slow.label())),
+                (ScrollSpeed::Normal, tl_ctx!("scroll speed", ScrollSpeed::Normal.label())),
+                (ScrollSpeed::Fast, tl_ctx!("scroll speed", ScrollSpeed::Fast.label())),
+            ],
+        );
+    });
+    ui.add_space(6.0);
+    ctx.checkbox(ui, &mut app.invert_middle_drag, tl!("Invert middle-button drag"), t);
+    ctx.label_secondary(ui, tl!("Panning or auto-scrolling with the middle (wheel) button moves the page the other way."), t);
+}
+
+/// Content for Card 4: Identity
+fn card_identity(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens, ctx: &mut PrefSearchContext) {
+    ui.horizontal(|ui| {
+        let label = ctx.label_primary(ui, tl!("Name on new comments"), t);
+        ui.add(crate::widgets::line(&mut app.comment_prefs.author).desired_width(240.0).char_limit(crate::MAX_AUTHOR_CHARS)).labelled_by(label.id);
+    });
+    ctx.checkbox(ui, &mut app.comment_prefs.hide_empty_highlight_hover, tl!("Hide hover previews for highlights without comment text"), t);
+}
+
+/// Content for Card 5: Fill & Sign
+fn card_fill_and_sign(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens, ctx: &mut PrefSearchContext) {
+    ctx.checkbox(ui, &mut app.flatten_fill_sign_on_save, tl!("Flatten Fill & Sign when saving"), t);
+    ctx.label_secondary(ui, tl!("Text, marks and signatures become part of the page. Other comments stay editable."), t);
+    ui.add_space(8.0);
+    date_format(ui, app, t, ctx);
+}
+
+/// Content for Card 6: JavaScript
+fn card_javascript(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens, ctx: &mut PrefSearchContext) {
+    let mut on = app.session.javascript();
+    if ctx.checkbox(ui, &mut on, tl!("Enable Acrobat JavaScript"), t).changed() {
+        app.session.set_javascript(on);
+    }
+    ctx.label_secondary(
+        ui,
+        tl!(
+            "Scripts run in a sandbox without file or network access. A script that asks to open a web page needs your permission first. With JavaScript off, Acrobat's standard format, validate and calculate functions still work."
+        ),
+        t,
+    );
+}
+
+/// Preferences dialog buttons: OK on the right. Returns true to close.
+pub(crate) fn preferences_buttons(ui: &mut egui::Ui) -> bool {
+    ui.add_space(10.0);
+    let mut close = false;
+    ui.horizontal(|ui| {
+        ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+            if widgets::pill_button(ui, tl!("OK"), true).clicked() {
+                close = true;
+            }
+        });
+    });
+    close
+}
+
+/// Fill & Sign date pattern and date language picker.
+fn date_format(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens, ctx: &mut PrefSearchContext) {
+    use pdfcraft_engine::dates::{DATE_FORMATS, DATE_LANGUAGES, MAX_DATE_FORMAT_CHARS};
+    ctx.label(ui, tl!("Date format"), theme::semibold(12.5), t.text);
+    let sample = |app: &PdfCraftApp, f: &str| format!("{}   {f}", app.date_text(Some(f)).unwrap_or_default());
+    ui.horizontal(|ui| {
+        let label = ctx.label_primary(ui, tl!("Fill & Sign dates"), t);
+        let current = app.session.date_format().to_string();
+        let selected = if DATE_FORMATS.contains(&current.as_str()) { sample(app, &current) } else { tl!("Custom").to_string() };
+        craft_ui::ComboBox::from_id_salt("date-format")
+            .selected_text(selected)
+            .width(240.0)
+            .show_ui(ui, |ui| {
+                for f in DATE_FORMATS {
+                    if ui.selectable_label(current == f, sample(app, f)).clicked() && app.session.set_date_format(f).is_ok() {
+                        app.date_format_draft = None;
+                        ui.close();
+                    }
+                }
+            })
+            .response
+            .labelled_by(label.id);
+    });
+    ui.horizontal(|ui| {
+        let label = ctx.label_primary(ui, tl!("Pattern"), t);
+        let mut text = app.date_format_draft.clone().unwrap_or_else(|| app.session.date_format().to_string());
+        let edit = ui.add(egui::TextEdit::singleline(&mut text).desired_width(160.0).char_limit(MAX_DATE_FORMAT_CHARS)).labelled_by(label.id);
+        if edit.changed() {
+            let _ = app.session.set_date_format(&text);
+            app.date_format_draft = Some(text.clone());
+        }
+        if !edit.has_focus() && pdfcraft_engine::dates::check_date_format(&text).is_ok() {
+            app.date_format_draft = None;
+        }
+        match app.date_text(Some(&text)) {
+            Ok(today) => {
+                let today_str = crate::i18n::fmt(tl!("Today: {date}"), &[("date", &today)]);
+                ctx.label_secondary(ui, &today_str, t);
+            }
+            Err(e) => {
+                ctx.label(ui, &e, theme::regular(13.0), Color32::from_rgb(0xD1, 0x3B, 0x3B));
+            }
+        };
+    });
+    let bad = app.date_text(None).map(|today| pdfcraft_engine::dates::unwritable(&today)).unwrap_or_default();
+    if !bad.is_empty() {
+        let bad_msg = crate::i18n::fmt(
+            tl!("{chars} can't be written into the PDF yet: Fill & Sign text is Western European only. Pick a numeric format such as dd.mm.yyyy."),
+            &[("chars", &bad)],
+        );
+        ctx.label(ui, &bad_msg, theme::regular(13.0), Color32::from_rgb(0xD1, 0x3B, 0x3B));
+    }
+    ui.horizontal(|ui| {
+        let label = ctx.label_primary(ui, tl!("Language"), t);
+        let (follow, selected, current, names) = {
+            let drawable = |text: &str| picker_text_is_drawable(ui, text);
+            let interface = crate::i18n::current().picker_name(drawable);
+            let follow = crate::i18n::fmt(tl!("Same as interface ({language})"), &[("language", interface)]);
+            let current = app.session.date_language().map(str::to_string);
+            let selected = DATE_LANGUAGES
+                .iter()
+                .find(|l| current.as_deref() == Some(l.code))
+                .map_or_else(|| follow.clone(), |l| date_language_picker_name(l, drawable).to_string());
+            let names = DATE_LANGUAGES.iter().map(|l| (l, date_language_picker_name(l, drawable))).collect::<Vec<_>>();
+            (follow, selected, current, names)
+        };
+        craft_ui::ComboBox::from_id_salt("date-language")
+            .selected_text(selected)
+            .width(240.0)
+            .show_ui(ui, |ui| {
+                if ui.selectable_label(current.is_none(), follow).clicked() && app.session.set_date_language(None).is_ok() {
+                    ui.close();
+                }
+                for (l, name) in &names {
+                    if ui.selectable_label(current.as_deref() == Some(l.code), *name).clicked() && app.session.set_date_language(Some(l.code)).is_ok()
+                    {
+                        ui.close();
+                    }
+                }
+            })
+            .response
+            .labelled_by(label.id);
+    });
+    let date_help = crate::i18n::fmt(
+        tl!(
+            "yyyy or yy year · m or mm month · mmm or mmmm month name · d or dd day · ddd or dddd weekday. H, h, M, s and t are time letters and can't be used on their own: put {escape} before a letter to show it as is."
+        ),
+        &[("escape", "\\")],
+    );
+    ctx.label_secondary(ui, &date_help, t);
+}
+
+/// Reading colours settings: presets, preview and custom replacement options.
+fn reading_colours_section(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens, ctx: &mut PrefSearchContext) {
+    ctx.label(ui, tl!("Reading colours"), theme::semibold(13.0), t.text);
+    let mode = app.reading_colors.mode_name();
+    ui.horizontal_wrapped(|ui| {
+        for (name, label, colors) in [
+            ("off", "Off", pdfcraft_render::ReadingColors::default()),
+            ("black-on-white", "Black on white", pdfcraft_render::ReadingColors::BLACK_ON_WHITE),
+            ("white-on-black", "White on black", pdfcraft_render::ReadingColors::WHITE_ON_BLACK),
+            ("yellow-on-black", "Yellow on black", pdfcraft_render::ReadingColors::YELLOW_ON_BLACK),
+            ("green-on-black", "Green on black", pdfcraft_render::ReadingColors::GREEN_ON_BLACK),
+        ] {
+            let params = colors.params.unwrap_or(pdfcraft_render::ReadingParams {
+                text: [0, 0, 0],
+                background: [255, 255, 255],
+                only_black: false,
+                line_art: true,
+            });
+            ui.vertical(|ui| {
+                ui.set_width(100.0);
+                let sample = RichText::new("Aa").size(20.0).color(Color32::from_rgb(params.text[0], params.text[1], params.text[2]));
+                let button = egui::Button::new(sample)
+                    .fill(Color32::from_rgb(params.background[0], params.background[1], params.background[2]))
+                    .min_size(vec2(90.0, 40.0))
+                    .stroke(Stroke::new(if mode == name { 2.0 } else { 1.0 }, if mode == name { t.accent } else { t.border }));
+                let response = ui.add(button);
+                response.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, mode == name, tl!(label)));
+                if response.clicked() {
+                    app.set_reading_colors(colors);
+                }
+                ctx.label(ui, tl!(label), theme::regular(12.0), t.text);
+            });
+        }
+    });
+    ui.add_space(4.0);
+    if let Some(params) = app.reading_colors.params {
+        let text = Color32::from_rgb(params.text[0], params.text[1], params.text[2]);
+        let background = Color32::from_rgb(params.background[0], params.background[1], params.background[2]);
+        egui::Frame::new().fill(background).inner_margin(12.0).corner_radius(CornerRadius::same(6)).show(ui, |ui| {
+            ui.set_min_width((ui.available_width() - 24.0).max(0.0));
+            ctx.label(ui, tl!("Reading colours"), theme::semibold(16.0), text);
+            ctx.label(ui, tl!("Colours are remapped while rendering; the document itself never changes."), theme::regular(13.0), text);
+        });
+    } else {
+        ctx.label_primary(ui, tl!("Original"), t);
+    }
+    egui::CollapsingHeader::new(tl!("Custom")).default_open(mode == "custom").show(ui, |ui| {
+        let mut colors = if app.reading_colors.params.is_some() { app.reading_colors } else { pdfcraft_render::ReadingColors::BLACK_ON_WHITE };
+        let mut changed = false;
+        if let Some(params) = colors.params.as_mut() {
+            ui.horizontal(|ui| {
+                let text = ctx.label_primary(ui, tl!("Text"), t);
+                changed |= ui.color_edit_button_srgb(&mut params.text).labelled_by(text.id).changed();
+                let background = ctx.label_primary(ui, tl!("Page background"), t);
+                changed |= ui.color_edit_button_srgb(&mut params.background).labelled_by(background.id).changed();
+            });
+            changed |= ctx.checkbox(ui, &mut params.only_black, tl!("Only change the colour of black text or line art"), t).changed();
+            changed |= ctx.checkbox(ui, &mut params.line_art, tl!("Change the colour of line art as well as text"), t).changed();
+        }
+        if changed {
+            app.set_reading_colors(colors);
+        }
+    });
+    ctx.label_secondary(ui, tl!("Colours are remapped while rendering; the document itself never changes."), t);
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_find_match_ranges_case_insensitive() {
+        let text = "Hide hover previews for highlights without comment text";
+        let ranges = find_match_ranges(text, "hide hover");
+        assert_eq!(ranges, vec![(0, 10)]);
+        assert_eq!(text.get(ranges[0].0..ranges[0].1), Some("Hide hover"));
+
+        let text2 = "Highlight fields and highlight text";
+        let ranges2 = find_match_ranges(text2, "highlight");
+        assert_eq!(ranges2.len(), 2);
+        assert_eq!(text2.get(ranges2[0].0..ranges2[0].1), Some("Highlight"));
+        assert_eq!(text2.get(ranges2[1].0..ranges2[1].1), Some("highlight"));
+
+        let ranges3 = find_match_ranges(text, "not found");
+        assert!(ranges3.is_empty());
+
+        let ranges4 = find_match_ranges(text, "");
+        assert!(ranges4.is_empty());
+    }
+
+    #[test]
+    fn test_find_match_ranges_turkish_i() {
+        let text = "Doldur ve İmzala";
+        let ranges = find_match_ranges(text, "imzala");
+        assert_eq!(ranges.len(), 1);
+        assert_eq!(text.get(ranges[0].0..ranges[0].1), Some("İmzala"));
+
+        let ranges2 = find_match_ranges(text, "İMZALA");
+        assert_eq!(ranges2.len(), 1);
+        assert_eq!(text.get(ranges2[0].0..ranges2[0].1), Some("İmzala"));
+
+        let text2 = "Doldur ve imzala";
+        let ranges3 = find_match_ranges(text2, "İmzala");
+        assert_eq!(ranges3.len(), 1);
+        assert_eq!(text2.get(ranges3[0].0..ranges3[0].1), Some("imzala"));
+
+        let ranges4 = find_match_ranges(text, "ımzala");
+        assert_eq!(ranges4.len(), 1);
+        assert_eq!(text.get(ranges4[0].0..ranges4[0].1), Some("İmzala"));
+    }
+}
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index 8def569f58..b810e2abe5 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -31,7 +31,7 @@ fn new_text_typed(v: &crate::DocView) -> bool {
 /// is a deleted annotation's page's annotations before the delete (empty for other edits).
 fn select_after_edit(
     view: &mut crate::DocView,
-    edit: Edit,
+    edit: &Edit,
     info: &pdfcraft_render::DocInfo,
     annots_before: &[pdfcraft_render::Annotation],
     quick_tool: crate::QuickTool,
@@ -39,21 +39,24 @@ fn select_after_edit(
     match edit {
         Edit::MovePages { pages, to } => {
             let n = pages.iter().collect::<std::collections::BTreeSet<_>>().len();
-            let to = to.min(info.pages.len() - n);
+            let to = (*to).min(info.pages.len() - n);
             view.select_pages(&(to..to + n).collect::<Vec<_>>());
         }
         Edit::DuplicatePages { pages, at: Some(at) } => {
             let n = pages.iter().collect::<std::collections::BTreeSet<_>>().len();
-            let at = at.min(info.pages.len().saturating_sub(n));
+            let at = (*at).min(info.pages.len().saturating_sub(n));
             view.select_pages(&(at..at + n).collect::<Vec<_>>());
         }
-        Edit::InsertBlankPage { at, .. } => view.select_pages(&[at.min(info.pages.len() - 1)]),
+        Edit::InsertBlankPage { at, .. } => view.select_pages(&[(*at).min(info.pages.len() - 1)]),
         Edit::DeletePages { .. } => view.select_pages(&[]),
         // A stroke drawn with the pen stays unselected, so the selection box and
         // author popup don't sit over the next stroke (#429).
         Edit::AddAnnotation(a)
-            if matches!(a.shape, pdfcraft_engine::Shape::Ink { .. })
-                && quick_tool == crate::QuickTool::Comment(crate::comments::CommentTool::Ink) =>
+            if matches!(a.shape, pdfcraft_engine::Shape::Ink { .. } | pdfcraft_engine::Shape::FreehandHighlight { .. })
+                && matches!(
+                    quick_tool,
+                    crate::QuickTool::Comment(crate::comments::CommentTool::Ink | crate::comments::CommentTool::FreehandHighlight)
+                ) =>
         {
             view.comments.selected = None;
         }
@@ -71,7 +74,7 @@ fn select_after_edit(
                 view.comments.open_editor(a.page, n, String::new());
             }
         }
-        Edit::DeleteAnnotation { page, index } => view.comments.annotation_deleted(annots_before, &info.annotations, (page, index)),
+        Edit::DeleteAnnotation { page, index } => view.comments.annotation_deleted(annots_before, &info.annotations, (*page, *index)),
         _ => {}
     }
 }
@@ -112,6 +115,25 @@ impl PdfCraftApp {
     pub fn apply_edit(&mut self, edit: Edit) -> bool {
         let Some((i, id)) = self.active_ids() else { return false };
         let label = edit.label();
+        let target_arrange_image = match &edit {
+            Edit::EditPageImage { page, index, change: pdfcraft_engine::ImageEdit::Arrange(_) } => {
+                let doc = self.session.get(id);
+                let target = doc.and_then(|d| d.page_images(*page).get(*index).cloned());
+                let ambiguous = doc.is_some_and(|d| {
+                    if let Some(t) = &target {
+                        d.page_images(*page)
+                            .iter()
+                            .filter(|img| img.name == t.name && img.object == t.object && rect_matches(img.rect, t.rect))
+                            .count()
+                            > 1
+                    } else {
+                        false
+                    }
+                });
+                target.map(|t| (t, ambiguous))
+            }
+            _ => None,
+        };
         let (form_before, page_count_before, had_xfa) = if let Some(d) = self.session.get(id) {
             (Some(std::sync::Arc::clone(&d.form)), d.info.pages.len(), d.xfa.is_some())
         } else {
@@ -166,7 +188,11 @@ impl PdfCraftApp {
                     view.comments.comment_added();
                 }
                 // Keep the pages the user acted on selected, where they now are.
-                select_after_edit(view, edit, info, &annots_before, self.quick_tool);
+                select_after_edit(view, &edit, info, &annots_before, self.quick_tool);
+                if let (Some((target, ambiguous_before)), Edit::EditPageImage { page, .. }) = (target_arrange_image, &edit) {
+                    let page_images = doc.page_images(*page);
+                    re_resolve_image_selection(view, *page, &target, ambiguous_before, &page_images);
+                }
                 if std::mem::take(&mut view.comments.tool_done) && !self.comment_prefs.pinned {
                     self.quick_tool = crate::QuickTool::Select;
                 }
@@ -187,6 +213,9 @@ impl PdfCraftApp {
                 if let Some(view) = self.views.get_mut(i) {
                     // A drawing whose annotation wasn't added must not stay painted.
                     view.comments.drawings_refused();
+                    if matches!(&edit, Edit::EditPageImage { change, .. } if !matches!(change, pdfcraft_engine::ImageEdit::Arrange(_))) {
+                        view.image_selection = None;
+                    }
                     // A paragraph that couldn't be applied opens again with its typing, instead of
                     // the box the click moved to.
                     if let Edit::EditTextBlock { page, block, .. } = &edit
@@ -287,13 +316,34 @@ impl PdfCraftApp {
         if !self.close_text_editors(i, id) {
             return;
         }
+        let target_image = self.views.get(i).and_then(|v| v.image_selection.as_ref()).and_then(|s| {
+            let doc = self.session.get(id)?;
+            let images = doc.page_images(s.page);
+            let target = images.get(s.index).cloned()?;
+            let ambiguous =
+                images.iter().filter(|img| img.name == target.name && img.object == target.object && rect_matches(img.rect, target.rect)).count() > 1;
+            Some((s.page, target, ambiguous))
+        });
+        let had_selection = self.views.get(i).and_then(|v| v.image_selection.as_ref()).is_some();
         let result = if undo { self.session.undo(id) } else { self.session.redo(id) };
         match result {
             Ok(label) => {
-                if let Some(doc) = self.session.get(id) {
-                    self.views[i].document_changed(&doc.info);
+                if let Some(doc) = self.session.get(id)
+                    && let Some(view) = self.views.get_mut(i)
+                {
+                    view.document_changed(&doc.info);
+                    view.picked_image = None;
+                    if let Some((page, target, ambiguous_before)) = target_image {
+                        let page_images = doc.page_images(page);
+                        re_resolve_image_selection(view, page, &target, ambiguous_before, &page_images);
+                    } else if had_selection {
+                        view.image_selection = None;
+                    }
+                }
+                if let Some(view) = self.views.get_mut(i) {
+                    view.comments.selected = None;
+                    view.comments.history_stepped();
                 }
-                self.views[i].comments.history_stepped();
                 let label = crate::i18n::edit_label(&label);
                 if undo {
                     self.notify_fmt("Undid {label}", &[("label", &label)]);
@@ -783,6 +833,48 @@ impl PdfCraftApp {
     }
 }
 
+fn rect_matches(a: [f64; 4], b: [f64; 4]) -> bool {
+    a.iter().zip(b.iter()).all(|(x, y)| (x - y).abs() < 1e-3)
+}
+
+fn re_resolve_image_selection(
+    view: &mut crate::DocView,
+    page: usize,
+    target: &pdfcraft_engine::PageImage,
+    ambiguous_before: bool,
+    page_images: &[pdfcraft_engine::PageImage],
+) {
+    let exact_matches: Vec<usize> = page_images
+        .iter()
+        .enumerate()
+        .filter(|(_, img)| img.name == target.name && img.object == target.object && rect_matches(img.rect, target.rect))
+        .map(|(idx, _)| idx)
+        .collect();
+    let new_idx = if !ambiguous_before && exact_matches.len() == 1 {
+        exact_matches.first().copied()
+    } else if !ambiguous_before && exact_matches.is_empty() {
+        let name_obj_matches: Vec<usize> =
+            page_images.iter().enumerate().filter(|(_, img)| img.name == target.name && img.object == target.object).map(|(idx, _)| idx).collect();
+        if name_obj_matches.len() == 1 {
+            name_obj_matches.first().copied()
+        } else if name_obj_matches.is_empty() {
+            let name_matches: Vec<usize> = page_images.iter().enumerate().filter(|(_, img)| img.name == target.name).map(|(idx, _)| idx).collect();
+            if name_matches.len() == 1 { name_matches.first().copied() } else { None }
+        } else {
+            None
+        }
+    } else {
+        None
+    };
+    if let Some(s) = view.image_selection.as_mut().filter(|s| s.page == page) {
+        if let Some(idx) = new_idx {
+            s.index = idx;
+        } else {
+            view.image_selection = None;
+        }
+    }
+}
+
 /// The single page a content edit changes (`None` for other edits). Like comment edits,
 /// these leave every other page's bytes, geometry and text alone, so their rasters stay valid.
 fn content_page(edit: &Edit) -> Option<usize> {
diff --git a/crates/ui-egui/src/home.rs b/crates/ui-egui/src/home.rs
index 390b059228..4f5ac9deba 100644
--- a/crates/ui-egui/src/home.rs
+++ b/crates/ui-egui/src/home.rs
@@ -20,6 +20,57 @@ pub(crate) fn card_lift(ui: &egui::Ui, t: &Tokens, rect: Rect, press: theme::Pre
     }
 }
 
+/// Render a single tool card with the standard lift, styling, icon, title, description, and action.
+/// If `allow_unpin` is true, an unpin button is always accessible in the top right corner.
+fn tool_card(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens, g: &'static catalog::ToolGroup, allow_unpin: bool) -> Option<&'static str> {
+    let (rect, resp) = ui.allocate_exact_size(vec2(190.0, 104.0), Sense::click());
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!(g.label)));
+    let press = theme::Press::track(ui, &resp);
+    card_lift(ui, t, rect, press);
+    let fill = press.fill(t.card, t.hover, t.pressed);
+    ui.painter().rect(rect, CornerRadius::same(10), fill, Stroke::new(1.0, t.divider), egui::StrokeKind::Inside);
+    let body = rect.translate(press.offset());
+    let color = egui::Color32::from_rgb(g.hue[0], g.hue[1], g.hue[2]);
+    icons::paint(ui, Rect::from_min_size(body.min + vec2(14.0, 14.0), vec2(22.0, 22.0)), g.icon, 21.0, color);
+
+    let mut unpin_clicked = false;
+    if allow_unpin {
+        let unpin_rect = Rect::from_center_size(body.right_top() + vec2(-18.0, 18.0), vec2(22.0, 22.0));
+        let unpin_resp = ui.interact(unpin_rect, ui.scope_id().with(("unpin_card_btn", g.id)), Sense::click());
+        unpin_resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!("Unpin tool")));
+        if unpin_resp.hovered() {
+            ui.painter().rect_filled(unpin_rect, CornerRadius::same(4), t.pressed);
+        }
+        icons::paint(ui, unpin_rect.shrink(4.0), "x", 14.0, t.icon);
+        if unpin_resp.on_hover_text(tl!("Unpin from Home")).clicked() {
+            unpin_clicked = true;
+        }
+    }
+
+    let mut title_job = egui::text::LayoutJob::simple_singleline(tl!(g.label).to_owned(), theme::semibold(13.5), t.text);
+    title_job.wrap = egui::text::TextWrapping { max_width: body.width() - 58.0, max_rows: 1, break_anywhere: true, ..Default::default() };
+    let title = ui.fonts_mut(|f| f.layout_job(title_job));
+    let title_elided = title.elided;
+    ui.painter().galley(body.min + vec2(44.0, 25.0 - title.size().y * 0.5), title, t.text);
+    let blurb = g.sections.first().map(|s| s.items.iter().take(3).map(|i| tl!(i.label)).collect::<Vec<_>>().join(" · ")).unwrap_or_default();
+    // Fixed-height cards must leave room for their action in every language.
+    let mut job = egui::text::LayoutJob::simple(blurb.clone(), theme::regular(11.5), t.text_muted, body.width() - 28.0);
+    job.wrap.max_rows = 2;
+    let galley = ui.fonts_mut(|f| f.layout_job(job));
+    let blurb_elided = galley.elided;
+    ui.painter().galley(body.min + vec2(14.0, 46.0), galley, t.text_muted);
+    ui.painter().text(body.left_bottom() + vec2(14.0, -14.0), Align2::LEFT_CENTER, tl!("Use now"), theme::medium(12.0), t.accent_text);
+    let resp = if title_elided || blurb_elided { resp.on_hover_text(format!("{}\n{blurb}", tl!(g.label))) } else { resp };
+    if unpin_clicked {
+        Some(g.id)
+    } else {
+        if theme::hand(resp).clicked() {
+            app.select_tool(g.id);
+        }
+        None
+    }
+}
+
 /// Draw the Home page with the welcome text, community card and recent documents.
 pub fn show(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
     let t = Tokens::get(ui.ctx());
@@ -73,44 +124,11 @@ pub fn show(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                     ui.horizontal_wrapped(|ui| {
                         ui.spacing_mut().item_spacing = vec2(14.0, 14.0);
                         for id in RECOMMENDED {
-                            let Some(g) = catalog::group(id) else { continue };
-                            let (rect, resp) = ui.allocate_exact_size(vec2(190.0, 104.0), Sense::click());
-                            resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!(g.label)));
-                            let press = theme::Press::track(ui, &resp);
-                            card_lift(ui, &t, rect, press);
-                            let fill = press.fill(t.card, t.hover, t.pressed);
-                            ui.painter().rect(rect, CornerRadius::same(10), fill, Stroke::new(1.0, t.divider), egui::StrokeKind::Inside);
-                            let body = rect.translate(press.offset());
-                            let color = egui::Color32::from_rgb(g.hue[0], g.hue[1], g.hue[2]);
-                            icons::paint(ui, Rect::from_min_size(body.min + vec2(14.0, 14.0), vec2(22.0, 22.0)), g.icon, 21.0, color);
-                            let mut title_job = egui::text::LayoutJob::simple_singleline(tl!(g.label).to_owned(), theme::semibold(13.5), t.text);
-                            title_job.wrap =
-                                egui::text::TextWrapping { max_width: body.width() - 58.0, max_rows: 1, break_anywhere: true, ..Default::default() };
-                            let title = ui.fonts_mut(|f| f.layout_job(title_job));
-                            let title_elided = title.elided;
-                            ui.painter().galley(body.min + vec2(44.0, 25.0 - title.size().y * 0.5), title, t.text);
-                            let blurb = g
-                                .sections
-                                .first()
-                                .map(|s| s.items.iter().take(3).map(|i| tl!(i.label)).collect::<Vec<_>>().join(" · "))
-                                .unwrap_or_default();
-                            // Fixed-height cards must leave room for their action in every language.
-                            let mut job = egui::text::LayoutJob::simple(blurb.clone(), theme::regular(11.5), t.text_muted, body.width() - 28.0);
-                            job.wrap.max_rows = 2;
-                            let galley = ui.fonts_mut(|f| f.layout_job(job));
-                            let blurb_elided = galley.elided;
-                            ui.painter().galley(body.min + vec2(14.0, 46.0), galley, t.text_muted);
-                            ui.painter().text(
-                                body.left_bottom() + vec2(14.0, -14.0),
-                                Align2::LEFT_CENTER,
-                                tl!("Use now"),
-                                theme::medium(12.0),
-                                t.accent_text,
-                            );
-                            let resp = if title_elided || blurb_elided { resp.on_hover_text(format!("{}\n{blurb}", tl!(g.label))) } else { resp };
-                            if theme::hand(resp).clicked() {
-                                app.select_tool(g.id);
+                            if app.is_tool_pinned(id) {
+                                continue;
                             }
+                            let Some(g) = catalog::group(id) else { continue };
+                            tool_card(app, ui, &t, g, false);
                         }
                         let (rect, resp) = ui.allocate_exact_size(vec2(170.0, 104.0), Sense::click());
                         resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!("Open file")));
@@ -132,31 +150,64 @@ pub fn show(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                     });
                 });
 
+            ui.add_space(26.0);
+            let mut unpin_tool = None;
+            ui.horizontal(|ui| {
+                ui.label(egui::RichText::new(tl!("Pinned Tools")).font(theme::semibold(17.0)));
+                ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+                    if widgets::ghost_button(ui, "pin", tl!("Pin a tool…")).clicked() {
+                        app.dialog = Some(crate::Dialog::PinTool);
+                    }
+                });
+            });
+            ui.add_space(4.0);
+            if app.pinned_tools.is_empty() {
+                ui.label(egui::RichText::new(tl!("Pin your favorite tools here for quick access.")).color(t.text_muted));
+            } else {
+                ui.add_space(6.0);
+                let pinned = app.pinned_tools.clone();
+                ui.horizontal_wrapped(|ui| {
+                    ui.spacing_mut().item_spacing = vec2(14.0, 14.0);
+                    for id in &pinned {
+                        let Some(g) = catalog::group(id) else { continue };
+                        if let Some(to_unpin) = tool_card(app, ui, &t, g, true) {
+                            unpin_tool = Some(to_unpin);
+                        }
+                    }
+                });
+            }
+            if let Some(id) = unpin_tool {
+                app.unpin_tool(id);
+            }
+
             #[cfg(not(target_arch = "wasm32"))]
             {
                 ui.add_space(26.0);
                 crate::folders_ui::section(app, ui);
             }
 
-            ui.add_space(26.0);
             let mut clear = false;
-            ui.horizontal(|ui| {
-                ui.label(egui::RichText::new(tl!("Recent")).font(theme::semibold(17.0)));
-                if !app.recent.is_empty() {
-                    ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
-                        let resp = widgets::ghost_button(ui, "trash-2", tl!("Clear"));
-                        resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!("Clear Recent Files")));
-                        clear = resp.on_hover_text(tl!("Clear Recent Files")).clicked();
-                    });
+            // Preferences can turn the list off (#5572).
+            if app.recent_limit > 0 {
+                ui.add_space(26.0);
+                ui.horizontal(|ui| {
+                    ui.label(egui::RichText::new(tl!("Recent")).font(theme::semibold(17.0)));
+                    if !app.recent.is_empty() {
+                        ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+                            let resp = widgets::ghost_button(ui, "trash-2", tl!("Clear"));
+                            resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!("Clear Recent Files")));
+                            clear = resp.on_hover_text(tl!("Clear Recent Files")).clicked();
+                        });
+                    }
+                });
+                ui.add_space(8.0);
+                if app.recent.is_empty() {
+                    ui.label(egui::RichText::new(tl!("Files you open in PdfCraft appear here. Drop a PDF anywhere to open it.")).color(t.text_muted));
                 }
-            });
-            ui.add_space(8.0);
-            if app.recent.is_empty() {
-                ui.label(egui::RichText::new(tl!("Files you open in PdfCraft appear here. Drop a PDF anywhere to open it.")).color(t.text_muted));
             }
             let mut open = None;
             let mut remove = None;
-            for r in &app.recent {
+            for r in app.recent.iter().take(app.recent_limit) {
                 let (rect, resp) = ui.allocate_exact_size(vec2(ui.available_width(), 46.0), Sense::click());
                 resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, &r.name));
                 let press = theme::Press::track(ui, &resp);
@@ -229,6 +280,41 @@ pub fn show(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
 mod tests {
     use super::*;
 
+    fn review_home_harness() -> egui_kittest::Harness<'static, PdfCraftApp> {
+        crate::i18n::set_current(crate::i18n::Lang::EN);
+        let mut app = PdfCraftApp::new();
+        app.pinned_tools = vec!["edit".into()];
+        let mut fonts = false;
+        egui_kittest::Harness::builder().with_size(vec2(1500.0, 1200.0)).build_ui_state(
+            move |ui, app| {
+                if !fonts {
+                    ui.ctx().set_fonts(theme::font_definitions());
+                    fonts = true;
+                }
+                show(app, ui);
+            },
+            app,
+        )
+    }
+
+    #[test]
+    fn review_pinned_recommended_tools_appear_once() {
+        use egui_kittest::kittest::Queryable;
+        let mut h = review_home_harness();
+        h.run_steps(3);
+        assert_eq!(h.get_all_by_label("Edit a PDF").count(), 1);
+    }
+
+    #[test]
+    fn review_a_pinned_tool_can_be_unpinned_without_hover() {
+        use egui_kittest::kittest::Queryable;
+        let mut h = review_home_harness();
+        h.run_steps(3);
+        h.get_by_label("Unpin tool").click();
+        h.run_steps(2);
+        assert!(h.state().pinned_tools.is_empty());
+    }
+
     #[test]
     fn translated_card_description_leaves_room_for_the_action() {
         let de = crate::i18n::Lang::from_code("de").unwrap();
diff --git a/crates/ui-egui/src/hotbar.rs b/crates/ui-egui/src/hotbar.rs
new file mode 100644
index 0000000000..c66b7e30b0
--- /dev/null
+++ b/crates/ui-egui/src/hotbar.rs
@@ -0,0 +1,811 @@
+//! A movable, persistent set of shortcuts to the shared command registry and core document tools.
+use egui::{Color32, CornerRadius, Rect, Sense, Stroke, vec2};
+use pdfcraft_engine::Edit;
+use pdfcraft_engine::commands::{COMMANDS, command};
+use serde::{Deserialize, Serialize};
+
+use crate::{PdfCraftApp, QuickTool, comments, icons, theme, theme::Tokens};
+
+/// Persistent state and UI state for the customizable document hotbar.
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(default)]
+pub(crate) struct Hotbar {
+    pub tools: Vec<String>,
+    /// Position as a fraction of the available travel, so resizing keeps the bar visible.
+    pub position: [f32; 2],
+    pub vertical: bool,
+    pub button_size: f32,
+    pub dock: Option<String>,
+    pub full_side: bool,
+    #[serde(default)]
+    pub placed: bool,
+    #[serde(skip)]
+    search: String,
+    #[serde(skip)]
+    picker_open: bool,
+}
+
+impl Default for Hotbar {
+    /// Create a default vertical floating hotbar positioned in the document margin.
+    fn default() -> Self {
+        Self {
+            tools: Vec::new(),
+            position: [0.0, 0.0],
+            vertical: true,
+            button_size: 32.0,
+            dock: None,
+            full_side: false,
+            placed: false,
+            search: String::new(),
+            picker_open: false,
+        }
+    }
+}
+
+impl Hotbar {
+    /// Clamp button size and normalized position coordinates, drop unknown docked sides,
+    /// and deduplicate/filter tool command identifiers against the command registry.
+    pub fn normalize(&mut self) {
+        self.button_size = if self.button_size.is_finite() { self.button_size.clamp(24.0, 64.0) } else { 32.0 };
+        if self.dock.as_deref().is_some_and(|side| !matches!(side, "left" | "right" | "top" | "bottom")) {
+            self.dock = None;
+        }
+        let mut seen = std::collections::HashSet::new();
+        self.tools.retain(|id| command(id).is_some() && seen.insert(id.clone()));
+        for coordinate in &mut self.position {
+            *coordinate = if coordinate.is_finite() { coordinate.clamp(0.0, 1.0) } else { 0.5 };
+        }
+        if self.dock.is_some() || self.position != [0.0, 0.0] {
+            self.placed = true;
+        }
+    }
+
+    /// Adopt preferences saved before the hotbar absorbed the quick-action bar (#5890), which have
+    /// no `placed` key. A bar left at that release's default (floating, horizontal, top centre)
+    /// moves to the new default in the left margin; any other spot is one the user chose, so it
+    /// is kept, including the top-left corner.
+    pub fn adopt_legacy(&mut self) {
+        if self.dock.is_none() && !self.vertical && self.position == [0.5, 0.0] {
+            self.position = [0.0, 0.0];
+            self.vertical = true;
+            self.full_side = false;
+            self.placed = false;
+        } else {
+            self.placed = true;
+        }
+    }
+
+    /// Parse and validate a comma-separated list of command identifiers for the hotbar.
+    pub fn set_tools(&mut self, value: &str) -> Result<(), String> {
+        let tools: Vec<String> = value.split(',').map(str::trim).filter(|s| !s.is_empty()).map(str::to_owned).collect();
+        if let Some(id) = tools.iter().find(|id| command(id).is_none()) {
+            return Err(format!("Unknown hotbar command: {id}"));
+        }
+        self.tools = tools;
+        self.normalize();
+        Ok(())
+    }
+
+    /// Dock the hotbar to `"left"`, `"right"`, `"top"`, or `"bottom"`, or undock with `"float"`.
+    pub fn place(&mut self, side: &str) -> Result<(), String> {
+        if side == "float" {
+            self.dock = None;
+            self.placed = true;
+            return Ok(());
+        }
+        let (position, vertical) = match side {
+            "left" => ([0.0, 0.5], true),
+            "right" => ([1.0, 0.5], true),
+            "top" => ([0.5, 0.0], false),
+            "bottom" => ([0.5, 1.0], false),
+            _ => return Err("hotbar-side must be float, left, right, top or bottom".into()),
+        };
+        self.dock = Some(side.to_owned());
+        self.position = position;
+        self.vertical = vertical;
+        self.placed = true;
+        Ok(())
+    }
+}
+
+/// Render the hotbar settings gear button and open the tool picker when clicked.
+fn settings_button(ui: &mut egui::Ui, cell: f32, picker_open: &mut bool) -> bool {
+    let settings = ui
+        .push_id("hotbar-settings", |ui| {
+            icons::button(ui, "settings", cell, false, tl!("Hotbar settings")).on_hover_text(tl!("Hotbar settings / add tools"))
+        })
+        .inner;
+    if settings.clicked() {
+        *picker_open = true;
+        true
+    } else {
+        false
+    }
+}
+
+/// Determine where flyout popup menus should open from a toolbar button based on docking and layout.
+fn popup_align_for(dock: Option<&str>, vertical: bool) -> egui::RectAlign {
+    match dock {
+        Some("right") => egui::RectAlign::LEFT_START,
+        Some("bottom") => egui::RectAlign::TOP_START,
+        Some("top") => egui::RectAlign::BOTTOM_START,
+        _ => {
+            if vertical {
+                egui::RectAlign::RIGHT_START
+            } else {
+                egui::RectAlign::BOTTOM_START
+            }
+        }
+    }
+}
+
+/// Whether `spec` matches the hotbar picker search query across the translated label, canonical
+/// English label, or command identifier (case-insensitively).
+fn matches_search(spec: &pdfcraft_engine::commands::CommandSpec, query: &str) -> bool {
+    let search = query.to_lowercase();
+    tl!(spec.label).to_lowercase().contains(&search) || spec.label.to_lowercase().contains(&search) || spec.id.to_lowercase().contains(&search)
+}
+
+/// Render the configured custom tool shortcut buttons and their removal context menus.
+fn tool_buttons(ui: &mut egui::Ui, app: &PdfCraftApp, tools: &[String], cell: f32, run: &mut Option<&'static str>, remove: &mut Option<usize>) {
+    for (index, id) in tools.iter().enumerate() {
+        let Some(spec) = command(id) else { continue };
+        let active = crate::comments::CommentTool::from_command(id).is_some_and(|tool| app.quick_tool == crate::QuickTool::Comment(tool));
+        let button = ui.add_enabled_ui(app.command_enabled(spec), |ui| icons::button(ui, spec.icon, cell, active, tl!(spec.label))).inner;
+        if button.clicked() {
+            *run = Some(spec.id);
+        }
+        button.context_menu(|ui| {
+            if ui.button(tl!("Remove from hotbar")).clicked() {
+                *remove = Some(index);
+                ui.close();
+            }
+        });
+    }
+}
+
+/// Render core quick tools: Select, Hand, Comment groups, Edit text, and Fill & Sign.
+fn core_tool_buttons(ui: &mut egui::Ui, app: &mut PdfCraftApp, cell: f32, popup_align: egui::RectAlign, t: &Tokens) {
+    if icons::button(ui, "mouse-pointer-2", cell, app.quick_tool == QuickTool::Select, tl!("Select (V)")).clicked() {
+        app.quick_tool = QuickTool::Select;
+    }
+    if icons::button(ui, "hand", cell, app.quick_tool == QuickTool::Hand, tl!("Hand (H)")).clicked() {
+        app.quick_tool = QuickTool::Hand;
+    }
+    // Comment ▸, Highlight ▸, Draw ▸ (Acrobat's comment toolbar groups). Clicking a
+    // group selects its last-used tool; clicking it again opens the flyout.
+    for g in 0..comments::GROUPS.len() {
+        let current = app.comment_prefs.group_tool[g];
+        let active = matches!(app.quick_tool, QuickTool::Comment(t) if t.group() == g);
+        let resp = icons::button(ui, current.icon(), cell, active, tl!(current.label()));
+        if comments::GROUPS[g].len() == 1 {
+            if resp.clicked() {
+                app.execute(current.command());
+            }
+            continue;
+        }
+        // A small corner triangle marks the flyout.
+        let r = resp.rect;
+        let tri = [r.right_bottom() + vec2(-4.0, -4.0), r.right_bottom() + vec2(-9.0, -4.0), r.right_bottom() + vec2(-4.0, -9.0)];
+        ui.painter().add(egui::Shape::convex_polygon(tri.to_vec(), if active { t.accent } else { t.text_faint }, Stroke::NONE));
+        let open = (resp.clicked() && active) || resp.secondary_clicked();
+        if resp.clicked() && !active {
+            app.execute(current.command());
+        }
+        egui::Popup::menu(&resp).open_memory(open.then_some(egui::SetOpenCommand::Toggle)).align(popup_align).gap(6.0).show(|ui| {
+            for tool in comments::GROUPS[g] {
+                let on = app.quick_tool == QuickTool::Comment(*tool);
+                let (row, click) = ui.allocate_exact_size(vec2(180.0, 28.0), Sense::click());
+                let press = theme::Press::track(ui, &click);
+                press.wash(ui, row, 4, on);
+                let body = row.translate(press.offset());
+                icons::paint(ui, Rect::from_min_size(body.min + vec2(8.0, 6.0), vec2(16.0, 16.0)), tool.icon(), 16.0, t.text);
+                let reserve = if on { 28.0 } else { 8.0 };
+                crate::widgets::paint_left(
+                    ui,
+                    body.left_center() + vec2(34.0, 0.0),
+                    tl!(tool.label()),
+                    theme::regular(13.0),
+                    t.text,
+                    (row.width() - 34.0 - reserve).max(0.0),
+                );
+                if on {
+                    icons::paint(ui, Rect::from_min_size(body.right_top() + vec2(-24.0, 7.0), vec2(14.0, 14.0)), "check", 14.0, t.accent);
+                }
+                let click = theme::hand(click);
+                let info = tl!(tool.label()).to_string();
+                click.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, on, info.clone()));
+                if click.clicked() {
+                    app.execute(tool.command());
+                    ui.close();
+                }
+            }
+        });
+    }
+    // Edit text & images, while the Edit workspace is open (Acrobat's Edit toolbar)
+    // or the tool is in use.
+    if app.mode == crate::Mode::Edit || app.quick_tool == QuickTool::EditText {
+        let on = app.quick_tool == QuickTool::EditText;
+        if icons::button(ui, "text-cursor-input", cell, on, tl!("Edit text & images")).clicked() {
+            if on {
+                app.put_down_edit_text();
+            } else {
+                app.quick_tool = QuickTool::EditText;
+            }
+        }
+    }
+    // Fill & Sign ▸ (text, marks, date, signature).
+    let current_fill = match app.quick_tool {
+        QuickTool::Fill(f) => Some(f),
+        _ => None,
+    };
+    let shown = current_fill.unwrap_or(crate::fill_sign::FillTool::Text);
+    let resp = icons::button(ui, if current_fill.is_some() { shown.icon() } else { "pen-line" }, cell, current_fill.is_some(), tl!("Fill & Sign"));
+    let r = resp.rect;
+    let tri = [r.right_bottom() + vec2(-4.0, -4.0), r.right_bottom() + vec2(-9.0, -4.0), r.right_bottom() + vec2(-4.0, -9.0)];
+    ui.painter().add(egui::Shape::convex_polygon(tri.to_vec(), if current_fill.is_some() { t.accent } else { t.text_faint }, Stroke::NONE));
+    if resp.clicked() && current_fill.is_none() {
+        app.execute(shown.command());
+    }
+    let open = (resp.clicked() && current_fill.is_some()) || resp.secondary_clicked();
+    egui::Popup::menu(&resp).open_memory(open.then_some(egui::SetOpenCommand::Toggle)).align(popup_align).gap(6.0).show(|ui| {
+        for tool in crate::fill_sign::FILL_TOOLS {
+            if matches!(tool, crate::fill_sign::FillTool::Signature | crate::fill_sign::FillTool::Initials) {
+                continue;
+            }
+            let on = current_fill == Some(tool);
+            let (row, click) = ui.allocate_exact_size(vec2(180.0, 28.0), Sense::click());
+            let press = theme::Press::track(ui, &click);
+            press.wash(ui, row, 4, on);
+            let body = row.translate(press.offset());
+            icons::paint(ui, Rect::from_min_size(body.min + vec2(8.0, 6.0), vec2(16.0, 16.0)), tool.icon(), 16.0, t.text);
+            let reserve = if on { 28.0 } else { 8.0 };
+            crate::widgets::paint_left(
+                ui,
+                body.left_center() + vec2(34.0, 0.0),
+                tl!(tool.label()),
+                theme::regular(13.0),
+                t.text,
+                (row.width() - 34.0 - reserve).max(0.0),
+            );
+            if on {
+                icons::paint(ui, Rect::from_min_size(body.right_top() + vec2(-24.0, 7.0), vec2(14.0, 14.0)), "check", 14.0, t.accent);
+            }
+            let click = theme::hand(click);
+            let info = tl!(tool.label()).to_string();
+            click.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, on, info.clone()));
+            if click.clicked() {
+                app.execute(tool.command());
+                ui.close();
+            }
+        }
+        ui.separator();
+        if let Some(command) = crate::fill_sign::signature_entries(ui, app, t) {
+            app.execute(command);
+            ui.close();
+        }
+    });
+}
+
+/// Extra controls rendered below/beside the buttons when a comment or fill tool is active.
+fn active_tool_controls(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens, vertical: bool) {
+    let current_fill = match app.quick_tool {
+        QuickTool::Fill(f) => Some(f),
+        _ => None,
+    };
+    if matches!(current_fill, Some(crate::fill_sign::FillTool::Text | crate::fill_sign::FillTool::Date)) {
+        if vertical {
+            ui.label(tl!("Font size:"));
+        }
+        let size = ui.add(
+            egui::DragValue::new(&mut app.fill_text_size)
+                .range(crate::fill_sign::MIN_TEXT_SIZE..=crate::fill_sign::MAX_TEXT_SIZE)
+                .speed(0.25)
+                .suffix(" pt"),
+        );
+        if ((size.changed() && !size.dragged()) || size.drag_stopped())
+            && let Some((index, id)) = app.active_ids()
+            && let Some((page, annotation)) = app.views.get(index).and_then(|view| view.comments.selected)
+            && app.session.get(id).is_some_and(|doc| {
+                doc.allows_annotation()
+                    && doc
+                        .info
+                        .annotations
+                        .iter()
+                        .any(|a| a.page == page && a.index == annotation && a.fill_sign && a.subtype == "FreeText" && !a.locked)
+            })
+        {
+            app.apply_edit(Edit::FontSizeAnnotation { page, index: annotation, size: app.fill_text_size });
+        }
+        ui.menu_button(tl!("Colour"), |ui| {
+            if let Some(color) = comments::swatch_grid(ui, Some(app.fill_text_color)) {
+                app.fill_text_color = color;
+                ui.close();
+            }
+        });
+    }
+    if let QuickTool::Comment(tool) = app.quick_tool {
+        let (r, _) = if vertical {
+            ui.allocate_exact_size(vec2(crate::canvas::bars::QUICK_BAR_WIDTH, 9.0), Sense::hover())
+        } else {
+            ui.allocate_exact_size(vec2(9.0, crate::canvas::bars::QUICK_BAR_WIDTH), Sense::hover())
+        };
+        if vertical {
+            ui.painter().hline(r.x_range().shrink(6.0), r.center().y, Stroke::new(1.0, t.divider));
+        } else {
+            ui.painter().vline(r.center().x, r.y_range().shrink(6.0), Stroke::new(1.0, t.divider));
+        }
+        if let Some(color) = comments::quick_bar_controls(ui, tool, &mut app.comment_prefs)
+            && let Some((index, id)) = app.active_ids()
+            && let Some((page, annotation)) = app.views.get(index).and_then(|view| view.comments.selected)
+            && app.session.get(id).is_some_and(|doc| {
+                doc.allows_annotation()
+                    && doc
+                        .info
+                        .annotations
+                        .iter()
+                        .any(|a| a.page == page && a.index == annotation && !a.is_reply() && !a.locked && comments::made_by(a, tool))
+            })
+        {
+            app.apply_edit(Edit::StyleAnnotation { page, index: annotation, color: Some(color), opacity: None, width: None, endings: None });
+        }
+    }
+}
+
+/// Render a modern iOS-style pill toggle switch.
+fn toggle_switch(ui: &mut egui::Ui, on: &mut bool, label: &str, t: &Tokens) -> egui::Response {
+    let width = 34.0;
+    let height = 18.0;
+    let (rect, mut response) = ui.allocate_exact_size(vec2(width, height), Sense::click());
+    if response.clicked() {
+        *on = !*on;
+        response.mark_changed();
+    }
+    response.widget_info(|| egui::WidgetInfo::selected(egui::Role::Switch, ui.is_enabled(), *on, label));
+
+    if ui.is_rect_visible(rect) {
+        let radius = height / 2.0;
+        let bg_color = if *on { t.accent } else { t.border };
+        ui.painter().rect(rect, CornerRadius::same(radius as u8), bg_color, Stroke::NONE, egui::StrokeKind::Inside);
+        let circle_radius = radius - 2.5;
+        let circle_x = if *on { rect.max.x - radius } else { rect.min.x + radius };
+        ui.painter().circle_filled(egui::pos2(circle_x, rect.center().y), circle_radius, Color32::WHITE);
+    }
+    response
+}
+
+/// Render the dock placement choice: [ Float | Left | Right | Top | Bottom ], scrolling sideways
+/// when the picker is narrower than the row.
+fn segmented_dock_picker(ui: &mut egui::Ui, bar: &mut Hotbar, t: &Tokens) {
+    let options = [
+        (None, tl!("Float")),
+        (Some("left"), tl!("Left")),
+        (Some("right"), tl!("Right")),
+        (Some("top"), tl!("Top")),
+        (Some("bottom"), tl!("Bottom")),
+    ];
+    let mut side = options.iter().map(|(side, _)| *side).find(|side| *side == bar.dock.as_deref()).flatten();
+    let changed = egui::ScrollArea::horizontal()
+        .id_salt("hotbar-dock")
+        .auto_shrink([false, true])
+        .show(ui, |ui| crate::dialogs::preferences::segmented_pill_choice(ui, t, &mut side, &options))
+        .inner;
+    if changed {
+        // `place` accepts every side listed above.
+        let _ = bar.place(side.unwrap_or("float"));
+    }
+}
+
+/// Draw the unified floating or side-docked toolbar, combining quick actions, core tools, and custom shortcuts.
+pub(crate) fn show(app: &mut PdfCraftApp, area: Rect, page_left: Option<f32>, ui: &mut egui::Ui) {
+    let ctx = ui.ctx().clone();
+    let mut bar = std::mem::take(&mut app.hotbar);
+    bar.normalize();
+    let t = Tokens::get(&ctx);
+    let id = egui::Id::unique("quick-bar");
+    let full_side = bar.full_side && bar.dock.is_some();
+    let bounds = if full_side { area } else { area.shrink(10.0) };
+    if let Some(side) = bar.dock.clone() {
+        let _ = bar.place(&side);
+    }
+    let cell = bar.button_size;
+    let popup_align = popup_align_for(bar.dock.as_deref(), bar.vertical);
+    let mut size = ctx.data_mut(|data| data.get_temp::<egui::Vec2>(id)).unwrap_or(vec2(crate::canvas::bars::QUICK_BAR_WIDTH, 220.0));
+    if full_side {
+        size = if bar.vertical { vec2(cell + 12.0, bounds.height()) } else { vec2(bounds.width(), cell + 12.0) };
+    }
+    let travel = (bounds.size() - size).max(vec2(0.0, 0.0));
+    let default_x = crate::canvas::bars::quick_bar_offset(page_left.map_or(0.0, |left| left - area.left()), size.x);
+    let pos = if full_side {
+        bounds.min + vec2(travel.x * bar.position[0], travel.y * bar.position[1])
+    } else if bar.dock.is_none() && !bar.placed {
+        area.left_top() + vec2(default_x, crate::canvas::bars::QUICK_BAR_EDGE)
+    } else {
+        bounds.min + vec2(travel.x * bar.position[0], travel.y * bar.position[1])
+    };
+    let mut run = None;
+    let was_picker_open = bar.picker_open;
+    let mut picker_open = bar.picker_open;
+    let mut settings_clicked = false;
+    let shown = egui::Area::new(id).order(egui::Order::Middle).fixed_pos(pos).constrain_to(bounds).show(&ctx, |ui| {
+        let frame = if full_side {
+            egui::Frame::NONE.fill(t.chrome).corner_radius(egui::CornerRadius::ZERO).inner_margin(6)
+        } else {
+            egui::Frame::new()
+                .fill(t.card)
+                .stroke(egui::Stroke::new(1.0, t.border))
+                .corner_radius(CornerRadius::same(12))
+                .shadow(egui::Shadow { offset: [0, 4], blur: 16, spread: 0, color: Color32::from_black_alpha(if t.dark() { 100 } else { 28 }) })
+                .inner_margin(6)
+        };
+        let frame_resp = frame.show(ui, |ui| {
+            if full_side {
+                ui.set_min_size((size - vec2(12.0, 12.0)).max(vec2(0.0, 0.0)));
+            }
+            ui.spacing_mut().item_spacing = vec2(4.0, 4.0);
+            if bar.vertical {
+                ui.set_width(cell);
+            } else {
+                ui.set_height(cell);
+            }
+            let mut remove = None;
+            if full_side {
+                if bar.vertical {
+                    ui.with_layout(egui::Layout::bottom_up(egui::Align::Center), |ui| {
+                        settings_clicked |= settings_button(ui, cell, &mut picker_open);
+                        ui.add_space(4.0);
+                        let remaining = ui.available_height().max(cell);
+                        egui::ScrollArea::vertical().max_height(remaining).show(ui, |ui| {
+                            ui.with_layout(egui::Layout::top_down(egui::Align::Center), |ui| {
+                                core_tool_buttons(ui, app, cell, popup_align, &t);
+                                active_tool_controls(ui, app, &t, true);
+                                if !bar.tools.is_empty() {
+                                    ui.separator();
+                                    tool_buttons(ui, app, &bar.tools, cell, &mut run, &mut remove);
+                                }
+                            });
+                        });
+                    });
+                } else {
+                    ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+                        settings_clicked |= settings_button(ui, cell, &mut picker_open);
+                        ui.add_space(4.0);
+                        let remaining = ui.available_width().max(cell);
+                        egui::ScrollArea::horizontal().max_height(cell).max_width(remaining).show(ui, |ui| {
+                            ui.with_layout(egui::Layout::left_to_right(egui::Align::Center), |ui| {
+                                core_tool_buttons(ui, app, cell, popup_align, &t);
+                                active_tool_controls(ui, app, &t, false);
+                                if !bar.tools.is_empty() {
+                                    ui.separator();
+                                    tool_buttons(ui, app, &bar.tools, cell, &mut run, &mut remove);
+                                }
+                            });
+                        });
+                    });
+                }
+            } else {
+                let layout =
+                    if bar.vertical { egui::Layout::top_down(egui::Align::Center) } else { egui::Layout::left_to_right(egui::Align::Center) };
+                ui.with_layout(layout, |ui| {
+                    let grip_size = if bar.vertical { vec2(cell, 18.0) } else { vec2(18.0, cell) };
+                    let (grip_rect, grip) = ui.allocate_exact_size(grip_size, Sense::drag());
+                    for x in [-3.0, 3.0] {
+                        for y in [-6.0, 0.0, 6.0] {
+                            let offset = if bar.vertical { vec2(y, x) } else { vec2(x, y) };
+                            ui.painter().circle_filled(grip_rect.center() + offset, 1.5, t.text_faint);
+                        }
+                    }
+                    let drag_label = tl!("Drag hotbar");
+                    let grip = grip.on_hover_text(drag_label).on_hover_cursor(egui::CursorIcon::Grab);
+                    grip.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, drag_label));
+                    if grip.dragged() && bar.dock.is_none() {
+                        let delta = grip.drag_delta();
+                        if !bar.placed {
+                            let cur_x = (pos.x - bounds.min.x).max(0.0);
+                            let cur_y = (pos.y - bounds.min.y).max(0.0);
+                            bar.position[0] = (cur_x / travel.x.max(1.0)).clamp(0.0, 1.0);
+                            bar.position[1] = (cur_y / travel.y.max(1.0)).clamp(0.0, 1.0);
+                        }
+                        bar.position[0] = (bar.position[0] + delta.x / travel.x.max(1.0)).clamp(0.0, 1.0);
+                        bar.position[1] = (bar.position[1] + delta.y / travel.y.max(1.0)).clamp(0.0, 1.0);
+                        bar.placed = true;
+                    }
+                    if bar.vertical {
+                        let fixed_overhead = grip_size.y + cell + 24.0;
+                        let max_tools_length = (bounds.height() - fixed_overhead).max(cell);
+                        egui::ScrollArea::vertical().max_height(max_tools_length).show(ui, |ui| {
+                            ui.with_layout(layout, |ui| {
+                                core_tool_buttons(ui, app, cell, popup_align, &t);
+                                active_tool_controls(ui, app, &t, true);
+                                if !bar.tools.is_empty() {
+                                    ui.separator();
+                                    tool_buttons(ui, app, &bar.tools, cell, &mut run, &mut remove);
+                                }
+                            });
+                        });
+                        settings_clicked |= settings_button(ui, cell, &mut picker_open);
+                    } else {
+                        core_tool_buttons(ui, app, cell, popup_align, &t);
+                        active_tool_controls(ui, app, &t, false);
+                        if !bar.tools.is_empty() {
+                            ui.separator();
+                            let scroll_max = (bounds.width() - cell - 50.0).max(cell);
+                            egui::ScrollArea::horizontal().max_height(cell).max_width(scroll_max).show(ui, |ui| {
+                                ui.with_layout(layout, |ui| {
+                                    tool_buttons(ui, app, &bar.tools, cell, &mut run, &mut remove);
+                                });
+                            });
+                        }
+                        settings_clicked |= settings_button(ui, cell, &mut picker_open);
+                    }
+                });
+            }
+            if let Some(index) = remove {
+                bar.tools.remove(index);
+            }
+        });
+        if full_side {
+            let r = frame_resp.response.rect;
+            let divider = egui::Stroke::new(1.0, t.divider);
+            match bar.dock.as_deref() {
+                Some("left") => {
+                    ui.painter().vline(r.right() - 0.5, r.top()..=r.bottom(), divider);
+                }
+                Some("right") => {
+                    ui.painter().vline(r.left() + 0.5, r.top()..=r.bottom(), divider);
+                }
+                Some("top") => {
+                    ui.painter().hline(r.left()..=r.right(), r.bottom() - 0.5, divider);
+                }
+                Some("bottom") => {
+                    ui.painter().hline(r.left()..=r.right(), r.top() + 0.5, divider);
+                }
+                _ => {}
+            }
+        }
+    });
+    let picker_id = egui::Id::unique("hotbar-picker");
+    // A remembered collapsed state can survive disabling the collapse affordance.
+    let mut expanded = egui::collapsing_header::CollapsingState::load_with_default_open(&ctx, picker_id.with("collapsing"), true);
+    expanded.set_open(true);
+    expanded.store(&ctx);
+    let screen = ctx.content_rect().shrink(12.0);
+    let margin_x = 14.0;
+    let card_margin_total = margin_x * 2.0;
+    let card_width = 280.0f32.min((screen.width() - card_margin_total).max(180.0));
+    let outer_width = card_width + card_margin_total;
+    let bar_rect = shown.response.rect;
+    let picker_x =
+        if bar_rect.right() + outer_width + 10.0 < screen.right() { bar_rect.right() + 14.0 } else { bar_rect.left() - outer_width - 14.0 };
+    let picker_y = if bar.dock.as_deref() == Some("top") {
+        (bar_rect.bottom() + 10.0).clamp(screen.top(), (screen.bottom() - 480.0).max(screen.top()))
+    } else if bar.dock.as_deref() == Some("bottom") {
+        (bar_rect.top() - 500.0).clamp(screen.top(), (screen.bottom() - 480.0).max(screen.top()))
+    } else {
+        bar_rect.top().clamp(screen.top(), (screen.bottom() - 480.0).max(screen.top()))
+    };
+    let picker_pos = egui::pos2(picker_x.clamp(screen.left(), (screen.right() - outer_width).max(screen.left())), picker_y);
+    let mut close_dialog = false;
+    let picker_resp = egui::Window::new(tl!("Hotbar tools"))
+        .id(picker_id)
+        .order(egui::Order::Foreground)
+        .open(&mut picker_open)
+        .collapsible(false)
+        .resizable(false)
+        .title_bar(false)
+        .fixed_pos(picker_pos)
+        .frame(
+            egui::Frame::NONE
+                .fill(t.card)
+                .stroke(Stroke::new(1.0, t.border))
+                .corner_radius(CornerRadius::same(10))
+                .shadow(egui::Shadow { offset: [0, 6], blur: 20, spread: 0, color: Color32::from_black_alpha(if t.dark() { 120 } else { 35 }) })
+                .inner_margin(egui::Margin::symmetric(14, 12)),
+        )
+        .show(&ctx, |ui| {
+            ui.set_width(card_width);
+
+            // Title bar: "Hotbar Tools" on the left, "X" close button on the right
+            ui.horizontal(|ui| {
+                ui.label(egui::RichText::new(tl!("Hotbar tools")).size(14.0).strong().color(t.text));
+                ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+                    if icons::button(ui, "x", 16.0, false, tl!("Close menu")).clicked() {
+                        close_dialog = true;
+                    }
+                });
+            });
+
+            ui.add_space(10.0);
+
+            // Section 1: Layout & Sizing
+            ui.label(egui::RichText::new(tl!("Layout & Sizing")).size(13.0).strong().color(t.text));
+            ui.add_space(6.0);
+
+            // Toolbar size slider row
+            ui.horizontal(|ui| {
+                ui.label(egui::RichText::new(tl!("Toolbar size")).size(12.5).color(t.text));
+                let slider_width = (ui.available_width() - 55.0).clamp(50.0, 140.0);
+                ui.spacing_mut().slider_width = slider_width;
+                ui.add(egui::Slider::new(&mut bar.button_size, 24.0..=64.0).show_value(false));
+                ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+                    ui.label(egui::RichText::new(format!("{:.0} px", bar.button_size)).size(12.0).color(t.text_muted));
+                });
+            });
+
+            ui.add_space(8.0);
+
+            // Vertical layout toggle switch row
+            ui.horizontal(|ui| {
+                ui.add_enabled_ui(bar.dock.is_none(), |ui| {
+                    let label = tl!("Vertical layout");
+                    toggle_switch(ui, &mut bar.vertical, label, &t);
+                    ui.add_space(8.0);
+                    ui.label(egui::RichText::new(label).size(12.5).color(t.text));
+                });
+            });
+
+            ui.add_space(10.0);
+
+            // Stick to a side section with segmented control
+            ui.label(egui::RichText::new(tl!("Stick to a side:")).size(12.5).color(t.text));
+            ui.add_space(6.0);
+            segmented_dock_picker(ui, &mut bar, &t);
+
+            ui.add_space(8.0);
+
+            // Full-side strip checkbox
+            let strip_hint = tl!("Extend the docked toolbar along the entire side. Choose a side above to enable.");
+            ui.add_enabled(bar.dock.is_some(), crate::widgets::checkbox(&mut bar.full_side, tl!("Full-side strip")))
+                .on_hover_text(strip_hint)
+                .on_disabled_hover_text(strip_hint);
+
+            ui.add_space(12.0);
+            ui.separator();
+            ui.add_space(10.0);
+
+            // Section 2: Add Tools to Hotbar
+            ui.label(egui::RichText::new(tl!("Add Tools to Hotbar")).size(13.0).strong().color(t.text));
+            ui.add_space(8.0);
+
+            // Search bar pill
+            let search_frame = egui::Frame::NONE
+                .fill(t.field)
+                .stroke(Stroke::new(1.0, t.border))
+                .corner_radius(CornerRadius::same(8))
+                .inner_margin(egui::Margin::symmetric(10, 6));
+            search_frame.show(ui, |ui| {
+                ui.horizontal(|ui| {
+                    ui.spacing_mut().item_spacing.x = 8.0;
+                    ui.add(icons::image("search", 14.0, t.text_faint));
+                    ui.add(
+                        egui::TextEdit::singleline(&mut bar.search)
+                            .hint_text(tl!("Search all tools…"))
+                            .frame(egui::Frame::NONE)
+                            .desired_width(ui.available_width()),
+                    );
+                });
+            });
+
+            ui.add_space(8.0);
+
+            // Scrollable tools list with checkboxes
+            let max_list_height = (screen.height() - 340.0).clamp(120.0, 220.0);
+            egui::ScrollArea::vertical().max_height(max_list_height).auto_shrink([false, false]).show(ui, |ui| {
+                ui.spacing_mut().item_spacing.y = 5.0;
+                for spec in COMMANDS {
+                    if !matches_search(spec, &bar.search) {
+                        continue;
+                    }
+                    let mut selected = bar.tools.iter().any(|id| id == spec.id);
+                    if ui.add(crate::widgets::checkbox(&mut selected, tl!(spec.label))).changed() {
+                        if selected {
+                            bar.tools.push(spec.id.to_owned());
+                        } else {
+                            bar.tools.retain(|id| id != spec.id);
+                        }
+                    }
+                }
+            });
+        });
+    let clicked_outside = was_picker_open
+        && !settings_clicked
+        && picker_resp.as_ref().is_some_and(|wr| {
+            wr.response.clicked_elsewhere()
+                || ctx.input(|i| i.pointer.any_click() && !i.pointer.interact_pos().is_some_and(|p| wr.response.rect.contains(p)))
+        });
+    if clicked_outside || ctx.input(|i| i.key_pressed(egui::Key::Escape)) {
+        close_dialog = true;
+    }
+    if close_dialog {
+        picker_open = false;
+    }
+    ctx.data_mut(|data| {
+        data.insert_temp(id, shown.response.rect.size());
+        data.insert_temp(egui::Id::unique("custom-hotbar"), shown.response.rect.size());
+    });
+    bar.picker_open = picker_open;
+    app.hotbar = bar;
+    if let Some(id) = run {
+        app.execute(id);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn hotbar_validation_and_placement() {
+        let mut bar = Hotbar::default();
+        assert!(bar.tools.is_empty());
+        bar.set_tools("comment.ink,comment.freehand_highlight,comment.ink").unwrap();
+        assert_eq!(bar.tools.len(), 2);
+        assert!(bar.set_tools("does.not.exist").is_err());
+        assert_eq!(bar.tools.len(), 2);
+        bar.place("right").unwrap();
+        assert!(bar.vertical);
+        assert_eq!(bar.position, [1.0, 0.5]);
+        bar.place("bottom").unwrap();
+        assert!(!bar.vertical);
+        assert_eq!(bar.position, [0.5, 1.0]);
+        assert_eq!(bar.dock.as_deref(), Some("bottom"));
+        bar.place("float").unwrap();
+        assert!(bar.dock.is_none());
+    }
+
+    #[test]
+    fn hotbar_preferences_round_trip() {
+        let mut app = PdfCraftApp::new();
+        app.set_option("hotbar-tools", "comment.freehand_highlight,comment.ink").unwrap();
+        app.set_option("hotbar-side", "left").unwrap();
+        app.set_option("hotbar-size", "48").unwrap();
+        app.set_option("hotbar-full-side", "true").unwrap();
+        assert!(app.set_option("hotbar-size", "NaN").is_err());
+        let mut restored = PdfCraftApp::new();
+        restored.restore(&app.persist());
+        assert_eq!(restored.hotbar.tools, app.hotbar.tools);
+        assert_eq!(restored.hotbar.position, [0.0, 0.5]);
+        assert!(restored.hotbar.vertical);
+        assert_eq!(restored.hotbar.button_size, 48.0);
+        assert!(restored.hotbar.full_side);
+        assert_eq!(restored.hotbar.dock.as_deref(), Some("left"));
+    }
+
+    #[test]
+    fn hotbar_restore_filters_unknown_tools_and_offscreen_positions() {
+        let mut app = PdfCraftApp::new();
+        app.restore(r#"{"hotbar":{"tools":["invalid","comment.ink","comment.ink"],"position":[-10,999]}}"#);
+        assert_eq!(app.hotbar.tools, ["comment.ink"]);
+        assert_eq!(app.hotbar.position, [0.0, 1.0]);
+    }
+
+    #[test]
+    fn hotbar_restore_moves_legacy_default_into_margin_and_keeps_chosen_spots() {
+        let mut app = PdfCraftApp::new();
+        app.restore(r#"{"hotbar":{"tools":["comment.ink"],"position":[0.5,0.0],"vertical":false,"button_size":40.0,"dock":null}}"#);
+        assert_eq!(app.hotbar.position, [0.0, 0.0]);
+        assert!(app.hotbar.vertical);
+        assert!(!app.hotbar.placed);
+        assert_eq!(app.hotbar.tools, ["comment.ink"]);
+        assert_eq!(app.hotbar.button_size, 40.0);
+        app.restore(r#"{"hotbar":{"position":[0.0,0.0],"vertical":false,"dock":null}}"#);
+        assert_eq!(app.hotbar.position, [0.0, 0.0]);
+        assert!(!app.hotbar.vertical);
+        assert!(app.hotbar.placed, "a legacy bar dragged to the corner stays there");
+        app.restore(r#"{"hotbar":{"position":[0.5,0.0],"vertical":false,"dock":null,"placed":true}}"#);
+        assert_eq!(app.hotbar.position, [0.5, 0.0], "current preferences are not migrated");
+        assert!(!app.hotbar.vertical);
+    }
+
+    #[test]
+    fn hotbar_search_matches_translated_and_canonical_labels() {
+        let ink = command("comment.ink").unwrap();
+        crate::i18n::set_current(crate::i18n::lang_from_tag("fr").unwrap());
+        assert_eq!(tl!(ink.label), "Dessiner à main levée");
+        assert!(matches_search(ink, "dessiner"), "translated French label must match");
+        assert!(matches_search(ink, "freehand"), "canonical English label must still match");
+        assert!(matches_search(ink, "comment.ink"), "command ID must still match");
+        assert!(!matches_search(ink, "introuvable"));
+        crate::i18n::set_current(crate::i18n::Lang::EN);
+    }
+}
diff --git a/crates/ui-egui/src/i18n.rs b/crates/ui-egui/src/i18n.rs
index 3f478b637f..3ac16d622c 100644
--- a/crates/ui-egui/src/i18n.rs
+++ b/crates/ui-egui/src/i18n.rs
@@ -16,7 +16,7 @@
 //! placeholders, plural forms) pick it up from the registry.
 //!
 //! # Looking strings up
-//! - [`tl!`](crate::tl) / [`t`]: a plain string in the current language. [`tr`]: in a given one.
+//! - `tl!` / [`t`]: a plain string in the current language. [`tr`]: in a given one.
 //! - [`tr_ctx`] (`tl_ctx!` in UI code): when one English word needs different translations.
 //! - [`tr_id`]: a command-id keyed string with the English label as fallback (menu items), so a
 //!   translation survives rewording of the English text and can differ per command.
diff --git a/crates/ui-egui/src/i18n/ar.tsv b/crates/ui-egui/src/i18n/ar.tsv
index 56f62b7734..1b08929307 100644
--- a/crates/ui-egui/src/i18n/ar.tsv
+++ b/crates/ui-egui/src/i18n/ar.tsv
@@ -20,6 +20,10 @@
 # reorders each line with UAX #9, so preordering here would reverse right-to-left text twice.
 # Spaces and a colon at either end of an entry stay at that end, next to what the code appends.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	القائمة
 	File	ملف
 	Edit	تحرير
@@ -2792,6 +2796,25 @@ certificate	Version	الإصدار
 	Make properties default	جعل الخصائص افتراضية
 	Pages selected	الصفحات المحددة
 	Page properties	خصائص الصفحة
+	Clear search	مسح البحث
+	Pin	تثبيت
+	Pin a tool…	تثبيت أداة…
+	Pin to Home	تثبيت في الصفحة الرئيسية
+	Pin tools to Home	تثبيت الأدوات في الصفحة الرئيسية
+	Pin your favorite tools here for quick access.	ثبّت أدواتك المفضلة هنا للوصول السريع.
+	Pinned	مثبت
+	Pinned Tools	الأدوات المثبتة
+	Search tools…	البحث عن الأدوات…
+	Select tools to display on your Home page for quick access.	حدد الأدوات المراد عرضها على صفحتك الرئيسية للوصول السريع.
+	Unpin from Home	إلغاء التثبيت من الصفحة الرئيسية
+	Unpin tool	إلغاء تثبيت الأداة
+	Transform image	تحويل الصورة
+	Select Tool	أداة التحديد
+	Hand Tool	أداة اليد
+	Marquee Zoom	تكبير بالتحديد
+	Edit this PDF	تحرير هذا الملف PDF
+	Export this PDF	تصدير هذا الملف PDF
+	Find text or tools	البحث عن نص أو أدوات
 	Create & Edit	الإنشاء والتحرير
 	Review & Compare	المراجعة والمقارنة
 	Forms & Signatures	النماذج والتوقيعات
@@ -2838,6 +2861,13 @@ certificate	Version	الإصدار
 	field names can't contain a period: {name}	لا يمكن أن تحتوي أسماء الحقول على نقطة: {name}
 	two cells would both be named {name}	ستحمل خليتان الاسم نفسه {name}
 	a field named {name} already exists	يوجد حقل باسم {name} بالفعل
+	Arrange image	ترتيب الصورة
+	Bring forward	إحضار للأمام
+	Bring to front	إحضار إلى المقدمة
+	Crop	قص
+	Remove crop	إزالة القص
+	Send backward	إرسال للخلف
+	Send to back	إرسال إلى المؤخرة
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	اليوم
@@ -2854,3 +2884,11 @@ certificate	Version	الإصدار
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	خيارات هذا الرد
 	Export value	قيمة التصدير
+	Show Page Edge Shadows	إظهار ظلال حواف الصفحات
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	بحث…
+	Image pasted	تم لصق الصورة
+	No image on clipboard to paste	لا توجد صورة في الحافظة للصقها
+	Pinned {tool} to Home	تم تثبيت {tool} في الرئيسية
+	Unpinned {tool} from Home	تم إلغاء تثبيت {tool} من الرئيسية
diff --git a/crates/ui-egui/src/i18n/bg.tsv b/crates/ui-egui/src/i18n/bg.tsv
index ceccdf9582..e269febf18 100644
--- a/crates/ui-egui/src/i18n/bg.tsv
+++ b/crates/ui-egui/src/i18n/bg.tsv
@@ -7,6 +7,10 @@
 # Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) stay in Latin letters;
 # the trailing "…" of dialog commands is kept.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	About	За програмата
 	Contributors	Сътрудници
 	Models	Модели
@@ -2432,7 +2436,7 @@ animation effects	Off	Изключени
 	You are viewing revision {rev} of “{from}”. It is a snapshot: changes here won't affect the original.	Разглеждате редакция {rev} на „{from}“. Това е моментна снимка: промените тук няма да засегнат оригинала.
 	Turn upside down (180°)	Обърни наопаки (180°)
 	4 x 6 in label (101.6 x 152.4 mm)	Етикет 4 × 6 in (101,6 × 152,4 mm)
-	Cuts each page to its printed area, turns it upright and fits it to the sheet without stretching. One label per sheet.	Изрязва всяка страница до отпечатаната ѝ област, завърта я изправено и я побира в листа без разтягане. Един етикет на лист.
+	Cuts each page to its printed area, turns it upright and fits it to the sheet without stretching. One label per sheet.	Изрязва всяка страница до отпечатаната и област, завърта я изправено и я побира в листа без разтягане. Един етикет на лист.
 	Find untagged content	Намиране на немаркирано съдържание
 	No untagged content was found.	Не е намерено немаркирано съдържание.
 	Found {n} untagged content problems.	Открити са {n} проблема с немаркирано съдържание.
@@ -2478,6 +2482,26 @@ animation effects	Off	Изключени
 	Make properties default	Задаване като свойства по подразбиране
 	Pages selected	Избрани страници
 	Page properties	Свойства на страницата
+	Clear search	Изчистване на търсенето
+	Pin	Закачане
+	Pin a tool…	Закачане на инструмент…
+	Pin to Home	Закачане към Начало
+	Pin tools to Home	Закачане на инструменти към Начало
+	Pin your favorite tools here for quick access.	Закачете любимите си инструменти тук за бърз достъп.
+	Pinned	Закачено
+	Pinned Tools	Закачени инструменти
+	Search tools…	Търсене на инструменти…
+	Select tools to display on your Home page for quick access.	Изберете инструменти за показване на началната страница за бърз достъп.
+	Unpin from Home	Откачане от Начало
+	Unpin tool	Откачане на инструмент
+	Transform image	Трансформиране на изображение
+	Select Tool	Инструмент за избор
+	Hand Tool	Инструмент „Ръка“
+	Marquee Zoom	Мащабиране с рамка
+	Paste	Постави
+	Edit this PDF	Редактирай този PDF
+	Export this PDF	Експортирай този PDF
+	Find text or tools	Търсене на текст или инструменти
 	Create & Edit	Създаване и редактиране
 	Review & Compare	Преглед и сравнение
 	Forms & Signatures	Формуляри и подписи
@@ -2525,6 +2549,13 @@ animation effects	Off	Изключени
 	field names can't contain a period: {name}	имената на полетата не може да съдържат точка: {name}
 	two cells would both be named {name}	две клетки биха имали едно и също име {name}
 	a field named {name} already exists	вече съществува поле с име {name}
+	Arrange image	Подреждане на изображението
+	Bring forward	Преместване напред
+	Bring to front	Преместване най-отпред
+	Crop	Изрязване
+	Remove crop	Премахване на изрязването
+	Send backward	Преместване назад
+	Send to back	Преместване най-отзад
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Днес
@@ -2541,3 +2572,11 @@ animation effects	Off	Изключени
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Опции за този отговор
 	Export value	Стойност за експортиране
+	Show Page Edge Shadows	Показване на сенки по краищата на страниците
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Търсене…
+	Image pasted	Изображението е поставено
+	No image on clipboard to paste	Няма изображение в клипборда за поставяне
+	Pinned {tool} to Home	{tool} е закачен в Начало
+	Unpinned {tool} from Home	{tool} е откачен от Начало
diff --git a/crates/ui-egui/src/i18n/ca.tsv b/crates/ui-egui/src/i18n/ca.tsv
index 83750ba124..7ff0f83fee 100644
--- a/crates/ui-egui/src/i18n/ca.tsv
+++ b/crates/ui-egui/src/i18n/ca.tsv
@@ -9,6 +9,10 @@
 # Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) are not translated;
 # the trailing "…" of dialog commands is kept.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	Menú
 	File	Fitxer
 	Edit	Edita
@@ -2815,6 +2819,33 @@ theme	Appearance	Aspecte
 	field names can't contain a period: {name}	els noms dels camps no poden contenir cap punt: {name}
 	two cells would both be named {name}	dues cel·les es dirien {name}
 	a field named {name} already exists	ja existeix un camp anomenat {name}
+	Bring forward	Porta endavant
+	Bring to front	Porta al capdavant
+	Crop image	Retalla la imatge
+	Remove crop	Elimina el retall
+	Send backward	Envia enrere
+	Send to back	Envia al fons
+	Clear search	Neteja la cerca
+	Edit this PDF	Edita aquest PDF
+	Export this PDF	Exporta aquest PDF
+	Find text or tools	Cerca text o eines
+	Hand Tool	Eina Mà
+	Marquee Zoom	Zoom d'enquadrament
+	Pin	Fixa
+	Pin a tool…	Fixa una eina…
+	Pin to Home	Fixa a l'Inici
+	Pin tools to Home	Fixa eines a l'Inici
+	Pin your favorite tools here for quick access.	Fixeu aquí les vostres eines preferides per a un accés ràpid.
+	Pinned	Fixat
+	Pinned Tools	Eines fixades
+	Search tools…	Cerca eines…
+	Select Tool	Eina Selecció
+	Select tools to display on your Home page for quick access.	Seleccioneu les eines que es mostraran a la pàgina d'Inici per a un accés ràpid.
+	Transform image	Transforma la imatge
+	Unpin from Home	Desenganxa de l'Inici
+	Unpin tool	Desenganxa l'eina
+	Arrange image	Organitza la imatge
+	Crop	Escapça
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Avui
@@ -2838,3 +2869,10 @@ theme	Appearance	Aspecte
 
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Opcions d'aquesta resposta
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Cerca…
+	Image pasted	Imatge enganxada
+	No image on clipboard to paste	No hi ha cap imatge al porta-retalls per enganxar
+	Pinned {tool} to Home	{tool} fixat a Inici
+	Unpinned {tool} from Home	{tool} desfixat d’Inici
diff --git a/crates/ui-egui/src/i18n/ckb.tsv b/crates/ui-egui/src/i18n/ckb.tsv
index f6d91e3f42..3b6a7671ed 100644
--- a/crates/ui-egui/src/i18n/ckb.tsv
+++ b/crates/ui-egui/src/i18n/ckb.tsv
@@ -20,6 +20,10 @@
 # reorders each line with UAX #9, so preordering here would reverse right-to-left text twice.
 # Spaces and a colon at either end of an entry stay at that end, next to what the code appends.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	پێڕست
 	File	فایل
 	Edit	دەستکاریکردن
@@ -2735,6 +2739,13 @@ certificate	Version	وەشان
 	Make properties default	کردنی تایبەتمەندییەکان بە بنەڕەتی
 	Pages selected	پەڕە هەڵبژێردراوەکان
 	Page properties	تایبەتمەندییەکانی پەڕە
+	Arrange image	ڕێکخستنی وێنە
+	Bring forward	هێنانە پێشەوە
+	Bring to front	هێنانە پێشەوەی سەرەکی
+	Crop	بڕینەوە
+	Remove crop	لابردنی بڕینەوە
+	Send backward	ناردنە دواوە
+	Send to back	ناردنە دواوەی سەرەکی
 	Create & Edit	دروستکردن و دەستکاریکردن
 	Review & Compare	پێداچوونەوە و بەراوردکردن
 	Forms & Signatures	فۆڕمەکان و واژووەکان
@@ -2770,3 +2781,32 @@ certificate	Version	وەشان
 @plural	{n} more formula reads a missing field.|{n} more formulas read missing fields.	{n} more formula reads a missing field.|{n} more formulas read missing fields.
 @plural	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.
 @plural	{fields} is missing|{fields} are missing	{fields} is missing|{fields} are missing
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	گەڕان…
+	Image pasted	وێنەکە لکێنرا
+	No image on clipboard to paste	هیچ وێنەیەک لە کلیپبۆرد نییە بۆ لکاندن
+	Pinned {tool} to Home	{tool} لە ماڵەوە جێگیرکرا
+	Unpinned {tool} from Home	{tool} لە ماڵەوە لابرا
+
+# Home tools (AI-assisted; not separately native-reviewed)
+	Clear search	پاککردنەوەی گەڕان
+	Pin	جێگیرکردن
+	Pin a tool…	جێگیرکردنی ئامراز…
+	Pin to Home	جێگیرکردن لە ماڵەوە
+	Pin tools to Home	جێگیرکردنی ئامرازەکان لە ماڵەوە
+	Pin your favorite tools here for quick access.	ئامرازە دڵخوازەکانت لێرە جێگیر بکە بۆ دەستگەیشتنی خێرا.
+	Pinned	جێگیرکراو
+	Pinned Tools	ئامرازە جێگیرکراوەکان
+	Search tools…	گەڕان بەدوای ئامرازەکان…
+	Select tools to display on your Home page for quick access.	ئامرازەکان هەڵبژێرە بۆ پیشاندان لە ماڵەوە و دەستگەیشتنی خێرا.
+	Unpin from Home	لابردنی جێگیرکردن لە ماڵەوە
+	Unpin tool	لابردنی جێگیرکردنی ئامراز
+	Transform image	گۆڕینی شێوەی وێنە
+	Select Tool	ئامرازی هەڵبژاردن
+	Hand Tool	ئامرازی دەست
+	Marquee Zoom	گەورەکردنی ناوچەی هەڵبژێردراو
+	Edit this PDF	دەستکاریکردنی ئەم PDF ـە
+	Export this PDF	هەناردەکردنی ئەم PDF ـە
+	Find text or tools	دۆزینەوەی دەق یان ئامراز
+	Crop image	بڕینەوەی وێنە
diff --git a/crates/ui-egui/src/i18n/cs.tsv b/crates/ui-egui/src/i18n/cs.tsv
index 8bfde72a85..22f6e3e056 100644
--- a/crates/ui-egui/src/i18n/cs.tsv
+++ b/crates/ui-egui/src/i18n/cs.tsv
@@ -19,6 +19,10 @@
 # commands is kept. Messages with a count but no `@plural` entry use count-neutral wording
 # ("Vybráno stránek: {n}"), because Czech has three plural forms.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	Nabídka
 	File	Soubor
 	Rotation:	Otočení:
@@ -2589,6 +2593,26 @@ animation effects	Off	Vypnuto
 	Make properties default	Nastavit vlastnosti jako výchozí
 	Pages selected	Vybrané stránky
 	Page properties	Vlastnosti stránky
+	Clear search	Vymazat hledání
+	Pin	Připnout
+	Pin a tool…	Připnout nástroj…
+	Pin to Home	Připnout na domovskou stránku
+	Pin tools to Home	Připnout nástroje na domovskou stránku
+	Pin your favorite tools here for quick access.	Připněte si sem oblíbené nástroje pro rychlý přístup.
+	Pinned	Připnuto
+	Pinned Tools	Připnuté nástroje
+	Search tools…	Hledat nástroje…
+	Select tools to display on your Home page for quick access.	Vyberte nástroje, které se mají zobrazovat na domovské stránce pro rychlý přístup.
+	Unpin from Home	Odepnout z domovské stránky
+	Unpin tool	Odepnout nástroj
+	Transform image	Transformovat obrázek
+	Select Tool	Nástroj pro výběr
+	Hand Tool	Nástroj ručička
+	Marquee Zoom	Zvětšit vybranou oblast
+	Paste	Vložit
+	Edit this PDF	Upravit toto PDF
+	Export this PDF	Exportovat toto PDF
+	Find text or tools	Hledat text nebo nástroje
 	Create & Edit	Vytváření a úpravy
 	Review & Compare	Revize a porovnání
 	Forms & Signatures	Formuláře a podpisy
@@ -2793,7 +2817,6 @@ animation effects	Off	Vypnuto
 	Organize	Uspořádat
 	Page {n}	Stránka {n}
 	Page {n} of {total}	Stránka {n} z {total}
-	Paste	Vložit
 	Previous	Předchozí
 	Previous (⇧⌘G)	Předchozí (⇧⌘G)
 	Print (⌘P)	Tisk (⌘P)
@@ -2869,6 +2892,14 @@ certificate	Version	Verze
 	field names can't contain a period: {name}	názvy polí nesmějí obsahovat tečku: {name}
 	two cells would both be named {name}	dvě buňky by se jmenovaly {name}
 	a field named {name} already exists	pole s názvem {name} už existuje
+	Bring forward	Přenést blíž
+	Bring to front	Přenést do popředí
+	Crop image	Oříznout obrázek
+	Remove crop	Odebrat oříznutí
+	Send backward	Přenést dál
+	Send to back	Přenést do pozadí
+	Arrange image	Uspořádat obrázek
+	Crop	Oříznout
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Dnes
@@ -2885,3 +2916,11 @@ certificate	Version	Verze
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Možnosti této odpovědi
 	Export value	Exportní hodnota
+	Show Page Edge Shadows	Zobrazovat stíny okrajů stránek
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Hledat…
+	Image pasted	Obrázek vložen
+	No image on clipboard to paste	Ve schránce není obrázek k vložení
+	Pinned {tool} to Home	{tool} připnuto na úvodní stránku
+	Unpinned {tool} from Home	{tool} odepnuto z úvodní stránky
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
index 83684c08ea..2c9ce7ae36 100644
--- a/crates/ui-egui/src/i18n/de.tsv
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -9,6 +9,10 @@
 # Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) are not translated;
 # the trailing "…" of dialog commands is kept.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	Menü
 	File	Datei
 	Edit	Bearbeiten
@@ -2516,6 +2520,26 @@ animation effects	Off	Aus
 	Make properties default	Eigenschaften als Standard festlegen
 	Pages selected	Ausgewählte Seiten
 	Page properties	Seiteneigenschaften
+	Clear search	Suche löschen
+	Pin	Anheften
+	Pin a tool…	Werkzeug anheften…
+	Pin to Home	An Start anheften
+	Pin tools to Home	Werkzeuge an Start anheften
+	Pin your favorite tools here for quick access.	Heften Sie Ihre bevorzugten Werkzeuge hier an, um schnell darauf zuzugreifen.
+	Pinned	Angeheftet
+	Pinned Tools	Angeheftete Werkzeuge
+	Search tools…	Werkzeuge suchen…
+	Select tools to display on your Home page for quick access.	Wählen Sie Werkzeuge für den Schnellzugriff auf Ihrer Startseite aus.
+	Unpin from Home	Von Start lösen
+	Unpin tool	Werkzeug lösen
+	Transform image	Bild transformieren
+	Select Tool	Auswahl-Werkzeug
+	Hand Tool	Hand-Werkzeug
+	Marquee Zoom	Auswahlrahmen-Zoom
+	Paste	Einfügen
+	Edit this PDF	Dieses PDF bearbeiten
+	Export this PDF	Dieses PDF exportieren
+	Find text or tools	Text oder Werkzeuge suchen
 	Create & Edit	Erstellen & Bearbeiten
 	Review & Compare	Prüfen & Vergleichen
 	Forms & Signatures	Formulare & Signaturen
@@ -2563,6 +2587,13 @@ animation effects	Off	Aus
 	field names can't contain a period: {name}	Feldnamen dürfen keinen Punkt enthalten: {name}
 	two cells would both be named {name}	zwei Zellen hätten beide den Namen {name}
 	a field named {name} already exists	ein Feld namens {name} ist bereits vorhanden
+	Arrange image	Bild anordnen
+	Bring forward	Nach vorne bringen
+	Bring to front	In den Vordergrund
+	Crop	Zuschneiden
+	Remove crop	Zuschnitt entfernen
+	Send backward	Nach hinten senden
+	Send to back	In den Hintergrund
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Heute
@@ -2579,3 +2610,11 @@ animation effects	Off	Aus
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Optionen für diese Antwort
 	Export value	Exportwert
+	Show Page Edge Shadows	Schatten an Seitenrändern anzeigen
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Suchen…
+	Image pasted	Bild eingefügt
+	No image on clipboard to paste	Kein Bild in der Zwischenablage zum Einfügen
+	Pinned {tool} to Home	{tool} an Start angeheftet
+	Unpinned {tool} from Home	{tool} von Start gelöst
diff --git a/crates/ui-egui/src/i18n/el.tsv b/crates/ui-egui/src/i18n/el.tsv
index 576cdfcd6d..d83bf4aef7 100644
--- a/crates/ui-egui/src/i18n/el.tsv
+++ b/crates/ui-egui/src/i18n/el.tsv
@@ -2,6 +2,11 @@
 # Partial, clean-room initial contribution. Entries not yet translated fall back to English.
 # Translate from English meanings; retain placeholders and trailing ellipses.
 # Greek plural forms: one (1) | other (0, 2+).
+
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	Μενού
 	File	Αρχείο
 	Edit	Επεξεργασία
@@ -2521,6 +2526,26 @@ animation effects	Off	Ανενεργά
 	Make properties default	Ορισμός ιδιοτήτων ως προεπιλογή
 	Pages selected	Επιλεγμένες σελίδες
 	Page properties	Ιδιότητες σελίδας
+	Clear search	Εκκαθάριση αναζήτησης
+	Pin	Καρφίτσωμα
+	Pin a tool…	Καρφίτσωμα εργαλείου…
+	Pin to Home	Καρφίτσωμα στην Αρχική
+	Pin tools to Home	Καρφίτσωμα εργαλείων στην Αρχική
+	Pin your favorite tools here for quick access.	Καρφιτσώστε τα αγαπημένα σας εργαλεία εδώ για γρήγορη πρόσβαση.
+	Pinned	Καρφιτσωμένο
+	Pinned Tools	Καρφιτσωμένα εργαλεία
+	Search tools…	Αναζήτηση εργαλείων…
+	Select tools to display on your Home page for quick access.	Επιλέξτε εργαλεία για εμφάνιση στην Αρχική σας για γρήγορη πρόσβαση.
+	Unpin from Home	Ξεκαρφίτσωμα από την Αρχική
+	Unpin tool	Ξεκαρφίτσωμα εργαλείου
+	Transform image	Μετασχηματισμός εικόνας
+	Select Tool	Εργαλείο επιλογής
+	Hand Tool	Εργαλείο χεριού
+	Marquee Zoom	Μεγέθυνση επιλεγμένης περιοχής
+	Paste	Επικόλληση
+	Edit this PDF	Επεξεργασία αυτού του PDF
+	Export this PDF	Εξαγωγή αυτού του PDF
+	Find text or tools	Εύρεση κειμένου ή εργαλείων
 	Create & Edit	Δημιουργία και επεξεργασία
 	Review & Compare	Αναθεώρηση και σύγκριση
 	Forms & Signatures	Φόρμες και υπογραφές
@@ -2568,6 +2593,13 @@ animation effects	Off	Ανενεργά
 	field names can't contain a period: {name}	τα ονόματα πεδίων δεν μπορούν να περιέχουν τελεία: {name}
 	two cells would both be named {name}	δύο κελιά θα είχαν το ίδιο όνομα {name}
 	a field named {name} already exists	υπάρχει ήδη πεδίο με όνομα {name}
+	Arrange image	Διάταξη εικόνας
+	Bring forward	Μεταφορά εμπρός
+	Bring to front	Μεταφορά σε πρώτο πλάνο
+	Crop	Περικοπή
+	Remove crop	Κατάργηση περικοπής
+	Send backward	Μεταφορά πίσω
+	Send to back	Μεταφορά σε δεύτερο πλάνο
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Σήμερα
@@ -2584,3 +2616,11 @@ animation effects	Off	Ανενεργά
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Επιλογές για αυτήν την απάντηση
 	Export value	Τιμή εξαγωγής
+	Show Page Edge Shadows	Εμφάνιση σκιών στα άκρα των σελίδων
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Αναζήτηση…
+	Image pasted	Η εικόνα επικολλήθηκε
+	No image on clipboard to paste	Δεν υπάρχει εικόνα στο πρόχειρο για επικόλληση
+	Pinned {tool} to Home	Το {tool} καρφιτσώθηκε στην Αρχική
+	Unpinned {tool} from Home	Το {tool} ξεκαρφιτσώθηκε από την Αρχική
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index 3216e4e448..131d2dacaf 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -9,6 +9,10 @@
 # Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) are not translated;
 # the trailing "…" of dialog commands is kept.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	Menú
 	File	Archivo
 	Edit	Edición
@@ -2012,9 +2016,16 @@ action wizard	Start	Iniciar
 	Edit text	Editar texto
 	Load document font	Cargar fuente del documento
 	Move image	Mover imagen
+	Transform image	Transformar imagen
 	Rotate image	Girar imagen
 	Flip image	Voltear imagen
 	Delete image	Eliminar imagen
+	Bring to front	Traer al frente
+	Send to back	Enviar al fondo
+	Bring forward	Traer adelante
+	Send backward	Enviar atrás
+	Remove crop	Quitar recorte
+	Crop image	Recortar imagen
 	Add header & footer	Añadir encabezado y pie de página
 	Update header & footer	Actualizar encabezado y pie de página
 	Update watermark	Actualizar marca de agua
@@ -2679,6 +2690,25 @@ animation effects	Off	Desactivados
 # Historical snapshot notice bar (View signed version / View revision).
 	You are viewing the signed version of “{from}” (revision {rev}). It is a snapshot: changes here won't affect the original.	Estás viendo la versión firmada de «{from}» (revisión {rev}). Es una instantánea: los cambios aquí no afectarán al original.
 	You are viewing revision {rev} of “{from}”. It is a snapshot: changes here won't affect the original.	Estás viendo la revisión {rev} de «{from}». Es una instantánea: los cambios aquí no afectarán al original.
+	Clear search	Borrar búsqueda
+	Pin	Anclar
+	Pin a tool…	Anclar una herramienta…
+	Pin to Home	Anclar en Inicio
+	Pin tools to Home	Anclar herramientas en Inicio
+	Pin your favorite tools here for quick access.	Ancla tus herramientas favoritas aquí para un acceso rápido.
+	Pinned	Anclado
+	Pinned Tools	Herramientas ancladas
+	Search tools…	Buscar herramientas…
+	Select tools to display on your Home page for quick access.	Selecciona las herramientas que se mostrarán en la página de Inicio para un acceso rápido.
+	Unpin from Home	Desanclar de Inicio
+	Unpin tool	Desanclar herramienta
+	Select Tool	Herramienta Selección
+	Hand Tool	Herramienta Mano
+	Marquee Zoom	Zoom por selección
+	Paste	Pegar
+	Edit this PDF	Editar este PDF
+	Export this PDF	Exportar este PDF
+	Find text or tools	Buscar texto o herramientas
 	Attach a file…	Adjuntar un archivo…
 	Delete attachment	Eliminar adjunto
 	Attaching files is not available on the web yet	Adjuntar archivos aún no está disponible en la web
@@ -2834,7 +2864,6 @@ theme	Appearance	Aspecto
 	Import	Importar
 	Move	Mover
 	Duplicate	Duplicar
-	Paste	Pegar
 	Select all	Seleccionar todo
 	Refresh	Actualizar
 	Next	Siguiente
@@ -2885,6 +2914,8 @@ theme	Appearance	Aspecto
 	field names can't contain a period: {name}	los nombres de campo no pueden contener un punto: {name}
 	two cells would both be named {name}	dos celdas se llamarían {name}
 	a field named {name} already exists	ya existe un campo llamado {name}
+	Arrange image	Organizar imagen
+	Crop	Recortar
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Hoy
@@ -2901,3 +2932,11 @@ theme	Appearance	Aspecto
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Opciones de esta respuesta
 	Export value	Valor de exportación
+	Show Page Edge Shadows	Mostrar sombras en los bordes de las páginas
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Buscar…
+	Image pasted	Imagen pegada
+	No image on clipboard to paste	No hay ninguna imagen en el portapapeles para pegar
+	Pinned {tool} to Home	{tool} fijado en Inicio
+	Unpinned {tool} from Home	{tool} desfijado de Inicio
diff --git a/crates/ui-egui/src/i18n/fa.tsv b/crates/ui-egui/src/i18n/fa.tsv
index 292b4fbdb3..4f9286b843 100644
--- a/crates/ui-egui/src/i18n/fa.tsv
+++ b/crates/ui-egui/src/i18n/fa.tsv
@@ -19,6 +19,10 @@
 # each rendered line. The Persian comma \u060c and question mark \u061f are used, and \u200c (ZWNJ) joins
 # compound words.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	منو
 	File	فایل
 	Edit	ویرایش
@@ -2816,3 +2820,10 @@ theme	Appearance	ظاهر
 
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	گزینه‌های این پاسخ
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	جستجو…
+	Image pasted	تصویر چسبانده شد
+	No image on clipboard to paste	تصویری در حافظهٔ موقت برای چسباندن نیست
+	Pinned {tool} to Home	{tool} به خانه سنجاق شد
+	Unpinned {tool} from Home	{tool} از خانه جدا شد
diff --git a/crates/ui-egui/src/i18n/fi.tsv b/crates/ui-egui/src/i18n/fi.tsv
index 80d2a0f859..8c1a9baab9 100644
--- a/crates/ui-egui/src/i18n/fi.tsv
+++ b/crates/ui-egui/src/i18n/fi.tsv
@@ -16,6 +16,11 @@
 # Labels use sentence case. Product and technology names (PdfCraft, PDF, OCR, JavaScript ...)
 # stay in Latin letters; the trailing "…" of dialog commands is kept. Calendar headings use the
 # nominative month (`Lokakuu 2026`); dates use the partitive (`14. lokakuuta 2026`).
+
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	Valikko
 	File	Tiedosto
 	Edit	Muokkaa
@@ -2824,6 +2829,33 @@ theme	Appearance	Teema
 	field names can't contain a period: {name}	kenttien nimissä ei voi olla pistettä: {name}
 	two cells would both be named {name}	kahdella solulla olisi sama nimi {name}
 	a field named {name} already exists	kenttä nimeltä {name} on jo olemassa
+	Bring forward	Tuo eteenpäin
+	Bring to front	Tuo etualalle
+	Crop image	Rajaa kuva
+	Remove crop	Poista rajaus
+	Send backward	Vie taaksepäin
+	Send to back	Vie taustalle
+	Clear search	Tyhjennä haku
+	Edit this PDF	Muokkaa tätä PDF-tiedostoa
+	Export this PDF	Vie tämä PDF-tiedosto
+	Find text or tools	Etsi tekstiä tai työkaluja
+	Hand Tool	Käsityökalu
+	Marquee Zoom	Alueen zoomaus
+	Pin	Kiinnitä
+	Pin a tool…	Kiinnitä työkalu…
+	Pin to Home	Kiinnitä Aloitus-näkymään
+	Pin tools to Home	Kiinnitä työkaluja Aloitus-näkymään
+	Pin your favorite tools here for quick access.	Kiinnitä suosikkityökalusi tähän nopeaa käyttöä varten.
+	Pinned	Kiinnitetty
+	Pinned Tools	Kiinnitetyt työkalut
+	Search tools…	Etsi työkaluja…
+	Select Tool	Valintatyökalu
+	Select tools to display on your Home page for quick access.	Valitse Aloitus-sivulla näytettävät työkalut nopeaa käyttöä varten.
+	Transform image	Muunna kuvaa
+	Unpin from Home	Irrota Aloitus-näkymästä
+	Unpin tool	Irrota työkalu
+	Arrange image	Järjestä kuva
+	Crop	Rajaa
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Tänään
@@ -2847,3 +2879,10 @@ theme	Appearance	Teema
 
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Tämän vastauksen asetukset
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Hae…
+	Image pasted	Kuva liitetty
+	No image on clipboard to paste	Leikepöydällä ei ole liitettävää kuvaa
+	Pinned {tool} to Home	{tool} kiinnitetty aloitussivulle
+	Unpinned {tool} from Home	{tool} irrotettu aloitussivulta
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index 6092231df3..edfe48de44 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -9,6 +9,10 @@
 # Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) are not translated;
 # the trailing "…" of dialog commands is kept.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	Menu
 	File	Fichier
 	Edit	Édition
@@ -2515,6 +2519,26 @@ animation effects	Off	Désactivés
 	Make properties default	Définir comme propriétés par défaut
 	Pages selected	Pages sélectionnées
 	Page properties	Propriétés de la page
+	Clear search	Effacer la recherche
+	Pin	Épingler
+	Pin a tool…	Épingler un outil…
+	Pin to Home	Épingler à l'Accueil
+	Pin tools to Home	Épingler des outils à l'Accueil
+	Pin your favorite tools here for quick access.	Épinglez vos outils préférés ici pour un accès rapide.
+	Pinned	Épinglé
+	Pinned Tools	Outils épinglés
+	Search tools…	Rechercher des outils…
+	Select tools to display on your Home page for quick access.	Sélectionnez les outils à afficher sur votre page d'Accueil pour un accès rapide.
+	Unpin from Home	Désépingler de l'Accueil
+	Unpin tool	Désépingler l'outil
+	Transform image	Transformer l'image
+	Select Tool	Outil Sélection
+	Hand Tool	Outil Main
+	Marquee Zoom	Zoom par sélection
+	Paste	Coller
+	Edit this PDF	Modifier ce PDF
+	Export this PDF	Exporter ce PDF
+	Find text or tools	Rechercher du texte ou des outils
 	Create & Edit	Créer et modifier
 	Review & Compare	Réviser et comparer
 	Forms & Signatures	Formulaires et signatures
@@ -2632,7 +2656,6 @@ animation effects	Off	Désactivés
 	Page {} has additional actions	La page {} contient des actions supplémentaires
 	Panel layout could not be restored: {error}	Impossible de restaurer la disposition des panneaux : {error}
 	Panel move was not applied: {error}	Le déplacement du panneau n'a pas été appliqué : {error}
-	Paste	Coller
 	PdfCraft can't check this signature yet: {}.	PdfCraft ne peut pas encore contrôler cette signature : {}.
 	Previous	Précédent
 	Previous (⇧⌘G)	Précédent (⇧⌘G)
@@ -2828,6 +2851,13 @@ certificate	Version	Version
 	field names can't contain a period: {name}	les noms de champ ne peuvent pas contenir de point : {name}
 	two cells would both be named {name}	deux cellules porteraient le nom {name}
 	a field named {name} already exists	un champ nommé {name} existe déjà
+	Arrange image	Organiser l'image
+	Bring forward	Avancer
+	Bring to front	Mettre au premier plan
+	Crop	Recadrer
+	Remove crop	Supprimer le recadrage
+	Send backward	Reculer
+	Send to back	Mettre à l'arrière-plan
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Aujourd'hui
@@ -2844,3 +2874,29 @@ certificate	Version	Version
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Options de cette réponse
 	Export value	Valeur d’exportation
+	Show Page Edge Shadows	Afficher les ombres des bords des pages
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Rechercher…
+	Image pasted	Image collée
+	No image on clipboard to paste	Aucune image à coller dans le presse-papiers
+	Pinned {tool} to Home	{tool} épinglé à l’Accueil
+	Unpinned {tool} from Home	{tool} désépinglé de l’Accueil
+
+# The strings the report listed as missing for fr.
+	Crop image	Recadrer l'image
+	Mouse wheel scroll speed	Vitesse de défilement à la molette
+	Remove {standard} identification	Supprimer l'identification {standard}
+	The certificate of {} has critical extensions PdfCraft does not recognize, so it is not used to vouch for {}.	Le certificat de {} comporte des extensions critiques que PdfCraft ne reconnaît pas ; il n'est donc pas utilisé pour attester {}.
+	The password must have at least 8 characters.	Le mot de passe doit comporter au moins 8 caractères.
+	The signature's signed attributes have no content type, which CMS requires; it was read anyway.	Les attributs signés de la signature n'ont pas de type de contenu, exigé par CMS ; elle a néanmoins été lue.
+	The signature's signed attributes have no message digest, so the signature does not cover the document.	Les attributs signés de la signature n'ont pas de condensat de message ; la signature ne couvre donc pas le document.
+	The signature's signed attributes name a content type other than data, so it is not a signature of the document.	Les attributs signés de la signature indiquent un type de contenu autre que des données ; ce n'est donc pas une signature du document.
+	The timestamp authority's certificate is not issued for time stamping.	Le certificat de l'autorité d'horodatage n'est pas émis pour l'horodatage.
+	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	Ce fichier a changé sur le disque. Rechargez-le pour voir la nouvelle version ; vos modifications non enregistrées seront perdues.
+	This signature uses an RSA key shorter than 2048 bits, which is no longer considered strong enough for signatures. It still validates, but it should not be relied on.	Cette signature utilise une clé RSA de moins de 2048 bits, ce qui n'est plus considéré comme suffisamment robuste pour des signatures. Elle se valide toujours, mais il ne faut pas s'y fier.
+	a table has 1 to {max} columns	un tableau a de 1 à {max} colonnes
+	a table has 1 to {max} rows	un tableau a de 1 à {max} lignes
+	the area, the spacing and the column widths must be numbers, the spacing 0 or more and each width more than 0	l'aire, l'espacement et les largeurs de colonnes doivent être des nombres, l'espacement 0 ou plus et chaque largeur supérieure à 0
+	the first row number can be at most {max}	le numéro de la première ligne peut être au maximum {max}
+theme	Appearance	Apparence
diff --git a/crates/ui-egui/src/i18n/hi.tsv b/crates/ui-egui/src/i18n/hi.tsv
index dfaa94b5d6..52c5450bb3 100644
--- a/crates/ui-egui/src/i18n/hi.tsv
+++ b/crates/ui-egui/src/i18n/hi.tsv
@@ -2,6 +2,11 @@
 #   context <TAB> English source <TAB> translation
 #   Clean-room translation written from the English source's meaning.
 #   License: MIT OR Apache-2.0.
+
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	मेनू
 	File	फ़ाइल
 	Edit	संपादित करें
@@ -2786,6 +2791,31 @@ theme	Appearance	स्वरूप
 	field names can't contain a period: {name}	फ़ील्ड के नामों में पूर्ण विराम (.) नहीं हो सकता: {name}
 	two cells would both be named {name}	दो सेल का नाम {name} हो जाएगा
 	a field named {name} already exists	{name} नाम का फ़ील्ड पहले से मौजूद है
+	Clear search	खोज साफ़ करें
+	Edit this PDF	इस PDF को संपादित करें
+	Export this PDF	इस PDF को निर्यात करें
+	Find text or tools	पाठ या उपकरण ढूंढें
+	Hand Tool	हैंड टूल
+	Marquee Zoom	मार्की ज़ूम
+	Pin	पिन करें
+	Pin a tool…	उपकरण पिन करें…
+	Pin to Home	होम पर पिन करें
+	Pin tools to Home	होम पर उपकरण पिन करें
+	Pin your favorite tools here for quick access.	त्वरित पहुँच के लिए अपने पसंदीदा उपकरण यहाँ पिन करें।
+	Pinned	पिन किया गया
+	Pinned Tools	पिन किए गए उपकरण
+	Search tools…	उपकरण खोजें…
+	Select Tool	चयन उपकरण
+	Select tools to display on your Home page for quick access.	त्वरित पहुँच के लिए अपने होम पेज पर प्रदर्शित करने हेतु उपकरण चुनें।
+	Unpin from Home	होम से अनपिन करें
+	Unpin tool	उपकरण अनपिन करें
+	Arrange image	छवि व्यवस्थित करें
+	Bring forward	आगे लाएँ
+	Bring to front	सबसे आगे लाएँ
+	Crop	क्रॉप करें
+	Remove crop	क्रॉप हटाएँ
+	Send backward	पीछे भेजें
+	Send to back	सबसे पीछे भेजें
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	आज
@@ -2809,3 +2839,10 @@ theme	Appearance	स्वरूप
 
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	इस जवाब के विकल्प
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	खोजें…
+	Image pasted	छवि चिपकाई गई
+	No image on clipboard to paste	चिपकाने के लिए क्लिपबोर्ड में कोई छवि नहीं है
+	Pinned {tool} to Home	{tool} को होम पर पिन किया गया
+	Unpinned {tool} from Home	{tool} को होम से अनपिन किया गया
diff --git a/crates/ui-egui/src/i18n/hu.tsv b/crates/ui-egui/src/i18n/hu.tsv
index 53b81062bb..47d9c24b40 100644
--- a/crates/ui-egui/src/i18n/hu.tsv
+++ b/crates/ui-egui/src/i18n/hu.tsv
@@ -9,6 +9,11 @@
 # consulted or copied; add entries the same way.
 # Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) are not translated;
 # the trailing "…" of dialog commands is kept.
+
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	Menü
 	File	Fájl
 	Edit	Szerkesztés
@@ -2514,6 +2519,26 @@ animation effects	Off	Ki
 	Make properties default	Tulajdonságok beállítása alapértelmezettként
 	Pages selected	Kijelölt oldalak
 	Page properties	Oldaltulajdonságok
+	Clear search	Keresés törlése
+	Pin	Rögzítés
+	Pin a tool…	Eszköz rögzítése…
+	Pin to Home	Rögzítés a Kezdőlapra
+	Pin tools to Home	Eszközök rögzítése a Kezdőlapra
+	Pin your favorite tools here for quick access.	Rögzítse ide kedvenc eszközeit a gyors eléréshez.
+	Pinned	Rögzítve
+	Pinned Tools	Rögzített eszközök
+	Search tools…	Eszközök keresése…
+	Select tools to display on your Home page for quick access.	Válassza ki a Kezdőlapon megjelenítendő eszközöket a gyors eléréshez.
+	Unpin from Home	Rögzítés feloldása a Kezdőlapról
+	Unpin tool	Eszköz rögzítésének feloldása
+	Transform image	Kép transzformálása
+	Select Tool	Kijelölő eszköz
+	Hand Tool	Kéz eszköz
+	Marquee Zoom	Kijelölő nagyítás
+	Paste	Beillesztés
+	Edit this PDF	Ezen PDF szerkesztése
+	Export this PDF	Ezen PDF exportálása
+	Find text or tools	Szöveg vagy eszközök keresése
 	Create & Edit	Létrehozás és szerkesztés
 	Review & Compare	Áttekintés és összehasonlítás
 	Forms & Signatures	Űrlapok és aláírások
@@ -2561,6 +2586,13 @@ animation effects	Off	Ki
 	field names can't contain a period: {name}	a mezőnevek nem tartalmazhatnak pontot: {name}
 	two cells would both be named {name}	két cella neve is {name} lenne
 	a field named {name} already exists	már van {name} nevű mező
+	Arrange image	Kép elrendezése
+	Bring forward	Előrébb hozás
+	Bring to front	Előrehozás
+	Crop	Körülvágás
+	Remove crop	Körülvágás eltávolítása
+	Send backward	Hátrébb küldés
+	Send to back	Hátraküldés
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Ma
@@ -2577,3 +2609,11 @@ animation effects	Off	Ki
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	A válasz beállításai
 	Export value	Exportérték
+	Show Page Edge Shadows	Oldalszéli árnyékok megjelenítése
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Keresés…
+	Image pasted	Kép beillesztve
+	No image on clipboard to paste	Nincs beilleszthető kép a vágólapon
+	Pinned {tool} to Home	{tool} rögzítve a kezdőlapra
+	Unpinned {tool} from Home	{tool} leválasztva a kezdőlapról
diff --git a/crates/ui-egui/src/i18n/id.tsv b/crates/ui-egui/src/i18n/id.tsv
index 0eb02928f1..89152f62a4 100644
--- a/crates/ui-egui/src/i18n/id.tsv
+++ b/crates/ui-egui/src/i18n/id.tsv
@@ -3,6 +3,11 @@
 # Clean-room translations of PdfCraft's English UI labels. Use standard Indonesian computing
 # terms; keep product and format names (PdfCraft, PDF, PDF/A, OCR, XFA, Word...) unchanged.
 # Indonesian does not inflect nouns for number, so @plural entries list one form.
+
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	Menu
 	Edit	Edit
 	Pages	Halaman
@@ -2787,6 +2792,31 @@ theme	Appearance	Tampilan
 	field names can't contain a period: {name}	nama kolom tidak boleh berisi titik: {name}
 	two cells would both be named {name}	dua sel akan sama-sama bernama {name}
 	a field named {name} already exists	kolom bernama {name} sudah ada
+	Clear search	Bersihkan pencarian
+	Edit this PDF	Edit PDF ini
+	Export this PDF	Ekspor PDF ini
+	Find text or tools	Temukan teks atau alat
+	Hand Tool	Alat Tangan
+	Marquee Zoom	Zoom Bidang
+	Pin	Sematkan
+	Pin a tool…	Sematkan alat…
+	Pin to Home	Sematkan ke Beranda
+	Pin tools to Home	Sematkan alat ke Beranda
+	Pin your favorite tools here for quick access.	Sematkan alat favorit Anda di sini untuk akses cepat.
+	Pinned	Disematkan
+	Pinned Tools	Alat yang Disematkan
+	Search tools…	Cari alat…
+	Select Tool	Alat Pemilih
+	Select tools to display on your Home page for quick access.	Pilih alat untuk ditampilkan di halaman Beranda Anda untuk akses cepat.
+	Unpin from Home	Lepas sematan dari Beranda
+	Unpin tool	Lepas sematan alat
+	Arrange image	Atur gambar
+	Bring forward	Maju Selangkah
+	Bring to front	Bawa ke Depan
+	Crop	Pangkas
+	Remove crop	Hapus pangkasan
+	Send backward	Mundur Selangkah
+	Send to back	Kirim ke Belakang
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Hari ini
@@ -2810,3 +2840,10 @@ theme	Appearance	Tampilan
 
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Opsi untuk balasan ini
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Cari…
+	Image pasted	Gambar ditempel
+	No image on clipboard to paste	Tidak ada gambar di papan klip untuk ditempel
+	Pinned {tool} to Home	{tool} disematkan ke Beranda
+	Unpinned {tool} from Home	{tool} dilepas dari Beranda
diff --git a/crates/ui-egui/src/i18n/it.tsv b/crates/ui-egui/src/i18n/it.tsv
index a3dc999d6d..0cae8f3e98 100644
--- a/crates/ui-egui/src/i18n/it.tsv
+++ b/crates/ui-egui/src/i18n/it.tsv
@@ -15,6 +15,10 @@
 # Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) stay in Latin letters;
 # the trailing "…" of dialog commands is kept.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	Menu
 	File	File
 	Edit	Modifica
@@ -2727,6 +2731,26 @@ certificate	Key usage	Utilizzo chiave
 certificate	Self-signed	Autofirmato
 certificate	SHA-1 digest	Impronta SHA-1
 certificate	SHA-256 digest	Impronta SHA-256
+	Clear search	Cancella ricerca
+	Pin	Fissa
+	Pin a tool…	Fissa uno strumento…
+	Pin to Home	Fissa sulla Home
+	Pin tools to Home	Fissa strumenti sulla Home
+	Pin your favorite tools here for quick access.	Fissa qui i tuoi strumenti preferiti per un accesso rapido.
+	Pinned	Fissato
+	Pinned Tools	Strumenti fissati
+	Search tools…	Cerca strumenti…
+	Select tools to display on your Home page for quick access.	Seleziona gli strumenti da visualizzare nella pagina Home per un acceso rapido.
+	Unpin from Home	Rimuovi da Home
+	Unpin tool	Sblocca strumento dalla Home
+	Transform image	Trasforma immagine
+	Select Tool	Strumento Selezione
+	Hand Tool	Strumento Mano
+	Marquee Zoom	Ingrandimento selettivo
+	Paste	Incolla
+	Edit this PDF	Modifica questo PDF
+	Export this PDF	Esporta questo PDF
+	Find text or tools	Trova testo o strumenti
 	Create & Edit	Crea e modifica
 	Review & Compare	Revisione e confronto
 	Forms & Signatures	Moduli e firme
@@ -2794,6 +2818,13 @@ certificate	SHA-256 digest	Impronta SHA-256
 	field names can't contain a period: {name}	i nomi dei campi non possono contenere un punto: {name}
 	two cells would both be named {name}	due celle si chiamerebbero entrambe {name}
 	a field named {name} already exists	esiste già un campo chiamato {name}
+	Arrange image	Disponi immagine
+	Bring forward	Porta avanti
+	Bring to front	Porta in primo piano
+	Crop	Ritaglia
+	Remove crop	Rimuovi ritaglio
+	Send backward	Porta indietro
+	Send to back	Porta in secondo piano
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Oggi
@@ -2810,3 +2841,11 @@ certificate	SHA-256 digest	Impronta SHA-256
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Opzioni per questa risposta
 	Export value	Valore di esportazione
+	Show Page Edge Shadows	Mostra le ombre ai bordi delle pagine
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Cerca…
+	Image pasted	Immagine incollata
+	No image on clipboard to paste	Nessuna immagine negli appunti da incollare
+	Pinned {tool} to Home	{tool} fissato alla Home
+	Unpinned {tool} from Home	{tool} rimosso dai preferiti della Home
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index 5e64a1a8ce..abc616b817 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -15,6 +15,10 @@
 # Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) stay in Latin letters;
 # the trailing "…" of dialog commands is kept.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	メニュー
 	File	ファイル
 	Edit	編集
@@ -2515,6 +2519,26 @@ animation effects	Off	オフ
 	Make properties default	プロパティをデフォルトに設定
 	Pages selected	選択したページ
 	Page properties	ページのプロパティ
+	Clear search	検索をクリア
+	Pin	ピン留め
+	Pin a tool…	ツールをピン留め…
+	Pin to Home	ホームにピン留め
+	Pin tools to Home	ツールをホームにピン留め
+	Pin your favorite tools here for quick access.	よく使うツールをここにピン留めして、すばやくアクセスできるようにします。
+	Pinned	ピン留め済み
+	Pinned Tools	ピン留めしたツール
+	Search tools…	ツールを検索…
+	Select tools to display on your Home page for quick access.	すばやくアクセスできるように、ホームに表示するツールを選択します。
+	Unpin from Home	ホームからピン留めを解除
+	Unpin tool	ツールのピン留めを解除
+	Transform image	画像を変換
+	Select Tool	選択ツール
+	Hand Tool	手のひらツール
+	Marquee Zoom	範囲指定ズーム
+	Paste	貼り付け
+	Edit this PDF	この PDF を編集
+	Export this PDF	この PDF を書き出す
+	Find text or tools	テキストまたはツールを検索
 	Create & Edit	作成と編集
 	Review & Compare	レビューと比較
 	Forms & Signatures	フォームと署名
@@ -2562,6 +2586,13 @@ animation effects	Off	オフ
 	field names can't contain a period: {name}	フィールド名にピリオドは使えません: {name}
 	two cells would both be named {name}	2 つのセルが同じ名前 {name} になります
 	a field named {name} already exists	{name} という名前のフィールドは既にあります
+	Arrange image	画像を配置
+	Bring forward	前面へ移動
+	Bring to front	最前面へ移動
+	Crop	切り抜き
+	Remove crop	切り抜きを解除
+	Send backward	背面へ移動
+	Send to back	最背面へ移動
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	今日
@@ -2578,3 +2609,11 @@ animation effects	Off	オフ
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	この返信のオプション
 	Export value	書き出し値
+	Show Page Edge Shadows	ページ端の影を表示
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	検索…
+	Image pasted	画像を貼り付けました
+	No image on clipboard to paste	貼り付ける画像がクリップボードにありません
+	Pinned {tool} to Home	{tool} をホームにピン留めしました
+	Unpinned {tool} from Home	{tool} のホームへのピン留めを解除しました
diff --git a/crates/ui-egui/src/i18n/kk.tsv b/crates/ui-egui/src/i18n/kk.tsv
index 5c8e594759..fc6a2d783a 100644
--- a/crates/ui-egui/src/i18n/kk.tsv
+++ b/crates/ui-egui/src/i18n/kk.tsv
@@ -1,3 +1,7 @@
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	Мәзір
 	File	Файл
 	Edit	Түзету
@@ -2513,6 +2517,26 @@ animation effects	Off	Өшірулі
 	Make properties default	Қасиеттерді әдепкі ету
 	Pages selected	Таңдалған беттер
 	Page properties	Бет қасиеттері
+	Clear search	Іздеуді тазалау
+	Pin	Бекіту
+	Pin a tool…	Құралды бекіту…
+	Pin to Home	Басты бетке бекіту
+	Pin tools to Home	Құралдарды басты бетке бекіту
+	Pin your favorite tools here for quick access.	Жылдам қол жеткізу үшін таңдаулы құралдарды осында бекітіңіз.
+	Pinned	Бекітілген
+	Pinned Tools	Бекітілген құралдар
+	Search tools…	Құралдарды іздеу…
+	Select tools to display on your Home page for quick access.	Жылдам қол жеткізу үшін басты бетте көрсетілетін құралдарды таңдаңыз.
+	Unpin from Home	Басты беттен алып тастау
+	Unpin tool	Құралды бекітуден шығару
+	Transform image	Кескінді түрлендіру
+	Select Tool	Таңдау құралы
+	Hand Tool	Қол құралы
+	Marquee Zoom	Аймақты масштабтау
+	Paste	Қою
+	Edit this PDF	Осы PDF файлын түзету
+	Export this PDF	Осы PDF файлын экспорттау
+	Find text or tools	Мәтінді немесе құралдарды табу
 	Create & Edit	Жасау және өңдеу
 	Review & Compare	Шолу және салыстыру
 	Forms & Signatures	Пішіндер және қолтаңбалар
@@ -2560,6 +2584,13 @@ animation effects	Off	Өшірулі
 	field names can't contain a period: {name}	өріс атауларында нүкте болмауы керек: {name}
 	two cells would both be named {name}	екі ұяшықтың да атауы {name} болар еді
 	a field named {name} already exists	{name} атты өріс бар
+	Arrange image	Суретті реттеу
+	Bring forward	Алға жылжыту
+	Bring to front	Алдыңғы планға шығару
+	Crop	Қию
+	Remove crop	Қиюды алып тастау
+	Send backward	Артқа жылжыту
+	Send to back	Артқы планға жіберу
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Бүгін
@@ -2576,3 +2607,11 @@ animation effects	Off	Өшірулі
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Осы жауаптың параметрлері
 	Export value	Экспорт мәні
+	Show Page Edge Shadows	Бет жиектерінің көлеңкелерін көрсету
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Іздеу…
+	Image pasted	Сурет қойылды
+	No image on clipboard to paste	Алмасу буферінде қоятын сурет жоқ
+	Pinned {tool} to Home	{tool} басты бетке бекітілді
+	Unpinned {tool} from Home	{tool} басты беттен ажыратылды
diff --git a/crates/ui-egui/src/i18n/ko.tsv b/crates/ui-egui/src/i18n/ko.tsv
index 1e461bbdff..20315b5fcf 100644
--- a/crates/ui-egui/src/i18n/ko.tsv
+++ b/crates/ui-egui/src/i18n/ko.tsv
@@ -2,6 +2,11 @@
 #   context <TAB> English source <TAB> translation
 #   Clean-room translation written from the English source's meaning.
 #   License: MIT OR Apache-2.0.
+
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	메뉴
 	File	파일
 	Edit	편집
@@ -2786,6 +2791,31 @@ theme	Appearance	모양
 	field names can't contain a period: {name}	필드 이름에는 마침표를 쓸 수 없습니다: {name}
 	two cells would both be named {name}	두 셀의 이름이 모두 {name}이(가) 됩니다
 	a field named {name} already exists	{name}(이)라는 필드가 이미 있습니다
+	Clear search	검색 지우기
+	Edit this PDF	이 PDF 편집
+	Export this PDF	이 PDF 내보내기
+	Find text or tools	텍스트 또는 도구 찾기
+	Hand Tool	손 도구
+	Marquee Zoom	영역 확대/축소
+	Pin	고정
+	Pin a tool…	도구 고정…
+	Pin to Home	홈에 고정
+	Pin tools to Home	홈에 도구 고정
+	Pin your favorite tools here for quick access.	빠른 액세스를 위해 즐겨찾는 도구를 여기에 고정하세요.
+	Pinned	고정됨
+	Pinned Tools	고정된 도구
+	Search tools…	도구 검색…
+	Select Tool	선택 도구
+	Select tools to display on your Home page for quick access.	빠른 액세스를 위해 홈 페이지에 표시할 도구를 선택하세요.
+	Unpin from Home	홈에서 고정 해제
+	Unpin tool	도구 고정 해제
+	Arrange image	이미지 정렬
+	Bring forward	앞으로 가져오기
+	Bring to front	맨 앞으로 가져오기
+	Crop	자르기
+	Remove crop	자르기 제거
+	Send backward	뒤로 보내기
+	Send to back	맨 뒤로 보내기
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	오늘
@@ -2809,3 +2839,10 @@ theme	Appearance	모양
 
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	이 답글의 옵션
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	검색…
+	Image pasted	이미지를 붙여넣었습니다
+	No image on clipboard to paste	클립보드에 붙여넣을 이미지가 없습니다
+	Pinned {tool} to Home	{tool}을 홈에 고정했습니다
+	Unpinned {tool} from Home	{tool}의 홈 고정을 해제했습니다
diff --git a/crates/ui-egui/src/i18n/lo.tsv b/crates/ui-egui/src/i18n/lo.tsv
index c4d45c90d1..ea684f6d59 100644
--- a/crates/ui-egui/src/i18n/lo.tsv
+++ b/crates/ui-egui/src/i18n/lo.tsv
@@ -15,6 +15,10 @@
 # Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) stay in Latin letters;
 # the trailing "..." of dialog commands is kept.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	ເມນູ
 	File	ໄຟລ໌
 	Edit	ແກ້ໄຂ
@@ -2451,6 +2455,13 @@ animation effects	Off	ປິດ
 	Make properties default	ກຳນົດຄຸນສົມບັດເປັນຄ່າເລີ່ມຕົ້ນ
 	Pages selected	ໜ້າທີ່ເລືອກ
 	Page properties	ຄຸນສົມບັດໜ້າ
+	Arrange image	ຈັດຮູບພາບ
+	Bring forward	ນຳມາທາງໜ້າ
+	Bring to front	ນຳມາໄວ້ໜ້າສຸດ
+	Crop	ຕັດຂອບ
+	Remove crop	ຍົກເລີກການຕັດຂອບ
+	Send backward	ສົ່ງໄປທາງຫຼັງ
+	Send to back	ສົ່ງໄປໄວ້ຫຼັງສຸດ
 	Create & Edit	ສ້າງ & ແກ້ໄຂ
 	Review & Compare	ກວດກາຄືນ & ປຽບທຽບ
 	Forms & Signatures	ຟອມ & ລາຍເຊັນ
@@ -2481,3 +2492,33 @@ animation effects	Off	ປິດ
 	Unchecked reads	Unchecked reads
 	{field} reads fields named as it runs	{field} reads fields named as it runs
 	Some names are built as it runs	Some names are built as it runs
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	ຄົ້ນຫາ…
+	Image pasted	ວາງຮູບແລ້ວ
+	No image on clipboard to paste	ບໍ່ມີຮູບໃນຄລິບບອດເພື່ອວາງ
+	Pinned {tool} to Home	ປັກໝຸດ {tool} ໄວ້ໜ້າຫຼັກແລ້ວ
+	Unpinned {tool} from Home	ຖອນໝຸດ {tool} ຈາກໜ້າຫຼັກແລ້ວ
+
+# Home tools (AI-assisted; not separately native-reviewed)
+	Clear search	ລ້າງການຄົ້ນຫາ
+	Pin	ປັກໝຸດ
+	Pin a tool…	ປັກໝຸດເຄື່ອງມື…
+	Pin to Home	ປັກໝຸດໄວ້ໜ້າຫຼັກ
+	Pin tools to Home	ປັກໝຸດເຄື່ອງມືໄວ້ໜ້າຫຼັກ
+	Pin your favorite tools here for quick access.	ປັກໝຸດເຄື່ອງມືທີ່ມັກໄວ້ທີ່ນີ້ເພື່ອເຂົ້າໃຊ້ໄດ້ໄວ.
+	Pinned	ປັກໝຸດແລ້ວ
+	Pinned Tools	ເຄື່ອງມືທີ່ປັກໝຸດ
+	Search tools…	ຄົ້ນຫາເຄື່ອງມື…
+	Select tools to display on your Home page for quick access.	ເລືອກເຄື່ອງມືໃຫ້ສະແດງໃນໜ້າຫຼັກເພື່ອເຂົ້າໃຊ້ໄດ້ໄວ.
+	Unpin from Home	ຖອນໝຸດຈາກໜ້າຫຼັກ
+	Unpin tool	ຖອນໝຸດເຄື່ອງມື
+	Transform image	ປ່ຽນຮູບຮ່າງຮູບ
+	Select Tool	ເຄື່ອງມືເລືອກ
+	Hand Tool	ເຄື່ອງມືມື
+	Marquee Zoom	ຊູມພື້ນທີ່ເລືອກ
+	Paste	ວາງ
+	Edit this PDF	ແກ້ໄຂ PDF ນີ້
+	Export this PDF	ສົ່ງອອກ PDF ນີ້
+	Find text or tools	ຊອກຫາຂໍ້ຄວາມ ຫຼື ເຄື່ອງມື
+	Crop image	ຕັດຂອບຮູບພາບ
diff --git a/crates/ui-egui/src/i18n/lt.tsv b/crates/ui-egui/src/i18n/lt.tsv
index 61fd9dc9a2..fd7f431154 100644
--- a/crates/ui-egui/src/i18n/lt.tsv
+++ b/crates/ui-egui/src/i18n/lt.tsv
@@ -4,6 +4,10 @@
 # consult the Lietuvos Respublikos terminų bankas (terminai.vlkk.lt) when selecting terminology.
 # Product and format names (PdfCraft, PDF, PDF/A, OCR, XFA, Word…) remain unchanged.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	Meniu
 	Edit	Redaguoti
 	Pages	Puslapiai
@@ -2765,6 +2769,12 @@ key	Space	Tarpas
 	Make properties default	Nustatyti ypatybes kaip numatytąsias
 	Pages selected	Pasirinkti puslapiai
 	Page properties	Puslapio ypatybės
+	Bring forward	Perkelti į priekį
+	Bring to front	Iškelti į priekį
+	Crop image	Apkarpyti paveikslėlį
+	Remove crop	Pašalinti apkarpymą
+	Send backward	Perkelti atgal
+	Send to back	Nukelti į galą
 	Create & Edit	Kūrimas ir redagavimas
 	Review & Compare	Peržiūra ir palyginimas
 	Forms & Signatures	Formos ir parašai
@@ -2773,7 +2783,6 @@ key	Space	Tarpas
 	No tools match your search.	Paieškos neatitinka joks įrankis.
 	Expand all tools	Išskleisti visus įrankius
 	Collapse all tools	Suskleisti visus įrankius
-
 # AI-assisted additions for concurrently merged UI features (2026-10-15).
 # These additions have not had separate native-speaker review.
 	Mouse wheel scroll speed	Pelės ratuko slinkimo greitis
@@ -2781,6 +2790,25 @@ key	Space	Tarpas
 	The password must have at least 6 characters.	Slaptažodį turi sudaryti bent 6 simboliai.
 	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	Šis failas diske pasikeitė. Įkelkite jį iš naujo, kad pamatytumėte naują versiją; neįrašyti pakeitimai bus prarasti.
 theme	Appearance	Išvaizda
+	Clear search	Išvalyti paiešką
+	Pin	Prisegti
+	Pin a tool…	Prisegti įrankį…
+	Pin to Home	Prisegti pradžioje
+	Pin tools to Home	Prisegti įrankius pradžioje
+	Pin your favorite tools here for quick access.	Prisekite mėgstamus įrankius čia, kad greitai pasiektumėte.
+	Pinned	Prisegta
+	Pinned Tools	Prisegti įrankiai
+	Search tools…	Ieškoti įrankių…
+	Select tools to display on your Home page for quick access.	Pasirinkite įrankius, kuriuos norite rodyti pradžios puslapyje.
+	Unpin from Home	Atsegti nuo pradžios
+	Unpin tool	Atsegti įrankį
+	Transform image	Transformuoti paveikslėlį
+	Select Tool	Pasirinkimo įrankis
+	Hand Tool	Rankos įrankis
+	Marquee Zoom	Didinti pažymėtą sritį
+	Edit this PDF	Redaguoti šį PDF
+	Export this PDF	Eksportuoti šį PDF
+	Find text or tools	Rasti tekstą arba įrankius
 	Attach a file…	Pridėti failą…
 	Delete attachment	Ištrinti priedą
 	Attaching files is not available on the web yet	Failų pridėjimas žiniatinklyje dar negalimas
@@ -2823,6 +2851,8 @@ theme	Appearance	Išvaizda
 	a table has 1 to {max} columns	lentelėje gali būti nuo 1 iki {max} stulpelių
 	the first row number can be at most {max}	pirmosios eilutės numeris gali būti ne didesnis nei {max}
 	the area, the spacing and the column widths must be numbers, the spacing 0 or more and each width more than 0	sritis, tarpai ir stulpelių pločiai turi būti skaičiai, tarpai – 0 arba daugiau, o kiekvienas plotis – daugiau nei 0
+	Arrange image	Tvarkyti vaizdą
+	Crop	Apkarpyti
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Šiandien
@@ -2839,3 +2869,11 @@ theme	Appearance	Išvaizda
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Šio atsakymo parinktys
 	Export value	Eksporto reikšmė
+	Show Page Edge Shadows	Rodyti puslapių kraštų šešėlius
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Ieškoti…
+	Image pasted	Paveikslėlis įklijuotas
+	No image on clipboard to paste	Iškarpinėje nėra paveikslėlio įklijuoti
+	Pinned {tool} to Home	{tool} prisegtas pradžios puslapyje
+	Unpinned {tool} from Home	{tool} atsegtas nuo pradžios puslapio
diff --git a/crates/ui-egui/src/i18n/nb.tsv b/crates/ui-egui/src/i18n/nb.tsv
index e81b84e341..b54b3e3526 100644
--- a/crates/ui-egui/src/i18n/nb.tsv
+++ b/crates/ui-egui/src/i18n/nb.tsv
@@ -7,6 +7,10 @@
 # Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) are not translated;
 # the trailing "…" of dialog commands is kept.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Allow	Tillat
 	Cancel	Avbryt
 	Only allow this if you trust the source document.	Tillat dette bare hvis du stoler på kildedokumentet.
@@ -2724,6 +2728,13 @@ key	Space	Mellomrom
 # Page gaps (AI-assisted, not separately native-reviewed)
 	Show gaps between pages	Vis mellomrom mellom sidene
 	Hide gaps to join page edges. Margins inside the PDF remain unchanged.	Skjul mellomrommene slik at sidekantene møtes. Margene inne i PDF-en endres ikke.
+	Arrange image	Ranger bilde
+	Bring forward	Flytt fremover
+	Bring to front	Plasser lengst frem
+	Crop	Beskjær
+	Remove crop	Fjern beskjæring
+	Send backward	Flytt bakover
+	Send to back	Plasser lengst bak
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	I dag
@@ -2754,3 +2765,32 @@ key	Space	Mellomrom
 @plural	{n} more formula reads a missing field.|{n} more formulas read missing fields.	{n} more formula reads a missing field.|{n} more formulas read missing fields.
 @plural	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.
 @plural	{fields} is missing|{fields} are missing	{fields} is missing|{fields} are missing
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Søk…
+	Image pasted	Bilde limt inn
+	No image on clipboard to paste	Ingen bilder på utklippstavlen å lime inn
+	Pinned {tool} to Home	Festet {tool} til Hjem
+	Unpinned {tool} from Home	Løsnet {tool} fra Hjem
+
+# Home tools (AI-assisted; not separately native-reviewed)
+	Clear search	Tøm søk
+	Pin	Fest
+	Pin a tool…	Fest et verktøy…
+	Pin to Home	Fest til Hjem
+	Pin tools to Home	Fest verktøy til Hjem
+	Pin your favorite tools here for quick access.	Fest favorittverktøyene dine her for rask tilgang.
+	Pinned	Festet
+	Pinned Tools	Festede verktøy
+	Search tools…	Søk etter verktøy…
+	Select tools to display on your Home page for quick access.	Velg verktøy som skal vises på hjemmesiden for rask tilgang.
+	Unpin from Home	Løsne fra Hjem
+	Unpin tool	Løsne verktøy
+	Transform image	Transformer bilde
+	Select Tool	Markeringsverktøy
+	Hand Tool	Håndverktøy
+	Marquee Zoom	Områdezoom
+	Edit this PDF	Rediger denne PDF-en
+	Export this PDF	Eksporter denne PDF-en
+	Find text or tools	Finn tekst eller verktøy
+	Crop image	Beskjær bilde
diff --git a/crates/ui-egui/src/i18n/pl.tsv b/crates/ui-egui/src/i18n/pl.tsv
index 203cad58d8..208dd1c61e 100644
--- a/crates/ui-egui/src/i18n/pl.tsv
+++ b/crates/ui-egui/src/i18n/pl.tsv
@@ -15,6 +15,10 @@
 # Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) stay in Latin letters;
 # the trailing "…" of dialog commands is kept.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	Menu
 	File	Plik
 	Edit	Edycja
@@ -2491,6 +2495,26 @@ animation effects	Off	Wyłączone
 	Make properties default	Ustaw właściwości jako domyślne
 	Pages selected	Zaznaczone strony
 	Page properties	Właściwości strony
+	Clear search	Wyczyść wyszukiwanie
+	Pin	Przypnij
+	Pin a tool…	Przypnij narzędzie…
+	Pin to Home	Przypnij do strony głównej
+	Pin tools to Home	Przypnij narzędzia do strony głównej
+	Pin your favorite tools here for quick access.	Przypnij tutaj ulubione narzędzia, aby mieć do nich szybki dostęp.
+	Pinned	Przypięte
+	Pinned Tools	Przypięte narzędzia
+	Search tools…	Szukaj narzędzi…
+	Select tools to display on your Home page for quick access.	Wybierz narzędzia do wyświetlenia na stronie głównej, aby mieć do nich szybki dostęp.
+	Unpin from Home	Odepnij od strony głównej
+	Unpin tool	Odepnij narzędzie
+	Transform image	Przekształć obraz
+	Select Tool	Narzędzie Zaznaczanie
+	Hand Tool	Narzędzie Rączka
+	Marquee Zoom	Powiększ zaznaczony obszar
+	Paste	Wklej
+	Edit this PDF	Edytuj ten plik PDF
+	Export this PDF	Eksportuj ten plik PDF
+	Find text or tools	Znajdź tekst lub narzędzia
 	Create & Edit	Tworzenie i edycja
 	Review & Compare	Recenzja i porównanie
 	Forms & Signatures	Formularze i podpisy
@@ -2658,6 +2682,13 @@ animation effects	Off	Wyłączone
 	field names can't contain a period: {name}	nazwy pól nie mogą zawierać kropki: {name}
 	two cells would both be named {name}	dwie komórki miałyby nazwę {name}
 	a field named {name} already exists	pole o nazwie {name} już istnieje
+	Arrange image	Rozmieść obraz
+	Bring forward	Przesuń do przodu
+	Bring to front	Przesuń na wierzch
+	Crop	Przytnij
+	Remove crop	Usuń przycięcie
+	Send backward	Przesuń do tyłu
+	Send to back	Przesuń pod spód
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Dzisiaj
@@ -2674,3 +2705,11 @@ animation effects	Off	Wyłączone
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Opcje tej odpowiedzi
 	Export value	Wartość eksportowa
+	Show Page Edge Shadows	Pokaż cienie krawędzi stron
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Szukaj…
+	Image pasted	Wklejono obraz
+	No image on clipboard to paste	Brak obrazu do wklejenia w schowku
+	Pinned {tool} to Home	Przypięto {tool} do strony głównej
+	Unpinned {tool} from Home	Odpięto {tool} od strony głównej
diff --git a/crates/ui-egui/src/i18n/pt-br.tsv b/crates/ui-egui/src/i18n/pt-br.tsv
index 45f827171b..a172a03879 100644
--- a/crates/ui-egui/src/i18n/pt-br.tsv
+++ b/crates/ui-egui/src/i18n/pt-br.tsv
@@ -8,6 +8,10 @@
 # Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) are not translated;
 # the trailing "…" of dialog commands is kept.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	Menu
 	File	Arquivo
 	Rotation:	Rotação:
@@ -2529,6 +2533,25 @@ animation effects	Off	Desativados
 	Make properties default	Tornar propriedades padrão
 	Pages selected	Páginas selecionadas
 	Page properties	Propriedades da página
+	Clear search	Limpar pesquisa
+	Pin	Fixar
+	Pin a tool…	Fixar uma ferramenta…
+	Pin to Home	Fixar no Início
+	Pin tools to Home	Fixar ferramentas no Início
+	Pin your favorite tools here for quick access.	Fixe suas ferramentas favoritas aqui para acesso rápido.
+	Pinned	Fixado
+	Pinned Tools	Ferramentas fixadas
+	Search tools…	Pesquisar ferramentas…
+	Select tools to display on your Home page for quick access.	Selecione ferramentas para exibir na página Início para acesso rápido.
+	Unpin from Home	Desafixar do Início
+	Unpin tool	Desafixar ferramenta
+	Transform image	Transformar imagem
+	Select Tool	Ferramenta Seleção
+	Hand Tool	Ferramenta Mão
+	Marquee Zoom	Zoom por seleção
+	Edit this PDF	Editar este PDF
+	Export this PDF	Exportar este PDF
+	Find text or tools	Localizar texto ou ferramentas
 	Create & Edit	Criar e editar
 	Review & Compare	Revisar e comparar
 	Forms & Signatures	Formulários e assinaturas
@@ -2847,6 +2870,14 @@ theme	Appearance	Aparência
 	a table has 1 to {max} columns	uma tabela tem de 1 a {max} colunas
 	the first row number can be at most {max}	o número da primeira linha pode ser no máximo {max}
 	the area, the spacing and the column widths must be numbers, the spacing 0 or more and each width more than 0	a área, o espaçamento e as larguras das colunas devem ser números, o espaçamento 0 ou mais e cada largura maior que 0
+	Bring forward	Avançar
+	Bring to front	Trazer para a frente
+	Crop image	Cortar imagem
+	Remove crop	Remover corte
+	Send backward	Recuar
+	Send to back	Enviar para trás
+	Arrange image	Organizar imagem
+	Crop	Cortar
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Hoje
@@ -2863,3 +2894,11 @@ theme	Appearance	Aparência
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Opções desta resposta
 	Export value	Valor de exportação
+	Show Page Edge Shadows	Mostrar sombras nas bordas das páginas
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Pesquisar…
+	Image pasted	Imagem colada
+	No image on clipboard to paste	Nenhuma imagem na área de transferência para colar
+	Pinned {tool} to Home	{tool} fixado no Início
+	Unpinned {tool} from Home	{tool} desafixado do Início
diff --git a/crates/ui-egui/src/i18n/ro.tsv b/crates/ui-egui/src/i18n/ro.tsv
index 6b23515b8e..0d0fbf16b4 100644
--- a/crates/ui-egui/src/i18n/ro.tsv
+++ b/crates/ui-egui/src/i18n/ro.tsv
@@ -9,6 +9,10 @@
 # the trailing "…" of dialog commands is kept. Commands use the noun form ("Salvare", "Deschidere…"),
 # messages address the user formally ("Alegeți", "dvs.").
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	Meniu
 	Edit	Editare
 	Pages	Pagini
@@ -2815,6 +2819,33 @@ theme	Appearance	Aspect
 	field names can't contain a period: {name}	numele câmpurilor nu pot conține punct: {name}
 	two cells would both be named {name}	două celule s-ar numi amândouă {name}
 	a field named {name} already exists	există deja un câmp numit {name}
+	Bring forward	Aduce mai în față
+	Bring to front	Aduce în prim-plan
+	Crop image	Decupare imagine
+	Remove crop	Elimină decuparea
+	Send backward	Trimite mai în spate
+	Send to back	Trimite în fundal
+	Clear search	Golește căutarea
+	Edit this PDF	Editează acest PDF
+	Export this PDF	Exportă acest PDF
+	Find text or tools	Găsește text sau instrumente
+	Hand Tool	Instrumentul Mână
+	Marquee Zoom	Zoom cadru
+	Pin	Fixează
+	Pin a tool…	Fixează un instrument…
+	Pin to Home	Fixează la Pagina de pornire
+	Pin tools to Home	Fixează instrumente la Pagina de pornire
+	Pin your favorite tools here for quick access.	Fixează instrumentele preferate aici pentru acces rapid.
+	Pinned	Fixat
+	Pinned Tools	Instrumente fixate
+	Search tools…	Caută instrumente…
+	Select Tool	Instrumentul Selecție
+	Select tools to display on your Home page for quick access.	Selectează instrumentele de afișat pe Pagina de pornire pentru acces rapid.
+	Transform image	Transformare imagine
+	Unpin from Home	Anulează fixarea la Pagina de pornire
+	Unpin tool	Anulează fixarea instrumentului
+	Arrange image	Aranjează imaginea
+	Crop	Decupare
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Astăzi
@@ -2838,3 +2869,10 @@ theme	Appearance	Aspect
 
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Opțiuni pentru acest răspuns
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Caută…
+	Image pasted	Imagine lipită
+	No image on clipboard to paste	Nicio imagine în clipboard de lipit
+	Pinned {tool} to Home	{tool} fixat pe pagina principală
+	Unpinned {tool} from Home	{tool} desprins de pe pagina principală
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
index 59c483526a..b45d73ecab 100644
--- a/crates/ui-egui/src/i18n/ru.tsv
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -8,6 +8,10 @@
 # Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) are not translated;
 # the trailing "…" of dialog commands is kept.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	Меню
 	File	Файл
 	Edit	Редактирование
@@ -2428,6 +2432,26 @@ animation effects	Off	Выкл
 	Make properties default	Сделать свойства стандартными
 	Pages selected	Выделенные страницы
 	Page properties	Свойства страницы
+	Clear search	Очистить поиск
+	Pin	Закрепить
+	Pin a tool…	Закрепить инструмент…
+	Pin to Home	Закрепить на Главной
+	Pin tools to Home	Закрепить инструменты на Главной
+	Pin your favorite tools here for quick access.	Закрепите здесь избранные инструменты для быстрого доступа.
+	Pinned	Закреплено
+	Pinned Tools	Закрепленные инструменты
+	Search tools…	Поиск инструментов…
+	Select tools to display on your Home page for quick access.	Выберите инструменты для отображения на Главной странице для быстрого доступа.
+	Unpin from Home	Открепить от Главной
+	Unpin tool	Открепить инструмент
+	Transform image	Трансформировать изображение
+	Select Tool	Инструмент «Выделение»
+	Hand Tool	Инструмент «Рука»
+	Marquee Zoom	Масштаб выделением
+	Paste	Вставить
+	Edit this PDF	Редактировать этот PDF
+	Export this PDF	Экспортировать этот PDF
+	Find text or tools	Найти текст или инструменты
 	Create & Edit	Создание и редактирование
 	Review & Compare	Рецензирование и сравнение
 	Forms & Signatures	Формы и подписи
@@ -2475,6 +2499,13 @@ animation effects	Off	Выкл
 	field names can't contain a period: {name}	имена полей не могут содержать точку: {name}
 	two cells would both be named {name}	две ячейки получили бы одно имя {name}
 	a field named {name} already exists	поле с именем {name} уже существует
+	Arrange image	Упорядочить изображение
+	Bring forward	Переместить вперед
+	Bring to front	На передний план
+	Crop	Обрезать
+	Remove crop	Убрать обрезку
+	Send backward	Переместить назад
+	Send to back	На задний план
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Сегодня
@@ -2491,3 +2522,11 @@ animation effects	Off	Выкл
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Параметры этого ответа
 	Export value	Значение экспорта
+	Show Page Edge Shadows	Показывать тени по краям страниц
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Поиск…
+	Image pasted	Изображение вставлено
+	No image on clipboard to paste	В буфере обмена нет изображения для вставки
+	Pinned {tool} to Home	{tool} закреплён на главной
+	Unpinned {tool} from Home	{tool} откреплён от главной
diff --git a/crates/ui-egui/src/i18n/sl.tsv b/crates/ui-egui/src/i18n/sl.tsv
index 83cb594158..c95f6d6bd6 100644
--- a/crates/ui-egui/src/i18n/sl.tsv
+++ b/crates/ui-egui/src/i18n/sl.tsv
@@ -8,6 +8,10 @@
 # Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) are not translated;
 # the trailing "…" of dialog commands is kept.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	Meni
 	File	Datoteka
 	Edit	Urejanje
@@ -2520,6 +2524,26 @@ animation effects	Off	Izklopljeni
 	Make properties default	Nastavi lastnosti kot privzete
 	Pages selected	Izbrane strani
 	Page properties	Lastnosti strani
+	Clear search	Počisti iskanje
+	Pin	Pripni
+	Pin a tool…	Pripni orodje…
+	Pin to Home	Pripni na domov
+	Pin tools to Home	Pripni orodja na domov
+	Pin your favorite tools here for quick access.	Tukaj pripnite svoja priljubljena orodja za hiter dostop.
+	Pinned	Pripeto
+	Pinned Tools	Pripeta orodja
+	Search tools…	Išči orodja…
+	Select tools to display on your Home page for quick access.	Izberite orodja za prikaz na domači strani za hiter dostop.
+	Unpin from Home	Odpni z domače strani
+	Unpin tool	Odpni orodje
+	Transform image	Preoblikuj sliko
+	Select Tool	Orodje za izbiro
+	Hand Tool	Orodje z roko
+	Marquee Zoom	Povečava z okvirjem
+	Paste	Prilepi
+	Edit this PDF	Uredi ta PDF
+	Export this PDF	Izvozi ta PDF
+	Find text or tools	Poišči besedilo ali orodja
 	Create & Edit	Ustvarjanje in urejanje
 	Review & Compare	Pregled in primerjava
 	Forms & Signatures	Obrazci in podpisi
@@ -2567,6 +2591,13 @@ animation effects	Off	Izklopljeni
 	field names can't contain a period: {name}	imena polj ne smejo vsebovati pike: {name}
 	two cells would both be named {name}	dve celici bi imeli enako ime {name}
 	a field named {name} already exists	polje z imenom {name} že obstaja
+	Arrange image	Uredi sliko
+	Bring forward	Premakni naprej
+	Bring to front	Postavi v ospredje
+	Crop	Obreži
+	Remove crop	Odstrani obrezovanje
+	Send backward	Premakni nazaj
+	Send to back	Postavi v ozadje
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Danes
@@ -2583,3 +2614,11 @@ animation effects	Off	Izklopljeni
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Možnosti tega odgovora
 	Export value	Izvozna vrednost
+	Show Page Edge Shadows	Prikaži sence robov strani
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Išči…
+	Image pasted	Slika prilepljena
+	No image on clipboard to paste	V odložišču ni slike za lepljenje
+	Pinned {tool} to Home	{tool} pripeto na domačo stran
+	Unpinned {tool} from Home	{tool} odpeto z domače strani
diff --git a/crates/ui-egui/src/i18n/sq.tsv b/crates/ui-egui/src/i18n/sq.tsv
index e5a8f5b037..eb9eed3a0e 100644
--- a/crates/ui-egui/src/i18n/sq.tsv
+++ b/crates/ui-egui/src/i18n/sq.tsv
@@ -8,6 +8,10 @@
 # Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) are not translated;
 # the trailing "…" of dialog commands is kept.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	Menyja
 	File	Skedari
 	Edit	Redakto
@@ -2385,7 +2389,7 @@ animation effects	Off	Joaktiv
 	Collapse all pages	Collapse all pages
 	Counting words… {n} pages read	Counting words… {n} pages read
 	Create Link…	Create Link…
-	Crop Image	Crop Image
+	Crop Image	Prit imazhin
 	Current page only	Current page only
 	Cut Image	Cut Image
 	Cuts each page to its printed area, turns it upright and fits it to the sheet without stretching. One label per sheet.	Cuts each page to its printed area, turns it upright and fits it to the sheet without stretching. One label per sheet.
@@ -2463,7 +2467,7 @@ animation effects	Off	Joaktiv
 	Recognize Text…	Recognize Text…
 	Redact Image	Redact Image
 	Redaction mark appearance	Redaction mark appearance
-	Remove Crop	Remove Crop
+	Remove Crop	Hiq prerjen
 	Remove this leaf tag from reading order and mark its direct content as an artifact	Remove this leaf tag from reading order and mark its direct content as an artifact
 	Resolution:	Resolution:
 	Save anyway	Save anyway
@@ -2541,6 +2545,32 @@ animation effects	Off	Joaktiv
 	field names can't contain a period: {name}	emrat e fushave nuk mund të përmbajnë pikë: {name}
 	two cells would both be named {name}	dy qeliza do të kishin të dyja emrin {name}
 	a field named {name} already exists	ekziston tashmë një fushë me emrin {name}
+	Clear search	Pastro kërkimin
+	Edit this PDF	Redakto këtë PDF
+	Export this PDF	Eksporto këtë PDF
+	Find text or tools	Gjej tekst ose mjete
+	Hand Tool	Mjeti Dorë
+	Marquee Zoom	Zmadhim me kornizë
+	Paste	Ngjit
+	Pin	Fikso
+	Pin a tool…	Fikso një mjet…
+	Pin to Home	Fikso në Ballinë
+	Pin tools to Home	Fikso mjetet në Ballinë
+	Pin your favorite tools here for quick access.	Fiksoni mjetet tuaja të preferuara këtu për qasje të shpejtë.
+	Pinned	I fiksuar
+	Pinned Tools	Mjete të fiksuara
+	Search tools…	Kërko mjete…
+	Select Tool	Mjeti Përzgjedhje
+	Select tools to display on your Home page for quick access.	Zgjidhni mjetet për t'u shfaqur në faqen tuaj të Ballinës për qasje të shpejtë.
+	Unpin from Home	Hiq fiksimin nga Ballina
+	Unpin tool	Hiq fiksimin e mjetit
+	Arrange image	Rregullo figurën
+	Bring forward	Kalo përpara
+	Bring to front	Sille përpara
+	Crop	Prit
+	Remove crop	Hiq prerjen
+	Send backward	Kalo prapa
+	Send to back	Dërgo mbrapa
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Sot
@@ -2564,3 +2594,10 @@ animation effects	Off	Joaktiv
 
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Opsionet për këtë përgjigje
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Kërko…
+	Image pasted	Imazhi u ngjit
+	No image on clipboard to paste	Nuk ka imazh në kujtesën e përkohshme për të ngjitur
+	Pinned {tool} to Home	{tool} u fiksua te Kreu
+	Unpinned {tool} from Home	{tool} u hoq nga fiksimi te Kreu
diff --git a/crates/ui-egui/src/i18n/te.tsv b/crates/ui-egui/src/i18n/te.tsv
index 0bb56f4793..9b81ffb8b9 100644
--- a/crates/ui-egui/src/i18n/te.tsv
+++ b/crates/ui-egui/src/i18n/te.tsv
@@ -12,6 +12,10 @@
 # Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) are not translated;
 # the trailing "…" of dialog commands is kept.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	మెనూ
 	File	ఫైల్
 	Edit	సవరణ
@@ -2424,6 +2428,26 @@ animation effects	Off	ఆఫ్
 	Make properties default	లక్షణాలను డిఫాల్ట్‌గా చేయి
 	Pages selected	ఎంచుకున్న పేజీలు
 	Page properties	పేజీ లక్షణాలు
+	Clear search	శోధనను తీసివేయి
+	Pin	పిన్ చేయి
+	Pin a tool…	ఒక సాధనాన్ని పిన్ చేయి…
+	Pin to Home	హోమ్‌కు పిన్ చేయి
+	Pin tools to Home	సాధనాలను హోమ్‌కు పిన్ చేయి
+	Pin your favorite tools here for quick access.	త్వరిత ప్రాప్యత కోసం మీకు ఇష్టమైన సాధనాలను ఇక్కడ పిన్ చేయండి.
+	Pinned	పిన్ చేయబడింది
+	Pinned Tools	పిన్ చేసిన సాధనాలు
+	Search tools…	సాధనాలను శోధించండి…
+	Select tools to display on your Home page for quick access.	త్వరిత ప్రాప్యత కోసం మీ హోమ్ పేజీలో ప్రదర్శించడానికి సాధనాలను ఎంచుకోండి.
+	Unpin from Home	హోమ్ నుండి అన్‌పిన్ చేయి
+	Unpin tool	సాధనాన్ని అన్‌పిన్ చేయి
+	Transform image	చిత్రాన్ని రూపాంతరం చేయండి
+	Select Tool	ఎంపిక సాధనం
+	Hand Tool	హ్యాండ్ సాధనం
+	Marquee Zoom	ఎంచుకున్న ప్రాంతానికి జూమ్
+	Paste	అతికించు
+	Edit this PDF	ఈ PDFను సవరించు
+	Export this PDF	ఈ PDFను ఎగుమти చేయి
+	Find text or tools	వచనం లేదా సాధనాలను కనుగొనండి
 	Create & Edit	సృష్టించు & సవరించు
 	Review & Compare	సమీక్షించు & పోల్చు
 	Forms & Signatures	ఫారమ్‌లు & సంతకాలు
@@ -2471,6 +2495,13 @@ animation effects	Off	ఆఫ్
 	field names can't contain a period: {name}	ఫీల్డ్ పేర్లలో చుక్క ఉండకూడదు: {name}
 	two cells would both be named {name}	రెండు గడులకూ {name} అనే పేరు వస్తుంది
 	a field named {name} already exists	{name} అనే ఫీల్డ్ ఇప్పటికే ఉంది
+	Arrange image	చిత్రాన్ని అమర్చు
+	Bring forward	ముందుకు తీసుకురా
+	Bring to front	అందరికంటే ముందుకు తీసుకురా
+	Crop	కత్తిరించు
+	Remove crop	కత్తిరింపును తీసివేయి
+	Send backward	వెనుకకు పంపు
+	Send to back	అందరికంటే వెనుకకు పంపు
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	ఈరోజు
@@ -2487,3 +2518,11 @@ animation effects	Off	ఆఫ్
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	ఈ ప్రత్యుత్తరం ఎంపికలు
 	Export value	ఎగుమతి విలువ
+	Show Page Edge Shadows	పేజీ అంచుల నీడలను చూపించు
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	శోధించండి…
+	Image pasted	చిత్రం అతికించబడింది
+	No image on clipboard to paste	అతికించడానికి క్లిప్‌బోర్డ్‌లో చిత్రం లేదు
+	Pinned {tool} to Home	{tool} హోమ్‌కు పిన్ చేయబడింది
+	Unpinned {tool} from Home	{tool} హోమ్ నుండి అన్‌పిన్ చేయబడింది
diff --git a/crates/ui-egui/src/i18n/tests.rs b/crates/ui-egui/src/i18n/tests.rs
index 41a4578cf0..22110de938 100644
--- a/crates/ui-egui/src/i18n/tests.rs
+++ b/crates/ui-egui/src/i18n/tests.rs
@@ -1217,3 +1217,12 @@ fn date_languages_are_the_interface_languages() {
     let dates: Vec<(&str, &str)> = pdfcraft_engine::dates::DATE_LANGUAGES.iter().map(|l| (l.code, l.name)).collect();
     assert_eq!(dates, interface);
 }
+
+#[test]
+fn image_paste_and_home_notifications_are_translated() {
+    for language in Lang::all().filter(|l| *l != Lang::EN) {
+        for source in ["Search…", "Image pasted", "No image on clipboard to paste", "Pinned {tool} to Home", "Unpinned {tool} from Home"] {
+            assert!(language.catalog().plain(source).is_some(), "{}: {source}", language.code());
+        }
+    }
+}
diff --git a/crates/ui-egui/src/i18n/th.tsv b/crates/ui-egui/src/i18n/th.tsv
index 0c2b58a812..f7f8a65c5c 100644
--- a/crates/ui-egui/src/i18n/th.tsv
+++ b/crates/ui-egui/src/i18n/th.tsv
@@ -7,6 +7,10 @@
 # names stay in Latin letters; the trailing ellipsis of dialog commands is kept. Thai has one
 # plural form.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	เมนู
 	File	ไฟล์
 	Edit	แก้ไข
@@ -2711,6 +2715,13 @@ key	Space	Space
 	Collapse all tools	ยุบเครื่องมือทั้งหมด
 	The password must have at least 8 characters.	รหัสผ่านต้องมีอย่างน้อย 8 ตัวอักษร
 theme	Appearance	ลักษณะที่ปรากฏ
+	Arrange image	จัดเรียงรูปภาพ
+	Bring forward	นำไปข้างหน้า
+	Bring to front	นำไปไว้ข้างหน้าสุด
+	Crop	ครอบตัด
+	Remove crop	เอาการครอบตัดออก
+	Send backward	ส่งไปข้างหลัง
+	Send to back	ส่งไปไว้ข้างหลังสุด
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	วันนี้
@@ -2736,3 +2747,32 @@ theme	Appearance	ลักษณะที่ปรากฏ
 	Unchecked reads	Unchecked reads
 	{field} reads fields named as it runs	{field} reads fields named as it runs
 	Some names are built as it runs	Some names are built as it runs
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	ค้นหา…
+	Image pasted	วางรูปภาพแล้ว
+	No image on clipboard to paste	ไม่มีรูปภาพในคลิปบอร์ดให้วาง
+	Pinned {tool} to Home	ปักหมุด {tool} ไว้ที่หน้าแรกแล้ว
+	Unpinned {tool} from Home	เลิกปักหมุด {tool} จากหน้าแรกแล้ว
+
+# Home tools (AI-assisted; not separately native-reviewed)
+	Clear search	ล้างการค้นหา
+	Pin	ปักหมุด
+	Pin a tool…	ปักหมุดเครื่องมือ…
+	Pin to Home	ปักหมุดไว้ที่หน้าแรก
+	Pin tools to Home	ปักหมุดเครื่องมือไว้ที่หน้าแรก
+	Pin your favorite tools here for quick access.	ปักหมุดเครื่องมือโปรดที่นี่เพื่อเข้าถึงอย่างรวดเร็ว
+	Pinned	ปักหมุดแล้ว
+	Pinned Tools	เครื่องมือที่ปักหมุด
+	Search tools…	ค้นหาเครื่องมือ…
+	Select tools to display on your Home page for quick access.	เลือกเครื่องมือที่จะแสดงบนหน้าแรกเพื่อเข้าถึงอย่างรวดเร็ว
+	Unpin from Home	เลิกปักหมุดจากหน้าแรก
+	Unpin tool	เลิกปักหมุดเครื่องมือ
+	Transform image	แปลงรูปภาพ
+	Select Tool	เครื่องมือเลือก
+	Hand Tool	เครื่องมือมือ
+	Marquee Zoom	ซูมพื้นที่ที่เลือก
+	Edit this PDF	แก้ไข PDF นี้
+	Export this PDF	ส่งออก PDF นี้
+	Find text or tools	ค้นหาข้อความหรือเครื่องมือ
+	Crop image	ครอบตัดรูปภาพ
diff --git a/crates/ui-egui/src/i18n/tr.tsv b/crates/ui-egui/src/i18n/tr.tsv
index b52688606b..8a0d7bf74b 100644
--- a/crates/ui-egui/src/i18n/tr.tsv
+++ b/crates/ui-egui/src/i18n/tr.tsv
@@ -2511,6 +2511,26 @@ animation effects	Off	Kapalı
 	Make properties default	Özellikleri varsayılan yap
 	Pages selected	Seçilen sayfalar
 	Page properties	Sayfa özellikleri
+	Clear search	Aramayı temizle
+	Pin	Sabitle
+	Pin a tool…	Bir aracı sabitle…
+	Pin to Home	Giriş'e sabitle
+	Pin tools to Home	Araçları Giriş'e sabitle
+	Pin your favorite tools here for quick access.	Hızlı erişim için favori araçlarınızı buraya sabitleyin.
+	Pinned	Sabitlendi
+	Pinned Tools	Sabitlenen Araçlar
+	Search tools…	Araçları ara…
+	Select tools to display on your Home page for quick access.	Hızlı erişim için Giriş sayfanızda görüntülenecek araçları seçin.
+	Unpin from Home	Giriş'ten sabitlemeyi kaldır
+	Unpin tool	Aracın sabitlemesini kaldır
+	Transform image	Görüntüyü dönüştür
+	Select Tool	Seçim Aracı
+	Hand Tool	El Aracı
+	Marquee Zoom	Seçim yakınlaştırma
+	Paste	Yapıştır
+	Edit this PDF	Bu PDF'i düzenle
+	Export this PDF	Bu PDF'i dışa aktar
+	Find text or tools	Metin veya araç bul
 	Create & Edit	Oluştur ve Düzenle
 	Review & Compare	İncele ve Karşılaştır
 	Forms & Signatures	Formlar ve İmzalar
@@ -2558,6 +2578,13 @@ animation effects	Off	Kapalı
 	field names can't contain a period: {name}	alan adları nokta içeremez: {name}
 	two cells would both be named {name}	iki hücrenin de adı {name} olurdu
 	a field named {name} already exists	{name} adlı bir alan zaten var
+	Arrange image	Resmi düzenle
+	Bring forward	Öne getir
+	Bring to front	En öne getir
+	Crop	Kırp
+	Remove crop	Kırpmayı kaldır
+	Send backward	Arkaya gönder
+	Send to back	En arkaya gönder
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Bugün
@@ -2574,3 +2601,303 @@ animation effects	Off	Kapalı
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Bu yanıtın seçenekleri
 	Export value	Dışa aktarma değeri
+	Show Page Edge Shadows	Sayfa kenarı gölgelerini göster
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Ara…
+	Image pasted	Görüntü yapıştırıldı
+	No image on clipboard to paste	Panoda yapıştırılacak görüntü yok
+	Pinned {tool} to Home	{tool} Ana Sayfaya sabitlendi
+	Unpinned {tool} from Home	{tool} Ana Sayfadan kaldırıldı
+
+# Strings the translation gaps report listed on 2026-11-03 (AI-assisted; a native Turkish speaker reviewed the judgement calls: "of", hotbar, navigation rail, certificate terms, weekday heads).
+	Lowering this forgets the oldest files. At 0 there is no list.	Bu değeri düşürmek en eski dosyaları unutturur. 0'da liste olmaz.
+	Recent files to keep	Saklanacak son dosya sayısı
+	 on page {label}	 {label}. sayfada
+	1 line	1 satır
+	A font isn't embedded	Bir yazı tipi gömülü değil
+	A {} action isn't allowed	{} eylemine izin verilmiyor
+	A {} annotation has additional actions	Bir {} açıklamasının ek eylemleri var
+	A {} annotation has no appearance stream	Bir {} açıklamasının görünüm akışı yok
+	A {} annotation isn't set to print, or is hidden	Bir {} açıklaması yazdırılacak şekilde ayarlanmamış ya da gizli
+	Accessibility Report	Erişilebilirlik Raporu
+	Add tools to hotbar	Kısayol çubuğuna araç ekle
+	Always	Her zaman
+	Automatically	Otomatik
+	CRL Signing	CRL İmzalama
+	Certificate Signing	Sertifika İmzalama
+	Certificate authority	Sertifika yetkilisi
+	Change Author	Yazarı Değiştir
+	Change Keywords	Anahtar Kelimeleri Değiştir
+	Change Subject	Konuyu Değiştir
+	Change Title	Başlığı Değiştir
+	Choose a digital ID.	Bir dijital kimlik seçin.
+	Choose a file…	Dosya seç…
+	Choose a folder…	Klasör seç…
+	Choose…	Seç…
+	Close menu	Menüyü kapat
+	Color	Renk
+	Comment	Yorum
+	Comment and review	Yorumla ve incele
+	Copied to clipboard	Panoya kopyalandı
+	Copy to clipboard	Panoya kopyala
+	Create folder	Klasör oluştur
+	Create links	Bağlantı oluştur
+	Creator	Oluşturan
+	Crop image	Resmi kırp
+	Custom scale	Özel ölçek
+	Cut and stack needs Two-sided: Off. Print single-sided sheets.	Kes ve istifle için Çift taraflı: Kapalı olmalı. Tek taraflı sayfalar yazdırın.
+	Data Encipherment	Veri Şifreleme
+	Decipher Only	Yalnızca Şifre Çözme
+	Detailed Report	Ayrıntılı Rapor
+	DeviceCMYK is used, but the PDF/A output intent isn't a CMYK profile	DeviceCMYK kullanılıyor ancak PDF/A çıktı amacı bir CMYK profili değil
+	DeviceRGB is used, but the PDF/A output intent isn't an RGB profile	DeviceRGB kullanılıyor ancak PDF/A çıktı amacı bir RGB profili değil
+	Digital Signature	Dijital İmza
+	Disabled	Devre dışı
+	Dock navigation rail on Left	Gezinme çubuğunu sola yerleştir
+	Dock navigation rail on Right	Gezinme çubuğunu sağa yerleştir
+	Document properties (⌘D)	Belge özellikleri (⌘D)
+	Drag hotbar	Kısayol çubuğunu sürükle
+	Duplicate	Çoğalt
+	Enabled	Etkin
+	Encipher Only	Yalnızca Şifreleme
+	End entity	Son varlık
+	English	İngilizce
+	Enter a URL	Bir URL girin
+	Enter a name.	Bir ad girin.
+	Enter a page number	Bir sayfa numarası girin
+	Enter the field names	Alan adlarını girin
+	Error	Hata
+	Every line set in the style chosen for a level becomes a bookmark of that level, under a new first bookmark.	Bir düzey için seçilen stille yazılmış her satır, yeni bir ilk yer işaretinin altında o düzeyin yer işareti olur.
+	Extend the docked toolbar along the entire side. Choose a side above to enable.	Yerleştirilmiş araç çubuğunu kenar boyunca uzat. Etkinleştirmek için yukarıdan bir kenar seçin.
+	Field "{}" on page {p} has no description (tooltip)	{p}. sayfadaki "{}" alanının açıklaması (araç ipucu) yok
+	Filename	Dosya adı
+	Flatten Fill & Sign	Doldur ve İmzala'yı düzleştir
+	Float (drag anywhere)	Serbest (istediğin yere sürükle)
+	Folder	Klasör
+	Font (unnamed) on page {p} doesn't map its characters to Unicode	{p}. sayfadaki (adsız) yazı tipi karakterlerini Unicode'a eşlemiyor
+	Font {} on page {p} doesn't map its characters to Unicode	{p}. sayfadaki {} yazı tipi karakterlerini Unicode'a eşlemiyor
+	Form field on page {p} isn't tagged	{p}. sayfadaki form alanı etiketli değil
+	Freehand-Highlight	Serbest Vurgulama
+	Full-side strip	Tam kenar şeridi
+	General & Interface	Genel ve Arayüz
+	Hand	El
+	Help…	Yardım…
+	Hotbar settings	Kısayol çubuğu ayarları
+	Hotbar settings / add tools	Kısayol çubuğu ayarları / araç ekle
+	Hotbar tools	Kısayol çubuğu araçları
+	H{n} follows an H{d}; headings should not skip levels	H{n}, bir H{d} ardından geliyor; başlıklar düzey atlamamalı
+	Import	İçe aktar
+	Information	Bilgi
+	Key Agreement	Anahtar Anlaşması
+	Key Encipherment	Anahtar Şifreleme
+	Level {n}	Düzey {n}
+	Loading…	Yükleniyor…
+	Mouse wheel scroll speed	Fare tekerleği kaydırma hızı
+	Move	Taşı
+	Navigation rail side	Gezinme çubuğunun kenarı
+	Never	Hiçbir zaman
+	New bookmark (⌘B)	Yeni yer işareti (⌘B)
+	New bookmarks from text styles	Metin stillerinden yeni yer işaretleri
+	New bookmarks from text styles…	Metin stillerinden yeni yer işaretleri…
+	Next	Sonraki
+	Next (⌘G)	Sonraki (⌘G)
+	No document language is set	Belge dili ayarlanmamış
+	No page has text: the document appears to be images of pages	Hiçbir sayfada metin yok: belge sayfa resimlerinden oluşuyor gibi görünüyor
+	No results	Sonuç yok
+	Non-Repudiation	İnkâr Edilemezlik
+	On	Açık
+	Open a PDF (⌘O)	PDF aç (⌘O)
+	Open folder	Klasörü aç
+	Organize	Düzenle
+	Page Properties	Sayfa Özellikleri
+	Page properties…	Sayfa özellikleri…
+	Page {n}	Sayfa {n}
+	Page {n} of {total}	Sayfa {n} / {total}
+	Page {p} doesn't tab in structure order	{p}. sayfanın sekme sırası yapı sırasını izlemiyor
+	Page {p}: {n} untagged content item	Sayfa {p}: {n} etiketsiz içerik öğesi
+	Page {p}: {n} untagged content items	Sayfa {p}: {n} etiketsiz içerik öğesi
+	Page {} has additional actions	{}. sayfanın ek eylemleri var
+	Panel layout could not be restored: {error}	Panel düzeni geri yüklenemedi: {error}
+	Panel move was not applied: {error}	Panel taşıma uygulanmadı: {error}
+	PdfCraft can't check this signature yet: {}.	PdfCraft bu imzayı henüz denetleyemiyor: {}.
+	Previous	Önceki
+	Previous (⇧⌘G)	Önceki (⇧⌘G)
+	Print (⌘P)	Yazdır (⌘P)
+	Producer	Üretici
+	Refresh	Yenile
+	Remove from hotbar	Kısayol çubuğundan kaldır
+	Remove {standard} identification	{standard} tanımlamasını kaldır
+	Rendering…	İşleniyor…
+	Report created	Rapor oluşturuldu
+	Reset side panels	Yan panelleri sıfırla
+	Rev. {rev}: Certified by an unknown signer	Rev. {rev}: Bilinmeyen bir imzalayan tarafından onaylandı
+	Rev. {rev}: Certified by {name}	Rev. {rev}: {name} tarafından onaylandı
+	Rev. {rev}: Signed by an unknown signer	Rev. {rev}: Bilinmeyen bir imzalayan tarafından imzalandı
+	Rev. {rev}: Signed by {name}	Rev. {rev}: {name} tarafından imzalandı
+	Rotate view clockwise (⇧⌘+)	Görünümü saat yönünde döndür (⇧⌘+)
+	Rule Name	Kural Adı
+	Save as {level}	{level} olarak kaydet
+	Save changes?	Değişiklikler kaydedilsin mi?
+	Save file	Dosyayı kaydet
+	Search all tools…	Tüm araçlarda ara…
+	Search results	Arama sonuçları
+	Search settings…	Ayarlarda ara…
+	Select	Seç
+	Select all	Tümünü seç
+	Show or hide the Tools panel	Araçlar panelini göster veya gizle
+	Show or hide the side panel	Yan paneli göster veya gizle
+	Signature is invalid	İmza geçersiz
+	Signature is valid	İmza geçerli
+	Signature validity is unknown	İmzanın geçerliliği bilinmiyor
+	Signing time is from the clock on the signer's computer.	İmzalama zamanı, imzalayanın bilgisayarındaki saatten alınmıştır.
+	Stick to a side:	Bir kenara yapıştır:
+	Still rendering — this page is unusually complex…	Hâlâ işleniyor — bu sayfa alışılmadık derecede karmaşık…
+	Success	Başarılı
+	System	Sistem
+	Tab Order	Sekme Sırası
+	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PDFCRAFT_MODELS).	Metin tanıma kurulu değil: modelleri eksik (`cargo xtask models` çalıştırın ya da PDFCRAFT_MODELS ayarlayın).
+	The ECDSA signature is not in canonical DER (trailing bytes, padding or a missing sign byte); it was read anyway.	ECDSA imzası kurallı DER biçiminde değil (sondaki baytlar, dolgu ya da eksik işaret baytı); yine de okundu.
+	The ECDSA signature is the raw r and s values instead of a DER sequence; it was read anyway.	ECDSA imzası bir DER dizisi yerine ham r ve s değerlerinden oluşuyor; yine de okundu.
+	The RSA signature value does not have the length of the key's modulus (leading zero bytes dropped or added); it was read anyway.	RSA imza değeri, anahtarın modülüyle aynı uzunlukta değil (baştaki sıfır baytlar atılmış ya da eklenmiş); yine de okundu.
+	The RSA signature's DigestInfo has no NULL parameter (older signers write it so); it was read anyway.	RSA imzasının DigestInfo alanında NULL parametresi yok (eski imzalayıcılar böyle yazar); yine de okundu.
+	The certificate of {} does not allow this many CA certificates below it (path length), so it is not used to vouch for {}.	{} sertifikası altında bu kadar çok CA sertifikasına izin vermiyor (yol uzunluğu), bu yüzden {} için güvence olarak kullanılmıyor.
+	The certificate of {} has critical extensions PdfCraft does not recognize, so it is not used to vouch for {}.	{} sertifikasında PdfCraft'ın tanımadığı kritik uzantılar var, bu yüzden {} için güvence olarak kullanılmıyor.
+	The certificate of {} is not a CA certificate that may issue certificates, so it is not used to vouch for {}.	{} sertifikası, sertifika verebilen bir CA sertifikası değil, bu yüzden {} için güvence olarak kullanılmıyor.
+	The certificate of {} was not valid at the time of signing, so it is not used to vouch for {}.	{} sertifikası imzalama sırasında geçerli değildi, bu yüzden {} için güvence olarak kullanılmıyor.
+	The checker found problems which may prevent the document from being fully accessible.	Denetleyici, belgenin tam olarak erişilebilir olmasını engelleyebilecek sorunlar buldu.
+	The document has been altered or corrupted since the signature was applied.	Belge, imza uygulandıktan sonra değiştirilmiş ya da bozulmuş.
+	The document has been altered or corrupted since the timestamp was applied.	Belge, zaman damgası uygulandıktan sonra değiştirilmiş ya da bozulmuş.
+	The document has been altered since this signature was applied in ways it does not permit ({}).	Belge, bu imza uygulandıktan sonra imzanın izin vermediği biçimlerde değiştirilmiş ({}).
+	The document has been altered since this timestamp was applied in ways it does not permit ({}).	Belge, bu zaman damgası uygulandıktan sonra damganın izin vermediği biçimlerde değiştirilmiş ({}).
+	The document has been modified since this signature was applied, but the changes are permitted ({}).	Belge, bu imza uygulandıktan sonra değiştirilmiş ancak değişikliklere izin veriliyor ({}).
+	The document has been modified since this timestamp was applied, but the changes are permitted ({}).	Belge, bu zaman damgası uygulandıktan sonra değiştirilmiş ancak değişikliklere izin veriliyor ({}).
+	The document has no tags (structure tree)	Belgede etiket (yapı ağacı) yok
+	The document has no title	Belgenin başlığı yok
+	The document isn't marked as tagged (MarkInfo Marked)	Belge etiketli olarak işaretlenmemiş (MarkInfo Marked)
+	The document isn't tagged, so none of its content is	Belge etiketli değil, dolayısıyla içeriğinin hiçbir kısmı etiketli değil
+	The document's embedded revocation information shows that the signer's certificate has not been revoked.	Belgeye gömülü iptal bilgileri, imzalayanın sertifikasının iptal edilmediğini gösteriyor.
+	The embedded timestamp token is valid and its authority is trusted; trusted time is {}.	Gömülü zaman damgası belirteci geçerli ve yetkilisine güveniliyor; güvenilir zaman {}.
+	The font {} isn't embedded	{} yazı tipi gömülü değil
+	The metadata doesn't identify the file as {}	Meta veriler dosyayı {} olarak tanımlamıyor
+	The password is incorrect.	Parola yanlış.
+	The password must have at least 6 characters.	Parola en az 6 karakter olmalıdır.
+	The password must have at least 8 characters.	Parola en az 8 karakter olmalıdır.
+	The passwords do not match.	Parolalar eşleşmiyor.
+	The security settings don't allow screen readers to read the text	Güvenlik ayarları ekran okuyucuların metni okumasına izin vermiyor
+	The signature algorithm and the SignerInfo's digest algorithm name different hashes; the signature was made with the SignerInfo's.	İmza algoritması ile SignerInfo'nun özet algoritması farklı karma işlevleri belirtiyor; imza SignerInfo'dakiyle oluşturulmuş.
+	The signature carries an unverified timestamp ({}): the timestamp authority is not in your list of trusted certificates, so the signing time claimed by the signer is used instead.	İmza doğrulanmamış bir zaman damgası taşıyor ({}): zaman damgası yetkilisi güvenilen sertifikalar listenizde değil, bu yüzden onun yerine imzalayanın bildirdiği imzalama zamanı kullanılıyor.
+	The signature contents are not hexadecimal.	İmza içeriği onaltılık değil.
+	The signature could not be checked ({}).	İmza denetlenemedi ({}).
+	The signature could not be read ({}).	İmza okunamadı ({}).
+	The signature could not be verified ({}).	İmza doğrulanamadı ({}).
+	The signature has no valid byte range.	İmzanın geçerli bir bayt aralığı yok.
+	The signature includes an embedded timestamp.	İmza gömülü bir zaman damgası içeriyor.
+	The signature is BER-encoded (indefinite lengths) rather than DER; it was read leniently.	İmza DER yerine BER ile kodlanmış (belirsiz uzunluklar); esnek biçimde okundu.
+	The signature uses the legacy adbe.x509.rsa_sha1 format.	İmza eski adbe.x509.rsa_sha1 biçimini kullanıyor.
+	The signature value does not match the signer's certificate: the signature is corrupt.	İmza değeri imzalayanın sertifikasıyla eşleşmiyor: imza bozuk.
+	The signature's byte range does not exclude exactly its contents.	İmzanın bayt aralığı tam olarak kendi içeriğini dışarıda bırakmıyor.
+	The signature's byte range does not match the file.	İmzanın bayt aralığı dosyayla eşleşmiyor.
+	The signature's signed attributes have no content type, which CMS requires; it was read anyway.	İmzanın imzalı özniteliklerinde CMS'in gerektirdiği içerik türü yok; yine de okundu.
+	The signature's signed attributes have no message digest, so the signature does not cover the document.	İmzanın imzalı özniteliklerinde ileti özeti yok, bu yüzden imza belgeyi kapsamıyor.
+	The signature's signed attributes name a content type other than data, so it is not a signature of the document.	İmzanın imzalı öznitelikleri data dışında bir içerik türü belirtiyor, bu yüzden bu bir belge imzası değil.
+	The signature's timestamp token could not be verified ({}).	İmzanın zaman damgası belirteci doğrulanamadı ({}).
+	The signature's timestamp token does not cover the signature value.	İmzanın zaman damgası belirteci imza değerini kapsamıyor.
+	The signed content is a constructed (segmented) OCTET STRING, as BER allows; it was read anyway.	İmzalanan içerik, BER'in izin verdiği gibi oluşturulmuş (parçalı) bir OCTET STRING; yine de okundu.
+	The signer's certificate does not allow digital signatures (its key usage has neither digital signature nor non-repudiation).	İmzalayanın sertifikası dijital imzaya izin vermiyor (anahtar kullanımında ne dijital imza ne de inkâr edilemezlik var).
+	The signer's certificate has been revoked ({}).	İmzalayanın sertifikası iptal edilmiş ({}).
+	The signer's certificate has critical extensions PdfCraft does not recognize ({}).	İmzalayanın sertifikasında PdfCraft'ın tanımadığı kritik uzantılar var ({}).
+	The signer's certificate is not in the signature.	İmzalayanın sertifikası imzada yok.
+	The signer's certificate is not issued for signing documents (its extended key usage has no document-signing purpose).	İmzalayanın sertifikası belge imzalamak için verilmemiş (genişletilmiş anahtar kullanımında belge imzalama amacı yok).
+	The signer's certificate was not valid at the time of signing.	İmzalayanın sertifikası imzalama sırasında geçerli değildi.
+	The signer's identity is unknown because it has not been included in your list of trusted certificates and none of its parent certificates are trusted certificates.	İmzalayanın kimliği bilinmiyor; çünkü güvenilen sertifikalar listenize eklenmemiş ve üst sertifikalarının hiçbiri güvenilen sertifika değil.
+	The signer's identity is valid.	İmzalayanın kimliği geçerli.
+	The standard fonts can't draw “{c}” ({code}). Only Western European characters can be added as text for now.	Standart yazı tipleri “{c}” ({code}) karakterini çizemiyor. Şimdilik metin olarak yalnızca Batı Avrupa karakterleri eklenebilir.
+	The timestamp authority's certificate is not issued for time stamping.	Zaman damgası yetkilisinin sertifikası zaman damgalama için verilmemiş.
+	The timestamp authority's certificate was not valid at the time of timestamping.	Zaman damgası yetkilisinin sertifikası zaman damgalama sırasında geçerli değildi.
+	The timestamp contents are not hexadecimal.	Zaman damgası içeriği onaltılık değil.
+	The timestamp has no valid byte range.	Zaman damgasının geçerli bir bayt aralığı yok.
+	The timestamp token could not be read ({}).	Zaman damgası belirteci okunamadı ({}).
+	The timestamp token is valid and its authority is trusted.	Zaman damgası belirteci geçerli ve yetkilisine güveniliyor.
+	The timestamp token is valid, but the timestamp authority is not in your list of trusted certificates.	Zaman damgası belirteci geçerli ancak zaman damgası yetkilisi güvenilen sertifikalar listenizde değil.
+	The timestamp's byte range does not exclude exactly its contents.	Zaman damgasının bayt aralığı tam olarak kendi içeriğini dışarıda bırakmıyor.
+	The timestamp's byte range does not match the file.	Zaman damgasının bayt aralığı dosyayla eşleşmiyor.
+	The window shows the file name, not the title (Initial View > Show)	Pencere başlığı değil dosya adını gösteriyor (İlk Görünüm > Göster)
+	Theme	Tema
+	There is no folder to save the digital ID in.	Dijital kimliğin kaydedileceği bir klasör yok.
+	This document has no text to make bookmarks from.	Bu belgede yer işareti oluşturulacak metin yok.
+	This document has not been modified since this signature was applied.	Bu belge, bu imza uygulandığından beri değiştirilmemiş.
+	This document has not been modified since this timestamp was applied.	Bu belge, bu zaman damgası uygulandığından beri değiştirilmemiş.
+	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	Bu dosya diskte değişti. Yeni sürümü görmek için yeniden yükleyin; kaydedilmemiş değişiklikleriniz kaybolacak.
+	This signature uses RIPEMD-160, a legacy 160-bit hash algorithm that is no longer recommended for signatures. It still validates, but it should not be relied on.	Bu imza, artık imzalar için önerilmeyen eski bir 160 bitlik karma algoritması olan RIPEMD-160'ı kullanıyor. Hâlâ doğrulanıyor ancak güvenilmemelidir.
+	This signature uses SHA-1, a weak hash algorithm: collisions in it have been demonstrated. It still validates because many documents signed years ago use it, but it should not be relied on.	Bu imza, zayıf bir karma algoritması olan SHA-1'i kullanıyor: bu algoritmada çakışmalar gösterilmiştir. Yıllar önce imzalanmış birçok belge onu kullandığı için hâlâ doğrulanıyor ancak güvenilmemelidir.
+	This signature uses an RSA key shorter than 2048 bits, which is no longer considered strong enough for signatures. It still validates, but it should not be relied on.	Bu imza, artık imzalar için yeterince güçlü sayılmayan, 2048 bitten kısa bir RSA anahtarı kullanıyor. Hâlâ doğrulanıyor ancak güvenilmemelidir.
+	Toolbar size	Araç çubuğu boyutu
+	Unsigned signature field	İmzalanmamış imza alanı
+	Unsigned signature field: {name}	İmzalanmamış imza alanı: {name}
+	Unspecified	Belirtilmemiş
+	Use Column Order	Sütun Sırasını Kullan
+	Use Document Structure	Belge Yapısını Kullan
+	Use Row Order	Satır Sırasını Kullan
+	Vertical layout	Dikey düzen
+	Warning	Uyarı
+	Window	Pencere
+	Zoom in (⌘+)	Yakınlaştır (⌘+)
+	Zoom in / out (also pinch or ⌘-scroll)	Yakınlaştır / uzaklaştır (iki parmakla sıkıştırma ya da ⌘-kaydırma ile de)
+	Zoom out (⌘−)	Uzaklaştır (⌘−)
+	a table has 1 to {max} columns	bir tabloda 1 ile {max} arası sütun olur
+	a table has 1 to {max} rows	bir tabloda 1 ile {max} arası satır olur
+	alternate text hides an annotation inside it	alternatif metin içindeki bir açıklamayı gizliyor
+	alternate text on an element with no page content	sayfa içeriği olmayan bir öğede alternatif metin
+	bold	kalın
+	comments	yorumlar
+	document security store	belge güvenlik deposu
+	document structure	belge yapısı
+	form fill	form doldurma
+	italic	italik
+	its alternate text is inside another element's and will never be read	alternatif metni başka bir öğeninkinin içinde ve hiçbir zaman okunmayacak
+	links	bağlantılar
+	metadata	meta veriler
+	no alternate text	alternatif metin yok
+	no header cells (TH)	başlık hücresi (TH) yok
+	no summary	özet yok
+	not in a TR	bir TR içinde değil
+	not in a Table, THead, TBody or TFoot	bir Table, THead, TBody ya da TFoot içinde değil
+	not in an L (list)	bir L (liste) içinde değil
+	not in an LI (list item)	bir LI (liste öğesi) içinde değil
+	of	/
+	other changes	diğer değişiklikler
+	page content	sayfa içeriği
+	page {n} is out of range (1–{count})	{n}. sayfa aralığın dışında (1–{count})
+	pages added or removed	eklenen ya da kaldırılan sayfalar
+	rows have between {min} and {max} columns	satırlarda {min} ile {max} arası sütun var
+	the area, the spacing and the column widths must be numbers, the spacing 0 or more and each width more than 0	alan, aralık ve sütun genişlikleri sayı olmalı; aralık 0 veya daha büyük, her genişlik 0'dan büyük olmalı
+	the first heading is an H{n}; headings should not skip levels	ilk başlık bir H{n}; başlıklar düzey atlamamalı
+	the first row number can be at most {max}	ilk satır numarası en fazla {max} olabilir
+	the signed version could not be read	imzalı sürüm okunamadı
+	{font}, {size} pt	{font}, {size} pt
+	{n} lines	{n} satır
+	{n} pages and no bookmarks	{n} sayfa ve hiç yer işareti yok
+	{page} is not a page number or label	{page} bir sayfa numarası ya da etiketi değil
+	{ty} element on page {p}: {what}	{p}. sayfadaki {ty} öğesi: {what}
+	{ty} element: {what}	{ty} öğesi: {what}
+	{who}, certificate issued by an unknown issuer.	{who}, sertifikayı bilinmeyen bir yayımcı vermiş.
+	{who}, certificate issued by {issuer}.	{who}, sertifikayı {issuer} vermiş.
+	{} annotation on page {p} isn't tagged	{p}. sayfadaki {} açıklaması etiketli değil
+	{} annotations aren't allowed	{} açıklamalarına izin verilmiyor
+	… and {n} more	… ve {n} tane daha
+@plural	Delete {n} field|Delete {n} fields	{n} alanı sil
+@plural	{n} byte|{n} bytes	{n} bayt
+@plural	{n} comment|{n} comments	{n} yorum
+@plural	{n} file|{n} files	{n} dosya
+@plural	{n} image optimized|{n} images optimized	{n} resim iyileştirildi
+@plural	{n} item discarded|{n} items discarded	{n} öğe atıldı
+@plural	{n} pixel|{n} pixels	{n} piksel
+@plural	{n} result|{n} results	{n} sonuç
+calendar weekday	Fr	Cu
+calendar weekday	Mo	Pt
+calendar weekday	Sa	Ct
+calendar weekday	Su	Pz
+calendar weekday	Th	Pe
+calendar weekday	Tu	Sa
+calendar weekday	We	Ça
diff --git a/crates/ui-egui/src/i18n/uk.tsv b/crates/ui-egui/src/i18n/uk.tsv
index dc65faf7a2..a824769600 100644
--- a/crates/ui-egui/src/i18n/uk.tsv
+++ b/crates/ui-egui/src/i18n/uk.tsv
@@ -18,6 +18,10 @@
 # Integer plurals (CLDR uk): one (1, 21) | few (2–4, 22–24) | many (0, 5–19); 11–14 take many.
 # Commands use infinitives. Fixed-count templates use count-neutral wording.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	Меню
 	File	Файл
 	Edit	Редагування
@@ -2537,6 +2541,26 @@ animation effects	Off	Вимкнено
 	Make properties default	Зробити властивості типовими
 	Pages selected	Вибрані сторінки
 	Page properties	Властивості сторінки
+	Clear search	Очистити пошук
+	Pin	Закріпити
+	Pin a tool…	Закріпити інструмент…
+	Pin to Home	Закріпити на Головній
+	Pin tools to Home	Закріпити інструменти на Головній
+	Pin your favorite tools here for quick access.	Закріпіть улюблені інструменти тут для швидкого доступу.
+	Pinned	Закріплено
+	Pinned Tools	Закріплені інструменти
+	Search tools…	Шукати інструменти…
+	Select tools to display on your Home page for quick access.	Виберіть інструменти для відображення на Головній для швидкого доступу.
+	Unpin from Home	Відкріпити від Головної
+	Unpin tool	Відкріпити інструмент
+	Transform image	Трансформувати зображення
+	Select Tool	Інструмент виділення
+	Hand Tool	Інструмент «Рука»
+	Marquee Zoom	Масштабувати виділену область
+	Paste	Вставити
+	Edit this PDF	Редактировать цей PDF
+	Export this PDF	Експортувати цей PDF
+	Find text or tools	Знайти текст або інструменти
 	Create & Edit	Створення й редагування
 	Review & Compare	Рецензування й порівняння
 	Forms & Signatures	Форми й підписи
@@ -2584,6 +2608,13 @@ animation effects	Off	Вимкнено
 	field names can't contain a period: {name}	імена полів не можуть містити крапку: {name}
 	two cells would both be named {name}	дві клітинки мали б однакове ім'я {name}
 	a field named {name} already exists	поле з іменем {name} уже існує
+	Arrange image	Упорядкувати зображення
+	Bring forward	Перемістити вперед
+	Bring to front	На передній план
+	Crop	Обрізати
+	Remove crop	Прибрати обрізання
+	Send backward	Перемістити назад
+	Send to back	На задній план
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Сьогодні
@@ -2600,3 +2631,11 @@ animation effects	Off	Вимкнено
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Параметри цієї відповіді
 	Export value	Значення експорту
+	Show Page Edge Shadows	Показувати тіні на краях сторінок
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Пошук…
+	Image pasted	Зображення вставлено
+	No image on clipboard to paste	У буфері обміну немає зображення для вставлення
+	Pinned {tool} to Home	{tool} закріплено на головній
+	Unpinned {tool} from Home	{tool} відкріплено від головної
diff --git a/crates/ui-egui/src/i18n/vi.tsv b/crates/ui-egui/src/i18n/vi.tsv
index e9a9a73f2b..e79a8aacc4 100644
--- a/crates/ui-egui/src/i18n/vi.tsv
+++ b/crates/ui-egui/src/i18n/vi.tsv
@@ -7,6 +7,11 @@
 # Plural rule: `plural_none` — every @plural row lists exactly one form.
 # Context-sensitive wording and intentional unchanged strings are regression-tested in i18n/mod.rs.
 #
+
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	Trình đơn
 	Edit	Chỉnh sửa
 	Pages	Trang
@@ -2702,6 +2707,12 @@ key	Space	Space
 	Redact Image	Xóa nội dung nhạy cảm của hình ảnh
 	Create Link…	Tạo liên kết…
 	Recognize Text…	Nhận dạng văn bản…
+	Bring forward	Chuyển lên trước
+	Bring to front	Đưa lên trước cùng
+	Crop image	Cắt hình ảnh
+	Remove crop	Xóa cắt
+	Send backward	Chuyển về sau
+	Send to back	Đưa về sau cùng
 	Create & Edit	Tạo và chỉnh sửa
 	Review & Compare	Xem xét và so sánh
 	Forms & Signatures	Biểu mẫu và chữ ký
@@ -2789,6 +2800,25 @@ key	Space	Space
 # Historical snapshot notice bar (View signed version / View revision).
 	You are viewing the signed version of “{from}” (revision {rev}). It is a snapshot: changes here won't affect the original.	Bạn đang xem phiên bản đã ký của “{from}” (bản sửa đổi {rev}). Đây là ảnh nhanh: các thay đổi ở đây không được áp dụng đến bản gốc.
 	You are viewing revision {rev} of “{from}”. It is a snapshot: changes here won't affect the original.	Bạn đang xem bản sửa đổi {rev} của “{from}”. Đây là ảnh nhanh: các thay đổi ở đây không được áp dụng đến bản gốc.
+	Clear search	Xóa tìm kiếm
+	Pin	Ghim
+	Pin a tool…	Ghim công cụ…
+	Pin to Home	Ghim vào Trang chủ
+	Pin tools to Home	Ghim công cụ vào Trang chủ
+	Pin your favorite tools here for quick access.	Ghim các công cụ yêu thích của bạn vào đây để truy cập nhanh.
+	Pinned	Đã ghim
+	Pinned Tools	Công cụ đã ghim
+	Search tools…	Tìm kiếm công cụ…
+	Select tools to display on your Home page for quick access.	Chọn các công cụ hiển thị trên Trang chủ để truy cập nhanh.
+	Unpin from Home	Bỏ ghim khỏi Trang chủ
+	Unpin tool	Bỏ ghim công cụ
+	Transform image	Chuyển đổi hình ảnh
+	Select Tool	Công cụ chọn
+	Hand Tool	Công cụ bàn tay
+	Marquee Zoom	Thu phóng theo vùng chọn
+	Edit this PDF	Chỉnh sửa PDF này
+	Export this PDF	Xuất PDF này
+	Find text or tools	Tìm văn bản hoặc công cụ
 	Attach a file…	Đính kèm tệp…
 	Delete attachment	Xóa tệp đính kèm
 	Attaching files is not available on the web yet	Chưa thể đính kèm tệp trên web
@@ -2826,6 +2856,8 @@ key	Space	Space
 	a table has 1 to {max} columns	một bảng có từ 1 đến {max} cột
 	the first row number can be at most {max}	số hàng đầu tiên tối đa là {max}
 	the area, the spacing and the column widths must be numbers, the spacing 0 or more and each width more than 0	vùng, khoảng cách và độ rộng cột phải là số, khoảng cách từ 0 trở lên và mỗi độ rộng lớn hơn 0
+	Arrange image	Sắp xếp hình ảnh
+	Crop	Xén
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Hôm nay
@@ -2845,3 +2877,11 @@ key	Space	Space
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Tùy chọn cho câu trả lời này
 	Export value	Giá trị xuất
+	Show Page Edge Shadows	Hiển thị bóng viền trang
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Tìm kiếm…
+	Image pasted	Đã dán hình ảnh
+	No image on clipboard to paste	Không có hình ảnh trong bảng nhớ tạm để dán
+	Pinned {tool} to Home	Đã ghim {tool} vào Trang chủ
+	Unpinned {tool} from Home	Đã bỏ ghim {tool} khỏi Trang chủ
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index 5f08576b8e..96e9c3bb75 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -8,6 +8,10 @@
 # Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) stay in Latin letters;
 # the trailing "…" of dialog commands is kept.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 # About, contributor/model credits, and multiline interface guidance.
 	About	关于
 	Contributors	贡献者
@@ -2479,6 +2483,26 @@ animation effects	Off	关
 	Make properties default	将属性设为默认
 	Pages selected	选定的页面
 	Page properties	页面属性
+	Clear search	清除搜索
+	Pin	固定
+	Pin a tool…	固定工具…
+	Pin to Home	固定到主页
+	Pin tools to Home	将工具固定到主页
+	Pin your favorite tools here for quick access.	将常用的工具固定在此处以便快速访问。
+	Pinned	已固定
+	Pinned Tools	已固定的工具
+	Search tools…	搜索工具…
+	Select tools to display on your Home page for quick access.	选择要在主页上显示的工具以便快速访问。
+	Unpin from Home	从主页取消固定
+	Unpin tool	取消固定工具
+	Transform image	变换图像
+	Select Tool	选择工具
+	Hand Tool	手形工具
+	Marquee Zoom	选框缩放
+	Paste	粘贴
+	Edit this PDF	编辑此 PDF
+	Export this PDF	导出此 PDF
+	Find text or tools	查找文本或工具
 	Create & Edit	创建和编辑
 	Review & Compare	审阅和比较
 	Forms & Signatures	表单和签名
@@ -2526,6 +2550,13 @@ animation effects	Off	关
 	field names can't contain a period: {name}	字段名称不能包含句点：{name}
 	two cells would both be named {name}	两个单元格的名称都会是 {name}
 	a field named {name} already exists	已存在名为 {name} 的字段
+	Arrange image	排列图像
+	Bring forward	上移一层
+	Bring to front	置于顶层
+	Crop	裁剪
+	Remove crop	移除裁剪
+	Send backward	下移一层
+	Send to back	置于底层
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	今天
@@ -2542,3 +2573,11 @@ animation effects	Off	关
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	此回复的选项
 	Export value	导出值
+	Show Page Edge Shadows	显示页面边缘阴影
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	搜索…
+	Image pasted	已粘贴图像
+	No image on clipboard to paste	剪贴板中没有可粘贴的图像
+	Pinned {tool} to Home	已将 {tool} 固定到主页
+	Unpinned {tool} from Home	已从主页取消固定 {tool}
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index 2570f12f1c..a1b933b830 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -8,6 +8,10 @@
 # Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) stay in Latin letters;
 # the trailing "…" of dialog commands is kept.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	選單
 	File	檔案
 	Edit	編輯
@@ -2465,6 +2469,26 @@ animation effects	Off	關
 	Make properties default	將內容設為預設
 	Pages selected	選取的頁面
 	Page properties	頁面屬性
+	Clear search	清除搜尋
+	Pin	釘選
+	Pin a tool…	釘選工具…
+	Pin to Home	釘選到首頁
+	Pin tools to Home	將工具釘選到首頁
+	Pin your favorite tools here for quick access.	將常用的工具釘選在此處以便快速存取。
+	Pinned	已釘選
+	Pinned Tools	已釘選的工具
+	Search tools…	搜尋工具…
+	Select tools to display on your Home page for quick access.	選取要在首頁上顯示的工具以便快速存取。
+	Unpin from Home	從首頁取消釘選
+	Unpin tool	取消釘選工具
+	Transform image	變換影像
+	Select Tool	選取工具
+	Hand Tool	手形工具
+	Marquee Zoom	選取範圍縮放
+	Paste	貼上
+	Edit this PDF	編輯此 PDF
+	Export this PDF	匯出此 PDF
+	Find text or tools	尋找文字或工具
 	Create & Edit	建立與編輯
 	Review & Compare	審閱與比較
 	Forms & Signatures	表單與簽名
@@ -2512,6 +2536,13 @@ animation effects	Off	關
 	field names can't contain a period: {name}	欄位名稱不能包含句點：{name}
 	two cells would both be named {name}	兩個儲存格的名稱都會是 {name}
 	a field named {name} already exists	已有名為 {name} 的欄位
+	Arrange image	排列影像
+	Bring forward	上移一層
+	Bring to front	移到最上層
+	Crop	裁切
+	Remove crop	移除裁切
+	Send backward	下移一層
+	Send to back	移到最下層
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	今天
@@ -2528,3 +2559,11 @@ animation effects	Off	關
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	此回覆的選項
 	Export value	匯出值
+	Show Page Edge Shadows	顯示頁面邊緣陰影
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	搜尋…
+	Image pasted	已貼上影像
+	No image on clipboard to paste	剪貼簿中沒有可貼上的影像
+	Pinned {tool} to Home	已將 {tool} 釘選至首頁
+	Unpinned {tool} from Home	已從首頁取消釘選 {tool}
diff --git a/crates/ui-egui/src/image_engine.rs b/crates/ui-egui/src/image_engine.rs
new file mode 100644
index 0000000000..518bea0223
--- /dev/null
+++ b/crates/ui-egui/src/image_engine.rs
@@ -0,0 +1,578 @@
+//! Image manipulation engine for non-destructive crop, anchor-based resize, and movement.
+//!
+//! Contributor-original clean-room design with zero-panic safety and lockstep pixel-scale invariance.
+
+use egui::{Color32, Pos2, Rect, Stroke, Vec2, pos2};
+
+use crate::edit_text_ui::ImageHandle;
+
+// ============================================================================
+// 1. MATHEMATICAL CORE: ANCHOR-BASED RESIZE & CROP
+// ============================================================================
+
+/// Minimum allowed dimensions in pixels to prevent panics, zero divisions, or inverted rects.
+pub const MIN_RECT_SIZE: f32 = 10.0;
+
+/// **Anchor-Based Resize System**
+///
+/// Recalculates the screen bounding box by locking the diagonally opposite point/edge as
+/// a fixed anchor.
+///
+/// Math breakdown:
+/// - Corner handles: The diagonally opposite corner is fixed in both X and Y.
+///   Width and height are calculated relative to that anchor, clamped to >= `MIN_RECT_SIZE`,
+///   and the new bounding box is constructed from `anchor` and the clamped dragged coordinate.
+/// - Mid-edge handles: The opposite edge coordinate is fixed in 1D. The perpendicular axis is
+///   completely unaffected.
+pub fn apply_resize(image_rect: Rect, handle: ImageHandle, delta: Vec2) -> Rect {
+    if !image_rect.is_finite() || !delta.x.is_finite() || !delta.y.is_finite() {
+        return image_rect;
+    }
+    let mut min = image_rect.min;
+    let mut max = image_rect.max;
+
+    match handle {
+        // Dragging TopLeft: Fixed Anchor = BottomRight (max.x, max.y)
+        ImageHandle::TopLeft => {
+            let anchor = max;
+            let target = min + delta;
+            let new_w = (anchor.x - target.x).max(MIN_RECT_SIZE);
+            let new_h = (anchor.y - target.y).max(MIN_RECT_SIZE);
+            min.x = anchor.x - new_w;
+            min.y = anchor.y - new_h;
+        }
+
+        // Dragging TopCenter: Fixed Anchor = Bottom edge (max.y)
+        ImageHandle::TopCenter => {
+            let anchor_y = max.y;
+            let target_y = min.y + delta.y;
+            let new_h = (anchor_y - target_y).max(MIN_RECT_SIZE);
+            min.y = anchor_y - new_h;
+        }
+
+        // Dragging TopRight: Fixed Anchor = BottomLeft (min.x, max.y)
+        ImageHandle::TopRight => {
+            let anchor_x = min.x;
+            let anchor_y = max.y;
+            let target_x = max.x + delta.x;
+            let target_y = min.y + delta.y;
+            let new_w = (target_x - anchor_x).max(MIN_RECT_SIZE);
+            let new_h = (anchor_y - target_y).max(MIN_RECT_SIZE);
+            max.x = anchor_x + new_w;
+            min.y = anchor_y - new_h;
+        }
+
+        // Dragging RightCenter: Fixed Anchor = Left edge (min.x)
+        ImageHandle::RightCenter => {
+            let anchor_x = min.x;
+            let target_x = max.x + delta.x;
+            let new_w = (target_x - anchor_x).max(MIN_RECT_SIZE);
+            max.x = anchor_x + new_w;
+        }
+
+        // Dragging BottomRight: Fixed Anchor = TopLeft (min.x, min.y)
+        ImageHandle::BottomRight => {
+            let anchor = min;
+            let target = max + delta;
+            let new_w = (target.x - anchor.x).max(MIN_RECT_SIZE);
+            let new_h = (target.y - anchor.y).max(MIN_RECT_SIZE);
+            max.x = anchor.x + new_w;
+            max.y = anchor.y + new_h;
+        }
+
+        // Dragging BottomCenter: Fixed Anchor = Top edge (min.y)
+        ImageHandle::BottomCenter => {
+            let anchor_y = min.y;
+            let target_y = max.y + delta.y;
+            let new_h = (target_y - anchor_y).max(MIN_RECT_SIZE);
+            max.y = anchor_y + new_h;
+        }
+
+        // Dragging BottomLeft: Fixed Anchor = TopRight (max.x, min.y)
+        ImageHandle::BottomLeft => {
+            let anchor_x = max.x;
+            let anchor_y = min.y;
+            let target_x = min.x + delta.x;
+            let target_y = max.y + delta.y;
+            let new_w = (anchor_x - target_x).max(MIN_RECT_SIZE);
+            let new_h = (target_y - anchor_y).max(MIN_RECT_SIZE);
+            min.x = anchor_x - new_w;
+            max.y = anchor_y + new_h;
+        }
+
+        // Dragging LeftCenter: Fixed Anchor = Right edge (max.x)
+        ImageHandle::LeftCenter => {
+            let anchor_x = max.x;
+            let target_x = min.x + delta.x;
+            let new_w = (anchor_x - target_x).max(MIN_RECT_SIZE);
+            min.x = anchor_x - new_w;
+        }
+    }
+
+    Rect::from_min_max(min, max)
+}
+
+/// **Anchor-Based Proportional Resize System**
+///
+/// Recalculates the screen bounding box by locking the diagonally opposite point as
+/// a fixed anchor while preserving the aspect ratio.
+///
+/// For corner handles, uses the axis with the larger relative change to scale both
+/// width and height uniformly from the locked anchor point, clamped to `>= MIN_RECT_SIZE`.
+/// For mid-edge handles, delegates to `apply_resize`.
+pub fn apply_resize_proportional(image_rect: Rect, handle: ImageHandle, delta: Vec2) -> Rect {
+    if !image_rect.is_finite() || !delta.x.is_finite() || !delta.y.is_finite() {
+        return image_rect;
+    }
+    let w0 = image_rect.width().max(1.0);
+    let h0 = image_rect.height().max(1.0);
+
+    match handle {
+        ImageHandle::TopLeft => {
+            let horizontal = -delta.x / w0;
+            let vertical = -delta.y / h0;
+            let d = if horizontal.abs() > vertical.abs() { horizontal } else { vertical };
+            let k = (1.0 + d).max(MIN_RECT_SIZE / w0).max(MIN_RECT_SIZE / h0);
+            let (w, h) = (w0 * k, h0 * k);
+            Rect::from_min_max(Pos2::new(image_rect.max.x - w, image_rect.max.y - h), image_rect.max)
+        }
+        ImageHandle::TopRight => {
+            let horizontal = delta.x / w0;
+            let vertical = -delta.y / h0;
+            let d = if horizontal.abs() > vertical.abs() { horizontal } else { vertical };
+            let k = (1.0 + d).max(MIN_RECT_SIZE / w0).max(MIN_RECT_SIZE / h0);
+            let (w, h) = (w0 * k, h0 * k);
+            Rect::from_min_max(Pos2::new(image_rect.min.x, image_rect.max.y - h), Pos2::new(image_rect.min.x + w, image_rect.max.y))
+        }
+        ImageHandle::BottomLeft => {
+            let horizontal = -delta.x / w0;
+            let vertical = delta.y / h0;
+            let d = if horizontal.abs() > vertical.abs() { horizontal } else { vertical };
+            let k = (1.0 + d).max(MIN_RECT_SIZE / w0).max(MIN_RECT_SIZE / h0);
+            let (w, h) = (w0 * k, h0 * k);
+            Rect::from_min_max(Pos2::new(image_rect.max.x - w, image_rect.min.y), Pos2::new(image_rect.max.x, image_rect.min.y + h))
+        }
+        ImageHandle::BottomRight => {
+            let horizontal = delta.x / w0;
+            let vertical = delta.y / h0;
+            let d = if horizontal.abs() > vertical.abs() { horizontal } else { vertical };
+            let k = (1.0 + d).max(MIN_RECT_SIZE / w0).max(MIN_RECT_SIZE / h0);
+            let (w, h) = (w0 * k, h0 * k);
+            Rect::from_min_max(image_rect.min, Pos2::new(image_rect.min.x + w, image_rect.min.y + h))
+        }
+        mid => apply_resize(image_rect, mid, delta),
+    }
+}
+
+/// Trim a screen rectangle and its UVs together, keeping the opposite edge fixed.
+/// The pixel scale stays unchanged, and each edge stops at the texture boundary.
+pub fn apply_crop(image_rect: Rect, uv_rect: Rect, handle: ImageHandle, delta: Vec2) -> (Rect, Rect) {
+    if !delta.is_finite() || !image_rect.is_finite() || !uv_rect.is_finite() || !image_rect.is_positive() || !uv_rect.is_positive() {
+        return (image_rect, uv_rect);
+    }
+    let scale = image_rect.size() / uv_rect.size();
+    if !scale.is_finite() || scale.x <= 0.0 || scale.y <= 0.0 {
+        return (image_rect, uv_rect);
+    }
+    let minimum = (egui::vec2(MIN_RECT_SIZE, MIN_RECT_SIZE) / scale).min(uv_rect.size() * 0.95);
+    let mut uv = uv_rect;
+    if matches!(handle, ImageHandle::TopLeft | ImageHandle::LeftCenter | ImageHandle::BottomLeft) {
+        uv.min.x = (uv.min.x + delta.x / scale.x).clamp(0.0, (uv.max.x - minimum.x).max(0.0));
+    } else if matches!(handle, ImageHandle::TopRight | ImageHandle::RightCenter | ImageHandle::BottomRight) {
+        uv.max.x = (uv.max.x + delta.x / scale.x).clamp((uv.min.x + minimum.x).min(1.0), 1.0);
+    }
+    if matches!(handle, ImageHandle::TopLeft | ImageHandle::TopCenter | ImageHandle::TopRight) {
+        uv.min.y = (uv.min.y + delta.y / scale.y).clamp(0.0, (uv.max.y - minimum.y).max(0.0));
+    } else if matches!(handle, ImageHandle::BottomLeft | ImageHandle::BottomCenter | ImageHandle::BottomRight) {
+        uv.max.y = (uv.max.y + delta.y / scale.y).clamp((uv.min.y + minimum.y).min(1.0), 1.0);
+    }
+    // Reconstruct from the fixed opposite edge, rather than adding a nearly full-width
+    // shift to the moved edge. Calculate in f64 so each screen coordinate rounds only
+    // once to f32; small crops far from the origin otherwise lose multiple ulps.
+    let span = |min: f32, max: f32| f64::from(max) - f64::from(min);
+    let width = span(image_rect.min.x, image_rect.max.x) * span(uv.min.x, uv.max.x) / span(uv_rect.min.x, uv_rect.max.x);
+    let height = span(image_rect.min.y, image_rect.max.y) * span(uv.min.y, uv.max.y) / span(uv_rect.min.y, uv_rect.max.y);
+    let mut screen = image_rect;
+    if uv.min.x != uv_rect.min.x {
+        screen.min.x = (f64::from(image_rect.max.x) - width) as f32;
+    } else if uv.max.x != uv_rect.max.x {
+        screen.max.x = (f64::from(image_rect.min.x) + width) as f32;
+    }
+    if uv.min.y != uv_rect.min.y {
+        screen.min.y = (f64::from(image_rect.max.y) - height) as f32;
+    } else if uv.max.y != uv_rect.max.y {
+        screen.max.y = (f64::from(image_rect.min.y) + height) as f32;
+    }
+    if !screen.is_finite() || !screen.is_positive() {
+        return (image_rect, uv_rect);
+    }
+    (screen, uv)
+}
+
+// ============================================================================
+// 2. VISUAL RENDERING HELPERS
+// ============================================================================
+
+/// Vibrant amber/orange color for Crop Mode.
+pub const CROP_ACCENT: Color32 = Color32::from_rgb(230, 126, 34);
+
+/// Renders the Rule-of-Thirds composition grid inside the given crop rectangle.
+pub fn draw_rule_of_thirds(painter: &egui::Painter, rect: Rect, stroke: Stroke) {
+    let w = rect.width();
+    let h = rect.height();
+    if w <= 0.0 || h <= 0.0 {
+        return;
+    }
+
+    let x1 = rect.min.x + w / 3.0;
+    let x2 = rect.min.x + (2.0 * w) / 3.0;
+    painter.line_segment([pos2(x1, rect.min.y), pos2(x1, rect.max.y)], stroke);
+    painter.line_segment([pos2(x2, rect.min.y), pos2(x2, rect.max.y)], stroke);
+
+    let y1 = rect.min.y + h / 3.0;
+    let y2 = rect.min.y + (2.0 * h) / 3.0;
+    painter.line_segment([pos2(rect.min.x, y1), pos2(rect.max.x, y1)], stroke);
+    painter.line_segment([pos2(rect.min.x, y2), pos2(rect.max.x, y2)], stroke);
+}
+
+/// Renders a circular handle with shadow, fill, and accent stroke using the image tool accent.
+pub fn draw_handle(painter: &egui::Painter, center: Pos2, is_active: bool, is_hovered: bool, crop_mode: bool, accent_color: Color32) {
+    let base_radius = 6.5;
+    let circle_radius = if is_active {
+        base_radius + 2.0
+    } else if is_hovered {
+        base_radius + 1.2
+    } else {
+        base_radius
+    };
+
+    let fill_color = if crop_mode {
+        if is_active || is_hovered { Color32::from_rgb(255, 230, 150) } else { Color32::from_rgb(255, 255, 255) }
+    } else if is_active || is_hovered {
+        Color32::from_rgb(210, 235, 255)
+    } else {
+        Color32::from_rgb(255, 255, 255)
+    };
+
+    // Draw handle shadow/glow
+    painter.circle_filled(center, circle_radius + 1.5, Color32::from_rgba_unmultiplied(0, 0, 0, 80));
+
+    // Draw handle circle
+    painter.circle_filled(center, circle_radius, fill_color);
+    painter.circle_stroke(center, circle_radius, Stroke::new(1.8, accent_color));
+}
+
+// ============================================================================
+// 3. UNIT TESTS: MATHEMATICAL VERIFICATION
+// ============================================================================
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use egui::vec2;
+
+    // Verify scale in screen space: dividing an endpoint's rounding error by a tiny
+    // retained UV span would magnify it and make a fixed scale tolerance invalid.
+    fn crop_scale_preserved(before: Rect, uv_before: Rect, after: Rect, uv_after: Rect) -> bool {
+        let axis = |lo: f32, hi: f32, u0: f32, u1: f32, new_lo: f32, new_hi: f32, v0: f32, v1: f32| {
+            let span = f64::from(hi) - f64::from(lo);
+            let expected = span * (f64::from(v1) - f64::from(v0)) / (f64::from(u1) - f64::from(u0));
+            let actual = f64::from(new_hi) - f64::from(new_lo);
+            // One moved endpoint rounds once to f32. EPSILON * coordinate magnitude
+            // bounds one ulp (conservatively twice the nearest-rounding error).
+            // The f64 term also covers the two arithmetic operations above.
+            let magnitude = f64::from(new_lo).abs().max(f64::from(new_hi).abs()).max(expected.abs());
+            let bound = f64::from(f32::EPSILON) * magnitude + 4.0 * f64::EPSILON * span.abs();
+            (actual - expected).abs() <= bound
+        };
+        axis(before.min.x, before.max.x, uv_before.min.x, uv_before.max.x, after.min.x, after.max.x, uv_after.min.x, uv_after.max.x)
+            && axis(before.min.y, before.max.y, uv_before.min.y, uv_before.max.y, after.min.y, after.max.y, uv_after.min.y, uv_after.max.y)
+    }
+
+    #[test]
+    fn crop_scale_at_large_screen_offset() {
+        let screen = Rect::from_min_size(pos2(813.7157, 0.0), vec2(495.0725, 50.0));
+        let uv = Rect::from_min_size(pos2(0.114936605, 0.0), vec2(0.32074833, 0.3));
+        let (cropped, kept) = apply_crop(screen, uv, ImageHandle::BottomLeft, vec2(1255.676, 0.0));
+        let width = (f64::from(screen.max.x) - f64::from(screen.min.x)) * (f64::from(kept.max.x) - f64::from(kept.min.x))
+            / (f64::from(uv.max.x) - f64::from(uv.min.x));
+        assert_eq!(cropped.min.x, (f64::from(screen.max.x) - width) as f32, "moved edge rounds once from the fixed anchor");
+        assert_eq!(cropped.max.x, screen.max.x, "opposite horizontal edge stays fixed");
+        assert_eq!(cropped.min.y, screen.min.y, "opposite vertical edge stays fixed");
+        assert!(crop_scale_preserved(screen, uv, cropped, kept));
+        let stretched = Rect::from_min_max(cropped.min - vec2(0.1, 0.0), cropped.max);
+        assert!(!crop_scale_preserved(screen, uv, stretched, kept), "a visible stretch must exceed the rounding bound");
+    }
+
+    #[test]
+    fn test_resize_bottom_right_anchor() {
+        let r = Rect::from_min_max(pos2(100.0, 100.0), pos2(300.0, 200.0));
+        let res = apply_resize(r, ImageHandle::BottomRight, vec2(50.0, 25.0));
+        assert_eq!(res.min, pos2(100.0, 100.0), "TopLeft anchor must remain fixed");
+        assert_eq!(res.max, pos2(350.0, 225.0), "BottomRight must expand by delta");
+    }
+
+    #[test]
+    fn test_resize_top_left_anchor() {
+        let r = Rect::from_min_max(pos2(100.0, 100.0), pos2(300.0, 200.0));
+        let res = apply_resize(r, ImageHandle::TopLeft, vec2(20.0, 15.0));
+        assert_eq!(res.max, pos2(300.0, 200.0), "BottomRight anchor must remain fixed");
+        assert_eq!(res.min, pos2(120.0, 115.0), "TopLeft must move by delta");
+    }
+
+    #[test]
+    fn test_resize_clamping_prevents_inversion() {
+        let r = Rect::from_min_max(pos2(100.0, 100.0), pos2(200.0, 200.0));
+        let res = apply_resize(r, ImageHandle::TopLeft, vec2(500.0, 500.0));
+        assert_eq!(res.max, pos2(200.0, 200.0));
+        assert_eq!(res.min, pos2(200.0 - MIN_RECT_SIZE, 200.0 - MIN_RECT_SIZE));
+        assert!(res.width() >= MIN_RECT_SIZE);
+        assert!(res.height() >= MIN_RECT_SIZE);
+    }
+
+    #[test]
+    fn test_resize_top_right_anchor() {
+        let r = Rect::from_min_max(pos2(100.0, 100.0), pos2(300.0, 200.0));
+        let res = apply_resize(r, ImageHandle::TopRight, vec2(10.0, -10.0));
+        assert_eq!(res.min.x, 100.0, "min.x (BL) anchor fixed");
+        assert_eq!(res.max.y, 200.0, "max.y (BL) anchor fixed");
+        assert_eq!(res.max.x, 310.0);
+        assert_eq!(res.min.y, 90.0);
+    }
+
+    #[test]
+    fn test_resize_bottom_left_anchor() {
+        let r = Rect::from_min_max(pos2(100.0, 100.0), pos2(300.0, 200.0));
+        let res = apply_resize(r, ImageHandle::BottomLeft, vec2(-15.0, 20.0));
+        assert_eq!(res.max.x, 300.0, "max.x (TR) anchor fixed");
+        assert_eq!(res.min.y, 100.0, "min.y (TR) anchor fixed");
+        assert_eq!(res.min.x, 85.0);
+        assert_eq!(res.max.y, 220.0);
+    }
+
+    #[test]
+    fn test_resize_mid_edges() {
+        let r = Rect::from_min_max(pos2(100.0, 100.0), pos2(300.0, 200.0));
+
+        let tm = apply_resize(r, ImageHandle::TopCenter, vec2(50.0, -30.0));
+        assert_eq!(tm.min.x, 100.0, "X min unaffected");
+        assert_eq!(tm.max.x, 300.0, "X max unaffected");
+        assert_eq!(tm.max.y, 200.0, "Y max anchor locked");
+        assert_eq!(tm.min.y, 70.0);
+
+        let rm = apply_resize(r, ImageHandle::RightCenter, vec2(40.0, 50.0));
+        assert_eq!(rm.min.x, 100.0, "X min anchor locked");
+        assert_eq!(rm.max.x, 340.0);
+        assert_eq!(rm.min.y, 100.0, "Y unaffected");
+        assert_eq!(rm.max.y, 200.0, "Y unaffected");
+    }
+
+    #[test]
+    fn test_crop_lockstep_ratio_preservation() {
+        let screen = Rect::from_min_max(pos2(100.0, 100.0), pos2(500.0, 400.0));
+        let uv = Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0));
+
+        let initial_px_per_uv_x = screen.width() / uv.width();
+        let initial_px_per_uv_y = screen.height() / uv.height();
+
+        let (new_screen, new_uv) = apply_crop(screen, uv, ImageHandle::RightCenter, vec2(-80.0, 0.0));
+
+        assert_eq!(new_screen.min.x, 100.0, "Left edge anchored");
+        assert_eq!(new_screen.max.x, 420.0, "Right edge moved in by 80px");
+        assert_eq!(new_screen.width(), 320.0);
+
+        assert_eq!(new_uv.min.x, 0.0);
+        assert!((new_uv.max.x - 0.8).abs() < 1e-4);
+
+        let new_px_per_uv_x = new_screen.width() / new_uv.width();
+        assert!((new_px_per_uv_x - initial_px_per_uv_x).abs() < 1e-4, "Pixel scale must remain invariant in crop mode");
+
+        let new_px_per_uv_y = new_screen.height() / new_uv.height();
+        assert!((new_px_per_uv_y - initial_px_per_uv_y).abs() < 1e-4, "Pixel scale Y must remain invariant");
+    }
+
+    #[test]
+    fn test_crop_left_edge_anchoring() {
+        let screen = Rect::from_min_max(pos2(100.0, 100.0), pos2(500.0, 400.0));
+        let uv = Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0));
+
+        let (new_screen, new_uv) = apply_crop(screen, uv, ImageHandle::LeftCenter, vec2(50.0, 0.0));
+
+        assert_eq!(new_screen.max.x, 500.0, "Right edge must remain strictly anchored");
+        assert_eq!(new_screen.min.x, 150.0, "Left edge must move by 50px");
+        assert_eq!(new_screen.width(), 350.0);
+
+        assert!((new_uv.min.x - 0.125).abs() < 1e-4);
+        assert_eq!(new_uv.max.x, 1.0);
+    }
+
+    #[test]
+    fn test_crop_uncrop_clamped_at_zero_and_one() {
+        let screen = Rect::from_min_max(pos2(100.0, 100.0), pos2(500.0, 400.0));
+        let uv = Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0));
+
+        let (new_screen, new_uv) = apply_crop(screen, uv, ImageHandle::LeftCenter, vec2(-100.0, 0.0));
+        assert_eq!(new_uv.min.x, 0.0, "UV min cannot go below 0.0");
+        assert_eq!(new_screen.min.x, 100.0, "Screen min clamped at initial position");
+
+        let (new_screen2, new_uv2) = apply_crop(screen, uv, ImageHandle::RightCenter, vec2(100.0, 0.0));
+        assert_eq!(new_uv2.max.x, 1.0, "UV max cannot exceed 1.0");
+        assert_eq!(new_screen2.max.x, 500.0, "Screen max clamped at initial position");
+    }
+
+    #[test]
+    fn test_apply_resize_proportional_horizontal_only_scales_both_dimensions() {
+        let rect = Rect::from_min_max(pos2(100.0, 100.0), pos2(200.0, 200.0)); // 100 x 100
+        // TopRight corner moved horizontally by -25px (from x=200 to x=175)
+        let resized = apply_resize_proportional(rect, ImageHandle::TopRight, vec2(-25.0, 0.0));
+        assert_eq!(resized.min.x, 100.0, "Left anchor preserved");
+        assert_eq!(resized.max.y, 200.0, "Bottom anchor preserved");
+        assert_eq!(resized.width(), 75.0, "Width scaled to 75%");
+        assert_eq!(resized.height(), 75.0, "Height scaled to 75% proportionally");
+        assert_eq!(resized.max.x, 175.0);
+        assert_eq!(resized.min.y, 125.0);
+    }
+
+    #[test]
+    fn test_apply_resize_proportional_bottom_right_anchor_locked() {
+        let rect = Rect::from_min_max(pos2(50.0, 50.0), pos2(150.0, 250.0)); // 100 x 200
+        // BottomRight moved down/right by (20px, 40px)
+        let resized = apply_resize_proportional(rect, ImageHandle::BottomRight, vec2(20.0, 40.0));
+        assert_eq!(resized.min, pos2(50.0, 50.0), "TopLeft anchor strictly locked");
+        assert_eq!(resized.width(), 120.0);
+        assert_eq!(resized.height(), 240.0);
+    }
+
+    #[cfg(test)]
+    mod proptests {
+        use super::*;
+        use proptest::prelude::*;
+
+        fn arb_handle() -> impl Strategy<Value = ImageHandle> {
+            prop_oneof![
+                Just(ImageHandle::TopLeft),
+                Just(ImageHandle::TopCenter),
+                Just(ImageHandle::TopRight),
+                Just(ImageHandle::RightCenter),
+                Just(ImageHandle::BottomRight),
+                Just(ImageHandle::BottomCenter),
+                Just(ImageHandle::BottomLeft),
+                Just(ImageHandle::LeftCenter),
+            ]
+        }
+
+        proptest! {
+            #[test]
+            fn prop_apply_resize_never_inverts_and_respects_min_size(
+                min_x in -5000.0f32..5000.0,
+                min_y in -5000.0f32..5000.0,
+                w in 10.0f32..2000.0,
+                h in 10.0f32..2000.0,
+                handle in arb_handle(),
+                dx in -10000.0f32..10000.0,
+                dy in -10000.0f32..10000.0,
+            ) {
+                let rect = Rect::from_min_size(pos2(min_x, min_y), vec2(w, h));
+                let res = apply_resize(rect, handle, vec2(dx, dy));
+                prop_assert!(res.is_finite());
+                prop_assert!(res.width() >= MIN_RECT_SIZE - 1e-3);
+                prop_assert!(res.height() >= MIN_RECT_SIZE - 1e-3);
+                prop_assert!(res.min.x <= res.max.x);
+                prop_assert!(res.min.y <= res.max.y);
+            }
+
+            #[test]
+            fn prop_apply_resize_proportional_preserves_aspect_ratio(
+                min_x in -2000.0f32..2000.0,
+                min_y in -2000.0f32..2000.0,
+                w in 20.0f32..1000.0,
+                h in 20.0f32..1000.0,
+                handle in arb_handle(),
+                dx in -5000.0f32..5000.0,
+                dy in -5000.0f32..5000.0,
+            ) {
+                let rect = Rect::from_min_size(pos2(min_x, min_y), vec2(w, h));
+                let res = apply_resize_proportional(rect, handle, vec2(dx, dy));
+                prop_assert!(res.is_finite());
+                prop_assert!(res.width() >= MIN_RECT_SIZE - 1e-3);
+                prop_assert!(res.height() >= MIN_RECT_SIZE - 1e-3);
+
+                let is_corner = matches!(handle, ImageHandle::TopLeft | ImageHandle::TopRight | ImageHandle::BottomLeft | ImageHandle::BottomRight);
+                if is_corner {
+                    let orig_ratio = w / h;
+                    let new_ratio = res.width() / res.height();
+                    prop_assert!((orig_ratio - new_ratio).abs() <= 1e-3 * orig_ratio.max(1.0), "orig: {orig_ratio}, new: {new_ratio}");
+                }
+            }
+
+            #[test]
+            fn prop_apply_crop_uv_clamped(
+                min_x in 0.0f32..1000.0,
+                min_y in 0.0f32..1000.0,
+                w in 50.0f32..500.0,
+                h in 50.0f32..500.0,
+                uv_u0 in 0.0f32..0.4,
+                uv_v0 in 0.0f32..0.4,
+                uv_w in 0.3f32..0.5,
+                uv_h in 0.3f32..0.5,
+                handle in arb_handle(),
+                dx in -2000.0f32..2000.0,
+                dy in -2000.0f32..2000.0,
+            ) {
+                let screen = Rect::from_min_size(pos2(min_x, min_y), vec2(w, h));
+                let uv = Rect::from_min_size(pos2(uv_u0, uv_v0), vec2(uv_w, uv_h));
+                let (new_screen, new_uv) = apply_crop(screen, uv, handle, vec2(dx, dy));
+
+                prop_assert!(new_screen.is_finite());
+                prop_assert!(new_uv.is_finite());
+                prop_assert!(new_uv.min.x >= 0.0 - 1e-5);
+                prop_assert!(new_uv.min.y >= 0.0 - 1e-5);
+                prop_assert!(new_uv.max.x <= 1.0 + 1e-5);
+                prop_assert!(new_uv.max.y <= 1.0 + 1e-5);
+                prop_assert!(new_uv.width() > 0.0);
+                prop_assert!(new_uv.height() > 0.0);
+
+                if !matches!(handle, ImageHandle::TopLeft | ImageHandle::LeftCenter | ImageHandle::BottomLeft) {
+                    prop_assert_eq!(new_screen.min.x, screen.min.x, "stationary left edge moved");
+                }
+                if !matches!(handle, ImageHandle::TopRight | ImageHandle::RightCenter | ImageHandle::BottomRight) {
+                    prop_assert_eq!(new_screen.max.x, screen.max.x, "stationary right edge moved");
+                }
+                if !matches!(handle, ImageHandle::TopLeft | ImageHandle::TopCenter | ImageHandle::TopRight) {
+                    prop_assert_eq!(new_screen.min.y, screen.min.y, "stationary top edge moved");
+                }
+                if !matches!(handle, ImageHandle::BottomLeft | ImageHandle::BottomCenter | ImageHandle::BottomRight) {
+                    prop_assert_eq!(new_screen.max.y, screen.max.y, "stationary bottom edge moved");
+                }
+
+                prop_assert!(crop_scale_preserved(screen, uv, new_screen, new_uv),
+                    "screen/UV scale changed beyond endpoint rounding: {screen:?} {uv:?} => {new_screen:?} {new_uv:?}");
+            }
+
+            #[test]
+            fn prop_quad_contains_never_panics(
+                q0_x in -1000.0f32..1000.0,
+                q0_y in -1000.0f32..1000.0,
+                q1_x in -1000.0f32..1000.0,
+                q1_y in -1000.0f32..1000.0,
+                q2_x in -1000.0f32..1000.0,
+                q2_y in -1000.0f32..1000.0,
+                q3_x in -1000.0f32..1000.0,
+                q3_y in -1000.0f32..1000.0,
+                px in -2000.0f32..2000.0,
+                py in -2000.0f32..2000.0,
+            ) {
+                let quad = [pos2(q0_x, q0_y), pos2(q1_x, q1_y), pos2(q2_x, q2_y), pos2(q3_x, q3_y)];
+                let p = pos2(px, py);
+                let _ = crate::edit_text_ui::quad_contains(quad, p);
+            }
+        }
+
+        #[test]
+        fn degenerate_quad_does_not_contain_points() {
+            let zero_quad = [pos2(0.0, 0.0), pos2(0.0, 0.0), pos2(0.0, 0.0), pos2(0.0, 0.0)];
+            assert!(!crate::edit_text_ui::quad_contains(zero_quad, pos2(10.0, 10.0)));
+            assert!(!crate::edit_text_ui::quad_contains(zero_quad, pos2(0.0, 0.0)));
+        }
+    }
+}
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index 222bb988e4..643d5e90ff 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -36,6 +36,7 @@ macro_rules! tl_ctx {
 }
 pub mod canvas;
 mod chrome;
+mod image_engine;
 pub use combine_grid::ThumbState as CombineThumb;
 pub use combine_ui::{Columns as CombineColumns, CombineView, Lock as CombineLock, SortKey};
 mod commands;
@@ -45,15 +46,17 @@ mod menus;
 pub mod marks {
     pub use crate::marks_ui::{MarksDraft, PageRange, Subset};
 }
+pub use content_ui::TextDraft;
 pub use create_ui::Clip;
 pub use link_ui::LinkDraft;
 pub use optimize_ui::{OptimizeDraft, OptimizeTab};
 pub use sign_ui::{DigitalIdEntry, SignDraft, SignGraphic, SignStep};
 mod bidi;
 mod dialogs;
-pub use edit_text_ui::CropMode;
+pub use edit_text_ui::{CropMode, DragTarget, ImageDrag, ImageHandle, ImageSelection};
 mod editing;
 mod home;
+mod hotbar;
 mod panels;
 pub use print_ui::{Handling as PrintHandling, OptionsSource, PrintDraft, PrinterSource, Which as PrintWhich, system_printers};
 pub use redact_ui::{HiddenDraft, PagesDraft as RedactPagesDraft, RedactPrefs, SearchDraft as RedactSearchDraft, SearchMode as RedactSearchMode};
@@ -77,6 +80,9 @@ mod state;
 mod tools;
 mod workflows;
 
+#[cfg(not(target_arch = "wasm32"))]
+pub(crate) mod os_clipboard;
+
 #[cfg(not(target_arch = "wasm32"))]
 pub(crate) use app::same_file;
 pub(crate) use app::{MAX_AUTHOR_CHARS, copy_refused, date_text_for_pdf, print_refused};
@@ -114,6 +120,7 @@ use panels::search_ui;
 pub use panels::side_panels;
 pub use persist::last_session;
 pub use persist::last_view;
+pub use persist::paper;
 use persist::recovery;
 pub use persist::units;
 #[cfg(not(target_arch = "wasm32"))]
@@ -140,7 +147,7 @@ use state::CopyPage;
 use state::OpenRequest;
 pub use state::{
     CustomDraft, Dialog, DuplicateDraft, LeftPanel, LinkOrigin, Mode, NumberDraft, OpenOutcome, PageClip, PagePropsDraft, PasswordPrompt,
-    PendingLink, PendingRemoteLink, PropsTab, QuickTool, RecentFile, RightPanel, UnlockPrompt,
+    PendingLink, PendingRemoteLink, PropsTab, QuickTool, RECENT_FILES_DEFAULT, RECENT_FILES_MAX, RecentFile, RightPanel, UnlockPrompt,
 };
 use state::{DocumentCopyJob, GridFile};
 pub use tools::bulk_fields;
@@ -239,6 +246,7 @@ struct PendingOpen {
     after_open: Option<pdfcraft_render::RemoteDestination>,
     recovered: Option<RecoveryMeta>,
     then: Option<&'static str>,
+    display_override: Option<(canvas::PageLayout, bool)>,
 }
 
 pub struct PdfCraftApp {
@@ -258,6 +266,8 @@ pub struct PdfCraftApp {
     pub view_defaults: canvas::ViewDefaults,
     /// The unit page sizes and margins are shown in (Preferences ▸ Documents and view).
     pub units: units::Unit,
+    /// The paper Create ▸ Blank page makes (#5644): the system region's.
+    pub blank_paper: paper::Paper,
     /// The Preferences ▸ Date format box while it's being edited, or while it holds an invalid
     /// pattern (the session keeps the last valid one).
     pub date_format_draft: Option<String>,
@@ -285,12 +295,15 @@ pub struct PdfCraftApp {
     full_screen_tool: Option<QuickTool>,
     /// Comment author, per-tool colours and widths, pin.
     pub comment_prefs: comments::CommentPrefs,
+    pub(crate) hotbar: hotbar::Hotbar,
     /// Resolved colours, including the current OS theme when following the system.
     pub theme: ThemeKind,
     pub theme_preference: ThemePreference,
     /// The reading-colours preference (Preferences ▸ Reading colours): applied to every open
     /// document, and documents open with it (Acrobat's Replace Document Colors).
     pub reading_colors: pdfcraft_render::ReadingColors,
+    /// App-wide page decoration only; never part of a PDF edit or render request.
+    pub show_page_edge_shadows: bool,
     /// The Linux portal is enabled only by the native host, and starts on the first System choice.
     #[cfg(target_os = "linux")]
     desktop_theme: Option<pdfcraft_platform::desktop_theme::DesktopTheme>,
@@ -298,6 +311,9 @@ pub struct PdfCraftApp {
     desktop_theme_enabled: bool,
     /// How far a mouse-wheel notch scrolls.
     pub scroll_speed: scroll_speed::ScrollSpeed,
+    /// Preferences ▸ Invert middle-button drag: the middle button's pan or auto-scroll moves the
+    /// view the other way. Off by default.
+    pub invert_middle_drag: bool,
     /// Preferences ▸ Animation effects: on, off, or as the system's animation setting says.
     pub animation_effects: motion::AnimationEffects,
     /// Whether the system asked for no animations, and how the desktop app asks it.
@@ -338,6 +354,8 @@ pub struct PdfCraftApp {
     /// tab coming to the front (Home, a document, Combine files) puts the view away.
     all_tools_tab: (Option<DocId>, bool),
     pub recent: Vec<RecentFile>,
+    /// How many recent files to keep, 0 for no list (Preferences ▸ Documents and view, #5572).
+    pub recent_limit: usize,
     /// Preferences: reopen the files that were open when PdfCraft last closed (#442).
     pub reopen_last_session: bool,
     /// Restore last view settings when reopening documents (Preferences ▸ Documents and view;
@@ -368,10 +386,21 @@ pub struct PdfCraftApp {
     pending_opens: Vec<PendingOpen>,
     #[cfg(not(target_arch = "wasm32"))]
     next_open_token: u64,
+    /// Explicit CLI layout waits for flagged launch opens, never targeting restored tabs.
+    #[cfg(not(target_arch = "wasm32"))]
+    launch_layout: Option<(canvas::PageLayout, bool)>,
+    #[cfg(not(target_arch = "wasm32"))]
+    launch_display_target: Option<DocId>,
     #[cfg(all(test, not(target_arch = "wasm32")))]
     open_prepare_gate: Option<std::sync::Arc<open_worker::PrepareGate>>,
     /// Folders pinned to Home, and what they held when last listed.
     pub pinned: folders_ui::PinnedFolders,
+    /// The recent files restored from settings, checked off the UI thread (#5682).
+    recent_check: persist::recent_check::RecentCheck,
+    /// Tools pinned to Home, in user-defined order.
+    pub pinned_tools: Vec<String>,
+    /// Search query for the Pin a tool selection dialog.
+    pub pin_tool_search: String,
     pub toast: Option<(String, f64)>,
     /// The form script message the toast shows now, if it shows one: drawn with its title and
     /// icon (#4293).
@@ -537,8 +566,6 @@ pub struct PdfCraftApp {
     pub system_clipboard: bool,
     /// What ⌘V reads instead of the system clipboard (tests).
     pub clipboard_override: Option<create_ui::Clip>,
-    /// V is down as a plain key press (see [`Self::paste_key_released`]).
-    v_pressed: bool,
     /// Attach file: the file to attach instead of asking (tests, automation).
     pub attach_override: Option<(String, Vec<u8>)>,
     /// Duplicate Field: which field and onto which pages.
diff --git a/crates/ui-egui/src/os_clipboard.rs b/crates/ui-egui/src/os_clipboard.rs
new file mode 100644
index 0000000000..9f68bd957b
--- /dev/null
+++ b/crates/ui-egui/src/os_clipboard.rs
@@ -0,0 +1,28 @@
+//! The one way to the operating system's clipboard.
+//!
+//! The system clipboard is a single process-wide resource: on Windows, two threads that
+//! open it at once can corrupt the heap. Every access goes through [`with`], which holds a
+//! lock across the whole open, use and close, so parallel callers (test threads, workers)
+//! take turns instead of racing.
+
+use std::sync::{Mutex, PoisonError};
+
+static LOCK: Mutex<()> = Mutex::new(());
+
+/// Opens the system clipboard, runs `f` on it and closes it, with no other thread inside.
+pub(crate) fn with<T>(f: impl FnOnce(&mut arboard::Clipboard) -> Result<T, arboard::Error>) -> Result<T, arboard::Error> {
+    let _turn = LOCK.lock().unwrap_or_else(PoisonError::into_inner);
+    // Declared after the guard, so it's closed before the lock is released.
+    let mut clipboard = arboard::Clipboard::new()?;
+    f(&mut clipboard)
+}
+
+/// Nonempty text supersedes the app's cached image, even if another clipboard format also exists.
+pub(crate) fn has_text() -> bool {
+    with(|cb| cb.get_text()).is_ok_and(|text| !text.is_empty())
+}
+
+/// The system clipboard as image paste sees it; text takes precedence over a cached image.
+pub(crate) fn for_image_paste() -> Option<crate::create_ui::Clip> {
+    if has_text() { Some(crate::create_ui::Clip::Text(String::new())) } else { crate::create_ui::read_clipboard() }
+}
diff --git a/crates/ui-egui/src/panels/comments_panel.rs b/crates/ui-egui/src/panels/comments_panel.rs
index c549ed8e3e..d54daf5717 100644
--- a/crates/ui-egui/src/panels/comments_panel.rs
+++ b/crates/ui-egui/src/panels/comments_panel.rs
@@ -241,6 +241,10 @@ pub(crate) fn show(
     }
     let mut page = usize::MAX;
     let mut group: Option<String> = None;
+    // A card (or page header) out of view that was measured at this width only takes up its
+    // height: laying out hundreds of them every frame put the panel over the frame budget
+    // (#5488). Shorter lists are laid out whole, so every card stays in the accessibility tree.
+    let virtual_list = roots.len() > LAY_OUT_WHOLE;
     for a in roots {
         if sort != SortBy::Page {
             let g = group_of(a);
@@ -252,48 +256,118 @@ pub(crate) fn show(
             }
         } else if a.page != page {
             page = a.page;
-            let n = page_counts.get(&page).copied().unwrap_or_default();
-            let open = !view.comments.collapsed_pages.contains(&page);
-            ui.add_space(6.0);
-            let clicked = ui
-                .horizontal(|ui| {
-                    let chevron = if open { "chevron-down" } else { "chevron-right" };
-                    let toggle = icons::button(ui, chevron, 18.0, false, if open { tl!("Collapse") } else { tl!("Expand") }).clicked();
-                    let label = ui.add(
-                        egui::Label::new(
-                            egui::RichText::new(crate::i18n::fmt(tl!("Page {label}"), &[("label", &info.pages[page].label)]))
-                                .font(theme::semibold(12.5))
-                                .color(t.text_muted),
-                        )
-                        .sense(Sense::click()),
-                    );
-                    ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
-                        ui.label(egui::RichText::new(n.to_string()).color(t.text_faint).small())
-                    });
-                    toggle || label.clicked()
-                })
-                .inner;
-            if clicked {
-                if open {
-                    view.comments.collapsed_pages.push(page);
-                } else {
-                    view.comments.collapsed_pages.retain(|&c| c != page);
+            // Per document: two documents shown at the same width don't share heights.
+            let header = ui.scope_id().with(("comment-page-header", view.id, page));
+            if !(virtual_list && skip_if_hidden(ui, header)) {
+                let top = ui.cursor().min.y;
+                page_header(ui, t, info, page, page_counts.get(&page).copied().unwrap_or_default(), &mut view.comments.collapsed_pages);
+                if virtual_list {
+                    remember_height(ui, header, top);
                 }
             }
-            ui.add_space(2.0);
         }
         if sort == SortBy::Page && view.comments.collapsed_pages.contains(&a.page) {
             continue;
         }
+        let key = (a.page, a.index);
         let thread = replies_of(a);
+        let selected = view.comments.selected == Some(key);
+        // A height is kept for what the card showed when it was measured: its document, what the
+        // thread says, whether it was the selected card (which draws its menu and editor) and
+        // whether an editor was open on it. An
+        // edit, undo or redo that changes the card measures it afresh; other cards keep theirs.
+        // A card with an editor open on it or on a reply is always drawn too (CodeRabbit on
+        // #5583): a kept height would show it at its size before the editor opened.
+        let editing = view.comments.editing.as_ref().is_some_and(|(p, i, _)| (*p, *i) == key || thread.iter().any(|r| (r.page, r.index) == (*p, *i)));
+        let id = ui.scope_id().with(("comment-card", view.id, key, card_signature(a, thread), selected, editing));
+        // The selected card is always drawn, so it can scroll itself into view and keep its menu
+        // and editor.
+        if virtual_list && !selected && !editing && skip_if_hidden(ui, id) {
+            continue;
+        }
         let rotation = info.pages.get(a.page).map_or(0, |p| p.rotation);
+        let top = ui.cursor().min.y;
         if let Some(e) = card(ui, view, CardContext { theme: t, annotation: a, rotation, thread, doc, prefs, allowed, nav }) {
             edit = Some(e);
         }
+        if virtual_list {
+            remember_height(ui, id, top);
+        }
     }
     edit
 }
 
+/// The "Page N" group header with its fold chevron and comment count `n`; a click folds or
+/// unfolds the page.
+fn page_header(ui: &mut egui::Ui, t: &Tokens, info: &DocInfo, page: usize, n: usize, collapsed: &mut Vec<usize>) {
+    let open = !collapsed.contains(&page);
+    ui.add_space(6.0);
+    let clicked = ui
+        .horizontal(|ui| {
+            let chevron = if open { "chevron-down" } else { "chevron-right" };
+            let toggle = icons::button(ui, chevron, 18.0, false, if open { tl!("Collapse") } else { tl!("Expand") }).clicked();
+            let label = ui.add(
+                egui::Label::new(
+                    egui::RichText::new(crate::i18n::fmt(tl!("Page {label}"), &[("label", info.pages.get(page).map_or("?", |p| p.label.as_str()))]))
+                        .font(theme::semibold(12.5))
+                        .color(t.text_muted),
+                )
+                .sense(Sense::click()),
+            );
+            ui.with_layout(Layout::right_to_left(Align::Center), |ui| ui.label(egui::RichText::new(n.to_string()).color(t.text_faint).small()));
+            toggle || label.clicked()
+        })
+        .inner;
+    ui.add_space(2.0);
+    if clicked {
+        if open {
+            collapsed.push(page);
+        } else {
+            collapsed.retain(|&c| c != page);
+        }
+    }
+}
+
+/// What a card's height depends on in the document: the comment and its replies as shown (their
+/// kind, author, text, date, status, colour and lock). Two cards with the same signature lay out
+/// alike at one width.
+fn card_signature(a: &Annotation, thread: &[&Annotation]) -> u64 {
+    use std::hash::{Hash, Hasher};
+    let mut h = std::collections::hash_map::DefaultHasher::new();
+    for x in std::iter::once(a).chain(thread.iter().copied()) {
+        (&x.subtype, &x.author, &x.contents, &x.modified, &x.state, x.locked).hash(&mut h);
+        x.color.map(|c| c.map(f32::to_bits)).hash(&mut h);
+    }
+    h.finish()
+}
+
+/// Comment lists up to this long are laid out whole; longer ones lay out only what is in view.
+const LAY_OUT_WHOLE: usize = 100;
+
+/// For a part of the list (a card or a page header) that was measured at this width and would
+/// fall out of view: takes up its height without laying it out, and returns `true`.
+fn skip_if_hidden(ui: &mut egui::Ui, id: egui::Id) -> bool {
+    let width = ui.available_width();
+    let Some(height) = ui.data(|d| d.get_temp::<(f32, f32)>(id)).filter(|(w, _)| (w - width).abs() < 0.5).map(|(_, h)| h) else {
+        return false;
+    };
+    if ui.is_rect_visible(egui::Rect::from_min_size(ui.cursor().min, vec2(width, height))) {
+        return false;
+    }
+    ui.allocate_space(vec2(width, height));
+    true
+}
+
+/// Records the height part `id` took since the cursor was at `top`, for [`skip_if_hidden`]: less
+/// the spacing `allocate_space` adds back after it.
+fn remember_height(ui: &egui::Ui, id: egui::Id, top: f32) {
+    let height = ui.cursor().min.y - top - ui.spacing().item_spacing.y;
+    if height.is_finite() && height > 0.0 {
+        let width = ui.available_width();
+        ui.data_mut(|d| d.insert_temp(id, (width, height)));
+    }
+}
+
 /// Draw one comment thread card, including author, body or inline editor, replies, status and per-comment
 /// actions; returns an edit to apply.
 struct CardContext<'a> {
diff --git a/crates/ui-egui/src/panels/edit.rs b/crates/ui-egui/src/panels/edit.rs
index e95db85a72..2c2fb7a09a 100644
--- a/crates/ui-egui/src/panels/edit.rs
+++ b/crates/ui-egui/src/panels/edit.rs
@@ -55,6 +55,7 @@ pub(super) fn edit_panel(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens, g
     // Format text at the top while text is selected or being added.
     format_section(app, ui, t);
     egui::ScrollArea::vertical().auto_shrink([false, false]).show(ui, |ui| {
+        super::tools::clear_of_scrollbar(ui);
         widgets::section_title(ui, tl!("Modify page"));
         ui.horizontal(|ui| {
             ui.spacing_mut().item_spacing.x = 6.0;
@@ -185,6 +186,7 @@ pub(super) fn stamp_palette(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens
     use pdfcraft_engine::{StampGroup, StampKind};
     ui.label(egui::RichText::new(tl!("Choose a stamp, then click on the page to place it.")).small().color(t.text_faint));
     egui::ScrollArea::vertical().auto_shrink([false, false]).show(ui, |ui| {
+        super::tools::clear_of_scrollbar(ui);
         for (group, title) in [
             (StampGroup::Dynamic, tl!("Dynamic")),
             (StampGroup::SignHere, tl!("Sign Here")),
@@ -266,11 +268,27 @@ fn format_section(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens) {
             .into_iter()
             .map(|f| (f.resource, f.face))
             .collect();
-        let shown = ed.font_shown(&sources);
+        let fmt = ed.selection_formatting(&sources);
+        ed.sync_selection_look(&fmt);
+        let shown = fmt.font_shown;
+        let mixed_size = fmt.size.is_none();
         // A selection aligns the rows it touches; the caret alone, the whole paragraph.
         let paragraphs = crate::format_text_ui::Paragraphs { text: &ed.text, selection: ed.selection.clone(), tidy: false };
-        let out = crate::format_text_ui::panel(ui, t, &mut ed.look, Some(&mut ed.extras), Fonts { sources: Some(&sources), shown }, Some(paragraphs));
+        let out = crate::format_text_ui::panel(
+            ui,
+            t,
+            &mut ed.look,
+            Some(&mut ed.extras),
+            Fonts { sources: Some(&sources), shown, mixed_size },
+            Some(paragraphs),
+        );
+        if out.size_committed {
+            ed.choose_size(ed.look.size);
+        }
         let mut changed = out.changed;
+        if let Some(script) = out.script {
+            changed |= crate::edit_text_ui::toggle_script(&mut ed.text, &mut ed.selection, script);
+        }
         match out.font {
             Some(FontChoice::KeepSource) => {
                 ed.keep_source_font();
@@ -305,7 +323,13 @@ fn format_section(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens) {
         }
         let mut style = draft.style.clone();
         let paragraphs = crate::format_text_ui::Paragraphs { text: &draft.text, selection: draft.selection.clone(), tidy: true };
-        added_text_format(ui, t, &mut style, Some(paragraphs));
+        let out = added_text_format(ui, t, &mut style, Some(paragraphs));
+        if let Some(script) = out.script {
+            let mut toggled = draft.clone();
+            if crate::edit_text_ui::toggle_script(&mut toggled.text, &mut toggled.selection, script) {
+                app.views[i].content.draft = Some(toggled);
+            }
+        }
         if style != draft.style {
             app.restyle_draft(i, style);
         }
@@ -363,12 +387,18 @@ fn format_section(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens) {
 
 /// Format text for added text: the standard families, size, colour, style and alignment
 /// (of the lines `paragraphs` selects, while the text is being typed).
-fn added_text_format(ui: &mut egui::Ui, t: &Tokens, style: &mut pdfcraft_engine::AddedText, paragraphs: Option<crate::format_text_ui::Paragraphs>) {
+fn added_text_format(
+    ui: &mut egui::Ui,
+    t: &Tokens,
+    style: &mut pdfcraft_engine::AddedText,
+    paragraphs: Option<crate::format_text_ui::Paragraphs>,
+) -> crate::format_text_ui::Outcome {
     let shown = style.family.label().to_string();
-    let out = crate::format_text_ui::panel(ui, t, style, None, crate::format_text_ui::Fonts { sources: None, shown }, paragraphs);
+    let out = crate::format_text_ui::panel(ui, t, style, None, crate::format_text_ui::Fonts { sources: None, shown, mixed_size: false }, paragraphs);
     if let Some(crate::format_text_ui::FontChoice::Family(family)) = out.font {
         style.family = family;
     }
+    out
 }
 
 impl PdfCraftApp {
diff --git a/crates/ui-egui/src/panels/format_text_ui.rs b/crates/ui-egui/src/panels/format_text_ui.rs
index eccef2aa79..99ffc054e1 100644
--- a/crates/ui-egui/src/panels/format_text_ui.rs
+++ b/crates/ui-egui/src/panels/format_text_ui.rs
@@ -3,12 +3,13 @@
 //! horizontal scale and character spacing. One panel serves a paragraph being edited (with the
 //! fonts already on its page and the spacing controls) and added text (the standard families,
 //! size, colour, style, alignment and character spacing). What PdfCraft can't apply yet (lists,
-//! superscript and subscript, paragraph spacing, or line spacing and scale for added text) is shown
+//! paragraph spacing, or line spacing and scale for added text) is shown
 //! disabled and says so.
 //!
 //! The icons are Lucide's (AGENTS.md §1); only the arrangement follows Acrobat.
 
 use egui::{Align, Color32, CornerRadius, Layout, Rect, Sense, Stroke, vec2};
+use pdfcraft_engine::text_script::Script;
 use pdfcraft_engine::{AddedText, FontFamily, TextAlign};
 
 use crate::edit_text_ui::Extras;
@@ -38,6 +39,7 @@ pub(crate) struct Fonts<'a> {
     pub sources: Option<&'a [(String, String)]>,
     /// The name the list shows for the current choice.
     pub shown: String,
+    pub mixed_size: bool,
 }
 
 /// Text being typed in, for the alignment buttons: with some of it selected, they show and set the
@@ -85,7 +87,10 @@ impl Paragraphs<'_> {
 #[derive(Default)]
 pub(crate) struct Outcome {
     pub changed: bool,
+    pub size_committed: bool,
     pub font: Option<FontChoice>,
+    /// Superscript or Subscript was clicked, for the selected paragraphs' text.
+    pub script: Option<Script>,
 }
 
 const SIZES: [f64; 16] = [4.0, 6.0, 8.0, 9.0, 10.0, 11.0, 12.0, 14.0, 16.0, 18.0, 20.0, 24.0, 28.0, 36.0, 48.0, 72.0];
@@ -102,6 +107,23 @@ const LABEL_ICON: f32 = 22.0;
 /// The button beside a number field that opens its list of common values: just an arrow, so the
 /// field keeps the room its value needs.
 const PRESET_LIST: f32 = 22.0;
+/// The room a number field keeps for its value ("-5.0 pt"), beside the arrow in its box.
+const NUMBER_MIN: f32 = 52.0;
+/// The size field's room in the row: English "Mixed", its margins and the 2 pt of its box. The
+/// field reserves room for "Mixed" so it doesn't resize while typing, but no more than this.
+/// shortcut: a longer translation of "Mixed" scrolls in the field. Upgrade by having the panel
+/// report its measured row width to the pane, if that reads badly.
+const SIZE_FIELD: f32 = 62.0;
+/// The least width the panel's widest rows need, which sets how narrow the Tools pane may be
+/// dragged. Size and alignment: the size field and its arrow (in their box), the swatch, the
+/// divider, three 30 pt buttons, and the gaps between those six. The spacing rows: two icons and
+/// two number fields with their arrows (in a box each), the space between the columns, and four
+/// gaps.
+pub(crate) const MIN_ROW: f32 = {
+    let size_row = (SIZE_FIELD + PRESET_LIST + 2.0) + 28.0 + 9.0 + 3.0 * 30.0 + 5.0 * GAP;
+    let spacing_row = 2.0 * LABEL_ICON + 2.0 * (NUMBER_MIN + PRESET_LIST + 2.0) + 8.0 + 4.0 * GAP;
+    if size_row > spacing_row { size_row } else { spacing_row }
+};
 /// What can be typed: horizontal scale in percent, character spacing in points.
 const SCALE_RANGE: std::ops::RangeInclusive<f64> = 10.0..=400.0;
 const CHAR_SPACING_RANGE: std::ops::RangeInclusive<f64> = -5.0..=50.0;
@@ -125,58 +147,122 @@ pub(crate) fn panel(
     widgets::section_title(ui, tl!("Format text"));
 
     // The font, across the panel.
+    ui.spacing_mut().combo_height = 360.0;
     let width = ui.available_width();
-    craft_ui::ComboBox::from_id_salt("format-font")
-        .selected_text(fonts.shown.as_str())
-        .width(width)
-        .show_ui(ui, |ui| {
-            if let Some(sources) = fonts.sources {
-                if ui.selectable_label(false, tl!("Keep source fonts")).clicked() {
-                    out.font = Some(FontChoice::KeepSource);
-                }
-                for (resource, face) in sources.iter().filter(|(r, _)| !r.starts_with("PCApproved")) {
-                    if ui.selectable_label(false, face).clicked() {
-                        out.font = Some(FontChoice::Resource(resource.clone()));
+    let font_resp = outlined(ui, |ui| {
+        craft_ui::ComboBox::from_id_salt("format-font")
+            .selected_text(fonts.shown.as_str())
+            .width(width)
+            .show_ui(ui, |ui| {
+                if let Some(sources) = fonts.sources {
+                    if ui.selectable_label(false, tl!("Keep source fonts")).clicked() {
+                        out.font = Some(FontChoice::KeepSource);
                     }
-                }
-                ui.separator();
-            }
-            for f in [FontFamily::Helvetica, FontFamily::Times, FontFamily::Courier] {
-                if ui.selectable_label(fonts.sources.is_none() && look.family == f, f.label()).clicked() {
-                    out.font = Some(FontChoice::Family(f));
-                }
-            }
-            if fonts.sources.is_some() {
-                ui.separator();
-                if ui.selectable_label(false, tl!("Load font…")).clicked() {
-                    out.font = Some(FontChoice::Load);
-                }
-                #[cfg(not(target_arch = "wasm32"))]
-                ui.menu_button(tl!("Installed fonts…"), |ui| match crate::files::installed_font_files(ui.ctx()) {
-                    Some(list) if list.is_empty() => {
-                        ui.label(tl!("No openly licensed document fonts found. Load a font file."));
-                    }
-                    Some(list) => {
-                        for font in list {
-                            if ui.button(&font.face).clicked() {
-                                out.font = Some(FontChoice::Installed(font.path));
-                                ui.close();
-                            }
+                    for (resource, face) in sources.iter().filter(|(r, _)| !r.starts_with("PCApproved")) {
+                        if ui.selectable_label(false, face).clicked() {
+                            out.font = Some(FontChoice::Resource(resource.clone()));
                         }
                     }
-                    None => {
-                        ui.label(tl!("Finding document fonts…"));
+                    ui.separator();
+                }
+                for f in [FontFamily::Helvetica, FontFamily::Times, FontFamily::Courier] {
+                    if ui.selectable_label(fonts.sources.is_none() && look.family == f, f.label()).clicked() {
+                        out.font = Some(FontChoice::Family(f));
                     }
-                });
-            }
-        })
-        .response
-        .on_hover_text(format!("{}\n{}", tl!("Font"), tl!("Thai and Arabic use regular fallback fonts when available.")));
+                }
+                if fonts.sources.is_some() {
+                    ui.separator();
+                    if ui.selectable_label(false, tl!("Load font…")).clicked() {
+                        out.font = Some(FontChoice::Load);
+                    }
+                    #[cfg(not(target_arch = "wasm32"))]
+                    ui.menu_button(tl!("Installed fonts…"), |ui| {
+                        ui.set_min_width(260.0);
+                        let reload = ui.button(tl!("Reload")).clicked();
+                        match crate::files::installed_font_files(ui.ctx(), reload) {
+                            Some(list) if list.is_empty() => {
+                                ui.label(tl!("No openly licensed document fonts found. Load a font file."));
+                            }
+                            Some(list) => {
+                                let search_id = ui.scope_id().with("installed-font-search");
+                                let mut query = ui.data(|d| d.get_temp::<String>(search_id)).unwrap_or_default();
+                                ui.horizontal(|ui| {
+                                    let (icon_rect, _) = ui.allocate_exact_size(egui::vec2(16.0, 16.0), egui::Sense::hover());
+                                    crate::icons::paint(ui, icon_rect, "search", 13.0, ui.visuals().text_color().gamma_multiply(0.6));
+                                    let resp = ui.add(
+                                        egui::TextEdit::singleline(&mut query).hint_text(tl!("Search…")).desired_width(ui.available_width() - 8.0),
+                                    );
+                                    if resp.changed() {
+                                        ui.data_mut(|d| d.insert_temp(search_id, query.clone()));
+                                    }
+                                });
+                                ui.separator();
+
+                                let query_lower = query.trim().to_lowercase();
+                                let mut families: std::collections::BTreeMap<&str, Vec<&pdfcraft_engine::text_fonts::FontFile>> =
+                                    std::collections::BTreeMap::new();
+                                for font in &list {
+                                    if query_lower.is_empty()
+                                        || font.family.to_lowercase().contains(&query_lower)
+                                        || font.face.to_lowercase().contains(&query_lower)
+                                    {
+                                        families.entry(&font.family).or_default().push(font);
+                                    }
+                                }
+
+                                if families.is_empty() {
+                                    ui.label(tl!("No openly licensed document fonts found. Load a font file."));
+                                } else {
+                                    egui::ScrollArea::vertical().max_height(350.0).show(ui, |ui| {
+                                        for (family, faces) in families {
+                                            if faces.len() == 1 {
+                                                if let Some(&font) = faces.first() {
+                                                    let label =
+                                                        if font.face != font.family && !font.face.is_empty() { font.face.as_str() } else { family };
+                                                    if ui.button(label).clicked() {
+                                                        out.font = Some(FontChoice::Installed(font.path.clone()));
+                                                        ui.close();
+                                                    }
+                                                }
+                                            } else {
+                                                ui.menu_button(family, |ui| {
+                                                    ui.set_min_width(180.0);
+                                                    for font in faces {
+                                                        let label = font
+                                                            .face
+                                                            .strip_prefix(family)
+                                                            .map(str::trim)
+                                                            .filter(|s| !s.is_empty())
+                                                            .unwrap_or(&font.face);
+                                                        if ui.button(label).clicked() {
+                                                            out.font = Some(FontChoice::Installed(font.path.clone()));
+                                                            ui.close();
+                                                        }
+                                                    }
+                                                });
+                                            }
+                                        }
+                                    });
+                                }
+                            }
+                            None => {
+                                ui.label(tl!("Finding document fonts…"));
+                            }
+                        }
+                    });
+                    ui.add_space(4.0);
+                }
+            })
+            .response
+    });
+    font_resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::ComboBox, ui.is_enabled(), tl!("Font")));
+    font_resp.on_hover_text(format!("{}\n{}", tl!("Font"), tl!("Thai and Arabic use regular fallback fonts when available.")));
     ui.add_space(4.0);
 
     // Size and colour | bullets, numbering and alignment.
+    let mut size_committed = false;
     row(ui, |ui| {
-        font_size_input(ui, &mut look.size);
+        size_committed = font_size_input(ui, &mut look.size, fonts.mixed_size);
         let swatch = colour_button(ui, t, look.color);
         egui::Popup::menu(&swatch).close_behavior(egui::PopupCloseBehavior::CloseOnClickOutside).show(|ui| {
             if let Some(picked) = crate::comments::swatch_grid(ui, Some(look.color)) {
@@ -241,37 +327,64 @@ pub(crate) fn panel(
             }
             None => planned(ui, "underline", tl!("Underline")),
         }
-        planned(ui, "superscript", tl!("Superscript"));
-        planned(ui, "subscript", tl!("Subscript"));
+        if let Some(p) = &paragraphs {
+            for (script, icon, tip) in [(Script::Super, "superscript", tl!("Superscript")), (Script::Sub, "subscript", tl!("Subscript"))] {
+                let on = pdfcraft_engine::text_script::is_in(p.text, p.selection.as_ref(), script);
+                if icons::button(ui, icon, 30.0, on, tip).clicked() {
+                    out.script = Some(script);
+                }
+            }
+        } else {
+            planned(ui, "superscript", tl!("Superscript"));
+            planned(ui, "subscript", tl!("Subscript"));
+        }
     });
 
     // Line and paragraph spacing; horizontal scale and character spacing: two columns, each an
     // icon and its control, `half` wide.
-    let half = ((ui.available_width() - 2.0 * LABEL_ICON - 8.0 - 3.0 * GAP) / 2.0).max(40.0);
+    // From the font list's width, not what is left now: a row above that overflows (a long
+    // translation of "Mixed" in the size field) widens the panel's layout.
+    let half = ((width - 2.0 * LABEL_ICON - 8.0 - 3.0 * GAP) / 2.0).max(40.0);
     let editing = extras.is_some();
     let mut fallback = Extras::default();
     let e = extras.as_deref_mut().unwrap_or(&mut fallback);
     ui.add_enabled_ui(editing, |ui| {
         row(ui, |ui| {
-            labelled_icon(ui, t, "arrow-up-down", tl!("Line spacing"));
+            let label = labelled_icon(ui, t, "arrow-up-down", tl!("Line spacing"));
             let own = tl!("Auto").to_string();
             let shown = if e.line_spacing == 0.0 { own.clone() } else { number(e.line_spacing) };
-            craft_ui::ComboBox::from_id_salt("format-line-spacing").selected_text(shown).width(half).show_ui(ui, |ui| {
-                ui.selectable_value(&mut e.line_spacing, 0.0, own.as_str());
-                for v in LINE_SPACINGS {
-                    ui.selectable_value(&mut e.line_spacing, v, number(v));
-                }
+            outlined(ui, |ui| {
+                // The column is `half` wide in every language: a longer "Auto" is cut short (the
+                // menu and the tooltip have it whole).
+                ui.set_max_width(half);
+                let spacing_resp = craft_ui::ComboBox::from_id_salt("format-line-spacing")
+                    .selected_text(centred(ui, &shown))
+                    .width(half)
+                    .wrap_mode(egui::TextWrapMode::Truncate)
+                    .show_ui(ui, |ui| {
+                        ui.selectable_value(&mut e.line_spacing, 0.0, own.as_str());
+                        for v in LINE_SPACINGS {
+                            ui.selectable_value(&mut e.line_spacing, v, number(v));
+                        }
+                    })
+                    .response
+                    .labelled_by(label.id);
+                spacing_resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::ComboBox, ui.is_enabled(), tl!("Line spacing")));
+                spacing_resp.on_hover_text(&shown);
             });
             ui.add_space(8.0);
             ui.add_enabled_ui(false, |ui| {
-                labelled_icon(ui, t, "pilcrow", tl!("Paragraph spacing"));
+                let label = labelled_icon(ui, t, "pilcrow", tl!("Paragraph spacing"));
                 let tip = format!("{} — {}", tl!("Paragraph spacing"), tl!("Planned"));
-                let _ = craft_ui::ComboBox::from_id_salt("format-paragraph-spacing")
-                    .selected_text("0")
-                    .width(half)
-                    .show_ui(ui, |_| {})
-                    .response
-                    .on_disabled_hover_text(tip);
+                let _ = outlined(ui, |ui| {
+                    craft_ui::ComboBox::from_id_salt("format-paragraph-spacing")
+                        .selected_text(centred(ui, "0"))
+                        .width(half)
+                        .show_ui(ui, |_| {})
+                        .response
+                        .labelled_by(label.id)
+                        .on_disabled_hover_text(tip)
+                });
             });
         });
     });
@@ -290,12 +403,29 @@ pub(crate) fn panel(
         number_with_presets(ui, spacing, &CHAR_SPACINGS, half, (label.id, tl!("Character spacing")));
     });
 
-    out.changed = (look.clone(), extras.as_deref().copied()) != before;
+    out.size_committed = size_committed;
+    out.changed = out.changed || size_committed || (look.clone(), extras.as_deref().copied()) != before;
     ui.add_space(6.0);
     ui.separator();
     out
 }
 
+/// Runs `add` with the panel's fields outlined and filled, so a list or number field reads as one
+/// beside the plain icon buttons around it.
+fn outlined<R>(ui: &mut egui::Ui, add: impl FnOnce(&mut egui::Ui) -> R) -> R {
+    ui.scope(|ui| {
+        let t = Tokens::get(ui.ctx());
+        let w = &mut ui.visuals_mut().widgets;
+        w.inactive.weak_bg_fill = t.field;
+        w.inactive.bg_stroke = Stroke::new(1.0, t.border);
+        w.hovered.bg_stroke = Stroke::new(1.0, t.text_muted);
+        // A list's text, pad and arrow touch: its gaps would widen it past the column it is given.
+        ui.spacing_mut().icon_spacing = 0.0;
+        add(ui)
+    })
+    .inner
+}
+
 /// One row of the panel, [`ROW`] high, its controls [`GAP`] apart and centred on it.
 fn row<R>(ui: &mut egui::Ui, add: impl FnOnce(&mut egui::Ui) -> R) -> R {
     let size = vec2(ui.available_width(), ROW);
@@ -344,15 +474,48 @@ struct Number<'a> {
     suffix: &'static str,
 }
 
+/// A combo box's selected text, centred in its button. The button lays out the text and then its
+/// arrow, and every growing atom takes an equal share of the room left: a pad as wide as the arrow
+/// before the text balances the arrow after it, and the text centres itself in its own share. Text
+/// longer than the list is wide (a translated "Auto") is cut short rather than widening it.
+fn centred<'a>(ui: &egui::Ui, text: &str) -> egui::Atoms<'a> {
+    use egui::AtomExt as _;
+    let pad = egui::Atom::custom(egui::IdSalt::new("combo-pad"), vec2(ui.spacing().icon_width, 0.0)).atom_grow(true);
+    let text = egui::Atom::from(text.to_string()).atom_grow(true).atom_shrink(true).atom_align(egui::Align2::CENTER_CENTER);
+    egui::Atoms::new((pad, text))
+}
+
+/// The arrow that lists a field's common values, centred on the 26-point field beside it.
+fn preset_arrow(ui: &mut egui::Ui, label: &str) -> egui::Response {
+    let (slot, _) = ui.allocate_exact_size(vec2(PRESET_LIST, 26.0), Sense::hover());
+    let at = Rect::from_center_size(slot.center(), vec2(PRESET_LIST, PRESET_LIST));
+    ui.scope_builder(egui::UiBuilder::new().max_rect(at), |ui| icons::button(ui, "chevron-down", PRESET_LIST, false, label)).inner
+}
+
+/// One box round a value and its arrow, like a list's, so the pair reads as a single control.
+fn boxed(ui: &mut egui::Ui, add: impl FnOnce(&mut egui::Ui)) {
+    let t = Tokens::get(ui.ctx());
+    let edge = if ui.is_enabled() { t.border } else { t.border.gamma_multiply(0.5) };
+    egui::Frame::new().fill(t.field).stroke(Stroke::new(1.0, edge)).corner_radius(CornerRadius::same(4)).show(ui, |ui| {
+        let w = &mut ui.visuals_mut().widgets;
+        for state in [&mut w.inactive, &mut w.hovered, &mut w.active, &mut w.open] {
+            state.bg_stroke = Stroke::NONE;
+        }
+        w.inactive.weak_bg_fill = Color32::TRANSPARENT;
+        ui.spacing_mut().item_spacing.x = 0.0;
+        ui.spacing_mut().button_padding.x = 2.0;
+        add(ui);
+    });
+}
+
 /// A number field with an arrow beside it that lists common values, in `width` all told: type any
 /// value in its range, or pick one. Both are named by `label`: the icon before them and its text.
 fn number_with_presets(ui: &mut egui::Ui, n: Number<'_>, presets: &[f64], width: f32, label: (egui::Id, &str)) {
-    ui.scope(|ui| {
-        ui.spacing_mut().item_spacing.x = 2.0;
+    boxed(ui, |ui| {
         let field = egui::DragValue::new(&mut *n.value).range(n.range).speed(n.speed).max_decimals(2).suffix(n.suffix);
-        let height = ui.spacing().interact_size.y;
-        ui.add_sized([(width - PRESET_LIST - 2.0).max(30.0), height], field).labelled_by(label.0);
-        let list = icons::button(ui, "chevron-down", PRESET_LIST, false, label.1);
+        let drag_resp = ui.add_sized([(width - PRESET_LIST - 2.0).max(30.0), 26.0], field).labelled_by(label.0);
+        drag_resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::SpinButton, ui.is_enabled(), label.1));
+        let list = preset_arrow(ui, label.1);
         egui::Popup::menu(&list).show(|ui| {
             for &v in presets {
                 if ui.selectable_label(*n.value == v, number(v)).clicked() {
@@ -378,31 +541,62 @@ fn colour_button(ui: &mut egui::Ui, t: &Tokens, color: [f64; 3]) -> egui::Respon
 
 /// Commit a typed size once (Enter or leaving the field), rather than one undo step per key.
 /// The bounds match AddedText validation, so the panel also accepts coloured text below 8 pt.
-fn font_size_input(ui: &mut egui::Ui, size: &mut f64) {
-    ui.scope(|ui| {
-        ui.spacing_mut().item_spacing.x = 2.0;
+fn font_size_input(ui: &mut egui::Ui, size: &mut f64, mixed: bool) -> bool {
+    let mut committed = false;
+    // The panel's own padding, read before the box tightens it, so "Mixed" keeps its margins.
+    let margin = egui::Margin::from(ui.spacing().button_padding);
+    boxed(ui, |ui| {
         let id = ui.make_persistent_id("font-size-input");
-        let (previous, mut text) = ui.data(|d| d.get_temp::<(u64, String)>(id)).unwrap_or_else(|| (size.to_bits(), size.to_string()));
-        if previous != size.to_bits() {
-            text = size.to_string();
+        let initial_text = || {
+            if mixed || *size <= 0.0 { tl!("Mixed").to_string() } else { size.to_string() }
+        };
+        // A selection can become mixed without changing its representative numeric size.
+        let (previous, previous_mixed, mut text) =
+            ui.data(|d| d.get_temp::<(u64, bool, String)>(id)).unwrap_or_else(|| (size.to_bits(), mixed, initial_text()));
+        if previous != size.to_bits() || previous_mixed != mixed {
+            text = initial_text();
+        }
+        // Reserve the localized mixed label, field margins and caret without resizing while typing.
+        let font = egui::TextStyle::Body.resolve(ui.style());
+        let mixed_width = ui.painter().layout_no_wrap(tl!("Mixed").into(), font.clone(), ui.visuals().text_color()).size().x;
+        // Within the row's allowance, so a long translation ("Valeurs différentes") scrolls in the
+        // field rather than pushing the row past the pane.
+        let width = (mixed_width + margin.sum().x + 2.0).ceil().clamp(40.0, SIZE_FIELD - 2.0);
+        let field = egui::TextEdit::singleline(&mut text)
+            .id(id)
+            .font(font)
+            .margin(margin)
+            .desired_width(width)
+            .frame(egui::Frame::NONE)
+            .align(egui::Align2::CENTER_CENTER);
+        let mut response = ui.add_sized([width, 26.0], field).accessible_name(tl!("Font size:"));
+        // A long translation of "Mixed" scrolls in the field: the tooltip has it whole.
+        if mixed {
+            response = response.on_hover_text(tl!("Mixed"));
         }
-        let field = egui::TextEdit::singleline(&mut text).id(id).desired_width(40.0);
-        let response = ui.add_sized([40.0, ui.spacing().interact_size.y], field).accessible_name(tl!("Font size:"));
         let cancel = (response.has_focus() || response.lost_focus()) && ui.input(|i| i.key_pressed(egui::Key::Escape));
         if cancel {
-            text = size.to_string();
+            text = initial_text();
             response.surrender_focus();
         } else if response.lost_focus() || (response.has_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter))) {
             if let Some(value) = typed_font_size(&text) {
+                if mixed || *size != value {
+                    committed = true;
+                }
                 *size = value;
+                text = size.to_string();
+            } else {
+                text = initial_text();
             }
-            text = size.to_string();
         }
         let before = *size;
-        let list = icons::button(ui, "chevron-down", PRESET_LIST, false, tl!("Font size"));
+        let list = preset_arrow(ui, tl!("Font size"));
         egui::Popup::menu(&list).show(|ui| {
             for value in SIZES {
                 if ui.selectable_label(*size == value, format!("{value} pt")).clicked() {
+                    if mixed || *size != value {
+                        committed = true;
+                    }
                     *size = value;
                     ui.close();
                 }
@@ -411,8 +605,9 @@ fn font_size_input(ui: &mut egui::Ui, size: &mut f64) {
         if *size != before {
             text = size.to_string();
         }
-        ui.data_mut(|d| d.insert_temp(id, (size.to_bits(), text)));
+        ui.data_mut(|d| d.insert_temp(id, (size.to_bits(), mixed, text)));
     });
+    committed
 }
 
 fn typed_font_size(text: &str) -> Option<f64> {
@@ -447,12 +642,87 @@ mod typed_size_tests {
         }
     }
 
+    #[test]
+    fn mixed_size_label_fits_the_themed_panel() {
+        crate::i18n::set_current(crate::i18n::Lang::EN);
+        let mut ready = false;
+        let mut h = egui_kittest::Harness::builder().with_size(vec2(272.0, 500.0)).with_accessibility_check(false).build_ui_state(
+            move |ui, look: &mut AddedText| {
+                if !ready {
+                    egui_extras::install_image_loaders(ui.ctx());
+                    crate::theme::install_fonts(ui.ctx());
+                    crate::theme::apply(ui.ctx(), crate::theme::ThemeKind::Light);
+                    ready = true;
+                    return;
+                }
+                let fonts = Fonts { sources: Some(&[]), shown: tl!("Mixed").into(), mixed_size: true };
+                panel(ui, &Tokens::get(ui.ctx()), look, None, fonts, None);
+            },
+            AddedText::default(),
+        );
+        h.run_steps(4);
+        let field = h.get_by_role_and_label(egui::accesskit::Role::TextInput, "Font size:");
+        let style = h.ctx.global_style();
+        let font = egui::TextStyle::Body.resolve(&style);
+        let width = h.ctx.fonts_mut(|fonts| fonts.layout_no_wrap(tl!("Mixed").into(), font, Color32::BLACK).size().x);
+        let padding = 2.0 * style.spacing.button_padding.x;
+        assert!(field.rect().width() - padding >= width, "Mixed must fit inside the input margins");
+        assert!(h.get_by_label("Alignment").rect().right() <= 272.0, "the wider size field must leave room for the rest of the format row");
+        if let Ok(path) = std::env::var("PDFCRAFT_MIXED_PANEL_SHOT") {
+            h.render().unwrap().save(path).unwrap();
+        }
+    }
+
+    #[test]
+    fn mixed_size_changes_refresh_the_field_without_discarding_a_draft() {
+        let mut h = egui_kittest::Harness::new_ui_state(
+            |ui, state: &mut (f64, bool, usize)| {
+                if font_size_input(ui, &mut state.0, state.1) {
+                    state.1 = false;
+                    state.2 += 1;
+                }
+            },
+            (12.0, false, 0),
+        );
+        h.run();
+        let field =
+            |h: &egui_kittest::Harness<'_, (f64, bool, usize)>| h.get_by_role_and_label(egui::accesskit::Role::TextInput, "Font size:").value();
+        assert_eq!(field(&h).as_deref(), Some("12"));
+        h.state_mut().0 = 24.0;
+        h.run_steps(2);
+        assert_eq!(field(&h).as_deref(), Some("24"), "the heading selection updates the size");
+        h.state_mut().1 = true;
+        h.run_steps(2);
+        assert_eq!(field(&h).as_deref(), Some("Mixed"), "collapsing to a mixed block must refresh even when its representative size stays 24");
+        if let Ok(path) = std::env::var("PDFCRAFT_MIXED_SIZE_SHOT") {
+            h.render().unwrap().save(path).unwrap();
+        }
+        h.state_mut().1 = false;
+        h.run_steps(2);
+        assert_eq!(field(&h).as_deref(), Some("24"), "selecting the heading again clears Mixed without a numeric change");
+        h.state_mut().1 = true;
+        h.run_steps(2);
+        h.get_by_role_and_label(egui::accesskit::Role::TextInput, "Font size:").click();
+        h.run();
+        h.event(egui::Event::Key { key: egui::Key::A, physical_key: None, pressed: true, repeat: false, modifiers: egui::Modifiers::COMMAND });
+        h.event(egui::Event::Text("1".into()));
+        h.run_steps(3);
+        assert_eq!(field(&h).as_deref(), Some("1"), "an unchanged mixed style must preserve the draft");
+        h.event(egui::Event::Text("8".into()));
+        h.run_steps(3);
+        assert_eq!(field(&h).as_deref(), Some("18"));
+        assert_eq!(*h.state(), (24.0, true, 0), "typing does not apply a formatting change");
+        h.event(egui::Event::Key { key: egui::Key::Enter, physical_key: None, pressed: true, repeat: false, modifiers: egui::Modifiers::NONE });
+        h.run_steps(2);
+        assert_eq!(*h.state(), (18.0, false, 1));
+    }
+
     #[test]
     fn typed_size_commits_once_and_invalid_input_preserves_the_style() {
         let mut h = egui_kittest::Harness::new_ui_state(
             |ui, state: &mut (f64, usize)| {
                 let before = state.0;
-                ui.horizontal(|ui| font_size_input(ui, &mut state.0));
+                ui.horizontal(|ui| font_size_input(ui, &mut state.0, false));
                 if state.0 != before {
                     state.1 += 1;
                 }
@@ -481,7 +751,7 @@ mod typed_size_tests {
         let mut h = egui_kittest::Harness::new_ui_state(
             |ui, state: &mut (f64, usize)| {
                 let before = state.0;
-                ui.horizontal(|ui| font_size_input(ui, &mut state.0));
+                ui.horizontal(|ui| font_size_input(ui, &mut state.0, false));
                 let _ = ui.button("Other control");
                 if state.0 != before {
                     state.1 += 1;
diff --git a/crates/ui-egui/src/panels/page_selection_ui.rs b/crates/ui-egui/src/panels/page_selection_ui.rs
index eb97b16b09..deb811768e 100644
--- a/crates/ui-egui/src/panels/page_selection_ui.rs
+++ b/crates/ui-egui/src/panels/page_selection_ui.rs
@@ -22,7 +22,9 @@ pub(crate) fn parse(text: &str, count: usize) -> Result<Vec<usize>, PrintError>
     let mut pages = BTreeSet::new();
     let mut budget = 1_000_000usize;
     let number = |token: &str| {
-        let n = token.trim().parse::<usize>().map_err(|_| PrintError::NotAPage(token.into()))?;
+        let t = token.trim();
+        let n =
+            if t.bytes().all(|b| b.is_ascii_digit()) { t.parse::<usize>().ok() } else { None }.ok_or_else(|| PrintError::NotAPage(token.into()))?;
         if n == 0 || n > count { Err(PrintError::OutOfRange(n, count)) } else { Ok(n - 1) }
     };
     for part in text.split([',', ';']).map(str::trim) {
@@ -132,6 +134,13 @@ impl PageSelectionInput {
 mod tests {
     use super::*;
 
+    #[test]
+    fn plus_sign_is_not_a_page_number() {
+        for text in ["+3", "+2-4", "2-+4"] {
+            assert!(matches!(parse(text, 100), Err(PrintError::NotAPage(_))), "{text}");
+        }
+    }
+
     #[test]
     fn selection_ranges_are_sorted_unique_and_bounded() {
         let pages = parse("1,12,16-18,89,92,93,97,99", 100).unwrap();
diff --git a/crates/ui-egui/src/panels/side_panels.rs b/crates/ui-egui/src/panels/side_panels.rs
index 71c3baa648..3676d9762b 100644
--- a/crates/ui-egui/src/panels/side_panels.rs
+++ b/crates/ui-egui/src/panels/side_panels.rs
@@ -17,7 +17,10 @@ use crate::{Mode, PdfCraftApp};
 pub const TOOLS_WIDTH: f32 = 272.0;
 /// Default width of the side panel.
 pub const SIDE_WIDTH: f32 = 330.0;
-const TOOLS_RANGE: RangeInclusive<f32> = 240.0..=520.0;
+/// The Tools pane's own margins, left and right (14 pt each, and a pt of border), around what a panel lays out.
+const TOOLS_GUTTERS: f32 = 30.0;
+/// No narrower than Format text's widest row, so nothing in it is cut off.
+const TOOLS_RANGE: RangeInclusive<f32> = (crate::format_text_ui::MIN_ROW + TOOLS_GUTTERS)..=520.0;
 const SIDE_RANGE: RangeInclusive<f32> = 260.0..=520.0;
 /// Version of the saved `side_panels` value.
 const VERSION: u64 = 1;
@@ -65,13 +68,14 @@ pub struct SidePanels {
     /// The one setting that places the Tools pane; [`SidePanels::tools_edge`] is its only reader
     /// in the layout.
     pub tools_side: ToolsSide,
+    pub rail_side: ToolsSide,
     pub tools_width: f32,
     pub side_width: f32,
 }
 
 impl Default for SidePanels {
     fn default() -> Self {
-        Self { tools_side: ToolsSide::Left, tools_width: TOOLS_WIDTH, side_width: SIDE_WIDTH }
+        Self { tools_side: ToolsSide::Left, rail_side: ToolsSide::Right, tools_width: TOOLS_WIDTH, side_width: SIDE_WIDTH }
     }
 }
 
@@ -103,6 +107,19 @@ impl SidePanels {
         }
     }
 
+    /// Whether the navigation rail is docked on the right side of the window.
+    pub fn rail_on_right(&self) -> bool {
+        self.rail_side == ToolsSide::Right
+    }
+
+    /// Return the layout [`Edge`] (`Start` or `End`) where the navigation rail and side panel dock.
+    pub fn rail_edge(&self) -> Edge {
+        match self.rail_side {
+            ToolsSide::Left => Edge::Start,
+            ToolsSide::Right => Edge::End,
+        }
+    }
+
     pub fn width(&self, pane: Pane) -> f32 {
         match pane {
             Pane::Tools => self.tools_width,
@@ -123,6 +140,7 @@ impl SidePanels {
         json!({
             "version": VERSION,
             "tools_side": self.tools_side,
+            "rail_side": self.rail_side,
             "tools_open": tools_open,
             "tools_width": self.tools_width,
             "side_width": self.side_width,
@@ -143,6 +161,9 @@ pub fn restore(saved: &Value) -> Restored {
         if let Some(side) = value.get("tools_side").and_then(|v| serde_json::from_value::<ToolsSide>(v.clone()).ok()) {
             panels.tools_side = side;
         }
+        if let Some(side) = value.get("rail_side").and_then(|v| serde_json::from_value::<ToolsSide>(v.clone()).ok()) {
+            panels.rail_side = side;
+        }
         if let Some(width) = value.get("tools_width").and_then(Value::as_f64).and_then(|w| clamp_width(Pane::Tools, w)) {
             panels.tools_width = width;
         }
@@ -346,10 +367,11 @@ impl PaneContent<Pane> for Content<'_> {
     }
 }
 
+/// Return the docked [`PaneState`] (edge and width) for `pane`.
 fn state_of(panels: &SidePanels, pane: Pane) -> PaneState {
     let edge = match pane {
         Pane::Tools => panels.tools_edge(),
-        Pane::Side => Edge::End,
+        Pane::Side => panels.rail_edge(),
     };
     PaneState::docked(edge, panels.width(pane))
 }
@@ -368,6 +390,31 @@ fn open_panes(app: &PdfCraftApp) -> Vec<Pane> {
     open
 }
 
+/// Width of a pane's resize edge that takes the pointer, right of its border.
+const RESIZE_GRIP: f32 = 4.0;
+
+/// Moves each open pane's resize edge to the right of its border (#5730).
+///
+/// The host centres the edge on the border and widens it, so it reaches over whatever ends left
+/// of the border. egui puts a vertical scrollbar at the right of its area, so that is the
+/// scrollbar of the page beside a right-docked pane, or of the Inspector beside a right-docked
+/// Tools pane, and its right half became the edge. Right of a border starts the next area, never
+/// with a scrollbar: a right-docked pane's own scrollbar is at its far side, and a left-docked
+/// pane keeps a gutter left of its border.
+///
+/// The edge is the host's widget registered again with a smaller rect; egui keeps the last rect
+/// for the next frame's hit test, and the layer is the one the host used.
+fn keep_resize_edges_off_scrollbars(ui: &mut egui::Ui, host: egui::Id, open: &[Pane]) {
+    for pane in open {
+        let id = host.with(("pane", *pane)).with("resize");
+        // An inert edge (bad geometry) senses no drag: leave it so.
+        let Some(edge) = ui.ctx().read_response(id).filter(|r| r.sense.senses_drag() && r.rect.is_positive()) else { continue };
+        let border = edge.rect.center().x;
+        let grip = egui::Rect::from_x_y_ranges(border..=border + RESIZE_GRIP, edge.rect.y_range());
+        ui.new_child(egui::UiBuilder::new().layer_id(edge.layer_id)).interact(grip, id, egui::Sense::drag());
+    }
+}
+
 /// Draws the rail and the open panes. Call after the top bars and before the central panel.
 pub fn show(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
     if let Some(panel) = app.right {
@@ -389,13 +436,16 @@ pub fn show(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
     let labels = PaneLabels { resize: crate::i18n::t("Resize panels").to_owned(), ..PaneLabels::default() };
     let panels = app.side_panels;
     // Columns: both panes may share the right edge, Tools outermost, as `open` lists them.
-    let output = PaneHost::new(egui::Id::unique("pdfcraft-side-panels"))
+    let host = egui::Id::unique("pdfcraft-side-panels");
+    let output = PaneHost::new(host)
         .policy(SidePolicy::Columns)
         .f6(false)
         .labels(labels)
         .frame(egui::Frame::NONE.fill(t.panel))
         .body_margin(egui::Margin::ZERO)
         .show(ui, &open, |pane| Some(state_of(&panels, *pane)), &mut Content { app });
+
+    keep_resize_edges_off_scrollbars(ui, host, &open);
     for request in output.requests {
         match request {
             PaneRequest::Resize(pane, width) => app.side_panels.set_width(pane, width),
@@ -434,7 +484,7 @@ mod tests {
     #[test]
     fn docked_default_keeps_widths() {
         let restored = restore(&docked(300.0, 400.0));
-        assert_eq!(restored.panels, SidePanels { tools_side: ToolsSide::Left, tools_width: 300.0, side_width: 400.0 });
+        assert_eq!(restored.panels, SidePanels { tools_side: ToolsSide::Left, rail_side: ToolsSide::Right, tools_width: 300.0, side_width: 400.0 });
         assert_eq!((restored.tools_open, restored.side_closed), (Some(true), false));
     }
 
@@ -448,6 +498,7 @@ mod tests {
         );
         let restored = restore(&old);
         assert_eq!(restored.panels.tools_side, ToolsSide::Right);
+        assert_eq!(restored.panels.rail_side, ToolsSide::Right);
         assert_eq!(restored.panels.tools_width, 290.0);
         // The Inspector's own split fixes Tools' width, not its.
         assert_eq!(restored.panels.side_width, SIDE_WIDTH);
@@ -461,7 +512,10 @@ mod tests {
             json!([]),
         );
         let restored = restore(&old);
-        assert_eq!(restored.panels, SidePanels { tools_side: ToolsSide::Left, tools_width: TOOLS_WIDTH, side_width: 360.0 });
+        assert_eq!(
+            restored.panels,
+            SidePanels { tools_side: ToolsSide::Left, rail_side: ToolsSide::Right, tools_width: TOOLS_WIDTH, side_width: 360.0 }
+        );
         assert_eq!((restored.tools_open, restored.side_closed), (Some(true), false));
     }
 
@@ -470,6 +524,7 @@ mod tests {
         let old = workspace(split(json!({"FixedSecond": 350.0}), tabs(&["canvas"]), tabs(&["inspector", "tools"])), json!([]), json!([]));
         let restored = restore(&old);
         assert_eq!(restored.panels.tools_side, ToolsSide::Left);
+        assert_eq!(restored.panels.rail_side, ToolsSide::Right);
         assert_eq!((restored.panels.tools_width, restored.panels.side_width), (TOOLS_WIDTH, SIDE_WIDTH));
         assert_eq!((restored.tools_open, restored.side_closed), (Some(true), false));
     }
@@ -481,11 +536,11 @@ mod tests {
             json!([]),
             json!([
                 ["inspector", {"floating": null, "anchor": "canvas", "placement": {"Split": "Right"}, "size": {"FixedSecond": 380.0}, "stack": null, "sibling": ["canvas"]}],
-                ["tools", {"floating": null, "anchor": "canvas", "placement": {"Split": "Right"}, "size": {"FixedSecond": 250.0}, "stack": null, "sibling": ["canvas"]}]
+                ["tools", {"floating": null, "anchor": "canvas", "placement": {"Split": "Right"}, "size": {"FixedSecond": 300.0}, "stack": null, "sibling": ["canvas"]}]
             ]),
         );
         let restored = restore(&old);
-        assert_eq!(restored.panels, SidePanels { tools_side: ToolsSide::Right, tools_width: 250.0, side_width: 380.0 });
+        assert_eq!(restored.panels, SidePanels { tools_side: ToolsSide::Right, rail_side: ToolsSide::Right, tools_width: 300.0, side_width: 380.0 });
         assert_eq!((restored.tools_open, restored.side_closed), (Some(false), true));
     }
 
@@ -504,7 +559,10 @@ mod tests {
         }
         // Non-finite and out-of-range widths fall back or clamp; an unknown side keeps Left.
         let restored = restore(&json!({"side_panels": {"version": 1, "tools_side": "up", "tools_width": 9000.0, "side_width": "x"}}));
-        assert_eq!(restored.panels, SidePanels { tools_side: ToolsSide::Left, tools_width: 520.0, side_width: SIDE_WIDTH });
+        assert_eq!(
+            restored.panels,
+            SidePanels { tools_side: ToolsSide::Left, rail_side: ToolsSide::Right, tools_width: 520.0, side_width: SIDE_WIDTH }
+        );
         // Deep trees are cut off rather than walked.
         let mut deep = tabs(&["tools"]);
         for _ in 0..200 {
@@ -515,8 +573,19 @@ mod tests {
 
     #[test]
     fn saved_value_round_trips() {
-        let panels = SidePanels { tools_side: ToolsSide::Right, tools_width: 300.0, side_width: 410.0 };
+        let panels = SidePanels { tools_side: ToolsSide::Right, rail_side: ToolsSide::Left, tools_width: 300.0, side_width: 410.0 };
         let restored = restore(&json!({ "side_panels": panels.to_json(false) }));
         assert_eq!(restored, Restored { panels, tools_open: Some(false), side_closed: false });
     }
+
+    #[test]
+    fn rail_side_placement_and_restore() {
+        let mut panels = SidePanels::default();
+        assert_eq!(panels.rail_side, ToolsSide::Right);
+        assert_eq!(panels.rail_edge(), Edge::End);
+        panels.rail_side = ToolsSide::Left;
+        assert_eq!(panels.rail_edge(), Edge::Start);
+        let restored = restore(&json!({"side_panels": {"version": 1, "rail_side": "left"}}));
+        assert_eq!(restored.panels.rail_side, ToolsSide::Left);
+    }
 }
diff --git a/crates/ui-egui/src/panels/tools.rs b/crates/ui-egui/src/panels/tools.rs
index 9d106e38b3..fce62fb2ab 100644
--- a/crates/ui-egui/src/panels/tools.rs
+++ b/crates/ui-egui/src/panels/tools.rs
@@ -17,7 +17,7 @@ pub fn left_panel(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
     if app.left == LeftPanel::Tool("organize") && app.active.and_then(|i| app.views.get(i)).is_some_and(|v| !v.organize) {
         app.left = crate::organize_panel::workspace_panel(app.mode);
     }
-    egui::Frame::NONE.fill(t.panel).inner_margin(egui::Margin { left: 14, right: 10, top: 12, bottom: 10 }).stroke(Stroke::new(1.0, t.divider)).show(
+    egui::Frame::NONE.fill(t.panel).inner_margin(egui::Margin { left: 14, right: 14, top: 12, bottom: 10 }).stroke(Stroke::new(1.0, t.divider)).show(
         ui,
         |ui| match app.left {
             // Organize pages has its own panel whenever the grid shows (with a document open).
@@ -58,9 +58,15 @@ pub(crate) fn panel_header(ui: &mut egui::Ui, t: &Tokens, title: &str, lead: Opt
     (go_back, close)
 }
 
-/// Width kept free at the right of the tool list for the floating scrollbar.
+/// Width kept free at the right of a scrolling list for the floating scrollbar.
 const SCROLLBAR_GUTTER: f32 = 18.0;
 
+/// The scrollbar floats over the right edge: keeps the rows of the scroll area `ui` is in (and
+/// their rounded hover wash) clear of it.
+pub(super) fn clear_of_scrollbar(ui: &mut egui::Ui) {
+    ui.set_max_width((ui.available_width() - SCROLLBAR_GUTTER).max(0.0));
+}
+
 /// The All tools sidebar: Expand (the full view) and Close, then the tool list, the first few
 /// tools until View more shows them all.
 fn all_tools(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens) {
@@ -73,12 +79,14 @@ fn all_tools(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens) {
         app.left_open = false;
     }
     egui::ScrollArea::vertical().auto_shrink([false, false]).show(ui, |ui| {
-        // The scrollbar floats over the right edge: keep the rows (and their rounded hover wash) clear of it.
-        ui.set_max_width((ui.available_width() - SCROLLBAR_GUTTER).max(0.0));
+        clear_of_scrollbar(ui);
         ui.add_space(2.0);
         let shown = if app.all_tools_expanded { TOOL_GROUPS.len() } else { COLLAPSED_TOOLS.min(TOOL_GROUPS.len()) };
         for g in &TOOL_GROUPS[..shown] {
-            if tool_row(ui, t, g).clicked() {
+            let (resp, pin_clicked) = tool_row(ui, t, g, app.is_tool_pinned(g.id));
+            if pin_clicked {
+                app.toggle_pin_tool(g.id);
+            } else if resp.clicked() {
                 app.select_tool(g.id);
             }
         }
@@ -110,21 +118,29 @@ pub(super) fn row_label(ui: &mut egui::Ui, text: &str, font: egui::FontId, color
 }
 
 /// Draw one tool-group row with its icon, label, badge and availability hint.
-fn tool_row(ui: &mut egui::Ui, t: &Tokens, g: &ToolGroup) -> egui::Response {
+fn tool_row(ui: &mut egui::Ui, t: &Tokens, g: &ToolGroup, is_pinned: bool) -> (egui::Response, bool) {
     let (rect, resp) = ui.allocate_exact_size(vec2(ui.available_width(), 34.0), Sense::click());
     resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!(g.label)));
     let press = theme::Press::track(ui, &resp);
     press.wash(ui, rect, 6, false);
     let body = rect.translate(press.offset());
     icons::paint(ui, Rect::from_min_size(body.min + vec2(6.0, 7.0), vec2(20.0, 20.0)), g.icon, 19.0, hue(g));
-    let right_reserved = match (g.badge, g.availability) {
-        (Some(b), _) => ui.fonts_mut(|f| f.layout_no_wrap(tl!(b).to_owned(), theme::semibold(9.5), Color32::WHITE).size().x) + 26.0,
+
+    let pin_rect = Rect::from_center_size(body.right_center() - vec2(14.0, 0.0), vec2(22.0, 22.0));
+    let pin_resp = ui.interact(pin_rect, ui.scope_id().with(("pin_toggle_row", g.id)), Sense::click());
+    let pin_hovered = pin_resp.hovered();
+    let mut pin_clicked = false;
+
+    let pin_space = 26.0;
+    let badge_or_hint_reserved = match (g.badge, g.availability) {
+        (Some(b), _) => ui.fonts_mut(|f| f.layout_no_wrap(tl!(b).to_owned(), theme::semibold(9.5), Color32::WHITE).size().x) + 18.0,
         (None, Availability::Planned(m)) if resp.hovered() => {
             let hint = format!("{} · {m}", tl!("Planned"));
-            ui.fonts_mut(|f| f.layout_no_wrap(hint, theme::medium(10.5), t.text_faint).size().x) + 18.0
+            ui.fonts_mut(|f| f.layout_no_wrap(hint, theme::medium(10.5), t.text_faint).size().x) + 10.0
         }
-        _ => 8.0,
+        _ => 0.0,
     };
+    let right_reserved = pin_space + badge_or_hint_reserved + 8.0;
     let clipped =
         row_label(ui, tl!(g.label), theme::regular(13.5), t.text, body.left_center() + vec2(36.0, 0.0), rect.width() - 36.0 - right_reserved);
     match (g.badge, g.availability) {
@@ -132,14 +148,14 @@ fn tool_row(ui: &mut egui::Ui, t: &Tokens, g: &ToolGroup) -> egui::Response {
             let font = theme::semibold(9.5);
             let badge = tl!(b);
             let w = ui.fonts_mut(|f| f.layout_no_wrap(badge.to_string(), font.clone(), Color32::WHITE).size().x);
-            let r = Rect::from_center_size(body.right_center() - vec2(w / 2.0 + 10.0, 0.0), vec2(w + 10.0, 16.0));
+            let r = Rect::from_center_size(body.right_center() - vec2(pin_space + w / 2.0 + 4.0, 0.0), vec2(w + 10.0, 16.0));
             ui.painter().rect_filled(r, CornerRadius::same(4), t.badge_new);
             ui.painter().text(r.center(), Align2::CENTER_CENTER, badge, font, Color32::WHITE);
         }
         // Planned tools: a quiet milestone hint instead of a chip, so the list stays calm.
         (None, Availability::Planned(m)) if resp.hovered() => {
             ui.painter().text(
-                body.right_center() - vec2(10.0, 0.0),
+                body.right_center() - vec2(pin_space + 4.0, 0.0),
                 Align2::RIGHT_CENTER,
                 format!("{} · {m}", tl!("Planned")),
                 theme::medium(10.5),
@@ -148,13 +164,34 @@ fn tool_row(ui: &mut egui::Ui, t: &Tokens, g: &ToolGroup) -> egui::Response {
         }
         _ => {}
     }
+
+    let row_hovered = ui.rect_contains_pointer(rect) || resp.hovered();
+    if is_pinned || row_hovered || pin_hovered {
+        if pin_hovered {
+            ui.painter().rect_filled(pin_rect, CornerRadius::same(4), t.pressed);
+        }
+        let pin_tint = if is_pinned {
+            t.accent_text
+        } else if pin_hovered {
+            t.text
+        } else {
+            t.text_faint
+        };
+        icons::paint(ui, pin_rect.shrink(3.0), "pin", 15.0, pin_tint);
+        let tip = if is_pinned { tl!("Unpin from Home") } else { tl!("Pin to Home") };
+        pin_resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tip));
+        if theme::hand(pin_resp).on_hover_text(tip).clicked() {
+            pin_clicked = true;
+        }
+    }
+
     let tip = match g.availability {
         Availability::Ready => tl!("Available").to_string(),
         Availability::Planned(m) => format!("{} {m} — {}", tl!("Planned for milestone"), tl!("open to see what it will include")),
         Availability::Provider => tl!("Optional: needs an AI provider you configure").into(),
     };
     let tip = if clipped { format!("{} — {tip}", tl!(g.label)) } else { tip };
-    theme::hand(resp).on_hover_text(tip)
+    (theme::hand(resp).on_hover_text(tip), pin_clicked)
 }
 
 /// Draw the detail view for one tool group, dispatching its commands and tool-specific panels.
@@ -210,6 +247,7 @@ fn tool_detail(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens, g: &'static
     let marks = if footer { app.active_ids().and_then(|(_, id)| app.session.get(id)).map_or(0, |d| d.redaction_marks()) } else { 0 };
     let list_h = if footer { (ui.available_height() - 52.0).max(80.0) } else { ui.available_height() };
     egui::ScrollArea::vertical().auto_shrink([false, false]).max_height(list_h).show(ui, |ui| {
+        clear_of_scrollbar(ui);
         ui.add_space(2.0);
         for s in g.sections {
             widgets::section_title(ui, tl!(s.title));
diff --git a/crates/ui-egui/src/persist.rs b/crates/ui-egui/src/persist.rs
index bb29efeff2..20ccecdd3f 100644
--- a/crates/ui-egui/src/persist.rs
+++ b/crates/ui-egui/src/persist.rs
@@ -1,5 +1,7 @@
 pub mod last_session;
 pub mod last_view;
+pub mod paper;
+pub(crate) mod recent_check;
 pub(super) mod recovery;
 pub mod units;
 #[cfg(not(target_arch = "wasm32"))]
diff --git a/crates/ui-egui/src/persist/last_session.rs b/crates/ui-egui/src/persist/last_session.rs
index 7bc4833c0a..b46de0de7a 100644
--- a/crates/ui-egui/src/persist/last_session.rs
+++ b/crates/ui-egui/src/persist/last_session.rs
@@ -98,7 +98,7 @@ impl PdfCraftApp {
     /// the Recovery dialog offers, so neither opens twice.
     ///
     /// Only one password prompt can wait at a time: the first encrypted file asks for its
-    /// password and later ones stay closed (they are in the recent-files list).
+    /// password and later ones stay closed (in the recent-files list, if there is one).
     pub fn reopen_last_files(&mut self, skip: &[String]) {
         let last = std::mem::take(&mut self.last_session);
         #[cfg(not(target_arch = "wasm32"))]
diff --git a/crates/ui-egui/src/persist/paper.rs b/crates/ui-egui/src/persist/paper.rs
new file mode 100644
index 0000000000..2aeb8fceb3
--- /dev/null
+++ b/crates/ui-egui/src/persist/paper.rs
@@ -0,0 +1,150 @@
+//! The paper size the system's region prints on: the size of a new blank document (Create ▸
+//! Blank page).
+
+use super::units::region_of;
+
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub enum Paper {
+    #[default]
+    Letter,
+    A4,
+}
+
+impl Paper {
+    /// Width and height in points, portrait.
+    pub fn points(self) -> (f64, f64) {
+        match self {
+            Paper::Letter => (612.0, 792.0),
+            Paper::A4 => (595.28, 841.89),
+        }
+    }
+
+    /// The system region's paper: US Letter in the Americas that use it, A4 everywhere else;
+    /// Letter when the region can't be told, as before the region was read.
+    pub fn system() -> Paper {
+        static SYSTEM: std::sync::OnceLock<Paper> = std::sync::OnceLock::new();
+        *SYSTEM.get_or_init(|| detect().unwrap_or_default())
+    }
+}
+
+/// The paper for a locale tag's region (`en_US.UTF-8`, `fr-BE`, `es_MX`); `None` without a region.
+/// The Letter regions are CLDR's `paperSize` US-Letter territories.
+pub(crate) fn paper_for_tag(tag: &str) -> Option<Paper> {
+    Some(match region_of(tag)?.as_str() {
+        "US" | "CA" | "MX" | "PH" | "PR" | "BZ" | "CL" | "CO" | "CR" | "GT" | "NI" | "PA" | "SV" | "VE" => Paper::Letter,
+        _ => Paper::A4,
+    })
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+fn detect() -> Option<Paper> {
+    // A Finder-started app gets no LANG, so the system locale's region decides first.
+    #[cfg(target_os = "macos")]
+    if let Ok(out) = std::process::Command::new("/usr/bin/defaults").args(["read", "-g", "AppleLocale"]).output()
+        && out.status.success()
+        && let Some(paper) = paper_for_tag(String::from_utf8_lossy(&out.stdout).trim())
+    {
+        return Some(paper);
+    }
+    // Region ▸ the paper size Windows keeps per user, read in-process like the measurement system.
+    #[cfg(target_os = "windows")]
+    if let Some(paper) = windows_paper().and_then(|v| paper_for_ipapersize(&v)) {
+        return Some(paper);
+    }
+    paper_for_tag(&locale_for_paper(|var| std::env::var(var).ok())?)
+}
+
+/// The locale that decides the paper, as POSIX picks it: the first of `LC_ALL`, `LC_PAPER` and
+/// `LANG` that is set and not empty, read through `var`. A later one never stands in for it, so
+/// `LC_ALL=C` with `LANG=de_DE` has no paper from the locale (CodeRabbit on #5651).
+#[cfg(any(test, not(target_arch = "wasm32")))]
+pub(crate) fn locale_for_paper(var: impl Fn(&str) -> Option<String>) -> Option<String> {
+    ["LC_ALL", "LC_PAPER", "LANG"].iter().find_map(|name| var(name).filter(|v| !v.is_empty()))
+}
+
+/// The paper for the Windows `iPaperSize` value (a `DMPAPER` number): "1" Letter, "9" A4. `None`
+/// for anything else, so another size falls through to the locale check.
+#[cfg(any(test, target_os = "windows"))]
+pub(crate) fn paper_for_ipapersize(value: &str) -> Option<Paper> {
+    match value.trim() {
+        "1" => Some(Paper::Letter),
+        "9" => Some(Paper::A4),
+        _ => None,
+    }
+}
+
+/// `HKCU\Control Panel\International\iPaperSize` as text; `None` when it is missing, unreadable
+/// or not a string.
+#[cfg(target_os = "windows")]
+fn windows_paper() -> Option<String> {
+    use winsafe::{HKEY, RegistryValue, co::RRF};
+    match HKEY::CURRENT_USER.RegGetValue(Some("Control Panel\\International"), Some("iPaperSize"), RRF::RT_REG_SZ).ok()? {
+        RegistryValue::Sz(v) => Some(v),
+        _ => None,
+    }
+}
+
+#[cfg(target_arch = "wasm32")]
+fn detect() -> Option<Paper> {
+    None
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{Paper, locale_for_paper, paper_for_ipapersize, paper_for_tag};
+
+    #[test]
+    fn region_decides_the_paper() {
+        assert_eq!(paper_for_tag("en_US.UTF-8"), Some(Paper::Letter));
+        assert_eq!(paper_for_tag("fr_CA"), Some(Paper::Letter));
+        assert_eq!(paper_for_tag("es-MX"), Some(Paper::Letter));
+        assert_eq!(paper_for_tag("fr_BE.UTF-8"), Some(Paper::A4));
+        assert_eq!(paper_for_tag("en_GB@euro"), Some(Paper::A4));
+        assert_eq!(paper_for_tag("de-DE"), Some(Paper::A4));
+        assert_eq!(paper_for_tag("zh-Hans-CN"), Some(Paper::A4));
+        assert_eq!(paper_for_tag("C"), None);
+        assert_eq!(paper_for_tag("en"), None);
+        assert_eq!(paper_for_tag(""), None);
+        // A BCP 47 extension is not the region (CodeRabbit on #5651): `nu` is a key, not Niue.
+        assert_eq!(paper_for_tag("en-US-u-nu-latn"), Some(Paper::Letter));
+        assert_eq!(paper_for_tag("de-DE-u-rg-uszzzz"), Some(Paper::A4));
+        assert_eq!(paper_for_tag("en-x-us"), None);
+    }
+
+    /// POSIX precedence (CodeRabbit on #5651): the first locale variable that is set decides, even
+    /// when it has no region; an empty one is not set.
+    #[test]
+    fn the_first_locale_variable_set_decides() {
+        let env =
+            |pairs: &'static [(&'static str, &'static str)]| move |name: &str| pairs.iter().find(|(k, _)| *k == name).map(|(_, v)| v.to_string());
+        assert_eq!(locale_for_paper(env(&[("LC_ALL", "C"), ("LANG", "de_DE.UTF-8")])).as_deref(), Some("C"));
+        assert_eq!(locale_for_paper(env(&[("LC_ALL", ""), ("LC_PAPER", "en_US"), ("LANG", "de_DE")])).as_deref(), Some("en_US"));
+        assert_eq!(locale_for_paper(env(&[("LANG", "fr_FR")])).as_deref(), Some("fr_FR"));
+        assert_eq!(locale_for_paper(env(&[])), None);
+        assert_eq!(locale_for_paper(env(&[("LC_ALL", "C.UTF-8"), ("LANG", "de_DE")])).and_then(|t| paper_for_tag(&t)), None);
+    }
+
+    #[test]
+    fn windows_paper_size_decides_the_paper() {
+        assert_eq!(paper_for_ipapersize("1"), Some(Paper::Letter));
+        assert_eq!(paper_for_ipapersize(" 9\r\n"), Some(Paper::A4));
+        assert_eq!(paper_for_ipapersize("5"), None);
+        assert_eq!(paper_for_ipapersize(""), None);
+    }
+
+    /// The registry read works in-process and gives a value the mapping understands, or nothing.
+    #[cfg(target_os = "windows")]
+    #[test]
+    fn windows_reads_ipapersize_in_process() {
+        if let Some(v) = super::windows_paper() {
+            assert!(v.trim().parse::<u32>().is_ok(), "unexpected iPaperSize {v:?}");
+        }
+    }
+
+    #[test]
+    fn a4_and_letter_in_points() {
+        assert_eq!(Paper::Letter.points(), (612.0, 792.0));
+        let (w, h) = Paper::A4.points();
+        assert_eq!(((w * 25.4 / 72.0).round(), (h * 25.4 / 72.0).round()), (210.0, 297.0));
+    }
+}
diff --git a/crates/ui-egui/src/persist/recent_check.rs b/crates/ui-egui/src/persist/recent_check.rs
new file mode 100644
index 0000000000..8c7db75f8b
--- /dev/null
+++ b/crates/ui-egui/src/persist/recent_check.rs
@@ -0,0 +1,125 @@
+//! Recent files whose files are gone leave the list, without the window waiting to find out
+//! (#5682).
+//!
+//! A recent file can be on a network or cloud mount that has stopped answering, where even
+//! asking whether the file exists blocks in the kernel, and no timeout can cancel that. So
+//! settings keep every recent entry when they load, and a worker asks about them once the window
+//! is up; each frame only takes the answers it has so far. An entry the worker hasn't reached
+//! yet, or can't tell about (the mount answers with an error), stays listed and can be opened or
+//! removed by hand. A worker stuck on a dead mount stays stuck, but nothing waits for it.
+
+use std::sync::{Arc, Mutex, PoisonError};
+
+use crate::PdfCraftApp;
+
+/// The recent files restored from settings that haven't been checked yet, and the check under way.
+#[derive(Debug, Default)]
+pub struct RecentCheck {
+    /// Paths restored from settings, checked on the next frame.
+    unchecked: Vec<String>,
+    /// The paths the worker has found gone so far; it adds to them as it goes.
+    gone: Option<Arc<Mutex<Vec<String>>>>,
+    /// Paths opened while a check was pending: the file is there now, whatever the worker found.
+    opened: Vec<String>,
+}
+
+impl RecentCheck {
+    /// Settings just restored these recent files: check them once the window is up.
+    pub(crate) fn restored(&mut self, paths: Vec<String>) {
+        self.unchecked = paths;
+    }
+
+    /// `path` was just opened: an answer the worker gives about it later is out of date.
+    pub(crate) fn opened(&mut self, path: &str) {
+        if self.gone.is_some() || !self.unchecked.is_empty() {
+            self.opened.push(path.to_string());
+        }
+    }
+}
+
+/// Whether `path` is known to be gone. Any other answer, an error included, keeps the entry.
+fn gone(path: &str) -> bool {
+    matches!(std::fs::exists(path), Ok(false))
+}
+
+impl PdfCraftApp {
+    /// Start checking the recent files restored from settings, and drop the ones found gone so
+    /// far (called each frame). The check runs on a worker thread, inline in tests
+    /// ([`PdfCraftApp::run_inline`]).
+    pub(crate) fn check_restored_recent(&mut self) {
+        let paths = std::mem::take(&mut self.recent_check.unchecked);
+        // The web build's recent files aren't paths on a file system.
+        if !paths.is_empty() && !cfg!(target_arch = "wasm32") {
+            let slot = Arc::new(Mutex::new(Vec::new()));
+            let out = slot.clone();
+            let ctx = self.ctx.clone();
+            let work = move || {
+                for path in paths {
+                    if gone(&path) {
+                        out.lock().unwrap_or_else(PoisonError::into_inner).push(path);
+                        if let Some(ctx) = &ctx {
+                            ctx.request_repaint();
+                        }
+                    }
+                }
+            };
+            if self.run_inline {
+                work();
+            } else if std::thread::Builder::new().name("pdfcraft-recent".into()).spawn(work).is_err() {
+                // No worker: the entries stay listed, as if the check hadn't reached them.
+                return;
+            }
+            self.recent_check.gone = Some(slot);
+        }
+        let Some(slot) = &self.recent_check.gone else { return };
+        // Asked before taking, so a path the worker adds after this is taken on a later frame.
+        let finished = Arc::strong_count(slot) == 1;
+        let gone = std::mem::take(&mut *slot.lock().unwrap_or_else(PoisonError::into_inner));
+        if !gone.is_empty() {
+            // A file opened since the check began is there, whatever the worker found earlier.
+            let opened = &self.recent_check.opened;
+            self.recent.retain(|r| !gone.contains(&r.path) || opened.contains(&r.path));
+        }
+        // The worker has finished (or panicked) and everything it found is taken.
+        if finished {
+            self.recent_check.gone = None;
+            self.recent_check.opened.clear();
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// A file opened after the worker found it gone, but before that answer was taken, stays
+    /// listed (CodeRabbit on #5692).
+    #[test]
+    fn a_file_opened_while_the_check_is_pending_stays() {
+        let mut app = PdfCraftApp::new();
+        app.recent = vec![crate::state::RecentFile { name: "a.pdf".into(), path: "/gone/a.pdf".into(), pages: 1, size: 0 }];
+        // The worker's answer is waiting: it found the file gone.
+        app.recent_check.gone = Some(Arc::new(Mutex::new(vec!["/gone/a.pdf".to_string()])));
+        app.recent_check.opened("/gone/a.pdf");
+        app.check_restored_recent();
+        assert_eq!(app.recent.len(), 1, "the reopened file stays");
+        assert!(app.recent_check.gone.is_none() && app.recent_check.opened.is_empty());
+        // Without the open, the answer removes it.
+        app.recent_check.gone = Some(Arc::new(Mutex::new(vec!["/gone/a.pdf".to_string()])));
+        app.check_restored_recent();
+        assert!(app.recent.is_empty());
+    }
+
+    #[test]
+    fn only_a_path_known_to_be_missing_is_gone() {
+        let dir = std::env::temp_dir().join(format!("pdfcraft-recent-check-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let here = dir.join("here.pdf");
+        std::fs::write(&here, b"%PDF-1.7").unwrap();
+        assert!(!gone(&here.to_string_lossy()));
+        assert!(gone(&dir.join("missing.pdf").to_string_lossy()));
+        // A path that can't be asked about (here: one with a NUL) is not known to be gone.
+        assert!(!gone("bad\0path.pdf"));
+        std::fs::remove_dir_all(&dir).unwrap();
+    }
+}
diff --git a/crates/ui-egui/src/persist/units.rs b/crates/ui-egui/src/persist/units.rs
index a345456fab..147c502513 100644
--- a/crates/ui-egui/src/persist/units.rs
+++ b/crates/ui-egui/src/persist/units.rs
@@ -69,14 +69,22 @@ impl Unit {
 /// The unit for a locale tag's region: `en_US.UTF-8`, `en-US`, `bg-BG`, `zh-Hans-CN`, `en_GB@euro`.
 /// `None` without a region (`C`, `POSIX`, `en`).
 pub(crate) fn unit_for_tag(tag: &str) -> Option<Unit> {
-    let tag = tag.split(['.', '@']).next().unwrap_or_default();
-    let region = tag.split(['-', '_']).skip(1).filter(|p| p.len() == 2 && p.chars().all(|c| c.is_ascii_alphabetic())).last()?;
-    Some(match region.to_ascii_uppercase().as_str() {
+    Some(match region_of(tag)?.as_str() {
         "US" | "LR" | "MM" => Unit::Inches,
         _ => Unit::Millimetres,
     })
 }
 
+/// The upper-case two-letter region of a locale tag; `None` without one (`C`, `POSIX`, `en`).
+/// Only the base tag counts: a BCP 47 extension or private use part (`-u-nu-latn`, `-x-…`, each
+/// after a one-letter singleton) is not a region (CodeRabbit on #5651).
+pub(crate) fn region_of(tag: &str) -> Option<String> {
+    let tag = tag.split(['.', '@']).next().unwrap_or_default();
+    let region =
+        tag.split(['-', '_']).skip(1).take_while(|p| p.len() != 1).filter(|p| p.len() == 2 && p.chars().all(|c| c.is_ascii_alphabetic())).last()?;
+    Some(region.to_ascii_uppercase())
+}
+
 #[cfg(not(target_arch = "wasm32"))]
 fn detect() -> Option<Unit> {
     // The system's own measurement setting first: a terminal's LANG is often en_US whatever the region.
diff --git a/crates/ui-egui/src/platform/drag_pointer.rs b/crates/ui-egui/src/platform/drag_pointer.rs
index 05ef05c426..3074f7d851 100644
--- a/crates/ui-egui/src/platform/drag_pointer.rs
+++ b/crates/ui-egui/src/platform/drag_pointer.rs
@@ -1,6 +1,7 @@
-//! Where the pointer is while files are dragged over the window. The windowing layer reports
-//! that a file hovers, but not where, and sends no pointer moves until the drag ends; the
-//! system has to be asked.
+//! Where the pointer is when the windowing layer doesn't say: while files are dragged over the
+//! window (it reports that a file hovers, but not where, and sends no pointer moves until the drag
+//! ends), and when the wheel turns after switching back to the window (no move is sent until the
+//! mouse moves, #1518). The system has to be asked.
 
 /// The pointer in this window's coordinates (egui points), when the system can tell.
 #[cfg(target_os = "macos")]
@@ -38,3 +39,65 @@ pub(crate) fn in_window(ctx: &egui::Context) -> Option<egui::Pos2> {
 pub(crate) fn in_window(_ctx: &egui::Context) -> Option<egui::Pos2> {
     None
 }
+
+/// Wheel input with no known pointer: after Alt+Tab back to the window, the windowing layer sends
+/// no pointer move until the mouse moves, so egui doesn't know what is under the pointer and the
+/// wheel scrolls nothing (#1518). When `raw` turns the wheel, has no pointer move of its own and
+/// egui knows no pointer position (`known`), the pointer from `system` is put first, if it is
+/// inside the window's `size` (egui points).
+pub(crate) fn locate_wheel(raw: &mut egui::RawInput, known: bool, size: egui::Vec2, system: impl FnOnce() -> Option<egui::Pos2>) {
+    let wheel = raw.events.iter().any(|e| matches!(e, egui::Event::MouseWheel { .. }));
+    let moved = raw.events.iter().any(|e| matches!(e, egui::Event::PointerMoved(_) | egui::Event::PointerGone));
+    if !wheel || moved || known {
+        return;
+    }
+    if let Some(pos) = system().filter(|p| egui::Rect::from_min_size(egui::Pos2::ZERO, size).contains(*p)) {
+        raw.events.insert(0, egui::Event::PointerMoved(pos));
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn wheel() -> egui::Event {
+        egui::Event::MouseWheel {
+            unit: egui::MouseWheelUnit::Line,
+            delta: egui::vec2(0.0, -1.0),
+            phase: egui::TouchPhase::Move,
+            modifiers: egui::Modifiers::NONE,
+            source: egui::MouseWheelSource::Unknown,
+        }
+    }
+
+    fn located(events: Vec<egui::Event>, known: bool, system: Option<egui::Pos2>) -> Vec<egui::Event> {
+        let mut raw = egui::RawInput { events, ..Default::default() };
+        locate_wheel(&mut raw, known, egui::vec2(800.0, 600.0), || system);
+        raw.events
+    }
+
+    #[test]
+    fn a_wheel_with_no_known_pointer_asks_the_system_where_it_is() {
+        let at = egui::pos2(300.0, 200.0);
+        // After Alt+Tab back: the wheel turns, nothing moved, egui knows no pointer.
+        assert_eq!(located(vec![wheel()], false, Some(at)), vec![egui::Event::PointerMoved(at), wheel()]);
+        // Otherwise nothing is added: egui knows the pointer, the frame moves it itself, there is
+        // no wheel, the system can't tell, or the pointer is outside the window.
+        assert_eq!(located(vec![wheel()], true, Some(at)), vec![wheel()]);
+        let moved = egui::Event::PointerMoved(egui::pos2(1.0, 1.0));
+        assert_eq!(located(vec![moved.clone(), wheel()], false, Some(at)), vec![moved, wheel()]);
+        assert_eq!(located(vec![egui::Event::PointerGone, wheel()], false, Some(at)), vec![egui::Event::PointerGone, wheel()]);
+        assert_eq!(
+            located(
+                vec![egui::Event::Key { key: egui::Key::A, physical_key: None, pressed: true, repeat: false, modifiers: egui::Modifiers::NONE }],
+                false,
+                Some(at)
+            )
+            .len(),
+            1
+        );
+        assert_eq!(located(vec![wheel()], false, None), vec![wheel()]);
+        assert_eq!(located(vec![wheel()], false, Some(egui::pos2(900.0, 200.0))), vec![wheel()]);
+        assert_eq!(located(vec![wheel()], false, Some(egui::pos2(f32::NAN, 0.0))), vec![wheel()]);
+    }
+}
diff --git a/crates/ui-egui/src/platform/open_worker/tests.rs b/crates/ui-egui/src/platform/open_worker/tests.rs
index fe2a0ae410..c0fe2f03a2 100644
--- a/crates/ui-egui/src/platform/open_worker/tests.rs
+++ b/crates/ui-egui/src/platform/open_worker/tests.rs
@@ -733,6 +733,146 @@ fn startup_files_wait_for_absolute_link_consent_and_preparation() {
     let _ = std::fs::remove_file(path);
 }
 
+#[test]
+fn launch_layout_waits_for_cli_opens_and_preserves_restored_tabs() {
+    use crate::canvas::PageLayout;
+    // Controlled worker replies exercise both completion orders without scheduling races.
+    for reverse in [false, true] {
+        for count in [1, 2] {
+            for restored in [false, true] {
+                let mut app = PdfCraftApp::new();
+                app.set_option("default-layout", "continuous").unwrap();
+                if restored {
+                    app.open_bytes("restored.pdf", None, fixture(1)).unwrap();
+                }
+                let offset = usize::from(restored);
+                let mut replies = Vec::new();
+                for token in 0..count {
+                    let name = format!("cli-{token}.pdf");
+                    let bytes = Arc::new(fixture(2));
+                    let prepared = app.session.prepare_open(&name, None, bytes.clone(), None);
+                    let (sender, receiver) = std::sync::mpsc::channel();
+                    app.pending_opens.push(crate::PendingOpen {
+                        token,
+                        receiver,
+                        name,
+                        path: None,
+                        stamp: None,
+                        activate: true,
+                        after_open: None,
+                        recovered: None,
+                        then: None,
+                        display_override: Some((PageLayout::TwoUp, false)),
+                    });
+                    replies.push((
+                        sender,
+                        open_worker::ResultMessage { token, kind: open_worker::ResultKind::Prepared { bytes, result: Box::new(prepared) } },
+                    ));
+                }
+                app.set_launch_layout("single").unwrap();
+                if restored {
+                    assert!(app.views[0].continuous(), "pending --layout must not target the restored tab");
+                }
+                if reverse {
+                    replies.reverse();
+                }
+                for (index, (sender, reply)) in replies.into_iter().enumerate() {
+                    let name = format!("cli-{}.pdf", reply.token);
+                    sender.send(reply).unwrap();
+                    app.poll_pending_opens();
+                    let view = &app.views[index + offset];
+                    assert_eq!(view.layout, if index + 1 == count as usize { PageLayout::Single } else { PageLayout::TwoUp });
+                    assert!(!view.continuous());
+                    assert_eq!(app.session.get(view.id).unwrap().name, name);
+                }
+                assert_eq!(app.active, Some(count as usize + offset - 1));
+                if restored {
+                    assert_eq!(app.views[0].layout, PageLayout::Single);
+                    assert!(app.views[0].continuous());
+                }
+                assert_eq!(app.view_defaults.layout, PageLayout::Single);
+                assert!(app.view_defaults.continuous);
+                assert_eq!(serde_json::from_str::<Value>(&app.persist()).unwrap()["default_layout"], "continuous");
+                // Ordinary later opens cannot inherit either launch override.
+                app.open_bytes("later.pdf", None, fixture(1)).unwrap();
+                assert!(app.views.last().unwrap().continuous());
+            }
+        }
+    }
+}
+
+#[test]
+fn launch_layout_failed_or_cancelled_opens_do_not_target_existing_documents() {
+    use crate::canvas::PageLayout;
+    for cancel in [false, true] {
+        let mut app = PdfCraftApp::new();
+        app.set_option("default-layout", "continuous").unwrap();
+        app.open_bytes("restored.pdf", None, fixture(1)).unwrap();
+        let (sender, receiver) = std::sync::mpsc::channel();
+        app.pending_opens.push(crate::PendingOpen {
+            token: 0,
+            receiver,
+            name: "cli.pdf".into(),
+            path: None,
+            stamp: None,
+            activate: true,
+            after_open: None,
+            recovered: None,
+            then: None,
+            display_override: Some((PageLayout::TwoUp, false)),
+        });
+        app.set_launch_layout("single").unwrap();
+        assert!(app.set_launch_layout("invalid").is_err());
+        let kind = if cancel {
+            open_worker::ResultKind::Prepared { bytes: Arc::new(fixture(1)), result: Box::new(Err(pdfcraft_render::OpenError::NeedsPassword)) }
+        } else {
+            open_worker::ResultKind::ReadFailed("synthetic read failure".into())
+        };
+        sender.send(open_worker::ResultMessage { token: 0, kind }).unwrap();
+        app.poll_pending_opens();
+        if cancel {
+            app.submit_password(None);
+        }
+        assert!(app.launch_layout.is_none());
+        assert_eq!(app.views.len(), 1);
+        assert!(app.views[0].continuous());
+        app.open_bytes("later.pdf", None, fixture(1)).unwrap();
+        assert!(app.views[1].continuous());
+    }
+}
+
+#[test]
+fn flagged_startup_opens_wait_for_password_ownership_before_the_first_frame() {
+    use crate::canvas::PageLayout;
+    let locked = tool_open_file("launch-locked", "pdf", &encrypted_tool_fixture());
+    let second = tool_open_file("launch-second", "pdf", &fixture(2));
+    let mut app = PdfCraftApp::new();
+    app.set_option("default-layout", "continuous").unwrap();
+    app.open_path_with_display(locked.0.to_str().unwrap(), PageLayout::TwoUp, false);
+    let bytes = app.password_prompt.as_ref().unwrap().bytes.clone();
+    app.open_path_with_display(locked.0.to_str().unwrap(), PageLayout::TwoUp, false);
+    assert!(app.pending_opens.is_empty(), "repeating the locked file keeps its original prompt");
+    app.open_path_with_display(second.0.to_str().unwrap(), PageLayout::TwoUp, false);
+    assert_eq!(app.pending_opens.len(), 1);
+    assert!(Arc::ptr_eq(&app.password_prompt.as_ref().unwrap().bytes, &bytes));
+    app.set_launch_layout("single").unwrap();
+    app.submit_password(Some("wrong".into()));
+    assert!(app.password_prompt.as_ref().unwrap().error.is_some());
+    app.submit_password(Some("tool-password".into()));
+    assert_eq!(app.views.len(), 1);
+    assert_eq!(app.views[0].layout, PageLayout::TwoUp);
+    let deadline = std::time::Instant::now() + Duration::from_secs(5);
+    while !app.pending_opens.is_empty() {
+        assert!(std::time::Instant::now() < deadline);
+        app.poll_pending_opens();
+        std::thread::sleep(Duration::from_millis(5));
+    }
+    assert_eq!(app.views.len(), 2);
+    assert_eq!(app.views[1].layout, PageLayout::Single);
+    assert!(!app.views[1].continuous());
+    assert!(app.view_defaults.continuous);
+}
+
 /// #1928: a new file handed over by the OS (Finder, or another launch) raises the window at once,
 /// before it is prepared, and is the selected tab once it opens.
 #[test]
diff --git a/crates/ui-egui/src/platform/pickers.rs b/crates/ui-egui/src/platform/pickers.rs
index 92852e4897..80d44d975b 100644
--- a/crates/ui-egui/src/platform/pickers.rs
+++ b/crates/ui-egui/src/platform/pickers.rs
@@ -376,6 +376,7 @@ mod tests {
             after_open: None,
             recovered: None,
             then: None,
+            display_override: None,
         });
         let got = Arc::new(Mutex::new(Vec::new()));
         app.pickers.showing.store(true, Ordering::SeqCst);
diff --git a/crates/ui-egui/src/state.rs b/crates/ui-egui/src/state.rs
index 03df25f201..e3a9c540a6 100644
--- a/crates/ui-egui/src/state.rs
+++ b/crates/ui-egui/src/state.rs
@@ -186,6 +186,8 @@ pub enum Dialog {
     AuditSpace,
     /// Signatures ▸ Show certificate.
     CertificateViewer,
+    /// Pin tools to Home: selection modal.
+    PinTool,
 }
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
@@ -329,6 +331,8 @@ pub struct PasswordPrompt {
     pub(crate) then: Option<&'static str>,
     /// A link destination to apply after the linked PDF is unlocked.
     pub(crate) after_open: Option<pdfcraft_render::RemoteDestination>,
+    /// A launch-time display override, applied only after this PDF is unlocked.
+    pub(crate) display_override: Option<(canvas::PageLayout, bool)>,
 }
 
 #[cfg(not(target_arch = "wasm32"))]
@@ -361,6 +365,11 @@ impl UnlockPrompt {
     }
 }
 
+/// How many recent files are kept until Preferences says otherwise.
+pub const RECENT_FILES_DEFAULT: usize = 12;
+/// The most Preferences can ask to keep.
+pub const RECENT_FILES_MAX: usize = 50;
+
 #[derive(serde::Serialize, serde::Deserialize)]
 pub struct RecentFile {
     pub name: String,
diff --git a/crates/ui-egui/src/tools/comments.rs b/crates/ui-egui/src/tools/comments.rs
index e9956e5f95..cb8bafe642 100644
--- a/crates/ui-egui/src/tools/comments.rs
+++ b/crates/ui-egui/src/tools/comments.rs
@@ -54,6 +54,9 @@ pub(crate) use state::{EditorFocus, PageCx};
 /// Acrobat's selection blue for annotation frames and handles (11-visual-spec §5).
 const SELECT_BLUE: Color32 = Color32::from_rgb(0x14, 0x73, 0xE6);
 
+/// Maximum stroke thickness offered by commenting controls, in PDF points.
+pub const MAX_LINE_WIDTH: f64 = 100.0;
+
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
 pub enum CommentTool {
     Note,
@@ -63,6 +66,7 @@ pub enum CommentTool {
     StrikeOut,
     Squiggly,
     Ink,
+    FreehandHighlight,
     Line,
     Arrow,
     Rectangle,
@@ -80,7 +84,15 @@ pub enum CommentTool {
 /// The quick-bar flyout groups, in Acrobat's order: Comment ▸, Highlight ▸, Draw ▸.
 pub const GROUPS: [&[CommentTool]; 3] = [
     &[CommentTool::Note, CommentTool::TextBox, CommentTool::Callout, CommentTool::Attach],
-    &[CommentTool::Highlight, CommentTool::Underline, CommentTool::StrikeOut, CommentTool::Squiggly, CommentTool::Caret, CommentTool::ReplaceText],
+    &[
+        CommentTool::Highlight,
+        CommentTool::FreehandHighlight,
+        CommentTool::Underline,
+        CommentTool::StrikeOut,
+        CommentTool::Squiggly,
+        CommentTool::Caret,
+        CommentTool::ReplaceText,
+    ],
     &[
         CommentTool::Ink,
         CommentTool::Line,
@@ -94,7 +106,8 @@ pub const GROUPS: [&[CommentTool]; 3] = [
     ],
 ];
 
-pub const ALL: [CommentTool; 19] = [
+pub const ALL: [CommentTool; 20] = [
+    CommentTool::FreehandHighlight,
     CommentTool::Eraser,
     CommentTool::ReplaceText,
     CommentTool::Attach,
@@ -117,6 +130,7 @@ pub const ALL: [CommentTool; 19] = [
 ];
 
 impl CommentTool {
+    /// The command registry identifier (`"comment.*"`) corresponding to this tool.
     pub fn command(self) -> &'static str {
         match self {
             Self::Note => "comment.note",
@@ -125,6 +139,7 @@ impl CommentTool {
             Self::Underline => "comment.underline",
             Self::StrikeOut => "comment.strikeout",
             Self::Squiggly => "comment.squiggly",
+            Self::FreehandHighlight => "comment.freehand_highlight",
             Self::Ink => "comment.ink",
             Self::Line => "comment.line",
             Self::Arrow => "comment.arrow",
@@ -141,10 +156,12 @@ impl CommentTool {
         }
     }
 
+    /// Resolve a [`CommentTool`] from its command registry identifier.
     pub fn from_command(id: &str) -> Option<Self> {
         ALL.into_iter().find(|t| t.command() == id)
     }
 
+    /// User-facing label for this commenting tool.
     pub fn label(self) -> &'static str {
         match self {
             Self::Note => "Add a sticky note",
@@ -153,6 +170,7 @@ impl CommentTool {
             Self::Underline => "Underline",
             Self::StrikeOut => "Strikethrough",
             Self::Squiggly => "Squiggly underline",
+            Self::FreehandHighlight => "Freehand-Highlight",
             Self::Ink => "Draw",
             Self::Line => "Line",
             Self::Arrow => "Arrow",
@@ -169,6 +187,7 @@ impl CommentTool {
         }
     }
 
+    /// Lucide icon name for this commenting tool.
     pub fn icon(self) -> &'static str {
         match self {
             Self::Note => "message-square-plus",
@@ -177,6 +196,7 @@ impl CommentTool {
             Self::Underline => "underline",
             Self::StrikeOut => "strikethrough",
             Self::Squiggly => "spline",
+            Self::FreehandHighlight => "highlighter",
             Self::Ink => "pencil",
             Self::Line => "minus",
             Self::Arrow => "move-right",
@@ -209,7 +229,7 @@ impl CommentTool {
 
     /// Tools that draw with a drag gesture.
     pub fn draws(self) -> bool {
-        matches!(self, Self::Ink | Self::Line | Self::Arrow | Self::Rectangle | Self::Oval | Self::Eraser)
+        matches!(self, Self::Ink | Self::FreehandHighlight | Self::Line | Self::Arrow | Self::Rectangle | Self::Oval | Self::Eraser)
     }
 
     /// Tools that place points one click at a time (double-click or Enter finishes).
@@ -240,6 +260,7 @@ impl CommentTool {
             Self::Highlight | Self::Underline | Self::StrikeOut | Self::Squiggly => {
                 Shape::TextMarkup { kind: self.markup().unwrap_or(Markup::Highlight), quads: Vec::new() }
             }
+            Self::FreehandHighlight => Shape::FreehandHighlight { strokes: Vec::new() },
             Self::Ink => Shape::Ink { strokes: Vec::new() },
             Self::Line => Shape::Line { from: [0.0; 2], to: [0.0; 2], start: LineEnding::None, end: LineEnding::None },
             Self::Arrow => Shape::Line { from: [0.0; 2], to: [0.0; 2], start: LineEnding::None, end: LineEnding::OpenArrow },
@@ -318,9 +339,10 @@ impl CommentPrefs {
         }
     }
 
+    /// Clamp and store the stroke width (`tool.min_width()..=MAX_LINE_WIDTH`) for `tool`.
     pub fn set_width(&mut self, tool: CommentTool, w: f64) {
         if let Some((_, s)) = self.styles.iter_mut().find(|(t, _)| *t == tool) {
-            s.width = w.clamp(tool.min_width(), 12.0);
+            s.width = if w.is_finite() { w.clamp(tool.min_width(), MAX_LINE_WIDTH) } else { s.width };
         }
     }
 
@@ -381,6 +403,7 @@ pub fn tool_for(a: &Annotation) -> Option<CommentTool> {
         ("StrikeOut", Some("StrikeOutTextEdit")) => CommentTool::ReplaceText,
         ("StrikeOut", _) => CommentTool::StrikeOut,
         ("Squiggly", _) => CommentTool::Squiggly,
+        ("Ink", Some("FreehandHighlight")) => CommentTool::FreehandHighlight,
         ("Ink", _) => CommentTool::Ink,
         ("Line", _) => CommentTool::Line,
         ("Square", _) => CommentTool::Rectangle,
diff --git a/crates/ui-egui/src/tools/comments/input.rs b/crates/ui-egui/src/tools/comments/input.rs
index 5e74fdf56e..a7ef6c92e1 100644
--- a/crates/ui-egui/src/tools/comments/input.rs
+++ b/crates/ui-egui/src/tools/comments/input.rs
@@ -140,7 +140,7 @@ fn on_link(cx: &PageCx<'_>, p: Pos2) -> bool {
 /// clear; not while drawing freehand, where it would cover the next stroke (#429); and not while a
 /// comment is moved, resized or drawn.
 pub(crate) fn describe(cx: &PageCx<'_>, view: &mut DocView) {
-    let freehand = matches!(cx.tool, QuickTool::Comment(CommentTool::Ink | CommentTool::Eraser));
+    let freehand = matches!(cx.tool, QuickTool::Comment(CommentTool::Ink | CommentTool::FreehandHighlight | CommentTool::Eraser));
     if matches!(cx.tool, QuickTool::Fill(_)) || freehand || view.comments.gesture.is_some() {
         return;
     }
@@ -343,7 +343,7 @@ impl Gestures<'_> {
         {
             let p = clamp_to(page_rect, p);
             let u = cx.to_user(p);
-            if matches!(*tool, CommentTool::Ink | CommentTool::Eraser) {
+            if matches!(*tool, CommentTool::Ink | CommentTool::FreehandHighlight | CommentTool::Eraser) {
                 let last = points.last().map(|l| cx.to_screen(*l)).unwrap_or(p);
                 if last.distance(p) >= 1.5 {
                     points.push(u);
@@ -369,7 +369,7 @@ impl Gestures<'_> {
         // A quick press/release does not start an egui drag, but Acrobat's Draw tool treats
         // it as a one-point ink stroke (a dot). The appearance uses round line caps, so a
         // single PDF point is visible and remains editable like any other drawing.
-        if tool == CommentTool::Ink
+        if matches!(tool, CommentTool::Ink | CommentTool::FreehandHighlight)
             && resp.clicked()
             && over_page
             && let Some(p) = pointer
diff --git a/crates/ui-egui/src/tools/comments/menu.rs b/crates/ui-egui/src/tools/comments/menu.rs
index 52ea8d707d..b577fbbd29 100644
--- a/crates/ui-egui/src/tools/comments/menu.rs
+++ b/crates/ui-egui/src/tools/comments/menu.rs
@@ -330,7 +330,7 @@ pub(crate) fn quick_bar_controls(ui: &mut egui::Ui, tool: CommentTool, prefs: &m
             ui.set_min_width(180.0);
             let mut w = style.width;
             ui.label(egui::RichText::new(tl!("Line thickness")).font(theme::semibold(12.0)));
-            if ui.add(egui::Slider::new(&mut w, tool.min_width()..=12.0).step_by(0.5).suffix(" pt")).changed() {
+            if ui.add(egui::Slider::new(&mut w, tool.min_width()..=super::MAX_LINE_WIDTH).step_by(0.5).suffix(" pt")).changed() {
                 prefs.set_width(tool, w);
             }
         });
diff --git a/crates/ui-egui/src/tools/comments/paint.rs b/crates/ui-egui/src/tools/comments/paint.rs
index bfcd67982b..59b5ca773a 100644
--- a/crates/ui-egui/src/tools/comments/paint.rs
+++ b/crates/ui-egui/src/tools/comments/paint.rs
@@ -127,10 +127,10 @@ fn paint_draw(painter: &egui::Painter, cx: &PageCx<'_>, tool: &CommentTool, poin
     {
         let style = cx.prefs.style(*tool);
         let zoom = cx.xf.zoom();
-        let stroke = Stroke::new((style.width as f32 * zoom).max(1.0), color32(style.color));
+        let stroke = Stroke::new((style.width as f32 * zoom).max(1.0), color32(style.color).gamma_multiply(style.opacity as f32));
         let pts: Vec<Pos2> = points.iter().map(|p| cx.to_screen(*p)).collect();
         match tool {
-            CommentTool::Ink => {
+            CommentTool::Ink | CommentTool::FreehandHighlight => {
                 painter.add(egui::Shape::line(pts, stroke));
             }
             CommentTool::Eraser => {
@@ -186,6 +186,7 @@ pub(super) fn drawn_shape(tool: CommentTool, points: &[[f64; 2]]) -> Option<Shap
     let rect = [first[0].min(last[0]), first[1].min(last[1]), first[0].max(last[0]), first[1].max(last[1])];
     let big = rect[2] - rect[0] >= 2.0 && rect[3] - rect[1] >= 2.0;
     match tool {
+        CommentTool::FreehandHighlight if !points.is_empty() => Some(Shape::FreehandHighlight { strokes: vec![points.to_vec()] }),
         CommentTool::Ink if !points.is_empty() => Some(Shape::Ink { strokes: vec![points.to_vec()] }),
         CommentTool::Line | CommentTool::Arrow if far => Some(Shape::Line {
             from: first,
@@ -209,7 +210,7 @@ pub(super) fn drawn_shape(tool: CommentTool, points: &[[f64; 2]]) -> Option<Shap
 /// per point, so the default 2 pt keeps the 12-pixel eraser it always had, and the thickness
 /// slider's 0.5–12 pt gives 3 to 72 pixels across. A setting that isn't a number is the default.
 fn eraser_radius_px(width: f64) -> f64 {
-    3.0 * if width.is_finite() { width.clamp(0.5, 12.0) } else { 2.0 }
+    3.0 * if width.is_finite() { width.clamp(0.5, super::MAX_LINE_WIDTH) } else { 2.0 }
 }
 
 /// Eraser: rub out drawings along `path` (user space); one undo step for all of them. It rubs
diff --git a/crates/ui-egui/src/tools/comments/state.rs b/crates/ui-egui/src/tools/comments/state.rs
index ab24352256..6cac912210 100644
--- a/crates/ui-egui/src/tools/comments/state.rs
+++ b/crates/ui-egui/src/tools/comments/state.rs
@@ -87,7 +87,10 @@ const SETTLE_MAX: usize = 16;
 impl CommentView {
     /// Remember a released drag drawing so it stays on screen until its page is re-rendered.
     pub(crate) fn settle(&mut self, now: f64, page: usize, tool: CommentTool, points: &[[f64; 2]]) {
-        if !matches!(tool, CommentTool::Ink | CommentTool::Line | CommentTool::Arrow | CommentTool::Rectangle | CommentTool::Oval) {
+        if !matches!(
+            tool,
+            CommentTool::Ink | CommentTool::FreehandHighlight | CommentTool::Line | CommentTool::Arrow | CommentTool::Rectangle | CommentTool::Oval
+        ) {
             return;
         }
         self.settling.retain(|s| now - s.since < SETTLE_SECS);
diff --git a/crates/ui-egui/src/tools/comments/tests.rs b/crates/ui-egui/src/tools/comments/tests.rs
index 91e796e43a..6110e8a6fc 100644
--- a/crates/ui-egui/src/tools/comments/tests.rs
+++ b/crates/ui-egui/src/tools/comments/tests.rs
@@ -1,5 +1,22 @@
 use super::*;
 
+#[test]
+fn freehand_highlight_and_draw_accept_widths_up_to_100() {
+    assert_eq!(CommentTool::FreehandHighlight.group(), CommentTool::Highlight.group());
+    assert_eq!(GROUPS.len(), 3);
+    let mut prefs = CommentPrefs::default();
+    assert_eq!(prefs.style(CommentTool::FreehandHighlight).width, 14.0);
+    assert_eq!(prefs.style(CommentTool::FreehandHighlight).opacity, 0.35);
+    for tool in [CommentTool::Ink, CommentTool::FreehandHighlight] {
+        prefs.set_width(tool, 75.0);
+        assert_eq!(prefs.style(tool).width, 75.0);
+        prefs.set_width(tool, 200.0);
+        assert_eq!(prefs.style(tool).width, 100.0);
+        prefs.set_width(tool, f64::NAN);
+        assert_eq!(prefs.style(tool).width, 100.0);
+    }
+}
+
 /// A selected line is drawn where it is going: moved by its body (both ends follow the
 /// pointer), with an end dragged (that end alone), and as released until the page is drawn.
 #[test]
diff --git a/crates/ui-egui/src/tools/content_ui.rs b/crates/ui-egui/src/tools/content_ui.rs
index e28f20e232..f6d7574e25 100644
--- a/crates/ui-egui/src/tools/content_ui.rs
+++ b/crates/ui-egui/src/tools/content_ui.rs
@@ -315,7 +315,10 @@ fn on_page(added: &[Added], page: usize) -> Vec<(usize, &Added)> {
 }
 
 pub(crate) fn hits_added(xf: &PageXform, info: &DocInfo, page: usize, added: &[Added], point: Pos2) -> bool {
-    on_page(added, page).iter().any(|(_, a)| screen_rect(xf, info, page, a.content.rect()).expand(2.0).contains(point))
+    on_page(added, page)
+        .iter()
+        .filter(|(_, a)| matches!(a.content, AddedContent::Text(_)))
+        .any(|(_, a)| screen_rect(xf, info, page, a.content.rect()).expand(2.0).contains(point))
 }
 
 fn handles(r: Rect) -> [(Pos2, bool, bool); 4] {
@@ -355,7 +358,7 @@ pub(crate) fn hit(xf: &PageXform, info: &DocInfo, page: usize, added: &[Added],
     if !xf.rect.contains(p) {
         return None;
     }
-    let items = on_page(added, page);
+    let items: Vec<(usize, &Added)> = on_page(added, page).into_iter().filter(|(_, a)| matches!(a.content, AddedContent::Text(_))).collect();
     let selected = view.content.selected.filter(|s| s.0 == page).and_then(|(_, si)| items.iter().find(|(i, _)| *i == si));
     if let Some((index, a)) = selected
         && let Some((_, left, top)) = handles(screen_rect(xf, info, page, a.content.rect())).into_iter().find(|(c, ..)| c.distance(p) <= 6.0)
@@ -390,11 +393,10 @@ pub(crate) fn page_input(
             let end = pointer.unwrap_or(start);
             if let Some((sp, si)) = cv.selected
                 && sp == page
-                && let Some((_, a)) = on_page(added, page).into_iter().find(|(i, _)| *i == si)
+                && let Some((_, a)) = on_page(added, page).into_iter().find(|(i, a)| *i == si && matches!(a.content, AddedContent::Text(_)))
                 && (end - start).length() >= 1.0
             {
-                let keep = matches!(a.content, AddedContent::Image(_));
-                let r = dragged(screen_rect(xf, info, page, a.content.rect()), grab, end - start, keep);
+                let r = dragged(screen_rect(xf, info, page, a.content.rect()), grab, end - start, false);
                 let (p0, p1) = (to_display(xf, info, page, r.left_bottom()), to_display(xf, info, page, r.right_top()));
                 let mut rect = [p0[0], p0[1], p1[0], p1[1]];
                 if let AddedContent::Text(t) = &a.content
@@ -409,7 +411,7 @@ pub(crate) fn page_input(
         return consumed;
     }
     let Some(p) = pointer.filter(|p| xf.rect.contains(*p)) else { return consumed };
-    let items = on_page(added, page);
+    let items: Vec<(usize, &Added)> = on_page(added, page).into_iter().filter(|(_, a)| matches!(a.content, AddedContent::Text(_))).collect();
     let hit = items.iter().rev().find(|(_, a)| screen_rect(xf, info, page, a.content.rect()).expand(2.0).contains(p)).map(|(i, a)| (*i, *a));
     let selected_rect = cv
         .selected
@@ -515,6 +517,9 @@ pub(crate) fn paint_page(
 ) {
     let cv = &view.content;
     for (i, a) in on_page(added, page) {
+        if matches!(a.content, AddedContent::Image(_)) {
+            continue;
+        }
         if cv.draft.as_ref().is_some_and(|d| d.page == page && d.index == Some(i)) {
             continue;
         }
@@ -537,9 +542,52 @@ pub(crate) fn paint_page(
     }
 }
 
+/// The image controller owns image selection; the added-content panel follows the same XObject.
+pub(crate) fn sync_image_selection(view: &mut DocView, page: usize, images: &[pdfcraft_engine::PageImage], added: &[Added]) {
+    let Some(selection) = view.image_selection.as_ref().filter(|selection| selection.page == page) else { return };
+    if view.content.draft.is_some() {
+        return;
+    }
+    let object = images
+        .get(selection.index)
+        .and_then(|image| image.object)
+        .filter(|object| images.iter().filter(|image| image.object == Some(*object)).count() == 1);
+    view.content.selected = object.and_then(|object| {
+        let mut matches = added
+            .iter()
+            .filter(|item| item.page == page)
+            .enumerate()
+            .filter(|(_, item)| matches!(&item.content, AddedContent::Image(image) if image.image == object));
+        let selected = matches.next().map(|(index, _)| (page, index));
+        if matches.next().is_none() { selected } else { None }
+    });
+    view.content.select_added = None;
+    view.content.grab = None;
+}
+
+/// Leaving the image controller cannot leave a hidden added image owning keyboard actions.
+pub(crate) fn release_image_selection(view: &mut DocView, added: &[Added]) {
+    if view.content.draft.is_some() {
+        return;
+    }
+    let image_selected = view.content.selected.is_some_and(|(page, index)| {
+        added.iter().filter(|item| item.page == page).nth(index).is_some_and(|item| matches!(item.content, AddedContent::Image(_)))
+    });
+    if image_selected {
+        view.content.selected = None;
+        view.content.select_added = None;
+        view.content.grab = None;
+    }
+}
+
 /// Delete removes the selected item; Escape clears the selection.
-pub(crate) fn keys(ctx: &egui::Context, view: &mut DocView) {
-    if view.content.selected.is_none() || view.content.draft.is_some() || ctx.egui_wants_keyboard_input() {
+pub(crate) fn keys(ctx: &egui::Context, view: &mut DocView, image_controller_active: bool) {
+    if image_controller_active && view.image_selection.is_some()
+        || matches!(view.pending_edit.as_ref(), Some(Edit::EditPageImage { .. }))
+        || view.content.selected.is_none()
+        || view.content.draft.is_some()
+        || ctx.egui_wants_keyboard_input()
+    {
         return;
     }
     let (del, esc) = ctx.input(|i| (i.key_pressed(egui::Key::Delete) || i.key_pressed(egui::Key::Backspace), i.key_pressed(egui::Key::Escape)));
@@ -899,7 +947,7 @@ impl crate::PdfCraftApp {
     }
 
     /// Copy Image: image `index` on `page`, at its own resolution, to the clipboard.
-    pub(crate) fn copy_page_image(&mut self, page: usize, index: usize) -> bool {
+    pub fn copy_page_image(&mut self, page: usize, index: usize) -> bool {
         // A newer copy wins over a whole-document copy still reading its pages.
         self.document_copy = None;
         let Some((_, id)) = self.active_ids() else { return false };
@@ -911,12 +959,13 @@ impl crate::PdfCraftApp {
             #[cfg(not(target_arch = "wasm32"))]
             if self.system_clipboard {
                 let img = arboard::ImageData { width: w as usize, height: h as usize, bytes: std::borrow::Cow::Borrowed(&rgba) };
-                arboard::Clipboard::new().and_then(|mut c| c.set_image(img)).map_err(|e| e.to_string())?;
+                crate::os_clipboard::with(|c| c.set_image(img)).map_err(|e| e.to_string())?;
             }
             #[cfg(target_arch = "wasm32")]
             if self.system_clipboard {
                 return Err("the web version can't put images on the clipboard yet; use Save Image As".to_string());
             }
+            self.last_copied_file = None;
             self.last_copied_image = Some((w, h, rgba));
             Ok((w, h))
         });
@@ -933,17 +982,26 @@ impl crate::PdfCraftApp {
     }
 
     /// The picture's visible box on its page, in user space.
-    fn page_image_box(&self, page: usize, index: usize) -> Option<[f64; 4]> {
+    pub(crate) fn page_image_box(&self, page: usize, index: usize) -> Option<[f64; 4]> {
         let (_, id) = self.active_ids()?;
         let image = self.session.get(id)?.page_images(page).into_iter().nth(index)?;
         Some(image.visible_rect.unwrap_or(image.rect))
     }
 
     /// Cut: copy the picture, and only when that worked take it off the page (one undo step).
-    pub(crate) fn cut_page_image(&mut self, page: usize, index: usize) {
-        if self.copy_page_image(page, index) {
-            self.apply_edit(Edit::EditPageImage { page, index, change: pdfcraft_engine::ImageEdit::Delete });
+    pub(crate) fn cut_page_image(&mut self, page: usize, index: usize) -> bool {
+        let Some((view, id)) = self.active_ids() else { return false };
+        if self.session.get(id).is_some_and(|doc| !doc.allows_modification()) {
+            self.notify_error(tl!("The document's security settings don't allow this change"));
+            return false;
         }
+        if !self.copy_page_image(page, index) || !self.apply_edit(Edit::EditPageImage { page, index, change: pdfcraft_engine::ImageEdit::Delete }) {
+            return false;
+        }
+        if let Some(view) = self.views.get_mut(view) {
+            view.image_selection = None;
+        }
+        true
     }
 
     /// Redact image: a redaction mark over the whole picture. It is applied, like any mark, from
@@ -1002,50 +1060,203 @@ impl crate::PdfCraftApp {
     pub fn add_image(&mut self, name: String, bytes: Vec<u8>) {
         let Some((i, id)) = self.active_ids() else { return };
         let page = self.views[i].current;
-        let before = self.session.get(id).map_or(0, |d| d.added().iter().filter(|a| a.page == page).count());
+        let before_img = self.session.get(id).map_or(0, |d| d.page_images(page).len());
+        let before_added = self.session.get(id).map_or(0, |d| d.added().iter().filter(|a| a.page == page).count());
         if self.apply_edit(Edit::AddImage { page, rect: None, name, bytes: std::sync::Arc::new(bytes) }) {
-            self.views[i].content.select_added = Some((page, before));
+            self.views[i].content.selected = Some((page, before_added));
+            self.views[i].content.select_added = Some((page, before_added));
+            self.views[i].image_selection = Some(crate::edit_text_ui::ImageSelection::at(page, before_img));
+            self.quick_tool = crate::QuickTool::EditText;
             self.left = crate::LeftPanel::Tool("edit");
             self.left_open = true;
         }
     }
 
-    /// Whether ⌘V / Ctrl+V was let go this frame. egui-winit swallows that press (with a Paste
-    /// event only if the clipboard holds text), while a plain V press always comes through: a
-    /// release of V with no press of V since the last one is the shortcut, even when ⌘ or Ctrl
-    /// was let go first. Read every frame, dialogs or not, so a press is never missed.
-    pub(crate) fn paste_key_released(&mut self, ctx: &egui::Context) -> bool {
-        let mut released = false;
-        ctx.input(|inp| {
-            for e in &inp.events {
-                if let egui::Event::Key { key: egui::Key::V, pressed, .. } = e {
-                    released |= !*pressed && !self.v_pressed;
-                    self.v_pressed = *pressed;
-                }
+    /// Whether there is an image in the in-memory clipboard or system clipboard ready to paste.
+    pub fn can_paste_image(&self) -> bool {
+        if let Some(crate::create_ui::Clip::Image { .. }) = self.clipboard_override.as_ref() {
+            return true;
+        }
+        if self.clipboard_override.is_some() {
+            return false;
+        }
+        #[cfg(not(target_arch = "wasm32"))]
+        {
+            if self.system_clipboard {
+                return matches!(crate::os_clipboard::for_image_paste(), Some(crate::create_ui::Clip::Image { .. }));
             }
-        });
-        released
+        }
+        self.last_copied_image.is_some() || self.last_copied_file.is_some()
     }
 
-    /// ⌘V / Ctrl+V with a picture on the system clipboard (a screenshot, a picture copied in a
-    /// browser) places it on the current page, as Add Image does.
-    /// Organize Pages keeps ⌘V for pages, Prepare Form for fields, and text fields for text.
-    pub(crate) fn paste_image_key(&mut self, i: usize, ctx: &egui::Context, pasted: bool) {
-        let free = self.dialog.is_none() && !self.palette_open && !ctx.egui_wants_keyboard_input();
-        let Some(view) = self.views.get(i) else { return };
-        if !pasted || !free || view.organize || view.forms.focus.is_some() || self.is_preparing() {
-            return;
+    /// Paste the integration's delivered pixels without rereading a clipboard that may have changed.
+    pub(crate) fn paste_received_image(&mut self, page: usize, image: &egui::ColorImage) -> bool {
+        let [width, height] = image.size;
+        let pixels = width.checked_mul(height);
+        let bytes = pixels.and_then(|n| n.checked_mul(4));
+        if width == 0
+            || height == 0
+            || width > crate::create_ui::MAX_IMAGE_SIDE
+            || height > crate::create_ui::MAX_IMAGE_SIDE
+            || pixels != Some(image.pixels.len())
+            || bytes.is_none_or(|n| n > crate::create_ui::MAX_IMAGE_BYTES)
+        {
+            self.notify_error("the clipboard image is empty, malformed or exceeds size limits");
+            return false;
         }
-        let clip = match self.clipboard_override.clone() {
-            Some(c) => Some(c),
-            #[cfg(not(target_arch = "wasm32"))]
-            None if self.system_clipboard => crate::create_ui::read_clipboard(),
-            None => None,
+        let rgba = image.pixels.iter().flat_map(egui::Color32::to_srgba_unmultiplied).collect();
+        let delivered = crate::create_ui::Clip::Image { width, height, rgba };
+        self.paste_image_with_system(page, None, None, None, false, Some(delivered))
+    }
+
+    /// Paste an image from the clipboard onto `page`.
+    pub fn paste_image(&mut self, page: usize, rect: Option<[f64; 4]>) -> bool {
+        self.paste_image_internal(page, rect, None)
+    }
+
+    /// Paste an image centered at context menu point `at: [f64; 2]` on `page`.
+    pub fn paste_image_at(&mut self, page: usize, at: [f64; 2]) -> bool {
+        self.paste_image_internal(page, None, Some(at))
+    }
+
+    fn paste_image_internal(&mut self, page: usize, rect: Option<[f64; 4]>, at: Option<[f64; 2]>) -> bool {
+        #[cfg(not(target_arch = "wasm32"))]
+        let system = if self.clipboard_override.is_none() && self.system_clipboard { crate::os_clipboard::for_image_paste() } else { None };
+        #[cfg(target_arch = "wasm32")]
+        let system = None;
+        self.paste_image_with_system(
+            page,
+            rect,
+            at,
+            system,
+            cfg!(not(target_arch = "wasm32")) && self.system_clipboard,
+            self.clipboard_override.clone(),
+        )
+    }
+
+    fn paste_image_with_system(
+        &mut self,
+        page: usize,
+        rect: Option<[f64; 4]>,
+        at: Option<[f64; 2]>,
+        system: Option<crate::create_ui::Clip>,
+        system_authoritative: bool,
+        clipboard: Option<crate::create_ui::Clip>,
+    ) -> bool {
+        let Some((i, id)) = self.active_ids() else {
+            return false;
         };
-        let Some(crate::create_ui::Clip::Image { width, height, rgba }) = clip else { return };
-        match crate::create_ui::png_from_rgba(width, height, &rgba) {
-            Ok(png) => self.add_image("Pasted image.png".into(), png),
-            Err(e) => self.notify_fmt("Couldn't read {name}: {e}", &[("name", tl!("Clipboard")), ("e", &e)]),
+        if let Some(doc) = self.session.get(id)
+            && !doc.allows_modification()
+        {
+            self.notify_error(tl!("The document's security settings don't allow this change"));
+            return false;
+        }
+
+        let image_data: Option<(String, Vec<u8>)> = match clipboard {
+            Some(crate::create_ui::Clip::Image { width, height, rgba }) => {
+                let is_same = self
+                    .last_copied_image
+                    .as_ref()
+                    .is_some_and(|(w, h, bytes)| *w as usize == width && *h as usize == height && bytes.as_slice() == rgba.as_slice());
+                if !is_same {
+                    self.last_copied_file = None;
+                    self.last_copied_image = Some((width as u32, height as u32, rgba.clone()));
+                }
+                crate::create_ui::png_from_rgba(width, height, &rgba).ok().map(|b| ("pasted_image.png".to_string(), b))
+            }
+            Some(crate::create_ui::Clip::Text(_)) => None,
+            None => {
+                if matches!(system, Some(crate::create_ui::Clip::Text(_))) || (system_authoritative && system.is_none()) {
+                    self.last_copied_image = None;
+                    self.last_copied_file = None;
+                    self.notify_tr("No image on clipboard to paste");
+                    return false;
+                }
+                let sys_result = match system {
+                    Some(crate::create_ui::Clip::Image { width, height, rgba }) => Some((width, height, rgba)),
+                    _ => None,
+                };
+
+                if let Some((img_width, img_height, img_bytes)) = sys_result {
+                    let is_same_as_last = self
+                        .last_copied_image
+                        .as_ref()
+                        .is_some_and(|(w, h, rgba)| *w as usize == img_width && *h as usize == img_height && rgba.as_slice() == img_bytes.as_slice());
+                    if is_same_as_last && let Some((name, bytes)) = self.last_copied_file.clone() {
+                        Some((name, bytes))
+                    } else if is_same_as_last && let Some((w, h, rgba)) = self.last_copied_image.clone() {
+                        crate::create_ui::png_from_rgba(w as usize, h as usize, &rgba).ok().map(|b| ("pasted_image.png".to_string(), b))
+                    } else {
+                        // System clipboard has a newer / external image!
+                        self.last_copied_file = None;
+                        self.last_copied_image = Some((img_width as u32, img_height as u32, img_bytes.clone()));
+                        crate::create_ui::png_from_rgba(img_width, img_height, &img_bytes).ok().map(|b| ("clipboard_image.png".to_string(), b))
+                    }
+                } else if let Some((name, bytes)) = self.last_copied_file.clone() {
+                    Some((name, bytes))
+                } else if let Some((w, h, rgba)) = self.last_copied_image.clone() {
+                    crate::create_ui::png_from_rgba(w as usize, h as usize, &rgba).ok().map(|b| ("pasted_image.png".to_string(), b))
+                } else {
+                    None
+                }
+            }
+        };
+
+        let Some((name, bytes)) = image_data else {
+            self.notify_tr("No image on clipboard to paste");
+            return false;
+        };
+
+        let target_rect = if let Some(r) = rect {
+            Some(r)
+        } else if let Some(at) = at {
+            let (raw_w, raw_h) = self
+                .last_copied_image
+                .as_ref()
+                .map(|(w, h, _)| (*w as f64, *h as f64))
+                .or_else(|| {
+                    (bytes.len() <= 64_000_000 * 4).then(|| pdfcraft_engine::image_dimensions(&bytes)).flatten().map(|(w, h)| (w as f64, h as f64))
+                })
+                .unwrap_or((100.0, 100.0));
+            let (pw, ph) =
+                self.session.get(id).and_then(|d| d.info.pages.get(page)).map(|p| (p.width as f64, p.height as f64)).unwrap_or((612.0, 792.0));
+            let k = ((pw * 0.8) / raw_w.max(1.0)).min((ph * 0.8) / raw_h.max(1.0)).min(1.0);
+            let (w, h) = (raw_w * k, raw_h * k);
+            let Some(info) = self.session.get(id).and_then(|doc| doc.info.pages.get(page)) else { return false };
+            let view = info.user_to_view(at[0] as f32, at[1] as f32).map(f64::from);
+            // Added content uses the page's bottom-left display origin; rendered view space is y-down.
+            let center = [view[0], f64::from(info.height) - view[1]];
+            Some([center[0] - w * 0.5, center[1] - h * 0.5, center[0] + w * 0.5, center[1] + h * 0.5])
+        } else {
+            None
+        };
+
+        let added_before: std::collections::HashSet<_> =
+            self.session.get(id).into_iter().flat_map(|doc| doc.added()).filter(|item| item.page == page).map(|item| item.obj).collect();
+        if self.apply_edit(pdfcraft_engine::Edit::AddImage { page, rect: target_rect, name, bytes: std::sync::Arc::new(bytes) }) {
+            let selection = self.session.get(id).and_then(|doc| {
+                let mut inserted =
+                    doc.added().iter().filter(|item| item.page == page).enumerate().filter(|(_, item)| !added_before.contains(&item.obj));
+                let (added_idx, item) = inserted.next()?;
+                if inserted.next().is_some() {
+                    return None;
+                }
+                let AddedContent::Image(image) = &item.content else { return None };
+                let pasted_idx = doc.page_images(page).iter().rposition(|placed| placed.object == Some(image.image))?;
+                Some((added_idx, pasted_idx))
+            });
+            if let Some(v) = self.views.get_mut(i) {
+                v.current = page;
+                v.content.selected = selection.map(|(added, _)| (page, added));
+                v.content.select_added = v.content.selected;
+                v.image_selection = selection.map(|(_, image)| crate::edit_text_ui::ImageSelection::at(page, image));
+            }
+            self.quick_tool = crate::QuickTool::EditText;
+            self.notify_tr("Image pasted");
+            true
+        } else {
+            false
         }
     }
 }
@@ -1141,6 +1352,89 @@ mod tests {
 
     use super::*;
 
+    #[test]
+    fn delivered_pixels_are_bounded_before_cache_or_document_changes() {
+        let mut app = crate::PdfCraftApp::new();
+        app.create_blank();
+        app.last_copied_image = Some((1, 1, vec![0, 255, 0, 255]));
+        let before = app.last_copied_image.clone();
+        for size in [[0, 1], [usize::MAX, 2], [crate::create_ui::MAX_IMAGE_SIDE + 1, 1], [2, 2]] {
+            let mut image = egui::ColorImage::filled([1, 1], egui::Color32::RED);
+            image.size = size;
+            assert!(!app.paste_received_image(0, &image));
+            assert_eq!(app.last_copied_image, before);
+        }
+        assert!(app.session.get(app.views[0].id).unwrap().page_images(0).is_empty());
+    }
+
+    #[test]
+    fn delivered_pixels_keep_unpremultiplied_alpha() {
+        let mut app = crate::PdfCraftApp::new();
+        app.create_blank();
+        let image = egui::ColorImage::from_rgba_unmultiplied([1, 1], &[255, 0, 0, 128]);
+        assert!(app.paste_received_image(0, &image));
+        assert_eq!(app.last_copied_image.unwrap().2, vec![255, 0, 0, 128]);
+    }
+
+    #[test]
+    fn review_web_can_paste_an_internal_image_without_a_native_clipboard() {
+        let mut app = crate::PdfCraftApp::new();
+        app.create_blank();
+        app.system_clipboard = true;
+        app.last_copied_image = Some((1, 1, vec![255, 0, 0, 255]));
+        assert!(app.paste_image_with_system(0, None, None, None, false, None));
+        let id = app.active_ids().unwrap().1;
+        assert_eq!(app.session.get(id).unwrap().page_images(0).len(), 1);
+    }
+
+    #[test]
+    fn review_system_without_supported_formats_does_not_paste_a_cached_image() {
+        let mut app = crate::PdfCraftApp::new();
+        app.create_blank();
+        app.system_clipboard = true;
+        app.last_copied_image = Some((1, 1, vec![255, 0, 0, 255]));
+        assert!(!app.paste_image_with_system(0, None, None, None, true, None));
+    }
+
+    #[test]
+    fn review_cut_checks_modify_permission_before_writing_the_clipboard() {
+        let mut app = crate::PdfCraftApp::new();
+        app.system_clipboard = false;
+        app.create_blank();
+        let png = crate::create_ui::png_from_rgba(1, 1, &[255, 0, 0, 255]).unwrap();
+        app.add_image("test.png".into(), png);
+        app.apply_edit(Edit::Protect(pdfcraft_engine::Protection {
+            permissions_password: Some("owner".into()),
+            changes: pdfcraft_engine::Changes::None,
+            copy: true,
+            ..Default::default()
+        }));
+        let id = app.active_ids().unwrap().1;
+        let bytes = app.session.save_bytes(id).unwrap();
+        let mut locked = crate::PdfCraftApp::new();
+        locked.system_clipboard = false;
+        locked.open_bytes("locked.pdf", None, bytes.as_ref().clone()).unwrap();
+        assert!(!locked.session.get(locked.active_ids().unwrap().1).unwrap().allows_modification());
+        locked.last_copied_image = Some((1, 1, vec![0, 255, 0, 255]));
+        let before = locked.last_copied_image.clone();
+        assert!(!locked.cut_page_image(0, 0));
+        assert_eq!(locked.last_copied_image, before);
+    }
+
+    #[test]
+    fn system_text_prevents_context_menu_paste_of_a_cached_image() {
+        let mut app = crate::PdfCraftApp::new();
+        app.system_clipboard = false;
+        app.create_blank();
+        let id = app.active_ids().unwrap().1;
+        app.last_copied_image = Some((1, 1, vec![255, 0, 0, 255]));
+        let undo = app.session.get(id).unwrap().can_undo().map(str::to_owned);
+        assert!(!app.paste_image_with_system(0, None, Some([20.0, 20.0]), Some(crate::create_ui::Clip::Text("new text".into())), true, None));
+        assert_eq!(app.session.get(id).unwrap().can_undo().map(str::to_owned), undo);
+        assert!(app.session.get(id).unwrap().page_images(0).is_empty());
+        assert!(app.last_copied_image.is_none());
+    }
+
     /// The image a flip button leaves behind, as the panel returns it.
     fn flipped(tooltip: &str) -> pdfcraft_engine::AddedImage {
         let img = pdfcraft_engine::AddedImage::new([0.0, 0.0, 100.0, 50.0], pdfcraft_cos::ObjRef::new(7, 0));
diff --git a/crates/ui-egui/src/tools/edit_text_ui.rs b/crates/ui-egui/src/tools/edit_text_ui.rs
index 768af2059b..681564c146 100644
--- a/crates/ui-egui/src/tools/edit_text_ui.rs
+++ b/crates/ui-egui/src/tools/edit_text_ui.rs
@@ -7,7 +7,7 @@
 use std::collections::BTreeMap;
 use std::sync::Arc;
 
-use egui::{Color32, CornerRadius, FontFamily, FontId, Pos2, Rect, Stroke};
+use egui::{Color32, CornerRadius, FontFamily, FontId, Pos2, Rect, Stroke, pos2};
 use pdfcraft_engine::{Edit, ObjectKind, ObjectTarget};
 use pdfcraft_render::DocInfo;
 
@@ -21,14 +21,17 @@ mod image;
 mod layout;
 
 pub(crate) use background::TextBackground;
-pub use image::{CropMode, ImageSelection};
-pub(crate) use image::{ImageAction, ImageCx, body_hit as picture_hit, handle_hit as picture_handle_hit, image_input};
+pub use image::{CropMode, DragTarget, ImageAction, ImageDrag, ImageHandle, ImageSelection, image_menu_id};
+pub(crate) use image::{
+    ImageCx, Matrix, body_hit as picture_hit, crop_controls_contain, handle_hit as picture_handle_hit, image_context_menu, image_input,
+    quad_contains, user_to_screen,
+};
 #[cfg(test)]
-use image::{rotate_knob, turn_degrees};
+use image::{rotate_knob, turn_degrees, turn_degrees_delta};
 #[cfg(test)]
 use layout::{DARK_EDITOR_FILL, contrast};
 pub(crate) use layout::{caret_color_on, editor_fill, editor_font, install_source_fonts};
-use layout::{color32, editor_galley, editor_job, look_of, luminance, unseen};
+use layout::{color32, editor_galley, editor_job, look_of, luminance, source_look, unseen};
 
 const ACCENT: Color32 = Color32::from_rgb(0x14, 0x73, 0xE6);
 
@@ -42,7 +45,22 @@ enum TextTarget {
 /// ~1000 tiny images on one page; stroking all of them every frame (plus a hover query
 /// per box) stalls the UI. Past this, only the selected and hovered boxes are outlined:
 /// hit-testing still covers every image, so nothing becomes unselectable.
-const MAX_OUTLINES: usize = 250;
+pub(crate) const MAX_OUTLINES: usize = 250;
+
+/// Format text ▸ Superscript or Subscript on `text`: on the `selection` (bytes of `text`), or all
+/// of it without one ([`pdfcraft_engine::text_script::toggle`]). A selection follows the
+/// converted characters. Whether the text changed.
+pub(crate) fn toggle_script(text: &mut String, selection: &mut Option<std::ops::Range<usize>>, script: pdfcraft_engine::text_script::Script) -> bool {
+    if selection.as_ref().is_some_and(|r| r.is_empty()) {
+        *selection = None;
+    }
+    let Some((toggled, range)) = pdfcraft_engine::text_script::toggle(text, selection.as_ref(), script) else { return false };
+    *text = toggled;
+    if selection.is_some() {
+        *selection = Some(range);
+    }
+    true
+}
 
 /// A paragraph being edited.
 #[derive(Clone, Debug, PartialEq)]
@@ -67,7 +85,7 @@ pub struct LineEditor {
     /// Current screen-space size. Recomputed from the current page transform before painting.
     size: f32,
     /// Take the keyboard focus on the next frame.
-    pub(crate) focus: bool,
+    pub focus: bool,
     /// Whether the text box had the keyboard at the end of the editor's last frame
     /// ([`lost_focus_once`]).
     had_focus: bool,
@@ -78,6 +96,7 @@ pub struct LineEditor {
     /// (Calibri reads as Helvetica) can be the one picked, so comparing `look` with `look0` alone
     /// would miss the choice.
     family_chosen: bool,
+    size_chosen: bool,
     /// Underline, line spacing (× size; 0 = the paragraph's own), character spacing (pt) and
     /// horizontal scale (%), and what they were.
     pub extras: Extras,
@@ -226,10 +245,7 @@ impl LineEditor {
         }
         let base = self.source.as_ref().map(|(block, _)| block.base_font.as_str()).unwrap_or_default();
         // "ABCDEF+Calibri" is a subset of Calibri.
-        let name = match base.split_once('+') {
-            Some((tag, rest)) if tag.len() == 6 && tag.bytes().all(|b| b.is_ascii_uppercase()) => rest,
-            _ => base,
-        };
+        let name = pdfcraft_engine::strip_subset_tag(base);
         if name.is_empty() { tl!("Keep source fonts").to_string() } else { name.to_string() }
     }
 
@@ -254,7 +270,7 @@ impl LineEditor {
 
     /// Whether the paragraph with `text` in it differs from what was opened.
     fn changes_with(&self, text: &str) -> bool {
-        text != self.original || self.look != self.look0 || self.extras != self.extras0 || self.family_chosen
+        text != self.original || self.look != self.look0 || self.extras != self.extras0 || self.family_chosen || self.size_chosen
     }
 
     /// Extra width permitted by the editor. Source containers now remain fixed.
@@ -273,7 +289,7 @@ impl LineEditor {
         let mut style = pdfcraft_engine::BlockStyle {
             resource: self.font_resource.clone(),
             family: (l.family != o.family || self.family_chosen || l.bold != o.bold || l.italic != o.italic).then_some((l.family, l.bold, l.italic)),
-            size: (l.size != o.size).then_some(l.size),
+            size: (self.size_chosen || l.size != o.size).then_some(l.size),
             color: (l.color != o.color).then_some(l.color),
             // The whole paragraph's alignment when it was picked, or when the rows' own were
             // dropped for it (the rows are where those put them, so leaving it out keeps them there).
@@ -314,14 +330,22 @@ impl LineEditor {
         style
     }
 
-    /// After applying formatting: the paragraph now has it. The selection stays, as the box still
-    /// shows it, so a second alignment or format picked for it applies to the same rows.
+    /// An explicit size commit also normalizes a mixed selection to the displayed value.
+    pub(crate) fn choose_size(&mut self, size: f64) {
+        self.look.size = size;
+        self.size_chosen = true;
+    }
+
+    /// After applying formatting: the paragraph now has it. Its old byte selection is cleared;
+    /// the rewritten paragraph may have different text or geometry.
     pub fn applied(&mut self) {
+        self.size_chosen = false;
         self.font_resource = None;
         self.family_chosen = false;
         self.look0 = self.look.clone();
         self.extras0 = self.extras;
         self.original = self.text.clone();
+        self.selection = None;
         // The page now has this text: the box's history restarts, even when the format left the
         // text as it was, so a Redo from before can't put undone typing back on top of it.
         self.typing_from = None;
@@ -348,6 +372,120 @@ impl LineEditor {
         self.original = self.text.clone();
     }
 
+    fn current_formatting(&self, sources: &[(String, String)]) -> SelectionFormatting {
+        SelectionFormatting {
+            font_shown: self.font_shown(sources),
+            size: Some(self.look.size),
+            family: Some(self.look.family),
+            bold: Some(self.look.bold),
+            italic: Some(self.look.italic),
+            color: Some(self.look.color),
+        }
+    }
+
+    pub fn selection_formatting(&self, sources: &[(String, String)]) -> SelectionFormatting {
+        let Some((block, lines)) = &self.source else {
+            return self.current_formatting(sources);
+        };
+
+        let spans = block.edited_spans(&self.text);
+        let matching_lines: Vec<&pdfcraft_engine::TextLine> = match &self.selection {
+            Some(range) if range.start < range.end => {
+                spans.iter().filter(|(span, _)| span.start < range.end && span.end > range.start).filter_map(|(_, idx)| lines.get(*idx)).collect()
+            }
+            _ => spans.iter().filter_map(|(_, idx)| lines.get(*idx)).collect(),
+        };
+
+        let Some(first) = matching_lines.first().copied() else {
+            return self.current_formatting(sources);
+        };
+
+        let line_font = |l: &pdfcraft_engine::TextLine| -> String {
+            if let Some((_, face)) = sources.iter().find(|(res, _)| res == &l.font) {
+                return face.clone();
+            }
+            let base = l.base_font.as_str();
+            let name = pdfcraft_engine::strip_subset_tag(base);
+            if let Some((_, face)) = sources.iter().find(|(_, face)| face.as_str() == name) {
+                return face.clone();
+            }
+            let look = look_of_line(l);
+            let lower = name.to_ascii_lowercase();
+            if ["times", "serif", "roman", "courier", "helvetica", "arial"].iter().any(|s| lower.contains(s)) {
+                return look.family.label().to_string();
+            }
+            if name.is_empty() { tl!("Keep source fonts").to_string() } else { name.to_string() }
+        };
+
+        let first_font = line_font(first);
+        let same_font = matching_lines.iter().skip(1).all(|l| line_font(l) == first_font);
+        let font_shown = if same_font {
+            if self.font_resource.is_some() || self.look.family != self.look0.family || self.family_chosen {
+                self.font_shown(sources)
+            } else {
+                first_font
+            }
+        } else {
+            tl!("Mixed").to_string()
+        };
+
+        let first_size = (first.size * 10.0).round() / 10.0;
+        let same_size = matching_lines.iter().skip(1).all(|l| ((l.size * 10.0).round() / 10.0 - first_size).abs() < 0.05);
+        let size = if same_size { Some(first_size) } else { None };
+
+        let first_look = look_of_line(first);
+        let same_family = matching_lines.iter().skip(1).all(|l| look_of_line(l).family == first_look.family);
+        let family = if same_family { Some(first_look.family) } else { None };
+        let same_bold = matching_lines.iter().skip(1).all(|l| l.bold == first.bold);
+        let bold = if same_bold { Some(first.bold) } else { None };
+        let same_italic = matching_lines.iter().skip(1).all(|l| l.italic == first.italic);
+        let italic = if same_italic { Some(first.italic) } else { None };
+        let same_color = matching_lines.iter().skip(1).all(|l| l.color == first.color);
+        let color = if same_color { Some(first.color) } else { None };
+
+        SelectionFormatting { font_shown, size, family, bold, italic, color }
+    }
+
+    pub(crate) fn sync_selection_look(&mut self, fmt: &SelectionFormatting) {
+        if let Some(sz) = fmt.size {
+            self.look.size = sz;
+            self.look0.size = sz;
+        } else {
+            if self.look.size <= 0.0 {
+                self.look.size = 12.0;
+            }
+            self.look0.size = self.look.size;
+        }
+        if let Some(f) = fmt.family {
+            self.look.family = f;
+            self.look0.family = f;
+        }
+        match fmt.bold {
+            Some(b) => {
+                self.look.bold = b;
+                self.look0.bold = b;
+            }
+            None => {
+                self.look.bold = false;
+                self.look0.bold = false;
+            }
+        }
+        match fmt.italic {
+            Some(it) => {
+                self.look.italic = it;
+                self.look0.italic = it;
+            }
+            None => {
+                self.look.italic = false;
+                self.look0.italic = false;
+            }
+        }
+        if let Some(c) = fmt.color {
+            self.look.color = c;
+            self.look0.color = c;
+        }
+    }
+
     /// The text changed from `before` through the box's own typing (typing, Undo, Redo): rows
     /// aligned on their own keep their alignment, and a row Undo brings back gets its own back.
     pub(crate) fn follow_typed_rows(&mut self, ctx: &egui::Context, before: &str) {
@@ -362,6 +500,20 @@ impl LineEditor {
     }
 }
 
+#[derive(Clone, Debug, PartialEq)]
+pub struct SelectionFormatting {
+    pub font_shown: String,
+    pub size: Option<f64>,
+    pub family: Option<pdfcraft_engine::FontFamily>,
+    pub bold: Option<bool>,
+    pub italic: Option<bool>,
+    pub color: Option<[f64; 3]>,
+}
+
+fn look_of_line(l: &pdfcraft_engine::TextLine) -> pdfcraft_engine::AddedText {
+    source_look(&l.base_font, l.size, l.color, l.bold, l.italic)
+}
+
 /// What a drag on a paragraph box takes hold of.
 #[derive(Clone, Copy, Debug, PartialEq)]
 enum Grip {
@@ -458,7 +610,7 @@ pub(crate) fn hit(xf: &PageXform, info: &DocInfo, page: usize, lines: &[pdfcraft
     })
 }
 
-fn user_box(xf: &PageXform, info: &DocInfo, page: usize, r: Rect) -> [f64; 4] {
+pub(crate) fn user_box(xf: &PageXform, info: &DocInfo, page: usize, r: Rect) -> [f64; 4] {
     let p = &info.pages[page];
     let (a, b) = (xf.screen_to_view(r.min), xf.screen_to_view(r.max));
     let (u, v) = (p.view_to_user(a.0, a.1), p.view_to_user(b.0, b.1));
@@ -500,6 +652,7 @@ fn open_editor(cx: PageToolContext<'_>, lines: &[pdfcraft_engine::TextBlock], bo
         look: look_of(l),
         look0: look_of(l),
         family_chosen: false,
+        size_chosen: false,
         extras: Extras::default(),
         extras0: Extras::default(),
         typing_from: None,
@@ -794,23 +947,26 @@ pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo) -
                     }
                 }
                 look = Some((Arc::clone(&output.galley), output.galley_pos));
-                if let Some(cursor) = output.cursor_range {
-                    let selected = cursor.as_sorted_char_range();
-                    let byte = |index| ed.text.char_indices().nth(index).map_or(ed.text.len(), |(at, _)| at);
-                    ed.selection = (!selected.is_empty()).then(|| byte(selected.start.into())..byte(selected.end.into()));
-                }
                 let r = output.response;
-                if r.changed() {
-                    ed.follow_typed_rows(ctx, &before);
-                    // The next pass measures the updated draft with the Apply/Save rewrite.
-                    ctx.request_repaint();
-                }
                 if ed.focus {
                     r.request_focus();
                     if let Some(range) = &ed.selection {
                         reselect(ui.ctx(), input, &ed.text, range);
                     }
                     ed.focus = false;
+                } else if r.has_focus() {
+                    if let Some(cursor) = output.cursor_range {
+                        let selected = cursor.as_sorted_char_range();
+                        let byte = |index| ed.text.char_indices().nth(index).map_or(ed.text.len(), |(at, _)| at);
+                        ed.selection = (!selected.is_empty()).then(|| byte(selected.start.into())..byte(selected.end.into()));
+                    } else {
+                        ed.selection = None;
+                    }
+                }
+                if r.changed() {
+                    ed.follow_typed_rows(ctx, &before);
+                    // The next pass measures the updated draft with the Apply/Save rewrite.
+                    ctx.request_repaint();
                 }
                 let lost = lost_focus_once(&r, &mut ed.had_focus);
                 let esc = ui.input(|i| i.key_pressed(egui::Key::Escape));
@@ -1003,6 +1159,22 @@ C", &picked
         assert_eq!(at(f32::NAN, 5.0), 0.0);
     }
 
+    #[test]
+    fn the_rotate_knob_measures_clockwise_delta_from_drag_start() {
+        let c = Pos2::new(100.0, 100.0);
+        // Start dragging at 45° clockwise from top:
+        let r = 50.0_f32;
+        let start = c + egui::vec2(r * 45.0_f32.to_radians().sin(), -r * 45.0_f32.to_radians().cos());
+        // At start position, delta is 0:
+        assert!(turn_degrees_delta(c, start, start, false).abs() < 1e-3);
+        // Move by +15° (to 60°):
+        let p_60 = c + egui::vec2(r * 60.0_f32.to_radians().sin(), -r * 60.0_f32.to_radians().cos());
+        assert!((turn_degrees_delta(c, start, p_60, false) - 15.0).abs() < 1e-2);
+        // Move by -10° (to 35°):
+        let p_35 = c + egui::vec2(r * 35.0_f32.to_radians().sin(), -r * 35.0_f32.to_radians().cos());
+        assert!((turn_degrees_delta(c, start, p_35, false) + 10.0).abs() < 1e-2);
+    }
+
     /// An app with one text document open, and an editor on its first paragraph.
     fn preview_app() -> (crate::PdfCraftApp, LineEditor) {
         let mut app = crate::PdfCraftApp::new();
@@ -1030,6 +1202,7 @@ C", &picked
             look: look_of(&block),
             look0: look_of(&block),
             family_chosen: false,
+            size_chosen: false,
             extras: Extras::default(),
             extras0: Extras::default(),
             typing_from: None,
@@ -1037,6 +1210,30 @@ C", &picked
         (app, ed)
     }
 
+    #[test]
+    fn review_committing_the_shown_size_applies_it_to_a_mixed_selection() {
+        let (_app, mut ed) = preview_app();
+        ed.selection = Some(0..2);
+        let mut fmt = ed.current_formatting(&[]);
+        fmt.size = None;
+        ed.sync_selection_look(&fmt);
+        let shown = ed.look.size;
+        ed.choose_size(shown);
+        assert!(ed.has_changes());
+        assert_eq!(ed.style().ranges[0].size, Some(shown));
+        ed.applied();
+        assert!(ed.style().ranges.is_empty());
+    }
+
+    #[test]
+    fn review_a_caret_only_script_formats_the_whole_draft() {
+        let mut text = "x2".to_string();
+        let mut caret = Some(1..1);
+        assert!(toggle_script(&mut text, &mut caret, pdfcraft_engine::text_script::Script::Super));
+        assert_eq!(text, "ˣ²");
+        assert_eq!(caret, None);
+    }
+
     #[test]
     fn picking_the_family_the_font_name_reads_as_still_changes_the_font() {
         // A Calibri paragraph reads as Helvetica; picking Helvetica from the list used to leave
@@ -1194,4 +1391,53 @@ C", &picked
         assert_eq!(caret_color_on(Color32::BLACK), Color32::WHITE);
         assert_eq!(caret_color_on(DARK_EDITOR_FILL), Color32::WHITE);
     }
+
+    #[test]
+    fn superscript_and_subscript_conversion() {
+        use pdfcraft_engine::text_script::Script;
+        let (mut text, mut selection) = ("E = mc2".to_string(), Some(6..7));
+        assert!(toggle_script(&mut text, &mut selection, Script::Super));
+        assert_eq!((text.as_str(), selection.clone()), ("E = mc²", Some(6..8)), "the selection follows the converted character");
+        assert!(toggle_script(&mut text, &mut selection, Script::Super));
+        assert_eq!((text.as_str(), selection), ("E = mc2", Some(6..7)));
+
+        // No selection: the whole text. H and O have no subscript form, and it still toggles back.
+        let (mut text, mut none) = ("H2O".to_string(), None);
+        assert!(toggle_script(&mut text, &mut none, Script::Sub));
+        assert_eq!((text.as_str(), none.clone()), ("H₂O", None));
+        assert!(toggle_script(&mut text, &mut none, Script::Sub));
+        assert_eq!(text, "H2O");
+    }
+
+    #[test]
+    fn value_based_line_spacing_in_style() {
+        let ed = LineEditor {
+            page: 0,
+            block: 0,
+            text: "Paragraph text".to_string(),
+            original: "Paragraph text".to_string(),
+            rect: egui::Rect::ZERO,
+            source_rect: [0.0; 4],
+            max_width: 100.0,
+            overflow: false,
+            selection: None,
+            font_resource: None,
+            fonts: std::collections::BTreeMap::new(),
+            source: None,
+            multiline: false,
+            size: 12.0,
+            family_chosen: false,
+            size_chosen: false,
+            focus: true,
+            had_focus: false,
+            look: pdfcraft_engine::AddedText::default(),
+            look0: pdfcraft_engine::AddedText::default(),
+            extras: Extras { line_spacing: 1.33, underline: true, ..Default::default() },
+            extras0: Extras::default(),
+            typing_from: None,
+        };
+        let style = ed.style();
+        assert_eq!(style.line_spacing, Some(1.33));
+        assert_eq!(style.underline, Some(true));
+    }
 }
diff --git a/crates/ui-egui/src/tools/edit_text_ui/image.rs b/crates/ui-egui/src/tools/edit_text_ui/image.rs
index 6956e656af..600f3d8801 100644
--- a/crates/ui-egui/src/tools/edit_text_ui/image.rs
+++ b/crates/ui-egui/src/tools/edit_text_ui/image.rs
@@ -1,53 +1,9 @@
-use super::{ACCENT, Color32, CornerRadius, DocInfo, DocView, Edit, MAX_OUTLINES, PagePointer, PageXform, Pos2, Rect, Stroke, user_box};
+use super::{ACCENT, Color32, CornerRadius, DocInfo, DocView, Edit, MAX_OUTLINES, PagePointer, PageXform, Pos2, Rect, Stroke, pos2, user_box};
+use crate::canvas::{ImageObb, PainterExt, image_screen_rect};
+use crate::image_engine::{CROP_ACCENT, apply_crop, apply_resize, apply_resize_proportional, draw_handle, draw_rule_of_thirds};
 use crate::page_cursor::Layer;
 use crate::page_router::{Hit, Owner, PicturePart};
 
-/// A selected page image, and what the pointer is doing to it.
-#[derive(Clone, Debug, PartialEq)]
-pub struct ImageSelection {
-    pub page: usize,
-    pub index: usize,
-    /// Dragging: the start point and, for a corner, the opposite corner (screen).
-    drag: Option<(Pos2, Option<Pos2>)>,
-    /// Crop mode (Acrobat's crop handles): the box kept so far.
-    pub crop: Option<CropMode>,
-    /// The drag is turning the picture by its rotate handle (the `drag` start is then unused).
-    turning: bool,
-    /// A move or resize applied on release: the frame it had and the one it got, in the page's
-    /// 0..1 coordinates, while the page raster still has the picture where it was.
-    settled: Option<(Rect, Rect)>,
-}
-
-impl ImageSelection {
-    /// Cancel an in-progress text, rotation or crop drag and restore the crop it was previewing.
-    pub(crate) fn cancel_pointer_gesture(&mut self) {
-        self.drag = None;
-        self.turning = false;
-        if let Some(crop) = &mut self.crop
-            && let Some((_, _, before)) = crop.drag.take()
-        {
-            crop.keep = before;
-        }
-    }
-}
-
-/// Cropping a page image: the handles trim instead of resizing, the part that will go is
-/// dimmed, Enter or Done applies and Esc or Cancel leaves it.
-#[derive(Clone, Debug, PartialEq)]
-pub struct CropMode {
-    /// The box to keep (user space).
-    pub keep: [f64; 4],
-    /// A drag in progress: the grip (0–3 corners, 4–7 edges, 8 the inside), where it started
-    /// and the box then.
-    drag: Option<(usize, Pos2, [f64; 4])>,
-}
-
-impl CropMode {
-    pub fn new(keep: [f64; 4]) -> Self {
-        Self { keep, drag: None }
-    }
-}
-
 /// What the pointer and the page are, for the image tools on one page.
 #[derive(Clone, Copy)]
 pub(crate) struct ImageCx<'a> {
@@ -60,141 +16,463 @@ pub(crate) struct ImageCx<'a> {
     pub allow_interaction: bool,
 }
 
-/// The screen boxes of the crop's eight handles: corners, then the top, right, bottom and left
-/// edge midpoints.
+/// The 8 resize handles on an image (4 corners + 4 edge centers).
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub enum ImageHandle {
+    TopLeft,
+    TopCenter,
+    TopRight,
+    RightCenter,
+    BottomRight,
+    BottomCenter,
+    BottomLeft,
+    LeftCenter,
+}
+
+impl ImageHandle {
+    /// The resize cursor for this handle on an upright box.
+    pub(crate) fn cursor_icon(self) -> egui::CursorIcon {
+        match self {
+            ImageHandle::TopLeft | ImageHandle::BottomRight => egui::CursorIcon::ResizeNwSe,
+            ImageHandle::TopRight | ImageHandle::BottomLeft => egui::CursorIcon::ResizeNeSw,
+            ImageHandle::TopCenter | ImageHandle::BottomCenter => egui::CursorIcon::ResizeVertical,
+            ImageHandle::LeftCenter | ImageHandle::RightCenter => egui::CursorIcon::ResizeHorizontal,
+        }
+    }
+}
+
+/// The handles in the order [`crop_handles`] places them: corners, then the top, right, bottom
+/// and left edge midpoints.
+const GRIPS: [ImageHandle; 8] = [
+    ImageHandle::TopLeft,
+    ImageHandle::TopRight,
+    ImageHandle::BottomLeft,
+    ImageHandle::BottomRight,
+    ImageHandle::TopCenter,
+    ImageHandle::RightCenter,
+    ImageHandle::BottomCenter,
+    ImageHandle::LeftCenter,
+];
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum DragTarget {
+    Move,
+    Handle(ImageHandle),
+    Rotate,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct ImageDrag {
+    pub start: Pos2,
+    pub target: DragTarget,
+    pub initial_rect: Rect,
+    /// Captured user-space frame: the visible crop for resizing, full placement for moving.
+    pub initial_matrix: [f64; 6],
+}
+
+/// A selected page image, and what the pointer is doing to it.
+#[derive(Clone, Debug, PartialEq)]
+pub struct ImageSelection {
+    pub page: usize,
+    pub index: usize,
+    /// Dragging in progress.
+    pub drag: Option<ImageDrag>,
+    /// Crop mode: the box kept so far.
+    pub crop: Option<CropMode>,
+    /// The drag is turning the picture by its rotate handle (the `drag` start is then unused).
+    pub turning: bool,
+    /// A move or resize applied on release: the frame it had and the one it got, in the page's
+    /// 0..1 coordinates, while the page raster still has the picture where it was.
+    pub settled: Option<(Rect, Rect)>,
+}
+
+impl ImageSelection {
+    /// Select a page image without an active gesture.
+    pub fn at(page: usize, index: usize) -> Self {
+        Self { page, index, drag: None, crop: None, turning: false, settled: None }
+    }
+
+    /// Cancel an in-progress text, rotation or crop drag and restore the crop it was previewing.
+    pub(crate) fn cancel_pointer_gesture(&mut self) {
+        self.drag = None;
+        self.turning = false;
+        if let Some(crop) = &mut self.crop
+            && let Some((_, _, before)) = crop.drag.take()
+        {
+            crop.keep = before;
+        }
+    }
+
+    pub(crate) fn dragging(&self) -> bool {
+        self.drag.is_some()
+    }
+}
+
+/// Cropping a page image: the handles trim instead of resizing, the part that will go is
+/// dimmed, Enter or Done applies and Esc or Cancel leaves it.
+#[derive(Clone, Debug, PartialEq)]
+pub struct CropMode {
+    /// The box to keep (user space or normalized UV).
+    pub keep: [f64; 4],
+    /// A drag in progress: the grip (0–7 handles, 8 inside), where it started and the box then.
+    pub(crate) drag: Option<(usize, Pos2, [f64; 4])>,
+}
+
+impl CropMode {
+    pub fn new(keep: [f64; 4]) -> Self {
+        Self { keep, drag: None }
+    }
+}
+
+pub(crate) use pdfcraft_content::Matrix;
+
+/// The displayed crop frame, expressed in page user space, rather than the full image placement.
+fn resize_frame(obb: &ImageObb, xf: &PageXform, info: &DocInfo, page: usize) -> Matrix {
+    let p00 = screen_to_user(xf, info, page, obb.s00);
+    let p10 = screen_to_user(xf, info, page, obb.s10);
+    let p01 = screen_to_user(xf, info, page, obb.s01);
+    Matrix([p10.0 - p00.0, p10.1 - p00.1, p01.0 - p00.0, p01.1 - p00.1, p00.0, p00.1])
+}
+
+/// Resize from the captured press displacement in the frame's actual affine basis.
+fn resize_affine_frame(frame: Matrix, handle: ImageHandle, delta: (f64, f64), proportional: bool) -> Option<Matrix> {
+    if !frame.0.iter().all(|v| v.is_finite()) || !delta.0.is_finite() || !delta.1.is_finite() {
+        return None;
+    }
+    if delta == (0.0, 0.0) {
+        return Some(frame);
+    }
+    let [a, b, c, d, _, _] = frame.0;
+    let inverse_basis = Matrix([a, b, c, d, 0.0, 0.0]).invert()?;
+    let (du, dv) = inverse_basis.apply(delta.0, delta.1);
+    if !du.is_finite() || !dv.is_finite() {
+        return None;
+    }
+    let (u, v) = match handle {
+        ImageHandle::TopRight => (1.0, 1.0),
+        ImageHandle::TopLeft => (-1.0, 1.0),
+        ImageHandle::BottomLeft => (-1.0, -1.0),
+        ImageHandle::BottomRight => (1.0, -1.0),
+        ImageHandle::RightCenter => (1.0, 0.0),
+        ImageHandle::LeftCenter => (-1.0, 0.0),
+        ImageHandle::TopCenter => (0.0, 1.0),
+        ImageHandle::BottomCenter => (0.0, -1.0),
+    };
+    let (minimum_u, minimum_v) = (5.0 / a.hypot(b), 5.0 / c.hypot(d));
+    let (mut su, mut sv) = (1.0 + u * du, 1.0 + v * dv);
+    if proportional && u != 0.0 && v != 0.0 {
+        let scale = if (su - 1.0).abs() >= (sv - 1.0).abs() { su } else { sv };
+        su = scale.max(minimum_u).max(minimum_v);
+        sv = su;
+    } else {
+        if u != 0.0 {
+            su = su.max(minimum_u);
+        }
+        if v != 0.0 {
+            sv = sv.max(minimum_v);
+        }
+    }
+    let local = Matrix([su, 0.0, 0.0, sv, if u < 0.0 { 1.0 - su } else { 0.0 }, if v < 0.0 { 1.0 - sv } else { 0.0 }]);
+    let resized = local.then(&frame);
+    resized.0.iter().all(|v| v.is_finite()).then_some(resized)
+}
+
+pub(crate) fn user_to_screen(xf: &PageXform, info: &DocInfo, page: usize, x: f64, y: f64) -> Pos2 {
+    let Some(p) = info.pages.get(page) else { return Pos2::ZERO };
+    let v = p.user_to_view(x as f32, y as f32);
+    xf.norm_to_screen(v[0] / xf.pw, v[1] / xf.ph)
+}
+
+fn screen_to_user(xf: &PageXform, info: &DocInfo, page: usize, pt: Pos2) -> (f64, f64) {
+    let (vx, vy) = xf.screen_to_view(pt);
+    let Some(p) = info.pages.get(page) else { return (0.0, 0.0) };
+    let u = p.view_to_user(vx, vy);
+    (f64::from(u[0]), f64::from(u[1]))
+}
+
+pub(crate) fn quad_contains(quad: [Pos2; 4], p: Pos2) -> bool {
+    if !p.x.is_finite() || !p.y.is_finite() || quad.iter().any(|pt| !pt.x.is_finite() || !pt.y.is_finite()) {
+        return false;
+    }
+    let mut sign = 0;
+    for i in 0..4 {
+        let p1 = quad[i];
+        let p2 = quad[(i + 1) % 4];
+        let cross = (p2.x - p1.x) * (p.y - p1.y) - (p2.y - p1.y) * (p.x - p1.x);
+        if cross.abs() > 1e-4 {
+            let s = if cross > 0.0 { 1 } else { -1 };
+            if sign == 0 {
+                sign = s;
+            } else if sign != s {
+                return false;
+            }
+        }
+    }
+    sign != 0
+}
+
+/// The screen positions of the crop's eight handles: corners, then the top, right, bottom and left edge midpoints.
 fn crop_handles(k: Rect) -> [Pos2; 8] {
     [k.left_top(), k.right_top(), k.left_bottom(), k.right_bottom(), k.center_top(), k.right_center(), k.center_bottom(), k.left_center()]
 }
 
+// Keep a dragged crop inside the image, including images smaller than six screen pixels.
+fn clamp_crop(b: Rect, new_screen: Rect) -> Rect {
+    if !b.is_finite() || !b.is_positive() || !b.size().is_finite() || !new_screen.is_finite() {
+        return new_screen;
+    }
+    let (min_w, min_h) = (6.0_f32.min(b.width()), 6.0_f32.min(b.height()));
+    Rect::from_min_max(
+        pos2(new_screen.min.x.clamp(b.min.x, b.max.x - min_w), new_screen.min.y.clamp(b.min.y, b.max.y - min_h)),
+        pos2(new_screen.max.x.clamp(b.min.x + min_w, b.max.x), new_screen.max.y.clamp(b.min.y + min_h, b.max.y)),
+    )
+}
+
+#[cfg(test)]
+mod crop_bounds_tests {
+    use super::*;
+
+    #[test]
+    fn crop_drag_rejects_nonfinite_bounds() {
+        for value in [f32::NAN, f32::INFINITY, f32::NEG_INFINITY] {
+            let bounds = Rect { min: pos2(value, 0.0), max: pos2(100.0, 100.0) };
+            let keep = Rect::from_min_max(pos2(10.0, 10.0), pos2(50.0, 50.0));
+            assert_eq!(clamp_crop(bounds, keep), keep);
+        }
+    }
+}
+
+fn same_rect(a: [f64; 4], b: [f64; 4]) -> bool {
+    a.into_iter().zip(b).all(|(a, b)| (a - b).abs() < 1e-3)
+}
+
+fn crop_bounds(image: &pdfcraft_engine::PageImage, xf: &PageXform, info: &DocInfo, page: usize) -> Rect {
+    let full = xf.user_rect(info, page, image.rect.map(|v| v as f32));
+    if full.is_positive() { full } else { xf.user_rect(info, page, image.visible_rect.unwrap_or(image.rect).map(|v| v as f32)) }
+}
+
+/// Whether `p` is on the crop box or one of its handles (#5835). The Done, Cancel and Remove
+/// Crop pills are widgets of their own, so they take their clicks before the canvas does.
+pub(crate) fn crop_controls_contain(
+    image: &pdfcraft_engine::PageImage,
+    mode: &CropMode,
+    xf: &PageXform,
+    info: &DocInfo,
+    page: usize,
+    p: Pos2,
+) -> bool {
+    let b = crop_bounds(image, xf, info, page);
+    let k = xf.user_rect(info, page, mode.keep.map(|v| v as f32)).intersect(b);
+    if !b.is_finite() || !b.is_positive() || !b.size().is_finite() || !k.is_finite() || !k.is_positive() {
+        return false;
+    }
+    k.contains(p) || crop_handles(k).iter().any(|h| h.distance(p) < 10.0)
+}
+
 /// Crop mode for the selected image `i` whose visible frame is `b` (screen). Returns `true`
 /// (the pointer and keys are the crop's while it lasts).
-fn crop_input(cx: &ImageCx<'_>, view: &mut DocView, i: usize, b: Rect) -> bool {
+#[allow(clippy::cognitive_complexity)]
+fn crop_input(cx: &ImageCx<'_>, view: &mut DocView, i: usize, image: &pdfcraft_engine::PageImage) -> bool {
     let ImageCx { ui, resp, xf, ptr, page, info, allow_interaction } = *cx;
     let painter = ui.painter();
     let Some(mode) = view.image_selection.as_mut().and_then(|s| s.crop.as_mut()) else { return false };
     let hover_pos = ptr.pos;
+    let b = crop_bounds(image, xf, info, page);
     let keep_screen = |keep: [f64; 4]| xf.user_rect(info, page, keep.map(|v| v as f32)).intersect(b);
-    // A drag in progress moves a grip; the box stays inside the picture and at least 6 px.
+    let k = keep_screen(mode.keep);
+    if !b.is_finite() || !b.is_positive() || !b.size().is_finite() || !k.is_finite() || !k.is_positive() {
+        mode.drag = None;
+        return true;
+    }
+
     if allow_interaction
         && resp.drag_started()
         && let Some(o) = ptr.origin
     {
-        let k = keep_screen(mode.keep);
-        let grip = crop_handles(k).iter().position(|h| h.distance(o) < 8.0).or_else(|| k.contains(o).then_some(8));
+        let grip = crop_handles(k).iter().position(|h| h.distance(o) < 10.0).or_else(|| k.contains(o).then_some(8));
         if let Some(g) = grip {
             mode.drag = Some((g, o, mode.keep));
         }
     }
+
     if let Some((grip, start, at_start)) = mode.drag
         && let Some(p) = hover_pos
     {
         let d = p - start;
         let k0 = keep_screen(at_start);
-        let (mut min, mut max) = (k0.min, k0.max);
-        match grip {
-            0 => {
-                min.x += d.x;
-                min.y += d.y;
-            }
-            1 => {
-                max.x += d.x;
-                min.y += d.y;
-            }
-            2 => {
-                min.x += d.x;
-                max.y += d.y;
-            }
-            3 => {
-                max.x += d.x;
-                max.y += d.y;
-            }
-            4 => min.y += d.y,
-            5 => max.x += d.x,
-            6 => max.y += d.y,
-            7 => min.x += d.x,
-            _ => {
-                let shift = egui::vec2(d.x.clamp(b.min.x - k0.min.x, b.max.x - k0.max.x), d.y.clamp(b.min.y - k0.min.y, b.max.y - k0.max.y));
-                min += shift;
-                max += shift;
-            }
+        if !d.is_finite() || !k0.is_finite() || !k0.is_positive() {
+            mode.drag = None;
+            return true;
+        }
+        if let Some(&handle) = GRIPS.get(grip) {
+            let uv0 = if b.width() > 0.0 && b.height() > 0.0 {
+                Rect::from_min_max(
+                    pos2(((k0.min.x - b.min.x) / b.width()).clamp(0.0, 1.0), ((k0.min.y - b.min.y) / b.height()).clamp(0.0, 1.0)),
+                    pos2(((k0.max.x - b.min.x) / b.width()).clamp(0.0, 1.0), ((k0.max.y - b.min.y) / b.height()).clamp(0.0, 1.0)),
+                )
+            } else {
+                Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0))
+            };
+            let (new_screen, _) = apply_crop(k0, uv0, handle, d);
+            let clamped = clamp_crop(b, new_screen);
+            mode.keep = user_box(xf, info, page, clamped);
+        } else {
+            let shift = egui::vec2(d.x.clamp(b.min.x - k0.min.x, b.max.x - k0.max.x), d.y.clamp(b.min.y - k0.min.y, b.max.y - k0.max.y));
+            mode.keep = user_box(xf, info, page, Rect::from_min_max(k0.min + shift, k0.max + shift));
         }
-        let (min_w, min_h) = (6.0_f32.min(b.width()), 6.0_f32.min(b.height()));
-        min.x = min.x.clamp(b.min.x, b.max.x - min_w);
-        min.y = min.y.clamp(b.min.y, b.max.y - min_h);
-        max.x = max.x.clamp(min.x + min_w, b.max.x);
-        max.y = max.y.clamp(min.y + min_h, b.max.y);
-        mode.keep = user_box(xf, info, page, Rect::from_min_max(min, max));
         if resp.drag_stopped() || !ptr.primary_down {
             mode.drag = None;
         }
     }
-    let k = keep_screen(mode.keep);
-    // What goes is dimmed; what stays keeps its frame and handles.
+
+    // Faint ghost outline of the full uncropped image underneath
+    painter.rect_stroke(b, CornerRadius::ZERO, Stroke::new(1.0, Color32::from_rgba_unmultiplied(200, 200, 200, 80)), egui::StrokeKind::Outside);
+
+    // Dim outer excluded bands
     let dim = Color32::from_black_alpha(96);
-    for r in [
-        Rect::from_min_max(b.min, Pos2::new(b.max.x, k.min.y)),
-        Rect::from_min_max(Pos2::new(b.min.x, k.max.y), b.max),
-        Rect::from_min_max(Pos2::new(b.min.x, k.min.y), Pos2::new(k.min.x, k.max.y)),
-        Rect::from_min_max(Pos2::new(k.max.x, k.min.y), Pos2::new(b.max.x, k.max.y)),
-    ] {
-        if r.is_positive() {
-            painter.rect_filled(r.intersect(xf.rect), CornerRadius::ZERO, dim);
-        }
+    if k.min.y > b.min.y {
+        painter.rect_filled(Rect::from_min_max(b.min, Pos2::new(b.max.x, k.min.y)), CornerRadius::ZERO, dim);
     }
-    painter.rect_stroke(k, CornerRadius::ZERO, Stroke::new(1.5, ACCENT), egui::StrokeKind::Outside);
-    for h in crop_handles(k) {
-        painter.rect(
-            Rect::from_center_size(h, egui::vec2(8.0, 8.0)),
-            CornerRadius::ZERO,
-            Color32::WHITE,
-            Stroke::new(1.0, ACCENT),
-            egui::StrokeKind::Middle,
-        );
+    if k.max.y < b.max.y {
+        painter.rect_filled(Rect::from_min_max(Pos2::new(b.min.x, k.max.y), b.max), CornerRadius::ZERO, dim);
     }
-    // Done and Cancel, painted under the box (above it near the bottom of the view).
+    if k.min.x > b.min.x {
+        painter.rect_filled(Rect::from_min_max(Pos2::new(b.min.x, k.min.y), Pos2::new(k.min.x, k.max.y)), CornerRadius::ZERO, dim);
+    }
+    if k.max.x < b.max.x {
+        painter.rect_filled(Rect::from_min_max(Pos2::new(k.max.x, k.min.y), Pos2::new(b.max.x, k.max.y)), CornerRadius::ZERO, dim);
+    }
+
+    // Rule-of-Thirds Grid inside crop area
+    draw_rule_of_thirds(painter, k, Stroke::new(1.0, CROP_ACCENT.gamma_multiply(0.45)));
+
+    // Crop border stroke
+    painter.rect_stroke(k, CornerRadius::ZERO, Stroke::new(1.5, CROP_ACCENT), egui::StrokeKind::Outside);
+
+    // Crop handles
+    for (idx, h) in crop_handles(k).iter().enumerate() {
+        let is_active = mode.drag.as_ref().is_some_and(|d| d.0 == idx);
+        let is_hovered = hover_pos.is_some_and(|p| p.distance(*h) < 10.0);
+        draw_handle(painter, *h, is_active, is_hovered, true, CROP_ACCENT);
+    }
+
+    // Action pills
     let font = egui::FontId::proportional(12.5);
-    let pill = |label: &str, right: f32, y: f32| -> Rect {
-        let w = painter.layout_no_wrap(label.to_string(), font.clone(), Color32::WHITE).size().x + 20.0;
-        Rect::from_min_size(Pos2::new(right - w, y), egui::vec2(w, 22.0))
+    let done_w = painter.layout_no_wrap(tl!("Done").to_string(), font.clone(), Color32::WHITE).size().x + 22.0;
+    let cancel_w = painter.layout_no_wrap(tl!("Cancel").to_string(), font.clone(), Color32::WHITE).size().x + 22.0;
+    let initial_keep = image.visible_rect.unwrap_or(image.rect);
+    let has_crop = image.has_editor_crop() || !same_rect(mode.keep, initial_keep);
+    let reset_w =
+        if has_crop { Some(painter.layout_no_wrap(tl!("Remove Crop").to_string(), font.clone(), Color32::WHITE).size().x + 22.0) } else { None };
+    let spacing = 6.0;
+    let total_w = done_w + spacing + cancel_w + reset_w.map_or(0.0, |w| w + spacing);
+
+    // Position pills below crop box if there's room, otherwise above
+    let y = if k.max.y + 32.0 < xf.rect.max.y {
+        k.max.y + 6.0
+    } else if k.min.y - 28.0 > xf.rect.min.y {
+        k.min.y - 28.0
+    } else {
+        k.max.y + 6.0
     };
-    let y = if k.max.y + 30.0 < xf.rect.max.y { k.max.y + 6.0 } else { k.min.y - 28.0 };
-    let done = pill(tl!("Done"), k.max.x, y);
-    let cancel = pill(tl!("Cancel"), done.min.x - 6.0, y);
+
+    // Right-align pills with k.max.x, clamped inside the page bounds
+    let mut right = k.max.x.min(xf.rect.max.x - 8.0);
+    if right - total_w < xf.rect.min.x + 8.0 {
+        right = (xf.rect.min.x + 8.0 + total_w).min(xf.rect.max.x - 8.0);
+    }
+
+    let done = Rect::from_min_size(Pos2::new(right - done_w, y), egui::vec2(done_w, 22.0));
+    let cancel = Rect::from_min_size(Pos2::new(done.min.x - spacing - cancel_w, y), egui::vec2(cancel_w, 22.0));
+    let reset = reset_w.map(|w| Rect::from_min_size(Pos2::new(cancel.min.x - spacing - w, y), egui::vec2(w, 22.0)));
+
+    let done_id = ui.scope_id().with("crop_pill_done").with(page).with(i);
+    let cancel_id = ui.scope_id().with("crop_pill_cancel").with(page).with(i);
+    let reset_id = ui.scope_id().with("crop_pill_reset").with(page).with(i);
+
+    let done_resp = ui.interact(done, done_id, egui::Sense::click());
+    let cancel_resp = ui.interact(cancel, cancel_id, egui::Sense::click());
+    let reset_resp = reset.map(|r| ui.interact(r, reset_id, egui::Sense::click()));
+    done_resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, allow_interaction, tl!("Done")));
+    cancel_resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, allow_interaction, tl!("Cancel")));
+    if let Some(response) = &reset_resp {
+        response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, allow_interaction, tl!("Remove Crop")));
+    }
+
     let t = crate::theme::Tokens::get(ui.ctx());
-    painter.rect_filled(done, CornerRadius::same(11), ACCENT);
+
+    // Done button (accent colored)
+    let done_bg = if done_resp.is_pointer_button_down_on() {
+        ACCENT.gamma_multiply(0.8)
+    } else if done_resp.hovered() {
+        Color32::from_rgb(40, 145, 255)
+    } else {
+        ACCENT
+    };
+    painter.rect_filled(done, CornerRadius::same(11), done_bg);
     painter.text(done.center(), egui::Align2::CENTER_CENTER, tl!("Done"), font.clone(), Color32::WHITE);
-    painter.rect(cancel, CornerRadius::same(11), t.panel, Stroke::new(1.0, t.border), egui::StrokeKind::Inside);
-    painter.text(cancel.center(), egui::Align2::CENTER_CENTER, tl!("Cancel"), font, t.text);
-    // Cropping takes over its page's cursor, and the buttons' wherever they are; other pages
-    // keep theirs.
-    if let Some(p) = hover_pos.filter(|p| xf.rect.contains(*p) || done.contains(*p) || cancel.contains(*p)) {
-        let icon = if let Some(g) = crop_handles(k).iter().position(|h| h.distance(p) < 8.0) {
-            match g {
-                0 | 3 => egui::CursorIcon::ResizeNwSe,
-                1 | 2 => egui::CursorIcon::ResizeNeSw,
-                4 | 6 => egui::CursorIcon::ResizeVertical,
-                _ => egui::CursorIcon::ResizeHorizontal,
-            }
-        } else if done.contains(p) || cancel.contains(p) {
+
+    let neutral_pill = |r: Rect, response: &egui::Response, label: &str| {
+        let background = if response.is_pointer_button_down_on() {
+            t.pressed
+        } else if response.hovered() {
+            t.hover
+        } else {
+            t.card
+        };
+        let border = Stroke::new(1.0, if response.hovered() { ACCENT } else { t.border });
+        let text = if response.hovered() { ACCENT } else { t.text };
+        painter.rect(r, CornerRadius::same(11), background, border, egui::StrokeKind::Inside);
+        painter.text(r.center(), egui::Align2::CENTER_CENTER, label, font.clone(), text);
+    };
+    neutral_pill(cancel, &cancel_resp, tl!("Cancel"));
+    if let (Some(r), Some(response)) = (reset, reset_resp.as_ref()) {
+        neutral_pill(r, response, tl!("Remove Crop"));
+    }
+
+    if let Some(p) = hover_pos {
+        let icon = if done_resp.hovered()
+            || cancel_resp.hovered()
+            || reset_resp.as_ref().is_some_and(|r| r.hovered())
+            || done.contains(p)
+            || cancel.contains(p)
+            || reset.is_some_and(|r| r.contains(p))
+        {
             egui::CursorIcon::PointingHand
+        } else if let Some(&g) = crop_handles(k).iter().position(|h| h.distance(p) < 8.0).and_then(|g| GRIPS.get(g)) {
+            g.cursor_icon()
         } else if k.contains(p) {
-            egui::CursorIcon::Move
+            if mode.drag.is_some() { egui::CursorIcon::Grabbing } else { egui::CursorIcon::Grab }
         } else {
             egui::CursorIcon::Default
         };
         view.cursor.claim(Layer::Editor, icon);
     }
-    let clicked = |r: Rect| allow_interaction && resp.clicked() && hover_pos.is_some_and(|p| r.contains(p));
+
     let keys = |key: egui::Key| allow_interaction && ui.input(|inp| inp.key_pressed(key)) && !ui.ctx().egui_wants_keyboard_input();
-    if clicked(done) || keys(egui::Key::Enter) {
+    let done_clicked = allow_interaction && (done_resp.clicked() || (resp.clicked() && hover_pos.is_some_and(|p| done.contains(p))));
+    let cancel_clicked = allow_interaction && (cancel_resp.clicked() || (resp.clicked() && hover_pos.is_some_and(|p| cancel.contains(p))));
+    let reset_clicked = allow_interaction
+        && reset
+            .is_some_and(|r| reset_resp.as_ref().is_some_and(|res| res.clicked()) || (resp.clicked() && hover_pos.is_some_and(|p| r.contains(p))));
+
+    if reset_clicked {
+        mode.keep = if image.has_editor_crop() { image.rect } else { initial_keep };
+        mode.drag = None;
+    } else if done_clicked || keys(egui::Key::Enter) {
         let keep = mode.keep;
         if let Some(s) = view.image_selection.as_mut() {
             s.crop = None;
         }
-        if keep_screen(keep) != b {
+        let is_full = same_rect(keep, image.rect);
+        if is_full {
+            if image.has_editor_crop() {
+                view.pending_edit = Some(Edit::EditPageImage { page, index: i, change: pdfcraft_engine::ImageEdit::RemoveCrop });
+            }
+        } else if image.visible_rect != Some(keep) {
             view.pending_edit = Some(Edit::EditPageImage { page, index: i, change: pdfcraft_engine::ImageEdit::Crop(keep) });
         }
-    } else if (clicked(cancel) || keys(egui::Key::Escape))
+    } else if (cancel_clicked || keys(egui::Key::Escape))
         && let Some(s) = view.image_selection.as_mut()
     {
         s.crop = None;
@@ -202,12 +480,6 @@ fn crop_input(cx: &ImageCx<'_>, view: &mut DocView, i: usize, b: Rect) -> bool {
     true
 }
 
-impl ImageSelection {
-    pub(crate) fn dragging(&self) -> bool {
-        self.drag.is_some()
-    }
-}
-
 /// The page raster's picture of the box `from`, stretched into `to`, over blanks at `blank` (where
 /// the screen may still show the picture).
 fn stretched_picture(painter: &egui::Painter, xf: &PageXform, tex: egui::TextureId, blank: &[Rect], from: Rect, to: Rect) {
@@ -215,19 +487,32 @@ fn stretched_picture(painter: &egui::Painter, xf: &PageXform, tex: egui::Texture
     for r in blank {
         clipped.rect_filled(*r, CornerRadius::ZERO, Color32::WHITE);
     }
+    mapped_picture(
+        &clipped,
+        xf,
+        tex,
+        [from.left_top(), from.right_top(), from.right_bottom(), from.left_bottom()],
+        [to.left_top(), to.right_top(), to.right_bottom(), to.left_bottom()],
+    );
+}
+
+fn mapped_picture(painter: &egui::Painter, xf: &PageXform, tex: egui::TextureId, from: [Pos2; 4], to: [Pos2; 4]) {
     let mut mesh = egui::Mesh::with_texture(tex);
-    for (a, b) in [
-        (from.left_top(), to.left_top()),
-        (from.right_top(), to.right_top()),
-        (from.right_bottom(), to.right_bottom()),
-        (from.left_bottom(), to.left_bottom()),
-    ] {
-        let (u, v) = xf.screen_to_norm(a);
-        mesh.vertices.push(egui::epaint::Vertex { pos: b, uv: Pos2::new(u, v), color: Color32::WHITE });
+    for (from, to) in from.into_iter().zip(to) {
+        let (u, v) = xf.screen_to_norm(from);
+        mesh.vertices.push(egui::epaint::Vertex { pos: to, uv: Pos2::new(u, v), color: Color32::WHITE });
     }
     mesh.add_triangle(0, 1, 2);
     mesh.add_triangle(0, 2, 3);
-    clipped.add(egui::Shape::mesh(mesh));
+    painter.add(egui::Shape::mesh(mesh));
+}
+
+fn picture_frame(painter: &egui::Painter, obb: &ImageObb, upright: Rect, fill: Color32, stroke: Stroke) {
+    if obb.is_rotated {
+        painter.polygon(obb.corners().to_vec(), fill, stroke);
+    } else if upright.is_positive() {
+        painter.rect(upright, CornerRadius::ZERO, fill, stroke, egui::StrokeKind::Outside);
+    }
 }
 
 /// The selected picture's grips under `p`: its corners and its rotate knob. They are asked after
@@ -244,14 +529,16 @@ pub(crate) fn handle_hit(
     p: Pos2,
 ) -> Option<Hit> {
     let s = view.image_selection.as_ref().filter(|s| s.page == page && s.crop.is_none())?;
-    let b = images.get(s.index)?.visible_rect.map(|r| xf.user_rect(info, page, r.map(|v| v as f32)))?;
+    let image = images.get(s.index)?;
+    let b = image_screen_rect(image, xf, info, page);
+    let obb = ImageObb::from_image(image, xf, info, page);
     let picture = |part| Owner::Picture { index: s.index, part };
-    if rotate_knob(b, clip).0.distance(p) < 8.0 {
+    let knob = if obb.is_rotated { obb.s_rot } else { rotate_knob(b, clip).0 };
+    if knob.distance(p) < 8.0 {
         return Some(Hit::new(picture(PicturePart::Knob), Layer::Handle, egui::CursorIcon::Grab));
     }
-    let corner = [b.left_top(), b.right_top(), b.left_bottom(), b.right_bottom()].iter().position(|c| c.distance(p) < 8.0)?;
-    let icon = if matches!(corner, 0 | 3) { egui::CursorIcon::ResizeNwSe } else { egui::CursorIcon::ResizeNeSw };
-    Some(Hit::new(picture(PicturePart::Corner(corner)), Layer::Handle, icon))
+    let (grip, (handle, _)) = obb.handles().into_iter().enumerate().find(|(_, (_, point))| point.distance(p) < 8.0)?;
+    Some(Hit::new(picture(PicturePart::Corner(grip)), Layer::Handle, obb.handle_cursor(handle)))
 }
 
 /// The picture under `p` (its shape, not only its box): a click selects it, a drag moves the
@@ -273,7 +560,7 @@ pub(crate) fn body_hit(xf: &PageXform, page: usize, info: &DocInfo, images: &[pd
 
 /// What a right-click on a selected image asks for.
 #[derive(Clone, Copy, Debug, PartialEq)]
-pub(crate) enum ImageAction {
+pub enum ImageAction {
     Replace(usize, usize),
     Save(usize, usize),
     Copy(usize, usize),
@@ -286,6 +573,9 @@ pub(crate) enum ImageAction {
     Link(usize, usize),
     /// Open Recognize Text for the picture's page.
     Recognize(usize),
+    Paste(usize, Option<[f64; 2]>),
+    DrawFreehand,
+    AddComment(usize, usize),
 }
 
 /// Where the rotate knob sits, and the edge point its stem starts from: above the middle of the
@@ -295,196 +585,43 @@ pub(super) fn rotate_knob(b: Rect, view: Rect) -> (Pos2, Pos2) {
     if above.y - 6.0 >= view.top() { (above, b.center_top()) } else { (b.center_bottom() + egui::vec2(0.0, 22.0), b.center_bottom()) }
 }
 
-/// Degrees clockwise (-180..=180) that turn "straight up" from `centre` onto the pointer; `snap`
+/// Degrees clockwise (-180..=180) that turn from `start` onto `pointer` around `centre`; `snap`
 /// rounds to steps of 15 degrees (Shift). A pointer on the centre turns nothing.
-pub(super) fn turn_degrees(centre: Pos2, pointer: Pos2, snap: bool) -> f32 {
-    let v = pointer - centre;
-    if !(v.x.is_finite() && v.y.is_finite()) || v.length() < 4.0 {
+pub(super) fn turn_degrees_delta(centre: Pos2, start: Pos2, pointer: Pos2, snap: bool) -> f32 {
+    let v_start = start - centre;
+    let v_curr = pointer - centre;
+    if !(v_curr.x.is_finite() && v_curr.y.is_finite())
+        || v_curr.length() < 4.0
+        || !(v_start.x.is_finite() && v_start.y.is_finite())
+        || v_start.length() < 4.0
+    {
         return 0.0;
     }
     // Screen y points down: up is (0, -1); clockwise is atan2(x, -y).
-    let d = v.x.atan2(-v.y).to_degrees();
+    let theta_start = v_start.x.atan2(-v_start.y).to_degrees();
+    let theta_curr = v_curr.x.atan2(-v_curr.y).to_degrees();
+    let mut d = theta_curr - theta_start;
+    d = ((d + 180.0).rem_euclid(360.0)) - 180.0;
     if snap { (d / 15.0).round() * 15.0 } else { d }
 }
 
-/// Which boxes are outlined on the page, and why.
-struct OutlineState {
-    selected: Option<usize>,
-    hovered_box: Option<usize>,
-    /// The picture being dragged, whose outline would trail behind until the release.
-    moving: Option<usize>,
-    dragging: bool,
-    /// Few images: faint outlines for all of them.
-    faint_all: bool,
+/// Degrees clockwise (-180..=180) that turn "straight up" from `centre` onto the pointer; `snap`
+/// rounds to steps of 15 degrees (Shift). A pointer on the centre turns nothing.
+#[cfg(test)]
+pub(super) fn turn_degrees(centre: Pos2, pointer: Pos2, snap: bool) -> f32 {
+    turn_degrees_delta(centre, centre - egui::vec2(0.0, 10.0), pointer, snap)
 }
 
-/// Outlines the images: all of them faintly when there are few, else the selected and hovered
-/// ones; the hovered or selected one is emphasised.
-fn draw_outlines(painter: &egui::Painter, boxes: &[Rect], state: OutlineState) {
-    let OutlineState { selected, hovered_box, moving, dragging, faint_all } = state;
-    if faint_all {
-        for (_, b) in boxes.iter().enumerate().filter(|(i, b)| b.is_positive() && moving != Some(*i)) {
-            painter.rect_stroke(*b, CornerRadius::ZERO, Stroke::new(0.75, ACCENT.gamma_multiply(0.35)), egui::StrokeKind::Outside);
-        }
-    }
-    if !faint_all {
-        for i in selected.filter(|_| moving.is_none()).into_iter().chain(hovered_box.filter(|h| Some(*h) != selected)) {
-            if let Some(b) = boxes.get(i).filter(|b| b.is_positive()) {
-                painter.rect_stroke(*b, CornerRadius::ZERO, Stroke::new(0.75, ACCENT.gamma_multiply(0.35)), egui::StrokeKind::Outside);
-            }
-        }
-    }
-    for i in selected.into_iter().chain(hovered_box).collect::<Vec<_>>() {
-        let Some(b) = boxes.get(i).copied().filter(|b| b.is_positive()) else { continue };
-        if selected == Some(i) {
-            // The selected frame and handles are drawn below (or the drag preview instead).
-            if !dragging {
-                painter.rect_filled(b, CornerRadius::ZERO, ACCENT.gamma_multiply(0.04));
-            }
-        } else {
-            painter.rect_stroke(b, CornerRadius::ZERO, Stroke::new(1.5, ACCENT.gamma_multiply(0.7)), egui::StrokeKind::Outside);
-        }
-    }
-}
-
-fn draw_handles(painter: &egui::Painter, rect: Rect) {
-    for c in [rect.left_top(), rect.right_top(), rect.left_bottom(), rect.right_bottom()] {
-        painter.rect(
-            Rect::from_center_size(c, egui::vec2(8.0, 8.0)),
-            CornerRadius::ZERO,
-            Color32::WHITE,
-            Stroke::new(1.0, ACCENT),
-            egui::StrokeKind::Middle,
-        );
-    }
-}
-
-/// Turning the picture by its rotate handle: the turned outline as a preview (the engine redraws
-/// the pixels on release).
-fn turn_preview(cx: &ImageCx<'_>, view: &mut DocView, i: usize, b: Rect, knob: Pos2) {
-    let ImageCx { ui, resp, ptr, page, .. } = *cx;
-    let painter = ui.painter();
-    let hover_pos = ptr.pos;
-    let shift = ui.input(|i| i.modifiers.shift);
-    let degrees = hover_pos.map_or(0.0, |p| turn_degrees(b.center(), p, shift));
-    // The turned outline as a preview; the engine redraws the pixels on release.
-    let centre = b.center();
-    let (sin, cos) = degrees.to_radians().sin_cos();
-    let turn = |c: Pos2| {
-        let v = c - centre;
-        centre + egui::vec2(v.x * cos - v.y * sin, v.x * sin + v.y * cos)
-    };
-    let outline = [b.left_top(), b.right_top(), b.right_bottom(), b.left_bottom()].map(turn).to_vec();
-    painter.add(egui::Shape::closed_line(outline, Stroke::new(1.5, ACCENT)));
-    let galley = painter.layout_no_wrap(format!("{degrees:.0}\u{b0}"), egui::FontId::proportional(12.0), ACCENT);
-    let label = Rect::from_center_size(turn(knob) - egui::vec2(0.0, 14.0), galley.size() + egui::vec2(8.0, 4.0));
-    painter.rect(label, CornerRadius::same(3), Color32::WHITE, Stroke::new(1.0, ACCENT), egui::StrokeKind::Middle);
-    painter.galley(label.center() - galley.size() / 2.0, galley, ACCENT);
-    view.cursor.claim(Layer::Drag, egui::CursorIcon::Grabbing);
-    if resp.drag_stopped() || !ptr.primary_down {
-        if let Some(s) = view.image_selection.as_mut() {
-            s.drag = None;
-            s.turning = false;
-        }
-        if degrees.abs() >= 0.05 {
-            view.pending_edit = Some(Edit::EditPageImage { page, index: i, change: pdfcraft_engine::ImageEdit::RotateBy(f64::from(degrees)) });
-        }
-    }
-}
-
-/// Where the screen may still show the picture from before an applied move, and whether the
-/// page's whole raster is the old one.
-#[derive(Clone, Copy)]
-struct Blanked {
-    left_at: Option<Rect>,
-    raster_old: bool,
-}
-
-/// A frame of the picture being moved or resized: the stretched picture, its frame and handles,
-/// and on release the edit.
-fn drag_preview(
-    cx: &ImageCx<'_>,
-    images: &[pdfcraft_engine::PageImage],
-    view: &mut DocView,
-    (i, b): (usize, Rect),
-    (start, opposite, p): (Pos2, Option<Pos2>, Pos2),
-    blanked: Blanked,
-) {
-    let ImageCx { ui, resp, xf, ptr, page, info, .. } = *cx;
-    let painter = ui.painter();
-    let Blanked { left_at, raster_old } = blanked;
-    let screen = |r: Rect| Rect::from_two_pos(xf.norm_to_screen(r.min.x, r.min.y), xf.norm_to_screen(r.max.x, r.max.y));
-    let preview = match opposite {
-        // Resize from the opposite corner, keeping the aspect ratio.
-        Some(fixed) => {
-            let (w0, h0) = (b.width().max(1.0), b.height().max(1.0));
-            // Use the axis with the larger relative pointer change. Taking the maximum
-            // absolute size freezes shrinking when the other axis hasn't moved. Measure
-            // from the press point so grabbing a handle off-centre cannot cause a jump.
-            let horizontal = (p.x - start.x) * (start.x - fixed.x).signum() / w0;
-            let vertical = (p.y - start.y) * (start.y - fixed.y).signum() / h0;
-            let delta = if horizontal.abs() > vertical.abs() { horizontal } else { vertical };
-            let k = (1.0 + delta).max(0.05);
-            let (w, h) = (w0 * k, h0 * k);
-            let x = if start.x < fixed.x { fixed.x - w } else { fixed.x };
-            let y = if start.y < fixed.y { fixed.y - h } else { fixed.y };
-            Rect::from_min_size(Pos2::new(x, y), egui::vec2(w, h))
-        }
-        None => b.translate(p - start),
-    };
-    // Move/resize the full placement by the visible frame's change. The engine
-    // transforms an isolated crop together with its image, preserving its contents.
-    let raw = images.get(i).map_or(b, |im| xf.user_rect(info, page, im.rect.map(|v| v as f32)));
-    // A zero-width or zero-height visible frame (or a degenerate ratio) keeps the
-    // placement's scale instead of producing inf/NaN.
-    let ratio = |new: f32, old: f32| if old.abs() > 1e-3 && (new / old).is_finite() { new / old } else { 1.0 };
-    let factor = egui::vec2(ratio(preview.width(), b.width()), ratio(preview.height(), b.height()));
-    let target = Rect::from_min_max(preview.min + (raw.min - b.min) * factor, preview.min + (raw.max - b.min) * factor);
-    let visible = preview.intersect(xf.rect);
-    if visible.is_positive() {
-        // The pixels follow the frame: the page raster's picture of the image, stretched
-        // into the preview over a blank where it was. Re-rendering every frame of a drag
-        // would lag; the edit renders it properly on release.
-        if preview != b
-            && let Some(tex) = view.page_raster(page)
-        {
-            // Its pixels: where the whole-page raster has it.
-            let source = left_at.filter(|_| raster_old).map_or(b, screen);
-            let blank: Vec<Rect> = left_at.map(screen).into_iter().chain(std::iter::once(b)).collect();
-            stretched_picture(painter, xf, tex, &blank, source, preview);
-        }
-        painter.rect_filled(visible, CornerRadius::ZERO, ACCENT.gamma_multiply(0.04));
-        painter.rect_stroke(visible, CornerRadius::ZERO, Stroke::new(1.5, ACCENT), egui::StrokeKind::Outside);
-        draw_handles(painter, preview);
-    }
-    if resp.drag_stopped() || !ptr.primary_down {
-        if let Some(s) = view.image_selection.as_mut() {
-            s.drag = None;
-            let norm = |r: Rect| {
-                let ((u0, v0), (u1, v1)) = (xf.screen_to_norm(r.min), xf.screen_to_norm(r.max));
-                Rect::from_two_pos(Pos2::new(u0, v0), Pos2::new(u1, v1))
-            };
-            s.settled = (preview != b).then(|| (left_at.unwrap_or_else(|| norm(b)), norm(preview)));
-        }
-        if preview != b {
-            view.pending_edit =
-                Some(Edit::EditPageImage { page, index: i, change: pdfcraft_engine::ImageEdit::Move(user_box(xf, info, page, target)) });
-        }
-    }
-    view.cursor.claim(
-        Layer::Drag,
-        match opposite {
-            Some(fixed) if (start.x - fixed.x) * (start.y - fixed.y) < 0.0 => egui::CursorIcon::ResizeNeSw,
-            Some(_) => egui::CursorIcon::ResizeNwSe,
-            None => egui::CursorIcon::Move,
-        },
-    );
+#[doc(hidden)]
+pub fn image_menu_id() -> egui::Id {
+    egui::Id::unique("image-menu")
 }
 
 /// Images on a page: select, move, resize, right-click. Returns `true` when the pointer was used.
-pub(crate) fn image_input(cx: &ImageCx<'_>, images: &[pdfcraft_engine::PageImage], view: &mut DocView, action: &mut Option<ImageAction>) -> bool {
+#[allow(clippy::cognitive_complexity)]
+pub(crate) fn image_input(cx: &ImageCx<'_>, images: &[pdfcraft_engine::PageImage], view: &mut DocView) -> bool {
     let ImageCx { ui, resp, xf, ptr, page, info, allow_interaction } = *cx;
-    let boxes: Vec<Rect> = images.iter().map(|im| im.visible_rect.map_or(Rect::NOTHING, |r| xf.user_rect(info, page, r.map(|v| v as f32)))).collect();
+    let boxes: Vec<Rect> = images.iter().map(|im| crate::canvas::image_screen_rect(im, xf, info, page)).collect();
     let painter = ui.painter();
     let hover_pos = ptr.pos;
     let image_contains = |index: usize, point: Pos2| {
@@ -495,32 +632,58 @@ pub(crate) fn image_input(cx: &ImageCx<'_>, images: &[pdfcraft_engine::PageImage
     };
     let selected = view.image_selection.as_ref().filter(|s| s.page == page).map(|s| s.index).filter(|i| *i < boxes.len());
     let dragging = view.image_selection.as_ref().is_some_and(|s| s.drag.is_some());
-    // Few images: faint outlines for all of them, as before. Many: only the selected and
-    // hovered boxes, so a ~1000-image CAD page stays interactive in Edit text & images.
-    // Fully clipped placements (empty visible frames) get no outline.
     let faint_all = boxes.len() <= MAX_OUTLINES;
-    // The picture being dragged has its frame at the pointer; its outline where it was would
-    // trail behind until the release.
     let moving = selected.filter(|_| dragging);
-    let hovered_box = hover_pos.and_then(|p| boxes.iter().enumerate().rposition(|(i, b)| b.is_positive() && b.contains(p) && image_contains(i, p)));
-    draw_outlines(painter, &boxes, OutlineState { selected, hovered_box, moving, dragging, faint_all });
+    if faint_all {
+        for (idx, im) in images.iter().enumerate() {
+            if moving == Some(idx) {
+                continue;
+            }
+            if let Some(b) = boxes.get(idx).filter(|b| b.is_positive()) {
+                let obb = ImageObb::from_image(im, xf, info, page);
+                if obb.is_rotated {
+                    let pts = obb.corners();
+                    for k in 0..4 {
+                        painter.line_segment([pts[k], pts[(k + 1) % 4]], Stroke::new(0.75, ACCENT.gamma_multiply(0.35)));
+                    }
+                } else {
+                    painter.rect_stroke(*b, CornerRadius::ZERO, Stroke::new(0.75, ACCENT.gamma_multiply(0.35)), egui::StrokeKind::Outside);
+                }
+            }
+        }
+    }
+    let hovered_box = hover_pos.and_then(|p| {
+        boxes.iter().enumerate().rposition(|(i, b)| {
+            b.is_positive() && images.get(i).is_some_and(|img| ImageObb::from_image(img, xf, info, page).contains(*b, p)) && image_contains(i, p)
+        })
+    });
+    if !faint_all {
+        for i in selected.filter(|_| moving.is_none()).into_iter().chain(hovered_box.filter(|h| Some(*h) != selected)) {
+            if let (Some(b), Some(img)) = (boxes.get(i).filter(|b| b.is_positive()), images.get(i)) {
+                let obb = ImageObb::from_image(img, xf, info, page);
+                picture_frame(painter, &obb, *b, Color32::TRANSPARENT, Stroke::new(0.75, ACCENT.gamma_multiply(0.35)));
+            }
+        }
+    }
+    for i in selected.into_iter().chain(hovered_box).collect::<Vec<_>>() {
+        let (Some(b), Some(img)) = (boxes.get(i).copied().filter(|b| b.is_positive()), images.get(i)) else { continue };
+        let obb = ImageObb::from_image(img, xf, info, page);
+        if selected == Some(i) {
+            if !dragging {
+                picture_frame(painter, &obb, b, ACCENT.gamma_multiply(0.04), Stroke::NONE);
+            }
+        } else {
+            picture_frame(painter, &obb, b, Color32::TRANSPARENT, Stroke::new(1.5, ACCENT.gamma_multiply(0.7)));
+        }
+    }
+
     // The selected image: frame, corner handles, dragging.
     if let Some(i) = selected.filter(|i| boxes.get(*i).is_some_and(|b| b.is_positive())) {
-        let b = boxes[i];
-        if view.image_selection.as_ref().is_some_and(|s| s.crop.is_some()) {
-            return crop_input(cx, view, i, b);
-        }
-        let corners = [b.left_top(), b.right_top(), b.left_bottom(), b.right_bottom()];
-        // Until the page is rendered again its raster has an applied move or resize's picture
-        // where it was: it stays blanked there and drawn where it went.
-        // The whole-page raster and its tiles are replaced separately: the old frame stays blanked
-        // while anything still shows the picture there, but its pixels come from the old frame
-        // only while the whole-page raster itself is the old one. Once that is fresh it has the
-        // picture where it went, and that is where they come from.
+        let Some(b) = boxes.get(i).copied() else { return false };
+        let Some(image) = images.get(i) else { return false };
+        let obb = ImageObb::from_image(image, xf, info, page);
         let (out_of_date, raster_old, raster) = (view.page_out_of_date(page), view.page_raster_out_of_date(page), view.page_raster(page));
         let screen = |r: Rect| Rect::from_two_pos(xf.norm_to_screen(r.min.x, r.min.y), xf.norm_to_screen(r.max.x, r.max.y));
-        // Where the screen may still show the picture from before an applied move, while the page
-        // isn't drawn again yet. Another drag keeps it blanked too.
         let left_at = view.image_selection.as_ref().and_then(|s| s.settled).filter(|_| out_of_date).map(|(from, _)| from);
         if let Some(s) = view.image_selection.as_mut().filter(|s| s.drag.is_none()) {
             match (s.settled, raster) {
@@ -528,45 +691,254 @@ pub(crate) fn image_input(cx: &ImageCx<'_>, images: &[pdfcraft_engine::PageImage
                     let source = if raster_old { from } else { to };
                     stretched_picture(painter, xf, tex, &[screen(from)], screen(source), screen(to));
                 }
-                _ => s.settled = None,
+                _ if !out_of_date => s.settled = None,
+                _ => {}
             }
         }
-        if view.image_selection.as_ref().is_some_and(|s| s.drag.is_none()) {
-            painter.rect_stroke(b, CornerRadius::ZERO, Stroke::new(1.5, ACCENT), egui::StrokeKind::Outside);
-            draw_handles(painter, b);
+
+        if view.image_selection.as_ref().is_some_and(|s| s.crop.is_some()) {
+            return crop_input(cx, view, i, image);
         }
-        // The rotate handle: a knob above the top edge, joined to it by a short stem.
         let (knob, stem) = rotate_knob(b, ui.clip_rect());
+        let shown_knob = if obb.is_rotated { obb.s_rot } else { knob };
         if view.image_selection.as_ref().is_some_and(|s| s.drag.is_none()) {
-            painter.line_segment([stem, knob], Stroke::new(1.0, ACCENT));
-            painter.circle(knob, 5.0, Color32::WHITE, Stroke::new(1.0, ACCENT));
+            picture_frame(painter, &obb, b, Color32::TRANSPARENT, Stroke::new(1.5, ACCENT));
+            if obb.is_rotated {
+                painter.line_segment([obb.s_tc, obb.s_rot], Stroke::new(1.2, ACCENT));
+                painter.circle(obb.s_rot, 4.5, Color32::WHITE, Stroke::new(1.0, ACCENT));
+            } else {
+                painter.line_segment([stem, knob], Stroke::new(1.0, ACCENT));
+                painter.circle(knob, 5.0, Color32::WHITE, Stroke::new(1.0, ACCENT));
+            }
+            for (_, h) in obb.handles() {
+                let is_hovered = hover_pos.is_some_and(|p| p.distance(h) < 10.0);
+                draw_handle(painter, h, false, is_hovered, false, ACCENT);
+            }
         }
-        // A drag on what the press was on ([`handle_hit`], [`body_hit`]): the knob turns the
-        // picture, a corner resizes it from the opposite one, the picture itself moves.
-        if allow_interaction
-            && resp.drag_started()
-            && let Some(o) = ptr.origin
-            && let Some(Owner::Picture { index, part }) = view.router.owner(page)
-            && index == i
-            && let Some(s) = view.image_selection.as_mut()
-        {
-            match part {
-                PicturePart::Knob => {
-                    s.drag = Some((o, None));
+
+        let mut handle_drag = None;
+        for (h, h_pos) in obb.handles() {
+            let handle_rect = Rect::from_center_size(h_pos, egui::vec2(18.0, 18.0));
+            let handle_resp = ui.interact(handle_rect, ui.scope_id().with("img_handle").with(h), egui::Sense::drag());
+            if allow_interaction && handle_resp.drag_started() {
+                handle_drag = Some(h);
+            }
+        }
+        let rot_id = ui.scope_id().with("img_handle").with(8);
+        let rot_rect = Rect::from_center_size(shown_knob, egui::vec2(12.0, 12.0));
+        let rot_resp = ui.interact(rot_rect, rot_id, egui::Sense::drag());
+        let rot_drag = allow_interaction && rot_resp.drag_started();
+
+        if allow_interaction && let Some(p) = hover_pos {
+            if shown_knob.distance(p) < 8.0 {
+                view.cursor.claim(Layer::Handle, egui::CursorIcon::Grab);
+            } else if let Some((h, _)) = obb.handles().iter().find(|(_, pos)| pos.distance(p) < 8.0) {
+                let icon = obb.handle_cursor(*h);
+                view.cursor.claim(Layer::Handle, icon);
+            }
+        }
+
+        let origin = ptr.origin;
+        if allow_interaction {
+            if let Some(h) = handle_drag {
+                if let Some(s) = view.image_selection.as_mut() {
+                    let o = origin.unwrap_or_else(|| obb.handle_pos(h));
+                    s.drag = Some(ImageDrag {
+                        start: o,
+                        target: DragTarget::Handle(h),
+                        initial_rect: b,
+                        initial_matrix: resize_frame(&obb, xf, info, page).0,
+                    });
+                }
+            } else if rot_drag {
+                if let Some(s) = view.image_selection.as_mut() {
+                    let o = origin.unwrap_or(shown_knob);
+                    s.drag = Some(ImageDrag { start: o, target: DragTarget::Rotate, initial_rect: b, initial_matrix: image.matrix });
                     s.turning = true;
                 }
-                PicturePart::Corner(k) => s.drag = Some((o, 3usize.checked_sub(k).and_then(|opposite| corners.get(opposite)).copied())),
-                PicturePart::Body => s.drag = Some((o, None)),
+            } else if resp.drag_started()
+                && let Some(o) = origin
+            {
+                if shown_knob.distance(o) < 8.0 {
+                    if let Some(s) = view.image_selection.as_mut() {
+                        s.drag = Some(ImageDrag { start: o, target: DragTarget::Rotate, initial_rect: b, initial_matrix: image.matrix });
+                        s.turning = true;
+                    }
+                } else if let Some((h, _)) = obb.handles().iter().find(|(_, pos)| pos.distance(o) < 8.0) {
+                    if let Some(s) = view.image_selection.as_mut() {
+                        s.drag = Some(ImageDrag {
+                            start: o,
+                            target: DragTarget::Handle(*h),
+                            initial_rect: b,
+                            initial_matrix: resize_frame(&obb, xf, info, page).0,
+                        });
+                    }
+                } else if (image_contains(i, o) || quad_contains(obb.corners(), o))
+                    && let Some(s) = view.image_selection.as_mut()
+                {
+                    s.drag = Some(ImageDrag { start: o, target: DragTarget::Move, initial_rect: b, initial_matrix: image.matrix });
+                }
             }
         }
+
         if view.image_selection.as_ref().is_some_and(|s| s.turning) {
-            turn_preview(cx, view, i, b, knob);
+            let shift = ui.input(|i| i.modifiers.shift);
+            let visible = image.visible_rect.unwrap_or(image.rect);
+            let centre = user_to_screen(xf, info, page, visible[0] * 0.5 + visible[2] * 0.5, visible[1] * 0.5 + visible[3] * 0.5);
+            let rot_knob = shown_knob;
+            let drag_start = view.image_selection.as_ref().and_then(|s| s.drag).map_or(rot_knob, |d| d.start);
+            let degrees = hover_pos.map_or(0.0, |p| turn_degrees_delta(centre, drag_start, p, shift));
+            let (sin, cos) = degrees.to_radians().sin_cos();
+            let turn = |c: Pos2| {
+                let v = c - centre;
+                centre + egui::vec2(v.x * cos - v.y * sin, v.x * sin + v.y * cos)
+            };
+            let outline = obb.corners().map(turn).to_vec();
+            painter.add(egui::Shape::closed_line(outline, Stroke::new(1.5, ACCENT)));
+            let galley = painter.layout_no_wrap(format!("{degrees:.0}\u{b0}"), egui::FontId::proportional(12.0), ACCENT);
+            let label = Rect::from_center_size(turn(rot_knob) - egui::vec2(0.0, 14.0), galley.size() + egui::vec2(8.0, 4.0));
+            painter.rect(label, CornerRadius::same(3), Color32::WHITE, Stroke::new(1.0, ACCENT), egui::StrokeKind::Middle);
+            painter.galley(label.center() - galley.size() / 2.0, galley, ACCENT);
+            view.cursor.claim(Layer::Drag, egui::CursorIcon::Grabbing);
+            if resp.drag_stopped() || !ptr.primary_down {
+                if let Some(s) = view.image_selection.as_mut() {
+                    s.drag = None;
+                    s.turning = false;
+                }
+                if degrees.abs() >= 0.05 {
+                    view.pending_edit =
+                        Some(Edit::EditPageImage { page, index: i, change: pdfcraft_engine::ImageEdit::RotateBy(f64::from(degrees)) });
+                }
+            }
             return true;
         }
-        if let Some((start, opposite)) = view.image_selection.as_ref().and_then(|s| s.drag)
+
+        if let Some(drag) = view.image_selection.as_ref().and_then(|s| s.drag)
             && let Some(p) = hover_pos
         {
-            drag_preview(cx, images, view, (i, b), (start, opposite, p), Blanked { left_at, raster_old });
+            if !obb.is_rotated && !matches!(drag.target, DragTarget::Rotate) {
+                let preview = match drag.target {
+                    DragTarget::Handle(handle) => {
+                        let delta = p - drag.start;
+                        let is_corner =
+                            matches!(handle, ImageHandle::TopLeft | ImageHandle::TopRight | ImageHandle::BottomLeft | ImageHandle::BottomRight);
+                        let shift = ui.input(|inp| inp.modifiers.shift);
+                        if is_corner && !shift {
+                            apply_resize_proportional(drag.initial_rect, handle, delta)
+                        } else {
+                            apply_resize(drag.initial_rect, handle, delta)
+                        }
+                    }
+                    DragTarget::Move => drag.initial_rect.translate(p - drag.start),
+                    _ => drag.initial_rect,
+                };
+
+                let raw = images.get(i).map_or(b, |im| xf.user_rect(info, page, im.rect.map(|v| v as f32)));
+                let ratio = |new: f32, old: f32| if old.abs() > 1e-3 && (new / old).is_finite() { new / old } else { 1.0 };
+                let factor = egui::vec2(ratio(preview.width(), b.width()), ratio(preview.height(), b.height()));
+                let f_min = egui::vec2((raw.min.x - b.min.x) * factor.x, (raw.min.y - b.min.y) * factor.y);
+                let f_max = egui::vec2((raw.max.x - b.min.x) * factor.x, (raw.max.y - b.min.y) * factor.y);
+                let target = Rect::from_min_max(preview.min + f_min, preview.min + f_max);
+                let visible = preview.intersect(xf.rect);
+
+                if visible.is_positive() {
+                    if preview != b
+                        && let Some(tex) = raster
+                    {
+                        let source = left_at.filter(|_| raster_old).map_or(b, screen);
+                        let blank: Vec<Rect> = left_at.map(screen).into_iter().chain(std::iter::once(b)).collect();
+                        stretched_picture(painter, xf, tex, &blank, source, preview);
+                    }
+                    painter.rect_filled(visible, CornerRadius::ZERO, ACCENT.gamma_multiply(0.04));
+                    painter.rect_stroke(visible, CornerRadius::ZERO, Stroke::new(1.5, ACCENT), egui::StrokeKind::Outside);
+                    for h in [
+                        preview.left_top(),
+                        preview.right_top(),
+                        preview.left_bottom(),
+                        preview.right_bottom(),
+                        preview.center_top(),
+                        preview.right_center(),
+                        preview.center_bottom(),
+                        preview.left_center(),
+                    ] {
+                        draw_handle(painter, h, false, false, false, ACCENT);
+                    }
+                }
+
+                if resp.drag_stopped() || !ptr.primary_down {
+                    if let Some(s) = view.image_selection.as_mut() {
+                        s.drag = None;
+                        let norm = |r: Rect| {
+                            let ((u0, v0), (u1, v1)) = (xf.screen_to_norm(r.min), xf.screen_to_norm(r.max));
+                            Rect::from_two_pos(Pos2::new(u0, v0), Pos2::new(u1, v1))
+                        };
+                        s.settled = (preview != b).then(|| (left_at.unwrap_or_else(|| norm(b)), norm(preview)));
+                    }
+                    if preview != b {
+                        view.pending_edit =
+                            Some(Edit::EditPageImage { page, index: i, change: pdfcraft_engine::ImageEdit::Move(user_box(xf, info, page, target)) });
+                    }
+                }
+
+                let icon = match drag.target {
+                    DragTarget::Handle(handle) => obb.handle_cursor(handle),
+                    DragTarget::Move => egui::CursorIcon::Grabbing,
+                    _ => egui::CursorIcon::Move,
+                };
+                view.cursor.claim(Layer::Drag, icon);
+                return true;
+            }
+            let m_init = Matrix(drag.initial_matrix);
+            let [a0, b0, c0, d0, e0, f0] = drag.initial_matrix;
+            let (sx, sy) = screen_to_user(xf, info, page, drag.start);
+            let (px, py) = screen_to_user(xf, info, page, p);
+
+            let (m_new, cursor_icon) = match drag.target {
+                DragTarget::Move => {
+                    let (dx, dy) = (px - sx, py - sy);
+                    (Matrix([a0, b0, c0, d0, e0 + dx, f0 + dy]), egui::CursorIcon::Move)
+                }
+                DragTarget::Handle(handle) => {
+                    let proportional = !ui.input(|input| input.modifiers.shift);
+                    let resized = resize_affine_frame(m_init, handle, (px - sx, py - sy), proportional).unwrap_or(m_init);
+                    (resized, obb.handle_cursor(handle))
+                }
+                // Turning is handled above.
+                DragTarget::Rotate => (m_init, egui::CursorIcon::Default),
+            };
+
+            let preview_obb = ImageObb::from_matrix(m_new.0, xf, info, page);
+            if let Some(tex) = view.page_raster(page) {
+                let clipped = painter.with_clip_rect(painter.clip_rect().intersect(xf.rect));
+                let mut from = obb.corners();
+                let mut to = preview_obb.corners();
+                from.reverse();
+                to.reverse();
+                mapped_picture(&clipped, xf, tex, from, to);
+            }
+
+            let visible = Rect::from_two_pos(preview_obb.s01, preview_obb.s10).intersect(xf.rect);
+            picture_frame(painter, &preview_obb, visible, ACCENT.gamma_multiply(0.04), Stroke::new(1.5, ACCENT));
+            for (_, h) in preview_obb.handles() {
+                draw_handle(painter, h, false, false, false, ACCENT);
+            }
+
+            if resp.drag_stopped() || !ptr.primary_down {
+                if let Some(s) = view.image_selection.as_mut() {
+                    s.drag = None;
+                }
+                if m_new.0 != drag.initial_matrix {
+                    if matches!(drag.target, DragTarget::Move) {
+                        let (dx, dy) = (px - sx, py - sy);
+                        let new_rect = [image.rect[0] + dx, image.rect[1] + dy, image.rect[2] + dx, image.rect[3] + dy];
+                        view.pending_edit = Some(Edit::EditPageImage { page, index: i, change: pdfcraft_engine::ImageEdit::Move(new_rect) });
+                    } else if let Some(inv) = Matrix(drag.initial_matrix).invert() {
+                        let t = inv.then(&m_new);
+                        view.pending_edit = Some(Edit::EditPageImage { page, index: i, change: pdfcraft_engine::ImageEdit::Transform(t.0) });
+                    }
+                }
+            }
+            view.cursor.claim(Layer::Drag, cursor_icon);
             return true;
         }
         if allow_interaction
@@ -581,120 +953,201 @@ pub(crate) fn image_input(cx: &ImageCx<'_>, images: &[pdfcraft_engine::PageImage
     if !allow_interaction {
         return false;
     }
-    // An open menu stays drawn wherever the pointer is: most of its items lie outside the picture
-    // (a logo is smaller than its menu), and a menu that is not drawn for a frame cannot be clicked.
-    // Only a menu opened by a right-click on the picture: one opened over text or empty page while
-    // a picture stays selected is the page's own menu.
-    let menu_key = resp.id.with("image-menu");
-    if resp.secondary_clicked() {
-        ui.ctx().data_mut(|d| d.insert_temp(menu_key, false));
-    }
-    let mut menu_drawn = false;
-    if let Some(sel) = selected
-        && resp.context_menu_opened()
-        && ui.ctx().data(|d| d.get_temp::<bool>(menu_key)).unwrap_or(false)
-    {
-        resp.context_menu(|ui| image_menu(ui, page, sel, images, view, action));
-        menu_drawn = true;
-    }
+    let menu_key = image_menu_id();
     let Some(p) = hover_pos.filter(|p| xf.rect.contains(*p)) else { return false };
-    let Some(hit) = boxes.iter().enumerate().rposition(|(i, b)| b.contains(p) && image_contains(i, p)) else { return false };
+    let Some(hit) = boxes.iter().enumerate().rposition(|(i, b)| {
+        b.is_positive() && images.get(i).is_some_and(|img| ImageObb::from_image(img, xf, info, page).contains(*b, p)) && image_contains(i, p)
+    }) else {
+        if resp.secondary_clicked() || resp.clicked() {
+            view.image_selection = None;
+            ui.ctx().data_mut(|d| d.insert_temp(menu_key, false));
+        }
+        return false;
+    };
+    let Some(hit_img) = images.get(hit) else { return false };
+    let hit_obb = ImageObb::from_image(hit_img, xf, info, page);
     if selected != Some(hit) {
-        painter.rect_stroke(boxes[hit], CornerRadius::ZERO, Stroke::new(1.5, ACCENT.gamma_multiply(0.7)), egui::StrokeKind::Outside);
+        if hit_obb.is_rotated {
+            let pts = hit_obb.corners();
+            for k in 0..4 {
+                painter.line_segment([pts[k], pts[(k + 1) % 4]], Stroke::new(1.5, ACCENT.gamma_multiply(0.7)));
+            }
+        } else if let Some(b) = boxes.get(hit).copied() {
+            painter.rect_stroke(b, CornerRadius::ZERO, Stroke::new(1.5, ACCENT.gamma_multiply(0.7)), egui::StrokeKind::Outside);
+        }
     }
-    // A click selects the picture the press was on; a right-click the one under the pointer.
+    let grip = hit_obb.handles().into_iter().find(|(_, point)| point.distance(p) < 10.0);
+    let cursor = if selected == Some(hit) {
+        grip.map_or(egui::CursorIcon::Grab, |(handle, _)| hit_obb.handle_cursor(handle))
+    } else {
+        egui::CursorIcon::PointingHand
+    };
+    view.cursor.claim(Layer::Text, cursor);
     let clicked = match view.router.owner(page) {
         Some(Owner::Picture { index, .. }) if resp.clicked() => Some(index),
-        _ => resp.secondary_clicked().then_some(hit),
+        _ => (resp.clicked() || resp.secondary_clicked()).then_some(hit),
     };
     if let Some(index) = clicked {
-        view.image_selection = Some(ImageSelection { page, index, drag: None, crop: None, turning: false, settled: None });
+        view.image_selection = Some(ImageSelection::at(page, index));
     }
     if resp.secondary_clicked() {
         ui.ctx().data_mut(|d| d.insert_temp(menu_key, true));
     }
-    if selected == Some(hit) && !menu_drawn {
-        resp.context_menu(|ui| image_menu(ui, page, hit, images, view, action));
-    }
     true
 }
 
-/// The right-click menu of the picture `hit` (its rotate, flip, replace, copy, cut, redact, link,
-/// recognize and delete items).
-fn image_menu(
+/// The right-click context menu for a selected image.
+#[allow(clippy::too_many_arguments)]
+pub(crate) fn image_context_menu(
     ui: &mut egui::Ui,
+    view: &mut DocView,
+    images: &[pdfcraft_engine::PageImage],
     page: usize,
     hit: usize,
-    images: &[pdfcraft_engine::PageImage],
-    view: &mut DocView,
+    can_paste: bool,
     action: &mut Option<ImageAction>,
+    at: Option<[f64; 2]>,
+    rotation: u16,
 ) {
+    let Some(img) = images.get(hit) else { return };
     use pdfcraft_engine::ImageEdit as E;
-    let items: [(&str, Option<E>); 4] = [
-        (tl!("Rotate Clockwise"), Some(E::Rotate(1))),
-        (tl!("Rotate Counterclockwise"), Some(E::Rotate(3))),
-        (tl!("Flip Horizontal"), Some(E::Flip { horizontal: true })),
-        (tl!("Flip Vertical"), Some(E::Flip { horizontal: false })),
-    ];
-    for (label, change) in items {
-        if ui.button(label).clicked() {
-            view.pending_edit = change.map(|c| Edit::EditPageImage { page, index: hit, change: c });
+    let raster = !img.is_form;
+
+    // Whether `entry` was clicked; a click closes the menu.
+    let picked = |ui: &mut egui::Ui, entry: egui::Response| {
+        let clicked = entry.clicked();
+        if clicked {
+            ui.ctx().data_mut(|d| d.insert_temp(image_menu_id(), false));
+            egui::Popup::close_all(ui.ctx());
             ui.close();
         }
-    }
-    // Crop: the handles trim instead of resizing until Done.
-    if ui.button(tl!("Crop Image")).clicked() {
-        if let (Some(s), Some(im)) = (view.image_selection.as_mut(), images.get(hit)) {
-            s.crop = Some(CropMode::new(im.visible_rect.unwrap_or(im.rect)));
+        clicked
+    };
+    let item = |ui: &mut egui::Ui, enabled: bool, label: &str| {
+        let entry = ui.add_enabled(enabled, egui::Button::new(label));
+        picked(ui, entry)
+    };
+    let edit = |change| Some(Edit::EditPageImage { page, index: hit, change });
+
+    // Top horizontal icon bar: Comment, Crop, Rotate CCW, Rotate CW
+    ui.horizontal(|ui| {
+        ui.spacing_mut().item_spacing.x = 4.0;
+        let icon = |ui: &mut egui::Ui, name: &str, tip: &str| {
+            let entry = crate::icons::button(ui, name, 24.0, false, tip);
+            picked(ui, entry)
+        };
+        if icon(ui, "message-square", tl!("Add a sticky note here")) {
+            *action = Some(ImageAction::AddComment(page, hit));
         }
-        ui.close();
-    }
-    let cropped = images.get(hit).is_some_and(|im| im.visible_rect.is_some_and(|v| v.iter().zip(im.rect.iter()).any(|(a, b)| (a - b).abs() > 0.01)));
-    if ui.add_enabled(cropped, egui::Button::new(tl!("Remove Crop"))).clicked() {
-        if let Some(im) = images.get(hit) {
-            view.pending_edit = Some(Edit::EditPageImage { page, index: hit, change: E::Crop(im.rect) });
+        if raster
+            && icon(ui, "crop", tl!("Crop"))
+            && let Some(s) = view.image_selection.as_mut()
+        {
+            s.crop = Some(CropMode::new(img.visible_rect.unwrap_or(img.rect)));
         }
-        ui.close();
-    }
-    let raster = images.get(hit).is_some_and(|image| !image.is_form);
-    if ui.add_enabled(raster, egui::Button::new(tl!("Replace Image…"))).clicked() {
-        *action = Some(ImageAction::Replace(page, hit));
-        ui.close();
-    }
-    if ui.add_enabled(raster, egui::Button::new(tl!("Save Image As…"))).clicked() {
-        *action = Some(ImageAction::Save(page, hit));
-        ui.close();
-    }
-    // Cutting and copying also find the picture inside grouped Form artwork.
-    if ui.button(tl!("Cut Image")).clicked() {
+        if icon(ui, "rotate-ccw", tl!("Rotate Counterclockwise")) {
+            view.pending_edit = edit(E::Rotate(3));
+        }
+        if icon(ui, "rotate-cw", tl!("Rotate Clockwise")) {
+            view.pending_edit = edit(E::Rotate(1));
+        }
+    });
+
+    ui.separator();
+
+    if item(ui, true, tl!("Cut Image")) {
         *action = Some(ImageAction::Cut(page, hit));
-        ui.close();
     }
-    if ui.button(tl!("Copy Image")).clicked() {
+    if item(ui, true, tl!("Copy Image")) {
         *action = Some(ImageAction::Copy(page, hit));
-        ui.close();
     }
-    if ui.button(tl!("Copy Image in Original Format")).clicked() {
-        *action = Some(ImageAction::CopyFile(page, hit));
-        ui.close();
+    if item(ui, can_paste, tl!("Paste")) {
+        *action = Some(ImageAction::Paste(page, at));
     }
+
     ui.separator();
-    if ui.button(tl!("Redact Image")).clicked() {
+
+    if raster && img.has_editor_crop() && item(ui, true, tl!("Remove crop")) {
+        view.pending_edit = edit(E::RemoveCrop);
+    }
+    if item(ui, true, tl!("Flip horizontal")) {
+        view.pending_edit = edit(E::Flip { horizontal: flip_user_axis(true, rotation) });
+    }
+    if item(ui, true, tl!("Flip vertical")) {
+        view.pending_edit = edit(E::Flip { horizontal: flip_user_axis(false, rotation) });
+    }
+
+    ui.menu_button(tl!("Arrange image"), |ui| {
+        use pdfcraft_engine::ArrangeOrder as A;
+        for (order, label) in [
+            (A::BringToFront, tl!("Bring to front")),
+            (A::SendToBack, tl!("Send to back")),
+            (A::BringForward, tl!("Bring forward")),
+            (A::SendBackward, tl!("Send backward")),
+        ] {
+            if item(ui, true, label) {
+                view.pending_edit = edit(E::Arrange(order));
+            }
+        }
+    });
+
+    if item(ui, raster, tl!("Replace image")) {
+        *action = Some(ImageAction::Replace(page, hit));
+    }
+    if item(ui, raster, tl!("Save Image As…")) {
+        *action = Some(ImageAction::Save(page, hit));
+    }
+
+    ui.separator();
+
+    if item(ui, true, tl!("Draw freehand")) {
+        *action = Some(ImageAction::DrawFreehand);
+    }
+    if item(ui, true, tl!("Redact Image")) {
         *action = Some(ImageAction::Redact(page, hit));
-        ui.close();
-    }
-    if ui.button(tl!("Create Link…")).clicked() {
-        *action = Some(ImageAction::Link(page, hit));
-        ui.close();
-    }
-    if ui.button(tl!("Recognize Text…")).clicked() {
-        *action = Some(ImageAction::Recognize(page));
-        ui.close();
     }
+
     ui.separator();
-    if ui.button(tl!("Delete")).clicked() {
+
+    if item(ui, true, tl!("Create Link…")) {
+        *action = Some(ImageAction::Link(page, hit));
+    }
+    if item(ui, true, tl!("Recognize Text…")) {
+        *action = Some(ImageAction::Recognize(page));
+    }
+
+    ui.separator();
+
+    if item(ui, true, tl!("Delete")) {
         view.image_selection = None;
-        view.pending_edit = Some(Edit::EditPageImage { page, index: hit, change: E::Delete });
-        ui.close();
+        view.pending_edit = edit(E::Delete);
+    }
+}
+
+fn flip_user_axis(horizontal: bool, rotation: u16) -> bool {
+    horizontal ^ (rotation % 180 == 90)
+}
+
+#[cfg(test)]
+mod screen_orientation_tests {
+    use super::*;
+
+    #[test]
+    fn affine_resize_rejects_degenerate_or_nonfinite_frames() {
+        for frame in [[1.0, 1.0, 1.0, 1.0, 0.0, 0.0], [1.0, 1.0, 1.0, 1.0 + 1e-13, 0.0, 0.0], [f64::INFINITY, 0.0, 0.0, 1.0, 0.0, 0.0]] {
+            assert!(resize_affine_frame(Matrix(frame), ImageHandle::TopRight, (1.0, 1.0), true).is_none(), "{frame:?}");
+        }
+        let frame = Matrix([100.0, 0.0, 50.0, 100.0, 100.0, 100.0]);
+        assert!(resize_affine_frame(frame, ImageHandle::TopRight, (10.0, 10.0), true).is_some());
+        assert!(resize_affine_frame(frame, ImageHandle::TopRight, (f64::NAN, 0.0), true).is_none());
+        assert!(resize_affine_frame(frame, ImageHandle::TopRight, (0.0, f64::INFINITY), true).is_none());
+    }
+
+    #[test]
+    fn flip_labels_follow_the_screen_axis() {
+        for rotation in [0, 90, 180, 270] {
+            assert_eq!(flip_user_axis(true, rotation), rotation % 180 == 0);
+            assert_eq!(flip_user_axis(false, rotation), rotation % 180 != 0);
+        }
     }
 }
diff --git a/crates/ui-egui/src/tools/edit_text_ui/layout.rs b/crates/ui-egui/src/tools/edit_text_ui/layout.rs
index ef004403be..1946519203 100644
--- a/crates/ui-egui/src/tools/edit_text_ui/layout.rs
+++ b/crates/ui-egui/src/tools/edit_text_ui/layout.rs
@@ -1,7 +1,7 @@
 use super::{Arc, BTreeMap, Color32, FontFamily, FontId, LineEditor, Rect};
 
 /// The look shown for a paragraph: the family and weight guessed from its PDF font name.
-fn source_look(base_font: &str, size: f64, color: [f64; 3], detected_bold: bool, detected_italic: bool) -> pdfcraft_engine::AddedText {
+pub(super) fn source_look(base_font: &str, size: f64, color: [f64; 3], detected_bold: bool, detected_italic: bool) -> pdfcraft_engine::AddedText {
     use pdfcraft_engine::FontFamily as F;
     let name = base_font.to_ascii_lowercase();
     let family = if ["courier", "mono", "consolas", "menlo", "monaco", "lucida console"].iter().any(|s| name.contains(s)) {
diff --git a/crates/ui-egui/src/tools/object_ui.rs b/crates/ui-egui/src/tools/object_ui.rs
index 17aea394fe..67a077bc7b 100644
--- a/crates/ui-egui/src/tools/object_ui.rs
+++ b/crates/ui-egui/src/tools/object_ui.rs
@@ -198,10 +198,13 @@ pub(crate) fn hit(view: &DocView, xf: &PageXform, info: &DocInfo, page: usize, o
 /// Returns true while group selection owns the interaction. Ordinary clicks still reach the
 /// single-object text/resize tools. A text draft is finished or discarded through its editor.
 pub(crate) fn page_input(cx: PageToolContext<'_>, view: &mut DocView) -> bool {
-    let PageToolContext { ui, xf, ptr, page, .. } = cx;
+    let PageToolContext { ui, resp, xf, ptr, page, .. } = cx;
     if view.objects.input_blocked {
         return true;
     }
+    if resp.context_menu_opened() || egui::Popup::is_any_open(ui.ctx()) {
+        return false;
+    }
     if view.content.draft.is_some() || view.line_editor.as_ref().is_some_and(|e| e.has_changes()) {
         let blocked = view.objects.blocked_page == Some(page);
         let modifier_press = ptr.pressed().is_some() && modified(ui) && ptr.pos.is_some_and(|p| xf.rect.contains(p) && ui.clip_rect().contains(p));
diff --git a/crates/ui-egui/src/tools/redact_ui.rs b/crates/ui-egui/src/tools/redact_ui.rs
index 96b544b4d0..e55dd8c5c3 100644
--- a/crates/ui-egui/src/tools/redact_ui.rs
+++ b/crates/ui-egui/src/tools/redact_ui.rs
@@ -360,16 +360,24 @@ pub(crate) fn pages_body(ui: &mut egui::Ui, d: &mut PagesDraft, pages: usize, _t
     ui.label(egui::RichText::new(tl!("Mark Page Range")).font(crate::theme::semibold(18.0)));
     ui.add_space(8.0);
     widgets::radio_value(ui, &mut d.current, true, tl!("Current page"));
-    ui.horizontal(|ui| {
-        widgets::radio_value(ui, &mut d.current, false, tl!("Pages from"));
-        ui.add_enabled(!d.current, egui::DragValue::new(&mut d.from).range(1..=pages));
-        ui.label(tl!("to"));
-        ui.add_enabled(!d.current, egui::DragValue::new(&mut d.to).range(1..=pages));
-        ui.label(crate::i18n::fmt(tl!("of {name}"), &[("name", &pages.to_string())]));
-    });
-    d.to = d.to.max(d.from);
+    let to_field = ui
+        .horizontal(|ui| {
+            let from_label = widgets::radio_value(ui, &mut d.current, false, tl!("Pages from"));
+            ui.add_enabled(!d.current, egui::DragValue::new(&mut d.from).range(1..=pages)).labelled_by(from_label.id);
+            let to_label = ui.label(tl!("to"));
+            let to_field = ui.add_enabled(!d.current, egui::DragValue::new(&mut d.to).range(1..=pages)).labelled_by(to_label.id);
+            ui.label(crate::i18n::fmt(tl!("of {name}"), &[("name", &pages.to_string())]));
+            to_field
+        })
+        .inner;
+    widgets::keep_range_ordered(d.from, &mut d.to, widgets::typing_into(&to_field));
     ui.add_space(12.0);
-    buttons(ui, "OK", true)
+    let (ok, cancel) = buttons(ui, "OK", true);
+    if ok {
+        // OK while the end is still being typed (a screen reader can press it).
+        widgets::keep_range_ordered(d.from, &mut d.to, false);
+    }
+    (ok, cancel)
 }
 
 /// Find text and redact. Returns (search, cancel, import a word list).
@@ -675,3 +683,106 @@ pub(crate) fn sanitize_body(ui: &mut egui::Ui, t: &Tokens) -> (bool, bool) {
     ui.add_space(12.0);
     buttons(ui, "Sanitize", true)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use egui::accesskit::Role;
+    use egui_kittest::kittest::Queryable;
+
+    fn key(key: egui::Key, modifiers: egui::Modifiers) -> egui::Event {
+        egui::Event::Key { key, physical_key: None, pressed: true, repeat: false, modifiers }
+    }
+
+    /// #5574: typing "12" into the end of 5 to 5 came out as 5. The end was raised to the start
+    /// after every keystroke, so the half-typed "1" was replaced before the "2" arrived.
+    #[test]
+    fn typing_the_last_page_keeps_what_is_typed() {
+        let mut fonts = false;
+        let mut h = egui_kittest::Harness::new_ui_state(
+            move |ui, d: &mut PagesDraft| {
+                // The app's fonts (the semibold heading) take effect from the next frame.
+                if !fonts {
+                    ui.ctx().set_fonts(crate::theme::font_definitions());
+                    fonts = true;
+                    return;
+                }
+                let t = Tokens::get(ui.ctx());
+                pages_body(ui, d, 20, &t);
+            },
+            PagesDraft { current: false, from: 5, to: 5 },
+        );
+        h.run();
+        for (typed, expected) in [("12", 12), ("3", 5)] {
+            h.get_by_role_and_label(Role::SpinButton, "to").click();
+            h.run();
+            h.event(key(egui::Key::A, egui::Modifiers::COMMAND));
+            for c in typed.chars() {
+                h.event(egui::Event::Text(c.to_string()));
+                h.run_steps(2);
+            }
+            h.event(key(egui::Key::Enter, egui::Modifiers::NONE));
+            h.run_steps(2);
+            assert_eq!(*h.state(), PagesDraft { current: false, from: 5, to: expected }, "typed {typed:?}");
+        }
+    }
+
+    /// The dialog with its OK result kept: (draft, OK pressed).
+    fn dialog() -> egui_kittest::Harness<'static, (PagesDraft, bool)> {
+        let mut fonts = false;
+        let mut h = egui_kittest::Harness::new_ui_state(
+            move |ui, (d, ok): &mut (PagesDraft, bool)| {
+                if !fonts {
+                    ui.ctx().set_fonts(crate::theme::font_definitions());
+                    fonts = true;
+                    return;
+                }
+                let t = Tokens::get(ui.ctx());
+                *ok |= pages_body(ui, d, 20, &t).0;
+            },
+            (PagesDraft { current: false, from: 5, to: 5 }, false),
+        );
+        h.run();
+        h
+    }
+
+    fn type_last_page(h: &mut egui_kittest::Harness<'static, (PagesDraft, bool)>, typed: &str) {
+        h.get_by_role_and_label(Role::SpinButton, "to").click();
+        h.run();
+        h.event(key(egui::Key::A, egui::Modifiers::COMMAND));
+        for c in typed.chars() {
+            h.event(egui::Event::Text(c.to_string()));
+            h.run_steps(2);
+        }
+    }
+
+    /// OK pressed while the end is still being typed (a screen reader's click leaves the field
+    /// focused) orders the range, so a reversed one never reaches the edit.
+    #[test]
+    fn ok_while_the_last_page_is_typed_orders_the_range() {
+        let mut h = dialog();
+        type_last_page(&mut h, "3");
+        assert_eq!(h.state().0.to, 3, "still typing");
+        h.get_by_label("OK").click_accesskit();
+        h.run_steps(2);
+        assert_eq!(*h.state(), (PagesDraft { current: false, from: 5, to: 5 }, true));
+    }
+
+    /// Switching to another window halfway through "12" leaves the typed "1" alone: the field
+    /// still has the keyboard when the window comes back.
+    #[test]
+    fn switching_windows_mid_number_keeps_what_is_typed() {
+        let mut h = dialog();
+        type_last_page(&mut h, "1");
+        h.input_mut().focused = false;
+        h.run_steps(2);
+        assert_eq!(h.state().0.to, 1, "the typed 1 stays while the window is in the background");
+        h.input_mut().focused = true;
+        h.run_steps(2);
+        h.event(egui::Event::Text("2".into()));
+        h.run_steps(2);
+        h.event(key(egui::Key::Enter, egui::Modifiers::NONE));
+        h.run_steps(2);
+        assert_eq!(h.state().0.to, 12);
+    }
+}
diff --git a/crates/ui-egui/src/widgets.rs b/crates/ui-egui/src/widgets.rs
index 1c688b9bb3..5e33f9cd9a 100644
--- a/crates/ui-egui/src/widgets.rs
+++ b/crates/ui-egui/src/widgets.rs
@@ -70,7 +70,7 @@ pub fn line(text: &mut dyn egui::TextBuffer) -> egui::TextEdit<'_> {
     egui::TextEdit::singleline(text).margin(FIELD_MARGIN).min_size(vec2(0.0, FIELD_MIN_HEIGHT))
 }
 
-/// A multiline field with the same horizontal inset as [`line`].
+/// A multiline field with the same horizontal inset as [`line()`].
 pub fn block(text: &mut dyn egui::TextBuffer) -> egui::TextEdit<'_> {
     egui::TextEdit::multiline(text).margin(egui::Margin::symmetric(10, 6))
 }
@@ -254,6 +254,23 @@ pub fn radio_value<'a, V: PartialEq>(ui: &mut egui::Ui, current: &mut V, alterna
     response
 }
 
+/// Keeps the end of a "from … to …" page range at or after its start, but not while `typing` into the
+/// end's `DragValue` ([`typing_into`]): the half-typed "1" of "12" is below `from`, and raising it
+/// then replaced what the user was typing with `from` (#5574). A dialog's OK orders it whatever has
+/// the keyboard (`typing` false), so a range left reversed never reaches the edit.
+pub fn keep_range_ordered(from: usize, to: &mut usize, typing: bool) {
+    if !typing {
+        *to = (*to).max(from);
+    }
+}
+
+/// Whether `field` is being typed into: it has the keyboard focus in egui's memory. Unlike
+/// `Response::has_focus` this stays true while the window is in the background, so switching to
+/// another app mid-number doesn't end the typing.
+pub fn typing_into(field: &Response) -> bool {
+    field.ctx.memory(|m| m.has_focus(field.id))
+}
+
 /// The box of a checkbox or the circle of a radio button. egui draws it with the widgets' visuals
 /// and has no style of its own for it, so it is set in a scope around the widget, keeping what
 /// the caller set (dialogs and the search panel already outline theirs):
diff --git a/crates/ui-egui/src/workflows/create_ui.rs b/crates/ui-egui/src/workflows/create_ui.rs
index 6dceb50657..5a6c9caf7b 100644
--- a/crates/ui-egui/src/workflows/create_ui.rs
+++ b/crates/ui-egui/src/workflows/create_ui.rs
@@ -57,19 +57,36 @@ pub enum Clip {
 }
 
 /// An image on the system clipboard, or else its text.
+pub(crate) const MAX_IMAGE_SIDE: usize = 16384;
+pub(crate) const MAX_IMAGE_BYTES: usize = 64 * 1024 * 1024;
+
 #[cfg(not(target_arch = "wasm32"))]
 pub(crate) fn read_clipboard() -> Option<Clip> {
-    let mut cb = arboard::Clipboard::new().ok()?;
-    if let Ok(img) = cb.get_image() {
-        return Some(Clip::Image { width: img.width, height: img.height, rgba: img.bytes.into_owned() });
-    }
-    cb.get_text().ok().filter(|t| !t.trim().is_empty()).map(Clip::Text)
+    crate::os_clipboard::with(|cb| {
+        if let Ok(img) = cb.get_image() {
+            let expected_len = img.width.checked_mul(img.height).and_then(|px| px.checked_mul(4));
+            if img.width > 0
+                && img.height > 0
+                && img.width <= MAX_IMAGE_SIDE
+                && img.height <= MAX_IMAGE_SIDE
+                && expected_len == Some(img.bytes.len())
+                && img.bytes.len() <= MAX_IMAGE_BYTES
+            {
+                return Ok(Some(Clip::Image { width: img.width, height: img.height, rgba: img.bytes.into_owned() }));
+            }
+            return Ok(None);
+        }
+        Ok(cb.get_text().ok().filter(|t| !t.trim().is_empty()).map(Clip::Text))
+    })
+    .ok()
+    .flatten()
 }
 
 pub(crate) fn png_from_rgba(width: usize, height: usize, rgba: &[u8]) -> Result<Vec<u8>, String> {
     let (w, h) = (u32::try_from(width).map_err(|e| e.to_string())?, u32::try_from(height).map_err(|e| e.to_string())?);
-    if w == 0 || h == 0 || rgba.len() != width * height * 4 {
-        return Err("the clipboard image is empty or malformed".into());
+    let expected = width.checked_mul(height).and_then(|p| p.checked_mul(4));
+    if w == 0 || h == 0 || width > MAX_IMAGE_SIDE || height > MAX_IMAGE_SIDE || expected != Some(rgba.len()) || rgba.len() > MAX_IMAGE_BYTES {
+        return Err("the clipboard image is empty, malformed or exceeds size limits".into());
     }
     let mut out = Vec::new();
     let mut enc = png::Encoder::new(&mut out, w, h);
@@ -141,9 +158,10 @@ impl PdfCraftApp {
         self.open_created_bytes("Clipboard.pdf", created.map_err(|e| e.to_string()))
     }
 
-    /// Create ▸ Blank page: a new untitled US Letter document.
+    /// Create ▸ Blank page: a new untitled document on the system region's paper (#5644).
     pub(crate) fn create_blank(&mut self) {
-        let created = self.session.create_blank(612.0, 792.0, 1).map_err(|e| e.to_string());
+        let (w, h) = self.blank_paper.points();
+        let created = self.session.create_blank(w, h, 1).map_err(|e| e.to_string());
         if let Err(e) = self.open_created_bytes("Untitled.pdf", created) {
             self.notify_fmt("Couldn't create a PDF: {e}", &[("e", &e.to_string())]);
         }
diff --git a/crates/ui-egui/src/workflows/files.rs b/crates/ui-egui/src/workflows/files.rs
index a9313a4714..adb5e2f0dd 100644
--- a/crates/ui-egui/src/workflows/files.rs
+++ b/crates/ui-egui/src/workflows/files.rs
@@ -28,33 +28,65 @@ pub enum FilePurpose {
     RedactWords,
 }
 
-/// Discover installed document fonts off the GUI thread, only when the picker is opened.
 #[cfg(not(target_arch = "wasm32"))]
-pub(crate) fn installed_font_files(ctx: &egui::Context) -> Option<Vec<pdfcraft_engine::text_fonts::FontFile>> {
+fn discover_fonts_safely(
+    discover: impl FnOnce() -> Vec<pdfcraft_engine::text_fonts::FontFile> + std::panic::UnwindSafe,
+) -> Vec<pdfcraft_engine::text_fonts::FontFile> {
+    std::panic::catch_unwind(discover).unwrap_or_default()
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+#[derive(Default)]
+struct FontScanCache {
+    files: Option<Vec<pdfcraft_engine::text_fonts::FontFile>>,
+    loading: bool,
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+impl FontScanCache {
+    fn begin(&mut self, reload: bool) -> bool {
+        if self.loading || (!reload && self.files.is_some()) {
+            return false;
+        }
+        self.loading = true;
+        self.files = None;
+        true
+    }
+
+    fn finish(&mut self, files: Vec<pdfcraft_engine::text_fonts::FontFile>) {
+        self.files = Some(files);
+        self.loading = false;
+    }
+}
+
+/// Discover installed document fonts off the GUI thread. Reload permits retrying a
+/// failed scan or discovering newly installed fonts without restarting the app.
+#[cfg(not(target_arch = "wasm32"))]
+pub(crate) fn installed_font_files(ctx: &egui::Context, reload: bool) -> Option<Vec<pdfcraft_engine::text_fonts::FontFile>> {
     use std::sync::{Mutex, OnceLock};
-    type Files = Arc<Mutex<Option<Vec<pdfcraft_engine::text_fonts::FontFile>>>>;
+    type Files = Arc<Mutex<FontScanCache>>;
     static CACHE: OnceLock<Files> = OnceLock::new();
-    let files = CACHE.get_or_init(|| {
-        let files: Files = Arc::new(Mutex::new(None));
+    let files = CACHE.get_or_init(|| Arc::new(Mutex::new(FontScanCache::default())));
+    let start = files.lock().is_ok_and(|mut state| state.begin(reload));
+    if start {
         let result = files.clone();
         let ctx = ctx.clone();
         if std::thread::Builder::new()
             .name("document-font-discovery".into())
             .spawn(move || {
-                let fonts = pdfcraft_engine::text_fonts::discover(&pdfcraft_engine::text_fonts::installed_directories());
+                let fonts = discover_fonts_safely(|| pdfcraft_engine::text_fonts::discover(&pdfcraft_engine::text_fonts::installed_directories()));
                 if let Ok(mut result) = result.lock() {
-                    *result = Some(fonts);
+                    result.finish(fonts);
                 }
                 ctx.request_repaint();
             })
             .is_err()
             && let Ok(mut result) = files.lock()
         {
-            *result = Some(Vec::new());
+            result.finish(Vec::new());
         }
-        files
-    });
-    files.lock().ok().and_then(|f| f.clone())
+    }
+    files.lock().ok().and_then(|f| f.files.clone())
 }
 
 /// The picker for `purpose`: PDFs, and for Create and Insert also what they convert.
@@ -1177,3 +1209,28 @@ mod stem_tests {
         out
     }
 }
+
+#[cfg(all(test, not(target_arch = "wasm32")))]
+mod font_scan_tests {
+    #[test]
+    fn completed_and_failed_font_scans_can_be_reloaded_without_duplicate_workers() {
+        let mut cache = super::FontScanCache::default();
+        assert!(cache.begin(false));
+        assert!(!cache.begin(true), "a reload during discovery must not start another worker");
+        cache.finish(Vec::new());
+        assert!(!cache.begin(false), "reuse a finished scan until explicitly reloaded");
+        assert!(cache.begin(true), "an empty or failed scan can be retried");
+        cache.finish(vec![pdfcraft_engine::text_fonts::FontFile {
+            path: "installed.ttf".into(),
+            family: "Installed".into(),
+            face: "Installed".into(),
+        }]);
+        assert!(cache.begin(true), "a populated scan can discover newly installed fonts");
+        assert!(cache.files.is_none());
+    }
+
+    #[test]
+    fn a_panicking_font_scan_finishes_with_an_empty_list() {
+        assert!(super::discover_fonts_safely(|| panic!("synthetic font scan failure")).is_empty());
+    }
+}
diff --git a/crates/ui-egui/src/workflows/js_ui.rs b/crates/ui-egui/src/workflows/js_ui.rs
index b8f5d51cc6..c19ffcb66a 100644
--- a/crates/ui-egui/src/workflows/js_ui.rs
+++ b/crates/ui-egui/src/workflows/js_ui.rs
@@ -316,414 +316,10 @@ pub(crate) fn document_js_body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tok
     close
 }
 
-/// The height the Preferences dialog keeps below its scrolling settings for the OK row: the
-/// button, and the space above it.
-pub(crate) const PREFERENCES_BUTTON_ROW: f32 = 52.0;
-
-/// The least height the scrolling settings are given. The dialog around them takes about 80 more,
-/// so this still fits the smallest window (520 pt) at the largest interface size (300%, which
-/// leaves 173 pt): a taller floor would push OK off the screen again.
-pub(crate) const PREFERENCES_MIN_SCROLL: f32 = 60.0;
-
-/// Whether the interface can draw a language picker's native name. On the web the browser's glyph
-/// rasterizer draws scripts no embedded face has, so the native names stay; on native, ask the
-/// fonts this build installed (including an installed fallback face, unless system fonts are off).
-fn picker_text_is_drawable(ui: &egui::Ui, text: &str) -> bool {
-    #[cfg(target_arch = "wasm32")]
-    {
-        let _ = (ui, text);
-        true
-    }
-    #[cfg(not(target_arch = "wasm32"))]
-    {
-        ui.fonts_mut(|fonts| fonts.has_glyphs(&egui::FontId::proportional(13.0), text))
-    }
-}
-
-/// The date picker's displayed name. Its languages are the interface languages, so it uses the
-/// same drawable-name fallback: a native name whose script this build has no face for would
-/// otherwise abort under egui 0.37's `MissingGlyphPolicy::Panic` (for example Hindi without a
-/// Devanagari face and installed system fonts turned off).
-fn date_language_picker_name(l: &pdfcraft_engine::dates::DateLanguage, drawable: impl FnOnce(&str) -> bool) -> &'static str {
-    match crate::i18n::Lang::from_code(l.code) {
-        Some(language) => language.picker_name(drawable),
-        None => l.name,
-    }
-}
-
-/// Preferences: interface language and size, appearance, identity and JavaScript. Drawn in a scroll
-/// area; [`preferences_buttons`] goes below it, outside the scroll, so OK is always in reach.
-pub(crate) fn preferences_body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) {
-    ui.label(egui::RichText::new(tl!("Preferences")).font(theme::semibold(18.0)));
-    ui.horizontal(|ui| {
-        let label = ui.label(tl!("Interface language"));
-        // A native name is only drawn when these fonts can draw it; otherwise the English name
-        // keeps the list readable instead of aborting on a missing glyph (for example Hindi
-        // without a Devanagari face, and installed system fonts turned off).
-        let (selected, picker) = {
-            let drawable = |text: &str| picker_text_is_drawable(ui, text);
-            let selected = crate::i18n::Lang::from_code(&app.language)
-                .map_or_else(|| tl!("Auto").to_owned(), |language| language.picker_name(drawable).to_owned());
-            let picker = crate::i18n::Lang::for_picker_by(|language| language.picker_name(drawable))
-                .into_iter()
-                .map(|language| (language, language.picker_name(drawable)))
-                .collect::<Vec<_>>();
-            (selected, picker)
-        };
-        let before = app.language.clone();
-        craft_ui::ComboBox::from_id_salt("interface-language")
-            .selected_text(selected)
-            .show_ui(ui, |ui| {
-                if ui.selectable_value(&mut app.language, crate::i18n::AUTO.to_string(), tl!("Auto")).clicked() {
-                    ui.close();
-                }
-                for (language, name) in &picker {
-                    if ui.selectable_value(&mut app.language, language.code().to_string(), *name).clicked() {
-                        ui.close();
-                    }
-                }
-            })
-            .response
-            .labelled_by(label.id);
-        // Relabel the rest of this dialog in the new language right away, not next frame.
-        if app.language != before {
-            crate::i18n::set_current(crate::i18n::Lang::from_pref(&app.language));
-        }
-    });
-    ui.horizontal(|ui| {
-        use crate::ui_scale;
-        let label = ui.label(tl!("Interface size"));
-        // Auto shows the size it draws at: the display's scale times the system's text scale.
-        let native = ui.ctx().native_pixels_per_point().unwrap_or(1.0);
-        let auto_percent = ui_scale::percent(ui_scale::drawn(None, app.system_text_scale, native));
-        let auto = crate::i18n::fmt(tl!("Auto ({percent}%)"), &[("percent", &auto_percent.to_string())]);
-        let selected = app.ui_scale.map_or_else(|| auto.clone(), |f| format!("{}%", ui_scale::percent(f)));
-        craft_ui::ComboBox::from_id_salt("interface-size")
-            .selected_text(selected)
-            .show_ui(ui, |ui| {
-                if ui.selectable_value(&mut app.ui_scale, None, auto).clicked() {
-                    ui.close();
-                }
-                for p in ui_scale::PRESETS {
-                    let factor = f32::from(p) / 100.0;
-                    if ui.selectable_label(app.ui_scale.is_some_and(|f| ui_scale::percent(f) == u32::from(p)), format!("{p}%")).clicked() {
-                        app.ui_scale = Some(factor);
-                        ui.close();
-                    }
-                }
-            })
-            .response
-            .labelled_by(label.id);
-    });
-    ui.label(
-        egui::RichText::new(tl!("Auto follows the system's text size. Pages always render at the display's full resolution."))
-            .small()
-            .color(t.text_muted),
-    );
-    ui.horizontal(|ui| {
-        ui.label(tl!("Tools panel side"));
-        let right = app.side_panels.tools_on_right();
-        if ui.selectable_label(!right, tl!("Left")).clicked() {
-            app.side_panels.tools_side = crate::side_panels::ToolsSide::Left;
-        }
-        if ui.selectable_label(right, tl!("Right")).clicked() {
-            app.side_panels.tools_side = crate::side_panels::ToolsSide::Right;
-        }
-    });
-    ui.add_space(8.0);
-    crate::appearance::preferences_section(ui, app, t);
-    ui.add_space(8.0);
-    reading_colours_section(ui, app, t);
-    ui.add_space(8.0);
-    ui.label(egui::RichText::new(tl!("Documents and view")).font(theme::semibold(13.0)));
-    ui.horizontal(|ui| {
-        ui.label(tl!("Default workspace mode"));
-        for (mode, label) in [
-            (crate::Mode::AllTools, "All tools"),
-            (crate::Mode::Read, "Read"),
-            (crate::Mode::Edit, "Edit"),
-            (crate::Mode::Convert, "Convert"),
-            (crate::Mode::Sign, "E-Sign"),
-        ] {
-            widgets::radio_value(ui, &mut app.default_mode, mode, tl!(label));
-        }
-    });
-    ui.label(
-        egui::RichText::new(tl!("Used when opening PDFs. An explicit launch or control mode takes precedence for the session."))
-            .small()
-            .color(t.text_muted),
-    );
-    let defaults = &mut app.view_defaults;
-    ui.horizontal(|ui| {
-        ui.label(tl!("Default page display"));
-        for l in crate::canvas::PageLayout::ORDER {
-            widgets::radio_value(ui, &mut defaults.layout, l, tl!(l.label()));
-        }
-        ui.add(widgets::checkbox(&mut defaults.continuous, tl!("Continuous scrolling")));
-    });
-    ui.add(widgets::checkbox(&mut defaults.show_page_gaps, tl!("Show gaps between pages")));
-    ui.label(egui::RichText::new(tl!("Hide gaps to join page edges. Margins inside the PDF remain unchanged.")).small().color(t.text_muted));
-    ui.horizontal(|ui| {
-        use crate::canvas::Fit;
-        ui.label(tl!("Default zoom"));
-        widgets::radio_value(ui, &mut defaults.fit, Fit::Width, tl!("Fit to width"));
-        widgets::radio_value(ui, &mut defaults.fit, Fit::Page, tl!("Zoom to page level"));
-        widgets::radio_value(ui, &mut defaults.fit, Fit::None, tl!("Custom"));
-        // Editing the percentage selects Custom.
-        let mut percent = defaults.zoom * 100.0;
-        if ui.add(egui::DragValue::new(&mut percent).range(8.0..=6400.0).max_decimals(0).suffix("%")).changed() {
-            (defaults.fit, defaults.zoom) = (Fit::None, percent / 100.0);
-        }
-    });
-    ui.label(
-        egui::RichText::new(tl!("Used when a PDF doesn't ask for a layout or zoom. Continuous scrolling never snaps between pages."))
-            .small()
-            .color(t.text_muted),
-    );
-    ui.add(widgets::checkbox(&mut app.always_default_view, tl!("Always use my default zoom and page layout")));
-    ui.horizontal(|ui| {
-        ui.label(tl!("Units"));
-        for u in crate::units::Unit::ALL {
-            widgets::radio_value(ui, &mut app.units, u, u.label());
-        }
-    });
-    ui.label(egui::RichText::new(tl!("For page sizes and margins.")).small().color(t.text_muted));
-    // The web build has no file paths to reopen.
-    #[cfg(not(target_arch = "wasm32"))]
-    ui.add(widgets::checkbox(&mut app.reopen_last_session, tl!("Reopen the files that were open when PdfCraft last closed")));
-    // Acrobat's "Restore last view settings when reopening documents" (#1767).
-    #[cfg(not(target_arch = "wasm32"))]
-    ui.add(widgets::checkbox(&mut app.restore_last_view, tl!("Restore the last view (page, zoom and page display) when a document is opened again")));
-    // The web build has no files on disk to watch.
-    #[cfg(not(target_arch = "wasm32"))]
-    ui.add(widgets::checkbox(&mut app.reload_changed_files, tl!("Reload documents when their files change on disk")));
-    // The notice's "Don't show again" turns this off (#4035); the restrictions stay either way.
-    ui.add(widgets::checkbox(&mut app.show_secured_notice, tl!("Show a notice when a document is secured")));
-    ui.horizontal(|ui| {
-        ui.label(tl!("Scroll speed (mouse wheel and arrow keys)"));
-        for speed in crate::scroll_speed::ScrollSpeed::ALL {
-            widgets::radio_value(ui, &mut app.scroll_speed, speed, tl_ctx!("scroll speed", speed.label()));
-        }
-    });
-    // Whether anything animates, the wheel's scrolling and zooming included; left alone it
-    // follows the system's animation setting.
-    ui.horizontal(|ui| {
-        ui.label(tl!("Animation effects"));
-        for choice in crate::motion::AnimationEffects::ALL {
-            widgets::radio_value(ui, &mut app.animation_effects, choice, tl_ctx!("animation effects", choice.label()));
-        }
-    });
-    // Only where the app draws the title bar (GNOME on Wayland); elsewhere the desktop draws it.
-    if app.window_controls.is_some() {
-        ui.add(widgets::checkbox(&mut app.system_title_bar, tl!("Use system title bar")))
-            .on_hover_text(tl!("Show a basic title bar for the window buttons instead of the tab strip. GNOME doesn't draw title bars for apps, so this one doesn't follow its theme."));
-    }
-    ui.add_space(8.0);
-    // Identity: the author of new comments (Acrobat: Preferences ▸ Identity).
-    ui.label(egui::RichText::new(tl!("Identity")).font(theme::semibold(13.0)));
-    ui.horizontal(|ui| {
-        let label = ui.label(tl!("Name on new comments"));
-        ui.add(crate::widgets::line(&mut app.comment_prefs.author).desired_width(220.0).char_limit(crate::MAX_AUTHOR_CHARS)).labelled_by(label.id);
-    });
-    ui.add(widgets::checkbox(&mut app.comment_prefs.hide_empty_highlight_hover, tl!("Hide hover previews for highlights without comment text")));
-    ui.add_space(8.0);
-    ui.label(egui::RichText::new(tl!("Fill & Sign")).font(theme::semibold(13.0)));
-    ui.add(widgets::checkbox(&mut app.flatten_fill_sign_on_save, tl!("Flatten Fill & Sign when saving")));
-    ui.label(
-        egui::RichText::new(tl!("Text, marks and signatures become part of the page. Other comments stay editable.")).small().color(t.text_muted),
-    );
-    ui.add_space(8.0);
-    date_format(ui, app, t);
-    ui.add_space(8.0);
-    ui.label(egui::RichText::new("JavaScript").font(theme::semibold(13.0)));
-    egui::Frame::new().fill(t.hover).corner_radius(egui::CornerRadius::same(6)).inner_margin(egui::Margin::same(10)).show(ui, |ui| {
-        ui.set_width(ui.available_width());
-        let mut on = app.session.javascript();
-        if ui.add(widgets::checkbox(&mut on, tl!("Enable Acrobat JavaScript"))).changed() {
-            app.session.set_javascript(on);
-        }
-        ui.label(
-            egui::RichText::new(tl!("Scripts run in a sandbox without file or network access. A script that asks to open a web page needs your permission first. With JavaScript off, Acrobat's standard format, validate and calculate functions still work."))
-                .small()
-                .color(t.text_muted),
-        );
-    });
-}
-
-/// The Preferences dialog's OK row. Returns `true` to close.
-pub(crate) fn preferences_buttons(ui: &mut egui::Ui) -> bool {
-    ui.add_space(10.0);
-    buttons(ui, tl!("OK"), &[]).is_some()
-}
-
-/// Preferences ▸ Date format: a preset, or any pattern typed in, for Fill & Sign dates, and the
-/// language of its month and weekday names. A valid pattern applies as it's typed; an invalid
-/// one stays in the box with the reason, and the last valid one stays in use.
-fn date_format(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) {
-    use pdfcraft_engine::dates::{DATE_FORMATS, DATE_LANGUAGES, MAX_DATE_FORMAT_CHARS};
-    ui.label(egui::RichText::new(tl!("Date format")).font(theme::semibold(13.0)));
-    let sample = |app: &PdfCraftApp, f: &str| format!("{}   {f}", app.date_text(Some(f)).unwrap_or_default());
-    ui.horizontal(|ui| {
-        let label = ui.label(tl!("Fill & Sign dates"));
-        let current = app.session.date_format().to_string();
-        let selected = if DATE_FORMATS.contains(&current.as_str()) { sample(app, &current) } else { tl!("Custom").to_string() };
-        craft_ui::ComboBox::from_id_salt("date-format")
-            .selected_text(selected)
-            .width(240.0)
-            .show_ui(ui, |ui| {
-                for f in DATE_FORMATS {
-                    if ui.selectable_label(current == f, sample(app, f)).clicked() && app.session.set_date_format(f).is_ok() {
-                        app.date_format_draft = None;
-                        ui.close();
-                    }
-                }
-            })
-            .response
-            .labelled_by(label.id);
-    });
-    ui.horizontal(|ui| {
-        let label = ui.label(tl!("Pattern"));
-        let mut text = app.date_format_draft.clone().unwrap_or_else(|| app.session.date_format().to_string());
-        let edit = ui.add(egui::TextEdit::singleline(&mut text).desired_width(160.0).char_limit(MAX_DATE_FORMAT_CHARS)).labelled_by(label.id);
-        // The box keeps the text as typed (a trailing space included) while it has focus; the
-        // setting takes the trimmed pattern whenever it's valid.
-        if edit.changed() {
-            let _ = app.session.set_date_format(&text);
-            app.date_format_draft = Some(text.clone());
-        }
-        if !edit.has_focus() && pdfcraft_engine::dates::check_date_format(&text).is_ok() {
-            app.date_format_draft = None;
-        }
-        match app.date_text(Some(&text)) {
-            Ok(today) => ui.label(egui::RichText::new(crate::i18n::fmt(tl!("Today: {date}"), &[("date", &today)])).color(t.text_muted)),
-            // The engine's reason, in English.
-            Err(e) => ui.label(egui::RichText::new(e).color(egui::Color32::from_rgb(0xD1, 0x3B, 0x3B))),
-        };
-    });
-    // Fill & Sign refuses a date it would save as "?"; say so before anyone tries.
-    let bad = app.date_text(None).map(|today| pdfcraft_engine::dates::unwritable(&today)).unwrap_or_default();
-    if !bad.is_empty() {
-        ui.label(
-            egui::RichText::new(crate::i18n::fmt(
-                tl!(
-                    "{chars} can't be written into the PDF yet: Fill & Sign text is Western European only. Pick a numeric format such as dd.mm.yyyy."
-                ),
-                &[("chars", &bad)],
-            ))
-            .color(egui::Color32::from_rgb(0xD1, 0x3B, 0x3B)),
-        );
-    }
-    ui.horizontal(|ui| {
-        let label = ui.label(tl!("Language"));
-        // Build every label before the combo box mutably borrows `ui`, with the same drawable
-        // fallback the interface language picker uses.
-        let (follow, selected, current, names) = {
-            let drawable = |text: &str| picker_text_is_drawable(ui, text);
-            let interface = crate::i18n::current().picker_name(drawable);
-            let follow = crate::i18n::fmt(tl!("Same as interface ({language})"), &[("language", interface)]);
-            let current = app.session.date_language().map(str::to_string);
-            let selected = DATE_LANGUAGES
-                .iter()
-                .find(|l| current.as_deref() == Some(l.code))
-                .map_or_else(|| follow.clone(), |l| date_language_picker_name(l, drawable).to_string());
-            let names = DATE_LANGUAGES.iter().map(|l| (l, date_language_picker_name(l, drawable))).collect::<Vec<_>>();
-            (follow, selected, current, names)
-        };
-        craft_ui::ComboBox::from_id_salt("date-language")
-            .selected_text(selected)
-            .width(240.0)
-            .show_ui(ui, |ui| {
-                if ui.selectable_label(current.is_none(), follow).clicked() && app.session.set_date_language(None).is_ok() {
-                    ui.close();
-                }
-                for (l, name) in &names {
-                    if ui.selectable_label(current.as_deref() == Some(l.code), *name).clicked() && app.session.set_date_language(Some(l.code)).is_ok()
-                    {
-                        ui.close();
-                    }
-                }
-            })
-            .response
-            .labelled_by(label.id);
-    });
-    ui.label(
-        egui::RichText::new(crate::i18n::fmt(
-            tl!("yyyy or yy year · m or mm month · mmm or mmmm month name · d or dd day · ddd or dddd weekday. H, h, M, s and t are time letters and can't be used on their own: put {escape} before a letter to show it as is."),
-            &[("escape", "\\")],
-        ))
-        .small()
-        .color(t.text_muted),
-    );
-}
-
-fn reading_colours_section(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) {
-    // Reading colours (Acrobat: Replace Document Colors): solid text and line-art paints are
-    // remapped while rendering, and the page clears to the background colour. The preference
-    // is app-wide: every open document follows it, and documents open with it.
-    ui.label(egui::RichText::new(tl!("Reading colours")).font(theme::semibold(13.0)));
-    let mode = app.reading_colors.mode_name();
-    ui.horizontal_wrapped(|ui| {
-        for (name, label, colors) in [
-            ("off", "Off", pdfcraft_render::ReadingColors::default()),
-            ("black-on-white", "Black on white", pdfcraft_render::ReadingColors::BLACK_ON_WHITE),
-            ("white-on-black", "White on black", pdfcraft_render::ReadingColors::WHITE_ON_BLACK),
-            ("yellow-on-black", "Yellow on black", pdfcraft_render::ReadingColors::YELLOW_ON_BLACK),
-            ("green-on-black", "Green on black", pdfcraft_render::ReadingColors::GREEN_ON_BLACK),
-        ] {
-            let params = colors.params.unwrap_or(pdfcraft_render::ReadingParams {
-                text: [0, 0, 0],
-                background: [255, 255, 255],
-                only_black: false,
-                line_art: true,
-            });
-            ui.vertical(|ui| {
-                ui.set_width(104.0);
-                let sample = egui::RichText::new("Aa").size(22.0).color(egui::Color32::from_rgb(params.text[0], params.text[1], params.text[2]));
-                let button = egui::Button::new(sample)
-                    .fill(egui::Color32::from_rgb(params.background[0], params.background[1], params.background[2]))
-                    .min_size(egui::vec2(94.0, 44.0))
-                    .stroke(egui::Stroke::new(if mode == name { 2.0 } else { 1.0 }, if mode == name { t.accent } else { t.border }));
-                let response = ui.add(button);
-                response.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, mode == name, tl!(label)));
-                if response.clicked() {
-                    app.set_reading_colors(colors);
-                }
-                ui.label(tl!(label));
-            });
-        }
-    });
-    ui.add_space(8.0);
-    if let Some(params) = app.reading_colors.params {
-        let text = egui::Color32::from_rgb(params.text[0], params.text[1], params.text[2]);
-        let background = egui::Color32::from_rgb(params.background[0], params.background[1], params.background[2]);
-        egui::Frame::new().fill(background).inner_margin(16.0).show(ui, |ui| {
-            ui.set_min_width((ui.available_width() - 32.0).max(0.0));
-            ui.label(egui::RichText::new(tl!("Reading colours")).size(18.0).color(text));
-            ui.label(egui::RichText::new(tl!("Colours are remapped while rendering; the document itself never changes.")).color(text));
-        });
-    } else {
-        ui.label(tl!("Original"));
-    }
-    egui::CollapsingHeader::new(tl!("Custom")).default_open(mode == "custom").show(ui, |ui| {
-        let mut colors = if app.reading_colors.params.is_some() { app.reading_colors } else { pdfcraft_render::ReadingColors::BLACK_ON_WHITE };
-        let mut changed = false;
-        if let Some(params) = colors.params.as_mut() {
-            ui.horizontal(|ui| {
-                let text = ui.label(tl!("Text"));
-                changed |= ui.color_edit_button_srgb(&mut params.text).labelled_by(text.id).changed();
-                let background = ui.label(tl!("Page background"));
-                changed |= ui.color_edit_button_srgb(&mut params.background).labelled_by(background.id).changed();
-            });
-            changed |= ui.add(crate::widgets::checkbox(&mut params.only_black, tl!("Only change the colour of black text or line art"))).changed();
-            changed |= ui.add(crate::widgets::checkbox(&mut params.line_art, tl!("Change the colour of line art as well as text"))).changed();
-        }
-        if changed {
-            app.set_reading_colors(colors);
-        }
-    });
-    ui.label(egui::RichText::new(tl!("Colours are remapped while rendering; the document itself never changes.")).small().color(t.text_muted));
-    ui.add_space(8.0);
-}
+#[expect(unused_imports, reason = "re-exported for tests and backward compatibility")]
+pub(crate) use crate::dialogs::preferences::{
+    PREFERENCES_BUTTON_ROW, PREFERENCES_MIN_SCROLL, date_language_picker_name, preferences_body, preferences_buttons, preferences_header,
+};
 
 #[cfg(test)]
 mod tests {
diff --git a/crates/ui-egui/tests/it/comments.rs b/crates/ui-egui/tests/it/comments.rs
index 664f61733e..939de58dff 100644
--- a/crates/ui-egui/tests/it/comments.rs
+++ b/crates/ui-egui/tests/it/comments.rs
@@ -3022,3 +3022,360 @@ fn an_upright_comment_on_a_turned_page_is_drawn_where_it_goes_before_release() {
     h.drop_at(from + delta);
     h.run_steps(3);
 }
+
+/// `n` pages with one comment each, "Card 1" to "Card n".
+fn one_comment_per_page(n: usize) -> Vec<u8> {
+    let mut objs = vec!["<< /Type /Catalog /Pages 2 0 R >>".to_string()];
+    let kids: Vec<String> = (0..n).map(|i| format!("{} 0 R", 3 + 2 * i)).collect();
+    objs.push(format!("<< /Type /Pages /Kids [{}] /Count {n} /MediaBox [0 0 300 200] >>", kids.join(" ")));
+    for i in 0..n {
+        objs.push(format!("<< /Type /Page /Parent 2 0 R /Annots [{} 0 R] >>", 4 + 2 * i));
+        objs.push(format!("<< /Type /Annot /Subtype /Square /Rect [20 20 80 80] /C [1 0 0] /T (Ada) /Contents (Card {}) >>", i + 1));
+    }
+    let mut out = b"%PDF-1.7\n".to_vec();
+    for (i, o) in objs.iter().enumerate() {
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    out.extend_from_slice(b"trailer << /Root 1 0 R >>\n%%EOF\n");
+    out
+}
+
+/// #5488: the panel laid out every card on every frame, which put a few hundred comments over the
+/// frame budget. Cards out of view now only take up their height, and the selected one is still
+/// drawn wherever it is, so it can scroll into view.
+#[test]
+fn the_comments_panel_lays_out_only_the_cards_in_view() {
+    let mut h = harness_with_bytes(one_comment_per_page(120), |app| app.set_option("panel", "comments").unwrap());
+    h.run_steps(4);
+    let drawn = h.query_all_by_label_contains("Card ").count();
+    assert!((1..40).contains(&drawn), "{drawn} of 120 cards laid out");
+    h.state_mut().views[0].comments.selected = Some((100, 0));
+    h.state_mut().views[0].comments.reveal = true;
+    h.run_steps(4);
+    assert!(h.query_by_label("Card 101").is_some(), "the selected card is drawn and scrolled to");
+    assert!(h.query_by_label("Card 1").is_none(), "the top of the list scrolled out of view");
+}
+
+/// CodeRabbit on #5583: a card's measured height belongs to what it showed. Card 1, far above the
+/// cards in view, grows by two replies; the cards in view move down by its growth, not stay where
+/// card 1's old height would put them.
+#[test]
+fn a_card_out_of_view_that_grows_moves_the_cards_below_it() {
+    let mut h = harness_with_bytes(one_comment_per_page(120), |app| app.set_option("panel", "comments").unwrap());
+    h.run_steps(4);
+    h.state_mut().views[0].comments.selected = Some((60, 0));
+    h.state_mut().views[0].comments.reveal = true;
+    h.run_steps(4);
+    assert!(h.query_by_label("Card 1").is_none(), "card 1 is out of view");
+    let before = h.get_by_label("Card 61").rect().top();
+    for text in ["A first reply", "A second reply"] {
+        h.state_mut().apply_edit(pdfcraft_engine::Edit::ReplyToAnnotation { page: 0, index: 0, text: text.into(), author: "Bo".into() });
+    }
+    h.run_steps(4);
+    let after = h.get_by_label("Card 61").rect().top();
+    assert!(after > before + 40.0, "the cards below a grown card move down: {before} → {after}");
+}
+
+/// CodeRabbit on #5583: a card with an editor open on it is drawn wherever it is, so the cards
+/// below it make room for the editor rather than keep the card's height from before it opened.
+#[test]
+fn a_card_with_an_editor_open_out_of_view_is_drawn_at_its_size() {
+    let mut h = harness_with_bytes(one_comment_per_page(120), |app| app.set_option("panel", "comments").unwrap());
+    h.run_steps(4);
+    h.state_mut().views[0].comments.selected = Some((60, 0));
+    h.state_mut().views[0].comments.reveal = true;
+    h.run_steps(4);
+    assert!(h.query_by_label("Card 1").is_none(), "card 1 is out of view");
+    let before = h.get_by_label("Card 61").rect().top();
+    h.state_mut().views[0].comments.editing = Some((0, 0, "Card 1".into()));
+    h.run_steps(4);
+    let after = h.get_by_label("Card 61").rect().top();
+    assert!(after > before + 20.0, "the cards below make room for card 1's editor: {before} → {after}");
+}
+
+#[test]
+fn freehand_highlighter_draws_translucent_yellow_ink() {
+    let mut h = harness(|app| app.set_option("quick", "freehand_highlight").unwrap());
+    drag_pt(&mut h, (40.0, 100.0), (240.0, 100.0));
+
+    let c = comments(&h);
+    assert_eq!(c.len(), 1, "{c:?}");
+    assert_eq!(c[0].subtype, "Ink");
+    assert_eq!(c[0].intent.as_deref(), Some("FreehandHighlight"));
+    let props = h.state().session.get(h.state().views[0].id).unwrap().comment_props(0, c[0].index).expect("ink properties");
+    assert_eq!(props.color, Some([1.0, 0.94, 0.0]));
+    assert!((props.opacity - 0.35).abs() < 0.001);
+    assert_eq!(props.width, Some(14.0));
+    assert_eq!(h.state().quick_tool, QuickTool::Comment(pdfcraft_ui_egui::comments::CommentTool::FreehandHighlight));
+    h.state_mut().comment_prefs.set_width(pdfcraft_ui_egui::comments::CommentTool::FreehandHighlight, 100.0);
+    drag_pt(&mut h, (40.0, 160.0), (240.0, 160.0));
+    let c = comments(&h);
+    assert_eq!(c.len(), 2);
+    let props = h.state().session.get(h.state().views[0].id).unwrap().comment_props(0, c.iter().map(|a| a.index).max().unwrap()).unwrap();
+    assert_eq!(props.width, Some(100.0));
+    assert_eq!(h.state().views[0].comments.selected, None);
+}
+
+#[test]
+fn hotbar_picker_adds_and_runs_freehand_highlight() {
+    let mut h = harness(|_| {});
+    h.get_by_label("Hotbar settings").click();
+    h.run_steps(3);
+    field(&h, "Search all tools…").click();
+    h.run_steps(2);
+    field(&h, "Search all tools…").type_text("freehand");
+    h.run_steps(3);
+    h.get_by_role_and_label(Role::CheckBox, "Freehand-Highlight").click();
+    h.run_steps(3);
+    assert!(h.query_by_label("Close menu").is_some(), "picker stays open after adding a tool");
+    h.get_by_role_and_label(Role::CheckBox, "Draw freehand").click();
+    h.run_steps(3);
+    h.get_by_label("Close menu").click();
+    h.run_steps(3);
+    let saved: serde_json::Value = serde_json::from_str(&h.state().persist()).unwrap();
+    assert_eq!(saved["hotbar"]["tools"], serde_json::json!(["comment.freehand_highlight", "comment.ink"]));
+    h.state_mut().set_option("hotbar-side", "bottom").unwrap();
+    h.run_steps(3);
+    // The new tool is available directly from its custom shortcut.
+    h.query_all_by_role_and_label(Role::Button, "Freehand-Highlight").last().unwrap().click();
+    h.run_steps(3);
+    assert_eq!(h.state().quick_tool, QuickTool::Comment(pdfcraft_ui_egui::comments::CommentTool::FreehandHighlight));
+}
+
+#[test]
+fn hotbar_picker_searches_translated_tool_labels() {
+    let mut h = harness(|app| {
+        app.set_option("language", "fr").unwrap();
+    });
+    h.get_by_label("Hotbar settings").click();
+    h.run_steps(3);
+    field(&h, "Search all tools…").click();
+    h.run_steps(2);
+    field(&h, "Search all tools…").type_text("Dessiner");
+    h.run_steps(3);
+    h.get_by_role_and_label(Role::CheckBox, "Dessiner à main levée").click();
+    h.run_steps(3);
+    let saved: serde_json::Value = serde_json::from_str(&h.state().persist()).unwrap();
+    assert_eq!(saved["hotbar"]["tools"], serde_json::json!(["comment.ink"]));
+}
+
+#[test]
+fn hotbar_drag_moves_and_persists_position() {
+    let mut h = harness(|_| {});
+    let before: serde_json::Value = serde_json::from_str(&h.state().persist()).unwrap();
+    let from = h.get_by_label("Drag hotbar").rect().center();
+    drag(&mut h, from, from + egui::vec2(90.0, 90.0));
+    let after: serde_json::Value = serde_json::from_str(&h.state().persist()).unwrap();
+    assert_ne!(before["hotbar"]["position"], after["hotbar"]["position"]);
+    let mut restored = PdfCraftApp::new();
+    restored.restore(&h.state().persist());
+    let saved: serde_json::Value = serde_json::from_str(&restored.persist()).unwrap();
+    assert_eq!(saved["hotbar"], after["hotbar"]);
+}
+
+#[test]
+fn hotbar_vertical_size_and_docking() {
+    let mut h = harness(|app| {
+        app.set_option("hotbar-tools", "comment.ink,comment.freehand_highlight").unwrap();
+        app.set_option("hotbar-side", "right").unwrap();
+    });
+    for size in [24, 48, 64] {
+        h.state_mut().set_option("hotbar-size", &size.to_string()).unwrap();
+        h.run_steps(5);
+        let measured = h.ctx.data_mut(|d| d.get_temp::<egui::Vec2>(egui::Id::unique("custom-hotbar"))).unwrap();
+        assert!(measured.x <= size as f32 + 24.0, "vertical bar too wide: {measured:?}");
+        assert!(measured.x >= size as f32);
+    }
+    let from = h.get_by_label("Drag hotbar").rect().center();
+    drag(&mut h, from, from - egui::vec2(90.0, 90.0));
+    let saved: serde_json::Value = serde_json::from_str(&h.state().persist()).unwrap();
+    assert_eq!(saved["hotbar"]["position"], serde_json::json!([1.0, 0.5]));
+    assert_eq!(saved["hotbar"]["dock"], "right");
+    h.state_mut().set_option("hotbar-side", "float").unwrap();
+    h.run_steps(3);
+    let from = h.get_by_label("Drag hotbar").rect().center();
+    drag(&mut h, from, from - egui::vec2(90.0, 90.0));
+    let moved: serde_json::Value = serde_json::from_str(&h.state().persist()).unwrap();
+    assert_ne!(saved["hotbar"]["position"], moved["hotbar"]["position"]);
+}
+
+#[test]
+fn hotbar_settings_layout_and_side_controls_are_reachable_by_label() {
+    let mut h = harness(|_| {});
+    h.get_by_label("Hotbar settings").click();
+    h.run_steps(3);
+    fn vertical(h: &Harness<'static, PdfCraftApp>) -> serde_json::Value {
+        serde_json::from_str::<serde_json::Value>(&h.state().persist()).unwrap()["hotbar"]["vertical"].clone()
+    }
+    let before = vertical(&h);
+    h.get_by_role_and_label(Role::Switch, "Vertical layout").click();
+    h.run_steps(3);
+    assert_ne!(vertical(&h), before, "the layout switch toggles by its label");
+    h.get_by_role_and_label(Role::RadioButton, "Right").click();
+    h.run_steps(3);
+    let saved: serde_json::Value = serde_json::from_str(&h.state().persist()).unwrap();
+    assert_eq!(saved["hotbar"]["dock"], "right");
+    assert_eq!(saved["hotbar"]["vertical"], true, "docking at the side lays the bar out vertically");
+    h.get_by_role_and_label(Role::RadioButton, "Float").click();
+    h.run_steps(3);
+    let saved: serde_json::Value = serde_json::from_str(&h.state().persist()).unwrap();
+    assert!(saved["hotbar"]["dock"].is_null());
+}
+
+#[test]
+fn hotbar_settings_reopen_even_with_remembered_collapsed_state() {
+    let mut h = harness(|_| {});
+    let mut collapsed =
+        egui::collapsing_header::CollapsingState::load_with_default_open(&h.ctx, egui::Id::unique("hotbar-picker").with("collapsing"), false);
+    collapsed.set_open(false);
+    collapsed.store(&h.ctx);
+    h.get_by_label("Hotbar settings").click();
+    h.run_steps(5);
+    assert!(h.query_by_label("Close menu").is_some());
+    h.get_by_label("Hotbar settings").click();
+    h.run_steps(3);
+    assert!(h.query_by_label("Close menu").is_some(), "Hotbar settings always shows settings");
+    h.get_by_label("Close menu").click();
+    h.run_steps(3);
+    h.get_by_label("Hotbar settings").click();
+    h.run_steps(3);
+    assert!(h.query_by_label("Close menu").is_some());
+}
+
+#[test]
+fn hotbar_full_side_strip_spans_each_edge_and_returns_to_float() {
+    let mut h = harness(|app| {
+        app.set_option("hotbar-side", "right").unwrap();
+        app.set_option("hotbar-size", "48").unwrap();
+    });
+    h.get_by_label("Hotbar settings").click();
+    h.run_steps(5);
+    h.get_by_label("Full-side strip").click();
+    h.run_steps(3);
+    let enabled: serde_json::Value = serde_json::from_str(&h.state().persist()).unwrap();
+    assert_eq!(enabled["hotbar"]["full_side"], true, "settings checkbox enables strip");
+    h.get_by_label("Close menu").click();
+    for side in ["right", "left", "top", "bottom"] {
+        h.state_mut().set_option("hotbar-side", side).unwrap();
+        h.run_steps(5);
+        let size = h.ctx.data_mut(|d| d.get_temp::<egui::Vec2>(egui::Id::unique("custom-hotbar"))).unwrap();
+        let (length, thickness) = if matches!(side, "left" | "right") { (size.y, size.x) } else { (size.x, size.y) };
+        assert!(length > 300.0, "strip must fill the edge: {side} {size:?}");
+        assert!(thickness <= 64.0, "strip must stay narrow: {size:?}");
+        h.get_by_label("Hotbar settings");
+    }
+    let saved: serde_json::Value = serde_json::from_str(&h.state().persist()).unwrap();
+    assert_eq!(saved["hotbar"]["full_side"], true);
+    h.state_mut().set_option("hotbar-side", "float").unwrap();
+    h.run_steps(5);
+    let size = h.ctx.data_mut(|d| d.get_temp::<egui::Vec2>(egui::Id::unique("custom-hotbar"))).unwrap();
+    let (length, thickness) = if size.y > size.x { (size.y, size.x) } else { (size.x, size.y) };
+    assert!(thickness <= 64.0 && length < 550.0, "floating toolbar is compact: {size:?}");
+}
+
+#[test]
+fn hotbar_docked_left_does_not_override_quick_tools() {
+    let mut h = harness(|app| {
+        app.set_option("hotbar-side", "left").unwrap();
+    });
+    h.run_steps(5);
+    // Controls in the docked bar share one layout, so none may overlap (#5890).
+    let labels = ["Drag hotbar", "Select (V)", "Hand (H)", "Add a sticky note", "Highlight", "Draw", "Fill & Sign", "Hotbar settings"];
+    let rects: Vec<_> = labels.iter().map(|&label| h.get_by_label(label).rect()).collect();
+    for (i, a) in rects.iter().enumerate() {
+        for (j, b) in rects.iter().enumerate().skip(i + 1) {
+            let overlap = a.min.x < b.max.x && b.min.x < a.max.x && a.min.y < b.max.y && b.min.y < a.max.y;
+            assert!(!overlap, "{} overlaps {}: {a:?} / {b:?}", labels[i], labels[j]);
+        }
+    }
+}
+
+#[test]
+fn hotbar_docked_in_compact_window_keeps_settings_button_visible() {
+    for side in ["left", "right"] {
+        let mut h = Harness::builder().with_size(egui::vec2(800.0, 480.0)).build_eframe(move |_cc| {
+            let mut app = PdfCraftApp::new();
+            app.set_option("language", "en").unwrap();
+            app.open_bytes("text.pdf", None, TEXT_FIXTURE.to_vec()).expect("opens");
+            app.set_option("left", "closed").unwrap();
+            app.set_option("hotbar-side", side).unwrap();
+            app.set_option("hotbar-size", "48").unwrap();
+            app
+        });
+        h.run_steps(5);
+        let settings_rect = h.get_by_label("Hotbar settings").rect();
+        assert!(settings_rect.max.y <= 480.0, "{side} hotbar settings button must stay within window height: {settings_rect:?}");
+    }
+}
+
+#[test]
+fn hotbar_settings_menu_closes_on_click_outside() {
+    let mut h = harness(|app| {
+        app.open_bytes("text.pdf", None, TEXT_FIXTURE.to_vec()).expect("opens");
+    });
+    h.get_by_label("Hotbar settings").click();
+    h.run_steps(3);
+    assert!(h.query_by_label("Close menu").is_some());
+
+    // Clicking outside on the canvas dismisses the settings menu
+    h.event(egui::Event::PointerButton {
+        pos: egui::pos2(600.0, 300.0),
+        button: egui::PointerButton::Primary,
+        pressed: true,
+        modifiers: Default::default(),
+    });
+    h.event(egui::Event::PointerButton {
+        pos: egui::pos2(600.0, 300.0),
+        button: egui::PointerButton::Primary,
+        pressed: false,
+        modifiers: Default::default(),
+    });
+    h.run_steps(3);
+    assert!(h.query_by_label("Close menu").is_none(), "clicking outside closes the hotbar settings menu");
+
+    // Reopening and clicking another tool outside dismisses the menu and activates that tool
+    h.get_by_label("Hotbar settings").click();
+    h.run_steps(3);
+    assert!(h.query_by_label("Close menu").is_some());
+    h.get_by_label("Hand (H)").click();
+    h.run_steps(3);
+    assert!(h.query_by_label("Close menu").is_none());
+    assert_eq!(h.state().quick_tool, QuickTool::Hand);
+}
+
+#[test]
+fn hotbar_picker_in_narrow_viewport_fits_within_screen_width() {
+    let mut h = Harness::builder().with_size(egui::vec2(270.0, 480.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("text.pdf", None, TEXT_FIXTURE.to_vec()).expect("opens");
+        app
+    });
+    h.get_by_label("Hotbar settings").click();
+    h.run_steps(5);
+    let close_btn = h.get_by_label("Close menu");
+    assert!(close_btn.rect().max.x <= 270.0, "Close menu button must stay within viewport width: {:?}", close_btn.rect());
+}
+
+#[test]
+fn hotbar_floating_picker_does_not_overlap_rendered_bar() {
+    let mut h = Harness::builder().with_size(egui::vec2(1000.0, 600.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("text.pdf", None, TEXT_FIXTURE.to_vec()).expect("opens");
+        app
+    });
+    let settings_btn = h.get_by_label("Hotbar settings");
+    let settings_rect = settings_btn.rect();
+    settings_btn.click();
+    h.run_steps(5);
+
+    let picker_close = h.get_by_label("Close menu");
+    let picker_rect = picker_close.rect();
+    assert!(
+        picker_rect.min.x >= settings_rect.max.x || picker_rect.max.x <= settings_rect.min.x,
+        "picker ({:?}) must not overlap the settings button ({:?}) on the floating bar",
+        picker_rect,
+        settings_rect
+    );
+}
diff --git a/crates/ui-egui/tests/it/content.rs b/crates/ui-egui/tests/it/content.rs
index cb29ba99be..572bdf10f9 100644
--- a/crates/ui-egui/tests/it/content.rs
+++ b/crates/ui-egui/tests/it/content.rs
@@ -272,7 +272,8 @@ fn typing_moving_styling_and_deleting_added_content() {
 #[test]
 fn a_picture_on_the_clipboard_is_pasted_onto_the_page() {
     use pdfcraft_ui_egui::Clip;
-    let mut h = harness();
+    // Three frames between modifier releases represent a short real key gesture.
+    let mut h = harness_with_step_dt(1.0 / 60.0);
     let v = |pressed, modifiers| egui::Event::Key { key: egui::Key::V, physical_key: None, pressed, repeat: false, modifiers };
     let images = |h: &Harness<'static, PdfCraftApp>| added(h).iter().filter(|a| matches!(a.content, pdfcraft_engine::AddedContent::Image(_))).count();
     // Text on the clipboard: egui gets a Paste event instead of the press; nothing lands on the page.
@@ -288,9 +289,8 @@ fn a_picture_on_the_clipboard_is_pasted_onto_the_page() {
     h.event(v(false, egui::Modifiers::NONE));
     h.run_steps(3);
     assert_eq!(images(&h), 0, "a plain V doesn't paste");
-    // A picture alone: egui-winit sends no Paste event and swallows the press, so only the
-    // release of V arrives.
-    h.event(v(false, egui::Modifiers::COMMAND));
+    // The integration delivers image pixels and consumes the native shortcut keys.
+    h.event(egui::Event::PasteImage(std::sync::Arc::new(egui::ColorImage::filled([30, 20], egui::Color32::GRAY))));
     h.run_steps(3);
     let a = added(&h);
     assert_eq!(a.len(), 1);
@@ -301,14 +301,17 @@ fn a_picture_on_the_clipboard_is_pasted_onto_the_page() {
         let s = h.state();
         assert_eq!(s.session.get(s.views[0].id).unwrap().can_undo(), Some("Add image"));
     }
-    // Ctrl let go a moment before V: the release comes without the modifier, and still pastes.
+    // Modifier release order does not change delivery of the next image paste.
+    h.event(egui::Event::ModifiersChanged(egui::Modifiers::COMMAND));
+    h.event(egui::Event::ModifiersChanged(egui::Modifiers::NONE));
+    h.event(egui::Event::PasteImage(std::sync::Arc::new(egui::ColorImage::filled([30, 20], egui::Color32::GRAY))));
     h.event(v(false, egui::Modifiers::NONE));
     h.run_steps(3);
     assert_eq!(images(&h), 2, "Ctrl released first");
     // A text field with the keyboard keeps ⌘V for itself.
     assert!(h.state_mut().execute("edit.find"));
     h.run_steps(3);
-    h.event(v(false, egui::Modifiers::COMMAND));
+    h.event(egui::Event::PasteImage(std::sync::Arc::new(egui::ColorImage::filled([30, 20], egui::Color32::GRAY))));
     h.run_steps(3);
     assert_eq!(images(&h), 2, "the Find field has the keyboard");
     h.key_press(egui::Key::Escape);
@@ -317,7 +320,7 @@ fn a_picture_on_the_clipboard_is_pasted_onto_the_page() {
     assert!(h.state_mut().execute("page.organize"));
     h.run_steps(4);
     assert!(h.state().views[0].organize);
-    h.event(v(false, egui::Modifiers::COMMAND));
+    h.event(egui::Event::PasteImage(std::sync::Arc::new(egui::ColorImage::filled([30, 20], egui::Color32::GRAY))));
     h.run_steps(3);
     assert_eq!(images(&h), 2, "Organize Pages pastes pages");
     h.state_mut().views[0].organize = false;
@@ -326,7 +329,7 @@ fn a_picture_on_the_clipboard_is_pasted_onto_the_page() {
     assert!(h.state_mut().execute("form.prepare"));
     h.run_steps(3);
     assert!(h.state().is_preparing());
-    h.event(v(false, egui::Modifiers::COMMAND));
+    h.event(egui::Event::PasteImage(std::sync::Arc::new(egui::ColorImage::filled([30, 20], egui::Color32::GRAY))));
     h.run_steps(3);
     assert_eq!(images(&h), 2, "Prepare Form pastes fields");
 }
@@ -721,6 +724,68 @@ fn format_text_rows_line_up_and_fit_the_panel() {
     }
 }
 
+/// The Tools pane can't be dragged narrower than Format text needs: at its smallest width no
+/// control reaches past the font list, which spans the panel.
+#[test]
+fn format_text_fits_the_tools_pane_at_its_narrowest() {
+    use egui::accesskit::Role;
+    let mut h = harness();
+    // At the largest interface size too: it scales points to pixels, and the layout is in points.
+    h.state_mut().set_option("ui-scale", "300").unwrap();
+    h.state_mut().side_panels.tools_width = 0.0;
+    assert!(h.state_mut().execute("edit.text"));
+    h.run_steps(3);
+    let font = h.query_all_by_role(Role::ComboBox).find(|n| n.value().as_deref() == Some("Helvetica")).map(|n| n.rect()).expect("the font list");
+    let rects = ["Alignment", "Colour", "Font size", "Character spacing", "Horizontal scale", "Line spacing", "Paragraph spacing"]
+        .into_iter()
+        .flat_map(|l| h.query_all_by_label(l).map(move |n| (l, n.rect())))
+        .chain(h.query_all_by_role(Role::ComboBox).map(|n| ("list", n.rect())))
+        .collect::<Vec<_>>();
+    for (label, r) in rects {
+        assert!(r.right() <= font.right() + 0.5, "{label} {r:?} reaches past the font list ({font:?})");
+    }
+    // The font list ends where the pane's own content does: the header's Close button is its right edge.
+    let close = h.get_by_label("Close panel").rect();
+    assert!((font.right() - close.right()).abs() < 1.5, "the font list {font:?} is not at the pane's content edge ({close:?})");
+    // The rows below scroll, and the scrollbar floats over their right edge: they stop short of it.
+    let image = h.get_by_label("Image").rect();
+    assert!(image.right() <= font.right() - 17.0, "the Image row {image:?} runs under the scrollbar ({font:?})");
+    // The right-hand column ends where the font list does, as the left one starts where it does.
+    for label in ["Paragraph spacing", "Character spacing"] {
+        let right = h.query_all_by_label(label).map(|n| n.rect().right()).fold(f32::MIN, f32::max);
+        assert!((right - font.right()).abs() < 1.5, "{label} ends at {right}, the font list at {}", font.right());
+    }
+}
+
+/// The lists and the size row in Format text fit the narrowest Tools pane in every interface
+/// language: "Auto" in the line spacing list and "Mixed" in the size field are translated, and in
+/// Czech or French they are much longer. The font list spans the pane, so nothing may end past it.
+#[test]
+fn format_text_lists_fit_the_narrowest_tools_pane_in_every_language() {
+    use egui::accesskit::Role;
+    for lang in pdfcraft_ui_egui::i18n::Lang::all() {
+        let mut h = harness();
+        // A script with no face on this machine (Lao without system fonts) can't be drawn at all.
+        if !h.ctx.fonts_mut(|f| f.has_glyphs(&egui::FontId::proportional(13.0), lang.name())) {
+            continue;
+        }
+        h.state_mut().set_option("language", lang.code()).unwrap();
+        h.state_mut().side_panels.tools_width = 0.0;
+        assert!(h.state_mut().execute("edit.text"));
+        h.run_steps(3);
+        let lists: Vec<egui::Rect> = h.query_all_by_role(Role::ComboBox).map(|n| n.rect()).collect();
+        // Found by its value (a font name, never translated), not as the widest list: an overrun
+        // could make another list the widest.
+        let font = h.query_all_by_role(Role::ComboBox).find(|n| n.value().as_deref() == Some("Helvetica")).map(|n| n.rect()).expect("the font list");
+        for r in &lists {
+            assert!(r.right() <= font.right() + 0.5, "{}: {r:?} reaches past the font list ({font:?})", lang.code());
+        }
+        // The size row too: its field reserves room for a translated "Mixed".
+        let align = h.get_by_label(pdfcraft_ui_egui::i18n::t("Alignment")).rect();
+        assert!(align.right() <= font.right() + 0.5, "{}: Alignment {align:?} reaches past the font list ({font:?})", lang.code());
+    }
+}
+
 #[test]
 fn format_text_panel_sets_alignment_and_lists_planned_controls_disabled() {
     use egui_kittest::kittest::NodeT;
@@ -1425,3 +1490,23 @@ fn typing_in_one_tab_never_reaches_another_tabs_added_text() {
     h.run_steps(3);
     assert_eq!(h.state().views[1].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed"), "the other tab's typing stays out");
 }
+
+/// The rail's page and zoom fields are the same size, and each sits wholly inside the rail, so
+/// neither box is cut off at the edge (the page box lost its right side once the rail's contents
+/// changed width).
+#[test]
+fn rail_page_and_zoom_fields_match_and_fit_the_rail() {
+    let mut h = harness();
+    h.run_steps(3);
+    // The rail is 49 pt wide at the window's right edge (1400 pt wide), inside a 1 pt border.
+    let (rail_left, rail_right) = (1400.0 - 49.0 + 1.0, 1400.0 - 1.0);
+    let rail = h.get_by_label("Bookmarks").rect();
+    let (page, zoom) = (h.get_by_label("Current page").rect(), h.get_by_label("Zoom").rect());
+    assert_eq!((page.width(), page.height()), (zoom.width(), zoom.height()), "{page:?} vs {zoom:?}");
+    // The size `RAIL_FIELD_SIZE` sets: wide enough for "6400%", the largest zoom.
+    assert_eq!((page.width(), page.height()), (42.0, 22.0), "{page:?}");
+    for r in [page, zoom] {
+        assert!(r.left() >= rail_left && r.right() <= rail_right, "{r:?} is cut off by the rail ({rail_left}..{rail_right})");
+        assert!((r.center().x - rail.center().x).abs() < 1.0, "{r:?} is off the rail's centre ({rail:?})");
+    }
+}
diff --git a/crates/ui-egui/tests/it/control.rs b/crates/ui-egui/tests/it/control.rs
index e1a7e1f1db..c1465b233d 100644
--- a/crates/ui-egui/tests/it/control.rs
+++ b/crates/ui-egui/tests/it/control.rs
@@ -140,6 +140,25 @@ fn thumbnail_size_is_settable_and_inspectable_through_the_control_channel() {
     assert!(ok(&mut h, &c, "ui.state", json!({}))["active"]["thumbnail_zoom"].as_f64().unwrap() > 0.75);
 }
 
+#[test]
+fn page_shadows_are_an_observable_app_wide_preference() {
+    let (mut h, c) = harness();
+    assert_eq!(ok(&mut h, &c, "ui.state", json!({}))["show_page_edge_shadows"], true);
+    for value in ["false", "true"] {
+        ok(&mut h, &c, "ui.set", json!({ "key": "show_page_edge_shadows", "value": value }));
+        assert_eq!(ok(&mut h, &c, "ui.state", json!({}))["show_page_edge_shadows"], value == "true");
+    }
+    for value in ["off", "1", "False", ""] {
+        assert!(call(&mut h, &c, "ui.set", json!({ "key": "show_page_edge_shadows", "value": value })).is_err());
+        assert_eq!(ok(&mut h, &c, "ui.state", json!({}))["show_page_edge_shadows"], true);
+    }
+    ok(&mut h, &c, "ui.set", json!({ "key": "show_page_edge_shadows", "value": false }));
+    assert_eq!(ok(&mut h, &c, "ui.state", json!({}))["show_page_edge_shadows"], false);
+    h.state_mut().active = None;
+    ok(&mut h, &c, "ui.set", json!({ "key": "show_page_edge_shadows", "value": "false" }));
+    assert_eq!(ok(&mut h, &c, "ui.state", json!({}))["show_page_edge_shadows"], false);
+}
+
 #[test]
 fn control_resize_reports_observed_dimensions_and_rejects_invalid_sizes() {
     let (mut h, c) = harness();
@@ -897,6 +916,25 @@ fn middle_button_pans_while_held_outside_linux() {
     assert!(!h.state().session.get(h.state().views[0].id).unwrap().dirty);
 }
 
+/// With Invert middle-button drag on, a held middle drag moves the view the way the pointer goes.
+#[cfg(not(target_os = "linux"))]
+#[test]
+fn inverted_middle_drag_moves_the_view_the_way_the_pointer_goes() {
+    let (mut h, c) = harness();
+    h.state_mut().set_option("zoom", "400").unwrap();
+    ok(&mut h, &c, "ui.set", json!({ "key": "invert_middle_drag", "value": "true" }));
+    h.run_steps(3);
+    h.state_mut().views[0].go_to_page(1);
+    h.run_steps(2);
+    let p = h.state().views[0].viewport_rect().center();
+    let top = h.state().views[0].page_screen_rect(1).unwrap().top();
+    ok(&mut h, &c, "ui.drag", json!({ "from": [p.x, p.y], "to": [p.x, p.y - 60.0], "steps": 12, "button": "middle" }));
+    h.run_steps(2);
+    let moved = h.state().views[0].page_screen_rect(1).unwrap().top();
+    assert!((moved - (top + 60.0)).abs() < 1.0, "dragging up scrolls up, so the page moves down: {top} -> {moved}");
+    assert!(!h.state().session.get(h.state().views[0].id).unwrap().dirty);
+}
+
 #[test]
 fn state_and_view_options() {
     let (mut h, c) = harness();
@@ -2070,3 +2108,43 @@ fn routine_continuous_scrolling_does_not_add_navigation_history() {
     assert!(h.state().views[0].back.is_empty());
     assert!(h.state().views[0].forward.is_empty());
 }
+
+#[test]
+fn accessible_labels_on_format_text_and_pin_dialog() {
+    let (mut h, c) = harness();
+
+    // 1. Check Dialog::PinTool accessibility labels
+    h.state_mut().dialog = Some(pdfcraft_ui_egui::Dialog::PinTool);
+    h.run_steps(3);
+
+    let search = ok(&mut h, &c, "ui.inspect", json!({"role": "TextInput", "query": "Search tools…"}));
+    assert!(search["count"].as_u64().unwrap() >= 1, "search box has accessible label: {search}");
+
+    let result_rows = ok(&mut h, &c, "ui.inspect", json!({"query": "Organize Pages"}));
+    assert!(result_rows["count"].as_u64().unwrap() >= 1, "result row has accessible label: {result_rows}");
+
+    let pin_toggles = ok(&mut h, &c, "ui.inspect", json!({"query": "Pin"}));
+    assert!(pin_toggles["count"].as_u64().unwrap() >= 1, "pin toggle has accessible label: {pin_toggles}");
+
+    h.state_mut().dialog = None;
+    h.run_steps(2);
+
+    // 2. Open Add Text so Format text panel is visible
+    ok(&mut h, &c, "ui.command", json!({"id": "edit.text"}));
+    h.run_steps(3);
+
+    let font_combo = ok(&mut h, &c, "ui.inspect", json!({"query": "Font", "role": "ComboBox"}));
+    assert!(font_combo["count"].as_u64().unwrap() >= 1, "format-font has accessible label: {font_combo}");
+
+    let size_combo = ok(&mut h, &c, "ui.inspect", json!({"query": "Font size"}));
+    assert!(size_combo["count"].as_u64().unwrap() >= 1, "format-size has accessible label: {size_combo}");
+
+    let line_spacing_combo = ok(&mut h, &c, "ui.inspect", json!({"query": "Line spacing", "role": "ComboBox"}));
+    assert!(line_spacing_combo["count"].as_u64().unwrap() >= 1, "format-line-spacing has accessible label: {line_spacing_combo}");
+
+    let scale_spin = ok(&mut h, &c, "ui.inspect", json!({"query": "Horizontal scale", "role": "SpinButton"}));
+    assert!(scale_spin["count"].as_u64().unwrap() >= 1, "horizontal scale spin button has accessible label: {scale_spin}");
+
+    let char_spin = ok(&mut h, &c, "ui.inspect", json!({"query": "Character spacing", "role": "SpinButton"}));
+    assert!(char_spin["count"].as_u64().unwrap() >= 1, "character spacing spin button has accessible label: {char_spin}");
+}
diff --git a/crates/ui-egui/tests/it/create.rs b/crates/ui-egui/tests/it/create.rs
index 1c9a757651..7260dd816b 100644
--- a/crates/ui-egui/tests/it/create.rs
+++ b/crates/ui-egui/tests/it/create.rs
@@ -380,3 +380,24 @@ fn multiple_files_past_a_thousand_are_all_used() {
     let doc = app.session.get(app.views[0].id).unwrap();
     assert_eq!(doc.info.pages.len(), 1001, "every picked file is used, in order");
 }
+
+/// Create ▸ Blank page uses the system region's paper, not always US Letter (#5644): the app
+/// starts with the system's, and a blank page is on A4 and on Letter as the paper says
+/// (CodeRabbit on #5651: a Letter host alone would not tell a hard-coded Letter apart).
+#[test]
+fn a_blank_page_is_on_the_system_regions_paper() {
+    use pdfcraft_ui_egui::paper::Paper;
+    assert_eq!(PdfCraftApp::new().blank_paper, Paper::system());
+    for paper in [Paper::A4, Paper::Letter] {
+        let mut app = PdfCraftApp::new();
+        app.blank_paper = paper;
+        assert!(app.execute("create.blank"));
+        let docs = app.session.docs();
+        let crop = docs.last().and_then(|d| d.info.pages.first()).map(|p| p.crop).unwrap();
+        let (w, h) = paper.points();
+        assert!(
+            ((crop[2] - crop[0]) as f64 - w).abs() < 0.01 && ((crop[3] - crop[1]) as f64 - h).abs() < 0.01,
+            "{paper:?}: {crop:?} is not {w} × {h}"
+        );
+    }
+}
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index bdb0720dde..c4231d0f69 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -2602,6 +2602,131 @@ fn encrypted(bytes: Vec<u8>, algorithm: pdfcraft_cos::Algorithm, user: &str, own
     pdfcraft_cos::write_full(&doc, &Default::default()).unwrap()
 }
 
+#[test]
+fn launch_display_override_survives_password_retry_without_changing_defaults() {
+    use pdfcraft_ui_egui::canvas::PageLayout;
+    use std::io::Write as _;
+    let nonce = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).unwrap().as_nanos();
+    let path = temp_path(&format!("startup-layout-{nonce}.pdf"));
+    let mut file = std::fs::OpenOptions::new().write(true).create_new(true).open(&path).unwrap();
+    file.write_all(&protected("reader", "owner", -4)).unwrap();
+    drop(file);
+    let mut app = PdfCraftApp::new();
+    app.set_option("default-layout", "continuous").unwrap();
+    app.open_path_with_display(path.to_str().unwrap(), PageLayout::TwoUp, false);
+    assert!(app.views.is_empty() && app.password_prompt.is_some());
+    app.submit_password(Some("wrong".into()));
+    assert!(app.views.is_empty() && app.password_prompt.is_some());
+    app.submit_password(Some("reader".into()));
+    assert_eq!(app.views.len(), 1);
+    assert_eq!(app.views[0].layout, PageLayout::TwoUp);
+    assert!(!app.views[0].continuous());
+    let persisted: serde_json::Value = serde_json::from_str(&app.persist()).unwrap();
+    assert_eq!(persisted["default_layout"], "continuous");
+    std::fs::remove_file(path).unwrap();
+}
+
+#[test]
+fn asynchronous_launch_display_override_survives_retries_and_cancel() {
+    asynchronous_launch_display(false);
+}
+
+#[test]
+fn asynchronous_launch_display_explicit_layout_survives_retries_and_cancel() {
+    asynchronous_launch_display(true);
+}
+
+fn asynchronous_launch_display(explicit: bool) {
+    use pdfcraft_ui_egui::canvas::PageLayout;
+    fn wait(h: &mut Harness<'static, PdfCraftApp>, stage: &str, ready: impl Fn(&PdfCraftApp) -> bool) {
+        let deadline = std::time::Instant::now() + std::time::Duration::from_secs(5);
+        while !ready(h.state()) {
+            assert!(
+                std::time::Instant::now() < deadline,
+                "{stage}: views={}, prompt={}, error={}, notice={}",
+                h.state().views.len(),
+                h.state().password_prompt.is_some(),
+                h.state().password_prompt.as_ref().is_some_and(|p| p.error.is_some()),
+                h.state().toast.is_some()
+            );
+            h.run_steps(2);
+            std::thread::sleep(std::time::Duration::from_millis(5));
+        }
+    }
+    let path = temp_path(&format!("async-startup-layout-{explicit}.pdf"));
+    std::fs::write(&path, protected("reader", "owner", -4)).unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.set_option("default-layout", "continuous").unwrap();
+        app.open_bytes("other.pdf", None, fixture(2)).unwrap();
+        app
+    });
+    h.run_steps(2);
+    assert!(!h.state().run_inline, "exercise upstream's actual background-opening path");
+    let other = h.state().views[0].id;
+    h.state_mut().open_path_with_display(path.to_str().unwrap(), PageLayout::TwoUp, false);
+    if explicit {
+        h.state_mut().set_launch_layout("single").unwrap();
+    }
+    wait(&mut h, "password prompt", |app| app.password_prompt.is_some());
+    // The existing document keeps its default view while this request is pending.
+    h.state_mut().submit_password(Some("wrong".into()));
+    wait(&mut h, "wrong-password result", |app| app.password_prompt.as_ref().is_some_and(|p| p.error.is_some()));
+    assert_eq!(h.state().views.len(), 1);
+    h.state_mut().submit_password(Some("reader".into()));
+    wait(&mut h, "first unlock", |app| app.views.len() == 2);
+    assert_eq!(h.state().views[0].id, other);
+    assert_eq!(h.state().views[0].layout, PageLayout::Single);
+    assert!(h.state().views[0].continuous());
+    assert_eq!(h.state().views[1].layout, if explicit { PageLayout::Single } else { PageLayout::TwoUp });
+    assert!(!h.state().views[1].continuous());
+    let second_path = path.with_extension("second.pdf");
+    std::fs::copy(&path, &second_path).unwrap();
+    h.state_mut().open_path_with_display(second_path.to_str().unwrap(), PageLayout::TwoUp, false);
+    wait(&mut h, "password prompt", |app| app.password_prompt.is_some());
+    h.state_mut().submit_password(None);
+    h.state_mut().open_path(second_path.to_str().unwrap());
+    wait(&mut h, "password prompt", |app| app.password_prompt.is_some());
+    h.state_mut().submit_password(Some("reader".into()));
+    wait(&mut h, "normal unlock after cancel", |app| app.views.len() == 3);
+    assert_eq!(h.state().views[2].layout, PageLayout::Single);
+    assert!(h.state().views[2].continuous());
+    let persisted: serde_json::Value = serde_json::from_str(&h.state().persist()).unwrap();
+    assert_eq!(persisted["default_layout"], "continuous");
+    std::fs::remove_file(path).unwrap();
+    std::fs::remove_file(second_path).unwrap();
+}
+
+#[test]
+fn canceling_launch_display_override_does_not_affect_later_documents() {
+    use pdfcraft_ui_egui::canvas::PageLayout;
+    use std::io::Write as _;
+    let nonce = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).unwrap().as_nanos();
+    let path = temp_path(&format!("startup-cancel-layout-{nonce}.pdf"));
+    let mut file = std::fs::OpenOptions::new().write(true).create_new(true).open(&path).unwrap();
+    file.write_all(&protected("reader", "owner", -4)).unwrap();
+    drop(file);
+    let mut app = PdfCraftApp::new();
+    app.set_option("default-layout", "continuous").unwrap();
+    app.open_path_with_display(path.to_str().unwrap(), PageLayout::TwoUp, false);
+    assert!(app.views.is_empty() && app.password_prompt.is_some());
+    app.submit_password(None);
+    assert!(app.views.is_empty() && app.password_prompt.is_none());
+    app.open_bytes("next.pdf", None, fixture(2)).unwrap();
+    assert_eq!(app.views[0].layout, PageLayout::Single);
+    assert!(app.views[0].continuous());
+    // Reopening the same protected file normally must not resurrect the canceled override.
+    app.open_path(path.to_str().unwrap());
+    app.submit_password(Some("reader".into()));
+    assert_eq!(app.views.len(), 2);
+    assert_eq!(app.views[1].layout, PageLayout::Single);
+    assert!(app.views[1].continuous());
+    let persisted: serde_json::Value = serde_json::from_str(&app.persist()).unwrap();
+    assert_eq!(persisted["default_layout"], "continuous");
+    std::fs::remove_file(path).unwrap();
+}
+
 #[test]
 fn password_prompt_opens_and_security_tab_reports_the_details() {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
@@ -3010,6 +3135,37 @@ fn extract_options_and_rotate_pages_dialog() {
     assert_eq!(d.info.pages.iter().map(|p| p.rotation).collect::<Vec<_>>(), [90, 0]);
 }
 
+/// #5579: typing the last page of Rotate Pages' range keeps what is typed (croquete1): "12" after
+/// a first page of 5 rotates pages 5–12, not page 5 alone. An end typed below the start and left
+/// by clicking OK is raised to the start as the field lets go: page 5, not nothing.
+#[test]
+fn rotate_pages_keeps_a_typed_last_page() {
+    use egui::accesskit::Role;
+    for (typed, rotated) in [("12", 5..13), ("3", 5..6)] {
+        let mut h = organize(20);
+        h.state_mut().run_command("page.rotate_dialog");
+        h.run_steps(2);
+        let d = &mut h.state_mut().rotate_draft;
+        (d.which, d.from, d.to) = (2, 5, 5);
+        h.run_steps(1);
+        h.get_by_role_and_label(Role::SpinButton, "to").click();
+        h.run_steps(2);
+        // As events, not `key_press`: its `run` checks the dialog's unnamed combo boxes.
+        h.event(egui::Event::Key { key: egui::Key::A, physical_key: None, pressed: true, repeat: false, modifiers: egui::Modifiers::COMMAND });
+        for c in typed.chars() {
+            h.event(egui::Event::Text(c.to_string()));
+            h.run_steps(2);
+        }
+        // OK at once, the end still being typed.
+        h.get_by_label("OK").click();
+        h.run_steps(3);
+        let s = h.state();
+        let d = s.session.get(s.views[0].id).unwrap();
+        let turned: Vec<usize> = d.info.pages.iter().enumerate().filter(|(_, p)| p.rotation != 0).map(|(i, _)| i + 1).collect();
+        assert_eq!(turned, rotated.collect::<Vec<usize>>(), "typed {typed:?}");
+    }
+}
+
 #[test]
 fn dragging_thumbnails_reorders_pages() {
     let mut h = organize(4);
@@ -4306,6 +4462,83 @@ fn dragging_the_rotate_knob_turns_a_page_image() {
     assert!((turned[2] - turned[0] - hh).abs() < 1.5 && (turned[3] - turned[1] - w).abs() < 1.5, "{before:?} -> {turned:?}");
 }
 
+#[test]
+fn dragging_rotate_knob_on_already_rotated_image_applies_delta_only() {
+    let mut png = Vec::new();
+    image::RgbImage::from_pixel(80, 40, image::Rgb([200, 40, 40])).write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("picture.png", None, png.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    let id = h.state().views[0].id;
+
+    // Center picture
+    let full = h.state().session.get(id).unwrap().page_images(0)[0].rect;
+    let (qw, qh) = ((full[2] - full[0]) / 4.0, (full[3] - full[1]) / 4.0);
+    let (mx, my) = ((full[0] + full[2]) / 2.0, (full[1] + full[3]) / 2.0);
+    h.state_mut().apply_edit(pdfcraft_engine::Edit::EditPageImage {
+        page: 0,
+        index: 0,
+        change: pdfcraft_engine::ImageEdit::Move([mx - qw, my - qh, mx + qw, my + qh]),
+    });
+    h.run_steps(4);
+
+    // Rotate the image by 45° clockwise initially
+    h.state_mut().apply_edit(pdfcraft_engine::Edit::EditPageImage { page: 0, index: 0, change: pdfcraft_engine::ImageEdit::RotateBy(45.0) });
+    h.run_steps(4);
+
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let c = r.center();
+
+    // Select the picture
+    h.hover_at(c);
+    h.run_steps(1);
+    h.drag_at(c);
+    h.run_steps(1);
+    h.drop_at(c);
+    h.run_steps(2);
+    assert!(h.state().views[0].image_selection.is_some(), "selected");
+
+    let initial_img = &h.state().session.get(id).unwrap().page_images(0)[0];
+    let initial_matrix = initial_img.matrix;
+    let xf = h.state().views[0].page_xform(0).expect("page 0 xform");
+    let doc_info = &h.state().session.get(id).unwrap().info;
+    let obb = pdfcraft_ui_egui::canvas::ImageObb::from_matrix(initial_matrix, &xf, doc_info, 0);
+    let knob = obb.s_rot;
+    let center = obb.screen_center;
+    let radius = (knob - center).length();
+
+    // Hover at the rotated knob position:
+    h.hover_at(knob);
+    h.run_steps(1);
+    assert_eq!(h.output().platform_output.cursor_icon, egui::CursorIcon::Grab, "knob offers Grab cursor on 45° rotated image");
+
+    // Rotate clockwise by a small delta of 15° (from 45° to 60°):
+    let to_angle = (45.0 + 15.0_f32).to_radians();
+    let to = center + egui::vec2(radius * to_angle.sin(), -radius * to_angle.cos());
+
+    h.drag_at(knob);
+    h.run_steps(1);
+    for k in 1..=4 {
+        h.hover_at(knob + (to - knob) * (k as f32 / 4.0));
+        h.run_steps(1);
+    }
+    assert_eq!(h.output().platform_output.cursor_icon, egui::CursorIcon::Grabbing);
+    h.drop_at(to);
+    h.run_steps(4);
+
+    let doc = h.state().session.get(id).unwrap();
+    let final_img = &doc.page_images(0)[0];
+    let angle_deg = (-final_img.matrix[1]).atan2(final_img.matrix[0]).to_degrees();
+    let angle_deg = (angle_deg % 360.0 + 360.0) % 360.0;
+    assert!((angle_deg - 60.0).abs() < 2.0, "expected ~60° total rotation, got {angle_deg}°");
+}
+
 #[test]
 fn editing_existing_form_artwork_on_the_page() {
     use pdfcraft_cos::{Dict, Document, Object, SaveOptions, Stream, write_incremental};
@@ -4372,6 +4605,284 @@ fn check_existing_artwork(name: &'static str, bytes: Vec<u8>) {
     assert!(h.state().session.get(id).unwrap().page_images(0).is_empty());
 }
 
+#[test]
+fn image_right_click_context_menu_items_and_actions() {
+    let mut png = Vec::new();
+    image::RgbImage::from_pixel(80, 40, image::Rgb([200, 40, 40])).write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("picture.png", None, png.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let c = r.center();
+    // Select image
+    h.hover_at(c);
+    h.run_steps(1);
+    h.drag_at(c);
+    h.run_steps(1);
+    h.drop_at(c);
+    h.run_steps(2);
+    assert!(h.state().views[0].image_selection.is_some(), "selected");
+
+    // Right-click image
+    h.hover_at(c);
+    h.run_steps(1);
+    h.event(egui::Event::PointerButton { pos: c, button: egui::PointerButton::Secondary, pressed: true, modifiers: Default::default() });
+    h.event(egui::Event::PointerButton { pos: c, button: egui::PointerButton::Secondary, pressed: false, modifiers: Default::default() });
+    h.run_steps(2);
+    assert!(h.state().views[0].image_selection.is_some());
+
+    for item in [
+        "Cut",
+        "Copy",
+        "Paste",
+        "Flip horizontal",
+        "Flip vertical",
+        "Arrange image",
+        "Replace image",
+        "Draw freehand",
+        "Redact Image",
+        "Create Link",
+        "Recognize Text",
+    ] {
+        h.get_by_label_contains(item);
+    }
+
+    // Top horizontal icon buttons
+    h.get_by_label("Rotate Counterclockwise");
+    h.get_by_label("Rotate Clockwise");
+    h.get_by_label("Delete");
+
+    // Flip horizontal via context menu item
+    h.get_by_label("Flip horizontal").click();
+    h.run_steps(3);
+    let id = h.state().views[0].id;
+    let doc = h.state().session.get(id).unwrap();
+    assert_eq!(doc.can_undo(), Some("Flip image"));
+
+    // Undo flip
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::Z);
+    h.run_steps(3);
+    let doc = h.state().session.get(id).unwrap();
+    assert_eq!(doc.can_undo(), None);
+}
+
+#[test]
+fn default_page_context_menu_when_not_in_edit_mode() {
+    let mut h = harness(1, |_| {});
+    h.run_steps(4);
+    assert_eq!(h.state().quick_tool, pdfcraft_ui_egui::QuickTool::Select);
+
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let c = r.center();
+    // Right click on page in Select mode
+    h.hover_at(c);
+    h.run_steps(1);
+    h.event(egui::Event::PointerButton { pos: c, button: egui::PointerButton::Secondary, pressed: true, modifiers: Default::default() });
+    h.event(egui::Event::PointerButton { pos: c, button: egui::PointerButton::Secondary, pressed: false, modifiers: Default::default() });
+    h.run_steps(2);
+
+    // Verify default page context menu items
+    h.get_by_label("Rotate view counterclockwise");
+    h.get_by_label("Print");
+    h.get_by_label("Select Tool");
+    h.get_by_label("Hand Tool");
+    h.get_by_label("Marquee Zoom");
+
+    for item in ["Add bookmark", "Take a snapshot", "Edit this PDF", "Delete page", "Export this PDF", "Find text or tools", "Document properties…"]
+    {
+        h.get_by_label_contains(item);
+    }
+    h.get_by_label("Rotate view clockwise");
+    assert!(h.query_all_by_label("Add comment").next().is_some());
+    assert!(h.query_all_by_label("Add text").next().is_some());
+    assert!(h.query_all_by_label("Add image").next().is_some());
+    assert!(h.query_all_by_label_contains("Copy").next().is_some());
+    assert!(h.query_all_by_label_contains("Paste").next().is_some());
+
+    // Clicking "Edit this PDF" enters edit mode
+    h.get_by_label("Edit this PDF").click();
+    h.run_steps(2);
+    assert_eq!(h.state().quick_tool, pdfcraft_ui_egui::QuickTool::EditText);
+}
+
+#[test]
+fn page_context_menu_items_disabled_on_protected_pdf() {
+    let bytes = protected("", "owner", 0b0100);
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("protected.pdf", None, bytes.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    assert_eq!(h.state().quick_tool, pdfcraft_ui_egui::QuickTool::Select);
+
+    let doc_id = h.state().views[0].id;
+    let doc = h.state().session.get(doc_id).unwrap();
+    assert!(!doc.allows_modification());
+    assert!(!doc.allows_assembly());
+    assert!(!doc.allows_annotation());
+
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let c = r.center();
+    // Right click on page in Select mode
+    h.hover_at(c);
+    h.run_steps(1);
+    h.event(egui::Event::PointerButton { pos: c, button: egui::PointerButton::Secondary, pressed: true, modifiers: Default::default() });
+    h.event(egui::Event::PointerButton { pos: c, button: egui::PointerButton::Secondary, pressed: false, modifiers: Default::default() });
+    h.run_steps(2);
+
+    let is_disabled =
+        |h: &mut Harness<'static, PdfCraftApp>, label: &str| h.query_by(|n| n.label().as_deref() == Some(label) && n.is_disabled()).is_some();
+
+    // Context menu is open; check restricted items are greyed out (disabled)
+    assert!(is_disabled(&mut h, "Edit this PDF"), "Edit this PDF should be disabled on protected document");
+    assert!(is_disabled(&mut h, "Add text"), "Add text should be disabled");
+    assert!(is_disabled(&mut h, "Add image"), "Add image should be disabled");
+    assert!(is_disabled(&mut h, "Delete page"), "Delete page should be disabled");
+    assert!(is_disabled(&mut h, "Add comment"), "Add comment should be disabled");
+    assert!(is_disabled(&mut h, "Add bookmark"), "Add bookmark should be disabled");
+
+    // View-only items should still be enabled
+    assert!(!is_disabled(&mut h, "Select Tool"));
+    assert!(!is_disabled(&mut h, "Hand Tool"));
+    assert!(!is_disabled(&mut h, "Find text or tools"));
+}
+
+#[test]
+fn image_edge_handle_stretch_and_crop_mode() {
+    let mut png = Vec::new();
+    image::RgbImage::from_pixel(100, 100, image::Rgb([100, 150, 200]))
+        .write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png)
+        .unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("square.png", None, png.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let c = r.center();
+    // Select image
+    h.hover_at(c);
+    h.run_steps(1);
+    h.drag_at(c);
+    h.run_steps(1);
+    h.drop_at(c);
+    h.run_steps(2);
+    assert!(h.state().views[0].image_selection.is_some());
+
+    // Enter crop mode via context menu
+    h.event(egui::Event::PointerButton { pos: c, button: egui::PointerButton::Secondary, pressed: true, modifiers: Default::default() });
+    h.event(egui::Event::PointerButton { pos: c, button: egui::PointerButton::Secondary, pressed: false, modifiers: Default::default() });
+    h.run_steps(2);
+    h.get_by_label("Crop").click();
+    h.run_steps(2);
+    assert!(h.state().views[0].image_selection.as_ref().is_some_and(|s| s.crop.is_some()));
+
+    // Set smaller crop rect
+    let smaller = egui::Rect::from_center_size(c, egui::vec2(50.0, 50.0));
+    set_crop_box(&mut h, smaller);
+
+    // Confirm crop with Enter key
+    h.key_press(egui::Key::Enter);
+    h.run_steps(4);
+    assert!(!h.state().views[0].image_selection.as_ref().is_some_and(|s| s.crop.is_some()));
+    let doc_id = h.state().views[0].id;
+    let images = h.state().session.get(doc_id).unwrap().page_images(0);
+    assert_eq!(images.len(), 1, "image still exists: {images:?}");
+    assert!(images[0].visible_rect.is_some(), "cropped image is visible");
+    assert_ne!(images[0].visible_rect, Some(images[0].rect), "image is cropped");
+
+    // Remove crop via context menu
+    h.hover_at(c);
+    h.run_steps(1);
+    h.event(egui::Event::PointerButton { pos: c, button: egui::PointerButton::Secondary, pressed: true, modifiers: Default::default() });
+    h.event(egui::Event::PointerButton { pos: c, button: egui::PointerButton::Secondary, pressed: false, modifiers: Default::default() });
+    h.run_steps(2);
+    h.get_by_label("Remove crop").click();
+    h.run_steps(4);
+    let images = h.state().session.get(doc_id).unwrap().page_images(0);
+    assert_eq!(images[0].visible_rect, Some(images[0].rect), "crop is removed");
+}
+
+#[test]
+fn tiny_image_crop_handle_drag_does_not_panic() {
+    let mut png = Vec::new();
+    image::RgbImage::from_pixel(5, 5, image::Rgb([100, 150, 200])).write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(800.0, 600.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("tiny.png", None, png.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+
+    // Enter crop mode on image 0 with small dimensions (5.0 x 5.0)
+    h.state_mut().views[0].image_selection = Some(pdfcraft_ui_egui::ImageSelection {
+        page: 0,
+        index: 0,
+        drag: None,
+        crop: Some(pdfcraft_ui_egui::CropMode::new([100.0, 100.0, 105.0, 105.0])),
+        turning: false,
+        settled: None,
+    });
+    h.run_steps(1);
+
+    // Hover and drag a handle across a 5.0 x 5.0 image to ensure clamp bounds do not panic
+    h.hover_at(egui::pos2(100.0, 100.0));
+    h.run_steps(1);
+    h.drag_at(egui::pos2(100.0, 100.0));
+    h.run_steps(1);
+    h.hover_at(egui::pos2(105.0, 105.0));
+    h.run_steps(2);
+    h.drop_at(egui::pos2(105.0, 105.0));
+    h.run_steps(2);
+}
+
+#[test]
+fn text_selection_action_icons() {
+    let mut h = harness(1, |_| {});
+    // Dragging selects only once the page's text layer is in, and it comes from the render pool
+    // in the background: under load a fixed number of frames was sometimes not enough.
+    support::wait_until(&mut h, "page 1's text layer", |app| app.views[0].has_page_text(0));
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let p0 = egui::pos2(r.left() + 40.0 / 200.0 * r.width(), r.top() + (300.0 - 158.0) / 300.0 * r.height());
+    let p1 = egui::pos2(r.left() + 100.0 / 200.0 * r.width(), r.top() + (300.0 - 158.0) / 300.0 * r.height());
+
+    // Drag to select text
+    h.hover_at(p0);
+    h.run_steps(1);
+    h.drag_at(p0);
+    h.run_steps(1);
+    h.hover_at(p1);
+    h.run_steps(1);
+    h.drop_at(p1);
+    h.run_steps(2);
+
+    assert!(h.state().views[0].selected_text().is_some());
+
+    // Verify all 6 minimalist action icons are present in the floating menu
+    assert!(h.query_all_by_label("Add comment").next().is_some());
+    assert!(h.query_all_by_label("Highlight").next().is_some());
+    assert!(h.query_all_by_label("Underline").next().is_some());
+    assert!(h.query_all_by_label("Strikethrough").next().is_some());
+    assert!(h.query_all_by_label("Replace text").next().is_some());
+    assert!(h.query_all_by_label("Copy").next().is_some());
+}
+
 #[test]
 fn the_format_panel_restyles_the_paragraph_being_edited() {
     let mut h = harness(1, |_| {});
@@ -4404,6 +4915,76 @@ fn the_format_panel_restyles_the_paragraph_being_edited() {
     assert!(s.views[0].line_editor.as_ref().is_some_and(|e| e.extras.underline));
 }
 
+#[test]
+fn the_format_panel_toggles_superscript_and_subscript_on_selection() {
+    let mut h = harness(1, |_| {});
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let at = egui::pos2(r.left() + 40.0 / 200.0 * r.width(), r.top() + (300.0 - 158.0) / 300.0 * r.height());
+    h.hover_at(at);
+    h.run_steps(1);
+    h.drag_at(at);
+    h.run_steps(1);
+    h.drop_at(at);
+    h.run_steps(3);
+    assert!(h.state().views[0].line_editor.is_some());
+
+    // In line editor, select "1" in "Page 1":
+    let ed = h.state_mut().views[0].line_editor.as_mut().unwrap();
+    ed.selection = Some(5..6);
+    ed.focus = true;
+    h.run_steps(1);
+
+    // Click Superscript: "1" becomes "¹"
+    h.get_by_label("FORMAT TEXT");
+    let btn = h.get_by_label("Superscript");
+    btn.click();
+    h.run_steps(4);
+
+    let s = h.state();
+    let doc = s.session.get(s.views[0].id).unwrap();
+    assert_eq!(doc.can_undo(), Some("Edit text"));
+    assert_eq!(doc.text_blocks(0)[0].text, "Page ¹");
+
+    // Select "¹" in "Page ¹" to toggle it back:
+    let ed = h.state_mut().views[0].line_editor.as_mut().unwrap();
+    ed.selection = Some(5..7);
+    ed.focus = true;
+    h.run_steps(1);
+
+    // Click Superscript again: "¹" toggles back to "1"
+    h.get_by_label("Superscript").click();
+    h.run_steps(4);
+    let s2 = h.state();
+    let doc2 = s2.session.get(s2.views[0].id).unwrap();
+    assert_eq!(doc2.text_blocks(0)[0].text, "Page 1");
+
+    // Subscript toggle in added text:
+    h.state_mut().views[0].line_editor = None;
+    h.state_mut().quick_tool = pdfcraft_ui_egui::QuickTool::AddText;
+    let draft = pdfcraft_ui_egui::TextDraft {
+        page: 0,
+        index: None,
+        rect: [20.0, 20.0, 120.0, 40.0],
+        text: "H2O".into(),
+        style: Default::default(),
+        focus: false,
+        selection: Some(1..2),
+        typing_from: None,
+    };
+    h.state_mut().views[0].content.draft = Some(draft);
+    h.run_steps(2);
+
+    h.get_by_label("Subscript").click();
+    h.run_steps(2);
+    assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("H₂O"));
+
+    h.get_by_label("Subscript").click();
+    h.run_steps(2);
+    assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("H2O"));
+}
+
 /// Horizontal scale and Character spacing take any value in their ranges, not only the listed
 /// ones: values between the listed ones and beyond them, typed in Format text, reach the saved
 /// file as the engine writes them.
@@ -4588,6 +5169,17 @@ fn click_at(h: &mut Harness<'static, PdfCraftApp>, at: egui::Pos2) {
     h.run_steps(4);
 }
 
+/// Sets the open crop's box on page 0 to the screen rectangle `r`, as dragging its handles would.
+fn set_crop_box(h: &mut Harness<'static, PdfCraftApp>, r: egui::Rect) {
+    let view = &h.state().views[0];
+    let page = &h.state().session.get(view.id).unwrap().info.pages[0];
+    let xf = pdfcraft_ui_egui::canvas::PageXform { rect: view.page_screen_rect(0).unwrap(), rot: view.rotation, pw: page.width, ph: page.height };
+    let (a, b) = (xf.screen_to_view(r.min), xf.screen_to_view(r.max));
+    let (u, v) = (page.view_to_user(a.0, a.1), page.view_to_user(b.0, b.1));
+    let keep = [u[0].min(v[0]), u[1].min(v[1]), u[0].max(v[0]), u[1].max(v[1])].map(f64::from);
+    h.state_mut().views[0].image_selection.as_mut().unwrap().crop.as_mut().unwrap().keep = keep;
+}
+
 fn press(h: &mut Harness<'static, PdfCraftApp>, modifiers: Modifiers, key: Key) {
     h.key_press_modifiers(modifiers, key);
     h.run_steps(4);
@@ -6799,6 +7391,897 @@ fn leaving_organize_goes_back_to_the_workspace_panel() {
     assert_eq!(h.state().left, LeftPanel::AllTools);
 }
 
+#[test]
+fn image_copy_cut_paste_keyboard_and_context_menu() {
+    let mut png = Vec::new();
+    image::RgbImage::from_pixel(60, 40, image::Rgb([180, 50, 50])).write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.system_clipboard = false;
+        app.open_bytes("picture.png", None, png.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+
+    let id = h.state().views[0].id;
+    let initial_count = h.state().session.get(id).unwrap().page_images(0).len();
+    assert_eq!(initial_count, 1, "starts with 1 image");
+
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let c = r.center();
+
+    // 1. Select the image
+    h.hover_at(c);
+    h.run_steps(1);
+    h.drag_at(c);
+    h.run_steps(1);
+    h.drop_at(c);
+    h.run_steps(2);
+    assert!(h.state().views[0].image_selection.is_some(), "image selected");
+
+    // 2. Copy via keyboard shortcut (COMMAND+C / Event::Copy)
+    h.event(egui::Event::Copy);
+    h.run_steps(2);
+    assert!(h.state().last_copied_image.is_some(), "image copied to clipboard buffer");
+
+    // 3. The integration delivers the copied pixels for the keyboard paste.
+    let (width, height, rgba) = h.state().last_copied_image.clone().unwrap();
+    let image = egui::ColorImage::from_rgba_unmultiplied([width as usize, height as usize], &rgba);
+    h.event(egui::Event::PasteImage(std::sync::Arc::new(image)));
+    h.run_steps(3);
+    let after_paste = h.state().session.get(id).unwrap().page_images(0).len();
+    assert_eq!(after_paste, 2, "now has 2 images");
+    assert_eq!(h.state().views[0].image_selection.as_ref().map(|s| s.index), Some(1), "new image is selected");
+
+    // 4. Cut via keyboard shortcut (COMMAND+X / Event::Cut)
+    h.event(egui::Event::Cut);
+    h.run_steps(3);
+    let after_cut = h.state().session.get(id).unwrap().page_images(0).len();
+    assert_eq!(after_cut, 1, "cut deleted the pasted image");
+    assert!(h.state().views[0].image_selection.is_none(), "selection cleared after cut");
+
+    // 5. Paste again via context menu on the page
+    h.hover_at(c);
+    h.run_steps(1);
+    h.event(egui::Event::PointerButton { pos: c, button: egui::PointerButton::Secondary, pressed: true, modifiers: Default::default() });
+    h.event(egui::Event::PointerButton { pos: c, button: egui::PointerButton::Secondary, pressed: false, modifiers: Default::default() });
+    h.run_steps(2);
+    h.get_by_label_contains("Paste").click();
+    h.run_steps(3);
+    let after_paste2 = h.state().session.get(id).unwrap().page_images(0).len();
+    assert_eq!(after_paste2, 2, "pasted via context menu");
+}
+
+#[test]
+fn added_and_pasted_image_uses_refactored_image_edits() {
+    let mut png = Vec::new();
+    image::RgbImage::from_pixel(80, 80, image::Rgb([120, 180, 240])).write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+
+    let mut h = harness(1, |_| {});
+    h.run_steps(4);
+
+    // 1. Add image via add_image
+    h.state_mut().add_image("test_add.png".into(), png);
+    h.run_steps(3);
+
+    // Verify refactored mode is active
+    assert_eq!(h.state().quick_tool, pdfcraft_ui_egui::QuickTool::EditText);
+    let id = h.state().views[0].id;
+    let images = h.state().session.get(id).unwrap().page_images(0);
+    assert_eq!(images.len(), 1, "image is added");
+    assert_eq!(h.state().views[0].image_selection.as_ref().map(|s| (s.page, s.index)), Some((0, 0)), "added image has refactored image_selection");
+
+    // 2. Perform refactored crop on the added image
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let c = r.center();
+    h.hover_at(c);
+    h.run_steps(1);
+    h.event(egui::Event::PointerButton { pos: c, button: egui::PointerButton::Secondary, pressed: true, modifiers: Default::default() });
+    h.event(egui::Event::PointerButton { pos: c, button: egui::PointerButton::Secondary, pressed: false, modifiers: Default::default() });
+    h.run_steps(2);
+    h.get_by_label("Crop").click();
+    h.run_steps(2);
+    assert!(h.state().views[0].image_selection.as_ref().is_some_and(|s| s.crop.is_some()), "crop mode entered");
+
+    let smaller = egui::Rect::from_center_size(c, egui::vec2(40.0, 40.0));
+    set_crop_box(&mut h, smaller);
+    h.key_press(egui::Key::Enter);
+    h.run_steps(4);
+    assert!(!h.state().views[0].image_selection.as_ref().is_some_and(|s| s.crop.is_some()), "crop mode exited");
+
+    let images_after_crop = h.state().session.get(id).unwrap().page_images(0);
+    assert!(images_after_crop[0].visible_rect.is_some());
+    assert_ne!(images_after_crop[0].visible_rect, Some(images_after_crop[0].rect), "crop applied to added image");
+
+    // 3. Move the cropped added image
+    let orig_rect = images_after_crop[0].rect;
+    let orig_vis = images_after_crop[0].visible_rect.unwrap();
+    let dx = 20.0;
+    let dy = 20.0;
+    let new_rect = [orig_rect[0] + dx, orig_rect[1] + dy, orig_rect[2] + dx, orig_rect[3] + dy];
+    h.state_mut().apply_edit(pdfcraft_engine::Edit::EditPageImage { page: 0, index: 0, change: pdfcraft_engine::ImageEdit::Move(new_rect) });
+    h.run_steps(3);
+
+    let images_after_move = h.state().session.get(id).unwrap().page_images(0);
+    assert_eq!(images_after_move[0].rect, new_rect, "moved rect matches");
+    assert_eq!(
+        images_after_move[0].visible_rect,
+        Some([orig_vis[0] + dx, orig_vis[1] + dy, orig_vis[2] + dx, orig_vis[3] + dy]),
+        "crop preserved after move"
+    );
+}
+
+#[test]
+fn stale_clipboard_plain_text_does_not_paste_image() {
+    let mut h = harness(1, |_| {});
+    h.run_steps(4);
+    // Put an image into internal cache
+    h.state_mut().last_copied_image = Some((10, 10, vec![0; 400]));
+    h.state_mut().last_copied_file = Some(("cached.png".to_string(), vec![1, 2, 3]));
+    // The text arrives in the paste event, as it does from the OS. The real system clipboard is
+    // shared by every test thread, so this test doesn't write it.
+    h.state_mut().system_clipboard = false;
+
+    // A paste event containing plain text clears internal image cache and does not paste image
+    h.event(egui::Event::Paste("just plain text".into()));
+    h.run_steps(2);
+
+    // can_paste_image should now be false because the clipboard has text, not an image!
+    assert!(!h.state().can_paste_image(), "cannot paste image when the clipboard has text");
+
+    // paste_image should fail and return false without pasting
+    assert!(!h.state_mut().paste_image(0, None), "must not paste stale cached image");
+
+    let doc = h.state().session.get(h.state().views[0].id).unwrap();
+    assert_eq!(doc.page_images(0).len(), 0, "no image pasted on the page");
+}
+
+/// Delivered image pixels paste once; accompanying key releases add no second image.
+#[test]
+fn delivered_image_with_key_releases_pastes_once() {
+    let pdf = include_bytes!("../data/form.pdf").to_vec();
+    let mut h = Harness::builder().with_step_dt(1.0 / 60.0).with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.system_clipboard = false;
+        app.open_bytes("form.pdf", None, pdf.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+
+    let id = h.state().views[0].id;
+    let initial_count = h.state().session.get(id).unwrap().page_images(0).len();
+
+    h.state_mut().clipboard_override = Some(pdfcraft_ui_egui::Clip::Image { width: 40, height: 20, rgba: [100u8, 200, 100, 255].repeat(40 * 20) });
+
+    // The integration supplies the pixels and consumes native shortcut keys. Extra releases carry no paste authority.
+    h.event(egui::Event::PasteImage(std::sync::Arc::new(egui::ColorImage::filled([40, 20], egui::Color32::GREEN))));
+    h.event(egui::Event::Key { key: egui::Key::V, physical_key: None, pressed: false, repeat: false, modifiers: egui::Modifiers::COMMAND });
+    h.run_steps(3);
+
+    let count = h.state().session.get(id).unwrap().page_images(0).len();
+    assert_eq!(count, initial_count + 1, "exactly one image must be pasted for delivered pixels, got {count}");
+    h.event(egui::Event::Key { key: egui::Key::V, physical_key: None, pressed: false, repeat: false, modifiers: egui::Modifiers::NONE });
+    h.run_steps(2);
+    assert_eq!(h.state().session.get(id).unwrap().page_images(0).len(), initial_count + 1);
+}
+
+/// Win+V release without COMMAND must NOT paste an image.
+#[test]
+fn win_v_does_not_paste_on_open() {
+    let pdf = include_bytes!("../data/form.pdf").to_vec();
+    let mut h = Harness::builder().with_step_dt(1.0 / 60.0).with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.system_clipboard = false;
+        app.open_bytes("form.pdf", None, pdf.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+
+    let id = h.state().views[0].id;
+    let initial_count = h.state().session.get(id).unwrap().page_images(0).len();
+
+    h.state_mut().clipboard_override = Some(pdfcraft_ui_egui::Clip::Image { width: 40, height: 20, rgba: [100u8, 200, 100, 255].repeat(40 * 20) });
+
+    // Complete an intentional paste immediately before opening clipboard history.
+    h.event(egui::Event::PasteImage(std::sync::Arc::new(egui::ColorImage::filled([40, 20], egui::Color32::GREEN))));
+    h.event(egui::Event::Key { key: egui::Key::V, physical_key: None, pressed: false, repeat: false, modifiers: egui::Modifiers::COMMAND });
+    h.run_steps(1);
+    assert_eq!(h.state().session.get(id).unwrap().page_images(0).len(), initial_count + 1);
+
+    // Simulate pressing Win+V (opening clipboard history flyout):
+    // The OS intercepts V press, so PdfCraft only sees V release without COMMAND (Modifiers::NONE).
+    h.event(egui::Event::Key { key: egui::Key::V, physical_key: None, pressed: false, repeat: false, modifiers: egui::Modifiers::NONE });
+    h.run_steps(2);
+
+    let count = h.state().session.get(id).unwrap().page_images(0).len();
+    assert_eq!(count, initial_count + 1, "opening Win+V after a completed paste must not paste again");
+
+    // Choosing an item delivers another image, possibly alongside synthetic shortcut events.
+    h.event(egui::Event::PasteImage(std::sync::Arc::new(egui::ColorImage::filled([40, 20], egui::Color32::GREEN))));
+    h.event(egui::Event::Key { key: egui::Key::V, physical_key: None, pressed: false, repeat: false, modifiers: egui::Modifiers::COMMAND });
+    h.run_steps(3);
+
+    let final_count = h.state().session.get(id).unwrap().page_images(0).len();
+    assert_eq!(final_count, initial_count + 2, "the two intentional deliveries must paste exactly two images");
+}
+
+/// Normal Ctrl+V press followed by release delivers exactly one image, not two.
+#[test]
+fn paste_press_and_release_delivers_single_image() {
+    let pdf = include_bytes!("../data/form.pdf").to_vec();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.system_clipboard = false;
+        app.open_bytes("form.pdf", None, pdf.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+
+    let id = h.state().views[0].id;
+    let initial_count = h.state().session.get(id).unwrap().page_images(0).len();
+
+    h.state_mut().clipboard_override = Some(pdfcraft_ui_egui::Clip::Image { width: 40, height: 20, rgba: [100u8, 200, 100, 255].repeat(40 * 20) });
+
+    // Press V with COMMAND
+    h.event(egui::Event::Key { key: egui::Key::V, physical_key: None, pressed: true, repeat: false, modifiers: egui::Modifiers::COMMAND });
+    h.run_steps(1);
+
+    // Release V with COMMAND
+    h.event(egui::Event::Key { key: egui::Key::V, physical_key: None, pressed: false, repeat: false, modifiers: egui::Modifiers::COMMAND });
+    h.run_steps(2);
+
+    let count = h.state().session.get(id).unwrap().page_images(0).len();
+    assert_eq!(count, initial_count + 1, "Ctrl+V press and release must deliver exactly one image, got {count}");
+}
+
+/// Issue P1: Paste via context menu at a point away from the centre centers the image at that point.
+#[test]
+fn paste_at_context_menu_point_centers_on_cursor() {
+    let pdf = include_bytes!("../data/form.pdf").to_vec();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.system_clipboard = false;
+        app.open_bytes("form.pdf", None, pdf.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+
+    let id = h.state().views[0].id;
+    let initial_count = h.state().session.get(id).unwrap().page_images(0).len();
+
+    h.state_mut().clipboard_override = Some(pdfcraft_ui_egui::Clip::Image { width: 60, height: 40, rgba: [50u8, 150, 250, 255].repeat(60 * 40) });
+
+    let target_at = [120.0, 180.0];
+    assert!(h.state_mut().paste_image_at(0, target_at));
+
+    let images = h.state().session.get(id).unwrap().page_images(0);
+    assert_eq!(images.len(), initial_count + 1);
+    let r = images[initial_count].rect;
+    let center = ((r[0] + r[2]) / 2.0, (r[1] + r[3]) / 2.0);
+    assert!((center.0 - target_at[0]).abs() < 1.0 && (center.1 - target_at[1]).abs() < 1.0, "expected center {target_at:?}, got {center:?}");
+}
+
+/// Issue P2: A newer clipboard override image beats stale in-app copy.
+#[test]
+fn newer_clipboard_override_beats_stale_in_app_copy() {
+    let pdf = include_bytes!("../data/form.pdf").to_vec();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.system_clipboard = false;
+        app.open_bytes("form.pdf", None, pdf.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+
+    let id = h.state().views[0].id;
+    let initial_count = h.state().session.get(id).unwrap().page_images(0).len();
+
+    // Stale in-app copy: 10x10 red image
+    h.state_mut().last_copied_image = Some((10, 10, [255u8, 0, 0, 255].repeat(100)));
+
+    // Newer clipboard override: 50x50 green image
+    h.state_mut().clipboard_override = Some(pdfcraft_ui_egui::Clip::Image { width: 50, height: 50, rgba: [0u8, 255, 0, 255].repeat(2500) });
+
+    assert!(h.state_mut().paste_image(0, None));
+    let images = h.state().session.get(id).unwrap().page_images(0);
+    assert_eq!(images.len(), initial_count + 1);
+    let r = images[initial_count].rect;
+    let (w, h_dim) = (r[2] - r[0], r[3] - r[1]);
+    assert!((w - 50.0).abs() < 1.0 && (h_dim - 50.0).abs() < 1.0, "expected 50x50 override image, got {w}x{h_dim}");
+}
+
+#[test]
+fn rotated_image_selection_and_crop() {
+    let mut png = Vec::new();
+    image::RgbImage::from_pixel(80, 40, image::Rgb([200, 40, 40])).write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("picture.png", None, png.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    let id = h.state().views[0].id;
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let c = r.center();
+
+    // Select the image
+    h.hover_at(c);
+    h.run_steps(1);
+    h.drag_at(c);
+    h.run_steps(1);
+    h.drop_at(c);
+    h.run_steps(2);
+    assert!(h.state().views[0].image_selection.is_some(), "selected");
+
+    // Right-click and rotate clockwise
+    h.event(egui::Event::PointerButton { pos: c, button: egui::PointerButton::Secondary, pressed: true, modifiers: Default::default() });
+    h.event(egui::Event::PointerButton { pos: c, button: egui::PointerButton::Secondary, pressed: false, modifiers: Default::default() });
+    h.run_steps(2);
+    h.get_by_label("Rotate Clockwise").click();
+    h.run_steps(3);
+
+    let doc = h.state().session.get(id).unwrap();
+    let im_rotated = &doc.page_images(0)[0];
+    assert!(im_rotated.matrix[1].abs() > 1.0 || im_rotated.matrix[2].abs() > 1.0, "matrix is rotated: {:?}", im_rotated.matrix);
+
+    // Enter crop mode with user-space bounds [0.2..0.8] of rotated image rect
+    let full = im_rotated.rect;
+    let crop_keep = [
+        full[0] + (full[2] - full[0]) * 0.2,
+        full[1] + (full[3] - full[1]) * 0.2,
+        full[0] + (full[2] - full[0]) * 0.8,
+        full[1] + (full[3] - full[1]) * 0.8,
+    ];
+    h.state_mut().views[0].image_selection.as_mut().unwrap().crop = Some(pdfcraft_ui_egui::CropMode::new(crop_keep));
+    h.run_steps(2);
+
+    // Apply crop via Enter key
+    h.key_press(egui::Key::Enter);
+    h.run_steps(4);
+
+    let doc = h.state().session.get(id).unwrap();
+    assert_eq!(doc.can_undo(), Some("Crop image"));
+    let im_cropped = &doc.page_images(0)[0];
+    assert!(im_cropped.matrix[1].abs() > 1.0 || im_cropped.matrix[2].abs() > 1.0, "matrix remains rotated: {:?}", im_cropped.matrix);
+    assert!(h.state().views[0].image_selection.as_ref().is_some_and(|s| s.crop.is_none()), "crop mode ended");
+}
+
+#[test]
+fn test_image_8_handles_render_and_drag() {
+    let mut png = Vec::new();
+    image::RgbImage::from_pixel(100, 100, image::Rgb([100, 150, 200]))
+        .write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png)
+        .unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("square.png", None, png.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let c = r.center();
+
+    // Select the image
+    h.hover_at(c);
+    h.run_steps(1);
+    h.drag_at(c);
+    h.run_steps(1);
+    h.drop_at(c);
+    h.run_steps(2);
+    assert!(h.state().views[0].image_selection.is_some(), "selected");
+
+    let view = &h.state().views[0];
+    let sel = view.image_selection.as_ref().unwrap();
+    let doc = h.state().session.get(view.id).unwrap();
+    let img = &doc.page_images(sel.page)[sel.index];
+    let xf =
+        pdfcraft_ui_egui::canvas::PageXform { rect: r, rot: view.rotation, pw: doc.info.pages[sel.page].width, ph: doc.info.pages[sel.page].height };
+    let obb = pdfcraft_ui_egui::canvas::ImageObb::from_image(img, &xf, &doc.info, sel.page);
+
+    // Assert that exactly 8 unique resize handles (4 corners, 4 midpoints) are generated
+    let handles = obb.handles();
+    assert_eq!(handles.len(), 8, "exactly 8 resize handles generated");
+
+    let corners = [
+        pdfcraft_ui_egui::ImageHandle::TopLeft,
+        pdfcraft_ui_egui::ImageHandle::TopRight,
+        pdfcraft_ui_egui::ImageHandle::BottomRight,
+        pdfcraft_ui_egui::ImageHandle::BottomLeft,
+    ];
+    let midpoints = [
+        pdfcraft_ui_egui::ImageHandle::TopCenter,
+        pdfcraft_ui_egui::ImageHandle::RightCenter,
+        pdfcraft_ui_egui::ImageHandle::BottomCenter,
+        pdfcraft_ui_egui::ImageHandle::LeftCenter,
+    ];
+    for corner in &corners {
+        assert!(handles.iter().any(|(h, _)| h == corner), "missing corner handle: {:?}", corner);
+    }
+    for midpoint in &midpoints {
+        assert!(handles.iter().any(|(h, _)| h == midpoint), "missing midpoint handle: {:?}", midpoint);
+    }
+
+    for i in 0..8 {
+        for j in (i + 1)..8 {
+            assert!((handles[i].1 - handles[j].1).length() > 1.0, "handles {} and {} must be unique positions", i, j);
+        }
+    }
+
+    // Simulate a pointer drag on a corner that shrinks the image to 5x5 pixels and assert it does not panic
+    let tr_pos = obb.handle_pos(pdfcraft_ui_egui::ImageHandle::TopRight);
+    let anchor = obb.s00;
+    let shrink_target = anchor + egui::vec2(5.0, 5.0);
+    h.hover_at(tr_pos);
+    h.run_steps(1);
+    h.drag_at(tr_pos);
+    h.run_steps(1);
+    h.hover_at(shrink_target);
+    h.run_steps(2);
+    h.drop_at(shrink_target);
+    h.run_steps(4);
+}
+
+#[test]
+fn test_image_context_menu_precedence() {
+    let mut png = Vec::new();
+    image::RgbImage::from_pixel(80, 40, image::Rgb([200, 40, 40])).write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("picture.png", None, png.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let c = r.center();
+
+    // Select the image
+    h.hover_at(c);
+    h.run_steps(1);
+    h.drag_at(c);
+    h.run_steps(1);
+    h.drop_at(c);
+    h.run_steps(2);
+    assert!(h.state().views[0].image_selection.is_some(), "selected");
+
+    // Simulate a secondary click strictly inside an image's bounds
+    h.hover_at(c);
+    h.run_steps(1);
+    h.event(egui::Event::PointerButton { pos: c, button: egui::PointerButton::Secondary, pressed: true, modifiers: Default::default() });
+    h.event(egui::Event::PointerButton { pos: c, button: egui::PointerButton::Secondary, pressed: false, modifiers: Default::default() });
+    h.run_steps(2);
+
+    // Assert that the image widget consumes the click and the canvas background menu does not trigger
+    h.get_by_label("Rotate Clockwise");
+    h.get_by_label("Flip horizontal");
+    assert!(h.query_all_by_label("Rotate view clockwise").next().is_none(), "canvas background menu must not trigger");
+    assert!(h.query_all_by_label("Add bookmark").next().is_none(), "canvas background menu must not trigger");
+    assert!(h.query_all_by_label("Take a snapshot").next().is_none(), "canvas background menu must not trigger");
+}
+
+#[test]
+fn test_image_context_menu_in_crop_mode_and_when_moved() {
+    let mut png = Vec::new();
+    image::RgbImage::from_pixel(100, 100, image::Rgb([200, 40, 40])).write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("picture.png", None, png.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    let id = h.state().views[0].id;
+    // Shrink and center the picture on the page so page margins exist around it
+    let full = h.state().session.get(id).unwrap().page_images(0)[0].rect;
+    let (qw, qh) = ((full[2] - full[0]) / 4.0, (full[3] - full[1]) / 4.0);
+    let (mx, my) = ((full[0] + full[2]) / 2.0, (full[1] + full[3]) / 2.0);
+    h.state_mut().apply_edit(pdfcraft_engine::Edit::EditPageImage {
+        page: 0,
+        index: 0,
+        change: pdfcraft_engine::ImageEdit::Move([mx - qw, my - qh, mx + qw, my + qh]),
+    });
+    h.run_steps(4);
+
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let c = r.center();
+
+    // Select the image
+    h.hover_at(c);
+    h.run_steps(1);
+    h.drag_at(c);
+    h.run_steps(1);
+    h.drop_at(c);
+    h.run_steps(2);
+    assert!(h.state().views[0].image_selection.is_some(), "selected");
+
+    // Enter crop mode:
+    let doc_id = h.state().views[0].id;
+    let original_rect = h.state().session.get(doc_id).unwrap().page_images(0)[0].rect;
+    h.state_mut().views[0].image_selection.as_mut().unwrap().crop = Some(pdfcraft_ui_egui::CropMode::new(original_rect));
+    h.run_steps(2);
+
+    // Set a smaller crop box that is moved towards top-left
+    let moved_crop = egui::Rect::from_center_size(c - egui::vec2(5.0, 5.0), egui::vec2(20.0, 20.0));
+    set_crop_box(&mut h, moved_crop);
+    h.run_steps(2);
+
+    // Simulate secondary click on the moved crop box
+    let click_pos = moved_crop.center();
+    h.hover_at(click_pos);
+    h.run_steps(1);
+    h.event(egui::Event::PointerButton { pos: click_pos, button: egui::PointerButton::Secondary, pressed: true, modifiers: Default::default() });
+    h.event(egui::Event::PointerButton { pos: click_pos, button: egui::PointerButton::Secondary, pressed: false, modifiers: Default::default() });
+    h.run_steps(2);
+
+    // In crop mode and when moved, do not open right click window when clicked on the image (#5835)
+    assert!(h.query_all_by_label("Rotate Clockwise").next().is_none(), "image context menu must not trigger in crop mode");
+    assert!(h.query_all_by_label("Flip horizontal").next().is_none(), "image context menu must not trigger in crop mode");
+    assert!(h.query_all_by_label("Rotate view clockwise").next().is_none(), "canvas background menu must not trigger in crop mode");
+    assert!(h.query_all_by_label("Add bookmark").next().is_none(), "canvas background menu must not trigger in crop mode");
+    assert!(h.query_all_by_label("Take a snapshot").next().is_none(), "canvas background menu must not trigger in crop mode");
+    assert!(h.state().views[0].image_selection.as_ref().is_some_and(|s| s.crop.is_some()), "crop mode must remain active after right click on image");
+    // Action pills remain visible and interactive
+    assert!(h.query_by_label("Done").is_some());
+    assert!(h.query_by_label("Cancel").is_some());
+
+    // Right clicking outside the image on the page exits crop mode and opens the canvas background menu
+    let outside_pos = r.left_top() + egui::vec2(10.0, 10.0);
+    h.hover_at(outside_pos);
+    h.run_steps(1);
+    h.event(egui::Event::PointerButton { pos: outside_pos, button: egui::PointerButton::Secondary, pressed: true, modifiers: Default::default() });
+    h.event(egui::Event::PointerButton { pos: outside_pos, button: egui::PointerButton::Secondary, pressed: false, modifiers: Default::default() });
+    h.run_steps(2);
+
+    assert!(h.state().views[0].image_selection.is_none(), "clicking outside clears image selection");
+    assert!(h.query_all_by_label("Rotate view clockwise").next().is_some(), "canvas background menu triggers outside image");
+}
+
+fn crop_secondary_click(h: &mut Harness<'static, PdfCraftApp>, p: egui::Pos2) {
+    assert!(h.state().views[0].viewport_rect().contains(p), "test point must be visible: {p:?}");
+    h.hover_at(p);
+    h.run_steps(1);
+    h.event(egui::Event::PointerButton { pos: p, button: egui::PointerButton::Secondary, pressed: true, modifiers: Default::default() });
+    h.run_steps(1);
+    h.event(egui::Event::PointerButton { pos: p, button: egui::PointerButton::Secondary, pressed: false, modifiers: Default::default() });
+    h.run_steps(2);
+}
+
+fn assert_crop_context_preserved(h: &Harness<'static, PdfCraftApp>) {
+    let selection = h.state().views[0].image_selection.as_ref().expect("crop remains selected");
+    assert_eq!(selection.index, 0, "an overlapping image must not steal the crop");
+    assert!(selection.crop.is_some(), "crop mode remains active");
+    for label in ["Flip horizontal", "Rotate view clockwise", "Take a snapshot"] {
+        assert!(h.query_all_by_label(label).next().is_none(), "unexpected menu: {label}");
+    }
+    assert!(h.query_by_label("Done").is_some());
+    assert!(h.query_by_label("Cancel").is_some());
+}
+
+#[test]
+fn test_image_context_menu_crop_overlapping_image_and_handle() {
+    for rotation in [0, 90, 180, 270] {
+        let mut h = Harness::builder().with_size(egui::vec2(1400.0, 1400.0)).build_eframe(move |_cc| {
+            let mut app = PdfCraftApp::new();
+            app.set_option("language", "en").unwrap();
+            app.open_bytes("overlap.pdf", None, two_image_fixture()).unwrap();
+            app.views[0].rotation = rotation;
+            app
+        });
+        h.run_steps(4);
+        let id = h.state().views[0].id;
+        let rect = h.state().session.get(id).unwrap().page_images(0)[0].rect;
+        h.state_mut().apply_edit(pdfcraft_engine::Edit::EditPageImage { page: 0, index: 1, change: pdfcraft_engine::ImageEdit::Move(rect) });
+        let images = h.state().session.get(id).unwrap().page_images(0);
+        assert_eq!(images.len(), 2);
+        assert_eq!(images[0].rect, images[1].rect, "fixture images must overlap");
+        assert!(h.state_mut().execute("edit.edit_text"));
+        h.run_steps(4);
+        let mut selection = pdfcraft_ui_egui::ImageSelection::at(0, 0);
+        selection.crop = Some(pdfcraft_ui_egui::CropMode::new(rect));
+        h.state_mut().views[0].image_selection = Some(selection);
+        h.run_steps(2);
+        let xf = h.state().views[0].page_xform(0).unwrap();
+        let doc = h.state().session.get(id).unwrap();
+        let image_rect = pdfcraft_ui_egui::canvas::image_screen_rect(&doc.page_images(0)[0], &xf, &doc.info, 0);
+        crop_secondary_click(&mut h, image_rect.center());
+        assert_crop_context_preserved(&h);
+        // This point is outside both images, but inside the left handle's grip.
+        crop_secondary_click(&mut h, image_rect.left_center() - egui::vec2(5.0, 0.0));
+        assert_crop_context_preserved(&h);
+        crop_secondary_click(&mut h, image_rect.left_center() - egui::vec2(20.0, 0.0));
+        assert!(h.state().views[0].image_selection.is_none());
+        assert!(h.query_by_label("Rotate view clockwise").is_some());
+    }
+}
+
+#[test]
+fn test_image_context_menu_crop_page_edge_pills() {
+    for rotation in [0, 90, 180, 270] {
+        let mut h = Harness::builder().with_size(egui::vec2(1400.0, 1400.0)).build_eframe(move |_cc| {
+            let mut app = PdfCraftApp::new();
+            app.set_option("language", "en").unwrap();
+            app.open_bytes("edge.pdf", None, two_image_fixture()).unwrap();
+            app.views[0].rotation = rotation;
+            app.views[0].fit = pdfcraft_ui_egui::canvas::Fit::Page;
+            app
+        });
+        h.run_steps(4);
+        // A small image at a page corner exercises horizontal clamping and above placement.
+        let rect = [1.0, 1.0, 21.0, 21.0];
+        h.state_mut().apply_edit(pdfcraft_engine::Edit::EditPageImage { page: 0, index: 0, change: pdfcraft_engine::ImageEdit::Move(rect) });
+        h.state_mut().apply_edit(pdfcraft_engine::Edit::EditPageImage {
+            page: 0,
+            index: 1,
+            change: pdfcraft_engine::ImageEdit::Move([100.0, 150.0, 120.0, 170.0]),
+        });
+        assert!(h.state_mut().execute("edit.edit_text"));
+        h.run_steps(4);
+        let mut selection = pdfcraft_ui_egui::ImageSelection::at(0, 0);
+        selection.crop = Some(pdfcraft_ui_egui::CropMode::new([2.0, 2.0, 20.0, 20.0]));
+        h.state_mut().views[0].image_selection = Some(selection);
+        h.run_steps(2);
+        for label in ["Done", "Cancel", "Remove Crop"] {
+            let p = h.get_by_label(label).rect().center();
+            crop_secondary_click(&mut h, p);
+            assert_crop_context_preserved(&h);
+        }
+        // Beyond egui's 5-point interaction radius, empty space beside the rightmost pill is canvas.
+        let beside = h.get_by_label("Done").rect().right_center() + egui::vec2(8.0, 0.0);
+        let view = &h.state().views[0];
+        let doc = h.state().session.get(view.id).unwrap();
+        let xf = view.page_xform(0).unwrap();
+        assert!(
+            doc.page_images(0).iter().all(|img| !pdfcraft_ui_egui::canvas::image_screen_rect(img, &xf, &doc.info, 0).contains(beside)),
+            "background test point must miss both images"
+        );
+        crop_secondary_click(&mut h, beside);
+        assert!(
+            h.state().views[0].image_selection.is_none(),
+            "empty pill-adjacent space, rotation={rotation}, point={beside:?}, viewport={:?}, selection={:?}",
+            h.state().views[0].viewport_rect(),
+            h.state().views[0].image_selection
+        );
+        assert!(h.query_by_label("Rotate view clockwise").is_some());
+    }
+}
+
+#[test]
+fn test_rotated_image_crop_secondary_click_in_outer_bounding_box_clears_selection() {
+    let mut png = Vec::new();
+    image::RgbImage::from_pixel(80, 80, image::Rgb([200, 40, 40])).write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 1400.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("picture.png", None, png.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    let id = h.state().views[0].id;
+    let full = h.state().session.get(id).unwrap().page_images(0)[0].rect;
+    let (qw, qh) = ((full[2] - full[0]) / 4.0, (full[3] - full[1]) / 4.0);
+    let (mx, my) = ((full[0] + full[2]) / 2.0, (full[1] + full[3]) / 2.0);
+    h.state_mut().apply_edit(pdfcraft_engine::Edit::EditPageImage {
+        page: 0,
+        index: 0,
+        change: pdfcraft_engine::ImageEdit::Move([mx - qw, my - qh, mx + qw, my + qh]),
+    });
+    h.run_steps(4);
+    // Rotate the image by 45°
+    h.state_mut().apply_edit(pdfcraft_engine::Edit::EditPageImage { page: 0, index: 0, change: pdfcraft_engine::ImageEdit::RotateBy(45.0) });
+    h.run_steps(4);
+
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let c = r.center();
+
+    // Select the image and put it into crop mode
+    h.hover_at(c);
+    h.run_steps(1);
+    h.drag_at(c);
+    h.run_steps(1);
+    h.drop_at(c);
+    h.run_steps(2);
+    assert!(h.state().views[0].image_selection.is_some(), "selected");
+
+    let doc_id = h.state().views[0].id;
+    let img = &h.state().session.get(doc_id).unwrap().page_images(0)[0];
+    let (cx, cy) = ((full[0] + full[2]) / 2.0, (full[1] + full[3]) / 2.0);
+    let shrunk_crop = [cx - 5.0, cy - 5.0, cx + 5.0, cy + 5.0];
+    h.state_mut().views[0].image_selection.as_mut().unwrap().crop = Some(pdfcraft_ui_egui::CropMode::new(shrunk_crop));
+    h.run_steps(2);
+
+    let xf = h.state().views[0].page_xform(0).unwrap();
+    let doc_info = &h.state().session.get(doc_id).unwrap().info;
+    let b = pdfcraft_ui_egui::canvas::image_screen_rect(img, &xf, doc_info, 0);
+
+    // The top-left corner of the axis-aligned bounding box `b` is outside the 45°-rotated diamond quad
+    let corner = b.left_top() + egui::vec2(2.0, 2.0);
+    assert!(b.contains(corner), "corner point is inside screen bounding box");
+
+    // Right-clicking at the corner must clear the crop selection and show the canvas context menu (#5900 review)
+    crop_secondary_click(&mut h, corner);
+    assert!(h.state().views[0].image_selection.is_none(), "clicking in outer bounding box of rotated image clears crop selection");
+    assert!(h.query_by_label("Rotate view clockwise").is_some());
+}
+
+#[test]
+fn crop_action_pills_interactive_and_apply_cancel_reset() {
+    let mut png = Vec::new();
+    image::RgbImage::from_pixel(100, 100, image::Rgb([100, 150, 200]))
+        .write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png)
+        .unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("square.png", None, png.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let c = r.center();
+    // Select image
+    h.hover_at(c);
+    h.run_steps(1);
+    h.drag_at(c);
+    h.run_steps(1);
+    h.drop_at(c);
+    h.run_steps(2);
+    assert!(h.state().views[0].image_selection.is_some());
+
+    // Enter crop mode
+    let doc_id = h.state().views[0].id;
+    let original_rect = h.state().session.get(doc_id).unwrap().page_images(0)[0].rect;
+    h.state_mut().views[0].image_selection.as_mut().unwrap().crop = Some(pdfcraft_ui_egui::CropMode::new(original_rect));
+    h.run_steps(2);
+
+    // Set smaller crop rect (50x50 in center)
+    let smaller = egui::Rect::from_center_size(c, egui::vec2(50.0, 50.0));
+    set_crop_box(&mut h, smaller);
+    h.run_steps(2);
+
+    let pill_y = smaller.max.y + 17.0;
+    let done_pos = egui::pos2(smaller.max.x - 20.0, pill_y);
+    h.hover_at(done_pos);
+    h.run_steps(1);
+    assert_eq!(h.output().platform_output.cursor_icon, egui::CursorIcon::PointingHand, "Done pill has PointingHand cursor");
+
+    let cancel_pos = egui::pos2(smaller.max.x - 85.0, pill_y);
+    h.hover_at(cancel_pos);
+    h.run_steps(1);
+    assert_eq!(h.output().platform_output.cursor_icon, egui::CursorIcon::PointingHand, "Cancel pill has PointingHand cursor");
+
+    // Click Cancel pill: exits crop mode without applying changes
+    click_at(&mut h, cancel_pos);
+    h.run_steps(3);
+    assert!(h.state().views[0].image_selection.as_ref().is_some_and(|s| s.crop.is_none()), "Cancel exits crop mode");
+    assert_eq!(h.state().session.get(doc_id).unwrap().page_images(0)[0].visible_rect, Some(original_rect), "image is uncropped");
+
+    // Re-enter crop mode and set crop rect
+    h.state_mut().views[0].image_selection.as_mut().unwrap().crop = Some(pdfcraft_ui_egui::CropMode::new(original_rect));
+    set_crop_box(&mut h, smaller);
+    h.run_steps(2);
+
+    // Click "Remove Crop" pill
+    let reset_pos = egui::pos2(smaller.max.x - 170.0, pill_y);
+    h.hover_at(reset_pos);
+    h.run_steps(1);
+    assert_eq!(h.output().platform_output.cursor_icon, egui::CursorIcon::PointingHand, "Remove Crop pill has PointingHand cursor");
+    click_at(&mut h, reset_pos);
+    h.run_steps(2);
+    let current_keep = h.state().views[0].image_selection.as_ref().unwrap().crop.as_ref().unwrap().keep;
+    assert_eq!(current_keep, original_rect, "Remove Crop restored crop to full bounds");
+
+    // Re-set smaller crop and click "Done" pill to apply
+    set_crop_box(&mut h, smaller);
+    h.run_steps(2);
+    let done_pos_after = egui::pos2(smaller.max.x - 20.0, pill_y);
+    click_at(&mut h, done_pos_after);
+    h.run_steps(4);
+
+    assert!(h.state().views[0].image_selection.as_ref().is_some_and(|s| s.crop.is_none()), "Done exits crop mode");
+    let after_images = h.state().session.get(doc_id).unwrap().page_images(0);
+    assert_ne!(after_images[0].visible_rect, Some(original_rect), "crop was applied");
+}
+
+#[test]
+fn test_cropped_image_selection_and_bounding_box() {
+    let mut png = Vec::new();
+    image::RgbImage::from_pixel(100, 100, image::Rgb([100, 150, 200]))
+        .write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png)
+        .unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("square.png", None, png.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+
+    let doc_id = h.state().views[0].id;
+    let full_rect = h.state().session.get(doc_id).unwrap().page_images(0)[0].rect;
+
+    // Apply crop to the center quarter: [0.25, 0.25, 0.75, 0.75]
+    let crop_keep = [
+        full_rect[0] + (full_rect[2] - full_rect[0]) * 0.25,
+        full_rect[1] + (full_rect[3] - full_rect[1]) * 0.25,
+        full_rect[0] + (full_rect[2] - full_rect[0]) * 0.75,
+        full_rect[1] + (full_rect[3] - full_rect[1]) * 0.75,
+    ];
+    h.state_mut().apply_edit(pdfcraft_engine::Edit::EditPageImage { page: 0, index: 0, change: pdfcraft_engine::ImageEdit::Crop(crop_keep) });
+    h.run_steps(4);
+
+    let img = &h.state().session.get(doc_id).unwrap().page_images(0)[0];
+    assert_eq!(img.rect, full_rect, "underlying CTM rect is non-destructively preserved");
+    let vis = img.visible_rect.expect("has visible_rect");
+    assert!((vis[0] - crop_keep[0]).abs() < 1e-3);
+    assert!((vis[1] - crop_keep[1]).abs() < 1e-3);
+    assert!((vis[2] - crop_keep[2]).abs() < 1e-3);
+    assert!((vis[3] - crop_keep[3]).abs() < 1e-3);
+
+    // Verify selectable bounds helper gives the cropped intersection
+    assert_eq!(pdfcraft_ui_egui::canvas::image_selectable_bounds(img), vis);
+
+    // Select tool (mouse tool)
+    h.state_mut().quick_tool = pdfcraft_ui_egui::QuickTool::Select;
+    h.run_steps(2);
+
+    let page_rect = h.state().views[0].page_screen_rect(0).expect("on screen");
+    // Center point is inside the cropped area:
+    let center = page_rect.center();
+    click_at(&mut h, center);
+    h.run_steps(2);
+
+    let picked = h.state().views[0].picked_image.expect("image is picked when clicking inside crop");
+    assert_eq!(picked.page, 0);
+    assert_eq!(picked.index, 0);
+    // The selection bounding box wraps the visible cropped area, NOT the full CTM rect!
+    assert_eq!(picked.rect, vis, "picked rect wraps the cropped bounds");
+
+    // Deselect
+    h.key_press(egui::Key::Escape);
+    h.run_steps(2);
+    assert!(h.state().views[0].picked_image.is_none());
+
+    // Corner point (e.g. top-left corner of the page) is outside the crop box but inside full CTM rect
+    let corner = page_rect.min + egui::vec2(10.0, 10.0);
+    click_at(&mut h, corner);
+    h.run_steps(2);
+    assert!(h.state().views[0].picked_image.is_none(), "clicking cropped-away region must not hit-test or select the image");
+}
+
 /// The Read mode command (not the mode bar) applies a paragraph still open in the editor, as
 /// putting the Edit text tool down does; left open, it would stay drawn in Read mode with no tool.
 #[test]
@@ -6828,6 +8311,215 @@ fn read_mode_shortcut_applies_the_open_paragraph() {
     assert_eq!(s.session.get(s.views[0].id).unwrap().text_lines(0)[0].text, "Chapter One", "the edit is applied");
 }
 
+#[test]
+fn arrange_duplicate_image_clears_selection_when_ambiguous() {
+    use pdfcraft_cos::{Dict, Document, Object, SaveOptions, Stream, write_incremental};
+    let mut doc = Document::open(std::sync::Arc::new(fixture(1))).unwrap();
+    let page = pdfcraft_model::pages(&doc)[0].clone();
+    let mut form = Dict::new();
+    form.set(b"Subtype".to_vec(), Object::name("Form"));
+    form.set(b"BBox".to_vec(), Object::Array([0, 0, 200, 300].map(Object::Int).to_vec()));
+    let artwork = doc.add(Object::Stream(Stream::flate(form, b"0.2 0.5 0.9 rg 20 20 160 260 re f")));
+    // Paint two occurrences of the same figure at the exact same position
+    let contents = doc.add(Object::Stream(Stream::flate(Dict::new(), b"q 1 0 0 1 0 0 cm /Figure Do Q q 1 0 0 1 0 0 cm /Figure Do Q")));
+    doc.update_dict(page.obj, |d| {
+        d.set(b"Contents".to_vec(), Object::Ref(contents));
+        let mut xo = Dict::new();
+        xo.set(b"Figure".to_vec(), Object::Ref(artwork));
+        let mut resources = Dict::new();
+        resources.set(b"XObject".to_vec(), Object::Dict(xo));
+        d.set(b"Resources".to_vec(), Object::Dict(resources));
+    })
+    .unwrap();
+    let bytes = write_incremental(&doc, &SaveOptions::default()).unwrap();
+
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("dup.pdf", None, bytes.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+
+    let doc_id = h.state().views[0].id;
+    let images = h.state().session.get(doc_id).unwrap().page_images(0);
+    assert_eq!(images.len(), 2, "two duplicate image occurrences exist");
+    assert_eq!(images[0].rect, images[1].rect);
+    assert_eq!(images[0].name, images[1].name);
+
+    // Select the second occurrence (index 1)
+    h.state_mut().views[0].image_selection =
+        Some(pdfcraft_ui_egui::ImageSelection { page: 0, index: 1, drag: None, crop: None, turning: false, settled: None });
+    h.run_steps(2);
+
+    // Arrange send to back
+    let applied = h.state_mut().apply_edit(pdfcraft_engine::Edit::EditPageImage {
+        page: 0,
+        index: 1,
+        change: pdfcraft_engine::ImageEdit::Arrange(pdfcraft_engine::ArrangeOrder::SendToBack),
+    });
+    assert!(applied);
+    h.run_steps(2);
+
+    // Because there are duplicate occurrences matching name, object, and rect,
+    // selection must be cleared rather than picking an arbitrary occurrence.
+    assert!(h.state().views[0].image_selection.is_none(), "selection is safely cleared when reordering ambiguous duplicate images");
+}
+
+#[test]
+fn arrange_unique_image_preserves_selection() {
+    use pdfcraft_cos::{Dict, Document, Object, SaveOptions, Stream, write_incremental};
+    let mut doc = Document::open(std::sync::Arc::new(fixture(1))).unwrap();
+    let page = pdfcraft_model::pages(&doc)[0].clone();
+    let mut form = Dict::new();
+    form.set(b"Subtype".to_vec(), Object::name("Form"));
+    form.set(b"BBox".to_vec(), Object::Array([0, 0, 200, 300].map(Object::Int).to_vec()));
+    let artwork1 = doc.add(Object::Stream(Stream::flate(form.clone(), b"0.2 0.5 0.9 rg 20 20 160 260 re f")));
+    let artwork2 = doc.add(Object::Stream(Stream::flate(form, b"0.9 0.2 0.5 rg 40 40 100 100 re f")));
+    let contents = doc.add(Object::Stream(Stream::flate(Dict::new(), b"q 1 0 0 1 0 0 cm /FigA Do Q q 1 0 0 1 0 0 cm /FigB Do Q")));
+    doc.update_dict(page.obj, |d| {
+        d.set(b"Contents".to_vec(), Object::Ref(contents));
+        let mut xo = Dict::new();
+        xo.set(b"FigA".to_vec(), Object::Ref(artwork1));
+        xo.set(b"FigB".to_vec(), Object::Ref(artwork2));
+        let mut resources = Dict::new();
+        resources.set(b"XObject".to_vec(), Object::Dict(xo));
+        d.set(b"Resources".to_vec(), Object::Dict(resources));
+    })
+    .unwrap();
+    let bytes = write_incremental(&doc, &SaveOptions::default()).unwrap();
+
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("unique.pdf", None, bytes.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+
+    let doc_id = h.state().views[0].id;
+    let images = h.state().session.get(doc_id).unwrap().page_images(0);
+    assert_eq!(images.len(), 2);
+    assert_eq!(images[0].name, "FigA");
+    assert_eq!(images[1].name, "FigB");
+
+    // Select FigA at index 0 and bring it to front (should move after FigB, becoming index 1)
+    h.state_mut().views[0].image_selection =
+        Some(pdfcraft_ui_egui::ImageSelection { page: 0, index: 0, drag: None, crop: None, turning: false, settled: None });
+    h.run_steps(2);
+
+    let applied = h.state_mut().apply_edit(pdfcraft_engine::Edit::EditPageImage {
+        page: 0,
+        index: 0,
+        change: pdfcraft_engine::ImageEdit::Arrange(pdfcraft_engine::ArrangeOrder::BringToFront),
+    });
+    assert!(applied);
+    h.run_steps(2);
+
+    let sel = h.state().views[0].image_selection.as_ref().expect("selection is preserved for unique image");
+    assert_eq!(sel.index, 1, "selection index tracks the unique image's new position");
+}
+
+#[test]
+fn undo_arrange_re_resolves_image_selection_or_clears() {
+    use pdfcraft_cos::{Dict, Document, Object, SaveOptions, Stream, write_incremental};
+    let mut doc = Document::open(std::sync::Arc::new(fixture(1))).unwrap();
+    let page = pdfcraft_model::pages(&doc)[0].clone();
+    let mut form = Dict::new();
+    form.set(b"Subtype".to_vec(), Object::name("Form"));
+    form.set(b"BBox".to_vec(), Object::Array([0, 0, 200, 300].map(Object::Int).to_vec()));
+    let artwork1 = doc.add(Object::Stream(Stream::flate(form.clone(), b"0.2 0.5 0.9 rg 20 20 160 260 re f")));
+    let artwork2 = doc.add(Object::Stream(Stream::flate(form, b"0.9 0.2 0.5 rg 40 40 100 100 re f")));
+    let contents = doc.add(Object::Stream(Stream::flate(Dict::new(), b"q 1 0 0 1 0 0 cm /FigA Do Q q 1 0 0 1 0 0 cm /FigB Do Q")));
+    doc.update_dict(page.obj, |d| {
+        d.set(b"Contents".to_vec(), Object::Ref(contents));
+        let mut xo = Dict::new();
+        xo.set(b"FigA".to_vec(), Object::Ref(artwork1));
+        xo.set(b"FigB".to_vec(), Object::Ref(artwork2));
+        let mut resources = Dict::new();
+        resources.set(b"XObject".to_vec(), Object::Dict(xo));
+        d.set(b"Resources".to_vec(), Object::Dict(resources));
+    })
+    .unwrap();
+    let bytes = write_incremental(&doc, &SaveOptions::default()).unwrap();
+
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("undo_arrange.pdf", None, bytes.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+
+    let doc_id = h.state().views[0].id;
+    let images = h.state().session.get(doc_id).unwrap().page_images(0);
+    assert_eq!(images.len(), 2);
+    assert_eq!(images[0].name, "FigA");
+    assert_eq!(images[1].name, "FigB");
+
+    // Select FigA (back image, index 0)
+    h.state_mut().views[0].image_selection =
+        Some(pdfcraft_ui_egui::ImageSelection { page: 0, index: 0, drag: None, crop: None, turning: false, settled: None });
+    h.run_steps(2);
+
+    // Bring to front
+    let applied = h.state_mut().apply_edit(pdfcraft_engine::Edit::EditPageImage {
+        page: 0,
+        index: 0,
+        change: pdfcraft_engine::ImageEdit::Arrange(pdfcraft_engine::ArrangeOrder::BringToFront),
+    });
+    assert!(applied);
+    h.run_steps(2);
+
+    // Selection now tracks FigA at index 1
+    let sel = h.state().views[0].image_selection.as_ref().expect("selected after arrange");
+    assert_eq!(sel.index, 1);
+
+    // Undo
+    assert!(h.state_mut().execute("edit.undo"));
+    h.run_steps(2);
+
+    let doc_after = h.state().session.get(doc_id).unwrap();
+    let images_after = doc_after.page_images(0);
+    assert_eq!(images_after[0].name, "FigA");
+    assert_eq!(images_after[1].name, "FigB");
+
+    // After undoing Bring to front, selection must either be FigA (index 0) or None, never FigB (index 1)
+    let sel_after = h.state().views[0].image_selection.as_ref().expect("selection re-resolved to the same image");
+    assert_eq!(sel_after.index, 0, "selection should point to FigA at index 0, not FigB at index 1");
+    assert_eq!(images_after[sel_after.index].name, "FigA");
+
+    // Redo
+    assert!(h.state_mut().execute("edit.redo"));
+    h.run_steps(2);
+
+    let doc_redo = h.state().session.get(doc_id).unwrap();
+    let images_redo = doc_redo.page_images(0);
+    assert_eq!(images_redo[0].name, "FigB");
+    assert_eq!(images_redo[1].name, "FigA");
+
+    let sel_redo = h.state().views[0].image_selection.as_ref().expect("selection re-resolved after redo");
+    assert_eq!(sel_redo.index, 1, "selection should point to FigA at index 1");
+    assert_eq!(images_redo[sel_redo.index].name, "FigA");
+
+    // Bringing to front when already at front is refused, but selection must be preserved
+    let applied_again = h.state_mut().apply_edit(pdfcraft_engine::Edit::EditPageImage {
+        page: 0,
+        index: 1,
+        change: pdfcraft_engine::ImageEdit::Arrange(pdfcraft_engine::ArrangeOrder::BringToFront),
+    });
+    assert!(!applied_again);
+    h.run_steps(2);
+    let sel_refused = h.state().views[0].image_selection.as_ref().expect("selection preserved after refused arrange");
+    assert_eq!(sel_refused.index, 1);
+}
+
 /// #3061: a paragraph running past its page's bottom edge (an HTML converter relying on the
 /// page clip) opens in an editor that draws on its page only. It covered the next page.
 #[test]
@@ -7036,6 +8728,246 @@ fn mode_tabs_keep_the_hand_over_a_paragraph_scrolled_under_them() {
     assert_eq!(h.state().mode, pdfcraft_ui_egui::Mode::Convert, "the tab takes the click, not the paragraph's editor");
 }
 
+#[test]
+fn copy_pasted_image_discards_coordinates_and_moves_without_offset() {
+    let mut png = Vec::new();
+    image::RgbImage::from_pixel(60, 60, image::Rgb([100, 150, 200])).write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+
+    let mut h = harness(1, |_| {});
+    h.state_mut().system_clipboard = false;
+    h.run_steps(4);
+
+    // 1. Add image to page 0
+    h.state_mut().add_image("test_img.png".into(), png);
+    h.run_steps(3);
+
+    let id = h.state().views[0].id;
+    let images_before = h.state().session.get(id).unwrap().page_images(0);
+    assert_eq!(images_before.len(), 1);
+
+    // 2. Copy the image from page 0
+    assert!(h.state_mut().copy_page_image(0, 0));
+    assert!(h.state().last_copied_image.is_some(), "image pixel data is kept");
+
+    // 3. Paste the image via Ctrl+V (paste_image with rect: None)
+    assert!(h.state_mut().paste_image(0, None));
+    h.run_steps(3);
+
+    let images_after_paste = h.state().session.get(id).unwrap().page_images(0);
+    assert_eq!(images_after_paste.len(), 2, "second image pasted");
+
+    // The pasted image should be centered on the page, not offset by (+20, -20) from the first image
+    let img1 = &images_after_paste[0];
+    let img2 = &images_after_paste[1];
+    assert_eq!(img1.rect, img2.rect, "pasted image placed using natural page centering");
+
+    // 4. Move the pasted image by an explicit Move change
+    let target = [50.0, 50.0, 110.0, 110.0];
+    h.state_mut().apply_edit(pdfcraft_engine::Edit::EditPageImage { page: 0, index: 1, change: pdfcraft_engine::ImageEdit::Move(target) });
+    h.run_steps(3);
+
+    let images_after_move = h.state().session.get(id).unwrap().page_images(0);
+    assert_eq!(images_after_move[1].rect, target, "moved image rect matches target exactly without offset");
+}
+
+#[test]
+fn clicking_after_image_context_menu_action_resets_menu_state_and_updates_selection() {
+    let mut png = Vec::new();
+    image::RgbImage::from_pixel(80, 40, image::Rgb([200, 40, 40])).write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("picture.png", None, png.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    let id = h.state().views[0].id;
+    // Move the first image to left side: [10.0, 10.0, 30.0, 30.0]
+    h.state_mut().apply_edit(pdfcraft_engine::Edit::EditPageImage {
+        page: 0,
+        index: 0,
+        change: pdfcraft_engine::ImageEdit::Move([10.0, 10.0, 30.0, 30.0]),
+    });
+    // Add second image to right side: [50.0, 10.0, 70.0, 30.0]
+    let mut png2 = Vec::new();
+    image::RgbImage::from_pixel(20, 20, image::Rgb([40, 200, 40])).write_to(&mut std::io::Cursor::new(&mut png2), image::ImageFormat::Png).unwrap();
+    h.state_mut().apply_edit(pdfcraft_engine::Edit::AddImage {
+        page: 0,
+        rect: Some([50.0, 10.0, 70.0, 30.0]),
+        name: "img2.png".into(),
+        bytes: std::sync::Arc::new(png2),
+    });
+    h.run_steps(4);
+
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let info = h.state().session.get(id).unwrap().info.pages[0].clone();
+    let user_to_screen = move |u: [f64; 2]| {
+        let v = info.user_to_view(u[0] as f32, u[1] as f32);
+        let scale = r.width() / info.width;
+        egui::pos2(r.left() + v[0] * scale, r.top() + v[1] * scale)
+    };
+
+    let p0 = user_to_screen([20.0, 20.0]);
+    let p1 = user_to_screen([60.0, 20.0]);
+    let p_empty = user_to_screen([40.0, 35.0]);
+
+    // 1. Select image 0
+    h.hover_at(p0);
+    h.run_steps(1);
+    h.drag_at(p0);
+    h.run_steps(1);
+    h.drop_at(p0);
+    h.run_steps(2);
+    assert_eq!(h.state().views[0].image_selection.as_ref().map(|s| s.index), Some(0), "image 0 selected");
+
+    // 2. Select image 1 (switches selection)
+    h.hover_at(p1);
+    h.run_steps(1);
+    h.drag_at(p1);
+    h.run_steps(1);
+    h.drop_at(p1);
+    h.run_steps(2);
+    assert_eq!(h.state().views[0].image_selection.as_ref().map(|s| s.index), Some(1), "image 1 selected");
+
+    // 3. Click empty space (clears selection)
+    h.hover_at(p_empty);
+    h.run_steps(1);
+    h.drag_at(p_empty);
+    h.run_steps(1);
+    h.drop_at(p_empty);
+    h.run_steps(2);
+    assert!(h.state().views[0].image_selection.is_none(), "empty page clears selection");
+
+    // 4. Select image 0 again
+    h.hover_at(p0);
+    h.run_steps(1);
+    h.drag_at(p0);
+    h.run_steps(1);
+    h.drop_at(p0);
+    h.run_steps(2);
+    assert_eq!(h.state().views[0].image_selection.as_ref().map(|s| s.index), Some(0), "image 0 selected again");
+
+    // 5. Right-click image 0 to open context menu
+    h.hover_at(p0);
+    h.run_steps(1);
+    h.event(egui::Event::PointerButton { pos: p0, button: egui::PointerButton::Secondary, pressed: true, modifiers: Default::default() });
+    h.event(egui::Event::PointerButton { pos: p0, button: egui::PointerButton::Secondary, pressed: false, modifiers: Default::default() });
+    h.run_steps(2);
+
+    // 6. Click "Flip horizontal"
+    h.get_by_label("Flip horizontal").click();
+    h.run_steps(3);
+
+    assert!(h.query_all_by_label("Flip horizontal").next().is_none(), "the image menu closes after its action");
+
+    // 7. Click image 1: should switch selection to image 1
+    h.hover_at(p1);
+    h.run_steps(1);
+    h.drag_at(p1);
+    h.run_steps(1);
+    h.drop_at(p1);
+    h.run_steps(2);
+    assert_eq!(
+        h.state().views[0].image_selection.as_ref().map(|s| s.index),
+        Some(1),
+        "clicking other image switches selection after context menu action"
+    );
+
+    // 8. Click empty space: should clear selection
+    h.hover_at(p_empty);
+    h.run_steps(1);
+    h.drag_at(p_empty);
+    h.run_steps(1);
+    h.drop_at(p_empty);
+    h.run_steps(2);
+    assert!(h.state().views[0].image_selection.is_none(), "clicking empty page clears selection after context menu action");
+}
+
+#[test]
+fn format_panel_shows_selection_size_and_updates_after_font_applied() {
+    let mut objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R >>".into(),
+        "<< /Type /Pages /Kids [4 0 R] /Count 1 /MediaBox [0 0 200 300] >>".into(),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Contents 5 0 R /Resources << /Font << /F1 3 0 R >> >> >>".into(),
+    ];
+    let body = "BT /F1 24 Tf 20 200 Td (Heading) Tj /F1 12 Tf 0 -25 Td (Paragraph) Tj ET";
+    objs.push(format!("<< /Length {} >>\nstream\n{body}\nendstream", body.len()));
+    let mut pdf = Vec::from(b"%PDF-1.7\n");
+    let mut xref = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        xref.push(pdf.len());
+        pdf.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref_pos = pdf.len();
+    pdf.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in xref {
+        pdf.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    pdf.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref_pos}\n%%EOF\n", objs.len() + 1).as_bytes());
+
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("test.pdf", None, pdf).expect("fixture opens");
+        app
+    });
+    h.run_steps(4);
+
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let at = egui::pos2(r.left() + 40.0 / 200.0 * r.width(), r.top() + (300.0 - 180.0) / 300.0 * r.height());
+    h.hover_at(at);
+    h.run_steps(1);
+    h.drag_at(at);
+    h.run_steps(1);
+    h.drop_at(at);
+    h.run_steps(3);
+
+    assert!(h.state().views[0].line_editor.is_some(), "editor opened");
+    let text = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
+    assert!(text.contains("Paragraph"), "text is {text}");
+
+    // Select the 12 pt paragraph text "Paragraph" via keyboard selection in the TextEdit
+    h.key_press_modifiers(Modifiers::COMMAND, Key::ArrowRight);
+    h.run_steps(1);
+    for _ in 0.."Paragraph".len() {
+        h.key_press_modifiers(Modifiers::SHIFT, Key::ArrowLeft);
+        h.run_steps(1);
+    }
+    use egui::accesskit::Role;
+    let size_node = h.get_by_role_and_label(Role::TextInput, "Font size:");
+    assert_eq!(size_node.value().as_deref(), Some("12"), "size text input value is 12");
+
+    let font_node = h.get_by_role_and_label(Role::ComboBox, "Font");
+    assert_eq!(font_node.value().as_deref(), Some("Helvetica"), "initial font is Helvetica");
+
+    // Apply Times to the selection
+    font_node.click();
+    h.run_steps(2);
+    h.get_by_label("Times").click();
+    h.run_steps(4);
+
+    // Font combo box for the whole block is now Mixed because Heading is Helvetica and Paragraph is Times
+    let font_node = h.get_by_role_and_label(Role::ComboBox, "Font");
+    assert_eq!(font_node.value().as_deref(), Some("Mixed"), "whole block has mixed fonts");
+
+    // Apply Times to the whole block
+    font_node.click();
+    h.run_steps(2);
+    h.get_by_label("Times").click();
+    h.run_steps(4);
+
+    // Now all text is Times, so font combo box updates to Times
+    let font_node = h.get_by_role_and_label(Role::ComboBox, "Font");
+    assert_eq!(font_node.value().as_deref(), Some("Times"), "font combo box updates to Times");
+}
+
 /// The paragraph opened for typing, as a person opens it: a click on its text.
 fn open_paragraph(h: &mut Harness<'static, PdfCraftApp>) {
     let r = h.state().views[0].page_screen_rect(0).expect("on screen");
@@ -7520,6 +9452,101 @@ fn a_paragraph_selected_by_its_frame_deletes_with_one_key() {
     }
 }
 
+fn two_image_fixture() -> Vec<u8> {
+    let content = "q 20 0 0 20 100 100 cm /Im0 Do Q q 20 0 0 20 20 20 cm /Im0 Do Q";
+    let objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R >>".into(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 300] /Contents 4 0 R /Resources << /XObject << /Im0 5 0 R >> >> >>".into(),
+        format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len()),
+        "<< /Type /XObject /Subtype /Image /Width 2 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 8 /Length 4 >>\nstream\n\0\0\0\0\nendstream"
+            .into(),
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    out
+}
+
+#[test]
+fn duplicate_xobject_at_different_rects_arrange_and_delete_keeps_other_instance_through_menu() {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 1400.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("dup.pdf", None, two_image_fixture()).expect("opens fixture");
+        app
+    });
+    h.run_steps(4);
+    let id = h.state().views[0].id;
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+
+    let xf = h.state().views[0].page_xform(0).expect("page 0 xform");
+    let imgs = h.state().session.get(id).unwrap().page_images(0);
+    // B is at index 0 [100, 100, 120, 120], in the back
+    let b0 = pdfcraft_ui_egui::canvas::image_screen_rect(&imgs[0], &xf, &h.state().session.get(id).unwrap().info, 0);
+    let p_b = b0.center();
+
+    // 1. Select B (image 0)
+    h.hover_at(p_b);
+    h.run_steps(1);
+    h.drag_at(p_b);
+    h.run_steps(1);
+    h.drop_at(p_b);
+    h.run_steps(2);
+    assert_eq!(h.state().views[0].image_selection.as_ref().map(|s| s.index), Some(0), "image 0 (B) selected");
+
+    // 2. Right-click B (image 0) to open context menu
+    h.hover_at(p_b);
+    h.run_steps(1);
+    h.event(egui::Event::PointerButton { pos: p_b, button: egui::PointerButton::Secondary, pressed: true, modifiers: Default::default() });
+    h.event(egui::Event::PointerButton { pos: p_b, button: egui::PointerButton::Secondary, pressed: false, modifiers: Default::default() });
+    h.run_steps(2);
+
+    // 3. Open "Arrange image" submenu and click "Bring to front"
+    h.get_by_label("Arrange image").click();
+    h.run_steps(2);
+    h.get_by_label("Bring to front").click();
+    h.run_steps(3);
+
+    // 4. Selection must be preserved after arrange: B is now at index 1 (in front)
+    let sel = h.state().views[0].image_selection.as_ref().map(|s| s.index);
+    assert_eq!(sel, Some(1), "selection must track B to index 1 after arrange");
+
+    // 5. Right-click on the selected image (B at index 1) again to open context menu
+    let sel_idx = sel.unwrap();
+    let xf_again = h.state().views[0].page_xform(0).expect("page 0 xform");
+    let cur_imgs = h.state().session.get(id).unwrap().page_images(0);
+    let b_rect = pdfcraft_ui_egui::canvas::image_screen_rect(&cur_imgs[sel_idx], &xf_again, &h.state().session.get(id).unwrap().info, 0);
+    let p_b2 = b_rect.center();
+    h.hover_at(p_b2);
+    h.run_steps(1);
+    h.event(egui::Event::PointerButton { pos: p_b2, button: egui::PointerButton::Secondary, pressed: true, modifiers: Default::default() });
+    h.event(egui::Event::PointerButton { pos: p_b2, button: egui::PointerButton::Secondary, pressed: false, modifiers: Default::default() });
+    h.run_steps(2);
+
+    // 6. Click "Delete" in context menu
+    h.get_by_label("Delete").click();
+    h.run_steps(3);
+
+    // 7. Save, reopen and verify: A remains at [20, 20, 40, 40], B is deleted
+    let saved = h.state().session.save_bytes(id).unwrap();
+    let mut reopened = pdfcraft_engine::Session::new();
+    let rid = reopened.open("again.pdf", None, saved, None).unwrap();
+    let imgs = reopened.get(rid).unwrap().page_images(0);
+    assert_eq!(imgs.len(), 1, "exactly one image must remain after deleting B");
+    assert!((imgs[0].rect[0] - 20.0).abs() < 1e-2, "remaining image must be A at [20, 20, 40, 40], was {:?}", imgs[0].rect);
+}
+
 /// Esc in an open paragraph leaves its text and selects its box, as in Acrobat, so Esc and
 /// Delete remove it without aiming for the thin frame; the unapplied draft is discarded.
 #[test]
@@ -7554,3 +9581,316 @@ fn escape_in_an_open_paragraph_selects_its_box_for_delete() {
         assert_eq!(blocks(&h)[0].text, "Page 1");
     }
 }
+
+#[test]
+fn outward_image_grip_drags_grow_on_rotated_pages() {
+    for rotation in [0, 90, 180, 270] {
+        for image_turn in [0.0, 25.0] {
+            for grip in 0..8 {
+                let mut png = Vec::new();
+                image::RgbImage::from_pixel(100, 80, image::Rgb([100, 150, 200]))
+                    .write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png)
+                    .unwrap();
+                let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+                    let mut app = PdfCraftApp::new();
+                    app.set_option("language", "en").unwrap();
+                    app.open_bytes("grips.png", None, png.clone()).unwrap();
+                    app
+                });
+                h.run_steps(4);
+                h.state_mut().apply_edit(pdfcraft_engine::Edit::EditPageImage {
+                    page: 0,
+                    index: 0,
+                    change: pdfcraft_engine::ImageEdit::Move([20.0, 20.0, 80.0, 60.0]),
+                });
+                h.state_mut().apply_edit(pdfcraft_engine::Edit::RotatePages { pages: vec![0], degrees: rotation });
+                if image_turn != 0.0 {
+                    h.state_mut().apply_edit(pdfcraft_engine::Edit::EditPageImage {
+                        page: 0,
+                        index: 0,
+                        change: pdfcraft_engine::ImageEdit::RotateBy(image_turn),
+                    });
+                }
+                h.state_mut().views[0].fit = pdfcraft_ui_egui::canvas::Fit::Page;
+                assert!(h.state_mut().execute("edit.edit_text"));
+                h.state_mut().views[0].image_selection = Some(pdfcraft_ui_egui::ImageSelection::at(0, 0));
+                h.run_steps(3);
+                let view = &h.state().views[0];
+                let doc = h.state().session.get(view.id).unwrap();
+                let before = doc.page_images(0)[0].clone();
+                let obb = pdfcraft_ui_egui::canvas::ImageObb::from_image(&before, &view.page_xform(0).unwrap(), &doc.info, 0);
+                let (handle, start) = obb.handles()[grip];
+                let opposite = obb.handles()[(grip + 4) % 8].0;
+                let finish = start + (start - obb.screen_center) * 0.15;
+                assert!(view.viewport_rect().contains(start) && view.viewport_rect().contains(finish), "test grips must be visible");
+                h.hover_at(start);
+                h.run_steps(1);
+                h.drag_at(start);
+                h.run_steps(1);
+                let started = h.state().views[0].image_selection.clone();
+                h.hover_at(finish);
+                h.run_steps(2);
+                let moved = h.state().views[0].image_selection.clone();
+                h.drop_at(finish);
+                h.run_steps(3);
+                let view = &h.state().views[0];
+                let doc = h.state().session.get(view.id).unwrap();
+                let images = doc.page_images(0);
+                let after = &images[0];
+                let after_obb = pdfcraft_ui_egui::canvas::ImageObb::from_image(after, &view.page_xform(0).unwrap(), &doc.info, 0);
+                assert!(
+                    after_obb.handle_pos(opposite).distance(obb.handle_pos(opposite)) < 1.0,
+                    "fixed grip moved: rotation={rotation} image_turn={image_turn} grip={grip}"
+                );
+                assert!(
+                    after_obb.handle_pos(handle).distance(finish) < 1.0,
+                    "dragged grip missed pointer: rotation={rotation} image_turn={image_turn} grip={grip}"
+                );
+                let area = |m: [f64; 6]| (m[0] * m[3] - m[1] * m[2]).abs();
+                assert!(
+                    area(after.matrix) > area(before.matrix) * 1.05,
+                    "outward grip shrank or ignored: rotation={rotation} image_turn={image_turn} grip={grip}: {:?} => {:?}; started={started:?} moved={moved:?}",
+                    before.matrix,
+                    after.matrix
+                );
+            }
+        }
+    }
+}
+
+#[test]
+fn author_image_clip_is_not_offered_as_a_removable_editor_crop() {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 1100.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("author-clip.pdf", None, clipped_artwork_with_labels()).unwrap();
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.state_mut().views[0].image_selection = Some(pdfcraft_ui_egui::ImageSelection::at(0, 0));
+    h.run_steps(3);
+    let view = &h.state().views[0];
+    let doc = h.state().session.get(view.id).unwrap();
+    let image = doc.page_images(0)[0].clone();
+    let visible = image.visible_rect.unwrap();
+    let xf = view.page_xform(0).unwrap();
+    let bounds = pdfcraft_ui_egui::canvas::image_screen_rect(&image, &xf, &doc.info, 0);
+    let p = bounds.center();
+    h.hover_at(p);
+    h.event(egui::Event::PointerButton { pos: p, button: egui::PointerButton::Secondary, pressed: true, modifiers: Default::default() });
+    h.event(egui::Event::PointerButton { pos: p, button: egui::PointerButton::Secondary, pressed: false, modifiers: Default::default() });
+    h.run_steps(2);
+    assert!(h.query_all_by_label("Remove crop").next().is_none(), "author clips are not editor crops");
+    h.get_by_label("Crop").click();
+    h.run_steps(2);
+    assert!(h.query_all_by_label("Remove Crop").next().is_none(), "the initial author clip has no removable draft crop");
+    let mut draft = visible;
+    draft[0] += (draft[2] - draft[0]) * 0.2;
+    h.state_mut().views[0].image_selection.as_mut().unwrap().crop.as_mut().unwrap().keep = draft;
+    h.run_steps(3);
+    h.get_by_label("Remove Crop").click();
+    h.run_steps(1);
+    assert_eq!(h.state().views[0].image_selection.as_ref().unwrap().crop.as_ref().unwrap().keep, visible, "draft reset preserves the author's clip");
+    h.get_by_label("Done").click();
+    h.run_steps(2);
+    assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().page_images(0)[0].visible_rect, Some(visible));
+}
+
+fn affine_review_image_fixture(matrix: [f64; 6], clip: Option<[f64; 4]>, rotation: i64) -> Vec<u8> {
+    use pdfcraft_cos::{Dict, Document, Object, Stream};
+    let mut doc = Document::open(std::sync::Arc::new(fixture(1))).unwrap();
+    let page = pdfcraft_model::pages(&doc).remove(0);
+    let mut image = Dict::new();
+    image.set(b"Type".to_vec(), Object::name("XObject"));
+    image.set(b"Subtype".to_vec(), Object::name("Image"));
+    image.set(b"Width".to_vec(), Object::Int(1));
+    image.set(b"Height".to_vec(), Object::Int(1));
+    image.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+    image.set(b"ColorSpace".to_vec(), Object::name("DeviceRGB"));
+    let image = doc.add(Object::Stream(Stream::flate(image, &[220, 80, 50])));
+    let mut xobjects = Dict::new();
+    xobjects.set(b"ImReview".to_vec(), Object::Ref(image));
+    let mut resources = Dict::new();
+    resources.set(b"XObject".to_vec(), Object::Dict(xobjects));
+    let mut content = String::from("q ");
+    if let Some([x0, y0, x1, y1]) = clip {
+        content.push_str(&format!("{x0} {y0} {} {} re W n ", x1 - x0, y1 - y0));
+    }
+    let [a, b, c, d, e, f] = matrix;
+    content.push_str(&format!("{a} {b} {c} {d} {e} {f} cm /ImReview Do Q"));
+    let stream = doc.add(Object::Stream(Stream::flate(Dict::new(), content.as_bytes())));
+    doc.update_dict(page.obj, |dict| {
+        dict.set(b"Contents".to_vec(), Object::Ref(stream));
+        dict.set(b"Resources".to_vec(), Object::Dict(resources));
+        dict.set(b"MediaBox".to_vec(), Object::Array(vec![Object::Int(0), Object::Int(0), Object::Int(360), Object::Int(360)]));
+        dict.set(b"Rotate".to_vec(), Object::Int(rotation));
+    })
+    .unwrap();
+    pdfcraft_cos::write_incremental(&doc, &Default::default()).unwrap()
+}
+
+fn affine_review_harness(bytes: Vec<u8>) -> Harness<'static, PdfCraftApp> {
+    let mut h = Harness::builder().with_size(egui::vec2(1200.0, 1000.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("affine-review.pdf", None, bytes.clone()).unwrap();
+        app
+    });
+    h.run_steps(4);
+    h.state_mut().views[0].fit = pdfcraft_ui_egui::canvas::Fit::Page;
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.state_mut().views[0].image_selection = Some(pdfcraft_ui_egui::ImageSelection::at(0, 0));
+    h.run_steps(3);
+    h
+}
+
+#[test]
+fn affine_review_resize_out_and_back_preserves_saved_placement() {
+    for (matrix, clip, rotation) in [
+        ([100.0, 0.0, 0.0, 100.0, 100.0, 100.0], None, 0),
+        ([100.0, 0.0, 50.0, 100.0, 100.0, 100.0], None, 0),
+        ([86.60254, 50.0, -50.0, 86.60254, 150.0, 100.0], None, 0),
+        ([100.0, 0.0, 0.0, 100.0, 100.0, 100.0], Some([100.0, 100.0, 150.0, 200.0]), 90),
+    ] {
+        for offset in [egui::Vec2::ZERO, egui::vec2(3.0, 4.0)] {
+            let mut h = affine_review_harness(affine_review_image_fixture(matrix, clip, rotation));
+            let view = &h.state().views[0];
+            let id = view.id;
+            let doc = h.state().session.get(id).unwrap();
+            let original = doc.page_images(0)[0].matrix;
+            let before = h.state().session.save_bytes(id).unwrap();
+            let obb = pdfcraft_ui_egui::canvas::ImageObb::from_image(&doc.page_images(0)[0], &view.page_xform(0).unwrap(), &doc.info, 0);
+            let start = obb.handle_pos(pdfcraft_ui_egui::ImageHandle::TopRight) + offset;
+            h.hover_at(start);
+            h.run_steps(1);
+            h.drag_at(start);
+            h.run_steps(1);
+            h.hover_at(start + egui::vec2(30.0, -25.0));
+            h.run_steps(2);
+            h.hover_at(start);
+            h.run_steps(2);
+            h.drop_at(start);
+            h.run_steps(3);
+            let saved = h.state().session.save_bytes(id).unwrap();
+            assert!(saved == before, "out-and-back must not create an edit: matrix={matrix:?} clip={clip:?} rotation={rotation} offset={offset:?}");
+            assert_eq!(h.state().session.get(id).unwrap().can_undo(), None);
+            let mut reopened = pdfcraft_engine::Session::new();
+            let reopened_id = reopened.open("saved.pdf", None, saved, None).unwrap();
+            assert_eq!(reopened.get(reopened_id).unwrap().page_images(0)[0].matrix, original);
+        }
+    }
+}
+
+#[test]
+fn affine_review_resize_uses_press_delta_and_affine_frame() {
+    for (matrix, clip, rotation) in [
+        ([100.0, 0.0, 0.0, 100.0, 100.0, 100.0], None, 0),
+        ([100.0, 0.0, 50.0, 100.0, 100.0, 100.0], None, 0),
+        ([86.60254, 50.0, -50.0, 86.60254, 150.0, 100.0], None, 0),
+        ([100.0, 0.0, 0.0, 100.0, 100.0, 100.0], Some([100.0, 100.0, 150.0, 200.0]), 90),
+    ] {
+        let mut placements = Vec::new();
+        for offset in [egui::Vec2::ZERO, egui::vec2(3.0, 4.0)] {
+            let mut h = affine_review_harness(affine_review_image_fixture(matrix, clip, rotation));
+            let view = &h.state().views[0];
+            let id = view.id;
+            let doc = h.state().session.get(id).unwrap();
+            let xf = view.page_xform(0).unwrap();
+            let obb = pdfcraft_ui_egui::canvas::ImageObb::from_image(&doc.page_images(0)[0], &xf, &doc.info, 0);
+            let grip = obb.handle_pos(pdfcraft_ui_egui::ImageHandle::TopRight);
+            let start = grip + offset;
+            let finish = start + (grip - obb.screen_center) * 0.2;
+            h.hover_at(start);
+            h.run_steps(1);
+            h.drag_at(start);
+            h.run_steps(1);
+            h.hover_at(finish);
+            h.run_steps(2);
+            h.drop_at(finish);
+            h.run_steps(3);
+            let saved = h.state().session.save_bytes(id).unwrap();
+            let mut reopened = pdfcraft_engine::Session::new();
+            let reopened_id = reopened.open("saved.pdf", None, saved, None).unwrap();
+            let after = reopened.get(reopened_id).unwrap().page_images(0)[0].clone();
+            let after_obb = pdfcraft_ui_egui::canvas::ImageObb::from_image(&after, &xf, &reopened.get(reopened_id).unwrap().info, 0);
+            assert!(
+                after_obb.handle_pos(pdfcraft_ui_egui::ImageHandle::BottomLeft).distance(obb.handle_pos(pdfcraft_ui_egui::ImageHandle::BottomLeft))
+                    < 0.1,
+                "opposite affine grip moved: {matrix:?} clip={clip:?} rotation={rotation}"
+            );
+            assert!(
+                after_obb.handle_pos(pdfcraft_ui_egui::ImageHandle::TopRight).distance(grip + (grip - obb.screen_center) * 0.2) < 0.2,
+                "resized affine frame missed the press-relative target: {matrix:?} clip={clip:?} rotation={rotation} offset={offset:?}"
+            );
+            placements.push(after.matrix);
+        }
+        assert!(placements[0].into_iter().zip(placements[1]).all(|(a, b)| (a - b).abs() < 1e-3), "press offset changed placement: {placements:?}");
+    }
+}
+
+#[test]
+fn affine_review_cropped_rotation_preview_matches_saved_corners() {
+    let matrix = [70.710678, 70.710678, -70.710678, 70.710678, 170.710678, 100.0];
+    for (clip, rotation) in [(None, 0), (Some([100.0, 170.0, 241.421356, 241.421356]), 0), (Some([100.0, 170.0, 241.421356, 241.421356]), 90)] {
+        let mut h = affine_review_harness(affine_review_image_fixture(matrix, clip, rotation));
+        let view = &h.state().views[0];
+        let id = view.id;
+        let doc = h.state().session.get(id).unwrap();
+        let image = doc.page_images(0)[0].clone();
+        let xf = view.page_xform(0).unwrap();
+        let obb = pdfcraft_ui_egui::canvas::ImageObb::from_image(&image, &xf, &doc.info, 0);
+        let visible = image.visible_rect.unwrap_or(image.rect);
+        let p = doc.info.pages[0].user_to_view(((visible[0] + visible[2]) * 0.5) as f32, ((visible[1] + visible[3]) * 0.5) as f32);
+        let centre = xf.norm_to_screen(p[0] / xf.pw, p[1] / xf.ph);
+        let start = obb.s_rot;
+        let v = start - centre;
+        let finish = centre + egui::vec2(-v.y, v.x);
+        h.hover_at(start);
+        h.run_steps(1);
+        h.drag_at(start);
+        h.run_steps(1);
+        h.hover_at(finish);
+        h.run_steps(2);
+        assert!(h.state().views[0].image_selection.as_ref().unwrap().turning);
+        let preview = h
+            .output()
+            .shapes
+            .iter()
+            .find_map(|shape| match &shape.shape {
+                egui::Shape::Path(path) if path.closed && path.points.len() == 4 && path.stroke.width == 1.5 => Some(path.points.clone()),
+                _ => None,
+            })
+            .expect("rotation preview outline");
+        if clip.is_some()
+            && rotation == 0
+            && let Ok(directory) = std::env::var("PDFCRAFT_AFFINE_SHOTS")
+        {
+            h.render().unwrap().save(std::path::Path::new(&directory).join("affine-rotation-preview.png")).unwrap();
+        }
+        h.drop_at(finish);
+        h.run_steps(3);
+        if clip.is_some()
+            && rotation == 0
+            && let Ok(directory) = std::env::var("PDFCRAFT_AFFINE_SHOTS")
+        {
+            h.render().unwrap().save(std::path::Path::new(&directory).join("affine-rotation-committed.png")).unwrap();
+        }
+        let saved = h.state().session.save_bytes(id).unwrap();
+        let mut reopened = pdfcraft_engine::Session::new();
+        let reopened_id = reopened.open("saved.pdf", None, saved, None).unwrap();
+        let doc = reopened.get(reopened_id).unwrap();
+        let after = doc.page_images(0)[0].clone();
+        let committed = pdfcraft_ui_egui::canvas::ImageObb::from_matrix(after.matrix, &xf, &doc.info, 0).corners();
+        let (cx, cy) = ((visible[0] + visible[2]) * 0.5, (visible[1] + visible[3]) * 0.5);
+        let expected = pdfcraft_content::Matrix(image.matrix).then(&pdfcraft_content::Matrix([0.0, -1.0, 1.0, 0.0, cx - cy, cy + cx])).0;
+        assert!(
+            after.matrix.into_iter().zip(expected).all(|(a, b)| (a - b).abs() < 1e-3),
+            "knob must commit the requested 90-degree turn around visible bounds"
+        );
+        assert!(
+            preview.iter().zip(committed).all(|(a, b)| a.distance(b) < 1.0),
+            "preview jumped after commit/save: clip={clip:?} rotation={rotation}: {preview:?} != {committed:?}"
+        );
+    }
+}
diff --git a/crates/ui-egui/tests/it/main.rs b/crates/ui-egui/tests/it/main.rs
index a5c3192358..bce7c4d069 100644
--- a/crates/ui-egui/tests/it/main.rs
+++ b/crates/ui-egui/tests/it/main.rs
@@ -57,17 +57,21 @@ mod open_action;
 mod organize_drag;
 mod pageboxes;
 mod panel_snapshots;
+mod paste_ownership;
 mod pdf_links;
 mod pickers;
+mod pinned_tools;
 mod pointer;
 mod preferences_layout;
 mod prepare;
 mod print;
 mod protect;
 mod reading_colors;
+mod recent_files;
 mod recovery;
 mod redact;
 mod reload;
+mod script_noop;
 mod side_panels;
 mod signing;
 mod stamps;
diff --git a/crates/ui-egui/tests/it/paste_ownership.rs b/crates/ui-egui/tests/it/paste_ownership.rs
new file mode 100644
index 0000000000..5dc91e051a
--- /dev/null
+++ b/crates/ui-egui/tests/it/paste_ownership.rs
@@ -0,0 +1,304 @@
+//! Context paste coordinates, insertion identity and visible image ownership.
+use egui::{Key, Modifiers, PointerButton, Pos2};
+use egui_kittest::{
+    Harness,
+    kittest::{NodeT, Queryable},
+};
+use pdfcraft_engine::{AddedContent, AddedImage, Edit};
+use pdfcraft_ui_egui::{Clip, PdfCraftApp};
+
+fn fixture(rotation: u16, cropped: bool, shared: bool) -> Vec<u8> {
+    fixture_at(rotation, cropped, shared, false)
+}
+fn fixture_at(rotation: u16, cropped: bool, shared: bool, collision: bool) -> Vec<u8> {
+    let stream = |body: &str, dict: &str| format!("<< {dict} /Length {} >>\nstream\n{body}\nendstream", body.len());
+    let (media, crop, x, y) = if cropped { ("0 0 600 800", "150 250 450 550", 170, 270) } else { ("0 0 300 300", "0 0 300 300", 20, 20) };
+    let (x, y, w, height) = if collision { (60, 80, 40, 20) } else { (x, y, 30, 30) };
+    let extra = if shared { format!(" q 30 0 0 30 {} {y} cm /RedAgain Do Q", x + 50) } else { String::new() };
+    let objects = [
+        "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
+        format!(
+            "<< /Type /Page /Parent 2 0 R /MediaBox [{media}] /CropBox [{crop}] /Rotate {rotation} /Resources << /XObject << /Red 5 0 R /RedAgain 5 0 R >> >> /Contents 4 0 R >>"
+        ),
+        stream(&format!("q {w} 0 0 {height} {x} {y} cm /Red Do Q{extra}"), ""),
+        stream("FF0000>", "/Type /XObject /Subtype /Image /Width 1 /Height 1 /ColorSpace /DeviceRGB /BitsPerComponent 8 /Filter /ASCIIHexDecode"),
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (index, object) in objects.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{object}\nendobj\n", index + 1).as_bytes());
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objects.len() + 1).as_bytes());
+    for offset in offsets {
+        out.extend_from_slice(format!("{offset:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objects.len() + 1).as_bytes());
+    out
+}
+
+fn harness(bytes: Vec<u8>) -> Harness<'static, PdfCraftApp> {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 1000.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.system_clipboard = false;
+        app.open_bytes("ownership.pdf", None, bytes.clone()).unwrap();
+        app.clipboard_override = Some(Clip::Image { width: 40, height: 20, rgba: [0, 0, 255, 255].repeat(800) });
+        app
+    });
+    h.run_steps(4);
+    h
+}
+
+fn point(h: &Harness<'static, PdfCraftApp>, user: [f64; 2]) -> Pos2 {
+    let app = h.state();
+    let info = &app.session.get(app.views[0].id).unwrap().info.pages[0];
+    let v = info.user_to_view(user[0] as f32, user[1] as f32);
+    app.views[0].page_xform(0).unwrap().norm_to_screen(v[0] / info.width, v[1] / info.height)
+}
+
+fn right_click(h: &mut Harness<'static, PdfCraftApp>, user: [f64; 2]) {
+    let p = point(h, user);
+    h.hover_at(p);
+    h.run_steps(1);
+    for pressed in [true, false] {
+        h.event(egui::Event::PointerButton { pos: p, button: PointerButton::Secondary, pressed, modifiers: Modifiers::NONE });
+    }
+    h.run_steps(2);
+}
+
+fn reopened(app: &mut PdfCraftApp) -> PdfCraftApp {
+    let id = app.views[0].id;
+    let bytes = app.session.save_bytes(id).unwrap();
+    let mut saved = PdfCraftApp::new();
+    saved.open_bytes("saved.pdf", None, bytes.as_ref().clone()).unwrap();
+    saved
+}
+
+fn check_placement(rotation: u16, cropped: bool, view_rotation: u16, shared: bool, existing_added: bool, collision: bool) {
+    let mut h = harness(fixture_at(rotation, cropped, shared, collision));
+    if existing_added {
+        let mut png = Vec::new();
+        image::RgbImage::from_pixel(40, 40, image::Rgb([0, 0, 255])).write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+        h.state_mut().add_image("existing.png".into(), png);
+        assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().added().len(), 1);
+        h.state_mut().quick_tool = pdfcraft_ui_egui::QuickTool::Select;
+        h.state_mut().views[0].image_selection = None;
+        h.state_mut().views[0].content.selected = None;
+    }
+    h.state_mut().views[0].rotation = view_rotation;
+    h.run_steps(3);
+    let id = h.state().views[0].id;
+    let originals: Vec<_> = h.state().session.get(id).unwrap().page_images(0).iter().map(|image| image.object.unwrap()).collect();
+    let at = if cropped { [250.0, 400.0] } else { [210.0, 80.0] };
+    right_click(&mut h, at);
+    h.get_by_label_contains("Paste").click();
+    h.run_steps(3);
+    let doc = h.state().session.get(id).unwrap();
+    let inserted = doc
+        .added()
+        .iter()
+        .find_map(|item| match &item.content {
+            AddedContent::Image(image) if !originals.contains(&image.image) => Some(image.image),
+            _ => None,
+        })
+        .expect("a new image XObject was inserted");
+    assert!(!originals.contains(&inserted), "embedding must allocate a fresh image identity");
+    let selected = &doc.page_images(0)[h.state().views[0].image_selection.as_ref().unwrap().index];
+    assert_eq!(selected.object, Some(inserted), "the visible selection must name the inserted XObject");
+    let center = [(selected.rect[0] + selected.rect[2]) * 0.5, (selected.rect[1] + selected.rect[3]) * 0.5];
+    assert!((center[0] - at[0]).abs() < 0.001 && (center[1] - at[1]).abs() < 0.001, "rotation={rotation}, crop={cropped}: {center:?} vs {at:?}");
+    let saved = reopened(h.state_mut());
+    let placed = saved.session.get(saved.views[0].id).unwrap().page_images(0).into_iter().find(|image| image.object == Some(inserted)).unwrap();
+    assert!(((placed.rect[0] + placed.rect[2]) * 0.5 - at[0]).abs() < 0.001);
+    assert!(((placed.rect[1] + placed.rect[3]) * 0.5 - at[1]).abs() < 0.001);
+    h.key_press(Key::Delete);
+    h.run_steps(3);
+    let saved = reopened(h.state_mut());
+    let doc = saved.session.get(saved.views[0].id).unwrap();
+    assert_eq!(doc.added().len(), usize::from(existing_added));
+    let remaining = doc.page_images(0);
+    assert_eq!(remaining.len(), originals.len());
+    assert!(remaining.iter().any(|image| image.name == "Red"));
+    if shared {
+        assert!(remaining.iter().any(|image| image.name == "RedAgain"));
+    }
+}
+
+#[test]
+fn context_paste_ordinary_page_control() {
+    check_placement(0, false, 0, false, false, false);
+}
+#[test]
+fn context_paste_rotate90_places_and_selects_inserted_image() {
+    check_placement(90, false, 0, false, false, false);
+}
+#[test]
+fn context_paste_rotate180_places_and_selects_inserted_image() {
+    check_placement(180, false, 0, false, false, false);
+}
+#[test]
+fn context_paste_rotate270_places_and_selects_inserted_image() {
+    check_placement(270, false, 0, false, false, false);
+}
+#[test]
+fn context_paste_crop_offset_places_and_selects_inserted_image() {
+    check_placement(0, true, 0, false, false, false);
+}
+#[test]
+fn context_paste_rotated_crop_places_and_selects_inserted_image() {
+    check_placement(90, true, 0, false, false, false);
+}
+#[test]
+fn context_paste_view_rotation_control() {
+    check_placement(0, false, 90, false, false, false);
+}
+#[test]
+fn context_paste_shared_original_xobject_control() {
+    check_placement(90, false, 0, true, false, false);
+}
+
+#[test]
+fn context_paste_with_existing_added_image_control() {
+    check_placement(90, false, 0, false, true, false);
+}
+
+#[test]
+fn context_paste_identity_ignores_original_at_display_rectangle() {
+    check_placement(90, false, 0, false, false, true);
+}
+
+fn check_delete_owner(original: bool, shared_added: bool) {
+    let mut h = harness(fixture(0, false, false));
+    let id = h.state().views[0].id;
+    if shared_added {
+        let object = h.state().session.get(id).unwrap().page_images(0)[0].object.unwrap();
+        let (extension, bytes) = h.state().session.get(id).unwrap().page_image_copy_file(0, 0).unwrap();
+        assert!(h.state_mut().apply_edit(Edit::PasteContent {
+            page: 0,
+            content: AddedContent::Image(AddedImage::new([130.0, 130.0, 170.0, 170.0], object)),
+            file: Some((format!("shared.{extension}"), std::sync::Arc::new(bytes)))
+        }));
+        assert_eq!(h.state().session.get(id).unwrap().page_images(0).len(), 2);
+        assert!(h.state().session.get(id).unwrap().page_images(0).iter().all(|image| image.object == Some(object)));
+        h.state_mut().execute("edit.edit_text");
+        h.state_mut().views[0].content.selected = Some((0, 0));
+    } else {
+        let mut png = Vec::new();
+        image::RgbImage::from_pixel(40, 40, image::Rgb([0, 0, 255])).write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+        h.state_mut().add_image("blue.png".into(), png);
+    }
+    h.run_steps(3);
+    let p = point(&h, [150.0, 150.0]);
+    h.hover_at(p);
+    h.run_steps(1);
+    h.drag_at(p);
+    h.run_steps(1);
+    h.drop_at(p);
+    h.run_steps(2);
+    // The legacy editor can retain the added-image selection while its frame is hidden.
+    h.state_mut().views[0].content.selected = Some((0, 0));
+    let target = if original { [35.0, 35.0] } else { [150.0, 150.0] };
+    right_click(&mut h, target);
+    h.get_by_label("Copy Image").click();
+    h.run_steps(2);
+    let selection = h.state().views[0].image_selection.as_ref().unwrap();
+    let selected = &h.state().session.get(id).unwrap().page_images(0)[selection.index];
+    assert_eq!(selected.name == "Red", original, "the frame belongs to the requested occurrence");
+    h.key_press(Key::Delete);
+    h.run_steps(3);
+    let saved = reopened(h.state_mut());
+    let doc = saved.session.get(saved.views[0].id).unwrap();
+    assert_eq!(doc.page_images(0).len(), 1);
+    assert_eq!(doc.page_images(0).iter().any(|image| image.name == "Red"), !original, "Delete must remove the visibly selected occurrence");
+    assert_eq!(doc.added().len(), usize::from(original), "the other item must survive save/reopen");
+}
+
+#[test]
+fn original_image_selection_owns_delete_over_hidden_added_image() {
+    check_delete_owner(true, false);
+}
+#[test]
+fn added_image_selection_delete_control() {
+    check_delete_owner(false, false);
+}
+#[test]
+fn shared_xobject_original_occurrence_owns_delete() {
+    check_delete_owner(true, true);
+}
+
+#[test]
+fn whole_page_actions_do_not_require_a_selection() {
+    let mut h = harness(fixture(0, false, false));
+    right_click(&mut h, [210.0, 80.0]);
+    assert!(h.get_by_label_contains("Copy").accesskit_node().is_disabled());
+    assert!(!h.get_by_label("Take a snapshot").accesskit_node().is_disabled());
+    assert!(!h.get_by_label("Export this PDF").accesskit_node().is_disabled());
+}
+
+#[test]
+fn whole_page_actions_still_require_copy_permission() {
+    let mut app = PdfCraftApp::new();
+    app.open_bytes("source.pdf", None, fixture(0, false, false)).unwrap();
+    assert!(app.apply_edit(Edit::Protect(pdfcraft_engine::Protection { permissions_password: Some("owner".into()), ..Default::default() })));
+    let bytes = app.session.save_bytes(app.views[0].id).unwrap();
+    let mut h = harness(bytes.as_ref().clone());
+    right_click(&mut h, [210.0, 80.0]);
+    assert!(h.get_by_label("Take a snapshot").accesskit_node().is_disabled());
+    assert!(h.get_by_label("Export this PDF").accesskit_node().is_disabled());
+}
+
+#[test]
+fn legacy_text_delete_survives_switching_out_of_the_image_tool() {
+    let mut h = harness(fixture(0, false, false));
+    h.state_mut().execute("edit.edit_text");
+    right_click(&mut h, [35.0, 35.0]);
+    h.get_by_label("Copy Image").click();
+    h.run_steps(2);
+    assert!(h.state().views[0].image_selection.is_some());
+    assert!(h.state_mut().apply_edit(Edit::AddText {
+        page: 0,
+        text: pdfcraft_engine::AddedText { text: "note".into(), rect: [100.0, 100.0, 180.0, 130.0], ..Default::default() }
+    }));
+    assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().added().len(), 1);
+    h.state_mut().views[0].content.selected = Some((0, 0));
+    h.state_mut().quick_tool = pdfcraft_ui_egui::QuickTool::Select;
+    h.key_press(Key::Delete);
+    h.run_steps(3);
+    let saved = reopened(h.state_mut());
+    let doc = saved.session.get(saved.views[0].id).unwrap();
+    assert!(doc.added().is_empty());
+    assert_eq!(doc.page_images(0).len(), 1);
+}
+
+#[test]
+fn leaving_image_controller_cannot_leave_hidden_image_owning_delete() {
+    let mut h = harness(fixture(0, false, false));
+    let mut png = Vec::new();
+    image::RgbImage::from_pixel(40, 40, image::Rgb([0, 0, 255])).write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+    h.state_mut().add_image("blue.png".into(), png);
+    h.run_steps(3);
+    // Start from no selection, then let the controller select the added image itself.
+    h.state_mut().views[0].image_selection = None;
+    h.state_mut().views[0].content.selected = None;
+    let p = point(&h, [150.0, 150.0]);
+    h.hover_at(p);
+    h.run_steps(1);
+    h.drag_at(p);
+    h.run_steps(1);
+    h.drop_at(p);
+    h.run_steps(2);
+    assert!(h.state().views[0].image_selection.is_some());
+    h.key_press(Key::V);
+    h.run_steps(2);
+    assert_eq!(h.state().quick_tool, pdfcraft_ui_egui::QuickTool::Select);
+    assert!(h.state().views[0].image_selection.is_none());
+    h.key_press(Key::Delete);
+    h.run_steps(3);
+    let saved = reopened(h.state_mut());
+    let doc = saved.session.get(saved.views[0].id).unwrap();
+    assert_eq!(doc.page_images(0).len(), 2, "there is no visible image selection to delete");
+    assert_eq!(doc.added().len(), 1);
+}
diff --git a/crates/ui-egui/tests/it/pinned_tools.rs b/crates/ui-egui/tests/it/pinned_tools.rs
new file mode 100644
index 0000000000..55c84bc528
--- /dev/null
+++ b/crates/ui-egui/tests/it/pinned_tools.rs
@@ -0,0 +1,163 @@
+//! Pinned tools on Home: pin tools, unpin tools, persistence across sessions,
+//! selection modal, and the sidebar pin toggle.
+
+use egui_kittest::Harness;
+use egui_kittest::kittest::Queryable;
+use pdfcraft_ui_egui::{Dialog, LeftPanel, PdfCraftApp};
+
+fn harness(setup: impl FnOnce(&mut PdfCraftApp) + 'static) -> Harness<'static, PdfCraftApp> {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 1000.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.run_inline = true;
+        setup(&mut app);
+        app
+    });
+    h.run_steps(4);
+    h
+}
+
+#[test]
+fn state_operations_and_validation() {
+    let mut app = PdfCraftApp::new();
+    assert!(!app.is_tool_pinned("redact"));
+
+    // Pinning a valid tool
+    assert!(app.pin_tool("redact"));
+    assert!(app.is_tool_pinned("redact"));
+    assert_eq!(app.pinned_tools, vec!["redact"]);
+
+    // Pinning already pinned tool returns false (no duplicates)
+    assert!(!app.pin_tool("redact"));
+    assert_eq!(app.pinned_tools, vec!["redact"]);
+
+    // Pinning an invalid tool returns false
+    assert!(!app.pin_tool("invalid_tool_unknown_id"));
+    assert_eq!(app.pinned_tools, vec!["redact"]);
+
+    // Pinning a second valid tool
+    assert!(app.pin_tool("form"));
+    assert_eq!(app.pinned_tools, vec!["redact", "form"]);
+
+    // Unpinning
+    app.unpin_tool("redact");
+    assert!(!app.is_tool_pinned("redact"));
+    assert!(app.is_tool_pinned("form"));
+    assert_eq!(app.pinned_tools, vec!["form"]);
+
+    // Unpinning non-existent tool does nothing
+    app.unpin_tool("nonexistent");
+    assert_eq!(app.pinned_tools, vec!["form"]);
+
+    // Toggling
+    assert!(!app.toggle_pin_tool("form")); // unpins
+    assert!(!app.is_tool_pinned("form"));
+    assert!(app.pinned_tools.is_empty());
+
+    assert!(app.toggle_pin_tool("form")); // pins
+    assert!(app.is_tool_pinned("form"));
+    assert_eq!(app.pinned_tools, vec!["form"]);
+}
+
+#[test]
+fn persistence_round_trip_and_sanitization() {
+    let mut app = PdfCraftApp::new();
+    app.pin_tool("protect");
+    app.pin_tool("redact");
+
+    let saved = app.persist();
+    assert!(saved.contains("\"pinned_tools\""));
+
+    let mut restored = PdfCraftApp::new();
+    restored.restore(&saved);
+    assert_eq!(restored.pinned_tools, vec!["protect", "redact"]);
+
+    // Test sanitization: unknown tools are discarded and duplicates are removed, preserving order
+    let malicious_or_corrupt = serde_json::json!({
+        "pinned_tools": ["redact", "nonexistent_junk", "redact", "edit", "another_unknown", "protect"]
+    })
+    .to_string();
+    restored.restore(&malicious_or_corrupt);
+    assert_eq!(restored.pinned_tools, vec!["redact", "edit", "protect"]);
+}
+
+#[test]
+fn home_shows_pinned_tools_section_and_placeholder() {
+    let mut h = harness(|_| {});
+    // When no tools are pinned, the placeholder message appears
+    h.get_by_label_contains("Pinned Tools");
+    h.get_by_label_contains("Pin your favorite tools here for quick access.");
+    h.get_by_label("Pin a tool…");
+
+    // Pin a tool and step forward
+    h.state_mut().pin_tool("redact");
+    h.run_steps(3);
+
+    // Placeholder is gone and Redact card is shown
+    assert!(h.query_by_label_contains("Pin your favorite tools here for quick access.").is_none());
+    assert!(h.query_all_by_label("Redact a PDF").count() >= 1);
+
+    // Unpin tool and verify placeholder returns
+    h.state_mut().unpin_tool("redact");
+    h.run_steps(3);
+    h.get_by_label_contains("Pin your favorite tools here for quick access.");
+}
+
+#[test]
+fn clicking_pinned_tool_card_selects_it() {
+    let mut h = harness(|app| {
+        app.pin_tool("redact");
+    });
+    h.run_steps(2);
+
+    // The Redact card is rendered and can be clicked to select the tool
+    let nodes: Vec<_> = h.query_all_by_label("Redact a PDF").collect();
+    assert!(!nodes.is_empty());
+    // Click the card
+    nodes.last().unwrap().click();
+    h.run_steps(3);
+
+    // Redact tool panel is now active
+    assert_eq!(h.state().left, LeftPanel::Tool("redact"));
+}
+
+#[test]
+fn pin_tool_dialog_workflow() {
+    let mut h = harness(|app| {
+        app.dialog = Some(Dialog::PinTool);
+    });
+    h.run_steps(3);
+
+    // Modal is open
+    h.get_by_label_contains("Pin tools to Home");
+    h.get_by_label("Done");
+
+    // Pin a tool from inside the dialog
+    assert!(!h.state().is_tool_pinned("scan"));
+    h.state_mut().toggle_pin_tool("scan");
+    assert!(h.state().is_tool_pinned("scan"));
+    h.run_steps(2);
+
+    // Close dialog with "Done"
+    h.get_by_label("Done").click();
+    h.run_steps(2);
+    assert!(h.state().dialog.is_none());
+}
+
+#[test]
+fn sidebar_pin_toggle_unpins_and_pins() {
+    let mut h = harness(|app| {
+        app.pin_tool("redact");
+    });
+    h.run_steps(2);
+    assert!(h.state().is_tool_pinned("redact"));
+
+    // Since redact is pinned, the pin toggle is rendered in the sidebar with "Unpin from Home"
+    let unpin_btn = h.get_by_label("Unpin from Home");
+    unpin_btn.click();
+    h.run_steps(3);
+
+    assert!(!h.state().is_tool_pinned("redact"));
+    // Left panel did not navigate away (still AllTools)
+    assert_eq!(h.state().left, LeftPanel::AllTools);
+}
diff --git a/crates/ui-egui/tests/it/preferences_layout.rs b/crates/ui-egui/tests/it/preferences_layout.rs
index 1ebe06b7a0..e0a5d4e1cb 100644
--- a/crates/ui-egui/tests/it/preferences_layout.rs
+++ b/crates/ui-egui/tests/it/preferences_layout.rs
@@ -102,3 +102,152 @@ fn a_very_tall_window_does_not_leave_a_blank_gap_above_ok() {
     assert!(on_screen(ok, 2600.0) && on_screen(last, 2600.0), "{last:?} {ok:?}");
     assert!(ok.min.y - last.max.y < 120.0, "a gap of {} pt between the last setting and OK", ok.min.y - last.max.y);
 }
+
+#[test]
+fn segmented_pill_controls_switch_modes_and_layouts() {
+    let mut h = harness(900.0);
+    // Switch workspace mode via segmented pill
+    h.get_by_role_and_label(egui::accesskit::Role::RadioButton, "Convert").scroll_to_me();
+    h.run_steps(3);
+    h.get_by_role_and_label(egui::accesskit::Role::RadioButton, "Convert").click();
+    h.run_steps(2);
+    assert_eq!(h.state().default_mode, pdfcraft_ui_egui::Mode::Convert);
+
+    let continuous_before = h.state().view_defaults.continuous;
+
+    // Switch page layout via segmented pill
+    h.get_by_label("Two-page view").scroll_to_me();
+    h.run_steps(3);
+    h.get_by_label("Two-page view").click();
+    h.run_steps(2);
+    assert_eq!(h.state().view_defaults.layout, pdfcraft_ui_egui::canvas::PageLayout::TwoUp);
+    assert_eq!(h.state().view_defaults.continuous, continuous_before, "Two-page view retains continuous scrolling");
+
+    // Switch continuous scrolling pill (can be combined with Two-page view)
+    h.get_by_label("Continuous scrolling").click();
+    h.run_steps(2);
+    assert_eq!(h.state().view_defaults.continuous, !continuous_before);
+    assert_eq!(h.state().view_defaults.layout, pdfcraft_ui_egui::canvas::PageLayout::TwoUp, "two-page continuous scrolling is supported");
+
+    // Switch to single page mode (continuous setting remains independent)
+    h.get_by_label("Single page").click();
+    h.run_steps(2);
+    assert_eq!(h.state().view_defaults.layout, pdfcraft_ui_egui::canvas::PageLayout::Single);
+    assert_eq!(h.state().view_defaults.continuous, !continuous_before);
+
+    // Switch tools panel side via segmented pill
+    h.get_by_label("Left").scroll_to_me();
+    h.run_steps(3);
+    h.get_by_label("Left").click();
+    h.run_steps(2);
+    assert_eq!(h.state().side_panels.tools_side, pdfcraft_ui_egui::side_panels::ToolsSide::Left);
+
+    // Switch measurement units via segmented pill
+    h.get_by_label("pt").scroll_to_me();
+    h.run_steps(3);
+    h.get_by_label("pt").click();
+    h.run_steps(2);
+    assert_eq!(h.state().units, pdfcraft_ui_egui::units::Unit::Points);
+}
+
+#[test]
+fn search_settings_scans_and_highlights_in_situ_without_hiding_cards() {
+    let mut h = harness(900.0);
+    // Initially all card titles exist
+    assert!(h.query_by_label("General & Interface").is_some());
+    assert!(h.query_by_label("Comment").is_some());
+    assert!(h.query_by_label("JavaScript").is_some());
+
+    // Type "Hide hover" in search box
+    h.get_by_role_and_label(egui::accesskit::Role::TextInput, "Search settings…").click();
+    h.run_steps(1);
+    h.get_by_role_and_label(egui::accesskit::Role::TextInput, "Search settings…").type_text("Hide hover");
+    h.run_steps(4);
+
+    // In browser-style search, cards are NOT hidden
+    assert!(h.query_by_label("General & Interface").is_some());
+    assert!(h.query_by_label("Comment").is_some());
+    assert!(h.query_by_label("JavaScript").is_some());
+
+    // The setting "Hide hover previews for highlights without comment text" is present and matched
+    assert!(h.query_by_label("Hide hover previews for highlights without comment text").is_some());
+    // Match badge displays 1 match
+    assert!(h.query_by_label("1 match").is_some());
+
+    // Clearing search clears match badge
+    h.get_by_label("Clear search").click();
+    h.run_steps(4);
+    assert!(h.query_by_label("1 match").is_none());
+
+    // Search for "javascript"
+    h.get_by_role_and_label(egui::accesskit::Role::TextInput, "Search settings…").click();
+    h.run_steps(1);
+    h.get_by_role_and_label(egui::accesskit::Role::TextInput, "Search settings…").type_text("javascript");
+    h.run_steps(4);
+
+    // Cards remain visible and multiple matches are reported
+    assert!(h.query_by_label("JavaScript").is_some());
+    assert!(h.query_by_label("General & Interface").is_some());
+    assert!(h.query_by_label_contains("matches").is_some());
+
+    // Clearing search shows everything again
+    h.get_by_label("Clear search").click();
+    h.run_steps(4);
+    assert!(h.query_by_label("General & Interface").is_some());
+    assert!(h.query_by_label("Comment").is_some());
+    assert!(h.query_by_label("JavaScript").is_some());
+}
+
+#[test]
+fn preferences_dialog_scrollbar_spacing_and_controls() {
+    let h = harness(600.0);
+    let title = h.get_by(|n| n.role() == egui::accesskit::Role::Label && n.value().as_deref() == Some("Preferences")).rect();
+    let search = h.get_by_role_and_label(egui::accesskit::Role::TextInput, "Search settings…").rect();
+    let ok = h.get_by_label("OK").rect();
+    assert!(on_screen(ok, 600.0));
+    // Header title and search box are vertically aligned
+    assert!((title.center().y - search.center().y).abs() <= 2.0);
+    // Search box right edge is aligned within the dialog
+    assert!(search.max.x <= ok.max.x);
+}
+
+#[test]
+fn search_scrolls_option_only_and_theme_card_matches_into_visible_viewport() {
+    let mut h = harness(480.0);
+    let title = h.get_by(|n| n.role() == egui::accesskit::Role::Label && n.value().as_deref() == Some("Preferences")).rect();
+    let ok = h.get_by_label("OK").rect();
+
+    // "Two-page view" is an option in Card 3 (Documents and view).
+    // In a 480 pt window, it starts out below the visible scroll viewport.
+    let opt_before = h.get_by_label("Two-page view").rect();
+    assert!(opt_before.min.y >= ok.min.y, "Two-page option starts out below the visible viewport: {opt_before:?} vs OK {ok:?}");
+
+    // Searching "Two-page" (which only occurs inside that segmented pill option)
+    // auto-scrolls the matching option into the visible viewport between title and OK.
+    h.get_by_role_and_label(egui::accesskit::Role::TextInput, "Search settings…").click();
+    h.run_steps(1);
+    h.get_by_role_and_label(egui::accesskit::Role::TextInput, "Search settings…").type_text("Two-page");
+    h.run_steps(4);
+
+    let opt_after = h.get_by_label("Two-page view").rect();
+    assert!(
+        opt_after.min.y >= title.max.y && opt_after.max.y <= ok.min.y,
+        "Two-page option scrolled into visible scroll viewport: {opt_after:?} between title {title:?} and OK {ok:?}"
+    );
+
+    // Clear search and test a theme-card-only match
+    h.get_by_label("Clear search").click();
+    h.run_steps(4);
+
+    // Search for "Dark theme" (which occurs only in the dark theme card in Card 2).
+    h.get_by_role_and_label(egui::accesskit::Role::TextInput, "Search settings…").click();
+    h.run_steps(1);
+    h.get_by_role_and_label(egui::accesskit::Role::TextInput, "Search settings…").type_text("Dark theme");
+    h.run_steps(4);
+
+    let dark_card = h.get_by_label("Dark theme").rect();
+    assert!(
+        dark_card.min.y >= title.max.y && dark_card.max.y <= ok.min.y,
+        "Dark theme card scrolled into visible viewport: {dark_card:?} between title {title:?} and OK {ok:?}"
+    );
+}
diff --git a/crates/ui-egui/tests/it/recent_files.rs b/crates/ui-egui/tests/it/recent_files.rs
new file mode 100644
index 0000000000..e3f7721d2f
--- /dev/null
+++ b/crates/ui-egui/tests/it/recent_files.rs
@@ -0,0 +1,290 @@
+//! Preferences ▸ Recent files to keep (#5572): how many files the recent list holds, from none
+//! up to 50, on every path that adds to it, shows it or saves it.
+
+use egui::Key;
+use egui::accesskit::Role;
+use egui_kittest::Harness;
+use egui_kittest::kittest::Queryable;
+use pdfcraft_ui_egui::{Dialog, PdfCraftApp, RECENT_FILES_DEFAULT, RecentFile};
+
+use crate::support;
+
+const PDF: &[u8] = include_bytes!("../data/form.pdf");
+
+fn recent_file(name: &str) -> RecentFile {
+    RecentFile { name: name.into(), path: format!("/nowhere/{name}"), pages: 1, size: 0 }
+}
+
+fn names(app: &PdfCraftApp) -> Vec<&str> {
+    app.recent.iter().map(|r| r.name.as_str()).collect()
+}
+
+fn app_with(files: &[&str]) -> PdfCraftApp {
+    let mut app = PdfCraftApp::new();
+    app.set_option("language", "en").unwrap();
+    app.recent.extend(files.iter().map(|n| recent_file(n)));
+    app
+}
+
+/// Tall enough that the whole of Home is on screen without scrolling.
+fn harness(limit: usize, files: &[&str]) -> Harness<'static, PdfCraftApp> {
+    let files: Vec<String> = files.iter().map(ToString::to_string).collect();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 1600.0)).build_eframe(move |_cc| {
+        let mut app = app_with(&files.iter().map(String::as_str).collect::<Vec<_>>());
+        app.recent_limit = limit;
+        app
+    });
+    h.run_steps(4);
+    h
+}
+
+/// Open a document with a file behind it, as a file on disk is recorded.
+fn open(app: &mut PdfCraftApp, name: &str) {
+    app.open_bytes(name, Some(format!("/nowhere/{name}")), PDF.to_vec()).unwrap();
+}
+
+/// Typed the way a person does: click the field, type, Enter.
+fn type_limit(h: &mut Harness<'static, PdfCraftApp>, value: &str) {
+    h.get_by_role_and_label(Role::SpinButton, "Recent files to keep").click();
+    h.run_steps(2);
+    h.key_press_modifiers(egui::Modifiers::COMMAND, Key::A);
+    h.run_steps(1);
+    h.event(egui::Event::Text(value.into()));
+    h.run_steps(1);
+    h.key_press(Key::Enter);
+    h.run_steps(3);
+}
+
+#[test]
+fn the_list_keeps_twelve_files_until_preferences_says_otherwise() {
+    let mut app = app_with(&[]);
+    assert_eq!(app.recent_limit, 12);
+    for n in 0..=RECENT_FILES_DEFAULT {
+        open(&mut app, &format!("{n}.pdf"));
+    }
+    assert_eq!(app.recent.len(), 12);
+    assert_eq!(app.recent[0].name, "12.pdf", "newest first");
+    assert_eq!(app.recent[11].name, "1.pdf", "the oldest of the thirteen went");
+}
+
+#[test]
+fn opening_a_file_keeps_the_newest_up_to_the_limit() {
+    let mut app = app_with(&[]);
+    app.recent_limit = 2;
+    for name in ["first.pdf", "second.pdf", "third.pdf"] {
+        open(&mut app, name);
+    }
+    assert_eq!(names(&app), ["third.pdf", "second.pdf"]);
+    open(&mut app, "second.pdf");
+    assert_eq!(names(&app), ["second.pdf", "third.pdf"], "a file opened again moves up and loses nothing");
+}
+
+#[test]
+fn at_zero_opening_a_file_records_nothing() {
+    let mut app = app_with(&[]);
+    app.recent_limit = 0;
+    open(&mut app, "first.pdf");
+    assert!(app.recent.is_empty());
+    let saved: serde_json::Value = serde_json::from_str(&app.persist()).unwrap();
+    assert_eq!(saved["recent"], serde_json::json!([]), "and the saved list is empty");
+}
+
+#[test]
+fn at_zero_home_has_no_recent_section() {
+    let h = harness(0, &[]);
+    assert!(h.query_by_label("Recent").is_none(), "no heading");
+    assert!(h.query_by_label_contains("Files you open in PdfCraft appear here").is_none(), "and no promise of a list");
+    h.get_by_label_contains("PdfCraft works offline");
+}
+
+#[test]
+fn above_zero_an_empty_list_still_says_what_it_is_for() {
+    let h = harness(1, &[]);
+    h.get_by_label("Recent");
+    h.get_by_label_contains("Files you open in PdfCraft appear here");
+}
+
+#[test]
+fn at_zero_the_menu_and_the_palette_have_nothing_to_open() {
+    let mut h = harness(0, &[]);
+    support::open_menu(&mut h, "File");
+    assert!(h.query_by(|n| n.label().as_deref() == Some("Open Recent") && n.is_disabled()).is_some(), "Open Recent is disabled");
+    assert!(h.state_mut().execute("file.open_recent"));
+    assert!(h.state().toast.as_ref().is_some_and(|(m, _)| m.contains("No recent files")));
+    assert!(h.state().views.is_empty(), "and nothing opened");
+}
+
+#[test]
+fn the_longest_list_scrolls_in_the_smallest_window_down_to_clear() {
+    let files: Vec<String> = (0..50).map(|n| format!("{n}.pdf")).collect();
+    let mut h = Harness::builder().with_size(egui::vec2(1000.0, 520.0)).build_eframe({
+        let files = files.clone();
+        move |_cc| {
+            let mut app = app_with(&files.iter().map(String::as_str).collect::<Vec<_>>());
+            app.recent_limit = 50;
+            app.open_bytes("doc.pdf", None, PDF.to_vec()).unwrap();
+            app
+        }
+    });
+    h.run_steps(4);
+    support::open_menu(&mut h, "File");
+    support::menu_row(&h, "Open Recent").hover();
+    h.run_steps(3);
+    let foot = |h: &Harness<'static, PdfCraftApp>| support::menu_row(h, "Clear Recent Files").rect().max.y;
+    assert!(foot(&h) > 520.0, "fifty rows run past the smallest window");
+    support::menu_row(&h, "1.pdf").hover();
+    h.run_steps(2);
+    h.event(egui::Event::MouseWheel {
+        unit: egui::MouseWheelUnit::Point,
+        delta: egui::vec2(0.0, -5000.0),
+        phase: egui::TouchPhase::Move,
+        modifiers: egui::Modifiers::NONE,
+        source: egui::MouseWheelSource::Unknown,
+    });
+    h.run_steps(8);
+    assert!(foot(&h) <= 520.0, "the wheel brings the foot of the menu into view");
+    support::menu_row(&h, "Clear Recent Files").click();
+    h.run_steps(3);
+    assert!(h.state().recent.is_empty());
+}
+
+#[test]
+fn preferences_cuts_the_list_when_it_closes_and_not_before() {
+    let mut h = harness(12, &["first.pdf", "second.pdf", "third.pdf"]);
+    h.state_mut().dialog = Some(Dialog::Preferences);
+    h.run_steps(4);
+    type_limit(&mut h, "0");
+    assert_eq!(h.state().recent_limit, 0);
+    assert_eq!(h.state().recent.len(), 3, "0 on the way to another number forgets nothing");
+    assert!(h.query_by_label("first.pdf").is_none(), "though Home already leaves them out");
+    type_limit(&mut h, "2");
+    assert_eq!(h.state().recent.len(), 3);
+    h.get_by_label("OK").click();
+    h.run_steps(4);
+    assert_eq!(h.state().dialog, None);
+    assert_eq!(names(h.state()), ["first.pdf", "second.pdf"], "the newest two stay");
+}
+
+#[test]
+fn escape_closes_preferences_with_the_same_result_as_ok() {
+    let mut h = harness(12, &["first.pdf", "second.pdf"]);
+    h.state_mut().dialog = Some(Dialog::Preferences);
+    h.run_steps(4);
+    type_limit(&mut h, "1");
+    h.key_press(Key::Escape);
+    h.run_steps(4);
+    assert_eq!(h.state().dialog, None);
+    assert_eq!(names(h.state()), ["first.pdf"]);
+}
+
+#[test]
+fn the_field_does_not_go_past_fifty() {
+    let mut h = harness(12, &[]);
+    h.state_mut().dialog = Some(Dialog::Preferences);
+    h.run_steps(4);
+    type_limit(&mut h, "999");
+    assert_eq!(h.state().recent_limit, 50);
+}
+
+#[test]
+fn settings_saved_while_preferences_is_open_already_leave_the_rest_out() {
+    let mut app = app_with(&["first.pdf", "second.pdf"]);
+    app.recent_limit = 1;
+    let saved = app.persist();
+    assert!(saved.contains("first.pdf"));
+    assert!(!saved.contains("second.pdf"));
+}
+
+#[test]
+fn the_limit_is_saved_and_restored_and_cuts_a_longer_list() {
+    let dir = std::env::temp_dir().join(format!("pdfcraft-recent-limit-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let paths: Vec<String> = ["a.pdf", "b.pdf", "c.pdf"]
+        .iter()
+        .map(|n| {
+            let path = dir.join(n);
+            std::fs::write(&path, PDF).unwrap();
+            path.to_string_lossy().into_owned()
+        })
+        .collect();
+    let entries: Vec<RecentFile> = paths.iter().map(|p| RecentFile { name: "x.pdf".into(), path: p.clone(), pages: 1, size: 0 }).collect();
+    let json = serde_json::json!({ "recent": entries, "recent_limit": 2 }).to_string();
+    let mut restored = PdfCraftApp::new();
+    restored.restore(&json);
+    assert_eq!(restored.recent_limit, 2);
+    let kept: Vec<&str> = restored.recent.iter().map(|r| r.path.as_str()).collect();
+    assert_eq!(kept, [paths[0].as_str(), paths[1].as_str()]);
+    let mut again = PdfCraftApp::new();
+    again.restore(&restored.persist());
+    assert_eq!(again.recent_limit, 2);
+    assert_eq!(again.recent.len(), 2);
+    std::fs::remove_dir_all(&dir).unwrap();
+}
+
+/// #5682: restoring settings never asks the file system about recent files, which can block on a
+/// mount that has stopped answering. A gone file leaves the list once frames run, and a file that
+/// is there stays.
+#[test]
+fn restoring_settings_does_not_check_recent_files_and_a_frame_drops_the_gone_ones() {
+    let dir = std::env::temp_dir().join(format!("pdfcraft-recent-restore-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let here = dir.join("here.pdf");
+    std::fs::write(&here, PDF).unwrap();
+    let here = here.to_string_lossy().into_owned();
+    let gone = dir.join("gone.pdf").to_string_lossy().into_owned();
+    let entries: Vec<RecentFile> =
+        [&here, &gone].iter().map(|p| RecentFile { name: "x.pdf".into(), path: (*p).clone(), pages: 1, size: 0 }).collect();
+    let json = serde_json::json!({ "recent": entries }).to_string();
+
+    let mut restored = PdfCraftApp::new();
+    restored.restore(&json);
+    let paths: Vec<&str> = restored.recent.iter().map(|r| r.path.as_str()).collect();
+    assert_eq!(paths, [here.as_str(), gone.as_str()], "restoring keeps every entry without asking whether its file exists");
+
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 1600.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.run_inline = true;
+        app.restore(&json);
+        app
+    });
+    h.run_steps(2);
+    let paths: Vec<&str> = h.state().recent.iter().map(|r| r.path.as_str()).collect();
+    assert_eq!(paths, [here.as_str()], "the gone file leaves once the window is up");
+    std::fs::remove_dir_all(&dir).unwrap();
+}
+
+#[test]
+fn a_settings_file_can_not_ask_for_a_limit_that_is_not_one() {
+    for (saved, want) in [
+        ("{}", 12),
+        ("{\"recent_limit\": null}", 12),
+        ("{\"recent_limit\": \"3\"}", 12),
+        ("{\"recent_limit\": -1}", 12),
+        ("{\"recent_limit\": 2.5}", 12),
+        ("{\"recent_limit\": 0}", 0),
+        ("{\"recent_limit\": 50}", 50),
+        ("{\"recent_limit\": 51}", 50),
+        ("{\"recent_limit\": 18446744073709551615}", 50),
+    ] {
+        let mut app = PdfCraftApp::new();
+        app.restore(saved);
+        assert_eq!(app.recent_limit, want, "{saved}");
+    }
+}
+
+#[test]
+fn the_control_channel_sets_the_limit_and_refuses_what_it_can_not_be() {
+    let mut app = app_with(&["first.pdf", "second.pdf"]);
+    for bad in ["51", "-1", "x", "", "1.5"] {
+        let error = app.set_option("recent-files", bad).unwrap_err();
+        assert!(error.contains("between 0 and 50"), "{bad}: {error}");
+    }
+    assert_eq!((app.recent_limit, app.recent.len()), (12, 2), "a refused value changes nothing");
+    app.set_option("recent-files", "50").unwrap();
+    assert_eq!((app.recent_limit, app.recent.len()), (50, 2));
+    app.set_option("recent-files", "1").unwrap();
+    assert_eq!(names(&app), ["first.pdf"], "cut at once, with no dialog to wait for");
+    app.set_option("recent-files", "0").unwrap();
+    assert!(app.recent.is_empty());
+}
diff --git a/crates/ui-egui/tests/it/script_noop.rs b/crates/ui-egui/tests/it/script_noop.rs
new file mode 100644
index 0000000000..ba113e2a4c
--- /dev/null
+++ b/crates/ui-egui/tests/it/script_noop.rs
@@ -0,0 +1,80 @@
+//! A script button with no convertible characters must not rewrite hidden source text.
+use egui_kittest::{Harness, kittest::Queryable};
+use pdfcraft_render::{PageRenderer, RenderRequest};
+use pdfcraft_ui_egui::PdfCraftApp;
+use std::sync::Arc;
+
+fn hidden_text() -> Vec<u8> {
+    let body = "BT /F1 24 Tf 3 Tr 40 150 Td (QQQ) Tj ET";
+    let objects = [
+        "<< /Type /Catalog /Pages 2 0 R >>".to_owned(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_owned(),
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Resources << /Font << /F1 4 0 R >> >> /Contents 5 0 R >>".to_owned(),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".to_owned(),
+        format!("<< /Length {} >>\nstream\n{body}\nendstream", body.len()),
+    ];
+    let mut bytes = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, object) in objects.iter().enumerate() {
+        offsets.push(bytes.len());
+        bytes.extend_from_slice(format!("{} 0 obj\n{object}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = bytes.len();
+    bytes.extend_from_slice(b"xref\n0 6\n0000000000 65535 f \n");
+    for offset in offsets {
+        bytes.extend_from_slice(format!("{offset:010} 00000 n \n").as_bytes());
+    }
+    bytes.extend_from_slice(format!("trailer\n<< /Size 6 /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n").as_bytes());
+    bytes
+}
+
+fn pixels(bytes: Arc<Vec<u8>>) -> Vec<u8> {
+    let mut renderer = PageRenderer::new(bytes, Default::default());
+    let rendered = renderer.render(RenderRequest { page: 0, scale: 1.0, ..Default::default() });
+    assert!(rendered.error.is_none(), "{:?}", rendered.error);
+    rendered.rgba.to_vec()
+}
+
+#[test]
+fn unsupported_script_buttons_leave_hidden_text_bytes_history_and_saved_pixels_unchanged() {
+    for button in ["Superscript", "Subscript"] {
+        let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_| {
+            let mut app = PdfCraftApp::new();
+            app.set_option("language", "en").unwrap();
+            app.open_bytes("hidden.pdf", None, hidden_text()).unwrap();
+            app
+        });
+        h.run_steps(4);
+        assert!(h.state_mut().execute("edit.edit_text"));
+        h.run_steps(3);
+        let id = h.state().views[0].id;
+        let block = h.state().session.get(id).unwrap().text_blocks(0).remove(0);
+        assert_eq!(block.text, "QQQ");
+        let page = h.state().views[0].page_screen_rect(0).unwrap();
+        let x = (block.rect[0] + block.rect[2]) as f32 / 2.0;
+        let y = (block.rect[1] + block.rect[3]) as f32 / 2.0;
+        let at = egui::pos2(page.left() + x / 300.0 * page.width(), page.top() + (300.0 - y) / 300.0 * page.height());
+        h.hover_at(at);
+        h.run_steps(1);
+        h.drag_at(at);
+        h.run_steps(1);
+        h.drop_at(at);
+        h.run_steps(3);
+        let editor = h.state_mut().views[0].line_editor.as_mut().expect("hidden text editor opens");
+        editor.selection = Some(1..2);
+        editor.focus = true;
+        h.run_steps(1);
+        let before = h.state().session.get(id).unwrap().bytes.clone();
+        assert!(h.state().session.get(id).unwrap().can_undo().is_none());
+        h.get_by_label(button).click();
+        h.run_steps(4);
+        let saved = h.state_mut().session.save_bytes(id).unwrap();
+        assert_eq!(pixels(saved.clone()), pixels(before.clone()), "{button} must preserve hidden text after saving");
+        let doc = h.state().session.get(id).unwrap();
+        assert_eq!(doc.bytes.as_ref(), before.as_ref(), "no conversion must leave source bytes untouched");
+        assert!(doc.can_undo().is_none(), "no conversion must not create an edit");
+        let mut reopened = PdfCraftApp::new();
+        reopened.open_bytes("reopened.pdf", None, saved.as_ref().clone()).unwrap();
+        assert_eq!(reopened.session.get(reopened.views[0].id).unwrap().text_blocks(0)[0].text, "QQQ");
+    }
+}
diff --git a/crates/ui-egui/tests/it/side_panels.rs b/crates/ui-egui/tests/it/side_panels.rs
index 2436d41b61..d61187c143 100644
--- a/crates/ui-egui/tests/it/side_panels.rs
+++ b/crates/ui-egui/tests/it/side_panels.rs
@@ -15,8 +15,8 @@ trailer << /Root 1 0 R >>
 const WIDTH: f32 = 1400.0;
 const NO_BOOKMARKS: &str = "This document has no bookmarks.";
 
-fn harness(setup: impl FnOnce(&mut PdfCraftApp) + 'static) -> Harness<'static, PdfCraftApp> {
-    let mut h = Harness::builder().with_size(egui::vec2(WIDTH, 900.0)).build_eframe(move |_cc| {
+fn harness_sized(size: egui::Vec2, setup: impl FnOnce(&mut PdfCraftApp) + 'static) -> Harness<'static, PdfCraftApp> {
+    let mut h = Harness::builder().with_size(size).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
         app.set_option("language", "en").unwrap();
         app.open_bytes("doc.pdf", None, FIXTURE.to_vec()).unwrap();
@@ -27,6 +27,10 @@ fn harness(setup: impl FnOnce(&mut PdfCraftApp) + 'static) -> Harness<'static, P
     h
 }
 
+fn harness(setup: impl FnOnce(&mut PdfCraftApp) + 'static) -> Harness<'static, PdfCraftApp> {
+    harness_sized(egui::vec2(WIDTH, 900.0), setup)
+}
+
 fn rail(h: &Harness<'static, PdfCraftApp>) -> egui::Rect {
     h.get_by_role_and_label(Role::Button, "Bookmarks").rect()
 }
@@ -83,11 +87,11 @@ fn a_dragged_width_is_remembered_across_restarts() {
     // The side panel's resize edge: the one right of the page, left of the panel's text.
     let edge = h
         .get_all_by_label("Resize panels")
-        .map(|n| n.rect().center())
+        .map(|n| n.rect().left_center())
         .filter(|c| c.x < side_left && c.x > WIDTH / 2.0)
         .min_by(|a, b| (side_left - a.x).total_cmp(&(side_left - b.x)))
         .expect("the side panel has a resize edge")
-        // The pane's half of the edge: the page, drawn after the panes, takes the other half.
+        // 2 pt inside the panel: the edge lies right of the border, clear of the page's scrollbar.
         + egui::vec2(2.0, 0.0);
     h.hover_at(edge);
     h.run_steps(1);
@@ -131,3 +135,146 @@ fn f4_toggles_the_side_panel_and_shift_f4_the_tools_panel() {
     h.run_steps(3);
     h.get_by_label("Expand all tools");
 }
+
+#[test]
+fn scrollbar_and_panel_resize_handle_do_not_collide_on_either_dock_side() {
+    // 1. Left docking: tools panel on the left (resize handle on the right, scrollbar on the right).
+    let mut h = harness_sized(egui::vec2(1200.0, 450.0), |app| {
+        app.all_tools_expanded = true;
+    });
+    h.run_steps(4);
+
+    let splitters: Vec<_> = h.get_all_by_label("Resize panels").collect();
+    assert!(!splitters.is_empty(), "Splitter handle should exist");
+    let splitter_rect = splitters[0].rect();
+
+    // Find the scrollbar belonging to the Tools panel (left side of the window).
+    let sb_node = h.get_all_by_role(Role::ScrollBar).find(|s| s.rect().max.x < 300.0).expect("Tools panel scrollbar should exist");
+    let sb_rect = sb_node.rect();
+
+    // The scrollbar must sit strictly inside the panel, with clear gutter before the splitter.
+    assert!(sb_rect.max.x < splitter_rect.min.x);
+    assert!(splitter_rect.min.x - sb_rect.max.x >= 12.0, "Gutter must be at least 12px");
+
+    // Hovering directly over the scrollbar must NOT trigger panel resize cursor.
+    for x in [sb_rect.min.x, sb_rect.center().x, sb_rect.max.x - 0.5] {
+        h.hover_at(egui::pos2(x, sb_rect.center().y));
+        h.run_steps(1);
+        let cursor = h.output().platform_output.cursor_icon;
+        assert_ne!(cursor, egui::CursorIcon::ResizeHorizontal, "Hovering scrollbar at x={x} should not trigger resize handle");
+    }
+
+    // Hovering directly on the splitter handle MUST trigger panel resize cursor.
+    h.hover_at(splitter_rect.center());
+    h.run_steps(1);
+    assert_eq!(h.output().platform_output.cursor_icon, egui::CursorIcon::ResizeHorizontal);
+
+    // Dragging the scrollbar down scrolls the content up without resizing the panel.
+    let initial_width = h.state().side_panels.tools_width;
+    let first_row_before = h.get_by_label("Edit a PDF").rect().top();
+    h.hover_at(sb_rect.center());
+    h.run_steps(1);
+    h.drag_at(sb_rect.center());
+    h.run_steps(1);
+    h.hover_at(sb_rect.center() + egui::vec2(0.0, 60.0));
+    h.run_steps(1);
+    h.drop_at(sb_rect.center() + egui::vec2(0.0, 60.0));
+    h.run_steps(2);
+    let first_row_after = h.get_by_label("Edit a PDF").rect().top();
+    assert!(first_row_after < first_row_before, "Content should scroll up when dragging scrollbar down");
+    assert_eq!(h.state().side_panels.tools_width, initial_width, "Dragging scrollbar must not resize the panel");
+
+    // Dragging the splitter smoothly resizes the panel.
+    h.hover_at(splitter_rect.center());
+    h.run_steps(1);
+    h.drag_at(splitter_rect.center());
+    h.run_steps(1);
+    h.hover_at(splitter_rect.center() + egui::vec2(40.0, 0.0));
+    h.run_steps(1);
+    h.drop_at(splitter_rect.center() + egui::vec2(40.0, 0.0));
+    h.run_steps(2);
+    let after_width = h.state().side_panels.tools_width;
+    assert!(after_width > initial_width);
+    assert!((after_width - (initial_width + 40.0)).abs() <= 5.0);
+
+    // 2. Right docking: tools panel on the right (resize handle on the left), next to the page's
+    // scrollbar (#5730).
+    let mut h_right = harness_sized(egui::vec2(1200.0, 450.0), |app| {
+        app.set_option("tools-side", "right").unwrap();
+        app.all_tools_expanded = true;
+    });
+    h_right.run_steps(4);
+
+    let splitters_right: Vec<_> = h_right.get_all_by_label("Resize panels").collect();
+    assert!(!splitters_right.is_empty());
+    let right_splitter_rect = splitters_right[0].rect();
+    let bars: Vec<egui::Rect> = h_right.get_all_by_role(Role::ScrollBar).map(|s| s.rect()).filter(|r| r.height() > 0.0).collect();
+    // The page's scrollbar ends where the pane begins; the pane's own one is at its far side.
+    let page_bar = bars
+        .iter()
+        .copied()
+        .filter(|r| r.min.x < right_splitter_rect.center().x)
+        .max_by(|a, b| a.max.x.total_cmp(&b.max.x))
+        .expect("the page has a scrollbar");
+    assert!(
+        (right_splitter_rect.center().x - page_bar.max.x).abs() < 6.0,
+        "the page's scrollbar is beside the edge: {page_bar:?} {right_splitter_rect:?}"
+    );
+    let tools_bar = bars.iter().copied().find(|r| r.min.x > right_splitter_rect.center().x).expect("Tools panel scrollbar should exist");
+    let initial_right_width = h_right.state().side_panels.tools_width;
+
+    // All of either scrollbar is the scrollbar, not the resize edge.
+    for bar in [page_bar, tools_bar] {
+        for x in [bar.min.x + 0.5, bar.center().x, bar.max.x - 0.5] {
+            h_right.hover_at(egui::pos2(x, bar.center().y));
+            h_right.run_steps(1);
+            let cursor = h_right.output().platform_output.cursor_icon;
+            assert_ne!(cursor, egui::CursorIcon::ResizeHorizontal, "Hovering scrollbar {bar:?} at x={x} should not trigger resize handle");
+        }
+    }
+
+    // Dragging either scrollbar by its right edge scrolls its content and leaves the width alone.
+    let drag = |h: &mut Harness<'static, PdfCraftApp>, at: egui::Pos2| {
+        h.hover_at(at);
+        h.run_steps(1);
+        h.drag_at(at);
+        h.run_steps(1);
+        h.hover_at(at + egui::vec2(0.0, 60.0));
+        h.run_steps(1);
+        h.drop_at(at + egui::vec2(0.0, 60.0));
+        h.run_steps(2);
+    };
+    let page_top = |h: &Harness<'static, PdfCraftApp>| h.state().views[0].page_screen_rect(0).expect("page on screen").min.y;
+    let before = page_top(&h_right);
+    drag(&mut h_right, egui::pos2(page_bar.max.x - 1.0, page_bar.center().y));
+    assert!(page_top(&h_right) < before, "dragging the page's scrollbar scrolls the page");
+    assert_eq!(h_right.state().side_panels.tools_width, initial_right_width, "Dragging scrollbar must not resize the panel");
+    let before = h_right.get_by_label("Edit a PDF").rect().top();
+    drag(&mut h_right, egui::pos2(tools_bar.max.x - 1.0, tools_bar.center().y));
+    assert!(h_right.get_by_label("Edit a PDF").rect().top() < before, "Content should scroll up when dragging scrollbar down");
+    assert_eq!(h_right.state().side_panels.tools_width, initial_right_width, "Dragging scrollbar must not resize the panel");
+
+    // Splitter is at the left boundary of the right-docked pane.
+    h_right.hover_at(right_splitter_rect.center());
+    h_right.run_steps(1);
+    assert_eq!(h_right.output().platform_output.cursor_icon, egui::CursorIcon::ResizeHorizontal);
+
+    // Dragging the splitter on right-docked pane smoothly resizes.
+    h_right.hover_at(right_splitter_rect.center());
+    h_right.run_steps(1);
+    h_right.drag_at(right_splitter_rect.center());
+    h_right.run_steps(1);
+    // Moving left increases width of right-docked pane
+    h_right.hover_at(right_splitter_rect.center() - egui::vec2(30.0, 0.0));
+    h_right.run_steps(1);
+    h_right.drop_at(right_splitter_rect.center() - egui::vec2(30.0, 0.0));
+    h_right.run_steps(2);
+    let after_right_width = h_right.state().side_panels.tools_width;
+    assert!(after_right_width > initial_right_width);
+    assert!((after_right_width - (initial_right_width + 30.0)).abs() <= 5.0);
+
+    // Inside the right-docked panel (e.g. 15px inside from the splitter), cursor is not resize.
+    h_right.hover_at(right_splitter_rect.center() + egui::vec2(15.0, 0.0));
+    h_right.run_steps(1);
+    assert_ne!(h_right.output().platform_output.cursor_icon, egui::CursorIcon::ResizeHorizontal);
+}
diff --git a/crates/ui-egui/tests/it/theme.rs b/crates/ui-egui/tests/it/theme.rs
index a02c5c05ca..1f2709cd56 100644
--- a/crates/ui-egui/tests/it/theme.rs
+++ b/crates/ui-egui/tests/it/theme.rs
@@ -242,11 +242,11 @@ fn preferences_theme_cards_and_use_system_setting_stay_in_sync() {
     assert_theme(&h, ThemePreference::System, ThemeKind::Dark);
     assert_eq!(mode_shown(&h), "Use system setting");
 
-    // The OS is dark: the Dark card's radio row picks Dark, and the combo box says so.
+    // The OS is dark: the Dark card picks Dark, and the combo box says so.
     // The cards sit below the fold of the Preferences scroll area at this window size.
-    h.get_by_label("Dark gray").scroll_to_me();
+    h.get_by_label("Dark theme").scroll_to_me();
     h.run_steps(3);
-    h.get_by_label("Dark gray").click();
+    h.get_by_label("Dark theme").click();
     h.run_steps(3);
     assert_theme(&h, ThemePreference::Dark, ThemeKind::Dark);
     assert_eq!(mode_shown(&h), "Dark");
diff --git a/crates/ui-egui/tests/it/ui.rs b/crates/ui-egui/tests/it/ui.rs
index 69be82e7a7..0dc431344e 100644
--- a/crates/ui-egui/tests/it/ui.rs
+++ b/crates/ui-egui/tests/it/ui.rs
@@ -346,6 +346,30 @@ fn closed_right_panel_stays_closed_for_a_document_asking_for_its_outline() {
     assert_eq!(h.state().right, None, "the closed right panel reopened after a restart");
 }
 
+#[test]
+fn navigation_rail_toggles_between_right_and_left_and_persists() {
+    use pdfcraft_ui_egui::Dialog;
+
+    let mut h = harness(|app| app.open_bytes("fixture.pdf", None, FIXTURE.to_vec()).expect("fixture opens"));
+    assert_eq!(h.state().side_panels.rail_side, pdfcraft_ui_egui::side_panels::ToolsSide::Right);
+    h.get_by_label("Dock navigation rail on Left").click();
+    h.run_steps(3);
+    assert_eq!(h.state().side_panels.rail_side, pdfcraft_ui_egui::side_panels::ToolsSide::Left);
+    let saved = h.state().persist();
+    let mut h2 = harness(move |app| {
+        app.restore(&saved);
+    });
+    assert_eq!(h2.state().side_panels.rail_side, pdfcraft_ui_egui::side_panels::ToolsSide::Left);
+    h2.state_mut().dialog = Some(Dialog::Preferences);
+    h2.run_steps(3);
+    h2.get_by_label("Navigation rail side: Right").click();
+    h2.run_steps(3);
+    assert_eq!(h2.state().side_panels.rail_side, pdfcraft_ui_egui::side_panels::ToolsSide::Right);
+    h2.get_by_label("Navigation rail side: Left").click();
+    h2.run_steps(3);
+    assert_eq!(h2.state().side_panels.rail_side, pdfcraft_ui_egui::side_panels::ToolsSide::Left);
+}
+
 /// Read mode hides the tools, not the navigation panes: the rail's Bookmarks button opens the
 /// bookmarks when Read is the default workspace (#932), and the left tool pane stays hidden.
 #[test]
@@ -1696,36 +1720,53 @@ fn the_edit_panel_keeps_the_add_update_remove_menu() {
 /// being drawn under the page number field.
 #[test]
 fn short_window_rail_buttons_scroll_clear_of_page_navigation() {
-    let (width, height) = (1000.0, 560.0);
-    let mut h = Harness::builder().with_size(egui::vec2(width, height)).build_eframe(|_cc| {
-        let mut app = PdfCraftApp::new();
-        app.set_option("language", "en").unwrap();
-        app.open_bytes("short.pdf", None, FIXTURE.to_vec()).unwrap();
-        app
-    });
-    crate::support::settle(&mut h);
-    let rail = |h: &Harness<'static, PdfCraftApp>, label: &str| {
-        h.query_all_by_label(label).map(|n| n.rect()).find(|r| r.left() >= width - 48.0).unwrap_or_else(|| panic!("{label} in the rail"))
-    };
-    let page = h.get(By::new().role(egui::accesskit::Role::TextInput).value("1")).rect();
-    assert!(page.left() >= width - 48.0 && page.bottom() <= height, "page field {page:?} in the rail");
-    assert!(rail(&h, "Comments").bottom() <= page.top(), "the first button sits above the page field");
-    assert!(rail(&h, "Tags").top() >= page.top(), "the window is short enough that the buttons must scroll");
-    let over = rail(&h, "Comments").center();
-    h.event(egui::Event::PointerMoved(over));
-    for _ in 0..8 {
-        h.event(egui::Event::MouseWheel {
-            unit: egui::MouseWheelUnit::Point,
-            delta: egui::vec2(0.0, -200.0),
-            phase: egui::TouchPhase::Move,
-            modifiers: egui::Modifiers::NONE,
-            source: egui::MouseWheelSource::Unknown,
+    use pdfcraft_ui_egui::side_panels::ToolsSide;
+
+    for side in [ToolsSide::Right, ToolsSide::Left] {
+        let (width, height) = (1000.0, 560.0);
+        let mut h = Harness::builder().with_size(egui::vec2(width, height)).build_eframe(move |_cc| {
+            let mut app = PdfCraftApp::new();
+            app.set_option("language", "en").unwrap();
+            app.side_panels.rail_side = side;
+            app.open_bytes("short.pdf", None, FIXTURE.to_vec()).unwrap();
+            app
         });
-        h.run_steps(4);
+        crate::support::settle(&mut h);
+        let in_rail = |r: egui::Rect| match side {
+            ToolsSide::Left => r.right() <= 48.0,
+            ToolsSide::Right => r.left() >= width - 48.0,
+        };
+        let rail = |h: &Harness<'static, PdfCraftApp>, label: &str| {
+            h.query_all_by_label(label).map(|n| n.rect()).find(|r| in_rail(*r)).unwrap_or_else(|| panic!("{label} in the rail"))
+        };
+        let page = h.get(By::new().role(egui::accesskit::Role::TextInput).value("1")).rect();
+        assert!(in_rail(page) && page.bottom() <= height, "page field {page:?} in the rail");
+        let dock_label = match side {
+            ToolsSide::Right => "Dock navigation rail on Left",
+            ToolsSide::Left => "Dock navigation rail on Right",
+        };
+        let dock = rail(&h, dock_label);
+        assert!(dock.top() >= page.bottom() && dock.bottom() <= height, "dock button {dock:?} stays below navigation and inside the window");
+        assert!(rail(&h, "Comments").bottom() <= page.top(), "the first button sits above the page field");
+        assert!(rail(&h, "Tags").top() >= page.top(), "the window is short enough that the buttons must scroll");
+        let first = rail(&h, "Comments");
+        let over = first.center();
+        h.event(egui::Event::PointerMoved(over));
+        for _ in 0..8 {
+            h.event(egui::Event::MouseWheel {
+                unit: egui::MouseWheelUnit::Point,
+                delta: egui::vec2(0.0, -200.0),
+                phase: egui::TouchPhase::Move,
+                modifiers: egui::Modifiers::NONE,
+                source: egui::MouseWheelSource::Unknown,
+            });
+            h.run_steps(4);
+        }
+        let tags = rail(&h, "Tags");
+        assert!(tags.top() >= first.top(), "Tags {tags:?} is fully visible in the scrolling area");
+        assert!(tags.bottom() <= page.top(), "Tags {tags:?} scrolls into view above the page field {page:?}");
+        assert_eq!(h.get(By::new().role(egui::accesskit::Role::TextInput).value("1")).rect(), page, "navigation stays put");
     }
-    let tags = rail(&h, "Tags");
-    assert!(tags.bottom() <= page.top(), "Tags {tags:?} scrolls into view above the page field {page:?}");
-    assert_eq!(h.get(By::new().role(egui::accesskit::Role::TextInput).value("1")).rect(), page, "navigation stays put");
 }
 
 /// A PDF with `n` empty 200×300 pt pages.
diff --git a/crates/ui-egui/tests/it/view.rs b/crates/ui-egui/tests/it/view.rs
index aef5ddae73..0e9443bf51 100644
--- a/crates/ui-egui/tests/it/view.rs
+++ b/crates/ui-egui/tests/it/view.rs
@@ -520,6 +520,98 @@ fn single_page_swipe_that_reaches_the_edge_does_not_turn_but_a_fresh_one_does()
     );
 }
 
+#[test]
+fn single_page_wheel_at_last_page_bottom_edge_can_scroll_back_up() {
+    let mut h = harness_stepping(1.0 / 60.0, &[("layout", "single"), ("zoom", "200")]);
+    h.state_mut().views[0].go_to_page(2); // Go to last page of PAGES (3 pages)
+    h.run_steps(20);
+    let at = h.state().views[0].viewport_rect().center();
+    h.hover_at(at);
+    h.run_steps(4);
+
+    // Scroll to the bottom edge of page 3
+    let mut notches = 0;
+    let mut last = rect(&h, 2).expect("page 3 on screen").min.y;
+    let mut at_bottom = false;
+    while notches < 80 {
+        h.event(wheel(MouseWheelUnit::Line, -1.0, TouchPhase::Move));
+        h.run_steps(12);
+        notches += 1;
+        if let Some(r) = rect(&h, 2) {
+            if (r.min.y - last).abs() < 0.01 {
+                at_bottom = true;
+                break;
+            }
+            last = r.min.y;
+        }
+    }
+    assert!(at_bottom, "reached bottom edge of last page");
+    assert_eq!(h.state().views[0].current, 2, "remains on page 3");
+
+    // Push the wheel further against the bottom edge (cannot turn because it's the last page)
+    for _ in 0..5 {
+        h.event(wheel(MouseWheelUnit::Line, -1.0, TouchPhase::Move));
+        h.run_steps(12);
+    }
+    let bottom_y = rect(&h, 2).expect("page 3 on screen").min.y;
+
+    // Roll the wheel back up: the page must move away from the bottom edge (#5713)
+    h.event(wheel(MouseWheelUnit::Line, 1.0, TouchPhase::Move));
+    h.run_steps(12);
+    let after_up_y = rect(&h, 2).expect("page 3 on screen").min.y;
+    assert!(after_up_y > bottom_y, "scrolling up moves the page away from the bottom edge: {after_up_y} > {bottom_y}");
+}
+
+/// One notch of a mouse wheel that macOS reports in points (a Logitech mouse sends about 14).
+const POINT_NOTCH: f32 = 14.0;
+
+#[test]
+fn single_page_point_notches_pan_the_page_a_notch_turned_to() {
+    let mut h = harness_stepping(1.0 / 60.0, &[("layout", "single"), ("zoom", "200")]);
+    let at = h.state().views[0].viewport_rect().center();
+    h.hover_at(at);
+    h.run_steps(20);
+    for _ in 0..120 {
+        h.event(wheel(MouseWheelUnit::Point, -POINT_NOTCH, TouchPhase::Move));
+        h.run_steps(12);
+        if h.state().views[0].current == 1 {
+            break;
+        }
+    }
+    assert_eq!(h.state().views[0].current, 1, "notches pan page 1, then turn to page 2");
+    h.run_steps(20);
+    let top = rect(&h, 1).expect("page 2 on screen").min.y;
+    for _ in 0..3 {
+        h.event(wheel(MouseWheelUnit::Point, -POINT_NOTCH, TouchPhase::Move));
+        h.run_steps(12);
+    }
+    let after = rect(&h, 1).expect("page 2 on screen").min.y;
+    assert!(after < top, "notches pan page 2 down after the turn (#5713): {after} < {top}");
+}
+
+#[test]
+fn single_page_point_notches_scroll_back_up_from_the_last_page_bottom() {
+    let mut h = harness_stepping(1.0 / 60.0, &[("layout", "single"), ("zoom", "200")]);
+    h.state_mut().views[0].go_to_page(2);
+    h.run_steps(20);
+    let at = h.state().views[0].viewport_rect().center();
+    h.hover_at(at);
+    h.run_steps(4);
+    // Past the bottom: the extra notches push against the last page's edge.
+    for _ in 0..200 {
+        h.event(wheel(MouseWheelUnit::Point, -POINT_NOTCH, TouchPhase::Move));
+        h.run_steps(12);
+    }
+    assert_eq!(h.state().views[0].current, 2, "stays on the last page");
+    let bottom = rect(&h, 2).expect("page 3 on screen").min.y;
+    for _ in 0..3 {
+        h.event(wheel(MouseWheelUnit::Point, POINT_NOTCH, TouchPhase::Move));
+        h.run_steps(12);
+    }
+    let after = rect(&h, 2).expect("page 3 on screen").min.y;
+    assert!(after > bottom + 1.0, "notches scroll back up from the last page's bottom (#5713): {after} > {bottom}");
+}
+
 #[test]
 fn stepping_past_either_end_leaves_the_view_alone() {
     // Paging on past the first or last page must not jump the page back to its top.
@@ -1909,7 +2001,8 @@ fn sidebar_collapse_and_resize_preserves_scroll_position() {
     let rect_after = v.page_screen_rect(2).expect("page 2 still on screen");
     let vp_after = v.viewport_rect();
     let rel_y_after = rect_after.min.y - vp_after.min.y;
-    assert!((rel_y_after - rel_y_before).abs() < 1.0, "page 2 scroll position preserved: before {rel_y_before}, after {rel_y_after}");
+    // Page rectangles snap to whole pixels, so a different width can move the page by one.
+    assert!((rel_y_after - rel_y_before).abs() <= 1.0, "page 2 scroll position preserved: before {rel_y_before}, after {rel_y_after}");
 
     // Reopen bookmarks panel: available width decreases, so fit-width zoom decreases.
     h.state_mut().set_option("panel", "bookmarks").unwrap();
@@ -1926,7 +2019,10 @@ fn sidebar_collapse_and_resize_preserves_scroll_position() {
     let rect_reopened = v.page_screen_rect(2).expect("page 2 still on screen");
     let vp_reopened = v.viewport_rect();
     let rel_y_reopened = rect_reopened.min.y - vp_reopened.min.y;
-    assert!((rel_y_reopened - rel_y_before).abs() < 1.0, "page 2 scroll position preserved on reopen: before {rel_y_before}, after {rel_y_reopened}");
+    assert!(
+        (rel_y_reopened - rel_y_before).abs() <= 1.0,
+        "page 2 scroll position preserved on reopen: before {rel_y_before}, after {rel_y_reopened}"
+    );
 }
 
 /// Synthetic unequal-height spreads, generated without font or image assets.
@@ -2072,7 +2168,11 @@ fn long_view_menu_fits_a_short_window() {
     assert!(after <= 400.0, "the menu scrolls Side panels into view: {after}");
     crate::support::menu_row(&h, "Side panels").hover();
     h.run_steps(4);
-    h.get_all_by_label("Bookmarks").last().unwrap().click();
+    // The navigation rail has a Bookmarks button too; click the submenu's radio item.
+    let bookmarks = h.get_by(|n| n.role() == egui::accesskit::Role::MenuItemRadio && n.label().as_deref() == Some("Bookmarks"));
+    let row = bookmarks.rect();
+    assert!(row.top() >= 0.0 && row.bottom() <= 400.0, "the Bookmarks submenu row is onscreen: {row:?}");
+    bookmarks.click();
     h.run_steps(4);
     assert_eq!(h.state().right, Some(pdfcraft_ui_egui::RightPanel::Bookmarks));
 }
diff --git a/crates/ui-egui/tests/it/viewer.rs b/crates/ui-egui/tests/it/viewer.rs
index 3d824b9ea1..6f7d3d3cc8 100644
--- a/crates/ui-egui/tests/it/viewer.rs
+++ b/crates/ui-egui/tests/it/viewer.rs
@@ -1838,6 +1838,22 @@ fn the_scroll_speed_preference_scales_mouse_wheel_notches() {
     assert_eq!(again.scroll_speed, ScrollSpeed::Fast);
 }
 
+#[test]
+fn the_invert_middle_drag_preference_is_off_by_default_and_kept_in_the_settings() {
+    let mut app = PdfCraftApp::new();
+    assert!(!app.invert_middle_drag, "the middle button keeps its direction unless asked");
+    app.set_option("invert_middle_drag", "true").unwrap();
+    assert!(app.set_option("invert_middle_drag", "yes").unwrap_err().contains("true or false"));
+    let mut again = PdfCraftApp::new();
+    again.restore(&app.persist());
+    assert!(again.invert_middle_drag, "turned on, it survives a restart");
+    again.set_option("invert_middle_drag", "false").unwrap();
+    let mut off = PdfCraftApp::new();
+    off.invert_middle_drag = true;
+    off.restore(&again.persist());
+    assert!(!off.invert_middle_drag, "turned off, that is saved too");
+}
+
 /// A 40 × 30 picture (one red corner) and a harness showing a PDF of it.
 fn picture_harness() -> (image::RgbaImage, Harness<'static, PdfCraftApp>) {
     picture_harness_sized(egui::vec2(1400.0, 900.0))
diff --git a/crates/ui-egui/tests/page_shadows.rs b/crates/ui-egui/tests/page_shadows.rs
new file mode 100644
index 0000000000..a83fa6ce05
--- /dev/null
+++ b/crates/ui-egui/tests/page_shadows.rs
@@ -0,0 +1,353 @@
+//! Decorative page shadows are app preferences, never PDF edits.
+
+use egui_kittest::{Harness, kittest::Queryable};
+use pdfcraft_ui_egui::PdfCraftApp;
+
+#[test]
+fn viewer_shadows_follow_the_preference_without_moving_pages() {
+    for theme in ["light", "dark"] {
+        for layout in ["single", "two-page", "continuous", "two-up"] {
+            let mut h = harness(theme);
+            h.state_mut().set_option("layout", layout).unwrap();
+            h.run_steps(3);
+            let rectangles = h.state().views[0].visible_page_rects().to_vec();
+            let original = shadows(&h, false);
+            assert!(!original.is_empty(), "{theme} {layout}");
+            h.state_mut().set_option("show_page_edge_shadows", "false").unwrap();
+            h.run_steps(2);
+            assert!(shadows(&h, false).is_empty(), "{theme} {layout}");
+            assert_eq!(h.state().views[0].visible_page_rects(), rectangles);
+            h.state_mut().set_option("zoom", "125").unwrap();
+            h.state_mut().set_option("page", "2").unwrap();
+            h.run_steps(3);
+            assert!(shadows(&h, false).is_empty());
+            h.state_mut().set_option("show_page_edge_shadows", "true").unwrap();
+            h.run_steps(2);
+            assert!(!shadows(&h, false).is_empty());
+        }
+    }
+}
+
+#[test]
+fn viewport_fades_follow_the_preference_and_keep_other_scroll_areas_styled() {
+    for theme in ["light", "dark"] {
+        for organize in [false, true] {
+            let mut h = harness(theme);
+            if organize {
+                h.state_mut().set_option("organize", "on").unwrap();
+                // Make the three-page grid overflow vertically.
+                h.state_mut().set_option("grid-zoom", "300").unwrap();
+            }
+            h.run_steps(4);
+            let original_style = h.ctx.global_style().spacing.scroll.fade;
+            assert!(original_style.strength > 0.0);
+            assert!(!viewport_fades(&h).is_empty(), "bottom fade at start: {theme}, organize={organize}");
+            scroll_down(&mut h, 100.0);
+            let original = viewport_fades(&h);
+            let viewport = h.state().views[0].viewport_rect();
+            assert!(original.iter().any(|r| (r.top() - viewport.top()).abs() < 2.0), "top fade: {original:?}");
+            assert!(original.iter().any(|r| (r.bottom() - viewport.bottom()).abs() < 2.0), "bottom fade: {original:?}");
+            let pages = h.state().views[0].visible_page_rects().to_vec();
+            h.state_mut().set_option("show_page_edge_shadows", "false").unwrap();
+            h.run_steps(2);
+            assert!(viewport_fades(&h).is_empty(), "viewport fades remain: {theme}, organize={organize}");
+            assert_eq!(h.state().views[0].visible_page_rects(), pages);
+            assert_eq!(h.ctx.global_style().spacing.scroll.fade, original_style);
+            h.state_mut().set_option("show_page_edge_shadows", "true").unwrap();
+            h.run_steps(2);
+            assert_eq!(viewport_fades(&h), original);
+            scroll_down(&mut h, 100_000.0);
+            let at_end = viewport_fades(&h);
+            assert!(at_end.iter().any(|r| (r.top() - viewport.top()).abs() < 2.0));
+            assert!(!at_end.iter().any(|r| (r.bottom() - viewport.bottom()).abs() < 2.0), "no bottom fade at the end");
+        }
+    }
+}
+
+#[test]
+fn horizontal_viewport_fades_also_follow_the_preference() {
+    let mut h = harness("dark");
+    h.state_mut().set_option("zoom", "400").unwrap();
+    h.run_steps(4);
+    let viewport = h.state().views[0].viewport_rect();
+    let horizontal: Vec<_> = viewport_fades(&h).into_iter().filter(|r| r.width() <= 21.0).collect();
+    assert!(horizontal.iter().any(|r| (r.left() - viewport.left()).abs() < 2.0), "left fade: {horizontal:?}");
+    assert!(horizontal.iter().any(|r| (r.right() - viewport.right()).abs() < 2.0), "right fade: {horizontal:?}");
+    let pages = h.state().views[0].visible_page_rects().to_vec();
+    h.state_mut().set_option("show_page_edge_shadows", "false").unwrap();
+    h.run_steps(2);
+    assert!(viewport_fades(&h).is_empty());
+    assert_eq!(h.state().views[0].visible_page_rects(), pages);
+}
+
+fn scroll_down(h: &mut Harness<'static, PdfCraftApp>, points: f32) {
+    h.hover_at(h.state().views[0].viewport_rect().center());
+    h.run_steps(1);
+    h.event(egui::Event::MouseWheel {
+        unit: egui::MouseWheelUnit::Point,
+        delta: egui::vec2(0.0, -points),
+        phase: egui::TouchPhase::Move,
+        modifiers: egui::Modifiers::NONE,
+        source: egui::MouseWheelSource::Unknown,
+    });
+    h.run_steps(12);
+}
+
+/// Inspect the actual egui painter output: untextured four-vertex gradients
+/// with a transparent edge, spanning one dimension of the document viewport.
+fn viewport_fades(h: &Harness<'static, PdfCraftApp>) -> Vec<egui::Rect> {
+    let viewport = h.state().views[0].viewport_rect();
+    h.output()
+        .shapes
+        .iter()
+        .filter_map(|s| {
+            let egui::Shape::Mesh(mesh) = &s.shape else { return None };
+            if mesh.texture_id != egui::TextureId::default() || mesh.vertices.len() != 4 || mesh.indices.len() != 6 {
+                return None;
+            }
+            let rect = mesh.calc_bounds();
+            let transparent = mesh.vertices.iter().filter(|v| v.color == egui::Color32::TRANSPARENT).count();
+            (transparent == 2
+                && (((rect.width() - viewport.width()).abs() < 2.0 && rect.height() <= 21.0)
+                    || ((rect.height() - viewport.height()).abs() < 2.0 && rect.width() <= 21.0))
+                && rect.intersects(viewport))
+            .then_some(rect)
+        })
+        .collect()
+}
+
+#[test]
+fn organize_shadows_follow_the_preference() {
+    for theme in ["light", "dark"] {
+        let mut h = harness(theme);
+        h.state_mut().set_option("organize", "on").unwrap();
+        h.run_steps(3);
+        let original = shadows(&h, true);
+        assert_eq!(original.len(), 3);
+        h.state_mut().set_option("show_page_edge_shadows", "false").unwrap();
+        h.run_steps(2);
+        assert!(shadows(&h, true).is_empty());
+        h.state_mut().set_option("show_page_edge_shadows", "true").unwrap();
+        h.run_steps(2);
+        assert_eq!(shadows(&h, true), original);
+    }
+}
+
+#[test]
+fn checkbox_and_multiple_documents_do_not_edit_pdf_state() {
+    let mut h = harness("light");
+    h.state_mut().open_bytes("second.pdf", None, pdf()).unwrap();
+    let ids: Vec<_> = h.state().views.iter().map(|v| v.id).collect();
+    h.state_mut().session.apply(ids[0], pdfcraft_engine::Edit::SetInfo { key: "Title".into(), value: "Keep existing edits".into() }).unwrap();
+    assert!(h.state().session.get(ids[0]).unwrap().dirty);
+    assert!(h.state().session.get(ids[0]).unwrap().can_undo().is_some());
+    let saved: Vec<_> = ids.iter().map(|id| h.state_mut().session.save_bytes(*id).unwrap()).collect();
+    let before: Vec<_> = h
+        .state()
+        .views
+        .iter()
+        .map(|v| {
+            let d = h.state().session.get(v.id).unwrap();
+            (
+                d.bytes.clone(),
+                d.dirty,
+                d.can_undo().map(str::to_owned),
+                d.can_redo().map(str::to_owned),
+                d.info.pages.iter().map(|p| (p.width, p.height, p.rotation)).collect::<Vec<_>>(),
+            )
+        })
+        .collect();
+    h.state_mut().set_option("dialog", "preferences").unwrap();
+    h.run_steps(3);
+    let checkbox = h.get_by_label("Show Page Edge Shadows");
+    checkbox.click();
+    h.run_steps(2);
+    assert_eq!(serde_json::from_str::<serde_json::Value>(&h.state().persist()).unwrap()["show_page_edge_shadows"], false);
+    h.get_by_label("Show Page Edge Shadows").focus();
+    h.key_press(egui::Key::Space);
+    h.run_steps(2);
+    assert_eq!(serde_json::from_str::<serde_json::Value>(&h.state().persist()).unwrap()["show_page_edge_shadows"], true);
+    let dialog_shadow = h.ctx.global_style().visuals.window_shadow;
+    assert_ne!(dialog_shadow, egui::Shadow::NONE);
+    h.state_mut().set_option("show_page_edge_shadows", "false").unwrap();
+    h.run_steps(2);
+    assert_eq!(h.ctx.global_style().visuals.window_shadow, dialog_shadow);
+    h.state_mut().set_option("dialog", "none").unwrap();
+    for tab in [0, 1] {
+        h.state_mut().active = Some(tab);
+        h.run_steps(2);
+        assert!(shadows(&h, false).is_empty());
+        let d = h.state().session.get(h.state().views[tab].id).unwrap();
+        assert_eq!(
+            (&d.bytes, d.dirty, d.can_undo(), d.can_redo()),
+            (&before[tab].0, before[tab].1, before[tab].2.as_deref(), before[tab].3.as_deref())
+        );
+        assert_eq!(d.info.pages.iter().map(|p| (p.width, p.height, p.rotation)).collect::<Vec<_>>(), before[tab].4);
+    }
+    for (id, bytes) in ids.iter().zip(&saved) {
+        assert_eq!(h.state_mut().session.save_bytes(*id).unwrap(), *bytes);
+    }
+    h.state_mut().open_bytes("new.pdf", None, pdf()).unwrap();
+    h.run_steps(2);
+    assert!(shadows(&h, false).is_empty());
+}
+
+#[test]
+fn rendered_page_content_is_identical_with_and_without_decoration() {
+    let mut h = harness("dark");
+    h.state_mut().set_option("panel", "pages").unwrap();
+    h.state_mut().set_option("zoom", "175").unwrap();
+    h.run_steps(3);
+    scroll_down(&mut h, 20.0);
+    for _ in 0..400 {
+        h.run_steps(2);
+        if !h.state().render_pending() {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    assert!(!h.state().render_pending(), "the actual PDF raster must be ready");
+    let rect = h.state().views[0].page_screen_rect(0).unwrap();
+    let fades = viewport_fades(&h);
+    assert_eq!(fades.iter().filter(|r| r.height() <= 21.0).count(), 2, "the screenshot comparison must contain both vertical fades");
+    let enabled = h.render().unwrap();
+    h.state_mut().set_option("show_page_edge_shadows", "false").unwrap();
+    h.run_steps(2);
+    let disabled = h.render().unwrap();
+    assert_eq!(h.state().views[0].page_screen_rect(0), Some(rect));
+    let viewport = h.state().views[0].viewport_rect();
+    assert!(viewport_fades(&h).is_empty());
+    // Only the painter's actual decorative fade strips may change over the page.
+    // All remaining artwork, annotation and form pixels must be identical.
+    for (_, page) in h.state().views[0].visible_page_rects() {
+        let visible = page.intersect(viewport).shrink(2.0);
+        if !visible.is_positive() {
+            continue;
+        }
+        for y in visible.top().ceil() as u32..visible.bottom().floor() as u32 {
+            for x in visible.left().ceil() as u32..visible.right().floor() as u32 {
+                if !fades.iter().any(|fade| fade.expand(1.0).contains(egui::pos2(x as f32, y as f32))) {
+                    assert_eq!(enabled.get_pixel(x, y), disabled.get_pixel(x, y), "page content at {x},{y}");
+                }
+            }
+        }
+    }
+    // The top overlaps the first page's blue artwork; the bottom overlaps the
+    // blank second page. Sample clear of the unchanged scrollbar at the edge.
+    let x = rect.intersect(viewport).center().x as u32;
+    for (y, expected) in [(viewport.top() + 8.0, [204, 230, 255, 255]), (viewport.bottom() - 10.0, [255, 255, 255, 255])] {
+        assert_eq!(disabled.get_pixel(x, y as u32).0, expected, "unobscured PDF at y={y}");
+        assert_ne!(enabled.get_pixel(x, y as u32).0, expected, "fade overlays the PDF at y={y}");
+    }
+    // The Pages sidebar, including its thumbnails and selection borders, is unaffected.
+    for y in 0..enabled.height() {
+        for x in (0..viewport.left().floor() as u32).chain(viewport.right().ceil() as u32..enabled.width()) {
+            assert_eq!(enabled.get_pixel(x, y), disabled.get_pixel(x, y), "sidebar at {x},{y}");
+        }
+    }
+    assert_ne!(enabled.as_raw(), disabled.as_raw(), "the decoration really changes the image");
+    if let Ok(directory) = std::env::var("PDFCRAFT_SHADOW_SCREENSHOTS") {
+        enabled.save(format!("{directory}/page-shadows-enabled.png")).unwrap();
+        disabled.save(format!("{directory}/page-shadows-disabled.png")).unwrap();
+    }
+}
+
+fn harness(theme: &str) -> Harness<'static, PdfCraftApp> {
+    let theme = theme.to_string();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_| {
+        let mut app = PdfCraftApp::new();
+        // Save comparisons must not depend on crossing a /ModDate second boundary.
+        app.session = app.session.with_clock(|| 1_700_000_000);
+        app.set_option("language", "en").unwrap();
+        app.set_option("theme", &theme).unwrap();
+        app.open_bytes("pages.pdf", None, pdf()).unwrap();
+        app.set_option("zoom", "100").unwrap();
+        app
+    });
+    h.run_steps(3);
+    h
+}
+
+fn shadows(h: &Harness<'static, PdfCraftApp>, grid: bool) -> Vec<egui::Rect> {
+    let color = pdfcraft_ui_egui::theme::Tokens::for_kind(h.state().theme).page_shadow;
+    fn collect(shape: &egui::Shape, color: egui::Color32, grid: bool, out: &mut Vec<egui::Rect>) {
+        match shape {
+            egui::Shape::Vec(shapes) => {
+                for s in shapes {
+                    collect(s, color, grid, out);
+                }
+            }
+            egui::Shape::Rect(r)
+                if r.fill == color
+                    && r.rect.width() > 20.0
+                    && r.rect.height() > 20.0
+                    && if grid {
+                        r.blur_width == 0.0 && r.corner_radius == egui::CornerRadius::same(1)
+                    } else {
+                        r.blur_width == 14.0 && r.corner_radius == egui::CornerRadius::ZERO
+                    } =>
+            {
+                out.push(r.rect)
+            }
+            _ => {}
+        }
+    }
+    let mut out = Vec::new();
+    for s in &h.output().shapes {
+        collect(&s.shape, color, grid, &mut out);
+    }
+    out
+}
+
+/// Synthetic pages include colored artwork, an annotation and a form field.
+fn pdf() -> Vec<u8> {
+    let objects = [
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [7 0 R] >> >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R 4 0 R 5 0 R] /Count 3 /MediaBox [0 0 300 400] >>".to_string(),
+        "<< /Type /Page /Parent 2 0 R /Contents 8 0 R /Annots [6 0 R 7 0 R] >>".to_string(),
+        "<< /Type /Page /Parent 2 0 R >>".to_string(),
+        "<< /Type /Page /Parent 2 0 R >>".to_string(),
+        "<< /Type /Annot /Subtype /Text /Rect [20 20 40 40] /Contents (Note) >>".to_string(),
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (field) /V (value) /Rect [50 50 100 70] /P 3 0 R >>".to_string(),
+        {
+            let body = "0.8 0.9 1 rg 0 0 300 400 re f 0.3 g 10 10 280 8 re f";
+            format!("<< /Length {} >>\nstream\n{body}\nendstream", body.len())
+        },
+    ];
+    let mut bytes = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, object) in objects.iter().enumerate() {
+        offsets.push(bytes.len());
+        bytes.extend_from_slice(format!("{} 0 obj\n{object}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = bytes.len();
+    bytes.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objects.len() + 1).as_bytes());
+    for offset in offsets {
+        bytes.extend_from_slice(format!("{offset:010} 00000 n \n").as_bytes());
+    }
+    bytes.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objects.len() + 1).as_bytes());
+    bytes
+}
+
+#[test]
+fn page_shadow_preference_round_trips_and_ignores_invalid_settings() {
+    let mut app = PdfCraftApp::new();
+    let enabled = |app: &PdfCraftApp| serde_json::from_str::<serde_json::Value>(&app.persist()).unwrap()["show_page_edge_shadows"].clone();
+    assert_eq!(enabled(&app), true);
+    app.restore("{}");
+    assert_eq!(enabled(&app), true);
+    for value in [false, true] {
+        app.set_option("show_page_edge_shadows", if value { "true" } else { "false" }).unwrap();
+        let mut restored = PdfCraftApp::new();
+        restored.restore(&app.persist());
+        assert_eq!(enabled(&restored), value);
+    }
+    for invalid in ["null", "0", "\"false\"", "[]", "{}"] {
+        app.restore(&format!("{{\"show_page_edge_shadows\":{invalid}}}"));
+        assert_eq!(enabled(&app), true);
+    }
+    app.restore("not json");
+    assert_eq!(enabled(&app), true);
+    assert!(app.set_option("show_page_edge_shadows", "maybe").is_err());
+    assert_eq!(enabled(&app), true);
+}
diff --git a/crates/xfa/README.md b/crates/xfa/README.md
index 2d08a74bb2..2ae840a8f0 100644
--- a/crates/xfa/README.md
+++ b/crates/xfa/README.md
@@ -32,7 +32,10 @@ that warning and keeps the existing layout and accepted widget values.
   page masters chosen by occurrence; a table's header row repeats after a break; presence
   `hidden` takes no space, `invisible` takes space; repeating subforms get their initial
   instances, in flowed content and in a top-to-bottom container inside positioned content (a
-  table in an area) alike; fields that compute the page number or count on layout show the numbers.
+  table in an area) alike; fields that compute the page number or count on layout show the numbers;
+  a draw placed by position turns about its anchor (`rotate`: degrees counter-clockwise, a multiple
+  of 90), as one item a page break doesn't cut, and its container grows to the box it stands in. A
+  field, a subform or a draw in a flow doesn't turn.
 - **PDF** (`pdf::write_form`): pages with content streams in the standard 14 fonts (Arial and
   friends → Helvetica, Courier New → Courier, serif faces → Times; nothing is embedded), JPEG
   XObjects, and widgets: text (multi-line, max length, alignment), date (Acrobat's `AFDate`
diff --git a/crates/xfa/src/layout.rs b/crates/xfa/src/layout.rs
index 73c6bde90f..eab26c6dd4 100644
--- a/crates/xfa/src/layout.rs
+++ b/crates/xfa/src/layout.rs
@@ -32,7 +32,7 @@ use common::collect_values;
 pub(crate) use common::date_pattern;
 pub use common::formatted_value;
 pub(crate) use items::UNDERLINE_DROP;
-pub use items::{Action, BorderShape, Form, Item, Page, Rounded, Widget, WidgetBorder, WidgetKind};
+pub use items::{Action, BorderShape, Form, Item, Page, Rounded, Turned, Widget, WidgetBorder, WidgetKind};
 
 /// Most pages a form may lay out to.
 pub const MAX_PAGES: usize = 500;
@@ -212,17 +212,22 @@ pub fn layout(tpl: &Template, data: Option<&DataNode>) -> Result<Form, XfaError>
     let total = l.pages.len();
     let count = total.to_string();
     for p in &mut l.pages {
-        for it in &mut p.items {
-            if let Item::Text(s) = it
-                && s.text.contains(PAGE_COUNT_MARK)
-            {
-                s.text = s.text.replace(PAGE_COUNT_MARK, &count);
-            }
-        }
+        fill_page_count(&mut p.items, &count);
     }
     Ok(Form { pages: l.pages, fields: l.fields, warnings: l.warnings })
 }
 
+/// Puts the page count, known once every page is, where `items` left room for it.
+fn fill_page_count(items: &mut [Item], count: &str) {
+    for it in items {
+        match it {
+            Item::Text(s) if s.text.contains(PAGE_COUNT_MARK) => s.text = s.text.replace(PAGE_COUNT_MARK, count),
+            Item::Turned(t) => fill_page_count(&mut t.items, count),
+            _ => {}
+        }
+    }
+}
+
 // Bytes of embedded field values copied out on this thread, for tests that bound layout work.
 #[cfg(test)]
 thread_local! {
diff --git a/crates/xfa/src/layout/common.rs b/crates/xfa/src/layout/common.rs
index 625f305a6b..54259ede47 100644
--- a/crates/xfa/src/layout/common.rs
+++ b/crates/xfa/src/layout/common.rs
@@ -51,6 +51,7 @@ pub(super) fn solid_extent(item: &Item) -> Option<(f64, f64)> {
         Item::Text(s) => Some((s.baseline - s.face.size * 0.8, s.baseline + s.face.size * 0.2)),
         Item::Image { rect, .. } => Some((rect.y, rect.bottom())),
         Item::Widget(w) => Some((w.rect.y, w.rect.bottom())),
+        Item::Turned(t) => Some(t.extent),
         Item::Fill { .. } | Item::Line { .. } | Item::Rounded(_) => None,
     }
 }
@@ -130,6 +131,11 @@ pub(super) fn moved(mut item: Item, dx: f64, dy: f64) -> Item {
             w.rect.x += dx;
             w.rect.y += dy;
         }
+        Item::Turned(t) => {
+            t.about = (t.about.0 + dx, t.about.1 + dy);
+            t.extent = (t.extent.0 + dy, t.extent.1 + dy);
+            t.items = std::mem::take(&mut t.items).into_iter().map(|i| moved(i, dx, dy)).collect();
+        }
     }
     item
 }
diff --git a/crates/xfa/src/layout/draw.rs b/crates/xfa/src/layout/draw.rs
index f6520c1628..02659c812e 100644
--- a/crates/xfa/src/layout/draw.rs
+++ b/crates/xfa/src/layout/draw.rs
@@ -1,5 +1,5 @@
 use super::common::clean_name;
-use super::items::{Item, Rounded};
+use super::items::{Item, Rounded, Turned};
 use super::{
     Arc, Border, Ctx, Draw, ExclGroup, Face, Font, Layout, Layouter, MAX_DEPTH, MAX_IMAGE_BYTES, Node, Para, Presence, Rect, SomIndices, Stroke,
     Subform, Value, XfaError, data_path, text,
@@ -35,7 +35,27 @@ impl Layouter<'_> {
         }
         let (w, h) = self.size_of(k, (inner.w - c.x.unwrap_or(0.0)).max(1.0), ctx, depth + 1);
         let (x, y) = c.top_left(w, h);
-        self.draw_node(k, Rect::new(inner.x + x, inner.y + y, w, h), ctx, depth + 1, sib)
+        let rect = Rect::new(inner.x + x, inner.y + y, w, h);
+        let start = self.item_count();
+        self.draw_node(k, rect, ctx, depth + 1, sib)?;
+        if c.rotate != 0 && matches!(k, Node::Draw(_)) {
+            let stands = k.standing_box(w, h);
+            let extent = (inner.y + stands.y, inner.y + stands.bottom());
+            self.turn(start, (inner.x + c.x.unwrap_or(0.0), inner.y + c.y.unwrap_or(0.0)), c.rotate, extent);
+        }
+        Ok(())
+    }
+
+    /// Turn the items the last page got since `start`, a draw, about `about`.
+    fn turn(&mut self, start: usize, about: (f64, f64), quarters: u8, extent: (f64, f64)) {
+        let Some(page) = self.pages.last_mut().filter(|p| start < p.items.len()) else { return };
+        let items = page.items.split_off(start);
+        page.items.push(Item::Turned(Box::new(Turned { about, quarters, extent, items })));
+        // One item now, kept whole by what it is: the record of its items, the last one kept,
+        // would fall on the next.
+        if self.leaves.last().is_some_and(|leaf| leaf.0 == start) {
+            self.leaves.pop();
+        }
     }
 
     pub(super) fn draw_node(&mut self, node: &Node, rect: Rect, ctx: &Ctx, depth: usize, sib: usize) -> Result<(), XfaError> {
diff --git a/crates/xfa/src/layout/items.rs b/crates/xfa/src/layout/items.rs
index 8a68388684..be9499cb84 100644
--- a/crates/xfa/src/layout/items.rs
+++ b/crates/xfa/src/layout/items.rs
@@ -27,6 +27,22 @@ pub enum Item {
         content_type: String,
     },
     Widget(Box<Widget>),
+    /// A draw turned about its anchor.
+    Turned(Box<Turned>),
+}
+
+/// A draw turned about its anchor ([`Item::Turned`]). It stays one item, so a page break doesn't
+/// cut it, and what it holds is written unturned under one matrix.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Turned {
+    /// The point it turns about.
+    pub about: (f64, f64),
+    /// Quarter turns counter-clockwise, 1 to 3.
+    pub quarters: u8,
+    /// Top and bottom of its box once turned.
+    pub extent: (f64, f64),
+    /// The draw as it stands before turning.
+    pub items: Vec<Item>,
 }
 
 /// A box with rounded corners ([`Item::Rounded`]).
diff --git a/crates/xfa/src/layout/measure.rs b/crates/xfa/src/layout/measure.rs
index 2fffb3dfa0..32250ab02f 100644
--- a/crates/xfa/src/layout/measure.rs
+++ b/crates/xfa/src/layout/measure.rs
@@ -141,7 +141,7 @@ impl Layouter<'_> {
             Layout::Positioned => visible
                 .map(|k| {
                     let (w, h) = self.size_of(k, avail_w, ctx, depth + 1);
-                    k.common().top_left(w, h).0 + w
+                    k.standing_box(w, h).right()
                 })
                 .fold(0.0, f64::max)
                 .min(avail_w),
@@ -297,7 +297,7 @@ impl Layouter<'_> {
             .map(|k| {
                 let c = k.common();
                 let (w, h) = self.size_of(k, (inner_w - c.x.unwrap_or(0.0)).max(1.0), ctx, depth + 1);
-                c.top_left(w, h).1 + h
+                k.standing_box(w, h).bottom()
             })
             .fold(0.0, f64::max)
     }
diff --git a/crates/xfa/src/model.rs b/crates/xfa/src/model.rs
index 0fac8db18e..23b685102c 100644
--- a/crates/xfa/src/model.rs
+++ b/crates/xfa/src/model.rs
@@ -334,6 +334,9 @@ pub struct Common {
     pub x: Option<f64>,
     pub y: Option<f64>,
     pub anchor: Anchor,
+    /// Quarter turns counter-clockwise about the anchor (`rotate`), 0 to 3. Only a draw placed by
+    /// position is turned.
+    pub rotate: u8,
     pub w: Option<f64>,
     pub h: Option<f64>,
     pub min_w: Option<f64>,
@@ -366,6 +369,26 @@ impl Common {
 }
 
 impl Node {
+    /// The box a positioned object of `w` by `h` stands in, in its parent: from `x`, `y` and the
+    /// anchor, and for a draw, the only object that turns, turned about the anchor.
+    pub fn standing_box(&self, w: f64, h: f64) -> Rect {
+        let c = self.common();
+        let (x, y) = c.top_left(w, h);
+        let upright = Rect::new(x, y, w, h);
+        if !matches!(self, Node::Draw(_)) {
+            return upright;
+        }
+        let (ax, ay) = (c.x.unwrap_or(0.0), c.y.unwrap_or(0.0));
+        let (left, top, right, bottom) = (x - ax, y - ay, x + w - ax, y + h - ay);
+        // Counter-clockwise on a page whose y grows down, from the anchor.
+        match c.rotate {
+            1 => Rect::new(ax + top, ay - right, h, w),
+            2 => Rect::new(ax - right, ay - bottom, w, h),
+            3 => Rect::new(ax - bottom, ay + left, h, w),
+            _ => upright,
+        }
+    }
+
     pub fn common(&self) -> &Common {
         match self {
             Node::Subform(s) => &s.common,
diff --git a/crates/xfa/src/parse.rs b/crates/xfa/src/parse.rs
index fc114aebac..9ca6a7f3cd 100644
--- a/crates/xfa/src/parse.rs
+++ b/crates/xfa/src/parse.rs
@@ -198,6 +198,16 @@ fn parse_para(n: Option<XmlNode>) -> ParaSpec {
     }
 }
 
+/// `rotate` as quarter turns (XFA 3.3: degrees counter-clockwise, a multiple of 90, `deg` optional):
+/// anything else leaves the object as it stands.
+fn quarter_turns(rotate: Option<&str>) -> u8 {
+    let degrees = rotate.map(str::trim).map(|v| v.strip_suffix("deg").unwrap_or(v).trim_end());
+    let turns = degrees.and_then(|v| v.parse::<f64>().ok()).map(|v| v.rem_euclid(360.0) / 90.0);
+    // Whole, which NaN and infinities aren't, and in range, so the cast is exact; a tiny negative
+    // angle rounds to a full turn.
+    turns.filter(|t| t.fract() == 0.0).map_or(0, |t| t as u8 % 4)
+}
+
 fn parse_common(n: XmlNode) -> Common {
     Common {
         name: n.attribute("name").map(str::to_string).filter(|s| !s.is_empty()),
@@ -205,6 +215,7 @@ fn parse_common(n: XmlNode) -> Common {
         x: attr_measure(n, "x"),
         y: attr_measure(n, "y"),
         anchor: Anchor::parse(n.attribute("anchorType")),
+        rotate: quarter_turns(n.attribute("rotate")),
         w: attr_measure(n, "w"),
         h: attr_measure(n, "h"),
         min_w: attr_measure(n, "minW"),
diff --git a/crates/xfa/src/pdf.rs b/crates/xfa/src/pdf.rs
index 0c21507abf..8e9b30c00d 100644
--- a/crates/xfa/src/pdf.rs
+++ b/crates/xfa/src/pdf.rs
@@ -8,7 +8,7 @@ use pdfcraft_cos::{Dict, Document, ObjRef, Object, PdfString, Stream};
 use pdfcraft_fonts::{literal, win_ansi};
 
 use crate::XfaError;
-use crate::layout::{Action, BorderShape, Form, Item, Page, Rounded, Widget, WidgetKind};
+use crate::layout::{Action, BorderShape, Form, Item, Page, Rounded, Turned, Widget, WidgetKind};
 use crate::model::Rect;
 use crate::text::{Face, Family, Span};
 
@@ -567,12 +567,30 @@ impl Emitter<'_> {
         let h = page.height;
         // The link the text before ended in, which a next piece of it on the line widens.
         let mut last_link: Option<LinkPiece> = None;
-        for (i, item) in page.items.iter().enumerate() {
+        let steps = steps(&page.items);
+        let mut turn = None;
+        for (i, step) in steps.iter().enumerate() {
+            let item = match step {
+                Step::Item(item) => *item,
+                Step::Turn(t) => {
+                    let matrix = turn_matrix(t, h);
+                    turn = Some(matrix);
+                    last_link = None;
+                    content.extend(format!("q {} cm\n", matrix.map(n).join(" ")).bytes());
+                    continue;
+                }
+                Step::EndTurn => {
+                    turn = None;
+                    last_link = None;
+                    content.extend_from_slice(b"Q\n");
+                    continue;
+                }
+            };
             // A link's pieces join only across text and the underline drawn just before it: a fill,
             // picture, field or any other line (a rule) between them ends the link there.
             let keeps_link = match item {
                 Item::Text(_) => true,
-                Item::Line { from, to, .. } => matches!(page.items.get(i + 1), Some(Item::Text(s))
+                Item::Line { from, to, .. } => matches!(steps.get(i + 1), Some(Step::Item(Item::Text(s)))
                     if (from.1 - to.1).abs() < 0.01
                         && (from.0 - s.x).abs() < 0.01
                         && (from.1 - (s.baseline + s.face.size * crate::layout::UNDERLINE_DROP)).abs() < 0.01),
@@ -627,7 +645,7 @@ impl Emitter<'_> {
                     );
                     content.extend(literal(&win_ansi(&s.text)));
                     content.extend_from_slice(format!(" Tj{close}\n").as_bytes());
-                    if let Some(r) = self.text_link(s, h, page_ref, &mut last_link)? {
+                    if let Some(r) = self.text_link(s, h, page_ref, &mut last_link, turn)? {
                         annots.push(Object::Ref(r));
                     }
                 }
@@ -637,6 +655,8 @@ impl Emitter<'_> {
                     xobjects.set(name.clone().into_bytes(), Object::Ref(r));
                     content.extend(format!("q {} 0 0 {} {} {} cm /{name} Do Q\n", n(rect.w), n(rect.h), n(rect.x), n(h - rect.bottom())).bytes());
                 }
+                // Opened out by `steps`.
+                Item::Turned(_) => {}
                 Item::Widget(w) => {
                     if let Some(r) = self.widget(w, page, page_ref)? {
                         annots.push(Object::Ref(r));
@@ -675,12 +695,25 @@ impl Emitter<'_> {
     /// A span that goes on the link `last` ended in, on the same line, widens that annotation
     /// instead (a link whose text changes style partway is one link). An address PdfCraft
     /// wouldn't open from a document leaves the text as plain text, with one warning for the form.
-    fn text_link(&mut self, s: &Span, page_height: f64, page_ref: ObjRef, last: &mut Option<LinkPiece>) -> Result<Option<ObjRef>, XfaError> {
+    fn text_link(
+        &mut self,
+        s: &Span,
+        page_height: f64,
+        page_ref: ObjRef,
+        last: &mut Option<LinkPiece>,
+        turn: Option<[f64; 6]>,
+    ) -> Result<Option<ObjRef>, XfaError> {
         let piece = self.link_piece(s, page_height);
-        let Some((target, rect)) = piece else {
+        let Some((target, mut rect)) = piece else {
             *last = None;
             return Ok(None);
         };
+        // Turned text is drawn by a matrix, and clicked where that puts it. Its pieces don't join:
+        // that goes by the line they stand on before turning.
+        if let Some(m) = turn {
+            rect = turned_rect(rect, m);
+            *last = None;
+        }
         if let Some(prev) = last.as_mut()
             && prev.uri == target
             && (prev.baseline - s.baseline).abs() < 0.01
@@ -765,6 +798,45 @@ fn write_button_action(action: Option<&Action>, d: &mut Dict) {
     }
 }
 
+/// What a page's content is written from: its items, with a turned draw opened out.
+enum Step<'a> {
+    Item(&'a Item),
+    Turn(&'a Turned),
+    EndTurn,
+}
+
+fn steps(items: &[Item]) -> Vec<Step<'_>> {
+    let mut out = Vec::with_capacity(items.len());
+    for item in items {
+        if let Item::Turned(t) = item {
+            out.push(Step::Turn(t));
+            out.extend(t.items.iter().map(Step::Item));
+            out.push(Step::EndTurn);
+        } else {
+            out.push(Step::Item(item));
+        }
+    }
+    out
+}
+
+/// The matrix that turns `t` about its point, on a page `page_height` tall.
+fn turn_matrix(t: &Turned, page_height: f64) -> [f64; 6] {
+    let (cos, sin) = match t.quarters {
+        1 => (0.0, 1.0),
+        2 => (-1.0, 0.0),
+        _ => (0.0, -1.0),
+    };
+    let (x, y) = (t.about.0, page_height - t.about.1);
+    [cos, sin, -sin, cos, x - cos * x + sin * y, y - sin * x - cos * y]
+}
+
+/// Rectangle `r`, `[left, bottom, right, top]`, under quarter-turn matrix `m`.
+fn turned_rect(r: [f64; 4], m: [f64; 6]) -> [f64; 4] {
+    let at = |x: f64, y: f64| (m[0] * x + m[2] * y + m[4], m[1] * x + m[3] * y + m[5]);
+    let (a, b) = (at(r[0], r[1]), at(r[2], r[3]));
+    [a.0.min(b.0), a.1.min(b.1), a.0.max(b.0), a.1.max(b.1)]
+}
+
 /// The link annotation a page's text last ended in: the next piece of the same link on the same
 /// line widens it.
 struct LinkPiece {
diff --git a/crates/xfa/src/tests.rs b/crates/xfa/src/tests.rs
index e424be5441..6d93e1bc99 100644
--- a/crates/xfa/src/tests.rs
+++ b/crates/xfa/src/tests.rs
@@ -4145,3 +4145,389 @@ fn clear_password_values_clears_static_xfa_password_fields() {
     let packets = read_packets(&doc).unwrap().unwrap();
     assert!(!packets.xdp.contains("hunter2"), "{}", packets.xdp);
 }
+
+/// A form with `draws` in a subform placed by position, on a letter page whose content area is a
+/// quarter inch in, with `master` on the page itself.
+fn form_of_draws(master: &str, draws: &str) -> String {
+    format!(
+        r#"<xdp:xdp xmlns:xdp="http://ns.adobe.com/xdp/"><template xmlns="http://www.xfa.org/schema/xfa-template/3.3/"><subform name="form" layout="tb"><pageSet><pageArea name="p">{master}<contentArea x="0.25in" y="0.25in" w="8in" h="10.5in"/><medium stock="letter" short="8.5in" long="11in"/></pageArea></pageSet><subform name="s" w="8in" h="2.5in">{draws}</subform></subform></template></xdp:xdp>"#
+    )
+}
+
+/// A line from the top-left to the bottom-right of a box 0.7in × 0.4in, as #5561's form draws.
+fn line_draw(x: &str, y: &str, rotate: &str) -> String {
+    format!(r#"<draw x="{x}" y="{y}" w="0.7in" h="0.4in" {rotate}><value><line><edge thickness="2.5pt"/></line></value></draw>"#)
+}
+
+/// `xdp` laid out into its document, and that document's first page.
+fn written(xdp: &str) -> (Document, Dict) {
+    let mut doc = Document::open(Arc::new(shell(xdp))).unwrap();
+    render_into(&mut doc).unwrap();
+    let root = doc.get(doc.root().unwrap());
+    let pages = doc.get(root.as_dict().unwrap().reference(b"Pages").unwrap());
+    let kids = pages.as_dict().unwrap().get(b"Kids").map(|k| doc.resolve(k)).unwrap();
+    let page = doc.get(kids.as_array().unwrap()[0].as_ref().unwrap());
+    let page = page.as_dict().unwrap().clone();
+    (doc, page)
+}
+
+fn page_content(doc: &Document, page: &Dict) -> String {
+    let contents = doc.get(page.reference(b"Contents").unwrap());
+    let Object::Stream(s) = &*contents else { panic!("not a stream") };
+    String::from_utf8_lossy(&s.decoded().unwrap()).into_owned()
+}
+
+/// The ends of each line `content` strokes, on the page: through the matrices around it.
+fn stroked_lines(content: &str) -> Vec<[(f64, f64); 2]> {
+    let (mut stack, mut matrix) = (Vec::new(), [1.0, 0.0, 0.0, 1.0, 0.0, 0.0]);
+    let (mut numbers, mut from, mut lines): (Vec<f64>, _, _) = (Vec::new(), (0.0, 0.0), Vec::new());
+    for token in content.split_whitespace() {
+        let at = |m: [f64; 6], x: f64, y: f64| (m[0] * x + m[2] * y + m[4], m[1] * x + m[3] * y + m[5]);
+        let last = |numbers: &[f64]| (numbers[numbers.len() - 2], numbers[numbers.len() - 1]);
+        match token {
+            "q" => stack.push(matrix),
+            "Q" => matrix = stack.pop().unwrap(),
+            "cm" => {
+                let n: [f64; 6] = numbers[numbers.len() - 6..].try_into().unwrap();
+                let m = matrix;
+                matrix = [
+                    n[0] * m[0] + n[1] * m[2],
+                    n[0] * m[1] + n[1] * m[3],
+                    n[2] * m[0] + n[3] * m[2],
+                    n[2] * m[1] + n[3] * m[3],
+                    n[4] * m[0] + n[5] * m[2] + m[4],
+                    n[4] * m[1] + n[5] * m[3] + m[5],
+                ];
+            }
+            "m" => {
+                let (x, y) = last(&numbers);
+                from = at(matrix, x, y);
+            }
+            "l" => {
+                let (x, y) = last(&numbers);
+                lines.push([from, at(matrix, x, y)]);
+            }
+            _ => {}
+        }
+        match token.parse() {
+            Ok(v) => numbers.push(v),
+            Err(_) => numbers.clear(),
+        }
+    }
+    lines
+}
+
+fn turned(page: &Page) -> Vec<&crate::layout::Turned> {
+    page.items.iter().filter_map(|i| if let Item::Turned(t) = i { Some(t.as_ref()) } else { None }).collect()
+}
+
+/// A draw turns counter-clockwise about its anchor. The figures are where Acrobat put these lines
+/// on the page it flattened for #5561's form: from the anchor by (+50.4, -28.8) unturned, and by
+/// (+28.8, +50.4), (-50.4, +28.8) and (-28.8, -50.4) at 90, 180 and 270 degrees.
+#[test]
+fn a_draw_turns_counter_clockwise_about_its_anchor() {
+    let draws = [
+        line_draw("1in", "0.95in", ""),
+        line_draw("3in", "0.95in", r#"rotate="90""#),
+        line_draw("5in", "0.95in", r#"rotate="180""#),
+        line_draw("7in", "0.95in", r#"rotate="270""#),
+    ]
+    .concat();
+    let (doc, page) = written(&form_of_draws("", &draws));
+    let lines = stroked_lines(&page_content(&doc, &page));
+    assert_eq!(lines.len(), 4, "{lines:?}");
+    let top = 792.0 - 18.0 - 0.95 * 72.0;
+    let acrobat = [((90.0, top), (50.4, -28.8)), ((234.0, top), (28.8, 50.4)), ((378.0, top), (-50.4, 28.8)), ((522.0, top), (-28.8, -50.4))];
+    for ([from, to], (anchor, by)) in lines.iter().zip(acrobat) {
+        assert!((from.0 - anchor.0).abs() < 0.01 && (from.1 - anchor.1).abs() < 0.01, "{from:?} for {anchor:?}");
+        let moved = (to.0 - from.0, to.1 - from.1);
+        assert!((moved.0 - by.0).abs() < 0.01 && (moved.1 - by.1).abs() < 0.01, "{moved:?} for {by:?}");
+    }
+}
+
+/// The anchor is the point it turns about, whichever corner that is: a box anchored at its bottom
+/// right stands up and to the left of it, not where a top-left anchor would turn it.
+#[test]
+fn a_draw_turns_about_the_anchor_it_names() {
+    let draw = r#"<draw x="3in" y="1in" w="0.7in" h="0.4in" anchorType="bottomRight" rotate="90"><value><line><edge thickness="1pt"/></line></value></draw>"#;
+    let (doc, page) = written(&form_of_draws("", draw));
+    let lines = stroked_lines(&page_content(&doc, &page));
+    let anchor = (18.0 + 216.0, 792.0 - 18.0 - 72.0);
+    // Its bottom right is 0.7in right and 0.4in down of its top left, here turned to 0.7in up and
+    // 0.4in right: so the top left is that far back from the anchor, and the line ends on it.
+    let [from, to] = lines[0];
+    assert!((to.0 - anchor.0).abs() < 0.01 && (to.1 - anchor.1).abs() < 0.01, "{to:?} for {anchor:?}");
+    assert!((from.0 - (anchor.0 - 28.8)).abs() < 0.01 && (from.1 - (anchor.1 - 50.4)).abs() < 0.01, "{from:?}");
+}
+
+/// Each of the nine anchors stays where it is, and the box goes round it at each turn. What is
+/// asked for comes from the box's corners here, not from layout: from the anchor, y up, the line
+/// runs from the top left to the bottom right, and a quarter turn takes (x, y) to (-y, x).
+#[test]
+fn a_draw_turns_about_each_of_the_nine_anchors() {
+    let (w, h) = (50.4, 28.8);
+    let anchor = (18.0 + 216.0, 792.0 - 18.0 - 72.0);
+    for (name, down) in [("top", 0.0), ("middle", 0.5), ("bottom", 1.0)] {
+        for (side, across) in [("Left", 0.0), ("Center", 0.5), ("Right", 1.0)] {
+            for quarters in 0..4 {
+                let rotate = quarters * 90;
+                let draw = format!(
+                    r#"<draw x="3in" y="1in" w="0.7in" h="0.4in" anchorType="{name}{side}" rotate="{rotate}"><value><line><edge thickness="1pt"/></line></value></draw>"#
+                );
+                let (doc, page) = written(&form_of_draws("", &draw));
+                let lines = stroked_lines(&page_content(&doc, &page));
+                assert_eq!(lines.len(), 1, "{name}{side} at {rotate}: {lines:?}");
+                let (left, top) = (-across * w, down * h);
+                for (got, corner) in lines[0].iter().zip([(left, top), (left + w, top - h)]) {
+                    let turned = (0..quarters).fold(corner, |(x, y), _| (-y, x));
+                    let want = (anchor.0 + turned.0, anchor.1 + turned.1);
+                    assert!((got.0 - want.0).abs() < 0.01 && (got.1 - want.1).abs() < 0.01, "{name}{side} at {rotate}: {got:?} for {want:?}");
+                }
+            }
+        }
+    }
+}
+
+/// A draw that stands past the edge of the page once turned stays where it turned to: nothing moves
+/// it back or cuts it, as for an upright one. From the page's top left corner of the content area
+/// it goes off to the left and above the page, and from its right side, off to the right.
+#[test]
+fn a_turned_draw_stands_past_the_edge_of_the_page() {
+    for (x, rotate, anchor, by) in [("0in", "180", 18.0, (-50.4, 28.8)), ("8in", "90", 594.0, (28.8, 50.4))] {
+        let draw = line_draw(x, "0in", &format!(r#"rotate="{rotate}""#));
+        let (doc, page) = written(&form_of_draws("", &draw));
+        let content = page_content(&doc, &page);
+        assert!(!content.split_whitespace().any(|t| t == "W" || t == "W*"), "{rotate}: nothing clips it: {content}");
+        let lines = stroked_lines(&content);
+        assert_eq!(lines.len(), 1, "{rotate}: {lines:?}");
+        let [from, to] = lines[0];
+        assert!((from.0 - anchor).abs() < 0.01 && (from.1 - 774.0).abs() < 0.01, "{rotate}: {from:?}");
+        assert!((to.0 - (anchor + by.0)).abs() < 0.01 && (to.1 - (774.0 + by.1)).abs() < 0.01, "{rotate}: {to:?}");
+        assert!(to.0 < 0.0 || to.0 > 612.0, "{rotate}: it does stand past the edge, at {to:?}");
+    }
+}
+
+/// Everything a draw shows turns with it, under one matrix: its text, its picture and its border,
+/// rounded or not, each written as if it stood upright.
+#[test]
+fn text_pictures_and_borders_turn_with_their_draw() {
+    let picture = format!(
+        r#"<draw x="1in" y="1in" w="1in" h="1in" rotate="90"><value><image contentType="image/png">{}</image></value></draw>"#,
+        base64::Engine::encode(&base64::engine::general_purpose::STANDARD, tiny_png())
+    );
+    for (draw, shows) in [
+        (r#"<draw x="1in" y="1in" w="2in" h="0.5in" rotate="90"><value><text>upright</text></value></draw>"#.to_string(), "(upright) Tj"),
+        (picture, " Do "),
+        (r#"<draw x="1in" y="1in" w="2in" h="0.5in" rotate="90"><value><rectangle><edge thickness="1pt"/></rectangle></value></draw>"#.to_string(), " l S"),
+        (
+            r#"<draw x="1in" y="1in" w="2in" h="0.5in" rotate="90"><value><rectangle><edge thickness="1pt"/><corner radius="5pt"/></rectangle></value></draw>"#.to_string(),
+            " c",
+        ),
+        (r#"<draw x="1in" y="1in" w="2in" h="0.5in" rotate="90"><border><fill><color value="255,0,0"/></fill></border><value><text>x</text></value></draw>"#.to_string(), " re f"),
+    ] {
+        let (doc, page) = written(&form_of_draws("", &draw));
+        let content = page_content(&doc, &page);
+        let open = content.find("0 1 -1 0 ").unwrap_or_else(|| panic!("no matrix for {draw}: {content}"));
+        let close = open + content[open..].find("\nQ\n").unwrap_or_else(|| panic!("no end for {draw}: {content}"));
+        assert!(content[open..close].contains(shows), "{shows} outside the matrix: {content}");
+    }
+}
+
+/// `rotate` as a multiple of 90 degrees, with a unit or not, past a full turn or below none;
+/// anything else leaves the draw as it stands.
+#[test]
+fn rotate_reads_as_quarter_turns() {
+    let quarters = |rotate: &str| {
+        let form = layout_xml(&form_of_draws("", &line_draw("1in", "1in", &format!(r#"rotate="{rotate}""#)))).unwrap();
+        turned(&form.pages[0]).first().map_or(0, |t| t.quarters)
+    };
+    for (rotate, want) in [("90", 1), ("180", 2), ("270", 3), ("0", 0), ("360", 0), ("450", 1), ("-90", 3), ("90deg", 1), (" 90 ", 1), ("90.0", 1)] {
+        assert_eq!(quarters(rotate), want, "{rotate}");
+    }
+    for rotate in ["45", "89.5", "135", "225", "abc", "", "deg", "NaN", "inf", "-inf"] {
+        assert_eq!(quarters(rotate), 0, "{rotate}");
+    }
+    // Far past what a turn can be told apart at, or just under none: in range whatever it reads as.
+    for rotate in ["1e300", "-1e-300"] {
+        assert!(quarters(rotate) < 4, "{rotate}");
+    }
+}
+
+/// A turned draw is one item: a page break moves it whole, what it holds moving with the point it
+/// turns about, and doesn't cut it, and the draws around it stay where they belong.
+#[test]
+fn a_page_break_moves_a_turned_draw_whole() {
+    let draws = format!(
+        r#"<draw x="6in" y="10.4in" w="1in" h="0.5in"><border><edge thickness="1pt"/></border><value><text>across</text></value></draw><draw x="1in" y="1in" w="2in" h="0.5in"><value><text>first</text></value></draw>{}{}<draw x="1in" y="13in" w="2in" h="0.5in"><value><text>last</text></value></draw>"#,
+        [
+            line_draw("3in", "12in", r#"rotate="90""#),
+            r#"<draw x="5in" y="12in" w="2in" h="0.5in" rotate="90"><border><edge thickness="1pt"/></border><value><text>sideways</text></value></draw>"#.to_string(),
+        ]
+        .concat(),
+        (2..8).map(|y| line_draw("1in", &format!("{y}in"), "")).collect::<String>()
+    );
+    let xdp = form_of_draws("", &draws).replace(r#"h="2.5in""#, r#"h="14in""#);
+    let form = layout_xml(&xdp).unwrap();
+    assert!(form.pages.len() >= 2, "{}", form.pages.len());
+    assert_eq!(texts(&form.pages[0]), ["first"]);
+    // Written after the turned draws, these lines still belong at the top of the block: what the
+    // break knew of the draw's many items mustn't carry over to those that now stand in their places.
+    let lines = form.pages[0].items.iter().filter(|i| matches!(i, Item::Line { .. })).count();
+    assert_eq!(lines, 6, "{:?}", form.pages[0].items);
+    assert_eq!(turned(&form.pages[0]).len(), 0);
+    let moved = turned(&form.pages[1]);
+    assert_eq!(moved.len(), 2, "{:?}", form.pages[1].items);
+    let Item::Line { from, .. } = &moved[0].items[0] else { panic!("not a line") };
+    assert_eq!(*from, moved[0].about, "the line moved with the point it turns about");
+    // Turned 90 degrees, a box 0.7in wide stands 0.7in up from its anchor, on a second page.
+    assert!(moved[0].about.1 < 792.0, "{:?}", moved[0].about);
+    assert!((moved[0].extent.1 - moved[0].about.1).abs() < 0.01, "{:?}", moved[0]);
+    assert!((moved[0].about.1 - moved[0].extent.0 - 50.4).abs() < 0.01, "{:?}", moved[0]);
+    let moved_text = texts(&form.pages[1]);
+    assert!(moved_text.contains(&"last".to_string()) && moved_text.contains(&"across".to_string()), "{moved_text:?}");
+}
+
+/// What a page break goes by is the box as it stands once turned, whichever way, about whichever
+/// corner: from a top-left anchor, it stands up, up or down of it; from a bottom-right one, the
+/// box starts behind the anchor and the same turns take it the other way.
+#[test]
+fn a_turned_draw_knows_where_it_stands() {
+    let box_at = |anchor: &str, rotate: u32| {
+        let draw = format!(
+            r#"<draw x="3in" y="1in" w="0.7in" h="0.4in" {anchor} rotate="{rotate}"><value><line><edge thickness="1pt"/></line></value></draw>"#
+        );
+        let form = layout_xml(&form_of_draws("", &draw)).unwrap();
+        let held = turned(&form.pages[0]);
+        let t = held.first().expect("turned");
+        (t.extent.0 - t.about.1, t.extent.1 - t.about.1)
+    };
+    let close = |got: (f64, f64), want: (f64, f64)| (got.0 - want.0).abs() < 0.01 && (got.1 - want.1).abs() < 0.01;
+    for (rotate, want) in [(90, (-50.4, 0.0)), (180, (-28.8, 0.0)), (270, (0.0, 50.4))] {
+        assert!(close(box_at("", rotate), want), "{rotate}: {:?}", box_at("", rotate));
+    }
+    for (rotate, want) in [(90, (0.0, 50.4)), (180, (0.0, 28.8)), (270, (-50.4, 0.0))] {
+        let got = box_at(r#"anchorType="bottomRight""#, rotate);
+        assert!(close(got, want), "{rotate}: {got:?}");
+    }
+}
+
+/// The page count is filled in inside a turned draw too, as it comes last, when every page is known.
+#[test]
+fn the_page_count_reaches_a_turned_draw() {
+    let master = r##"<draw x="7in" y="10in" w="1in" h="0.2in" rotate="90"><value><exData contentType="text/html"><body xmlns="http://www.w3.org/1999/xhtml"><p>of <span xfa:embed="#pageCount" xmlns:xfa="http://www.xfa.org/schema/xfa-data/1.0/"/></p></body></exData></value></draw><field name="pageCount" id="pageCount" presence="hidden" w="1in" h="0.2in"><ui><textEdit/></ui><event activity="ready" ref="$layout"><script contentType="application/x-javascript">this.rawValue = xfa.layout.pageCount();</script></event></field>"##;
+    let form = layout_xml(&form_of_draws(master, &line_draw("1in", "1in", ""))).unwrap();
+    let held = turned(&form.pages[0]);
+    assert_eq!(held.len(), 1, "{:?}", form.pages[0].items);
+    let text: Vec<&str> = held[0].items.iter().filter_map(|i| if let Item::Text(s) = i { Some(s.text.as_str()) } else { None }).collect();
+    assert_eq!(text.concat().trim(), "of 1", "{text:?}");
+}
+
+/// A link in turned text is clicked where the text is drawn, whichever way it turned: the box it
+/// has unturned, turned about the draw's anchor.
+#[test]
+fn a_link_turns_with_its_text() {
+    let rect_at = |rotate: &str| {
+        let draw = format!(
+            r#"<draw x="1in" y="3in" w="2in" h="0.5in" {rotate}><value><exData contentType="text/html"><body xmlns="http://www.w3.org/1999/xhtml"><p><a href="https://example.com/a">a link in turned text</a></p></body></exData></value></draw>"#
+        );
+        let (doc, page) = written(&form_of_draws("", &draw));
+        let annots = page.get(b"Annots").map(|a| doc.resolve(a)).expect("the link");
+        let annot = doc.get(annots.as_array().unwrap()[0].as_ref().unwrap());
+        let rect: Vec<f64> = annot.as_dict().unwrap().get(b"Rect").unwrap().as_array().unwrap().iter().map(|v| v.as_f64().unwrap()).collect();
+        rect
+    };
+    let upright = rect_at("");
+    let (ax, ay) = (18.0 + 72.0, 792.0 - 18.0 - 216.0);
+    let (left, bottom, right, top) = (upright[0] - ax, upright[1] - ay, upright[2] - ax, upright[3] - ay);
+    assert!(left >= -0.01 && top <= 0.01 && right - left > 3.0 * (top - bottom), "it stands right and down of its anchor: {upright:?}");
+    for (rotate, want) in [
+        ("90", [ax - top, ay + left, ax - bottom, ay + right]),
+        ("180", [ax - right, ay - top, ax - left, ay - bottom]),
+        ("270", [ax + bottom, ay - right, ax + top, ay - left]),
+    ] {
+        let got = rect_at(&format!(r#"rotate="{rotate}""#));
+        assert!(got.iter().zip(want).all(|(g, w)| (g - w).abs() < 0.01), "{rotate}: {got:?} for {want:?}");
+    }
+}
+
+/// Only a draw placed by position turns: a field, and a draw in a flow, stand as they did.
+#[test]
+fn only_positioned_draws_turn() {
+    let field = r#"<field name="f" x="1in" y="1in" w="2in" h="0.5in" rotate="90"><ui><textEdit/></ui></field>"#;
+    let form = layout_xml(&form_of_draws("", field)).unwrap();
+    assert!(turned(&form.pages[0]).is_empty());
+    assert_eq!(widgets(&form.pages[0]).len(), 1);
+    let flowed = form_of_draws("", &line_draw("1in", "1in", r#"rotate="90""#))
+        .replace(r#"<subform name="s" w="8in" h="2.5in">"#, r#"<subform name="s" w="8in" layout="tb">"#);
+    let form = layout_xml(&flowed).unwrap();
+    assert!(turned(&form.pages[0]).is_empty(), "{:?}", form.pages[0].items);
+    assert!(form.pages[0].items.iter().any(|i| matches!(i, Item::Line { .. })), "it is still drawn");
+    // A draw that shows nothing has nothing to turn.
+    let form = layout_xml(&form_of_draws("", &line_draw("1in", "1in", r#"rotate="90" presence="invisible""#))).unwrap();
+    assert!(form.pages[0].items.is_empty(), "{:?}", form.pages[0].items);
+}
+
+/// A block carried over to a content area further across takes a turned draw with it, point and
+/// items both.
+#[test]
+fn a_turned_draw_moves_across_with_its_content_area() {
+    let xdp = form_of_draws("", &line_draw("1in", "6in", r#"rotate="90""#))
+        .replace(
+            r#"<contentArea x="0.25in" y="0.25in" w="8in" h="10.5in"/>"#,
+            r#"<contentArea x="0.25in" y="0.25in" w="3in" h="5in"/><contentArea x="4in" y="0.25in" w="3in" h="5in"/>"#,
+        )
+        .replace(r#"h="2.5in""#, r#"h="7in""#);
+    let form = layout_xml(&xdp).unwrap();
+    let moved = form.pages.iter().flat_map(turned).next().expect("turned");
+    let Item::Line { from, .. } = &moved.items[0] else { panic!("not a line") };
+    assert_eq!(*from, moved.about);
+    assert!((moved.about.0 - (4.0 + 1.0) * 72.0).abs() < 0.01, "{:?}", moved.about);
+}
+
+/// A positioned subform with no height grows to hold what it holds as it stands, so what comes next
+/// neither runs through a turned draw nor leaves the room its upright box would have had.
+#[test]
+fn a_container_grows_to_a_turned_draw_as_it_stands() {
+    let next = r#"</subform><subform name="next" w="8in" h="1in"><draw x="0in" y="0in" w="2in" h="0.5in"><value><text>next</text></value></draw></subform></subform></template>"#;
+    let baseline = |rotate: &str| {
+        let xdp = form_of_draws("", &line_draw("1in", "1in", rotate)).replace(r#" h="2.5in""#, "").replace("</subform></subform></template>", next);
+        let form = layout_xml(&xdp).unwrap();
+        assert_eq!(form.pages.len(), 1);
+        form.pages[0].items.iter().find_map(|i| if let Item::Text(s) = i { Some(s.baseline) } else { None }).expect("the next block")
+    };
+    // Upright the box ends 0.4in below the anchor, and the next block starts there.
+    let upright = baseline("");
+    for (rotate, bottom) in [("90", 0.0), ("180", 0.0), ("270", 50.4)] {
+        let got = baseline(&format!(r#"rotate="{rotate}""#)) - (upright - 28.8);
+        assert!((got - bottom).abs() < 0.01, "{rotate}: the next block starts {got} below the anchor, not {bottom}");
+    }
+}
+
+/// A subform with no width is as wide as what it holds as it stands, whichever way that turned,
+/// so a neighbour in a row doesn't stand off from it or over it.
+#[test]
+fn a_container_is_as_wide_as_a_turned_draw_stands() {
+    let row = |rotate: &str| {
+        let xdp = form_of_draws(
+            "",
+            &format!(
+                r#"<subform name="turned">{}</subform><subform name="beside" w="1in" h="1in"><draw x="0in" y="0in" w="1in" h="0.5in"><value><text>beside</text></value></draw></subform>"#,
+                line_draw("1in", "1in", rotate)
+            ),
+        )
+        .replace(r#"<subform name="s" w="8in" h="2.5in">"#, r#"<subform name="s" w="8in" h="2.5in" layout="lr-tb">"#);
+        let form = layout_xml(&xdp).unwrap();
+        form.pages[0].items.iter().find_map(|i| if let Item::Text(s) = i { Some(s.x) } else { None }).expect("the neighbour")
+    };
+    let upright = row("");
+    // Upright it ends 0.7in right of the anchor; turned, 0.4in right, at the anchor, and at it again.
+    for (rotate, right) in [("90", 28.8), ("180", 0.0), ("270", 0.0)] {
+        let got = row(&format!(r#"rotate="{rotate}""#)) - (upright - 50.4);
+        assert!((got - right).abs() < 0.01, "{rotate}: the neighbour stands {got} right of the anchor, not {right}");
+    }
+    // From a bottom-right anchor the box starts behind it, and the same turns take it the other way.
+    for (rotate, right) in [("90", 0.0), ("180", 50.4), ("270", 28.8)] {
+        let got = row(&format!(r#"anchorType="bottomRight" rotate="{rotate}""#)) - (upright - 50.4);
+        assert!((got - right).abs() < 0.01, "{rotate}: the neighbour stands {got} right of the anchor, not {right}");
+    }
+}
diff --git a/docs/architecture.md b/docs/architecture.md
index 008cae903d..77e141d0de 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -71,10 +71,11 @@ The PDF object graph *is* the model (`crates/engine/README.md` §The editing mod
 ## File I/O
 
 - PDF in: any revision chain, xref tables or streams, hybrid files, damaged files (repaired and
-  logged), all standard-security revisions. Image codecs (DCT, JPX, JBIG2) decode through the
-  bootstrap renderer; CCITT decodes through `pdfcraft-filters` (`decode_ccitt`, behind
-  `Document::decoded_image`) for export, redaction and the optimizer, and through the renderer
-  for display. Export ▸ Images decodes JPEG itself.
+  logged), all standard-security revisions. Image codecs (DCT, JPX) decode through the bootstrap
+  renderer; CCITT and JBIG2 decode through `pdfcraft-filters` (`decode_ccitt_within`,
+  `decode_jbig2_within`, behind `ImageBudget::decode`, the only way to decode an image outside
+  the renderer, which shares one allowance across an operation's images) for export, redaction
+  and the optimizer, and through the renderer for display. Export ▸ Images decodes JPEG itself.
 - PDF out: incremental or full saves, object streams, re-encryption, resource de-duplication when
   combining.
 - Other formats: images and text in (`create`); PNG/JPEG/TIFF, text, RTF, Word and HTML out
diff --git a/docs/licensing-self-check.md b/docs/licensing-self-check.md
new file mode 100644
index 0000000000..305d756ff7
--- /dev/null
+++ b/docs/licensing-self-check.md
@@ -0,0 +1,33 @@
+# Source licensing self-check
+
+Run `cargo xtask license-check` to validate the checked-out source, offline. The command
+does not download assets, fetch models, inspect installers, or generate dependency notices.
+It reuses `cargo xtask assets` for attribution, asset policy and locked dependency versions,
+then checks the documents recorded in `LICENSES.toml`.
+
+Each document has a repository-relative source, a unique portable logical destination and
+the SHA-256 of its audited text. Destinations are validation metadata, not instructions to
+copy files into packages. Required project documents and every asset's `licence_file` must
+be mapped. Every dependency-bundled asset must have a document mapping matching its existing
+`ATTRIBUTION.toml` licence expression. Foxit has an explicit required document. Licence
+texts for egui's default fonts and CMaps are retained in `licenses/`, with their pinned
+upstream origins recorded in the manifest. Existing font and asset texts stay in place.
+
+Missing files, empty or invalid text, changed hashes, duplicate mappings, case-insensitive
+destination collisions, parent-file conflicts and unsafe paths fail the check. Source
+symlinks must resolve inside the checkout. OCR models need complete attribution and valid
+hashes and destination names; the model binaries and downloaded licence texts need not be
+present. The optional craft-fonts checkout remains governed by its own attribution and
+the existing asset validator; this command does not audit that external checkout.
+
+When changing attribution, edit `ATTRIBUTION.toml`, run `cargo xtask assets --write`. Generated attribution consistency remains checked only
+by the existing asset validator. When changing licence or notice text, re-audit
+its provenance before updating the corresponding hash. Do not replace a licence with
+guessed terms or update a hash merely to silence a failure. `LICENSES.toml` is validated
+with unknown fields rejected.
+
+The existing Linux source-validation step in `.github/workflows/ci.yml` and `cargo xtask ci`
+run `license-check` in place of `assets`; the asset validator runs once within that command.
+This Stage 1 check establishes source-document consistency, not completed-package
+compliance or legal sufficiency. Installer inspection, dependency-notice generation and
+font-delivery packaging changes remain separate work.
diff --git a/docs/localization-parity.md b/docs/localization-parity.md
index fee2ba3e7b..dc0cbab4e5 100644
--- a/docs/localization-parity.md
+++ b/docs/localization-parity.md
@@ -1,5 +1,6 @@
 # Localization parity
 
+> **Last reviewed:** 2026-11-03 · **Last updated:** 2026-11-03 · **Change:** minor (Turkish: 2,867 entries, 0 missing in `cargo xtask i18n-report` on 2026-11-03; AI-assisted)
 > **Last reviewed:** 2026-10-25 · **Last updated:** 2026-10-25 · **Change:** minor (Persian (`fa`, 2,785 entries) added right-to-left like Arabic and Kurdish; Arabic current state corrected: catalogs stay logical, RTL labels take an explicit direction and stock chrome mirrors; native/browser RTL input, IME and complex workflows remain unqualified. Native release Hans face via LXGW WenKai Lite; release-pinned craft-fonts still has no Telugu face. Current union 2,798 keys. Scores and estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 
 Per-language status of PdfCraft's interface against Acrobat Pro's. How translations work and how to
@@ -72,7 +73,7 @@ help/docs polish (catalog and script work are already done), not missing UI stri
 | Polish | `pl` | 2,611 entries | partial | yes |
 | Slovenian | `sl` | 2,536 entries | partial | no |
 | Greek | `el` | 2,545 entries | partial | no |
-| Turkish | `tr` | 2,525 entries | partial | yes |
+| Turkish | `tr` | 2,867 entries (0 missing in `cargo xtask i18n-report`, 2026-11-03) | partial; AI-assisted, judgement calls reviewed by a native speaker, full proofreading pending | yes |
 | Lithuanian | `lt` | 2,798 (100% of current key union) | partial; community native-speaker review ([#1401](https://github.com/storytold/pdfcraft/pull/1401)) | no |
 | Finnish | `fi` | 2,798 entries (every current key) | partial; AI-assisted, native proofreading pending | yes |
 | Albanian | `sq` | 2,524 entries | partial; not yet reviewed by a native speaker | no |
@@ -93,6 +94,7 @@ Acrobat languages PdfCraft lacks: Danish, Dutch, Swedish, Hebrew. Vietnamese is
 | 2026-10-25 | minor | Added Persian (`fa`, 2,785 entries, all but 13 of the current 2,798-key union); right-to-left like Arabic and Kurdish, with logical entries reordered by egui 0.37's epaint; AI-assisted, not yet native-reviewed |
 | 2026-10-21 | minor | Brazilian Portuguese (`pt-br`) now covers all 2,674 distinct keys in the current catalog union; no help or engine/OS error-detail localization; twelve-language mean still rounds to ≈ 68% |
 | 2026-10-20 | minor | Spanish: the 143 keys the other catalogs had and `es.tsv` was missing; `es` now covers the whole 2,674-key union, like `lt` and `vi`. Restated Lithuanian against the current union (its 2,585 was measured on 2026-10-13) and said plainly in *How this was measured* that the union moves, so counts only compare within a date |
+| 2026-11-03 | minor | Turkish: 2,867 entries after translating the 288 keys the translation gaps report listed (AI-assisted); measured with the report, not against the 2,798-key union of 2026-10-25, which predates keys added since |
 | 2026-10-19 | minor | Removed the 2026-10-13 status line and the 14-language summary that concurrent merges left beside the current ones; the summary keeps the Italian and Norwegian Bokmål measurement dates |
 | 2026-10-16 | minor | Czech: 2,674 entries after adding the keys the other catalogs had (the engine's sentences, weekday heads, certificate fields, shared buttons) and unifying "tag" as *tag* (not *značka*, which is a redaction mark) |
 | 2026-10-13 | minor | Vietnamese (`vi`) catalog: 2,591 entries (100% of current key union + `theme`/`Appearance`); twelve-language mean ≈ 68%; native-speaker community review; registered with `plural_none` |
diff --git a/docs/pdf-spec-parity.md b/docs/pdf-spec-parity.md
index b62ecbc171..aefc959698 100644
--- a/docs/pdf-spec-parity.md
+++ b/docs/pdf-spec-parity.md
@@ -2,7 +2,7 @@
 
 > Integration update 2026-10-30: lossless JBIG2 generic and exact-copy symbol coding are included; no lossy substitution. Combined tests passed at bdf5620; the subsequent review fixes require fresh CI.
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-26 · **Change:** minor (§7.4: redaction decodes CCITT fax images, Group 3 on bytes aside; earlier, §7.4: CCITT decoding in `pdfcraft-filters`) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-30 · **Change:** minor (§7.4: JBIG2 decoding in `pdfcraft-filters`, so redaction clears JBIG2 scans; earlier, §7.4: redaction decodes CCITT fax images, Group 3 on bytes aside) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 
 How much of ISO 32000-2 (PDF 2.0) and the PDF subset standards PdfCraft implements, set against
 what Acrobat Pro implements. This is PdfCraft's equivalent of a "geometry" or "codec" checklist:
@@ -23,7 +23,7 @@ are borrowed; PDF 2.0 additions and most subset standards are missing. **150–2
 |---|---|---|---|---|
 | §7.2–7.5 | Syntax, objects, file structure, xref tables and streams, object streams, hybrid files, incremental updates | full | **own**, tolerant, repairs damaged files | `crates/cos`; corpus 958 files; fuzzed nightly |
 | §7.4 | Stream filters: Flate, LZW, ASCII85, ASCIIHex, RunLength, predictors | full | **own** | `crates/filters` |
-| §7.4 | Image filters: DCT, JPX, JBIG2, CCITTFax | full | **borrowed** (decode); CCITT Group 4 and lossless JBIG2 encoding | `core.image-filters` partial; own codecs M1.1/M1.2; CCITT decoding in `pdfcraft-filters` (`decode_ccitt`, through `hayro-ccitt`) for export, redaction and the Optimizer, which encodes Group 4 (`optimize.mono-compression`); lossless JBIG2 generic-region or exact-copy symbol encoding and image export; no lossy substitution |
+| §7.4 | Image filters: DCT, JPX, JBIG2, CCITTFax | full | **borrowed** (decode); CCITT Group 4 and lossless JBIG2 encoding | `core.image-filters` partial; own codecs M1.1/M1.2; CCITT decoding in `pdfcraft-filters` (`decode_ccitt`, through `hayro-ccitt`) for export, redaction and the Optimizer, which encodes Group 4 (`optimize.mono-compression`); JBIG2 decoding there too (`decode_jbig2`, through `hayro-jbig2`) for export and redaction; lossless JBIG2 generic-region or exact-copy symbol encoding; no lossy substitution |
 | §7.5.8 | Linearization | R W | R only | `core.linearization` planned |
 | §7.6.4 | Standard security handler R2–R6 (RC4 40/128, AES-128, AES-256), crypt filters, `/EncryptMetadata`, SASLprep | full | **own**, read and write | `crates/crypt`; written files open in Acrobat DC since #836 (#774: Acrobat needs the catalog outside object streams) |
 | §7.6.5 | Public-key security handler | full | none | `core.open-public-key`, `protect.certificate-encryption` planned |
@@ -132,6 +132,7 @@ are borrowed; PDF 2.0 additions and most subset standards are missing. **150–2
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-30 | minor | §7.4: JBIG2 decoding (`hayro-jbig2`) in `pdfcraft-filters`, which `Document::decoded_image` uses with the image's `/JBIG2Globals`: export reads JBIG2 behind other filters too, and redaction clears pixels in JBIG2 images instead of removing them whole (one whose page isn't its size still is) |
 | 2026-10-26 | minor | §7.4: redaction clears pixels in CCITT fax images through the CCITT decoder, instead of removing them whole (Group 4 and Group 3 off bytes; Group 3 on bytes is still removed whole, as the bootstrap renderer may draw it as other rows than the decoder reads) |
 | 2026-10-26 | minor | §7.4: CCITT decoding (`hayro-ccitt`) in `pdfcraft-filters`, for export and the Optimizer |
 | 2026-10-26 | minor | §7.4: CCITT Group 4 encoding (`fax`) in the Optimizer |
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 0f1fb6f4d5..1caf3f3e22 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -1,5 +1,15 @@
 # PdfCraft roadmap: milestones and what's next
 
+> **2026-11-03, M7 / #5835 review:** active image crops retain secondary clicks over overlapping images; crop controls share measured layout with hit detection. Rotation, handle and page-edge regressions added; focused tests, scoped Clippy, formatting, layering and asset checks passed locally. Estimates unchanged.
+
+> **Last reviewed:** 2026-11-01 | **Last updated:** 2026-11-01 | **Change:** patch (M7 #5657: header/footer, watermark and background operations commit all selected pages together; later-page errors preserve marks, content, shared/inherited resources and pending edits; estimates unchanged)
+
+> **Last reviewed:** 2026-11-01 | **Last updated:** 2026-11-01 | **Change:** patch (M7, PR #2155 further review: inherited drawing/text state, affine image gestures, paste/selection ownership, no-op scripts and menu permissions; estimates unchanged)
+
+> **Last reviewed:** 2026-11-01 | **Last updated:** 2026-11-01 | **Change:** patch (M7, PR #2155 latest comments: explicit image-paste events, mixed-size field refresh, and documented mixed-script normalization with Undo; estimates unchanged)
+
+> **Last reviewed:** 2026-11-01 | **Last updated:** 2026-11-01 | **Change:** patch (M7, PR #2155 review follow-up: preserve image crop/tag/stream ownership, resize in page orientation, harden clipboard and text formatting, and reload installed fonts; estimates unchanged)
+
 > **Last reviewed:** 2026-10-31 | **Last updated:** 2026-10-31 | **Change:** patch (M2, PR #4172: GBK rasters compared with explicit Unicode and independently selected installed faces; wrong-glyph and wrong-family negative controls fail; estimates unchanged)
 > **Last reviewed:** 2026-10-31 | **Last updated:** 2026-10-31 | **Change:** patch (M2, PR #4172: integrate main fa5f9f8c; retain CJK viewer and upstream raster regressions, restore explicit display_config imports; estimates unchanged)
 > **Last reviewed:** 2026-10-28 · **Last updated:** 2026-10-28 · **Change:** patch (M2, PR #4172: integrate main 5af10276; retain both roadmap histories and viewer-only CJK font policy; estimates unchanged)
@@ -194,7 +204,7 @@ total matches the parity estimate.
 | M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings. Packed TIFF-predictor RGB rows retain later rows in decoding and rendering. Page marks, added content and print output retain small page-unit transform coefficients when serialized. Forms without Resources use page Properties for ActualText and layer visibility; own dictionaries stop fallback. Oversized missing inline-image samples, including header and terminator overhead, no longer pin the content window (#3107 / PR #3438); normal large streamed images retain deterministic sample boundaries. Radial luminosity fades have synthetic coverage for the existing #2132 mask guard, including per-pixel references, antialiased clips, previews, scales and tiles; no additional production fix was needed. Dotted TOC leaders no longer inflate letter tracking or hide word spaces (#3086); phrase search and selection are covered. Short tracked ellipses retain their gap samples and remain searchable. Missing spacing glyphs in non-embedded Japanese CID substitutes render blank without changing PDF advances or Unicode (#3601). The desktop viewer can use installed CJK fonts, including Windows GBK Song/Hei/Kai/FangSong and subset-prefixed Founder names; Combine thumbnails and accessibility figure previews use the same display-only fallback, without changing export or print font policy (#234, continuation of #1567, review #4172). Print previews exclude installed faces and isolate their font cache; GBK regressions cover view/print switching for inline and pooled whole-page/tile rendering. Installed-font helpers and their regression contracts have function documentation. GBK regression rasters match explicit-Unicode references with independently selected installed faces; wrong-glyph and wrong-family negative controls fail. Integration with main fa5f9f8c retains viewer fallback across the split engine session modules, renderer tests and Combine thumbnail workers. |
 | M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings. Packed TIFF-predictor RGB rows retain later rows in decoding and rendering. The renderer keeps its one-point crop-size floor in physical points after UserUnit scaling, with regression coverage for crop origins, rotations and f32 reciprocal rounding. Existing unit policy and nearly-zero fallback are retained. |
 | M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings |
-| M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). #3808: the Pages inspector offers a 50–150% thumbnail slider and buttons, also available through `ui.set`. Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). Selected-text Copy in Edit and the canvas context menu is covered by focused regressions and native clipboard checks (#1225); document copy restrictions apply to the floating action too. #1364 candidate: absolute local GoToR links ask before target access; headless callers explicitly opt in. Native-opening candidate: chosen tools survive preparation and password retries; startup intake waits for pending preparation. Page-label navigation displays logical labels, retains the current page on unchanged submission and refreshes focused same-document replacements; clean file-watcher reload preserves the chosen scrolling mode, preventing a Single Page reader from jumping to page 1 during replacement. Synthetic control regressions cover these behaviors. #3149: page-list changes discard render demand based on old geometry; actual raster dimensions are checked against the GPU limit before upload. Synthetic crash and continued-rendering regressions cover the replacement path. Save-prompt shortcuts yield to dialogs above them; stacked link-consent UI regression covers Escape and Return. Comment hover follows individual marked lines and original annotation paint order (#3541/#3620), independently of spatial inspection sorting; synthetic rotation, differing-upper-edge overlap and unchanged-document regressions. Optional page gaps join page edges without cropping PDF margins; current-document toggle, persisted default and UI control options are covered by viewer tests. Gap changes in Organize Pages preserve document scroll position, and both comparison panes follow menu and control choices. Repeated window resizes by an edge and moves by the tab strip on GNOME/Wayland work without a click in between. |
+| M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). #3808: the Pages inspector offers a 50–150% thumbnail slider and buttons, also available through `ui.set`. Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). Selected-text Copy in Edit and the canvas context menu is covered by focused regressions and native clipboard checks (#1225); document copy restrictions apply to the floating action too. #1364 candidate: absolute local GoToR links ask before target access; headless callers explicitly opt in. Native-opening candidate: chosen tools survive preparation and password retries; startup intake waits for pending preparation. Page-label navigation displays logical labels, retains the current page on unchanged submission and refreshes focused same-document replacements; clean file-watcher reload preserves the chosen scrolling mode, preventing a Single Page reader from jumping to page 1 during replacement. Synthetic control regressions cover these behaviors. #3149: page-list changes discard render demand based on old geometry; actual raster dimensions are checked against the GPU limit before upload. Synthetic crash and continued-rendering regressions cover the replacement path. Save-prompt shortcuts yield to dialogs above them; stacked link-consent UI regression covers Escape and Return. Comment hover follows individual marked lines and original annotation paint order (#3541/#3620), independently of spatial inspection sorting; synthetic rotation, differing-upper-edge overlap and unchanged-document regressions. Optional page gaps join page edges without cropping PDF margins; current-document toggle, persisted default and UI control options are covered by viewer tests. Gap changes in Organize Pages preserve document scroll position, and both comparison panes follow menu and control choices. Repeated window resizes by an edge and moves by the tab strip on GNOME/Wayland work without a click in between. Optional --two-paged applies noncontinuous two-page layout to explicitly opened CLI files without changing defaults; explicit --layout wins. |
 | M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). Selected-text Copy in Edit and the canvas context menu is covered by focused regressions and native clipboard checks (#1225); document copy restrictions apply to the floating action too. #1364 candidate: absolute local GoToR links ask before target access; headless callers explicitly opt in. Native-opening candidate: chosen tools survive preparation and password retries; startup intake waits for pending preparation. Page-label navigation displays logical labels, retains the current page on unchanged submission and refreshes focused same-document replacements; clean file-watcher reload preserves the chosen scrolling mode, preventing a Single Page reader from jumping to page 1 during replacement. Synthetic control regressions cover these behaviors. Wrapped revision buttons stay above Binding in Document Properties (#2739); a synthetic UI test checks layout and saved revision content. |
 | M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). #1364 candidate: absolute local GoToR links ask before target access; headless callers explicitly opt in. Native-opening candidate: chosen tools survive preparation and password retries; startup intake waits for pending preparation. Later native-open replies stay queued while a modal or picker owns the foreground; regressions cover recipient ownership, completion/cancellation and one-shot wakes. |
 | M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). #1364 candidate: absolute local GoToR links ask before target access; headless callers explicitly opt in. Native-opening candidate: chosen tools survive preparation and password retries; startup intake waits for pending preparation. #1980: exact quit modifiers preserve Ctrl+Alt+Q email input; Ctrl+Q/Cmd+Q asks before discarding unsaved documents. |
@@ -217,7 +227,7 @@ total matches the parity estimate.
 | M6 | Forms + JavaScript | 160–320 | 50% | 40–75 | Done: filling all field types with regenerated appearances; Prepare a form (every field type, multi-select/shared properties, move/resize/delete, Field Properties General/Appearance/Position/Options/Format/Validate/Calculate); Acrobat's AF format/keystroke/validate/calculate functions and simplified field notation run natively in Acrobat's event order; tab order; push-button actions; flatten; agent tools. Form data exchange (FDF, XFDF, XML, CSV, text) done; XFDF values retain text across XML comments and processing instructions. Plain AcroForm XML imports retain all direct text around comments and processing instructions, including CDATA and character references.<br>Done since: JavaScript engine (boa, sandboxed) running custom keystroke/validate/calculate/format and button scripts, document JavaScripts, console. Missing: Actions tab, wider object model (annotations, layers, dialogs), XFA<br>Done since: Multi-select choice fields write ascending `/I` option indices while preserving `/V` selection order; synthetic forms/engine regressions cover reverse selection and save/reopen. CSV export preserves carriage returns in names and values. |
 | M6 | Forms + JavaScript | 160–320 | 50% | 40–75 | Done: filling all field types with regenerated appearances; Prepare a form (every field type, multi-select/shared properties, move/resize/delete, Field Properties General/Appearance/Position/Options/Format/Validate/Calculate); Acrobat's AF format/keystroke/validate/calculate functions and simplified field notation run natively in Acrobat's event order; tab order; push-button actions; flatten; agent tools. Form data exchange (FDF, XFDF, XML, CSV, text) done; XFDF values retain text across XML comments and processing instructions. XML/XFDF exports preserve tabs and line breaks in names and comment metadata. Refreshed against upstream `99941daa` (2026-10-15).<br>Done since: JavaScript engine (boa, sandboxed) running custom keystroke/validate/calculate/format and button scripts, document JavaScripts, console. Missing: Actions tab, wider object model (annotations, layers, dialogs), XFA<br>Done since: Multi-select choice fields write ascending `/I` option indices while preserving `/V` selection order; synthetic forms/engine regressions cover reverse selection and save/reopen. CSV export preserves carriage returns in names and values. |
 | M6 | Forms + JavaScript | 160–320 | 50% | 40–75 | Done: filling all field types with regenerated appearances; Prepare a form (every field type, multi-select/shared properties, move/resize/delete, Field Properties General/Appearance/Position/Options/Format/Validate/Calculate); Acrobat's AF format/keystroke/validate/calculate functions and simplified field notation run natively in Acrobat's event order; tab order; push-button actions; flatten; agent tools. Form data exchange (FDF, XFDF, XML, CSV, text) done; XFDF values retain text across XML comments and processing instructions. XML/XFDF exports preserve tabs and line breaks in names and comment metadata. Plain AcroForm XML imports retain all direct text around comments and processing instructions, including CDATA and character references. CSV export and spreadsheet merging quote tabs, and import distinguishes quoted tabs from TSV delimiters without changing field identities.<br>Done since: JavaScript engine (boa, sandboxed) running custom keystroke/validate/calculate/format and button scripts, document JavaScripts, console. Missing: Actions tab, wider object model (annotations, layers, dialogs), XFA<br>Done since: Multi-select choice fields write ascending `/I` option indices while preserving `/V` selection order; synthetic forms/engine regressions cover reverse selection and save/reopen. CSV export preserves carriage returns in names and values. |
-| M7 | Content editing (text, images, header/footer, watermark) | 250–500 | 20% | 100–180 | Done: header & footer, watermarks, backgrounds, Bates; added text and images that stay editable (move, resize, format, rotate, flip, crop, replace); links (Link tool, Link Properties, create from URLs, remove all). Done since: Edit text preserves Arabic/Hebrew `/ActualText` typing order, with font-independent regressions; single-glyph RTL ligature spans (including lam-alef) join their surrounding word. Done since (#1116): editable text regions grouped across compatible words and subset fonts, one rich-text editor over a background with the source text removed, embedded sfnt faces reused as editor faces, and visible (clipped) bounds for cropped-image selection and resize. Exclusive crops now resize across nested states and content streams, with shared clips fixed.<br>Done since: #594 ordinary paragraph drags preserve overlapping source text; UI/engine regressions, native save/reopen, independent-reader checks and full CI passed in the Linux test environment. #1200 candidate: local GoToR links open in desktop tabs and through root-confined automation; appearance-only edits preserve existing actions. Named destinations remain unapplied and `/NewWindow` is a tab hint. Done since: #3187: Added-image automation normalizes extreme signed rotation angles before combining them with the current orientation; integer bounds, history, pixels, save/reopen and MCP have regressions. Done since: #2592: Styled fallback fonts batch up to 240 glyphs per actual face and retain source styles. Budget refusal and distinct same-BaseFont descriptor weights have mutation-checked regressions; coverage and complex mixed runs remain limited. Missing: editing existing text and images in place (the longest pole), image/PDF watermarks |
+| M7 | Content editing (text, images, header/footer, watermark) | 250–500 | 20% | 100–180 | Done: header & footer, watermarks, backgrounds, Bates; added text and images that stay editable (move, resize, format, rotate, flip, crop, replace); links (Link tool, Link Properties, create from URLs, remove all). Done since: Edit text preserves Arabic/Hebrew `/ActualText` typing order, with font-independent regressions; single-glyph RTL ligature spans (including lam-alef) join their surrounding word. Done since (#1116): editable text regions grouped across compatible words and subset fonts, one rich-text editor over a background with the source text removed, embedded sfnt faces reused as editor faces, and visible (clipped) bounds for cropped-image selection and resize. Exclusive crops now resize across nested states and content streams, with shared clips fixed.<br>Done since: #594 ordinary paragraph drags preserve overlapping source text; UI/engine regressions, native save/reopen, independent-reader checks and full CI passed in the Linux test environment. #1200 candidate: local GoToR links open in desktop tabs and through root-confined automation; appearance-only edits preserve existing actions. Named destinations remain unapplied and `/NewWindow` is a tab hint. Done since: #3187: Added-image automation normalizes extreme signed rotation angles before combining them with the current orientation; integer bounds, history, pixels, save/reopen and MCP have regressions. Done since: #2592: Styled fallback fonts batch up to 240 glyphs per actual face and retain source styles. Budget refusal and distinct same-BaseFont descriptor weights have mutation-checked regressions; coverage and complex mixed runs remain limited. Done since: #5657 page-mark operations are atomic across selected pages, including shared/inherited resources and existing unsaved edits. Missing: editing existing text and images in place (the longest pole), image/PDF watermarks PR #2155 candidate: editor-owned crops preserve original clips through group moves; Arrange preserves added-item stream ownership and refuses unsafe scope/state/tag extraction; image handles and flips follow page orientation; general transforms and Unicode script toggles have headless tools. Clipboard, mixed-size formatting, Home pins and reloadable installed-font discovery have review regressions. Latest follow-up uses explicit image-paste events, refreshes the mixed-size display, and documents script normalization with Undo. Further review covers inherited Form text and mask chronology, scoped transform composition, affine resize/rotation pivots, paste/selection ownership, no-op scripts and page-menu permissions. Done since: #5835 a right-click on an image in crop mode keeps the crop and opens no menu, also over overlapping and rotated images. |
 | M7 | Content editing (text, images, header/footer, watermark) | 250–500 | 20% | 100–180 | Done: header & footer, watermarks, backgrounds, Bates; added text and images that stay editable (move, resize, format, rotate, flip, crop, replace); links (Link tool, Link Properties, create from URLs, remove all). Done since: Edit text preserves Arabic/Hebrew `/ActualText` typing order, with font-independent regressions. Done since (#1116): editable text regions grouped across compatible words and subset fonts, one rich-text editor over a background with the source text removed, embedded sfnt faces reused as editor faces, and visible (clipped) bounds for cropped-image selection and resize. Exclusive crops now resize across nested states and content streams, with shared clips fixed.<br>Done since: #594 ordinary paragraph drags preserve overlapping source text; UI/engine regressions, native save/reopen, independent-reader checks and full CI passed in the Linux test environment. #1200 candidate: local GoToR links open in desktop tabs and through root-confined automation; appearance-only edits preserve existing actions. Named destinations remain unapplied and `/NewWindow` is a tab hint. #1316: replacing a line or paragraph keeps a neighbouring line whose glyph box overlaps when the baselines differ; a second copy on the same baseline is still replaced. Missing: editing existing text and images in place (the longest pole), image/PDF watermarks |
 | M7 | Content editing (text, images, header/footer, watermark) | 250–500 | 20% | 100–180 | Done: header & footer, watermarks, backgrounds, Bates; added text and images that stay editable (move, resize, format, rotate, flip, crop, replace); links (Link tool, Link Properties, create from URLs, remove all). #3212: Headers, Bates numbers, watermarks and added text stay visible after unfinished marked content, without revealing hidden content. Tracked editable text distinguishes repeated glyph spacing from word gaps, with synthetic paragraph/object regressions. Missing: editing existing text and images in place (the longest pole), watermark print/screen visibility and repeat |
 | M6 | Forms + JavaScript | 160–320 | 50% | 40–75 | Done: filling all field types with regenerated appearances; Prepare a form (every field type, multi-select/shared properties, move/resize/delete, Field Properties General/Appearance/Position/Options/Format/Validate/Calculate); Acrobat's AF format/keystroke/validate/calculate functions and simplified field notation run natively in Acrobat's event order; tab order; push-button actions; flatten; agent tools. Form data exchange (FDF, XFDF, XML, CSV, text) done; XFDF values retain text across XML comments and processing instructions.<br>Done since: JavaScript engine (boa, sandboxed) running custom keystroke/validate/calculate/format and button scripts, document JavaScripts, console. Missing: Actions tab, wider object model (annotations, layers, dialogs), XFA<br>Done since: Existing simple field-font encodings and Differences are respected when generating appearances; an unencodable value uses a separate Helvetica appearance font without changing the source font. Synthetic reopen regressions cover punctuation, subset fallback and multiline text. Exact font metrics/layout and broader Unicode fallback remain incomplete. |
@@ -231,7 +241,7 @@ total matches the parity estimate.
 | M13 | Automation (MCP, Action Wizard, CLI) + AI providers | 60–120 | 45% | 25–45 | Done: MCP resources (document info, text, page images); headless tool table (123 tools incl. signing, optimizing, initial view, links, stamps, data exchange, comment review, forms authoring and scripts, redaction, sanitize, print, add content), opt-in MCP server over stdio, CLI `run`/`tools` (closed stdout pipes exit cleanly), UI control channel with drag. Missing: Action Wizard, AI providers<br>Done since: CLI run and MCP reject missing, empty, repeated and option-valued --root arguments before any tool/script execution or MCP initialization. A single-hyphen directory name remains valid; synthetic CLI regressions preserve a would-be overwritten file. `text_find` also caps the per-page match ranges it materializes at the remaining result limit plus one continuation match. CLI robustness scans visit each directory once through overlapping roots and symlink aliases. |
 | M12 | Accessibility, compare, measure, search, XFA | 200–380 | 30% | 90–160 | Done: new `a11y` crate with the Accessibility Checker (all 32 rules, report, Fix/Skip/Explain, options dialog and results panel, agent tools). Locatable figure, annotation and form findings highlight their page bounds. Character encoding accepts Identity-H/V with Adobe CJK collections and predefined CJK CMaps independently (#3673); per-glyph validation and embedded-font extraction remain separate.<br>Done since: 2D distance, perimeter and area measurements with persistent viewport calibration, snapping, live information and CSV export; a bounded text-only auto-tag proposal tool; text-only Apply writes marked content, paragraph tags and a parent tree, then opens the Tags panel for review. Missing: mixed-content and field autotag, heading/list/table/figure classification, Order/Content panels, Reading Order tool, compare, geospatial/3D measurement, search index, XFA<br>Done since: CLI info, text and render use dynamic XFA layout pages, with synthetic count/text/pixel and copy-permission regressions (#1645).<br>Reading colours: pending page backgrounds follow the configured colour (#2059). |
 | M13 | Automation (MCP, Action Wizard, CLI) + AI providers | 60–120 | 45% | 25–45 | Done: MCP resources (document info, text, page images); headless tool table (123 tools incl. signing, optimizing, initial view, links, stamps, data exchange, comment review, forms authoring and scripts, redaction, sanitize, print, add content), opt-in MCP server over stdio, CLI `run`/`tools` (closed stdout pipes exit cleanly), UI control channel with drag. Missing: Action Wizard, AI providers<br>Done since: CLI run and MCP reject missing, empty, repeated and option-valued --root arguments before any tool/script execution or MCP initialization. A single-hyphen directory name remains valid; synthetic CLI regressions preserve a would-be overwritten file. `text_find` also caps the per-page match ranges it materializes at the remaining result limit plus one continuation match. |
-| M14 | 1.0 polish: performance, localization, installers | 120–250 | 15% | 80–150 | Done: PhotoCraft's translation system (`i18n/`: TSV catalogs, `tl!`, command-id and plural entries, system-language detection, strict catalog tests); every dialog, panel and notice goes through `tl!`. Catalogs of ≈ 2,000–2,140 entries for Japanese, Simplified and Traditional Chinese, Russian, Bulgarian, German, Spanish, French, Telugu, Hungarian, Ukrainian and Arabic (logical catalog; explicit right-to-left labels and mirrored stock chrome; end-to-end RTL workflows unqualified); the 2,674-entry Brazilian Portuguese catalog covers the current key union; Czech covers the menus. Italian has 2,528 entries: every key of the other catalogs that the code looks up. Signed and notarized macOS builds, signed Windows installers (x64, x86, ARM64), AppImage, deb, rpm, Flatpak and FreeBSD packages. #307 (bounded large-PDF memory): shared resource indexes and parser metadata, lazy inspection, bounded caches; a 9,156-page file inspects in ≈ 1.8 s at ≈ 500 MiB instead of exceeding 10 GiB. Edits let go of the previous working file before writing the next (a 1 GiB file peaks at two copies while editing, not three; gap 13). Shortcut display uses localized modifier/key names across menus, toolbar, palette, Help and tooltips (#496). Lithuanian adds a 2,578-entry catalog and date names, reviewed by a native-speaking contributor. Norwegian Bokmål adds a catalog and date names (terminology reviewed by a native speaker). Validated candidate (macOS raster probe; Windows runtime unverified): the Windows policy changes only embedded JetBrains Mono; horizontal alpha-edge energy per ink improves 2.78%, 3.87% and 1.59% at 100%, 125% and 150%, and is down 0.79% at 200%. Inter is pixel-identical; layout hashes, glyph coverage and the 8 MiB atlas are unchanged. Timing and RSS ranges overlap, with no improvement claimed. Estimates unchanged. Candidate #2383 clamps GPU requests to supported limits while retaining the adapter texture extent; synthetic V3D/downlevel and Windows GPU-required tests pass, but Raspberry Pi startup is unverified. Missing: end-to-end RTL workflow qualification, a Chinese web UI face, Hindi/Indonesian/Korean, file-backed input and global memory budgets, performance budgets, keyboard-only operation Linux/Unix UI fallback fonts also use Fontconfig directories, including Nix store paths, with bounded discovery and the existing candidate allowlist; relative includes and digit-prefixed config filtering have isolated regressions. Missing: end-to-end RTL workflow qualification, a Chinese web UI face, Hindi/Indonesian/Korean, file-backed input and global memory budgets, performance budgets, keyboard-only operation XDG desktops use the configuration base for preferences with non-overwriting migration and original-data preservation (#1395). Traditional Chinese accessibility statuses, rule semantics and Taiwan form/table terms have catalog regressions. Long main-menu lists scroll in short windows (#3373). Missing: end-to-end RTL workflow qualification, a Chinese web UI face, Hindi/Indonesian/Korean, file-backed input and global memory budgets, performance budgets, keyboard-only operation. Candidate #3558: bounded-worker macOS per-file PDFCraft association recovery after desktop open/save/sign; metadata-only watcher handling and upstream #3042 shared-writer preservation; recovery parser limits do not narrow save limits. Native workflow qualified on macOS 27.0.1; other versions and physical SMB/FUSE volumes remain unqualified. Estimates unchanged. Missing: end-to-end RTL workflow qualification, a Chinese web UI face, Hindi/Indonesian/Korean/Vietnamese, file-backed input and global memory budgets, performance budgets, keyboard-only operation. |
+| M14 | 1.0 polish: performance, localization, installers | 120–250 | 15% | 80–150 | Local customization: adjustable, floating or side-docked hotbar with optional full-side strip and persistent tool picker; freehand highlighting is grouped with Highlight. Estimates unchanged. Done: PhotoCraft's translation system (`i18n/`: TSV catalogs, `tl!`, command-id and plural entries, system-language detection, strict catalog tests); every dialog, panel and notice goes through `tl!`. Catalogs of ≈ 2,000–2,140 entries for Japanese, Simplified and Traditional Chinese, Russian, Bulgarian, German, Spanish, French, Telugu, Hungarian, Ukrainian and Arabic (logical catalog; explicit right-to-left labels and mirrored stock chrome; end-to-end RTL workflows unqualified); the 2,674-entry Brazilian Portuguese catalog covers the current key union; Czech covers the menus. Italian has 2,528 entries: every key of the other catalogs that the code looks up. Signed and notarized macOS builds, signed Windows installers (x64, x86, ARM64), AppImage, deb, rpm, Flatpak and FreeBSD packages. #307 (bounded large-PDF memory): shared resource indexes and parser metadata, lazy inspection, bounded caches; a 9,156-page file inspects in ≈ 1.8 s at ≈ 500 MiB instead of exceeding 10 GiB. Edits let go of the previous working file before writing the next (a 1 GiB file peaks at two copies while editing, not three; gap 13). Shortcut display uses localized modifier/key names across menus, toolbar, palette, Help and tooltips (#496). Lithuanian adds a 2,578-entry catalog and date names, reviewed by a native-speaking contributor. Norwegian Bokmål adds a catalog and date names (terminology reviewed by a native speaker). Validated candidate (macOS raster probe; Windows runtime unverified): the Windows policy changes only embedded JetBrains Mono; horizontal alpha-edge energy per ink improves 2.78%, 3.87% and 1.59% at 100%, 125% and 150%, and is down 0.79% at 200%. Inter is pixel-identical; layout hashes, glyph coverage and the 8 MiB atlas are unchanged. Timing and RSS ranges overlap, with no improvement claimed. Estimates unchanged. Candidate #2383 clamps GPU requests to supported limits while retaining the adapter texture extent; synthetic V3D/downlevel and Windows GPU-required tests pass, but Raspberry Pi startup is unverified. Missing: end-to-end RTL workflow qualification, a Chinese web UI face, Hindi/Indonesian/Korean, file-backed input and global memory budgets, performance budgets, keyboard-only operation Linux/Unix UI fallback fonts also use Fontconfig directories, including Nix store paths, with bounded discovery and the existing candidate allowlist; relative includes and digit-prefixed config filtering have isolated regressions. Missing: end-to-end RTL workflow qualification, a Chinese web UI face, Hindi/Indonesian/Korean, file-backed input and global memory budgets, performance budgets, keyboard-only operation XDG desktops use the configuration base for preferences with non-overwriting migration and original-data preservation (#1395). Traditional Chinese accessibility statuses, rule semantics and Taiwan form/table terms have catalog regressions. Long main-menu lists scroll in short windows (#3373). Missing: end-to-end RTL workflow qualification, a Chinese web UI face, Hindi/Indonesian/Korean, file-backed input and global memory budgets, performance budgets, keyboard-only operation. Candidate #3558: bounded-worker macOS per-file PDFCraft association recovery after desktop open/save/sign; metadata-only watcher handling and upstream #3042 shared-writer preservation; recovery parser limits do not narrow save limits. Native workflow qualified on macOS 27.0.1; other versions and physical SMB/FUSE volumes remain unqualified. Estimates unchanged. Missing: end-to-end RTL workflow qualification, a Chinese web UI face, Hindi/Indonesian/Korean/Vietnamese, file-backed input and global memory budgets, performance budgets, keyboard-only operation. |
 | M13 | Automation (MCP, Action Wizard, CLI) + AI providers | 60–120 | 45% | 25–45 | Done: MCP resources (document info, text, page images); headless tool table (123 tools incl. signing, optimizing, initial view, links, stamps, data exchange, comment review, forms authoring and scripts, redaction, sanitize, print, add content), opt-in MCP server over stdio, CLI `run`/`tools` (closed stdout pipes exit cleanly), UI control channel with drag. Missing: Action Wizard, AI providers |
 | | **Total** | **2,085–3,840** | **≈ 49% ready** | **≈ 770–1,400** | Area view of the same work: [target-app-parity.md](target-app-parity.md#by-feature-area) |
 
@@ -290,6 +300,10 @@ Estimates unchanged.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-11-02 | patch | M10 #5743: macOS print jobs carry the job name and owner some vendors' filters need; not yet checked on a physical printer |
+| 2026-11-01 | patch | M7 #5657: header/footer, watermark and background operations commit all selected pages together; later-page errors preserve marks, content, shared/inherited resources and pending edits; estimates unchanged. |
+| 2026-10-31 | patch | #1577: reconcile optional page shadows with current viewer/organizer and settings modules; CI validation pending. |
+| 2026-10-31 | patch | M3 #1354: reconcile the launch override with split app/file modules and the structured open result; preserve headless help/version exits. CI validation pending. |
 | 2026-10-31 | patch | M2, PR #4172: eight GBK font/alias cases compare exact pixels with independent installed-face and explicit-Unicode references; wrong-glyph and wrong-family negative controls fail. Estimates unchanged. |
 | 2026-10-31 | patch | M2, PR #4172: integrate main fa5f9f8c, preserve both raster test groups and restore explicit display_config imports; display-only CJK policy and estimates unchanged. |
 | 2026-10-28 | patch | M2, PR #4172: integrate main 5af10276 and retain both roadmap histories; viewer-only CJK and print/output font policies and estimates unchanged. |
diff --git a/docs/ui-parity.md b/docs/ui-parity.md
index 86eb0c66e7..f950e36a94 100644
--- a/docs/ui-parity.md
+++ b/docs/ui-parity.md
@@ -26,7 +26,7 @@ No dump of Acrobat's menu tree has been diffed against the registry yet (gap 24)
 |---|---|---|---|
 | Home view (recent files, recommended tools) | yes | yes | shipped |
 | All tools pane, tool sets | yes | yes, with milestone badges | shipped |
-| Quick-action toolbar, customisable | yes | fixed | partial (`view.customize-quick-tools` planned) |
+| Quick-action toolbar, customisable | yes | customizable floating/docked hotbar, adjustable size, persistent multi-select picker | partial (`view.customize-quick-tools`; no shortcut reordering) |
 | Command search | "Search tools" | command palette (⌘K), matches translated and English labels | shipped |
 | Document tabs | yes | yes, with unsaved marker | shipped |
 | Multiple windows, drag a tab out | yes | no | planned |
diff --git a/licenses/CMap-LICENSE.txt b/licenses/CMap-LICENSE.txt
new file mode 100644
index 0000000000..2552cc990c
--- /dev/null
+++ b/licenses/CMap-LICENSE.txt
@@ -0,0 +1,28 @@
+Copyright 1990-2023 Adobe. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+Redistributions of source code must retain the above copyright notice,
+this list of conditions and the following disclaimer.
+
+Redistributions in binary form must reproduce the above copyright
+notice, this list of conditions and the following disclaimer in the
+documentation and/or other materials provided with the distribution.
+
+Neither the name of Adobe nor the names of its contributors may be
+used to endorse or promote products derived from this software without
+specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/licenses/egui-Hack-Regular.txt b/licenses/egui-Hack-Regular.txt
new file mode 100644
index 0000000000..b0ec74488a
--- /dev/null
+++ b/licenses/egui-Hack-Regular.txt
@@ -0,0 +1,31 @@
+The work in the Hack project is Copyright 2018 Source Foundry Authors and licensed under the MIT License
+
+The work in the DejaVu project was committed to the public domain.
+
+Bitstream Vera Sans Mono Copyright 2003 Bitstream Inc. and licensed under the Bitstream Vera License with Reserved Font Names "Bitstream" and "Vera"
+MIT License
+
+Copyright (c) 2018 Source Foundry Authors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+BITSTREAM VERA LICENSE
+
+Copyright (c) 2003 by Bitstream, Inc. All Rights Reserved. Bitstream Vera is a trademark of Bitstream, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of the fonts accompanying this license ("Fonts") and associated documentation files (the "Font Software"), to reproduce and distribute the Font Software, including without limitation the rights to use, copy, merge, publish, distribute, and/or sell copies of the Font Software, and to permit persons to whom the Font Software is furnished to do so, subject to the following conditions:
+
+The above copyright and trademark notices and this permission notice shall be included in all copies of one or more of the Font Software typefaces.
+
+The Font Software may be modified, altered, or added to, and in particular the designs of glyphs or characters in the Fonts may be modified and additional glyphs or characters may be added to the Fonts, only if the fonts are renamed to names not containing either the words "Bitstream" or the word "Vera".
+
+This License becomes null and void to the extent applicable to Fonts or Font Software that has been modified and is distributed under the "Bitstream Vera" names.
+
+The Font Software may be sold as part of a larger software package but no copy of one or more of the Font Software typefaces may be sold by itself.
+
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL BITSTREAM OR THE GNOME FOUNDATION BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM OTHER DEALINGS IN THE FONT SOFTWARE.
+
+Except as contained in this notice, the names of Gnome, the Gnome Foundation, and Bitstream Inc., shall not be used in advertising or otherwise to promote the sale, use or other dealings in this Font Software without prior written authorization from the Gnome Foundation or Bitstream Inc., respectively. For further information, contact: fonts at gnome dot org.
diff --git a/licenses/egui-OFL.txt b/licenses/egui-OFL.txt
new file mode 100644
index 0000000000..d952d62c06
--- /dev/null
+++ b/licenses/egui-OFL.txt
@@ -0,0 +1,92 @@
+This Font Software is licensed under the SIL Open Font License,
+Version 1.1.
+
+This license is copied below, and is also available with a FAQ at:
+http://scripts.sil.org/OFL
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font
+creation efforts of academic and linguistic communities, and to
+provide a free and open framework in which fonts may be shared and
+improved in partnership with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded,
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply to
+any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software
+components as distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to,
+deleting, or substituting -- in part or in whole -- any of the
+components of the Original Version, by changing formats or by porting
+the Font Software to a new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed,
+modify, redistribute, and sell modified and unmodified copies of the
+Font Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components, in
+Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the
+corresponding Copyright Holder. This restriction only applies to the
+primary font name as presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created using
+the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.
diff --git a/licenses/egui-UFL.txt b/licenses/egui-UFL.txt
new file mode 100644
index 0000000000..ae78a8f94e
--- /dev/null
+++ b/licenses/egui-UFL.txt
@@ -0,0 +1,96 @@
+-------------------------------
+UBUNTU FONT LICENCE Version 1.0
+-------------------------------
+
+PREAMBLE
+This licence allows the licensed fonts to be used, studied, modified and
+redistributed freely. The fonts, including any derivative works, can be
+bundled, embedded, and redistributed provided the terms of this licence
+are met. The fonts and derivatives, however, cannot be released under
+any other licence. The requirement for fonts to remain under this
+licence does not require any document created using the fonts or their
+derivatives to be published under this licence, as long as the primary
+purpose of the document is not to be a vehicle for the distribution of
+the fonts.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this licence and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Original Version" refers to the collection of Font Software components
+as received under this licence.
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to
+a new environment.
+
+"Copyright Holder(s)" refers to all individuals and companies who have a
+copyright ownership of the Font Software.
+
+"Substantially Changed" refers to Modified Versions which can be easily
+identified as dissimilar to the Font Software by users of the Font
+Software comparing the Original Version with the Modified Version.
+
+To "Propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy. Propagation includes copying,
+distribution (with or without modification and with or without charging
+a redistribution fee), making available to the public, and in some
+countries other activities as well.
+
+PERMISSION & CONDITIONS
+This licence does not grant any rights under trademark law and all such
+rights are reserved.
+
+Permission is hereby granted, free of charge, to any person obtaining a
+copy of the Font Software, to propagate the Font Software, subject to
+the below conditions:
+
+1) Each copy of the Font Software must contain the above copyright
+notice and this licence. These can be included either as stand-alone
+text files, human-readable headers or in the appropriate machine-
+readable metadata fields within text or binary files as long as those
+fields can be easily viewed by the user.
+
+2) The font name complies with the following:
+(a) The Original Version must retain its name, unmodified.
+(b) Modified Versions which are Substantially Changed must be renamed to
+avoid use of the name of the Original Version or similar names entirely.
+(c) Modified Versions which are not Substantially Changed must be
+renamed to both (i) retain the name of the Original Version and (ii) add
+additional naming elements to distinguish the Modified Version from the
+Original Version. The name of such Modified Versions must be the name of
+the Original Version, with "derivative X" where X represents the name of
+the new work, appended to that name.
+
+3) The name(s) of the Copyright Holder(s) and any contributor to the
+Font Software shall not be used to promote, endorse or advertise any
+Modified Version, except (i) as required by this licence, (ii) to
+acknowledge the contribution(s) of the Copyright Holder(s) or (iii) with
+their explicit written permission.
+
+4) The Font Software, modified or unmodified, in part or in whole, must
+be distributed entirely under this licence, and must not be distributed
+under any other licence. The requirement for fonts to remain under this
+licence does not affect any document created using the Font Software,
+except any version of the Font Software extracted from a document
+created using the Font Software may only be distributed under this
+licence.
+
+TERMINATION
+This licence becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF
+COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM OTHER
+DEALINGS IN THE FONT SOFTWARE.
diff --git a/licenses/egui-emoji-icon-font-mit-license.txt b/licenses/egui-emoji-icon-font-mit-license.txt
new file mode 100644
index 0000000000..99016e120b
--- /dev/null
+++ b/licenses/egui-emoji-icon-font-mit-license.txt
@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) 2014 John Slegers
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/packaging/linux/flatpak-bundle.sh b/packaging/linux/flatpak-bundle.sh
index 26e09cd1c8..0534b3194e 100755
--- a/packaging/linux/flatpak-bundle.sh
+++ b/packaging/linux/flatpak-bundle.sh
@@ -20,10 +20,12 @@ APP_ID=ai.storyteller.pdfcraft
 FLATHUB=https://dl.flathub.org/repo/flathub.flatpakrepo
 
 TEST=1
+OCI=0
 TARBALL=""
 while [[ $# -gt 0 ]]; do
   case "$1" in
     --no-test) TEST=0; shift ;;
+    --oci) OCI=1; shift ;;
     -h | --help) sed -n '2,14p' "$0"; exit 0 ;;
     -*) echo "unknown argument: $1" >&2; exit 2 ;;
     *) TARBALL="$1"; shift ;;
@@ -62,6 +64,13 @@ OUT="$DIST/$BASENAME.flatpak"
 flatpak build-bundle --runtime-repo="$FLATHUB" "$WORK/repo" "$OUT" "$APP_ID" stable
 echo "wrote $OUT"
 
+if [[ "$OCI" = 1 ]]; then
+  OUT_OCI="$DIST/$BASENAME-oci"
+  rm -rf "$OUT_OCI"
+  flatpak build-bundle --oci "$WORK/repo" "$OUT_OCI" "$APP_ID" stable
+  echo "wrote OCI layout to $OUT_OCI"
+fi
+
 if [[ "$TEST" = 1 ]]; then
   flatpak install --user -y --noninteractive --reinstall "$OUT"
   flatpak info --user "$APP_ID"
diff --git a/packaging/linux/flatpak-oci.sh b/packaging/linux/flatpak-oci.sh
new file mode 100755
index 0000000000..0572ef1a3a
--- /dev/null
+++ b/packaging/linux/flatpak-oci.sh
@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+# Build PdfCraft as an OCI container layout and push it to GitHub Container Registry (GHCR)
+# for consumption by Flatpak OCI clients (flatpak-oci-specs).
+#
+# Usage:
+#   packaging/linux/flatpak-oci.sh [--push] [TARBALL]
+#
+# Environment variables:
+#   REGISTRY       Target registry image (default: ghcr.io/storytold/pdfcraft)
+#   TAG            Target image tag (default: $VERSION-$ARCH, also tags stable and latest)
+#   GITHUB_TOKEN   Token for GHCR authentication when --push is used
+set -euo pipefail
+# shellcheck source=../env.sh
+. "$(dirname "${BASH_SOURCE[0]}")/../env.sh"
+HERE="$ROOT/packaging/linux"
+
+PUSH=0
+TARBALL=""
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --push) PUSH=1; shift ;;
+    -h | --help) sed -n '2,12p' "$0"; exit 0 ;;
+    -*) echo "unknown argument: $1" >&2; exit 2 ;;
+    *) TARBALL="$1"; shift ;;
+  esac
+done
+
+ARCH="$(uname -m)"
+case "$ARCH" in
+  x86_64) ;;
+  aarch64 | arm64) ARCH=aarch64 ;;
+  *) echo "unsupported architecture $ARCH" >&2; exit 2 ;;
+esac
+
+BASENAME="pdfcraft-$VERSION-linux-$ARCH"
+OUT_OCI="$DIST/$BASENAME-oci"
+
+echo "==> Building Flatpak OCI layout for $BASENAME"
+"$HERE/flatpak-bundle.sh" --oci --no-test "${TARBALL:-}"
+
+[[ -d "$OUT_OCI" ]] || { echo "error: $OUT_OCI layout not generated" >&2; exit 1; }
+
+REGISTRY="${REGISTRY:-ghcr.io/storytold/pdfcraft}"
+TAG="${TAG:-$VERSION-$ARCH}"
+
+echo "==> OCI layout ready at $OUT_OCI (Target: $REGISTRY:$TAG)"
+
+if [[ "$PUSH" = 1 ]]; then
+  command -v skopeo >/dev/null || { echo "error: skopeo is required to push OCI images (apt install skopeo)" >&2; exit 1; }
+
+  AUTH_ARGS=()
+  if [[ -n "${GITHUB_TOKEN:-}" ]]; then
+    AUTH_ARGS=(--dest-creds "${GITHUB_ACTOR:-storytold}:$GITHUB_TOKEN")
+  fi
+
+  echo "==> Pushing to $REGISTRY:$TAG"
+  skopeo copy --format oci "${AUTH_ARGS[@]}" "oci:$OUT_OCI" "docker://$REGISTRY:$TAG"
+
+  # Also update architecture-specific stable tag
+  echo "==> Pushing to $REGISTRY:stable-$ARCH"
+  skopeo copy --format oci "${AUTH_ARGS[@]}" "oci:$OUT_OCI" "docker://$REGISTRY:stable-$ARCH"
+
+  echo "==> Push complete"
+fi
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 0b6f658dd6..ef4007bc80 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -130,8 +130,8 @@ milestone = "M1"
 status = "partial"
 commands = []
 tools = []
-evidence = ["crates/filters/src/ccitt.rs::decoding_gives_the_rows_back", "crates/filters/src/ccitt.rs::group_3_rows_on_bytes_read_by_the_codes_in_the_data", "crates/cos/src/document/tests.rs::fax_images_decode_with_their_parameters"]
-notes = "decoded through the hayro bootstrap for display; own codecs are M1.1/M1.2. CCITT fax decoding is in filters (decode_ccitt, through hayro-ccitt), which Document::decoded_image uses for Export ▸ Images, the optimizer and redaction. Byte-aligned Group 3 is read by its end-of-line codes when the data starts with one and on bytes otherwise; still limited: data with codes but none before the first row (not as T.4 sends them) is read on bytes, as the renderer draws it, and at /K 0 may come out as other rows, which the optimizer then writes back. The bootstrap renderer draws byte-aligned Group 3 whose fill ends each end-of-line code on a byte as other rows (black box, at every /K), which decode_ccitt reads right; redaction removes Group 3 on bytes whole"
+evidence = ["crates/filters/src/ccitt.rs::decoding_gives_the_rows_back", "crates/filters/src/ccitt.rs::group_3_rows_on_bytes_read_by_the_codes_in_the_data", "crates/cos/src/document/tests.rs::fax_images_decode_with_their_parameters", "crates/filters/src/jbig2/decode.rs::both_codings_decode_to_their_samples", "crates/filters/src/jbig2/decode.rs::what_it_cannot_decode_is_an_error", "crates/cos/src/document/tests.rs::jbig2_images_decode_with_their_globals", "crates/cos/src/document/tests.rs::shared_jbig2_globals_are_read_once"]
+notes = "decoded through the hayro bootstrap for display; own codecs are M1.1/M1.2. CCITT fax decoding is in filters (decode_ccitt, through hayro-ccitt), which Document::decoded_image uses for Export ▸ Images, the optimizer and redaction; so is JBIG2 decoding (decode_jbig2, through hayro-jbig2, the page bounded before it is decoded), which it uses with the image's /JBIG2Globals (within 32 MiB) for Export ▸ Images, Copy Image, redaction and the optimizer. Byte-aligned Group 3 is read by its end-of-line codes when the data starts with one and on bytes otherwise; still limited: data with codes but none before the first row (not as T.4 sends them) is read on bytes, as the renderer draws it, and at /K 0 may come out as other rows, which the optimizer then writes back. The bootstrap renderer draws byte-aligned Group 3 whose fill ends each end-of-line code on a byte as other rows (black box, at every /K), which decode_ccitt reads right; redaction removes Group 3 on bytes whole"
 
 [[feature]]
 id = "core.decompression-limits"
@@ -890,8 +890,8 @@ milestone = "M3"
 status = "shipped"
 commands = ["view.layout.two_up"]
 tools = []
-evidence = ["crates/ui-egui/tests/it/view.rs::two_up_layout_places_pages_side_by_side", "crates/ui-egui/tests/it/viewer.rs::two_page_view_steps_a_spread_at_a_time"]
-notes = "next/previous page step a spread at a time"
+evidence = ["crates/ui-egui/tests/it/view.rs::two_up_layout_places_pages_side_by_side", "crates/ui-egui/tests/it/viewer.rs::two_page_view_steps_a_spread_at_a_time", "apps/pdfcraft/src/startup.rs::startup_override_is_per_file_and_does_not_persist", "crates/ui-egui/src/platform/open_worker/tests.rs::flagged_startup_opens_wait_for_password_ownership_before_the_first_frame"]
+notes = "Next/previous page step a spread at a time. Optional desktop --two-paged launches named PDFs in noncontinuous two-page view without changing saved defaults or unrelated restored tabs. Explicit --layout wins after flagged opens settle, including password retries; repeated files reuse their tab. This is a launch override, not a declarative configuration module."
 
 [[feature]]
 id = "view.layout-two-up-scrolling"
@@ -938,8 +938,8 @@ milestone = "M3"
 status = "partial"
 commands = []
 tools = []
-evidence = ["crates/ui-egui/tests/it/control.rs::middle_click_autoscroll_latches_has_a_dead_zone_and_scrolls_both_directions", "crates/ui-egui/tests/it/control.rs::organize_pages_supports_autoscroll_without_selecting_or_reordering_pages", "crates/ui-egui/tests/it/control.rs::moving_before_middle_button_release_keeps_scrolling_without_starting_page_tools", "crates/ui-egui/tests/it/control.rs::farther_from_the_click_scrolls_faster_in_the_viewer_and_page_grid", "crates/ui-egui/tests/it/control.rs::autoscroll_uses_the_initial_click_position_when_input_arrives_in_one_frame", "crates/ui-egui/tests/it/control.rs::autoscroll_uses_elapsed_frame_time_and_preserves_fractional_motion_in_both_views", "crates/ui-egui/tests/it/control.rs::middle_button_pans_while_held_outside_linux", "crates/ui-egui/tests/it/comments.rs::a_middle_drag_with_a_drawing_tool_scrolls_instead_of_drawing"]
-notes = "Linux-only middle-button vertical autoscroll in the document and Organize Pages; Windows and macOS pan 1:1 while the middle button is held (Grabbing cursor, no latch). On every target the middle button never reaches the page tools, so it scrolls instead of drawing, selecting, cropping or moving. Click to toggle, release keeps scrolling on, and a Chromium-style nonlinear curve increases speed with vertical screen distance from the initial click. A 15-point dead zone pauses immediately. Continuous redraws use elapsed frame time and preserve fractional movement, tested at 30/60/120/144 fps. Cancels on another middle click, Escape, other pointer/wheel input, focus loss, tab changes and dialogs. Driven headlessly through the opt-in UI control channel (ui.click/ui.move/ui.drag). Keyboard-started timed scrolling is not implemented."
+evidence = ["crates/ui-egui/tests/it/control.rs::middle_click_autoscroll_latches_has_a_dead_zone_and_scrolls_both_directions", "crates/ui-egui/tests/it/control.rs::organize_pages_supports_autoscroll_without_selecting_or_reordering_pages", "crates/ui-egui/tests/it/control.rs::moving_before_middle_button_release_keeps_scrolling_without_starting_page_tools", "crates/ui-egui/tests/it/control.rs::farther_from_the_click_scrolls_faster_in_the_viewer_and_page_grid", "crates/ui-egui/tests/it/control.rs::autoscroll_uses_the_initial_click_position_when_input_arrives_in_one_frame", "crates/ui-egui/tests/it/control.rs::autoscroll_uses_elapsed_frame_time_and_preserves_fractional_motion_in_both_views", "crates/ui-egui/tests/it/control.rs::middle_button_pans_while_held_outside_linux", "crates/ui-egui/tests/it/comments.rs::a_middle_drag_with_a_drawing_tool_scrolls_instead_of_drawing", "crates/ui-egui/tests/it/control.rs::inverted_middle_drag_moves_the_view_the_way_the_pointer_goes", "crates/ui-egui/tests/it/viewer.rs::the_invert_middle_drag_preference_is_off_by_default_and_kept_in_the_settings"]
+notes = "Linux-only middle-button vertical autoscroll in the document and Organize Pages; Windows and macOS pan 1:1 while the middle button is held (Grabbing cursor, no latch). On every target the middle button never reaches the page tools, so it scrolls instead of drawing, selecting, cropping or moving. Click to toggle, release keeps scrolling on, and a Chromium-style nonlinear curve increases speed with vertical screen distance from the initial click. A 15-point dead zone pauses immediately. Continuous redraws use elapsed frame time and preserve fractional movement, tested at 30/60/120/144 fps. Cancels on another middle click, Escape, other pointer/wheel input, focus loss, tab changes and dialogs. Preferences ▸ Invert middle-button drag (off by default, saved; ui.set invert_middle_drag) reverses the direction of both the pan and the auto-scroll (#5790); it changes direction only, not which of the two a platform uses. Driven headlessly through the opt-in UI control channel (ui.click/ui.move/ui.drag). Keyboard-started timed scrolling is not implemented."
 
 [[feature]]
 id = "view.zoom-in-out"
@@ -1287,7 +1287,7 @@ status = "shipped"
 commands = []
 tools = []
 evidence = ["crates/ui-egui/tests/it/view.rs::pages_sidebar_select_all_keeps_current_page_and_keyboard_scope", "crates/ui-egui/tests/it/editing.rs::dragging_pages_panel_thumbnails_reorders_pages", "crates/ui-egui/tests/it/viewer.rs::pages_panel_thumbnails_have_a_context_menu", "crates/ui-egui/tests/it/editing.rs::split_from_pages_panel_context_menu", "crates/ui-egui/tests/it/editing.rs::deleting_pages_from_the_pages_panel_menu", "crates/ui-egui/tests/it/editing.rs::the_delete_key_deletes_pages_picked_in_the_pages_panel_but_never_every_page"]
-notes = "Ctrl/Cmd+A selects every page while the Pages sidebar owns the keyboard, without navigation; Escape clears that selection. Viewer and text-field shortcuts keep their own scope. Drag the selection (or the page grabbed) to reorder, with a drop bar and edge scrolling; right-click offers Split document…, Extract pages, Cut, Copy, Paste after and Delete pages (also the Delete key over the panel). Not yet: Rotate, Insert and Page labels in the menu, dragging pages between documents, or dropping files onto the panel."
+notes = "Ctrl/Cmd+A selects every page while the Pages sidebar owns the keyboard, without navigation; Escape clears that selection. Viewer and text-field shortcuts keep their own scope. Drag the selection (or the page grabbed) to reorder, with a drop bar and edge scrolling; right-click offers Split document…, Extract pages, Cut, Copy, Paste after and Delete pages (also the Delete key over the panel). Deleting pages makes the next Save a full rewrite (unsigned files), so the deleted pages leave the file; signed files stay incremental. Not yet: Rotate, Insert and Page labels in the menu, dragging pages between documents, or dropping files onto the panel."
 
 [[feature]]
 id = "view.bookmarks-panel"
@@ -1598,8 +1598,8 @@ milestone = "M3"
 status = "partial"
 commands = []
 tools = []
-evidence = ["crates/ui-egui/tests/it/viewer.rs::a_clicked_picture_is_selected_and_copied_in_its_original_format", "crates/ui-egui/tests/it/viewer.rs::right_click_on_a_picture_copies_it_at_full_size", "crates/ui-egui/tests/it/viewer.rs::a_picture_inside_form_artwork_under_text_is_selected_and_copied", "crates/engine/src/tests.rs::copy_image_finds_a_picture_inside_form_artwork_under_text"]
-notes = "Select tool: a click selects a raster image (also inside Form artwork or under text) and ⌘C copies it as a file in its original format (JPEG as stored, else PNG); right-click ▸ Copy Image copies its pixels at full resolution. Missing: inline images (BI/ID/EI), JPEG 2000 images and JBIG2 inside other filters, multi-format clipboard (file and bitmap at once), the web build"
+evidence = ["crates/ui-egui/tests/it/viewer.rs::a_clicked_picture_is_selected_and_copied_in_its_original_format", "crates/ui-egui/tests/it/viewer.rs::right_click_on_a_picture_copies_it_at_full_size", "crates/ui-egui/tests/it/viewer.rs::a_picture_inside_form_artwork_under_text_is_selected_and_copied", "crates/engine/src/tests.rs::copy_image_finds_a_picture_inside_form_artwork_under_text", "crates/engine/src/tests.rs::copy_image_copies_a_jbig2_picture_behind_another_filter", "crates/engine/src/tests.rs::copy_image_reads_the_globals_of_a_jbig2_picture"]
+notes = "Select tool: a click selects a raster image (also inside Form artwork or under text) and ⌘C copies it as a file in its original format (JPEG as stored, else PNG); right-click ▸ Copy Image copies its pixels at full resolution. Missing: inline images (BI/ID/EI), JPEG 2000 images, multi-format clipboard (file and bitmap at once), the web build"
 
 [[feature]]
 id = "view.rulers"
@@ -1799,11 +1799,28 @@ title = "Customise the quick-action toolbar and pinned tools"
 area = "B"
 tier = "P2"
 milestone = "M14"
-status = "planned"
+status = "partial"
 commands = []
 tools = []
-evidence = []
-notes = ""
+evidence = [
+  "crates/ui-egui/tests/it/pinned_tools.rs::state_operations_and_validation",
+  "crates/ui-egui/tests/it/pinned_tools.rs::persistence_round_trip_and_sanitization",
+  "crates/ui-egui/tests/it/pinned_tools.rs::home_shows_pinned_tools_section_and_placeholder",
+  "crates/ui-egui/tests/it/pinned_tools.rs::pin_tool_dialog_workflow",
+  "crates/ui-egui/tests/it/pinned_tools.rs::sidebar_pin_toggle_unpins_and_pins",
+  "crates/ui-egui/tests/it/comments.rs::hotbar_picker_adds_and_runs_freehand_highlight",
+  "crates/ui-egui/tests/it/comments.rs::hotbar_drag_moves_and_persists_position",
+  "crates/ui-egui/tests/it/comments.rs::hotbar_vertical_size_and_docking",
+  "crates/ui-egui/tests/it/comments.rs::hotbar_settings_reopen_even_with_remembered_collapsed_state",
+  "crates/ui-egui/tests/it/comments.rs::hotbar_full_side_strip_spans_each_edge_and_returns_to_float",
+  "crates/ui-egui/tests/it/comments.rs::hotbar_docked_left_does_not_override_quick_tools",
+  "crates/ui-egui/tests/it/comments.rs::hotbar_docked_in_compact_window_keeps_settings_button_visible",
+  "crates/ui-egui/tests/it/comments.rs::hotbar_settings_menu_closes_on_click_outside",
+  "crates/ui-egui/tests/it/comments.rs::hotbar_picker_in_narrow_viewport_fits_within_screen_width",
+  "crates/ui-egui/tests/it/comments.rs::hotbar_floating_picker_does_not_overlap_rendered_bar",
+  "crates/ui-egui/tests/it/comments.rs::hotbar_settings_layout_and_side_controls_are_reachable_by_label",
+]
+notes = "Pin and unpin tools on the Home page via tool card hover button, All Tools row toggle, or 'Pin a tool' search dialog. Pinned tool order persists across sessions. Customizable document hotbar searches the command registry, adds/removes tools, resizes buttons from 24 to 64 pixels, floats or docks on any side with an optional full-side chrome strip, and persists preferences (UI control: hotbar-tools, hotbar-size, hotbar-side, hotbar-full-side). Missing: hotbar shortcut reordering and full Acrobat customization-dialog parity."
 
 [[feature]]
 id = "view.restriction-notice"
@@ -1959,11 +1976,19 @@ title = "Superscript and subscript"
 area = "C"
 tier = "P2"
 milestone = "M7"
-status = "planned"
-commands = []
-tools = []
-evidence = []
-notes = ""
+status = "partial"
+commands = ["edit.edit_text"]
+tools = ["text_script"]
+evidence = [
+  "crates/engine/src/text_script.rs::every_form_toggles_back_to_its_character",
+  "crates/engine/src/text_script.rs::text_with_characters_unicode_cannot_raise_toggles_back",
+  "crates/ui-egui/src/tools/edit_text_ui.rs::superscript_and_subscript_conversion",
+  "crates/ui-egui/tests/it/editing.rs::the_format_panel_toggles_superscript_and_subscript_on_selection",
+  "crates/automation/tests/it/automation.rs::superscript_and_subscript_through_tools",
+  "crates/engine/src/text_script.rs::mixed_plain_and_scripted_text_normalizes_instead_of_round_tripping",
+  "crates/automation/tests/it/automation.rs::mixed_script_tools_normalize_but_undo_restores_the_exact_mixture",
+]
+notes = "Toggled in the Format text panel for the selection, and headlessly with text_script on a paragraph or a byte range of it; each toggle of a paragraph is one undo step. Uses Unicode superscript and subscript forms (2 ↔ ²) rather than text rise (Ts) and font scaling, so the font must provide the corresponding glyphs and extracted text contains the Unicode characters. Characters Unicode has no form for (q, most capitals in subscript) stay unchanged and do not determine script state. Two toggles restore uniformly plain or uniformly scripted inputs. Mixed input normalizes (H₂2 → H₂₂ → H22), so a second toggle does not recover the original mixture; Undo restores the exact prior text. The mathematical minus sign U+2212 has its own script mapping, while ASCII hyphen-minus stays unchanged."
 
 [[feature]]
 id = "edit.paragraph-alignment"
@@ -2129,8 +2154,8 @@ milestone = "M7"
 status = "shipped"
 commands = ["edit.image"]
 tools = ["content_update", "image_edit"]
-evidence = ["crates/ui-egui/tests/it/editing.rs::cropping_a_picture_with_its_handles", "crates/engine/src/tests.rs::cropping_an_existing_image_clips_it_and_moves_with_it", "crates/automation/tests/it/automation.rs::editing_page_images_through_tools", "crates/engine/src/tests.rs::added_images_rotate_flip_and_crop_as_drawn", "crates/automation/tests/it/automation.rs::adding_content_through_tools"]
-notes = "Existing page images: right-click ▸ Crop Image puts the picture in crop mode: its eight handles trim (the inside pans), the part that will go is dimmed, Enter or Done applies, Esc or Cancel leaves it; Remove Crop shows the whole picture again. The pixels stay where they are (a clipping path inside the picture's own scope, so a later move or resize carries it along; cropping again replaces the earlier crop, so it can grow back); image_edit crop. Added images: trim each side by percent in Edit image, clipped. Not yet: cropping grouped Form artwork by handles is allowed the same way (it is a clip), but a shared clip of the original file is not changed."
+evidence = ["crates/edit/src/tests.rs::removing_a_crop_preserves_author_clips_and_works_under_outer_clip", "crates/ui-egui/tests/it/editing.rs::cropping_a_picture_with_its_handles", "crates/engine/src/tests.rs::cropping_an_existing_image_clips_it_and_moves_with_it", "crates/automation/tests/it/automation.rs::editing_page_images_through_tools", "crates/engine/src/tests.rs::added_images_rotate_flip_and_crop_as_drawn", "crates/automation/tests/it/automation.rs::adding_content_through_tools"]
+notes = "Existing page images: right-click ▸ Crop Image puts the picture in crop mode: its eight handles trim (the inside pans), the part that will go is dimmed, Enter or Done applies, Esc or Cancel leaves it; Remove Crop removes only a crop created by PdfCraft, preserving original document clips. The pixels stay where they are (a clipping path inside the picture's own scope, so a later move or resize carries it along; cropping again replaces the earlier crop, so it can grow back); image_edit crop. Added images: trim each side by percent in Edit image, clipped. Grouped Form artwork cannot be cropped. Shared clips and other clipping paths from the original file remain unchanged."
 
 [[feature]]
 id = "edit.image-rotate-flip"
@@ -2153,8 +2178,8 @@ milestone = "M7"
 status = "shipped"
 commands = ["edit.edit_text"]
 tools = ["image_edit", "image_hit"]
-evidence = ["crates/edit/src/tests.rs::private_image_crop_with_intervening_state_resizes_across_streams", "crates/automation/tests/it/automation.rs::private_crops_with_nested_state_resize_save_reopen_through_tools", "crates/edit/src/tests.rs::form_artwork_edits_only_the_selected_placement", "crates/ui-egui/tests/it/editing.rs::editing_existing_form_artwork_on_the_page", "crates/automation/tests/it/automation.rs::editing_form_artwork_through_tools", "crates/edit/src/tests.rs::page_images_move_turn_replace_and_delete", "crates/ui-egui/tests/it/editing.rs::editing_existing_images_on_the_page", "crates/automation/tests/it/automation.rs::editing_page_images_through_tools", "crates/edit/src/tests.rs::curved_image_clips_have_analytic_bounds_and_holes_do_not_capture_points", "crates/edit/src/tests.rs::cropped_image_resizing_moves_private_clips_and_keeps_shared_ones", "crates/ui-egui/tests/it/editing.rs::cropped_image_corner_resize_keeps_opposite_corner_and_scales_crop", "crates/edit/src/tests.rs::image_selection_bounds_respect_clips_and_restore_graphics_state", "crates/ui-egui/tests/it/editing.rs::cropped_images_do_not_intercept_text_and_stay_inside_each_page", "crates/automation/tests/it/automation.rs::clipped_image_bounds_and_text_edit_save_reopen_through_tools", "crates/edit/src/tests.rs::resizing_an_image_under_a_shared_clip_moves_its_own_clip"]
-notes = "existing raster images and grouped Form artwork: select, drag to move, drag a corner to resize keeping proportions; Delete removes one placement. Forms include their nested content as a group; individual internal elements and inline images are not supported. See docs/editing-images.md; added images too Since #1116: raster images and grouped Forms move/resize/turn as placements; selected grips own the gesture and opposite anchor, with no PDF writes during movement. Curved path frames use analytic Bezier extrema and hit testing evaluates actual nonzero/even-odd fill rules, excluding holes; intersections can retain a loose frame. Selection and resize use the visible (clipped) frame; exclusive image clips move with their pixels across nested states, intervening operators and content streams, also inside a clip the picture shares with other content (its own clip scales, the shared one stays); shared clips stay fixed. Inline images and Form internals remain unsupported; see docs/editing-images.md"
+evidence = ["crates/edit/src/tests.rs::private_image_crop_with_intervening_state_resizes_across_streams", "crates/automation/tests/it/automation.rs::private_crops_with_nested_state_resize_save_reopen_through_tools", "crates/edit/src/tests.rs::form_artwork_edits_only_the_selected_placement", "crates/ui-egui/tests/it/editing.rs::editing_existing_form_artwork_on_the_page", "crates/automation/tests/it/automation.rs::editing_form_artwork_through_tools", "crates/edit/src/tests.rs::page_images_move_turn_replace_and_delete", "crates/ui-egui/tests/it/editing.rs::editing_existing_images_on_the_page", "crates/automation/tests/it/automation.rs::editing_page_images_through_tools", "crates/edit/src/tests.rs::curved_image_clips_have_analytic_bounds_and_holes_do_not_capture_points", "crates/edit/src/tests.rs::cropped_image_resizing_moves_private_clips_and_keeps_shared_ones", "crates/ui-egui/tests/it/editing.rs::cropped_image_corner_resize_keeps_opposite_corner_and_scales_crop", "crates/edit/src/tests.rs::image_selection_bounds_respect_clips_and_restore_graphics_state", "crates/ui-egui/tests/it/editing.rs::cropped_images_do_not_intercept_text_and_stay_inside_each_page", "crates/automation/tests/it/automation.rs::clipped_image_bounds_and_text_edit_save_reopen_through_tools", "crates/edit/src/tests.rs::resizing_an_image_under_a_shared_clip_moves_its_own_clip", "crates/automation/tests/it/automation.rs::transforming_page_images_through_tools"]
+notes = "existing raster images and grouped Form artwork: select, drag to move, 8-point handles to resize (corners keep proportions, edges scale along axis, Shift inverts aspect lock); Delete removes one placement. Headless: image_edit action move (a new box) or transform (any finite, non-flat 6-number matrix in top-left-origin points, applied after the placement: the edit a resize of a turned image makes). Forms include their nested content as a group; individual internal elements and inline images are not supported. See docs/editing-images.md; added images too Since #1116: raster images and grouped Forms move/resize/turn as placements; selected grips own the gesture and opposite anchor, with no PDF writes during movement. Curved path frames use analytic Bezier extrema and hit testing evaluates actual nonzero/even-odd fill rules, excluding holes; intersections can retain a loose frame. Selection and resize use the visible (clipped) frame; exclusive image clips move with their pixels across nested states, intervening operators and content streams, also inside a clip the picture shares with other content (its own clip scales, the shared one stays); shared clips stay fixed. Inline images and Form internals remain unsupported; see docs/editing-images.md"
 
 [[feature]]
 id = "edit.image-extract"
@@ -2186,11 +2211,17 @@ title = "Arrange objects (bring forward, send backward)"
 area = "C"
 tier = "P1"
 milestone = "M7"
-status = "planned"
+status = "partial"
 commands = []
-tools = []
-evidence = []
-notes = ""
+tools = ["image_edit"]
+evidence = [
+  "crates/edit/src/tests.rs::image_arrange_stacking_order_and_remove_crop",
+  "crates/edit/src/tests.rs::image_arrange_refuses_crossed_scope_boundaries_without_changes",
+  "crates/edit/src/tests.rs::arrange_refuses_unrestorable_extended_print_state",
+  "crates/automation/tests/it/automation.rs::arranging_page_images_through_tools",
+  "crates/ui-egui/tests/it/editing.rs::duplicate_xobject_at_different_rects_arrange_and_delete_keeps_other_instance_through_menu",
+]
+notes = "Image stacking order in content streams: Bring to Front, Send to Back, Bring Forward, Send Backward with undo/redo and persistence. Refuses arranging across shared marked content, unbalanced graphics/marked-content boundaries, or when clipping path transforms cannot be cleanly preserved. Stacking for arbitrary vector paths and inline images remains planned."
 
 [[feature]]
 id = "edit.align-distribute-objects"
@@ -2435,8 +2466,8 @@ milestone = "M7"
 status = "shipped"
 commands = ["edit.header_footer.update", "edit.header_footer.remove"]
 tools = ["doc_header_footer", "doc_remove_marks"]
-evidence = ["crates/edit/src/tests.rs::replace_and_remove_restore_the_original_content", "crates/ui-egui/tests/it/marks.rs::header_and_footer_dialog_inserts_tokens_and_applies_to_a_subset"]
-notes = "recognises PdfCraft marks; Acrobat-made headers are not detected yet"
+evidence = ["crates/edit/src/tests.rs::replace_and_remove_restore_the_original_content", "crates/ui-egui/tests/it/marks.rs::header_and_footer_dialog_inserts_tokens_and_applies_to_a_subset", "crates/edit/src/mark_transaction_tests.rs::header_footer_changes_are_atomic_after_a_later_page_failure", "crates/edit/src/mark_transaction_tests.rs::replacements_commit_all_selected_pages_and_preserve_other_marks_and_shared_resources"]
+notes = "Add and Update are atomic across all selected pages: errors preserve existing marks, page content/resources and pending edits (#5657). recognises PdfCraft marks; Acrobat-made headers are not detected yet"
 
 [[feature]]
 id = "edit.header-footer-tokens"
@@ -2507,8 +2538,8 @@ milestone = "M7"
 status = "shipped"
 commands = ["edit.watermark.update", "edit.watermark.remove"]
 tools = ["doc_watermark", "doc_remove_marks"]
-evidence = ["crates/edit/src/tests.rs::replace_and_remove_restore_the_original_content", "crates/engine/src/tests.rs::headers_footers_watermarks_and_backgrounds_show_update_and_remove"]
-notes = ""
+evidence = ["crates/edit/src/tests.rs::replace_and_remove_restore_the_original_content", "crates/engine/src/tests.rs::headers_footers_watermarks_and_backgrounds_show_update_and_remove", "crates/edit/src/mark_transaction_tests.rs::watermark_changes_are_atomic_after_a_later_page_failure", "crates/edit/src/mark_transaction_tests.rs::replacements_commit_all_selected_pages_and_preserve_other_marks_and_shared_resources"]
+notes = "Add and Update are atomic across all selected pages: errors preserve existing marks, page content/resources and pending edits (#5657). "
 
 [[feature]]
 id = "edit.watermark-appearance"
@@ -2543,8 +2574,8 @@ milestone = "M7"
 status = "shipped"
 commands = ["edit.background.update", "edit.background.remove"]
 tools = ["doc_background", "doc_remove_marks"]
-evidence = ["crates/edit/src/tests.rs::replace_and_remove_restore_the_original_content", "crates/engine/src/tests.rs::headers_footers_watermarks_and_backgrounds_show_update_and_remove", "crates/edit/src/backdrop_tests.rs::a_white_fill_backdrop_is_replaced_and_put_back_when_the_background_goes", "crates/edit/src/backdrop_tests.rs::an_edit_after_the_fill_is_kept_and_the_backdrop_still_comes_back", "crates/edit/src/backdrop_tests.rs::a_copy_written_out_again_with_other_spacing_still_comes_back", "crates/edit/src/backdrop_tests.rs::a_change_before_the_fill_leaves_it_off_and_names_the_page", "crates/edit/src/backdrop_tests.rs::a_fill_that_would_cover_content_painted_before_it_stays_off", "crates/engine/src/tests.rs::remove_background_names_the_pages_whose_own_backdrop_stays_off", "crates/automation/tests/it/backdrop.rs::removed_text_leaves_the_file_when_a_background_replaced_the_pages_backdrop"]
-notes = "Remove also turns back on a page backdrop Add replaced, keeping edits made after it; where that isn't safe it says which pages keep it off"
+evidence = ["crates/edit/src/tests.rs::replace_and_remove_restore_the_original_content", "crates/engine/src/tests.rs::headers_footers_watermarks_and_backgrounds_show_update_and_remove", "crates/edit/src/backdrop_tests.rs::a_white_fill_backdrop_is_replaced_and_put_back_when_the_background_goes", "crates/edit/src/backdrop_tests.rs::an_edit_after_the_fill_is_kept_and_the_backdrop_still_comes_back", "crates/edit/src/backdrop_tests.rs::a_copy_written_out_again_with_other_spacing_still_comes_back", "crates/edit/src/backdrop_tests.rs::a_change_before_the_fill_leaves_it_off_and_names_the_page", "crates/edit/src/backdrop_tests.rs::a_fill_that_would_cover_content_painted_before_it_stays_off", "crates/engine/src/tests.rs::remove_background_names_the_pages_whose_own_backdrop_stays_off", "crates/automation/tests/it/backdrop.rs::removed_text_leaves_the_file_when_a_background_replaced_the_pages_backdrop", "crates/edit/src/mark_transaction_tests.rs::background_changes_are_atomic_after_a_later_page_failure", "crates/edit/src/mark_transaction_tests.rs::replacements_commit_all_selected_pages_and_preserve_other_marks_and_shared_resources"]
+notes = "Add and Update are atomic across all selected pages: errors preserve existing marks, page content/resources and pending edits (#5657). Remove also turns back on a page backdrop Add replaced, keeping edits made after it; where that isn't safe it says which pages keep it off"
 
 [[feature]]
 id = "edit.decoration-profiles"
@@ -5320,8 +5351,8 @@ milestone = "M12"
 status = "partial"
 commands = ["file.open"]
 tools = ["doc_open", "doc_info", "form_fields", "form_fill", "js_run"]
-evidence = ["crates/xfa/src/tests.rs::layout_places_captions_fields_and_sizes_containers_to_their_content", "crates/xfa/src/tests.rs::tables_break_across_pages_and_repeat_their_header_row", "crates/xfa/src/tests.rs::rendering_into_the_pdf_replaces_the_placeholder_page_and_adds_fields", "crates/engine/src/tests.rs::dynamic_xfa_forms_are_laid_out_on_open_filled_and_saved_incrementally", "crates/automation/tests/it/automation.rs::dynamic_xfa_forms_open_render_fill_and_save_through_tools", "crates/ui-egui/tests/it/xfa.rs::a_dynamic_xfa_form_is_laid_out_and_filled", "crates/xfa/src/tests.rs::nested_width_less_subforms_lay_out_in_polynomial_time", "crates/js/src/tests.rs::instance_managers_add_remove_and_count", "crates/xfa/src/tests.rs::the_form_tree_carries_values_presence_instances_and_the_events", "crates/engine/src/tests.rs::xfa_scripts_initialize_calculate_validate_toggle_and_add_rows", "crates/engine/src/tests.rs::xfa_date_arithmetic_reads_the_date_as_its_display_picture_shows_it", "crates/automation/tests/it/automation.rs::xfa_scripts_run_for_buttons_and_field_changes_through_tools", "crates/ui-egui/tests/it/xfa.rs::xfa_buttons_run_their_scripts_in_the_app", "crates/engine/src/tests.rs::hostile_xfa_open_scripts_are_merged_capped_kept_from_printing_and_noted", "crates/engine/src/tests.rs::runaway_xfa_calculations_at_open_end_quickly_with_a_report", "crates/ui-egui/tests/it/xfa.rs::a_form_whose_scripts_were_turned_off_at_open_says_so", "crates/ui-egui/tests/it/xfa.rs::scripts_turned_off_by_a_click_bring_a_closed_notice_bar_back", "crates/automation/tests/it/automation.rs::doc_info_says_when_a_runaway_script_turned_the_forms_scripts_off", "crates/xfa/src/tests.rs::the_live_form_of_nested_repeating_subforms_stops_at_its_node_budget", "crates/xfa/src/tests.rs::data_ops_of_one_event_are_one_datasets_rewrite", "crates/xfa/src/tests.rs::choice_lists_signatures_passwords_and_pictures_become_fields_and_images", "crates/xfa/src/tests.rs::choice_values_come_from_the_data_as_saved_values_and_several_for_lists", "crates/xfa/src/tests.rs::pictures_are_sized_from_their_headers_and_hostile_ones_are_refused_unallocated", "crates/engine/src/tests.rs::xfa_choice_lists_signature_and_picture_fields_open_fill_script_and_save", "crates/xfa/src/tests.rs::repeating_subforms_inside_positioned_content_get_their_instances", "crates/engine/src/tests.rs::xfa_rows_in_areas_are_laid_out_read_calculated_and_written_where_adobe_binds_them", "crates/xfa/src/tests.rs::page_area_without_occur_serves_every_body_page", "apps/pdfcraft-cli/tests/it/xfa.rs::info_reports_the_laid_out_pages_and_fields", "apps/pdfcraft-cli/tests/it/xfa.rs::text_reads_the_layout_including_a_page_absent_from_the_placeholder", "apps/pdfcraft-cli/tests/it/xfa.rs::render_matches_the_engine_layout_on_the_second_page", "apps/pdfcraft-cli/tests/it/xfa.rs::a_laid_out_form_keeps_the_original_copy_permissions", "crates/engine/src/tests.rs::filling_growable_xfa_text_reflows_and_undo_restores_the_layout", "crates/engine/src/tests.rs::xfa_text_growth_refreshes_widget_geometry_but_fixed_height_fields_keep_their_widgets", "crates/automation/tests/it/automation.rs::growable_xfa_text_paginates_after_fill_save_and_print", "crates/engine/src/tests.rs::an_xfa_script_that_fails_partway_keeps_what_it_changed_before_the_error", "crates/engine/src/tests.rs::repeated_xfa_print_buttons_run_their_click_script", "crates/automation/tests/it/automation.rs::repeated_xfa_print_buttons_work_through_tools_and_after_reopen", "crates/xfa/src/tests.rs::rich_text_max_length_reaches_the_field_and_layout", "crates/automation/tests/it/automation.rs::xfa_rich_text_max_length_is_reported_and_enforced_through_tools", "crates/xfa/src/tests.rs::bmp_and_tiff_pictures_are_decoded_and_drawn", "crates/engine/src/tests.rs::active_xfa_does_not_run_pdf_container_scripts_but_keeps_requested_alerts", "crates/engine/src/tests.rs::active_xfa_without_template_scripts_does_not_initialize_pdf_fallback_scripts", "crates/engine/src/tests.rs::inactive_xfa_and_ordinary_pdfs_keep_document_helpers_and_alerts", "crates/automation/tests/it/automation.rs::active_xfa_skips_container_fallback_scripts_after_save_and_reopen", "crates/xfa/src/tests.rs::laying_a_form_out_takes_off_the_usage_rights_it_voids", "crates/engine/src/tests.rs::a_dynamic_xfa_form_is_saved_without_the_usage_rights_its_layout_voided", "crates/xfa/src/tests.rs::faces_measure_text_at_their_standard_14_widths", "crates/xfa/src/tests.rs::rich_text_links_keep_their_address", "crates/xfa/src/tests.rs::links_in_rich_text_become_link_annotations_one_per_line", "crates/xfa/src/tests.rs::a_links_pieces_share_one_address", "crates/xfa/src/tests.rs::a_rule_between_two_pieces_of_a_link_keeps_them_apart", "crates/xfa/src/tests.rs::links_to_anything_but_web_and_email_addresses_stay_plain_text", "crates/automation/tests/it/automation.rs::links_in_xfa_rich_text_are_listed_through_tools", "crates/xfa/src/tests.rs::rounded_corners_make_a_border_one_rounded_shape", "crates/xfa/src/tests.rs::a_rounded_box_cut_by_a_page_break_keeps_its_corners_on_each_page", "crates/xfa/src/tests.rs::rounded_boxes_are_written_as_curved_paths", "crates/xfa/src/tests.rs::a_flowed_subform_is_drawn_with_its_border_under_its_content", "crates/xfa/src/tests.rs::a_check_box_sits_where_its_margins_caption_and_alignment_put_it", "crates/xfa/src/tests.rs::a_check_box_caption_without_a_reserve_takes_the_rest_of_the_field", "crates/xfa/src/tests.rs::a_radio_button_sits_where_a_check_box_would", "crates/xfa/src/tests.rs::a_check_box_caption_without_a_reserve_is_measured_as_it_is_drawn", "crates/js/src/tests.rs::message_box_keeps_its_title_icon_and_buttons", "crates/js/src/tests.rs::app_alert_in_an_xfa_script_reads_app_alerts_arguments", "crates/engine/src/tests.rs::xfa_message_boxes_keep_their_title_icon_and_buttons", "crates/xfa/src/tests.rs::signature_fields_are_named_by_their_som_path", "crates/xfa/src/tests.rs::a_signature_on_a_laid_out_box_survives_a_new_layout"]
-notes = "Active XFA layout skips PDF-container document-script initialization for the Acrobat console/field context, so fallback-viewer scripts do not run there. Scripts remain in the file/listing; explicit console/field and XFA alerts still run. Ordinary PDF, static XFA and unlaid-out shells keep document scripts; static-conversion undo restores the XFA policy. Changed growable multiline text (no fixed h) reflows from final datasets after edits, with or without scripts; pages/widgets refresh and undo/redo, save/reopen and print retain all text. Oversized text still uses the existing read-only page-text fallback with a warning; fixed-height fields do not reflow. Repeated page-master buttons resolve their own PDF field to the shared XFA click script; the numPages-based print script requests printing from every copy, including after save/reopen (#2572). Rich-text exData/maxLength is carried into AcroForm MaxLen, reported by form_fields and enforced by form_fill (Unicode characters); limits and accepted values survive save/reopen (#2570). laid out from the template on open by the xfa crate (positioned, tb, lr-tb, table/row, page masters (a page area with no occur repeats without limit, one with occur max=1 is used once, one with occur min=1 the body never reached gets a page after the body, as Acrobat Pro does on a synthetic form), breaks, repeated header rows, borders and fills of flowed subforms (a page break between their children gives each page's part a closed border, the margins repeated at the cut, as measured on a synthetic form in another viewer, and a child's own page break breaks them the same way; one holding an item that doesn't fit on its page, cut across pages or placed past the content area's bottom, is drawn without its border, with a layout warning), captions, rounded and inverted border corners, rich text (its http, https and mailto links clickable), JPEG/PNG/GIF/BMP/TIFF images) into real pages and AcroForm fields (text, password, date with AFDate formats, check boxes and radio groups (each box placed by its field's margins, caption and paragraph alignment as measured on two synthetic forms in another viewer: with no caption at the right of the content area, beside a reserved caption where the alignment puts it, and a caption without a reserve taking the rest of the field; a check box's own margin larger than the box draws a bigger box there, which isn't copied), drop-downs and list boxes with shown/saved item pairs and multi-select, signature fields (each named by its SOM path, under a generated field for each step above it, so that another viewer, which lays the form out again, finds a signature made here, as seen on a synthetic form, and a box signed here keeps its signature, and that name, when a script lays the form out again; a box whose path, or a part of it, the file already gives another field keeps its own name, and its signature isn't found there yet), image fields showing their picture (pictures decoded once per document, at most 20 million pixels, and reused across re-layouts), buttons with reset/print/save/URL), filled from the datasets packet (including rows another viewer added), saved as an incremental revision with the values merged into the datasets so Adobe's viewers show them; usage rights the form carried (/Perms /UR3) are taken off with a note, as the layout voids them and a form with void usage rights opens with every field locked; doc_info reports xfa_layout. CLI info reports the laid-out page/field counts and dimensions while retaining the input file size and raw counts as pdf_pages/acroform_fields; text and render use those pages too, preserving copy permissions and leaving the source file unchanged (#1645). XFA JavaScript and FormCalc (form.xfa-formcalc) run in the js crate's XFA object model (xfa.form, SOM resolution, rawValue, formattedValue in a date display picture's pattern (number and text display pictures still give the raw value), presence, access, instance managers, xfa.host, xfa.layout, xfa.event): initialize and calculate on open, exit, validate and calculate after a field changes, click for buttons (through js_run and the app), with rows added and removed, subforms shown and hidden, and the form laid out again, all as one undo step and kept in the file. All the scripts of one event run on one thread, each in a fresh context on the form as the engine holds it then (nothing shared between scripts; the live form kept up to date in place for values, rebuilt only when the structure changed), so hundreds of calculations run within the open budget. Hostile scripts are bounded per event (merged and capped effects, messages and console lines, lower loop limits and a time budget on open and calculate, one datasets rewrite per event, print/save/links/focus from clicks only, a runaway script abandoned and the form's scripts turned off, which the app says in a toast and on the notice bar, with a button to the JavaScript console, and doc_info reports as xfa_scripts_off) and what open-time scripts changed is noted. A script that fails partway keeps what it changed before the error, as JavaScript does (forms often trip over an object an earlier version had after their first lines did the work). Missing: a page area's relevant=\"-print\" (on a synthetic form Acrobat still prints the page but leaves it blank; PdfCraft prints its content, #2574); a page break before the first section (Acrobat opens an empty body page first when the first section has breakBefore targetType=pageArea, with or without startNew, as seen on synthetic forms; PdfCraft skips a break on an empty page and lays out one page fewer, #2574); loops inside nested calls are only stopped by abandoning their thread, and script memory is not capped; the change event per keystroke; xfa.template, connections and data descriptions; a hidden instance of a repeating subform hides them all; barcodes are drawn as their text, not bars; keep rules; text is measured at the exact standard-14 widths of the face it is drawn in (bold, italic and Times included), not in the template's own typefaces, and Acrobat fidelity is eyeballed on real forms, not measured (#60). xfa.host.messageBox keeps its title, icon and buttons, and app.alert in an XFA script reads its own argument order; every message box still answers OK (1) (#4291)."
+evidence = ["crates/xfa/src/tests.rs::a_draw_turns_counter_clockwise_about_its_anchor", "crates/xfa/src/tests.rs::layout_places_captions_fields_and_sizes_containers_to_their_content", "crates/xfa/src/tests.rs::tables_break_across_pages_and_repeat_their_header_row", "crates/xfa/src/tests.rs::rendering_into_the_pdf_replaces_the_placeholder_page_and_adds_fields", "crates/engine/src/tests.rs::dynamic_xfa_forms_are_laid_out_on_open_filled_and_saved_incrementally", "crates/automation/tests/it/automation.rs::dynamic_xfa_forms_open_render_fill_and_save_through_tools", "crates/ui-egui/tests/it/xfa.rs::a_dynamic_xfa_form_is_laid_out_and_filled", "crates/xfa/src/tests.rs::nested_width_less_subforms_lay_out_in_polynomial_time", "crates/js/src/tests.rs::instance_managers_add_remove_and_count", "crates/xfa/src/tests.rs::the_form_tree_carries_values_presence_instances_and_the_events", "crates/engine/src/tests.rs::xfa_scripts_initialize_calculate_validate_toggle_and_add_rows", "crates/engine/src/tests.rs::xfa_date_arithmetic_reads_the_date_as_its_display_picture_shows_it", "crates/automation/tests/it/automation.rs::xfa_scripts_run_for_buttons_and_field_changes_through_tools", "crates/ui-egui/tests/it/xfa.rs::xfa_buttons_run_their_scripts_in_the_app", "crates/engine/src/tests.rs::hostile_xfa_open_scripts_are_merged_capped_kept_from_printing_and_noted", "crates/engine/src/tests.rs::runaway_xfa_calculations_at_open_end_quickly_with_a_report", "crates/ui-egui/tests/it/xfa.rs::a_form_whose_scripts_were_turned_off_at_open_says_so", "crates/ui-egui/tests/it/xfa.rs::scripts_turned_off_by_a_click_bring_a_closed_notice_bar_back", "crates/automation/tests/it/automation.rs::doc_info_says_when_a_runaway_script_turned_the_forms_scripts_off", "crates/xfa/src/tests.rs::the_live_form_of_nested_repeating_subforms_stops_at_its_node_budget", "crates/xfa/src/tests.rs::data_ops_of_one_event_are_one_datasets_rewrite", "crates/xfa/src/tests.rs::choice_lists_signatures_passwords_and_pictures_become_fields_and_images", "crates/xfa/src/tests.rs::choice_values_come_from_the_data_as_saved_values_and_several_for_lists", "crates/xfa/src/tests.rs::pictures_are_sized_from_their_headers_and_hostile_ones_are_refused_unallocated", "crates/engine/src/tests.rs::xfa_choice_lists_signature_and_picture_fields_open_fill_script_and_save", "crates/xfa/src/tests.rs::repeating_subforms_inside_positioned_content_get_their_instances", "crates/engine/src/tests.rs::xfa_rows_in_areas_are_laid_out_read_calculated_and_written_where_adobe_binds_them", "crates/xfa/src/tests.rs::page_area_without_occur_serves_every_body_page", "apps/pdfcraft-cli/tests/it/xfa.rs::info_reports_the_laid_out_pages_and_fields", "apps/pdfcraft-cli/tests/it/xfa.rs::text_reads_the_layout_including_a_page_absent_from_the_placeholder", "apps/pdfcraft-cli/tests/it/xfa.rs::render_matches_the_engine_layout_on_the_second_page", "apps/pdfcraft-cli/tests/it/xfa.rs::a_laid_out_form_keeps_the_original_copy_permissions", "crates/engine/src/tests.rs::filling_growable_xfa_text_reflows_and_undo_restores_the_layout", "crates/engine/src/tests.rs::xfa_text_growth_refreshes_widget_geometry_but_fixed_height_fields_keep_their_widgets", "crates/automation/tests/it/automation.rs::growable_xfa_text_paginates_after_fill_save_and_print", "crates/engine/src/tests.rs::an_xfa_script_that_fails_partway_keeps_what_it_changed_before_the_error", "crates/engine/src/tests.rs::repeated_xfa_print_buttons_run_their_click_script", "crates/automation/tests/it/automation.rs::repeated_xfa_print_buttons_work_through_tools_and_after_reopen", "crates/xfa/src/tests.rs::rich_text_max_length_reaches_the_field_and_layout", "crates/automation/tests/it/automation.rs::xfa_rich_text_max_length_is_reported_and_enforced_through_tools", "crates/xfa/src/tests.rs::bmp_and_tiff_pictures_are_decoded_and_drawn", "crates/engine/src/tests.rs::active_xfa_does_not_run_pdf_container_scripts_but_keeps_requested_alerts", "crates/engine/src/tests.rs::active_xfa_without_template_scripts_does_not_initialize_pdf_fallback_scripts", "crates/engine/src/tests.rs::inactive_xfa_and_ordinary_pdfs_keep_document_helpers_and_alerts", "crates/automation/tests/it/automation.rs::active_xfa_skips_container_fallback_scripts_after_save_and_reopen", "crates/xfa/src/tests.rs::laying_a_form_out_takes_off_the_usage_rights_it_voids", "crates/engine/src/tests.rs::a_dynamic_xfa_form_is_saved_without_the_usage_rights_its_layout_voided", "crates/xfa/src/tests.rs::faces_measure_text_at_their_standard_14_widths", "crates/xfa/src/tests.rs::rich_text_links_keep_their_address", "crates/xfa/src/tests.rs::links_in_rich_text_become_link_annotations_one_per_line", "crates/xfa/src/tests.rs::a_links_pieces_share_one_address", "crates/xfa/src/tests.rs::a_rule_between_two_pieces_of_a_link_keeps_them_apart", "crates/xfa/src/tests.rs::links_to_anything_but_web_and_email_addresses_stay_plain_text", "crates/automation/tests/it/automation.rs::links_in_xfa_rich_text_are_listed_through_tools", "crates/xfa/src/tests.rs::rounded_corners_make_a_border_one_rounded_shape", "crates/xfa/src/tests.rs::a_rounded_box_cut_by_a_page_break_keeps_its_corners_on_each_page", "crates/xfa/src/tests.rs::rounded_boxes_are_written_as_curved_paths", "crates/xfa/src/tests.rs::a_flowed_subform_is_drawn_with_its_border_under_its_content", "crates/xfa/src/tests.rs::a_check_box_sits_where_its_margins_caption_and_alignment_put_it", "crates/xfa/src/tests.rs::a_check_box_caption_without_a_reserve_takes_the_rest_of_the_field", "crates/xfa/src/tests.rs::a_radio_button_sits_where_a_check_box_would", "crates/xfa/src/tests.rs::a_check_box_caption_without_a_reserve_is_measured_as_it_is_drawn", "crates/js/src/tests.rs::message_box_keeps_its_title_icon_and_buttons", "crates/js/src/tests.rs::app_alert_in_an_xfa_script_reads_app_alerts_arguments", "crates/engine/src/tests.rs::xfa_message_boxes_keep_their_title_icon_and_buttons", "crates/xfa/src/tests.rs::signature_fields_are_named_by_their_som_path", "crates/xfa/src/tests.rs::a_signature_on_a_laid_out_box_survives_a_new_layout"]
+notes = "A draw placed by position turns about its anchor (rotate); fields, subforms and draws in a flow don't. Active XFA layout skips PDF-container document-script initialization for the Acrobat console/field context, so fallback-viewer scripts do not run there. Scripts remain in the file/listing; explicit console/field and XFA alerts still run. Ordinary PDF, static XFA and unlaid-out shells keep document scripts; static-conversion undo restores the XFA policy. Changed growable multiline text (no fixed h) reflows from final datasets after edits, with or without scripts; pages/widgets refresh and undo/redo, save/reopen and print retain all text. Oversized text still uses the existing read-only page-text fallback with a warning; fixed-height fields do not reflow. Repeated page-master buttons resolve their own PDF field to the shared XFA click script; the numPages-based print script requests printing from every copy, including after save/reopen (#2572). Rich-text exData/maxLength is carried into AcroForm MaxLen, reported by form_fields and enforced by form_fill (Unicode characters); limits and accepted values survive save/reopen (#2570). laid out from the template on open by the xfa crate (positioned, tb, lr-tb, table/row, page masters (a page area with no occur repeats without limit, one with occur max=1 is used once, one with occur min=1 the body never reached gets a page after the body, as Acrobat Pro does on a synthetic form), breaks, repeated header rows, borders and fills of flowed subforms (a page break between their children gives each page's part a closed border, the margins repeated at the cut, as measured on a synthetic form in another viewer, and a child's own page break breaks them the same way; one holding an item that doesn't fit on its page, cut across pages or placed past the content area's bottom, is drawn without its border, with a layout warning), captions, rounded and inverted border corners, rich text (its http, https and mailto links clickable), JPEG/PNG/GIF/BMP/TIFF images) into real pages and AcroForm fields (text, password, date with AFDate formats, check boxes and radio groups (each box placed by its field's margins, caption and paragraph alignment as measured on two synthetic forms in another viewer: with no caption at the right of the content area, beside a reserved caption where the alignment puts it, and a caption without a reserve taking the rest of the field; a check box's own margin larger than the box draws a bigger box there, which isn't copied), drop-downs and list boxes with shown/saved item pairs and multi-select, signature fields (each named by its SOM path, under a generated field for each step above it, so that another viewer, which lays the form out again, finds a signature made here, as seen on a synthetic form, and a box signed here keeps its signature, and that name, when a script lays the form out again; a box whose path, or a part of it, the file already gives another field keeps its own name, and its signature isn't found there yet), image fields showing their picture (pictures decoded once per document, at most 20 million pixels, and reused across re-layouts), buttons with reset/print/save/URL), filled from the datasets packet (including rows another viewer added), saved as an incremental revision with the values merged into the datasets so Adobe's viewers show them; usage rights the form carried (/Perms /UR3) are taken off with a note, as the layout voids them and a form with void usage rights opens with every field locked; doc_info reports xfa_layout. CLI info reports the laid-out page/field counts and dimensions while retaining the input file size and raw counts as pdf_pages/acroform_fields; text and render use those pages too, preserving copy permissions and leaving the source file unchanged (#1645). XFA JavaScript and FormCalc (form.xfa-formcalc) run in the js crate's XFA object model (xfa.form, SOM resolution, rawValue, formattedValue in a date display picture's pattern (number and text display pictures still give the raw value), presence, access, instance managers, xfa.host, xfa.layout, xfa.event): initialize and calculate on open, exit, validate and calculate after a field changes, click for buttons (through js_run and the app), with rows added and removed, subforms shown and hidden, and the form laid out again, all as one undo step and kept in the file. All the scripts of one event run on one thread, each in a fresh context on the form as the engine holds it then (nothing shared between scripts; the live form kept up to date in place for values, rebuilt only when the structure changed), so hundreds of calculations run within the open budget. Hostile scripts are bounded per event (merged and capped effects, messages and console lines, lower loop limits and a time budget on open and calculate, one datasets rewrite per event, print/save/links/focus from clicks only, a runaway script abandoned and the form's scripts turned off, which the app says in a toast and on the notice bar, with a button to the JavaScript console, and doc_info reports as xfa_scripts_off) and what open-time scripts changed is noted. A script that fails partway keeps what it changed before the error, as JavaScript does (forms often trip over an object an earlier version had after their first lines did the work). Missing: a page area's relevant=\"-print\" (on a synthetic form Acrobat still prints the page but leaves it blank; PdfCraft prints its content, #2574); a page break before the first section (Acrobat opens an empty body page first when the first section has breakBefore targetType=pageArea, with or without startNew, as seen on synthetic forms; PdfCraft skips a break on an empty page and lays out one page fewer, #2574); loops inside nested calls are only stopped by abandoning their thread, and script memory is not capped; the change event per keystroke; xfa.template, connections and data descriptions; a hidden instance of a repeating subform hides them all; barcodes are drawn as their text, not bars; keep rules; text is measured at the exact standard-14 widths of the face it is drawn in (bold, italic and Times included), not in the template's own typefaces, and Acrobat fidelity is eyeballed on real forms, not measured (#60). xfa.host.messageBox keeps its title, icon and buttons, and app.alert in an XFA script reads its own argument order; every message box still answers OK (1) (#4291)."
 
 [[feature]]
 id = "form.xfa-formcalc"
@@ -5804,8 +5835,8 @@ milestone = "M8"
 status = "shipped"
 commands = ["redact.apply"]
 tools = ["redact_apply"]
-evidence = ["crates/redact/src/tests.rs::images_are_removed_or_have_their_pixels_cleared", "crates/redact/src/tests.rs::redaction_clears_pixels_intersected_without_covering_their_centres", "crates/redact/src/tests.rs::a_fax_image_has_its_covered_pixels_cleared_instead_of_being_removed", "crates/redact/src/tests.rs::group_3_on_bytes_is_removed_whole_and_other_fax_images_cleared", "crates/redact/src/tests.rs::an_image_whose_predictor_is_given_by_reference_has_the_covered_pixel_cleared"]
-notes = "intersected pixel footprints are cleared conservatively in a copy, CCITT fax images (scans stored as Group 4) included; DCT/JPX/JBIG2 images, and Group 3 on bytes (which the bootstrap renderer may draw as other rows than the decoder reads), removed whole"
+evidence = ["crates/redact/src/tests.rs::images_are_removed_or_have_their_pixels_cleared", "crates/redact/src/tests.rs::redaction_clears_pixels_intersected_without_covering_their_centres", "crates/redact/src/tests.rs::a_fax_image_has_its_covered_pixels_cleared_instead_of_being_removed", "crates/redact/src/tests.rs::group_3_on_bytes_is_removed_whole_and_other_fax_images_cleared", "crates/redact/src/tests.rs::an_image_whose_predictor_is_given_by_reference_has_the_covered_pixel_cleared", "crates/redact/src/tests.rs::a_jbig2_image_has_its_covered_pixels_cleared_instead_of_being_removed", "crates/redact/src/tests.rs::a_jbig2_image_that_cannot_be_cleared_for_certain_is_removed_whole", "crates/redact/src/tests.rs::a_redacted_jbig2_scan_keeps_neither_its_code_nor_its_globals", "crates/redact/src/tests.rs::a_cleared_black_and_white_scan_is_stored_as_group_4", "crates/redact/src/tests.rs::globals_a_redacted_jbig2_image_shares_with_another_page_leave_the_file"]
+notes = "intersected pixel footprints are cleared conservatively in a copy, CCITT fax and JBIG2 images (scans stored as Group 4 or JBIG2, with their /JBIG2Globals) included; DCT/JPX images, Group 3 on bytes (which the bootstrap renderer may draw as other rows than the decoder reads), and a JBIG2 image whose page isn't its size, removed whole. The copy is Flate, or for a one-bit image of one component Group 4, or JBIG2 when it was JBIG2, whichever is smallest as stored, and refers to no globals; every other image using a redacted image's globals is stored again without them (Flate, Group 4 or JBIG2, whichever is smallest), so they leave the file (one that can't be decoded refuses the redaction)"
 
 [[feature]]
 id = "protect.redact-vectors"
@@ -6968,8 +6999,8 @@ milestone = "M10"
 status = "shipped"
 commands = ["create.blank"]
 tools = ["doc_create"]
-evidence = ["crates/ui-egui/tests/it/create.rs::opening_images_and_text_converts_them_to_new_pdfs", "crates/create/src/tests.rs::blank_documents", "crates/automation/tests/it/automation.rs::creating_and_reducing_through_tools"]
-notes = ""
+evidence = ["crates/ui-egui/tests/it/create.rs::opening_images_and_text_converts_them_to_new_pdfs", "crates/ui-egui/tests/it/create.rs::a_blank_page_is_on_the_system_regions_paper", "crates/ui-egui/src/persist/paper.rs::region_decides_the_paper", "crates/create/src/tests.rs::blank_documents", "crates/automation/tests/it/automation.rs::creating_and_reducing_through_tools"]
+notes = "The page is the system region's paper (#5644): US Letter in the US, Canada, Mexico, the Philippines and the other CLDR Letter regions, A4 elsewhere; Windows' own Region paper size (iPaperSize) first, then the system locale (macOS) or LC_ALL/LC_PAPER/LANG; Letter when the region is unknown (web). The doc_create tool keeps Letter unless given width and height. Missing: a page size or count chooser like Acrobat's New Document dialog."
 
 [[feature]]
 id = "create.from-html"
@@ -7188,8 +7219,8 @@ milestone = "M10"
 status = "shipped"
 commands = ["export.all_images"]
 tools = ["doc_export_all_images"]
-evidence = ["crates/create/src/tests.rs::ccitt_fax_images_export_as_their_picture", "crates/create/src/tests.rs::group_3_ccitt_masks_and_parameters_by_reference_export_as_their_picture", "crates/create/src/tests.rs::images_export_as_jpeg_unchanged_and_others_as_png", "crates/create/src/tests.rs::indexed_and_one_bit_images_decode", "crates/create/src/tests.rs::jpeg_images_with_a_soft_mask_export_as_png_with_alpha", "crates/create/src/tests.rs::soft_masks_of_another_size_and_stencil_and_colour_key_masks_become_alpha", "crates/create/src/tests.rs::soft_mask_decode_ranges_become_exported_alpha", "crates/create/src/tests.rs::soft_mask_decode_maps_packed_and_jpeg_masks_before_resizing", "crates/automation/tests/it/automation.rs::exporting_all_images_through_tools", "crates/ui-egui/tests/it/export.rs::export_dialogs_write_images_and_text", "crates/create/src/tests.rs::lossless_decode_maps_each_component_before_colour_conversion", "crates/create/src/tests.rs::lossless_indexed_decode_rounds_in_index_units_then_clamps", "crates/create/src/tests.rs::jbig2_images_export_as_their_picture", "crates/create/src/tests.rs::jbig2_globals_are_decoded_within_a_limit_of_their_own", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_jbig2", "crates/create/src/tests.rs::symbol_coded_jbig2_images_export_as_their_picture"]
-notes = "each image once (page resources and nested forms); JPEG unchanged unless it has transparency, others PNG (gray/RGB/CMYK/ICC/Indexed, 1–16 bpc, stencil masks); transparency as PNG alpha: /SMask (scaled to the image size, /Matte un-blended), stencil /Mask and colour-key /Mask, JPEG images included (#645); JPX/JBIG2 masks are left out (image exported opaque); JPX/JBIG2/separations reported as skipped; minimum size filter. Lossless images apply per-component Decode; Indexed values round and clip before palette lookup. Missing, null or malformed Decode arrays keep the default mapping. Soft-mask Decode intervals preserve opacity before resizing, including indirect arrays and endpoints. Still limited: 16-bit samples use high bytes; general JPEG image Decode, ICC transforms, and calibrated colors remain unsupported. CCITT fax images (Group 3 and 4, with their /DecodeParms, behind other filters too) export as their picture, masks included; byte-aligned Group 3 is read by the end-of-line codes when the data starts with one and on bytes otherwise, and one cut short is reported. Still limited: byte-aligned Group 3 with codes but none before the first row (not as T.4 sends them) is reported, or at /K 0 may export wrong."
+evidence = ["crates/create/src/tests.rs::ccitt_fax_images_export_as_their_picture", "crates/create/src/tests.rs::group_3_ccitt_masks_and_parameters_by_reference_export_as_their_picture", "crates/create/src/tests.rs::images_export_as_jpeg_unchanged_and_others_as_png", "crates/create/src/tests.rs::indexed_and_one_bit_images_decode", "crates/create/src/tests.rs::jpeg_images_with_a_soft_mask_export_as_png_with_alpha", "crates/create/src/tests.rs::soft_masks_of_another_size_and_stencil_and_colour_key_masks_become_alpha", "crates/create/src/tests.rs::soft_mask_decode_ranges_become_exported_alpha", "crates/create/src/tests.rs::soft_mask_decode_maps_packed_and_jpeg_masks_before_resizing", "crates/automation/tests/it/automation.rs::exporting_all_images_through_tools", "crates/ui-egui/tests/it/export.rs::export_dialogs_write_images_and_text", "crates/create/src/tests.rs::lossless_decode_maps_each_component_before_colour_conversion", "crates/create/src/tests.rs::lossless_indexed_decode_rounds_in_index_units_then_clamps", "crates/create/src/tests.rs::jbig2_images_export_as_their_picture", "crates/create/src/tests.rs::jbig2_globals_are_decoded_within_a_limit_of_their_own", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_jbig2", "crates/create/src/tests.rs::symbol_coded_jbig2_images_export_as_their_picture", "crates/create/src/tests.rs::jbig2_images_behind_another_filter_export_as_their_picture"]
+notes = "each image once (page resources and nested forms), up to what one export may decode and hold of files (2 GiB or twice the document), images past that left out with the reason; JPEG unchanged unless it has transparency, others PNG (gray/RGB/CMYK/ICC/Indexed, 1–16 bpc, stencil masks); transparency as PNG alpha: /SMask (scaled to the image size, /Matte un-blended), stencil /Mask and colour-key /Mask, JPEG images included (#645); JPX masks are left out (image exported opaque); JPX images and separations reported as skipped; minimum size filter. Lossless images apply per-component Decode; Indexed values round and clip before palette lookup. Missing, null or malformed Decode arrays keep the default mapping. Soft-mask Decode intervals preserve opacity before resizing, including indirect arrays and endpoints. Still limited: 16-bit samples use high bytes; general JPEG image Decode, ICC transforms, and calibrated colors remain unsupported. CCITT fax images (Group 3 and 4, with their /DecodeParms, behind other filters too) export as their picture, masks included; byte-aligned Group 3 is read by the end-of-line codes when the data starts with one and on bytes otherwise, and one cut short is reported. Still limited: byte-aligned Group 3 with codes but none before the first row (not as T.4 sends them) is reported, or at /K 0 may export wrong. JBIG2 images (with the /JBIG2Globals of their own /DecodeParms entry, within 32 MiB, behind other filters too) export as their picture, masks included; the JBIG2 page has to be the image's size (the renderer draws the whole page into the image)."
 
 [[feature]]
 id = "create.export-html"
@@ -7348,8 +7379,8 @@ milestone = "M11"
 status = "shipped"
 commands = ["optimize.reduce"]
 tools = ["doc_reduce"]
-evidence = ["crates/ui-egui/tests/it/create.rs::reduce_file_size_writes_a_compact_copy", "crates/ui-egui/tests/it/create.rs::reduce_file_size_saves_nothing_when_the_file_is_already_small", "crates/engine/src/tests.rs::create_and_reduce", "crates/automation/tests/it/automation.rs::creating_and_reducing_through_tools", "crates/automation/tests/it/automation.rs::optimizing_through_tools", "crates/optimize/tests/optimize.rs::an_identity_decode_array_does_not_stop_reduce"]
-notes = "images above 225 ppi to 150 ppi JPEG medium (after merging page pictures printed as one-pixel strips into one image), black-and-white images averaged down to 300 ppi above 450 ppi, and stored as CCITT Group 4 whenever that is smaller, thumbnails dropped, resources merged, object streams; scanner images with the default decode array are included; a copy that isn't smaller is not saved (\"already as small as it can be made\"); runs in the background with a progress bar and Cancel"
+evidence = ["crates/ui-egui/tests/it/create.rs::reduce_file_size_writes_a_compact_copy", "crates/optimize/tests/optimize.rs::a_picture_with_a_stencil_mask_is_downsampled_under_its_mask", "crates/optimize/tests/optimize.rs::a_picture_whose_mask_is_not_a_stencil_is_left_alone", "crates/ui-egui/tests/it/create.rs::reduce_file_size_saves_nothing_when_the_file_is_already_small", "crates/engine/src/tests.rs::create_and_reduce", "crates/automation/tests/it/automation.rs::creating_and_reducing_through_tools", "crates/automation/tests/it/automation.rs::optimizing_through_tools", "crates/optimize/tests/optimize.rs::an_identity_decode_array_does_not_stop_reduce"]
+notes = "images above 225 ppi to 150 ppi JPEG medium (after merging page pictures printed as one-pixel strips into one image), black-and-white images averaged down to 300 ppi above 450 ppi, and stored as CCITT Group 4 whenever that is smaller, thumbnails dropped, resources merged, object streams; scanner images with the default decode array are included; pictures under a stencil mask are included and the mask stays as it is, though samples it hides still count when resampling, so their colour can reach its edge; pictures with a colour-key mask are left alone; a copy that isn't smaller is not saved (\"already as small as it can be made\"); runs in the background with a progress bar and Cancel"
 
 [[feature]]
 id = "optimize.compatibility-level"
@@ -7384,8 +7415,8 @@ milestone = "M11"
 status = "partial"
 commands = ["optimize.advanced"]
 tools = ["doc_optimize"]
-evidence = ["crates/optimize/tests/optimize.rs::images_are_measured_where_drawn_and_downsampled", "crates/optimize/tests/optimize.rs::settings_choose_what_happens", "crates/automation/tests/it/automation.rs::optimizing_through_tools", "crates/optimize/tests/optimize.rs::a_page_picture_printed_as_one_pixel_strips_is_merged_into_one_image", "crates/optimize/tests/optimize.rs::images_that_do_not_tile_a_picture_are_left_alone", "crates/optimize/tests/optimize.rs::a_deeply_nested_form_is_measured_at_its_largest_use", "crates/optimize/tests/optimize.rs::images_are_not_resampled_when_some_uses_could_not_be_measured", "crates/optimize/tests/optimize.rs::image_resolution_uses_the_pages_physical_unit", "crates/optimize/tests/optimize.rs::optimization_retains_an_image_below_threshold_on_a_scaled_page", "crates/optimize/tests/optimize.rs::shared_forms_are_measured_in_each_pages_physical_units", "crates/optimize/tests/optimize.rs::ambiguous_monochrome_text_is_recompressed_without_lossy_reduction", "crates/optimize/src/images.rs::it_matches_the_slow_way", "crates/automation/tests/it/automation.rs::doc_optimize_averages_black_and_white_scans_down", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "colour and grayscale, bicubic, effective resolution measured where drawn (every use, with page-local UserUnit scaling, through nested forms up to 12 deep; when a use can't be measured, nothing is resampled); image fragments stacked edge to edge are merged first (side-by-side tiles not yet); monochrome (1-bit, CCITT fax, and eight-bit black-and-white grey and RGB, and indexed images that use only palette entries 0 and 1) averaged by area to 300 ppi above 450 ppi by default, a tie to the dark sample (black in grey, painted in a mask, ink in a separation, after the decode array; an indexed image's entry 0, its palette not read yet), then stored as Group 4 or 1-bit Flate (Monochrome Images ▸ Downsample to; doc_optimize mono); not monochrome images with a soft mask, halftones and dithers (most of their new pixels would cover both black and white, and their tones turn solid), or images wider than a fax row (1,048,576 samples), and Acrobat's bicubic and subsampling choices for monochrome aren't offered"
+evidence = ["crates/optimize/tests/optimize.rs::images_are_measured_where_drawn_and_downsampled", "crates/optimize/tests/optimize.rs::settings_choose_what_happens", "crates/automation/tests/it/automation.rs::optimizing_through_tools", "crates/optimize/tests/optimize.rs::a_page_picture_printed_as_one_pixel_strips_is_merged_into_one_image", "crates/optimize/tests/optimize.rs::images_that_do_not_tile_a_picture_are_left_alone", "crates/optimize/tests/optimize.rs::a_deeply_nested_form_is_measured_at_its_largest_use", "crates/optimize/tests/optimize.rs::images_are_not_resampled_when_some_uses_could_not_be_measured", "crates/optimize/tests/optimize.rs::image_resolution_uses_the_pages_physical_unit", "crates/optimize/tests/optimize.rs::optimization_retains_an_image_below_threshold_on_a_scaled_page", "crates/optimize/tests/optimize.rs::shared_forms_are_measured_in_each_pages_physical_units", "crates/optimize/tests/optimize.rs::ambiguous_monochrome_text_is_recompressed_without_lossy_reduction", "crates/optimize/tests/optimize.rs::indexed_thin_rules_survive_averaging_for_both_palette_orders_and_decodes", "crates/optimize/src/images.rs::an_indexed_images_palette_says_which_sample_is_dark", "crates/optimize/tests/optimize.rs::jbig2_scans_are_averaged_and_stored_again", "crates/optimize/src/images.rs::it_matches_the_slow_way", "crates/automation/tests/it/automation.rs::doc_optimize_averages_black_and_white_scans_down", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
+notes = "colour and grayscale, bicubic, effective resolution measured where drawn (every use, with page-local UserUnit scaling, through nested forms up to 12 deep; when a use can't be measured, nothing is resampled); image fragments stacked edge to edge are merged first (side-by-side tiles not yet); monochrome grey, image masks and indexed images (1-bit, CCITT fax, JBIG2, and eight-bit black-and-white grey and RGB packed to one bit) averaged by area to 300 ppi above 450 ppi by default, a tie to the dark sample (black in grey, painted in a mask, the darker palette entry over DeviceGray or DeviceRGB, after a decode array of two different numbers), then stored as Group 4 or 1-bit Flate (Monochrome Images ▸ Downsample to; doc_optimize mono); not separations or DeviceN (their tint transforms aren't read), calibrated or ICC grey, indexed images over another base or with a table over 4 KiB, images drawn or listed where /DefaultGray or /DefaultRGB is or may be in force (an indexed image also used beyond the page and form resources read, as an annotation's appearance), images with a colour key, which can hide the dark sample, or a soft mask, halftones and dithers (most of their new pixels would cover both black and white, and their tones turn solid), images with a square of four such new pixels (a small screened picture on a white page; ragged scanned text has them along its strokes too, and keeps its resolution), or images wider than a fax row (1,048,576 samples), and Acrobat's bicubic and subsampling choices for monochrome aren't offered"
 
 [[feature]]
 id = "optimize.recompress-images"
@@ -7408,8 +7439,8 @@ milestone = "M11"
 status = "partial"
 commands = ["optimize.advanced", "optimize.reduce"]
 tools = ["doc_optimize", "doc_reduce"]
-evidence = ["crates/optimize/tests/optimize.rs::eight_bit_black_and_white_images_become_one_bit", "crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/optimize/tests/optimize.rs::group_3_fax_images_become_group_4", "crates/optimize/tests/optimize.rs::rgb_and_two_colour_indexed_black_and_white_images_become_one_bit", "crates/optimize/tests/optimize.rs::black_and_white_rgb_used_beyond_the_page_content_read_stays_rgb", "crates/optimize/tests/optimize.rs::black_and_white_rgb_drawn_only_where_the_optimizer_reads_becomes_grey", "crates/optimize/tests/optimize.rs::black_and_white_rgb_in_resources_its_page_tree_and_a_form_share_becomes_grey", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy", "crates/filters/src/mq.rs::the_annex_h_test_sequence_encodes_to_its_bytes", "crates/filters/src/jbig2.rs::bitmaps_round_trip", "crates/filters/src/jbig2.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/optimize/tests/optimize.rs::black_and_white_images_become_jbig2", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_jbig2", "crates/filters/src/jbig2/symbols.rs::repeated_marks_are_stored_once", "crates/filters/src/jbig2/symbols.rs::scattered_marks_round_trip", "crates/optimize/tests/optimize.rs::rendered_text_becomes_jbig2_symbols"]
-notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Packed to one bit first, then stored the same way (colour-key masks aside): eight-bit grey of only black and white, eight-bit DeviceRGB of only black and white (as DeviceGray; calibrated RGB, RGB with a profile, RGB drawn or listed where /DefaultGray or /DefaultRGB is in force or referred to from anywhere but the page and form resources read (an annotation's appearance or a pattern drawing it, directly or through resources or a form shared with a page; another image's /Alternates), and RGB whose soft mask has a /Matte aside), and an indexed image of 2, 4 or 8 bits that uses only palette entries 0 and 1 (keeping its palette), unless the grey or colour settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Group 3 fax images are stored again as Group 4 when that is smaller (damaged Group 3 with end-of-line codes as the decoder recovers it, as it reports no damage there; byte-aligned Group 3 with end-of-line codes but none before the first row, not as T.4 sends them, as PdfCraft draws it, which at /K 0 may be other rows than were coded). CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Lossless JBIG2 with bounded exact-copy symbol coding is available too, with image export; lossy JBIG2 remains unsupported. Not yet: inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples."
+evidence = ["crates/optimize/src/images.rs::flate_images_past_the_runs_allowance_stay_as_they_are", "crates/optimize/tests/optimize.rs::eight_bit_black_and_white_images_become_one_bit", "crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/optimize/tests/optimize.rs::group_3_fax_images_become_group_4", "crates/optimize/tests/optimize.rs::rgb_and_two_colour_indexed_black_and_white_images_become_one_bit", "crates/optimize/tests/optimize.rs::black_and_white_rgb_used_beyond_the_page_content_read_stays_rgb", "crates/optimize/tests/optimize.rs::black_and_white_rgb_drawn_only_where_the_optimizer_reads_becomes_grey", "crates/optimize/tests/optimize.rs::black_and_white_rgb_in_resources_its_page_tree_and_a_form_share_becomes_grey", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy", "crates/filters/src/mq.rs::the_annex_h_test_sequence_encodes_to_its_bytes", "crates/filters/src/jbig2.rs::bitmaps_round_trip", "crates/filters/src/jbig2.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/optimize/tests/optimize.rs::black_and_white_images_become_jbig2", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_jbig2", "crates/filters/src/jbig2/symbols.rs::repeated_marks_are_stored_once", "crates/filters/src/jbig2/symbols.rs::scattered_marks_round_trip", "crates/optimize/tests/optimize.rs::rendered_text_becomes_jbig2_symbols", "crates/optimize/tests/optimize.rs::jbig2_scans_are_averaged_and_stored_again", "crates/optimize/src/images.rs::jbig2_images_past_the_runs_allowance_stay_as_they_are"]
+notes = "All of a run's images share one allowance of decoding, filters, decoders and pixels alike (about 1,000 scanned pages' worth, more for a longer file); those past it stay as they are, those the image pass read being counted in the report, which doc_optimize and doc_reduce return and the panel doesn't show yet. CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Packed to one bit first, then stored the same way (colour-key masks aside): eight-bit grey of only black and white, eight-bit DeviceRGB of only black and white (as DeviceGray; calibrated RGB, RGB with a profile, RGB drawn or listed where /DefaultGray or /DefaultRGB is in force or referred to from anywhere but the page and form resources read (an annotation's appearance or a pattern drawing it, directly or through resources or a form shared with a page; another image's /Alternates), and RGB whose soft mask has a /Matte aside), and an indexed image of 2, 4 or 8 bits that uses only palette entries 0 and 1 (keeping its palette), unless the grey or colour settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Group 3 fax images are stored again as Group 4 when that is smaller (damaged Group 3 with end-of-line codes as the decoder recovers it, as it reports no damage there; byte-aligned Group 3 with end-of-line codes but none before the first row, not as T.4 sends them, as PdfCraft draws it, which at /K 0 may be other rows than were coded). CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Lossless JBIG2 with bounded exact-copy symbol coding is available too, with image export; lossy JBIG2 remains unsupported. JBIG2 images are read too: averaged like any (under Retain stored as JBIG2 again), and, not resampled, stored again as the compression asks when that is smaller (as JBIG2 symbols where its own coding is a generic region, say); a symbol-coded scan, averaged, loses its exact repeats and is often larger, and then stays as it is; one whose JBIG2 page isn't its size is left alone. Not yet: inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples."
 
 [[feature]]
 id = "optimize.only-if-smaller"
@@ -8060,8 +8091,8 @@ milestone = "M10"
 status = "shipped"
 commands = ["print.dialog"]
 tools = ["printers", "printer_options", "doc_print"]
-evidence = ["crates/print/src/tests.rs::spooler_arguments_and_printer_list", "crates/print/src/tests.rs::driverless_printers_join_the_list_without_a_queue", "crates/print/src/tests.rs::windows_printers_carry_one_default_and_keep_their_names", "crates/print/src/tests.rs::printer_options_come_from_the_ppd", "crates/print/src/tests.rs::printer_option_defaults_and_job_arguments", "crates/ui-egui/tests/it/print.rs::print_dialog_shows_the_printer_driver_options", "crates/ui-egui/tests/it/print.rs::printers_listed_in_the_background_preselect_the_default_unless_one_was_picked", "crates/ui-egui/src/workflows/web_print.rs::resolution_falls_with_the_sheet_count_and_long_jobs_are_refused", "crates/ui-egui/src/workflows/web_print.rs::large_sheets_are_drawn_within_the_pixel_cap_and_bad_sizes_are_refused", "crates/ui-egui/src/workflows/web_print.rs::a_sink_error_or_a_page_that_isnt_there_stops_the_job", "crates/print/src/tests.rs::a_command_that_never_answers_is_stopped_at_the_deadline", "crates/ui-egui/tests/it/print.rs::printer_options_are_read_off_the_gui_thread_and_a_dead_read_offers_nothing"]
-notes = "CUPS queues via lpstat -p -d and driverless destinations without a queue via lpstat -e; on Windows shared craft-print lists the queues (EnumPrinters), the default (GetDefaultPrinter) and each driver's two-sided support in this process, and draws jobs as vectors with Windows.Data.Pdf into the XPS print API with a driver-validated PrintTicket (exact paper, orientation, no scaling; portrait and landscape sheets in one job via /Rotate), starting no PowerShell, so printing works under App Control script enforcement (#1107); the printer list and submission run on workers; Save as PDF on every platform. Properties…: on CUPS the driver's own PPD job options (tray, paper type, finishing …, not installable options or what the dialog sets) for this job, sent as lp -o; on Windows the driver's Printing Preferences window (printui), saved as that printer's per-user defaults rather than per job. On the web: \"Browser's print dialog\" (the default there) reaches the system's printers through the browser; PdfCraft draws the sheets itself (300 dpi up to 100 sheets, 200 up to 300, 150 up to 1,000; at most 64 megapixels a sheet and 1 GiB a job) and prints them from a hidden iframe, one per printed page, a landscape sheet among portrait ones turned onto the paper; copies, two-sided and colour are chosen in the browser's dialog; a browser that refuses to print gets the print-ready PDF as a download. Checked in headless Chromium, not yet in Firefox or Safari; pictures, not vectors; sheets of another paper size print at their own size only where the browser honours named @page sizes (Chromium doesn't). Properties… on CUPS reads the driver options off the GUI thread and gives lpoptions ten seconds before the PPD defaults stand (#1818)"
+evidence = ["crates/print/src/tests.rs::spooler_arguments_and_printer_list", "crates/print/src/tests.rs::a_job_names_its_title_and_owner_to_the_spooler", "crates/print/src/tests.rs::a_job_keeps_the_title_and_owner_it_already_sets", "crates/print/src/tests.rs::a_submitted_job_reaches_lp_named", "crates/print/src/tests.rs::driverless_printers_join_the_list_without_a_queue", "crates/print/src/tests.rs::windows_printers_carry_one_default_and_keep_their_names", "crates/print/src/tests.rs::printer_options_come_from_the_ppd", "crates/print/src/tests.rs::printer_option_defaults_and_job_arguments", "crates/ui-egui/tests/it/print.rs::print_dialog_shows_the_printer_driver_options", "crates/ui-egui/tests/it/print.rs::printers_listed_in_the_background_preselect_the_default_unless_one_was_picked", "crates/ui-egui/src/workflows/web_print.rs::resolution_falls_with_the_sheet_count_and_long_jobs_are_refused", "crates/ui-egui/src/workflows/web_print.rs::large_sheets_are_drawn_within_the_pixel_cap_and_bad_sizes_are_refused", "crates/ui-egui/src/workflows/web_print.rs::a_sink_error_or_a_page_that_isnt_there_stops_the_job", "crates/print/src/tests.rs::a_command_that_never_answers_is_stopped_at_the_deadline", "crates/ui-egui/tests/it/print.rs::printer_options_are_read_off_the_gui_thread_and_a_dead_read_offers_nothing"]
+notes = "CUPS queues via lpstat -p -d and driverless destinations without a queue via lpstat -e; on Windows shared craft-print lists the queues (EnumPrinters), the default (GetDefaultPrinter) and each driver's two-sided support in this process, and draws jobs as vectors with Windows.Data.Pdf into the XPS print API with a driver-validated PrintTicket (exact paper, orientation, no scaling; portrait and landscape sheets in one job via /Rotate), starting no PowerShell, so printing works under App Control script enforcement (#1107); the printer list and submission run on workers; Save as PDF on every platform. Properties…: on CUPS the driver's own PPD job options (tray, paper type, finishing …, not installable options or what the dialog sets) for this job, sent as lp -o; on Windows the driver's Printing Preferences window (printui), saved as that printer's per-user defaults rather than per job. On the web: \"Browser's print dialog\" (the default there) reaches the system's printers through the browser; PdfCraft draws the sheets itself (300 dpi up to 100 sheets, 200 up to 300, 150 up to 1,000; at most 64 megapixels a sheet and 1 GiB a job) and prints them from a hidden iframe, one per printed page, a landscape sheet among portrait ones turned onto the paper; copies, two-sided and colour are chosen in the browser's dialog; a browser that refuses to print gets the print-ready PDF as a download. Checked in headless Chromium, not yet in Firefox or Safari; pictures, not vectors; sheets of another paper size print at their own size only where the browser honours named @page sizes (Chromium doesn't). Properties… on CUPS reads the driver options off the GUI thread and gives lpoptions ten seconds before the PPD defaults stand (#1818); on macOS lp jobs also carry the job name and owner (com.apple.print.JobInfo.PMJobName and PMJobOwner) that the system print dialog sends and some vendors' filters need (#5743). Not yet checked on a physical Kyocera printer."
 
 [[feature]]
 id = "print.copies-collate"
@@ -9928,8 +9959,8 @@ milestone = "M14"
 status = "partial"
 commands = []
 tools = []
-evidence = ["crates/ui-egui/tests/it/view.rs::default_page_display_is_used_for_new_documents", "crates/ui-egui/tests/it/view.rs::default_zoom_is_used_for_new_documents", "crates/ui-egui/tests/it/view.rs::preferences_set_the_default_zoom", "crates/ui-egui/tests/it/view.rs::always_use_my_default_zoom_and_page_layout_ignores_what_the_pdf_asks_for"]
-notes = "Preferences ▸ Documents and view: Default page display and Default zoom (Fit to width, Zoom to page level or a percentage) for every new tab; a PDF that asks for a layout or zoom gets it, unless Always use my default zoom and page layout is on. Missing: Acrobat's resolution, rendering and page-content options"
+evidence = ["crates/ui-egui/tests/page_shadows.rs::viewport_fades_follow_the_preference_and_keep_other_scroll_areas_styled", "crates/ui-egui/tests/page_shadows.rs::rendered_page_content_is_identical_with_and_without_decoration", "crates/ui-egui/tests/page_shadows.rs::page_shadow_preference_round_trips_and_ignores_invalid_settings", "crates/ui-egui/tests/page_shadows.rs::viewer_shadows_follow_the_preference_without_moving_pages", "crates/ui-egui/tests/page_shadows.rs::organize_shadows_follow_the_preference", "crates/ui-egui/tests/it/control.rs::page_shadows_are_an_observable_app_wide_preference", "crates/ui-egui/tests/it/view.rs::default_page_display_is_used_for_new_documents", "crates/ui-egui/tests/it/view.rs::default_zoom_is_used_for_new_documents", "crates/ui-egui/tests/it/view.rs::preferences_set_the_default_zoom", "crates/ui-egui/tests/it/view.rs::always_use_my_default_zoom_and_page_layout_ignores_what_the_pdf_asks_for"]
+notes = "Preferences ▸ Documents and view: Default page display and Default zoom (Fit to width, Zoom to page level or a percentage) for every new tab; a PDF that asks for a layout or zoom gets it, unless Always use my default zoom and page layout is on. Preferences ▸ Appearance also has an app-wide, persistent Show Page Edge Shadows checkbox (on by default), exposed through ui.set and ui.state; it affects viewer and Organize decorations, including the viewport-edge gradients painted over pages, only. Missing: Acrobat's resolution, rendering and page-content options"
 
 [[feature]]
 id = "misc.prefs-documents"
@@ -9937,11 +9968,11 @@ title = "Preferences: documents (autosave interval, recent count)"
 area = "N"
 tier = "P1"
 milestone = "M14"
-status = "planned"
+status = "partial"
 commands = []
 tools = []
-evidence = []
-notes = ""
+evidence = ["crates/ui-egui/tests/it/recent_files.rs::preferences_cuts_the_list_when_it_closes_and_not_before", "crates/ui-egui/tests/it/recent_files.rs::at_zero_home_has_no_recent_section", "crates/ui-egui/tests/it/recent_files.rs::a_settings_file_can_not_ask_for_a_limit_that_is_not_one"]
+notes = "Preferences ▸ Documents and view: Recent files to keep, from 0 to 50 with 12 by default (#5572). At 0 Home has no Recent section and File ▸ Open Recent is disabled; Restore the last view keeps its own record of paths under its own switch. Still missing: the autosave interval (recovery snapshots run every AUTOSAVE_SECS, 60 s) and the rest of Acrobat's Documents page."
 
 [[feature]]
 id = "misc.prefs-commenting"
diff --git a/vendor/README.md b/vendor/README.md
index 84b2546bf3..12f8804773 100644
--- a/vendor/README.md
+++ b/vendor/README.md
@@ -39,11 +39,11 @@ Other resource categories retain their existing parent-chain lookup.
 
 | Crate | Version | Licence | Patches | Test |
 |---|---|---|---|---|
-| hayro-interpret | 0.7.0 | Apache-2.0 OR MIT | (1) select `/AP /N` appearance states via `/AS` (checkboxes, radios, stateful icons) and honour the NoView flag; (2) Type3 Unicode fallback to `/Encoding` glyph names, then printable ASCII; (3) `Type3Glyph::advance_width`; (4) `InterpreterSettings::ocg_overrides` for viewer layer toggles; (5) soft masks whose group lacks `/CS` were dropped (Chrome gradient text); (6) paint nesting cap `MAX_PAINT_NESTING` for tiling patterns and Type 3 glyphs (self-referencing content overflowed the stack); (7) CID width ranges in `/W` and `/W2` clamped to `MAX_CID` (a `0 4294967295 w` range hung); (8) `InterpreterSettings::hide_comments` skips markup annotations but keeps widgets and links (View ▸ Hide all comments); (9) `image_size_ok`: images and masks over 2^28 pixels are not decoded (a fuzzed `/W 4294967295` stencil mask allocated 4 GiB); (10) `MAX_NESTED_PAINTS`: nested paints (forms, Type 3 glyphs and tiling patterns inside one another) share a per-page budget of 50,000 (a glyph showing eight glyphs of its own font, sixteen deep, hung); (11) depends on skrifa 0.47 instead of 0.42 (upstream read-fonts fixed a Type 1 tokenizer that recursed through runs of numbers: a fuzzed font hung or overflowed the stack), with the one API change (`Charset::glyph_id` returns `Option`); (12) annotation appearances whose `/BBox` or `/Matrix` collapses to a line or a point are skipped (mapping them onto `/Rect` divided by zero and handed the device infinite or NaN matrices); (13) a Highlight annotation without a usable normal appearance is drawn from its `/QuadPoints`, `/C` and `/CA` with Multiply blending, as pdfcraft-annot draws highlights (it was not drawn at all); (14) simple-font `/Widths` (`read_widths`): entries only for codes 0–255 (one entry per code below `/FirstChar` was allocated: `4294967295` asked for 34 GB), an entry that isn't a number leaves its code missing instead of ending the array, and a `/LastChar` below `/FirstChar` gives no widths instead of discarding the font for a standard one; (15) the appearance box is mapped onto `/Rect` corner to corner: the translation now accounts for the scale (an appearance whose box didn't start at the origin and differed in size from `/Rect` was drawn shifted); (16) a clip set by `W`/`W*` takes effect after whichever path-painting operator ends the path (`S`, `f`, `B`, … as well as `n`; ISO 32000-2 §8.5.4): it was applied only on `n`, so `re W* S` clipped nothing and the clip stayed pending for a later, unrelated `n`; (17) `InterpreterSettings::cancelled`: once set, interpretation stops before the next content operator (a render pool sets it for every worker when dropped, after an edit or on closing, and for one worker when the watchdog gives up on its render, so renders whose answers nobody can receive stop instead of running to the end); (18) `MAX_PAGE_CONTENT`: the content a page holds at once (its contents, and the forms, tiling patterns and Type 3 glyph procedures being painted) stays within 512 MiB (`decode_content`; once it runs out, `InterpreterWarning::ContentTruncated` is reported (once per page by pdfcraft-render) so a truncated page is not a clean render; each level gives its bytes back when it finishes): forms nest fifty deep and each level kept its content while the next ran, so a form painting itself around a stream inflating to 256 MiB would have held over 12 GB; and Type 0 sampled functions take at most `MAX_SAMPLE_ENTRIES` (2^21) table points and `MAX_SAMPLE_VALUES` (2^23) samples, read no further than `/Size` asks (256 MiB of 1-bit samples asked for over 8 GB); (19) mesh shadings (types 4–7) are sampled only inside the area being drawn (`ShadingPattern::encode_within`, which the vendored hayro renderer calls with that area plus a pixel), within 8 visits per pixel of it plus 4 per triangle (`TriangleSampler`), and patches are triangulated one at a time: points far off the page were sampled over their whole bounding box, up to 65536 × 65536 entries (a fuzzed 147-byte patch stream; a synthetic page passed 6 GB in six seconds), ten thousand overlapping triangles ran for minutes, and every patch became 722 triangles before any limit; meshes hold at most `MAX_MESH_PATCHES` (2^16) patches and `MAX_MESH_TRIANGLES` (2^20) triangles, a lattice needs two to 2^19 vertices per row (`/VerticesPerRow 0` pushed empty rows for ever; one huge row read the whole stream), and a page samples at most `MAX_PAGE_MESH_TRIANGLES` (2^25) mesh triangles in all (a mesh painted a thousand times was triangulated a thousand times); each cut logs a warning; (20) PDF function construction is limited to 64 levels and 10,000 total nodes with cycle detection; calculator parsing and evaluation share procedure depth/work budgets, integer division/bitshift/rotation/index are panic-free, and fixed-size stack errors propagate; (21) a Type 0 font drawn with a substitute that isn't CID-keyed (it isn't embedded, or its program doesn't load) draws `.notdef` for a CID of an Adobe character collection (Japan1, GB1, CNS1, Korea1) that it can't find by Unicode: hayro took the CID for a glyph index of the substitute, which numbers its glyphs its own way, so the character was drawn as an unrelated one (𠮷 as "Ｑ" in BIZ UDPGothic); (22) a Type 0 font drawn with a substitute finds a character given with a variation selector (`/ToUnicode`, or Adobe-Japan1-UCS2, which maps the JIS X 0208 forms of the kanji JIS X 0213:2004 redrew that way: CID 1247 is 噂 U+E0100) through the substitute's variation sequences, else as the character alone: such a CID found no glyph and was drawn as an unrelated one; (23) backport of hayro 0.8's `gradient` module: `EncodedShadingPattern::as_svg_gradient` turns an axial or radial shading into stops of an sRGB gradient (within 0.01 per channel, a stop at every stitching-function bound via `Function::stitching_bounds`) when a native gradient draws it exactly (extended past the box drawn in; a radial one with no background colour); (24) `DecodedImageCache`: decoded image pixels shared across renders through the interpreter cache within a 64 MiB budget (an image-heavy page decoded its thousands of images again per tile and per scale), keyed by every decode input (`DecodedImageKey`: the stream's place and dictionary bytes, its object, mask/stencil/raster output, interpolation, decode target size, preview or final); images under a transfer function and inline images are not cached, an image over the budget is never kept, and a poisoned lock decodes uncached; (25) `Device::actual_text` hands the device a marked content sequence's `/ActualText` (inline or named in `/Properties`), so text extraction keeps the Thai, Indic and Arabic clusters Chrome marks this way (their shaped tone marks and vowels have no Unicode of their own); (26) non-embedded simple fonts drawn with a standard-font stand-in build the Latin Extended-A letters the stand-in lacks (`/Gbreve`, `/Idotaccent`, `/Scedilla`, `/aogonek`, `/ccaron`…) from the base letter and accent it has (`StandardKind::composite_glyph`, `ACCENTED_LETTERS`): PDFium's Foxit stand-ins hold only the Standard/WinAnsi/Mac Roman glyphs, so iText letters with Times New Roman unembedded showed blanks for Ğ, İ, Ş, ğ and ş; the comma-below letters (`/scommaaccent`, `/Tcommaaccent`, `/kcommaaccent`…, found by character, so `/uni0136` and the glyph list's `/Kcedilla` too) are the letter and the font's comma, smaller and under the baseline, since the stand-ins have no `commaaccent` (Romanian ș drew nothing and ț a cedilla in forms laid out from XFA; ģ, whose comma is turned and above, is not built); (27) an embedded TrueType font without a base encoding reads its codes as WinAnsi for text extraction (`EmbeddedKind::code_to_unicode_name`), matching pdftotext's output, instead of Standard: OCR text layers of scans write WinAnsi codes with no `/Encoding`, and Standard has no ü, ö or ß and reads é as Ø (glyph selection unchanged); (28) an image whose pixels hold at most 16 bits of samples (an 8-bit Separation or DeviceN image, a 1-, 2- or 4-bit gray or indexed one) is converted once per possible pixel value through a lookup table instead of once per pixel (`rgb_via_lookup`): a spot-colour tint transform is often a PostScript calculator program, run for every pixel, so a fillable character sheet's 3304 × 4105 DeviceN background took four seconds and 430 MB to draw a page; each entry is converted on its own (`convert_each`), so a tint transform giving the wrong number of components for a value the image never uses cannot shift the colours of the values it does; (29) `Device::begin_annotations`/`end_annotations` bracket the page's annotations, so a device can tell comment paints from document paints (reading colours recolour the document, never a comment, #1548); (30) the Annex D.2 alias codes read as the ink they draw: WinAnsiEncoding 0xA0 and 0xAD, and MacRomanEncoding 0xCA, carry the glyph names `space` and `hyphen` -- the names those tables also give 0x20 and 0x2D -- not `nbspace` and `sfthyphen`, whose glyph list values U+00A0 and U+00AD are invisible formatting characters. Extraction hid drawn ink behind them, so search and redaction matched neither (`XiaoBiaoSong.pdf` in the pdf.js corpus drew 104 soft hyphens; across the 989 files the soft hyphens we extract fall from 117 to 13 and the non-breaking spaces from 30 to 26, what remains coming from `/ToUnicode` maps, which say so explicitly). The base table only, in the text direction only: a `/Differences` name keeps its glyph list value and glyph lookup is untouched, both as pdftotext does; (31) a Type 0 sampled function keeps its samples in one flat array indexed by strides (`Type0::entry`) instead of a hash map keyed by each grid point: the map was built again, one hashed insert per sample, every time a shading using the function was painted (a 2,097,152-sample ramp painted 30 times took 38 s; `bug1721218` in the pdf.js corpus spent most of a 1.5 s page on it); the interpolation is unchanged, so results are bit for bit the same, a sample missing from a short stream still gives no value, and the maximum sample value is computed without overflowing at 32 bits per sample; (32) the decoded-image cache (24) keys a decode by the size the image is drawn at only when a JPX stream decodes it or its soft mask or mask (`decode_reads_target`): JPX is the only filter that decodes a reduced resolution for a size, so a JPEG or Flate scan was decoded again at every zoom step and kept once per zoom level; one decode now serves every size; `InterpreterCache::decoded_image_decodes` counts the cache's decodes; (33) Coons and tensor-product patches copy their vertices' colours less: each point of a patch's 20 × 20 triangle grid is interpolated once (`generate_patch_triangles`; each cell interpolated its four corners itself, 1,444 interpolations a patch for 400 points), a cell's second triangle takes the vertices its first copied, and the mesh sampler moves a patch's triangles into device space instead of copying each vertex (`TriangleSampler::sample_owned`); the same values, 10–16% faster on mesh-gradient pages; (34) `color::tint_transform_runs`: how many colours the calling thread has run through a Separation or DeviceN tint transform (counted once per batch in `convert_f32`), so a test counts patch (28)'s once-per-sample-value runs instead of timing them (its 10 s deadline failed on a busy FreeBSD VM in CI); (35) `EncodedShadingPattern::extent`: where a mesh shading (types 4–7) can paint at all, the pixels its triangles touched when it was encoded (`None` for the types that paint everywhere, and when the shading has a `/Background`), so the renderer samples a texture there alone and skips a mesh with nothing on the canvas; (36) a mesh shading's pixel whose corner no triangle holds strictly (on an edge two triangles share, or on the mesh's side) takes the triangle that covers its centre, edges included (`Triangle::covers`): testing only the corner left a white seam along every shared edge, and the colour is still taken at the corner; (38) the `/DefaultGray`, `/DefaultRGB` and `/DefaultCMYK` colour spaces of a resource dictionary (ISO 32000-2 §8.6.5.6) replace the device space content selects: with `g`/`G`, `rg`/`RG`, `k`/`K` and `cs`/`CS` (by name, or through a `/ColorSpace` resource that is a device space), and as the `/ColorSpace` of an image XObject, an inline image or a shading painted by `sh` or as a shading pattern (`DefaultColorSpaces`, looked up once per content window in the resources and those they inherit, so a form XObject without a default of its own draws in its page's, as Poppler and MuPDF draw it); a default that is a Lab, Indexed, Pattern or device space, has another number of components or is no colour space is ignored and device colour is drawn as before; device spaces inside other spaces (an Indexed base, a Separation or DeviceN alternate, a Pattern's underlying space), shading dictionaries, masks and transparency group spaces are unchanged, and the decoded-image cache (24) keys a decode by the default it was drawn in. hayro drew device colour as it was, so pages that calibrate it this way (common in PDF/A) came out in the wrong colours; (39) knockout groups (#2971): `Device::set_knockout` right after a `/K true` group is pushed; `Device::knockout_image` for an unmasked image before its group is pushed, when `Device::in_knockout_group`: the device clears its placement rectangle only if it will draw the image (on the canvas, not a preview's tiny image, and it decodes), decoded at its draw size so the draw reuses that decode; and, when `Device::knockout_erase_wanted`, a nested group's content drawn once between `begin_knockout_erase` and `end_knockout_erase` before the group itself, which then always gets a layer of its own; (40) an optional content membership dictionary's visibility expression (`/VE`: `/And`, `/Or`, `/Not`, nested up to 32 deep) decides its visibility ahead of `/OCGs` and `/P` (ISO 32000-2 §8.11.2.2); it was ignored, so content under it stayed visible with its layers hidden; a malformed expression, including one naming an object the document doesn't list in `/OCProperties /OCGs`, falls back to `/OCGs` and `/P` (#2986); (41) a transparency group that is neither isolated nor knockout, entered at full opacity with no soft mask and Normal blending, is drawn straight onto the page instead of into a layer of its own (§11.4.7: its elements composite with the backdrop; the layer made a `/BM /Multiply` highlight appearance an opaque block, #1968); (42) text in a Type 3 font is drawn filled whatever the text rendering mode, except mode 3 (invisible): only that mode has any effect on Type 3 fonts (ISO 32000-1 §9.3.6). Stroking ran the glyph procedure a second time, so `2 Tr` made bitmap fonts look bold, `1 Tr` painted an uncoloured glyph in the stroking colour, and `7 Tr` hid it (`7 Tr` since follows 64); (43) Lab colour spaces honour their own `/WhitePoint`: L\*a\*b\* goes to XYZ relative to that white, is Bradford-adapted to D65 and converted to sRGB (ISO 32000-2 §8.6.5.4) instead of through `LAB.icc` as if every white were D50 (a D65 blue came out 45 levels too red; the profile is removed); components normalised to [0, 1] (`manual_scale`, an `/Indexed` palette over Lab) map onto L\* 0..100 and the a\*/b\* `/Range`; (44) a Type 0 font whose `/ToUnicode` is the name `/Identity-H` or `/Identity-V` (not a CMap stream; WSCAD writes it) reads each code as its Unicode value, as Acrobat shows it (`Type0Font::identity_to_unicode`); the identity CMap the name resolved to maps codes to CIDs only, so such pages had no text to select or find; (46) an image XObject's group applies the fill opacity, so the fill alpha is reset to 1 before a stencil mask takes the fill colour as its paint, and a pattern paint drops the opacity it captured at `scn` (`Pattern::without_opacity`) (it was applied twice: a mask at `ca 0.5` was drawn at a quarter, #2975); (47) `path_as_rect`: a five-element path is a rectangle only when its four points are distinct, each step from one to the next runs along a single axis, and the last returns to the first. The length test admits one MoveTo and four LineTo as well as one MoveTo, three LineTo and a ClosePath, and asking only that every corner of the bounding box was visited says nothing about the order or the steps between, so a five-point polyline whose ends reached the corners was painted as that box -- a fourth side the path does not have -- and a clip of that shape was discarded; the coordinates are compared exactly, since the matrix is applied after this check and a `cm` of 10,000 turns `is_nearly_equal`'s 256th of a unit into tens of device units (#3327); (48) an `/ICCBased` colour space is cached by what its profile is read from (`IccProfileKey`): the stream object it names, looked up without reading the stream, and then the stream's dictionary and its own bytes (decrypted, not decoded), so a byte-for-byte copy of a profile in another object is read once, and a profile stream written directly in its array, which reports the object holding the array as every other stream written there does, is told apart by its bytes. hayro keyed it by the stream dictionary's bytes alone, so two different profiles with the same `/N` and `/Length` shared whichever was read first, and colours in the second were drawn through the first. `InterpreterCache::icc_profile_reads` counts the profiles read; (49) `OpenTypeFontBlob::new` also accepts a `post` table version 1.0, 2.0 or 3.0 written with its 16-bit halves swapped (`00 00 00 03`), as ScanSoft PDF Create! embeds every font; such fonts were refused and their text drawn with a substitute (Hebrew came out garbled or missing, #2946); `glyph_names` reads such a table from a copy with the version written correctly, so a 2.0 table's names serve `/Differences`. Any other unknown version is still refused (pdf.js 9462); (50) `CffFontBlob::glyph_index_by_name` looks a glyph name up in a name to glyph map built on first use (shared between clones) instead of searching the whole charset, with a string lookup per glyph, for every character code of a font; the first glyph with a name still wins; (51) at most 4096 graphics states saved at once, holding at most 64 MiB together (each `q` copies the whole state, dash array and clip list included, so short operators multiplied one large state); a `q` past either limit is counted but not copied, and its `Q` still removes the clips added since (from storytold/craft-libs#239); (52) a `/W2` run whose first CID is past `MAX_CID` stops there, as in `/W` (7), checked before the run's metrics are read: a first CID of 4294967295 inserted one entry and then overflowed, discarding the whole `/W2` table (from storytold/craft-libs#254); (55) a Separation or DeviceN tint transform that cannot be read keeps its colour space, and one that cannot be read or evaluated paints the alternate space's initial colour, as evaluation failures already did; that fallback, and a `cs`/`CS` colour space that cannot be read (drawn in DeviceGray as before), are now reported once per content stream as `InterpreterWarning::ColorFallback` (`RenderWarning::ColourFallback` in `pdfcraft-render`) instead of silently (#4260); (56) an annotation whose Invisible flag (bit 1) is set and whose `/Subtype` is none of the standard types of ISO 32000-2 Table 171 (`is_standard_annotation_type`; no `/Subtype` counts as unknown) is not drawn (Table 167), and a `/Popup` annotation's appearance is never painted on the page (§12.5.6.14: a popup has no appearance stream of its own; the viewer shows it as a window for its parent annotation). Both were drawn from their `/AP`; (57) a simple font drawn with a standard-font stand-in because the document names a font it doesn't embed (`StandardKind` with `fallback`) narrows a glyph to a narrower `/Widths` advance but no longer widens it to a wider one: the advance already places the next glyph (ISO 32000-2 §9.2.4; /Widths in Table 109), and widening drew a non-embedded `Arial,Bold` with 600-unit widths as a heavy fixed-pitch face whose `i` and `l` were solid blocks twice their width; an exact standard-14 font still matches its standard metrics both ways; (58) the fallback request for a Type 0 font that is not embedded (`FallbackFontQuery::with_descriptor`) takes its serif, italic and small-cap flags, `/FontWeight`, `/FontFamily` and `/FontStretch` from the descendant CIDFont's font descriptor (ISO 32000-2 §9.7.4.1, §9.7.6.1; §9.8): it read them from the Type 0 dictionary, which has none, so every such request asked for a regular sans-serif face and no resolver could tell a Song or Mincho font from a Hei or Gothic one, or see `/FontWeight 700`; (59) the NoRotate flag (`/F` bit 5) is honoured: the appearance, fitted to `/Rect`, is turned against the page's `/Rotate` about the rectangle's upper-left corner, which stays where it is, so it reads upright as the page is displayed (ISO 32000-2 §12.5.3). Sticky notes, which are saved NoRotate, were drawn turned with the page (#2583). Form fields and links stay in `/Rect`, where PdfCraft takes their click targets from it; (64) text in a Type 3 font follows ISO 32000-2 §9.3.6 in the clipping modes: under `7 Tr` it is not rendered (reported to the device as clipping text, `GlyphDrawMode::Clip`, so extraction keeps it), and in modes 4 to 7 a Type 3 glyph adds nothing to the clipping path (`clip_glyph`), so text shown only in a Type 3 font leaves no clip at `ET`. Since (42) `7 Tr` painted the glyphs in the fill colour (black by default), so a fill meant to follow showed them wherever it didn't cover them; 4 to 6 still render filled; (66) a Separation colour space whose colourant is the special name `All` paints every colourant at once (ISO 32000-2 §8.6.6.4): on screen and in an RGB print raster its tint t is the gray 1 − t, complemented because the device is additive, whatever its alternate space and tint transform say (hayro drew it through the tint transform, so a `/DeviceCMYK` transform giving cyan drew registration marks light cyan); `/None` still paints nothing, any other name still goes through its alternate, and a DeviceN space naming `All` keeps its alternate, since the clause gives the name that meaning in a Separation space; (63) a luminosity soft mask whose group colour space is `/DeviceCMYK` (by name, not an ICC-based or calibrated space) reads a `/DeviceCMYK` fill or stroke colour drawn in it, and its `/BC`, as their gray `1 - min(1, 0.3 c + 0.59 m + 0.11 y + k)` (ISO 32000-2 §10.4.2.3, §11.5.3: device colour converts to gray with no colour calibration; `Context::luminosity_in_device_cmyk`, `color::device_cmyk_to_gray`): it went through the CMYK display profile, where 100% K is a dark grey, so a 100% K mask let about an eighth of the masked paint through. CMYK images, shadings and tiling patterns inside such a mask, and CMYK on the page, still use the profile | (1) `raster::tests::widget_appearance_states`; (2, 3) `xtask text-oracle` on corpus/pdfjs issue918; (4) `raster::tests::layer_override_hides_content`; (5) `raster::tests::soft_mask_without_group_colour_space_is_applied`; (6) `raster::tests::self_referencing_tiling_pattern_terminates`, `raster::tests::self_referencing_type3_glyph_terminates`; (7) `raster::tests::huge_cid_width_ranges_terminate`; (8) `raster::tests::hiding_comments_keeps_fields`; (9) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (10) `raster::tests::type3_glyphs_that_fan_out_into_themselves_finish`; (11) `raster::tests::type1_font_programs_with_long_runs_of_numbers_load_quickly`; (12) `raster::tests::degenerate_annotation_appearances_are_skipped`; (13) `raster::tests::highlights_without_an_appearance_are_drawn`; (14) `raster::tests::malformed_simple_font_widths_keep_later_widths_and_the_font`, `raster::tests::huge_simple_font_first_char_terminates`; (15) `raster::tests::annotation_appearance_box_maps_onto_rect`; (16) `raster::tests::clipping_path_applies_after_any_painting_operator`; (17) `raster::tests::dropping_the_pool_cancels_its_renders`, `raster::tests::the_watchdog_stops_the_render_it_gives_up_on`; (18) `raster::tests::page_contents_and_nested_forms_share_one_budget`, `raster::tests::content_painted_again_and_again_keeps_drawing`, `raster::tests::sampled_functions_with_billions_of_samples_are_refused`; (19) `raster::tests::mesh_shadings_far_off_the_page_render`, `raster::tests::many_overlapping_mesh_triangles_finish`, `raster::tests::mesh_shadings_with_many_patches_or_no_rows_finish`; (20) `raster::tests::function_limits_calculator_arithmetic_and_depth`, `raster::tests::function_limits_public_construction_work_and_depth`, `raster::tests::function_limits_stitching_cycles_are_refused_and_shared_children_work`, `raster::tests::function_limits_invalid_calculator_keeps_the_page_renderable`; (21) `raster::tests::cids_a_substitute_lacks_are_not_drawn_as_other_glyphs`; (22) `raster::tests::variation_sequences_draw_their_kanji_in_a_substitute`; (23) `raster::tests::axial_and_radial_shadings_draw_as_native_gradients`; (24) `raster::tests::tiles_match_full_render`, `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel` (both decode through the cache), `raster::tests::decoded_images_with_identical_dictionaries_keep_their_own_pixels`, `raster::tests::decoded_images_under_a_transfer_function_are_not_shared`; (25) `text::tests::actual_text_replaces_the_glyphs_it_marks_in_every_writing_direction`, `text::tests::actual_text_follows_the_pdf_rules_for_marked_content`; (26) `raster::tests::accented_letters_the_standard_stand_ins_lack_are_built_from_their_parts`, `raster::tests::comma_below_letters_in_standard_fonts_draw_a_comma_under_the_letter`; (27) `text::tests::truetype_without_an_encoding_reads_its_codes_as_win_ansi`; (28) `raster::tests::spot_colour_images_run_their_tint_transform_once_per_sample_value`, `raster::tests::images_converted_through_a_table_keep_every_samples_colour`, `raster::tests::a_malformed_tint_for_an_unused_sample_keeps_the_used_colours`; (29) `raster::tests::reading_colors_keep_highlight_annotations_readable`; (30) `text::tests::the_annex_d2_alias_codes_read_as_an_ordinary_hyphen_and_space`; (31) `raster::tests::shadings_with_large_sampled_functions_paint_quickly`, `raster::tests::sampled_functions_interpolate_their_grid_as_before`; (32) `raster::tests::decoded_images_serve_every_size_they_are_drawn_at`; (33) `raster::tests::patch_meshes_keep_their_corner_colours`; (34) `raster::tests::spot_colour_images_run_their_tint_transform_once_per_sample_value`; (35) `mesh_extent_tests::{a_mesh_paints_its_triangles_alone, a_mesh_keeps_the_graphics_state_alpha, a_mesh_off_the_canvas_paints_nothing}` (`cargo test -p hayro`); (36) `raster::tests::mesh_triangles_sharing_an_edge_leave_no_seam`; (38) `raster::tests::default_colour_spaces::device_rgb_operators_draw_in_default_rgb`, `raster::tests::default_colour_spaces::device_cmyk_operators_draw_in_default_cmyk`, `raster::tests::default_colour_spaces::device_gray_operators_draw_in_default_gray`, `raster::tests::default_colour_spaces::device_images_draw_in_the_default_colour_spaces`, `raster::tests::default_colour_spaces::device_shadings_draw_in_the_default_colour_spaces`, `raster::tests::default_colour_spaces::an_image_drawn_with_and_without_a_default_keeps_both_colours`, `raster::tests::default_colour_spaces::forms_inherit_the_default_colour_spaces_they_do_not_override`, `raster::tests::default_colour_spaces::unusable_defaults_leave_device_colour_alone`; (39) `raster::tests::knockout_groups_replace_what_their_elements_cover`; (40) `raster::tests::visibility_expressions_decide_what_a_membership_dictionary_shows`; (41) `raster::tests::a_multiply_highlight_inside_a_transparency_group_keeps_the_text`; (42) `raster::tests::rendering_modes_but_3_and_7_draw_type3_glyphs_as_filled`; (43) `raster::tests::lab_honours_the_space_white_point`, `raster::tests::indexed_palettes_over_lab_keep_their_colours`; (44) `text::tests::identity_to_unicode_names_give_text`; (46) `raster::tests::stencil_masks_are_drawn_at_the_fill_opacity_once`; (47) `raster::tests::a_five_point_polyline_is_not_painted_as_its_bounding_box`, `raster::tests::a_path_that_visits_every_corner_out_of_order_is_not_a_rectangle`, `raster::tests::a_rectangle_is_still_painted_as_a_rectangle`; (48) `raster::tests::icc_profile_cache::icc_profiles_with_identical_dictionaries_draw_their_own_colours`, `raster::tests::icc_profile_cache::icc_profiles_used_again_are_read_once`; (49) `raster::tests::a_font_whose_post_version_has_swapped_halves_is_still_used`; (50) `font::blob::tests::glyph_names_resolve_to_the_first_glyph_with_that_name`; (51) `context::saved_state_tests::repeated_saves_stay_bounded_and_balanced`; (52) `font::cid::tests::w2_run_past_the_largest_cid_keeps_the_rest_of_the_table` (hayro-interpret); (55) `raster::tests::devicen_inks::a_tint_transform_that_cannot_be_evaluated_draws_the_rest_of_the_page_and_warns`, `raster::tests::devicen_inks::a_tint_transform_that_cannot_be_read_falls_back_and_warns`; (56) `raster::tests::invisible_unknown_annotations_and_popups_paint_nothing`; (57) `substitute_widths::a_substitute_keeps_its_glyph_shapes_at_wider_advances`, `substitute_widths::a_substitute_still_narrows_glyphs_to_narrower_advances` (pdfcraft-render `tests/it`); (58) `cid_fallback_query::a_cid_font_fallback_request_carries_its_descendants_style`, `cid_fallback_query::a_cid_font_without_a_descriptor_asks_for_the_default_style` (pdfcraft-render integration tests); (59) `raster::tests::no_rotate_notes_stay_upright_at_their_corner_on_rotated_pages` (hayro-interpret); (64) `type3_text_clip::{clip_only_type3_text_is_not_rendered_and_leaves_no_clip, invisible_type3_text_is_not_rendered, other_modes_render_type3_glyphs_filled_and_never_clip, only_outline_glyphs_shape_a_clip_shared_with_type3_text, self_nesting_type3_text_in_a_clip_mode_stays_bounded}` (`cargo test -p pdfcraft-render --test it`), `raster::tests::rendering_modes_but_3_and_7_draw_type3_glyphs_as_filled`, `text::tests::clipping_mode_type3_text_is_kept_by_the_ocr_filter`; (66) `separation_all::{separation_all_fills_paint_the_complemented_tint_as_gray, separation_all_strokes_paint_the_complemented_tint_as_gray, separation_all_images_paint_each_sample_as_the_complemented_gray, separation_all_shadings_paint_the_complemented_gray, separation_none_paints_nothing, a_named_separation_still_paints_through_its_alternate, a_device_n_space_naming_all_still_paints_through_its_alternate}` (`cargo test -p pdfcraft-render --test it`); (63) `color::device_cmyk_gray_tests::{each_ink_darkens_by_its_iso_weight, ink_past_full_coverage_is_black_and_bad_components_read_as_zero}` (hayro-interpret), `it::luminosity_group_space::{black_ink_in_a_device_cmyk_group_masks_fully_and_no_ink_shows_fully, each_process_ink_in_a_device_cmyk_group_masks_by_its_weight, a_device_cmyk_backdrop_colour_masks_by_its_gray, gray_and_rgb_groups_mask_as_before, device_cmyk_on_the_page_keeps_its_display_colour}` (pdfcraft-render) |
-| hayro | 0.7.1 | Apache-2.0 OR MIT | (1) `RenderSettings::{x_offset, y_offset}` to render one tile of a large page; (2) images over `MAX_IMAGE_PIXELS` (2^28) are skipped (a fuzzed `/W 4294967295` hung in resampling); (3) `tiling_cell_scale` keeps a tiling pattern's cell pixmap within 3000 px a side whatever its `/XStep`/`/YStep` (a fuzzed step far beyond `/BBox` allocated 2 GB); (4) stroke widths clamped to 4 × (canvas width + height) device pixels (a fuzzed `/LW 9223372036854775807` allocated 10 GB in stroke expansion); (5) `usable_dash_pattern`: a stroke whose dash pattern could cut it into more than `MAX_DASHES_PER_STROKE` (250,000) pieces, counting kurbo's restart of the pattern at every subpath and `ClosePath`, is drawn solid (a fuzzed `/D [[11] 0]` on a line from x = 92234775807 allocated over 5 GB, `[0.000001] 0 d` on a 20 pt line over 10 GB); (6) a dash pattern with a negative or non-finite entry, or a period that isn't positive, is drawn solid (`[-1 -1] 0 d` looped for ever in kurbo); (7) `render_size` and `render_into`: render into a buffer the caller allocates (PdfCraft renders into pixel-aligned memory that the GUI takes over as texture data); `render` is `render_into` on a new pixmap; (8) checked image source/target/RGBA, alpha-premultiplication scratch and intermediate sizes before resampling, finite transforms and exact source/mask buffers; sources wider than u16 may shrink before backend limits, with a 2^20 source-axis cap and conservative 128 MiB filter-planning estimate; an over-limit or failed resize keeps the original image resolution and geometry when the source fits the backend, otherwise skips it, with a logged warning; staging, resampling output/scratch, RGBA conversion and padding buffers use fallible reserves; (9) `may_paint_canvas`: a fill or stroke whose control-point box, grown by how far its paint reaches past the path (half the stroke width times the larger of the miter limit and √2) plus 0.5 user units and 2 pixels, misses the canvas is not drawn, so a tile no longer strokes and fills every path of its page (item 5 of #623); `set_skip_offscreen_paths` turns this off for the regression test; (10) `/Interpolate` governs the pre-resize too (#624): a minified image that does not request interpolation is pre-resized with nearest-neighbour, planned without the Catmull-Rom filter limits (`image_resampling_size` takes the flag); a Type 3 glyph image is sampled bicubically only when interpolated; a minified image with a matching soft mask is nearest-sampled straight into premultiplied RGBA; (11) `may_paint_rect`: an image whose stream-size box, mapped to the device, misses the canvas is skipped before decoding (decoded data can only shrink against that box), so a tile of an image-heavy page no longer decodes, resamples and rasterizes every image on it; (12) preview renders (`InterpreterSettings::preview`: backdrops, thumbnails, grid cells, signature-drag backgrounds) skip images under `PREVIEW_MIN_IMAGE_AREA` device pixels, while final renders always draw them; (13) reading colours (#897): `RenderSettings::color_replacement` takes a `ColorReplacement` (text colour, background, `only_black`, `line_art`) that remaps solid text and line-art paint while rendering, glyph outlines counting as text and stencil-mask ink as line art; images, image alpha masks, soft masks and pattern cells keep their colours; `render_pdf` gains a `color_replacement: Option<ColorReplacement>` argument (pass `None` for true colours); the upstream-only `[dev-dependencies.log]` entry is removed from `Cargo.toml` (log is a normal dependency since the logging patch), so `cargo test -p hayro` runs this crate's unit tests; (14) a shrunk, interpolated, axis-aligned image is snapped to whole device pixels: shrunk once to its rounded device rectangle and drawn 1:1 at the rounded corner, instead of a ceil-sized raster resampled again at a fractional scale and offset (`snap_minified_image`; scans looked soft next to Acrobat); (15) a soft mask of another size than its image is filtered when shrunk, whatever its `/Interpolate` (#1649): such a mask carries the shape on its own (Word saves text as a tiny black image with a glyph-bitmap mask), and nearest-neighbour dropped every stroke thinner than the shrink factor; (16) under a soft mask or a blend mode, axial and radial shadings are sampled instead of drawn as native gradients (#2128): vello_cpu 0.0.8 copies an opaque gradient over fully covered tiles without the mask or blend mode, so PowerPoint's faded gradient fills came out solid; (17) the renderer keeps annotation paints out of the reading-colours mapping between `begin_annotations` and `end_annotations` (#1548); (18) the page renders as one transparency group; under reading colours its background is painted inside it as the initial backdrop, so a Multiply highlight blends with the dark background instead of staying an opaque block, and otherwise the background stays outside, so a blend mode over an empty part of the page keeps its colour instead of blending with the white paper (#2970); (19) `set_paint` samples a mesh shading's texture over its triangles alone (`EncodedShadingPattern::extent`, padded rather than repeated) and skips a mesh with none on the canvas: a BricsCAD plan's 310 one-triangle `sh` each covered the whole tile, 2 s per 1024 px tile at any zoom (the watchdog gave the page up on a busy machine), now about 70 ms; (20) a tiling pattern whose step is too large for a cell pixmap, where what is painted (a fill, or a stroke with its width) can only show the first cell (PowerPoint's `/XStep 2147480100` for a picture fill drawn once), has its `/BBox` drawn at full scale with a transparent border and padded instead of tiled (`shows_one_cell`; a cell whose scale isn't finite and positive, from a `/BBox` too thin to divide by, keeps the old path: `usable_cell_scale`); shrinking the cell to fit the 3000 px limit of (3) left the picture under a pixel, so network diagrams lost their pictures (#3349); (22) knockout groups: while one is innermost, fills, strokes, glyph outlines and shadings are drawn with `Compose::Copy` (weighted by coverage), so each element replaces what earlier elements of the group drew instead of compositing over it; an image or nested group, drawn into a layer of its own, first has what is under its shape cleared (`knockout_image` for an unmasked image's rectangle, only when `draw_image` will draw it, decoded at the size it is drawn; a knockout erase pass that draws a nested group's content with every paint clearing instead of painting, a shading fill's clear clipped to the shading's `/BBox` as its paint is) and then composites over it (#2971); (23) backport of hayro 0.8: shadings that `as_svg_gradient` can represent are painted as a `vello_cpu` linear or two-point radial gradient instead of a texture sampled pixel by pixel through the shading function (InDesign fades are luminosity soft masks of one full-page axial `sh`: 40 on a report page took 15 s at 144 dpi, now under 1 s); without upstream's half-pixel shift, which suits vello_cpu 0.3 but moves 0.0.8's gradients off pixel centres; (25) a tiling cell is drawn at the scale that makes one `/XStep` (`/YStep`) exactly the cell pixmap's whole number of pixels (`tiling_cell_pixels`, at least 1 and at most the cap), so the repeated pixmap puts cells at whole multiples of the step at any device scale; drawing at the unrounded scale repeated the cell up to half a pixel off at every step, and the error grew with distance from the pattern's origin (ISO 32000-2 8.7.3.1) | (1) `raster::tests::tiles_match_full_render`; (2) `raster::tests::absurd_image_dimensions_are_skipped`; (3) `raster::tests::tiling_cells_stay_small_whatever_the_step`; (4) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (5) `raster::tests::dash_patterns_that_cut_a_stroke_into_billions_of_pieces_render`; (6) `raster::tests::invalid_dash_patterns_terminate_and_are_drawn_solid`; (7) `raster::tests::pixels_are_a_plain_renders_bytes_in_a_buffer_a_gui_can_take_over`; (8) `raster::tests::image_resampling_rejects_anisotropic_target_growth`, `raster::tests::image_resampling_bounds_intermediate_before_planning`, `raster::tests::image_resampling_rejects_invalid_sources_and_scales`, `raster::tests::image_resampling_keeps_valid_sizes_and_exact_limits`, `raster::tests::resampling_fallback_preserves_original_geometry_and_pixels`, `raster::tests::image_resampling_wide_sources_shrink_before_backend_side_limits`, `raster::tests::image_resampling_wide_transparent_sources_still_shrink`, `raster::tests::image_resampling_padded_backend_dimensions_stay_checked`, `raster::tests::image_resampling_mismatched_alpha_mask_keeps_pixels_and_placement`; (9) `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel`; (10) `raster::tests::non_interpolated_images_are_not_smoothed_when_minified`, `raster::tests::non_interpolated_gray_images_are_not_smoothed_when_minified`, `raster::tests::non_integer_minification_samples_the_same_columns`, `raster::tests::non_integer_minification_samples_colour_and_mask_from_the_same_columns`, `raster::tests::non_interpolated_alpha_images_keep_their_colours_and_mask_when_minified`, `raster::tests::non_interpolated_type3_glyph_images_are_not_smoothed_when_minified`, `raster::tests::image_resampling_nearest_accepts_wide_sources_the_filter_refuses`, `raster::tests::wide_non_interpolated_sources_draw_after_shrinking`; (11) `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel`; (12) `raster::tests::preview_renders_skip_tiny_images_but_finals_draw_everything`; (13) `color_replacement_tests::{black_maps_to_text_colour, white_maps_to_background, midgrey_interpolates, alpha_copied_verbatim, only_black_threshold, line_art_false_skips_paths_but_not_text}`, `color_replacement_render_tests::{color_replacement_maps_text_and_line_art, color_replacement_maps_stencil_mask_ink}`; (14) `raster::tests::interpolated_minified_image_edges_snap_to_whole_pixels` (`cargo test -p hayro`); (15) `raster::tests::shrunk_soft_mask_larger_than_its_image_keeps_thin_strokes`; (16) `raster::tests::soft_mask_applies_to_a_shading_pattern_fill`; (17), (18) `raster::tests::reading_colors_keep_highlight_annotations_readable`; (19) `mesh_extent_tests::{a_mesh_paints_its_triangles_alone, a_mesh_keeps_the_graphics_state_alpha, a_mesh_off_the_canvas_paints_nothing}` (`cargo test -p hayro`); (20) `raster::tests::a_tiling_pattern_drawn_once_shows_its_cell`, `raster::tests::a_large_step_still_tiles_where_the_next_cell_shows`, `raster::tests::a_tiling_cell_too_thin_to_scale_keeps_the_old_path`; (22) `raster::tests::knockout_groups_replace_what_their_elements_cover`; (23) `raster::tests::axial_and_radial_shadings_draw_as_native_gradients`; (25) `tiling_cell_placement::{far_cells_of_a_fill_sit_at_whole_steps, far_cells_sit_at_whole_steps_under_a_turned_scaled_matrix, far_cells_of_a_stroke_sit_at_whole_steps, a_cell_pixmap_spans_exactly_one_step}` (`cargo test -p pdfcraft-render --test it`) |
-| hayro-jbig2 | 0.3.0 | Apache-2.0 OR MIT | (1) at most 2^28 pixels per bitmap, page bitmap, halftone grid and grayscale image (each side could be 65535: 4.3 billion pixels decoded one by one); (2) at most 2^26 symbol pixels per symbol dictionary (a fuzzed dictionary decoded for minutes); (3) a symbol dictionary's height classes are capped at one per new symbol and its export runs at `2 × symbols + 1`, each plus `EXTRA_EMPTY_STEPS` (1024): an empty height class or a zero-length export run doesn't advance, and past the end of its data the arithmetic decoder can decode them for ever (one changed byte hung the renderer); (4) a segment header's long-form referred-to segment count is capped at `u16::MAX` and a larger count is refused before its retention or referred-to bytes are read: the 29-bit count went straight to `Vec::with_capacity`, a reservation of about 2 GiB whose failure aborts the process (from storytold/craft-libs#176) | (1) `raster::tests::jbig2_regions_of_billions_of_pixels_are_refused`; (2) the nightly `cargo xtask fuzz` finding, which now finishes in about a second; (3) `raster::tests::jbig2_symbol_dictionaries_that_never_advance_terminate`; (4) `segment::tests::test_referred_to_count_is_capped` (`cargo test --manifest-path vendor/hayro-jbig2/Cargo.toml`) |
+| hayro-interpret | 0.7.0 | Apache-2.0 OR MIT | (1) select `/AP /N` appearance states via `/AS` (checkboxes, radios, stateful icons) and honour the NoView flag; (2) Type3 Unicode fallback to `/Encoding` glyph names, then printable ASCII; (3) `Type3Glyph::advance_width`; (4) `InterpreterSettings::ocg_overrides` for viewer layer toggles; (5) soft masks whose group lacks `/CS` were dropped (Chrome gradient text); (6) paint nesting cap `MAX_PAINT_NESTING` for tiling patterns and Type 3 glyphs (self-referencing content overflowed the stack); (7) CID width ranges in `/W` and `/W2` clamped to `MAX_CID` (a `0 4294967295 w` range hung); (8) `InterpreterSettings::hide_comments` skips markup annotations but keeps widgets and links (View ▸ Hide all comments); (9) `image_size_ok`: images and masks over 2^28 pixels are not decoded (a fuzzed `/W 4294967295` stencil mask allocated 4 GiB); (10) `MAX_NESTED_PAINTS`: nested paints (forms, Type 3 glyphs and tiling patterns inside one another) share a per-page budget of 50,000 (a glyph showing eight glyphs of its own font, sixteen deep, hung); (11) depends on skrifa 0.47 instead of 0.42 (upstream read-fonts fixed a Type 1 tokenizer that recursed through runs of numbers: a fuzzed font hung or overflowed the stack), with the one API change (`Charset::glyph_id` returns `Option`); (12) annotation appearances whose `/BBox` or `/Matrix` collapses to a line or a point are skipped (mapping them onto `/Rect` divided by zero and handed the device infinite or NaN matrices); (13) a Highlight annotation without a usable normal appearance is drawn from its `/QuadPoints`, `/C` and `/CA` with Multiply blending, as pdfcraft-annot draws highlights (it was not drawn at all); (14) simple-font `/Widths` (`read_widths`): entries only for codes 0–255 (one entry per code below `/FirstChar` was allocated: `4294967295` asked for 34 GB), an entry that isn't a number leaves its code missing instead of ending the array, and a `/LastChar` below `/FirstChar` gives no widths instead of discarding the font for a standard one; (15) the appearance box is mapped onto `/Rect` corner to corner: the translation now accounts for the scale (an appearance whose box didn't start at the origin and differed in size from `/Rect` was drawn shifted); (16) a clip set by `W`/`W*` takes effect after whichever path-painting operator ends the path (`S`, `f`, `B`, … as well as `n`; ISO 32000-2 §8.5.4): it was applied only on `n`, so `re W* S` clipped nothing and the clip stayed pending for a later, unrelated `n`; (17) `InterpreterSettings::cancelled`: once set, interpretation stops before the next content operator (a render pool sets it for every worker when dropped, after an edit or on closing, and for one worker when the watchdog gives up on its render, so renders whose answers nobody can receive stop instead of running to the end); (18) `MAX_PAGE_CONTENT`: the content a page holds at once (its contents, and the forms, tiling patterns and Type 3 glyph procedures being painted) stays within 512 MiB (`decode_content`; once it runs out, `InterpreterWarning::ContentTruncated` is reported (once per page by pdfcraft-render) so a truncated page is not a clean render; each level gives its bytes back when it finishes): forms nest fifty deep and each level kept its content while the next ran, so a form painting itself around a stream inflating to 256 MiB would have held over 12 GB; and Type 0 sampled functions take at most `MAX_SAMPLE_ENTRIES` (2^21) table points and `MAX_SAMPLE_VALUES` (2^23) samples, read no further than `/Size` asks (256 MiB of 1-bit samples asked for over 8 GB); (19) mesh shadings (types 4–7) are sampled only inside the area being drawn (`ShadingPattern::encode_within`, which the vendored hayro renderer calls with that area plus a pixel), within 8 visits per pixel of it plus 4 per triangle (`TriangleSampler`), and patches are triangulated one at a time: points far off the page were sampled over their whole bounding box, up to 65536 × 65536 entries (a fuzzed 147-byte patch stream; a synthetic page passed 6 GB in six seconds), ten thousand overlapping triangles ran for minutes, and every patch became 722 triangles before any limit; meshes hold at most `MAX_MESH_PATCHES` (2^16) patches and `MAX_MESH_TRIANGLES` (2^20) triangles, a lattice needs two to 2^19 vertices per row (`/VerticesPerRow 0` pushed empty rows for ever; one huge row read the whole stream), and a page samples at most `MAX_PAGE_MESH_TRIANGLES` (2^25) mesh triangles in all (a mesh painted a thousand times was triangulated a thousand times); each cut logs a warning; (20) PDF function construction is limited to 64 levels and 10,000 total nodes with cycle detection; calculator parsing and evaluation share procedure depth/work budgets, integer division/bitshift/rotation/index are panic-free, and fixed-size stack errors propagate; (21) a Type 0 font drawn with a substitute that isn't CID-keyed (it isn't embedded, or its program doesn't load) draws `.notdef` for a CID of an Adobe character collection (Japan1, GB1, CNS1, Korea1) that it can't find by Unicode: hayro took the CID for a glyph index of the substitute, which numbers its glyphs its own way, so the character was drawn as an unrelated one (𠮷 as "Ｑ" in BIZ UDPGothic); (22) a Type 0 font drawn with a substitute finds a character given with a variation selector (`/ToUnicode`, or Adobe-Japan1-UCS2, which maps the JIS X 0208 forms of the kanji JIS X 0213:2004 redrew that way: CID 1247 is 噂 U+E0100) through the substitute's variation sequences, else as the character alone: such a CID found no glyph and was drawn as an unrelated one; (23) backport of hayro 0.8's `gradient` module: `EncodedShadingPattern::as_svg_gradient` turns an axial or radial shading into stops of an sRGB gradient (within 0.01 per channel, a stop at every stitching-function bound via `Function::stitching_bounds`) when a native gradient draws it exactly (extended past the box drawn in; a radial one with no background colour); (24) `DecodedImageCache`: decoded image pixels shared across renders through the interpreter cache within a 64 MiB budget (an image-heavy page decoded its thousands of images again per tile and per scale), keyed by every decode input (`DecodedImageKey`: the stream's place and dictionary bytes, its object, mask/stencil/raster output, interpolation, decode target size, preview or final); images under a transfer function and inline images are not cached, an image over the budget is never kept, and a poisoned lock decodes uncached; (25) `Device::actual_text` hands the device a marked content sequence's `/ActualText` (inline or named in `/Properties`), so text extraction keeps the Thai, Indic and Arabic clusters Chrome marks this way (their shaped tone marks and vowels have no Unicode of their own); (26) non-embedded simple fonts drawn with a standard-font stand-in build the Latin Extended-A letters the stand-in lacks (`/Gbreve`, `/Idotaccent`, `/Scedilla`, `/aogonek`, `/ccaron`…) from the base letter and accent it has (`StandardKind::composite_glyph`, `ACCENTED_LETTERS`): PDFium's Foxit stand-ins hold only the Standard/WinAnsi/Mac Roman glyphs, so iText letters with Times New Roman unembedded showed blanks for Ğ, İ, Ş, ğ and ş; the comma-below letters (`/scommaaccent`, `/Tcommaaccent`, `/kcommaaccent`…, found by character, so `/uni0136` and the glyph list's `/Kcedilla` too) are the letter and the font's comma, smaller and under the baseline, since the stand-ins have no `commaaccent` (Romanian ș drew nothing and ț a cedilla in forms laid out from XFA; ģ, whose comma is turned and above, is not built); (27) an embedded TrueType font without a base encoding reads its codes as WinAnsi for text extraction (`EmbeddedKind::code_to_unicode_name`), matching pdftotext's output, instead of Standard: OCR text layers of scans write WinAnsi codes with no `/Encoding`, and Standard has no ü, ö or ß and reads é as Ø (glyph selection unchanged); (28) an image whose pixels hold at most 16 bits of samples (an 8-bit Separation or DeviceN image, a 1-, 2- or 4-bit gray or indexed one) is converted once per possible pixel value through a lookup table instead of once per pixel (`rgb_via_lookup`): a spot-colour tint transform is often a PostScript calculator program, run for every pixel, so a fillable character sheet's 3304 × 4105 DeviceN background took four seconds and 430 MB to draw a page; each entry is converted on its own (`convert_each`), so a tint transform giving the wrong number of components for a value the image never uses cannot shift the colours of the values it does; (29) `Device::begin_annotations`/`end_annotations` bracket the page's annotations, so a device can tell comment paints from document paints (reading colours recolour the document, never a comment, #1548); (30) the Annex D.2 alias codes read as the ink they draw: WinAnsiEncoding 0xA0 and 0xAD, and MacRomanEncoding 0xCA, carry the glyph names `space` and `hyphen` -- the names those tables also give 0x20 and 0x2D -- not `nbspace` and `sfthyphen`, whose glyph list values U+00A0 and U+00AD are invisible formatting characters. Extraction hid drawn ink behind them, so search and redaction matched neither (`XiaoBiaoSong.pdf` in the pdf.js corpus drew 104 soft hyphens; across the 989 files the soft hyphens we extract fall from 117 to 13 and the non-breaking spaces from 30 to 26, what remains coming from `/ToUnicode` maps, which say so explicitly). The base table only, in the text direction only: a `/Differences` name keeps its glyph list value and glyph lookup is untouched, both as pdftotext does; (31) a Type 0 sampled function keeps its samples in one flat array indexed by strides (`Type0::entry`) instead of a hash map keyed by each grid point: the map was built again, one hashed insert per sample, every time a shading using the function was painted (a 2,097,152-sample ramp painted 30 times took 38 s; `bug1721218` in the pdf.js corpus spent most of a 1.5 s page on it); the interpolation is unchanged, so results are bit for bit the same, a sample missing from a short stream still gives no value, and the maximum sample value is computed without overflowing at 32 bits per sample; (32) the decoded-image cache (24) keys a decode by the size the image is drawn at only when a JPX stream decodes it or its soft mask or mask (`decode_reads_target`): JPX is the only filter that decodes a reduced resolution for a size, so a JPEG or Flate scan was decoded again at every zoom step and kept once per zoom level; one decode now serves every size; `InterpreterCache::decoded_image_decodes` counts the cache's decodes; (33) Coons and tensor-product patches copy their vertices' colours less: each point of a patch's 20 × 20 triangle grid is interpolated once (`generate_patch_triangles`; each cell interpolated its four corners itself, 1,444 interpolations a patch for 400 points), a cell's second triangle takes the vertices its first copied, and the mesh sampler moves a patch's triangles into device space instead of copying each vertex (`TriangleSampler::sample_owned`); the same values, 10–16% faster on mesh-gradient pages; (34) `color::tint_transform_runs`: how many colours the calling thread has run through a Separation or DeviceN tint transform (counted once per batch in `convert_f32`), so a test counts patch (28)'s once-per-sample-value runs instead of timing them (its 10 s deadline failed on a busy FreeBSD VM in CI); (35) `EncodedShadingPattern::extent`: where a mesh shading (types 4–7) can paint at all, the pixels its triangles touched when it was encoded (`None` for the types that paint everywhere, and when the shading has a `/Background`), so the renderer samples a texture there alone and skips a mesh with nothing on the canvas; (36) a mesh shading's pixel whose corner no triangle holds strictly (on an edge two triangles share, or on the mesh's side) takes the triangle that covers its centre, edges included (`Triangle::covers`): testing only the corner left a white seam along every shared edge, and the colour is still taken at the corner; (38) the `/DefaultGray`, `/DefaultRGB` and `/DefaultCMYK` colour spaces of a resource dictionary (ISO 32000-2 §8.6.5.6) replace the device space content selects: with `g`/`G`, `rg`/`RG`, `k`/`K` and `cs`/`CS` (by name, or through a `/ColorSpace` resource that is a device space), and as the `/ColorSpace` of an image XObject, an inline image or a shading painted by `sh` or as a shading pattern (`DefaultColorSpaces`, looked up once per content window in the resources and those they inherit, so a form XObject without a default of its own draws in its page's, as Poppler and MuPDF draw it); a default that is a Lab, Indexed, Pattern or device space, has another number of components or is no colour space is ignored and device colour is drawn as before; device spaces inside other spaces (an Indexed base, a Separation or DeviceN alternate, a Pattern's underlying space), shading dictionaries, masks and transparency group spaces are unchanged, and the decoded-image cache (24) keys a decode by the default it was drawn in. hayro drew device colour as it was, so pages that calibrate it this way (common in PDF/A) came out in the wrong colours; (39) knockout groups (#2971): `Device::set_knockout` right after a `/K true` group is pushed; `Device::knockout_image` for an unmasked image before its group is pushed, when `Device::in_knockout_group`: the device clears its placement rectangle only if it will draw the image (on the canvas, not a preview's tiny image, and it decodes), decoded at its draw size so the draw reuses that decode; and, when `Device::knockout_erase_wanted`, a nested group's content drawn once between `begin_knockout_erase` and `end_knockout_erase` before the group itself, which then always gets a layer of its own; (40) an optional content membership dictionary's visibility expression (`/VE`: `/And`, `/Or`, `/Not`, nested up to 32 deep) decides its visibility ahead of `/OCGs` and `/P` (ISO 32000-2 §8.11.2.2); it was ignored, so content under it stayed visible with its layers hidden; a malformed expression, including one naming an object the document doesn't list in `/OCProperties /OCGs`, falls back to `/OCGs` and `/P` (#2986); (41) a transparency group that is neither isolated nor knockout, entered at full opacity with no soft mask and Normal blending, is drawn straight onto the page instead of into a layer of its own (§11.4.7: its elements composite with the backdrop; the layer made a `/BM /Multiply` highlight appearance an opaque block, #1968); (42) text in a Type 3 font is drawn filled whatever the text rendering mode, except mode 3 (invisible): only that mode has any effect on Type 3 fonts (ISO 32000-1 §9.3.6). Stroking ran the glyph procedure a second time, so `2 Tr` made bitmap fonts look bold, `1 Tr` painted an uncoloured glyph in the stroking colour, and `7 Tr` hid it (`7 Tr` since follows 64); (43) Lab colour spaces honour their own `/WhitePoint`: L\*a\*b\* goes to XYZ relative to that white, is Bradford-adapted to D65 and converted to sRGB (ISO 32000-2 §8.6.5.4) instead of through `LAB.icc` as if every white were D50 (a D65 blue came out 45 levels too red; the profile is removed); components normalised to [0, 1] (`manual_scale`, an `/Indexed` palette over Lab) map onto L\* 0..100 and the a\*/b\* `/Range`; (44) a Type 0 font whose `/ToUnicode` is the name `/Identity-H` or `/Identity-V` (not a CMap stream; WSCAD writes it) reads each code as its Unicode value, as Acrobat shows it (`Type0Font::identity_to_unicode`); the identity CMap the name resolved to maps codes to CIDs only, so such pages had no text to select or find; (46) an image XObject's group applies the fill opacity, so the fill alpha is reset to 1 before a stencil mask takes the fill colour as its paint, and a pattern paint drops the opacity it captured at `scn` (`Pattern::without_opacity`) (it was applied twice: a mask at `ca 0.5` was drawn at a quarter, #2975); (47) `path_as_rect`: a five-element path is a rectangle only when its four points are distinct, each step from one to the next runs along a single axis, and the last returns to the first. The length test admits one MoveTo and four LineTo as well as one MoveTo, three LineTo and a ClosePath, and asking only that every corner of the bounding box was visited says nothing about the order or the steps between, so a five-point polyline whose ends reached the corners was painted as that box -- a fourth side the path does not have -- and a clip of that shape was discarded; the coordinates are compared exactly, since the matrix is applied after this check and a `cm` of 10,000 turns `is_nearly_equal`'s 256th of a unit into tens of device units (#3327); (48) an `/ICCBased` colour space is cached by what its profile is read from (`IccProfileKey`): the stream object it names, looked up without reading the stream, and then the stream's dictionary and its own bytes (decrypted, not decoded), so a byte-for-byte copy of a profile in another object is read once, and a profile stream written directly in its array, which reports the object holding the array as every other stream written there does, is told apart by its bytes. hayro keyed it by the stream dictionary's bytes alone, so two different profiles with the same `/N` and `/Length` shared whichever was read first, and colours in the second were drawn through the first. `InterpreterCache::icc_profile_reads` counts the profiles read; (49) `OpenTypeFontBlob::new` also accepts a `post` table version 1.0, 2.0 or 3.0 written with its 16-bit halves swapped (`00 00 00 03`), as ScanSoft PDF Create! embeds every font; such fonts were refused and their text drawn with a substitute (Hebrew came out garbled or missing, #2946); `glyph_names` reads such a table from a copy with the version written correctly, so a 2.0 table's names serve `/Differences`. Any other unknown version is still refused (pdf.js 9462); (50) `CffFontBlob::glyph_index_by_name` looks a glyph name up in a name to glyph map built on first use (shared between clones) instead of searching the whole charset, with a string lookup per glyph, for every character code of a font; the first glyph with a name still wins; (51) at most 4096 graphics states saved at once, holding at most 64 MiB together (each `q` copies the whole state, dash array and clip list included, so short operators multiplied one large state); a `q` past either limit is counted but not copied, and its `Q` still removes the clips added since (from storytold/craft-libs#239); (52) a `/W2` run whose first CID is past `MAX_CID` stops there, as in `/W` (7), checked before the run's metrics are read: a first CID of 4294967295 inserted one entry and then overflowed, discarding the whole `/W2` table (from storytold/craft-libs#254); (55) a Separation or DeviceN tint transform that cannot be read keeps its colour space, and one that cannot be read or evaluated paints the alternate space's initial colour, as evaluation failures already did; that fallback, and a `cs`/`CS` colour space that cannot be read (drawn in DeviceGray as before), are now reported once per content stream as `InterpreterWarning::ColorFallback` (`RenderWarning::ColourFallback` in `pdfcraft-render`) instead of silently (#4260); (56) an annotation whose Invisible flag (bit 1) is set and whose `/Subtype` is none of the standard types of ISO 32000-2 Table 171 (`is_standard_annotation_type`; no `/Subtype` counts as unknown) is not drawn (Table 167), and a `/Popup` annotation's appearance is never painted on the page (§12.5.6.14: a popup has no appearance stream of its own; the viewer shows it as a window for its parent annotation). Both were drawn from their `/AP`; (57) a simple font drawn with a standard-font stand-in because the document names a font it doesn't embed (`StandardKind` with `fallback`) narrows a glyph to a narrower `/Widths` advance but no longer widens it to a wider one: the advance already places the next glyph (ISO 32000-2 §9.2.4; /Widths in Table 109), and widening drew a non-embedded `Arial,Bold` with 600-unit widths as a heavy fixed-pitch face whose `i` and `l` were solid blocks twice their width; an exact standard-14 font still matches its standard metrics both ways; (58) the fallback request for a Type 0 font that is not embedded (`FallbackFontQuery::with_descriptor`) takes its serif, italic and small-cap flags, `/FontWeight`, `/FontFamily` and `/FontStretch` from the descendant CIDFont's font descriptor (ISO 32000-2 §9.7.4.1, §9.7.6.1; §9.8): it read them from the Type 0 dictionary, which has none, so every such request asked for a regular sans-serif face and no resolver could tell a Song or Mincho font from a Hei or Gothic one, or see `/FontWeight 700`; (59) the NoRotate flag (`/F` bit 5) is honoured: the appearance, fitted to `/Rect`, is turned against the page's `/Rotate` about the rectangle's upper-left corner, which stays where it is, so it reads upright as the page is displayed (ISO 32000-2 §12.5.3). Sticky notes, which are saved NoRotate, were drawn turned with the page (#2583). Form fields and links stay in `/Rect`, where PdfCraft takes their click targets from it; (64) text in a Type 3 font follows ISO 32000-2 §9.3.6 in the clipping modes: under `7 Tr` it is not rendered (reported to the device as clipping text, `GlyphDrawMode::Clip`, so extraction keeps it), and in modes 4 to 7 a Type 3 glyph adds nothing to the clipping path (`clip_glyph`), so text shown only in a Type 3 font leaves no clip at `ET`. Since (42) `7 Tr` painted the glyphs in the fill colour (black by default), so a fill meant to follow showed them wherever it didn't cover them; 4 to 6 still render filled; (66) a Separation colour space whose colourant is the special name `All` paints every colourant at once (ISO 32000-2 §8.6.6.4): on screen and in an RGB print raster its tint t is the gray 1 − t, complemented because the device is additive, whatever its alternate space and tint transform say (hayro drew it through the tint transform, so a `/DeviceCMYK` transform giving cyan drew registration marks light cyan); `/None` still paints nothing, any other name still goes through its alternate, and a DeviceN space naming `All` keeps its alternate, since the clause gives the name that meaning in a Separation space; (63) a luminosity soft mask whose group colour space is `/DeviceCMYK` (by name, not an ICC-based or calibrated space) reads a `/DeviceCMYK` fill or stroke colour drawn in it, and its `/BC`, as their gray `1 - min(1, 0.3 c + 0.59 m + 0.11 y + k)` (ISO 32000-2 §10.4.2.3, §11.5.3: device colour converts to gray with no colour calibration; `Context::luminosity_in_device_cmyk`, `color::device_cmyk_to_gray`): it went through the CMYK display profile, where 100% K is a dark grey, so a 100% K mask let about an eighth of the masked paint through. CMYK images, shadings and tiling patterns inside such a mask, and CMYK on the page, still use the profile; (71) a lookup table in an indirect string reads: it was read as a stream first, which uses up a reference (ISO 32000-2 §8.6.6.3); (72) an uncoloured pattern's underlying space given as a name or a reference is used: it was skipped, so a CMYK cyan drew red (ISO 32000-2 §8.7.3.3); (73) `InterpreterSettings::jbig2_work`, set for each page in `interpret_page` and ended with it, and a JBIG2 image or an image with a JBIG2 mask past it left out with `ContentTruncated`; (74) colour spaces nest at most 32 levels, through every way one names another, so a chain of them ends instead of overflowing the stack; an ICC profile's `/Alternate` is read where it's met and isn't kept with the profile, or a page could build a chain past the limit on spaces already read | (1) `raster::tests::widget_appearance_states`; (2, 3) `xtask text-oracle` on corpus/pdfjs issue918; (4) `raster::tests::layer_override_hides_content`; (5) `raster::tests::soft_mask_without_group_colour_space_is_applied`; (6) `raster::tests::self_referencing_tiling_pattern_terminates`, `raster::tests::self_referencing_type3_glyph_terminates`; (7) `raster::tests::huge_cid_width_ranges_terminate`; (8) `raster::tests::hiding_comments_keeps_fields`; (9) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (10) `raster::tests::type3_glyphs_that_fan_out_into_themselves_finish`; (11) `raster::tests::type1_font_programs_with_long_runs_of_numbers_load_quickly`; (12) `raster::tests::degenerate_annotation_appearances_are_skipped`; (13) `raster::tests::highlights_without_an_appearance_are_drawn`; (14) `raster::tests::malformed_simple_font_widths_keep_later_widths_and_the_font`, `raster::tests::huge_simple_font_first_char_terminates`; (15) `raster::tests::annotation_appearance_box_maps_onto_rect`; (16) `raster::tests::clipping_path_applies_after_any_painting_operator`; (17) `raster::tests::dropping_the_pool_cancels_its_renders`, `raster::tests::the_watchdog_stops_the_render_it_gives_up_on`; (18) `raster::tests::page_contents_and_nested_forms_share_one_budget`, `raster::tests::content_painted_again_and_again_keeps_drawing`, `raster::tests::sampled_functions_with_billions_of_samples_are_refused`; (19) `raster::tests::mesh_shadings_far_off_the_page_render`, `raster::tests::many_overlapping_mesh_triangles_finish`, `raster::tests::mesh_shadings_with_many_patches_or_no_rows_finish`; (20) `raster::tests::function_limits_calculator_arithmetic_and_depth`, `raster::tests::function_limits_public_construction_work_and_depth`, `raster::tests::function_limits_stitching_cycles_are_refused_and_shared_children_work`, `raster::tests::function_limits_invalid_calculator_keeps_the_page_renderable`; (21) `raster::tests::cids_a_substitute_lacks_are_not_drawn_as_other_glyphs`; (22) `raster::tests::variation_sequences_draw_their_kanji_in_a_substitute`; (23) `raster::tests::axial_and_radial_shadings_draw_as_native_gradients`; (24) `raster::tests::tiles_match_full_render`, `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel` (both decode through the cache), `raster::tests::decoded_images_with_identical_dictionaries_keep_their_own_pixels`, `raster::tests::decoded_images_under_a_transfer_function_are_not_shared`; (25) `text::tests::actual_text_replaces_the_glyphs_it_marks_in_every_writing_direction`, `text::tests::actual_text_follows_the_pdf_rules_for_marked_content`; (26) `raster::tests::accented_letters_the_standard_stand_ins_lack_are_built_from_their_parts`, `raster::tests::comma_below_letters_in_standard_fonts_draw_a_comma_under_the_letter`; (27) `text::tests::truetype_without_an_encoding_reads_its_codes_as_win_ansi`; (28) `raster::tests::spot_colour_images_run_their_tint_transform_once_per_sample_value`, `raster::tests::images_converted_through_a_table_keep_every_samples_colour`, `raster::tests::a_malformed_tint_for_an_unused_sample_keeps_the_used_colours`; (29) `raster::tests::reading_colors_keep_highlight_annotations_readable`; (30) `text::tests::the_annex_d2_alias_codes_read_as_an_ordinary_hyphen_and_space`; (31) `raster::tests::shadings_with_large_sampled_functions_paint_quickly`, `raster::tests::sampled_functions_interpolate_their_grid_as_before`; (32) `raster::tests::decoded_images_serve_every_size_they_are_drawn_at`; (33) `raster::tests::patch_meshes_keep_their_corner_colours`; (34) `raster::tests::spot_colour_images_run_their_tint_transform_once_per_sample_value`; (35) `mesh_extent_tests::{a_mesh_paints_its_triangles_alone, a_mesh_keeps_the_graphics_state_alpha, a_mesh_off_the_canvas_paints_nothing}` (`cargo test -p hayro`); (36) `raster::tests::mesh_triangles_sharing_an_edge_leave_no_seam`; (38) `raster::tests::default_colour_spaces::device_rgb_operators_draw_in_default_rgb`, `raster::tests::default_colour_spaces::device_cmyk_operators_draw_in_default_cmyk`, `raster::tests::default_colour_spaces::device_gray_operators_draw_in_default_gray`, `raster::tests::default_colour_spaces::device_images_draw_in_the_default_colour_spaces`, `raster::tests::default_colour_spaces::device_shadings_draw_in_the_default_colour_spaces`, `raster::tests::default_colour_spaces::an_image_drawn_with_and_without_a_default_keeps_both_colours`, `raster::tests::default_colour_spaces::forms_inherit_the_default_colour_spaces_they_do_not_override`, `raster::tests::default_colour_spaces::unusable_defaults_leave_device_colour_alone`; (39) `raster::tests::knockout_groups_replace_what_their_elements_cover`; (40) `raster::tests::visibility_expressions_decide_what_a_membership_dictionary_shows`; (41) `raster::tests::a_multiply_highlight_inside_a_transparency_group_keeps_the_text`; (42) `raster::tests::rendering_modes_but_3_and_7_draw_type3_glyphs_as_filled`; (43) `raster::tests::lab_honours_the_space_white_point`, `raster::tests::indexed_palettes_over_lab_keep_their_colours`; (44) `text::tests::identity_to_unicode_names_give_text`; (46) `raster::tests::stencil_masks_are_drawn_at_the_fill_opacity_once`; (47) `raster::tests::a_five_point_polyline_is_not_painted_as_its_bounding_box`, `raster::tests::a_path_that_visits_every_corner_out_of_order_is_not_a_rectangle`, `raster::tests::a_rectangle_is_still_painted_as_a_rectangle`; (48) `raster::tests::icc_profile_cache::icc_profiles_with_identical_dictionaries_draw_their_own_colours`, `raster::tests::icc_profile_cache::icc_profiles_used_again_are_read_once`; (49) `raster::tests::a_font_whose_post_version_has_swapped_halves_is_still_used`; (50) `font::blob::tests::glyph_names_resolve_to_the_first_glyph_with_that_name`; (51) `context::saved_state_tests::repeated_saves_stay_bounded_and_balanced`; (52) `font::cid::tests::w2_run_past_the_largest_cid_keeps_the_rest_of_the_table` (hayro-interpret); (55) `raster::tests::devicen_inks::a_tint_transform_that_cannot_be_evaluated_draws_the_rest_of_the_page_and_warns`, `raster::tests::devicen_inks::a_tint_transform_that_cannot_be_read_falls_back_and_warns`; (56) `raster::tests::invisible_unknown_annotations_and_popups_paint_nothing`; (57) `substitute_widths::a_substitute_keeps_its_glyph_shapes_at_wider_advances`, `substitute_widths::a_substitute_still_narrows_glyphs_to_narrower_advances` (pdfcraft-render `tests/it`); (58) `cid_fallback_query::a_cid_font_fallback_request_carries_its_descendants_style`, `cid_fallback_query::a_cid_font_without_a_descriptor_asks_for_the_default_style` (pdfcraft-render integration tests); (59) `raster::tests::no_rotate_notes_stay_upright_at_their_corner_on_rotated_pages` (hayro-interpret); (64) `type3_text_clip::{clip_only_type3_text_is_not_rendered_and_leaves_no_clip, invisible_type3_text_is_not_rendered, other_modes_render_type3_glyphs_filled_and_never_clip, only_outline_glyphs_shape_a_clip_shared_with_type3_text, self_nesting_type3_text_in_a_clip_mode_stays_bounded}` (`cargo test -p pdfcraft-render --test it`), `raster::tests::rendering_modes_but_3_and_7_draw_type3_glyphs_as_filled`, `text::tests::clipping_mode_type3_text_is_kept_by_the_ocr_filter`; (66) `separation_all::{separation_all_fills_paint_the_complemented_tint_as_gray, separation_all_strokes_paint_the_complemented_tint_as_gray, separation_all_images_paint_each_sample_as_the_complemented_gray, separation_all_shadings_paint_the_complemented_gray, separation_none_paints_nothing, a_named_separation_still_paints_through_its_alternate, a_device_n_space_naming_all_still_paints_through_its_alternate}` (`cargo test -p pdfcraft-render --test it`); (63) `color::device_cmyk_gray_tests::{each_ink_darkens_by_its_iso_weight, ink_past_full_coverage_is_black_and_bad_components_read_as_zero}` (hayro-interpret), `it::luminosity_group_space::{black_ink_in_a_device_cmyk_group_masks_fully_and_no_ink_shows_fully, each_process_ink_in_a_device_cmyk_group_masks_by_its_weight, a_device_cmyk_backdrop_colour_masks_by_its_gray, gray_and_rgb_groups_mask_as_before, device_cmyk_on_the_page_keeps_its_display_colour}` (pdfcraft-render); (71) `raster::tests::an_indexed_lookup_table_is_read_in_every_legal_form` (pdfcraft-render); (72) `raster::tests::an_uncoloured_pattern_uses_its_underlying_space_in_every_form` (pdfcraft-render); (73) `raster::tests::the_jbig2_images_of_a_page_share_one_allowance`, `a_picture_whose_jbig2_mask_is_past_the_pages_allowance_is_not_drawn` and `a_pages_jbig2_allowance_ends_with_the_page` (pdfcraft-render); (74) `raster::tests::{a_chain_of_colour_spaces_ends, colour_spaces_are_read_to_the_limit_of_their_nesting, a_chain_built_on_spaces_already_read_ends, a_profile_read_at_the_limit_keeps_its_alternate_for_a_read_nearer_the_top}` (pdfcraft-render) |
+| hayro | 0.7.1 | Apache-2.0 OR MIT | (1) `RenderSettings::{x_offset, y_offset}` to render one tile of a large page; (2) images over `MAX_IMAGE_PIXELS` (2^28) are skipped (a fuzzed `/W 4294967295` hung in resampling); (3) `tiling_cell_scale` keeps a tiling pattern's cell pixmap within 3000 px a side whatever its `/XStep`/`/YStep` (a fuzzed step far beyond `/BBox` allocated 2 GB); (4) stroke widths clamped to 4 × (canvas width + height) device pixels (a fuzzed `/LW 9223372036854775807` allocated 10 GB in stroke expansion); (5) `usable_dash_pattern`: a stroke whose dash pattern could cut it into more than `MAX_DASHES_PER_STROKE` (250,000) pieces, counting kurbo's restart of the pattern at every subpath and `ClosePath`, is drawn solid (a fuzzed `/D [[11] 0]` on a line from x = 92234775807 allocated over 5 GB, `[0.000001] 0 d` on a 20 pt line over 10 GB); (6) a dash pattern with a negative or non-finite entry, or a period that isn't positive, is drawn solid (`[-1 -1] 0 d` looped for ever in kurbo); (7) `render_size` and `render_into`: render into a buffer the caller allocates (PdfCraft renders into pixel-aligned memory that the GUI takes over as texture data); `render` is `render_into` on a new pixmap; (8) checked image source/target/RGBA, alpha-premultiplication scratch and intermediate sizes before resampling, finite transforms and exact source/mask buffers; sources wider than u16 may shrink before backend limits, with a 2^20 source-axis cap and conservative 128 MiB filter-planning estimate; an over-limit or failed resize keeps the original image resolution and geometry when the source fits the backend, otherwise skips it, with a logged warning; staging, resampling output/scratch, RGBA conversion and padding buffers use fallible reserves; (9) `may_paint_canvas`: a fill or stroke whose control-point box, grown by how far its paint reaches past the path (half the stroke width times the larger of the miter limit and √2) plus 0.5 user units and 2 pixels, misses the canvas is not drawn, so a tile no longer strokes and fills every path of its page (item 5 of #623); `set_skip_offscreen_paths` turns this off for the regression test; (10) `/Interpolate` governs the pre-resize too (#624): a minified image that does not request interpolation is pre-resized with nearest-neighbour, planned without the Catmull-Rom filter limits (`image_resampling_size` takes the flag); a Type 3 glyph image is sampled bicubically only when interpolated; a minified image with a matching soft mask is nearest-sampled straight into premultiplied RGBA; (11) `may_paint_rect`: an image whose stream-size box, mapped to the device, misses the canvas is skipped before decoding (decoded data can only shrink against that box), so a tile of an image-heavy page no longer decodes, resamples and rasterizes every image on it; (12) preview renders (`InterpreterSettings::preview`: backdrops, thumbnails, grid cells, signature-drag backgrounds) skip images under `PREVIEW_MIN_IMAGE_AREA` device pixels, while final renders always draw them; (13) reading colours (#897): `RenderSettings::color_replacement` takes a `ColorReplacement` (text colour, background, `only_black`, `line_art`) that remaps solid text and line-art paint while rendering, glyph outlines counting as text and stencil-mask ink as line art; images, image alpha masks, soft masks and pattern cells keep their colours; `render_pdf` gains a `color_replacement: Option<ColorReplacement>` argument (pass `None` for true colours); the upstream-only `[dev-dependencies.log]` entry is removed from `Cargo.toml` (log is a normal dependency since the logging patch), so `cargo test -p hayro` runs this crate's unit tests; (14) a shrunk, interpolated image whose axes lie along the device's (upright, mirrored or a quarter turn, as on a page under `/Rotate`) is snapped to whole device pixels: shrunk once to its rounded device rectangle and drawn 1:1 from the rounded corner, instead of a ceil-sized raster resampled again at a fractional scale and offset (`snap_minified_image`; scans looked soft next to Acrobat, and until #5530 a turned one still did, up to 200 grey levels off the same page drawn upright). An image counts as axis-aligned when the terms the snap drops move its far edges by at most a hundredth of a device pixel (`SNAP_SKEW`), not by a tolerance on the coefficients, which let a slight skew of a very wide image through; and the snapped 1:1 transform is used only when the shrink produced the snapped size, so a failed resize keeps the full transform instead of drawing the source raster at its source size; (15) a soft mask of another size than its image is filtered when shrunk, whatever its `/Interpolate` (#1649): such a mask carries the shape on its own (Word saves text as a tiny black image with a glyph-bitmap mask), and nearest-neighbour dropped every stroke thinner than the shrink factor; (16) under a soft mask or a blend mode, axial and radial shadings are sampled instead of drawn as native gradients (#2128): vello_cpu 0.0.8 copies an opaque gradient over fully covered tiles without the mask or blend mode, so PowerPoint's faded gradient fills came out solid; (17) the renderer keeps annotation paints out of the reading-colours mapping between `begin_annotations` and `end_annotations` (#1548); (18) the page renders as one transparency group; under reading colours its background is painted inside it as the initial backdrop, so a Multiply highlight blends with the dark background instead of staying an opaque block, and otherwise the background stays outside, so a blend mode over an empty part of the page keeps its colour instead of blending with the white paper (#2970); (19) `set_paint` samples a mesh shading's texture over its triangles alone (`EncodedShadingPattern::extent`, padded rather than repeated) and skips a mesh with none on the canvas: a BricsCAD plan's 310 one-triangle `sh` each covered the whole tile, 2 s per 1024 px tile at any zoom (the watchdog gave the page up on a busy machine), now about 70 ms; (20) a tiling pattern whose step is too large for a cell pixmap, where what is painted (a fill, or a stroke with its width) can only show the first cell (PowerPoint's `/XStep 2147480100` for a picture fill drawn once), has its `/BBox` drawn at full scale with a transparent border and padded instead of tiled (`shows_one_cell`; a cell whose scale isn't finite and positive, from a `/BBox` too thin to divide by, keeps the old path: `usable_cell_scale`); shrinking the cell to fit the 3000 px limit of (3) left the picture under a pixel, so network diagrams lost their pictures (#3349); (22) knockout groups: while one is innermost, fills, strokes, glyph outlines and shadings are drawn with `Compose::Copy` (weighted by coverage), so each element replaces what earlier elements of the group drew instead of compositing over it; an image or nested group, drawn into a layer of its own, first has what is under its shape cleared (`knockout_image` for an unmasked image's rectangle, only when `draw_image` will draw it, decoded at the size it is drawn; a knockout erase pass that draws a nested group's content with every paint clearing instead of painting, a shading fill's clear clipped to the shading's `/BBox` as its paint is) and then composites over it (#2971); (23) backport of hayro 0.8: shadings that `as_svg_gradient` can represent are painted as a `vello_cpu` linear or two-point radial gradient instead of a texture sampled pixel by pixel through the shading function (InDesign fades are luminosity soft masks of one full-page axial `sh`: 40 on a report page took 15 s at 144 dpi, now under 1 s); without upstream's half-pixel shift, which suits vello_cpu 0.3 but moves 0.0.8's gradients off pixel centres; (25) a tiling cell is drawn at the scale that makes one `/XStep` (`/YStep`) exactly the cell pixmap's whole number of pixels (`tiling_cell_pixels`, at least 1 and at most the cap), so the repeated pixmap puts cells at whole multiples of the step at any device scale; drawing at the unrounded scale repeated the cell up to half a pixel off at every step, and the error grew with distance from the pattern's origin (ISO 32000-2 8.7.3.1) | (1) `raster::tests::tiles_match_full_render`; (2) `raster::tests::absurd_image_dimensions_are_skipped`; (3) `raster::tests::tiling_cells_stay_small_whatever_the_step`; (4) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (5) `raster::tests::dash_patterns_that_cut_a_stroke_into_billions_of_pieces_render`; (6) `raster::tests::invalid_dash_patterns_terminate_and_are_drawn_solid`; (7) `raster::tests::pixels_are_a_plain_renders_bytes_in_a_buffer_a_gui_can_take_over`; (8) `raster::tests::image_resampling_rejects_anisotropic_target_growth`, `raster::tests::image_resampling_bounds_intermediate_before_planning`, `raster::tests::image_resampling_rejects_invalid_sources_and_scales`, `raster::tests::image_resampling_keeps_valid_sizes_and_exact_limits`, `raster::tests::resampling_fallback_preserves_original_geometry_and_pixels`, `raster::tests::image_resampling_wide_sources_shrink_before_backend_side_limits`, `raster::tests::image_resampling_wide_transparent_sources_still_shrink`, `raster::tests::image_resampling_padded_backend_dimensions_stay_checked`, `raster::tests::image_resampling_mismatched_alpha_mask_keeps_pixels_and_placement`; (9) `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel`; (10) `raster::tests::non_interpolated_images_are_not_smoothed_when_minified`, `raster::tests::non_interpolated_gray_images_are_not_smoothed_when_minified`, `raster::tests::non_integer_minification_samples_the_same_columns`, `raster::tests::non_integer_minification_samples_colour_and_mask_from_the_same_columns`, `raster::tests::non_interpolated_alpha_images_keep_their_colours_and_mask_when_minified`, `raster::tests::non_interpolated_type3_glyph_images_are_not_smoothed_when_minified`, `raster::tests::image_resampling_nearest_accepts_wide_sources_the_filter_refuses`, `raster::tests::wide_non_interpolated_sources_draw_after_shrinking`; (11) `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel`; (12) `raster::tests::preview_renders_skip_tiny_images_but_finals_draw_everything`; (13) `color_replacement_tests::{black_maps_to_text_colour, white_maps_to_background, midgrey_interpolates, alpha_copied_verbatim, only_black_threshold, line_art_false_skips_paths_but_not_text}`, `color_replacement_render_tests::{color_replacement_maps_text_and_line_art, color_replacement_maps_stencil_mask_ink}`; (14) `raster::tests::interpolated_minified_image_edges_snap_to_whole_pixels` (`cargo test -p hayro`), `raster::tests::a_turned_or_mirrored_minified_image_snaps_to_whole_pixels`, `rotated_image_snap::a_shrunk_image_on_a_turned_page_is_the_upright_render_turned` (`cargo test -p pdfcraft-render --test it`), `renderer::snap_tests::a_skew_that_moves_a_far_edge_is_not_snapped` (`cargo test -p hayro`); (15) `raster::tests::shrunk_soft_mask_larger_than_its_image_keeps_thin_strokes`; (16) `raster::tests::soft_mask_applies_to_a_shading_pattern_fill`; (17), (18) `raster::tests::reading_colors_keep_highlight_annotations_readable`; (19) `mesh_extent_tests::{a_mesh_paints_its_triangles_alone, a_mesh_keeps_the_graphics_state_alpha, a_mesh_off_the_canvas_paints_nothing}` (`cargo test -p hayro`); (20) `raster::tests::a_tiling_pattern_drawn_once_shows_its_cell`, `raster::tests::a_large_step_still_tiles_where_the_next_cell_shows`, `raster::tests::a_tiling_cell_too_thin_to_scale_keeps_the_old_path`; (22) `raster::tests::knockout_groups_replace_what_their_elements_cover`; (23) `raster::tests::axial_and_radial_shadings_draw_as_native_gradients`; (25) `tiling_cell_placement::{far_cells_of_a_fill_sit_at_whole_steps, far_cells_sit_at_whole_steps_under_a_turned_scaled_matrix, far_cells_of_a_stroke_sit_at_whole_steps, a_cell_pixmap_spans_exactly_one_step}` (`cargo test -p pdfcraft-render --test it`) |
+| hayro-jbig2 | 0.3.0 | Apache-2.0 OR MIT | (1) at most 2^28 pixels per bitmap and page bitmap, and 2^25 cells per halftone grid and grayscale image (each side could be 65535: 4.3 billion pixels decoded one by one, and a 4-byte value per cell); (2) at most 2^26 symbol pixels per symbol dictionary (a fuzzed dictionary decoded for minutes); (3) a symbol dictionary's height classes are capped at one per new symbol and its export runs at `2 × symbols + 1`, each plus `EXTRA_EMPTY_STEPS` (1024): an empty height class or a zero-length export run doesn't advance, and past the end of its data the arithmetic decoder can decode them for ever (one changed byte hung the renderer); (4) a segment header's long-form referred-to segment count is capped at `u16::MAX` and a larger count is refused before its retention or referred-to bytes are read: the 29-bit count went straight to `Vec::with_capacity`, a reservation of about 2 GiB whose failure aborts the process (from storytold/craft-libs#176); (5) what a page's segments hold for later ones (intermediate regions, pattern and symbol dictionaries with their headers and retained contexts, and Huffman tables) is at most 64 MiB, two square bitmaps of 16,384 a side (`MAX_RETAINED_WORDS`), and a dictionary's new and exported symbols are counted against it as they are made: each was bounded on its own, but a few dozen bytes an intermediate region held 33 MB each, and 8 MiB symbols exported again and again killed the process, so a few kilobytes could exhaust memory; (6) a segment may refer to at most 2^20 symbols, checked before any are collected: references may repeat, and 65,535 of them to one dictionary, in a 78 KB stream, asked for 17 GB; (7) a pattern dictionary keeps at most 16 MiB of shifted copies, which only speed up drawing, and none that wouldn't fit what the page has left (`MAX_SHIFTED_WORDS`); (8) a custom Huffman table has at most 2^16 lines, and a stream with its globals at most 2^20 segments and 2^22 references, checked as they are read: both grew before anything counted them, and PDFs of a kilobyte or so reached 5 GB and more behind nested Flate; (9) a page past the bounds of (1) is refused when the stream is opened: a caller sizes its output from the header before the page bitmap is made, and an Indexed image in a 743-byte PDF asked for 137 GB, which aborts; (10) a stream may ask for at most 2^30 units of decoding work, four of the largest pages, about 6 s to 17 s (`MAX_WORK`): decoding a bitmap costs a pixel each and 4 a row, copying one a word each and 1 a row, and each integer an item reads costs 38, what one takes at worst, so one with no pixels pays too, before it is decoded: each bitmap was bounded, but nothing bounded how many there were, and a 795-byte PDF took 265 s; (11) `Image::decode_within` spends from what a run of images may still do, starting with its page's pixels, and `charge_reading` charges reading a stream and its globals before anything is parsed, so an operation over a document can bound what `MAX_WORK` bounds for one image, and images that fail or decode nothing add up too: a file of thousands of images made to reach that limit took as many times as long; (12) adding to a location, a reference offset, a symbol's corner or a Huffman range line near the end of an `i32`, and negating a decoded integer of 2^31, overflowed: a panic wherever overflow is checked. The refinement context, a text region's corners, the integer decoder and the Huffman table wrap, as a release build did, and `Bitmap::combine` saturates, which comes to the same, as a location that overflows is past the end of any page. What is drawn doesn't change | (1) `raster::tests::jbig2_regions_of_billions_of_pixels_are_refused`, `raster::tests::jbig2_halftone_grids_past_their_bound_are_refused`; (2) the nightly `cargo xtask fuzz` finding, which now finishes in about a second; (3) `raster::tests::jbig2_symbol_dictionaries_that_never_advance_terminate`; (4) `segment::tests::test_referred_to_count_is_capped` (`cargo test --manifest-path vendor/hayro-jbig2/Cargo.toml`); (5) `raster::tests::jbig2_regions_held_past_a_pages_bound_are_refused`, `jbig2_symbols_without_pixels_count_towards_a_pages_bound`, `jbig2_retained_contexts_count_towards_a_pages_bound`, `jbig2_huffman_tables_count_towards_a_pages_bound`, `jbig2_new_symbols_count_towards_a_pages_bound`, `jbig2_new_symbols_are_held_to_what_a_page_has_left`, `jbig2_pattern_dictionaries_count_towards_a_pages_bound`, and in the crate (`cargo test --manifest-path vendor/hayro-jbig2/Cargo.toml`) `decode::symbol::tests::exported_symbols_are_counted_before_they_are_copied`, `tests::the_room_left_shrinks_as_segments_are_stored`; (6) `raster::tests::jbig2_segments_referring_to_too_many_symbols_are_refused`; (7) `raster::tests::jbig2_pattern_dictionaries_too_large_to_shift_still_draw`, `jbig2_shifted_patterns_never_refuse_an_image`; (8) `raster::tests::jbig2_huffman_tables_of_too_many_lines_are_refused`, `jbig2_streams_of_too_many_segments_are_refused`, `jbig2_streams_of_too_many_references_are_refused`, and in the crate `tests::the_segments_of_a_stream_and_its_globals_count_together`; (9) `raster::tests::jbig2_pages_past_the_bounds_are_refused_before_anything_is_sized_from_them`, `tests::a_page_past_the_bounds_is_refused_when_opened`; (10) `raster::tests::jbig2_decoding_work_is_counted_item_by_item`; (11) `jbig2::decode::tests::a_run_of_images_spends_its_allowance_down_to_the_step` (pdfcraft-filters); (12) `raster::tests::jbig2_placements_at_the_end_of_an_i32_draw_nothing` |
 | lopdf | 0.45.0 | MIT | (1) PNG predictor rows longer than the data are refused before their buffers are allocated (a fuzzed `/Columns 4294967295` allocated two 4 GiB rows), and empty frames return without row buffers; (2) predictor row widths use saturating arithmetic or reject overflow; (3) sub-byte TIFF Predictor 2 scratch is bounded by the samples present in the input instead of the declared `/Colors`, aligned with [lopdf#589](https://github.com/J-F-Liu/lopdf/pull/589); (4) the object lookup keeps its cycle history through compressed objects, requires an ordinary in-file container, and caps the chain of indirect lookups at 16 (a chain of new objects, each a `/Length` compressed in a container whose own `/Length` names the next, or a stream whose `/Length` names the next stream, overflowed the stack: a dev build's 2 MiB thread within 800 hops); (5) object-stream members are parsed within their own extent (up to the next distinct offset), an entry whose offset repeats an earlier entry's is skipped (so a repeated object number can resolve to its earlier entry), and offsets are processed in index order; (6) `find_latest_trailer`: a rebuild takes a `/Type /XRef` stream dictionary as the trailer when the file has no `trailer` keyword (the latest in the file wins, as a later `trailer` would), so a concatenated or truncated file keeps its /Info and /ID instead of failing to load; a candidate whose /Root is the catalog beats one whose /Root is another dictionary, and an in-file /Root must match its generation (#2365) | (1) `inspect::tests::png_predictor_rows_longer_than_the_data_are_refused_before_allocating`, `inspect::tests::empty_png_predictor_frames_do_not_allocate_rows`; (2) `inspect::tests::tiff_subbyte_predictor_row_width_overflow_is_refused`; (3) `inspect::tests::tiff_subbyte_predictor_scratch_is_bounded_by_available_samples`, `inspect::tests::tiff_subbyte_predictors_keep_components_rows_and_padding`; (4) `inspect::tests::compressed_object_self_container_does_not_recurse`, `inspect::tests::compressed_object_mutual_containers_do_not_recurse`, `inspect::tests::object_stream_length_cycle_does_not_recurse`, `inspect::tests::compressed_object_container_chain_does_not_recurse`, `inspect::tests::compressed_length_chain_does_not_recurse`, `inspect::tests::plain_stream_length_chain_does_not_recurse`, `inspect::tests::compressed_objects_and_indirect_stream_length_still_load`, `inspect::tests::compressed_length_in_a_container_with_an_indirect_length_still_loads`; (5) `inspect::tests::object_stream_member_extents_bound_owned_strings`, `inspect::tests::object_stream_member_extents_preserve_index_order_and_whitespace`; (6) `inspect::tests::rebuilt_file_keeps_the_info_of_its_cross_reference_stream`, `inspect::tests::rebuilt_file_prefers_a_trailer_whose_root_is_the_catalog` |
-| hayro-syntax | 0.7.2 | Apache-2.0 OR MIT | (1) Page-tree cycle guard in `resolve_pages` (visited set + depth cap): a `/Kids` loop among compressed objects overflowed the stack and aborted the process; (2) `ccitt_size_ok`: CCITT images wider than 2^20 columns or over 2^28 pixels are not decoded (a fuzzed `/Columns 4294967295` allocated 4 GiB); (3) Flate/LZW predictor row widths are saturating `usize`, a zero width is refused and a row longer than the data is not allocated (a fuzzed `/Columns 9223372036854775807` wrapped to a 2^61-byte allocation and aborted); (4) the inline-image end-of-data check (`EI`) doesn't nest inside its own look-ahead and examines at most 256 candidates and steps (50 images with "EI" in their data ran for over ten minutes); an EI followed by a delimiter (EI%..., EI[...) ends the image like one followed by white space; only a regular character after EI skips the candidate; (5) a stream whose `/Length` is wrong is recovered only when `stream` is the next token — scanning ahead to a later object's `stream` made an indirect appearance-state dictionary (Quartz checkboxes: `/AP /N` → `<< /Yes … /Off … >>`) render as a non-form, so the widget was skipped; (6) JPX rescaling uses an exact integer sample range for 1–32-bit components (32 shifted past u32, and floating-point maxima at 25–31 bits wrapped to zero), and refuses zero-sized rows; (7) `decode_limit`: Flate (through flate2 and the fallback inflater), LZW, RunLength and ASCII85 never write past `MAX_DECODED_STREAM` (256 MiB), or, for the last filter of an image of known size, past twice its pixel bytes (a predictor tag byte per byte), at most 1 GiB; `Stream::decoded_within` for budgeted callers; a page's `/Contents` array shares one `MAX_DECODED_STREAM` (a 2 MB page whose content stream or 8 × 8 image inflated to 2 GB took the renderer past 3 GB in under a second; naming the stream twenty times in `/Contents`, 5 GB); (8) high-precision numbers (jsPDF MediaBox coordinates with over 19 digits) parse without overflowing the u64 mantissa: fractional digits past it are dropped, integer digits past it scale the value (a real, kept finite); (9) large dictionary indexes are built on first use and shared across repeated reads within each PDF (#307); the validated-byte cache is bounded, reader contexts remain separate, repairs and inline/content dictionaries bypass sharing, and small dictionaries stay eager; (10) decoded object-stream slots publish once under contention, cold loading rejects recursive dependencies, and xref repair serializes without holding recursive read guards; this permits one parser per native render pool with private worker caches; (11) `sync.rs`: a poisoned lock is recovered instead of unwrapped (a worker panic no longer cascades into every reader of the same PDF), and xref repair takes a blocking write lock instead of asserting a non-blocking one; (12) `SegmentList` (`util.rs`) returns `None` for an out-of-range index instead of panicking; (13) a page's `/UserUnit` scales `render_dimensions` and `initial_transform`, so the page and everything on it are sized in points, as Acrobat shows them; it is read as Acrobat reads it (the page's own entry, not inherited; a number from 1 up, at most 75,000; anything else counts as 1), and a page without it keeps exactly the transform it had; (14) revision 2–4 passwords are tried as given and then in PDFDocEncoding (`legacy_passwords` in `crypto/mod.rs`, which resolves the upstream `TODO: Convert to PDFDocEncoding`): passwords arrive as UTF-8 text, so a password with characters outside ASCII (`Çok güzel`, `ılık€`) written in PDFDocEncoding, as ISO 32000-2 §7.6.4.3.2 asks and qpdf and Acrobat write it, was always wrong; (15) page content is read a piece at a time (`page::ContentReader`, `Page::content_reader`): plain streams and Flate streams without a predictor are decoded as they are read, with a budget of 64 times their compressed size and never less than `MAX_DECODED_STREAM` (a stream that expands past it is cut and reported); other streams are decoded whole, as before, and share `MAX_DECODED_STREAM`. The content tokenizer reads a window at a time (`UntypedIter::new_window`, `TypedIter::needs_more`, `TypedIter::committed`): an instruction that runs past the window is not decided until more data follows, which `Reader` records by flagging reads and `at_end` past the end of the data, including through the clones the parser makes. The Flate decoder keeps its own 32 KiB history, so it pauses at any output size. `ContentReader::new` reuses raw/decrypted stream bytes for budget accounting and piece creation, and `decoded_raw_within` applies the existing Whole-stream filters and limits to those bytes without decrypting twice; (16) revision 5–6 (AES-256) passwords are tried in their SASLprep form (RFC 4013, then UTF-8, at most 127 bytes, as ISO 32000-2 §7.6.4.3.3 Algorithm 2.A asks and pdfcraft-crypt writes them) and then, if that differs, as given (`aes256_passwords` in `crypto/mod.rs`, which resolves the upstream `TODO: Do the above.`; `stringprep`, already in the tree through pdfcraft-crypt, is an optional dependency enabled by `std`, and without `std` passwords are used as given): the renderer used the password as typed, so one that SASLprep changes (a decomposed `café`, a no-break space, the fullwidth `ａｂ` a Japanese IME types in full-width mode) was wrong, although pdfcraft-cos accepted it: protecting a document with such an open password was rolled back ("the password is incorrect"), and a file with such a password did not open with it.; (17) CCITT `/Rows 0` means the height is not predetermined (ISO 32000-2 Table 11), not zero rows: scanned Group 4 pages written that way rendered blank; (18) The streaming Flate decoder (`lzw_flate::flate::fallback`) copies a back-reference in runs of up to its distance (`extend_from_within`), not byte by byte. The copy reads only bytes already in the output, and a copy whose source does not exist still writes nothing, so the bytes are those a byte-by-byte copy writes. Inflating the A1 sample's content stream (278.6 MB) takes about 14% less time (0.66 s to 0.56 s); the output is identical; (19) CCITT `/Rows` below the image's `/Height` decodes to the height: a plotter driver wrote `/Rows` equal to `/Columns`, so only the first rows were decoded and the rest drawn black (#3308) (20) `stream` followed by spaces or tabs and then the line break (`stream \r\n`, as Microsoft Reporting Services writes it) starts the data after the line break; the content stream was taken to start at the space and the page rendered blank.; (21) a JP2 colour specification naming an enumerated colour space the decoder refuses (CIEJab in a veraPDF fixture, YCbCr, PhotoYCC, YPbPr, bilevel…) no longer fails the image: it is decoded again from a copy whose `colr` names the space the decoder assumes without one, greyscale, sRGB or CMYK by component count, as MuPDF and Poppler draw it (`without_refused_enumerated_colour`; the page drew blank, #3306); (22) an object stream's index of `objnum offset` pairs is parsed once per stream and kept beside its decoded data (`ObjectStreamIndexes`, `XRef::with_object_stream_indexes`), and an offset past `usize` is malformed instead of wrapping: `XRef::get_with` parsed the whole index again for every object it fetched from the stream, so reading all of a stream of N objects took N² steps (a Firefox page whose 65,542 objects share one stream took 37 s to draw and 40 s to extract its text); (23) the inline-image end-of-data look-ahead no longer rejects a candidate `EI` because a byte above 0x7F lies between it and the next one: when the candidate is the end, those bytes are the content stream that follows the image, and its strings carry such bytes (WinAnsi `(Grüße) Tj`, the two-byte codes of any Type 0 font), so the operator check that follows decides alone, bounded as in (4) (a scanned page whose OCR text held an accented word and a later capital "EI" — EINGANG, BEI, KLEIN — drew and extracted nothing after the image: 40 of 275 pages across five real documents); (24) `xref::prev_offset`: a trailer `/Prev` written as a reference `N G R` is read as the offset that object holds when the section's own entries place it (iText's `indirectPrev.pdf`; each section's entries are read before its `Prev` is followed), and otherwise as offset N (tiff2pdf; JHOVE's PDF-HUL-157 files, #2366), as `pdfcraft-cos` and other readers take it, so the earlier sections' pages are seen instead of one; (25) direct arrays and dictionaries share a reader-local nesting cap of 128, counted while skipping and while parsing a dictionary (its lenient repair reads, rather than skips, an object found where a key belongs, so `<< << …` recursed through that read); deeper objects return `None` instead of overflowing the stack (including unused trailer values, trailer entries, content operands and marked-content properties); a chain of 65 direct stitching functions now stops at this cap, before the 64-function guard; (26) an xref stream subsection must be backed by its decoded data: all-zero `/W` widths (an entry reads no bytes) and a declared count longer than the data are refused before any entry is inserted, where a tiny stream with a large `/Size` or `/Index` count inserted that many entries (from storytold/craft-libs#239); a subsection running past object number `i32::MAX` is refused instead of overflowing or turning negative; (27) an xref stream's type field is read big-endian at its full `/W[0]` width, where only its first byte was read and wider fields shifted every later entry, and `/W[0]` over 8 bytes is refused like `/W[1]` (from storytold/craft-libs#241); (28) a content instruction keeps up to 256 operands (`MAX_OPERANDS`) instead of 10, and past that drops the oldest instead of ending the content stream: the eleventh operand of a twelve-ink DeviceN `scn` (ISO 32000-2 §8.6.6.5 allows any number of components) blanked the rest of the page (#4260) | (1) `cos/tests/writer.rs::page_tree_loops_in_object_streams_do_not_crash_readers`; (2) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (3) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (4) `raster::tests::inline_images_with_ei_in_their_data_parse_in_linear_time`, `content::tests::inline_image_ei_may_be_followed_by_a_delimiter`; (5) `raster::tests::indirect_appearance_state_dict_is_not_another_stream`; (6) `raster::tests::jpx_stream_bit_depth_boundaries_do_not_panic`, `raster::tests::jpx_32_bit_image_does_not_prevent_other_page_content_from_rendering`, `raster::tests::jpx_gray_rgb_and_alpha_keep_eight_bit_samples`, `raster::tests::jpx_streams_reject_out_of_range_bit_depths`; (7) `raster::tests::decompression_bombs_stop_at_the_stream_limit`, `raster::tests::page_contents_and_nested_forms_share_one_budget`; (8) `inspect::tests::jspdf_high_precision_mediabox_does_not_overflow_dimensions`, `object::number::tests::high_precision_float_does_not_overflow_mantissa` (hayro-syntax); (9) `object::dict::lazy_index_tests`, `raster::tests::large_resource_indexes_preserve_pixels_and_text`; (10) `data::tests`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`, `raster::tests::shared_parser_is_lazy_and_initializes_once_under_contention`; (11) `data::tests::panicking_initializer_wakes_waiters_and_prevents_retries`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`; (12) `util::tests::segment_list_rejects_out_of_range_indices`; (13) `raster::tests::user_unit_scales_the_page_and_everything_on_it`; (14) `crypto::pdfcraft_password_tests`, `pdfcraft-engine` `tests::legacy_passwords_with_turkish_characters_open`; (15) `content::tests::windows_keep_every_instruction_at_every_split`, `content::tests::windows_keep_every_instruction_in_pieces_of_any_size`, `content::tests::windows_match_the_slice_on_random_content`, `content::tests::windows_drop_blanks_and_keep_a_comment_that_may_go_on`, `page::content_reader_tests::content_past_the_cap_is_read_to_the_end`, `page::content_reader_tests::a_stream_that_expands_past_the_budget_is_cut_there`, `page::content_reader_tests::a_small_expansion_under_the_cap_is_not_cut`, `raster::tests::page_content_past_the_old_cap_renders`, `raster::tests::content_reader_returns_the_same_bytes_in_any_pieces`, `raster::tests::content_bombs_stop_at_the_budget_and_say_so`, `page::content_reader_tests::plain_and_whole_pieces_keep_their_bytes`, `page::content_reader_tests::repeated_content_reference_counts_compressed_bytes_once`, `page::content_reader_tests::whole_cap_still_counts_later_unique_streams`; (16) `crypto::pdfcraft_password_tests::aes256_passwords_are_tried_in_their_saslprep_form_then_as_given`, `crypto::pdfcraft_password_tests::aes256_passwords_open_as_typed_and_in_their_saslprep_form`, `pdfcraft-engine` `tests::aes256_open_passwords_that_saslprep_changes_protect_and_reopen_as_typed`, `tests::aes256_files_whose_passwords_saslprep_changes_open_as_typed`; (17) `raster::tests::group4_fax_with_rows_zero_decodes_to_the_image_height`; (18) `filter::lzw_flate::tests::back_reference_longer_than_its_distance_repeats_its_source`, `back_reference_cut_by_the_limit_resumes_in_the_next_call` and `back_reference_reads_bytes_written_by_an_earlier_call`; each fails when the copy returns the wrong remaining count; (19) `raster::tests::group4_fax_with_rows_below_its_height_decodes_to_the_image_height`; (20) `raster::tests::space_before_the_line_break_after_stream_still_renders`; (21) `raster::tests::a_jp2_image_in_a_refused_enumerated_colour_space_is_drawn`, `filter::jpx::tests::refused_enumerated_colour_spaces_become_the_component_counts_default`, `filter::jpx::tests::what_the_decoder_handles_or_cant_be_read_is_left_alone` (`cargo test --manifest-path vendor/hayro-syntax/Cargo.toml`); (22) `raster::tests::objects_in_one_large_object_stream_are_read_in_linear_time`; (23) `text::tests::text_after_an_inline_image_survives_a_non_ascii_byte_before_a_later_ei`, `content::tests::an_inline_image_ends_at_its_own_ei_when_later_text_holds_a_non_ascii_byte` (hayro-syntax); (24) `xref::tests::prev_as_reference_reaches_the_earlier_section`, `xref::tests::prev_as_reference_to_an_object_holding_the_offset_reads_that_offset`, `pdfcraft-cos` `document::tests::a_prev_written_as_a_reference_still_reaches_the_earlier_sections`, `document::tests::a_prev_reference_to_an_object_holding_the_offset_reads_that_offset`; (25) `raster::tests::deeply_nested_direct_objects_do_not_overflow_the_stack`, `raster::tests::dictionaries_nested_without_keys_in_content_do_not_overflow_the_stack`, `raster::tests::dictionaries_nested_without_keys_in_the_trailer_do_not_overflow_the_stack`, `raster::tests::dictionaries_nested_without_keys_as_marked_content_properties_do_not_overflow_the_stack`, `raster::tests::dictionaries_nested_without_keys_are_read_up_to_the_nesting_cap`, `raster::tests::nesting_at_the_cap_fits_a_512_kib_stack` (native only), `raster::tests::function_limits_depth_guard_refuses_a_chain_of_references`; (26) `xref::tests::xref_stream_entries_need_backing_bytes`; (27) `xref::tests::xref_stream_type_field_uses_the_full_w0_width`, `xref::tests::xref_stream_loader_rejects_oversized_w0` (`cargo test --manifest-path vendor/hayro-syntax/Cargo.toml`); (28) `content::ops::tests::scn_with_twelve_components_keeps_them_all`, `content::ops::tests::operands_past_the_cap_keep_the_latest_in_order` (hayro-syntax), `raster::tests::devicen_inks::a_twelve_ink_devicen_colour_paints`, `raster::tests::devicen_inks::a_four_ink_devicen_colour_paints`, `raster::tests::devicen_inks::an_operator_with_hundreds_of_operands_does_not_end_the_content` |
+| hayro-syntax | 0.7.2 | Apache-2.0 OR MIT | (1) Page-tree cycle guard in `resolve_pages` (visited set + depth cap): a `/Kids` loop among compressed objects overflowed the stack and aborted the process; (2) `ccitt_size_ok`: CCITT images wider than 2^20 columns or over 2^28 pixels are not decoded (a fuzzed `/Columns 4294967295` allocated 4 GiB); (3) Flate/LZW predictor row widths are saturating `usize`, a zero width is refused and a row longer than the data is not allocated (a fuzzed `/Columns 9223372036854775807` wrapped to a 2^61-byte allocation and aborted); (4) the inline-image end-of-data check (`EI`) doesn't nest inside its own look-ahead and examines at most 256 candidates and steps (50 images with "EI" in their data ran for over ten minutes); an EI followed by a delimiter (EI%..., EI[...) ends the image like one followed by white space; only a regular character after EI skips the candidate; (5) a stream whose `/Length` is wrong is recovered only when `stream` is the next token — scanning ahead to a later object's `stream` made an indirect appearance-state dictionary (Quartz checkboxes: `/AP /N` → `<< /Yes … /Off … >>`) render as a non-form, so the widget was skipped; (6) JPX rescaling uses an exact integer sample range for 1–32-bit components (32 shifted past u32, and floating-point maxima at 25–31 bits wrapped to zero), and refuses zero-sized rows; (7) `decode_limit`: Flate (through flate2 and the fallback inflater), LZW, RunLength and ASCII85 never write past `MAX_DECODED_STREAM` (256 MiB), or, for the last filter of an image of known size, past twice its pixel bytes (a predictor tag byte per byte), at most 1 GiB; `Stream::decoded_within` for budgeted callers; a page's `/Contents` array shares one `MAX_DECODED_STREAM` (a 2 MB page whose content stream or 8 × 8 image inflated to 2 GB took the renderer past 3 GB in under a second; naming the stream twenty times in `/Contents`, 5 GB); (8) high-precision numbers (jsPDF MediaBox coordinates with over 19 digits) parse without overflowing the u64 mantissa: fractional digits past it are dropped, integer digits past it scale the value (a real, kept finite); (9) large dictionary indexes are built on first use and shared across repeated reads within each PDF (#307); the validated-byte cache is bounded, reader contexts remain separate, repairs and inline/content dictionaries bypass sharing, and small dictionaries stay eager; (10) decoded object-stream slots publish once under contention, cold loading rejects recursive dependencies, and xref repair serializes without holding recursive read guards; this permits one parser per native render pool with private worker caches; (11) `sync.rs`: a poisoned lock is recovered instead of unwrapped (a worker panic no longer cascades into every reader of the same PDF), and xref repair takes a blocking write lock instead of asserting a non-blocking one; (12) `SegmentList` (`util.rs`) returns `None` for an out-of-range index instead of panicking; (13) a page's `/UserUnit` scales `render_dimensions` and `initial_transform`, so the page and everything on it are sized in points, as Acrobat shows them; it is read as Acrobat reads it (the page's own entry, not inherited; a number from 1 up, at most 75,000; anything else counts as 1), and a page without it keeps exactly the transform it had; (14) revision 2–4 passwords are tried as given and then in PDFDocEncoding (`legacy_passwords` in `crypto/mod.rs`, which resolves the upstream `TODO: Convert to PDFDocEncoding`): passwords arrive as UTF-8 text, so a password with characters outside ASCII (`Çok güzel`, `ılık€`) written in PDFDocEncoding, as ISO 32000-2 §7.6.4.3.2 asks and qpdf and Acrobat write it, was always wrong; (15) page content is read a piece at a time (`page::ContentReader`, `Page::content_reader`): plain streams and Flate streams without a predictor are decoded as they are read, with a budget of 64 times their compressed size and never less than `MAX_DECODED_STREAM` (a stream that expands past it is cut and reported); other streams are decoded whole, as before, and share `MAX_DECODED_STREAM`. The content tokenizer reads a window at a time (`UntypedIter::new_window`, `TypedIter::needs_more`, `TypedIter::committed`): an instruction that runs past the window is not decided until more data follows, which `Reader` records by flagging reads and `at_end` past the end of the data, including through the clones the parser makes. The Flate decoder keeps its own 32 KiB history, so it pauses at any output size. `ContentReader::new` reuses raw/decrypted stream bytes for budget accounting and piece creation, and `decoded_raw_within` applies the existing Whole-stream filters and limits to those bytes without decrypting twice; (16) revision 5–6 (AES-256) passwords are tried in their SASLprep form (RFC 4013, then UTF-8, at most 127 bytes, as ISO 32000-2 §7.6.4.3.3 Algorithm 2.A asks and pdfcraft-crypt writes them) and then, if that differs, as given (`aes256_passwords` in `crypto/mod.rs`, which resolves the upstream `TODO: Do the above.`; `stringprep`, already in the tree through pdfcraft-crypt, is an optional dependency enabled by `std`, and without `std` passwords are used as given): the renderer used the password as typed, so one that SASLprep changes (a decomposed `café`, a no-break space, the fullwidth `ａｂ` a Japanese IME types in full-width mode) was wrong, although pdfcraft-cos accepted it: protecting a document with such an open password was rolled back ("the password is incorrect"), and a file with such a password did not open with it.; (17) CCITT `/Rows 0` means the height is not predetermined (ISO 32000-2 Table 11), not zero rows: scanned Group 4 pages written that way rendered blank; (18) The streaming Flate decoder (`lzw_flate::flate::fallback`) copies a back-reference in runs of up to its distance (`extend_from_within`), not byte by byte. The copy reads only bytes already in the output, and a copy whose source does not exist still writes nothing, so the bytes are those a byte-by-byte copy writes. Inflating the A1 sample's content stream (278.6 MB) takes about 14% less time (0.66 s to 0.56 s); the output is identical; (19) CCITT `/Rows` below the image's `/Height` decodes to the height: a plotter driver wrote `/Rows` equal to `/Columns`, so only the first rows were decoded and the rest drawn black (#3308) (20) `stream` followed by spaces or tabs and then the line break (`stream \r\n`, as Microsoft Reporting Services writes it) starts the data after the line break; the content stream was taken to start at the space and the page rendered blank.; (21) a JP2 colour specification naming an enumerated colour space the decoder refuses (CIEJab in a veraPDF fixture, YCbCr, PhotoYCC, YPbPr, bilevel…) no longer fails the image: it is decoded again from a copy whose `colr` names the space the decoder assumes without one, greyscale, sRGB or CMYK by component count, as MuPDF and Poppler draw it (`without_refused_enumerated_colour`; the page drew blank, #3306); (22) an object stream's index of `objnum offset` pairs is parsed once per stream and kept beside its decoded data (`ObjectStreamIndexes`, `XRef::with_object_stream_indexes`), and an offset past `usize` is malformed instead of wrapping: `XRef::get_with` parsed the whole index again for every object it fetched from the stream, so reading all of a stream of N objects took N² steps (a Firefox page whose 65,542 objects share one stream took 37 s to draw and 40 s to extract its text); (23) the inline-image end-of-data look-ahead no longer rejects a candidate `EI` because a byte above 0x7F lies between it and the next one: when the candidate is the end, those bytes are the content stream that follows the image, and its strings carry such bytes (WinAnsi `(Grüße) Tj`, the two-byte codes of any Type 0 font), so the operator check that follows decides alone, bounded as in (4) (a scanned page whose OCR text held an accented word and a later capital "EI" — EINGANG, BEI, KLEIN — drew and extracted nothing after the image: 40 of 275 pages across five real documents); (24) `xref::prev_offset`: a trailer `/Prev` written as a reference `N G R` is read as the offset that object holds when the section's own entries place it (iText's `indirectPrev.pdf`; each section's entries are read before its `Prev` is followed), and otherwise as offset N (tiff2pdf; JHOVE's PDF-HUL-157 files, #2366), as `pdfcraft-cos` and other readers take it, so the earlier sections' pages are seen instead of one; (25) direct arrays and dictionaries share a reader-local nesting cap of 128, counted while skipping and while parsing a dictionary (its lenient repair reads, rather than skips, an object found where a key belongs, so `<< << …` recursed through that read); deeper objects return `None` instead of overflowing the stack (including unused trailer values, trailer entries, content operands and marked-content properties); a chain of 65 direct stitching functions now stops at this cap, before the 64-function guard; (26) an xref stream subsection must be backed by its decoded data: all-zero `/W` widths (an entry reads no bytes) and a declared count longer than the data are refused before any entry is inserted, where a tiny stream with a large `/Size` or `/Index` count inserted that many entries (from storytold/craft-libs#239); a subsection running past object number `i32::MAX` is refused instead of overflowing or turning negative; (27) an xref stream's type field is read big-endian at its full `/W[0]` width, where only its first byte was read and wider fields shifted every later entry, and `/W[0]` over 8 bytes is refused like `/W[1]` (from storytold/craft-libs#241); (28) a content instruction keeps up to 256 operands (`MAX_OPERANDS`) instead of 10, and past that drops the oldest instead of ending the content stream: the eleventh operand of a twelve-ink DeviceN `scn` (ISO 32000-2 §8.6.6.5 allows any number of components) blanked the rest of the page (#4260); (29) a `/JBIG2Globals` stream that is itself JBIG2 isn't decoded: globals are raw segments, and a chain of 16,000 such streams overflowed the stack, which aborts the process; (31) `set_page_jbig2_work`: the JBIG2 images decoded on a thread spend one allowance, set per page, 2^30 steps (`MAX_PAGE_JBIG2_WORK`), so a page of many images made to reach their own limit stops at one, and what they cost to read counts, whether they decode or not; unbounded until a page sets it; (32) a group of array items read together (a tuple: an image's `/Decode`, `/W`, `/W2`, and a function's `/Domain`, `/Range`, `/Encode` and `/Decode`) can start with a reference: it was taken for the whole group and lost, which ended the array, so an image with `/Decode [7 0 R 0]` didn't draw and CID widths fell back to `/DW`; (33) an object that holds only a reference stands for what that names, stored on its own or in an object stream, up to 32 references: read as a number it was the reference's own object number, so a `/Decode` or `/W` entry naming such an object took a wrong value, and as anything else it was lost. Past 32, as any cycle goes, it reads as a missing object. An object stream isn't reached that way, as its checks are of the object named; reading its index counts against the 64 nested loads and reads its dictionary alone, as a chain of them, each with a member of the next for its `/N`, `/First` or `/Length`, ran out of stack; and a comment inside a reference counts as white space; (34) a table rebuilt by scanning the file (`fallback_xref_map`) finds an object by its number when its header names another generation, including one no generation may be (`3 18446744073709551616 obj` in `poppler-85140-0.pdf`, #5580): the header is read leniently only in that scan (`read_object_header`), the object is also filed under generation 0 unless a real `N 0 obj` holds that key (a later header for the number moves the stand-in), `XRef::get_with` matches by object number only in a repaired table, and `XRef::objects` yields each location once | (1) `cos/tests/writer.rs::page_tree_loops_in_object_streams_do_not_crash_readers`; (2) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (3) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (4) `raster::tests::inline_images_with_ei_in_their_data_parse_in_linear_time`, `content::tests::inline_image_ei_may_be_followed_by_a_delimiter`; (5) `raster::tests::indirect_appearance_state_dict_is_not_another_stream`; (6) `raster::tests::jpx_stream_bit_depth_boundaries_do_not_panic`, `raster::tests::jpx_32_bit_image_does_not_prevent_other_page_content_from_rendering`, `raster::tests::jpx_gray_rgb_and_alpha_keep_eight_bit_samples`, `raster::tests::jpx_streams_reject_out_of_range_bit_depths`; (7) `raster::tests::decompression_bombs_stop_at_the_stream_limit`, `raster::tests::page_contents_and_nested_forms_share_one_budget`; (8) `inspect::tests::jspdf_high_precision_mediabox_does_not_overflow_dimensions`, `object::number::tests::high_precision_float_does_not_overflow_mantissa` (hayro-syntax); (9) `object::dict::lazy_index_tests`, `raster::tests::large_resource_indexes_preserve_pixels_and_text`; (10) `data::tests`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`, `raster::tests::shared_parser_is_lazy_and_initializes_once_under_contention`; (11) `data::tests::panicking_initializer_wakes_waiters_and_prevents_retries`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`; (12) `util::tests::segment_list_rejects_out_of_range_indices`; (13) `raster::tests::user_unit_scales_the_page_and_everything_on_it`; (14) `crypto::pdfcraft_password_tests`, `pdfcraft-engine` `tests::legacy_passwords_with_turkish_characters_open`; (15) `content::tests::windows_keep_every_instruction_at_every_split`, `content::tests::windows_keep_every_instruction_in_pieces_of_any_size`, `content::tests::windows_match_the_slice_on_random_content`, `content::tests::windows_drop_blanks_and_keep_a_comment_that_may_go_on`, `page::content_reader_tests::content_past_the_cap_is_read_to_the_end`, `page::content_reader_tests::a_stream_that_expands_past_the_budget_is_cut_there`, `page::content_reader_tests::a_small_expansion_under_the_cap_is_not_cut`, `raster::tests::page_content_past_the_old_cap_renders`, `raster::tests::content_reader_returns_the_same_bytes_in_any_pieces`, `raster::tests::content_bombs_stop_at_the_budget_and_say_so`, `page::content_reader_tests::plain_and_whole_pieces_keep_their_bytes`, `page::content_reader_tests::repeated_content_reference_counts_compressed_bytes_once`, `page::content_reader_tests::whole_cap_still_counts_later_unique_streams`; (16) `crypto::pdfcraft_password_tests::aes256_passwords_are_tried_in_their_saslprep_form_then_as_given`, `crypto::pdfcraft_password_tests::aes256_passwords_open_as_typed_and_in_their_saslprep_form`, `pdfcraft-engine` `tests::aes256_open_passwords_that_saslprep_changes_protect_and_reopen_as_typed`, `tests::aes256_files_whose_passwords_saslprep_changes_open_as_typed`; (17) `raster::tests::group4_fax_with_rows_zero_decodes_to_the_image_height`; (18) `filter::lzw_flate::tests::back_reference_longer_than_its_distance_repeats_its_source`, `back_reference_cut_by_the_limit_resumes_in_the_next_call` and `back_reference_reads_bytes_written_by_an_earlier_call`; each fails when the copy returns the wrong remaining count; (19) `raster::tests::group4_fax_with_rows_below_its_height_decodes_to_the_image_height`; (20) `raster::tests::space_before_the_line_break_after_stream_still_renders`; (21) `raster::tests::a_jp2_image_in_a_refused_enumerated_colour_space_is_drawn`, `filter::jpx::tests::refused_enumerated_colour_spaces_become_the_component_counts_default`, `filter::jpx::tests::what_the_decoder_handles_or_cant_be_read_is_left_alone` (`cargo test --manifest-path vendor/hayro-syntax/Cargo.toml`); (22) `raster::tests::objects_in_one_large_object_stream_are_read_in_linear_time`; (23) `text::tests::text_after_an_inline_image_survives_a_non_ascii_byte_before_a_later_ei`, `content::tests::an_inline_image_ends_at_its_own_ei_when_later_text_holds_a_non_ascii_byte` (hayro-syntax); (24) `xref::tests::prev_as_reference_reaches_the_earlier_section`, `xref::tests::prev_as_reference_to_an_object_holding_the_offset_reads_that_offset`, `pdfcraft-cos` `document::tests::a_prev_written_as_a_reference_still_reaches_the_earlier_sections`, `document::tests::a_prev_reference_to_an_object_holding_the_offset_reads_that_offset`; (25) `raster::tests::deeply_nested_direct_objects_do_not_overflow_the_stack`, `raster::tests::dictionaries_nested_without_keys_in_content_do_not_overflow_the_stack`, `raster::tests::dictionaries_nested_without_keys_in_the_trailer_do_not_overflow_the_stack`, `raster::tests::dictionaries_nested_without_keys_as_marked_content_properties_do_not_overflow_the_stack`, `raster::tests::dictionaries_nested_without_keys_are_read_up_to_the_nesting_cap`, `raster::tests::nesting_at_the_cap_fits_a_512_kib_stack` (native only), `raster::tests::function_limits_depth_guard_refuses_a_chain_of_references`; (26) `xref::tests::xref_stream_entries_need_backing_bytes`; (27) `xref::tests::xref_stream_type_field_uses_the_full_w0_width`, `xref::tests::xref_stream_loader_rejects_oversized_w0` (`cargo test --manifest-path vendor/hayro-syntax/Cargo.toml`); (28) `content::ops::tests::scn_with_twelve_components_keeps_them_all`, `content::ops::tests::operands_past_the_cap_keep_the_latest_in_order` (hayro-syntax), `raster::tests::devicen_inks::a_twelve_ink_devicen_colour_paints`, `raster::tests::devicen_inks::a_four_ink_devicen_colour_paints`, `raster::tests::devicen_inks::an_operator_with_hundreds_of_operands_does_not_end_the_content`; (29) `raster::tests::jbig2_globals_that_are_jbig2_themselves_are_not_decoded`, `raster::tests::jbig2_globals_are_read`, `raster::tests::the_jbig2_images_of_a_page_share_one_allowance`, `raster::tests::an_image_that_fails_spends_the_pages_allowance_too`; (32) `raster::tests::a_decode_array_with_references_in_it_is_read`, `raster::tests::a_functions_arrays_can_start_with_a_reference` (pdfcraft-render), `font::cid::width_tests::a_width_group_can_start_with_a_reference` (hayro-interpret); (33) `raster::tests::a_reference_to_a_reference_is_what_it_names`, `raster::tests::a_decode_array_with_references_in_it_is_read` (pdfcraft-render), `font::cid::width_tests::a_width_group_can_start_with_a_reference` (hayro-interpret), `xref::tests::an_object_stream_isnt_reached_through_a_reference`, `xref::tests::a_chain_of_object_streams_ends_at_the_limit_of_nested_loads`, `xref::tests::a_chain_of_object_streams_takes_no_more_work_for_two_ways_on`, `xref::tests::a_reference_held_in_either_storage_is_followed`, `xref::tests::a_page_a_reference_is_held_to_is_found_once` (hayro-syntax); (34) `raster::tests::a_rebuilt_table_finds_an_object_whose_header_names_another_generation`, `raster::tests::a_rebuilt_tables_generation_0_stand_in_is_not_a_second_object` (pdfcraft-render), `xref::tests::an_object_stream_and_its_first_member_are_both_enumerated` (hayro-syntax) |
 | winit | 0.30.13 | Apache-2.0 | (1) on Windows 11 (build 22000 and later), `WM_DPICHANGED` applies the rect Windows suggests. It used to nudge the window onto the monitor `MonitorFromWindow` names, which during a drag is still the monitor being left; the nudge sent another `WM_DPICHANGED`, so a window dragged to a monitor with another scale factor grew and stayed on the wrong monitor at the wrong scale (#324). Backport of winit master 488c036a ([winit#4341](https://github.com/rust-windowing/winit/pull/4341)), which no 0.30 release has; Windows 10 keeps the old adjustment, as on winit master. (2) on Wayland, a seat's text input is destroyed when the seat goes away, not whenever it loses a capability: losing any capability (a touch screen or tablet unplugged, a remote-desktop session ending) destroyed it, and only an added capability recreated it, so IME stopped working until restart. Port of [winit#4747](https://github.com/rust-windowing/winit/pull/4747); (3) on Windows, an IME composition reports its cursor from `GCS_CURSORPOS` only when `WM_IME_COMPOSITION` says it is set, and at the end of the composition otherwise: the Microsoft Korean IME never sets it, so the cursor read as 0 (egui then drew no caret while composing; it now draws it after the syllable). Port of [winit#4746](https://github.com/rust-windowing/winit/pull/4746); (4) on Windows, a hidden window is not maximized until it is shown, and a hidden window shown while maximized gets one `ShowWindow(SW_MAXIMIZE)`: `SW_MAXIMIZE` shows a hidden window, so PdfCraft, which eframe keeps hidden until its first frame is drawn, appeared unpainted (white) when it restored a maximized window, and could lose its focus. Port of [winit#4587](https://github.com/rust-windowing/winit/pull/4587) (the later, focus-safe form of [winit#4575](https://github.com/rust-windowing/winit/pull/4575)); (5) on X11, when allowing or disallowing IME replaces the focused window's input context (egui does it each time a text field gains or loses focus), the new context is focused: no focus event follows, so it stayed unfocused until the window lost and regained focus. Port of [winit#4727](https://github.com/rust-windowing/winit/pull/4727); (6) on macOS, `insertText` commits through IME when a composition was started (`pending_commit`, set by `setMarkedText`) rather than when marked text is left: input methods that end a composition with `unmarkText` before `insertText` lost the text, and Apple Korean dropped the key typed after a syllable (`한` then `5` or `;`); other `insertText` calls stay `KeyboardInput`; a commit outside a key press (a candidate clicked with the mouse, dictation) clears the marked text and leaves no key to swallow, as in [winit#4748](https://github.com/rust-windowing/winit/pull/4748) (without it the next key, such as Backspace, was lost). `validAttributesForMarkedText` lists the underline and marked-clause attributes, without which some input methods don't compose. Port of [winit#4650](https://github.com/rust-windowing/winit/pull/4650), the 0.30 backport of [winit#4651](https://github.com/rust-windowing/winit/pull/4651) (merged on winit master), with the underline attribute spelled as AppKit's `NSUnderlineStyleAttributeName` (`NSUnderline`); (7) on macOS, disallowing IME with a composition in progress (focus leaving a text field) tells the input method to discard its marked text (`discardMarkedText`): it kept composing it once IME was allowed again, so the abandoned syllable came back (`하`, then `가` typed in the next field, became `학`, then `하` + `가`; Japanese `か` then `さ` became `傘`). Port of [winit#4745](https://github.com/rust-windowing/winit/pull/4745); (8) on macOS, text inserted outside a key press without a composition (the emoji picker) is reported as `Ime::Commit`; it was dropped. Port of the emoji-picker part of [winit#4749](https://github.com/rust-windowing/winit/pull/4749) (0.30 backport of [winit#4748](https://github.com/rust-windowing/winit/pull/4748)); its `selectedRange` change for dictation is left out because it switches on press-and-hold for every held key (an accent menu instead of key repeat, and the chosen accent added after the repeated letters); (9) on macOS, a key whose text was committed through IME isn't also sent as `KeyboardInput` unless AppKit forwards it as a command (Enter): Apple Korean answers Space with no syllable in progress with `setMarkedText(" ")`, `insertText(" ")`, `setMarkedText("")`, and the last call reset winit's state, so the space arrived twice. Same goal as [winit#4478](https://github.com/rust-windowing/winit/pull/4478), whose changes don't reach this call order (macOS 14); to be proposed upstream there; (10) on macOS, when the first key in a fresh app reaches Apple Korean's `insertText` as a raw compatibility jamo instead of starting a composition, that key is interpreted once more, synchronously, before it is sent as `KeyboardInput` (g k s typed ㅎㅏㄴ instead of 한); only an unmodified, non-repeated first key whose one callback inserts that same jamo, with IME enabled and nothing composed, focus and input source unchanged, is retried (`ime_startup.rs`). Port of [winit#4744](https://github.com/rust-windowing/winit/pull/4744), with its policy tests.; (11) on X11 without `Xft.dpi`, the scale factor comes from the X screen's configured DPI (its size in pixels and millimetres) before the output's physical density from RandR: Xorg can deliberately run a dense panel at 96 DPI, and only winit applications then looked zoomed; `Xft.dpi` still wins, `WINIT_X11_SCALE_FACTOR` still overrides, and a screen reporting no size keeps the RandR fallback. PdfCraft patch (#1150, replacing the launcher pin proposed in #908). (12) on macOS, `WinitView` answers `mouseDownCanMoveWindow` with the window's `movable_by_window_background` attribute (NO unless asked): NSView answers YES for a view that isn't opaque, so with the transparent title bar and full-size content view PdfCraft uses, AppKit moved the window for any drag that began in the 28 pt title-bar band before the app saw it, and document tabs (which live in that band) could not be dragged to reorder them. The empty strip still moves the window through `ViewportCommand::StartDrag`. PdfCraft patch. The published crate's asset files (`docs/res/*.svg`, `examples/data/*.png`) are left out, so its `window` example doesn't build; (13) on Wayland, pixel-only wheel, wheel-tilt and continuous-source scroll events report `Moved` rather than starting an unterminated finger gesture, so egui follows modifier release instead of keeping Ctrl zoom latched (#991). Finger gestures and unknown sources retain their existing phase policy | (1) `pdfcraft` `tests::winit_carries_the_windows_11_monitor_scale_fix` keeps the patch in the build; the drag itself needs two monitors with different scale factors on Windows 11; (2) `pdfcraft` `tests/winit_wayland_text_input.rs`; the capability change itself needs a Wayland session and an input method; (3) `pdfcraft` `tests/winit_windows_ime_cursor.rs`; composing itself needs the Microsoft Korean IME; (4) `pdfcraft` `tests/winit_windows_hidden_maximized.rs`; the start-up itself needs Windows and a window that was closed maximized; (5) `pdfcraft` `tests/winit_x11_ime_focus.rs`; switching fields itself needs an X11 session and an input method (IBus, fcitx5); (6) `pdfcraft` `tests/winit_macos_ime_commit.rs`; composing itself needs macOS and an input method; (7) `pdfcraft` `tests/winit_macos_ime_discard.rs`; composing itself needs macOS and an input method; (8) `pdfcraft` `tests/winit_macos_emoji_picker.rs`; the picker itself needs macOS; (9) `pdfcraft` `tests/winit_macos_korean_space.rs`; composing itself needs macOS and Apple Korean; (10) `pdfcraft` `tests/winit_macos_korean_first_key.rs` and `ime_startup.rs`'s own tests (run them with `rustc --test`); typing itself needs macOS and Apple Korean; (11) `pdfcraft` `tests/winit_x11_dpi.rs` keeps the patch in the build, and `util::randr` tests the policy (run them in the vendored crate); the scale itself needs an X11 session; (12) `pdfcraft` `tests/winit_macos_title_bar_drag.rs` keeps the patch in the build; the drag itself needs macOS and a pointer; (13) `pdfcraft` `tests/winit_wayland_scroll.rs` compiles the production phase policy and exercises modifier release through egui; live COSMIC confirmation remains open |
 | egui-wgpu | 0.36.2 | MIT OR Apache-2.0 | (1) `winit::surface_fit`: a window's surface is configured within the device's `max_texture_dimension_2d`, both sides shrunk by one factor that egui then draws at (`pixels_per_point × render_scale`), so the whole window is drawn into the surface (on DX12 it is stretched over the window and lines up with the pointer; wgpu's GL backend copies it unscaled into a corner); the longer side becomes exactly the limit; the depth and MSAA textures follow, and a recreated surface starts again from the window's own size. egui-wgpu configured the window's size as is, and `Surface::configure` panics beyond the limit: a window restored at another monitor's scale (opening an Outlook attachment on a mixed-DPI laptop asked an 8192-pixel device for 8600 × 3423, #577) or stretched across monitors closed PdfCraft, before its window appeared when it happened at start-up ([emilk/egui#8361](https://github.com/emilk/egui/issues/8361)). The published crate leaves out egui's licence files; `LICENSE-APACHE` and `LICENSE-MIT` are from the 0.36.2 tag; (2) `winit::catch_errors`: a new window's surface is configured inside wgpu error scopes (validation, out of memory, internal), and a failure is returned as `WgpuError::ConfigureSurface` (for the root window at start-up eframe returns it as `Error::Wgpu`, which PdfCraft retries with OpenGL); nothing is kept for the window. wgpu's default handler panicked instead, and eframe configures the root surface before the app is created, so a driver that can't configure one closed PdfCraft at launch (a 2015 Intel GPU through wgpu's GL backend timed out waiting for the GPU to go idle, `GpuWaitTimeout`, #519). Unchanged, so still a panic: an error in a later reconfigure (resize, a lost surface), a device lost during the first configure (wgpu reports it only to a callback), and a window shown at zero size (first configured on resize) | (1) `pdfcraft` `tests::a_window_larger_than_the_gpu_limit_gets_a_surface_within_it`, `tests::surface_fit_never_empties_or_overflows_a_surface`, and `tests::vendor_provenance_egui_wgpu_surface_fit_identity`, which keeps the patch in the build and in the paths that size a surface; (2) `pdfcraft` `tests::a_gpu_error_while_a_window_is_set_up_is_returned_not_a_panic` (a real device: an error inside `catch_errors` is returned, not a panic) and `tests::vendor_provenance_egui_wgpu_catch_errors_identity`, which keeps it around `add_surface`'s configure |
 | vello_common | 0.0.8 | Apache-2.0 OR MIT | (1) `clip::intersect` (the clip step every clipped path passes through) starts its row walk at the first row both paths have strips in, not the earlier of the two first rows. The walk visited every row from the top of the clip for each path (on the A1 sample's full-page canvas, about half its strip rows per stroke), and rows where one path has no strips produce no output, so the strips are unchanged (vello_common 0.1 starts at the later row too). Its cost grew with the page, and a full-page render of the A1 sample was about 30% faster; the output is byte-identical | (1) `clip::tests::intersect_walks_only_rows_both_paths_have_strips` counts the rows the walk visits (`cargo test --manifest-path vendor/vello_common/Cargo.toml`) and fails without the patch; the render crate's pixel tests run through the patched crate |
diff --git a/vendor/hayro-interpret/src/color.rs b/vendor/hayro-interpret/src/color.rs
index 29a74a6de8..b93b69c73c 100644
--- a/vendor/hayro-interpret/src/color.rs
+++ b/vendor/hayro-interpret/src/color.rs
@@ -166,12 +166,24 @@ fn icc_stream_object(array: &Array<'_>, stream: &Stream<'_>) -> Option<object::O
     dict.obj_id()
 }
 
+/// PdfCraft patch (74): how deeply colour spaces may nest. A legal file goes five levels at most:
+/// a Pattern's underlying space, an Indexed base, a Separation's alternate, an ICC profile, and
+/// that profile's alternate. Reading an object already being read is refused, which ends a cycle
+/// but not a chain: 5,000 spaces each naming the next, 180 KB of file, overflowed the stack, and
+/// that aborts the process.
+const MAX_COLOR_SPACE_DEPTH: u32 = 32;
+
 impl ColorSpaceType {
-    fn new(object: Object<'_>, cache: &Cache) -> Option<Self> {
-        Self::new_inner(object, cache)
+    fn new(object: Object<'_>, cache: &Cache, depth: u32) -> Option<Self> {
+        if depth >= MAX_COLOR_SPACE_DEPTH {
+            warn!("colour spaces nest past the limit of {MAX_COLOR_SPACE_DEPTH} levels");
+            return None;
+        }
+
+        Self::new_inner(object, cache, depth)
     }
 
-    fn new_inner(object: Object<'_>, cache: &Cache) -> Option<Self> {
+    fn new_inner(object: Object<'_>, cache: &Cache, depth: u32) -> Option<Self> {
         if let Object::Name(name) = object {
             return Self::new_from_name(&name);
         } else if let Object::Array(color_array) = object {
@@ -186,6 +198,9 @@ impl ColorSpaceType {
 
                     // PdfCraft patch (48): cached by what the profile is read from (see
                     // `IccProfileKey`), not by the stream dictionary's bytes alone.
+                    // PdfCraft patch (74): what's kept is what the profile itself reads as. What
+                    // it falls back to depends on how deep it was met, and kept with the profile
+                    // a page could build a chain past the limit on spaces already read.
                     let read = || {
                         let data = icc_stream.raw_data();
                         let content = IccProfileKey::Content {
@@ -194,40 +209,37 @@ impl ColorSpaceType {
                         };
                         cache.get_or_insert_with(hash128(&content), || {
                             cache.count_icc_profile_read();
-                            if let Some(decoded) = icc_stream.decoded().ok().as_ref() {
-                                ICCProfile::new(decoded, num_components)
-                                    .map(|icc| {
-                                        // TODO: For SVG and PNG we can assume that the output color space is
-                                        // sRGB. If we ever implement PDF-to-PDF, we probably want to
-                                        // let the user pass the native color type and don't make this optimization
-                                        // if it's not sRGB.
-                                        if icc.is_srgb() {
-                                            Self::DeviceRgb
-                                        } else {
-                                            Self::ICCBased(icc)
-                                        }
-                                    })
-                                    .or_else(|| {
-                                        dict.get::<Object<'_>>(ALTERNATE)
-                                            .and_then(|o| Self::new(o, cache))
-                                    })
-                                    .or_else(|| match dict.get::<u8>(N) {
-                                        Some(1) => Some(Self::DeviceGray),
-                                        Some(3) => Some(Self::DeviceRgb),
-                                        Some(4) => Some(Self::DeviceCmyk),
-                                        _ => None,
-                                    })
-                            } else {
-                                None
-                            }
+                            let decoded = icc_stream.decoded().ok()?;
+                            Some(ICCProfile::new(&decoded, num_components).map(|icc| {
+                                // TODO: For SVG and PNG we can assume that the output color space is
+                                // sRGB. If we ever implement PDF-to-PDF, we probably want to
+                                // let the user pass the native color type and don't make this optimization
+                                // if it's not sRGB.
+                                if icc.is_srgb() {
+                                    Self::DeviceRgb
+                                } else {
+                                    Self::ICCBased(icc)
+                                }
+                            }))
                         })
                     };
-                    return match icc_stream_object(&color_array, &icc_stream) {
+                    let profile = match icc_stream_object(&color_array, &icc_stream) {
                         Some(object) => {
                             cache.get_or_insert_with(hash128(&IccProfileKey::Object(object)), read)
                         }
                         None => read(),
                     };
+                    return profile?
+                        .or_else(|| {
+                            dict.get::<Object<'_>>(ALTERNATE)
+                                .and_then(|o| Self::new(o, cache, depth + 1))
+                        })
+                        .or_else(|| match dict.get::<u8>(N) {
+                            Some(1) => Some(Self::DeviceGray),
+                            Some(3) => Some(Self::DeviceRgb),
+                            Some(4) => Some(Self::DeviceCmyk),
+                            _ => None,
+                        });
                 }
                 CALCMYK => return Some(Self::DeviceCmyk),
                 CALGRAY => {
@@ -246,19 +258,20 @@ impl ColorSpaceType {
                     return Some(Self::Lab(Lab::new(&lab_dict)?));
                 }
                 INDEXED | I => {
-                    return Some(Self::Indexed(Indexed::new(&color_array, cache)?));
+                    return Some(Self::Indexed(Indexed::new(&color_array, cache, depth)?));
                 }
                 SEPARATION => {
-                    return Some(Self::Separation(Separation::new(&color_array, cache)?));
+                    return Some(Self::Separation(Separation::new(&color_array, cache, depth)?));
                 }
                 DEVICE_N => {
-                    return Some(Self::DeviceN(DeviceN::new(&color_array, cache)?));
+                    return Some(Self::DeviceN(DeviceN::new(&color_array, cache, depth)?));
                 }
                 PATTERN => {
-                    let _ = iter.next::<Name<'_>>();
+                    // PdfCraft patch (72): the family is already read. Reading a name here too took
+                    // the underlying space when it was a name or a reference.
                     let cs = iter
                         .next::<Object<'_>>()
-                        .and_then(|o| ColorSpace::new(o, cache))
+                        .and_then(|o| ColorSpace::within(o, cache, depth + 1))
                         .unwrap_or(ColorSpace::device_rgb());
                     return Some(Self::Pattern(cs));
                 }
@@ -291,7 +304,12 @@ pub struct ColorSpace(Arc<ColorSpaceType>);
 impl ColorSpace {
     /// Create a new color space from the given object.
     pub(crate) fn new(object: Object<'_>, cache: &Cache) -> Option<Self> {
-        Some(Self(Arc::new(ColorSpaceType::new(object, cache)?)))
+        Self::within(object, cache, 0)
+    }
+
+    /// A colour space named by another, `depth` levels down.
+    fn within(object: Object<'_>, cache: &Cache, depth: u32) -> Option<Self> {
+        Some(Self(Arc::new(ColorSpaceType::new(object, cache, depth)?)))
     }
 
     /// Create a new color space from the name.
@@ -991,21 +1009,22 @@ pub(crate) struct Indexed {
 }
 
 impl Indexed {
-    fn new(array: &Array<'_>, cache: &Cache) -> Option<Self> {
+    fn new(array: &Array<'_>, cache: &Cache, depth: u32) -> Option<Self> {
         let mut iter = array.flex_iter();
         // Skip name
         let _ = iter.next::<Name<'_>>()?;
-        let base_color_space = ColorSpace::new(iter.next::<Object<'_>>()?, cache)?;
+        let base_color_space = ColorSpace::within(iter.next::<Object<'_>>()?, cache, depth + 1)?;
         let hival = iter.next::<u32>()?.min(u8::MAX as u32) as u8;
 
         let values = {
-            let data = iter
-                .next::<Stream<'_>>()
-                .and_then(|s| s.decoded().ok())
-                .or_else(|| {
-                    iter.next::<object::String<'_>>()
-                        .map(|s| Cow::Owned(s.to_vec()))
-                })?;
+            // PdfCraft patch (71): read once, as whichever it is. A failed read as a stream leaves
+            // a direct string in place but uses up a reference, so a table in an indirect string
+            // was lost, and the space with it.
+            let data = match iter.next::<Object<'_>>()? {
+                Object::Stream(s) => s.decoded().ok()?,
+                Object::String(s) => Cow::Owned(s.to_vec()),
+                _ => return None,
+            };
 
             let num_components = base_color_space.num_components();
 
@@ -1080,12 +1099,12 @@ fn eval_tint_transform(
 }
 
 impl Separation {
-    fn new(array: &Array<'_>, cache: &Cache) -> Option<Self> {
+    fn new(array: &Array<'_>, cache: &Cache, depth: u32) -> Option<Self> {
         let mut iter = array.flex_iter();
         // Skip `/Separation`
         let _ = iter.next::<Name<'_>>()?;
         let name = iter.next::<Name<'_>>()?;
-        let alternate_space = ColorSpace::new(iter.next::<Object<'_>>()?, cache)?;
+        let alternate_space = ColorSpace::within(iter.next::<Object<'_>>()?, cache, depth + 1)?;
         // PdfCraft patch (55): an unreadable tint transform keeps the space (see
         // `eval_tint_transform`).
         let tint_transform = iter.next::<Object<'_>>().and_then(|f| Function::new(&f));
@@ -1147,7 +1166,7 @@ pub(crate) struct DeviceN {
 }
 
 impl DeviceN {
-    fn new(array: &Array<'_>, cache: &Cache) -> Option<Self> {
+    fn new(array: &Array<'_>, cache: &Cache, depth: u32) -> Option<Self> {
         let mut iter = array.flex_iter();
         // Skip `/DeviceN`
         let _ = iter.next::<Name<'_>>()?;
@@ -1158,7 +1177,7 @@ impl DeviceN {
             .collect::<Vec<_>>();
         let num_components = u8::try_from(names.len()).ok()?;
         let all_none = names.iter().all(|n| n.as_str() == "None");
-        let alternate_space = ColorSpace::new(iter.next::<Object<'_>>()?, cache)?;
+        let alternate_space = ColorSpace::within(iter.next::<Object<'_>>()?, cache, depth + 1)?;
         // PdfCraft patch (55): an unreadable tint transform keeps the space (see
         // `eval_tint_transform`).
         let tint_transform = iter.next::<Object<'_>>().and_then(|f| Function::new(&f));
diff --git a/vendor/hayro-interpret/src/context.rs b/vendor/hayro-interpret/src/context.rs
index d41f35ee83..de3907b1ff 100644
--- a/vendor/hayro-interpret/src/context.rs
+++ b/vendor/hayro-interpret/src/context.rs
@@ -218,6 +218,8 @@ impl<'a> Context<'a> {
         NESTED_PAINTS.with(|n| n.set(0));
         CONTENT_LEFT.with(|c| c.set(MAX_PAGE_CONTENT));
         CONTENT_TRUNCATED.with(|truncated| truncated.set(false));
+        // PdfCraft patch (73): and fresh JBIG2 decoding, which every image of it shares.
+        hayro_syntax::set_page_jbig2_work(settings.jbig2_work);
         // PdfCraft patch (55): a fallback left over from another page is not this page's.
         crate::color::take_color_fallback();
         crate::encode::reset_mesh_budget();
diff --git a/vendor/hayro-interpret/src/font/cid.rs b/vendor/hayro-interpret/src/font/cid.rs
index 44e076b4b1..43b558b050 100644
--- a/vendor/hayro-interpret/src/font/cid.rs
+++ b/vendor/hayro-interpret/src/font/cid.rs
@@ -698,3 +698,75 @@ mod tests {
         assert_eq!(map.len(), 12);
     }
 }
+
+#[cfg(test)]
+mod width_tests {
+    use super::*;
+    use hayro_syntax::Pdf;
+    use hayro_syntax::object::ObjectIdentifier;
+
+    /// A PDF whose object 5 is `array`, for what references in it can reach.
+    fn with_array(array: &str) -> Pdf {
+        let pdf = format!(
+            "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 10 10] >> endobj\n\
+             4 0 obj 20 endobj\n5 0 obj {array} endobj\n6 0 obj 22 endobj\n\
+             7 0 obj 7 0 R endobj\n8 0 obj 9 0 R endobj\n9 0 obj 8 0 R endobj\n\
+             10 0 obj 4 0 R endobj\n11 0 obj [500 600] endobj\n12 0 obj [-1000 500 880] endobj\n\
+             trailer << /Root 1 0 R >>\n%%EOF\n"
+        );
+        Pdf::new(pdf.into_bytes()).unwrap()
+    }
+
+    /// `/W` and `/W2` read groups of items, and either kind can start with a reference: taken for
+    /// the whole group it was lost, with all that followed, and those glyphs fell back to `/DW`.
+    #[test]
+    fn a_width_group_can_start_with_a_reference() {
+        let widths = |array: &str| {
+            let pdf = with_array(array);
+            let array = pdf.xref().get::<Array<'_>>(ObjectIdentifier::new(5, 0)).unwrap();
+            let mut read: Vec<_> = read_widths(&array).unwrap().into_iter().collect();
+            read.sort_by_key(|(cid, _)| *cid);
+            read
+        };
+        let by_list = vec![(20, 500.0), (21, 600.0)];
+        assert_eq!(widths("[20 [500 600]]"), by_list);
+        assert_eq!(widths("[4 0 R [500 600]]"), by_list);
+        let by_range = vec![(20, 700.0), (21, 700.0), (22, 700.0)];
+        assert_eq!(widths("[20 22 700]"), by_range);
+        assert_eq!(widths("[4 0 R 22 700]"), by_range);
+        assert_eq!(widths("[4 0 R 6 0 R 700]"), by_range);
+        assert_eq!(widths("[1 [100] 4 0 R [500 600]]"), vec![(1, 100.0), (20, 500.0), (21, 600.0)], "after a group");
+
+        let vertical = |array: &str| {
+            let pdf = with_array(array);
+            let array = pdf.xref().get::<Array<'_>>(ObjectIdentifier::new(5, 0)).unwrap();
+            let mut read: Vec<_> = read_widths2(&array).unwrap().into_iter().collect();
+            read.sort_by_key(|(cid, _)| *cid);
+            read
+        };
+        let by_list = vec![(20, [-1000.0, 500.0, 880.0])];
+        assert_eq!(vertical("[20 [-1000 500 880]]"), by_list);
+        assert_eq!(vertical("[4 0 R [-1000 500 880]]"), by_list);
+        let by_range = vec![(20, [-900.0, 400.0, 800.0]), (21, [-900.0, 400.0, 800.0]), (22, [-900.0, 400.0, 800.0])];
+        assert_eq!(vertical("[20 22 -900 400 800]"), by_range);
+        assert_eq!(vertical("[4 0 R 22 -900 400 800]"), by_range);
+
+        // A group's list can be given by reference too, and a reference to a reference is what it
+        // names.
+        let by_list = vec![(20, 500.0), (21, 600.0)];
+        assert_eq!(widths("[20 11 0 R]"), by_list);
+        assert_eq!(widths("[10 0 R [500 600]]"), by_list);
+        assert_eq!(widths("[10 0 R 11 0 R]"), by_list);
+        assert_eq!(vertical("[20 12 0 R]"), vec![(20, [-1000.0, 500.0, 880.0])]);
+
+        // A reference that only leads back to itself holds no number, so those glyphs keep `/DW`.
+        for array in ["[7 0 R [500 600]]", "[8 0 R [500 600]]", "[20 7 0 R 700]", "[7 0 R 8 0 R 700]", "[20 [7 0 R 600]]"] {
+            assert!(widths(array).is_empty(), "{array}");
+        }
+        for array in ["[7 0 R [-1000 500 880]]", "[8 0 R 22 -900 400 800]", "[20 [7 0 R 500 880]]"] {
+            assert!(vertical(array).is_empty(), "{array}");
+        }
+    }
+}
diff --git a/vendor/hayro-interpret/src/interpret/mod.rs b/vendor/hayro-interpret/src/interpret/mod.rs
index 58213439ac..332000e248 100644
--- a/vendor/hayro-interpret/src/interpret/mod.rs
+++ b/vendor/hayro-interpret/src/interpret/mod.rs
@@ -120,6 +120,10 @@ pub struct InterpreterSettings {
     /// costs a decode and a resample each for pixels nobody can see. Never set it for a final
     /// render (tiles, whole pages, print, export).
     pub preview: bool,
+    /// PdfCraft patch (73): the steps of JBIG2 decoding a page's images may take between them
+    /// ([`hayro_syntax::MAX_PAGE_JBIG2_WORK`] by default). Images past it aren't drawn, nor images
+    /// whose masks are past it, each with [`InterpreterWarning::ContentTruncated`].
+    pub jbig2_work: u64,
 }
 
 impl Default for InterpreterSettings {
@@ -142,6 +146,7 @@ impl Default for InterpreterSettings {
             ocg_overrides: Arc::new(Vec::new()),
             cancelled: None,
             preview: false,
+            jbig2_work: hayro_syntax::MAX_PAGE_JBIG2_WORK,
         }
     }
 }
@@ -163,12 +168,25 @@ pub enum InterpreterWarning {
     ColorFallback,
 }
 
+/// PdfCraft patch (73): ends a page's JBIG2 allowance with the page, so that what decodes on its
+/// thread afterwards has no page to run out on.
+struct PageJbig2Work;
+
+impl Drop for PageJbig2Work {
+    fn drop(&mut self) {
+        hayro_syntax::set_page_jbig2_work(u64::MAX);
+    }
+}
+
 /// interpret the contents of the page and render them into the device.
 pub fn interpret_page<'a>(
     page: &Page<'a>,
     context: &mut Context<'a>,
     device: &mut impl Device<'a>,
 ) {
+    // PdfCraft patch (73): a context used again is another page.
+    hayro_syntax::set_page_jbig2_work(context.settings.jbig2_work);
+    let _allowance = PageJbig2Work;
     let resources = page.resources();
     let mut content = page.content_reader();
     // PdfCraft patch: the page's own contents count against its content budget too, where they
diff --git a/vendor/hayro-interpret/src/x_object.rs b/vendor/hayro-interpret/src/x_object.rs
index cfdd969faf..6fcb34a5d7 100644
--- a/vendor/hayro-interpret/src/x_object.rs
+++ b/vendor/hayro-interpret/src/x_object.rs
@@ -681,13 +681,23 @@ fn decoded_mask_size(mask: &DecodedMask) -> usize {
 /// `/Filter` or its inline abbreviation `/F`. Errs towards `true`: a name the decoder would
 /// ignore still counts, which only keeps the target in the key as before.
 fn uses_jpx(stream: &Stream<'_>) -> bool {
+    uses_filter(stream, JPX_DECODE)
+}
+
+/// PdfCraft patch (73): whether `stream` is JBIG2, so that what the page has left, which all of it
+/// shares, says something about why this stream failed.
+fn uses_jbig2(stream: &Stream<'_>) -> bool {
+    uses_filter(stream, JBIG2_DECODE)
+}
+
+fn uses_filter(stream: &Stream<'_>, filter: &[u8]) -> bool {
     let dict = stream.dict();
-    let is_jpx = |name: &Name<'_>| name.deref() == JPX_DECODE;
+    let is_filter = |name: &Name<'_>| name.deref() == filter;
     [F, FILTER].into_iter().any(|key| {
-        dict.get::<Name<'_>>(key).is_some_and(|name| is_jpx(&name))
+        dict.get::<Name<'_>>(key).is_some_and(|name| is_filter(&name))
             || dict
                 .get::<Array<'_>>(key)
-                .is_some_and(|filters| filters.iter::<Name<'_>>().any(|name| is_jpx(&name)))
+                .is_some_and(|filters| filters.iter::<Name<'_>>().any(|name| is_filter(&name)))
     })
 }
 
@@ -755,7 +765,15 @@ fn decode_context<'a>(
     let decoded = obj
         .stream
         .decoded_image(&decode_params)
-        .map_err(|_| (obj.warning_sink)(InterpreterWarning::ImageDecodeFailure))
+        .map_err(|_| {
+            // PdfCraft patch (73): left out for the page's allowance, it is content the page's
+            // budget skipped, which is reported, and no failure of this image.
+            (obj.warning_sink)(if hayro_syntax::page_jbig2_work_spent() && uses_jbig2(&obj.stream) {
+                InterpreterWarning::ContentTruncated
+            } else {
+                InterpreterWarning::ImageDecodeFailure
+            });
+        })
         .ok()?;
 
     let (mut scale_x, mut scale_y) = (1.0, 1.0);
@@ -1008,6 +1026,15 @@ fn decode_raster(
         .flatten()
     };
 
+    // PdfCraft patch (73): a bad mask leaves the image as it is, but one left out for the page's
+    // allowance takes the image with it. Both are reported, and only here is the file not to blame
+    // for what the mask would have hidden being shown.
+    let dict = obj.stream.dict();
+    let mask = dict.get::<Stream<'_>>(SMASK).or_else(|| dict.get::<Stream<'_>>(MASK));
+    if alpha.is_none() && hayro_syntax::page_jbig2_work_spent() && mask.is_some_and(|m| uses_jbig2(&m)) {
+        return None;
+    }
+
     Some(DecodedRaster { image, alpha })
 }
 
diff --git a/vendor/hayro-jbig2/src/bitmap.rs b/vendor/hayro-jbig2/src/bitmap.rs
index 35ed975615..87738a849d 100644
--- a/vendor/hayro-jbig2/src/bitmap.rs
+++ b/vendor/hayro-jbig2/src/bitmap.rs
@@ -19,6 +19,41 @@ pub(crate) const MAX_DIMENSION: u32 = u16::MAX as u32;
 /// pixels, decoded one by one.
 pub(crate) const MAX_PIXELS: u64 = 1 << 28;
 
+/// PdfCraft patch: the most cells a halftone grid may have, which still gives the largest page
+/// (see [`MAX_PIXELS`]) cells of 3 × 3, unrotated. Each cell takes a 4-byte value while the grid decodes, so
+/// the pixel bound alone let a 98-byte segment take 1 GiB; this one leaves 128 MiB.
+pub(crate) const MAX_GRID_CELLS: u64 = 1 << 25;
+
+/// PdfCraft patch: the decoding work a stream may ask for, in pixels decoded from their code: four
+/// of the largest pages, about 6 s on data the decoder predicts and about 17 s on data it can't, so
+/// a render finishes inside its 20 s watchdog. Each bitmap is bounded on its own, but nothing
+/// bounded how many there are: 1,140 bytes of generic regions took over 40 s, a 795-byte PDF's one
+/// halftone 265 s, and a 923-byte PDF's regions would have taken days.
+pub(crate) const MAX_WORK: u64 = 4 * MAX_PIXELS;
+
+/// PdfCraft patch: the work of reading one integer of an item, what an arithmetic-coded one takes
+/// at worst in decisions (see [`MAX_WORK`]), so that a decision costs no more than a pixel. An item
+/// with no pixels still reads its integers: charged a step each, a 22,515-byte PDF of refined text
+/// instances of no size stayed inside `MAX_WORK` and took 730 s.
+pub(crate) const INTEGER_WORK: u64 = 38;
+
+/// PdfCraft patch: the work of a line of a Huffman table built for symbols, about 50 ns (see
+/// [`MAX_WORK`]).
+pub(crate) const HUFFMAN_LINE_WORK: u64 = 10;
+
+/// PdfCraft patch: the work of decoding a bitmap pixel by pixel (see [`MAX_WORK`]). A row costs up
+/// to 21 ns however few pixels it has, about 4 pixels' worth, so one of no width isn't free: 16,384
+/// regions of 0 × 65535 took 9 s at a cost of nothing.
+pub(crate) fn decode_work(width: u32, height: u32) -> u64 {
+    u64::from(height) * (u64::from(width) + 4)
+}
+
+/// PdfCraft patch: the work of copying a bitmap (see [`MAX_WORK`]): a word at a time, and a row is
+/// a copy of its own, so a tall thin bitmap costs its rows, not its pixels.
+pub(crate) fn copy_work(width: u32, height: u32) -> u64 {
+    u64::from(height) * (u64::from(width.div_ceil(WORD_BITS)) + 1)
+}
+
 /// The underlying word type for packed pixel storage.
 /// Change this to `u32` to switch back to 32-bit words.
 pub(crate) type Word = u32;
@@ -26,6 +61,23 @@ pub(crate) type Word = u32;
 pub(crate) const WORD_BITS: u32 = Word::BITS;
 pub(crate) const WORD_SHIFT: u32 = WORD_BITS - 1;
 
+/// PdfCraft patch: the words a [`Bitmap`] takes before its pixels. A symbol of width 0 has no
+/// pixels and still costs this: 5 KB of zero-width dictionaries held 781 MB.
+pub(crate) const BITMAP_WORDS: usize = size_of::<Bitmap>() / size_of::<Word>();
+
+/// PdfCraft patch: refuse a page past the bounds on a bitmap (see `MAX_PIXELS`). A stream is held
+/// to this when it is opened as well as when its page bitmap is sized: a caller sizes its own
+/// output from the page header in between, and a 743-byte PDF's Indexed image asked for 137 GB.
+pub(crate) fn check_page_size(width: u32, height: u32) -> Result<()> {
+    if width > MAX_DIMENSION || height > MAX_DIMENSION {
+        return Err(OverflowError::BitmapDimension.into());
+    }
+    if u64::from(width) * u64::from(height) > MAX_PIXELS {
+        return Err(OverflowError::BitmapDimension.into());
+    }
+    Ok(())
+}
+
 /// A decoded bitmap with position information.
 ///
 /// "Pixels decoded by the MMR decoder having the value 'black' shall be treated
@@ -51,6 +103,11 @@ pub(crate) struct Bitmap {
 }
 
 impl Bitmap {
+    /// PdfCraft patch: the words this bitmap holds, its header included.
+    pub(crate) fn words(&self) -> usize {
+        self.data.len().saturating_add(BITMAP_WORDS)
+    }
+
     /// Create a new bitmap filled with white pixels (false).
     ///
     /// The bitmap is positioned at (0, 0).
@@ -93,13 +150,7 @@ impl Bitmap {
         height: u32,
         default_pixel: bool,
     ) -> Result<()> {
-        if width > MAX_DIMENSION || height > MAX_DIMENSION {
-            return Err(OverflowError::BitmapDimension.into());
-        }
-        // PdfCraft patch: see `MAX_PIXELS` (the page bitmap is sized here).
-        if u64::from(width) * u64::from(height) > MAX_PIXELS {
-            return Err(OverflowError::BitmapDimension.into());
-        }
+        check_page_size(width, height)?;
 
         let stride = width.div_ceil(WORD_BITS);
         let default_word: Word = if default_pixel { !0 } else { 0 };
@@ -149,7 +200,8 @@ impl Bitmap {
         // TODO: Figure out how we can optimize this, especially since this is a
         // bottleneck for symbols/patterns.
         let dest_x_start = x.max(0);
-        let dest_x_end = (x + other.width as i32).min(self.width as i32);
+        // Saturating: a location can be anywhere an `i32` reaches, and past the end it is off the page.
+        let dest_x_end = x.saturating_add(other.width as i32).min(self.width as i32);
 
         if dest_x_start >= dest_x_end {
             return;
@@ -160,7 +212,7 @@ impl Bitmap {
         let dest_x_end = dest_x_end as u32;
 
         for src_y in 0..other.height {
-            let dest_y = y + src_y as i32;
+            let dest_y = y.saturating_add(src_y as i32);
             if dest_y < 0 || dest_y >= self.height as i32 {
                 continue;
             }
diff --git a/vendor/hayro-jbig2/src/decode/generic_refinement.rs b/vendor/hayro-jbig2/src/decode/generic_refinement.rs
index a566b8de58..a6634439d4 100644
--- a/vendor/hayro-jbig2/src/decode/generic_refinement.rs
+++ b/vendor/hayro-jbig2/src/decode/generic_refinement.rs
@@ -179,10 +179,12 @@ impl<'a> RefinementContextGatherer<'a> {
 
     pub(crate) fn start_row(&mut self, region: &Bitmap, reference: &Bitmap, y: u32) {
         self.reg_y = y;
-        let ref_y = y as i32 - self.reference_dy;
+        // The offsets can be anywhere an `i32` reaches, so coordinates in the reference wrap here and
+        // below. Wrapped, they are off the reference, whose pixels there read as 0.
+        let ref_y = (y as i32).wrapping_sub(self.reference_dy);
         // This will on purpose wrap to a very large `u32` for negative values, such that
         // they resolve to 0 in `ContextGatherer::load_word`.
-        let ref_x0 = (-self.reference_dx) as u32;
+        let ref_x0 = self.reference_dx.wrapping_neg() as u32;
 
         self.reg_cur_x = 0;
         self.reg_m1 = if y >= 1 {
@@ -193,9 +195,9 @@ impl<'a> RefinementContextGatherer<'a> {
         self.reg_cur = 0;
 
         self.ref_cur_x = 0;
-        self.ref_m1 = ContextGatherer::load_word(reference, (ref_y - 1) as u32, 0);
+        self.ref_m1 = ContextGatherer::load_word(reference, ref_y.wrapping_sub(1) as u32, 0);
         self.ref_cur = ContextGatherer::load_word(reference, ref_y as u32, 0);
-        self.ref_p1 = ContextGatherer::load_word(reference, (ref_y + 1) as u32, 0);
+        self.ref_p1 = ContextGatherer::load_word(reference, ref_y.wrapping_add(1) as u32, 0);
 
         self.ctx = match self.template {
             RefinementTemplate::Template1 => {
@@ -257,7 +259,7 @@ impl<'a> RefinementContextGatherer<'a> {
             self.reg_cur = ContextGatherer::load_word(region, self.reg_y, new_start);
         }
 
-        let ref_x_signed = x as i32 - self.reference_dx;
+        let ref_x_signed = (x as i32).wrapping_sub(self.reference_dx);
         if ref_x_signed < 0 {
             self.ref_cur_x = 0;
             self.ref_m1 = 0;
@@ -268,18 +270,20 @@ impl<'a> RefinementContextGatherer<'a> {
 
             if ref_x + 1 >= self.ref_cur_x + WORD_BITS || ref_x < self.ref_cur_x {
                 let new_start = ref_x.saturating_sub(1);
-                let ref_y = self.reg_y as i32 - self.reference_dy;
+                let ref_y = (self.reg_y as i32).wrapping_sub(self.reference_dy);
                 self.ref_cur_x = new_start;
-                self.ref_m1 = ContextGatherer::load_word(reference, (ref_y - 1) as u32, new_start);
+                self.ref_m1 =
+                    ContextGatherer::load_word(reference, ref_y.wrapping_sub(1) as u32, new_start);
                 self.ref_cur = ContextGatherer::load_word(reference, ref_y as u32, new_start);
-                self.ref_p1 = ContextGatherer::load_word(reference, (ref_y + 1) as u32, new_start);
+                self.ref_p1 =
+                    ContextGatherer::load_word(reference, ref_y.wrapping_add(1) as u32, new_start);
             }
         }
     }
 
     #[inline(always)]
     pub(crate) fn tpgr_all_same(&self, x: u32) -> bool {
-        let ref_x = (x as i32 - self.reference_dx) as u32;
+        let ref_x = (x as i32).wrapping_sub(self.reference_dx) as u32;
         let rbx = ref_x.wrapping_sub(self.ref_cur_x);
 
         #[inline(always)]
@@ -310,7 +314,7 @@ impl<'a> RefinementContextGatherer<'a> {
 
     #[inline(always)]
     pub(crate) fn ref_center_pixel(&self, x: u32) -> u8 {
-        let ref_x = (x as i32 - self.reference_dx) as u32;
+        let ref_x = (x as i32).wrapping_sub(self.reference_dx) as u32;
         let rbx = ref_x.wrapping_sub(self.ref_cur_x);
 
         ContextGatherer::get_buf_pixel(self.ref_cur, rbx) as u8
@@ -329,7 +333,7 @@ impl<'a> RefinementContextGatherer<'a> {
     #[inline(always)]
     fn gather_template0_default(&mut self, _region: &Bitmap, _reference: &Bitmap, x: u32) -> u16 {
         let bx = x - self.reg_cur_x;
-        let ref_x = (x as i32 - self.reference_dx) as u32;
+        let ref_x = (x as i32).wrapping_sub(self.reference_dx) as u32;
         let rbx = ref_x.wrapping_sub(self.ref_cur_x);
 
         let new_pixels = (ContextGatherer::get_buf_pixel(self.reg_m1, bx + 1) << 10)
@@ -345,12 +349,12 @@ impl<'a> RefinementContextGatherer<'a> {
     #[inline(always)]
     fn gather_template0_custom(&mut self, region: &Bitmap, reference: &Bitmap, x: u32) -> u16 {
         let bx = x - self.reg_cur_x;
-        let ref_x_i = x as i32 - self.reference_dx;
+        let ref_x_i = (x as i32).wrapping_sub(self.reference_dx);
         let rbx = ref_x_i as u32 - self.ref_cur_x;
 
         let xi = x as i32;
         let yi = self.reg_y as i32;
-        let ref_y = yi - self.reference_dy;
+        let ref_y = yi.wrapping_sub(self.reference_dy);
         let at1 = self.at_pixels[0];
         let at2 = self.at_pixels[1];
 
@@ -360,8 +364,8 @@ impl<'a> RefinementContextGatherer<'a> {
             | (ContextGatherer::get_buf_pixel(self.reg_m1, bx + 1) << 10)
             | (ContextGatherer::get_buf_pixel(self.reg_cur, bx.wrapping_sub(1)) << 9)
             | ((reference.get_pixel(
-                (ref_x_i + at2.x as i32) as u32,
-                (ref_y + at2.y as i32) as u32,
+                ref_x_i.wrapping_add(at2.x as i32) as u32,
+                ref_y.wrapping_add(at2.y as i32) as u32,
             ) as u16)
                 << 8)
             | (ContextGatherer::get_buf_pixel(self.ref_m1, rbx.wrapping_add(1)) << 6)
@@ -375,7 +379,7 @@ impl<'a> RefinementContextGatherer<'a> {
     #[inline(always)]
     fn gather_template1(&mut self, _region: &Bitmap, _reference: &Bitmap, x: u32) -> u16 {
         let bx = x - self.reg_cur_x;
-        let ref_x = (x as i32 - self.reference_dx) as u32;
+        let ref_x = (x as i32).wrapping_sub(self.reference_dx) as u32;
         let rbx = ref_x.wrapping_sub(self.ref_cur_x);
 
         let new_pixels = (ContextGatherer::get_buf_pixel(self.reg_m1, bx + 1) << 7)
diff --git a/vendor/hayro-jbig2/src/decode/halftone.rs b/vendor/hayro-jbig2/src/decode/halftone.rs
index eb5c1c21e8..10000f801b 100644
--- a/vendor/hayro-jbig2/src/decode/halftone.rs
+++ b/vendor/hayro-jbig2/src/decode/halftone.rs
@@ -7,7 +7,7 @@ use super::RegionBitmap;
 use super::pattern::PatternDictionary;
 use super::{CombinationOperator, RegionSegmentInfo, Template, parse_region_segment_info};
 use crate::ScratchBuffers;
-use crate::bitmap::{Bitmap, MAX_DIMENSION, WORD_BITS};
+use crate::bitmap::{Bitmap, MAX_DIMENSION, WORD_BITS, copy_work, decode_work};
 use crate::error::{OverflowError, ParseError, RegionError, Result, bail};
 use crate::gray_scale::{GrayScaleParams, decode_gray_scale_image};
 use crate::reader::Reader;
@@ -48,11 +48,7 @@ pub(crate) fn decode_into(
         None
     };
 
-    // "3) Set HBPP to ⌈log₂(HNUMPATS)⌉." (6.6.5)
-    let bits_per_pixel = (pattern_dict.patterns.len() as u32)
-        .saturating_sub(1)
-        .checked_ilog2()
-        .map_or(1, |n| n + 1);
+    let bits_per_pixel = bits_per_pixel(pattern_dict);
 
     // "4) Decode an image GI of size HGW by HGH with HBPP bits per pixel using
     // the gray-scale image decoding procedure as described in Annex C." (6.6.5)
@@ -73,6 +69,28 @@ pub(crate) fn decode_into(
     Ok(())
 }
 
+/// PdfCraft patch: the work of a halftone region (see `bitmap::MAX_WORK`): a bit plane of the grid
+/// for each bit of a pattern's index, a pattern copied for each cell, and the region itself. One
+/// such segment in a 795-byte PDF took 265 s.
+pub(crate) fn work(header: &HalftoneRegionHeader<'_>, patterns: &PatternDictionary) -> u64 {
+    let grid = &header.grid_position_and_size;
+    let cells = u64::from(grid.width) * u64::from(grid.height);
+    let planes = u64::from(bits_per_pixel(patterns));
+    let copied = copy_work(patterns.pattern_width, patterns.pattern_height);
+    planes
+        .saturating_mul(decode_work(grid.width, grid.height))
+        .saturating_add(cells.saturating_mul(copied))
+        .saturating_add(copy_work(header.region_info.width, header.region_info.height))
+}
+
+/// "3) Set HBPP to ⌈log₂(HNUMPATS)⌉." (6.6.5)
+fn bits_per_pixel(patterns: &PatternDictionary) -> u32 {
+    (patterns.patterns.len() as u32)
+        .saturating_sub(1)
+        .checked_ilog2()
+        .map_or(1, |n| n + 1)
+}
+
 /// Parse a halftone region segment header (7.4.5.1).
 pub(crate) fn parse<'a>(reader: &mut Reader<'a>) -> Result<HalftoneRegionHeader<'a>> {
     let region_info = parse_region_segment_info(reader)?;
@@ -97,8 +115,8 @@ pub(crate) fn parse<'a>(reader: &mut Reader<'a>) -> Result<HalftoneRegionHeader<
     if grid_width > MAX_DIMENSION || grid_height > MAX_DIMENSION {
         bail!(OverflowError::GridDimension);
     }
-    // PdfCraft patch: the product is bounded too (see `bitmap::MAX_PIXELS`).
-    if u64::from(grid_width) * u64::from(grid_height) > crate::bitmap::MAX_PIXELS {
+    // PdfCraft patch: the product is bounded too (see `bitmap::MAX_GRID_CELLS`).
+    if u64::from(grid_width) * u64::from(grid_height) > crate::bitmap::MAX_GRID_CELLS {
         bail!(OverflowError::GridDimension);
     }
 
diff --git a/vendor/hayro-jbig2/src/decode/pattern.rs b/vendor/hayro-jbig2/src/decode/pattern.rs
index 2c15d70b8f..03d4d8eb89 100644
--- a/vendor/hayro-jbig2/src/decode/pattern.rs
+++ b/vendor/hayro-jbig2/src/decode/pattern.rs
@@ -3,15 +3,20 @@
 use super::{AdaptiveTemplatePixel, Template, generic};
 use crate::ScratchBuffers;
 use crate::arithmetic_decoder::{ArithmeticDecoder, ArithmeticDecoderContext};
-use crate::bitmap::{Bitmap, WORD_BITS, Word};
+use crate::bitmap::{Bitmap, WORD_BITS, Word, copy_work};
 use crate::error::{OverflowError, ParseError, Result};
 use crate::reader::Reader;
 use alloc::vec::Vec;
 
+/// PdfCraft patch: the most words of shifted copies a dictionary keeps, 16 MiB, where 256 patterns
+/// of 32 rows take 2 MiB. A 48-byte dictionary of 65,535 such patterns asked for 539 MB.
+const MAX_SHIFTED_WORDS: u64 = 1 << 22;
+
 /// Decode a pattern dictionary segment (7.4.4.2, 6.7).
 pub(crate) fn decode(
     header: &PatternDictionaryHeader<'_>,
     scratch: &mut ScratchBuffers,
+    room: u64,
 ) -> Result<PatternDictionary> {
     let pattern_width = header.pattern_width as u32;
     let pattern_height = header.pattern_height as u32;
@@ -133,7 +138,19 @@ pub(crate) fn decode(
     // for all possible 32-bit alignments, which later on allows us to
     // very easily blit it into the backdrop, significantly speeding up
     // the whole process.
-    let shifted_patterns = if pattern_width <= WORD_BITS && pattern_height <= WORD_BITS {
+    //
+    // PdfCraft patch: only when the table is small, and fits what the page may still hold
+    // (`room`), so that a speed-up never gets an image refused. It can be left out:
+    // `shifted_pattern` then returns `None` and the patterns are combined the slow way.
+    let shifted_words = (patterns.len() as u64)
+        .saturating_mul(32 * 2)
+        .saturating_mul(u64::from(pattern_height));
+    let pattern_words = patterns.iter().map(|p| p.words() as u64).fold(0, u64::saturating_add);
+    let shifted_patterns = if pattern_width <= WORD_BITS
+        && pattern_height <= WORD_BITS
+        && shifted_words <= MAX_SHIFTED_WORDS
+        && shifted_words.saturating_add(pattern_words) <= room
+    {
         let h = pattern_height as usize;
         let mut data = Vec::with_capacity(patterns.len() * 32 * h * 2);
         for pattern in &patterns {
@@ -180,6 +197,11 @@ impl PatternDictionary {
         let start = (pattern_idx * 32 + bit_offset as usize) * len;
         self.shifted_patterns.get(start..start + len)
     }
+
+    /// PdfCraft patch: the words the dictionary holds, its patterns and their shifted copies.
+    pub(crate) fn words(&self) -> usize {
+        self.patterns.iter().map(Bitmap::words).fold(self.shifted_patterns.len(), usize::saturating_add)
+    }
 }
 
 /// Parsed pattern dictionary segment header (7.4.4.1).
@@ -196,6 +218,17 @@ pub(crate) struct PatternDictionaryHeader<'a> {
     pub(crate) data: &'a [u8],
 }
 
+impl PatternDictionaryHeader<'_> {
+    /// PdfCraft patch: the work of decoding the patterns, side by side in one bitmap, and of
+    /// taking each out of it (see `bitmap::MAX_WORK`).
+    pub(crate) fn work(&self) -> u64 {
+        let (width, height) = (u32::from(self.pattern_width), u32::from(self.pattern_height));
+        let patterns = u64::from(self.num_patterns) + 1;
+        let side_by_side = u64::from(height) * (patterns.saturating_mul(u64::from(width)) + 4);
+        side_by_side.saturating_add(patterns.saturating_mul(copy_work(width, height)))
+    }
+}
+
 /// Parse a pattern dictionary segment header (7.4.4.1).
 pub(crate) fn parse<'a>(reader: &mut Reader<'a>) -> Result<PatternDictionaryHeader<'a>> {
     let flags_byte = reader.read_byte().ok_or(ParseError::UnexpectedEof)?;
diff --git a/vendor/hayro-jbig2/src/decode/symbol.rs b/vendor/hayro-jbig2/src/decode/symbol.rs
index f1aa8a6639..b682d4571c 100644
--- a/vendor/hayro-jbig2/src/decode/symbol.rs
+++ b/vendor/hayro-jbig2/src/decode/symbol.rs
@@ -4,7 +4,7 @@ use alloc::vec;
 use alloc::vec::Vec;
 
 use crate::arithmetic_decoder::{ArithmeticDecoder, ArithmeticDecoderContext};
-use crate::bitmap::{Bitmap, WORD_BITS};
+use crate::bitmap::{BITMAP_WORDS, Bitmap, HUFFMAN_LINE_WORK, INTEGER_WORK, WORD_BITS, Word, decode_work};
 use crate::decode::generic::{decode_bitmap_mmr, parse_adaptive_template_pixels};
 use crate::decode::text::{
     DecodeContext, ReferenceCorner, TextRegionContexts, TextRegionFlags, TextRegionHeader,
@@ -45,6 +45,8 @@ pub(crate) fn decode(
     referred_tables: &[HuffmanTable],
     standard_tables: &StandardHuffmanTables,
     input_contexts: Option<&RetainedContexts>,
+    room: u64,
+    work_left: &mut u64,
 ) -> Result<SymbolDictionary> {
     let num_new_symbols = header.num_new_symbols;
 
@@ -58,6 +60,9 @@ pub(crate) fn decode(
         total_width: 0,
         height_class_height: 0,
         pixels: 0,
+        new_words: 0,
+        room,
+        work_left,
         header,
         standard_tables,
     };
@@ -96,6 +101,8 @@ pub(crate) fn decode(
             bail!(SymbolError::Invalid);
         }
         height_classes_left -= 1;
+        // PdfCraft patch: see `bitmap::INTEGER_WORK`. A class of no symbols still reads its delta.
+        *ctx.work_left = ctx.work_left.checked_sub(INTEGER_WORK).ok_or(OverflowError::DecodingWork)?;
         let height_class_delta =
             read_height_class_delta(&mut ctx)?.ok_or(SymbolError::UnexpectedOob)?;
 
@@ -130,6 +137,19 @@ pub(crate) fn decode(
             if ctx.pixels > MAX_DICTIONARY_PIXELS {
                 bail!(OverflowError::BitmapDimension);
             }
+            // PdfCraft patch: see `bitmap::INTEGER_WORK`. Its width, and a stream can hold thousands
+            // of dictionaries of symbols of no pixels. An aggregated one reads its count, a symbol
+            // and two offsets as well.
+            let integers = if ctx.header.flags.use_refagg { 5 } else { 1 };
+            let work = decode_work(symbol_width, ctx.height_class_height).saturating_add(integers * INTEGER_WORK);
+            *ctx.work_left = ctx.work_left.checked_sub(work).ok_or(OverflowError::DecodingWork)?;
+            // PdfCraft patch: see `room`. Rows take a word at least, so symbols of one column
+            // held 270 MiB within the pixel bound, however few the dictionary exported.
+            let rows = u64::from(symbol_width.div_ceil(WORD_BITS)) * u64::from(ctx.height_class_height);
+            ctx.new_words = ctx.new_words.saturating_add(rows).saturating_add(BITMAP_WORDS as u64);
+            if ctx.new_words > ctx.room {
+                bail!(OverflowError::RetainedBitmaps);
+            }
 
             match (ctx.header.flags.use_huffman, ctx.header.flags.use_refagg) {
                 (false, false) => {
@@ -202,6 +222,18 @@ pub(crate) struct SymbolDictionary {
     pub(crate) retained_contexts: Option<RetainedContexts>,
 }
 
+impl SymbolDictionary {
+    /// PdfCraft patch: the words the dictionary holds, its retained contexts included. Those are
+    /// a byte each, and 1.1 MB of dictionaries that retain them, 103 KB behind Flate, held 2.89 GB.
+    pub(crate) fn words(&self) -> usize {
+        let contexts = self.retained_contexts.as_ref().map_or(0, |contexts| {
+            let bytes = contexts.generic_region.len().saturating_add(contexts.refinement_region.len());
+            bytes.saturating_mul(size_of::<ArithmeticDecoderContext>()) / size_of::<Word>()
+        });
+        self.exported_symbols.iter().map(Bitmap::words).fold(contexts, usize::saturating_add)
+    }
+}
+
 /// Decode a symbol bitmap using refinement/aggregate coding (6.5.8.2).
 fn decode_refinement_aggregation_bitmap(
     ctx: &mut SymbolDecodeContext<'_>,
@@ -337,6 +369,11 @@ fn decode_aggregation_bitmap(
 ) -> Result<Bitmap> {
     let use_huffman = ctx.header.flags.use_huffman;
 
+    // PdfCraft patch: see `bitmap::MAX_WORK`. What follows is sized by all the symbols, for each
+    // aggregated symbol, at about 50 ns a symbol: a 713-byte PDF asked for an hour.
+    let work = u64::from(ctx.total_symbols()).saturating_mul(HUFFMAN_LINE_WORK);
+    *ctx.work_left = ctx.work_left.checked_sub(work).ok_or(OverflowError::DecodingWork)?;
+
     // Concatenate input and new symbols.
     let mut all_symbols: Vec<&Bitmap> =
         Vec::with_capacity(ctx.symbols.input.len() + ctx.symbols.new.len());
@@ -422,7 +459,7 @@ fn decode_aggregation_bitmap(
         header.region_info.y_location,
         header.flags.default_pixel,
     )?;
-    decode_with(decode_ctx, &all_symbols, &header, &mut bitmap)?;
+    decode_with(decode_ctx, &all_symbols, &header, &mut bitmap, ctx.work_left)?;
     Ok(bitmap)
 }
 
@@ -463,6 +500,14 @@ struct SymbolDecodeContext<'a> {
     symbols_decoded_count: u32,
     total_width: u32,
     height_class_height: u32,
+    /// PdfCraft patch: the words the page may still hold, which neither the new symbols nor the
+    /// exported ones may pass. They are counted as they are made: counted only once the
+    /// dictionary was stored, 8 MiB symbols exported again and again killed the process.
+    room: u64,
+    /// PdfCraft patch: the words of the new symbols so far (see `room`).
+    new_words: u64,
+    /// PdfCraft patch: the decoding work the stream may still ask for (see `bitmap::MAX_WORK`).
+    work_left: &'a mut u64,
     /// PdfCraft patch: symbol pixels decoded so far (see `MAX_DICTIONARY_PIXELS`).
     pixels: u64,
 }
@@ -612,6 +657,17 @@ fn decode_height_class_collective_bitmap(ctx: &mut SymbolDecodeContext<'_>) -> R
 
     ctx.h_ctx.reader.align();
 
+    // PdfCraft patch: a class of no symbols has nothing to cut out, and `bitmap::decode_work` charges
+    // rows by the symbol, so decoding this would be rows for nothing: 65,535 a class, and a dictionary
+    // can hold a thousand such classes. Its bytes still have to be stepped over.
+    if ctx.symbols_decoded_count == ctx.height_class_first_symbol {
+        ctx.h_ctx
+            .reader
+            .read_bytes(bitmap_size as usize)
+            .ok_or(ParseError::UnexpectedEof)?;
+        return Ok(());
+    }
+
     let collective_bitmap = if bitmap_size == 0 {
         // Bitmap is stored uncompressed, so we basically just copy-paste
         // each byte. Rows are padded to the byte boundary.
@@ -708,6 +764,7 @@ fn export_symbols(ctx: &mut SymbolDecodeContext<'_>) -> Result<Vec<Bitmap>> {
         u32::try_from(value).map_err(|_| HuffmanError::InvalidCode.into())
     };
     let mut exported = Vec::with_capacity(ctx.header.num_exported_symbols as usize);
+    let mut exported_words: u64 = 0;
     let mut index: u32 = 0;
     let mut should_export = false;
     // PdfCraft patch: see `EXTRA_EMPTY_STEPS`.
@@ -718,6 +775,8 @@ fn export_symbols(ctx: &mut SymbolDecodeContext<'_>) -> Result<Vec<Bitmap>> {
             bail!(SymbolError::Invalid);
         }
         runs_left -= 1;
+        // PdfCraft patch: see `bitmap::INTEGER_WORK`. A run of no symbols still reads its length.
+        *ctx.work_left = ctx.work_left.checked_sub(INTEGER_WORK).ok_or(OverflowError::DecodingWork)?;
         let run_length = read_run_length()?;
 
         let end_index = index.checked_add(run_length).ok_or(OverflowError::Index)?;
@@ -730,9 +789,13 @@ fn export_symbols(ctx: &mut SymbolDecodeContext<'_>) -> Result<Vec<Bitmap>> {
                 let symbol = ctx
                     .symbols
                     .get(symbol_idx as usize)
-                    .ok_or(SymbolError::OutOfRange)?
-                    .clone();
-                exported.push(symbol);
+                    .ok_or(SymbolError::OutOfRange)?;
+                // PdfCraft patch: see `room`.
+                exported_words = exported_words.saturating_add(symbol.words() as u64);
+                if exported_words > ctx.room {
+                    bail!(OverflowError::RetainedBitmaps);
+                }
+                exported.push(symbol.clone());
             }
         }
 
@@ -864,3 +927,25 @@ pub(crate) fn parse<'a>(reader: &mut Reader<'a>) -> Result<SymbolDictionaryHeade
         data,
     })
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// A dictionary may export what it refers to, and may refer to one symbol again and again, so
+    /// its exports are counted against what the page may still hold before each is copied.
+    /// Refused only once stored, the copies are already made, which a render test can't see.
+    #[test]
+    fn exported_symbols_are_counted_before_they_are_copied() {
+        // Huffman coding, 1,000 exported and no new symbols; export runs of 0 and 1,000 (B.1).
+        let data = [0x00, 0x01, 0, 0, 0x03, 0xE8, 0, 0, 0, 0, 0x06, 0x02, 0xD8];
+        let header = parse(&mut Reader::new(&data)).unwrap();
+        let symbol = Bitmap::new(32, 32).unwrap();
+        let input = vec![&symbol; 1000];
+        let tables = StandardHuffmanTables::new();
+        let words = symbol.words() as u64 * 1000;
+        let decoded = decode(&header, &input, &[], &tables, None, words, &mut u64::MAX.clone()).unwrap();
+        assert_eq!(decoded.exported_symbols.len(), 1000);
+        assert!(decode(&header, &input, &[], &tables, None, words - 1, &mut u64::MAX.clone()).is_err());
+    }
+}
diff --git a/vendor/hayro-jbig2/src/decode/text.rs b/vendor/hayro-jbig2/src/decode/text.rs
index bbc2ac55c7..5406ffeb46 100644
--- a/vendor/hayro-jbig2/src/decode/text.rs
+++ b/vendor/hayro-jbig2/src/decode/text.rs
@@ -11,7 +11,7 @@ use super::{
 use super::{RegionBitmap, generic_refinement};
 use crate::ScratchBuffers;
 use crate::arithmetic_decoder::{ArithmeticDecoder, ArithmeticDecoderContext};
-use crate::bitmap::Bitmap;
+use crate::bitmap::{Bitmap, INTEGER_WORK, copy_work, decode_work};
 use crate::error::{HuffmanError, OverflowError, ParseError, Result, SymbolError, bail};
 use crate::huffman_table::{HuffmanTable, StandardHuffmanTables, TableLine};
 use crate::integer_decoder::IntegerDecoder;
@@ -25,6 +25,7 @@ pub(crate) fn decode(
     referred_tables: &[HuffmanTable],
     standard_tables: &StandardHuffmanTables,
     scratch: &mut ScratchBuffers,
+    work_left: &mut u64,
 ) -> Result<RegionBitmap> {
     let mut bitmap = Bitmap::new_with(
         header.region_info.width,
@@ -41,6 +42,7 @@ pub(crate) fn decode(
         standard_tables,
         &mut bitmap,
         scratch,
+        work_left,
     )?;
 
     Ok(RegionBitmap {
@@ -56,12 +58,13 @@ pub(crate) fn decode_into(
     standard_tables: &StandardHuffmanTables,
     bitmap: &mut Bitmap,
     scratch: &mut ScratchBuffers,
+    work_left: &mut u64,
 ) -> Result<()> {
     if header.flags.use_huffman {
         let mut reader = Reader::new(header.data);
         let ctx =
             DecodeContext::new_huffman(&mut reader, header, referred_tables, standard_tables)?;
-        decode_with(ctx, symbols, header, bitmap)?;
+        decode_with(ctx, symbols, header, bitmap, work_left)?;
     } else {
         let mut decoder = ArithmeticDecoder::new(header.data);
 
@@ -76,7 +79,7 @@ pub(crate) fn decode_into(
             .resize(num_gr_contexts, ArithmeticDecoderContext::default());
 
         let ctx = DecodeContext::new_arithmetic(&mut decoder, &mut contexts, &mut scratch.contexts);
-        decode_with(ctx, symbols, header, bitmap)?;
+        decode_with(ctx, symbols, header, bitmap, work_left)?;
     }
 
     Ok(())
@@ -88,6 +91,7 @@ pub(crate) fn decode_with(
     symbols: &[&Bitmap],
     header: &TextRegionHeader<'_>,
     region: &mut Bitmap,
+    work_left: &mut u64,
 ) -> Result<()> {
     let strip_size = header.strip_size();
 
@@ -147,7 +151,7 @@ pub(crate) fn decode_with(
             let symbol_id = ctx.read_symbol_id()?;
 
             let symbol_bitmap =
-                decode_symbol_instance_bitmap(&mut ctx, symbols, header, symbol_id)?;
+                decode_symbol_instance_bitmap(&mut ctx, symbols, header, symbol_id, work_left)?;
 
             let symbol_bitmap_ref: &Bitmap = match &symbol_bitmap {
                 SymbolBitmap::Reference(idx) => symbols.get(*idx).ok_or(SymbolError::OutOfRange)?,
@@ -156,6 +160,11 @@ pub(crate) fn decode_with(
             let symbol_width = symbol_bitmap_ref.width as i32;
             let symbol_height = symbol_bitmap_ref.height as i32;
 
+            // PdfCraft patch: see `bitmap::MAX_WORK`. An instance of a large symbol costs its copy,
+            // and 10,000 of one took 64 s. Even one with no pixels reads its four integers.
+            let work = copy_work(symbol_bitmap_ref.width, symbol_bitmap_ref.height).saturating_add(4 * INTEGER_WORK);
+            *work_left = work_left.checked_sub(work).ok_or(OverflowError::DecodingWork)?;
+
             if !header.flags.transposed
                 && (header.flags.reference_corner == ReferenceCorner::TopRight
                     || header.flags.reference_corner == ReferenceCorner::BottomRight)
@@ -173,23 +182,26 @@ pub(crate) fn decode_with(
             }
 
             let symbol_s = current_s;
+            // From the corner a symbol is placed by to its far side. The strip and the offset can
+            // be anywhere an `i32` reaches, and wrapped, the symbol is off the region.
+            let back = |corner: i32, size: i32| corner.wrapping_sub(size).wrapping_add(1);
 
             let (x, y) = if !header.flags.transposed {
                 match header.flags.reference_corner {
                     ReferenceCorner::TopLeft => (symbol_s, symbol_t),
-                    ReferenceCorner::TopRight => (symbol_s - symbol_width + 1, symbol_t),
-                    ReferenceCorner::BottomLeft => (symbol_s, symbol_t - symbol_height + 1),
+                    ReferenceCorner::TopRight => (back(symbol_s, symbol_width), symbol_t),
+                    ReferenceCorner::BottomLeft => (symbol_s, back(symbol_t, symbol_height)),
                     ReferenceCorner::BottomRight => {
-                        (symbol_s - symbol_width + 1, symbol_t - symbol_height + 1)
+                        (back(symbol_s, symbol_width), back(symbol_t, symbol_height))
                     }
                 }
             } else {
                 match header.flags.reference_corner {
                     ReferenceCorner::TopLeft => (symbol_t, symbol_s),
-                    ReferenceCorner::TopRight => (symbol_t - symbol_width + 1, symbol_s),
-                    ReferenceCorner::BottomLeft => (symbol_t, symbol_s - symbol_height + 1),
+                    ReferenceCorner::TopRight => (back(symbol_t, symbol_width), symbol_s),
+                    ReferenceCorner::BottomLeft => (symbol_t, back(symbol_s, symbol_height)),
                     ReferenceCorner::BottomRight => {
-                        (symbol_t - symbol_width + 1, symbol_s - symbol_height + 1)
+                        (back(symbol_t, symbol_width), back(symbol_s, symbol_height))
                     }
                 }
             };
@@ -531,6 +543,7 @@ fn decode_symbol_instance_bitmap(
     symbols: &[&Bitmap],
     header: &TextRegionHeader<'_>,
     symbol_id: usize,
+    work_left: &mut u64,
 ) -> Result<SymbolBitmap> {
     if !header.flags.use_refinement || ctx.read_refinement_flag()? == 0 {
         return Ok(SymbolBitmap::Reference(symbol_id));
@@ -562,6 +575,11 @@ fn decode_symbol_instance_bitmap(
         .checked_add(rdy)
         .ok_or(OverflowError::ReferenceOffset)?;
 
+    // PdfCraft patch: see `bitmap::MAX_WORK`. Before it is decoded: charged after, one instance
+    // could still be 2^28 pixels past what was left. With the four integers that gave its size.
+    let work = decode_work(refined_width, refined_height).saturating_add(4 * INTEGER_WORK);
+    *work_left = work_left.checked_sub(work).ok_or(OverflowError::DecodingWork)?;
+
     let mut refined_bitmap = Bitmap::new(refined_width, refined_height)?;
 
     ctx.decode_refinement_bitmap(
diff --git a/vendor/hayro-jbig2/src/error.rs b/vendor/hayro-jbig2/src/error.rs
index c579368b44..c8bcf8b811 100644
--- a/vendor/hayro-jbig2/src/error.rs
+++ b/vendor/hayro-jbig2/src/error.rs
@@ -133,8 +133,14 @@ pub enum OverflowError {
     ReferenceOffset,
     /// Index computation overflowed.
     Index,
-    /// A symbol dictionary has too many symbols.
+    /// A symbol dictionary has too many symbols, or a segment refers to too many.
     SymbolCount,
+    /// PdfCraft patch: the segments retain more bitmaps than a page may hold.
+    RetainedBitmaps,
+    /// PdfCraft patch: a stream has more segments, or references, than it may.
+    SegmentCount,
+    /// PdfCraft patch: a stream asks for more decoding work than it may.
+    DecodingWork,
 }
 
 impl fmt::Display for DecodeError {
@@ -161,7 +167,10 @@ impl fmt::Display for OverflowError {
             Self::ReferenceOffset => write!(f, "overflow in reference offset computation"),
             Self::Index => write!(f, "overflow in index computation"),
             Self::GridDimension => write!(f, "overflow in grid dimension computation"),
-            Self::SymbolCount => write!(f, "a symbol dictionary has too many symbols"),
+            Self::SymbolCount => write!(f, "too many symbols in a dictionary or referred to"),
+            Self::RetainedBitmaps => write!(f, "the segments retain too many bitmaps"),
+            Self::SegmentCount => write!(f, "too many segments or references in a stream"),
+            Self::DecodingWork => write!(f, "a stream asks for too much decoding work"),
         }
     }
 }
diff --git a/vendor/hayro-jbig2/src/file.rs b/vendor/hayro-jbig2/src/file.rs
index 1440a22efa..5b8bbe983b 100644
--- a/vendor/hayro-jbig2/src/file.rs
+++ b/vendor/hayro-jbig2/src/file.rs
@@ -5,12 +5,39 @@
 
 use alloc::vec::Vec;
 
-use crate::error::{FormatError, ParseError, Result, bail};
+use crate::error::{FormatError, OverflowError, ParseError, Result, bail};
 use crate::reader::Reader;
 use crate::segment::{
     Segment, SegmentType, parse_segment, parse_segment_data, parse_segment_header,
 };
 
+/// PdfCraft patch: the most segments a stream, with its globals, may have. They are all parsed and
+/// sorted before the first is decoded, at about 64 bytes for 11 of input, so behind nested Flate a
+/// 4,765-byte PDF reached 5 GB and failed only afterwards.
+const MAX_SEGMENTS: usize = 1 << 20;
+
+/// PdfCraft patch: the most references those segments may make, 4 bytes each for 1 of input.
+const MAX_REFERENCES: usize = 1 << 22;
+
+/// PdfCraft patch: the segments of a stream so far (see [`MAX_SEGMENTS`], [`MAX_REFERENCES`]).
+#[derive(Default)]
+pub(crate) struct SegmentCount {
+    segments: usize,
+    references: usize,
+}
+
+impl SegmentCount {
+    /// Count one more segment, making `references` references.
+    fn add(&mut self, references: usize) -> Result<()> {
+        self.segments = self.segments.saturating_add(1);
+        self.references = self.references.saturating_add(references);
+        if self.segments > MAX_SEGMENTS || self.references > MAX_REFERENCES {
+            bail!(OverflowError::SegmentCount);
+        }
+        Ok(())
+    }
+}
+
 /// "There are two standalone file organizations possible for a JBIG2 bitstream."
 /// (Annex D)
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
@@ -140,7 +167,9 @@ fn parse_segments<'a>(
     let mut segments = Vec::new();
 
     match organization {
-        FileOrganization::Sequential => parse_segments_sequential(reader, &mut segments)?,
+        FileOrganization::Sequential => {
+            parse_segments_sequential(reader, &mut segments, &mut SegmentCount::default())?;
+        }
         FileOrganization::RandomAccess => parse_segments_random_access(reader, &mut segments)?,
     }
 
@@ -155,6 +184,7 @@ fn parse_segments<'a>(
 pub(crate) fn parse_segments_sequential<'a>(
     reader: &mut Reader<'a>,
     segments: &mut Vec<Segment<'a>>,
+    count: &mut SegmentCount,
 ) -> Result<()> {
     loop {
         if reader.at_end() {
@@ -162,6 +192,7 @@ pub(crate) fn parse_segments_sequential<'a>(
         }
 
         let segment = parse_segment(reader)?;
+        count.add(segment.header.referred_to_segments.len())?;
 
         // "If a file contains an end of file segment, it must be the last segment."
         // (7.4.11)
@@ -187,6 +218,7 @@ fn parse_segments_random_access<'a>(
     segments: &mut Vec<Segment<'a>>,
 ) -> Result<()> {
     let mut headers = Vec::new();
+    let mut count = SegmentCount::default();
 
     loop {
         if reader.at_end() {
@@ -194,6 +226,7 @@ fn parse_segments_random_access<'a>(
         }
 
         let header = parse_segment_header(reader)?;
+        count.add(header.referred_to_segments.len())?;
 
         // "If a file contains an end of file segment, it must be the last segment."
         // (7.4.11)
diff --git a/vendor/hayro-jbig2/src/gray_scale.rs b/vendor/hayro-jbig2/src/gray_scale.rs
index 2836ec77a7..4aa4229a5b 100644
--- a/vendor/hayro-jbig2/src/gray_scale.rs
+++ b/vendor/hayro-jbig2/src/gray_scale.rs
@@ -83,8 +83,8 @@ fn decode_arithmetic(
     if width > MAX_DIMENSION || height > MAX_DIMENSION {
         bail!(OverflowError::BitmapDimension);
     }
-    // PdfCraft patch: the product is bounded too (see `bitmap::MAX_PIXELS`).
-    if u64::from(width) * u64::from(height) > crate::bitmap::MAX_PIXELS {
+    // PdfCraft patch: the product is bounded too (see `bitmap::MAX_GRID_CELLS`).
+    if u64::from(width) * u64::from(height) > crate::bitmap::MAX_GRID_CELLS {
         bail!(OverflowError::BitmapDimension);
     }
 
diff --git a/vendor/hayro-jbig2/src/huffman_table.rs b/vendor/hayro-jbig2/src/huffman_table.rs
index 2183c8eea0..1a20da5281 100644
--- a/vendor/hayro-jbig2/src/huffman_table.rs
+++ b/vendor/hayro-jbig2/src/huffman_table.rs
@@ -14,11 +14,27 @@ include!("huffman_tables_generated.rs");
 /// Maximum number of nodes in an inline Huffman table.
 const INLINE_TABLE_SIZE: usize = 43;
 
+/// PdfCraft patch: the most lines a custom table may have. A line takes 2 bits of input at least
+/// and 8 bytes here, so a table reading 250 MiB behind nested Flate, a 1,297-byte PDF, was killed
+/// at 8 GiB before it could be counted.
+const MAX_TABLE_LINES: usize = 1 << 16;
+
 /// A queryable Huffman table.
 #[derive(Debug, Clone)]
 pub(crate) struct HuffmanTable(Rc<InnerHuffmanTable>);
 
 impl HuffmanTable {
+    /// PdfCraft patch: the words this table holds. Every table takes the room of the inline
+    /// variant, however few nodes it has, and a dynamic one its nodes besides.
+    pub(crate) fn words(&self) -> usize {
+        let nodes = match &*self.0 {
+            InnerHuffmanTable::Inline { .. } => 0,
+            InnerHuffmanTable::Dynamic { nodes } => nodes.len(),
+        };
+        let bytes = nodes.saturating_mul(size_of::<HuffmanNode>());
+        bytes.saturating_add(size_of::<InnerHuffmanTable>()) / size_of::<u32>()
+    }
+
     /// Create a new inline Huffman table from a fixed-size node array.
     fn from_inline(nodes: [HuffmanNode; INLINE_TABLE_SIZE]) -> Self {
         Self(Rc::new(InnerHuffmanTable::Inline { nodes }))
@@ -219,6 +235,9 @@ impl HuffmanTable {
         // 5) "Decode each table line as follows:"
         //    d) "If CURRANGELOW ≥ HTHIGH then proceed to step 6."
         while current_range_low < maximum_value {
+            if lines.len() >= MAX_TABLE_LINES {
+                bail!(HuffmanError::InvalidCode);
+            }
             // a) "Read HTPS bits. Set PREFLEN[NTEMP] to the value decoded."
             let prefix_length = reader
                 .read_bits(prefix_length_bits)
@@ -448,11 +467,11 @@ impl HuffmanNode {
                     // 4) "Otherwise, if table line I is the lower range table line for this
                     //    table, then set: HTVAL = RANGELOW[I] − HTOFFSET"
                     // 5) "Otherwise, set: HTVAL = RANGELOW[I] + HTOFFSET"
-                    // `HTVAL`
+                    // `HTVAL`. Wrapping: a range line's offset can take it past what an `i32` holds.
                     let value = if leaf.is_lower {
-                        leaf.range_low - range_offset
+                        leaf.range_low.wrapping_sub(range_offset)
                     } else {
-                        leaf.range_low + range_offset
+                        leaf.range_low.wrapping_add(range_offset)
                     };
 
                     return Ok(Some(value));
diff --git a/vendor/hayro-jbig2/src/integer_decoder.rs b/vendor/hayro-jbig2/src/integer_decoder.rs
index 8b7656d296..7f9f7831a2 100644
--- a/vendor/hayro-jbig2/src/integer_decoder.rs
+++ b/vendor/hayro-jbig2/src/integer_decoder.rs
@@ -70,7 +70,8 @@ impl IntegerDecoder {
         if s == 0 {
             Some(v as i32)
         } else if v > 0 {
-            Some(-(v as i32))
+            // Wrapping: `V` can be 2^31, whose negative is `i32::MIN`, as the cast already reads it.
+            Some((v as i32).wrapping_neg())
         } else {
             None
         }
diff --git a/vendor/hayro-jbig2/src/lib.rs b/vendor/hayro-jbig2/src/lib.rs
index ad77a6dd17..2ee0f8f050 100644
--- a/vendor/hayro-jbig2/src/lib.rs
+++ b/vendor/hayro-jbig2/src/lib.rs
@@ -75,7 +75,7 @@ pub use error::{
     SegmentError, SymbolError, TemplateError,
 };
 
-use crate::file::parse_segments_sequential;
+use crate::file::{SegmentCount, parse_segments_sequential};
 use bitmap::Bitmap;
 use decode::CombinationOperator;
 use decode::generic;
@@ -120,13 +120,14 @@ impl<'a> Image<'a> {
     /// Annex D.3.
     pub fn new_embedded(data: &'a [u8], globals: Option<&'a [u8]>) -> Result<Self> {
         let mut segments = Vec::new();
+        let mut count = SegmentCount::default();
         if let Some(globals_data) = globals {
             let mut reader = Reader::new(globals_data);
-            parse_segments_sequential(&mut reader, &mut segments)?;
+            parse_segments_sequential(&mut reader, &mut segments, &mut count)?;
         };
 
         let mut reader = Reader::new(data);
-        parse_segments_sequential(&mut reader, &mut segments)?;
+        parse_segments_sequential(&mut reader, &mut segments, &mut count)?;
 
         segments.sort_by_key(|seg| seg.header.segment_number);
 
@@ -162,6 +163,7 @@ impl<'a> Image<'a> {
         if page_info.width == 0 || height == 0 {
             bail!(FormatError::EmptyPage);
         }
+        bitmap::check_page_size(page_info.width, height)?;
 
         Ok(Self {
             segments,
@@ -193,11 +195,37 @@ impl<'a> Image<'a> {
     /// This is useful in case you want to convert multiple JBIG2 images,
     /// as it allows `hayro-jbig2` to reuse allocations during decoding.
     pub fn decode_with<D: Decoder>(&self, decoder: &mut D, ctx: &mut DecoderContext) -> Result<()> {
-        decode_segments(&self.segments, self.height_from_stripes, ctx)?;
+        let mut work_left = bitmap::MAX_WORK;
+        decode_segments(&self.segments, self.height_from_stripes, ctx, &mut work_left)?;
         emit_bitmap(&ctx.page_bitmap, decoder);
 
         Ok(())
     }
+
+    /// PdfCraft patch: [`Image::decode`], spending from `work`, what decoding may still cost
+    /// across a run of images. An image spends what it took, failing or not, starting with its
+    /// page's pixels, which whoever asked for them will go through, and its segments, so images
+    /// that decode nothing add up too. On top of that, it takes at most [`bitmap::MAX_WORK`]
+    /// whatever `work` says. One that `work` can't pay for spends all of it, so a run ends rather
+    /// than trying every image it has left. Reading the stream comes before this and is charged
+    /// by [`charge_reading`].
+    pub fn decode_within<D: Decoder>(&self, decoder: &mut D, work: &mut u64) -> Result<()> {
+        let start = bitmap::decode_work(self.width, self.height).saturating_add(self.segments.len() as u64);
+        if charge_work(work, start).is_err() {
+            *work = 0;
+            bail!(OverflowError::DecodingWork);
+        }
+        let allowed = bitmap::MAX_WORK.min(*work);
+        let mut left = allowed;
+        let mut ctx = DecoderContext::default();
+        let decoded = decode_segments(&self.segments, self.height_from_stripes, &mut ctx, &mut left);
+        let refused = decoded == Err(OverflowError::DecodingWork.into());
+        *work = if refused && allowed < bitmap::MAX_WORK { 0 } else { *work - (allowed - left) };
+        decoded?;
+        emit_bitmap(&ctx.page_bitmap, &mut *decoder);
+
+        Ok(())
+    }
 }
 
 fn emit_bitmap<D: Decoder>(bitmap: &Bitmap, decoder: &mut D) {
@@ -257,10 +285,39 @@ fn emit_bitmap<D: Decoder>(bitmap: &Bitmap, decoder: &mut D) {
     }
 }
 
+/// PdfCraft patch: count `work` more decoding work, refusing past what is `left` of
+/// [`bitmap::MAX_WORK`] or a run's allowance before what asks for it is decoded.
+fn charge_work(left: &mut u64, work: u64) -> Result<()> {
+    *left = left.checked_sub(work).ok_or(OverflowError::DecodingWork)?;
+    Ok(())
+}
+
+/// PdfCraft patch: the steps of reading a byte of a stream or its globals: parsing and sorting
+/// segments, and building their tables, measured at about 3 a byte at the worst.
+const READ_WORK: u64 = 4;
+
+/// PdfCraft patch: charge `work`, what a run of images may still cost, for reading `bytes` of a stream
+/// and its globals. This comes before anything is parsed, as it counts whether or not they turn out
+/// to decode: an image that fails has still cost its reading, and it is read again for each use. What
+/// `work` can't pay for spends all of it.
+pub fn charge_reading(work: &mut u64, bytes: usize) -> Result<()> {
+    if charge_work(work, (bytes as u64).saturating_mul(READ_WORK)).is_err() {
+        *work = 0;
+        bail!(OverflowError::DecodingWork);
+    }
+    Ok(())
+}
+
+/// PdfCraft patch: the work of a region decoded pixel by pixel.
+fn region_work(region: &decode::RegionSegmentInfo) -> u64 {
+    bitmap::decode_work(region.width, region.height)
+}
+
 fn decode_segments(
     segments: &[segment::Segment<'_>],
     height_from_stripes: Option<u32>,
     decoder_ctx: &mut DecoderContext,
+    work_left: &mut u64,
 ) -> Result<()> {
     // Find and parse page information segment first.
     if let Some(page_info) = segments
@@ -293,6 +350,7 @@ fn decode_segments(
             SegmentType::ImmediateGenericRegion | SegmentType::ImmediateLosslessGenericRegion => {
                 let had_unknown_length = seg.header.data_length.is_none();
                 let header = generic::parse(&mut reader, had_unknown_length)?;
+                charge_work(work_left, region_work(&header.region_info))?;
 
                 if page_state.can_decode_directly(page_bitmap, &header.region_info, false) {
                     generic::decode_into(&header, page_bitmap, scratch_buffers)?;
@@ -310,25 +368,22 @@ fn decode_segments(
             SegmentType::IntermediateGenericRegion => {
                 // Intermediate segments cannot have unknown length.
                 let header = generic::parse(&mut reader, false)?;
+                charge_work(work_left, region_work(&header.region_info))?;
                 let region = generic::decode(&header, scratch_buffers)?;
-                page_state.store_region(seg.header.segment_number, region.bitmap);
+                page_state.store_region(seg.header.segment_number, region.bitmap)?;
             }
             SegmentType::PatternDictionary => {
                 let header = pattern::parse(&mut reader)?;
-                let dictionary = pattern::decode(&header, scratch_buffers)?;
-                page_state.store_pattern_dictionary(seg.header.segment_number, dictionary);
+                charge_work(work_left, header.work())?;
+                let dictionary = pattern::decode(&header, scratch_buffers, page_state.retained_room())?;
+                page_state.store_pattern_dictionary(seg.header.segment_number, dictionary)?;
             }
             SegmentType::SymbolDictionary => {
                 // "1) Concatenate all the input symbol dictionaries to form SDINSYMS."
                 // (6.5.5, step 1)
                 // Collect references to avoid cloning; symbols are only cloned if re-exported.
-                let input_symbols: Vec<&Bitmap> = seg
-                    .header
-                    .referred_to_segments
-                    .iter()
-                    .filter_map(|&num| page_state.get_symbol_dictionary(num))
-                    .flat_map(|dict| dict.exported_symbols.iter())
-                    .collect();
+                let input_symbols = page_state.referred_symbols(&seg.header.referred_to_segments)?;
+                charge_work(work_left, input_symbols.len() as u64)?;
 
                 // Collect Huffman tables from referred table segments.
                 let referred_tables: Vec<HuffmanTable> = seg
@@ -354,18 +409,15 @@ fn decode_segments(
                     &referred_tables,
                     &page_state.standard_tables,
                     retained_contexts,
+                    page_state.retained_room(),
+                    work_left,
                 )?;
-                page_state.store_symbol_dictionary(seg.header.segment_number, dictionary);
+                page_state.store_symbol_dictionary(seg.header.segment_number, dictionary)?;
             }
             SegmentType::ImmediateTextRegion | SegmentType::ImmediateLosslessTextRegion => {
                 // Collect symbols from referred symbol dictionaries (SBSYMS).
-                let symbols: Vec<&Bitmap> = seg
-                    .header
-                    .referred_to_segments
-                    .iter()
-                    .filter_map(|&num| page_state.get_symbol_dictionary(num))
-                    .flat_map(|dict| dict.exported_symbols.iter())
-                    .collect();
+                let symbols = page_state.referred_symbols(&seg.header.referred_to_segments)?;
+                charge_work(work_left, symbols.len() as u64)?;
 
                 // Collect Huffman tables from referred table segments.
                 // "These user-supplied Huffman decoding tables may be supplied either
@@ -379,6 +431,11 @@ fn decode_segments(
                     .collect();
 
                 let header = text::parse(&mut reader, symbols.len() as u32)?;
+                charge_work(work_left, bitmap::copy_work(header.region_info.width, header.region_info.height))?;
+                if header.flags.use_huffman {
+                    // Its symbol ID table has a line for each symbol.
+                    charge_work(work_left, (symbols.len() as u64).saturating_mul(bitmap::HUFFMAN_LINE_WORK))?;
+                }
 
                 if page_state.can_decode_directly(
                     page_bitmap,
@@ -392,6 +449,7 @@ fn decode_segments(
                         &page_state.standard_tables,
                         page_bitmap,
                         scratch_buffers,
+                        work_left,
                     )?;
                 } else {
                     let region = text::decode(
@@ -400,6 +458,7 @@ fn decode_segments(
                         &referred_tables,
                         &page_state.standard_tables,
                         scratch_buffers,
+                        work_left,
                     )?;
                     page_bitmap.combine(
                         &region.bitmap,
@@ -412,13 +471,8 @@ fn decode_segments(
             }
             SegmentType::IntermediateTextRegion => {
                 // Collect symbols from referred symbol dictionaries (SBSYMS).
-                let symbols: Vec<&Bitmap> = seg
-                    .header
-                    .referred_to_segments
-                    .iter()
-                    .filter_map(|&num| page_state.get_symbol_dictionary(num))
-                    .flat_map(|dict| dict.exported_symbols.iter())
-                    .collect();
+                let symbols = page_state.referred_symbols(&seg.header.referred_to_segments)?;
+                charge_work(work_left, symbols.len() as u64)?;
 
                 // Collect Huffman tables from referred table segments.
                 let referred_tables: Vec<HuffmanTable> = seg
@@ -430,14 +484,20 @@ fn decode_segments(
                     .collect();
 
                 let header = text::parse(&mut reader, symbols.len() as u32)?;
+                charge_work(work_left, bitmap::copy_work(header.region_info.width, header.region_info.height))?;
+                if header.flags.use_huffman {
+                    // Its symbol ID table has a line for each symbol.
+                    charge_work(work_left, (symbols.len() as u64).saturating_mul(bitmap::HUFFMAN_LINE_WORK))?;
+                }
                 let region = text::decode(
                     &header,
                     &symbols,
                     &referred_tables,
                     &page_state.standard_tables,
                     scratch_buffers,
+                    work_left,
                 )?;
-                page_state.store_region(seg.header.segment_number, region.bitmap);
+                page_state.store_region(seg.header.segment_number, region.bitmap)?;
             }
             SegmentType::ImmediateHalftoneRegion | SegmentType::ImmediateLosslessHalftoneRegion => {
                 let pattern_dict = seg
@@ -448,6 +508,7 @@ fn decode_segments(
                     .ok_or(SegmentError::MissingPatternDictionary)?;
 
                 let header = halftone::parse(&mut reader)?;
+                charge_work(work_left, halftone::work(&header, pattern_dict))?;
 
                 if page_state.can_decode_directly(
                     page_bitmap,
@@ -475,8 +536,9 @@ fn decode_segments(
                     .ok_or(SegmentError::MissingPatternDictionary)?;
 
                 let header = halftone::parse(&mut reader)?;
+                charge_work(work_left, halftone::work(&header, pattern_dict))?;
                 let region = halftone::decode(&header, pattern_dict, scratch_buffers)?;
-                page_state.store_region(seg.header.segment_number, region.bitmap);
+                page_state.store_region(seg.header.segment_number, region.bitmap)?;
             }
             SegmentType::IntermediateGenericRefinementRegion => {
                 // Same logic as immediate refinement, but store result instead of combining.
@@ -488,8 +550,9 @@ fn decode_segments(
                     .unwrap_or(page_bitmap);
 
                 let header = generic_refinement::parse(&mut reader)?;
+                charge_work(work_left, region_work(&header.region_info))?;
                 let region = generic_refinement::decode(&header, reference, scratch_buffers)?;
-                page_state.store_region(seg.header.segment_number, region.bitmap);
+                page_state.store_region(seg.header.segment_number, region.bitmap)?;
             }
             SegmentType::ImmediateGenericRefinementRegion
             | SegmentType::ImmediateLosslessGenericRefinementRegion => {
@@ -505,6 +568,7 @@ fn decode_segments(
                     .and_then(|&num| page_state.get_referred_segment(num));
 
                 let header = generic_refinement::parse(&mut reader)?;
+                charge_work(work_left, region_work(&header.region_info))?;
 
                 if let Some(referred_segment) = referred_segment
                     && page_state.can_decode_directly(page_bitmap, &header.region_info, false)
@@ -532,7 +596,7 @@ fn decode_segments(
                 // "This segment contains data which defines one or more user-supplied
                 // Huffman coding tables." (7.4.13)
                 let table = HuffmanTable::read_custom(&mut reader)?;
-                page_state.store_huffman_table(seg.header.segment_number, table);
+                page_state.store_huffman_table(seg.header.segment_number, table)?;
             }
             SegmentType::EndOfPage | SegmentType::EndOfFile => {
                 break;
@@ -545,6 +609,23 @@ fn decode_segments(
     Ok(())
 }
 
+/// PdfCraft patch: the words a stored item costs in its list, at least, apart from what it holds.
+const ENTRY_WORDS: u64 = 32;
+
+/// PdfCraft patch: the most words a page's segments may hold for later ones, 64 MiB: two square
+/// bitmaps of 16,384 a side (`bitmap::MAX_PIXELS`). Each stored item is bounded on its own, but without a
+/// bound on all of them a stream of a few dozen bytes a segment held 33 MB each (a 16,384-sample
+/// square region of typical rows), and a few kilobytes could exhaust memory. A segment being
+/// decoded takes more for a while, within its own bounds: the page bitmap isn't counted, nor is
+/// what a region or a grid uses until it is stored or freed.
+const MAX_RETAINED_WORDS: u64 =
+    2 * (bitmap::MAX_PIXELS / bitmap::WORD_BITS as u64 + bitmap::BITMAP_WORDS as u64 + ENTRY_WORDS);
+
+/// PdfCraft patch: the most symbols one segment may refer to, 2^20, far beyond the 65,535 a
+/// dictionary may export. References may repeat, so each names the same symbols again: without
+/// this, 65,535 references to one dictionary in a 78 KB stream collected 17 GB of pointers.
+const MAX_REFERRED_SYMBOLS: u64 = 1 << 20;
+
 /// Page-level decoding state for a JBIG2 page.
 #[derive(Default)]
 pub(crate) struct PageState {
@@ -561,6 +642,9 @@ pub(crate) struct PageState {
     /// Decoded Huffman tables from table segments, stored as (`segment_number`, table) pairs.
     /// "Tables – see 7.4.13." (type 53)
     pub(crate) huffman_tables: Vec<(u32, HuffmanTable)>,
+    /// PdfCraft patch: the words the regions, dictionaries and tables above hold, at most
+    /// [`MAX_RETAINED_WORDS`].
+    pub(crate) retained_words: u64,
     /// Standard Huffman tables (`TABLE_A` through `TABLE_O`).
     pub(crate) standard_tables: StandardHuffmanTables,
 }
@@ -573,6 +657,7 @@ impl PageState {
         self.pattern_dictionaries.clear();
         self.symbol_dictionaries.clear();
         self.huffman_tables.clear();
+        self.retained_words = 0;
         // Standard tables are lazily built and reused across images.
     }
 
@@ -610,9 +695,26 @@ impl PageState {
         }
     }
 
+    /// PdfCraft patch: the words the page may still hold for later segments.
+    fn retained_room(&self) -> u64 {
+        MAX_RETAINED_WORDS.saturating_sub(self.retained_words)
+    }
+
+    /// PdfCraft patch: count a stored item holding `words` for later segments, refusing past
+    /// [`MAX_RETAINED_WORDS`].
+    fn retain(&mut self, words: usize) -> Result<()> {
+        self.retained_words = self.retained_words.saturating_add(words as u64).saturating_add(ENTRY_WORDS);
+        if self.retained_words > MAX_RETAINED_WORDS {
+            bail!(OverflowError::RetainedBitmaps);
+        }
+        Ok(())
+    }
+
     /// Store a decoded region for later reference.
-    fn store_region(&mut self, segment_number: u32, region: Bitmap) {
+    fn store_region(&mut self, segment_number: u32, region: Bitmap) -> Result<()> {
+        self.retain(region.words())?;
         self.referred_segments.push((segment_number, region));
+        Ok(())
     }
 
     /// Look up a referred segment by number.
@@ -624,8 +726,10 @@ impl PageState {
     }
 
     /// Store a decoded pattern dictionary for later reference.
-    fn store_pattern_dictionary(&mut self, segment_number: u32, dictionary: PatternDictionary) {
+    fn store_pattern_dictionary(&mut self, segment_number: u32, dictionary: PatternDictionary) -> Result<()> {
+        self.retain(dictionary.words())?;
         self.pattern_dictionaries.push((segment_number, dictionary));
+        Ok(())
     }
 
     /// Look up a pattern dictionary by segment number.
@@ -637,8 +741,23 @@ impl PageState {
     }
 
     /// Store a decoded symbol dictionary for later reference.
-    fn store_symbol_dictionary(&mut self, segment_number: u32, dictionary: SymbolDictionary) {
+    fn store_symbol_dictionary(&mut self, segment_number: u32, dictionary: SymbolDictionary) -> Result<()> {
+        self.retain(dictionary.words())?;
         self.symbol_dictionaries.push((segment_number, dictionary));
+        Ok(())
+    }
+
+    /// PdfCraft patch: the symbols of the dictionaries in `segments`, in order, refusing past
+    /// [`MAX_REFERRED_SYMBOLS`] before anything is collected.
+    fn referred_symbols(&self, segments: &[u32]) -> Result<Vec<&Bitmap>> {
+        let dictionaries = || segments.iter().filter_map(|&num| self.get_symbol_dictionary(num));
+        let count = dictionaries()
+            .map(|dictionary| dictionary.exported_symbols.len() as u64)
+            .fold(0, u64::saturating_add);
+        if count > MAX_REFERRED_SYMBOLS {
+            bail!(OverflowError::SymbolCount);
+        }
+        Ok(dictionaries().flat_map(|dictionary| dictionary.exported_symbols.iter()).collect())
     }
 
     /// Look up a symbol dictionary by segment number.
@@ -650,8 +769,10 @@ impl PageState {
     }
 
     /// Store a decoded Huffman table for later reference.
-    fn store_huffman_table(&mut self, segment_number: u32, table: HuffmanTable) {
+    fn store_huffman_table(&mut self, segment_number: u32, table: HuffmanTable) -> Result<()> {
+        self.retain(table.words())?;
         self.huffman_tables.push((segment_number, table));
+        Ok(())
     }
 
     /// Look up a Huffman table by segment number.
@@ -690,3 +811,51 @@ fn init_page(
 
     Ok(())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// A page past the bounds is refused when the stream is opened, since callers size their
+    /// output from it before decoding starts. 16,384 squared is exactly the bound on pixels.
+    #[test]
+    fn a_page_past_the_bounds_is_refused_when_opened() {
+        let stream = |width: u32, height: u32| {
+            let mut stream = vec![0, 0, 0, 0, 48, 0, 1, 0, 0, 0, 19];
+            stream.extend_from_slice(&width.to_be_bytes());
+            stream.extend_from_slice(&height.to_be_bytes());
+            stream.extend_from_slice(&[0; 11]); // resolution, flags, striping
+            stream
+        };
+        assert!(Image::new_embedded(&stream(16384, 16384), None).is_ok());
+        assert!(Image::new_embedded(&stream(16385, 16384), None).is_err());
+        assert!(Image::new_embedded(&stream(65536, 1), None).is_err(), "too wide, though few pixels");
+        assert!(Image::new_embedded(&stream(1 << 20, 1 << 20), None).is_err());
+    }
+
+    /// A stream and its globals are one stream of segments, so they have one count.
+    #[test]
+    fn the_segments_of_a_stream_and_its_globals_count_together() {
+        let segment: &[u8] = &[0, 0, 0, 0, 62, 0, 1, 0, 0, 0, 0]; // an empty extension
+        let half = segment.repeat(1 << 19);
+        let more = segment.repeat((1 << 19) + 1);
+        let refused = |data: &[u8]| {
+            let error = Image::new_embedded(data, Some(&half)).err().map(|e| e.to_string());
+            error.as_deref() == Some("too many segments or references in a stream")
+        };
+        assert!(!refused(&half), "2^20 segments are allowed");
+        assert!(refused(&more), "one more isn't");
+    }
+
+    /// A dictionary being decoded has what the page may still hold, not all of it: refused only
+    /// once it is stored, its copies would already have been made.
+    #[test]
+    fn the_room_left_shrinks_as_segments_are_stored() {
+        let mut page = PageState::default();
+        assert_eq!(page.retained_room(), MAX_RETAINED_WORDS);
+        page.retain(1000).unwrap();
+        assert_eq!(page.retained_room(), MAX_RETAINED_WORDS - 1000 - ENTRY_WORDS);
+        page.retained_words = MAX_RETAINED_WORDS;
+        assert_eq!(page.retained_room(), 0);
+    }
+}
diff --git a/vendor/hayro-syntax/src/data.rs b/vendor/hayro-syntax/src/data.rs
index 9d5e2030f8..90c44f89c9 100644
--- a/vendor/hayro-syntax/src/data.rs
+++ b/vendor/hayro-syntax/src/data.rs
@@ -1,5 +1,4 @@
 use crate::object::ObjectIdentifier;
-use crate::object::Stream;
 use crate::reader::ReaderContext;
 use crate::sync::HashMap;
 use crate::sync::{Arc, Mutex, MutexExt};
@@ -92,6 +91,12 @@ impl Data {
         &self.data
     }
 
+    /// PdfCraft patch: (hayro-syntax (33)) enter the gate for what an object stream's index depends
+    /// on, once its data is read and [`Self::get_with`] has let go of it.
+    pub(crate) fn enter_loading(&self, id: ObjectIdentifier) -> Option<LoadGuard<'_>> {
+        self.loading.enter(id)
+    }
+
     /// Get access to the data of a decoded object stream.
     pub(crate) fn get_with(&self, id: ObjectIdentifier, ctx: &ReaderContext<'_>) -> Option<&[u8]> {
         // PdfCraft patch: (#307, see vendor/README.md hayro-syntax (10)) register exactly once:
@@ -110,7 +115,8 @@ impl Data {
         let _loading = self.loading.enter(id)?;
         self.decoded
             .get_or_init(idx, || {
-                let stream = ctx.xref().get_with::<Stream<'_>>(id, ctx)?;
+                // PdfCraft patch: (hayro-syntax (33)) only ever an object stream.
+                let stream = ctx.xref().object_stream(id, ctx)?;
                 stream.decoded().ok().map(Cow::into_owned)
             })?
             .as_deref()
@@ -244,7 +250,7 @@ mod tests {
     }
 }
 
-struct LoadGuard<'a>(&'a LoadGate);
+pub(crate) struct LoadGuard<'a>(&'a LoadGate);
 
 impl Drop for LoadGuard<'_> {
     fn drop(&mut self) {
diff --git a/vendor/hayro-syntax/src/filter/jbig2.rs b/vendor/hayro-syntax/src/filter/jbig2.rs
index d87253f536..33a7bc4dd8 100644
--- a/vendor/hayro-syntax/src/filter/jbig2.rs
+++ b/vendor/hayro-syntax/src/filter/jbig2.rs
@@ -1,4 +1,5 @@
 use crate::bit_reader::BitWriter;
+use crate::filter::Filter;
 use crate::object::Dict;
 use crate::object::Stream;
 use crate::object::dict::keys::JBIG2_GLOBALS;
@@ -8,6 +9,65 @@ use alloc::vec;
 use alloc::vec::Vec;
 use core::iter;
 
+/// PdfCraft patch (31): the steps of decoding a page's JBIG2 images may take between them, as many
+/// as one may. Each has its own limit, which doesn't bound a page of many made to reach it. That
+/// is about 6 s to 17 s, inside a render's watchdog; an image of the largest size costs a quarter of
+/// it to decode and a quarter for its page, and ordinary ones are far below that.
+pub const MAX_PAGE_JBIG2_WORK: u64 = 1 << 30;
+
+#[cfg(feature = "std")]
+std::thread_local! {
+    // Unbounded until a page says otherwise: what isn't drawing a page has no page to run out on.
+    static PAGE_WORK_LEFT: core::cell::Cell<u64> = const { core::cell::Cell::new(u64::MAX) };
+}
+
+/// PdfCraft patch (31): what the JBIG2 images decoded next on this thread may take, for a new page.
+#[cfg(feature = "std")]
+pub fn set_page_jbig2_work(work: u64) {
+    PAGE_WORK_LEFT.with(|left| left.set(work));
+}
+
+/// Pays for reading `bytes` of a stream and its globals out of what the page has left, or `None`.
+/// An image that doesn't decode isn't kept, so a page drawing it again and again reads it again.
+#[cfg(feature = "std")]
+fn charge_page_reading(bytes: usize) -> Option<()> {
+    let mut left = PAGE_WORK_LEFT.with(core::cell::Cell::get);
+    let charged = hayro_jbig2::charge_reading(&mut left, bytes);
+    PAGE_WORK_LEFT.with(|cell| cell.set(left));
+    charged.ok()
+}
+
+#[cfg(not(feature = "std"))]
+fn charge_page_reading(_: usize) -> Option<()> {
+    Some(())
+}
+
+/// `image` decoded through `decoder`, spending what the page has left, if there is anything.
+#[cfg(feature = "std")]
+fn decode_for_page<D: hayro_jbig2::Decoder>(image: &hayro_jbig2::Image<'_>, decoder: &mut D) -> Option<()> {
+    let mut left = PAGE_WORK_LEFT.with(core::cell::Cell::get);
+    let decoded = image.decode_within(decoder, &mut left);
+    PAGE_WORK_LEFT.with(|cell| cell.set(left));
+    decoded.ok()
+}
+
+#[cfg(not(feature = "std"))]
+fn decode_for_page<D: hayro_jbig2::Decoder>(image: &hayro_jbig2::Image<'_>, decoder: &mut D) -> Option<()> {
+    image.decode(decoder).ok()
+}
+
+/// PdfCraft patch (31): whether the page has nothing left for another image, which then isn't read
+/// at all.
+#[cfg(feature = "std")]
+pub fn page_jbig2_work_spent() -> bool {
+    PAGE_WORK_LEFT.with(core::cell::Cell::get) == 0
+}
+
+#[cfg(not(feature = "std"))]
+pub fn page_jbig2_work_spent() -> bool {
+    false
+}
+
 /// Decode JBIG2 data from a PDF stream.
 ///
 /// The `params` dictionary may contain a `JBIG2Globals` entry pointing to
@@ -17,10 +77,20 @@ pub(crate) fn decode(
     params: &Dict<'_>,
     image_params: &ImageDecodeParams,
 ) -> Option<FilterResult<'static>> {
+    if page_jbig2_work_spent() {
+        return None;
+    }
+
+    // PdfCraft patch: globals are raw segments, so JBIG2 inside them means nothing, and decoding
+    // it reads its own globals in turn: a chain of 16,000 such streams overflowed the stack, which
+    // aborts the process. Such a stream reads as globals that can't be decoded.
     let globals = params
         .get::<Stream<'_>>(JBIG2_GLOBALS)
+        .filter(|g| !g.filters().iter().any(|f| matches!(f, Filter::Jbig2Decode)))
         .and_then(|g| g.decoded().ok());
 
+    charge_page_reading(data.len().saturating_add(globals.as_deref().map_or(0, <[u8]>::len)))?;
+
     let image = hayro_jbig2::Image::new_embedded(data, globals.as_deref()).ok()?;
 
     // Whenever possible (if we don't have an indexed color space), we convert
@@ -55,7 +125,7 @@ pub(crate) fn decode(
 
         let writer = BitWriter::new(&mut packed, 1)?;
         let mut decoder = BitWriterDecoder { writer };
-        image.decode(&mut decoder).ok()?;
+        decode_for_page(&image, &mut decoder)?;
 
         (packed, 1)
     } else {
@@ -78,7 +148,7 @@ pub(crate) fn decode(
         }
 
         let mut decoder = Luma8Decoder { output: Vec::new() };
-        image.decode(&mut decoder).ok()?;
+        decode_for_page(&image, &mut decoder)?;
 
         (decoder.output, 8)
     };
diff --git a/vendor/hayro-syntax/src/filter/mod.rs b/vendor/hayro-syntax/src/filter/mod.rs
index 06bda29487..e81a37df98 100644
--- a/vendor/hayro-syntax/src/filter/mod.rs
+++ b/vendor/hayro-syntax/src/filter/mod.rs
@@ -9,6 +9,10 @@ mod dct;
 #[cfg(feature = "images")]
 mod jbig2;
 #[cfg(feature = "images")]
+pub use jbig2::{MAX_PAGE_JBIG2_WORK, page_jbig2_work_spent};
+#[cfg(all(feature = "images", feature = "std"))]
+pub use jbig2::set_page_jbig2_work;
+#[cfg(feature = "images")]
 mod jpx;
 mod lzw_flate;
 mod run_length;
diff --git a/vendor/hayro-syntax/src/object/array.rs b/vendor/hayro-syntax/src/object/array.rs
index d39230f7db..fb136e867a 100644
--- a/vendor/hayro-syntax/src/object/array.rs
+++ b/vendor/hayro-syntax/src/object/array.rs
@@ -191,6 +191,12 @@ impl<'a> FlexArrayIter<'a> {
         self.reader.skip_white_spaces_and_comments();
 
         if !self.reader.at_end() {
+            // PdfCraft patch (32): its items each follow a reference. Read as one that might be, a
+            // reference at the start was taken for the whole group, which it can't be, and lost.
+            if T::GROUP {
+                return self.reader.read_with_context::<T>(&self.ctx);
+            }
+
             return match self.reader.read_with_context::<MaybeRef<T>>(&self.ctx)? {
                 MaybeRef::Ref(r) => self.ctx.xref().get_with::<T>(r.into(), &self.ctx),
                 MaybeRef::NotRef(i) => Some(i),
diff --git a/vendor/hayro-syntax/src/object/mod.rs b/vendor/hayro-syntax/src/object/mod.rs
index d692db8b38..6ad97b64e4 100644
--- a/vendor/hayro-syntax/src/object/mod.rs
+++ b/vendor/hayro-syntax/src/object/mod.rs
@@ -32,7 +32,11 @@ pub mod dict;
 pub mod stream;
 
 /// A trait for PDF objects.
-pub(crate) trait ObjectLike<'a>: TryFrom<Object<'a>> + Readable<'a> + Debug + Clone {}
+pub(crate) trait ObjectLike<'a>: TryFrom<Object<'a>> + Readable<'a> + Debug + Clone {
+    /// PdfCraft patch (32): whether this is several items of an array, read one by one (a tuple).
+    /// Such a thing can't itself be given by reference, so one at its start is its first item's.
+    const GROUP: bool = false;
+}
 
 /// A trait for PDF objects that can be borrowed directly from an [`Object`].
 pub(crate) trait ObjectRefLike<'a>: Sized {
diff --git a/vendor/hayro-syntax/src/object/ref.rs b/vendor/hayro-syntax/src/object/ref.rs
index 71951f4d82..3d3cbffbe1 100644
--- a/vendor/hayro-syntax/src/object/ref.rs
+++ b/vendor/hayro-syntax/src/object/ref.rs
@@ -39,10 +39,11 @@ impl From<ObjectIdentifier> for ObjRef {
 
 impl Skippable for ObjRef {
     fn skip(r: &mut Reader<'_>, _: bool) -> Option<()> {
+        // PdfCraft patch: (hayro-syntax (33)) a comment counts as white space, here too.
         r.skip::<i32>(false)?;
-        r.skip_white_spaces();
+        r.skip_white_spaces_and_comments();
         r.skip::<i32>(false)?;
-        r.skip_white_spaces();
+        r.skip_white_spaces_and_comments();
         r.forward_tag(b"R")?;
 
         Some(())
@@ -52,9 +53,9 @@ impl Skippable for ObjRef {
 impl Readable<'_> for ObjRef {
     fn read(r: &mut Reader<'_>, _: &ReaderContext<'_>) -> Option<Self> {
         let obj_ref = r.read_without_context::<i32>()?;
-        r.skip_white_spaces();
+        r.skip_white_spaces_and_comments();
         let gen_num = r.read_without_context::<i32>()?;
-        r.skip_white_spaces();
+        r.skip_white_spaces_and_comments();
         r.forward_tag(b"R")?;
 
         Some(Self::new(obj_ref, gen_num))
diff --git a/vendor/hayro-syntax/src/object/tuple.rs b/vendor/hayro-syntax/src/object/tuple.rs
index 4a7190e916..c76c1b408c 100644
--- a/vendor/hayro-syntax/src/object/tuple.rs
+++ b/vendor/hayro-syntax/src/object/tuple.rs
@@ -39,6 +39,7 @@ where
     T: ObjectLike<'a> + Debug + Clone,
     U: ObjectLike<'a> + Debug + Clone,
 {
+    const GROUP: bool = true;
 }
 
 impl<'a, T, U, V> Readable<'a> for (T, U, V)
@@ -78,6 +79,7 @@ where
     U: ObjectLike<'a> + Debug + Clone,
     V: ObjectLike<'a> + Debug + Clone,
 {
+    const GROUP: bool = true;
 }
 
 impl<'a, T, U, V, W> Readable<'a> for (T, U, V, W)
@@ -122,6 +124,7 @@ where
     V: ObjectLike<'a> + Debug + Clone,
     W: ObjectLike<'a> + Debug + Clone,
 {
+    const GROUP: bool = true;
 }
 
 impl<'a, T, U, V, W, X> Readable<'a> for (T, U, V, W, X)
@@ -171,4 +174,5 @@ where
     W: ObjectLike<'a> + Debug + Clone,
     X: ObjectLike<'a> + Debug + Clone,
 {
+    const GROUP: bool = true;
 }
diff --git a/vendor/hayro-syntax/src/xref.rs b/vendor/hayro-syntax/src/xref.rs
index 745af95556..d3ab7d324f 100644
--- a/vendor/hayro-syntax/src/xref.rs
+++ b/vendor/hayro-syntax/src/xref.rs
@@ -4,6 +4,7 @@ use crate::crypto::{DecryptionError, DecryptionTarget, Decryptor, get};
 use crate::data::Data;
 use crate::metadata::Metadata;
 use crate::object::Name;
+use crate::object::Number;
 use crate::object::ObjectIdentifier;
 use crate::object::Stream;
 use crate::object::dict::keys::{
@@ -12,7 +13,7 @@ use crate::object::dict::keys::{
 };
 use crate::object::dict::{DictCache, probe_dict};
 use crate::object::indirect::IndirectObject;
-use crate::object::{Array, MaybeRef};
+use crate::object::{Array, MaybeRef, ObjRef};
 use crate::object::{DateTime, Dict};
 use crate::object::{Object, ObjectLike};
 use crate::pdf::PdfVersion;
@@ -31,6 +32,17 @@ use core::ops::Deref;
 
 pub(crate) const XREF_ENTRY_LEN: usize = 20;
 
+/// PdfCraft patch: (hayro-syntax (33)) how many references a read follows through objects that hold
+/// nothing else. Past it, as any cycle goes, the object reads as a missing one.
+const MAX_REFERENCE_HOPS: usize = 32;
+
+/// PdfCraft patch: (hayro-syntax (33)) what [`XRef::fetch`] found at an object's place.
+enum Fetched<T> {
+    Object(T),
+    /// All the object holds is a reference to this one.
+    Reference(ObjectIdentifier),
+}
+
 #[derive(Debug, Copy, Clone)]
 pub(crate) enum XRefError {
     Unknown,
@@ -69,6 +81,65 @@ pub(crate) fn fallback(data: PdfData, password: &[u8]) -> Option<XRef> {
     }
 }
 
+/// PdfCraft patch: an `N G obj` header for the repair scan, taking a generation number that
+/// cannot be read as 0.
+///
+/// A generation number is at most 65,535 (ISO 32000-2 §7.5.4), so `3 18446744073709551616 obj` is
+/// malformed and [`ObjectIdentifier::read`] is right to refuse it everywhere else. This scan runs
+/// only when a file's cross-reference table is unusable and its objects are being recovered by
+/// reading the file, where refusing the header drops the object and whatever it holds (#5580).
+/// Before #427 the digits wrapped, and 2^64 wrapped to exactly 0, which is the only reason such a
+/// file used to open.
+///
+/// Only here: reading numbers anywhere else is unchanged.
+fn read_object_header<'a>(r: &mut Reader<'a>, ctx: &ReaderContext<'a>) -> Option<ObjectIdentifier> {
+    let mut strict = r.clone();
+    if let Some(obj_id) = strict.read::<ObjectIdentifier>(ctx) {
+        *r = strict;
+        return Some(obj_id);
+    }
+    // On a clone as well, so a header that isn't one leaves `r` where it was for the caller.
+    let mut lenient = r.clone();
+    let obj_number = lenient.read_without_context::<i32>()?;
+    lenient.skip_white_spaces_and_comments();
+    // Any number at all in the generation position, including one no generation may be.
+    lenient.skip::<Number>(false)?;
+    lenient.skip_white_spaces_and_comments();
+    lenient.forward_tag(b"obj")?;
+    *r = lenient;
+    Some(ObjectIdentifier::new(obj_number, 0))
+}
+
+/// PdfCraft patch: the body of the object at `offset` whose `N G obj` header cannot be read
+/// strictly, for a table rebuilt by scanning the file (#5580). The steps are
+/// `IndirectObject::read`'s, with [`read_object_header`] in place of the strict identifier.
+fn read_repaired_body<'a, T>(
+    data: &'a [u8],
+    offset: usize,
+    id: ObjectIdentifier,
+    ctx: &ReaderContext<'a>,
+) -> Option<T>
+where
+    T: ObjectLike<'a>,
+{
+    let mut r = Reader::new(data);
+    r.jump(offset);
+    // The number is what identifies the object; the generation is what could not be read.
+    if read_object_header(&mut r, ctx)?.obj_number != id.obj_number {
+        return None;
+    }
+    let mut ctx = ctx.clone();
+    if ctx.parent_chain_contains(&id) {
+        warn!("cycle detected in indirect object: {id:?}");
+
+        return None;
+    }
+    ctx.set_obj_number(id);
+    ctx.parent_chain_push(id);
+    r.skip_white_spaces_and_comments();
+    r.read_with_context::<T>(&ctx)
+}
+
 fn fallback_xref_map<'a>(data: &'a PdfData, password: &[u8]) -> (XrefMap, Option<XRefInput<'a>>) {
     fallback_xref_map_inner(data, ReaderContext::dummy(), true, password)
 }
@@ -80,6 +151,10 @@ fn fallback_xref_map_inner<'a>(
     password: &[u8],
 ) -> (XrefMap, Option<XRefInput<'a>>) {
     let mut xref_map = FxHashMap::default();
+    // PdfCraft patch: the generation-0 keys below that stand in for a header with another
+    // generation, so a later header can replace one while a real `N 0 obj` is never displaced
+    // (noted in review of #5580).
+    let mut aliases: rustc_hash::FxHashSet<ObjectIdentifier> = rustc_hash::FxHashSet::default();
     let mut trailer_dicts = vec![];
     let mut root_ref = None;
 
@@ -94,12 +169,32 @@ fn fallback_xref_map_inner<'a>(
 
         // First try to check if we have an object identifier.
         if r.peek_byte().is_some_and(|b: u8| b.is_ascii_digit()) {
-            if let Some(obj_id) = r.read::<ObjectIdentifier>(&dummy_ctx) {
+            if let Some(obj_id) = read_object_header(&mut r, &dummy_ctx) {
                 let mut cloned = r.clone();
                 // Check that the object following it is actually valid before inserting it.
                 cloned.skip_white_spaces_and_comments();
                 if cloned.skip::<Object<'_>>(false).is_some() {
                     xref_map.insert(obj_id, EntryType::Normal(cur_pos));
+                    // PdfCraft patch: also reachable by object number alone, so a reference that
+                    // names a different generation than the header still finds it. A rebuilt
+                    // table has no revision history to tell two generations apart, and a file
+                    // that needs rebuilding references everything as `N 0 R` whatever its headers
+                    // say: `poppler-85140-0.pdf` has one page whose header reads
+                    // `3 18446744073709551616 obj` with a page tree pointing at `3 0 R`, so the
+                    // page was lost and the file did not open at all (#5580). `or_insert`, so a
+                    // real `N 0 obj` is never displaced by this alias.
+                    let by_number = ObjectIdentifier::new(obj_id.obj_number, 0);
+                    if obj_id.gen_number == 0 {
+                        // A real `N 0 obj`: it owns the key from here on, and the last one wins
+                        // as every other entry does.
+                        aliases.remove(&by_number);
+                    } else if !xref_map.contains_key(&by_number) || aliases.contains(&by_number) {
+                        // Stand in for it, and let a later header for the same number replace the
+                        // stand-in -- the exact key moves on, so an alias left behind would send
+                        // `N 0 R` to a body the exact key no longer names (noted in review).
+                        xref_map.insert(by_number, EntryType::Normal(cur_pos));
+                        aliases.insert(by_number);
+                    }
                     last_obj_num = Some(obj_id);
                     dummy_ctx.set_obj_number(obj_id);
                 }
@@ -487,12 +582,24 @@ impl XRef {
                 // Try to yield in the order the objects appeared in the
                 // PDF.
                 elements.sort_by(|e1, e2| e1.1.cmp(&e2.1));
+                // PdfCraft patch: one object per location. A rebuilt table can hold two keys for
+                // one object -- its own generation and the generation-0 stand-in (#5580) -- and
+                // enumeration yielded the object once for each, so a document recovered by
+                // `Pages::new_brute_force` reported the page twice (noted in review). Both keys
+                // stay for lookups; only this walk is deduplicated. The object number is part of
+                // the key: an object stream at (offset, 0) and its first member, also
+                // (offset, 0), are two objects.
+                elements.dedup_by(|a, b| a.1 == b.1 && a.0.obj_number == b.0.obj_number);
 
                 let mut iter = elements.into_iter();
 
                 iter::from_fn(move || {
                     for next in iter.by_ref() {
-                        if let Some(obj) = self.get_with(next.0, &ReaderContext::new(self, false)) {
+                        // PdfCraft patch: (hayro-syntax (33)) an object that only refers to another
+                        // isn't one of its own: followed, that one came out once more for each.
+                        if let Some(Fetched::Object(obj)) =
+                            self.fetch(next.0, &ReaderContext::new(self, false))
+                        {
                             return Some(obj);
                         } else {
                             // Skip invalid objects.
@@ -563,12 +670,48 @@ impl XRef {
     }
 
     /// Return the object with the given identifier.
+    ///
+    /// PdfCraft patch: (hayro-syntax (33)) an object that holds only a reference stands for what
+    /// that names. Read as a number it was the reference's own object number, and as anything else
+    /// it was lost. This is a loop, so a long chain takes no stack.
     #[allow(private_bounds)]
     pub(crate) fn get_with<'a, T>(
         &'a self,
         id: ObjectIdentifier,
         ctx: &ReaderContext<'a>,
     ) -> Option<T>
+    where
+        T: ObjectLike<'a>,
+    {
+        let mut id = id;
+        for _ in 0..=MAX_REFERENCE_HOPS {
+            match self.fetch::<T>(id, ctx)? {
+                Fetched::Object(object) => return Some(object),
+                Fetched::Reference(next) => id = next,
+            }
+        }
+        warn!("references lead on past the limit, or in a cycle: {id:?}");
+
+        None
+    }
+
+    /// PdfCraft patch: (hayro-syntax (33)) the object stream `id`. It has to be a stream stored as
+    /// that object (ISO 32000-2 7.5.7), so this follows no reference: the check of where it is stored
+    /// is of that object, and one reached through a reference could be a stream stored inside
+    /// another.
+    pub(crate) fn object_stream<'a>(
+        &'a self,
+        id: ObjectIdentifier,
+        ctx: &ReaderContext<'a>,
+    ) -> Option<Stream<'a>> {
+        match self.fetch::<Stream<'a>>(id, ctx)? {
+            Fetched::Object(stream) => Some(stream),
+            Fetched::Reference(_) => None,
+        }
+    }
+
+    /// What is stored at the object with the given identifier.
+    fn fetch<'a, T>(&'a self, id: ObjectIdentifier, ctx: &ReaderContext<'a>) -> Option<Fetched<T>>
     where
         T: ObjectLike<'a>,
     {
@@ -597,11 +740,32 @@ impl XRef {
                 ctx.set_in_object_stream(false);
                 r.jump(offset);
 
+                if let Some(next) = held_reference(r.clone(), id) {
+                    return Some(Fetched::Reference(next));
+                }
+
                 if let Some(object) = r.read_with_context::<IndirectObject<T>>(&ctx) {
-                    if object.id() == &id {
-                        return Some(object.get());
+                    // PdfCraft patch: in a table rebuilt by scanning the file, the object number
+                    // is what identifies an object. There is no revision history to tell two
+                    // generations apart, the scan already files objects found in object streams
+                    // under generation 0, and a malformed generation in a header would otherwise
+                    // make the object unreadable through the reference that names it (#5580). A
+                    // table read from the file's own xref keeps the exact match.
+                    if object.id() == &id || (repaired && object.id().obj_number == id.obj_number) {
+                        return Some(Fetched::Object(object.get()));
                     }
                 } else {
+                    // PdfCraft patch: the strict read of the header failed. In a table rebuilt by
+                    // scanning the file that can be a generation number no generation may be --
+                    // `3 18446744073709551616 obj` -- and refusing it loses the object the
+                    // reference names (#5580). The object number still has to be the one asked
+                    // for; only an unreadable generation is tolerated, and only here.
+                    if repaired
+                        && let Some(object) =
+                            read_repaired_body::<T>(repr.data.get().as_ref(), offset, id, &ctx)
+                    {
+                        return Some(Fetched::Object(object));
+                    }
                     // There is a valid object at the offset, it's just not of the type the caller
                     // expected, which is fine.
                     if r.skip::<IndirectObject<Object<'_>>>(false).is_some() {
@@ -622,7 +786,7 @@ impl XRef {
                     self.repair();
 
                     // Now try reading again.
-                    self.get_with::<T>(id, &ctx)
+                    self.fetch::<T>(id, &ctx)
                 }
             }
             EntryType::ObjStream(obj_stram_gen_num, index) => {
@@ -657,11 +821,20 @@ impl XRef {
                     // A stream whose pairs don't parse stays unreadable, as it was.
                     Some(offsets) => offsets?,
                     None => {
-                        let stream = self.get_with::<Stream<'_>>(obj_stream_id, &ctx)?;
+                        // PdfCraft patch: (hayro-syntax (33)) this read can reach another object
+                        // stream, whose `/N` or `/First` can be a member of the next: the gate's
+                        // limit holds here too, or a chain of them ran out of stack. It reads the
+                        // dictionary, which is all it needs: parsing the stream reads `/Length`
+                        // too, a second way to the next stream's index, which doubled at each.
+                        let _loading = repr.data.enter_loading(obj_stream_id)?;
+                        let Fetched::Object(dict) = self.fetch::<Dict<'_>>(obj_stream_id, &ctx)?
+                        else {
+                            return None;
+                        };
                         // `/N` and `/First` may be references that can't be followed while
                         // another stream loads: reading them fails without being remembered.
-                        let num_objects = stream.dict().get::<usize>(N)?;
-                        let first_offset = stream.dict().get::<usize>(FIRST)?;
+                        let num_objects = dict.get::<usize>(N)?;
+                        let first_offset = dict.get::<usize>(FIRST)?;
                         let parsed =
                             read_object_stream_index(num_objects, first_offset, data).map(Arc::new);
                         self.with_object_stream_indexes(|indexes| {
@@ -673,7 +846,12 @@ impl XRef {
                         .unwrap_or(parsed)?
                     }
                 };
-                ObjectStream::with_offsets(data, &ctx, offsets).get(index)
+                let stream = ObjectStream::with_offsets(data, &ctx, offsets);
+                if let Some(next) = stream.reference(index) {
+                    return Some(Fetched::Reference(next));
+                }
+
+                stream.get(index).map(Fetched::Object)
             }
         }
     }
@@ -1232,6 +1410,28 @@ impl<'a> ObjectStream<'a> {
 
         r.read_with_context::<T>(&self.ctx)
     }
+
+    /// PdfCraft patch: (hayro-syntax (33)) what the object at `index` refers to, when a reference is
+    /// all it holds.
+    fn reference(&self, index: u32) -> Option<ObjectIdentifier> {
+        let offset = self.offsets.get(index as usize)?.1;
+        let mut r = Reader::new(self.data);
+        r.jump(offset);
+        r.skip_white_spaces_and_comments();
+
+        Some(r.read_without_context::<ObjRef>()?.into())
+    }
+}
+
+/// PdfCraft patch: (hayro-syntax (33)) what the indirect object `id` at `r` refers to, when a
+/// reference is all it holds.
+fn held_reference(mut r: Reader<'_>, id: ObjectIdentifier) -> Option<ObjectIdentifier> {
+    if r.read_without_context::<ObjectIdentifier>()? != id {
+        return None;
+    }
+    r.skip_white_spaces_and_comments();
+
+    Some(r.read_without_context::<ObjRef>()?.into())
 }
 
 fn parse_metadata(info_dict: &Dict<'_>) -> Metadata {
@@ -1266,6 +1466,203 @@ fn parse_metadata(info_dict: &Dict<'_>) -> Metadata {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::Pdf;
+
+    /// A file with an xref stream: `stored` are objects on their own, as they would follow
+    /// `n 0 obj`, and `packed` says of each object in an object stream which stream and place.
+    fn with_xref_stream(stored: &[(u32, Vec<u8>)], packed: &[(u32, u32, u16)]) -> Vec<u8> {
+        let mut out = b"%PDF-1.7\n".to_vec();
+        let mut offsets = alloc::collections::BTreeMap::new();
+        for (num, body) in stored {
+            offsets.insert(*num, out.len());
+            out.extend_from_slice(alloc::format!("{num} 0 obj ").as_bytes());
+            out.extend_from_slice(body);
+            out.extend_from_slice(b"\nendobj\n");
+        }
+        let last = stored.iter().map(|o| o.0).chain(packed.iter().map(|o| o.0)).max().unwrap_or(0);
+        let (xref, size) = (last + 1, last + 2);
+        let at = out.len();
+        offsets.insert(xref, at);
+        let packed: alloc::collections::BTreeMap<u32, (u32, u16)> = packed.iter().map(|o| (o.0, (o.1, o.2))).collect();
+        let mut rows = Vec::new();
+        for num in 0..size {
+            if let Some(offset) = offsets.get(&num) {
+                rows.push(1);
+                rows.extend_from_slice(&(*offset as u32).to_be_bytes());
+                rows.extend_from_slice(&[0, 0]);
+            } else if let Some((stream, index)) = packed.get(&num) {
+                rows.push(2);
+                rows.extend_from_slice(&stream.to_be_bytes());
+                rows.extend_from_slice(&index.to_be_bytes());
+            } else {
+                rows.extend_from_slice(&[0; 7]);
+            }
+        }
+        out.extend_from_slice(
+            alloc::format!(
+                "{xref} 0 obj << /Type /XRef /Size {size} /W [1 4 2] /Root 1 0 R /Length {} >> stream\n",
+                rows.len()
+            )
+            .as_bytes(),
+        );
+        out.extend_from_slice(&rows);
+        out.extend_from_slice(alloc::format!("\nendstream endobj\nstartxref\n{at}\n%%EOF\n").as_bytes());
+        out
+    }
+
+    /// `/Type /ObjStm` around `members`, each stored at its offset, and `entries` of its own.
+    fn object_stream_of(members: &[(u32, &[u8])], entries: &str) -> Vec<u8> {
+        let (mut head, mut body) = (alloc::string::String::new(), Vec::new());
+        for (num, member) in members {
+            head.push_str(&alloc::format!("{num} {} ", body.len()));
+            body.extend_from_slice(member);
+            body.push(b'\n');
+        }
+        head.push('\n');
+        let dict = alloc::format!(
+            "<< /Type /ObjStm /N {} /First {} /Length {} {entries} >> stream\n",
+            members.len(),
+            head.len(),
+            head.len() + body.len()
+        );
+        let mut out = dict.into_bytes();
+        out.extend_from_slice(head.as_bytes());
+        out.extend_from_slice(&body);
+        out.extend_from_slice(b"\nendstream");
+        out
+    }
+
+    fn page_objects() -> Vec<(u32, Vec<u8>)> {
+        vec![
+            (1, b"<< /Type /Catalog /Pages 2 0 R >>".to_vec()),
+            (2, b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec()),
+            (3, b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 10 10] >>".to_vec()),
+        ]
+    }
+
+    /// An object stream is a stream stored as that object, however many references lead to one.
+    /// Object 10 holds a reference to 11, a stream stored inside object stream 12, and 31 claims to
+    /// be in 10, with 11's `/N`, `/First` or `/Length` being 31: reading it recursed until the
+    /// stack ran out. It reads as missing, and so does a member of such a stream.
+    #[test]
+    fn an_object_stream_isnt_reached_through_a_reference() {
+        for key in ["N", "First", "Length"] {
+            let inner = alloc::format!("<< /Type /ObjStm /{key} 31 0 R >> stream\n31 0 1\n\nendstream");
+            let mut stored = page_objects();
+            stored.push((10, b"11 0 R".to_vec()));
+            stored.push((12, object_stream_of(&[(11, inner.as_bytes())], "")));
+            let pdf = Pdf::new(with_xref_stream(&stored, &[(11, 12, 0), (31, 10, 0)])).unwrap();
+            assert_eq!(pdf.xref().get::<i32>(ObjectIdentifier::new(31, 0)), None, "{key}");
+        }
+        let inner = b"<< /Type /ObjStm /N 1 /First 5 /Length 8 >> stream\n20 0 7\n\nendstream";
+        let mut stored = page_objects();
+        stored.push((10, b"11 0 R".to_vec()));
+        stored.push((12, object_stream_of(&[(11, inner)], "")));
+        let pdf = Pdf::new(with_xref_stream(&stored, &[(11, 12, 0), (20, 10, 0)])).unwrap();
+        assert_eq!(pdf.xref().get::<i32>(ObjectIdentifier::new(20, 0)), None);
+    }
+
+    /// `count` object streams stored as themselves, the `keys` of each a member of the next, or
+    /// with `ring` of the first after the last. Reading the first member reads them all, and it is
+    /// `count + 100` to tell.
+    #[cfg(feature = "std")]
+    fn chain_of_object_streams(count: u32, keys: &[&str], ring: bool) -> Vec<u8> {
+        let mut stored = page_objects();
+        let mut packed = Vec::new();
+        for i in 0..count {
+            let (stream, member) = (100 + 2 * i, 101 + 2 * i);
+            let value = if i == 0 { count + 100 } else { 1 };
+            let data = alloc::format!("{member} 0 \n{value}\n");
+            let (first, length) = (alloc::format!("{}", alloc::format!("{member} 0 \n").len()), alloc::format!("{}", data.len()));
+            let next = match (i + 1 == count, ring) {
+                (true, true) => "101 0 R".into(),
+                (true, false) => "1".into(),
+                _ => alloc::format!("{} 0 R", member + 2),
+            };
+            let entry = |key, own: &'_ str| if keys.contains(&key) { next.clone() } else { own.into() };
+            let (n, first, length): (alloc::string::String, alloc::string::String, alloc::string::String) =
+                (entry("N", "1"), entry("First", &first), entry("Length", &length));
+            let body = alloc::format!("<< /Type /ObjStm /N {n} /First {first} /Length {length} >> stream\n{data}\nendstream");
+            stored.push((stream, body.into_bytes()));
+            packed.push((member, stream, 0));
+        }
+        with_xref_stream(&stored, &packed)
+    }
+
+    /// A chain of object streams, each with a member of the next for its `/N`, `/First` or
+    /// `/Length`, had no limit: one read recursed through all of them, holding a copy of the chain
+    /// at each, and 50,000 ran out of an 8 MiB stack. It stops at the gate's limit, on half the stack
+    /// of a render worker. Past that `/N` and `/First` can't be read, so the member reads as missing,
+    /// and a `/Length` that can't be read falls back on `endstream`, so it reads. A short chain reads.
+    #[cfg(feature = "std")]
+    #[test]
+    fn a_chain_of_object_streams_ends_at_the_limit_of_nested_loads() {
+        for key in ["N", "First", "Length"] {
+            let pdf = chain_of_object_streams(50_000, &[key], false);
+            std::thread::Builder::new()
+                .stack_size(1 << 20)
+                .spawn(move || {
+                    let pdf = Pdf::new(pdf).unwrap();
+                    let read = pdf.xref().get::<i32>(ObjectIdentifier::new(101, 0));
+                    assert_eq!(read, (key == "Length").then_some(50_100), "{key}");
+                })
+                .unwrap()
+                .join()
+                .unwrap();
+        }
+        let pdf = Pdf::new(chain_of_object_streams(10, &["N"], false)).unwrap();
+        assert_eq!(pdf.xref().get::<i32>(ObjectIdentifier::new(101, 0)), Some(110));
+    }
+
+    /// `/Length` and `/N` or `/First` both by reference were two ways to the next stream's index,
+    /// and an index that fails isn't remembered, so the work doubled at each stream: 65 streams, one
+    /// past the limit, in 8 KB, didn't finish, and other threads waited at the gate. The index reads
+    /// the dictionary alone now. Without that this doesn't end, so the time allowed can't fail it.
+    #[cfg(feature = "std")]
+    #[test]
+    fn a_chain_of_object_streams_takes_no_more_work_for_two_ways_on() {
+        for (count, ring) in [(65, false), (20, true), (5_000, false)] {
+            for keys in [&["Length", "N"][..], &["Length", "First"]] {
+                let pdf = chain_of_object_streams(count, keys, ring);
+                let (done, finished) = std::sync::mpsc::channel();
+                std::thread::Builder::new()
+                    .stack_size(1 << 20)
+                    .spawn(move || {
+                        let pdf = Pdf::new(pdf).unwrap();
+                        let _ = pdf.xref().get::<i32>(ObjectIdentifier::new(101, 0));
+                        let _ = done.send(());
+                    })
+                    .unwrap();
+                assert!(finished.recv_timeout(std::time::Duration::from_secs(120)).is_ok(), "{keys:?} of {count}");
+            }
+        }
+    }
+
+    /// Object 5, a member of a real object stream, holds a reference to object 6 stored on its own,
+    /// and 7, stored on its own, to 8, a member: each reads as what it names.
+    #[test]
+    fn a_reference_held_in_either_storage_is_followed() {
+        let mut stored = page_objects();
+        stored.push((6, b"42".to_vec()));
+        stored.push((7, b"8 0 R".to_vec()));
+        stored.push((9, object_stream_of(&[(5, b"6 0 R"), (8, b"43")], "")));
+        let pdf = Pdf::new(with_xref_stream(&stored, &[(5, 9, 0), (8, 9, 1)])).unwrap();
+        assert_eq!(pdf.xref().get::<i32>(ObjectIdentifier::new(5, 0)), Some(42));
+        assert_eq!(pdf.xref().get::<i32>(ObjectIdentifier::new(7, 0)), Some(43));
+    }
+
+    /// With no page tree, every page object is a page, and one that another object only refers to
+    /// is one page, not two.
+    #[test]
+    fn a_page_a_reference_is_held_to_is_found_once() {
+        let mut stored = page_objects();
+        stored[0].1 = b"<< /Type /Catalog /Pages 99 0 R >>".to_vec();
+        stored[2].1 = b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 10 10] /Contents 4 0 R >>".to_vec();
+        stored.push((4, b"<< /Length 0 >> stream\n\nendstream".to_vec()));
+        stored.push((12, b"3 0 R".to_vec()));
+        let pdf = Pdf::new(with_xref_stream(&stored, &[])).unwrap();
+        assert_eq!(pdf.pages().len(), 1);
+    }
 
     // PdfCraft patch tests (ported from craft-libs): xref stream entries are bounded by the
     // decoded data, and the type field is read at its full width.
@@ -1446,6 +1843,18 @@ mod tests {
         }
     }
 
+    #[test]
+    fn an_object_stream_and_its_first_member_are_both_enumerated() {
+        // Both sit at (stream offset, 0) in `objects`' ordering; one object per location must
+        // not cost either of them.
+        let pdf = crate::Pdf::new(object_stream_fixture(false)).unwrap();
+        let objects: Vec<_> = pdf.xref().objects().into_iter().collect();
+        assert!(objects.iter().any(|o| matches!(o, Object::Stream(_))));
+        assert!(objects.iter().any(
+            |o| matches!(o, Object::Dict(d) if d.get::<i32>(b"Marker") == Some(123))
+        ));
+    }
+
     #[test]
     fn recursive_object_stream_locations_fail_without_recursing() {
         let pdf = crate::Pdf::new(object_stream_fixture(true)).unwrap();
diff --git a/vendor/hayro/src/renderer.rs b/vendor/hayro/src/renderer.rs
index ac103fa197..0b9cfe779e 100644
--- a/vendor/hayro/src/renderer.rs
+++ b/vendor/hayro/src/renderer.rs
@@ -401,30 +401,55 @@ fn may_paint_rect(rect: Rect, transform: Affine, width: u16, height: u16) -> boo
     paints_canvas(device, width, height)
 }
 
-/// PdfCraft patch: the whole-pixel device rectangle of a shrunk, axis-aligned image, as
-/// `(width, height, x0, y0)`. `transform` maps source pixels to device pixels and `planned` is the
-/// size [`image_resampling_size`] chose; `None` (draw as before) for rotated, skewed or flipped
-/// images, non-finite geometry, or a snapped size that strays more than a pixel from `planned`
-/// (so the memory budget that size passed still holds).
+/// PdfCraft patch: how far, in device pixels, the terms [`snap_minified_image`] drops may move an
+/// image's far edges: a hundredth of a pixel, which no edge shows. Rounding noise in a turned or
+/// scaled matrix stays far below it.
+const SNAP_SKEW: f64 = 0.01;
+
+/// PdfCraft patch: the whole-pixel device rectangle of a shrunk image whose axes lie along the
+/// device's, as `(width, height, transform)`: the size to shrink it to (along its own axes) and
+/// the transform that draws that raster 1:1, one source-axis step a whole device pixel. Upright,
+/// mirrored and quarter-turned images all qualify, so a page under `/Rotate` (or an image placed
+/// turned) is drawn as sharply as upright (#5530). `transform` maps source pixels to device
+/// pixels and `planned` is the size [`image_resampling_size`] chose; `None` (draw as before) for
+/// skewed or freely rotated images, non-finite geometry, or a snapped size that strays more than
+/// a pixel from `planned` (so the memory budget that size passed still holds). An image counts
+/// as axis-aligned when the terms the snap drops move its far edges by at most [`SNAP_SKEW`]: a
+/// tolerance on the coefficients alone let a slight skew of a very wide image through, though it
+/// moved the far edge by more than a pixel.
 fn snap_minified_image(
     transform: &Affine,
     source: (u32, u32),
     planned: (u32, u32),
-) -> Option<(u32, u32, f64, f64)> {
+) -> Option<(u32, u32, Affine)> {
     let [a, b, c, d, e, f] = transform.as_coeffs();
-    let tiny = 1e-4 * a.abs().max(d.abs());
-    if !(a > 0.0 && d > 0.0 && b.abs() <= tiny && c.abs() <= tiny) {
-        return None;
-    }
+    // The device span of a source edge from `origin` across `side` samples of `scale`, rounded.
     let edge = |origin: f64, scale: f64, side: u32| {
-        let (lo, hi) = (origin.round(), (origin + scale * f64::from(side)).round());
+        let (p, q) = (origin.round(), (origin + scale * f64::from(side)).round());
+        let (lo, hi) = (p.min(q), p.max(q));
         (hi - lo >= 1.0 && lo.abs() < 1e6 && hi.abs() < 1e6).then_some((lo, hi))
     };
-    let (x0, x1) = edge(e, a, source.0)?;
-    let (y0, y1) = edge(f, d, source.1)?;
-    // Bounded by the 1e6 check above, so the casts cannot saturate.
-    let (w, h) = ((x1 - x0) as u32, (y1 - y0) as u32);
-    (w.abs_diff(planned.0) <= 1 && h.abs_diff(planned.1) <= 1).then_some((w, h, x0, y0))
+    // Along an axis drawn backwards (negative scale), the raster starts at the span's far end.
+    let start = |scale: f64, (lo, hi): (f64, f64)| if scale > 0.0 { lo } else { hi };
+    let step = |scale: f64| if scale > 0.0 { 1.0 } else { -1.0 };
+    // How far a dropped term moves the image's far edge: `scale` across `side` source samples.
+    let negligible = |scale: f64, side: u32| (scale * f64::from(side)).abs() <= SNAP_SKEW;
+    let (width, height) = source;
+    // Source x along device x, source y along device y (upright or mirrored), or a quarter turn:
+    // source x along device y, source y along device x.
+    let (w, h, draw) = if negligible(b, width) && negligible(c, height) {
+        let (x, y) = (edge(e, a, source.0)?, edge(f, d, source.1)?);
+        // Bounded by the 1e6 check above, so the casts cannot saturate.
+        let (w, h) = ((x.1 - x.0) as u32, (y.1 - y.0) as u32);
+        (w, h, Affine::new([step(a), 0.0, 0.0, step(d), start(a, x), start(d, y)]))
+    } else if negligible(a, width) && negligible(d, height) {
+        let (x, y) = (edge(e, c, source.1)?, edge(f, b, source.0)?);
+        let (w, h) = ((y.1 - y.0) as u32, (x.1 - x.0) as u32);
+        (w, h, Affine::new([0.0, step(b), step(c), 0.0, start(c, x), start(b, y)]))
+    } else {
+        return None;
+    };
+    (w.abs_diff(planned.0) <= 1 && h.abs_diff(planned.1) <= 1).then_some((w, h, draw))
 }
 
 /// PdfCraft patch (19): what `Renderer::set_paint` found out: the clip path to apply while
@@ -960,10 +985,11 @@ impl Renderer {
         if requested_resize && self.in_type3_glyph && interpolate {
             quality = ImageQuality::High;
         }
-        // PdfCraft patch: an axis-aligned, interpolated image that is shrunk lands on whole device
-        // pixels. It is shrunk once to exactly its snapped device rectangle and drawn 1:1 at the
-        // snapped corner. Otherwise the shrunk raster (rounded up to a whole size) is sampled a
-        // second time at a fractional scale and offset, which blurs scans and photos.
+        // PdfCraft patch: an interpolated image that is shrunk, with its axes along the device's
+        // (upright, mirrored or a quarter turn), lands on whole device pixels. It is shrunk once to
+        // exactly its snapped device rectangle and drawn 1:1 from the snapped corner. Otherwise the
+        // shrunk raster (rounded up to a whole size) is sampled a second time at a fractional scale
+        // and offset, which blurs scans and photos.
         let snapped = if interpolate
             && requested_resize
             && !self.in_type3_glyph
@@ -1122,9 +1148,12 @@ impl Renderer {
             img_height as u16,
             may_have_transparency,
         );
+        // The snapped transform draws the raster 1:1, so it holds only if the shrink produced the
+        // snapped size. A failed resize hands back the source raster: drawn 1:1 it would come out
+        // at its source size, so it keeps the full transform instead.
         let draw_transform = match snapped {
-            Some((_, _, x0, y0)) => Affine::translate((x0, y0)),
-            None => cur_transform * additional_transform,
+            Some((w, h, draw)) if (img_width, img_height) == (w, h) => draw,
+            _ => cur_transform * additional_transform,
         };
         self.draw_pixmap(Arc::new(pixmap), quality, draw_transform);
     }
@@ -2581,3 +2610,28 @@ pub fn tiling_cell_pixels(scale: f32, step: f32, max_pixels: f32) -> (u16, f64)
     // (`exact` is), so the division is too.
     (pixels as u16, pixels / step)
 }
+
+#[cfg(test)]
+mod snap_tests {
+    use super::{snap_minified_image, Affine};
+
+    /// The skew a snap drops is measured as the distance it moves the image's far edge, not as a
+    /// coefficient against the scale: a 40 000 sample wide image skewed by 4e-5 per sample moves
+    /// its far edge 1.6 device pixels, and must keep its full transform (#5640 review).
+    #[test]
+    fn a_skew_that_moves_a_far_edge_is_not_snapped() {
+        let source = (40_000, 400);
+        let planned = (20_000, 200);
+        // Upright, shrunk to half, sheared so the far end sits 1.6 pixels lower: not snapped.
+        let skewed = Affine::new([0.5, 4e-5, 0.0, 0.5, 0.3, 0.3]);
+        assert!(snap_minified_image(&skewed, source, planned).is_none());
+        // A quarter turn with the same stray term along device x: not snapped either.
+        let turned = Affine::new([4e-5, 0.5, -0.5, 0.0, 200.3, 0.3]);
+        assert!(snap_minified_image(&turned, source, (20_000, 200)).is_none());
+        // Rounding noise far below a hundredth of a pixel at the far edge still snaps.
+        let noisy = Affine::new([0.5, 1e-9, 0.0, 0.5, 0.3, 0.3]);
+        assert!(snap_minified_image(&noisy, source, planned).is_some());
+        let turned_noisy = Affine::new([1e-9, 0.5, -0.5, 0.0, 200.3, 0.3]);
+        assert!(snap_minified_image(&turned_noisy, source, (20_000, 200)).is_some());
+    }
+}
diff --git a/xtask/src/gates.rs b/xtask/src/gates.rs
index 0212e165a5..58efe66777 100644
--- a/xtask/src/gates.rs
+++ b/xtask/src/gates.rs
@@ -116,7 +116,7 @@ pub fn ci(_: &[String]) -> anyhow::Result<()> {
         ("i18n-report", Box::new(|| i18n_report(&["--workspace".to_string()]))),
         ("layers", Box::new(|| layers(&[]))),
         ("wasm", Box::new(|| wasm(&[]))),
-        ("assets", Box::new(|| crate::assets::run(&[]))),
+        ("license-check", Box::new(|| crate::license_check::run(&[]))),
         ("deny", Box::new(|| deny(&[]))),
         ("parity", Box::new(|| crate::parity::run(&[]))),
     ];
diff --git a/xtask/src/license_check.rs b/xtask/src/license_check.rs
new file mode 100644
index 0000000000..c845101db6
--- /dev/null
+++ b/xtask/src/license_check.rs
@@ -0,0 +1,471 @@
+//! Offline source-document checks. This does not inspect completed packages or dependencies.
+use std::collections::BTreeSet;
+use std::path::Path;
+
+use anyhow::{Context, Result, bail};
+use serde::Deserialize;
+
+use crate::assets;
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Documents {
+    document: Vec<Document>,
+    bundled: Vec<Bundled>,
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Document {
+    source: String,
+    destination: String,
+    sha256: String,
+    /// Audited identifiers of the full licence texts in this document, not inferred from its contents.
+    #[serde(default)]
+    licences: Vec<String>,
+    #[serde(default)]
+    origin: Option<String>,
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Bundled {
+    #[serde(rename = "crate")]
+    krate: String,
+    path: String,
+    licence: String,
+    documents: Vec<String>,
+}
+
+pub fn run(args: &[String]) -> Result<()> {
+    if !args.is_empty() {
+        bail!("usage: cargo xtask license-check (no downloads or write mode)");
+    }
+    let root = assets::root();
+    // Reuse the existing policy and generated-attribution validator, once.
+    assets::run(&[])?;
+    validate(&root)?;
+    println!("license-check: source documents and licensing metadata are consistent");
+    Ok(())
+}
+
+fn validate(root: &Path) -> Result<()> {
+    let text = std::fs::read_to_string(root.join("LICENSES.toml")).context("reading LICENSES.toml")?;
+    let docs: Documents = toml::from_str(&text).context("parsing LICENSES.toml")?;
+    let attribution = assets::load(root)?;
+    let mut problems = check(root, &docs, &attribution);
+    let ocr_source = std::fs::read_to_string(root.join("crates/ocr/src/lib.rs")).context("reading OCR model filename constants")?;
+    problems.extend(check_required_ocr_metadata(&ocr_source, &attribution)?);
+    if !problems.is_empty() {
+        bail!("source licensing errors:\n{}", problems.join("\n"));
+    }
+    Ok(())
+}
+
+/// Read only the two filename constants consumed by the OCR application. Fail closed if their
+/// declaration format changes; do not guess filenames or add a dependency on the OCR engine.
+fn check_required_ocr_metadata(source: &str, attribution: &assets::Manifest) -> Result<Vec<String>> {
+    let mut problems = Vec::new();
+    for name in ["DETECTION_MODEL", "RECOGNITION_MODEL"] {
+        let prefix = format!("pub const {name}: &str = \"");
+        let declarations: Vec<_> = source.lines().map(str::trim).filter_map(|line| line.strip_prefix(&prefix)).collect();
+        let file = declarations.first().and_then(|value| value.strip_suffix("\";"));
+        let Some(file) = file.filter(|file| declarations.len() == 1 && safe_path(file) && !file.contains('/')) else {
+            bail!(
+                "OCR constant {name}: expected one literal filename declaration in crates/ocr/src/lib.rs; update the source validator if its syntax changed"
+            );
+        };
+        let entries: Vec<_> = attribution.fetched.iter().filter(|f| f.file == file).collect();
+        if entries.is_empty() {
+            problems.push(format!("{file}: required OCR licensing metadata missing from ATTRIBUTION.toml"));
+        } else {
+            if entries.len() != 1 {
+                problems.push(format!("{file}: required OCR licensing metadata must have exactly one entry"));
+            }
+            if entries.iter().any(|f| f.kind != "model") {
+                problems.push(format!("{file}: required OCR licensing metadata must have kind = \"model\""));
+            }
+        }
+    }
+    Ok(problems)
+}
+
+/// The audited bundle inventory currently uses identifiers and flat AND/OR expressions only.
+/// Keep their semantics distinct, and fail closed on mixed operators, grouping or exceptions
+/// rather than introducing a general SPDX parser or flattening an unsupported expression.
+fn licence_coverage(expression: &str, covered: &BTreeSet<&str>) -> Result<bool> {
+    let mut tokens = expression.split_whitespace();
+    let Some(first) = tokens.next().filter(|id| assets::ALLOWED_LICENCES.contains(id)) else {
+        bail!("unsupported bundle licence expression `{expression}`");
+    };
+    let mut ids = vec![first];
+    let mut operator = None;
+    while let Some(op) = tokens.next() {
+        if !matches!(op, "AND" | "OR") || operator.is_some_and(|previous| previous != op) {
+            bail!("unsupported bundle licence expression `{expression}`; audit its applicability before extending the validator");
+        }
+        operator = Some(op);
+        let Some(id) = tokens.next().filter(|id| assets::ALLOWED_LICENCES.contains(id)) else {
+            bail!("unsupported bundle licence expression `{expression}`");
+        };
+        ids.push(id);
+    }
+    Ok(if operator == Some("OR") { ids.iter().any(|id| covered.contains(id)) } else { ids.iter().all(|id| covered.contains(id)) })
+}
+
+// A portable relative path, including on Windows; reject aliases before comparing mappings.
+fn safe_path(s: &str) -> bool {
+    !s.is_empty()
+        && !s.contains(['\\', ':'])
+        && s.split('/').all(|p| {
+            !p.is_empty()
+                && p != "."
+                && p != ".."
+                && !p.ends_with(['.', ' '])
+                && p.chars().all(|c| c.is_ascii_alphanumeric() || matches!(c, '-' | '_' | '.'))
+                && !matches!(
+                    p.split('.').next().unwrap_or_default().to_ascii_uppercase().as_str(),
+                    "CON"
+                        | "PRN"
+                        | "AUX"
+                        | "NUL"
+                        | "COM1"
+                        | "COM2"
+                        | "COM3"
+                        | "COM4"
+                        | "COM5"
+                        | "COM6"
+                        | "COM7"
+                        | "COM8"
+                        | "COM9"
+                        | "LPT1"
+                        | "LPT2"
+                        | "LPT3"
+                        | "LPT4"
+                        | "LPT5"
+                        | "LPT6"
+                        | "LPT7"
+                        | "LPT8"
+                        | "LPT9"
+                )
+        })
+}
+
+fn hash(s: &str) -> bool {
+    s.len() == 64 && s.bytes().all(|b| b.is_ascii_hexdigit())
+}
+
+fn check(root: &Path, docs: &Documents, attribution: &assets::Manifest) -> Vec<String> {
+    let mut problems = Vec::new();
+    let mut sources = BTreeSet::new();
+    let mut destinations = BTreeSet::new();
+    for d in &docs.document {
+        if !safe_path(&d.source) || !safe_path(&d.destination) {
+            problems.push(format!("{}: unsafe document source or destination", d.source));
+            continue;
+        }
+        let new_source = sources.insert(d.source.as_str());
+        let new_destination = destinations.insert(d.destination.to_ascii_lowercase());
+        if !new_source || !new_destination {
+            problems.push(format!("{}: duplicate document source or destination", d.source));
+        }
+        if d.origin.as_ref().is_some_and(|u| !u.starts_with("https://") || u.trim().len() <= 8) {
+            problems.push(format!("{}: invalid document origin", d.source));
+        }
+        let mut identifiers = BTreeSet::new();
+        for id in &d.licences {
+            if !assets::ALLOWED_LICENCES.contains(&id.as_str()) || !identifiers.insert(id.as_str()) {
+                problems.push(format!("{}: invalid or duplicate audited licence identifier `{id}`", d.source));
+            }
+        }
+        let path = root.join(&d.source);
+        // Canonical confinement also catches symlinks escaping the checkout.
+        let confined = root.canonicalize().and_then(|r| path.canonicalize().map(|p| p.starts_with(r))).unwrap_or(false);
+        if !confined || !path.is_file() {
+            problems.push(format!("{}: required document missing or outside checkout", d.source));
+            continue;
+        }
+        match std::fs::read_to_string(&path) {
+            Ok(text) if !text.trim().is_empty() && !text.contains('\0') => {
+                if !hash(&d.sha256) || assets::sha256_hex(text.as_bytes()) != d.sha256 {
+                    problems.push(format!("{}: document hash mismatch; re-audit the source before updating LICENSES.toml", d.source));
+                }
+            }
+            _ => problems.push(format!("{}: required document empty or invalid UTF-8 text", d.source)),
+        }
+    }
+    for destination in &destinations {
+        for (i, _) in destination.match_indices('/') {
+            if destination.get(..i).is_some_and(|prefix| destinations.contains(prefix)) {
+                problems.push(format!("{destination}: document destination conflicts with a parent file"));
+            }
+        }
+    }
+    for required in ["LICENSE-MIT", "LICENSE-APACHE", "NOTICE", "vendor/hayro-interpret/assets/LICENSE_FOXIT"]
+        .into_iter()
+        .chain(attribution.asset.iter().map(|a| a.licence_file.as_str()))
+    {
+        if !sources.contains(required) {
+            problems.push(format!("{required}: required document has no LICENSES.toml mapping"));
+        }
+    }
+    // One mapping per bundled asset, using the existing attribution's licence expression.
+    let mut seen = BTreeSet::new();
+    for b in &docs.bundled {
+        if !seen.insert((b.krate.as_str(), b.path.as_str())) {
+            problems.push(format!("{} {}: duplicate bundled mapping", b.krate, b.path));
+        }
+        if !attribution.bundled.iter().any(|a| a.krate == b.krate && a.path == b.path && a.licence == b.licence) {
+            problems.push(format!("{} {}: bundled mapping disagrees with ATTRIBUTION.toml", b.krate, b.path));
+        }
+        if b.documents.is_empty() || b.documents.iter().any(|d| !sources.contains(d.as_str())) {
+            problems.push(format!("{} {}: bundled licence documents missing", b.krate, b.path));
+        }
+        for document in docs.document.iter().filter(|d| b.documents.contains(&d.source)) {
+            if !document.licences.iter().any(|id| b.licence.split_whitespace().any(|token| token == id)) {
+                problems.push(format!("{} {}: inapplicable mapped document {}", b.krate, b.path, document.source));
+            }
+        }
+        let covered: BTreeSet<_> =
+            docs.document.iter().filter(|d| b.documents.contains(&d.source)).flat_map(|d| d.licences.iter().map(String::as_str)).collect();
+        match licence_coverage(&b.licence, &covered) {
+            Ok(true) => {}
+            Ok(false) => problems
+                .push(format!("{} {}: inapplicable licence documents; mapped audited identifiers do not cover `{}`", b.krate, b.path, b.licence)),
+            Err(error) => problems.push(format!("{} {}: {error}", b.krate, b.path)),
+        }
+    }
+    for b in &attribution.bundled {
+        if !seen.contains(&(b.krate.as_str(), b.path.as_str())) {
+            problems.push(format!("{} {}: bundled asset has no licence document mapping", b.krate, b.path));
+        }
+    }
+    for a in attribution.asset.iter().filter(|a| a.licence_file == "assets/icons/LICENSE-lucide.txt") {
+        if a.licence != "ISC AND MIT" {
+            problems.push(format!("{}: Lucide collection must credit ISC and Feather MIT", a.path));
+        }
+    }
+    check_model_metadata(attribution, &mut problems);
+    problems
+}
+
+fn check_model_metadata(attribution: &assets::Manifest, problems: &mut Vec<String>) {
+    let mut model_paths = BTreeSet::new();
+    for f in attribution.fetched.iter().filter(|f| f.kind == "model") {
+        if [f.title.as_str(), &f.author, &f.source, &f.usage, &f.licence].iter().any(|v| v.trim().is_empty())
+            || !hash(&f.sha256)
+            || !hash(&f.licence_sha256)
+            || !f.url.starts_with("https://")
+            || !f.licence_url.starts_with("https://")
+        {
+            problems.push(format!("{}: incomplete OCR model licensing metadata", f.file));
+        }
+        for path in [f.file.clone(), format!("{}.LICENCE.txt", f.file)] {
+            if !safe_path(&path)
+                || path.contains('/')
+                || path.eq_ignore_ascii_case("ATTRIBUTION.txt")
+                || !model_paths.insert(path.to_ascii_lowercase())
+            {
+                problems.push(format!("{}: duplicate or unsafe OCR model destination", f.file));
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::sync::atomic::{AtomicU64, Ordering};
+
+    fn fixture() -> (std::path::PathBuf, Documents) {
+        static NEXT: AtomicU64 = AtomicU64::new(0);
+        let root = std::env::temp_dir().join(format!("pdfcraft-license-{}-{}", std::process::id(), NEXT.fetch_add(1, Ordering::Relaxed)));
+        std::fs::create_dir_all(&root).unwrap();
+        let document = ["LICENSE-MIT", "LICENSE-APACHE", "NOTICE", "vendor/hayro-interpret/assets/LICENSE_FOXIT"]
+            .into_iter()
+            .map(|p| {
+                let path = root.join(p);
+                std::fs::create_dir_all(path.parent().unwrap()).unwrap();
+                std::fs::write(path, "synthetic licence text\n").unwrap();
+                Document {
+                    source: p.into(),
+                    destination: p.into(),
+                    sha256: assets::sha256_hex(b"synthetic licence text\n"),
+                    licences: match p {
+                        "LICENSE-MIT" => vec!["MIT".into()],
+                        "LICENSE-APACHE" => vec!["Apache-2.0".into()],
+                        _ => vec![],
+                    },
+                    origin: None,
+                }
+            })
+            .collect();
+        (root, Documents { document, bundled: vec![] })
+    }
+
+    #[test]
+    fn missing_license_fails_and_restoring_recovers() {
+        let (root, docs) = fixture();
+        let m = assets::Manifest::default();
+        assert!(check(&root, &docs, &m).is_empty());
+        std::fs::remove_file(root.join("LICENSE-MIT")).unwrap();
+        assert!(check(&root, &docs, &m).iter().any(|p| p.contains("LICENSE-MIT: required document missing")));
+        std::fs::write(root.join("LICENSE-MIT"), "synthetic licence text\n").unwrap();
+        assert!(check(&root, &docs, &m).is_empty());
+        std::fs::remove_dir_all(root).unwrap();
+    }
+
+    #[test]
+    fn empty_invalid_and_changed_documents_fail() {
+        let (root, docs) = fixture();
+        for text in [b" ".as_slice(), b"\xff", b"changed licence", b"text\0"] {
+            std::fs::write(root.join("NOTICE"), text).unwrap();
+            assert!(!check(&root, &docs, &assets::Manifest::default()).is_empty());
+        }
+        std::fs::remove_dir_all(root).unwrap();
+    }
+
+    #[test]
+    fn duplicate_and_unsafe_destinations_fail() {
+        let (root, mut docs) = fixture();
+        for dest in ["license-mit", "../NOTICE", "/NOTICE", "C:/NOTICE", "a\\NOTICE", "a//NOTICE", "CON.txt", "NOTICE."] {
+            docs.document.get_mut(2).unwrap().destination = dest.into();
+            assert!(!check(&root, &docs, &assets::Manifest::default()).is_empty(), "{dest}");
+        }
+        std::fs::remove_dir_all(root).unwrap();
+    }
+
+    #[test]
+    fn removing_required_mapping_fails() {
+        let (root, mut docs) = fixture();
+        docs.document.retain(|d| d.source != "LICENSE-MIT");
+        assert!(check(&root, &docs, &assets::Manifest::default()).iter().any(|p| p.contains("LICENSE-MIT: required document has no")));
+        std::fs::remove_dir_all(root).unwrap();
+    }
+
+    #[test]
+    fn bundled_documents_must_match_attribution() {
+        let (root, mut docs) = fixture();
+        let mut m = assets::Manifest::default();
+        m.bundled.push(assets::Bundled {
+            krate: "synthetic".into(),
+            version: "1.0.0".into(),
+            path: "font.ttf".into(),
+            title: "test".into(),
+            author: "test".into(),
+            source: "https://example.org".into(),
+            licence: "MIT".into(),
+            kind: "font".into(),
+            usage: "test".into(),
+            sha256: "a".repeat(64),
+            adobe_data: false,
+        });
+        assert!(check(&root, &docs, &m).iter().any(|p| p.contains("no licence document mapping")));
+        docs.bundled.push(Bundled {
+            krate: "synthetic".into(),
+            path: "font.ttf".into(),
+            licence: "MIT".into(),
+            documents: vec!["LICENSE-MIT".into()],
+        });
+        assert!(check(&root, &docs, &m).is_empty());
+        docs.bundled.get_mut(0).unwrap().documents = vec!["LICENSE-APACHE".into()];
+        assert!(check(&root, &docs, &m).iter().any(|p| p.contains("inapplicable")));
+        docs.bundled.get_mut(0).unwrap().documents = vec!["LICENSE-MIT".into(), "LICENSE-APACHE".into()];
+        assert!(check(&root, &docs, &m).iter().any(|p| p.contains("inapplicable mapped document")));
+        docs.bundled.get_mut(0).unwrap().documents = vec!["LICENSE-MIT".into()];
+        docs.bundled.get_mut(0).unwrap().licence = "ISC".into();
+        assert!(check(&root, &docs, &m).iter().any(|p| p.contains("disagrees")));
+        docs.bundled.get_mut(0).unwrap().documents.clear();
+        assert!(check(&root, &docs, &m).iter().any(|p| p.contains("documents missing")));
+        std::fs::remove_dir_all(root).unwrap();
+    }
+
+    #[test]
+    fn ocr_metadata_and_destinations_are_checked_without_models() {
+        let (root, docs) = fixture();
+        let mut m = assets::Manifest::default();
+        m.fetched.push(assets::Fetched {
+            file: "synthetic.rten".into(),
+            url: "https://example.org/model".into(),
+            title: "test model".into(),
+            author: "test".into(),
+            source: "https://example.org/card".into(),
+            licence: "CC-BY-SA-4.0".into(),
+            licence_url: "https://example.org/licence".into(),
+            licence_sha256: "a".repeat(64),
+            kind: "model".into(),
+            usage: "test".into(),
+            sha256: "b".repeat(64),
+        });
+        assert!(check(&root, &docs, &m).is_empty());
+        m.fetched.get_mut(0).unwrap().licence_sha256 = "z".repeat(64);
+        assert!(check(&root, &docs, &m).iter().any(|p| p.contains("incomplete OCR")));
+        m.fetched.get_mut(0).unwrap().file = "../outside.rten".into();
+        assert!(check(&root, &docs, &m).iter().any(|p| p.contains("unsafe OCR")));
+        std::fs::remove_dir_all(root).unwrap();
+    }
+
+    #[test]
+    fn required_ocr_models_cannot_be_missing() {
+        let source = include_str!("../../crates/ocr/src/lib.rs");
+        let original = assets::load(&assets::root()).unwrap();
+        assert_eq!(original.fetched.iter().filter(|f| f.kind == "model").count(), 2);
+        assert!(check_required_ocr_metadata(source, &original).unwrap().is_empty());
+        for model in original.fetched.iter().filter(|f| f.kind == "model") {
+            let mut m = assets::load(&assets::root()).unwrap();
+            m.fetched.retain(|f| f.file != model.file);
+            assert!(check_required_ocr_metadata(source, &m).unwrap().iter().any(|p| p.contains(&model.file) && p.contains("missing")));
+        }
+    }
+
+    #[test]
+    fn required_ocr_models_cannot_be_misclassified() {
+        let source = include_str!("../../crates/ocr/src/lib.rs");
+        let original = assets::load(&assets::root()).unwrap();
+        assert_eq!(original.fetched.iter().filter(|f| f.kind == "model").count(), 2);
+        for model in original.fetched.iter().filter(|f| f.kind == "model") {
+            let mut m = assets::load(&assets::root()).unwrap();
+            m.fetched.iter_mut().find(|f| f.file == model.file).unwrap().kind = "font".into();
+            assert!(check_required_ocr_metadata(source, &m).unwrap().iter().any(|p| p.contains(&model.file) && p.contains("kind")));
+        }
+    }
+
+    #[test]
+    fn licence_alternatives_and_combined_obligations_are_distinct() {
+        let mit = BTreeSet::from(["MIT"]);
+        assert!(licence_coverage("MIT OR Apache-2.0", &mit).unwrap());
+        assert!(!licence_coverage("MIT AND Apache-2.0", &mit).unwrap());
+        let both = BTreeSet::from(["MIT", "Bitstream-Vera"]);
+        assert!(licence_coverage("MIT AND Bitstream-Vera", &both).unwrap());
+        assert!(!licence_coverage("MIT OR Apache-2.0", &BTreeSet::from(["OFL-1.1"])).unwrap());
+        for expression in ["", "MIT AND", "MIT OR Apache-2.0 AND ISC", "(MIT OR Apache-2.0)", "MIT WITH exception"] {
+            assert!(licence_coverage(expression, &both).is_err(), "{expression}");
+        }
+    }
+
+    #[test]
+    fn changed_ocr_constant_syntax_fails_closed() {
+        assert!(check_required_ocr_metadata("", &assets::Manifest::default()).is_err());
+    }
+
+    #[test]
+    fn parent_file_destination_conflicts_fail() {
+        let (root, mut docs) = fixture();
+        docs.document.get_mut(2).unwrap().destination = "LICENSE-MIT/NOTICE".into();
+        assert!(check(&root, &docs, &assets::Manifest::default()).iter().any(|p| p.contains("parent file")));
+        std::fs::remove_dir_all(root).unwrap();
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn symlink_escape_fails() {
+        let (root, docs) = fixture();
+        let outside = root.with_extension("outside");
+        std::fs::write(&outside, "synthetic licence text\n").unwrap();
+        std::fs::remove_file(root.join("LICENSE-MIT")).unwrap();
+        std::os::unix::fs::symlink(&outside, root.join("LICENSE-MIT")).unwrap();
+        assert!(check(&root, &docs, &assets::Manifest::default()).iter().any(|p| p.contains("outside checkout")));
+        std::fs::remove_dir_all(root).unwrap();
+        std::fs::remove_file(outside).unwrap();
+    }
+}
diff --git a/xtask/src/main.rs b/xtask/src/main.rs
index 24ddd16d16..8e3255d5e6 100644
--- a/xtask/src/main.rs
+++ b/xtask/src/main.rs
@@ -8,6 +8,7 @@ mod demo_pdf;
 mod fuzz;
 mod gates;
 mod layers;
+mod license_check;
 mod macos_integration;
 mod parity;
 mod screenshots;
@@ -23,11 +24,12 @@ const COMMANDS: &[(&str, &str, Command)] = &[
     ("deny", "Dependency licences, bans, sources and advisories (deny.toml; needs cargo-deny)", gates::deny),
     (
         "ci",
-        "fmt --check, clippy -D warnings, the CLI without default features, test, i18n-report, layers, wasm, assets, deny, parity (stops at first failure)",
+        "fmt --check, clippy -D warnings, the CLI without default features, test, i18n-report, layers, wasm, license-check, deny, parity (stops at first failure)",
         gates::ci,
     ),
     ("test", "Workspace tests: cargo nextest (cargo test when it is missing), then doctests", gates::test),
     ("i18n-report", "Print the strings each interface language lacks (counts and a few keys); never fails", gates::i18n_report),
+    ("license-check", "Offline source licence documents, attribution and metadata", license_check::run),
     ("assets", "Enforce the asset policy (AGENTS.md §1) against ATTRIBUTION.toml; --write regenerates ATTRIBUTION.md", assets::run),
     ("corpus", "Fetch the pinned pdf.js test corpus into corpus/ (git-ignored) and verify it; --update-pin re-records the pin", gates::corpus),
     ("check", "Robustness sweep over corpus/ with pdfcraft-cli; fails on crashes or regressions vs xtask/baselines", gates::check),